@ikarmic/forge-core 4.5.0 → 5.1.0

package/dist/policy/ca-certs.js

@@ -0,0 +1,30 @@
+/**
+ * Extra certificate authorities for company networks that inspect TLS with their own root. Node reads
+ * `NODE_EXTRA_CA_CERTS` only at process start, which an editor extension cannot set, so the files are read here
+ * and handed to the HTTP dispatcher (see installProxy).
+ */
+import { readFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+export function readCaCertificates(files, opts = {}) {
+    const home = opts.home ?? os.homedir();
+    const pems = [];
+    const warnings = [];
+    for (const raw of files) {
+        const file = raw.trim();
+        if (!file)
+            continue;
+        const resolved = file === '~' || file.startsWith('~/') || file.startsWith('~\\') ? path.join(home, file.slice(1)) : file;
+        try {
+            const text = readFileSync(resolved, 'utf8');
+            if (/-----BEGIN CERTIFICATE-----/.test(text))
+                pems.push(text);
+            else
+                warnings.push(`${file}: no PEM certificate found; ignored`);
+        }
+        catch (err) {
+            warnings.push(`${file}: ${err.message}; ignored`);
+        }
+    }
+    return { pems, warnings };
+}

package/dist/policy/policy.d.ts

@@ -106,4 +106,3 @@ export declare function filterMcpServers<T>(servers: Record<string, T>, policy:
 /** Return `config` with the policy applied (a new object; the input is not mutated). */
 export declare function applyPolicy(config: AgentConfig, policy: OrgPolicy | undefined): AgentConfig;
 export {};
-//# sourceMappingURL=policy.d.ts.map

package/dist/policy/policy.js

@@ -124,4 +124,3 @@ export function applyPolicy(config, policy) {
     }
     return out;
 }
-//# sourceMappingURL=policy.js.map

package/dist/policy/proxy.d.ts

@@ -14,8 +14,14 @@ export interface ProxySettings {
 export declare function proxyFromEnv(env?: NodeJS.ProcessEnv): ProxySettings;
 export declare function hasProxy(p: ProxySettings): boolean;
 /**
- * Route all `fetch` traffic through the proxy in `settings` (default: the environment).
- * Idempotent. Returns whether a proxy was installed.
+ * A fetch that goes through the dispatcher installed by {@link installProxy} (the proxy and the extra CA roots), or
+ * undefined when none is installed. Needed because a host can replace the global `fetch` with one that ignores the
+ * global dispatcher: VS Code does in its extension host. Calls that must honour the proxy and the roots pass this one
+ * explicitly instead of relying on the global.
  */
-export declare function installProxy(settings?: ProxySettings): Promise<boolean>;
-//# sourceMappingURL=proxy.d.ts.map
+export declare function installedFetch(): typeof fetch | undefined;
+/**
+ * Route all `fetch` traffic through the proxy in `settings` (default: the environment) and trust `extraCa`
+ * (PEM text) on top of the built-in roots. Idempotent. Returns whether anything was installed.
+ */
+export declare function installProxy(settings?: ProxySettings, extraCa?: readonly string[]): Promise<boolean>;

package/dist/policy/proxy.js

@@ -5,6 +5,8 @@
  * well-known global symbol, so installing it from the npm `undici` package also
  * routes Node's bundled fetch.
  */
+import https from 'node:https';
+import { rootCertificates } from 'node:tls';
 /** Proxy settings from the standard environment variables (either case). */
 export function proxyFromEnv(env = process.env) {
     const pick = (a, b) => env[a] || env[b] || undefined;
@@ -17,15 +19,40 @@ export function hasProxy(p) {
     return Boolean(p.https || p.http);
 }
 let installed = false;
+let installedFetchFn;
 /**
- * Route all `fetch` traffic through the proxy in `settings` (default: the environment).
- * Idempotent. Returns whether a proxy was installed.
+ * A fetch that goes through the dispatcher installed by {@link installProxy} (the proxy and the extra CA roots), or
+ * undefined when none is installed. Needed because a host can replace the global `fetch` with one that ignores the
+ * global dispatcher: VS Code does in its extension host. Calls that must honour the proxy and the roots pass this one
+ * explicitly instead of relying on the global.
  */
-export async function installProxy(settings = proxyFromEnv()) {
-    if (installed || !hasProxy(settings))
+export function installedFetch() {
+    return installedFetchFn;
+}
+/**
+ * Route all `fetch` traffic through the proxy in `settings` (default: the environment) and trust `extraCa`
+ * (PEM text) on top of the built-in roots. Idempotent. Returns whether anything was installed.
+ */
+export async function installProxy(settings = proxyFromEnv(), extraCa = []) {
+    if (installed || (!hasProxy(settings) && extraCa.length === 0))
         return false;
-    const { EnvHttpProxyAgent, setGlobalDispatcher } = await import('undici');
-    setGlobalDispatcher(new EnvHttpProxyAgent({
+    const { Agent, EnvHttpProxyAgent, fetch: undiciFetch, setGlobalDispatcher } = await import('undici');
+    const useDispatcher = (dispatcher) => {
+        setGlobalDispatcher(dispatcher);
+        installedFetchFn = ((input, init) => undiciFetch(input, { ...init, dispatcher }));
+    };
+    const tls = extraCa.length > 0 ? { ca: [...rootCertificates, ...extraCa] } : undefined;
+    // Not everything goes through undici: VS Code replaces the extension host's fetch with one built on node:https, which
+    // reads the global agent. Trust the roots there too.
+    if (tls)
+        https.globalAgent.options.ca = tls.ca;
+    if (!hasProxy(settings)) {
+        useDispatcher(new Agent({ connect: tls }));
+        installed = true;
+        return true;
+    }
+    useDispatcher(new EnvHttpProxyAgent({
+        ...(tls ? { requestTls: tls, proxyTls: tls } : {}),
         // Plain-http targets are forwarded as absolute-URI requests (the classic proxy protocol);
         // https targets always use CONNECT tunnels.
         proxyTunnel: false,
@@ -36,4 +63,3 @@ export async function installProxy(settings = proxyFromEnv()) {
     installed = true;
     return true;
 }
-//# sourceMappingURL=proxy.js.map

package/dist/pricing.d.ts

@@ -70,4 +70,3 @@ export declare function costFor(model: ModelConfig | string, tokens: {
  * `--list-models` enrichment and for tests.
  */
 export declare function knownModelIds(provider?: ProviderName): string[];
-//# sourceMappingURL=pricing.d.ts.map

package/dist/pricing.js

@@ -1,3 +1,4 @@
+import { overrideCost } from './model-overrides.js';
 /**
  * Pricing table. Keys are matched with case-insensitive substring matching
  * against the model id (after stripping any "models/" / "claude-" /
@@ -99,6 +100,9 @@ export function lookupPricing(model, override) {
     const cache = typeof model === 'string' ? {} : cacheMultipliersFor(model);
     if (override)
         return { ...cache, ...override, known: true };
+    const configured = overrideCost(model);
+    if (configured)
+        return { ...cache, ...configured, known: true };
     const id = (typeof model === 'string' ? model : model.model).toLowerCase();
     // Strip only the OpenRouter-style 'models/' prefix so 'models/gemini-1.5-pro'
     // resolves the same way as 'gemini-1.5-pro'. We do NOT strip provider prefixes
@@ -187,4 +191,3 @@ export function knownModelIds(provider) {
     const hints = prefixHints[provider];
     return ids.filter((id) => hints.some((h) => id.includes(h)));
 }
-//# sourceMappingURL=pricing.js.map

package/dist/providers.d.ts

@@ -1,4 +1,5 @@
 import type { LanguageModel } from 'ai';
+import type { ProviderEndpoint } from './custom-providers.js';
 import type { ModelConfig, ProviderName } from './types.js';
 /**
  * Build a Vercel AI SDK `LanguageModel` from a `ModelConfig`.
@@ -14,6 +15,12 @@ import type { ModelConfig, ProviderName } from './types.js';
  * dependency footprint small (no separate `ollama-ai-provider` or
  * `openrouter-ai-provider` packages).
  */
+/**
+ * A model on a named provider: the OpenAI chat protocol (default) or the Anthropic message protocol, at the
+ * endpoint's URL with its key and headers. `timeoutMs` and `chunkTimeoutMs` wrap the HTTP calls.
+ * `fetchImpl` exists for tests.
+ */
+export declare function createEndpointModel(endpoint: ProviderEndpoint, model: string, fetchImpl?: typeof fetch): LanguageModel;
 export declare function createLanguageModel(config: ModelConfig): LanguageModel;
 /**
  * Resolve a model from the environment when no config is supplied. Throws a
@@ -34,4 +41,3 @@ export declare function pickAvailableProvider(env?: NodeJS.ProcessEnv, disabled?
  * Pretty-print a model identifier for display (e.g. "anthropic/claude-sonnet-4-5").
  */
 export declare function formatModelId(config: ModelConfig): string;
-//# sourceMappingURL=providers.d.ts.map

package/dist/providers.js

@@ -1,7 +1,10 @@
 import { anthropic } from '@ai-sdk/anthropic';
-import { google } from '@ai-sdk/google';
+import { createGoogleGenerativeAI, google } from '@ai-sdk/google';
+import { createAnthropic } from '@ai-sdk/anthropic';
 import { createOpenAI, openai } from '@ai-sdk/openai';
 import { defaultModelFor, hasProviderKey } from './config.js';
+import { installedFetch } from './policy/proxy.js';
+import { withTimeouts } from './timed-fetch.js';
 import { lazyLanguageModel } from './lazy-model.js';
 /**
  * Default Ollama base URL. Ollama serves an OpenAI-compatible API at
@@ -33,25 +36,51 @@ const MINIMAX_BASE_URL = 'https://api.minimax.io/v1';
  * dependency footprint small (no separate `ollama-ai-provider` or
  * `openrouter-ai-provider` packages).
  */
+/**
+ * A model on a named provider: the OpenAI chat protocol (default) or the Anthropic message protocol, at the
+ * endpoint's URL with its key and headers. `timeoutMs` and `chunkTimeoutMs` wrap the HTTP calls.
+ * `fetchImpl` exists for tests.
+ */
+export function createEndpointModel(endpoint, model, fetchImpl = installedFetch() ?? fetch) {
+    const timed = withTimeouts(fetchImpl, { ...(endpoint.timeoutMs ? { timeoutMs: endpoint.timeoutMs } : {}), ...(endpoint.chunkTimeoutMs ? { chunkTimeoutMs: endpoint.chunkTimeoutMs } : {}) });
+    const common = {
+        baseURL: endpoint.baseUrl,
+        ...(endpoint.headers ? { headers: endpoint.headers } : {}),
+        fetch: timed,
+    };
+    if (endpoint.api === 'anthropic')
+        return createAnthropic({ ...common, apiKey: endpoint.apiKey ?? '' })(model);
+    return createOpenAI({ ...common, apiKey: endpoint.apiKey ?? 'none' }).chat(model);
+}
+/** `{ fetch }` when a proxy or extra CA roots are installed (see installedFetch), else nothing: the SDK then uses the global one. */
+function viaInstalled() {
+    const f = installedFetch();
+    return f ? { fetch: f } : {};
+}
 export function createLanguageModel(config) {
+    if (config.endpoint)
+        return createEndpointModel(config.endpoint, config.model);
+    const net = viaInstalled();
     switch (config.provider) {
         case 'openai':
-            return openai(config.model);
+            return net.fetch ? createOpenAI(net)(config.model) : openai(config.model);
         case 'anthropic':
-            return anthropic(config.model);
+            return net.fetch ? createAnthropic(net)(config.model) : anthropic(config.model);
         case 'google':
-            return google(config.model);
+            return net.fetch ? createGoogleGenerativeAI(net)(config.model) : google(config.model);
         case 'ollama':
             return createOpenAI({
                 baseURL: process.env.OLLAMA_BASE_URL ?? DEFAULT_OLLAMA_BASE_URL,
                 // Ollama doesn't require an API key: pass a placeholder so the
                 // OpenAI SDK's auth header doesn't trip on undefined.
                 apiKey: process.env.OLLAMA_API_KEY ?? 'ollama',
+                ...net,
             }).chat(config.model);
         case 'openrouter':
             return createOpenAI({
                 baseURL: OPENROUTER_BASE_URL,
                 apiKey: process.env.OPENROUTER_API_KEY ?? '',
+                ...net,
                 headers: {
                     // OpenRouter recommends an app-name header so they can attribute
                     // traffic; helps if you ever need to reach support.
@@ -64,18 +93,20 @@ export function createLanguageModel(config) {
             return createOpenAI({
                 baseURL: process.env.MINIMAX_BASE_URL ?? MINIMAX_BASE_URL,
                 apiKey: process.env.MINIMAX_API_KEY ?? '',
+                ...net,
             }).chat(config.model);
         case 'lmstudio':
             return createOpenAI({
                 baseURL: process.env.LMSTUDIO_BASE_URL ?? DEFAULT_LMSTUDIO_BASE_URL,
                 apiKey: process.env.LMSTUDIO_API_KEY ?? 'lm-studio',
+                ...net,
             }).chat(config.model);
         case 'openai-compatible': {
             const baseURL = process.env.OPENAI_COMPATIBLE_BASE_URL;
             if (!baseURL) {
                 throw new Error('Provider "openai-compatible" needs OPENAI_COMPATIBLE_BASE_URL (e.g. http://localhost:8000/v1).');
             }
-            return createOpenAI({ baseURL, apiKey: process.env.OPENAI_COMPATIBLE_API_KEY ?? 'none' }).chat(config.model);
+            return createOpenAI({ baseURL, apiKey: process.env.OPENAI_COMPATIBLE_API_KEY ?? 'none', ...net }).chat(config.model);
         }
         // The three cloud-account SDKs are heavy (~1.2 s to import together), so they load on first use.
         case 'bedrock':
@@ -83,6 +114,7 @@ export function createLanguageModel(config) {
                 const { createAmazonBedrock } = await import('@ai-sdk/amazon-bedrock');
                 return createAmazonBedrock({
                     region: process.env.AWS_REGION ?? 'us-east-1',
+                    ...net,
                     ...(process.env.AWS_BEARER_TOKEN_BEDROCK ? { apiKey: process.env.AWS_BEARER_TOKEN_BEDROCK } : {}),
                     ...(process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY
                         ? {
@@ -99,12 +131,14 @@ export function createLanguageModel(config) {
                 return createVertex({
                     ...(process.env.GOOGLE_VERTEX_PROJECT ? { project: process.env.GOOGLE_VERTEX_PROJECT } : {}),
                     location: process.env.GOOGLE_VERTEX_LOCATION ?? 'us-central1',
+                    ...net,
                 })(config.model);
             });
         case 'azure':
             return lazyLanguageModel({ provider: 'azure', modelId: config.model }, async () => {
                 const { createAzure } = await import('@ai-sdk/azure');
                 return createAzure({
+                    ...net,
                     ...(process.env.AZURE_API_KEY ? { apiKey: process.env.AZURE_API_KEY } : {}),
                     ...(process.env.AZURE_RESOURCE_NAME ? { resourceName: process.env.AZURE_RESOURCE_NAME } : {}),
                     ...(process.env.AZURE_OPENAI_BASE_URL ? { baseURL: process.env.AZURE_OPENAI_BASE_URL } : {}),
@@ -218,4 +252,3 @@ export function pickAvailableProvider(env = process.env, disabled = []) {
 export function formatModelId(config) {
     return `${config.provider}/${config.model}`;
 }
-//# sourceMappingURL=providers.js.map

package/dist/repomap/index.d.ts

@@ -2,4 +2,3 @@ export { DEFAULT_MAP_TOKENS, buildEdges, buildRepoMap, estimateTokens, identifie
 export type { RepoMap, RepoMapOptions } from './repo-map.js';
 export { isExported, isTestFile, nameWeight } from './repo-map.js';
 export type { DefinitionFilter } from './repo-map.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/repomap/index.js

@@ -1,3 +1,2 @@
 export { DEFAULT_MAP_TOKENS, buildEdges, buildRepoMap, estimateTokens, identifierCounts, pageRank, repoMapBlock } from './repo-map.js';
 export { isExported, isTestFile, nameWeight } from './repo-map.js';
-//# sourceMappingURL=index.js.map

package/dist/repomap/repo-map.d.ts

@@ -41,4 +41,3 @@ export declare function isExported(file: string, sym: CodeSymbol, line: string):
 export declare function buildRepoMap(cwd: string, options?: RepoMapOptions): Promise<RepoMap>;
 /** The block added to the system prompt. */
 export declare function repoMapBlock(map: RepoMap): string;
-//# sourceMappingURL=repo-map.d.ts.map

package/dist/repomap/repo-map.js

@@ -256,4 +256,3 @@ export function repoMapBlock(map) {
         return '';
     return `<repo-map>\nOutline of the codebase, most important files first. It is a map, not the code: read a file before editing it.\n\n${map.text}\n</repo-map>`;
 }
-//# sourceMappingURL=repo-map.js.map

package/dist/semantic/chunker.d.ts

@@ -10,4 +10,3 @@ export interface Chunk {
  * overlapping line windows over the whole file.
  */
 export declare function chunkSource(source: string, ext: string): Promise<Chunk[]>;
-//# sourceMappingURL=chunker.d.ts.map

package/dist/semantic/chunker.js

@@ -32,4 +32,3 @@ export async function chunkSource(source, ext) {
     }
     return out;
 }
-//# sourceMappingURL=chunker.js.map

package/dist/semantic/embedder.d.ts

@@ -26,10 +26,24 @@ export interface OpenAiCompatibleEmbedderOptions {
     fetchImpl?: typeof fetch;
 }
 export declare function openAiCompatibleEmbedder(options: OpenAiCompatibleEmbedderOptions): Embedder;
+export interface EmbedderSpec {
+    kind: 'hashing' | 'openai' | 'ollama' | 'custom';
+    model?: string;
+    /** For `custom`: an OpenAI-compatible `/embeddings` endpoint, up to and including `/v1`. */
+    baseUrl?: string;
+    /** For `custom`: the name of the environment variable holding the key (never the key itself). */
+    apiKeyEnv?: string;
+    batchSize?: number;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * An embedder from explicit settings. A choice that lacks what it needs (no key, no endpoint) gives the offline
+ * hashing embedder rather than an embedder that fails every search.
+ */
+export declare function buildEmbedder(spec: EmbedderSpec, env?: NodeJS.ProcessEnv): Embedder;
 /**
  * `FORGE_EMBED_PROVIDER` = `hashing` (default) | `openai` | `ollama`.
  * `FORGE_EMBED_MODEL` overrides the model. Falls back to hashing when the
  * chosen provider lacks what it needs (e.g. no OPENAI_API_KEY).
  */
 export declare function embedderFromEnv(env?: NodeJS.ProcessEnv): Embedder;
-//# sourceMappingURL=embedder.d.ts.map

package/dist/semantic/embedder.js

@@ -85,6 +85,31 @@ export function openAiCompatibleEmbedder(options) {
         },
     };
 }
+/**
+ * An embedder from explicit settings. A choice that lacks what it needs (no key, no endpoint) gives the offline
+ * hashing embedder rather than an embedder that fails every search.
+ */
+export function buildEmbedder(spec, env = process.env) {
+    const common = { ...(spec.batchSize ? { batchSize: spec.batchSize } : {}), ...(spec.fetchImpl ? { fetchImpl: spec.fetchImpl } : {}) };
+    switch (spec.kind) {
+        case 'openai':
+            if (!env.OPENAI_API_KEY)
+                return hashingEmbedder();
+            return openAiCompatibleEmbedder({ baseUrl: env.OPENAI_BASE_URL ?? 'https://api.openai.com/v1', model: spec.model || 'text-embedding-3-small', apiKey: env.OPENAI_API_KEY, ...common });
+        case 'ollama': {
+            const host = (env.OLLAMA_BASE_URL ?? 'http://localhost:11434').replace(/\/+$/, '').replace(/\/v1$/, '');
+            return openAiCompatibleEmbedder({ baseUrl: `${host}/v1`, model: spec.model || 'nomic-embed-text', ...common });
+        }
+        case 'custom': {
+            if (!spec.baseUrl || !spec.model)
+                return hashingEmbedder();
+            const apiKey = spec.apiKeyEnv ? env[spec.apiKeyEnv] : undefined;
+            return openAiCompatibleEmbedder({ baseUrl: spec.baseUrl, model: spec.model, ...(apiKey ? { apiKey } : {}), ...common });
+        }
+        default:
+            return hashingEmbedder();
+    }
+}
 /**
  * `FORGE_EMBED_PROVIDER` = `hashing` (default) | `openai` | `ollama`.
  * `FORGE_EMBED_MODEL` overrides the model. Falls back to hashing when the
@@ -105,4 +130,3 @@ export function embedderFromEnv(env = process.env) {
     }
     return hashingEmbedder();
 }
-//# sourceMappingURL=embedder.js.map

package/dist/semantic/semantic-index.d.ts

@@ -1,5 +1,13 @@
 import { type Embedder } from './embedder.js';
 import { type SemanticManifest } from './vector-store.js';
+export interface SemanticOptions {
+    /** File extensions to index, with the dot. Default: the common source and Markdown ones. */
+    extensions?: readonly string[];
+    /** Hits scoring below this (cosine similarity) are left out. Default: none cut. */
+    minScore?: number;
+}
+/** `"ts, .py,md"` as `['.ts', '.py', '.md']`; undefined (use the defaults) when nothing usable is left. */
+export declare function parseExtensions(text: string | undefined): string[] | undefined;
 export interface SemanticHit {
     path: string;
     startLine: number;
@@ -8,6 +16,5 @@ export interface SemanticHit {
     snippet: string;
 }
 /** Bring `.forge/index/embeddings.json` up to date: re-embed only changed files, drop deleted ones. */
-export declare function ensureSemanticFresh(cwd: string, embedder: Embedder): Promise<SemanticManifest>;
-export declare function searchSemantic(cwd: string, embedder: Embedder, query: string, k?: number): Promise<SemanticHit[]>;
-//# sourceMappingURL=semantic-index.d.ts.map
+export declare function ensureSemanticFresh(cwd: string, embedder: Embedder, options?: SemanticOptions): Promise<SemanticManifest>;
+export declare function searchSemantic(cwd: string, embedder: Embedder, query: string, k?: number, options?: SemanticOptions): Promise<SemanticHit[]>;

package/dist/semantic/semantic-index.js

@@ -7,9 +7,17 @@ import { chunkSource } from './chunker.js';
 import { cosine } from './embedder.js';
 import { decodeVector, encodeVector, loadSemanticManifest, saveSemanticManifest } from './vector-store.js';
 const EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.py', '.go', '.rs', '.java', '.md']);
+/** `"ts, .py,md"` as `['.ts', '.py', '.md']`; undefined (use the defaults) when nothing usable is left. */
+export function parseExtensions(text) {
+    const list = (text ?? '')
+        .split(',')
+        .map((e) => e.trim().toLowerCase().replace(/^\.?/, '.'))
+        .filter((e) => /^\.[a-z0-9]{1,12}$/.test(e));
+    return list.length ? [...new Set(list)] : undefined;
+}
 const MAX_FILE_BYTES = 512 * 1024;
 const SNIPPET_LINES = 40;
-async function collect(cwd) {
+async function collect(cwd, extensions) {
     const out = [];
     const rules = IgnoreRules.forRoot(cwd);
     async function walk(dir) {
@@ -29,7 +37,7 @@ async function collect(cwd) {
             if (entry.isDirectory()) {
                 await walk(abs);
             }
-            else if (entry.isFile() && EXTENSIONS.has(path.extname(entry.name))) {
+            else if (entry.isFile() && extensions.has(path.extname(entry.name).toLowerCase())) {
                 const s = await stat(abs);
                 if (s.size <= MAX_FILE_BYTES) {
                     out.push({ rel: path.relative(cwd, abs).split(path.sep).join('/'), abs, ext: path.extname(entry.name), mtimeMs: s.mtimeMs });
@@ -41,9 +49,9 @@ async function collect(cwd) {
     return out;
 }
 /** Bring `.forge/index/embeddings.json` up to date: re-embed only changed files, drop deleted ones. */
-export async function ensureSemanticFresh(cwd, embedder) {
+export async function ensureSemanticFresh(cwd, embedder, options = {}) {
     const manifest = await loadSemanticManifest(cwd, embedder.id);
-    const files = await collect(cwd);
+    const files = await collect(cwd, options.extensions ? new Set(options.extensions) : EXTENSIONS);
     const seen = new Set(files.map((f) => f.rel));
     let changed = false;
     for (const f of files) {
@@ -68,8 +76,8 @@ export async function ensureSemanticFresh(cwd, embedder) {
         await saveSemanticManifest(cwd, manifest);
     return manifest;
 }
-export async function searchSemantic(cwd, embedder, query, k = 8) {
-    const manifest = await ensureSemanticFresh(cwd, embedder);
+export async function searchSemantic(cwd, embedder, query, k = 8, options = {}) {
+    const manifest = await ensureSemanticFresh(cwd, embedder, options);
     const [q] = await embedder.embed([query]);
     if (!q)
         return [];
@@ -80,7 +88,8 @@ export async function searchSemantic(cwd, embedder, query, k = 8) {
     }
     scored.sort((a, b) => b.score - a.score);
     const hits = [];
-    for (const top of scored.slice(0, k)) {
+    const floor = options.minScore;
+    for (const top of scored.filter((c) => floor === undefined || c.score >= floor).slice(0, k)) {
         let text;
         try {
             const lines = (await readFile(path.join(cwd, top.rel), 'utf8')).split(/\r?\n/);
@@ -93,4 +102,3 @@ export async function searchSemantic(cwd, embedder, query, k = 8) {
     }
     return hits;
 }
-//# sourceMappingURL=semantic-index.js.map

package/dist/semantic/vector-store.d.ts

@@ -17,4 +17,3 @@ export declare function encodeVector(v: number[]): string;
 export declare function decodeVector(s: string): number[];
 export declare function loadSemanticManifest(cwd: string, embedderId: string): Promise<SemanticManifest>;
 export declare function saveSemanticManifest(cwd: string, manifest: SemanticManifest): Promise<void>;
-//# sourceMappingURL=vector-store.d.ts.map

package/dist/semantic/vector-store.js

@@ -25,4 +25,3 @@ export async function saveSemanticManifest(cwd, manifest) {
     await mkdir(path.dirname(file), { recursive: true });
     await writeFile(file, JSON.stringify(manifest), 'utf8');
 }
-//# sourceMappingURL=vector-store.js.map

package/dist/sessions/index.d.ts

@@ -1,7 +1,7 @@
 export { defaultSessionDir, generateSessionId, saveSession, loadSession, deleteSession, listSessions, findLatestSession, } from './session-store.js';
 export type { Session, ListEntry } from './session-store.js';
+export { pruneByRetention, pruneSessions, type SessionPruneOptions, type SessionPruneResult } from './prune.js';
 export { formatSessionMarkdown, formatSessionJson, type FormatOptions } from './session-export.js';
 export { appendedSince, summarizeMessage, watchSession } from './watch.js';
 export type { SessionUpdate, WatchSessionOptions } from './watch.js';
 export { searchSessions, sessionText, type SessionMatch, type SearchSessionsOptions } from './search.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/sessions/index.js

@@ -1,5 +1,5 @@
 export { defaultSessionDir, generateSessionId, saveSession, loadSession, deleteSession, listSessions, findLatestSession, } from './session-store.js';
+export { pruneByRetention, pruneSessions } from './prune.js';
 export { formatSessionMarkdown, formatSessionJson } from './session-export.js';
 export { appendedSince, summarizeMessage, watchSession } from './watch.js';
 export { searchSessions, sessionText } from './search.js';
-//# sourceMappingURL=index.js.map

package/dist/sessions/prune.d.ts

@@ -0,0 +1,23 @@
+export interface SessionPruneOptions {
+    /** Delete sessions last updated more than this many days ago. */
+    olderThanDays: number;
+    /** Session ids never to delete, such as the one that is open right now. */
+    keepIds?: readonly string[];
+    /** Report what would be deleted without deleting it. */
+    dryRun?: boolean;
+    /** The clock; tests pass a fixed date. */
+    now?: Date;
+}
+export interface SessionPruneResult {
+    /** Ids deleted (or, in a dry run, that would be). */
+    deleted: string[];
+    /** Sessions left in place. */
+    kept: number;
+}
+/**
+ * Prune by the `sessionRetentionDays` setting. Returns undefined, touching nothing, unless it is a
+ * positive number: unset means "keep everything".
+ */
+export declare function pruneByRetention(dir: string, retentionDays: number | undefined, opts?: Pick<SessionPruneOptions, 'keepIds' | 'now'>): Promise<SessionPruneResult | undefined>;
+/** Delete saved sessions that have not been touched for `olderThanDays` days. Files that are not valid sessions are never touched. */
+export declare function pruneSessions(dir: string, opts: SessionPruneOptions): Promise<SessionPruneResult>;

package/dist/sessions/prune.js

@@ -0,0 +1,35 @@
+import { existsSync } from 'node:fs';
+import { deleteSession, listSessions } from './session-store.js';
+/**
+ * Prune by the `sessionRetentionDays` setting. Returns undefined, touching nothing, unless it is a
+ * positive number: unset means "keep everything".
+ */
+export async function pruneByRetention(dir, retentionDays, opts = {}) {
+    if (retentionDays === undefined || !Number.isFinite(retentionDays) || retentionDays <= 0)
+        return undefined;
+    return pruneSessions(dir, { ...opts, olderThanDays: retentionDays });
+}
+/** Delete saved sessions that have not been touched for `olderThanDays` days. Files that are not valid sessions are never touched. */
+export async function pruneSessions(dir, opts) {
+    if (!Number.isFinite(opts.olderThanDays) || opts.olderThanDays <= 0) {
+        throw new Error(`pruneSessions: olderThanDays must be a positive number, got ${opts.olderThanDays}`);
+    }
+    if (!existsSync(dir))
+        return { deleted: [], kept: 0 };
+    const cutoff = (opts.now ?? new Date()).getTime() - opts.olderThanDays * 86_400_000;
+    const keep = new Set(opts.keepIds ?? []);
+    const deleted = [];
+    let kept = 0;
+    for (const entry of await listSessions(dir)) {
+        const updated = Date.parse(entry.updatedAt);
+        const stale = Number.isFinite(updated) && updated < cutoff;
+        if (!stale || keep.has(entry.id)) {
+            kept++;
+            continue;
+        }
+        if (!opts.dryRun)
+            await deleteSession(entry.id, dir);
+        deleted.push(entry.id);
+    }
+    return { deleted, kept };
+}

package/dist/sessions/search.d.ts

@@ -20,4 +20,3 @@ export interface SearchSessionsOptions {
 export declare function sessionText(messages: readonly unknown[]): string;
 export declare function snippetAround(text: string, at: number, width?: number): string;
 export declare function searchSessions(dir: string, query: string, options?: SearchSessionsOptions): Promise<SessionMatch[]>;
-//# sourceMappingURL=search.d.ts.map

package/dist/sessions/search.js

@@ -64,4 +64,3 @@ export async function searchSessions(dir, query, options = {}) {
     matches.sort((a, b) => b.hits - a.hits);
     return matches.slice(0, options.limit ?? 20);
 }
-//# sourceMappingURL=search.js.map

package/dist/sessions/session-export.d.ts

@@ -36,4 +36,3 @@ export declare function formatSessionMarkdown(session: Session, options?: Format
  * strings with `***REDACTED***`.
  */
 export declare function formatSessionJson(session: Session, options?: FormatOptions): string;
-//# sourceMappingURL=session-export.d.ts.map

package/dist/sessions/session-export.js

@@ -319,4 +319,3 @@ function redactContent(content) {
         return out;
     });
 }
-//# sourceMappingURL=session-export.js.map

package/dist/sessions/session-store.d.ts

@@ -62,4 +62,3 @@ export declare function deleteSession(id: string, dir: string): Promise<void>;
 export declare function listSessions(dir: string): Promise<ListEntry[]>;
 /** Most-recent session, or null if there are none. */
 export declare function findLatestSession(dir: string): Promise<ListEntry | null>;
-//# sourceMappingURL=session-store.d.ts.map

package/dist/sessions/session-store.js

@@ -155,7 +155,8 @@ function extractPreview(messages) {
     if (!firstUser)
         return undefined;
     const rawText = typeof firstUser.content === 'string' ? firstUser.content : extractText(firstUser.content);
-    const text = rawText === undefined ? undefined : stripSteering(rawText);
+    // The `<context ...>` blocks an @mention appends are attachments, not the user's words.
+    const text = rawText === undefined ? undefined : stripSteering(rawText).replace(/\n\n<context [^>]*>[\s\S]*?<\/context>/g, '');
     if (!text)
         return undefined;
     const oneLine = text.replace(/\s+/g, ' ').trim();
@@ -180,4 +181,3 @@ async function rename(from, to) {
 // Suppress unused-import warning on rare Node versions.
 void mkdtemp;
 void rm;
-//# sourceMappingURL=session-store.js.map

package/dist/sessions/watch.d.ts

@@ -26,4 +26,3 @@ export declare function watchSession(id: string, dir: string, onUpdate: (update:
 export declare function appendedSince(prev: ModelMessage[], next: ModelMessage[]): ModelMessage[] | null;
 /** One short line per message part, for live tails. */
 export declare function summarizeMessage(message: ModelMessage, maxChars?: number): string[];
-//# sourceMappingURL=watch.d.ts.map

package/dist/sessions/watch.js

@@ -79,4 +79,3 @@ export function summarizeMessage(message, maxChars = 200) {
     }
     return lines;
 }
-//# sourceMappingURL=watch.js.map

package/dist/settings-export.d.ts

@@ -22,4 +22,3 @@ export declare function importSettings(data: ForgeSettingsExport, opts: {
     configPath?: string;
     specialistsPath?: string;
 }): Promise<void>;
-//# sourceMappingURL=settings-export.d.ts.map