@namzu/sdk 59.0.0 → 60.0.0

package/CHANGELOG.md

@@ -1,5 +1,107 @@
 # Changelog
 
+## 60.0.0
+
+### Major Changes
+
+- 976d848: A mistake in a workflow script's own hook calls now fails the run instead of quietly producing `null` items. Wrong `agent()` arguments (a missing or non-string prompt, non-object options), a non-object `schema`, a non-function item given to `parallel()` or `pipeline()`, and a bad `phase()` title are re-thrown out of `parallel()` and `pipeline()`; the run ends `failed` and the error names the call. A thunk that throws on its own and an agent that failed still resolve to `null` with a `log()` line. A misspelt `agent()` option is still ignored, so a saved script keeps running; a `log()` line now names the ignored option. A script that passed a wrong-typed prompt inside `parallel()` and relied on the `null` must be corrected: it now fails the run, where before it produced `null`. The Workflow tool description tells the model the same.
+- b501d3f: `kernelHostCommands()` no longer returns a `tasks` command, and its options no longer accept `taskStore`. The command listed the model's task checklist; a host that dispatched `/tasks` through the registry now gets no outcome for that name, so a host that wants the checklist reads its own task store (`TaskStore.list()`) and draws it. `/tasks` is now free for a host to use for its own meaning (the CLI uses it for the background tasks view). The `agents`, `goal` and `skills` commands are unchanged. `query()`'s `taskStore` option and the task tools are unchanged.
+- 1cef008: `grep` and `glob` now skip files that `.gitignore`, `.ignore` and `.git/info/exclude` exclude (and never enter `.git`), and a limit no longer fails a search. Before, a repository with build output or a nested worktree could not be searched at all: the walk stopped at 20,000 examined entries and returned "File search stopped after examining 20000 entries" as an error.
+
+  What changes for a caller:
+
+  - Ignored files are no longer returned. To search them, pass `include_ignored: true` to `grep` or `glob`; for a direct walk pass `respectIgnore: false`. A search root named on purpose is never itself ignored, so `path: packages/sdk/dist` still searches `dist`.
+  - Reaching a limit (a full page, the 500-path `glob` cap, the examined-entry bound, the time budget with matches found, unreadable files) now returns `success: true` with the results found so far and a note saying what was cut. `data.truncated` stays true; `data.incomplete` and the `limited` / `incomplete` facts say which kind. Only a search that ran out of time with nothing found, or whose walk cannot start, is still an error. If you branched on `success === false` to detect a partial search, read `data.truncated` and `data.incomplete` instead.
+  - The examined-entry bound moves from 20,000 to 500,000 and `walkFilesLocally` / `walkFilesViaExec` no longer throw `ERR_FILE_WALK_LIMIT` by default: they end the walk and report `{ stopped: 'entry-limit' }` through the new `onSummary` option. To keep the thrown error, pass `failOnLimit: true`. A `Sandbox.walkFiles` implementation that does not go through `walkFilesViaExec` should honour `respectIgnore` and call `onSummary`.
+  - `grep` and `glob` paths are relative to the working directory when the file lies under it and absolute otherwise, without a `./` prefix. Code that stripped `./` can stay; code that required it must stop.
+  - `glob` and `grep` stop themselves after 12 seconds, inside the existing 15-second tool deadline, so they can return what they found. A file list stops reading at `offset + max(head_limit * 4, 1000)` matching files before it sorts newest first, so every offset the note offers can be served.
+
+  The ignore matcher is the SDK's own, with no new dependency: the sandbox guest program travels as one `node -e` argument and cannot import a package, so the host and the guest run the same source text. It is tested against `git check-ignore` over a generated corpus. A global `core.excludesFile` setting is not queried; the default global ignore file is read on the host.
+
+  A rule with an unclosed `[`, or more than three separate `*`, is dropped (the latter could make one name take seconds to test). `glob` honouring ignore files is deliberate: `include_ignored: true` gives the old listing.
+
+  `grep` and `glob` now search hidden files and directories by default (`.git` and the other version-control directories are always skipped). Before, host `grep` skipped them and `glob` needed `include_hidden: true`. Ignore files still apply, so a gitignored `.env` stays out, and a path the session's read rules deny is neither listed nor opened: `ToolContext` gains `readDenied(absolutePath)`, which the executor fills from the turn's authorization gate and the two tools call per file. To keep the old behavior pass `include_hidden: false` (new on `grep`, default flipped on `glob`). A host that builds its own `ToolContext` without `readDenied` gets no read-rule filtering, so supply it if you enable searching hidden files with your own rules.
+
+  `@namzu/cli`: a `read` deny rule no longer makes `grep` and `glob` refuse a search over a folder that holds the denied path; they search it and skip the path (`ls` still refuses).
+
+  `@namzu/sandbox` (minor): the public `testing` conformance suite gained mandatory cases (ignore rules, the bound's summary, and that `listFiles` names ignored files), so an existing third-party backend that does not honour `respectIgnore` or `onSummary` in `walkFiles`, or whose `listFiles` hides ignored files, can now fail it; its limit case passes `failOnLimit: true`. The Pal computer's `listFiles` (and so `ls`) still lists ignored entries and still throws past its bound.
+
+  In a sandbox, a path outside the folder the sandbox binds is treated as read-denied when the session has read rules, because it has no host path the rules could be checked against.
+
+- 976d848: A background job is now stopped when the host process ends by `process.exit` or an uncaught exception. Before, the job's command and anything it forked kept running as orphans with no way to stop them. This changes what happens to a running job when the host exits: a host that relied on its jobs outliving it (a detached daemon or a scheduled-task host that starts a job and exits) now loses them. To keep the old behaviour, start such work outside the job registry, for example with your own detached `spawn` that you `unref`. A host killed by an unhandled signal still leaves jobs behind, as no listener runs then. On Linux the exit path reads each process's environment once for all tracked jobs, including jobs started with their own kill, to find descendants that left the job's process group.
+
+### Minor Changes
+
+- c9a0a73: A host can now let the model answer the operator while a long tool call is still running. Set `QueryParams.answerWhileCallsRun: true` together with the new `QueryParams.waitForOperator(signal)`, which resolves when the operator wrote and for no other reason (a child's notice or a peer's mail, which wake `waitForInbound`, never hand a call back). When the operator writes during a tool batch that has run for two seconds, each unfinished call is answered with a "still running" placeholder, the model reads the message and replies at once, and the real result follows in a message that names the call id; the turn is held open for it. Nothing changes for a host that leaves it unset (the default), and a batch under per-call review is never detached. A host that turns it on must make `waitForOperator` free of side effects, because it is called during tool batches. A call queued behind an earlier one that has not begun is told it has not started, not that it is running. The coding-agent delegation doctrine, which every parent session receives, gains a short section on answering "how is it going": read the running-work note, give each item its state and age, say an unfinished item is still running, and offer to run one that died again. The section assumes the host may give the model a note about running work and reads conditionally when it does not. That changes the cached prompt prefix once.
+- 880586f: Computer use on Windows now says "done, verified" for inputs that worked but the driver could not confirm, types into classic text boxes in the background, and puts your window back after it used the screen.
+
+  A press, a key or typed text in a window is read back by what the window shows afterwards: typed text that now appears, or a change that followed the input, held still, and was not happening before it, is `done, verified (reads "…")`; nothing observable stays `sent, not confirmed`, and an unrelated change is never taken as the effect. `set_value` on a classic Win32 edit control and `type_text` into a window whose focused control is one are sent as window messages and read back with the control's own text, with no focus change; a program running with higher rights refuses them and the result is `not_delivered` with the reason. A list the driver's value call does not change (a web page's select element) is chosen with the keyboard through the idle-gated foreground ladder and read back, else the result names the browser tool. After a foreground burst the previous window is restored whenever the target took the front, including when Windows refused the helper's own raise, and the result says why when it could not be.
+
+  For a host: `WindowInputResult` gains an optional `readBack`, additive. `ForegroundMonitor` gains an optional `editText`; `encodeHelperCommand` now encodes only the bootstrap, and `helperScriptLine` gives the script line written first to the helper. Nothing to change unless you call those directly.
+
+- 880586f: Computer use on Windows now stops when you interrupt it, says plainly when an administrator window swallowed its typing, and refuses to act on a locked computer.
+
+  Interrupting a turn (Esc) ends a pending desktop action at once instead of waiting for the driver: an action that may already have been sent is reported as sent, not confirmed and unsafe to repeat, one that was not sent yet as not delivered and safe, and the window and pointer it borrowed are put back only after the driver has stopped acting. When a window running with higher rights is in front, input sent from here is dropped by Windows without any error; Namzu now detects that (the window's integrity level beforehand, and whether the system registered the input afterwards) and reports "An administrator window is in front; Namzu cannot type into it" as not delivered and safe to repeat. A locked computer (lock screen, sign-in screen or a secure prompt) is refused before anything is read or sent, and a screenshot taken while it locked is discarded. The desktop driver's own cursor is switched off so only Namzu's is shown.
+
+  For a host: every desktop-reaching `ComputerUseHost` method (`execute`, `listWindows`, `focusWindow`, `captureWindow`, `executeWindow`, `captureRegion`, `uiSnapshot`, `uiAct`) gains a trailing optional `signal?: AbortSignal`, additive; a host that ignores it keeps working. `MonitorState` gains optional integrity fields, `MonitorBurstEnd` gains optional `inputMoved` and `frontElevated`, and `@namzu/computer-use` exports `ComputerUseLockedError`. Nothing to change unless you implement a host or a foreground monitor.
+
+- 880586f: On Windows, computer use no longer takes the screen from a person who is using it. Input that cannot be delivered in the background (a web page's keys, a covered window, a window that needs real focus, anything sent with `delivery_mode: "foreground"`, display-scope input and `focus_window`) now waits until the user has had no real keyboard or mouse input for 2 s, holds a cross-session lease on the screen, is watched for the user's input while it runs, and afterwards puts back the previous window and pointer, but only if nobody touched input meanwhile.
+
+  What changes for the model: a blocked action comes back as "Not delivered" and safe to retry, naming what blocks it (the user is busy, another session holds the screen, the user said no, a lock screen or administrator prompt is in front, the target runs with higher rights). A background action that had to use the screen says so and for how long. If the user presses Escape during one, every later `computer_use` call of that turn returns the same stop message until the next turn. When the user stays busy for 15 s they are asked once whether the application may use the screen for a moment; where nobody can be asked (exec, scheduled runs) the action parks and retries for up to 120 s and then says what blocks it.
+
+  What changes for a host: `ComputerUseHost` gains optional `beginTurn(turnId)` and `endTurn()`; `FocusWindowResult` gains optional `delivery`, `retrySafety` and `detail`. All are additive. `SubprocessComputerUseHost` takes `foreground: { approve?, session?, timing? }` and exports `ComputerUseStoppedError`. Breaking default in `@namzu/computer-use` (hence the major): an action that used to reach the screen at once (a display click, `focus_window`, `delivery_mode: "foreground"`) now waits for a still moment and can come back as not delivered; the value that changed is the idle wait before display input and `focus_window`, from none to 2 s; to keep the old behaviour for a script that owns the machine, pass `foreground: { timing: { idleMs: 0, approvedIdleMs: 0 } }`. The CLI asks the one question through its question card.
+
+- 880586f: A `ui_snapshot` ref now names a control and survives later snapshots, a large window is shown as an outline you open one region at a time, and an action on a ref that no longer fits fails with a typed reason instead of acting on whatever is there.
+
+  What changes for the model: refs (`e12`) no longer die at the next `ui_snapshot`. `ui_act` finds the control again by its id, its place in the tree, then its role and name, and only then sends anything; if the control has gone the step fails with `STALE_REF`, and if several controls fit it fails with `AMBIGUOUS_TARGET`. Both mean nothing was sent, so it is safe to take a new snapshot and choose again. A window with more than about 220 controls comes back as an outline in which a region is marked `(+N more inside)` and has a ref; `ui_snapshot { root: <ref> }` reads that region alone (`offset` for the next page of a long one) and leaves every other ref usable, and `ui_snapshot { query: <text> }` lists only matching controls. The advice to "read a smaller window" is replaced by "drill into a region".
+
+  What changes for a host (additive and optional): `ComputerUseHost.uiSnapshot(windowId?, options?)` takes `UiSnapshotOptions` (`root`, `offset`, `query`); `UiElement` gains `hiddenChildren`; `UiSnapshot` gains `outline`, `total`, `region` and `next`; `UiActResult` gains `code` (`UiActFailureCode`: `STALE_REF`, `AMBIGUOUS_TARGET`). A host that ignores the new options keeps working: its refs are simply treated as stable for as long as it keeps them valid. The tool no longer discards the refs of earlier snapshots, so a host that reuses a ref string for a different control must not.
+
+  What changes in the Windows backend (`@namzu/computer-use`): refs carry identity evidence (automation id, role and name, tree path, window) and are re-resolved against a new read when older than 3 s, when a newer read of the window replaced the driver's handle, or after a driver restart; the same id under a different name is not accepted as the same control. The window is walked with the driver's own 5 000 node cap, a browser window is read once more when its first walk shows only the frame, and a control that holds nothing is no longer made the parent of rows the driver reported below a skipped level. Code that relied on an old ref being refused after the next snapshot, or on the exact wording "not a control of the latest ui_snapshot", should read `code` and `delivery` instead. This is `minor` for `@namzu/computer-use`: the refusal of an old ref has become a successful re-resolution, which no documented contract promised to preserve.
+
+  The CLI's permission review reads the new `ui_snapshot` fields (`root`, `offset`, `query`) as the read-only requests they are, instead of asking about an unknown field.
+
+- 880586f: `computer_use` now says what it knows about each action instead of reporting a call that returned as "done", and works from a window's controls first.
+
+  What changes for the model: an action reports `done, verified` only when the host read the state back, `sent, not confirmed` when the input went out and nothing could check it (look before repeating, because repeating can act twice), and a failure marked "Not delivered" when nothing reached the target (safe to try again). `data.steps[]` carries `delivery` (`delivered_verified`, `delivered_unverified`, `not_delivered`) and `retrySafety` (`safe`, `unsafe`). A new `wait_for` action (element, text or window condition, bounded) replaces fixed waits and returns the window's controls with fresh refs. The tool text leads with `list_windows`, `ui_snapshot`, `ui_act`; the first coordinate click in a captured window gets a reminder, not a refusal.
+
+  What changes for a host: `UiActResult` gains optional `delivery`, `retrySafety` and `readBack`; `executeWindow` may return a `WindowInputResult`; a display `{ type: 'ok' }` may carry `delivery`, `retrySafety` and `detail`. All are additive and optional, so an existing host keeps working and keeps the plain `done`. `ComputerUseHost.executeWindow` is now declared as returning `Promise<void | WindowInputResult>`; a wrapper that annotates it as `Promise<void>` and discards the result still compiles, but one that forwards it should use the wider type.
+
+  What changes in the Windows backend (`@namzu/computer-use`): `set_value`, `toggle` and `select` read the control back and are verified or not delivered by what the window then shows; `set_value` on a field with no settable value is "not delivered" and no longer types into it as a fallback; a click that leaves another window in front, and window input the driver could not confirm, are "sent, not confirmed" instead of done; a refused background input is "not delivered" with what to do next. Refs of a window stay valid after a read-back. If your own tooling parsed the old "typed into the empty field" detail or relied on those cases counting as success, read `delivery` instead.
+
+  This is `major` for `@namzu/computer-use` because an outcome a caller could rely on changes: the `set_value` fallback to typing is gone, former successes become failures or unconfirmed results, and a driver error the backend cannot classify is now reported as "sent, not confirmed" and unsafe to repeat rather than "not delivered". To keep the old behaviour, read `ok` only and ignore `delivery`; nothing restores the typing fallback.
+
+- dd0f7eb: A model id ending in `[1m]` (any case) now resolves to a window of at least 1,000,000 tokens, recognised or not, and `withModelWindowSuffixStripped(provider)` hands the driver the bare id; `stripModelWindowSuffix`, `splitModelWindowSuffix` and the pricing lookup ignore the suffix too. `NAMZU_DISABLE_1M_CONTEXT` switches it off. `parseAutoCompactWindow` and `resolveAutoCompactWindowSetting` read `786k`, `200000` and `1m` and clamp to 100k..1M. The hand table now gives exactly `deepseek-v4-flash`, `deepseek-v4-pro` and `deepseek-flash` 1,000,000 (they were 64,000, which put the first summary at 32,000 tokens), with or without a gateway prefix such as `deepseek/` and a `:tag`; any other id containing `deepseek`, a derivative like `deepseek-flash-lite` included, keeps 64,000. A host that depended on the old 64,000 for those three ids sets `contextWindowTokens`.
+- 1b54334: A session log can now carry records from a newer release. A record whose `type` this version does not know is read, hash-verified and skipped by the message fold when its writer set `ignorable: true`; the same record without the flag is still refused, as before. Nothing changes for existing logs. New export: `IgnorableRecordSchema`.
+- c9a0a73: A background job now records when and what it last wrote (`lastOutputAt`, `lastOutputLine`) and can be probed for whether its process still exists (`BackgroundJobRegistry.isAlive`, and `isAlive` on the ref `bindOwner` returns). `judgeLiveness` and `formatLivenessLine` turn those facts into one verdict (progressing, waiting, stalled, dead, finished) with the idle seconds printed; `job` with `action: "list"` prints it for each running job, `action: "read"` ends with the time since the last output, and `wait_for_job` that gives up says how long the job had been silent instead of "for a while".
+
+  Monitor events, a monitor's end, a job's exit notice and a task completion notification (`finished_at`) now carry their time (`SystemEvent.at` renders as an `at` attribute on the opening tag only when given, so frames built without it are unchanged). A caller that compares the exact text of `job list` output or the "went quiet" line needs to expect the new wording; the additions to `BackgroundJob`, the tool ref and `JobWaitOutcome` are optional or additive for callers.
+
+- 976d848: A background job whose exit a `wait_for_job` (or a `job` read of a stopped job) already returned is no longer announced a second time by a `[Background job update]` notice, and an idle session no longer wakes the model for it. A job-exit notice now carries the job's output inline when all of it is at most 2048 bytes (in an untrusted frame); larger output is still read with the `job` tool. New and opt-in: `WakeBudget` / `wakeBudgetFromEnv` and the `NAMZU_MAX_CONSECUTIVE_WAKES` setting cap how many automatic job wakes happen in a row (off unless set; only a person's message resets it), and `ToolContext.backgroundJobs` gains an optional `markCollected`. Nothing needs to change to keep the old behaviour except a host that parsed the notice text for the absence of output.
+- 976d848: A sandboxed command that fails with a read-only-filesystem error, or a permission error on a path outside the sandbox's allowed set, now carries a note that it looks like a sandbox denial (inferred from the error text), so the model asks to leave the sandbox instead of retrying. A launcher setup failure (`bwrap:`, `unshare:`, `sandbox-exec:` errors) is reported as a runner failure, not as the command failing. Additive: `SandboxExecResult` gains an optional `attribution` and `bash` results gain `data.sandboxAttribution`; nothing needs to change unless a custom sandbox backend wants to set `attribution` itself.
+- 976d848: A plugin manifest may now declare `platforms` (for example `["linux", "darwin"]`) and `engines.namzu` (a version range such as `">=60.0.0 <62"`). A plugin that does not support the running operating system or Namzu version is refused when its manifest is read, with a message naming what it needs and what this machine has. Additive: manifests that declare neither load exactly as before, and `PluginEnablementCapabilities` gains optional `platform` and `namzuVersion` for hosts that want to supply their own.
+- 976d848: On Linux, cancelling or timing out a command, and stopping a background job, now also stops descendants that left its process group with `setsid` or a double fork. This includes a server a command deliberately started with `setsid` or `nohup`: before, it survived the cancel, and now it is stopped with the command. A command that must outlive its cancel has to be started outside the host's shell tool. Every command the host starts now has a `NAMZU_SHELL_TAG` variable in its environment, which a command can see; the sweep finds descendants by it. A descendant that clears its environment still escapes, and systems without `/proc` signal the process group only.
+- d72677f: A workflow run can now be resumed. Nothing breaks: every new field is optional and the new run options default to the old behaviour.
+
+  - `WorkflowRunOptions.resume` (build it with `loadWorkflowResume(await journal.read())`) makes agents whose prompt and options are unchanged return the result saved in the journal instead of running. The first call that is new, edited, failed or was skipped ends reuse for the rest of the run; agents cut off by a stop, a closed session or the token budget run again without ending it. `usage.cachedAgents` and `WorkflowAgentEvent.cached` report the replays.
+  - `FileWorkflowJournal` now numbers and chains every line (`seq`, `prev`), can sign them (`new FileWorkflowJournal(dir, { runId, key })`), writes saved results and pass boundaries with `fsync`, serialises appends per file and drops a late record after a pass's `run_finished`. `read()` returns the records that passed the check. A journal written by an older version reads as `legacy` and is reported as not resumable; custom `WorkflowJournal` implementations keep working and may ignore the new fields and the optional third `writeScript` argument.
+  - `WorkflowRunOptions.deterministic` makes `Date.now()`, `new Date()` with no argument and `Math.random()` throw and removes `eval`. It defaults to `false`, so existing embedders are unchanged; set it for scripts you intend to resume.
+  - New exports: `loadWorkflowResume`, `readWorkflowJournalChecked`, `workflowCallKey`, `formatWorkflowJournalLine`, `workflowJournalSeed`, `workflowJournalLineHash` and the types `WorkflowResumeState`, `WorkflowJournalReader`, `CheckedWorkflowJournal`, `ChainedWorkflowJournalRecord`, `WorkflowCallIdentity`. `WorkflowAgentOutcome.sessionId` lets a host record where an agent ran.
+  - `FileWorkflowJournal.read()` and appends without `options.runId` take the run id from the file's first `run_started` (then the folder's parent name), so an embedder that keeps a journal in its own folder reads it back whole.
+
+### Patch Changes
+
+- 880586f: Selecting a file row in a folder window now selects it and no longer opens it. `ui_act select` on a list or tree row that can also be invoked goes through the row's selection pattern and is verified by reading the row back as selected; where that cannot be reached nothing is sent and the result says a click would open the row. Text typed in the background into a window that was never activated is delivered again (the window's single edit control is used when its thread has no focus window). A caller that relied on `select` opening a file should use `invoke`.
+
+  A background input that the window provably did not react to is now sent once more on the screen (through the idle gate, lease and restore) and its result is `sent, no effect seen` and safe to repeat if that also does nothing; a result that said `sent, not confirmed` for such an input before now says so only when the window changed in a way that cannot be tied to the input. A shortcut with a modifier that matches an item of the window's classic menu is carried out as that menu command without pressing a key. `ForegroundMonitor` gains an optional `menuCommand`; a custom monitor is unaffected. A key or mouse button held down now counts as the person using the computer.
+
+  An input is no longer sent a second time on the screen when the window read cannot show that it did nothing: a read with a cut text or a cut walk, Enter, Backspace, Delete, Space and Ctrl+Z/Y/X/V, and a shortcut carried out as a menu command are reported `sent, not confirmed` instead.
+
+- abe120f: Fix `~/.namzu/index.sqlite` becoming "database disk image is malformed" after a Namzu process was killed in the middle of an index write. The next process read the file read-only, could not roll the dead writer's journal back, took the file for "not a database" and renamed a rebuilt one over it, leaving the old journal beside the new file to be played into it. The index version is now read through a writable connection that recovers the journal, only SQLite's corrupt or not-a-database answer starts a rebuild, and a rebuild takes the old file's lock before replacing it. A session that is open while another process replaces the index file now reopens it once instead of failing every later write with "attempt to write a readonly database", and concurrent rebuilders no longer replace each other's finished file. If another process keeps the index locked for about ten seconds, opening it now throws a `SessionIndexError` ("in use by another process") instead of silently renaming over the file. Nothing to change for callers.
+- 976d848: A job's exit notice is no longer withdrawn when the `job` read or `wait_for_job` result that delivered the exit was missing output the retention cap had dropped or the bounded result had omitted. The model is still told the job ended. Nothing to change in a host.
+- 1be03f4: The kill helpers (`killTree`, `killTrees`, the tag scan, the host-exit sweep and the job registry's liveness probe) now refuse a pid that is not an integer above 1, or is the host's own. They used to pass a recorded pid straight to `process.kill(-pid)`, and a pid of 1 or 0 makes that call signal every process of the user or the caller's own group, so a job recorded with a placeholder pid could take the host down when it exited. A refused pid is treated as a process that is already gone and does not throw. Nothing to do: real jobs have pids above 1 and are stopped as before.
+- 976d848: Resuming a session no longer holds its whole log in memory to verify a checkpoint: the check now streams the log and keeps only the last entry, with the same result. On a generated 260 MB, 60,000-record log, peak memory for the check fell from about 550 MB to about 275 MB, and it completes inside a 48 MB heap limit. Nothing needs to change.
+
 ## 59.0.0
 
 ### Major Changes

package/dist/compaction/context-window.d.ts

@@ -29,6 +29,59 @@
  * accumulates every release. Until a driver does that, an entry here is
  * only ever as fresh as the day someone checked it.
  */
+/** The window an id declares with the `[1m]` suffix, and the ceiling `NAMZU_AUTO_COMPACT_WINDOW` accepts. */
+export declare const ONE_MILLION_WINDOW_TOKENS = 1000000;
+/** The window a model is held to when `NAMZU_DISABLE_1M_CONTEXT` is on. */
+export declare const DISABLED_ONE_MILLION_WINDOW_CAP_TOKENS = 200000;
+/**
+ * A model id may end in `[1m]` (any case) to declare a one-million-token
+ * window, whether or not the id is recognised. The suffix is a marker for
+ * Namzu, never part of the vendor's name: strip it with this before an id
+ * reaches a driver or a wire.
+ */
+export declare function splitModelWindowSuffix(model: string): {
+    readonly model: string;
+    readonly declaresOneMillion: boolean;
+};
+/** The id with any `[1m]` suffix removed. */
+export declare function stripModelWindowSuffix(model: string): string;
+/**
+ * `NAMZU_DISABLE_1M_CONTEXT` (1, true, yes or on): the suffix is still
+ * stripped but declares nothing, and no window above 200,000 tokens is
+ * assumed for a model whose window comes from a driver or the table.
+ */
+export declare function oneMillionWindowDisabled(env?: NodeJS.ProcessEnv): boolean;
+/** Smallest and largest window `NAMZU_AUTO_COMPACT_WINDOW` can name. */
+export declare const AUTO_COMPACT_WINDOW_MIN_TOKENS = 100000;
+export declare const AUTO_COMPACT_WINDOW_MAX_TOKENS = 1000000;
+export type AutoCompactWindowParse = {
+    readonly kind: 'in_range';
+    readonly tokens: number;
+} | {
+    readonly kind: 'below_minimum';
+    readonly tokens: number;
+} | {
+    readonly kind: 'above_maximum';
+} | {
+    readonly kind: 'unusable';
+};
+/**
+ * Read an automatic-summary window the way people write one: a plain number
+ * (`200000`) or one with a `k` or `m` suffix (`786k`, `1m`, `1.5m`). Anything
+ * under 100,000 is `below_minimum`, over 1,000,000 `above_maximum`, and
+ * something that is not a size at all `unusable`.
+ */
+export declare function parseAutoCompactWindow(raw: string): AutoCompactWindowParse;
+/**
+ * The window to use for a written size, and a one-line warning when what was
+ * written had to be changed: below 100,000 reads as 100,000, above 1,000,000
+ * as 1,000,000, and a non-size is ignored (`tokens` undefined). `source`
+ * names where it was written, e.g. `NAMZU_AUTO_COMPACT_WINDOW`.
+ */
+export declare function resolveAutoCompactWindowSetting(raw: string | number, source: string): {
+    readonly tokens: number | undefined;
+    readonly warning?: string;
+};
 /**
  * Conservative default for a model we do not recognise.
  *

package/dist/compaction/context-window.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-window.d.ts","sourceRoot":"","sources":["../../src/compaction/context-window.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,SAAU,CAAA;AAqDrD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOjF;AAED,4FAA4F;AAC5F,eAAO,MAAM,iCAAiC,QAAS,CAAA;AACvD,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,QAAS,CAAA;AAC3C;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,MAAM,CAAA;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACtC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,EACpB,eAAe,CAAC,EAAE,MAAM,EACxB,uBAAuB,CAAC,EAAE,MAAM,GAC9B,MAAM,CAoBR;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,CAAA;CAClE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CACnC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS;AACzB;;;;;;GAMG;AACH,gBAAgB,CAAC,EAAE,MAAM,GACvB,qBAAqB,CAevB"}
+{"version":3,"file":"context-window.d.ts","sourceRoot":"","sources":["../../src/compaction/context-window.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,6GAA6G;AAC7G,eAAO,MAAM,yBAAyB,UAAY,CAAA;AAClD,2EAA2E;AAC3E,eAAO,MAAM,sCAAsC,SAAU,CAAA;AAI7D;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;CACpC,CAIA;AAED,6CAA6C;AAC7C,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAGtF;AAED,wEAAwE;AACxE,eAAO,MAAM,8BAA8B,SAAU,CAAA;AACrD,eAAO,MAAM,8BAA8B,UAA4B,CAAA;AAEvE,MAAM,MAAM,sBAAsB,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEhC;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAe1E;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC9C,GAAG,EAAE,MAAM,GAAG,MAAM,EACpB,MAAM,EAAE,MAAM,GACZ;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAwBpE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,SAAU,CAAA;AA4ErD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAQjF;AAaD,4FAA4F;AAC5F,eAAO,MAAM,iCAAiC,QAAS,CAAA;AACvD,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,QAAS,CAAA;AAC3C;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,MAAM,CAAA;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACtC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,EACpB,eAAe,CAAC,EAAE,MAAM,EACxB,uBAAuB,CAAC,EAAE,MAAM,GAC9B,MAAM,CAoBR;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,CAAA;CAClE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CACnC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS;AACzB;;;;;;GAMG;AACH,gBAAgB,CAAC,EAAE,MAAM,GACvB,qBAAqB,CAmBvB"}

package/dist/compaction/context-window.js

@@ -29,6 +29,94 @@
  * accumulates every release. Until a driver does that, an entry here is
  * only ever as fresh as the day someone checked it.
  */
+/** The window an id declares with the `[1m]` suffix, and the ceiling `NAMZU_AUTO_COMPACT_WINDOW` accepts. */
+export const ONE_MILLION_WINDOW_TOKENS = 1_000_000;
+/** The window a model is held to when `NAMZU_DISABLE_1M_CONTEXT` is on. */
+export const DISABLED_ONE_MILLION_WINDOW_CAP_TOKENS = 200_000;
+const WINDOW_SUFFIX = /\[1m\]$/i;
+/**
+ * A model id may end in `[1m]` (any case) to declare a one-million-token
+ * window, whether or not the id is recognised. The suffix is a marker for
+ * Namzu, never part of the vendor's name: strip it with this before an id
+ * reaches a driver or a wire.
+ */
+export function splitModelWindowSuffix(model) {
+    const match = WINDOW_SUFFIX.exec(model);
+    if (!match)
+        return { model, declaresOneMillion: false };
+    return { model: model.slice(0, match.index), declaresOneMillion: true };
+}
+/** The id with any `[1m]` suffix removed. */
+export function stripModelWindowSuffix(model) {
+    return splitModelWindowSuffix(model).model;
+}
+/**
+ * `NAMZU_DISABLE_1M_CONTEXT` (1, true, yes or on): the suffix is still
+ * stripped but declares nothing, and no window above 200,000 tokens is
+ * assumed for a model whose window comes from a driver or the table.
+ */
+export function oneMillionWindowDisabled(env = process.env) {
+    const value = env.NAMZU_DISABLE_1M_CONTEXT?.trim().toLowerCase();
+    return value === '1' || value === 'true' || value === 'yes' || value === 'on';
+}
+/** Smallest and largest window `NAMZU_AUTO_COMPACT_WINDOW` can name. */
+export const AUTO_COMPACT_WINDOW_MIN_TOKENS = 100_000;
+export const AUTO_COMPACT_WINDOW_MAX_TOKENS = ONE_MILLION_WINDOW_TOKENS;
+/**
+ * Read an automatic-summary window the way people write one: a plain number
+ * (`200000`) or one with a `k` or `m` suffix (`786k`, `1m`, `1.5m`). Anything
+ * under 100,000 is `below_minimum`, over 1,000,000 `above_maximum`, and
+ * something that is not a size at all `unusable`.
+ */
+export function parseAutoCompactWindow(raw) {
+    const text = raw.trim();
+    const last = text.slice(-1).toLowerCase();
+    const scale = last === 'm' ? 1_000_000 : last === 'k' ? 1_000 : undefined;
+    const digits = scale === undefined ? text : text.slice(0, -1);
+    const valid = scale === undefined ? /^\+?\d+$/ : /^\+?\d+(\.\d+)?$/;
+    const value = valid.test(digits) ? Number(digits) * (scale ?? 1) : Number.NaN;
+    if (Number.isNaN(value) || value < 1)
+        return { kind: 'unusable' };
+    if (value < AUTO_COMPACT_WINDOW_MIN_TOKENS)
+        return {
+            kind: 'below_minimum',
+            tokens: Math.min(AUTO_COMPACT_WINDOW_MIN_TOKENS - 1, Math.round(value)),
+        };
+    if (value > AUTO_COMPACT_WINDOW_MAX_TOKENS)
+        return { kind: 'above_maximum' };
+    return { kind: 'in_range', tokens: Math.round(value) };
+}
+/**
+ * The window to use for a written size, and a one-line warning when what was
+ * written had to be changed: below 100,000 reads as 100,000, above 1,000,000
+ * as 1,000,000, and a non-size is ignored (`tokens` undefined). `source`
+ * names where it was written, e.g. `NAMZU_AUTO_COMPACT_WINDOW`.
+ */
+export function resolveAutoCompactWindowSetting(raw, source) {
+    const text = String(raw);
+    const parsed = parseAutoCompactWindow(text);
+    const shown = `${source}="${text.slice(0, 32).replace(/[^\w.,+ $%{}=;-]+/g, '?')}${text.length > 32 ? '\u2026' : ''}"`;
+    const advice = 'Set it to a size from 100k to 1M, such as 200k or 200000, or unset it.';
+    switch (parsed.kind) {
+        case 'in_range':
+            return { tokens: parsed.tokens };
+        case 'below_minimum':
+            return {
+                tokens: AUTO_COMPACT_WINDOW_MIN_TOKENS,
+                warning: `${shown} reads as ${parsed.tokens.toLocaleString('en-US')} tokens, so Namzu treats it as the 100k minimum. ${advice}`,
+            };
+        case 'above_maximum':
+            return {
+                tokens: AUTO_COMPACT_WINDOW_MAX_TOKENS,
+                warning: `${shown} is too large, so Namzu treats it as the 1M maximum. ${advice}`,
+            };
+        case 'unusable':
+            return {
+                tokens: undefined,
+                warning: `${shown} isn't a usable size, so Namzu ignores it. ${advice}`,
+            };
+    }
+}
 /**
  * Conservative default for a model we do not recognise.
  *
@@ -83,8 +171,29 @@ const WINDOWS = [
     ['qwen', 32_768],
     ['mistral-large', 128_000],
     ['mixtral', 32_768],
+    // The current DeepSeek models document a 1M window
+    // (https://api-docs.deepseek.com/quick_start/pricing), listed per id: a
+    // gateway can serve a derivative under a name that merely starts like one
+    // (a fine-tune, a distill), and nothing says it keeps the parent's window.
+    // Over-estimating ends a turn on a provider rejection; under-estimating
+    // costs a summary. So an id not named here falls to the bare `deepseek`
+    // row below, the 64k the older ids (chat, reasoner, R1 distills) had. The
+    // three ids are matched whole (see `DEEPSEEK_ONE_MILLION_IDS`), never by
+    // substring.
     ['deepseek', 64_000],
 ];
+/** DeepSeek ids documented at a 1M window; matched exactly, not by substring. */
+const DEEPSEEK_ONE_MILLION_IDS = new Set([
+    'deepseek-v4-flash',
+    'deepseek-v4-pro',
+    'deepseek-flash',
+]);
+/** The id with a gateway prefix (`deepseek/`) and a `:tag` (`:free`) removed. */
+function bareModelName(id) {
+    const afterSlash = id.slice(id.lastIndexOf('/') + 1);
+    const colon = afterSlash.indexOf(':');
+    return colon === -1 ? afterSlash : afterSlash.slice(0, colon);
+}
 const SORTED = [...WINDOWS].sort((a, b) => b[0].length - a[0].length);
 /**
  * Best-effort context window for a model id, or `undefined` when the id is
@@ -95,7 +204,20 @@ const SORTED = [...WINDOWS].sort((a, b) => b[0].length - a[0].length);
 export function lookupContextWindow(model) {
     if (!model)
         return undefined;
-    const id = model.toLowerCase();
+    const { declaresOneMillion } = splitModelWindowSuffix(model);
+    const known = lookupBareContextWindow(model);
+    if (declaresOneMillion && !oneMillionWindowDisabled()) {
+        return Math.max(known ?? 0, ONE_MILLION_WINDOW_TOKENS);
+    }
+    return known;
+}
+/** The table's answer for an id with any `[1m]` suffix ignored. */
+function lookupBareContextWindow(model) {
+    if (!model)
+        return undefined;
+    const id = stripModelWindowSuffix(model).toLowerCase();
+    if (DEEPSEEK_ONE_MILLION_IDS.has(bareModelName(id)))
+        return ONE_MILLION_WINDOW_TOKENS;
     for (const [prefix, tokens] of SORTED) {
         if (id.includes(prefix))
             return tokens;
@@ -162,13 +284,30 @@ providerReported) {
     if (configured !== undefined && configured > 0) {
         return { tokens: configured, source: 'config' };
     }
+    const { declaresOneMillion } = splitModelWindowSuffix(model ?? '');
+    const disabled = oneMillionWindowDisabled();
+    const base = resolveUndeclaredWindow(model, providerReported);
+    // `[1m]` raises the window to at least a million (reported as 'model-table':
+    // the id itself is the fact), never lowers one a
+    // driver or the table already puts higher.
+    if (declaresOneMillion && !disabled && base.tokens < ONE_MILLION_WINDOW_TOKENS) {
+        return { tokens: ONE_MILLION_WINDOW_TOKENS, source: 'model-table' };
+    }
+    // With the million-token window switched off, nothing assumed or reported
+    // for a model counts for more than 200,000.
+    if (disabled && base.tokens > DISABLED_ONE_MILLION_WINDOW_CAP_TOKENS) {
+        return { tokens: DISABLED_ONE_MILLION_WINDOW_CAP_TOKENS, source: base.source };
+    }
+    return base;
+}
+function resolveUndeclaredWindow(model, providerReported) {
     if (providerReported !== undefined && providerReported > 0) {
         return { tokens: providerReported, source: 'provider' };
     }
     // A driver that resolved `undefined` falls through to HERE, not to the
     // default. "I asked and it does not know" leaves the table exactly as
     // authoritative as it was before anyone asked.
-    const known = lookupContextWindow(model);
+    const known = lookupBareContextWindow(model);
     if (known !== undefined) {
         return { tokens: known, source: 'model-table' };
     }

package/dist/compaction/context-window.js.map

@@ -1 +1 @@
-{"version":3,"file":"context-window.js","sourceRoot":"","sources":["../../src/compaction/context-window.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAA;AAErD;;;;;GAKG;AACH,MAAM,OAAO,GAA6D;IACzE,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,eAAe,EAAE,SAAS,CAAC;IAC5B,CAAC,eAAe,EAAE,SAAS,CAAC;IAC5B,CAAC,iBAAiB,EAAE,SAAS,CAAC;IAC9B,CAAC,iBAAiB,EAAE,SAAS,CAAC;IAC9B,CAAC,iBAAiB,EAAE,SAAS,CAAC;IAC9B,CAAC,iBAAiB,EAAE,SAAS,CAAC;IAC9B,CAAC,mBAAmB,EAAE,SAAS,CAAC;IAChC,uEAAuE;IACvE,kEAAkE;IAClE,qEAAqE;IACrE,CAAC,kBAAkB,EAAE,OAAO,CAAC;IAC7B,CAAC,mBAAmB,EAAE,OAAO,CAAC;IAC9B,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAC5B,CAAC,eAAe,EAAE,OAAO,CAAC;IAC1B,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAC5B,CAAC,mBAAmB,EAAE,OAAO,CAAC;IAC9B,CAAC,mBAAmB,EAAE,OAAO,CAAC;IAC9B,CAAC,kBAAkB,EAAE,OAAO,CAAC;IAC7B,CAAC,eAAe,EAAE,OAAO,CAAC;IAC1B,CAAC,SAAS,EAAE,OAAO,CAAC;IACpB,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,QAAQ,EAAE,OAAO,CAAC;IACnB,CAAC,aAAa,EAAE,OAAO,CAAC;IACxB,CAAC,OAAO,EAAE,KAAK,CAAC;IAChB,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,IAAI,EAAE,OAAO,CAAC;IACf,CAAC,SAAS,EAAE,OAAO,CAAC;IACpB,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,kBAAkB,EAAE,SAAS,CAAC;IAC/B,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,mCAAmC;IACnC,CAAC,WAAW,EAAE,OAAO,CAAC;IACtB,CAAC,WAAW,EAAE,OAAO,CAAC;IACtB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,eAAe,EAAE,OAAO,CAAC;IAC1B,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,UAAU,EAAE,MAAM,CAAC;CACpB,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAErE;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;IAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IACvC,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAA;AACvD,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAC3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAA;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACtC,UAA8B,EAC9B,YAAoB,EACpB,eAAwB,EACxB,uBAAgC;IAEhC,IACC,uBAAuB,KAAK,SAAS;QACrC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,IAAI,uBAAuB,IAAI,CAAC,CAAC;QAEhF,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAA;IACjF,IAAI,uBAAuB,KAAK,SAAS,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAA;QAC9D,OAAO,CAAC,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,MAAM,CAAC,GAAG,YAAY,CAAA;IAC9F,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAA;IAC/C,IAAI,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;QAAE,OAAO,4BAA4B,CAAA;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACvB,eAAe,KAAK,SAAS,IAAI,eAAe,GAAG,CAAC;QACnD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,iCAAiC,EACpC,iCAAiC,CACjC,CAAA;IACD,MAAM,QAAQ,GAAG,CAAC,YAAY,GAAG,OAAO,GAAG,qBAAqB,CAAC,GAAG,YAAY,CAAA;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,QAAQ,CAAC,CAAC,CAAA;AACrE,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CACnC,UAA8B,EAC9B,KAAyB;AACzB;;;;;;GAMG;AACH,gBAAyB;IAEzB,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAChD,CAAC;IACD,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IACxD,CAAC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,+CAA+C;IAC/C,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;AACrE,CAAC"}
+{"version":3,"file":"context-window.js","sourceRoot":"","sources":["../../src/compaction/context-window.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,6GAA6G;AAC7G,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAA;AAClD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sCAAsC,GAAG,OAAO,CAAA;AAE7D,MAAM,aAAa,GAAG,UAAU,CAAA;AAEhC;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAInD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAA;IACvD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;AACxE,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,sBAAsB,CAAC,KAAa;IACnD,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAA;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAChE,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI,CAAA;AAC9E,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAA;AACrD,MAAM,CAAC,MAAM,8BAA8B,GAAG,yBAAyB,CAAA;AAQvE;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IACjD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACzC,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAA;IACnE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA;IAC7E,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IACjE,IAAI,KAAK,GAAG,8BAA8B;QACzC,OAAO;YACN,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,8BAA8B,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SACvE,CAAA;IACF,IAAI,KAAK,GAAG,8BAA8B;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IAC5E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAA;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC9C,GAAoB,EACpB,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACxB,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,GAAG,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAA;IACtH,MAAM,MAAM,GAAG,wEAAwE,CAAA;IACvF,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,UAAU;YACd,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;QACjC,KAAK,eAAe;YACnB,OAAO;gBACN,MAAM,EAAE,8BAA8B;gBACtC,OAAO,EAAE,GAAG,KAAK,aAAa,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,oDAAoD,MAAM,EAAE;aAC/H,CAAA;QACF,KAAK,eAAe;YACnB,OAAO;gBACN,MAAM,EAAE,8BAA8B;gBACtC,OAAO,EAAE,GAAG,KAAK,wDAAwD,MAAM,EAAE;aACjF,CAAA;QACF,KAAK,UAAU;YACd,OAAO;gBACN,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,GAAG,KAAK,8CAA8C,MAAM,EAAE;aACvE,CAAA;IACH,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,OAAO,CAAA;AAErD;;;;;GAKG;AACH,MAAM,OAAO,GAA6D;IACzE,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,eAAe,EAAE,SAAS,CAAC;IAC5B,CAAC,eAAe,EAAE,SAAS,CAAC;IAC5B,CAAC,iBAAiB,EAAE,SAAS,CAAC;IAC9B,CAAC,iBAAiB,EAAE,SAAS,CAAC;IAC9B,CAAC,iBAAiB,EAAE,SAAS,CAAC;IAC9B,CAAC,iBAAiB,EAAE,SAAS,CAAC;IAC9B,CAAC,mBAAmB,EAAE,SAAS,CAAC;IAChC,uEAAuE;IACvE,kEAAkE;IAClE,qEAAqE;IACrE,CAAC,kBAAkB,EAAE,OAAO,CAAC;IAC7B,CAAC,mBAAmB,EAAE,OAAO,CAAC;IAC9B,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAC5B,CAAC,eAAe,EAAE,OAAO,CAAC;IAC1B,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAC5B,CAAC,mBAAmB,EAAE,OAAO,CAAC;IAC9B,CAAC,mBAAmB,EAAE,OAAO,CAAC;IAC9B,CAAC,kBAAkB,EAAE,OAAO,CAAC;IAC7B,CAAC,eAAe,EAAE,OAAO,CAAC;IAC1B,CAAC,SAAS,EAAE,OAAO,CAAC;IACpB,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,QAAQ,EAAE,OAAO,CAAC;IACnB,CAAC,aAAa,EAAE,OAAO,CAAC;IACxB,CAAC,OAAO,EAAE,KAAK,CAAC;IAChB,CAAC,eAAe,EAAE,MAAM,CAAC;IACzB,CAAC,IAAI,EAAE,OAAO,CAAC;IACf,CAAC,SAAS,EAAE,OAAO,CAAC;IACpB,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,kBAAkB,EAAE,SAAS,CAAC;IAC/B,CAAC,gBAAgB,EAAE,SAAS,CAAC;IAC7B,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,mCAAmC;IACnC,CAAC,WAAW,EAAE,OAAO,CAAC;IACtB,CAAC,WAAW,EAAE,OAAO,CAAC;IACtB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,eAAe,EAAE,OAAO,CAAC;IAC1B,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,aAAa;IACb,CAAC,UAAU,EAAE,MAAM,CAAC;CACpB,CAAA;AAED,iFAAiF;AACjF,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IAC7D,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;CAChB,CAAC,CAAA;AAEF,iFAAiF;AACjF,SAAS,aAAa,CAAC,EAAU;IAChC,MAAM,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACrC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAErE;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,EAAE,kBAAkB,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAA;IAC5D,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAC5C,IAAI,kBAAkB,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,EAAE,yBAAyB,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,mEAAmE;AACnE,SAAS,uBAAuB,CAAC,KAAyB;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IACtD,IAAI,wBAAwB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,yBAAyB,CAAA;IACrF,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IACvC,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAA;AACvD,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAC3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAA;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACtC,UAA8B,EAC9B,YAAoB,EACpB,eAAwB,EACxB,uBAAgC;IAEhC,IACC,uBAAuB,KAAK,SAAS;QACrC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,IAAI,uBAAuB,IAAI,CAAC,CAAC;QAEhF,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAA;IACjF,IAAI,uBAAuB,KAAK,SAAS,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAA;QAC9D,OAAO,CAAC,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,MAAM,CAAC,GAAG,YAAY,CAAA;IAC9F,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAA;IAC/C,IAAI,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;QAAE,OAAO,4BAA4B,CAAA;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACvB,eAAe,KAAK,SAAS,IAAI,eAAe,GAAG,CAAC;QACnD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,iCAAiC,EACpC,iCAAiC,CACjC,CAAA;IACD,MAAM,QAAQ,GAAG,CAAC,YAAY,GAAG,OAAO,GAAG,qBAAqB,CAAC,GAAG,YAAY,CAAA;IAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,QAAQ,CAAC,CAAC,CAAA;AACrE,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CACnC,UAA8B,EAC9B,KAAyB;AACzB;;;;;;GAMG;AACH,gBAAyB;IAEzB,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAChD,CAAC;IACD,MAAM,EAAE,kBAAkB,EAAE,GAAG,sBAAsB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAA;IAC3C,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAA;IAC7D,6EAA6E;IAC7E,iDAAiD;IACjD,2CAA2C;IAC3C,IAAI,kBAAkB,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAChF,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IACpE,CAAC;IACD,0EAA0E;IAC1E,4CAA4C;IAC5C,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,sCAAsC,EAAE,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,sCAAsC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;IAC/E,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,uBAAuB,CAC/B,KAAyB,EACzB,gBAAoC;IAEpC,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IACxD,CAAC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,+CAA+C;IAC/C,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAChD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;AACrE,CAAC"}

package/dist/execution/workflow/index.d.ts

@@ -1,9 +1,11 @@
 export { WorkflowScriptError } from './errors.js';
 export { FileWorkflowJournal } from './journal.js';
 export { parseWorkflowMeta } from './meta.js';
+export { formatWorkflowJournalLine, loadWorkflowResume, readWorkflowJournalChecked, workflowCallKey, workflowJournalLineHash, workflowJournalSeed, } from './resume.js';
+export type { WorkflowCallIdentity } from './resume.js';
 export { summarizeWorkflowPhases } from './phases.js';
 export type { PhaseAgentView, PhaseRecord } from './phases.js';
-export { resolveWorkflowLimits, WORKFLOW_HOST_CALL, WorkflowRuntime } from './runtime.js';
+export { resolveWorkflowLimits, WORKFLOW_HOST_CALL, WorkflowRuntime, } from './runtime.js';
 export type { WorkflowRuntimeOptions } from './runtime.js';
 export type * from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/execution/workflow/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/execution/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AACzF,YAAY,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAC1D,mBAAmB,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/execution/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EACN,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,eAAe,EACf,uBAAuB,EACvB,mBAAmB,GACnB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EACN,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,GACf,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAC1D,mBAAmB,YAAY,CAAA"}

package/dist/execution/workflow/index.js

@@ -1,6 +1,7 @@
 export { WorkflowScriptError } from './errors.js';
 export { FileWorkflowJournal } from './journal.js';
 export { parseWorkflowMeta } from './meta.js';
+export { formatWorkflowJournalLine, loadWorkflowResume, readWorkflowJournalChecked, workflowCallKey, workflowJournalLineHash, workflowJournalSeed, } from './resume.js';
 export { summarizeWorkflowPhases } from './phases.js';
-export { resolveWorkflowLimits, WORKFLOW_HOST_CALL, WorkflowRuntime } from './runtime.js';
+export { resolveWorkflowLimits, WORKFLOW_HOST_CALL, WorkflowRuntime, } from './runtime.js';
 //# sourceMappingURL=index.js.map

package/dist/execution/workflow/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/execution/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/execution/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EACN,yBAAyB,EACzB,kBAAkB,EAClB,0BAA0B,EAC1B,eAAe,EACf,uBAAuB,EACvB,mBAAmB,GACnB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD,OAAO,EACN,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,GACf,MAAM,cAAc,CAAA"}

package/dist/execution/workflow/journal.d.ts

@@ -1,4 +1,4 @@
-import type { WorkflowJournal, WorkflowJournalRecord } from './types.js';
+import type { CheckedWorkflowJournal, WorkflowJournal, WorkflowJournalReader, WorkflowJournalRecord } from './types.js';
 export declare function sha256(text: string): string;
 /** The first `max` UTF-16 units of `text`, never ending inside a surrogate pair. */
 export declare function preview(text: string, max?: number): string;
@@ -6,13 +6,33 @@ export declare function preview(text: string, max?: number): string;
  * A journal in a directory: `script.js` (the exact script text, mode 0600)
  * and `journal.jsonl` (one JSON record per line, append-only). The caller
  * chooses the directory, normally `<session>/runs/<runId>/workflow/`.
+ *
+ * Every line carries `seq` and `prev` (the hash of the line before it, the
+ * first chaining from a seed bound to the run id), so a line that was edited,
+ * removed or cut short is found when the journal is read back. One writer per
+ * file serves the whole process: a resumed pass and a late agent of the pass
+ * before it append through the same queue and the same chain, and nothing is
+ * appended after a pass's `run_finished` until the next pass starts. This
+ * assumes one process writes the file at a time, which the session lease
+ * already guarantees. A chain proves the file was not damaged or edited by
+ * accident; someone who can rewrite the whole file can rewrite the chain too.
  */
-export declare class FileWorkflowJournal implements WorkflowJournal {
+export declare class FileWorkflowJournal implements WorkflowJournal, WorkflowJournalReader {
     private readonly dir;
+    private readonly options;
     private ready;
-    constructor(dir: string);
+    private readonly file;
+    constructor(dir: string, options?: {
+        readonly runId?: string;
+        /** A secret that signs every line; see `readWorkflowJournalChecked`. */
+        readonly key?: string | Uint8Array;
+    });
     private ensure;
-    writeScript(source: string): Promise<void>;
+    /** The run id of the file's first line, learned from the file or from the first `run_started` written. */
+    private learned;
+    private runId;
+    writeScript(source: string, _sha256?: string, pass?: number): Promise<void>;
+    read(): Promise<CheckedWorkflowJournal>;
     append(record: WorkflowJournalRecord): Promise<void>;
 }
 //# sourceMappingURL=journal.d.ts.map

package/dist/execution/workflow/journal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../../../src/execution/workflow/journal.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAExE,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,oFAAoF;AACpF,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAM,GAAG,MAAM,CAMvD;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IAG9C,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,OAAO,CAAC,KAAK,CAA2B;gBAEX,GAAG,EAAE,MAAM;IAExC,OAAO,CAAC,MAAM;IAKR,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1C,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;CAM1D"}
+{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../../../src/execution/workflow/journal.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACX,sBAAsB,EACtB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,YAAY,CAAA;AAEnB,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,oFAAoF;AACpF,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAM,GAAG,MAAM,CAMvD;AA2BD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,mBAAoB,YAAW,eAAe,EAAE,qBAAqB;IAKhF,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IALzB,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;gBAGX,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;QACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;QACvB,wEAAwE;QACxE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;KAC7B;IAKP,OAAO,CAAC,MAAM;IAKd,0GAA0G;IAC1G,OAAO,CAAC,OAAO,CAAoB;IAEnC,OAAO,CAAC,KAAK;IAmBP,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,SAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtE,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAa7C,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;CAgEpD"}