@nexrall/code-core 1.4.65 → 1.4.67

package/dist/agent/compaction.js

@@ -0,0 +1,976 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompactionUnavailableError = exports.PRUNE_KEEP_RECENT = exports.VERIFY_CMD_RE = exports.WRITE_TOOL_NAMES = exports.MAX_BODY_BYTES = exports.COMPACT_MAX_FAILURES = exports.COMPACT_MIN_RECLAIM_BYTES = exports.COMPACT_KEEP_MIN = exports._lastApiCallEndedAt = exports.PRUNE_MIN_RECLAIM_BYTES = exports.MODEL_CONTEXT_TOKENS = void 0;
+exports.contextWindowFor = contextWindowFor;
+exports.compactionLimits = compactionLimits;
+exports.compactionThresholds = compactionThresholds;
+exports.pruneReclaimFloor = pruneReclaimFloor;
+exports.estimateBodyBytes = estimateBodyBytes;
+exports.resolveAutoCompact = resolveAutoCompact;
+exports.resolveVerificationNudge = resolveVerificationNudge;
+exports.allowsTestOnlyWrite = allowsTestOnlyWrite;
+exports.findSafeCutIndex = findSafeCutIndex;
+exports.persistRuntimeContext = persistRuntimeContext;
+exports.transcriptOf = transcriptOf;
+exports.createLedger = createLedger;
+exports.ledgerRecord = ledgerRecord;
+exports.ledgerSummary = ledgerSummary;
+exports.pruneOldToolResults = pruneOldToolResults;
+exports.makeCachedSummarizer = makeCachedSummarizer;
+exports.autoCompactMessages = autoCompactMessages;
+exports.maybeCompactMemory = maybeCompactMemory;
+exports.estimateTokensRough = estimateTokensRough;
+exports.compactMessagesForResume = compactMessagesForResume;
+const types_1 = require("../types");
+const testIntegrity_1 = require("./testIntegrity");
+const flaky_1 = require("./flaky");
+const client_1 = require("../api/client");
+const rules_1 = require("../permissions/rules");
+const memory_1 = require("./memory");
+const modelCatalogue_1 = require("./modelCatalogue");
+const safeSlice_1 = require("../util/safeSlice");
+const hooks_1 = require("./hooks");
+// ─── Auto-compact ─────────────────────────────────────────────────────────────
+//
+// When the conversation's prompt size approaches the model's context window,
+// summarise the older portion automatically (Claude-Code style) instead of
+// letting the request fail or forcing the user to run /compact by hand.
+//
+// Compaction only happens at a turn boundary (top of the loop, before the next
+// streamChat) and only cuts at a "safe" user message — one with no tool_result
+// blocks — so tool_use/tool_result pairing is never broken.
+// Context window per model, keyed by BOTH the tier aliases and the real model
+// ids the picker now sends.
+//
+// This table drives auto-compaction, so a wrong number is expensive in one
+// direction and merely wasteful in the other: too small compacts early and
+// summarises lossily; too LARGE means compaction never fires before the real
+// ceiling and the turn dies on a provider 400 — mid-conversation, on exactly
+// the long sessions compaction exists to protect.
+//
+// It previously held only turbo/pro/ultra, all at 1M, which was correct while
+// every tier was a 1M-context Claude. With several providers selectable by
+// name that assumption breaks hard: gpt-4o-mini is 128K, i.e. 8x smaller than
+// the value this table would have guessed for it.
+//
+// The Anthropic figures mirror the backend registry
+// (services/providers/modelRegistry.js). The OpenAI figures were MEASURED
+// against the live API rather than read from docs — note that gpt-5.4 is
+// 922_000, not a round 1M, and gpt-4.1 is 1_047_576.
+exports.MODEL_CONTEXT_TOKENS = {
+    // Tier aliases — still sent by older clients, saved settings and sub-agent
+    // frontmatter, so they must keep resolving.
+    turbo: 1000000,
+    pro: 1000000,
+    ultra: 1000000,
+    fast: 200000,
+    // Anthropic, by real model id.
+    'claude-sonnet-5-5': 1000000,
+    'claude-opus-5-5': 1000000,
+    'claude-fable-5-1': 1000000,
+    'claude-haiku-4-5-20251001': 200000,
+    // OpenAI, by real model id (measured).
+    'gpt-5.4': 922000,
+    'gpt-5.4-mini': 272000,
+    'gpt-4.1': 1047576,
+    'gpt-4o-mini': 128000,
+    // GPT-5.6 family: MEASURED 2026-09-03 via a 400 (same technique as
+    // gpt-5.4's 922_000 above) — and it is the EXACT SAME 922,000-token
+    // ceiling on all three sizes. This CONTRADICTS the publicly documented
+    // figure (openai.com/index/gpt-5-6 + OpenRouter's model card both
+    // advertise 1,050,000) — see backend services/providers/modelRegistry.js's
+    // own comment on these rows for the measured 400 body. Guessing 1.05M here
+    // would fire auto-compaction ~12% past the real wall.
+    'gpt-5.6-sol': 922000,
+    'gpt-5.6-terra': 922000,
+    'gpt-5.6-luna': 922000,
+    // DeepSeek, by real model id (documented — see backend/services/providers/
+    // modelRegistry.js's own TODO(unverified-by-400): DeepSeek accepts an
+    // oversized max_completion_tokens without rejecting it, so there was no 400
+    // to measure the ceiling from the way the OpenAI rows above were).
+    'deepseek-flash': 1048576,
+    // Qwen (DashScope), by real model id (documented max input, same caveat).
+    'qwen3.7-max': 991800,
+    // Z.ai (GLM), by real model id. contextWindow is documented (Z.ai/
+    // Cloudflare Workers AI model cards, both list 1,048,576) rather than
+    // measured — a ~400K-token request was ACCEPTED (200), not rejected, so
+    // there was no 400 to read a real ceiling out of. maxOutputTokens IS
+    // measured: `max_tokens: 999999` was rejected with the ceiling in the
+    // error body (backend services/providers/modelRegistry.js's glm-5.3 row
+    // has the full verification notes).
+    'glm-5.3': 1048576,
+};
+/**
+ * Context window (tokens) for a model alias or real model id.
+ *
+ * Checks the LIVE catalogue (GET /api/code/models, modelCatalogue.ts) first —
+ * populated once per process by whichever client fetched it (CLI at session
+ * start, VS Code via _postModelCatalogue, desktop via its main-process
+ * fetch) — falling back to this hard-coded table when no live data exists yet
+ * (offline, older backend, or the catalogue simply hasn't been fetched by
+ * this call site). This is what lets a model added to the backend registry
+ * (services/providers/modelRegistry.js) get the CORRECT context window here
+ * even before this table is updated by hand for a new nexrall-code release —
+ * exactly the class of bug GPT-5.6's 922K-vs-1.05M mismatch was (see
+ * modelRegistry.js's own comment on that row).
+ *
+ * The static-table fallback is deliberately the SMALLEST window in the table
+ * rather than the largest. An unknown model is most likely a newly added one
+ * this client build predates, and guessing high is the failure that cannot be
+ * recovered from: the turn hits a provider 400 with no chance to compact.
+ * Guessing low only costs an earlier, lossy compaction — annoying, not broken.
+ */
+function contextWindowFor(model) {
+    const fallback = exports.MODEL_CONTEXT_TOKENS[model ?? 'turbo'] ?? 128000;
+    return (0, modelCatalogue_1.liveContextWindowFor)(model, fallback);
+}
+// ── Compaction thresholds (cost control) ─────────────────────────────────────
+// Two independent triggers, deliberately at DIFFERENT levels:
+//
+//   • PRUNE threshold (cheap, lossy-but-structure-preserving, NO model call):
+//     fires EARLY. Every turn a large history is resent, cache-read alone
+//     (0.10× input) is still billed on the whole prefix — on a 700K-token
+//     session that is real money accruing per turn long before the 1M wall.
+//     Anthropic's own server-side compaction defaults its trigger to 150K
+//     input tokens (docs: compact_20260112 default trigger 150000). We mirror
+//     that intent: start shedding already-consumed tool_result bulk at ~120K
+//     tokens (see compactionLimits) so the per-turn cache-read bill stops growing,
+//     WITHOUT paying for a summariser model call and WITHOUT dropping any turn
+//     (pruneOldToolResults keeps every tool_use/tool_result pair intact).
+//
+//   • SUMMARISE threshold (a model call, lossy: drops whole turns): Claude Code's
+//     ~167K line (see compactionLimits). Later than prune, because summarise-of-summarise is the main cause of an
+//     agent "forgetting" earlier work. Only when cheap pruning can't keep the
+//     prompt under this line do we fall through to summarisation.
+//
+// Both are overridable via env for power users / tests.
+function envFraction(name, fallback) {
+    const v = Number(process.env[name]);
+    return Number.isFinite(v) && v > 0 && v < 1 ? v : fallback;
+}
+// Where auto-compaction fires, in TOKENS — Claude Code's rule, not a fraction of a 1M window.
+//
+// Claude Code summarises at `window − min(maxOutput, 20K) − 13K buffer`, on a 200K window
+// (~167K tokens). We used to wait for 80% of a 1M window (~800K): every request of a long
+// run re-read that whole prefix from cache, so a session cost ~5× more per request than
+// the same work in Claude Code long before anything was shed. The window used for this is
+// capped (default 200K, like Claude Code) — the model's real 1M window still bounds what
+// the backend will accept; this only decides when WE tidy up.
+//
+//   NEXRALL_COMPACT_WINDOW / settings.json "autoCompactWindow": the cap (tokens). Set it
+//     to e.g. 1000000 to use the whole window before compacting.
+//   NEXRALL_PRUNE_THRESHOLD / NEXRALL_COMPACT_THRESHOLD: fractions of that capped window.
+const DEFAULT_COMPACT_WINDOW = 200000;
+const COMPACT_OUTPUT_RESERVE = 20000; // Claude Code: min(model max output, 20K)
+const COMPACT_BUFFER_TOKENS = 13000; // Claude Code's autocompact buffer
+const DEFAULT_PRUNE_FRACTION = 0.6; // cheap lossless prune ~120K, before the ~167K summarise
+function compactWindowCap(settingsRaw) {
+    const fromEnv = Number(process.env.NEXRALL_COMPACT_WINDOW);
+    if (Number.isFinite(fromEnv) && fromEnv >= 50000)
+        return fromEnv;
+    const fromSettings = Number(settingsRaw?.autoCompactWindow);
+    if (Number.isFinite(fromSettings) && fromSettings >= 50000)
+        return fromSettings;
+    return DEFAULT_COMPACT_WINDOW;
+}
+/** Token counts at which auto-prune and auto-compact (summarise) fire for a model window. */
+function compactionLimits(contextWindow, settingsRaw) {
+    const eff = Math.min(contextWindow, compactWindowCap(settingsRaw));
+    const compactFrac = envFraction('NEXRALL_COMPACT_THRESHOLD', 0);
+    const pruneFrac = envFraction('NEXRALL_PRUNE_THRESHOLD', 0);
+    const compact = compactFrac
+        ? eff * compactFrac
+        : Math.max(eff * 0.5, eff - Math.min(COMPACT_OUTPUT_RESERVE, eff * 0.1) - COMPACT_BUFFER_TOKENS);
+    const prune = Math.min(pruneFrac ? eff * pruneFrac : eff * DEFAULT_PRUNE_FRACTION, compact * 0.9);
+    return { prune: Math.floor(prune), compact: Math.floor(compact) };
+}
+/** Auto-prune / auto-compact thresholds as fractions of the context window — for UI display (e.g. `/context`). */
+function compactionThresholds(contextWindow = 1000000, settingsRaw) {
+    const { prune, compact } = compactionLimits(contextWindow, settingsRaw);
+    return { prune: prune / contextWindow, compact: compact / contextWindow };
+}
+// Only bother pruning if it reclaims a meaningful amount — a tiny prune busts
+// the message-level prompt cache (the pruned prefix changes) for little gain,
+// so we require at least this many bytes reclaimed before accepting a prune.
+// Sized for the ~120K-token prune line: at 256 KB a prune could rarely reclaim enough to
+// qualify, so sessions skipped straight to the lossy summariser.
+exports.PRUNE_MIN_RECLAIM_BYTES = 96 * 1024; // 96 KB
+// Cache-aware prune floor. The 96 KB floor exists ONLY to avoid busting a WARM prompt
+// cache for a small gain. Once the session has been idle past the provider cache TTL
+// (Anthropic/OpenAI: 5 min), the whole prefix is re-written on the next request anyway,
+// so a prune at that moment costs nothing extra — accept a much smaller reclaim then.
+// Keyed by sessionId (same scheme as _subAgentBudgets) because runAgentLoop runs once
+// per user turn and the idle gap that matters is BETWEEN turns.
+const PRUNE_MIN_RECLAIM_BYTES_COLD = 16 * 1024; // 16 KB
+const CACHE_COLD_AFTER_MS = 5 * 60000;
+exports._lastApiCallEndedAt = new Map();
+function pruneReclaimFloor(lastCallEndedAt, now = Date.now()) {
+    return lastCallEndedAt !== undefined && now - lastCallEndedAt >= CACHE_COLD_AFTER_MS
+        ? PRUNE_MIN_RECLAIM_BYTES_COLD
+        : exports.PRUNE_MIN_RECLAIM_BYTES;
+}
+exports.COMPACT_KEEP_MIN = 6; // always keep at least the last N messages verbatim
+/**
+ * Bytes a compaction must reclaim to count as productive.
+ *
+ * Deliberately much smaller than PRUNE_MIN_RECLAIM_BYTES: a prune declines when the
+ * gain isn't worth busting the prompt cache, whereas by the time we are summarising
+ * we are already committed to rewriting the prefix — the only question is whether the
+ * summariser is making ANY headway. 32 KB is small enough that a genuinely useful
+ * compaction always clears it, large enough that shuffling a few bytes doesn't.
+ */
+exports.COMPACT_MIN_RECLAIM_BYTES = 32 * 1024; // 32 KB
+/**
+ * Consecutive non-productive compaction attempts before auto-compaction is switched
+ * off for the rest of the run.
+ *
+ * 3 rather than 1 because the failure is often transient — a summariser stream that
+ * blipped will usually succeed on the next turn, and giving up instantly would lose
+ * the safety net for a whole long session over one network hiccup. 3 also bounds the
+ * wasted spend: at most three summariser calls, not hundreds.
+ */
+exports.COMPACT_MAX_FAILURES = 3;
+// Byte-level safety net, independent of the token estimate.
+//
+// Tool-heavy sessions on large codebases accumulate many tool_result blocks
+// (read_file / bash / search output). The token count can still look "under
+// budget" while the SERIALISED body has grown to tens of MB — the char↔token
+// ratio for JSON/code/logs is highly variable, so a token threshold alone does
+// NOT bound the request body size. The backend rejects bodies over its limit
+// (413), which the token-based compactor never anticipates because:
+//   • it reacts to lastPromptTokens from the PREVIOUS turn's usage event, so on
+//     a freshly-resumed (already-large) session it is 0 and never fires, and
+//   • 80% × 1M tokens of tool_result can be 25–45 MB — far past any body limit.
+// This guard measures the ACTUAL body bytes before each send and forces a
+// compaction whenever it crosses the threshold, regardless of the token count.
+// Kept comfortably under the server's 25 MB /api/code limit.
+exports.MAX_BODY_BYTES = 8 * 1024 * 1024; // 8 MB
+/** Approximate serialised request-body size (bytes) for the messages array. */
+function estimateBodyBytes(messages) {
+    try {
+        return Buffer.byteLength(JSON.stringify(messages), 'utf-8');
+    }
+    catch {
+        return 0; // circular/unserialisable — don't block on the estimate
+    }
+}
+function resolveAutoCompact(fromOptions, rawSettings) {
+    if (typeof fromOptions === 'boolean')
+        return fromOptions;
+    const env = (process.env.NEXRALL_AUTO_COMPACT ?? '').toLowerCase();
+    if (env === '0' || env === 'false' || env === 'off')
+        return false;
+    if (env === '1' || env === 'true' || env === 'on')
+        return true;
+    const s = rawSettings?.autoCompact;
+    if (typeof s === 'boolean')
+        return s;
+    return true;
+}
+/** Opt-out for the one-shot verification nudge (GAP D). Defaults to on. */
+function resolveVerificationNudge(rawSettings) {
+    const env = (process.env.NEXRALL_VERIFY_NUDGE ?? '').toLowerCase();
+    if (env === '0' || env === 'false' || env === 'off')
+        return false;
+    if (env === '1' || env === 'true' || env === 'on')
+        return true;
+    const s = rawSettings?.verifyNudge;
+    if (typeof s === 'boolean')
+        return s;
+    return true;
+}
+/** Tools that mutate the filesystem — used by the verification nudge (GAP D). */
+exports.WRITE_TOOL_NAMES = new Set(['write_file', 'edit_file', 'multi_edit', 'delete_file', 'move_file', 'copy_file', 'notebook_edit']);
+/**
+ * May an agent restricted to `testFilesOnly` perform this tool call?
+ *
+ * A tool allowlist is all-or-nothing per tool: granting `edit_file` grants it for
+ * every path in the repo. A user-defined test-writer agent needs write access to produce
+ * tests, but must NOT be able to "fix" production source so a failing test goes
+ * green — the single most common way a test-writing agent destroys the signal it
+ * was asked to create. Its prompt says so; this makes it a refusal rather than a
+ * request.
+ *
+ * Pure + exported so the rules are testable directly, without running a real
+ * sub-agent.
+ *
+ * KNOWN LIMIT, stated rather than hidden: this gates the file TOOLS, not `bash`.
+ * A determined model could still write source via `bash: echo ... > src/x.ts`.
+ * Closing that means parsing shell redirection, which is not reliably doable — so
+ * this is a strong guardrail against the realistic failure mode, not a sandbox.
+ * Real isolation is the sandbox config (tools/sandbox.ts), a separate mechanism.
+ */
+function allowsTestOnlyWrite(tool, input) {
+    // Non-write tools are unaffected: reading, searching and running tests are all
+    // essential to writing a test.
+    //
+    // WRITE_TOOL_NAMES deliberately excludes `create_directory`: isTestFile matches
+    // FILE paths, so a legitimate `create_directory('test/helpers')` would be
+    // refused and the agent could not scaffold the tree it needs — while an empty
+    // directory cannot damage production code, and files placed in it are still
+    // checked individually.
+    if (!exports.WRITE_TOOL_NAMES.has(tool))
+        return true;
+    // EVERY path the call could affect must be a test file, not just `path`:
+    // move_file takes {source, dest} and copy_file {source, destination}, so
+    // checking `path` alone would let `move_file src/index.ts -> /tmp/x` through and
+    // remove production code by relocating it.
+    //
+    // `source` is skipped for notebook_edit specifically, where it is the CELL
+    // CONTENT rather than a path — treating a blob of code as a path would refuse
+    // every legitimate notebook edit.
+    const pathKeys = tool === 'notebook_edit'
+        ? ['path']
+        : ['path', 'source', 'dest', 'destination'];
+    const candidates = pathKeys
+        .map((k) => input?.[k])
+        .filter((v) => typeof v === 'string' && v.length > 0);
+    // An unrecognised write shape (no path-like argument at all) is refused rather
+    // than allowed through, so a future tool cannot silently become a hole here.
+    if (candidates.length === 0)
+        return false;
+    return candidates.every((p) => (0, testIntegrity_1.isTestFile)(p));
+}
+/** Heuristic: does a bash command look like it's running tests/build/lint/typecheck? (GAP D) */
+exports.VERIFY_CMD_RE = /\b(npm|yarn|pnpm)\s+(run\s+)?(test|build|lint|typecheck|tsc)\b|\bpytest\b|\bgo\s+(test|vet|build)\b|\btsc\b|\beslint\b|\bcargo\s+(test|build|check)\b/i;
+/**
+ * Find the latest index ≤ maxIdx where history can be cut safely.
+ *
+ * A safe cut point is a **turn boundary**: an assistant message (which always
+ * begins a fresh turn after a user message). Cutting there guarantees that
+ * `messages[cut..]` starts with an assistant whose `tool_use` blocks are all
+ * answered by `tool_result`s that remain in the kept slice — so we never orphan
+ * a tool_result (which the API rejects). We deliberately allow cutting across
+ * tool_result-bearing user messages: the OLD implementation only cut at a
+ * *non*-tool_result user message, which never exists inside a single long
+ * agentic run (every user turn is a tool_result), so compaction was a no-op
+ * exactly when a long task needs it most.
+ */
+function findSafeCutIndex(messages, maxIdx) {
+    for (let i = Math.min(maxIdx, messages.length - 1); i >= 2; i--) {
+        if (messages[i].role === 'assistant')
+            return i;
+    }
+    return -1;
+}
+// Hard ceiling on the transcript we hand to the summariser. Per-block truncation
+// alone does NOT bound the total: a very long run has thousands of blocks, so the
+// concatenated transcript can itself exceed the summariser call's context window →
+// the summarise request 400s → autoCompactMessages returns false → NO compaction
+// happens exactly when the session is largest (the context-wall failure mode).
+// ~600K chars ≈ 150K tokens, well under a 1M window even with prompt overhead.
+const MAX_TRANSCRIPT_CHARS = 600000;
+/**
+ * Render messages to a plain-text transcript for the summariser (tool noise
+ * truncated per-block AND the whole transcript hard-capped). When the transcript
+ * would exceed MAX_TRANSCRIPT_CHARS we keep the HEAD (original task + early
+ * decisions) and the TAIL (most-recent, highest-signal context) and drop the
+ * middle — a middle-out elision that preserves both "what we set out to do" and
+ * "where we are now", which is what the continuation summary needs most.
+ */
+/**
+ * Appends the backend-announced runtime-context block to the user message it was
+ * attached to. No-op if that message is not a user turn or already ends with the
+ * identical block. Exported for tests.
+ */
+function persistRuntimeContext(messages, idx, text) {
+    const m = messages[idx];
+    if (!m || m.role !== 'user' || !Array.isArray(m.content))
+        return false;
+    const lastBlock = m.content[m.content.length - 1];
+    if (lastBlock && lastBlock.type === 'text' && lastBlock.text === text)
+        return false;
+    messages[idx] = { ...m, content: [...m.content, { type: 'text', text }] };
+    return true;
+}
+function transcriptOf(messages) {
+    const parts = [];
+    for (const m of messages) {
+        for (const b of m.content) {
+            if ((0, types_1.isRuntimeContextBlock)(b))
+                continue; // editor scaffolding, not conversation
+            if (b.type === 'text' && b.text) {
+                parts.push(`${m.role.toUpperCase()}: ${(0, safeSlice_1.sliceSafeEnd)(b.text, 2000)}`);
+            }
+            else if (b.type === 'tool_use') {
+                parts.push(`${m.role.toUpperCase()} [tool: ${b.name}]: ${(0, safeSlice_1.sliceSafeEnd)(JSON.stringify(b.input ?? {}), 400)}`);
+            }
+            else if (b.type === 'tool_result') {
+                parts.push(`TOOL RESULT: ${(0, safeSlice_1.sliceSafeEnd)(String(b.content ?? ''), 600)}`);
+            }
+        }
+    }
+    const full = parts.join('\n');
+    if (full.length <= MAX_TRANSCRIPT_CHARS)
+        return full;
+    // Middle-out: keep 40% head, 60% tail (recent context is higher-signal for
+    // continuation). Slice on line boundaries so we don't cut a line in half.
+    const headBudget = Math.floor(MAX_TRANSCRIPT_CHARS * 0.4);
+    const tailBudget = MAX_TRANSCRIPT_CHARS - headBudget;
+    const head = (0, safeSlice_1.sliceSafeEnd)(full, headBudget);
+    const tail = (0, safeSlice_1.sliceSafeStart)(full, full.length - tailBudget);
+    const dropped = full.length - head.length - tail.length;
+    return `${head}\n\n[… ${dropped} chars of mid-session transcript elided to fit the summariser's context window …]\n\n${tail}`;
+}
+// ─── Structured progress ledger (GAP E) ────────────────────────────────────────
+//
+// The single biggest long-horizon failure mode (industry-wide "context rot") is
+// that each auto-compaction summarises a transcript that ALREADY contains a prior
+// summary → summary-of-summary → fidelity decays: the agent forgets which files it
+// edited, whether tests passed, what's still open. Prose summarisation is inherently
+// lossy and gets worse every round.
+//
+// Defence: maintain a DETERMINISTIC, append-only ledger of high-signal facts derived
+// directly from tool calls — files created/edited (with count), commands verified
+// (test/build/lint) and their pass/fail, and explicit open TODOs. This is built from
+// structured tool data (NOT model output), so it is LOSSLESS and never degrades. We
+// inject it VERBATIM into every compaction preamble, so no matter how many times the
+// prose summary is re-summarised, the concrete "what changed / what's verified /
+// what's left" facts survive intact across an arbitrarily long run.
+const LEDGER_MAX_FILES = 60; // cap the file list so the preamble can't balloon
+const LEDGER_MAX_NOTES = 20; // cap verification/among notes
+function createLedger() {
+    return { filesTouched: new Map(), filesTouchedTotal: 0, verifications: [], testIntegrity: [], testIntegrityTotal: 0, epoch: 0 };
+}
+/** Record one tool call's effect on the ledger (deterministic, no model call). */
+function ledgerRecord(ledger, toolName, input, ok, output, exitCode) {
+    if (exports.WRITE_TOOL_NAMES.has(toolName)) {
+        if (!ok)
+            return; // a FAILED write changed nothing — not a durable fact
+        // A successful source write advances the mutation epoch: any verification
+        // run after this point has different inputs than runs before it.
+        ledger.epoch += 1;
+        const p = typeof input?.path === 'string' ? input.path : undefined;
+        if (p) {
+            const prev = ledger.filesTouched.get(p);
+            if (!prev)
+                ledger.filesTouchedTotal++;
+            // DELETE before SET, so a re-touched path moves to the BACK of the insertion
+            // order. `Map.set` on an existing key keeps its ORIGINAL slot, which quietly
+            // broke the eviction policy below: a file edited hundreds of times over a long
+            // session kept the position of its FIRST edit, so it aged out like a file nobody
+            // had looked at since — and on the next edit it was re-inserted as "new", double-
+            // counting filesTouchedTotal (which is documented as DISTINCT paths). Making the
+            // Map a true LRU-by-touch is what lets the `key !== p` guard below mean anything.
+            ledger.filesTouched.delete(p);
+            ledger.filesTouched.set(p, { tool: toolName, edits: (prev?.edits ?? 0) + 1 });
+            // Bound the Map itself, not just its rendering. LEDGER_MAX_FILES caps how many
+            // paths the preamble PRINTS (see ledgerSummary's slice), but the Map was only ever
+            // written to — so a multi-hour run touching thousands of files grew it without
+            // limit, and it is deliberately retained across every compaction. Evict the
+            // least-recently-touched entries once we hold well beyond what can ever be
+            // displayed. Hysteresis (evict down to 2× only once we exceed 4×) keeps this an
+            // occasional bulk sweep instead of a delete on every single write.
+            if (ledger.filesTouched.size > LEDGER_MAX_FILES * 4) {
+                for (const key of ledger.filesTouched.keys()) {
+                    if (ledger.filesTouched.size <= LEDGER_MAX_FILES * 2)
+                        break;
+                    if (key !== p)
+                        ledger.filesTouched.delete(key);
+                }
+            }
+        }
+        // Reward-hacking guard: if this write WEAKENED a test file, record it so the
+        // signal survives compaction and can be surfaced before the agent finishes.
+        const reasons = [];
+        // write_file overwrites carry a marker computed by the executor (which had the
+        // prior on-disk content) — it detects REMOVED assertions/cases, not just
+        // additive skips/tautologies. Prefer it when present.
+        const markerReasons = toolName === 'write_file' ? (0, testIntegrity_1.decodeTestIntegrityMarker)(output) : [];
+        if (markerReasons.length) {
+            reasons.push(...markerReasons);
+        }
+        else {
+            const ti = (0, testIntegrity_1.analyzeWriteToolForTestIntegrity)(toolName, input);
+            if (ti?.suspicious)
+                reasons.push(...ti.findings.map((f) => f.reason));
+        }
+        if (reasons.length && p) {
+            for (const reason of reasons) {
+                ledger.testIntegrity.push({ path: p, reason });
+                ledger.testIntegrityTotal++;
+            }
+            if (ledger.testIntegrity.length > LEDGER_MAX_NOTES * 2) {
+                ledger.testIntegrity.splice(0, ledger.testIntegrity.length - LEDGER_MAX_NOTES);
+            }
+        }
+    }
+    else if (toolName === 'bash') {
+        const cmd = String(input?.command ?? '').trim();
+        if (cmd && exports.VERIFY_CMD_RE.test(cmd)) {
+            // Record BOTH outcomes: a FAILED test/build is the single most important
+            // fact to carry across a compaction (it tells the agent work is NOT done).
+            //
+            // CRITICAL: `ok` is `result.error === undefined`, which is TRUE even when a
+            // test suite exits non-zero (the executor doesn't set `error` for a plain
+            // command failure — only for timeout/abort/spawn-fail). So `ok` alone would
+            // record a FAILING `npm test` as PASSED. The executor now reports the real
+            // process exit code via `exitCode`; a non-zero exit means the verification
+            // FAILED regardless of `ok`. Fall back to `ok` only when no exitCode is
+            // available (older tools / non-bash paths).
+            const passed = exitCode !== undefined ? exitCode === 0 : ok;
+            ledger.verifications.push({ cmd: cmd.slice(0, 120), ok: passed, epoch: ledger.epoch });
+            if (ledger.verifications.length > LEDGER_MAX_NOTES * 2) {
+                ledger.verifications.splice(0, ledger.verifications.length - LEDGER_MAX_NOTES);
+            }
+        }
+    }
+}
+/** Render the ledger as a compact, verbatim block for the compaction preamble. */
+function ledgerSummary(ledger) {
+    const lines = [];
+    if (ledger.filesTouched.size) {
+        const files = [...ledger.filesTouched.entries()];
+        // The TAIL, not the head: the Map is ordered least-recently-touched first, so
+        // slicing from the front showed the OLDEST files and reliably omitted the ones the
+        // agent was working on right now — the opposite of what this preamble is for.
+        const shown = files.slice(-LEDGER_MAX_FILES);
+        lines.push(`FILES CHANGED THIS SESSION (${ledger.filesTouchedTotal || ledger.filesTouched.size}):`);
+        for (const [p, meta] of shown) {
+            lines.push(`  • ${p}  (${meta.tool}${meta.edits > 1 ? ` ×${meta.edits}` : ''})`);
+        }
+        if (files.length > shown.length)
+            lines.push(`  • … and ${files.length - shown.length} more`);
+    }
+    if (ledger.verifications.length) {
+        const recent = ledger.verifications.slice(-LEDGER_MAX_NOTES);
+        lines.push(`VERIFICATION RUNS (most recent ${recent.length}):`);
+        for (const v of recent)
+            lines.push(`  • [${v.ok ? 'PASS' : 'FAIL'}] ${v.cmd}`);
+    }
+    if (ledger.testIntegrity.length) {
+        const recent = ledger.testIntegrity.slice(-LEDGER_MAX_NOTES);
+        lines.push(`⚠ TEST-INTEGRITY ALERTS (test files were weakened — must justify or revert):`);
+        for (const t of recent)
+            lines.push(`  • ${t.path}: ${t.reason}`);
+    }
+    const flaky = (0, flaky_1.detectFlaky)(ledger.verifications);
+    if (flaky.length) {
+        lines.push(`⚠ FLAKY TESTS (same command flipped PASS↔FAIL with no edit between — a green run proves nothing):`);
+        for (const f of flaky.slice(0, LEDGER_MAX_NOTES)) {
+            lines.push(`  • ${f.cmd}  (${f.passes} pass / ${f.fails} fail at identical code)`);
+        }
+    }
+    return lines.join('\n');
+}
+// How many of the most-recent messages keep their tool_result content verbatim.
+// Older tool_result bodies are the bulk of a large body and are the safest thing
+// to shed first (the model has already acted on them), so we replace their content
+// with a short stub while KEEPING the block (so tool_use/tool_result pairing and
+// turn structure stay intact — unlike summarisation, which drops whole turns).
+exports.PRUNE_KEEP_RECENT = 8;
+const PRUNE_STUB_KEEP_CHARS = 400; // keep a short head of each pruned result for context
+// Marker sentinel appended to a pruned tool_result's content. We detect
+// "already pruned" by this suffix rather than by an out-of-schema field on the
+// block, because the block object is serialised verbatim onto the request body
+// and forwarded to Anthropic — any extra property (e.g. a `_pruned` flag) would
+// be rejected as an unknown field on a content block (400). Encoding the state
+// inside the (string) content keeps the wire payload schema-clean AND idempotent.
+const PRUNE_MARKER = '\n\n[… ';
+const PRUNE_MARKER_TAIL = ' pruned to conserve context. Re-run the tool if you need the full result.]';
+/**
+ * Lossy-but-structure-preserving prune: shrink OLD, large tool_result blocks in
+ * place, keeping the last PRUNE_KEEP_RECENT messages untouched. This is tried
+ * BEFORE summarisation because it:
+ *   • keeps every turn and every tool_use/tool_result pair (API stays valid),
+ *   • never makes an extra model call (summarisation does — cost + latency),
+ *   • degrades gracefully on repeat (summarise-of-summarise loses the most on
+ *     long runs; pruning just trims already-consumed output further).
+ *
+ * IMPORTANT: pruned state is encoded in the content string (PRUNE_MARKER_TAIL
+ * suffix), NOT as an extra property on the block — a stray field on a content
+ * block is rejected by the Anthropic API as an unknown key (400). This keeps the
+ * serialised body schema-clean while remaining idempotent across repeat calls.
+ *
+ * Returns the number of bytes reclaimed (0 if nothing was prunable).
+ *
+ * `minReclaimBytes` (default 0): if the TOTAL prunable amount is below this, the
+ * function makes NO changes and returns 0. This is a cache-safety gate — pruning
+ * even one old block changes the request prefix and invalidates the message-level
+ * prompt cache, so a tiny prune would bust the cache (re-write at 1.25×) for
+ * almost no size win. Measuring first, then applying only if worthwhile, keeps
+ * the "don't bust cache for a trivial gain" contract truly atomic (the old code
+ * mutated first and let the caller decide, which had already invalidated the
+ * cache by the time the caller declined).
+ */
+function pruneOldToolResults(messages, minReclaimBytes = 0) {
+    const cutoff = messages.length - exports.PRUNE_KEEP_RECENT;
+    if (cutoff <= 1)
+        return 0;
+    // Collect prunable blocks + measure the total reclaim WITHOUT mutating yet.
+    const targets = [];
+    let total = 0;
+    for (let i = 0; i < cutoff; i++) {
+        const m = messages[i];
+        if (!Array.isArray(m.content))
+            continue;
+        for (const b of m.content) {
+            if (b.type !== 'tool_result')
+                continue;
+            const text = typeof b.content === 'string' ? b.content : JSON.stringify(b.content ?? '');
+            if (text.endsWith(PRUNE_MARKER_TAIL))
+                continue; // already pruned (idempotent)
+            if (text.length <= PRUNE_STUB_KEEP_CHARS + 80)
+                continue; // already small
+            // MUST use the surrogate-safe slice: a raw `text.slice(0, N)` landing
+            // between the high/low half of an emoji or CJK-extension glyph leaves a
+            // lone surrogate in the stub. That string is still valid JS but breaks
+            // when JSON.stringify'd onto the wire — Anthropic rejects the WHOLE
+            // request with a deterministic 400 "no low surrogate in string" that
+            // repeats identically on every retry (the corrupted payload never
+            // changes). This is exactly the class of bug util/safeSlice.ts exists
+            // to prevent; this call site just never got migrated to it.
+            const head = (0, safeSlice_1.sliceSafeEnd)(text, PRUNE_STUB_KEEP_CHARS);
+            const omitted = text.length - head.length;
+            targets.push({ block: b, head, omitted });
+            total += omitted;
+        }
+    }
+    // Cache-safety gate: not worth busting the prompt cache for a trivial reclaim.
+    if (total < minReclaimBytes)
+        return 0;
+    // Worthwhile — apply the stubs.
+    let reclaimed = 0;
+    for (const { block, head, omitted } of targets) {
+        block.content = `${head}${PRUNE_MARKER}${omitted} chars of earlier tool output${PRUNE_MARKER_TAIL}`;
+        reclaimed += omitted;
+    }
+    return reclaimed;
+}
+/**
+ * Compact `messages` in place: summarise everything before a safe cut point and
+ * replace it with a summary preamble. Returns true if compaction happened.
+ */
+/** Extract the first user turn's plain text — the ORIGINAL task/goal. */
+function originalTaskText(messages) {
+    const first = messages.find((m) => m.role === 'user');
+    if (!first || !Array.isArray(first.content))
+        return '';
+    return first.content
+        .filter((b) => b.type === 'text' && b.text && !(0, types_1.isRuntimeContextBlock)(b))
+        .map((b) => b.text)
+        .join('\n')
+        .trim();
+}
+/**
+ * The summariser's own model call failed — as opposed to running fine but not
+ * shrinking anything.
+ *
+ * These two outcomes used to be one `return false`, and collapsing them was a
+ * real bug: the in-loop circuit breaker disables auto-compaction permanently
+ * after COMPACT_MAX_FAILURES, on the sound theory that a compaction which cannot
+ * reclaim bytes will never start. But a summariser that THREW says nothing about
+ * whether compaction would help — only that the network/provider was unavailable
+ * for a moment. Feeding those into the same counter meant three transient blips
+ * (a 529 burst, a brief outage, a rate-limit spike) permanently switched off the
+ * one mechanism keeping the context under control, and the run then died at the
+ * context wall minutes later with its own recovery already disabled.
+ */
+class CompactionUnavailableError extends Error {
+    constructor() {
+        super('Compaction summariser was unavailable');
+        this.name = 'CompactionUnavailableError';
+    }
+}
+exports.CompactionUnavailableError = CompactionUnavailableError;
+function makeCachedSummarizer(messages, requestOptions, abortSignal) {
+    return async (instruction) => {
+        const last = messages[messages.length - 1];
+        if (!last || last.role !== 'user')
+            return '';
+        const lastContent = typeof last.content === 'string'
+            ? [{ type: 'text', text: last.content }]
+            : [...last.content];
+        const probe = [
+            ...messages.slice(0, -1),
+            { ...last, content: [...lastContent, { type: 'text', text: instruction }] },
+        ];
+        const reply = await (0, client_1.streamChat)(probe, { ...requestOptions(), abortSignal, allowRestartAfterRender: true }, () => { });
+        return reply.content
+            .filter((b) => b.type === 'text')
+            .map((b) => b.text ?? '')
+            .join('')
+            .trim();
+    };
+}
+const CACHED_SUMMARY_INSTRUCTION = `[Context compaction — this is an automated request from the agent runtime, not the user.]\n` +
+    `Do NOT call any tools and do NOT continue the task. Reply with text only: a concise bullet-point ` +
+    `summary of this whole session so far that you will need to continue the work — the user's goal, ` +
+    `key decisions, files changed (and how), commands run and their outcome, unresolved problems, and ` +
+    `user preferences. Max 400 words.`;
+async function autoCompactMessages(messages, options, ledger, summarizeCached) {
+    const cut = findSafeCutIndex(messages, messages.length - exports.COMPACT_KEEP_MIN);
+    if (cut < 2)
+        return false; // nothing meaningful to fold
+    // PreCompact: only now that compaction will really happen (the early return above would
+    // have made the hook fire for a no-op). Main agent only; an observer, it cannot veto.
+    if ((options._depth ?? 0) === 0) {
+        await (0, hooks_1.runLifecycleHooks)((0, hooks_1.loadHooks)(options.workDir).PreCompact, 'PreCompact', options.workDir, { trigger: 'auto', session_id: options.sessionId ?? '', messages_to_summarize: cut }, 'auto', (0, hooks_1.hookRunOptsFor)(options)).catch(() => undefined);
+    }
+    // Sizes measured here, not in firePostCompact: by then `messages` has already
+    // been spliced and the "before" number no longer exists.
+    const beforeCompact = messages.length;
+    const afterCompact = cut > 0 ? messages.length - cut + 1 : messages.length;
+    const toSummarize = messages.slice(0, cut);
+    const kept = messages.slice(cut);
+    const firePostCompact = async () => {
+        if ((options._depth ?? 0) !== 0)
+            return;
+        // Host callback: the loop rewrote the context, so the caller's own trail
+        // (event log, ledger, telemetry) must show it.
+        try {
+            options.onCompact?.({ trigger: 'auto', before: beforeCompact, after: afterCompact });
+        }
+        catch { /* a host callback must never break the run */ }
+        await (0, hooks_1.runLifecycleHooks)((0, hooks_1.loadHooks)(options.workDir).PostCompact, 'PostCompact', options.workDir, { trigger: 'auto', session_id: options.sessionId ?? '', messages_summarized: cut }, 'auto', (0, hooks_1.hookRunOptsFor)(options)).catch(() => undefined);
+    };
+    // Pin the ORIGINAL task verbatim. findSafeCutIndex can (and on a long single
+    // run usually does) cut PAST the first user turn, folding the user's actual
+    // goal into the lossy summary — after a few compactions the agent drifts off
+    // what it was asked to do. We re-inject the first user turn's text verbatim
+    // into the replacement preamble so the objective survives every compaction.
+    // (We cannot keep it as a separate user message: the API requires alternating
+    // roles and kept[0] is already an assistant turn — two user turns would 400.)
+    const originalTask = originalTaskText(toSummarize);
+    const summaryPrompt = `Summarize this coding-session transcript into concise bullet points the assistant needs to continue the work: ` +
+        `key decisions, files changed (and how), commands run, unresolved problems, and user preferences. Max 400 words.\n\n` +
+        transcriptOf(toSummarize);
+    let summary = '';
+    // Cache-friendly path first; any failure or empty reply falls back to the standalone
+    // transcript summariser below, which always works but pays for the history uncached.
+    if (summarizeCached) {
+        try {
+            summary = await summarizeCached(CACHED_SUMMARY_INSTRUCTION);
+        }
+        catch (err) {
+            if (options.abortSignal?.aborted || err.name === 'AbortError')
+                throw err;
+            summary = '';
+        }
+    }
+    if (!summary)
+        try {
+            const reply = await (0, client_1.streamChat)([{ role: 'user', content: [{ type: 'text', text: summaryPrompt }] }], {
+                // Run on the SAME model as the actual conversation. A previous version
+                // forced 'turbo' (Claude Sonnet 5) here on the theory that a mechanical
+                // "bullet-point this transcript" task doesn't need the user's tier — but
+                // that silently billed Anthropic (and made a real network call to a
+                // provider the user may not have configured/paid for) even when the
+                // whole session was running on OpenAI/DeepSeek/Qwen. Whatever the user
+                // is already paying for is used for compaction too, so there is never a
+                // surprise charge on a different provider. Falls back to the same
+                // default as the main loop (see `runAgentLoop`) only when no model was
+                // set at all.
+                //
+                // Cheapest model of the SAME vendor (Claude Code runs this kind of work on
+                // Haiku). Safe to downgrade HERE because this fallback sends a fresh
+                // transcript — it shares no cached prefix with the conversation, unlike
+                // summarizeCached above, which must stay on the conversation's own model.
+                // Never crosses providers; falls back to the session model if the
+                // catalogue is not loaded.
+                model: (0, modelCatalogue_1.cheapestSameVendorModel)(options.model ?? 'turbo') ?? options.model ?? 'turbo',
+                mode: 'ask', // summariser must not call tools; ask-mode discourages action
+                env: options.env,
+                clientType: options.clientType,
+                abortSignal: options.abortSignal,
+                // The summariser renders NOTHING (onEvent below is a no-op) and its result is
+                // read only from the returned message, so a restart has nothing to roll back —
+                // always safe. Worth enabling: a blip here used to abandon compaction entirely,
+                // which then let the very next turn hit the context wall it was meant to prevent.
+                allowRestartAfterRender: true,
+            }, () => { });
+            summary = reply.content
+                .filter((b) => b.type === 'text')
+                .map((b) => b.text ?? '')
+                .join('')
+                .trim();
+        }
+        catch {
+            // Summarisation FAILED — the model call itself threw (network blip, 529,
+            // provider quota). Distinguished from "ran fine but didn't help" by the
+            // caller, because the two must not feed the same circuit breaker: three
+            // transient network errors would otherwise permanently disable compaction
+            // for the rest of the run, leaving the context to grow until the turn dies
+            // with no recovery left. Leave history as is; the turn may still fit.
+            throw new CompactionUnavailableError();
+        }
+    if (!summary)
+        return false;
+    // Replace the summarized head with a single user summary message. The cut is
+    // at a turn boundary (kept[0] is an assistant message — see findSafeCutIndex),
+    // so `user(summary) → assistant(kept[0])` is a valid, well-ordered sequence
+    // and no orphaned tool_result is left behind. We intentionally do NOT insert
+    // an assistant-ack here: that would put two assistant messages back-to-back
+    // (kept[0] is already an assistant), which the API rejects.
+    const taskBlock = originalTask
+        ? `ORIGINAL TASK (verbatim — keep working toward this, do not lose sight of it):\n${originalTask}\n\n`
+        : '';
+    // GAP E — the deterministic ledger (files changed + verification pass/fail) is
+    // injected VERBATIM, so these concrete facts never decay through repeated
+    // summary-of-summary compactions the way the prose summary does.
+    const ledgerText = ledger ? ledgerSummary(ledger) : '';
+    const ledgerBlock = ledgerText
+        ? `PROGRESS LEDGER (authoritative, machine-tracked — trust this over the prose summary for what changed/verified):\n${ledgerText}\n\n`
+        : '';
+    messages.splice(0, cut, { role: 'user', content: [{ type: 'text', text: `[Auto-compacted ${toSummarize.length} earlier messages]\n\n${taskBlock}${ledgerBlock}Summary of the earlier conversation so far:\n${summary}\n\nContinue the work from here.` }] });
+    // `kept` follows automatically since splice only replaced the head.
+    void kept;
+    await firePostCompact();
+    return true;
+}
+// ─── Periodic memory compaction ────────────────────────────────────────────
+// A memory file (project or global — see agent/memory.ts) can grow large over
+// many sessions since memory_write only ever appends. writeMemory() already
+// applies an immediate, synchronous byte-cap eviction (oldest entries dropped)
+// as a hard backstop, but that's a blunt instrument — this periodically
+// consolidates the file with a real LLM summarization pass instead, so old
+// facts are condensed into fewer, denser bullets rather than silently lost.
+// Checked opportunistically right after a successful memory_write (see the
+// call site below) rather than on every tool call — cheap to check (a single
+// file stat), and memory_write is the only thing that can push a file over
+// the trigger threshold in the first place.
+async function maybeCompactMemory(scope, options) {
+    try {
+        await (0, memory_1.compactMemoryIfNeeded)(scope, options.workDir, async (prompt) => {
+            const reply = await (0, client_1.streamChat)([{ role: 'user', content: [{ type: 'text', text: prompt }] }], {
+                // Same reasoning as autoCompactMessages' summariser: run on the same
+                // model as the actual conversation rather than forcing a fixed tier
+                // (which silently billed Anthropic regardless of the user's provider).
+                // Cheapest SAME-vendor model: a fresh prompt with no shared cache prefix,
+                // and merging a few memory bullets does not need the session's top tier.
+                model: (0, modelCatalogue_1.cheapestSameVendorModel)(options.model ?? 'turbo') ?? options.model ?? 'turbo',
+                mode: 'ask',
+                env: options.env,
+                clientType: options.clientType,
+                abortSignal: options.abortSignal,
+                // Same as the transcript summariser: no rendered output, result read only from
+                // the returned message, so restarting on a blip is always safe.
+                allowRestartAfterRender: true,
+            }, () => { });
+            return reply.content
+                .filter((b) => b.type === 'text')
+                .map((b) => b.text ?? '')
+                .join('');
+        });
+    }
+    catch {
+        // Best-effort — a failed/aborted compaction just means the file stays as-is
+        // until the next memory_write call tries again; writeMemory's synchronous
+        // byte cap already bounds worst-case growth in the meantime.
+    }
+}
+// ─── Resume-time proactive compaction ─────────────────────────────────────────
+//
+// The in-loop auto-compact above only reacts to `lastPromptTokens`, which is
+// populated from the PREVIOUS turn's usage event. On a freshly-resumed session
+// (opening an old chat from history and sending the first new message) there is
+// no previous turn in this process — `lastPromptTokens` starts at 0 — so the
+// token-pressure trigger never fires for turn 0, and the byte-pressure trigger
+// only catches truly huge sessions (MAX_BODY_BYTES is sized to stay under the
+// backend's 25 MB body limit, not to bound cost — 8 MB of tool-heavy JSON is
+// already on the order of the 1M-token context window itself). The result: a
+// resumed session comfortably under both guards, but still hundreds of
+// thousands of tokens, gets sent to the model at FULL PRICE on the very first
+// message after resume, silently, every time.
+//
+// This function closes that gap: call it once, right after loading a stored
+// session and BEFORE the user's next message is sent, so the expensive
+// resend is compacted proactively instead of being missed by both in-loop
+// guards. It reuses the exact same threshold/mechanics as the in-loop guard
+// (cheap prune first, then summarising compaction) so behaviour stays
+// consistent whether compaction happens at resume-time or mid-run.
+const RESUME_CHARS_PER_TOKEN = 4; // rough, conservative estimate for JSON/code-heavy transcripts
+/** Rough token estimate for a resumed transcript — no API round-trip needed. */
+function estimateTokensRough(messages) {
+    return Math.ceil(estimateBodyBytes(messages) / RESUME_CHARS_PER_TOKEN);
+}
+/**
+ * Proactively compact `messages` in place if resuming this session would blow
+ * past the auto-compact threshold on the very first turn. Returns true if any
+ * compaction happened (so the caller can surface a one-line notice to the
+ * user). Safe to call on any message array, including empty/small ones (no-op).
+ *
+ * `model` picks the right context window (mirrors runAgentLoop's own lookup);
+ * `onNotice` is optional — pass it to show the same "auto-compacted" message
+ * the in-loop path shows, so the behaviour is visually consistent.
+ */
+async function compactMessagesForResume(messages, opts) {
+    if (messages.length <= exports.COMPACT_KEEP_MIN + 2)
+        return false;
+    const settings = (0, rules_1.loadSettings)(opts.workDir);
+    if (!resolveAutoCompact(undefined, settings.raw))
+        return false;
+    // Live catalogue first (see contextWindowFor's doc comment above for why),
+    // same fallback chain this call site always used otherwise.
+    const contextWindow = (0, modelCatalogue_1.liveContextWindowFor)(opts.model, exports.MODEL_CONTEXT_TOKENS[opts.model ?? 'turbo'] ?? 1000000);
+    let bodyBytes = estimateBodyBytes(messages);
+    let tokenGuess = estimateTokensRough(messages);
+    // Prune fires at the EARLY threshold (mirrors the in-loop guard); summarisation
+    // only at the late one. On resume this matters most: a stored session is resent
+    // whole on the first turn, so shedding old tool_result bulk up front is exactly
+    // what stops that first message being billed at full size.
+    const limits = compactionLimits(contextWindow, settings.raw);
+    const overPruneThreshold = () => tokenGuess > limits.prune || bodyBytes > exports.MAX_BODY_BYTES;
+    const overCompactThreshold = () => tokenGuess > limits.compact || bodyBytes > exports.MAX_BODY_BYTES;
+    if (!overPruneThreshold())
+        return false;
+    let compacted = false;
+    // Cheap pass first — shrinks old tool_result blocks with no model call. The
+    // reclaim floor is enforced atomically inside pruneOldToolResults (measures
+    // first, mutates only if worthwhile), so a declined prune leaves the cache intact.
+    if (messages.length > exports.PRUNE_KEEP_RECENT + 2) {
+        const reclaimed = pruneOldToolResults(messages, exports.PRUNE_MIN_RECLAIM_BYTES);
+        if (reclaimed > 0) {
+            bodyBytes = estimateBodyBytes(messages);
+            tokenGuess = estimateTokensRough(messages);
+            compacted = true;
+            opts.onNotice?.(`\n\u267b\ufe0f Trimmed ~${(reclaimed / (1024 * 1024)).toFixed(1)}MB of older tool output before resuming this chat.\n`);
+        }
+    }
+    // If still over the LATE (summarise) threshold, fall through to summarising
+    // compaction — same mechanism the in-loop guard uses, so this can safely loop
+    // (a single summarisation pass may still leave a very long session over it).
+    // A session between the prune and summarise thresholds is left as-is after the
+    // cheap prune: no model call needed, prefix already shrunk.
+    let guard = 0;
+    while (overCompactThreshold() && messages.length > exports.COMPACT_KEEP_MIN + 2 && guard < 5) {
+        guard += 1;
+        // No ledger at resume time — the ledger is per-run, in-memory, and would
+        // have been created fresh anyway since this is a new process/run. The
+        // ORIGINAL TASK verbatim pin (inside autoCompactMessages) still applies.
+        // A summariser failure is not fatal HERE. This runs before the session is
+        // handed back to the user, so the worst case is resuming with a longer (more
+        // expensive) prefix — strictly better than refusing to resume at all. The
+        // in-loop caller treats the same signal differently, because there it must
+        // decide whether to arm a circuit breaker.
+        let did;
+        try {
+            did = await autoCompactMessages(messages, {
+                workDir: opts.workDir,
+                model: opts.model,
+                clientType: opts.clientType,
+                env: opts.env,
+                onText: () => { },
+                onToolUse: () => { },
+                onToolResult: () => { },
+                onUsage: () => { },
+                requestPermission: async () => false,
+            });
+        }
+        catch (err) {
+            if (err instanceof CompactionUnavailableError)
+                break;
+            throw err;
+        }
+        if (!did)
+            break;
+        compacted = true;
+        bodyBytes = estimateBodyBytes(messages);
+        tokenGuess = estimateTokensRough(messages);
+    }
+    if (compacted) {
+        opts.onNotice?.(`\n\u267b\ufe0f Auto-compacted this chat's earlier history before resuming, to avoid resending it at full cost.\n`);
+    }
+    return compacted;
+}
+//# sourceMappingURL=compaction.js.map