@kenkaiiii/ggcoder 5.18.0 → 5.19.1

package/dist/core/agent-session.js

@@ -1,4 +1,4 @@
-import { agentLoop, isAbortError, } from "@kenkaiiii/gg-agent";
+import { agentLoop, isAbortError, isUsageLimitError, } from "@kenkaiiii/gg-agent";
 import { ProviderError, } from "@kenkaiiii/gg-ai";
 import { EventBus } from "./event-bus.js";
 import { SlashCommandRegistry, createBuiltinCommands, } from "./slash-commands.js";
@@ -6,11 +6,12 @@ import { PROMPT_COMMANDS, getPromptCommand } from "./prompt-commands.js";
 import { loadCustomCommands } from "./custom-commands.js";
 import { SettingsManager } from "./settings-manager.js";
 import { AuthStorage } from "./auth-storage.js";
+import { MOONSHOT_OAUTH_KEY } from "@kenkaiiii/gg-core";
 import { getClaudeCliUserAgent } from "./claude-code-version.js";
 import { kimiCodingHeaders, isKimiCodingEndpoint } from "./oauth/kimi.js";
 import { SessionManager, KEN_TURN_CUSTOM_KIND, AUTOPILOT_MARKER_CUSTOM_KIND, APP_MARKER_CUSTOM_KIND, } from "./session-manager.js";
 import { ExtensionLoader } from "./extensions/loader.js";
-import { shouldCompact, compact, getCompactionReserveTokens } from "./compaction/compactor.js";
+import { shouldCompact, compact } from "./compaction/compactor.js";
 import { getAuthStorageKeys, getContextWindow, getModel, getToolResultCharLimit, MODELS, } from "./model-registry.js";
 import { discoverSkills } from "./skills.js";
 import { ensureAppDirs } from "../config.js";
@@ -23,10 +24,12 @@ import { DeferredToolCatalog } from "./mcp/deferred-catalog.js";
 import { createToolSearchTool } from "../tools/tool-search.js";
 import { log } from "./logger.js";
 import { setEstimatorModel } from "./compaction/token-estimator.js";
+import { calculateActiveContextTokens } from "./compaction/active-context.js";
+import { pruneStaleToolResults } from "./compaction/tool-result-pruner.js";
 import { discoverAgents } from "./agents.js";
 import { enhancePrompt } from "../utils/prompt-enhancer.js";
 import { detectProjectStack } from "./language-detector.js";
-import { evaluateIdealReview, buildIdealReviewMessage, buildReviewCoverageMessage, detectTestDrift, ReviewCoverageTracker, } from "./ideal-review.js";
+import { evaluateIdealReview, buildIdealReviewMessage, buildReviewCoverageMessage, withReviewCoverageRequirements, detectTestDrift, ReviewCoverageTracker, } from "./ideal-review.js";
 import { evaluateLoopBreak, buildLoopBreakMessage, ToolCallProgressTracker, detectTextRepetition, } from "./loop-breaker.js";
 import { buildRegroundingMessage } from "./regrounding.js";
 import { wrapSteeringText, STEERING_PREFIX } from "./steering.js";
@@ -40,6 +43,18 @@ export function resolveSessionToolResultCharLimit(model, provider, accountId) {
     return (getToolResultCharLimit(model, { provider, accountId }) ??
         Math.floor(getContextWindow(model, { provider, accountId }) * 3.5 * 0.3));
 }
+/**
+ * Aggregate budget for ALL tool results produced in one assistant turn.
+ * Individual results are already capped, but wide parallel fan-outs (GPT-5.6's
+ * signature behavior) were observed injecting 100k+ uncached tokens in a single
+ * turn. ~15% of the context window in chars (1 token ≈ 3.5 chars), floored at
+ * 100KB so small windows still fit two full-size reads, ceilinged at 240KB so
+ * 1M-context models don't waive the budget entirely.
+ */
+export function resolveSessionTurnToolResultCharLimit(model, provider, accountId) {
+    const contextChars = getContextWindow(model, { provider, accountId }) * 3.5;
+    return Math.max(100_000, Math.min(Math.floor(contextChars * 0.15), 240_000));
+}
 // ── Agent Session ──────────────────────────────────────────
 export class AgentSession {
     eventBus = new EventBus();
@@ -93,10 +108,16 @@ export class AgentSession {
     hookFileEditCounts = new Map();
     hookToolCalls = new Map();
     idealReviewPhase = "idle";
+    /** Runtime-only suppression while Ken owns verification in autopilot mode. */
+    idealReviewSuppressed = false;
     reviewCoverage;
     loopBreakInjected = false;
     regroundingInjected = false;
     compactionOccurred = false;
+    lastCompactionCompacted = false;
+    compactionRetryAfter = 0;
+    /** Latest provider count, anchored to the assistant response it measured. */
+    providerContext = null;
     originalRequest = "";
     // Messages queued by the user while a run is in flight. Drained at the
     // mid-loop steering boundary (user steering wins over the hooks), mirroring
@@ -634,6 +655,13 @@ export class AgentSession {
             }
             case "turn_end":
                 this.hookStats.turns = event.turn;
+                for (let index = this.messages.length - 1; index >= 0; index--) {
+                    const anchor = this.messages[index];
+                    if (anchor?.role === "assistant") {
+                        this.providerContext = { usage: { ...event.usage }, anchor };
+                        break;
+                    }
+                }
                 await this.persistTurnMetric(event);
                 break;
         }
@@ -701,7 +729,7 @@ export class AgentSession {
         const childCompletionFollowUp = buildSubAgentCompletionFollowUp(this.subAgentManager);
         if (childCompletionFollowUp)
             return childCompletionFollowUp;
-        if (this.opts.selfCorrectionHooks === false)
+        if (this.opts.selfCorrectionHooks === false || this.idealReviewSuppressed)
             return null;
         if (this.idealReviewPhase === "reviewing") {
             const coverage = this.reviewCoverage.evidence();
@@ -746,7 +774,7 @@ export class AgentSession {
             lspMissing: lspEvidence.missing,
         });
         return [
-            this.withReviewLspEvidence(buildIdealReviewMessage(decision.reasons, driftedFiles), lspEvidence),
+            this.withReviewLspEvidence(withReviewCoverageRequirements(buildIdealReviewMessage(decision.reasons, driftedFiles), coverage.missing), lspEvidence),
         ];
     }
     reviewLspEvidence(files) {
@@ -806,24 +834,45 @@ export class AgentSession {
         this.lastAccountId = creds.accountId;
         // Auto-compact if needed. This must happen after credential resolution so
         // OpenAI OAuth/Codex sessions use the Codex product context window instead
-        // of the public API model window.
-        if (this.settingsManager.get("autoCompact")) {
+        // of the public API model window. Failed/no-op attempts cool down across
+        // prompts; provider overflow recovery still bypasses this path entirely.
+        if (this.settingsManager.get("autoCompact") && Date.now() >= this.compactionRetryAfter) {
             const contextWindow = getContextWindow(this.model, {
                 provider: this.provider,
                 accountId: creds.accountId,
             });
             const threshold = this.settingsManager.get("compactThreshold");
-            // Reserve headroom for this model's real output budget (e.g. GPT-5.5 over
-            // Codex OAuth: 272K window but up to 128K max output) — without this the
-            // default 16K reserve lets compaction skip until input alone is near the
-            // window, then `input + max_tokens` exceeds it and the provider rejects
-            // the turn outright with "exceeds the context window". Mirrors the TUI's
-            // useContextCompaction hook.
-            const reserveTokens = getCompactionReserveTokens(this.maxTokens);
-            if (shouldCompact(this.messages, contextWindow, threshold, undefined, reserveTokens)) {
-                await this.compact(creds);
-                // Re-grounding hook keys off this — the context was just summarized.
-                this.compactionOccurred = true;
+            let activeTokens;
+            if (this.providerContext) {
+                const anchorIndex = this.messages.lastIndexOf(this.providerContext.anchor);
+                if (anchorIndex >= 0) {
+                    activeTokens = calculateActiveContextTokens(this.messages, {
+                        usage: this.providerContext.usage,
+                        pendingMessages: this.messages.slice(anchorIndex + 1),
+                    });
+                }
+                else {
+                    this.providerContext = null;
+                }
+            }
+            if (shouldCompact(this.messages, contextWindow, threshold, activeTokens)) {
+                try {
+                    await this.compact(creds);
+                    if (this.lastCompactionCompacted) {
+                        // Re-grounding hook keys off this — the context was just summarized.
+                        this.compactionOccurred = true;
+                        this.compactionRetryAfter = 0;
+                    }
+                    else {
+                        this.compactionRetryAfter = Date.now() + 30_000;
+                    }
+                }
+                catch (error) {
+                    this.compactionRetryAfter = Date.now() + 30_000;
+                    if (isAbortError(error) || this.opts.signal?.aborted)
+                        throw error;
+                    log("WARN", "compaction", `Pre-run compaction failed; cooling down for 30s: ${error instanceof Error ? error.message : String(error)}`);
+                }
             }
         }
         const userAgent = this.provider === "anthropic" ? await getClaudeCliUserAgent() : undefined;
@@ -860,26 +909,93 @@ export class AgentSession {
                 // Codex caps each tool output at 10K tokens. Other transports retain the
                 // generic 30%-of-context allowance used before this provider policy.
                 maxToolResultChars: resolveSessionToolResultCharLimit(this.model, this.provider, accountId),
+                // Aggregate per-turn budget across parallel tool results (fan-out guard).
+                maxTurnToolResultChars: resolveSessionTurnToolResultCharLimit(this.model, this.provider, accountId),
                 // Self-correction hooks (same as the TUI): loop-break + re-grounding are
                 // polled mid-loop; the ideal review is polled when the agent would stop.
                 getSteeringMessages: () => this.getHookSteeringMessages(),
                 getFollowUpMessages: () => this.getHookFollowUpMessages(),
-                // Overflow recovery: the loop calls this with { force: true } when the
-                // provider rejects a turn as too large (request_too_large / context
-                // overflow). Force-compact the in-flight history and hand it back so the
-                // loop retries with a smaller request, instead of surfacing the error.
-                // Without this the desktop app (which drives the loop through
-                // AgentSession, not the TUI's useContextCompaction hook) had NO auto
-                // recovery on 413 — the error went straight to the user. The non-force
-                // pre-call invocations pass through untouched: pre-turn compaction is
-                // already handled above, so we only act on the overflow force path.
-                // `loopMessages === this.messages` (prepareDynamicContext returns it by
-                // reference) and the post-loop `this.messages = loopMessages` re-sync
-                // keeps persistence correct after compact() swaps the array.
+                // Check authoritative provider usage before every model/tool step.
+                // Forced overflow recovery bypasses settings and cooldown; proactive
+                // checks honor both and estimate only messages unseen by the provider.
                 transformContext: async (messages, transformOpts) => {
-                    if (!transformOpts?.force)
+                    if (transformOpts.usage) {
+                        const anchorIndex = messages.length - transformOpts.pendingMessages.length - 1;
+                        const anchor = messages[anchorIndex];
+                        if (anchor?.role === "assistant") {
+                            this.providerContext = { usage: { ...transformOpts.usage }, anchor };
+                        }
+                    }
+                    const force = transformOpts.force === true;
+                    if (!force) {
+                        if (!this.settingsManager.get("autoCompact"))
+                            return messages;
+                        // Cheap stale-tool-output pruning before the expensive LLM
+                        // compaction check. In-place mutation preserves anchors; drop the
+                        // retained usage afterwards since it counted the pruned content.
+                        const pruneResult = pruneStaleToolResults(messages);
+                        if (pruneResult.pruned) {
+                            this.providerContext = null;
+                            log("INFO", "compaction", "Pruned stale tool outputs", {
+                                prunedResults: String(pruneResult.prunedResults),
+                                freedTokens: String(pruneResult.freedTokens),
+                            });
+                        }
+                        if (Date.now() < this.compactionRetryAfter)
+                            return messages;
+                        // The turn's own usage also counted the pruned content — after a
+                        // prune, fall back to estimating the (now smaller) history so the
+                        // freed tokens actually defer the LLM compaction.
+                        let usage = pruneResult.pruned ? undefined : transformOpts.usage;
+                        let pendingMessages = transformOpts.pendingMessages;
+                        if (!usage && this.providerContext) {
+                            const anchorIndex = messages.lastIndexOf(this.providerContext.anchor);
+                            if (anchorIndex >= 0) {
+                                usage = this.providerContext.usage;
+                                pendingMessages = messages.slice(anchorIndex + 1);
+                            }
+                            else {
+                                this.providerContext = null;
+                            }
+                        }
+                        const contextWindow = getContextWindow(this.model, {
+                            provider: this.provider,
+                            accountId,
+                        });
+                        const threshold = this.settingsManager.get("compactThreshold");
+                        const activeTokens = calculateActiveContextTokens(messages, {
+                            usage,
+                            pendingMessages,
+                        });
+                        if (!shouldCompact(messages, contextWindow, threshold, activeTokens))
+                            return messages;
+                    }
+                    // compact() operates on this.messages, while an earlier transform may
+                    // have replaced the loop's in-flight array. Rebind before every attempt
+                    // so the current tool results are included in the summary.
+                    this.messages = messages;
+                    try {
+                        await this.compact({
+                            accessToken: apiKey,
+                            accountId,
+                            projectId,
+                            baseUrl: effectiveBaseUrl,
+                        });
+                    }
+                    catch (error) {
+                        this.messages = messages;
+                        this.compactionRetryAfter = Date.now() + 30_000;
+                        if (force || isAbortError(error) || this.opts.signal?.aborted)
+                            throw error;
+                        log("WARN", "compaction", `In-flight compaction failed; cooling down for 30s: ${error instanceof Error ? error.message : String(error)}`);
+                        return messages;
+                    }
+                    if (!this.lastCompactionCompacted) {
+                        this.messages = messages;
+                        this.compactionRetryAfter = Date.now() + 30_000;
                         return messages;
-                    await this.compact();
+                    }
+                    this.compactionRetryAfter = 0;
                     this.compactionOccurred = true;
                     return this.messages;
                 },
@@ -889,6 +1005,19 @@ export class AgentSession {
                 this.eventBus.forwardAgentEvent(event);
             }
         };
+        const clearInvalidStaticApiKey = async (error) => {
+            if (!(error instanceof ProviderError) || error.statusCode !== 401)
+                return false;
+            if (!(await this.authStorage.isStaticApiKey(this.provider)))
+                return false;
+            // Clear whichever key actually resolved (the request may have used a
+            // fallback key, not the model's first preference).
+            const badKey = (await this.authStorage.pickStorageKey(this.currentAuthStorageKeys())) ??
+                this.currentAuthStorageKeys()[0];
+            log("WARN", "auth", `Got 401 for ${this.provider} (${badKey}) — API key is invalid or revoked`);
+            await this.authStorage.clearCredentials(badKey);
+            return true;
+        };
         try {
             await runAgentLoop(creds.accessToken, creds.accountId, creds.projectId);
         }
@@ -897,21 +1026,48 @@ export class AgentSession {
             if (isAbortError(err) || this.opts.signal?.aborted) {
                 return;
             }
-            if (err instanceof ProviderError && err.statusCode === 401) {
+            // Kimi OAuth plan ran out of usage (hard usage-limit stop, or an HTTP 402
+            // billing stop). If the user ALSO configured a Moonshot API key, mark
+            // the OAuth credential usage-exhausted (honoring the provider-stated
+            // reset time when present) and retry this turn on the API key — OAuth
+            // stays the preferred credential and resumes automatically once the mark
+            // lapses. A generic 429 is deliberately excluded: it may be a transient
+            // rate limit and must not silently switch the user to a billed API key.
+            // Guarded on the Kimi managed endpoint actually being in use: if the API
+            // key was already active, the same error means BOTH are out and must surface.
+            if (this.provider === "moonshot" &&
+                !this.baseUrl &&
+                isKimiCodingEndpoint(creds.baseUrl) &&
+                (isUsageLimitError(err) || (err instanceof ProviderError && err.statusCode === 402)) &&
+                (await this.authStorage.hasCredentials("moonshot"))) {
+                const resetsAt = err instanceof ProviderError ? err.resetsAt : undefined;
+                await this.authStorage.markUsageExhausted(MOONSHOT_OAUTH_KEY, resetsAt);
+                log("WARN", "auth", "Kimi OAuth usage limit reached — retrying this turn on the Moonshot API key", { resetsAt: resetsAt !== undefined ? String(resetsAt) : "unknown" });
+                creds = await this.authStorage.resolveCredentials(this.provider, {
+                    storageKeys: this.currentAuthStorageKeys(),
+                });
+                this.lastAccountId = creds.accountId;
+                // The runAgentLoop closure re-reads `creds`, so the retry picks up the
+                // API key's baseUrl (api.moonshot.ai) and drops the Kimi coding headers.
+                try {
+                    await runAgentLoop(creds.accessToken, creds.accountId, creds.projectId);
+                }
+                catch (fallbackErr) {
+                    // The fallback is inside this catch branch, so its errors do not pass
+                    // through the outer 401 handler. Clear a rejected API key explicitly
+                    // before surfacing the error and prompting the user to log in again.
+                    await clearInvalidStaticApiKey(fallbackErr);
+                    throw fallbackErr;
+                }
+            }
+            else if (err instanceof ProviderError && err.statusCode === 401) {
                 // Static API-key providers (GLM, Moonshot API key, etc.) have no refresh
                 // mechanism — retrying with the same key is pointless. Clear the
                 // credential and surface the error so the user re-logins. Kimi OAuth
                 // (active for `moonshot` when present) is refreshable, so it falls
                 // through to the force-refresh path below.
-                if (await this.authStorage.isStaticApiKey(this.provider)) {
-                    // Clear whichever key actually resolved (the request may have used
-                    // a fallback key, not the model's first preference).
-                    const badKey = (await this.authStorage.pickStorageKey(this.currentAuthStorageKeys())) ??
-                        this.currentAuthStorageKeys()[0];
-                    log("WARN", "auth", `Got 401 for ${this.provider} (${badKey}) — API key is invalid or revoked`);
-                    await this.authStorage.clearCredentials(badKey);
+                if (await clearInvalidStaticApiKey(err))
                     throw err;
-                }
                 log("INFO", "auth", "Got 401, force-refreshing token and retrying");
                 creds = await this.authStorage.resolveCredentials(this.provider, {
                     forceRefresh: true,
@@ -936,6 +1092,7 @@ export class AgentSession {
         if (provider)
             this.provider = provider;
         this.model = model;
+        this.providerContext = null;
         // Keep host-provided option closures (notably chat delegation) aligned with
         // the live selection after an in-session model switch.
         this.opts.provider = this.provider;
@@ -1013,6 +1170,7 @@ export class AgentSession {
         }
     }
     async compact(existingCredentials) {
+        this.lastCompactionCompacted = false;
         const creds = existingCredentials ??
             (await this.authStorage.resolveCredentials(this.provider, {
                 storageKeys: this.currentAuthStorageKeys(),
@@ -1033,6 +1191,15 @@ export class AgentSession {
             signal: this.opts.signal,
         });
         this.messages = result.messages;
+        this.lastCompactionCompacted = result.result.compacted;
+        if (!result.result.compacted) {
+            this.eventBus.emit("compaction_end", {
+                originalCount: result.result.originalCount,
+                newCount: result.result.newCount,
+            });
+            return;
+        }
+        this.providerContext = null;
         // Transient sessions (Ken chat/autopilot, subagent spawns) must NEVER touch
         // the session store: without this guard, the first auto-compaction called
         // sessionManager.create() and assigned a real sessionPath, silently turning
@@ -1183,6 +1350,18 @@ export class AgentSession {
     getPlanMode() {
         return this.planModeRef.current;
     }
+    /**
+     * Suppress only the pre-final Ideal self-review for this live session.
+     * Autopilot uses this while Ken independently owns verification; loop-break
+     * and post-compaction re-grounding remain active.
+     */
+    setIdealReviewSuppressed(suppressed) {
+        this.idealReviewSuppressed = suppressed;
+        if (suppressed) {
+            this.idealReviewPhase = "idle";
+            this.reviewCoverage.reset();
+        }
+    }
     /** Queue a user message (optionally with attachments) to be injected mid-run
      *  as steering. Returns the new queue length. No-op semantics are the caller's
      *  concern. */
@@ -1631,7 +1810,15 @@ export class AgentSession {
             provider: this.provider,
             accountId: creds.accountId,
         });
-        if (shouldCompact(this.messages, contextWindow, 0.8, undefined, getCompactionReserveTokens(this.maxTokens))) {
+        const needsLoadCompaction = this.settingsManager.get("autoCompact") &&
+            shouldCompact(this.messages, contextWindow, this.settingsManager.get("compactThreshold"));
+        if (needsLoadCompaction && this.opts.deferLoadCompaction) {
+            // Host readiness is gated on initialize() — don't block it on a summary
+            // LLM call (up to 30s). runLoop()'s pre-run auto-compaction picks this
+            // up on the first prompt and emits compaction_start/_end for the UI.
+            log("INFO", "session", "Restored session exceeds context — deferring compaction to first prompt");
+        }
+        else if (needsLoadCompaction) {
             await this.subAgentManager?.hydrate(loaded.header.id);
             log("INFO", "session", `Restored session exceeds context — auto-compacting`);
             const compacted = await compact(this.messages, {