@prestyj/cli 5.13.0 → 5.16.0

package/dist/core/agent-session.js

@@ -26,7 +26,8 @@ import { buildSubAgentCompletionFollowUp } from "./subagent-manager.js";
 import { applyAsyncSubagentPolicy } from "./subagent-policy.js";
 import { z } from "zod";
 import { MCPClientManager, getAllMcpServers } from "./mcp/index.js";
-import { DeferredToolCatalog } from "./mcp/deferred-catalog.js";
+import { clampMcpToolDescription, DeferredToolCatalog } from "./mcp/deferred-catalog.js";
+import { CONTEXT_LIMITS, resolveContextLimits } from "./context-limits.js";
 import { McpCatalogCache } from "./mcp/catalog-cache.js";
 import { describeDropped, importForeignSession, } from "./foreign-session-import.js";
 import { createToolSearchTool } from "../tools/tool-search.js";
@@ -41,9 +42,10 @@ import { detectProjectStack } from "./language-detector.js";
 import { evaluateIdealReview, buildIdealReviewMessage, buildReviewCoverageEscalationMessage, buildReviewCoverageMessage, MAX_REVIEW_COVERAGE_INJECTIONS, withReviewCoverageRequirements, detectTestDrift, ReviewCoverageTracker, } from "./ideal-review.js";
 import { evaluateLoopBreak, buildLoopBreakMessage, CycleDetector, ToolCallProgressTracker, detectTextRepetition, } from "./loop-breaker.js";
 import { buildRegroundingMessage } from "./regrounding.js";
+import { buildEnvDeltaMessage } from "./env-delta.js";
 import { wrapSteeringText, buildNotificationSteeringText, STEERING_PREFIX } from "./steering.js";
 import { AgentNotificationQueue } from "./agent-notifications.js";
-import { VerificationGate, isCodeFilePath, isVerificationCommand } from "./verification-gate.js";
+import { VerificationGate, extractAddedLines, isCheckOwnFile, isCodeFilePath, isVerificationCommand, } from "./verification-gate.js";
 import { findUserSessionPrompt, getUserSessionPrompt } from "./session-preview.js";
 import { normalizeMessageImages } from "./message-images.js";
 import crypto from "node:crypto";
@@ -155,12 +157,21 @@ export class AgentSession {
     /** 0 = none; 1 = first nudge sent; 2 = final stop-and-report injected. */
     loopBreakInjected = 0;
     regroundingInjected = false;
+    /**
+     * The environment as the cached system prompt currently describes it.
+     * Re-recorded on every prompt build, so a rebuild (e.g. `/add-dir`) needs no
+     * delta; anything that changes WITHOUT one is caught by the hook below.
+     */
+    renderedEnvironment = {};
     /** Wall-clock start of the current run; scopes the background-process gate. */
     runStartedAt = 0;
     /** Gate injections spent this run, capped by MAX_PROCESS_GATE_INJECTIONS. */
     processGateInjected = 0;
     /** Verification gate: code edited this run, nothing proved it since. */
     verificationGate = new VerificationGate();
+    /** Mirror of the last verification `hook_armed` value, so the event fires
+     *  only on a real edge. */
+    verificationArmed = false;
     compactionOccurred = false;
     lastCompactionCompacted = false;
     compactionRetryAfter = 0;
@@ -195,6 +206,8 @@ export class AgentSession {
     mcpManager;
     /** Deferred MCP tools awaiting discovery via tool_search. */
     mcpCatalog;
+    /** Resolved prompt-injection byte budgets (contextLimits setting). */
+    contextLimits = CONTEXT_LIMITS;
     /**
      * Built-in tools held in the catalog instead of the live toolset. Their names
      * still render as one-line hints in the prompt's Tools section, so the model
@@ -305,6 +318,7 @@ export class AgentSession {
         // Load settings & auth
         this.settingsManager = new SettingsManager(paths.settingsFile);
         await this.settingsManager.load();
+        this.contextLimits = resolveContextLimits(this.settingsManager.get("contextLimits"));
         this.authStorage = new AuthStorage(paths.authFile);
         await this.authStorage.load();
         // Session manager. Agent-specific roots keep chat and coder histories isolated.
@@ -337,6 +351,7 @@ export class AgentSession {
         const { tools: builtInTools, processManager, rebuildReadTool, lspManager, subAgentManager, } = await createTools(this.cwd, {
             agents,
             skills: this.skills,
+            contextLimits: this.contextLimits,
             provider: this.provider,
             model: this.model,
             lspDiagnostics: this.settingsManager.get("lspDiagnostics"),
@@ -359,6 +374,7 @@ export class AgentSession {
                 // tool agree on which roots are writable.
                 additionalRoots: this.additionalRoots,
                 allowOutsideWorkspaceWrites: this.settingsManager.get("allowOutsideWorkspaceWrites"),
+                allowUnixSockets: this.settingsManager.get("sandboxAllowUnixSockets"),
             }),
             getUseExternalGrep: () => this.settingsManager.get("grepUseRipgrep"),
             authStorage: this.authStorage,
@@ -410,7 +426,7 @@ export class AgentSession {
                 // sits inside the cached prefix stays byte-stable across turns.
                 this.tools = core;
                 this.deferredBuiltinToolNames = deferred.map((t) => t.name);
-                this.mcpCatalog ??= new DeferredToolCatalog();
+                this.mcpCatalog ??= new DeferredToolCatalog(this.contextLimits);
                 this.mcpCatalog.add(deferred);
                 this.ensureToolSearchTool();
             }
@@ -533,7 +549,7 @@ export class AgentSession {
      * everything passes (default behavior). Otherwise a tool is allowed when its
      * name is in `allowedTools`, OR it's an MCP tool (`mcp__<server>__<tool>`)
      * whose `<server>` is in `allowedMcpServers`. The MCP-prefix rule lets a
-     * whitelisted research server (e.g. kencode-search) expose all its tools
+     * whitelisted research server expose all its tools
      * without hard-coding each one, while every other tool stays blocked.
      */
     isToolAllowed(name) {
@@ -563,8 +579,7 @@ export class AgentSession {
             return;
         // Allow-listed (read-only advisory) sessions enforce a fixed tool set by
         // name. An MCP server is only connected when its name is explicitly
-        // whitelisted via `allowedMcpServers` (the Nolan mentor agent does this for
-        // `kencode-search` so it can research real code). With no whitelist, skip
+        // whitelisted via `allowedMcpServers`. With no whitelist, skip
         // MCP entirely — dynamic `mcp__server__tool` names could never match a fixed
         // allow-list, and connecting would waste resources spawning stdio servers.
         const mcpWhitelist = this.opts.allowedMcpServers;
@@ -647,10 +662,11 @@ export class AgentSession {
         }
         const defer = !this.opts.allowedTools && this.settingsManager.get("deferredMcpTools");
         if (!defer) {
-            this.replaceOrPushTools(mcpTools);
+            // Eager path bypasses the catalog, so budget descriptions here too.
+            this.replaceOrPushTools(mcpTools.map((tool) => clampMcpToolDescription(tool, this.contextLimits)));
             return;
         }
-        this.mcpCatalog ??= new DeferredToolCatalog();
+        this.mcpCatalog ??= new DeferredToolCatalog(this.contextLimits);
         // `add` is name-keyed, so live definitions replace cached stubs in place.
         this.mcpCatalog.add(mcpTools);
         // A stub the model already promoted lives in `this.tools`; swap it for the
@@ -668,7 +684,7 @@ export class AgentSession {
      * registration on an existing catalog would leave those tools unreachable.
      */
     ensureToolSearchTool() {
-        this.mcpCatalog ??= new DeferredToolCatalog();
+        this.mcpCatalog ??= new DeferredToolCatalog(this.contextLimits);
         if (this.tools.some((t) => t.name === "tool_search"))
             return;
         this.tools.push(createToolSearchTool(this.mcpCatalog, (promoted) => {
@@ -686,7 +702,7 @@ export class AgentSession {
             return outcome.ok
                 ? { serverName, ok: true }
                 : { serverName, ok: false, error: outcome.error };
-        }));
+        }, this.contextLimits));
     }
     /** Append tools, replacing any same-named entry (cached stub → live tool). */
     replaceOrPushTools(tools) {
@@ -744,7 +760,7 @@ export class AgentSession {
     }
     /** Catalog-only registration for cached stubs — never marks them live. */
     addCachedMcpTools(stubs) {
-        this.mcpCatalog ??= new DeferredToolCatalog();
+        this.mcpCatalog ??= new DeferredToolCatalog(this.contextLimits);
         this.mcpCatalog.add(stubs);
         this.ensureToolSearchTool();
     }
@@ -882,12 +898,28 @@ export class AgentSession {
     buildAttachmentParts(text, attachments) {
         const parts = [];
         const fileNotes = [];
-        const modelSupportsVideo = getModel(this.model)?.supportsVideo ?? false;
+        const modelInfo = getModel(this.model);
+        const modelSupportsVideo = modelInfo?.supportsVideo ?? false;
+        // GLM only: GLM models have no native image input, but the GLM session is
+        // the only one with the zai_vision MCP server connected (core/mcp/defaults.ts).
+        // Point at the real tool instead of an inline image the provider layer would
+        // blank into a placeholder. Every other provider keeps inline images.
+        const glmImageHint = this.provider === "glm" && modelInfo?.supportsImages === false;
         for (const a of attachments) {
             if (a.kind === "image") {
-                parts.push({ type: "image", mediaType: a.mediaType, data: a.data });
-                if (a.path) {
-                    parts.push({ type: "text", text: `[Image saved at ${a.path}]` });
+                if (glmImageHint && a.path) {
+                    parts.push({
+                        type: "text",
+                        text: `[User attached an image saved at: ${a.path} — analyze it with the ` +
+                            `mcp__zai_vision__analyze_image tool (if that tool is not available yet, ` +
+                            `call tool_search with "analyze image" to unlock it first, then call it with image_source=${a.path})]`,
+                    });
+                }
+                else {
+                    parts.push({ type: "image", mediaType: a.mediaType, data: a.data });
+                    if (a.path) {
+                        parts.push({ type: "text", text: `[Image saved at ${a.path}]` });
+                    }
                 }
             }
             else if (a.kind === "video") {
@@ -961,6 +993,7 @@ export class AgentSession {
         this.idealReviewPhase = "idle";
         // No event here: clients reset their own hold on run_start.
         this.idealReviewArmed = false;
+        this.verificationArmed = false;
         this.idealDriftProbe = null;
         this.loopBreakInjected = 0;
         this.regroundingInjected = false;
@@ -1008,9 +1041,17 @@ export class AgentSession {
                 // Verification-gate bookkeeping: successful code mutations and completed
                 // foreground verification commands, in occurrence order.
                 if (!event.isError && args) {
-                    if ((name === "edit" || name === "write") &&
-                        isCodeFilePath(String(args.file_path ?? ""))) {
-                        this.verificationGate.recordMutation(String(args.file_path));
+                    if (name === "edit" || name === "write") {
+                        const filePath = String(args.file_path ?? "");
+                        // Check-owning files (tsconfig.json, pytest.ini, vitest.config.ts …)
+                        // are tracked even when they are not source code: editing one is how
+                        // a red suite is turned green without fixing anything.
+                        if (filePath && (isCodeFilePath(filePath) || isCheckOwnFile(filePath))) {
+                            const addedText = name === "write"
+                                ? String(args.content ?? "")
+                                : extractAddedLines(event.details?.diff ?? event.result);
+                            this.verificationGate.recordMutation(filePath, addedText);
+                        }
                     }
                     if (name === "bash" &&
                         !args.run_in_background &&
@@ -1033,12 +1074,12 @@ export class AgentSession {
                 // Tool results are what push the run over the review gate, and they all
                 // land before the model writes its candidate final answer — so this is
                 // the point where arming still beats the draft's first token.
-                this.refreshIdealReviewArmed();
+                this.refreshHookArming();
                 break;
             }
             case "turn_end":
                 this.hookStats.turns = event.turn;
-                this.refreshIdealReviewArmed();
+                this.refreshHookArming();
                 for (let index = this.messages.length - 1; index >= 0; index--) {
                     const anchor = this.messages[index];
                     if (anchor?.role === "assistant") {
@@ -1093,6 +1134,24 @@ export class AgentSession {
      * Mirrors the TUI's getSteeringMessages ordering.
      */
     getHookSteeringMessages() {
+        // Environment drift: settings can move the network allowlist mid-session,
+        // and `/add-dir` can widen the workspace, with no prompt rebuild — leaving
+        // the cached Environment section describing facts that are no longer real.
+        // Correcting it by appending is ~30 tokens; re-rendering the prompt would
+        // invalidate every cached byte from that section onward. Unconditional and
+        // cheap: identical facts produce no message at all.
+        //
+        // This runs for a verbatim custom prompt TOO. Those sessions (Nolan's) never
+        // rebuild their prompt, so this note is the only channel that can tell them
+        // a root was added — skipping it meant Nolan could write into a folder it had
+        // never been told about. The note states the facts outright rather than
+        // referring to a section such a prompt does not have.
+        const environmentDelta = buildEnvDeltaMessage(this.renderedEnvironment, this.promptEnvironment());
+        if (environmentDelta) {
+            // The model has now been told; only a further change re-triggers this.
+            this.renderedEnvironment = this.promptEnvironment();
+            log("INFO", "session", "Injecting an environment update the prompt is too stale to show");
+        }
         // Push notifications: a child that finished or a background build that
         // exited is new *fact*, not a correction, and it is cheap (bounded to 1 KiB
         // per drain). Drained above the loop-break checks so the agent can act on
@@ -1144,10 +1203,18 @@ export class AgentSession {
                 ];
                 return { role: "user", content: parts, provenance };
             });
-            return notificationMessage ? [...steeringMessages, notificationMessage] : steeringMessages;
+            return [
+                ...(environmentDelta ? [environmentDelta] : []),
+                ...steeringMessages,
+                ...(notificationMessage ? [notificationMessage] : []),
+            ];
+        }
+        if (environmentDelta || notificationMessage) {
+            return [
+                ...(environmentDelta ? [environmentDelta] : []),
+                ...(notificationMessage ? [notificationMessage] : []),
+            ];
         }
-        if (notificationMessage)
-            return [notificationMessage];
         if (this.opts.selfCorrectionHooks === false)
             return null;
         if (!this.settingsManager.get("idealReviewEnabled"))
@@ -1239,6 +1306,14 @@ export class AgentSession {
     wouldInjectIdealReview() {
         if (this.opts.selfCorrectionHooks === false || this.idealReviewSuppressed)
             return false;
+        // Mid-review a stop still injects: the coverage follow-up while files are
+        // unread, or its escalation once the budget is spent. Both make the model
+        // answer again, so the candidate answer is a draft exactly as it is before
+        // the review starts — without arming here it paints and the reviewed answer
+        // lands under it as a duplicate.
+        if (this.idealReviewPhase === "reviewing") {
+            return this.reviewCoverage.evidence().missing.length > 0;
+        }
         if (this.idealReviewPhase !== "idle")
             return false;
         if (!this.settingsManager.get("idealReviewEnabled"))
@@ -1257,9 +1332,36 @@ export class AgentSession {
         }
         return this.idealDriftProbe.drifted;
     }
-    /** Broadcast Ideal-review arming on change. Both edges matter: armed=false
-     *  after the review fires is what lets a client stream the REVIEWED final
-     *  answer live again. */
+    /** Would a stop right now inject the verification gate? Same conditions as
+     *  the pre-stop branch below, so arming and injection cannot disagree. */
+    wouldInjectVerification() {
+        if (this.opts.selfCorrectionHooks === false)
+            return false;
+        if (!this.settingsManager.get("verificationGateEnabled"))
+            return false;
+        if (this.opts.allowedTools && !this.opts.allowedTools.includes("bash"))
+            return false;
+        return this.verificationGate.willInject();
+    }
+    /** Broadcast pre-final hook arming on change. Both edges matter: armed=false
+     *  after the hook fires is what lets a client stream the REVIEWED final
+     *  answer live again.
+     *
+     *  Callable before `initialize()`: the sidecar sets Nolan's review suppression
+     *  on a freshly constructed session, and every arming predicate below reads
+     *  settings that `initialize()` has not loaded yet. Nothing can be armed
+     *  before the session can run a turn, and the first `tool_result`/`turn_end`
+     *  recomputes both edges — so skipping is the correct answer, not a patch. */
+    refreshHookArming() {
+        if (!this.settingsManager)
+            return;
+        this.refreshIdealReviewArmed();
+        const armed = this.wouldInjectVerification();
+        if (armed === this.verificationArmed)
+            return;
+        this.verificationArmed = armed;
+        this.eventBus.emit("hook_armed", { kind: "verification", armed });
+    }
     refreshIdealReviewArmed() {
         const armed = this.wouldInjectIdealReview();
         if (armed === this.idealReviewArmed)
@@ -1295,6 +1397,11 @@ export class AgentSession {
             const verificationFollowUp = this.verificationGate.followUp();
             if (verificationFollowUp) {
                 log("INFO", "verification-gate", "Injecting verification follow-up", {});
+                // Announce, THEN disarm: clients release held text on disarm, so the
+                // reverse order paints the draft and immediately deletes it — the exact
+                // flash arming exists to prevent.
+                this.eventBus.emit("hook", { kind: "verification" });
+                this.refreshHookArming();
                 return verificationFollowUp;
             }
         }
@@ -1310,8 +1417,20 @@ export class AgentSession {
                 lspMissing: lspEvidence.missing,
             });
             if (coverage.missing.length > 0) {
+                // Announce like any other pre-final injection: this follow-up makes the
+                // model answer again, so the answer it interrupts is a draft and the
+                // hook event is what tells clients to discard it. Injecting silently is
+                // what let the pre-coverage answer paint above the reviewed one.
+                this.eventBus.emit("hook", {
+                    kind: "ideal",
+                    coverageExpected: coverage.expected,
+                    coverageMissing: coverage.missing,
+                });
                 if (this.reviewCoverageInjected < MAX_REVIEW_COVERAGE_INJECTIONS) {
                     this.reviewCoverageInjected += 1;
+                    // Stays armed (coverage is still outstanding) — this call is here so a
+                    // client that missed the earlier edge is armed before the next draft.
+                    this.refreshIdealReviewArmed();
                     return [
                         this.withReviewLspEvidence(buildReviewCoverageMessage(coverage.missing), lspEvidence),
                     ];
@@ -1319,6 +1438,9 @@ export class AgentSession {
                 // Budget spent: close the gate so the run cannot spin on a file that
                 // never becomes readable, and require the gap be reported to the user.
                 this.idealReviewPhase = "complete";
+                // The gate is shut, so this is the real disarm: the answer to the
+                // escalation is final and streams live.
+                this.refreshIdealReviewArmed();
                 log("INFO", "ideal", "Ideal review coverage escalated after retry budget", {
                     injected: String(this.reviewCoverageInjected),
                     missing: coverage.missing,
@@ -1347,10 +1469,12 @@ export class AgentSession {
             coverageExpected: coverage.expected,
             coverageMissing: coverage.missing,
         });
-        // Disarm strictly AFTER the hook event. Clients release held text on
+        // Recompute strictly AFTER the hook event: clients release held text on
         // disarm, so the reverse order would paint the draft and then delete it —
-        // the exact flash arming exists to prevent. Leaving `idle` is what lets the
-        // reviewed final answer stream live instead of being held.
+        // the exact flash arming exists to prevent. Arming normally PERSISTS here,
+        // because review starts with every changed file uncovered and a stop while
+        // coverage is outstanding injects again. Disarm lands later, on the read
+        // that closes the last gap (or when the retry budget escalates).
         this.refreshIdealReviewArmed();
         log("INFO", "ideal", "Injecting ideal review before final response", {
             coverageExpected: coverage.expected,
@@ -1839,7 +1963,7 @@ export class AgentSession {
             // Reconnect MCP servers ONLY when GLM is involved on either side — GLM
             // is the only provider with a different server set (Z.AI tools), so a
             // non-GLM switch keeps the identical set. Skipping the dispose/reconnect
-            // there avoids tearing down a live stdio child (e.g. kencode-search) and
+            // there avoids tearing down a live stdio child and
             // gambling on a `npx` re-spawn that could fail and drop the tools.
             const glmInvolved = this.provider === "glm" || prevProvider === "glm";
             if (this.mcpManager && glmInvolved) {
@@ -2267,7 +2391,7 @@ export class AgentSession {
         }
         // Suppression flips mid-run (autopilot takes over verification), so a client
         // holding a draft under a stale arming must be released.
-        this.refreshIdealReviewArmed();
+        this.refreshHookArming();
     }
     /** Queue a user message (optionally with attachments) to be injected mid-run
      *  as steering. Returns the new queue length. No-op semantics are the caller's
@@ -2426,6 +2550,16 @@ export class AgentSession {
         const live = new Set(liveNames);
         return this.deferredBuiltinToolNames.filter((name) => !live.has(name));
     }
+    /**
+     * The environment about to be rendered into a prompt, remembered as the
+     * truth the model has been told. Pairs with the env-delta hook: whatever the
+     * prompt states, the model is only corrected when reality moves away from it.
+     */
+    recordRenderedEnvironment() {
+        const environment = this.promptEnvironment();
+        this.renderedEnvironment = environment;
+        return environment;
+    }
     /** Environment facts that vary per session rather than per host. */
     promptEnvironment() {
         const networkAllow = this.settingsManager.get("networkMode") === "allowlist"
@@ -2451,10 +2585,11 @@ export class AgentSession {
                 toolNames,
                 deferredToolNames,
                 context: this.opts.agentContext,
-                environment: this.promptEnvironment(),
+                environment: this.recordRenderedEnvironment(),
+                contextLimits: this.contextLimits,
             });
         }
-        return buildSystemPrompt(this.cwd, this.skills, planMode, approvedPlanPath, toolNames, undefined, this.provider, this.promptEnvironment(), deferredToolNames);
+        return buildSystemPrompt(this.cwd, this.skills, planMode, approvedPlanPath, toolNames, undefined, this.provider, this.recordRenderedEnvironment(), deferredToolNames, this.contextLimits);
     }
     /** Rebuild messages[0] from current plan-mode + approved-plan state. */
     async rebuildSystemPromptInPlace() {