@mafdet/cli 0.4.3 → 0.4.4

package/CHANGELOG.md

@@ -6,6 +6,70 @@ The version is the contract for the JSON output shapes and the exit codes.
 Being 0.x, semver still permits a break in a minor bump; the intent is not to
 use that latitude, and the promise becomes binding at 1.0.0.
 
+## 0.4.4 - 2026-08-11
+
+A security fix and twenty-one other corrections, all from an external audit of
+the 0.4.3 release.
+
+**Session ids are now checked before they become paths.** `mafdet sessions
+show`, `usage`, `delete` and `--resume` each joined whatever you typed onto
+the sessions directory, and `join` resolves `..` - so an id like
+`../../../something` reached outside the store. Reading it leaked another
+directory's contents, and `sessions delete ../../../something --yes` removed
+that directory's files. This was present from 0.3.0. It requires you (or a
+script running as you) to pass such a path - the agent has no way to invoke
+these commands - but it was a real destructive defect and it is fixed.
+
+**Resuming a conversation now honours what it says.** Blockers were computed
+and printed and then ignored, so a session whose workspace had been deleted,
+or whose model your key can no longer call, continued anyway - and it
+continued in your _current_ directory rather than the recorded one, which with
+`--allow-write` meant carrying one project's conversation into another
+project's files. A resumed session now runs where it was recorded, on the
+model it was recorded with, and refuses when it cannot.
+
+**Deleting reports what happened.** Every failure used to be swallowed and
+"deleted" printed regardless. It now takes the session lock first and only
+claims success when the directory is gone.
+
+**`--read-only` works in the interactive session.** It existed only in `mafdet
+agent`, so `mafdet --allow-write --read-only` was read-only there and
+write-enabled here.
+
+**Streams have limits.** The request timeout was cleared when the response
+headers arrived, which for a stream is the beginning: a gateway that then went
+quiet hung the CLI indefinitely. There is now a per-chunk idle deadline and a
+byte cap, and both close the connection.
+
+**Terminal control sequences.** A model's reply and a session's title, model
+and workspace are stripped of escape sequences when a terminal is reading
+them. Redirected output still receives exact bytes.
+
+**Context compaction covers conversations without tools**, and when nothing
+can safely be dropped the run stops and says so instead of sending a request
+that is over the window.
+
+**An unpriced request is no longer recorded as costing zero** - unknown and
+free are different claims.
+
+**`approvalMode` and `testCommands` are removed from the config.** They were
+accepted, displayed by `config list`, and read by nothing, so setting
+`auto-edit` looked like it turned approval off. They are removed rather than
+implemented because in a project file both would let a cloned repository raise
+its own permission level. Setting one is now an error explaining why.
+
+**A damaged line in the middle of a transcript is reported** rather than
+skipped in silence, and resuming from one is refused.
+
+Also: `mafdet agent` gains `--title` and `--no-history` (`--resume` stays in
+the interactive session and now says so); the model picker highlights the
+default you saved; `sessions` refuses unknown flags and stray arguments
+instead of ignoring them; `--json --plain` prints a usage error rather than a
+stack trace; the resume lock is released on exit; `mafdet help` describes what
+the agent can actually do; and the README states plainly that approving a
+command means allowing that program to run as you - the workspace bounds the
+agent's own tools, not the program, and is not a sandbox.
+
 ## 0.4.3 - 2026-08-11
 
 A long agent run no longer walks into the model's context window, a one-shot

package/README.md

@@ -3,7 +3,7 @@
 The official Mafdet AI command line: model calls, account queries, and a
 permissioned local agent.
 
-> **0.4.1.** 中文版见 [README.zh-CN.md](./README.zh-CN.md). The CLI never
+> **0.4.4.** 中文版见 [README.zh-CN.md](./README.zh-CN.md). The CLI never
 > advertises a command it cannot serve, so `mafdet help` always lists exactly
 > what works.
 >
@@ -25,8 +25,8 @@ Or build it from this repository:
 
 ```bash
 pnpm --filter @mafdet/cli build
-cd packages/cli && npm pack          # -> mafdet-cli-0.4.1.tgz
-npm install -g ./mafdet-cli-0.4.1.tgz
+cd packages/cli && npm pack          # -> mafdet-cli-0.4.4.tgz
+npm install -g ./mafdet-cli-0.4.4.tgz
 ```
 
 ## The interactive session
@@ -113,6 +113,16 @@ prefixes: `pnpm test` permits `pnpm test --filter web` but never `pnpm publish`.
 `;`, `&&`, backticks and `$( )` are refused with an explanation rather than
 sanitised.
 
+**What approving a command means.** It means allowing that program to run on
+your machine, as you. The workspace bounds which files the agent's own tools
+may touch; it is not a sandbox, and it does not bound the program. `pnpm test`
+can read your home directory, reach the network, or start something that
+outlives the run - because that is what running a program is. A short list of
+obviously destructive names is refused (`sudo`, `su`, `doas`, `chown`,
+`shutdown`, `reboot`, and invoking a program by path), but treat that as a
+guard against slips rather than as containment. Approve prefixes the way you
+would run the command yourself.
+
 In a session: `/model`, `/permissions`, `/diff`, `/cost`, `/compact`, `/exit`.
 
 ## Configuration
@@ -131,8 +141,8 @@ User config lives at `~/.config/mafdet/config.json` (Linux),
 `~/Library/Application Support/mafdet/config.json` (macOS) or
 `%APPDATA%\mafdet\config.json` (Windows).
 
-A project may carry `.mafdet.json` with `model`, `approvalMode` and
-`testCommands` — and nothing else. Credentials and endpoints in a project file
+A project may carry `.mafdet.json` with `model` — and nothing else.
+Credentials and endpoints in a project file
 are rejected outright: cloning a repository must never change where your key
 is sent.
 

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 Mafdet AI 官方命令行：模型调用、账户查询，以及一个受权限约束的本地 Agent。
 
-> **0.4.1。** 英文版见 [README.md](./README.md)。
+> **0.4.4。** 英文版见 [README.md](./README.md)。
 
 ## 环境要求
 
@@ -94,6 +94,13 @@ mafdet doctor
 **没有 shell**：命令被切成 argv 直接执行，所以管道、重定向、`;`、`&&`、反引号、`$( )`
 一律被拒绝并说明原因，而不是尝试"消毒"。
 
+**批准一条命令意味着什么。** 意味着允许那个程序在你的机器上、以你的身份运行。
+工作区限定的是 **Agent 自己的工具**能碰哪些文件，它**不是沙箱**，也约束不了那个程序。
+`pnpm test` 可以读你的家目录、可以联网、可以起一个比这次运行活得更久的进程——
+因为那就是"运行一个程序"的含义。我们会拒绝一小份明显破坏性的名字
+（`sudo`、`su`、`doas`、`chown`、`shutdown`、`reboot`，以及按路径调用），
+但请把它当作**防手滑的护栏，而不是隔离**。批准前缀时，请按"我自己会不会直接敲这条命令"来判断。
+
 会话内命令：`/model`、`/permissions`、`/diff`、`/cost`、`/compact`、`/exit`。
 
 ## 配置
@@ -111,7 +118,7 @@ mafdet doctor
 用户配置位置：Linux `~/.config/mafdet/config.json`、macOS
 `~/Library/Application Support/mafdet/config.json`、Windows `%APPDATA%\mafdet\config.json`。
 
-项目可以放一个 `.mafdet.json`，但**只允许** `model`、`approvalMode`、`testCommands` 三项。
+项目可以放一个 `.mafdet.json`，但**只允许 `model` 一项**。
 里面出现凭据或端点会**直接报错**：克隆一个仓库绝不该改变你的 Key 发往哪里。
 
 ## 退出码

package/dist/agent/context-budget.d.ts

@@ -34,4 +34,36 @@ export interface PruneResult {
  * running out of context.
  */
 export declare function pruneToolExchanges(history: ChatMessage[], keepRecent?: number): PruneResult;
+/**
+ * F-008 · Drop the oldest whole turns.
+ *
+ * The exchange-based prune above cannot help a conversation with no tools in
+ * it - a long back-and-forth of plain questions removed nothing and carried on
+ * requesting, so "a long run no longer walks into the context window" was only
+ * true for tool-using runs.
+ *
+ * A turn starts at a user message and runs to just before the next one, so
+ * cutting on that boundary can never orphan a tool result or leave a tool call
+ * unanswered: CLI-014's rule holds by construction. The system prompt and the
+ * first user message - the goal - always stay.
+ */
+export declare function dropOldestTurns(history: ChatMessage[], keepTurns: number): number;
+export interface CompactionResult extends PruneResult {
+    /** Whole turns dropped, when exchanges were not enough. */
+    readonly turns: number;
+    /** True when nothing could be dropped and the history is still too big. */
+    readonly exhausted: boolean;
+}
+/**
+ * Shorten the history as much as can be done safely.
+ *
+ * Tool exchanges go first because they are the bulk of a long agent run and
+ * the least useful to keep. Only when there are none left does it start
+ * dropping turns, which costs the model more context.
+ *
+ * `exhausted` is the honest outcome when neither helped: the caller must stop
+ * rather than send a request that is over the window, which would fail
+ * upstream and be billed for the attempt.
+ */
+export declare function compactForBudget(history: ChatMessage[], keepRecent?: number): CompactionResult;
 //# sourceMappingURL=context-budget.d.ts.map

package/dist/agent/context-budget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-budget.d.ts","sourceRoot":"","sources":["../../src/agent/context-budget.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAKT;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAsCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,WAAW,CAkBb"}
+{"version":3,"file":"context-budget.d.ts","sourceRoot":"","sources":["../../src/agent/context-budget.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAKT;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAsCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,WAAW,CAkBb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,EAAE,MAAM,GAChB,MAAM,CAuBR;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CAYlB"}

package/dist/agent/context-budget.js

@@ -103,3 +103,67 @@ export function pruneToolExchanges(history, keepRecent = KEEP_RECENT_EXCHANGES)
     history.push(...kept);
     return { removed, exchanges: droppable.length };
 }
+/**
+ * F-008 · Drop the oldest whole turns.
+ *
+ * The exchange-based prune above cannot help a conversation with no tools in
+ * it - a long back-and-forth of plain questions removed nothing and carried on
+ * requesting, so "a long run no longer walks into the context window" was only
+ * true for tool-using runs.
+ *
+ * A turn starts at a user message and runs to just before the next one, so
+ * cutting on that boundary can never orphan a tool result or leave a tool call
+ * unanswered: CLI-014's rule holds by construction. The system prompt and the
+ * first user message - the goal - always stay.
+ */
+export function dropOldestTurns(history, keepTurns) {
+    const userAt = [];
+    for (let i = 0; i < history.length; i += 1) {
+        if (history[i]?.role === "user")
+            userAt.push(i);
+    }
+    // The first user message is the goal and is not a droppable turn, so there
+    // have to be more than `keepTurns` turns after it before anything can go.
+    if (userAt.length <= keepTurns + 1)
+        return 0;
+    const cut = userAt[userAt.length - keepTurns];
+    if (cut === undefined)
+        return 0;
+    const kept = [];
+    if (history[0]?.role === "system")
+        kept.push(history[0]);
+    const goal = history[userAt[0]];
+    if (goal !== undefined && userAt[0] !== cut)
+        kept.push(goal);
+    kept.push(...history.slice(cut));
+    const removed = history.length - kept.length;
+    if (removed <= 0)
+        return 0;
+    history.length = 0;
+    history.push(...kept);
+    return removed;
+}
+/**
+ * Shorten the history as much as can be done safely.
+ *
+ * Tool exchanges go first because they are the bulk of a long agent run and
+ * the least useful to keep. Only when there are none left does it start
+ * dropping turns, which costs the model more context.
+ *
+ * `exhausted` is the honest outcome when neither helped: the caller must stop
+ * rather than send a request that is over the window, which would fail
+ * upstream and be billed for the attempt.
+ */
+export function compactForBudget(history, keepRecent = KEEP_RECENT_EXCHANGES) {
+    const pruned = pruneToolExchanges(history, keepRecent);
+    if (pruned.exchanges > 0) {
+        return { ...pruned, turns: 0, exhausted: false };
+    }
+    const turnsRemoved = dropOldestTurns(history, keepRecent);
+    return {
+        removed: turnsRemoved,
+        exchanges: 0,
+        turns: turnsRemoved > 0 ? 1 : 0,
+        exhausted: turnsRemoved === 0,
+    };
+}

package/dist/agent/loop.d.ts

@@ -12,7 +12,9 @@ export declare const DEFAULT_LIMITS: {
     maxCostMicroUsd: bigint | undefined;
 };
 export type AgentLimits = typeof DEFAULT_LIMITS;
-export type StopReason = "completed" | "max_turns" | "timeout" | "max_cost" | "cancelled" | "rate_limited" | "error";
+export type StopReason = "completed" | "max_turns" | "timeout" | "max_cost" | "cancelled" | "rate_limited"
+/** F-008 · Over the model's window with nothing left that is safe to drop. */
+ | "context_limit" | "error";
 export interface AgentReport {
     stopReason: StopReason;
     /** The model's last text answer, if it produced one. */
@@ -102,6 +104,11 @@ export type AgentEvent = {
     promptTokens: number;
     completionTokens: number;
     costMicroUsd: bigint;
+    /**
+     * F-012 · False when the catalogue had no price for this model, so a
+     * recorder can tell "we could not work it out" from "it was free".
+     */
+    priced: boolean;
 } | {
     type: "rate_limited";
     waitMs: number;

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAYD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAyJ1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc;AAChB,8EAA8E;GAC5E,eAAe,GACf,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAYD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAmK1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR"}

package/dist/agent/loop.js

@@ -1,5 +1,5 @@
 import { ApiError } from "../api/errors.js";
-import { pruneToolExchanges, shouldCompact } from "./context-budget.js";
+import { compactForBudget, shouldCompact } from "./context-budget.js";
 import { toolToJsonSchema, } from "./tools/types.js";
 /** Plan §7.4. */
 export const DEFAULT_LIMITS = {
@@ -59,20 +59,25 @@ export async function runAgent(options) {
         report.turns = turn;
         options.onEvent?.({ type: "turn", turn });
         // §7.4 · Shorten before asking, using what the provider counted last time.
-        // Only whole tool exchanges go, and only when the window is known.
         if (shouldCompact(options.pricing?.contextLength, lastPromptTokens)) {
-            const pruned = pruneToolExchanges(messages);
-            if (pruned.exchanges > 0) {
-                options.onEvent?.({
-                    type: "compacted",
-                    exchanges: pruned.exchanges,
-                    messages: pruned.removed,
-                    promptTokens: lastPromptTokens,
-                });
-                // Reset the measurement: the next response measures the shorter
-                // history, and reusing the old figure would compact again every turn.
-                lastPromptTokens = 0;
+            const compacted = compactForBudget(messages);
+            if (compacted.exhausted) {
+                // F-008 · Nothing left that can be dropped without breaking the
+                // conversation. Sending anyway means a request over the window, which
+                // fails upstream and is billed for the attempt - stopping and saying
+                // so is the only honest option.
+                return stop(report, "context_limit", `the conversation no longer fits in ${options.model}'s context window ` +
+                    `(${lastPromptTokens} input tokens last turn) and cannot be shortened further`);
             }
+            options.onEvent?.({
+                type: "compacted",
+                exchanges: compacted.exchanges,
+                messages: compacted.removed,
+                promptTokens: lastPromptTokens,
+            });
+            // Reset the measurement: the next response measures the shorter
+            // history, and reusing the old figure would compact again every turn.
+            lastPromptTokens = 0;
         }
         let response;
         try {
@@ -109,6 +114,7 @@ export async function runAgent(options) {
             promptTokens: usage?.prompt_tokens ?? 0,
             completionTokens: usage?.completion_tokens ?? 0,
             costMicroUsd: turnCost,
+            priced: canPrice(options.pricing, usage),
         });
         const choice = response.choices?.[0];
         const message = choice?.message;
@@ -267,6 +273,12 @@ export function backoffMs(retryAfterSeconds, attempt, random = Math.random) {
     // Full jitter: a fleet of CLIs must not retry in lockstep.
     return Math.round(base * (0.5 + random() * 0.5));
 }
+/** F-012 · Whether `priceTurn` had everything it needed to give an answer. */
+function canPrice(model, usage) {
+    return (usage !== undefined &&
+        model?.inputPricePer1mMicroUsd !== undefined &&
+        model?.outputPricePer1mMicroUsd !== undefined);
+}
 function priceTurn(model, usage) {
     if (!model?.inputPricePer1mMicroUsd ||
         !model.outputPricePer1mMicroUsd ||

package/dist/agent/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/agent/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAY,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAapE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,oEAAoE;IACpE,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAwFzB;AAgHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CA2B7D"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/agent/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAY,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAapE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,oEAAoE;IACpE,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA8FzB;AAgHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CA2B7D"}

package/dist/agent/session.js

@@ -80,7 +80,13 @@ export async function runSession(options) {
                 history,
                 approver: options.approver,
                 signal: options.signal,
-                onEvent: options.onEvent ?? ((event) => reportEvent(event, options)),
+                // Both, not either: `onEvent` was replacing the progress display, so
+                // attaching a recorder would have silently blanked the terminal. An
+                // observer is an addition to the rendering, never a substitute for it.
+                onEvent: (event) => {
+                    reportEvent(event, options);
+                    options.onEvent?.(event);
+                },
             });
             summary.turns += report.turns;
             summary.modelRequests += report.modelRequests;

package/dist/api/http.d.ts

@@ -44,10 +44,24 @@ export declare class HttpClient {
     postJson<T>(path: string, body: unknown, options?: RequestOptions): Promise<HttpResponse<T>>;
     /** For `/v1/audio/speech`, which answers with audio bytes. */
     postBinary(path: string, body: unknown, options?: RequestOptions): Promise<HttpResponse<Uint8Array>>;
-    /** Raw streaming response, for the SSE reader to consume. */
+    /**
+     * Raw streaming response, for the SSE reader to consume.
+     *
+     * F-009 · Returns `abort` and the limits the reader should apply. The
+     * request timeout in `send` is cleared once the headers arrive - which for a
+     * stream is the start - so from here on the deadline belongs to whoever is
+     * reading the body, and it needs a way to close the connection rather than
+     * merely stop reading. Generation is what gets billed; dropping our end of
+     * a socket we are no longer reading does not stop it.
+     */
     postStream(path: string, body: unknown, options?: RequestOptions): Promise<{
         response: Response;
         requestId?: string;
+        abort: () => void;
+        limits: {
+            idleTimeoutMs: number;
+            maxBytes: number;
+        };
     }>;
     private send;
     private readJson;

package/dist/api/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/api/http.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAC1C,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC;IACR,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,EAAE,iBAAiB;IAShC,OAAO,CAAC,CAAC,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAKrB,QAAQ,CAAC,CAAC,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAK3B,8DAA8D;IACxD,UAAU,CACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAiBpC,6DAA6D;IACvD,UAAU,CACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;YASxC,IAAI;YA4DJ,QAAQ;YAuCR,SAAS;CAexB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAkCrB"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/api/http.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAC1C,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC;IACR,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,EAAE,iBAAiB;IAShC,OAAO,CAAC,CAAC,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAKrB,QAAQ,CAAC,CAAC,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAK3B,8DAA8D;IACxD,UAAU,CACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAiBpC;;;;;;;;;OASG;IACG,UAAU,CACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC;QACT,QAAQ,EAAE,QAAQ,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,IAAI,CAAC;QAClB,MAAM,EAAE;YAAE,aAAa,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;KACrD,CAAC;YA2BY,IAAI;YA4DJ,QAAQ;YAuCR,SAAS;CAexB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAkCrB"}

package/dist/api/http.js

@@ -49,15 +49,36 @@ export class HttpClient {
             requestId,
         };
     }
-    /** Raw streaming response, for the SSE reader to consume. */
+    /**
+     * Raw streaming response, for the SSE reader to consume.
+     *
+     * F-009 · Returns `abort` and the limits the reader should apply. The
+     * request timeout in `send` is cleared once the headers arrive - which for a
+     * stream is the start - so from here on the deadline belongs to whoever is
+     * reading the body, and it needs a way to close the connection rather than
+     * merely stop reading. Generation is what gets billed; dropping our end of
+     * a socket we are no longer reading does not stop it.
+     */
     async postStream(path, body, options = {}) {
-        const response = await this.send("POST", path, body, options, {
-            accept: "text/event-stream",
-        });
+        const streamController = new AbortController();
+        const response = await this.send("POST", path, body, {
+            ...options,
+            signal: options.signal
+                ? AbortSignal.any([options.signal, streamController.signal])
+                : streamController.signal,
+        }, { accept: "text/event-stream" });
         const requestId = requestIdOf(response.headers);
         if (!response.ok)
             throw await this.errorFrom(response, requestId, options);
-        return { response, requestId };
+        return {
+            response,
+            requestId,
+            abort: () => streamController.abort(),
+            limits: {
+                idleTimeoutMs: options.timeoutMs ?? this.timeoutMs,
+                maxBytes: options.maxBytes ?? this.maxBytes,
+            },
+        };
     }
     async send(method, path, body, options, extraHeaders = {}) {
         const url = `${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`;

package/dist/api/sse-parser.d.ts

@@ -62,11 +62,36 @@ export declare class ChatStreamAssembler {
     push(payload: string): boolean;
     result(): StreamResult;
 }
+/** F-009 · Limits that apply for the whole life of the stream. */
+export interface StreamLimits {
+    /**
+     * How long to wait for the *next* chunk, not for the whole stream. A total
+     * deadline would kill a legitimately long generation; what "hung" actually
+     * means is that nothing is arriving.
+     */
+    readonly idleTimeoutMs?: number;
+    /** Total bytes accepted before the stream is treated as hostile. */
+    readonly maxBytes?: number;
+    /**
+     * Closes the underlying connection. Cancelling the reader alone stops us
+     * reading; it does not reliably stop the gateway generating, and generation
+     * is what gets billed.
+     */
+    readonly abort?: () => void;
+}
+export declare const DEFAULT_STREAM_IDLE_MS = 120000;
+export declare const DEFAULT_STREAM_MAX_BYTES: number;
 /**
  * Read a streaming response to completion.
  *
  * `signal` is the user's Ctrl+C: aborting stops reading AND closes the
  * connection, which is what actually tells the gateway to stop generating.
+ *
+ * F-009 · The request timeout in `HttpClient` is cleared the moment the
+ * response headers arrive, which for a stream is the beginning rather than the
+ * end. Without the two limits below, a gateway that sent headers and then
+ * stopped would hang the CLI forever, and one that never stopped sending would
+ * grow the buffer until the process died.
  */
-export declare function readChatStream(response: Response, events?: StreamEvents, signal?: AbortSignal): Promise<StreamResult>;
+export declare function readChatStream(response: Response, events?: StreamEvents, signal?: AbortSignal, limits?: StreamLimits): Promise<StreamResult>;
 //# sourceMappingURL=sse-parser.d.ts.map

package/dist/api/sse-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse-parser.d.ts","sourceRoot":"","sources":["../../src/api/sse-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAWD,+EAA+E;AAC/E,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE;IAMjC,kDAAkD;IAClD,GAAG,IAAI,MAAM,EAAE;IASf,OAAO,CAAC,KAAK;CAYd;AAED,8DAA8D;AAC9D,qBAAa,mBAAmB;IAOlB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAC7D,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,KAAK,CAAC,CAAc;IAC5B,OAAO,CAAC,IAAI,CAAS;gBAEQ,MAAM,GAAE,YAAiB;IAEtD,4DAA4D;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAgD9B,MAAM,IAAI,YAAY;CASvB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,MAAM,GAAE,YAAiB,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC,CAkCvB"}
+{"version":3,"file":"sse-parser.d.ts","sourceRoot":"","sources":["../../src/api/sse-parser.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAWD,+EAA+E;AAC/E,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE;IAMjC,kDAAkD;IAClD,GAAG,IAAI,MAAM,EAAE;IASf,OAAO,CAAC,KAAK;CAYd;AAED,8DAA8D;AAC9D,qBAAa,mBAAmB;IAOlB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAC7D,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,KAAK,CAAC,CAAc;IAC5B,OAAO,CAAC,IAAI,CAAS;gBAEQ,MAAM,GAAE,YAAiB;IAEtD,4DAA4D;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAgD9B,MAAM,IAAI,YAAY;CASvB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAC9C,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,MAAM,GAAE,YAAiB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,GAAE,YAAiB,GACxB,OAAO,CAAC,YAAY,CAAC,CA8DvB"}

package/dist/api/sse-parser.js

@@ -1,22 +1,5 @@
-/**
- * SSE reader for the chat data plane.
- *
- * Every rule here is a fact measured in Phase 0 against real transcripts from
- * DeepSeek, Kimi, Qwen and Vertex Gemini (tests/fixtures/cli-000*), not an
- * assumption about how streaming "usually" works:
- *
- *   - `id` and `name` arrive exactly once, so tool calls merge by `index`.
- *   - Qwen sends `"id": ""` on continuation frames; `??` would overwrite the
- *     real id with an empty string and the tool result would be rejected.
- *   - Gemini packs a thought signature into the id (700+ chars) and delivers a
- *     whole call in one frame, where Kimi takes nine — fragment counts mean
- *     nothing.
- *   - `finish_reason` arrives in its own frame with an empty delta; `[DONE]`
- *     ends the stream.
- *   - With `stream_options.include_usage`, usage arrives AFTER finish_reason
- *     in a frame whose `choices` is non-empty but whose delta is empty. A
- *     parser that only reads usage when `choices` is empty reports zero cost.
- */
+import { ApiError } from "./errors.js";
+import { ExitCode } from "../output/exit-codes.js";
 /** Split a byte stream into SSE `data:` payloads across arbitrary chunking. */
 export class SseFramer {
     buffer = "";
@@ -117,18 +100,29 @@ export class ChatStreamAssembler {
         };
     }
 }
+export const DEFAULT_STREAM_IDLE_MS = 120_000;
+export const DEFAULT_STREAM_MAX_BYTES = 32 * 1024 * 1024;
 /**
  * Read a streaming response to completion.
  *
  * `signal` is the user's Ctrl+C: aborting stops reading AND closes the
  * connection, which is what actually tells the gateway to stop generating.
+ *
+ * F-009 · The request timeout in `HttpClient` is cleared the moment the
+ * response headers arrive, which for a stream is the beginning rather than the
+ * end. Without the two limits below, a gateway that sent headers and then
+ * stopped would hang the CLI forever, and one that never stopped sending would
+ * grow the buffer until the process died.
  */
-export async function readChatStream(response, events = {}, signal) {
+export async function readChatStream(response, events = {}, signal, limits = {}) {
     const framer = new SseFramer();
     const assembler = new ChatStreamAssembler(events);
     const body = response.body;
     if (!body)
         return assembler.result();
+    const idleMs = limits.idleTimeoutMs ?? DEFAULT_STREAM_IDLE_MS;
+    const maxBytes = limits.maxBytes ?? DEFAULT_STREAM_MAX_BYTES;
+    let received = 0;
     const reader = body.getReader();
     const onAbort = () => void reader.cancel();
     // Attaching a listener is not enough: a signal that aborted between the
@@ -144,9 +138,29 @@ export async function readChatStream(response, events = {}, signal) {
         for (;;) {
             if (signal?.aborted)
                 break;
-            const { done, value } = await reader.read();
+            const chunk = await withIdleDeadline(reader.read(), idleMs);
+            if (chunk === IDLE) {
+                limits.abort?.();
+                await reader.cancel().catch(() => { });
+                throw new ApiError({
+                    kind: "timeout",
+                    exitCode: ExitCode.Unavailable,
+                    message: `the stream sent nothing for ${idleMs}ms`,
+                });
+            }
+            const { done, value } = chunk;
             if (done)
                 break;
+            received += value.byteLength;
+            if (received > maxBytes) {
+                limits.abort?.();
+                await reader.cancel().catch(() => { });
+                throw new ApiError({
+                    kind: "too_large",
+                    exitCode: ExitCode.Unavailable,
+                    message: `the stream exceeded the ${maxBytes} byte limit`,
+                });
+            }
             for (const payload of framer.push(value)) {
                 if (assembler.push(payload))
                     return assembler.result();
@@ -161,3 +175,30 @@ export async function readChatStream(response, events = {}, signal) {
     }
     return assembler.result();
 }
+/** Sentinel for "the deadline won", distinguishable from a real chunk. */
+const IDLE = Symbol("idle");
+/**
+ * Race a read against the idle deadline.
+ *
+ * The timer is unref'd and always cleared: a pending timer would keep the
+ * process alive after a stream that finished normally.
+ */
+async function withIdleDeadline(read, idleMs) {
+    let timer;
+    try {
+        return await Promise.race([
+            read,
+            new Promise((resolve) => {
+                // Deliberately not unref'd: if a stalled stream were the only thing
+                // left, an unref'd timer would let the process exit silently instead
+                // of reporting the timeout. The finally below always clears it, so
+                // nothing is held open after a stream that ended normally.
+                timer = setTimeout(() => resolve(IDLE), idleMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}