@sema-agent/core 2.12.0 → 3.0.0

package/dist/agents/verify.d.ts

@@ -1,6 +1,6 @@
 import { Type, type Static } from "typebox";
 import type { Runner, ResumeTaskConfig } from "../core/runner/runtask.js";
-import type { CheckpointToken, ResumeOutcome } from "../core/checkpoint-store.js";
+import type { CheckpointGate, CheckpointToken, ResumeOutcome } from "../core/checkpoint-store.js";
 import type { ModelRef, TaskResult, TaskSpec, ToolSpec } from "../core/types.js";
 export declare const VERIFICATION_PROMPT = "You are a verification specialist. Your job is NOT to confirm the implementation works \u2014 it is to try to BREAK it.\n\nYou have two documented failure patterns. First, verification avoidance: faced with a check, you find reasons not to run it \u2014 you read code, narrate what you would test, declare \"PASS,\" and move on. Second, being seduced by the first 80%: a polished result or a passing test suite makes you inclined to pass it, not noticing the edge that crashes, the state that vanishes, the bad input that is unhandled. The first 80% is the easy part. Your entire value is in finding the last 20%.\n\n## Hard boundary \u2014 do not modify the project\nYou are STRICTLY a verifier. Do NOT create, modify, or delete project files; do NOT install packages; do NOT run version-control write operations. Use only the read/probe/execute tools available to you. (If you need a scratch file, use a temp directory, and clean up.)\n\n## Evidence is mandatory\nReading code is NOT verification. Every check must actually run something \u2014 execute the code, hit the endpoint, run the build/tests \u2014 and record the command and its real output. A \"PASS\" with no command output is a skip, not a pass.\n\n## Strategy (adapt to what changed)\n- Build/lib changes: build it, run the full test suite, exercise the public API as a consumer would.\n- Backend/API: start it, call endpoints, check response *shapes* (not just status codes), test error paths.\n- CLI/script: run with representative AND edge inputs (empty, malformed, boundary); check stdout/stderr/exit codes.\n- Bug fix: reproduce the original bug first, verify the fix, then check for regressions and side effects.\n- Refactor (no behavior change): the existing suite must pass unchanged; diff the public surface; same inputs \u2192 same outputs.\nRun the project's own build/tests/linters as a baseline, then apply the type-specific checks. Test results are context, not proof \u2014 the implementer is an LLM too; its tests may be happy-path or circular.\n\n## Adversarial probes (pick the ones that fit)\nBoundary values (0, -1, empty, very long, unicode, max), idempotency (same mutating call twice), orphan operations (ids that don't exist), concurrency (parallel create-if-not-exists). Your verdict must include at least one adversarial probe you actually ran and its result \u2014 even if it was handled correctly.\n\n## Before you FAIL\nCheck you haven't missed why it's actually fine: defensive code elsewhere, intentional behavior documented in comments/specs, or an unfixable external-contract limitation (note that as an observation, not a FAIL). Don't wave away real issues, but don't FAIL on intentional behavior.\n\n## Verdict\nSubmit exactly one verdict via the provided output tool:\n- PASS \u2014 you ran real checks (including \u22651 adversarial probe) and it holds up. Put the commands + observed output in `evidence`.\n- FAIL \u2014 something is broken. Put each concrete problem (with how to reproduce) in `findings`.\n- PARTIAL \u2014 environmental limitation only (no test framework, a tool/server unavailable). Not for \"I'm unsure\": if you can run the check, decide PASS or FAIL. Note what you couldn't verify and why in `findings`.";
 export declare const STATIC_VERIFICATION_PROMPT = "You are a verification judge. Your job is NOT to confirm the change works \u2014 it is to find where it BREAKS.\n\nYou are READ-ONLY by design: the build and tests have ALREADY been run by a separate mechanical gate. Their results and the code change (a diff) are usually supplied to you as evidence; but if little or no diff/results are supplied this round (e.g. a re-verification AFTER a fix), judge the CURRENT working tree directly \u2014 do NOT return PARTIAL merely because a diff is absent. Do NOT try to execute code, run tests, or invoke a runtime \u2014 the environment will refuse it, and that is expected, not a limitation. Judge from any supplied diff/results plus read-only inspection of the working tree (read files, search, list).\n\nYou have two documented failure patterns. First, being seduced by the first 80%: a clean diff or a green test run makes you inclined to pass it, not noticing the edge that crashes, the state that vanishes, the bad input that is unhandled, the cross-module assumption that breaks. Second, hiding behind PARTIAL because you couldn't run something \u2014 that is NOT what PARTIAL is for here; execution was the mechanical gate's job. Your entire value is finding the last 20% by READING.\n\n## What to scrutinize (adapt to the diff)\n- Boundary/edge cases the tests likely miss: 0, -1, empty, very long, unicode, max, malformed input, idempotency, orphan ids, off-by-one, negative numbers, EOF/empty fields.\n- Semantic correctness vs the task spec: does the change actually do what was asked, including cases the tests don't cover (the title()/CSV/base62 class of defect)?\n- Cross-module/integration hazards in the diff: a changed signature/export/contract/default a caller elsewhere still assumes; a deleted helper something depends on.\n- If the provided test results show failures, that is a concrete FAIL with the failing output as evidence.\n\n## Verdict\nSubmit exactly one verdict via the provided output tool:\n- PASS \u2014 you read the diff + results, looked for the edges above, and it holds. Cite the specific things you checked in `evidence`.\n- FAIL \u2014 you found a concrete defect. Put each problem (with the diff location / input that breaks it) in `findings`.\n- PARTIAL \u2014 ONLY when the evidence itself is genuinely insufficient to judge (e.g. the diff is empty or unrelated to the task, no results supplied). NOT for \"I couldn't execute it.\" Say what's missing in `findings`.";
@@ -24,8 +24,15 @@ export interface VerifyConfig {
         verdict: VerificationOutcome["verdict"];
         findings: string[];
     }) => void;
+    onVerifierPause?: (info: {
+        round: number;
+        status: TaskResult["status"];
+        sessionId: string;
+        checkpointToken?: CheckpointToken;
+        checkpointGate?: CheckpointGate;
+    }) => void;
 }
-export type UnverifiedReason = "suspended" | "needs_review" | "no_verdict" | "opted_out" | "impl_incomplete" | "could_not_verify";
+export type UnverifiedReason = "suspended" | "needs_review" | "no_verdict" | "opted_out" | "impl_incomplete" | "could_not_verify" | "verifier_paused";
 export interface VerificationOutcome {
     verdict: "PASS" | "FAIL" | "PARTIAL" | "unverified";
     unverifiedReason?: UnverifiedReason;
@@ -33,6 +40,12 @@ export interface VerificationOutcome {
     findings: string[];
     evidence?: string;
     verifierCost?: number;
+    verifierPause?: {
+        status: TaskResult["status"];
+        sessionId: string;
+        checkpointToken?: CheckpointToken;
+        checkpointGate?: CheckpointGate;
+    };
 }
 export interface VerificationResult extends TaskResult {
     verification: VerificationOutcome;

package/dist/agents/verify.js

@@ -102,7 +102,8 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
             signal: specBase.signal,
         });
         try {
-            return { verdict: v.structuredOutput, cost: (v.stats.costMicroUsd ?? 0) + (v.stats.nested?.costMicroUsd ?? 0) };
+            const cost = (v.stats.costMicroUsd ?? 0) + (v.stats.nested?.costMicroUsd ?? 0);
+            return { verdict: v.structuredOutput, cost, ...(isDurablePause(v.status) ? { paused: v } : {}) };
         }
         finally {
             if (!isDurablePause(v.status))
@@ -115,9 +116,43 @@ export async function verifyCompleted(runner, result, specBase, objective, confi
     let spend = 0;
     let verifierSpend = 0;
     for (let round = 1; round <= maxRounds; round++) {
+        if (round > 1) {
+            if (config.totalTimeoutMs != null && Date.now() - startedAt >= config.totalTimeoutMs)
+                break;
+            if (config.costCeilingMicroUsd != null && spend >= config.costCeilingMicroUsd)
+                break;
+        }
         const v = await runVerifier(current, round);
         spend += v.cost;
         verifierSpend += v.cost;
+        if (v.paused) {
+            outcome = {
+                verdict: "unverified",
+                unverifiedReason: "verifier_paused",
+                rounds: round,
+                findings: [],
+                verifierCost: verifierSpend,
+                verifierPause: {
+                    status: v.paused.status,
+                    sessionId: v.paused.sessionId,
+                    ...(v.paused.checkpointToken ? { checkpointToken: v.paused.checkpointToken } : {}),
+                    ...(v.paused.checkpointGate ? { checkpointGate: v.paused.checkpointGate } : {}),
+                },
+            };
+            try {
+                config.onVerifierPause?.({
+                    round,
+                    status: v.paused.status,
+                    sessionId: v.paused.sessionId,
+                    ...(v.paused.checkpointToken ? { checkpointToken: v.paused.checkpointToken } : {}),
+                    ...(v.paused.checkpointGate ? { checkpointGate: v.paused.checkpointGate } : {}),
+                });
+            }
+            catch {
+            }
+            config.onRound?.({ round, verdict: outcome.verdict, findings: outcome.findings });
+            break;
+        }
         const rawVerdict = v.verdict?.verdict ?? "unverified";
         const verdict = rawVerdict === "PARTIAL" ? "unverified" : rawVerdict;
         const unverifiedReason = !v.verdict ? "no_verdict" : rawVerdict === "PARTIAL" ? "could_not_verify" : undefined;

package/dist/bin/sema-tb.js

@@ -289,7 +289,7 @@ async function main() {
         switch (e.kind) {
             case "brain.call":
                 lastServedModel = e.model;
-                line(`[call] model=${e.model} in=${e.promptTokens} out=${e.completionTokens} cache=${e.cacheRead} latMs=${e.latencyMs}` +
+                line(`[call] model=${e.model} in=${e.promptTokens} tot=${e.totalInputTokens} out=${e.completionTokens} cache=${e.cacheRead} latMs=${e.latencyMs}` +
                     (e.firstTokenMs !== undefined ? ` ttftMs=${e.firstTokenMs}` : "") +
                     (e.stopReason !== undefined ? ` stop=${e.stopReason}` : "") +
                     (e.callCap !== undefined ? ` cap=${e.callCap}${e.capThinkingSkipped ? "(think-skip)" : ""}` : "") +
@@ -403,7 +403,7 @@ async function main() {
                     reason.flush();
                     turns++;
                     const u = ev.usage;
-                    line(`[turn] ${turns}${u ? ` in=${u.inputTokens} out=${u.outputTokens} cache=${u.cacheReadTokens}` : ""}` +
+                    line(`[turn] ${turns}${u ? ` in=${u.inputTokens} tot=${u.totalInputTokens} out=${u.outputTokens} cache=${u.cacheReadTokens}` : ""}` +
                         (ev.usageMissing ? " usageMissing=1" : "") +
                         (ev.stopReason !== undefined ? ` stop=${ev.stopReason}` : ""));
                     break;

package/dist/brain/circuit-breaker.d.ts

@@ -8,6 +8,7 @@ export interface BreakerSnapshot {
     failures: number;
     openedAt?: number;
     halfOpenInFlight?: number;
+    halfOpenAt?: number;
 }
 export interface BreakerState {
     get(key: string): BreakerSnapshot | undefined;

package/dist/brain/circuit-breaker.js

@@ -11,14 +11,14 @@ class InMemoryBreakerState {
         this.m.set(k, s);
     }
 }
-function errorAssistantMessage(model, code, detail) {
+function errorAssistantMessage(model, code, detail, stopReason = "error") {
     return {
         role: "assistant",
         content: [{ type: "text", text: "" }],
         api: model.api,
         provider: model.provider,
         model: model.id,
-        stopReason: "error",
+        stopReason,
         errorMessage: `[${code}] ${detail}`,
         usage: ZERO_USAGE,
         timestamp: Date.now(),
@@ -44,21 +44,33 @@ export function createCircuitBreakerBrain(inner, opts = {}) {
         if (s.phase === "closed")
             return { pass: true };
         if (s.phase === "open") {
-            if (s.openedAt === undefined)
-                return { pass: false };
+            if (s.openedAt === undefined) {
+                state.set(key, { ...s, openedAt: now() });
+                return { pass: false, retryInMs: cooldownMs };
+            }
             const elapsed = now() - s.openedAt;
             if (elapsed >= cooldownMs) {
-                setState(key, s.phase, { ...s, phase: "half-open", halfOpenInFlight: 1 });
+                setState(key, s.phase, { ...s, phase: "half-open", halfOpenInFlight: 1, halfOpenAt: now() });
                 return { pass: true };
             }
             return { pass: false, retryInMs: cooldownMs - elapsed };
         }
         const inFlight = s.halfOpenInFlight ?? 0;
         if (inFlight < halfOpenProbes) {
-            state.set(key, { ...s, halfOpenInFlight: inFlight + 1 });
+            state.set(key, { ...s, halfOpenInFlight: inFlight + 1, halfOpenAt: s.halfOpenAt ?? now() });
             return { pass: true };
         }
-        return { pass: false };
+        const leaseStart = s.halfOpenAt;
+        if (leaseStart === undefined) {
+            state.set(key, { ...s, halfOpenAt: now() });
+            return { pass: false, retryInMs: cooldownMs };
+        }
+        const held = now() - leaseStart;
+        if (held >= cooldownMs) {
+            state.set(key, { ...s, halfOpenInFlight: 1, halfOpenAt: now() });
+            return { pass: true };
+        }
+        return { pass: false, retryInMs: cooldownMs - held };
     };
     const record = (key, failedCode, viaProbe = true) => {
         const s = snap(key);
@@ -118,9 +130,14 @@ export function createCircuitBreakerBrain(inner, opts = {}) {
                 }
             }
             catch (e) {
+                const aborted = options?.signal?.aborted === true || (e instanceof Error && e.name === "AbortError");
                 const code = e instanceof BrainError ? e.code : "network";
-                record(key, code, !bypass);
-                out.push({ type: "error", reason: "error", error: errorAssistantMessage(model, code, e instanceof Error ? e.message : String(e)) });
+                record(key, aborted ? "http" : code, !bypass);
+                out.push({
+                    type: "error",
+                    reason: aborted ? "aborted" : "error",
+                    error: errorAssistantMessage(model, code, e instanceof Error ? e.message : String(e), aborted ? "aborted" : "error"),
+                });
             }
         })();
         return out;

package/dist/brain/degrading.js

@@ -91,8 +91,20 @@ export function passthroughStream(brain, model, context, options) {
     void (async () => {
         try {
             const inner = await brain.stream(model, context, options);
-            for await (const ev of inner)
+            let sawTerminal = false;
+            for await (const ev of inner) {
+                if (ev.type === "done" || ev.type === "error")
+                    sawTerminal = true;
                 out.push(ev);
+            }
+            if (!sawTerminal) {
+                await inner.result();
+                out.push({
+                    type: "error",
+                    reason: "error",
+                    error: errorMessageOf(model, new Error("brain stream ended without a terminal event"), false),
+                });
+            }
         }
         catch (e) {
             const aborted = options?.signal?.aborted === true ||

package/dist/brain/failover.js

@@ -53,6 +53,8 @@ export function createFailoverBrain(brains) {
                             ...(lastFailedCode !== undefined ? { errorCode: lastFailedCode } : {}),
                         });
                     }
+                    if (!sawContent && heldStart)
+                        out.push(heldStart);
                     out.push(terminal ?? {
                         type: "done",
                         reason: message.stopReason,

package/dist/brain/repetition.js

@@ -11,6 +11,15 @@ const SEGMENT_MAX = 120;
 function clipSegment(s) {
     return s.length > SEGMENT_MAX ? s.slice(0, SEGMENT_MAX) : s;
 }
+function trailingRepeats(text, unit, cap) {
+    let n = 0;
+    let end = text.length;
+    while (n < cap && end - unit.length >= 0 && text.startsWith(unit, end - unit.length)) {
+        n++;
+        end -= unit.length;
+    }
+    return n;
+}
 function looksLikeCodeLineUnit(unit) {
     if (!unit.includes("\n")) {
         return false;
@@ -59,7 +68,7 @@ export function inspectDegenerate(text) {
             if (!looksLikeCodeLineUnit(unit)) {
                 return { degenerate: true, cut: event, spared };
             }
-            if (t === WINDOW && reps >= SATURATION_REPS && reps * p >= t - p) {
+            if (t === WINDOW && reps * p >= t - p && trailingRepeats(text, unit, SATURATION_REPS) >= SATURATION_REPS) {
                 return { degenerate: true, cut: event, spared };
             }
             if (!sparedUnitLoop) {

package/dist/brain/routing.js

@@ -17,7 +17,11 @@ export function createRoutingBrain(routes, opts = {}) {
     const by = opts.by ?? "provider";
     const stream = (model, context, options) => {
         const key = by === "api" ? model.api : model.provider;
-        const target = routes[key] ?? opts.fallback;
+        const routed = Object.hasOwn(routes, key) ? routes[key] : undefined;
+        const matched = routed !== null && typeof routed === "object" && typeof routed.stream === "function"
+            ? routed
+            : undefined;
+        const target = matched ?? opts.fallback;
         if (!target) {
             const out = createAssistantMessageEventStream();
             out.push({

package/dist/brain/status-sink.js

@@ -4,7 +4,11 @@ export function runWithStatusSink(emit, fn) {
     return statusSinkStore.run({ emit }, fn);
 }
 export function emitBrainStatus(status) {
-    statusSinkStore.getStore()?.emit(status);
+    try {
+        statusSinkStore.getStore()?.emit(status);
+    }
+    catch {
+    }
 }
 const telemetrySinkStore = new AsyncLocalStorage();
 export function runWithBrainTelemetry(emit, fn) {

package/dist/brain/stream-engine.js

@@ -43,6 +43,9 @@ function emptyAssistant(model) {
 function isAbortError(err) {
     return err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
 }
+function isWalltimeCutoff(err) {
+    return err instanceof Error && err.message === WALLTIME_CUTOFF_MESSAGE;
+}
 function sleep(ms, signal) {
     return new Promise((resolve) => {
         if (signal?.aborted)
@@ -85,7 +88,7 @@ export function runStreamingBrain(args) {
         .catch((err) => {
         const aborted = signal?.aborted === true || isAbortError(err);
         terminalRetryPhase = "gave_up";
-        terminalRetryDetail = aborted ? "cancelled while retrying" : "retries exhausted";
+        terminalRetryDetail = aborted ? "cancelled while retrying" : isWalltimeCutoff(err) ? "wall-clock deadline reached while retrying" : "retries exhausted";
         const errorMsg = emptyAssistant(model);
         errorMsg.stopReason = aborted ? "aborted" : "error";
         errorMsg.errorMessage = err instanceof Error ? err.message : String(err);

package/dist/brain/tool-call-repair.js

@@ -3,7 +3,7 @@ const FENCE_RE = /```(?:json|tool_call|tool|function)?\s*([\s\S]*?)```/gi;
 function asRecord(v) {
     return v && typeof v === "object" && !Array.isArray(v) ? v : undefined;
 }
-function extractCall(obj, toolNames) {
+function extractCall(obj, toolNames, framed) {
     const rec = asRecord(obj);
     if (!rec) {
         return undefined;
@@ -13,16 +13,32 @@ function extractCall(obj, toolNames) {
     if (typeof name !== "string" || !toolNames.has(name)) {
         return undefined;
     }
-    let rawArgs = rec.arguments ?? rec.parameters ?? rec.input ?? rec.args ?? fn?.arguments;
-    if (typeof rawArgs === "string") {
+    const rawArgs = rec.arguments ?? rec.parameters ?? rec.input ?? rec.args ?? fn?.arguments;
+    let args;
+    if (rawArgs === undefined) {
+        if (!framed)
+            return undefined;
+        args = {};
+    }
+    else if (typeof rawArgs === "string") {
+        let parsed;
         try {
-            rawArgs = JSON.parse(rawArgs);
+            parsed = JSON.parse(rawArgs);
         }
         catch {
-            rawArgs = {};
+            return undefined;
         }
+        const rec2 = asRecord(parsed);
+        if (!rec2)
+            return undefined;
+        args = rec2;
+    }
+    else {
+        const rec2 = asRecord(rawArgs);
+        if (!rec2)
+            return undefined;
+        args = rec2;
     }
-    const args = asRecord(rawArgs) ?? {};
     return {
         type: "toolCall",
         id: `repair_${name}_${Math.random().toString(36).slice(2, 8)}`,
@@ -30,28 +46,30 @@ function extractCall(obj, toolNames) {
         arguments: args,
     };
 }
-function parseBlock(raw, toolNames, out) {
+function parseBlock(raw, toolNames, out, framed) {
     let parsed;
     try {
         parsed = JSON.parse(raw.trim());
     }
     catch {
-        return false;
+        return "none";
     }
     const items = Array.isArray(parsed) ? parsed : [parsed];
-    let any = false;
+    let promoted = 0;
     for (const item of items) {
-        const call = extractCall(item, toolNames);
+        const call = extractCall(item, toolNames, framed);
         if (call) {
             out.push(call);
-            any = true;
+            promoted++;
         }
     }
-    return any;
+    if (promoted === 0)
+        return "none";
+    return promoted === items.length ? "all" : "some";
 }
 export function repairTextToolCalls(text, toolNames) {
     const toolCalls = [];
-    let cleaned = text.replace(TAG_RE, (m, _tag, inner) => parseBlock(inner, toolNames, toolCalls) ? "" : m);
-    cleaned = cleaned.replace(FENCE_RE, (m, inner) => parseBlock(inner, toolNames, toolCalls) ? "" : m);
+    let cleaned = text.replace(TAG_RE, (m, _tag, inner) => parseBlock(inner, toolNames, toolCalls, true) === "all" ? "" : m);
+    cleaned = cleaned.replace(FENCE_RE, (m, inner) => parseBlock(inner, toolNames, toolCalls, false) === "all" ? "" : m);
     return { toolCalls, cleanedText: cleaned.trim() };
 }

package/dist/core/auto-compaction.js

@@ -1,4 +1,4 @@
-import { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, CompactionError, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, formatPersistedOutputRefs, prepareCompaction, shouldCompact, } from "../internal/harness.js";
+import { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, CompactionError, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, formatFileOperations, formatPersistedOutputRefs, prepareCompaction, shouldCompact, } from "../internal/harness.js";
 import { fileArgPath } from "../tools/fs/safety.js";
 import { contextEditFrontier } from "./context-edit.js";
 import { selectCompactionEpoch } from "../prompt-assembly/epoch.js";
@@ -17,6 +17,10 @@ export function sanitizeCompactionInstructions(text) {
         ? cps.slice(0, COMPACTION_INSTRUCTIONS_MAX_CHARS).join("")
         : defused;
 }
+const WORKING_FILE_BREAKOUT_TAGS = ["working-file", "summary"];
+function escapeWorkingFilePathAttr(path) {
+    return path.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/[\r\n]+/g, " ");
+}
 export const COMPACTION_THROUGHPUT_PRIOR_TOKENS_PER_MS = 3;
 const COMPACTION_THROUGHPUT_EWMA_ALPHA = 0.3;
 const COMPACTION_WALLTIME_ABORT_FLAG = "semaCompactionWalltimeAbort";
@@ -69,8 +73,11 @@ export async function maybeCompact(opts) {
     const anchorStale = est.usageTokens > 0 && est.tokens > structuralTokens * STALE_ANCHOR_STRUCTURAL_MARGIN + overhead;
     const tokens = anchorStale || est.usageTokens === 0 ? structuralTokens + overhead : est.tokens;
     const window = opts.model.autoCompactTokens ?? opts.model.contextTokens ?? opts.model.contextWindow;
+    const windowKnown = Number.isFinite(window) && window > 0;
     const settings = sanitizeCompactionSettings(rawSettings, window);
-    const contextUsage = { usedTokens: tokens, windowTokens: window, compactAtTokens: window - settings.reserveTokens };
+    const contextUsage = windowKnown
+        ? { usedTokens: tokens, windowTokens: window, compactAtTokens: window - settings.reserveTokens }
+        : undefined;
     const wantsCompact = shouldCompact(tokens, window, settings);
     const naturalTrigger = wantsCompact && tokens >= (opts.minTokens ?? 0);
     const force = opts.force || (opts.forceUnderThreshold === true && !naturalTrigger);
@@ -118,7 +125,7 @@ export async function maybeCompact(opts) {
             : hookSanitized
         : specInstructions;
     const maxReuse = opts.maxConsecutiveProviderReuse ?? 3;
-    const forceRealSummary = (opts.consecutiveProviderReuse ?? 0) >= maxReuse;
+    const forceRealSummary = maxReuse > 0 && (opts.consecutiveProviderReuse ?? 0) >= maxReuse;
     let providerSummary;
     if (opts.summaryProvider && !forceRealSummary && !prep.value.isSplitTurn) {
         const providerModifiedFiles = computeFileLists(prep.value.fileOps).modifiedFilesByRecency;
@@ -151,7 +158,9 @@ export async function maybeCompact(opts) {
         summary = providerSummary;
         firstKeptEntryId = prep.value.firstKeptEntryId;
         summaryTokensBefore = prep.value.tokensBefore;
-        details = computeFileLists(prep.value.fileOps);
+        const providerFileLists = computeFileLists(prep.value.fileOps);
+        details = providerFileLists;
+        summary += formatFileOperations(providerFileLists.readFiles, providerFileLists.modifiedFiles);
         if (prep.value.invokedSkills.length > 0) {
             details.invokedSkills = prep.value.invokedSkills;
         }
@@ -330,7 +339,7 @@ export async function maybeCompact(opts) {
     const rawCandidateFiles = recentlyRead.length > 0 ? recentlyRead : (details?.modifiedFilesByRecency ?? details?.modifiedFiles);
     const maxFilesForSelection = Math.max(1, att?.maxFiles ?? 3);
     const excludedReadStatePreserveKeys = [];
-    const candidateFiles = Array.isArray(rawCandidateFiles) && rawCandidateFiles.length > 0
+    const candidateFiles = att !== undefined && Array.isArray(rawCandidateFiles) && rawCandidateFiles.length > 0
         ? await (async () => {
             const keptTailReadPathsRaw = new Set();
             const firstKeptIdx = branch.findIndex((e) => e.id === firstKeptEntryId);
@@ -417,7 +426,8 @@ export async function maybeCompact(opts) {
     if (att && Array.isArray(candidateFiles) && candidateFiles.length > 0) {
         const maxFiles = maxFilesForSelection;
         const perFileCap = Math.max(200, att.maxCharsPerFile ?? 16_000);
-        let remaining = Math.min(maxFiles * perFileCap, Math.floor(window * 0.15) * cpt);
+        const windowShareChars = windowKnown ? Math.floor(window * 0.15) * cpt : Number.POSITIVE_INFINITY;
+        let remaining = Math.min(maxFiles * perFileCap, windowShareChars);
         const blocks = [];
         for (const path of candidateFiles.slice(0, maxFiles)) {
             if (remaining <= 0)
@@ -437,7 +447,7 @@ export async function maybeCompact(opts) {
                 ? `${content.slice(0, cap)}\n[... ${content.length - cap} more characters truncated — read the file for the rest]`
                 : content;
             remaining -= clipped.length;
-            blocks.push(`<working-file path="${path}">\n${clipped}\n</working-file>`);
+            blocks.push(`<working-file path="${escapeWorkingFilePathAttr(path)}">\n${sanitizeUntrustedText(clipped, WORKING_FILE_BREAKOUT_TAGS)}\n</working-file>`);
             attachedFiles.push({ path, chars: Math.min(content.length, cap), truncated: wasClipped });
             if (!wasClipped)
                 attachedComplete.push({ path, content });

package/dist/core/auto-promote.js

@@ -1,4 +1,5 @@
 import { extractSymbols } from "../tools/fs/repo-map.js";
+import { parseSkillToolEntry } from "./skill-tool-specifier.js";
 export function decideAutoPromote(i) {
     if (i.tripwire.escalate)
         return "needs_human";
@@ -58,7 +59,7 @@ export function deriveTripwire(artifactText, declared, profileTokens) {
     const reasons = [];
     let escalate = false;
     try {
-        const allow = new Set(declared.allowTools ?? []);
+        const allow = new Set((declared.allowTools ?? []).map((entry) => parseSkillToolEntry(entry).name));
         const symbols = extractSymbols(artifactText);
         for (const sym of symbols) {
             if (!allow.has(sym)) {

package/dist/core/checkpoint-store.d.ts

@@ -30,6 +30,7 @@ export declare function riskSeverity(axes: {
     shell?: boolean;
 }): 1 | 2 | 3 | 4 | 5;
 export declare const MAX_TOOL_INPUT_PREVIEW_CHARS = 512;
+export declare const MAX_PENDING_STEER_CHARS = 16000;
 export declare function buildRiskDescriptor(input: {
     toolName: string;
     args: unknown;

package/dist/core/checkpoint-store.js

@@ -25,6 +25,7 @@ const MAX_TOUCHED_PATHS = 8;
 const MAX_DIGEST_KEYS = 16;
 const MAX_DIGEST_SCAN_KEYS = 256;
 export const MAX_TOOL_INPUT_PREVIEW_CHARS = 512;
+export const MAX_PENDING_STEER_CHARS = 16_000;
 function isPlainRecord(x) {
     try {
         if (x === null || typeof x !== "object" || Array.isArray(x))
@@ -130,26 +131,40 @@ export const MAX_SUPPORTED_CHECKPOINT_VERSION = 4;
 export function checkpointVersionOf(cp) {
     return cp.version ?? 0;
 }
+function finiteBound(v) {
+    return v !== undefined && Number.isFinite(v) ? v : undefined;
+}
+function finiteSpend(v) {
+    return v !== undefined && Number.isFinite(v) ? v : undefined;
+}
 export function debitLedger(prior, slice, total, opts) {
     return {
-        totalBudgetMicroUsd: prior?.totalBudgetMicroUsd ?? total?.totalBudgetMicroUsd,
-        totalWalltimeSec: prior?.totalWalltimeSec ?? total?.totalWalltimeSec,
-        spentMicroUsd: (prior?.spentMicroUsd ?? 0) + Math.max(0, slice.costMicroUsd),
-        spentTokens: (prior?.spentTokens ?? 0) + Math.max(0, slice.tokens),
-        spentTurns: (prior?.spentTurns ?? 0) + Math.max(0, slice.turns),
-        spentWalltimeMs: (prior?.spentWalltimeMs ?? 0) + Math.max(0, slice.walltimeMs ?? 0),
+        totalBudgetMicroUsd: finiteBound(prior?.totalBudgetMicroUsd) ?? finiteBound(total?.totalBudgetMicroUsd),
+        totalWalltimeSec: finiteBound(prior?.totalWalltimeSec) ?? finiteBound(total?.totalWalltimeSec),
+        spentMicroUsd: (finiteSpend(prior?.spentMicroUsd) ?? 0) + Math.max(0, finiteSpend(slice.costMicroUsd) ?? 0),
+        spentTokens: (finiteSpend(prior?.spentTokens) ?? 0) + Math.max(0, finiteSpend(slice.tokens) ?? 0),
+        spentTurns: (finiteSpend(prior?.spentTurns) ?? 0) + Math.max(0, finiteSpend(slice.turns) ?? 0),
+        spentWalltimeMs: (finiteSpend(prior?.spentWalltimeMs) ?? 0) + Math.max(0, finiteSpend(slice.walltimeMs) ?? 0),
         sliceCount: (prior?.sliceCount ?? 0) + (opts?.countSlice === false ? 0 : 1),
     };
 }
 export function remainingBudgetMicroUsd(ledger) {
-    if (ledger?.totalBudgetMicroUsd === undefined)
+    const total = ledger?.totalBudgetMicroUsd;
+    if (total === undefined || !Number.isFinite(total))
         return undefined;
-    return Math.max(0, ledger.totalBudgetMicroUsd - ledger.spentMicroUsd);
+    const spent = ledger?.spentMicroUsd;
+    if (spent !== undefined && !Number.isFinite(spent))
+        return 0;
+    return Math.max(0, total - (spent ?? 0));
 }
 export function remainingWalltimeMs(ledger) {
-    if (ledger?.totalWalltimeSec === undefined)
+    const total = ledger?.totalWalltimeSec;
+    if (total === undefined || !Number.isFinite(total))
         return undefined;
-    return Math.max(0, ledger.totalWalltimeSec * 1000 - (ledger.spentWalltimeMs ?? 0));
+    const spent = ledger?.spentWalltimeMs;
+    if (spent !== undefined && !Number.isFinite(spent))
+        return 0;
+    return Math.max(0, total * 1000 - (spent ?? 0));
 }
 export function summarizeCheckpoint(cp) {
     const riskDescriptor = cp.gate.kind === "human" || cp.gate.kind === "irreversible_ask" ? cp.gate.riskDescriptor : undefined;
@@ -217,6 +232,9 @@ export function validatePendingSteer(steer) {
     if (/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(steer.text)) {
         throw new CheckpointError("steering.invalid_content", "steering text must not contain control characters");
     }
+    if (steer.text.length > MAX_PENDING_STEER_CHARS) {
+        throw new CheckpointError("steering.invalid_content", `steering text must be at most ${MAX_PENDING_STEER_CHARS} characters (got ${steer.text.length})`);
+    }
     return { text: steer.text, trusted: steer.trusted };
 }
 export class InMemoryCheckpointStore {

package/dist/core/consolidate-scope.js

@@ -3,9 +3,9 @@ import { runMemoryConsolidation, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATI
 function maxMarker(a, b) {
     return a === undefined || b > a ? b : a;
 }
-function cappedHighWater(seen, failed) {
+function cappedHighWater(seen, blockers) {
     let floor;
-    for (const id of failed)
+    for (const id of blockers)
         if (floor === undefined || id < floor)
             floor = id;
     let hw;
@@ -66,7 +66,8 @@ export async function consolidateScope(scope, deps, opts = {}) {
             });
         }
         const seen = [...batchIds, ...(stats?.addedIds ?? [])];
-        const highWater = cappedHighWater(seen, stats?.failedIds ?? []);
+        const unfedTail = pending.slice(maxNotes).map((h) => h.id);
+        const highWater = cappedHighWater(seen, [...(stats?.failedIds ?? []), ...unfedTail]);
         if (highWater !== undefined && highWater !== cursor && (cursor === undefined || highWater > cursor)) {
             await store.setConsolidationCursor(scope, highWater);
         }

package/dist/core/context-edit.js

@@ -114,5 +114,8 @@ export function clearStaleToolResults(messages, opts) {
 }
 export function editBudget(model) {
     const window = model.autoCompactTokens ?? model.contextTokens ?? model.contextWindow;
+    if (!Number.isFinite(window) || window <= 0) {
+        return Number.POSITIVE_INFINITY;
+    }
     return contextEditFrontier(window);
 }

package/dist/core/context-guard.js

@@ -116,5 +116,8 @@ export function dropOrphanToolResults(messages) {
 }
 export function guardBudget(model) {
     const window = model.contextTokens ?? model.contextWindow;
+    if (!Number.isFinite(window) || window <= 0) {
+        return Number.POSITIVE_INFINITY;
+    }
     return Math.max(window - GUARD_HEADROOM_TOKENS, Math.floor(window * GUARD_FRACTION));
 }

package/dist/core/git-worktree-env.d.ts

@@ -12,4 +12,9 @@ export declare function addWorktree(baseEnv: ExecutionEnv, opts: AddWorktreeOpti
     };
     worktreeDir: string;
 }>;
-export declare function pruneWorktrees(baseEnv: ExecutionEnv, repoRoot: string): Promise<void>;
+export declare function pruneWorktrees(baseEnv: ExecutionEnv, repoRoot: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    detail: string;
+}>;