@possumtech/rummy 2.1.0 → 2.2.0

package/src/plugins/ask_user/ask_user.js

@@ -1,5 +1,13 @@
+import { SUMMARY_MAX_CHARS } from "../helpers.js";
 import docs from "./ask_userDoc.js";
 
+// Per-side cap for the "question → answer" summary projection. Splitting
+// before the arrow preserves the structural separator the model uses to
+// read the pair as a unit; a single trailing slice could lose the arrow
+// entirely when either side is large.
+const ARROW = " → ";
+const HALF = Math.floor((SUMMARY_MAX_CHARS - ARROW.length) / 2);
+
 const LOG_ACTION_RE = /^log:\/\/turn_\d+\/(\w+)\//;
 
 export default class AskUser {
@@ -68,7 +76,9 @@ export default class AskUser {
 
 	summary(entry) {
 		const { question, answer } = entry.attributes;
-		if (answer) return `${question} → ${answer}`;
-		return question;
+		if (answer) {
+			return `${question.slice(0, HALF)}${ARROW}${answer.slice(0, HALF)}`;
+		}
+		return question.slice(0, SUMMARY_MAX_CHARS);
 	}
 }

package/src/plugins/ask_user/ask_userDoc.md

@@ -1,10 +1,6 @@
 ## <ask_user question="[Question?]">[option1; option2; ...]</ask_user> - Ask the user a question
 
-* YOU SHOULD ONLY use for decisions, preferences, or approvals the user must make
-<!-- Positive framing. Shows what ask_user IS for. -->
+YOU SHOULD ONLY use <ask_user> for decisions, preferences, or approvals the user must make.
 
 Example: <ask_user question="Which test framework?">Mocha; Jest; Node Native</ask_user>
-<!-- Preference decision. Model truly cannot know this without asking. -->
-
 Example: <ask_user question="Deploy to staging or production?">staging; production</ask_user>
-<!-- Consequential action. High-stakes choice. -->

package/src/plugins/budget/README.md

@@ -7,37 +7,42 @@ Context ceiling enforcement.
 Ceiling = `floor(contextSize × RUMMY_BUDGET_CEILING)` (default 0.9). The
 10% headroom is the system's operating room for graceful overflow
 handling. No per-write gating — tools run uninterrupted. Enforcement
-happens at boundaries.
+happens at one boundary: the pre-LLM grinder.
 
 ## Enforcement Points
 
-1. **Pre-LLM enforce** (`hooks.budget.enforce`): checks assembled context
-   before the LLM call. If over ceiling on turn 1 → Prompt Demotion
-   (demote the incoming prompt, re-materialize, re-check). Runs in the
-   headroom if that fits. On non-first turns or still-over after
-   Prompt Demotion, emits a 413 error via `hooks.error.log` so the
-   strike system treats the overflow as a turn-level event.
+1. **Pre-LLM grinder** (`turn.beforeDispatch` filter): four-step
+   ladder per SPEC §budget_enforcement.
 
-2. **Post-dispatch Turn Demotion** (`hooks.budget.postDispatch`): after
-   all tools dispatch, re-materialize and check. If over ceiling →
-   demote ALL visible entries from this turn (status < 400, status
-   preserved — demotion only changes visibility). Emits a 413 error
-   with the 50% rule directive as its message; the error entry is
-   what the model sees next turn.
+   1. Check budget. If under ceiling → proceed.
+   2. Soft 413: demote `(current_turn − 1)` visible run_views to
+      `summarized` (all schemes, no exemption). Re-materialize, recheck.
+   3. Soft 413: demote the incoming `prompt://N` to `summarized`.
+      Re-materialize, recheck.
+   4. Hard 413: emit `error://`, set `ok=false` on the packet so
+      TurnExecutor short-circuits dispatch.
 
-3. **LLM rejection** (`isContextExceeded` in TurnExecutor): turn-1
-   token estimate drift causes LLM to reject. Same 413 error path as
-   pre-LLM overflow.
+   Steps 2 and 3 also emit `error://` 413 entries when they fire so
+   the model sees what was auto-demoted next turn. The grinder never
+   demotes speculatively or helpfully — only in response to actual
+   overflow.
+
+2. **LLM rejection** (`isContextExceeded` in TurnExecutor): turn-1
+   token-estimate drift causes the LLM to reject. Same 413 error path
+   as the grinder's hard step.
 
 ## Files
 
-- **budget.js** — Plugin. Enforce + postDispatch methods exposed on
-  `core.hooks.budget`.
+- **budget.js** — Plugin. Math (`ceiling`, `measureMessages`,
+  `measureRows`, `computeBudget`), 413 body shaper (`overflowBody`),
+  and the plugin class itself.
+
+## Hook participation
 
-## Registration
+- `core.filter("turn.beforeDispatch", ...)` — pre-LLM grinder. Returns
+  the (possibly demoted) packet with `ok` / `overflow` flags.
+- `core.filter("assembly.user", ..., 175)` — renders the `<budget>`
+  table into the user message.
 
-- **Hook**: `hooks.budget.enforce` — pre-LLM ceiling check + first-turn
-  Prompt Demotion.
-- **Hook**: `hooks.budget.postDispatch` — post-dispatch re-check + Turn
-  Demotion. Emits 413 errors through the unified error channel; there
-  is no separate `budget://` scheme.
+Emits 413 errors through the unified error channel (`hooks.error.log.emit`);
+there is no separate `budget://` scheme.

package/src/plugins/budget/budget.js

@@ -1,14 +1,35 @@
-import { ceiling, computeBudget, measureMessages } from "../../agent/budget.js";
-import materializeContext from "../../agent/materializeContext.js";
+import ContextAssembler from "../../agent/ContextAssembler.js";
 import { countTokens } from "../../agent/tokens.js";
 
-// Delta-from-actual; same scale as <prompt tokenUsage>. SPEC #budget_enforcement.
-function predictNextPacket(rows, currentTurn, baseline) {
-	let delta = 0;
-	for (const r of rows) {
-		if (r.source_turn === currentTurn) delta += countTokens(r.body);
-	}
-	return baseline + delta;
+const CEILING_RATIO = Number(process.env.RUMMY_BUDGET_CEILING);
+
+export function ceiling(contextSize) {
+	return Math.floor(contextSize * CEILING_RATIO);
+}
+
+// Sum assembled-message token counts; used by the enforce gate.
+export function measureMessages(messages) {
+	return messages.reduce((sum, m) => sum + countTokens(m.content), 0);
+}
+
+// Sum projected row body token counts; used by prompt.js pre-assembly.
+export function measureRows(rows) {
+	return rows.reduce((sum, r) => sum + countTokens(r.body), 0);
+}
+
+// Single source of truth for budget numbers; tokenUsage echoes totalTokens for the wire attribute.
+export function computeBudget({ contextSize, totalTokens }) {
+	const cap = ceiling(contextSize);
+	const tokensFree = Math.max(0, cap - totalTokens);
+	const overflow = Math.max(0, totalTokens - cap);
+	return {
+		ceiling: cap,
+		totalTokens,
+		tokenUsage: totalTokens,
+		tokensFree,
+		overflow,
+		ok: overflow === 0,
+	};
 }
 
 // 413 error body; wire format is part of the model contract.
@@ -17,10 +38,10 @@ export function overflowBody(overflow, contextSize, demoted) {
 	const size = cap + overflow;
 	const count = demoted.length;
 	const totalTokens = demoted.reduce((s, r) => s + r.tokens, 0);
-	const head = `Token Budget overflow: packet was ${size} tokens, ceiling is ${cap}. ${count} promotion${count === 1 ? "" : "s"} (${totalTokens} tokens) demoted to fit.`;
+	const head = `Token Budget overflow: packet was ${size} tokens, ceiling is ${cap}. ${count} promotion${count === 1 ? "" : "s"} (${totalTokens} tokens) demoted.`;
 	if (count === 0) return head;
 	const lines = demoted.map((d) =>
-		d.turn
+		d.turn != null
 			? `- ${d.path} (turn ${d.turn}, ${d.tokens} tokens)`
 			: `- ${d.path} (${d.tokens} tokens)`,
 	);
@@ -32,11 +53,23 @@ export default class Budget {
 
 	constructor(core) {
 		this.#core = core;
-		core.hooks.budget = {
-			enforce: this.enforce.bind(this),
-			postDispatch: this.postDispatch.bind(this),
-		};
-		core.filter("assembly.user", this.assembleBudget.bind(this), 175);
+		core.filter("turn.beforeDispatch", this.#onBeforeDispatch.bind(this));
+		core.filter("assembly.user", this.assembleBudget.bind(this), 90);
+	}
+
+	// Filter participant. Receives the assembled packet; returns a
+	// (possibly modified) packet. The pre-LLM grinder demotes-and-
+	// rechecks per SPEC §budget_enforcement; if it can't fit after the
+	// ladder runs, sets ok=false so TurnExecutor short-circuits.
+	async #onBeforeDispatch(packet, ctxBag) {
+		return this.enforce({
+			contextSize: packet.contextSize,
+			messages: packet.messages,
+			rows: packet.rows,
+			lastPromptTokens: packet.lastPromptTokens,
+			ctx: ctxBag.ctx,
+			rummy: ctxBag.rummy,
+		});
 	}
 
 	// Renders <budget> at priority 275; see SPEC #token_accounting.
@@ -140,27 +173,47 @@ export default class Budget {
 		};
 	}
 
-	async #emitOverflow({
-		message,
-		runId,
-		turn,
-		loopId,
-		rummy,
-		demotedCount = 0,
-		demotedTokens = 0,
-	}) {
+	async #emit({ message, ctx, rummy, demoted }) {
+		const totalTokens = demoted.reduce((s, r) => s + r.tokens, 0);
 		await rummy.hooks.error.log.emit({
 			store: rummy.entries,
-			runId,
-			turn,
-			loopId,
+			runId: ctx.runId,
+			turn: ctx.turn,
+			loopId: ctx.loopId,
 			message,
 			status: 413,
-			attributes: { demotedCount, demotedTokens },
+			attributes: {
+				demotedCount: demoted.length,
+				demotedTokens: totalTokens,
+			},
 		});
 	}
 
-	// Pre-LLM enforce: SPEC #budget_enforcement.
+	async #reassemble({ rows, ctx, rummy, contextSize, lastPromptTokens }) {
+		return ContextAssembler.assembleFromTurnContext(
+			rows,
+			{
+				type: ctx.mode,
+				systemPrompt: ctx.systemPrompt,
+				contextSize,
+				toolSet: ctx.toolSet,
+				lastContextTokens: lastPromptTokens,
+				turn: ctx.turn,
+			},
+			rummy.hooks,
+		);
+	}
+
+	// Pre-LLM grinder ladder. SPEC §budget_enforcement.
+	//
+	//   1. Check budget. ok → return.
+	//   2. Soft 413: demote (current_turn − 1) visible. Recheck.
+	//   3. Soft 413: demote current prompt. Recheck.
+	//   4. Hard 413: emit and return ok=false.
+	//
+	// Every step that demotes anything emits a 413 error://. Soft 413s
+	// keep the run alive (turn proceeds to LLM); the hard 413 bubbles
+	// through to AgentLoop.
 	async enforce({
 		contextSize,
 		messages,
@@ -173,6 +226,7 @@ export default class Budget {
 			return { messages, rows, assembledTokens: 0, ok: true };
 		}
 
+		// Step 1.
 		const first = this.#check({
 			contextSize,
 			messages,
@@ -181,103 +235,105 @@ export default class Budget {
 		});
 		if (first.ok) return first;
 
-		if (ctx?.loopIteration !== 1) {
-			const cap = ceiling(contextSize);
-			await this.#emitOverflow({
-				message: `Token Budget overflow: packet was ${cap + first.overflow} tokens, ceiling is ${cap}.`,
-				runId: ctx.runId,
-				turn: ctx.turn,
-				loopId: ctx.loopId,
+		const store = rummy.entries;
+
+		// Step 2: previous-turn demotion.
+		const prevTurn = ctx.turn - 1;
+		const rawTurnDemoted =
+			prevTurn >= 0 ? await store.demoteTurnEntries(ctx.runId, prevTurn) : [];
+		const turnDemoted = rawTurnDemoted.map((d) => ({ ...d, turn: prevTurn }));
+		if (turnDemoted.length > 0) {
+			for (const r of rows) {
+				if (r.source_turn === prevTurn && r.visibility === "visible") {
+					r.body = r.sBody;
+					r.visibility = "summarized";
+				}
+			}
+			const reMessages = await this.#reassemble({
+				rows,
+				ctx,
 				rummy,
+				contextSize,
+				lastPromptTokens: 0,
 			});
-			return first;
+			const rechecked = this.#check({
+				contextSize,
+				messages: reMessages,
+				rows,
+				lastPromptTokens: 0,
+			});
+			if (rechecked.ok) {
+				await this.#emit({
+					message: overflowBody(first.overflow, contextSize, turnDemoted),
+					ctx,
+					rummy,
+					demoted: turnDemoted,
+				});
+				return rechecked;
+			}
+			first.overflow = rechecked.overflow;
 		}
 
+		// Step 3: current-prompt demotion.
 		const promptRow = rows.findLast(
 			(r) => r.category === "prompt" && r.scheme === "prompt",
 		);
-		if (promptRow) {
-			await rummy.entries.set({
+		const promptDemoted = [];
+		if (promptRow && promptRow.visibility === "visible") {
+			await store.set({
 				runId: ctx.runId,
 				path: promptRow.path,
 				visibility: "summarized",
 			});
-		}
-		const reMat = await materializeContext({
-			db: rummy.db,
-			hooks: rummy.hooks,
-			runId: ctx.runId,
-			loopId: ctx.loopId,
-			turn: ctx.turn,
-			systemPrompt: ctx.systemPrompt,
-			mode: ctx.mode,
-			toolSet: ctx.toolSet,
-			contextSize,
-		});
-		const rechecked = this.#check({
-			contextSize,
-			messages: reMat.messages,
-			rows: reMat.rows,
-			lastPromptTokens: reMat.lastContextTokens,
-		});
-		if (!rechecked.ok) {
-			const cap = ceiling(contextSize);
-			await this.#emitOverflow({
-				message: `Token Budget overflow: packet was ${cap + rechecked.overflow} tokens after demoting the prompt, ceiling is ${cap}.`,
-				runId: ctx.runId,
-				turn: ctx.turn,
-				loopId: ctx.loopId,
+			promptDemoted.push({
+				path: promptRow.path,
+				turn: promptRow.source_turn,
+				tokens: countTokens(promptRow.body) - countTokens(promptRow.sBody),
+			});
+			promptRow.body = promptRow.sBody;
+			promptRow.visibility = "summarized";
+			const reMessages = await this.#reassemble({
+				rows,
+				ctx,
 				rummy,
+				contextSize,
+				lastPromptTokens: 0,
 			});
-		}
-		return rechecked;
-	}
-
-	// Post-dispatch Turn Demotion: SPEC #budget_enforcement.
-	async postDispatch({ contextSize, ctx, rummy }) {
-		if (!contextSize) return { failed: false };
-		const postMat = await materializeContext({
-			db: rummy.db,
-			hooks: rummy.hooks,
-			runId: ctx.runId,
-			loopId: ctx.loopId,
-			turn: ctx.turn,
-			systemPrompt: ctx.systemPrompt,
-			mode: ctx.mode,
-			toolSet: ctx.toolSet,
-			contextSize,
-		});
-		const baseline = postMat.lastContextTokens;
-		const predicted = predictNextPacket(postMat.rows, ctx.turn, baseline);
-		const cap = ceiling(contextSize);
-		if (predicted <= cap) return { failed: false };
-		const post = { overflow: predicted - cap };
-
-		const store = rummy.entries;
-		let demotedEntries = await store.demoteTurnEntries(ctx.runId, ctx.turn);
-		// Prior-turn-pressure fallback; SPEC #budget_enforcement.
-		if (demotedEntries.length === 0) {
-			demotedEntries = await store.demoteRunVisibleEntries(ctx.runId);
-		}
-		const promptRow = postMat.rows.find((r) => r.scheme === "prompt");
-		if (promptRow) {
-			await store.set({
-				runId: ctx.runId,
-				path: promptRow.path,
-				visibility: "summarized",
+			const rechecked = this.#check({
+				contextSize,
+				messages: reMessages,
+				rows,
+				lastPromptTokens: 0,
 			});
+			if (rechecked.ok) {
+				await this.#emit({
+					message: overflowBody(first.overflow, contextSize, [
+						...turnDemoted,
+						...promptDemoted,
+					]),
+					ctx,
+					rummy,
+					demoted: [...turnDemoted, ...promptDemoted],
+				});
+				return rechecked;
+			}
+			first.overflow = rechecked.overflow;
 		}
 
-		const totalDemoted = demotedEntries.reduce((s, r) => s + r.tokens, 0);
-		await this.#emitOverflow({
-			message: overflowBody(post.overflow, contextSize, demotedEntries),
-			demotedCount: demotedEntries.length,
-			demotedTokens: totalDemoted,
-			runId: ctx.runId,
-			turn: ctx.turn,
-			loopId: ctx.loopId,
+		// Step 4: hard 413.
+		const allDemoted = [...turnDemoted, ...promptDemoted];
+		await this.#emit({
+			message: overflowBody(first.overflow, contextSize, allDemoted),
+			ctx,
 			rummy,
+			demoted: allDemoted,
 		});
-		return { failed: true };
+		return {
+			messages,
+			rows,
+			assembledTokens: ceiling(contextSize) + first.overflow,
+			overflow: first.overflow,
+			ok: false,
+		};
 	}
 }

package/src/plugins/cli/README.md

@@ -29,9 +29,8 @@ preserves existing vars).
 |---|---|---|
 | `RUMMY_MODE` | `act` | `ask` or `act`. |
 
-`RUMMY_RUN_TIMEOUT` is required at boot via `src/agent/config.js`;
-default lives in `.env.example`. Watchdog exits with code `124` on
-overflow.
+`RUMMY_LOOP_TIMEOUT` is declared in `.env.example` and read directly
+from `process.env`. Watchdog exits with code `124` on overflow.
 
 Per-run defaults (`RUMMY_YOLO`, `RUMMY_NO_REPO`, `RUMMY_NO_WEB`,
 `RUMMY_NO_INTERACTION`, `RUMMY_NO_PROPOSALS`) cascade through
@@ -61,7 +60,7 @@ provider key. Bench harnesses call `rummy-cli` with just
 | `0` | Terminal status `200`. Model claimed success. |
 | `1` | Terminal status in `{204, 413, 422, 499, 500}` or run crashed. |
 | `2` | Arg parse error (invalid flag shape, missing required env). |
-| `124` | Wall-clock timeout (`RUMMY_RUN_TIMEOUT` exceeded). |
+| `124` | Wall-clock timeout (`RUMMY_LOOP_TIMEOUT` exceeded). |
 
 External verifiers (terminal-bench, SWE-bench, etc.) decide actual
 task success — the exit code only reports rummy's internal terminal

package/src/plugins/cli/cli.js

@@ -1,5 +1,5 @@
-import config from "../../agent/config.js";
 import ProjectAgent from "../../agent/ProjectAgent.js";
+import File from "../file/file.js";
 
 const TERMINAL_STATUSES = new Set([200, 204, 413, 422, 499, 500]);
 
@@ -42,10 +42,36 @@ export default class Cli {
 		const projectAgent = new ProjectAgent(db, hooks);
 		const { projectId } = await projectAgent.init(alias, projectRoot);
 
-		// Watchdog; overridable via --RUMMY_RUN_TIMEOUT=<ms>.
-		const timeoutMs = config.RUN_TIMEOUT;
-		const timer = setTimeout(() => {
-			console.error(`rummy-cli: timed out after ${timeoutMs}ms`);
+		// Operator-declared project surface (comma-separated literal paths,
+		// relative to project root). Files are ingested as entries with
+		// default visibility=archived; the model promotes specific
+		// entries via <get>. Decouples membership (constraint) from
+		// visibility (per-entry, model-controlled).
+		const projectFilesRaw = process.env.RUMMY_PROJECT_FILES;
+		if (projectFilesRaw) {
+			const patterns = projectFilesRaw
+				.split(",")
+				.map((s) => s.trim())
+				.filter(Boolean);
+			for (const pattern of patterns) {
+				await File.setConstraint(db, projectId, pattern, "add");
+			}
+		}
+
+		// Watchdog; overridable via --RUMMY_LOOP_TIMEOUT=<ms>. Drains
+		// the active loop before exit so SQLite, turn slices, and
+		// last_run.txt are durable on disk before the process dies —
+		// without this, harbor's outer asyncio.wait_for kills the
+		// docker exec mid-pipeline and the trial.log cp commands never
+		// run, leaving the post-mortem packet empty.
+		const timeoutMs = Number(process.env.RUMMY_LOOP_TIMEOUT);
+		const timer = setTimeout(async () => {
+			console.error(`rummy-cli: timed out after ${timeoutMs}ms — draining`);
+			try {
+				await projectAgent.shutdown();
+			} catch (err) {
+				console.error(`rummy-cli: drain failed: ${err.message}`);
+			}
 			process.exit(124);
 		}, timeoutMs);
 		timer.unref();

package/src/plugins/cloudflare/cloudflare.js

@@ -0,0 +1,136 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import msg from "../../agent/messages.js";
+import { chatCompletionStream } from "../../llm/openaiStream.js";
+
+const FETCH_TIMEOUT = Number(process.env.RUMMY_FETCH_TIMEOUT);
+
+const PROVIDER = "@cf";
+
+// Repo-root-relative key file. Resolved relative to this source file so
+// CWD changes during runs (programbench/tbench cd into workspaces) don't
+// break the lookup. Plugin is inert if the file is missing OR if
+// CLOUDFLARE_ACCOUNT_ID is unset (the API path is account-scoped).
+const __dirname = dirname(fileURLToPath(import.meta.url));
+function resolveKeyFile() {
+	return process.env.RUMMY_CLOUDFLARE_KEY_FILE
+		? process.env.RUMMY_CLOUDFLARE_KEY_FILE
+		: join(__dirname, "..", "..", "..", "cloudflare.key");
+}
+
+// Inert unless cloudflare.key exists and CLOUDFLARE_ACCOUNT_ID is set.
+// Matches model aliases starting with `@cf/` — Cloudflare Workers AI's
+// own namespace, used verbatim with no prefix stripping
+// (`@cf/google/gemma-4-26b-a4b-it`).
+//
+// Uses Cloudflare's OpenAI-compatible endpoint
+// (`/v1/chat/completions`) so the streaming SSE accumulator is shared
+// with the other OpenAI-shaped providers. Context-size lookups go to
+// the native models-search API which exposes `properties` including
+// the model's context window.
+export default class Cloudflare {
+	#apiKey;
+	#accountId;
+	#contextCache = new Map();
+
+	constructor(core) {
+		const accountId = process.env.CLOUDFLARE_ACCOUNT_ID;
+		if (!accountId) return;
+		const keyFile = resolveKeyFile();
+		if (!existsSync(keyFile)) return;
+		const raw = readFileSync(keyFile, "utf8").trim();
+		if (!raw) return;
+		this.#apiKey = raw;
+		this.#accountId = accountId;
+
+		core.hooks.llm.providers.push({
+			name: "cloudflare",
+			matches: (model) => model.split("/")[0] === PROVIDER,
+			completion: (messages, model, options) =>
+				this.#completion(messages, model, options),
+			getContextSize: (model) => this.#getContextSize(model),
+		});
+	}
+
+	#baseUrl() {
+		return `https://api.cloudflare.com/client/v4/accounts/${this.#accountId}/ai`;
+	}
+
+	async #completion(messages, model, options = {}) {
+		const body = { model, messages };
+		if (options.maxTokens !== undefined) body.max_tokens = options.maxTokens;
+		if (options.temperature !== undefined)
+			body.temperature = options.temperature;
+
+		const timeoutSignal = AbortSignal.timeout(FETCH_TIMEOUT);
+		const signal = options.signal
+			? AbortSignal.any([options.signal, timeoutSignal])
+			: timeoutSignal;
+
+		const headers = { Authorization: `Bearer ${this.#apiKey}` };
+
+		try {
+			return await chatCompletionStream({
+				url: `${this.#baseUrl()}/v1/chat/completions`,
+				headers,
+				body,
+				signal,
+			});
+		} catch (err) {
+			if (err.status === 401 || err.status === 403) {
+				throw new Error(
+					msg("error.cloudflare_auth", {
+						status: `${err.status} - ${err.body}`,
+					}),
+				);
+			}
+			if (err.status) {
+				throw new Error(
+					msg("error.cloudflare_api", {
+						status: `${err.status} - ${err.body}`,
+					}),
+				);
+			}
+			throw err;
+		}
+	}
+
+	async #getContextSize(model) {
+		if (this.#contextCache.has(model)) return this.#contextCache.get(model);
+
+		// Cloudflare's models-search returns model metadata including
+		// `properties` (an array with `property_id` / `value` pairs).
+		// `context_window` (or `max_input_tokens` on some entries) is
+		// the field we want.
+		const url = `${this.#baseUrl()}/models/search?search=${encodeURIComponent(model)}`;
+		const res = await fetch(url, {
+			headers: { Authorization: `Bearer ${this.#apiKey}` },
+			signal: AbortSignal.timeout(FETCH_TIMEOUT),
+		});
+		if (!res.ok) {
+			throw new Error(
+				msg("error.cloudflare_models_failed", { model, status: res.status }),
+			);
+		}
+		const data = await res.json();
+		const entry = data.result.find((m) => m.name === model);
+		if (!entry) {
+			throw new Error(msg("error.cloudflare_model_not_found", { model }));
+		}
+		const props = entry.properties;
+		// Prefer `context_window` (full prompt+output combined) over
+		// `max_input_tokens` (input-only). Some Cloudflare entries have
+		// both, some only one. Picking the larger one is wrong (would
+		// pick input cap when context is what we want); explicit priority.
+		const ctxProp =
+			props.find((p) => p.property_id === "context_window") ??
+			props.find((p) => p.property_id === "max_input_tokens");
+		const ctx = ctxProp ? Number(ctxProp.value) : null;
+		if (!ctx) {
+			throw new Error(msg("error.cloudflare_no_context_length", { model }));
+		}
+		this.#contextCache.set(model, ctx);
+		return ctx;
+	}
+}