@mafdet/cli 0.4.4 → 0.4.5

package/CHANGELOG.md

@@ -6,6 +6,49 @@ The version is the contract for the JSON output shapes and the exit codes.
 Being 0.x, semver still permits a break in a minor bump; the intent is not to
 use that latitude, and the promise becomes binding at 1.0.0.
 
+## 0.4.5 - 2026-08-12
+
+A second audit round, and the security fix in it is the important one.
+
+**With no tool-calling model, the interactive session no longer opens.** It
+used to print a warning and then offer every chat model - so the one case with
+nothing safe to offer was the case that offered everything, and the agent then
+ran on a model whose tool calling had never been verified. `mafdet agent`
+refused the same model outright, so the two surfaces disagreed about
+admission. They no longer do.
+
+**A cost ceiling that cannot be enforced stops the run.** When the catalogue
+has no price for a model, each turn counted as zero towards `--max-cost-usd`,
+so the ceiling quietly stopped being one while the run kept spending. Asking
+for a limit we cannot apply now ends the run and says why.
+
+**Context compaction keeps going until the history fits.** It used to drop a
+single tool exchange and send regardless, which changes nothing when the
+history is several times over the window - the request then failed upstream
+and was billed for the attempt.
+
+**A stream is closed when the answer ends.** `[DONE]` means the reply is
+complete, not that the socket is; an upstream that kept the connection open
+held ours too. There is also a total deadline now, because a trickle of bytes
+defeats an idle one.
+
+**More of what reaches the terminal is sanitised**: the answer from `mafdet
+agent`, the interactive session's answer, the session picker, the resume
+notice and the remaining `sessions` columns. The stripper also handles the
+8-bit C1 forms, which do the same things without an escape character.
+
+**An unpriced request is no longer displayed as `$0.00`** in `sessions list`,
+`show` or `usage`, and the JSON carries `unpriced_requests` so a script can
+tell the difference too.
+
+Also: `sessions list` refuses stray arguments like the other subcommands;
+`mafdet agent` documents `--title`, `--no-history` and `--read-only`, shows
+the first-save notice, and closes its recorder even when the session throws;
+resuming no longer asks you to pick a model it is going to ignore, and the
+banner names the model actually in use; and the Windows command-timeout note
+now says the `taskkill` path is written but unverified, rather than describing
+the implementation it replaced.
+
 ## 0.4.4 - 2026-08-11
 
 A security fix and twenty-one other corrections, all from an external audit of

package/README.md

@@ -3,13 +3,11 @@
 The official Mafdet AI command line: model calls, account queries, and a
 permissioned local agent.
 
-> **0.4.4.** 中文版见 [README.zh-CN.md](./README.zh-CN.md). The CLI never
+> **0.4.5.** 中文版见 [README.zh-CN.md](./README.zh-CN.md). The CLI never
 > advertises a command it cannot serve, so `mafdet help` always lists exactly
 > what works.
 >
-> macOS and Windows are not yet verified. On Windows the command timeout
-> relies on POSIX process groups, so only the direct child is terminated and a
-> grandchild can survive.
+> macOS and Windows are not yet verified. On Windows the command timeout uses `taskkill /T`, which is written but has never been run on a real Windows machine - so whether every grandchild process is reached there is unverified rather than fixed.
 
 ## Requirements
 
@@ -25,8 +23,8 @@ Or build it from this repository:
 
 ```bash
 pnpm --filter @mafdet/cli build
-cd packages/cli && npm pack          # -> mafdet-cli-0.4.4.tgz
-npm install -g ./mafdet-cli-0.4.4.tgz
+cd packages/cli && npm pack          # -> mafdet-cli-0.4.5.tgz
+npm install -g ./mafdet-cli-0.4.5.tgz
 ```
 
 ## The interactive session

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 Mafdet AI 官方命令行：模型调用、账户查询，以及一个受权限约束的本地 Agent。
 
-> **0.4.4。** 英文版见 [README.md](./README.md)。
+> **0.4.5。** 英文版见 [README.md](./README.md)。
 
 ## 环境要求
 
@@ -55,8 +55,9 @@ mafdet doctor
 的默认状态，中文系统为 cp936）也不会变成乱码。管道传入 prompt 也可以，但 PowerShell
 默认按 UTF-16 走管道——建议直接把 prompt 作为参数，或用 `--input <文件>`。
 
-⚠️ **macOS 与 Windows 尚未验收**。Windows 上有一个已知差异：命令超时终止依赖 POSIX 的
-进程组语义，Windows 只会终止直接子进程，孙子进程可能存活。
+⚠️ **macOS 与 Windows 尚未验收**。Windows 上的命令超时终止已改用 `taskkill /T`，
+但**从未在真 Windows 上执行过**——它是否真的能杀到每一个孙子进程，属于**未验证**，
+不是「已修复」。
 
 ## 命令
 

package/dist/agent/command-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-policy.d.ts","sourceRoot":"","sources":["../../src/agent/command-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BlD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,SAAS,MAAM,EAAO,GAChC,cAAc,CAwChB;AAmBD,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAe9C"}
+{"version":3,"file":"command-policy.d.ts","sourceRoot":"","sources":["../../src/agent/command-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BlD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,SAAS,MAAM,EAAO,GAChC,cAAc,CAwChB;AAmBD,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwB9C"}

package/dist/agent/command-policy.js

@@ -129,5 +129,14 @@ export function stripAnsi(text) {
         // Remaining C0 controls. Tab, newline and carriage return survive; the
         // rest can retitle a window, move the cursor or hide what follows, and a
         // model's output is not a trusted source of terminal instructions.
-        .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, ""));
+        .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "")
+        // R-4 · The 8-bit C1 forms of the same sequences. A terminal in 8-bit
+        // mode reads U+009B as CSI and U+009D as OSC - identical instructions to
+        // the ESC forms above, with no ESC to match on. Taken as whole
+        // sequences, so the payload goes with the introducer rather than being
+        // left behind as visible text.
+        .replace(/\u009b[0-?]*[ -/]*[@-~]/g, "")
+        .replace(/\u009d[^\u0007\u009c]*(?:\u0007|\u009c)?/g, "")
+        // Any remaining C1, including NEL (U+0085) and the lone introducers.
+        .replace(/[\u0080-\u009f]/g, ""));
 }

package/dist/agent/context-budget.d.ts

@@ -66,4 +66,19 @@ export interface CompactionResult extends PruneResult {
  * upstream and be billed for the attempt.
  */
 export declare function compactForBudget(history: ChatMessage[], keepRecent?: number): CompactionResult;
+/**
+ * R-2 · Shorten until it fits, or until nothing more can go.
+ *
+ * `compactForBudget` used to return the moment it dropped a single tool
+ * exchange, and the caller then sent the request regardless. One exchange out
+ * of a history three times over the window changes nothing, so the request
+ * still failed upstream - and was billed for the attempt.
+ *
+ * `estimate` maps the current history back to a token count. There is no
+ * tokenizer here (see the note at the top of this file), so it is derived from
+ * the last measurement: tokens per message, applied to what is left. Rough, but
+ * it is the only honest figure available and it is monotone in the right
+ * direction, which is what a loop needs.
+ */
+export declare function compactUntilItFits(history: ChatMessage[], contextLength: number | undefined, lastPromptTokens: number, keepRecent?: number): CompactionResult;
 //# sourceMappingURL=context-budget.d.ts.map

package/dist/agent/context-budget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-budget.d.ts","sourceRoot":"","sources":["../../src/agent/context-budget.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAKT;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAsCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,WAAW,CAkBb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,EAAE,MAAM,GAChB,MAAM,CAuBR;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CAYlB"}
+{"version":3,"file":"context-budget.d.ts","sourceRoot":"","sources":["../../src/agent/context-budget.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAKT;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAsCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,WAAW,CAkBb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,EAAE,MAAM,GAChB,MAAM,CAuBR;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CASlB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,EACxB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CA6BlB"}

package/dist/agent/context-budget.js

@@ -156,14 +156,54 @@ export function dropOldestTurns(history, keepTurns) {
  */
 export function compactForBudget(history, keepRecent = KEEP_RECENT_EXCHANGES) {
     const pruned = pruneToolExchanges(history, keepRecent);
-    if (pruned.exchanges > 0) {
-        return { ...pruned, turns: 0, exhausted: false };
-    }
     const turnsRemoved = dropOldestTurns(history, keepRecent);
     return {
-        removed: turnsRemoved,
-        exchanges: 0,
+        removed: pruned.removed + turnsRemoved,
+        exchanges: pruned.exchanges,
         turns: turnsRemoved > 0 ? 1 : 0,
-        exhausted: turnsRemoved === 0,
+        exhausted: pruned.exchanges === 0 && turnsRemoved === 0,
     };
 }
+/**
+ * R-2 · Shorten until it fits, or until nothing more can go.
+ *
+ * `compactForBudget` used to return the moment it dropped a single tool
+ * exchange, and the caller then sent the request regardless. One exchange out
+ * of a history three times over the window changes nothing, so the request
+ * still failed upstream - and was billed for the attempt.
+ *
+ * `estimate` maps the current history back to a token count. There is no
+ * tokenizer here (see the note at the top of this file), so it is derived from
+ * the last measurement: tokens per message, applied to what is left. Rough, but
+ * it is the only honest figure available and it is monotone in the right
+ * direction, which is what a loop needs.
+ */
+export function compactUntilItFits(history, contextLength, lastPromptTokens, keepRecent = KEEP_RECENT_EXCHANGES) {
+    const startedWith = history.length;
+    const perMessage = startedWith > 0 ? lastPromptTokens / startedWith : 0;
+    let exchanges = 0;
+    let turns = 0;
+    for (;;) {
+        const estimate = Math.round(perMessage * history.length);
+        if (!shouldCompact(contextLength, estimate)) {
+            return {
+                removed: startedWith - history.length,
+                exchanges,
+                turns,
+                exhausted: false,
+            };
+        }
+        const step = compactForBudget(history, keepRecent);
+        if (step.exhausted) {
+            return {
+                removed: startedWith - history.length,
+                exchanges,
+                turns,
+                // Still over budget with nothing left that is safe to drop.
+                exhausted: true,
+            };
+        }
+        exchanges += step.exchanges;
+        turns += step.turns;
+    }
+}

package/dist/agent/loop.d.ts

@@ -14,7 +14,13 @@ export declare const DEFAULT_LIMITS: {
 export type AgentLimits = typeof DEFAULT_LIMITS;
 export type StopReason = "completed" | "max_turns" | "timeout" | "max_cost" | "cancelled" | "rate_limited"
 /** F-008 · Over the model's window with nothing left that is safe to drop. */
- | "context_limit" | "error";
+ | "context_limit"
+/**
+ * R-5 · A cost ceiling was asked for and cannot be honoured, because the
+ * catalogue has no price for this model. Distinct from `max_cost`, which
+ * means the ceiling was reached.
+ */
+ | "cost_unknown" | "error";
 export interface AgentReport {
     stopReason: StopReason;
     /** The model's last text answer, if it produced one. */
@@ -122,6 +128,8 @@ export type AgentEvent = {
  | {
     type: "compacted";
     exchanges: number;
+    /** Whole conversation turns dropped, when exchanges were not enough. */
+    turns: number;
     messages: number;
     promptTokens: number;
 };

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc;AAChB,8EAA8E;GAC5E,eAAe,GACf,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAYD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAmK1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc;AAChB,8EAA8E;GAC5E,eAAe;AACjB;;;;GAIG;GACD,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAYD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA6L1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR"}

package/dist/agent/loop.js

@@ -1,5 +1,5 @@
 import { ApiError } from "../api/errors.js";
-import { compactForBudget, shouldCompact } from "./context-budget.js";
+import { compactUntilItFits, shouldCompact } from "./context-budget.js";
 import { toolToJsonSchema, } from "./tools/types.js";
 /** Plan §7.4. */
 export const DEFAULT_LIMITS = {
@@ -47,6 +47,8 @@ export async function runAgent(options) {
     };
     /** What the provider counted for the previous request; 0 until one lands. */
     let lastPromptTokens = 0;
+    /** R-5 · Turns whose cost the catalogue could not tell us. */
+    let unpricedTurns = 0;
     for (let turn = 1; turn <= limits.maxTurns; turn += 1) {
         if (options.signal?.aborted)
             return stop(report, "cancelled");
@@ -56,11 +58,23 @@ export async function runAgent(options) {
             report.costMicroUsd >= limits.maxCostMicroUsd) {
             return stop(report, "max_cost");
         }
+        // R-5 · An unpriceable turn counted as 0 towards the ceiling, so
+        // `--max-cost-usd` silently stopped being a ceiling at all and the run
+        // continued spending real money. A limit that cannot be enforced has to
+        // stop the run, not be quietly abandoned.
+        if (limits.maxCostMicroUsd !== undefined && unpricedTurns > 0) {
+            return stop(report, "cost_unknown", `--max-cost-usd cannot be enforced: the catalogue has no price for ` +
+                `${options.model}, so ${unpricedTurns} request(s) could not be counted ` +
+                `towards the ceiling. Re-run without the limit to continue anyway.`);
+        }
         report.turns = turn;
         options.onEvent?.({ type: "turn", turn });
         // §7.4 · Shorten before asking, using what the provider counted last time.
         if (shouldCompact(options.pricing?.contextLength, lastPromptTokens)) {
-            const compacted = compactForBudget(messages);
+            // R-2 · Keep going until the estimate is inside the budget. Dropping one
+            // exchange and sending anyway left a history that was still over the
+            // window: the request failed upstream and was billed for the attempt.
+            const compacted = compactUntilItFits(messages, options.pricing?.contextLength, lastPromptTokens);
             if (compacted.exhausted) {
                 // F-008 · Nothing left that can be dropped without breaking the
                 // conversation. Sending anyway means a request over the window, which
@@ -72,6 +86,9 @@ export async function runAgent(options) {
             options.onEvent?.({
                 type: "compacted",
                 exchanges: compacted.exchanges,
+                // R-2 · Reported separately: a pure conversation drops turns and no
+                // exchanges, and the display said "dropped 0 earlier tool exchanges".
+                turns: compacted.turns,
                 messages: compacted.removed,
                 promptTokens: lastPromptTokens,
             });
@@ -116,6 +133,8 @@ export async function runAgent(options) {
             costMicroUsd: turnCost,
             priced: canPrice(options.pricing, usage),
         });
+        if (!canPrice(options.pricing, usage))
+            unpricedTurns += 1;
         const choice = response.choices?.[0];
         const message = choice?.message;
         const calls = message?.tool_calls ?? [];

package/dist/agent/session.d.ts

@@ -32,6 +32,8 @@ export interface SessionOptions {
      * the same events are drawn.
      */
     onEvent?: (event: AgentEvent) => void;
+    /** R-4 · False when stdout is a pipe or a file, which get exact bytes. */
+    isTty?: boolean;
     /**
      * A conversation to continue, rebuilt from a saved session (CLI-024).
      * Appended to in place, exactly as the fresh array would be.

package/dist/agent/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/agent/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAY,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAapE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,oEAAoE;IACpE,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CA8FzB;AAgHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CA2B7D"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/agent/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAY,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAapE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,oEAAoE;IACpE,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAqGzB;AAgHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CA2B7D"}

package/dist/agent/session.js

@@ -2,6 +2,7 @@ import { createInterface } from "node:readline/promises";
 import { isAgentEligible } from "../api/models.js";
 import { formatUsd } from "../output/money.js";
 import { renderRecord } from "../output/format.js";
+import { safeForTerminal } from "../output/terminal-safe.js";
 import { runAgent } from "./loop.js";
 const HELP = `Session commands:
   /model [id]     Show or switch the model
@@ -94,8 +95,12 @@ export async function runSession(options) {
             summary.promptTokens += report.promptTokens;
             summary.completionTokens += report.completionTokens;
             summary.costMicroUsd += report.costMicroUsd;
-            if (report.finalText)
-                options.stdout(`${report.finalText}\n`);
+            // R-4 · The model's answer reaches a terminal here too. The TUI wraps
+            // this writer, but `mafdet agent` without a goal does not, so the
+            // sanitising belongs at the sink rather than at one of its callers.
+            if (report.finalText) {
+                options.stdout(`${safeForTerminal(report.finalText, options.isTty ?? true)}\n`);
+            }
             if (report.stopReason !== "completed") {
                 options.stderr(`[${report.stopReason}${report.error ? `: ${report.error}` : ""}]\n`);
             }

package/dist/api/sse-parser.d.ts

@@ -72,6 +72,19 @@ export interface StreamLimits {
     readonly idleTimeoutMs?: number;
     /** Total bytes accepted before the stream is treated as hostile. */
     readonly maxBytes?: number;
+    /**
+     * R-3 · A ceiling on the whole stream, not just on the gaps in it.
+     *
+     * The idle deadline is the right primitive for "this hung" - a long
+     * generation is not a stalled one - but it is defeated by a trickle: a few
+     * bytes before each deadline holds the connection indefinitely. The byte cap
+     * bounds the volume and not the time, so this bounds the time.
+     *
+     * Generous on purpose. It is a backstop against a hostile upstream, not a
+     * limit on how long a model may think, and a single response that takes
+     * longer than this is not a case worth serving.
+     */
+    readonly maxTotalMs?: number;
     /**
      * Closes the underlying connection. Cancelling the reader alone stops us
      * reading; it does not reliably stop the gateway generating, and generation
@@ -81,6 +94,8 @@ export interface StreamLimits {
 }
 export declare const DEFAULT_STREAM_IDLE_MS = 120000;
 export declare const DEFAULT_STREAM_MAX_BYTES: number;
+/** Matches the agent's wall-clock ceiling (§7.4), for the same reason. */
+export declare const DEFAULT_STREAM_TOTAL_MS: number;
 /**
  * Read a streaming response to completion.
  *

package/dist/api/sse-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse-parser.d.ts","sourceRoot":"","sources":["../../src/api/sse-parser.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAWD,+EAA+E;AAC/E,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE;IAMjC,kDAAkD;IAClD,GAAG,IAAI,MAAM,EAAE;IASf,OAAO,CAAC,KAAK;CAYd;AAED,8DAA8D;AAC9D,qBAAa,mBAAmB;IAOlB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAC7D,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,KAAK,CAAC,CAAc;IAC5B,OAAO,CAAC,IAAI,CAAS;gBAEQ,MAAM,GAAE,YAAiB;IAEtD,4DAA4D;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAgD9B,MAAM,IAAI,YAAY;CASvB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAC9C,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,MAAM,GAAE,YAAiB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,GAAE,YAAiB,GACxB,OAAO,CAAC,YAAY,CAAC,CA8DvB"}
+{"version":3,"file":"sse-parser.d.ts","sourceRoot":"","sources":["../../src/api/sse-parser.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAWD,+EAA+E;AAC/E,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAE7C,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE;IAMjC,kDAAkD;IAClD,GAAG,IAAI,MAAM,EAAE;IASf,OAAO,CAAC,KAAK;CAYd;AAED,8DAA8D;AAC9D,qBAAa,mBAAmB;IAOlB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAC7D,OAAO,CAAC,IAAI,CAAM;IAClB,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,KAAK,CAAC,CAAc;IAC5B,OAAO,CAAC,IAAI,CAAS;gBAEQ,MAAM,GAAE,YAAiB;IAEtD,4DAA4D;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAgD9B,MAAM,IAAI,YAAY;CASvB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAC9C,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AACzD,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,QAAc,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,QAAQ,EAClB,MAAM,GAAE,YAAiB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,GAAE,YAAiB,GACxB,OAAO,CAAC,YAAY,CAAC,CAyFvB"}

package/dist/api/sse-parser.js

@@ -102,6 +102,8 @@ export class ChatStreamAssembler {
 }
 export const DEFAULT_STREAM_IDLE_MS = 120_000;
 export const DEFAULT_STREAM_MAX_BYTES = 32 * 1024 * 1024;
+/** Matches the agent's wall-clock ceiling (§7.4), for the same reason. */
+export const DEFAULT_STREAM_TOTAL_MS = 30 * 60_000;
 /**
  * Read a streaming response to completion.
  *
@@ -122,9 +124,13 @@ export async function readChatStream(response, events = {}, signal, limits = {})
         return assembler.result();
     const idleMs = limits.idleTimeoutMs ?? DEFAULT_STREAM_IDLE_MS;
     const maxBytes = limits.maxBytes ?? DEFAULT_STREAM_MAX_BYTES;
+    const totalMs = limits.maxTotalMs ?? DEFAULT_STREAM_TOTAL_MS;
+    const startedAt = Date.now();
     let received = 0;
     const reader = body.getReader();
     const onAbort = () => void reader.cancel();
+    /** Set when `[DONE]` ended the answer while bytes may still be coming. */
+    let finished = false;
     // Attaching a listener is not enough: a signal that aborted between the
     // request and here would never fire one, and the read below would hang
     // forever on a stream nobody is going to close.
@@ -138,6 +144,15 @@ export async function readChatStream(response, events = {}, signal, limits = {})
         for (;;) {
             if (signal?.aborted)
                 break;
+            if (Date.now() - startedAt > totalMs) {
+                limits.abort?.();
+                await reader.cancel().catch(() => { });
+                throw new ApiError({
+                    kind: "timeout",
+                    exitCode: ExitCode.Unavailable,
+                    message: `the stream ran for longer than ${totalMs}ms`,
+                });
+            }
             const chunk = await withIdleDeadline(reader.read(), idleMs);
             if (chunk === IDLE) {
                 limits.abort?.();
@@ -162,8 +177,14 @@ export async function readChatStream(response, events = {}, signal, limits = {})
                 });
             }
             for (const payload of framer.push(value)) {
-                if (assembler.push(payload))
+                if (assembler.push(payload)) {
+                    // R-3 · `[DONE]` means the answer is complete, not that the socket
+                    // is. An upstream that keeps the connection open after it would
+                    // otherwise hold ours too - releasing the reader lock in the
+                    // `finally` does not close anything.
+                    finished = true;
                     return assembler.result();
+                }
             }
         }
         for (const payload of framer.end())
@@ -171,6 +192,12 @@ export async function readChatStream(response, events = {}, signal, limits = {})
     }
     finally {
         signal?.removeEventListener("abort", onAbort);
+        if (finished) {
+            // Cancel first, then release: cancelling closes the body, and the abort
+            // reaches the fetch itself, which is what actually frees the socket.
+            void reader.cancel().catch(() => { });
+            limits.abort?.();
+        }
         reader.releaseLock();
     }
     return assembler.result();

package/dist/commands/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/commands/agent.ts"],"names":[],"mappings":"AAKA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAYvE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAatB,eAAO,MAAM,gBAAgB,0XAK+C,CAAC;AAE7E,eAAO,MAAM,YAAY,mgBAOmB,CAAC;AAE7C,MAAM,WAAW,OAAQ,SAAQ,SAAS;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,uBAAuB,EAAE,QAAQ,CAAC;CACrD;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,OAAO,GACV,OAAO,CAAC,QAAQ,CAAC,CAsHnB;AAyJD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,kBAAkB,EAAE,OAAO,0JAI3E"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/commands/agent.ts"],"names":[],"mappings":"AAQA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAiBvE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAmBtB,eAAO,MAAM,gBAAgB,0XAK+C,CAAC;AAE7E,eAAO,MAAM,YAAY,mgBAOmB,CAAC;AAE7C,MAAM,WAAW,OAAQ,SAAQ,SAAS;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,uBAAuB,EAAE,QAAQ,CAAC;CACrD;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,OAAO,GACV,OAAO,CAAC,QAAQ,CAAC,CA6HnB;AAoLD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,kBAAkB,EAAE,OAAO,0JAI3E"}

package/dist/commands/agent.js

@@ -1,10 +1,13 @@
 import { fetchAccessibleModels, fetchCatalog, intersectModels, } from "../api/models.js";
+import { existsSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { approverFor } from "../agent/approvals.js";
 import { runAgent } from "../agent/loop.js";
 import { runSession } from "../agent/session.js";
+import { safeForTerminal } from "../output/terminal-safe.js";
 import { sessionsDir } from "../config/paths.js";
 import { keyDigest } from "../security/redact.js";
-import { decideRecording } from "../sessions/policy.js";
+import { decideRecording, firstSaveNotice, NOTICE_FILE, } from "../sessions/policy.js";
 import { SessionRecorder } from "../sessions/recorder.js";
 import { SessionWriter } from "../sessions/store.js";
 import { READ_ONLY_TOOLS } from "../agent/tools/read-only.js";
@@ -16,14 +19,20 @@ import { renderJson, renderRecord } from "../output/format.js";
 import { formatUsd } from "../output/money.js";
 import { buildRuntime, reportError, requireApiKey, } from "./runtime.js";
 const USAGE = `Usage:
-  mafdet agent "<goal>" [--model <id>] [--allow-write]
+  mafdet agent "<goal>" [--model <id>] [--allow-write] [--read-only]
                         [--allow-command "<prefix>"]... [--max-turns <n>]
                         [--max-cost-usd <n>] [--json]
+  mafdet agent          Interactive session (needs a terminal)
+                        [--title <text>] [--no-history]
 
 Read-only by default. With --allow-write the agent may edit and create files,
-and every change is shown as a diff and confirmed before it is written. There
-is no flag that approves everything in advance, and a non-interactive run
-cannot write at all.
+and every change is shown as a diff and confirmed before it is written.
+--read-only cancels an earlier --allow-write. There is no flag that approves
+everything in advance, and a non-interactive run cannot write at all.
+
+An interactive session is saved on this computer; --no-history records
+nothing and --title names it in 'mafdet sessions list'. To continue a saved
+conversation, use 'mafdet --resume <id>'.
 `;
 export const READ_ONLY_PROMPT = `You are the Mafdet CLI agent working inside a user's workspace.
 
@@ -82,25 +91,33 @@ export async function agentCommand(argv, io) {
             // F-007 · `decideRecording` already called this surface "interactive",
             // so the policy claimed these runs were saved while nothing saved them.
             const recorder = openRecorder(parsed, io, model, workspace.root, mode);
-            const summary = await runSession({
-                client: runtime.dataPlane,
-                ...(recorder === undefined
-                    ? {}
-                    : { onEvent: (event) => recorder.observe(event) }),
-                model,
-                pricing: resolved,
-                catalog,
-                systemPrompt: mode === "read-only" ? READ_ONLY_PROMPT : WRITE_PROMPT,
-                tools: buildToolset(mode, parsed.allowedCommands.length > 0),
-                toolContext: { workspace, allowedCommands: parsed.allowedCommands },
-                approver: io.approver ?? approverFor(mode, io, interactive),
-                mode,
-                allowedCommands: parsed.allowedCommands,
-                stdout: io.stdout,
-                stderr: io.stderr,
-                signal: io.signal,
-            });
-            recorder?.close();
+            // R-8 · In a finally: `close()` is what writes the final index entry, so
+            // a session that threw left the listing without it.
+            let summary;
+            try {
+                summary = await runSession({
+                    client: runtime.dataPlane,
+                    ...(recorder === undefined
+                        ? {}
+                        : { onEvent: (event) => recorder.observe(event) }),
+                    model,
+                    pricing: resolved,
+                    catalog,
+                    systemPrompt: mode === "read-only" ? READ_ONLY_PROMPT : WRITE_PROMPT,
+                    tools: buildToolset(mode, parsed.allowedCommands.length > 0),
+                    toolContext: { workspace, allowedCommands: parsed.allowedCommands },
+                    approver: io.approver ?? approverFor(mode, io, interactive),
+                    mode,
+                    allowedCommands: parsed.allowedCommands,
+                    stdout: io.stdout,
+                    stderr: io.stderr,
+                    signal: io.signal,
+                    isTty: isTty(io),
+                });
+            }
+            finally {
+                recorder?.close();
+            }
             io.stderr("\n" +
                 renderRecord([
                     ["goals", `${summary.goals}`],
@@ -149,6 +166,29 @@ export async function agentCommand(argv, io) {
  * writes nothing at all, and a store that cannot be opened costs the
  * transcript rather than the session.
  */
+/**
+ * R-8 · The first-save notice, once per machine.
+ *
+ * The marker file is shared with the TUI on purpose: the notice is about this
+ * computer, not about which command happened to write first.
+ */
+function showNoticeOnce(root, io) {
+    const marker = join(root, NOTICE_FILE);
+    try {
+        if (existsSync(marker))
+            return;
+        io.stderr(firstSaveNotice(root));
+        writeFileSync(marker, `${new Date().toISOString()}\n`, { mode: 0o600 });
+    }
+    catch {
+        // Telling the user is best effort; failing to record that we told them
+        // must not stop the session.
+    }
+}
+/** Whether a terminal is on the other end of stdout. Injectable for tests. */
+function isTty(io) {
+    return io.isTty ?? process.stdout.isTTY === true;
+}
 function openRecorder(parsed, io, modelId, workspaceRoot, mode) {
     const decision = decideRecording({
         surface: "interactive",
@@ -169,6 +209,10 @@ function openRecorder(parsed, io, modelId, workspaceRoot, mode) {
             workspace: workspaceRoot,
             mode,
         });
+        // R-8 · Said once per machine, on whichever surface records first. The
+        // TUI showed it and this one did not, so a `mafdet agent` user could have
+        // a transcript on disk without ever being told.
+        showNoticeOnce(root, io);
         return new SessionRecorder({
             writer,
             root,
@@ -303,8 +347,10 @@ function finish(report, json, io) {
         io.stdout(renderJson({ ...report, costMicroUsd: report.costMicroUsd.toString() }));
     }
     else {
-        if (report.finalText)
-            io.stdout(`${report.finalText}\n`);
+        // R-4 · The model's answer, sanitised only when a terminal is reading it.
+        if (report.finalText) {
+            io.stdout(`${safeForTerminal(report.finalText, isTty(io))}\n`);
+        }
         io.stderr("\n" +
             renderRecord([
                 ["status", report.stopReason],
@@ -334,6 +380,9 @@ function finish(report, json, io) {
         case "max_cost":
         // F-008 · A ceiling too: the window ran out, and the report says which.
         case "context_limit":
+        // R-5 · Asked for a ceiling we cannot enforce; stopped rather than spend
+        // past it. A limit, so it belongs with the other limits.
+        case "cost_unknown":
             // Stopped short on purpose; the report says so rather than pretending.
             return ExitCode.LimitReached;
         case "rate_limited":

package/dist/commands/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/commands/sessions.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AA4BnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAgBtB,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,QAAQ,CAAC,CAUnB;AA8PD,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAUX,CAAC"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/commands/sessions.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AA4BnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAgBtB,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAoRD,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAUX,CAAC"}