@mafdet/cli 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -6,6 +6,69 @@ The version is the contract for the JSON output shapes and the exit codes.
 Being 0.x, semver still permits a break in a minor bump; the intent is not to
 use that latitude, and the promise becomes binding at 1.0.0.
 
+## 0.4.3 - 2026-08-11
+
+A long agent run no longer walks into the model's context window, a one-shot
+chat can be saved, and the Windows timeout kill now walks the process tree.
+
+**Automatic compaction.** When a run gets close to the model's context window,
+the oldest tool exchanges are dropped from what is sent and you are told it
+happened. The size is measured rather than estimated: every response reports
+how many input tokens it actually cost, which is the provider's own count of
+exactly the conversation we sent. What gets dropped is always a whole exchange
+
+- an assistant tool call and the results answering it are inseparable - and
+  the system prompt and your original goal are never touched. A model whose
+  context length the catalogue does not publish is left alone, because guessing
+  a window would either truncate a conversation that fit or fail to truncate one
+  that did not. Your saved transcript is unaffected; only what is sent gets
+  shorter.
+
+**`mafdet chat "..." --save`** records a one-shot chat, through exactly the
+same store as an interactive session - the same redaction, the same private
+files, the same `mafdet sessions delete`. Chats are still not saved by
+default, `--no-history` still wins over `--save`, and a chat you cancel is not
+saved at all.
+
+**Windows command timeouts** now use `taskkill /T`, then `taskkill /T /F`,
+where POSIX uses SIGTERM then SIGKILL on the process group. Note the standing
+caveat: this path has not been run on a real Windows machine, so a surviving
+grandchild process there remains a known limitation rather than a fixed bug.
+
+## 0.4.2 - 2026-08-11
+
+Conversations are now saved on this computer, and a session's cost can be
+reconciled against the billing ledger.
+
+`mafdet sessions list|show|usage|delete` browses what is stored locally. None
+of it calls a model, so reading your own history is never charged. Recording
+is on by default for interactive sessions and off wherever a machine is
+reading the output; `--no-history` writes nothing at all.
+
+The transcript is plain text and stays on this machine - it is not uploaded,
+and Mafdet holds no copy. That is a statement about the archive, not about the
+model: the messages you send are still sent to the API to be answered and
+still appear in your usage records. The README says where the files live on
+each platform, and that deleting one is an ordinary file delete rather than a
+secure erase.
+
+`mafdet sessions usage <id> --refresh` asks the billing ledger what the
+requests actually cost and replaces the local estimate with the settled
+figure. It sends the request IDs already in the transcript and nothing else -
+no messages, no title, no workspace, no session ID. Requests paid for by a
+different API key are left alone and reported rather than guessed at, and a
+request the ledger has not settled stays `pending` rather than being shown as
+zero.
+
+The agent cannot read the CLI's own directories, even when you run `mafdet`
+from your home directory and the session store is technically inside the
+workspace.
+
+Fixed on the way: the value recorded to attribute usage to a key was the
+display fingerprint, which renders every live key identically - so a session
+that used two keys reported them as one. It is now a digest that actually
+differs per key, and still cannot be turned back into a key.
+
 ## 0.4.1 - 2026-08-07
 
 Fixes Ctrl+C in the interactive session, which did nothing while a model

package/README.md

@@ -77,18 +77,20 @@ prompt as an argument, or use `--input <file>`.
 
 ## Commands
 
-| Command                                                                                     | What it does                                                               |
-| ------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
-| `mafdet doctor`                                                                             | One pass over key, endpoints, model, tool-calling, balance, workspace, git |
-| `mafdet models list [--surface chat\|embeddings\|speech] [--agent]`                         | Models this key can call, joined with catalogue metadata                   |
-| `mafdet models show <id>`                                                                   | One model in detail, including whether the agent may drive it              |
-| `mafdet chat [prompt] [--model] [--system <file>] [--input <file>] [--no-stream] [--quiet]` | Send a prompt; streams by default                                          |
-| `mafdet agent "<goal>" [--allow-write] [--allow-command "<prefix>"]`                        | Local agent; read-only unless told otherwise                               |
-| `mafdet agent` (no goal, needs a terminal)                                                  | Interactive session                                                        |
-| `mafdet embed [text\|<file>] --model <id> [--output <file>]`                                | Text to vector                                                             |
-| `mafdet speech [text\|<file>] --model <id> --output <file> --voice <name>`                  | Text to an audio file                                                      |
-| `mafdet account balance\|usage\|subscription`                                               | Wallet, spend and plan (needs the `account:read` scope)                    |
-| `mafdet config list`                                                                        | The resolved settings and where each came from                             |
+| Command                                                                                              | What it does                                                               |
+| ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| `mafdet doctor`                                                                                      | One pass over key, endpoints, model, tool-calling, balance, workspace, git |
+| `mafdet models list [--surface chat\|embeddings\|speech] [--agent]`                                  | Models this key can call, joined with catalogue metadata                   |
+| `mafdet models show <id>`                                                                            | One model in detail, including whether the agent may drive it              |
+| `mafdet chat [prompt] [--model] [--system <file>] [--input <file>] [--no-stream] [--quiet] [--save]` | Send a prompt; streams by default                                          |
+| `mafdet agent "<goal>" [--allow-write] [--allow-command "<prefix>"]`                                 | Local agent; read-only unless told otherwise                               |
+| `mafdet agent` (no goal, needs a terminal)                                                           | Interactive session                                                        |
+| `mafdet embed [text\|<file>] --model <id> [--output <file>]`                                         | Text to vector                                                             |
+| `mafdet speech [text\|<file>] --model <id> --output <file> --voice <name>`                           | Text to an audio file                                                      |
+| `mafdet account balance\|usage\|subscription`                                                        | Wallet, spend and plan (needs the `account:read` scope)                    |
+| `mafdet sessions list\|show\|usage\|delete`                                                          | Conversations saved on this computer (never calls a model)                 |
+| `mafdet sessions usage <id> --refresh`                                                               | Replace the local estimate with the billing ledger's figure                |
+| `mafdet config list`                                                                                 | The resolved settings and where each came from                             |
 
 `--json` on any query command emits one complete JSON document; `--plain`
 emits tab-separated rows with no header, for `cut` and `awk`.
@@ -181,6 +183,71 @@ flag: it would put the key into shell history and the process list. Keys are
 never written to a config file and never printed in full — only as a
 fingerprint like `sk-mafdet-live-<redacted>`.
 
+## Saved conversations
+
+Interactive sessions are saved on this computer, and only on this computer.
+They are not uploaded, and Mafdet holds no copy of them.
+
+That is a statement about the transcript, not about the model. The messages you
+send are still sent to the API to be answered and still appear in your usage
+records; what stays local is the saved copy.
+
+Where they live:
+
+| Platform    | Path                                                |
+| ----------- | --------------------------------------------------- |
+| Linux / WSL | `${XDG_STATE_HOME:-~/.local/state}/mafdet/sessions` |
+| macOS       | `~/Library/Application Support/mafdet/sessions`     |
+| Windows     | `%LOCALAPPDATA%\mafdet\sessions`                    |
+
+The files are **plain text**. A transcript contains your messages, the model's
+replies, and any source the agent read while working — so treat a session
+directory the way you would treat the project it came from. API keys are the
+one exception: everything is passed through redaction on the way to disk, so a
+key you paste into a prompt is stored as `<redacted>`. Files are created
+`0600` and directories `0700` on Linux and macOS; Windows has no equivalent
+mode bits and inherits the ACL of `%LOCALAPPDATA%`.
+
+The agent cannot read these directories, even when you run `mafdet` from your
+home directory and the store is technically inside the workspace. Otherwise an
+agent working on one project could read another project's transcript in full.
+
+Turning it off and cleaning up:
+
+```bash
+mafdet --no-history            # this run is not recorded at all
+mafdet chat "..." --save       # a one-shot chat is saved only when asked
+mafdet sessions list           # what is saved, and the path when nothing is
+mafdet sessions delete <id> --yes
+```
+
+A single `mafdet chat` is not a conversation anyone resumes, so it is not
+recorded unless `--save` is given. `--no-history` still wins over `--save`, and
+a chat cancelled with Ctrl+C is not saved at all — half a reply is a worse
+record than none.
+
+`--no-history` writes nothing — not an empty directory, not an index entry.
+
+Deleting removes the local messages and this session's usage mapping. It does
+**not** remove API usage, billing records or charges: those belong to the API
+key, not to the transcript. And it is an ordinary file delete, not a secure
+erase — backups, snapshots and the filesystem itself may still hold copies.
+
+## Reconciling what a session cost
+
+`mafdet sessions usage <id>` adds up what a conversation used from the local
+record. Those charges are estimates, computed with the gateway's own
+arithmetic but computed here.
+
+`--refresh` asks the billing ledger for the real figure. It sends the request
+IDs already in the transcript and nothing else — no messages, no title, no
+workspace, no session ID. Requests paid for by a different API key are left
+alone and reported, so you know to run it again with that key.
+
+A request that the ledger has not caught up with stays `pending`, and a request
+that never returned an ID stays `unknown`. Neither is ever shown as `0`, which
+would read as "it was free".
+
 ## Cost and cancellation
 
 `chat` prints tokens and an estimated charge to stderr, computed with the same

package/README.zh-CN.md

@@ -60,18 +60,20 @@ mafdet doctor
 
 ## 命令
 
-| 命令                                                                                        | 作用                                                                |
-| ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
-| `mafdet doctor`                                                                             | 一次检查 Node、两个端点、Key、工作区、git、模型与工具调用能力、余额 |
-| `mafdet models list [--surface chat\|embeddings\|speech] [--agent]`                         | 这把 Key 能调用的模型，并附上目录元数据                             |
-| `mafdet models show <id>`                                                                   | 单个模型详情，含 Agent 是否可以驱动它                               |
-| `mafdet chat [提示词] [--model] [--system <文件>] [--input <文件>] [--no-stream] [--quiet]` | 发一次对话，默认流式                                                |
-| `mafdet embed [文本\|<文件>] --model <id> [--output <文件>]`                                | 文本转向量                                                          |
-| `mafdet speech [文本\|<文件>] --model <id> --output <文件> --voice <音色>`                  | 文本转音频                                                          |
-| `mafdet agent "<目标>" [--allow-write] [--allow-command "<前缀>"]`                          | 本地 Agent，默认只读                                                |
-| `mafdet agent`（不带目标，需终端）                                                          | 交互会话                                                            |
-| `mafdet account balance\|usage\|subscription`                                               | 钱包、用量、套餐（需 `account:read` scope）                         |
-| `mafdet config list`                                                                        | 当前生效的配置及其来源                                              |
+| 命令                                                                                                 | 作用                                                                |
+| ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
+| `mafdet doctor`                                                                                      | 一次检查 Node、两个端点、Key、工作区、git、模型与工具调用能力、余额 |
+| `mafdet models list [--surface chat\|embeddings\|speech] [--agent]`                                  | 这把 Key 能调用的模型，并附上目录元数据                             |
+| `mafdet models show <id>`                                                                            | 单个模型详情，含 Agent 是否可以驱动它                               |
+| `mafdet chat [提示词] [--model] [--system <文件>] [--input <文件>] [--no-stream] [--quiet] [--save]` | 发一次对话，默认流式                                                |
+| `mafdet embed [文本\|<文件>] --model <id> [--output <文件>]`                                         | 文本转向量                                                          |
+| `mafdet speech [文本\|<文件>] --model <id> --output <文件> --voice <音色>`                           | 文本转音频                                                          |
+| `mafdet agent "<目标>" [--allow-write] [--allow-command "<前缀>"]`                                   | 本地 Agent，默认只读                                                |
+| `mafdet agent`（不带目标，需终端）                                                                   | 交互会话                                                            |
+| `mafdet account balance\|usage\|subscription`                                                        | 钱包、用量、套餐（需 `account:read` scope）                         |
+| `mafdet sessions list\|show\|usage\|delete`                                                          | 保存在这台电脑上的会话（不会调用模型）                              |
+| `mafdet sessions usage <id> --refresh`                                                               | 用账单账本的权威金额替换本地估算                                    |
+| `mafdet config list`                                                                                 | 当前生效的配置及其来源                                              |
 
 查询类命令都支持 `--json`（输出一份完整 JSON 文档）与 `--plain`（无表头的 TSV，方便
 `cut`、`awk` 处理）。
@@ -156,6 +158,61 @@ Key 只从 `MAFDET_API_KEY` 读取。**刻意不提供 `--api-key` 参数**—
 shell 历史和进程列表。Key 不会被写入任何配置文件，也不会完整出现在任何输出里，
 只以 `sk-mafdet-live-<redacted>` 这样的指纹形式展示。
 
+## 保存下来的会话
+
+交互式会话会保存在这台电脑上，**也只在这台电脑上**。它们不会上传，Mafdet 没有副本。
+
+这是关于**存档**的说法，不是关于模型的。你发送的消息仍然会送到 API 去作答，
+仍然出现在你的用量记录里；留在本地的是那份保存下来的副本。
+
+存放位置：
+
+| 平台        | 路径                                                |
+| ----------- | --------------------------------------------------- |
+| Linux / WSL | `${XDG_STATE_HOME:-~/.local/state}/mafdet/sessions` |
+| macOS       | `~/Library/Application Support/mafdet/sessions`     |
+| Windows     | `%LOCALAPPDATA%\mafdet\sessions`                    |
+
+这些文件是**明文**。一份存档包含你的消息、模型的回复，以及 agent 工作时读过的任何源码——
+所以请把会话目录当作它所对应的那个项目本身来对待。API Key 是唯一的例外：
+所有内容在写盘前都会过一遍脱敏，你粘进提示词里的 Key 会以 `<redacted>` 的形式存下来。
+Linux 与 macOS 上文件权限 `0600`、目录 `0700`；**Windows 没有等价的权限位**，
+继承 `%LOCALAPPDATA%` 的 ACL。
+
+**Agent 读不到这些目录**——即使你在家目录里运行 `mafdet`、存档实际落在工作区内也一样。
+否则在 A 项目里工作的 agent 就能读到 B 项目会话的完整明文。
+
+关闭与清理：
+
+```bash
+mafdet --no-history            # 这一次运行完全不记录
+mafdet chat "..." --save       # 一次性对话只有明确要求时才保存
+mafdet sessions list           # 已保存的会话；没有时会告诉你路径
+mafdet sessions delete <id> --yes
+```
+
+一次 `mafdet chat` 不是有人会去恢复的对话，所以**不带 `--save` 就不保存**。
+`--no-history` 仍然压过 `--save`；被 Ctrl+C 取消的对话**完全不保存**——
+半个回复是比没有更糟的记录。
+
+`--no-history` 什么都不留——不留空目录，也不留索引条目。
+
+删除会移除本地消息和这个会话的用量映射。它**不会**移除 API 用量、账单记录或扣费：
+那些属于 API Key，不属于存档。而且它只是一次普通的文件删除，**不是安全擦除**——
+备份、快照和文件系统本身仍可能保有副本。
+
+## 对账：这次会话到底花了多少
+
+`mafdet sessions usage <id>` 从本地记录累加一次会话的用量。那些金额是**估算**，
+算法与网关一致，但是在本地算的。
+
+`--refresh` 会去问账单账本要真实金额。它只发送存档里已有的 request ID，**别的什么都不发**——
+不发消息、不发标题、不发工作区路径、不发 session ID。由另一把 API Key 支付的请求会被跳过
+并如实告知，好让你知道该换那把 Key 再跑一次。
+
+账本还没跟上的请求保持 `pending`，从未拿到 ID 的请求保持 `unknown`。
+**两者都绝不显示为 `0`**——0 读起来像「免费」。
+
 ## 费用与取消
 
 `chat` 会在 stderr 打印 token 数与预估费用，算法与网关计费一致，但**以钱包为准**。

package/dist/agent/context-budget.d.ts

@@ -0,0 +1,37 @@
+import type { ChatMessage } from "./loop.js";
+/**
+ * Fraction of the usable window at which we start shortening.
+ *
+ * Not 1.0, and the gap is not caution for its own sake: the request that
+ * measured `prompt_tokens` is smaller than the next one will be, because the
+ * assistant reply, its tool results and the next user message all land in
+ * between and none of them are counted yet.
+ */
+export declare const COMPACT_AT = 0.75;
+/** Room left for the reply, which shares the window with the input. */
+export declare function replyReserve(contextLength: number): number;
+/** Tool exchanges kept whatever happens, so the recent work stays intact. */
+export declare const KEEP_RECENT_EXCHANGES = 2;
+/**
+ * Is the conversation close enough to the window to shorten it?
+ *
+ * `lastPromptTokens` is what the provider counted for the previous request in
+ * this run. Zero means nothing has been measured yet, and an unknown window
+ * means we have nothing to compare against.
+ */
+export declare function shouldCompact(contextLength: number | undefined, lastPromptTokens: number): boolean;
+export interface PruneResult {
+    /** Messages removed from the array. */
+    readonly removed: number;
+    /** Complete tool exchanges dropped. */
+    readonly exchanges: number;
+}
+/**
+ * Drop the oldest complete tool exchanges, in place.
+ *
+ * The system prompt and the opening goal are never touched - without the goal
+ * the model no longer knows what it is doing, which is a worse failure than
+ * running out of context.
+ */
+export declare function pruneToolExchanges(history: ChatMessage[], keepRecent?: number): PruneResult;
+//# sourceMappingURL=context-budget.d.ts.map

package/dist/agent/context-budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-budget.d.ts","sourceRoot":"","sources":["../../src/agent/context-budget.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAKT;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAsCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,WAAW,CAkBb"}

package/dist/agent/context-budget.js

@@ -0,0 +1,105 @@
+// §7.4 · Keeping a long run inside the model's context window.
+//
+// The plan asks for "总上下文按模型窗口设置预算，接近上限时压缩历史". Two decisions
+// shape what that can honestly be:
+//
+// The size of the history is *measured*, not estimated. Every response carries
+// `prompt_tokens` for the request that produced it, which is the provider's own
+// count of exactly the conversation we sent. Estimating instead would mean
+// shipping a tokenizer per provider - CLI-000B already found the gateway's own
+// reservation under-counts badly because it cannot see the tool schema, and a
+// second wrong estimate here would be no better.
+//
+// And what gets dropped is whole tool exchanges, never individual messages.
+// CLI-014 established the rule the hard way: an assistant message carrying
+// `tool_calls` and the `tool` results answering them are inseparable, because
+// the API rejects a tool result with no matching call and a call with no
+// result. So the unit of removal is the pair, or nothing.
+//
+// When the model's context length is unknown, nothing happens at all. A guess
+// at the window would either truncate a conversation that fit, or fail to
+// truncate one that did not.
+/**
+ * Fraction of the usable window at which we start shortening.
+ *
+ * Not 1.0, and the gap is not caution for its own sake: the request that
+ * measured `prompt_tokens` is smaller than the next one will be, because the
+ * assistant reply, its tool results and the next user message all land in
+ * between and none of them are counted yet.
+ */
+export const COMPACT_AT = 0.75;
+/** Room left for the reply, which shares the window with the input. */
+export function replyReserve(contextLength) {
+    return Math.min(4096, Math.floor(contextLength / 8));
+}
+/** Tool exchanges kept whatever happens, so the recent work stays intact. */
+export const KEEP_RECENT_EXCHANGES = 2;
+/**
+ * Is the conversation close enough to the window to shorten it?
+ *
+ * `lastPromptTokens` is what the provider counted for the previous request in
+ * this run. Zero means nothing has been measured yet, and an unknown window
+ * means we have nothing to compare against.
+ */
+export function shouldCompact(contextLength, lastPromptTokens) {
+    if (contextLength === undefined || contextLength <= 0)
+        return false;
+    if (lastPromptTokens <= 0)
+        return false;
+    const usable = contextLength - replyReserve(contextLength);
+    return usable > 0 && lastPromptTokens >= usable * COMPACT_AT;
+}
+/**
+ * The assistant-with-tool_calls messages and the tool results that answer them.
+ *
+ * An exchange is only counted when every one of its calls has a result: a
+ * partial one is the tail of a run still in progress, and removing half of it
+ * is precisely the shape the API refuses.
+ */
+function exchangesIn(history) {
+    const found = [];
+    for (let i = 0; i < history.length; i += 1) {
+        const message = history[i];
+        if (message === undefined)
+            continue;
+        const calls = message.role === "assistant" ? message.tool_calls : undefined;
+        if (calls === undefined || calls.length === 0)
+            continue;
+        const answered = new Set();
+        let end = i + 1;
+        while (end < history.length && history[end]?.role === "tool") {
+            const id = history[end]?.tool_call_id;
+            if (typeof id === "string")
+                answered.add(id);
+            end += 1;
+        }
+        if (calls.every((call) => answered.has(call.id))) {
+            found.push({ start: i, end });
+        }
+        i = end - 1;
+    }
+    return found;
+}
+/**
+ * Drop the oldest complete tool exchanges, in place.
+ *
+ * The system prompt and the opening goal are never touched - without the goal
+ * the model no longer knows what it is doing, which is a worse failure than
+ * running out of context.
+ */
+export function pruneToolExchanges(history, keepRecent = KEEP_RECENT_EXCHANGES) {
+    const exchanges = exchangesIn(history);
+    const droppable = exchanges.slice(0, Math.max(0, exchanges.length - keepRecent));
+    if (droppable.length === 0)
+        return { removed: 0, exchanges: 0 };
+    const drop = new Set();
+    for (const exchange of droppable) {
+        for (let i = exchange.start; i < exchange.end; i += 1)
+            drop.add(i);
+    }
+    const kept = history.filter((_, index) => !drop.has(index));
+    const removed = history.length - kept.length;
+    history.length = 0;
+    history.push(...kept);
+    return { removed, exchanges: droppable.length };
+}

package/dist/agent/loop.d.ts

@@ -88,10 +88,35 @@ export type AgentEvent = {
 } | {
     type: "text";
     text: string;
+}
+/**
+ * One model request's accounting, as it happens. The summary already
+ * aggregates this; the event exists so a recorder can attribute each request
+ * to the ledger row it became (CLI-024/025) - `requestId` is the gateway's
+ * x-litellm-call-id, which is unique per row in request_ledger.
+ */
+ | {
+    type: "usage";
+    model: string;
+    requestId?: string;
+    promptTokens: number;
+    completionTokens: number;
+    costMicroUsd: bigint;
 } | {
     type: "rate_limited";
     waitMs: number;
     attempt: number;
+}
+/**
+ * §7.4 · The history was shortened to stay inside the model's window.
+ * Surfaced rather than done quietly: the user is entitled to know that
+ * earlier tool output is no longer being sent.
+ */
+ | {
+    type: "compacted";
+    exchanges: number;
+    messages: number;
+    promptTokens: number;
 };
 export interface ChatMessage {
     role: "system" | "user" | "assistant" | "tool";

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAUD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAyH1E;AAmID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAYD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAyJ1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR"}

package/dist/agent/loop.js

@@ -1,4 +1,5 @@
 import { ApiError } from "../api/errors.js";
+import { pruneToolExchanges, shouldCompact } from "./context-budget.js";
 import { toolToJsonSchema, } from "./tools/types.js";
 /** Plan §7.4. */
 export const DEFAULT_LIMITS = {
@@ -44,6 +45,8 @@ export async function runAgent(options) {
         completionTokens: 0,
         costMicroUsd: 0n,
     };
+    /** What the provider counted for the previous request; 0 until one lands. */
+    let lastPromptTokens = 0;
     for (let turn = 1; turn <= limits.maxTurns; turn += 1) {
         if (options.signal?.aborted)
             return stop(report, "cancelled");
@@ -55,6 +58,22 @@ export async function runAgent(options) {
         }
         report.turns = turn;
         options.onEvent?.({ type: "turn", turn });
+        // §7.4 · Shorten before asking, using what the provider counted last time.
+        // Only whole tool exchanges go, and only when the window is known.
+        if (shouldCompact(options.pricing?.contextLength, lastPromptTokens)) {
+            const pruned = pruneToolExchanges(messages);
+            if (pruned.exchanges > 0) {
+                options.onEvent?.({
+                    type: "compacted",
+                    exchanges: pruned.exchanges,
+                    messages: pruned.removed,
+                    promptTokens: lastPromptTokens,
+                });
+                // Reset the measurement: the next response measures the shorter
+                // history, and reusing the old figure would compact again every turn.
+                lastPromptTokens = 0;
+            }
+        }
         let response;
         try {
             response = await requestWithRateLimitHandling(options, limits, {
@@ -74,11 +93,23 @@ export async function runAgent(options) {
             return stop(report, "error", error instanceof Error ? error.message : String(error));
         }
         const usage = response.usage;
+        lastPromptTokens = usage?.prompt_tokens ?? lastPromptTokens;
         report.promptTokens += usage?.prompt_tokens ?? 0;
         report.completionTokens += usage?.completion_tokens ?? 0;
         // Cost comes from returned usage, never from the reservation: CLI-000B
         // showed the reserve cannot see the tool schema and under-counts badly.
-        report.costMicroUsd += priceTurn(options.pricing, usage);
+        const turnCost = priceTurn(options.pricing, usage);
+        report.costMicroUsd += turnCost;
+        options.onEvent?.({
+            type: "usage",
+            model: options.model,
+            ...(response.requestId === undefined
+                ? {}
+                : { requestId: response.requestId }),
+            promptTokens: usage?.prompt_tokens ?? 0,
+            completionTokens: usage?.completion_tokens ?? 0,
+            costMicroUsd: turnCost,
+        });
         const choice = response.choices?.[0];
         const message = choice?.message;
         const calls = message?.tool_calls ?? [];
@@ -198,8 +229,10 @@ async function requestWithRateLimitHandling(options, limits, body, report, clock
     for (let attempt = 0;; attempt += 1) {
         try {
             report.modelRequests += 1;
-            const { data } = await options.client.postJson("/chat/completions", body, { signal: options.signal });
-            return data;
+            const { data, requestId } = await options.client.postJson("/chat/completions", body, { signal: options.signal });
+            // Carried on the response so the caller can tie this turn to its ledger
+            // row without the loop needing to know what a session is.
+            return { ...data, requestId };
         }
         catch (error) {
             // Everything except an explicit 429 propagates. A timeout or a 5xx may

package/dist/agent/session.d.ts

@@ -32,6 +32,11 @@ export interface SessionOptions {
      * the same events are drawn.
      */
     onEvent?: (event: AgentEvent) => void;
+    /**
+     * A conversation to continue, rebuilt from a saved session (CLI-024).
+     * Appended to in place, exactly as the fresh array would be.
+     */
+    history?: ChatMessage[];
 }
 export interface SessionSummary {
     goals: number;

package/dist/agent/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/agent/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAY,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAapE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,oEAAoE;IACpE,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAwFzB;AAgHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CA2B7D"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/agent/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAY,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAapE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,oEAAoE;IACpE,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAwFzB;AAgHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CA2B7D"}

package/dist/agent/session.js

@@ -22,7 +22,7 @@ Anything else is sent to the model as the next goal.
  * rather than the last question.
  */
 export async function runSession(options) {
-    const history = [];
+    const history = options.history ?? [];
     const summary = {
         goals: 0,
         turns: 0,

package/dist/agent/tools/read-only.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-only.d.ts","sourceRoot":"","sources":["../../../src/agent/tools/read-only.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAe,cAAc,EAAE,MAAM,YAAY,CAAC;AAmB9D;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAYjD;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuBjD;AAmLD,eAAO,MAAM,eAAe,EAAE,cAAc,EAM3C,CAAC"}
+{"version":3,"file":"read-only.d.ts","sourceRoot":"","sources":["../../../src/agent/tools/read-only.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAe,cAAc,EAAE,MAAM,YAAY,CAAC;AAmB9D;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAYjD;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuBjD;AAwLD,eAAO,MAAM,eAAe,EAAE,cAAc,EAM3C,CAAC"}

package/dist/agent/tools/read-only.js

@@ -87,6 +87,12 @@ function walk(workspace, onFile) {
             if (entry.isDirectory()) {
                 if (SKIPPED_DIRECTORIES.has(entry.name))
                     continue;
+                // The CLI's own directories, uniformly. Dot-directories are skipped
+                // anyway, which covers Linux and Windows by accident - but on macOS
+                // the state directory is `Library/Application Support/mafdet`, so
+                // without this the session ids would be listed there and nowhere else.
+                if (workspace.isOwnedByCli(full))
+                    continue;
                 stack.push(full);
                 continue;
             }

package/dist/agent/tools/run-command.d.ts

@@ -15,6 +15,34 @@ export interface CommandResult {
  * failure mode where a "timed out" test run keeps holding a port.
  */
 export declare function executeCommand(argv: readonly string[], cwd: string, timeoutMs?: number): Promise<CommandResult>;
+/**
+ * What "kill the whole tree" means on this platform.
+ *
+ * Pure, and separated from doing it, because the Windows branch cannot be
+ * executed here: there is no Windows machine in this project, and a kill path
+ * that has never run is exactly the kind of code that is wrong in a way only
+ * production finds. Keeping the decision pure means the *shape* of the command
+ * is under test on both platforms even though only one of them can be run.
+ *
+ * POSIX: a negative pid signals the process group, which is why the child is
+ * spawned detached. Killing the parent alone leaves grandchildren running -
+ * the familiar case where a "timed out" test runner keeps holding a port.
+ *
+ * Windows has no process groups in that sense. `taskkill /T` walks the child
+ * tree instead, and `/F` is the forceful pass: without it taskkill asks
+ * politely, which a console process is free to ignore - the same distinction
+ * as SIGTERM and SIGKILL.
+ */
+export type KillPlan = {
+    readonly kind: "signal";
+    readonly target: number;
+    readonly signal: NodeJS.Signals;
+} | {
+    readonly kind: "spawn";
+    readonly command: string;
+    readonly args: readonly string[];
+};
+export declare function killPlan(pid: number, force: boolean, platform?: string): KillPlan;
 export declare const runCommandTool: ToolDefinition;
 export declare const COMMAND_TOOLS: ToolDefinition[];
 //# sourceMappingURL=run-command.d.ts.map