@linxiraos/pi-agent-core 1.1.5 → 1.1.7

package/CHANGELOG.md

@@ -2,15 +2,18 @@
 
 ## [Unreleased]
 
-## [1.1.5] - 2026-08-26
+## [1.1.7] - 2026-09-01
 
-- 同步上游 OMP v18.0.5 / v18.0.6（内部运行时与构建改进）。
+- 同步上游 OMP v18.0.11（`b8ce33a58911c26bed1d84f0db9a5e2e727c49a2`）。
 
-## [1.1.3] - 2026-08-25
+## [1.1.6] - 2026-08-30
 
-### Fixed
+- 同步上游 OMP v18.0.10（`33cc6b9a043a`）。
+- 同步上游 OMP v18.0.9（`cc14e04f075d`）。
 
-- Republished as 1.1.3 to reset the latest tag after the broken 1.1.2 (no functional change over 1.1.1).
+## [1.1.5] - 2026-08-26
+
+- 同步上游 OMP v18.0.5 / v18.0.6（内部运行时与构建改进）。
 
 ## [1.1.2] - 2026-08-25
 

package/dist/types/agent-loop.d.ts

@@ -38,13 +38,26 @@ export declare function resolveOwnedDialectFromEnv(value: string | undefined): D
  * The prompt is added to the context and events are emitted for it.
  */
 export declare function agentLoop(prompts: AgentMessage[], context: AgentContext, config: AgentLoopConfig, signal?: AbortSignal, streamFn?: StreamFn): EventStream<AgentEvent, AgentMessage[]>;
+/**
+ * Trailing assistant message whose runnable tool calls have no results yet.
+ *
+ * A harness that strips failed/aborted tool results in order to re-execute
+ * the calls (e.g. `AgentSession.retry`'s tool replay) leaves the transcript
+ * in this shape; {@link agentLoopContinue} resumes it by running those calls
+ * before the next model call. Cursor exec-resolved blocks are excluded — the
+ * provider already executed those server-side. `length`-truncated turns never
+ * qualify: their trailing call arguments may be incomplete.
+ */
+export declare function unpairedToolCallTail(messages: readonly AgentMessage[]): AssistantMessage | undefined;
 /**
  * Continue an agent loop from the current context without adding a new message.
  * Used for retries - context already has user message or tool results.
  *
  * **Important:** The last message in context must convert to a `user` or `toolResult` message
- * via `convertToLlm`. If it doesn't, the LLM provider will reject the request.
- * This cannot be validated here since `convertToLlm` is only called once per turn.
+ * via `convertToLlm` — except for an assistant tail with unpaired runnable
+ * tool calls (see {@link unpairedToolCallTail}), which resumes by executing
+ * those calls first. Any other assistant tail is rejected here; other invalid
+ * tails cannot be validated since `convertToLlm` is only called once per turn.
  */
 export declare function agentLoopContinue(context: AgentContext, config: AgentLoopConfig, signal?: AbortSignal, streamFn?: StreamFn): EventStream<AgentEvent, AgentMessage[]>;
 /**

package/dist/types/compaction/openai.d.ts

@@ -87,7 +87,7 @@ export declare function withOpenAiRemoteCompactionPreserveData(preserveData: Rec
  * @param previousReplacementHistory - History from a prior compaction whose
  *   encrypted reasoning we want to preserve.
  */
-export declare function buildOpenAiNativeHistory(messages: Message[], model: Model, previousReplacementHistory?: Array<Record<string, unknown>>): Array<Record<string, unknown>>;
+export declare function buildOpenAiNativeHistory(messages: Message[], model: Model, previousReplacementHistory?: Array<Record<string, unknown>>, supportsImageDetailOriginal?: boolean): Array<Record<string, unknown>>;
 export declare function requestOpenAiRemoteCompaction(model: Model, apiKey: string, compactInput: Array<Record<string, unknown>>, instructions: string, signal?: AbortSignal, opts?: {
     fetch?: FetchImpl;
     timeoutMs?: number;

package/dist/types/compaction/shake.d.ts

@@ -1,9 +1,10 @@
 /**
  * Context-reducing surgical compaction ("shake").
  *
- * `shake` drops heavy content out of the live context mechanically: whole
- * tool-call results and large fenced/XML blocks are replaced with short
- * placeholders. This module is the pure layer — region detection and in-place
+ * `shake` drops heavy content out of the live context mechanically:
+ * tool-result text and large fenced/XML blocks are replaced with short
+ * placeholders while non-text tool-result content is preserved. This module
+ * is the pure layer — region detection and in-place
  * mutation only. Artifact offload, persistence, and provider-session teardown
  * are orchestrated by the caller (`AgentSession.shake`).
  *
@@ -45,6 +46,7 @@ export declare const RESCUE_SHAKE_CONFIG: ShakeConfig;
 export interface ToolResultShakeRegion {
     kind: "toolResult";
     entry: SessionMessageEntry;
+    /** Estimated tokens in the removable text only; retained images are excluded. */
     tokens: number;
     originalText: string;
     /** Human label for the offload doc (tool name). */
@@ -68,10 +70,11 @@ export type ShakeRegion = ToolResultShakeRegion | BlockShakeRegion;
  * Pure detection: locate every eligible shake region on a branch.
  *
  * Walks the protect-recent window (most recent `protectTokens` of context is
- * kept intact), collects whole tool-result messages (honoring `protectedTools`
- * and skipping already-pruned results) and large fenced/XML blocks inside
- * user/developer/assistant/custom messages. Tool results flagged contextually
- * useless by their tool bypass the protect window — there is nothing recent
+ * kept intact), collects the text from eligible tool-result messages
+ * (honoring `protectedTools` and skipping already-pruned results) and large
+ * fenced/XML blocks inside user/developer/assistant/custom messages.
+ * Contextually useless tool results bypass the protect window — there is
+ * nothing recent
  * worth keeping in them. Returns regions in document order.
  *
  * `toolCall` blocks are never touched (tool-call/result pairing is preserved)
@@ -82,8 +85,9 @@ export declare function collectShakeRegions(entries: SessionEntry[], tokenizer:
 /**
  * Pure mutation: replace a single region's content in place.
  *
- * Tool-result: replaces the message content with the placeholder text and
- * stamps `prunedAt`. Block: splices `replacement` over `[start, end)` of the
+ * Tool-result: replaces its first non-empty text block with the placeholder,
+ * removes its other text blocks, preserves every non-text block, and stamps
+ * `prunedAt`. Block: splices `replacement` over `[start, end)` of the
  * target text block. When several block regions share one text block they MUST
  * be applied highest-start-first so earlier offsets stay valid — use
  * {@link applyShakeRegions}, which orders them correctly.

package/dist/types/tokenizer.d.ts

@@ -1,11 +1,12 @@
 import type { Model } from "@linxiraos/pi-ai";
-import { Encoding } from "@linxiraos/pi-natives";
+import * as natives from "@linxiraos/pi-natives";
 import type { AgentMessage } from "./types.js";
 /** Maps the catalog-resolved tokenizer family to its native implementation. */
-export declare function tokenizerEncodingForModel(model: Pick<Model, "tokenizer"> | null | undefined): Encoding | null;
+export declare function tokenizerEncodingForModel(model: Pick<Model, "tokenizer"> | null | undefined): natives.Encoding | null;
 /**
- * `strict` always pays for an exact native count (the catalog-resolved
- * tokenizer when known, o200k_base otherwise). `approximate` and
+ * `strict` always tries an exact native count (the catalog-resolved tokenizer
+ * when known, o200k_base otherwise), falling back to the byte upper bound when
+ * the loaded addon does not recognize that encoding. `approximate` and
  * `upperbound` prefer the same exact count for known tokenizer families or
  * when `PI_TOKENIZER_ACCURATE=1` is set; otherwise they use a cheap heuristic:
  * `approximate` a bytes/4 guess, `upperbound` the raw byte length (never
@@ -31,11 +32,10 @@ export interface TokenBudgetCheck {
     fits: boolean;
     /**
      * Token count behind the verdict: the exact native count when `exact` is
-     * set, otherwise the cheap byte upper bound (which already fit, so it is
-     * only an over-estimate of a count known to be under budget).
+     * set, otherwise the conservative byte upper bound.
      */
     tokens: number;
-    /** Whether the exact tokenizer had to run because the cheap bound busted. */
+    /** Whether `tokens` came from the exact native tokenizer. */
     exact: boolean;
 }
 /**
@@ -50,7 +50,7 @@ export interface TokenBudgetCheck {
 export declare class Tokenizer {
     #private;
     constructor(model?: Pick<Model, "tokenizer"> | null);
-    get encoding(): Encoding | null;
+    get encoding(): natives.Encoding | null;
     countTokens(text: string | string[], mode?: TokenCountMode): number;
     /**
      * Cheap-first budget probe — the way to ask "does this fit in `budget`

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@linxiraos/pi-agent-core",
-	"version": "1.1.5",
+	"version": "1.1.7",
 	"description": "General-purpose agent with transport abstraction, state management, and attachment support",
 	"homepage": "https://linxira-os.github.io/zeta/",
 	"author": "Can Boluk",
@@ -35,16 +35,16 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@linxiraos/pi-ai": "1.1.5",
-		"@linxiraos/pi-catalog": "1.1.5",
-		"@linxiraos/pi-natives": "1.1.5",
-		"@linxiraos/pi-utils": "1.1.5",
-		"@linxiraos/pi-wire": "1.1.5",
-		"@linxiraos/pi-snapcompact": "1.1.5",
+		"@linxiraos/pi-ai": "1.1.7",
+		"@linxiraos/pi-catalog": "1.1.7",
+		"@linxiraos/pi-natives": "1.1.7",
+		"@linxiraos/pi-utils": "1.1.7",
+		"@linxiraos/pi-wire": "1.1.7",
+		"@linxiraos/pi-snapcompact": "1.1.7",
 		"@opentelemetry/api": "^1.9.1"
 	},
 	"devDependencies": {
-		"@linxiraos/pi-omptype": "1.1.5",
+		"@linxiraos/pi-omptype": "1.1.7",
 		"@opentelemetry/context-async-hooks": "^2.9.0",
 		"@opentelemetry/sdk-trace-base": "^2.9.0",
 		"@types/bun": "^1.3.14"

package/src/agent-loop.ts

@@ -554,13 +554,36 @@ export function agentLoop(
 	return stream;
 }
 
+/**
+ * Trailing assistant message whose runnable tool calls have no results yet.
+ *
+ * A harness that strips failed/aborted tool results in order to re-execute
+ * the calls (e.g. `AgentSession.retry`'s tool replay) leaves the transcript
+ * in this shape; {@link agentLoopContinue} resumes it by running those calls
+ * before the next model call. Cursor exec-resolved blocks are excluded — the
+ * provider already executed those server-side. `length`-truncated turns never
+ * qualify: their trailing call arguments may be incomplete.
+ */
+export function unpairedToolCallTail(messages: readonly AgentMessage[]): AssistantMessage | undefined {
+	const tail = messages[messages.length - 1];
+	if (tail?.role !== "assistant") return undefined;
+	// Mirrors the loop's `runnableStop` rule for fresh turns.
+	if (tail.stopReason !== "toolUse" && tail.stopReason !== "stop") return undefined;
+	const hasRunnable = tail.content.some(
+		c => c.type === "toolCall" && (c as CursorExecResolvedCarrier)[kCursorExecResolved] !== true,
+	);
+	return hasRunnable ? tail : undefined;
+}
+
 /**
  * Continue an agent loop from the current context without adding a new message.
  * Used for retries - context already has user message or tool results.
  *
  * **Important:** The last message in context must convert to a `user` or `toolResult` message
- * via `convertToLlm`. If it doesn't, the LLM provider will reject the request.
- * This cannot be validated here since `convertToLlm` is only called once per turn.
+ * via `convertToLlm` — except for an assistant tail with unpaired runnable
+ * tool calls (see {@link unpairedToolCallTail}), which resumes by executing
+ * those calls first. Any other assistant tail is rejected here; other invalid
+ * tails cannot be validated since `convertToLlm` is only called once per turn.
  */
 export function agentLoopContinue(
 	context: AgentContext,
@@ -572,7 +595,7 @@ export function agentLoopContinue(
 		throw new Error("Cannot continue: no messages in context");
 	}
 
-	if (context.messages[context.messages.length - 1].role === "assistant") {
+	if (context.messages[context.messages.length - 1].role === "assistant" && !unpairedToolCallTail(context.messages)) {
 		throw new Error("Cannot continue from message role: assistant");
 	}
 
@@ -1061,6 +1084,43 @@ async function runLoopBody(
 		let softSatisfies: SoftToolRequirement["satisfies"];
 		let directiveResolvedForTurn = false;
 		let turnOpen = false;
+		// A trailing assistant message with unpaired tool calls: the harness
+		// stripped the failed/aborted results so this run re-executes the calls
+		// (AgentSession.retry's tool replay). Run them before the first model
+		// call; the loop then continues normally on the fresh results. Queued
+		// steering stays parked until after the batch — injecting a message
+		// between the tool_use blocks and their results would break the
+		// provider's pairing invariant.
+		const resumeTail = unpairedToolCallTail(currentContext.messages);
+		if (resumeTail) {
+			stream.push({ type: "turn_start" });
+			emitInputMessages(stream, messagesToEmit);
+			messagesToEmit = [];
+			turnOpen = true;
+			const executionResult = await executeToolCalls(
+				currentContext,
+				resumeTail,
+				signal,
+				stream,
+				config,
+				telemetry,
+				invokeAgentSpan,
+			);
+			for (const result of executionResult.toolResults) {
+				currentContext.messages.push(result);
+				newMessages.push(result);
+			}
+			await emitTurnEnd(stream, currentContext, resumeTail, executionResult.toolResults, config, signal, {
+				willContinue: !isDeadlineExceeded(config.deadline),
+			});
+			turnOpen = false;
+			// A tool hook may mark its completed result as terminal (e.g. subagent
+			// yield) — same stop-before-next-model-call rule as the main loop.
+			if (signal?.reason === TERMINAL_TOOL_RESULT_ABORT_REASON) {
+				endAgentStream(stream, newMessages, telemetry, stepCounter.count);
+				return;
+			}
+		}
 
 		// Outer loop: continues when queued follow-up messages arrive after agent would stop
 		while (true) {

package/src/agent.ts

@@ -34,6 +34,7 @@ import {
 	normalizeMessagesForProvider,
 	normalizeTools,
 	resolveOwnedDialectFromEnv,
+	unpairedToolCallTail,
 } from "./agent-loop";
 import type { AppendOnlyContextManager } from "./append-only-context";
 import { isProviderRefusalMessage } from "./replay-policy";
@@ -1249,6 +1250,15 @@ export class Agent {
 				throw new Error("No messages to continue from");
 			}
 			if (messages[messages.length - 1].role === "assistant") {
+				// A tail with unpaired runnable tool calls resumes by re-executing
+				// them (see `unpairedToolCallTail` in agent-loop). This must win over
+				// queued-message delivery: injecting a message between the tool_use
+				// blocks and their results would break the provider's pairing
+				// invariant. Queued messages drain inside the resumed loop instead.
+				if (unpairedToolCallTail(messages)) {
+					await this.#runLoop(undefined, undefined, signal, true);
+					return;
+				}
 				const queuedSteering = await this.#dequeueSteeringMessagesAfterHooks(dequeueSignal);
 				if (queuedSteering.length > 0) {
 					await this.#runLoop(queuedSteering, { skipInitialSteeringPoll: true }, signal, true);

package/src/compaction/compaction.ts

@@ -1674,6 +1674,7 @@ export async function compact(
 			(summaryOptions.convertToLlm ?? defaultConvertToLlm)(remoteMessages),
 			model,
 			previousReplacementHistory,
+			openAiCompatSupportsImageDetailOriginal(model),
 		);
 		if (remoteHistory.length > 0) {
 			try {

package/src/compaction/messages.ts

@@ -85,7 +85,16 @@ function getPrunedToolResultContent(message: ToolResultMessage): (TextContent |
 	}
 	const textBlocks = message.content.filter((content): content is TextContent => content.type === "text");
 	const text = textBlocks.map(block => block.text).join("") || "[Output truncated]";
-	return [{ type: "text", text }];
+	const firstTextIndex = message.content.findIndex(content => content.type === "text");
+	if (firstTextIndex < 0) return [{ type: "text", text }, ...message.content];
+
+	const content: (TextContent | ImageContent)[] = [];
+	for (let index = 0; index < message.content.length; index++) {
+		const block = message.content[index];
+		if (block.type !== "text") content.push(block);
+		else if (index === firstTextIndex) content.push({ type: "text", text });
+	}
+	return content;
 }
 
 export function renderBranchSummaryContext(summary: string): string {

package/src/compaction/openai.ts

@@ -23,6 +23,7 @@ import {
 	getCodexAttestationHeader,
 } from "@linxiraos/pi-ai/providers/openai-codex-responses";
 import {
+	encodeResponsesToolResultOutput,
 	hoistInterleavedResponsesToolBatchMessages,
 	parseAzureDeploymentNameMap,
 	parseTextSignature,
@@ -503,6 +504,7 @@ export function buildOpenAiNativeHistory(
 	messages: Message[],
 	model: Model,
 	previousReplacementHistory?: Array<Record<string, unknown>>,
+	supportsImageDetailOriginal = false,
 ): Array<Record<string, unknown>> {
 	const input: Array<Record<string, unknown>> = previousReplacementHistory
 		? adaptComputerHistoryForCompaction([...previousReplacementHistory], model.supportsComputerUse === true)
@@ -691,12 +693,7 @@ export function buildOpenAiNativeHistory(
 
 		if (message.role === "toolResult") {
 			const normalized = normalizeResponsesToolCallId(message.toolCallId);
-			const textOutput = message.content
-				.filter(block => block.type === "text")
-				.map(block => block.text)
-				.join("\n");
-			const hasImages = message.content.some(block => block.type === "image");
-			const outputText = textOutput.length > 0 ? textOutput : hasImages ? "(see attached image)" : "";
+			const { output, outputText } = encodeResponsesToolResultOutput(message, model, supportsImageDetailOriginal);
 			if (demotedComputerCallIds.has(normalized.callId)) {
 				const resultItem =
 					message.providerMetadata?.type === "computer"
@@ -746,23 +743,8 @@ export function buildOpenAiNativeHistory(
 			input.push({
 				type: customCallIds.has(normalized.callId) ? "custom_tool_call_output" : "function_call_output",
 				call_id: normalized.callId,
-				output: outputText.toWellFormed(),
+				output,
 			});
-
-			if (hasImages && model.input.includes("image")) {
-				const contentBlocks: Array<Record<string, unknown>> = [
-					{ type: "input_text", text: TOOL_RESULT_IMAGE_ATTACHMENT_TEXT },
-				];
-				for (const block of message.content) {
-					if (block.type !== "image") continue;
-					contentBlocks.push({
-						type: "input_image",
-						detail: "auto",
-						image_url: `data:${block.mimeType};base64,${block.data}`,
-					});
-				}
-				input.push({ type: "message", role: "user", content: contentBlocks });
-			}
 		}
 
 		msgIndex++;

package/src/compaction/shake.ts

@@ -1,9 +1,10 @@
 /**
  * Context-reducing surgical compaction ("shake").
  *
- * `shake` drops heavy content out of the live context mechanically: whole
- * tool-call results and large fenced/XML blocks are replaced with short
- * placeholders. This module is the pure layer — region detection and in-place
+ * `shake` drops heavy content out of the live context mechanically:
+ * tool-result text and large fenced/XML blocks are replaced with short
+ * placeholders while non-text tool-result content is preserved. This module
+ * is the pure layer — region detection and in-place
  * mutation only. Artifact offload, persistence, and provider-session teardown
  * are orchestrated by the caller (`AgentSession.shake`).
  *
@@ -80,6 +81,7 @@ const PLACEHOLDER_TOKEN_ESTIMATE = 16;
 export interface ToolResultShakeRegion {
 	kind: "toolResult";
 	entry: SessionMessageEntry;
+	/** Estimated tokens in the removable text only; retained images are excluded. */
 	tokens: number;
 	originalText: string;
 	/** Human label for the offload doc (tool name). */
@@ -114,11 +116,19 @@ function getToolResultMessage(entry: SessionEntry): ToolResultMessage | undefine
 	return message as ToolResultMessage;
 }
 
-function toolResultText(message: ToolResultMessage): string {
-	return message.content
-		.filter((block): block is TextContent => block.type === "text")
-		.map(block => block.text)
-		.join("\n");
+function toolResultText(
+	message: ToolResultMessage,
+	tokenizer: Tokenizer,
+): { originalText: string; tokens: number } | undefined {
+	const fragments: string[] = [];
+	for (const block of message.content) {
+		if (block.type === "text" && block.text.length > 0) fragments.push(block.text);
+	}
+	if (fragments.length === 0) return undefined;
+	return {
+		originalText: fragments.join("\n"),
+		tokens: tokenizer.countTokens(fragments),
+	};
 }
 
 /** Estimate the token contribution of an entry for the protect-recent window. */
@@ -292,10 +302,11 @@ function scanContentBlocks(
  * Pure detection: locate every eligible shake region on a branch.
  *
  * Walks the protect-recent window (most recent `protectTokens` of context is
- * kept intact), collects whole tool-result messages (honoring `protectedTools`
- * and skipping already-pruned results) and large fenced/XML blocks inside
- * user/developer/assistant/custom messages. Tool results flagged contextually
- * useless by their tool bypass the protect window — there is nothing recent
+ * kept intact), collects the text from eligible tool-result messages
+ * (honoring `protectedTools` and skipping already-pruned results) and large
+ * fenced/XML blocks inside user/developer/assistant/custom messages.
+ * Contextually useless tool results bypass the protect window — there is
+ * nothing recent
  * worth keeping in them. Returns regions in document order.
  *
  * `toolCall` blocks are never touched (tool-call/result pairing is preserved)
@@ -339,13 +350,13 @@ export function collectShakeRegions(entries: SessionEntry[], tokenizer: Tokenize
 			if (toolResult.prunedAt !== undefined) continue;
 			if (isProtectedToolResult(toolResult, toolCallsById.get(toolResult.toolCallId), config.protectedTools))
 				continue;
-			const text = toolResultText(toolResult);
-			if (text.length === 0) continue;
+			const text = toolResultText(toolResult, tokenizer);
+			if (!text) continue;
 			regions.push({
 				kind: "toolResult",
 				entry: entry as SessionMessageEntry,
-				tokens: tokenizer.countMessage(toolResult as AgentMessage),
-				originalText: text,
+				tokens: text.tokens,
+				originalText: text.originalText,
 				label: toolResult.toolName,
 			});
 			continue;
@@ -414,8 +425,9 @@ function getBlockTextSlot(entry: SessionMessageEntry | CustomMessageEntry, block
 /**
  * Pure mutation: replace a single region's content in place.
  *
- * Tool-result: replaces the message content with the placeholder text and
- * stamps `prunedAt`. Block: splices `replacement` over `[start, end)` of the
+ * Tool-result: replaces its first non-empty text block with the placeholder,
+ * removes its other text blocks, preserves every non-text block, and stamps
+ * `prunedAt`. Block: splices `replacement` over `[start, end)` of the
  * target text block. When several block regions share one text block they MUST
  * be applied highest-start-first so earlier offsets stay valid — use
  * {@link applyShakeRegions}, which orders them correctly.
@@ -423,7 +435,15 @@ function getBlockTextSlot(entry: SessionMessageEntry | CustomMessageEntry, block
 export function applyShakeRegion(region: ShakeRegion, replacement: string): void {
 	if (region.kind === "toolResult") {
 		const message = region.entry.message as ToolResultMessage;
-		message.content = [{ type: "text", text: replacement }];
+		const replacementIndex = message.content.findIndex(block => block.type === "text" && block.text.length > 0);
+		if (replacementIndex < 0) return;
+		const kept: typeof message.content = [];
+		for (let index = 0; index < message.content.length; index++) {
+			const block = message.content[index];
+			if (block.type !== "text") kept.push(block);
+			else if (index === replacementIndex) kept.push({ type: "text", text: replacement });
+		}
+		message.content = kept;
 		message.prunedAt = Date.now();
 		invalidateMessageCache(message as AgentMessage);
 		return;

package/src/tokenizer.ts

@@ -1,6 +1,6 @@
 import type { Model } from "@linxiraos/pi-ai";
 import type { ModelTokenizer } from "@linxiraos/pi-catalog/types";
-import { countTokens as countTokensNat, Encoding } from "@linxiraos/pi-natives";
+import * as natives from "@linxiraos/pi-natives";
 import * as snapcompact from "@linxiraos/pi-snapcompact";
 import { stringifyJson } from "@linxiraos/pi-utils";
 import { isEstimateCacheable, messageEstimateVersion } from "./compaction/message-cache";
@@ -9,25 +9,26 @@ import type { AgentMessage } from "./types";
 const testEnv = Bun.env.NODE_ENV === "test";
 const accurate = process.env.PI_TOKENIZER_ACCURATE === "1" && !testEnv;
 
-const NATIVE_ENCODING: Record<ModelTokenizer, Encoding> = {
-	"claude-v3": Encoding.ClaudeV3,
-	"claude-v47": Encoding.ClaudeV47,
-	"claude-v5": Encoding.ClaudeV5,
-	"claude-v5-sonnet": Encoding.ClaudeV5Sonnet,
-	qwen3: Encoding.Qwen3,
-	"deepseek-v3": Encoding.DeepSeekV3,
-	"kimi-k2": Encoding.KimiK2,
-	glm5: Encoding.Glm5,
+const NATIVE_ENCODING: Record<ModelTokenizer, natives.Encoding> = {
+	"claude-v3": natives.Encoding.ClaudeV3,
+	"claude-v47": natives.Encoding.ClaudeV47,
+	"claude-v5": natives.Encoding.ClaudeV5,
+	"claude-v5-sonnet": natives.Encoding.ClaudeV5Sonnet,
+	qwen3: natives.Encoding.Qwen3,
+	"deepseek-v3": natives.Encoding.DeepSeekV3,
+	"kimi-k2": natives.Encoding.KimiK2,
+	glm5: natives.Encoding.Glm5,
 };
 
 /** Maps the catalog-resolved tokenizer family to its native implementation. */
-export function tokenizerEncodingForModel(model: Pick<Model, "tokenizer"> | null | undefined): Encoding | null {
+export function tokenizerEncodingForModel(model: Pick<Model, "tokenizer"> | null | undefined): natives.Encoding | null {
 	return model?.tokenizer ? NATIVE_ENCODING[model.tokenizer] : null;
 }
 
 /**
- * `strict` always pays for an exact native count (the catalog-resolved
- * tokenizer when known, o200k_base otherwise). `approximate` and
+ * `strict` always tries an exact native count (the catalog-resolved tokenizer
+ * when known, o200k_base otherwise), falling back to the byte upper bound when
+ * the loaded addon does not recognize that encoding. `approximate` and
  * `upperbound` prefer the same exact count for known tokenizer families or
  * when `PI_TOKENIZER_ACCURATE=1` is set; otherwise they use a cheap heuristic:
  * `approximate` a bytes/4 guess, `upperbound` the raw byte length (never
@@ -61,17 +62,41 @@ function sumFragments(text: string | string[], perFragment: (t: string) => numbe
 	return Array.isArray(text) ? text.reduce((sum, t) => sum + perFragment(t), 0) : perFragment(text);
 }
 
+interface NativeTokenCount {
+	tokens: number;
+	exact: boolean;
+}
+
+function countTokensNat(
+	text: string | string[],
+	encoding: natives.Encoding | null | undefined,
+	mode: TokenCountMode,
+): NativeTokenCount {
+	try {
+		return { tokens: natives.countTokens(text, encoding), exact: true };
+	} catch (error) {
+		if (
+			!(error instanceof Error) ||
+			(!error.message.includes("does not match any variant of enum") &&
+				!error.message.includes("unknown enum variant"))
+		) {
+			throw error;
+		}
+		const tokens = sumFragments(text, mode === "approximate" ? byteEstimate : byteLength);
+		return { tokens, exact: false };
+	}
+}
+
 /** Verdict from {@link Tokenizer.checkTokenBudget}. */
 export interface TokenBudgetCheck {
 	/** Whether the text fits the budget. */
 	fits: boolean;
 	/**
 	 * Token count behind the verdict: the exact native count when `exact` is
-	 * set, otherwise the cheap byte upper bound (which already fit, so it is
-	 * only an over-estimate of a count known to be under budget).
+	 * set, otherwise the conservative byte upper bound.
 	 */
 	tokens: number;
-	/** Whether the exact tokenizer had to run because the cheap bound busted. */
+	/** Whether `tokens` came from the exact native tokenizer. */
 	exact: boolean;
 }
 
@@ -104,7 +129,7 @@ interface MessageEstimate {
  * `PI_TOKENIZER_ACCURATE=1`).
  */
 export class Tokenizer {
-	readonly #encoding: Encoding | null;
+	readonly #encoding: natives.Encoding | null;
 
 	/**
 	 * Per-message estimate memo. Keyed by message identity, deliberately not a
@@ -120,14 +145,14 @@ export class Tokenizer {
 		this.#encoding = tokenizerEncodingForModel(model);
 	}
 
-	get encoding(): Encoding | null {
+	get encoding(): natives.Encoding | null {
 		return this.#encoding;
 	}
 
 	countTokens(text: string | string[], mode: TokenCountMode = "approximate"): number {
-		if (mode === "strict") return countTokensNat(text, this.#encoding);
-		if (!testEnv && this.#encoding !== null) return countTokensNat(text, this.#encoding);
-		if (accurate) return countTokensNat(text);
+		if (mode === "strict") return countTokensNat(text, this.#encoding, mode).tokens;
+		if (!testEnv && this.#encoding !== null) return countTokensNat(text, this.#encoding, mode).tokens;
+		if (accurate) return countTokensNat(text, undefined, mode).tokens;
 		return sumFragments(text, mode === "upperbound" ? byteLength : byteEstimate);
 	}
 
@@ -145,8 +170,8 @@ export class Tokenizer {
 	checkTokenBudget(text: string | string[], budget: number): TokenBudgetCheck {
 		const bound = sumFragments(text, byteLength);
 		if (bound <= budget) return { fits: true, tokens: bound, exact: false };
-		const tokens = this.countTokens(text, "strict");
-		return { fits: tokens <= budget, tokens, exact: true };
+		const result = countTokensNat(text, this.#encoding, "strict");
+		return { fits: result.tokens <= budget, tokens: result.tokens, exact: result.exact };
 	}
 
 	/**