@sema-ai/core 1.275.1

package/dist/engine/compaction/compaction.js

@@ -0,0 +1,1030 @@
+import { resolveAgentCoreCompleteFn, } from "../loop/runtime-deps.js";
+import { asAgentMessage, convertToLlm, createCompactionSummaryMessage, createCustomMessage, } from "../harness/messages.js";
+import { buildSessionContext } from "../session/session.js";
+import { CompactionError, err, ok, } from "../harness/types.js";
+import { computeFileLists, createFileOps, extractFileOpsFromMessage, formatFileOperations, serializeConversation, stripFileOperationsFooter, } from "./utils.js";
+function safeJsonStringify(value) {
+    try {
+        return JSON.stringify(value) ?? "undefined";
+    }
+    catch {
+        return "[unserializable]";
+    }
+}
+function extractFileOperations(messages, entries, prevCompactionIndex) {
+    const fileOps = createFileOps();
+    if (prevCompactionIndex >= 0) {
+        const prevCompaction = entries[prevCompactionIndex];
+        if (!prevCompaction.fromHook && prevCompaction.details) {
+            const details = prevCompaction.details;
+            if (Array.isArray(details.readFiles)) {
+                for (const f of details.readFiles) {
+                    fileOps.read.add(f);
+                }
+            }
+            if (Array.isArray(details.modifiedFiles)) {
+                for (const f of details.modifiedFiles) {
+                    fileOps.edited.add(f);
+                }
+                // Seed recency from the previous compaction when it recorded one (newest-first → insert in
+                // reverse so the order set stays oldest→newest); files touched by THIS range's messages are
+                // extracted after this and move to newer positions naturally.
+                const prevRecency = details.modifiedFilesByRecency;
+                if (Array.isArray(prevRecency)) {
+                    for (const f of prevRecency.toReversed()) {
+                        fileOps.modifiedOrder.add(f);
+                    }
+                }
+            }
+        }
+    }
+    for (const msg of messages) {
+        extractFileOpsFromMessage(msg, fileOps);
+    }
+    return fileOps;
+}
+function getMessageFromEntry(entry) {
+    if (entry.type === "message") {
+        return entry.message;
+    }
+    if (entry.type === "custom_message") {
+        return asAgentMessage(createCustomMessage(entry.customType, entry.content, entry.display, entry.details, entry.timestamp));
+    }
+    if (entry.type === "compaction") {
+        return asAgentMessage(createCompactionSummaryMessage(entry.summary, entry.tokensBefore, entry.timestamp));
+    }
+    return undefined;
+}
+function getMessageFromEntryForCompaction(entry) {
+    if (entry.type === "compaction") {
+        return undefined;
+    }
+    return getMessageFromEntry(entry);
+}
+/** Default compaction settings used by the harness. */
+export const DEFAULT_COMPACTION_SETTINGS = {
+    enabled: true,
+    reserveTokens: 16384,
+    keepRecentTokens: 20000,
+};
+/**
+ * design/123 D2 — default structural coefficient (chars per token) for every structural token
+ * estimate. 4 = the historical chars/4 heuristic (CC 198's legacy-family value); per-model override
+ * via `Model.charsPerToken` (newer families → 3, CJK-heavy → 2–3). Threaded as an explicit parameter
+ * through the estimate chain so caller-side coordinates never split (estimate vs cut-point vs defense).
+ */
+export const DEFAULT_CHARS_PER_TOKEN = 4;
+/**
+ * design/123 D2 image pin — an inline image contributes a FIXED token weight, deliberately NOT
+ * derived from `chars / charsPerToken`: the old `chars += 4800` shape would silently re-price an
+ * image from 1200 to 1600 tokens under charsPerToken=3. Image-size specialization stays deferred;
+ * this constant keeps the estimate coefficient-invariant.
+ *
+ * 批③ P2 value bump 1200→2000 = the CC estimate ("Images/documents are approximately 2000 tokens
+ * regardless of format" — services/compact/microCompact.ts:152; services/tokenEstimation.ts:409-411
+ * returns 2000 per image, noting the API actually charges ~2000 where naive base64/4 estimated ~325k).
+ * At 1200 a vision-heavy session under-estimated by ~40% per image ⇒ compaction fired late ⇒
+ * provider-side overflow risk. Mechanism (fixed pin) unchanged; value only.
+ */
+const IMAGE_TOKEN_ESTIMATE = 2000;
+/** Calculate total context tokens from provider usage. */
+export function calculateContextTokens(usage) {
+    return usage.totalTokens || usage.input + usage.output + usage.cacheRead + usage.cacheWrite;
+}
+// VENDORED EDIT (design/64 §26.5 council #1): anchor on USAGE SIGNAL, not on stopReason alone.
+// - An "error" assistant often carries VALID usage (the provider billed the request before failing) —
+//   the old unconditional skip could drop the anchor entirely when the visible history holds only
+//   error assistants (shared session across failed tasks), silently falling back to the chars/4
+//   heuristic for the WHOLE history, which underestimates code-dense content (≈2×) → compaction
+//   skipped → provider-side truncation.
+// - Conversely, zero/empty usage (a synthetic loop-failure message carries EMPTY_USAGE — a truthy
+//   object) must NEVER anchor: anchoring at 0 would swallow the entire prior history from the
+//   estimate, far worse than the chars/4 fallback.
+// "aborted" stays excluded: its usage may reflect a partially consumed stream.
+function getAssistantUsage(msg) {
+    if (msg.role === "assistant" && "usage" in msg) {
+        const assistantMsg = msg;
+        if (assistantMsg.stopReason !== "aborted" &&
+            assistantMsg.usage &&
+            calculateContextTokens(assistantMsg.usage) > 0) {
+            return assistantMsg.usage;
+        }
+    }
+    return undefined;
+}
+/**
+ * Return usage from the last successful assistant message in session entries.
+ *
+ * design/123 D1 stale-anchor note (fable-m2, same-family point): this scans RAW session entries, so
+ * unlike `buildSessionContext` (which shallow-strips the usage of kept-tail assistants replayed
+ * across a compaction boundary — the anchor "naturally disappears", CC 198 parity) it CAN still see
+ * a pre-compaction anchor. Any consumer using this across a compaction boundary must treat such an
+ * anchor as STALE: it reflects the pre-compaction request and overestimates the post-compaction
+ * context. (Currently exported with no in-repo production consumer.)
+ */
+export function getLastAssistantUsage(entries) {
+    for (let i = entries.length - 1; i >= 0; i--) {
+        const entry = entries[i];
+        if (entry.type === "message") {
+            const usage = getAssistantUsage(entry.message);
+            if (usage) {
+                return usage;
+            }
+        }
+    }
+    return undefined;
+}
+function getLastAssistantUsageInfo(messages) {
+    for (let i = messages.length - 1; i >= 0; i--) {
+        const usage = getAssistantUsage(messages[i]);
+        if (usage) {
+            return { usage, index: i };
+        }
+    }
+    return undefined;
+}
+/** Estimate context tokens for messages using provider usage when available.
+ *  `charsPerToken` (design/123 D2): structural coefficient for the anchor-less fallback and the
+ *  trailing (post-anchor) increment — pass `Model.charsPerToken` so the estimate matches the model. */
+export function estimateContextTokens(messages, charsPerToken = DEFAULT_CHARS_PER_TOKEN) {
+    const usageInfo = getLastAssistantUsageInfo(messages);
+    if (!usageInfo) {
+        let estimated = 0;
+        for (const message of messages) {
+            estimated += estimateTokens(message, charsPerToken);
+        }
+        return {
+            tokens: estimated,
+            usageTokens: 0,
+            trailingTokens: estimated,
+            lastUsageIndex: null,
+        };
+    }
+    const usageTokens = calculateContextTokens(usageInfo.usage);
+    let trailingTokens = 0;
+    for (let i = usageInfo.index + 1; i < messages.length; i++) {
+        trailingTokens += estimateTokens(messages[i], charsPerToken);
+    }
+    return {
+        tokens: usageTokens + trailingTokens,
+        usageTokens,
+        trailingTokens,
+        lastUsageIndex: usageInfo.index,
+    };
+}
+/** Return whether context usage exceeds the configured compaction threshold. */
+export function shouldCompact(contextTokens, contextWindow, settings) {
+    if (!settings.enabled) {
+        return false;
+    }
+    return contextTokens > contextWindow - settings.reserveTokens;
+}
+/** Estimate token count for one message using a conservative character heuristic.
+ *  `charsPerToken` (design/123 D2): per-model structural coefficient (default 4 = byte-compatible
+ *  legacy heuristic). Images contribute a FIXED token weight independent of the coefficient. */
+export function estimateTokens(message, charsPerToken = DEFAULT_CHARS_PER_TOKEN) {
+    let chars = 0;
+    const harnessMessage = message;
+    switch (harnessMessage.role) {
+        case "user": {
+            const content = harnessMessage.content;
+            let imageTokens = 0;
+            if (typeof content === "string") {
+                chars = content.length;
+            }
+            else if (Array.isArray(content)) {
+                for (const block of content) {
+                    if (block.type === "text" && block.text) {
+                        chars += block.text.length;
+                    }
+                    // Upstream-parity fix (2026-07 diff, openclaw 2ece2945ae class): user-message image blocks
+                    // previously counted 0 tokens, so image-heavy sessions systematically UNDER-estimated context
+                    // and compaction triggered late. Mirror the toolResult branch's fixed-weight accounting
+                    // (image pin + PDF page approximation) so the estimate is symmetric across roles.
+                    if (block.type === "image") {
+                        imageTokens += IMAGE_TOKEN_ESTIMATE;
+                    }
+                    if (block.type === "document" && typeof block.data === "string") {
+                        imageTokens += Math.max(IMAGE_TOKEN_ESTIMATE, Math.ceil(block.data.length / 36));
+                    }
+                }
+            }
+            return Math.ceil(chars / charsPerToken) + imageTokens;
+        }
+        case "assistant": {
+            const assistant = harnessMessage;
+            for (const block of assistant.content) {
+                if (block.type === "text") {
+                    chars += block.text.length;
+                }
+                else if (block.type === "thinking") {
+                    // Count the signature payload too: redacted thinking carries its (billed) content in
+                    // `thinkingSignature` with an EMPTY `thinking` text, and the block is replayed to the
+                    // provider on the next request — a structural estimate blind to it under-counts exactly
+                    // the content the anchor legitimately billed (stale-anchor gate false positive; verify
+                    // leg F1 on docs/TOKEN-ESTIMATE-CALIBRATION-LIVE-2026-07-09.md). No-op for providers
+                    // that don't return signatures (e.g. deepseek).
+                    chars += block.thinking.length + (block.thinkingSignature?.length ?? 0);
+                }
+                else if (block.type === "toolCall") {
+                    chars += block.name.length + safeJsonStringify(block.arguments).length;
+                }
+            }
+            return Math.ceil(chars / charsPerToken);
+        }
+        case "custom":
+        case "toolResult": {
+            let imageTokens = 0;
+            if (typeof harnessMessage.content === "string") {
+                chars = harnessMessage.content.length;
+            }
+            else {
+                for (const block of harnessMessage.content) {
+                    if (block.type === "text" && block.text) {
+                        chars += block.text.length;
+                    }
+                    if (block.type === "image") {
+                        // Fixed token weight (design/123 D2 image pin): NOT chars-derived, so the estimate does
+                        // not drift when the coefficient changes (4800 chars was 1200 tokens at /4 but would
+                        // become 1600 at /3).
+                        imageTokens += IMAGE_TOKEN_ESTIMATE;
+                    }
+                    if (block.type === "document" && typeof block.data === "string") {
+                        // PDF read: a document block's cost scales with PAGE COUNT (Anthropic bills ~1,500-3,000
+                        // tokens/page: each page is charged as an image plus its extracted text), which we cannot
+                        // see here — approximate pages from payload size (~60KB raw ≈ 80K base64 chars per typical
+                        // page ⇒ tokens ≈ base64Len × 0.75/61440 × 2250 ≈ len/36), floored at one IMAGE-pin worth
+                        // so a tiny PDF never under-counts below the CC "≈2000 tokens regardless of format" floor.
+                        imageTokens += Math.max(IMAGE_TOKEN_ESTIMATE, Math.ceil(block.data.length / 36));
+                    }
+                }
+            }
+            return Math.ceil(chars / charsPerToken) + imageTokens;
+        }
+        case "bashExecution": {
+            chars = harnessMessage.command.length + harnessMessage.output.length;
+            return Math.ceil(chars / charsPerToken);
+        }
+        case "compactionSummary": {
+            chars = harnessMessage.summary.length;
+            return Math.ceil(chars / charsPerToken);
+        }
+    }
+    return 0;
+}
+function findValidCutPoints(entries, startIndex, endIndex) {
+    const cutPoints = [];
+    // message-identity Phase 1 coupling (verified 2026-06-28): the chosen cut point becomes `firstKeptEntryId`
+    // (the `compacted.preserved_segment` floor a consumer resolves via the `message_committed` wire event, which
+    // covers user/assistant/toolResult). This switch ALSO admits `bashExecution`/`custom`/`compactionSummary`
+    // message roles + `custom_message` entries as floors — but those have NO producer in this engine (no
+    // appendMessage of those roles; nothing queues a `custom_message` write; compactionSummary/custom are
+    // build-context reconstructions, not persisted message entries), so a real floor is always user/assistant. If a
+    // future change ADDS such a producer, a floor could land on an entry `message_committed` does not emit → extend
+    // message-identity coverage (or adopt the first-party `onEntryCommitted` escape hatch). The compaction-floor
+    // tripwire in `test/compaction.test.ts` ("message-identity Phase 1") goes RED if that invariant ever breaks.
+    for (let i = startIndex; i < endIndex; i++) {
+        const entry = entries[i];
+        switch (entry.type) {
+            case "message": {
+                const role = entry.message.role;
+                switch (role) {
+                    case "bashExecution":
+                    case "custom":
+                    case "compactionSummary":
+                    case "user":
+                    case "assistant":
+                        cutPoints.push(i);
+                        break;
+                    case "toolResult":
+                        break;
+                }
+                break;
+            }
+            // VENDORED EDIT (design/71 council fold, 2026-06-13): custom_message used to sit in the no-op
+            // fall-through AND get pushed by a standalone if AFTER the switch (upstream shape, shared with
+            // the deleted branch_summary) — a maintenance trap where editing the switch silently misses the
+            // out-of-band push. One source of truth: it IS a valid cut point, said in its own case.
+            case "custom_message":
+                cutPoints.push(i);
+                break;
+            case "thinking_level_change":
+            case "model_change":
+            case "compaction":
+            case "custom":
+            case "label":
+            case "session_info":
+            case "leaf":
+                break;
+        }
+    }
+    return cutPoints;
+}
+/** Find the user-visible message that starts the turn containing an entry. */
+export function findTurnStartIndex(entries, entryIndex, startIndex) {
+    for (let i = entryIndex; i >= startIndex; i--) {
+        const entry = entries[i];
+        if (entry.type === "custom_message") {
+            return i;
+        }
+        if (entry.type === "message") {
+            const role = entry.message.role;
+            if (role === "user" || role === "bashExecution") {
+                return i;
+            }
+        }
+    }
+    return -1;
+}
+/** Find the compaction cut point that keeps approximately the requested recent-token budget.
+ *  `charsPerToken` (design/123 D2): the keep-recent accumulation must live in the SAME structural
+ *  coordinate as the trigger estimate, or the kept tail is systematically over/under-sized. */
+export function findCutPoint(entries, startIndex, endIndex, keepRecentTokens, charsPerToken = DEFAULT_CHARS_PER_TOKEN) {
+    const cutPoints = findValidCutPoints(entries, startIndex, endIndex);
+    if (cutPoints.length === 0) {
+        return { firstKeptEntryIndex: startIndex, turnStartIndex: -1, isSplitTurn: false };
+    }
+    let accumulatedTokens = 0;
+    let cutIndex = cutPoints[0];
+    for (let i = endIndex - 1; i >= startIndex; i--) {
+        const entry = entries[i];
+        if (entry.type !== "message") {
+            continue;
+        }
+        const messageTokens = estimateTokens(entry.message, charsPerToken);
+        accumulatedTokens += messageTokens;
+        if (accumulatedTokens >= keepRecentTokens) {
+            let found = false;
+            for (const cutPoint of cutPoints) {
+                if (cutPoint >= i) {
+                    cutIndex = cutPoint;
+                    found = true;
+                    break;
+                }
+            }
+            // VENDORED EDIT (audit A-2 / design/64 §28.3): when the keep budget is exhausted INSIDE the
+            // trailing tool-result batch (tool results are not valid cut points, so no cutPoint ≥ i
+            // exists — e.g. two parallel 50KB reads ≥ keepRecentTokens at a within-task boundary), the
+            // old fallback was cutPoints[0] = the EARLIEST cut point: nearly the whole history was kept,
+            // messagesToSummarize came out empty, the model hallucinated a summary from an empty
+            // conversation (bypassing the empty-summary guard), context GREW, freedTokens=0 inflated the
+            // §25.2 regrowth floor past the window, and within-task compaction shut down for the rest of
+            // the task. Correct fallback: the LARGEST cut point ≤ i — keep the oversized batch (slightly
+            // over budget) and summarize everything before it. The normal path (a cut point at/after i
+            // exists) is unchanged.
+            if (!found) {
+                for (let c = cutPoints.length - 1; c >= 0; c--) {
+                    if (cutPoints[c] <= i) {
+                        cutIndex = cutPoints[c];
+                        break;
+                    }
+                }
+            }
+            break;
+        }
+    }
+    while (cutIndex > startIndex) {
+        const prevEntry = entries[cutIndex - 1];
+        if (prevEntry.type === "compaction") {
+            break;
+        }
+        if (prevEntry.type === "message") {
+            break;
+        }
+        cutIndex--;
+    }
+    const cutEntry = entries[cutIndex];
+    const isUserMessage = cutEntry.type === "message" && cutEntry.message.role === "user";
+    const turnStartIndex = isUserMessage ? -1 : findTurnStartIndex(entries, cutIndex, startIndex);
+    return {
+        firstKeptEntryIndex: cutIndex,
+        turnStartIndex,
+        isSplitTurn: !isUserMessage && turnStartIndex !== -1,
+    };
+}
+export const SUMMARIZATION_SYSTEM_PROMPT = `You are a context summarization assistant. Your task is to read a conversation between a user and an AI coding assistant, then produce a structured summary following the exact format specified.
+
+Do NOT continue the conversation. Do NOT respond to any questions in the conversation. ONLY output the structured summary.`;
+// VENDORED EDIT (design/64 §22 / design/66 D / channel [73], clay 2026-06-10 vendored-edit policy), realigned
+// 2026-07-08 (CC 2.1.198 compaction parity batch W:C1/C2/C3, bench/cc-parity-toolsuite/
+// compaction-cc198-verbatim-capture-2026-07-08.md §A1a): the 9 section names, the analysis checklist, and the
+// security-relevant-instructions preservation clauses (two occurrences — analysis checklist + section 6) are
+// CC 198 T$n VERBATIM. Deliberate sema supersets kept: the fenced `<conversation>` input framing (C9/H5
+// posture — CC sees the raw fork context instead) and the `<analysis>` scratch block being STRIPPED before
+// persisting (maybeCompact; CC keeps its own <analysis>/<summary> post-processing). No `<summary>` output tag
+// requested: our injection adds the fencing at render time (COMPACTION_SUMMARY_PREFIX/SUFFIX).
+// Mirrored in UPDATE_SUMMARIZATION_PROMPT (the update pass is a sema superset — CC is fresh-pass only).
+const SUMMARIZATION_PROMPT = `The messages above are a conversation to summarize. Your task is to create a detailed summary of the conversation so far, paying close attention to the user's explicit requests and your previous actions.
+This summary should be thorough in capturing technical details, code patterns, and architectural decisions that would be essential for continuing development work without losing context. Another LLM will use it to continue the work.
+
+Before providing your final summary, wrap your analysis in <analysis> tags to organize your thoughts and ensure you've covered all necessary points. This analysis is scratch work — it will be stripped and NOT kept, so it is only to help you write a faithful summary. In your analysis process:
+
+1. Chronologically analyze each message and section of the conversation. For each section thoroughly identify:
+   - The user's explicit requests and intents
+   - Your approach to addressing the user's requests
+   - Key decisions, technical concepts and code patterns
+   - Specific details like:
+     - file names
+     - full code snippets
+     - function signatures
+     - file edits
+   - Errors that you ran into and how you fixed them
+   - Pay special attention to specific user feedback that you received, especially if the user told you to do something differently.
+   - Note any security-relevant instructions or constraints the user stated (e.g., sensitive files or data to avoid, operations that must not be performed, credential or secret handling rules). These MUST be preserved verbatim in the summary so they continue to apply after compaction.
+2. Double-check for technical accuracy and completeness, addressing each required element thoroughly.
+
+Then, after </analysis>, write the summary. Your summary should include the following sections:
+
+1. Primary Request and Intent: Capture all of the user's explicit requests and intents in detail
+2. Key Technical Concepts: List all important technical concepts, technologies, and frameworks discussed.
+3. Files and Code Sections: Enumerate specific files and code sections examined, modified, or created. Pay special attention to the most recent messages and include full code snippets where applicable and include a summary of why this file read or edit is important.
+4. Errors and fixes: List all errors that you ran into, and how you fixed them. Pay special attention to specific user feedback that you received, especially if the user told you to do something differently.
+5. Problem Solving: Document problems solved and any ongoing troubleshooting efforts.
+6. All user messages: List ALL user messages that are not tool results. These are critical for understanding the users' feedback and changing intent. Preserve any security-relevant instructions or constraints verbatim so they remain in effect after compaction.
+7. Pending Tasks: Outline any pending tasks that you have explicitly been asked to work on.
+8. Current Work: Describe in detail precisely what was being worked on immediately before this summary request, paying special attention to the most recent messages from both user and assistant. Include file names and code snippets where applicable.
+9. Optional Next Step: List the next step that you will take that is related to the most recent work you were doing. IMPORTANT: ensure that this step is DIRECTLY in line with the user's most recent explicit requests, and the task you were working on immediately before this summary request. If your last task was concluded, then only list next steps if they are explicitly in line with the users request. Do not start on tangential requests or really old requests that were already completed without confirming with the user first.
+   If there is a next step, include direct quotes from the most recent conversation showing exactly what task you were working on and where you left off. This should be verbatim to ensure there's no drift in task interpretation.
+
+Please provide your summary based on the conversation so far, following this structure and ensuring precision and thoroughness in your response.
+
+Keep each section concise. Preserve exact file paths, function names, and error messages.`;
+const UPDATE_SUMMARIZATION_PROMPT = `The messages above are NEW conversation messages to incorporate into the existing summary provided in <previous-summary> tags.
+
+Update the existing structured summary with new information. RULES:
+- PRESERVE all existing information from the previous summary
+- ADD new progress, decisions, and context from the new messages
+- UPDATE "Pending Tasks" and "Current Work" based on what was accomplished
+- UPDATE "Optional Next Step" based on the most recent work
+- PRESERVE exact file paths, function names, and error messages
+- Preserve any security-relevant instructions or constraints verbatim so they remain in effect after compaction
+- If something is no longer relevant, you may remove it
+
+First, inside an <analysis>...</analysis> block, note what is new since the previous summary and what must change. This analysis is scratch work — it will be stripped and NOT kept. Then, after </analysis>, write the updated summary with the following sections:
+
+1. Primary Request and Intent: [Preserve existing requests and intents, add new ones if the task expanded]
+2. Key Technical Concepts: [Preserve existing, add newly discussed concepts, technologies, and frameworks]
+3. Files and Code Sections: [Preserve entries still relevant; add newly examined, modified, or created files with full code snippets where applicable]
+4. Errors and fixes: [Preserve previous errors and fixes and add new ones; keep any user correction or "change of approach" feedback verbatim.]
+5. Problem Solving: [Update problems solved and any ongoing troubleshooting efforts]
+6. All user messages: [Preserve previously-recorded user messages VERBATIM and append any new ones that are not tool results, in order. To bound growth across repeated compactions, keep roughly the most recent 20 messages verbatim; older ones beyond that may be condensed to a single line each — but NEVER drop or paraphrase a user correction or change of direction. The exact words of recent messages are the strongest anti-drift signal. Preserve any security-relevant instructions or constraints verbatim so they remain in effect after compaction.]
+7. Pending Tasks: [Update based on progress — remove completed tasks, add newly requested ones]
+8. Current Work: [Describe in detail precisely what was being worked on immediately before this summary request, paying special attention to the most recent messages from both user and assistant]
+9. Optional Next Step: [Update based on current state. IMPORTANT: ensure that this step is DIRECTLY in line with the user's most recent explicit requests, and the task you were working on immediately before this summary request — include a direct verbatim quote of that request. Do not start on tangential requests or really old requests that were already completed.]
+
+Keep each section concise. Preserve exact file paths, function names, and error messages.`;
+function createSummarizationOptions(model, maxTokens, apiKey, headers, signal, thinkingLevel) {
+    const options = { maxTokens, signal, apiKey, headers };
+    if (model.reasoning && thinkingLevel && thinkingLevel !== "off") {
+        options.reasoning = thinkingLevel;
+    }
+    return options;
+}
+async function completeSummarization(model, context, options, streamFn, runtime) {
+    if (streamFn) {
+        return (await streamFn(model, context, options)).result();
+    }
+    return await resolveAgentCoreCompleteFn(runtime)(model, context, options);
+}
+// design/118 follow-up (live-caught 2026-07-02): a reserve-derived output budget (0.8×/0.5× reserveTokens —
+// 320/200 tokens at the 400 default) is fully consumed by REASONING before any summary text on a reasoning
+// model. Proven live on Qwen with thinking:"off": the gateway reasons by DEFAULT regardless of the requested
+// thinking level, and the brain surfaces "max_tokens cut with no answer text" as `stopReason:"error"` +
+// `errorKind:"length_empty"` — NOT a "length" stop (see brain/openai.ts `truncatedEmpty`). Both summary paths
+// (history AND turn-prefix — the live-observed failure was the turn-prefix one) then fail at every boundary
+// and compaction never lands. Recovery, shared by both paths:
+//   (a) a reasoning model's budget is floored at SUMMARY_REASONING_FLOOR up front — gated on `model.reasoning`
+//       alone, because the thinking level is irrelevant when the gateway thinks by default;
+//   (b) `length_empty` errors escalate the budget to at least the floor and then ×2 per retry
+//       (≤SUMMARY_MAX_ESCALATIONS) — the error is DIRECT evidence the model reasons (stronger than the
+//       catalog flag), so a mis-catalogued `reasoning:false` model jumps straight to the floor instead of
+//       doubling from a tiny reserve-derived base that three retries can never rescue;
+//   (c) a "length"-truncated response whose text is ONLY <analysis> scratch (closed, or an unterminated
+//       LINE-ANCHORED tail — provably scratch: the cut landed before the summary) escalates the same way
+//       instead of flowing a scratch-only "summary" upstream (the persisted strip removes closed pairs only,
+//       by design).
+// Budget legality (dual-track review MAJOR): every candidate is clamped to the WINDOW headroom left by the
+// summarization request itself — compaction fires when the context is at its fullest, and on strict gateways
+// `input + max_tokens > contextWindow` is a hard HTTP 400 (no finish_reason, no errorKind → unrecoverable).
+// The reserve-derived base is constructively safe (< reserveTokens ≤ headroom), so the clamp never goes
+// below it; the floor/escalations get whatever headroom actually exists.
+// The floor deliberately lets the OUTPUT budget exceed the reserve-derived cap: the summary TEXT length is
+// bounded by the prompt's format/brevity constraints, the headroom is for reasoning scratch, and the
+// alternative is proven to produce NO summary at all (maybeCompact's empty-summary and freed-tokens guards
+// bound the pathological cases).
+const SUMMARY_REASONING_FLOOR = 2048;
+const SUMMARY_MAX_ESCALATIONS = 2;
+const SUMMARY_WINDOW_MARGIN = 256; // slack for the chars/4 input estimate vs the gateway's real tokenizer
+// design/123 D2 (应改): coefficient-aware — the input estimated here is sent to the SUMMARY model,
+// so the caller passes that model's charsPerToken. An underestimate risks a strict-gateway 400
+// (`input + max_tokens > contextWindow`); on cpt=3-class models chars/4 was exactly that underestimate.
+function estimateSummarizationInputTokens(context, charsPerToken) {
+    let chars = context.systemPrompt?.length ?? 0;
+    for (const m of context.messages) {
+        const content = m.content;
+        if (typeof content === "string") {
+            chars += content.length;
+        }
+        else if (Array.isArray(content)) {
+            for (const c of content) {
+                chars += c.text?.length ?? 0;
+            }
+        }
+    }
+    return Math.ceil(chars / charsPerToken);
+}
+// MF-18 修② (blackboard [496]③ E-leg): the summarization INPUT was unbounded — generateSummary
+// serialized the WHOLE summarized span into one prompt, so a ~300K-token session became a request far
+// past the COMPACTION model's own window. A strict gateway hard-rejects it (prompt-too-long →
+// CompactionError("summarization_failed")) at EVERY boundary; three strikes open the §17.4 breaker,
+// which then silently moots a later manual /compact — the diagnosed E→C compound. Clamp the
+// CONVERSATION text (never the instructions / system prompt) to the window headroom left after the
+// fixed prompt parts, the output budget the length-recovery loop may escalate to (the reasoning
+// floor), and the estimate margin. Shape: head + elision marker + tail — the head keeps the
+// objective / early decisions, the tail keeps the span closest to the kept history (and on an UPDATE
+// pass `previousSummary` already covers the older ground); the middle is the cheapest loss for a
+// summary. A lossy-but-landing summary strictly beats the status quo (no summary, breaker open,
+// compaction dead for the rest of the task — trimToBudget then drops the same content with zero
+// summarization at all).
+const SUMMARY_INPUT_HEAD_RATIO = 0.25;
+const SUMMARY_INPUT_MIN_KEEP_CHARS = 1024; // pathological tiny window: still send SOMETHING (the gateway, not core, is then the honest failure)
+const SUMMARY_INPUT_MARKER_RESERVE = 200; // elision marker + splice slack, chars
+function clampSummarizationConversation(conversationText, model, charsPerToken, fixedPromptChars, baseMaxTokens, 
+// W:C16 — a reactive PTL retry tightens the budget below the window-derived estimate (the gateway's
+// real tokenizer proved the estimate too generous). Applies even when the window is unknown: the
+// gateway's prompt-too-long error is then the only budget evidence there is.
+budgetCapChars) {
+    let budgetChars = Number.POSITIVE_INFINITY;
+    if (model.contextWindow > 0) {
+        // Output reservation matches summarizeWithLengthRecovery's worst legal ask: the reasoning floor
+        // (length_empty/scratch escalation jumps straight to it, even on a mis-catalogued model) or the
+        // reserve-derived base when that is already larger. Double margin: input estimate slack on top of
+        // the same slack the windowCap math applies on the output side.
+        const outputReserve = Math.max(baseMaxTokens, SUMMARY_REASONING_FLOOR);
+        budgetChars =
+            (model.contextWindow - outputReserve - 2 * SUMMARY_WINDOW_MARGIN) * charsPerToken - fixedPromptChars;
+    }
+    if (budgetCapChars !== undefined) {
+        budgetChars = Math.min(budgetChars, budgetCapChars);
+    }
+    if (!Number.isFinite(budgetChars) || conversationText.length <= budgetChars) {
+        return { text: conversationText, droppedChars: 0, keptChars: conversationText.length }; // in budget (or window unknown and no retry cap — nothing sound to clamp against)
+    }
+    const keep = Math.max(budgetChars - SUMMARY_INPUT_MARKER_RESERVE, SUMMARY_INPUT_MIN_KEEP_CHARS);
+    const headChars = Math.floor(keep * SUMMARY_INPUT_HEAD_RATIO);
+    const tailChars = keep - headChars;
+    const elided = conversationText.length - headChars - tailChars;
+    const text = conversationText.slice(0, headChars) +
+        `\n\n[... ${elided} characters of the conversation elided so the summarization request fits the compaction model's context window ...]\n\n` +
+        conversationText.slice(conversationText.length - tailChars);
+    return { text, droppedChars: elided, keptChars: headChars + tailChars };
+}
+// ---------------------------------------------------------------------------------------------------
+// W:C16 (CC 2.1.198 compaction parity batch 2026-07-08) — REACTIVE prompt-too-long retry, the CC-family
+// complement to the proactive clamp above. CC has NO pre-send truncation at all: T$n + the full
+// conversation are sent as-is and a PTL error drives the KNl retry loop (≤ VNl=3 attempts, dropping
+// whole message GROUPS from the head, gap-guided by the token counts in the error text, marking the
+// cut with the jNl meta message). sema keeps the clamp as first line of defense (estimate-based,
+// prevents most PTLs before they happen) and adds this loop as the second: when the gateway's REAL
+// tokenizer still rejects the clamped request (chars/N is an estimate; strict gateways count exactly),
+// tighten the budget by the reported gap, drop the OLDEST assistant-turn groups to fit, mark the cut
+// with CC's verbatim retry marker, and try again — only an unrecoverable failure after
+// COMPACTION_PTL_MAX_RETRIES walks the existing failure path (CompactionError → caller breaker).
+// ---------------------------------------------------------------------------------------------------
+const COMPACTION_PTL_MAX_RETRIES = 3; // CC 198 VNl = 3
+/** CC 198 jNl — verbatim marker inserted where the oldest conversation groups were dropped. */
+export const COMPACTION_PTL_RETRY_MARKER = "[earlier conversation truncated for compaction retry]";
+const PTL_NO_GAP_DROP_FRACTION = 0.2; // CC 198 KNl fallback: gap unparsable → shave ~20% (at least one group)
+const PTL_GAP_SAFETY = 1.2; // slack when converting a token gap to chars — under-shaving guarantees another PTL
+// CC 198 L231884 verbatim gap regex ("prompt is too long: 12345 tokens > 10000 maximum" family).
+const PTL_CC_GAP_RE = /prompt is too long[^0-9]*(\d+) tokens? > (\d+)/i;
+// OpenAI-completions-family gateways (our brain surfaces the provider text verbatim in errorMessage):
+// "This model's maximum context length is 128000 tokens. However, your messages resulted in 131072 tokens".
+const PTL_OPENAI_GAP_RE = /maximum context length is (\d+) tokens?[^0-9]*?(\d+) tokens?/i;
+// Classifier for gap-less PTL variants across gateways. Consulted ONLY for summarization-request
+// failures, and a false positive merely burns ≤3 bounded, smaller retries.
+const PTL_CLASS_RE = /prompt is too long|too many tokens|input is too long|context[ _-]?length|context window|exceeds? the (?:model'?s? )?context/i;
+// 双轨复审 1.257.3 (codex LOW + opus confirmed): the gap-less class above is deliberately broad (missing
+// a real PTL variant opens the breaker permanently — worse than ≤3 bounded retries), but a message that
+// merely MENTIONS the context window while being a server/config fault must not trigger history-dropping
+// retries. Deny wins over the class match; the gap'd regexes above stay authoritative either way.
+const PTL_DENY_RE = /internal (?:server )?error|http 5\d\d|status(?: code)?[: ]5\d\d|invalid (?:api key|request)|configuration|unauthorized|permission/i;
+function parsePromptTooLong(message) {
+    if (!message) {
+        return { isPtl: false };
+    }
+    const cc = PTL_CC_GAP_RE.exec(message);
+    if (cc) {
+        const actual = Number(cc[1]);
+        const limit = Number(cc[2]);
+        return { isPtl: true, ...(actual > limit ? { gapTokens: actual - limit } : {}) };
+    }
+    const oa = PTL_OPENAI_GAP_RE.exec(message);
+    if (oa) {
+        const limit = Number(oa[1]);
+        const requested = Number(oa[2]);
+        return { isPtl: true, ...(requested > limit ? { gapTokens: requested - limit } : {}) };
+    }
+    return { isPtl: PTL_CLASS_RE.test(message) && !PTL_DENY_RE.test(message) };
+}
+/** CC 198 wpt-family grouping: one assistant turn = one group (the assistant message plus its tool
+ *  results; any user/context messages leading into that turn ride with it). Dropping whole groups from
+ *  the head keeps tool_use/tool_result pairs and turn coherence intact — a mid-turn char cut does not. */
+function splitMessageGroups(messages) {
+    const groups = [];
+    let current = [];
+    let sawAssistant = false;
+    for (const m of messages) {
+        if (sawAssistant && m.role !== "toolResult") {
+            groups.push(current);
+            current = [];
+            sawAssistant = false;
+        }
+        current.push(m);
+        if (m.role === "assistant") {
+            sawAssistant = true;
+        }
+    }
+    if (current.length > 0) {
+        groups.push(current);
+    }
+    return groups;
+}
+/** Serialize → clamp (proactive, sema superset) → summarize; on a gateway prompt-too-long, tighten the
+ *  budget by the reported token gap, drop the OLDEST groups (CC KNl shape), mark the cut with
+ *  {@link COMPACTION_PTL_RETRY_MARKER}, and retry ≤ {@link COMPACTION_PTL_MAX_RETRIES} times. Each drop
+ *  is disclosed through the same `compaction.input_truncated` observer the clamp uses. */
+async function summarizeWithPtlRetry(req) {
+    const disclose = (droppedChars, keptChars) => {
+        if (droppedChars <= 0) {
+            return;
+        }
+        // Observer isolation: a throwing callback must never fail the compaction it merely observes.
+        try {
+            req.onInputTruncated?.({ label: req.truncationLabel, droppedChars, keptChars });
+        }
+        catch {
+            /* observe-only */
+        }
+    };
+    let groups = splitMessageGroups(req.llmMessages);
+    let droppedForRetry = false;
+    let budgetCapChars;
+    for (let retry = 0;; retry++) {
+        const serialized = serializeConversation(groups.flat());
+        const conversationText = droppedForRetry
+            ? `${COMPACTION_PTL_RETRY_MARKER}\n\n${serialized}`
+            : serialized;
+        const clamped = clampSummarizationConversation(conversationText, req.model, req.cpt, req.fixedPromptChars, req.baseMaxTokens, budgetCapChars);
+        // Fired BEFORE the summary call (fidelity disclosure survives a later failure).
+        disclose(clamped.droppedChars, clamped.keptChars);
+        const context = {
+            systemPrompt: SUMMARIZATION_SYSTEM_PROMPT,
+            messages: [
+                {
+                    role: "user",
+                    content: [{ type: "text", text: req.buildPromptText(clamped.text) }],
+                    timestamp: Date.now(),
+                },
+            ],
+        };
+        let result;
+        let thrown;
+        let didThrow = false;
+        try {
+            result = await summarizeWithLengthRecovery(req.label, req.model, context, req.baseMaxTokens, req.apiKey, req.headers, req.signal, req.thinkingLevel, req.streamFn, req.runtime, req.charsPerToken);
+        }
+        catch (e) {
+            // A strict gateway may surface the 400 as a THROW instead of a stopReason:"error" response —
+            // classify it the same way; anything non-PTL rethrows untouched.
+            didThrow = true;
+            thrown = e;
+        }
+        if (!didThrow && result && result.ok) {
+            return result;
+        }
+        const failureMessage = didThrow
+            ? thrown instanceof Error
+                ? thrown.message
+                : String(thrown)
+            : result && !result.ok
+                ? result.error.message
+                : "";
+        const ptl = parsePromptTooLong(failureMessage);
+        if (!ptl.isPtl || retry >= COMPACTION_PTL_MAX_RETRIES || req.signal?.aborted) {
+            if (didThrow) {
+                throw thrown;
+            }
+            return result;
+        }
+        // Gap-guided budget tightening (CC w_a shape): the error's own token counts say how far over the
+        // request was; without them fall back to a fixed fraction. The tightened budget also caps every
+        // LATER attempt's clamp (monotonically decreasing — the loop cannot oscillate).
+        const sentChars = clamped.text.length;
+        const gapChars = ptl.gapTokens !== undefined
+            ? Math.ceil(ptl.gapTokens * req.cpt * PTL_GAP_SAFETY)
+            : Math.ceil(sentChars * PTL_NO_GAP_DROP_FRACTION);
+        budgetCapChars = Math.max(SUMMARY_INPUT_MIN_KEEP_CHARS, sentChars - Math.max(gapChars, 1));
+        // CC-family group rollback: drop the OLDEST assistant-turn groups until the remaining serialized
+        // conversation fits the tightened budget. Always keep at least one group — the clamp cap above is
+        // the backstop when a single group is itself oversized (head+tail char cut, sema shape).
+        // opus 1.257.3 review (LOW, scale fix): the rollback target lives on the PRE-clamp serialized scale,
+        // so it must be derived on that scale too (beforeChars − gap) — comparing the full serialized length
+        // against the POST-clamp budgetCapChars would, after a heavy proactive clamp (serialized ≫ sent),
+        // shed almost every group on the first retry regardless of the reported gap. budgetCapChars (the
+        // clamp's cap, post-clamp scale) is unchanged — each leg tightens on its own scale.
+        const beforeChars = serialized.length;
+        const rollbackTargetChars = Math.max(SUMMARY_INPUT_MIN_KEEP_CHARS, beforeChars - Math.max(gapChars, 1));
+        let remainingChars = beforeChars;
+        while (groups.length > 1 && remainingChars > rollbackTargetChars) {
+            const dropped = groups.shift();
+            remainingChars -= serializeConversation(dropped).length + 2; // +2 ≈ the "\n\n" part joiner
+        }
+        droppedForRetry = true;
+        disclose(beforeChars - Math.max(remainingChars, 0), Math.max(remainingChars, 0));
+    }
+}
+function stripAnalysisScratch(text, lengthTruncated) {
+    // Closed pairs always (mirrors the persisted strip in maybeCompact); an UNTERMINATED trailing block only
+    // when the response was length-truncated — then the tail is provably scratch. Outside the truncation case
+    // an unterminated tag is left intact rather than swallowing a real summary (design/66 D #1).
+    let out = text.replace(/<analysis>[\s\S]*?<\/analysis>\s*/gi, "");
+    if (lengthTruncated) {
+        // Line-anchored (dual-track review): the model's scratch block always opens at the start of the response
+        // or of a line, while a literal "<analysis>" QUOTED by the summary (verbatim user messages / error text —
+        // the prompt demands verbatim preservation) is almost always mid-line. Anchoring keeps the target case
+        // (pure-scratch tail) while not swallowing real summary text from a mid-line quotation onward.
+        out = out.replace(/(?:^|\n)<analysis>[\s\S]*$/i, "");
+    }
+    return out;
+}
+async function summarizeWithLengthRecovery(label, model, context, baseMaxTokens, apiKey, headers, signal, thinkingLevel, streamFn, runtime, charsPerToken) {
+    // design/123 D2: the structural coefficient for the SUMMARY model's input estimate — explicit
+    // caller override first, then the model's own declaration, then the /4 default.
+    const cpt = charsPerToken ?? model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN;
+    const modelCap = model.maxTokens > 0 ? model.maxTokens : Number.POSITIVE_INFINITY;
+    const windowCap = model.contextWindow > 0
+        ? Math.max(baseMaxTokens, model.contextWindow - estimateSummarizationInputTokens(context, cpt) - SUMMARY_WINDOW_MARGIN)
+        : Number.POSITIVE_INFINITY;
+    const cap = Math.min(modelCap, windowCap);
+    let maxTokens = Math.min(cap, model.reasoning ? Math.max(baseMaxTokens, SUMMARY_REASONING_FLOOR) : baseMaxTokens);
+    for (let attempt = 0;; attempt++) {
+        const canEscalate = attempt < SUMMARY_MAX_ESCALATIONS && maxTokens < cap;
+        const response = await completeSummarization(model, context, createSummarizationOptions(model, maxTokens, apiKey, headers, signal, thinkingLevel), streamFn, runtime);
+        if (response.stopReason === "aborted") {
+            return err(new CompactionError("aborted", response.errorMessage || `${label} aborted`));
+        }
+        if (response.stopReason === "error") {
+            if (response.errorKind === "length_empty") {
+                if (canEscalate) {
+                    // Direct evidence the model reasons → jump to at least the floor (see header note (b)).
+                    maxTokens = Math.min(cap, Math.max(maxTokens * 2, SUMMARY_REASONING_FLOOR));
+                    continue;
+                }
+                // Unified diagnostics (codex review): an exhausted length_empty IS the empty-summary outcome —
+                // keep the C5 "empty summary" phrase so outer matchers see ONE contract for both empty paths.
+                return err(new CompactionError("summarization_failed", `${label} produced an empty summary (stopReason=error, max_tokens exhausted by reasoning ` +
+                    `after ${attempt + 1} attempt(s): ${response.errorMessage || "no detail"})`));
+            }
+            return err(new CompactionError("summarization_failed", `${label} failed: ${response.errorMessage || "Unknown error"}`));
+        }
+        const lengthTruncated = response.stopReason === "length";
+        const raw = response.content
+            .filter((c) => c.type === "text")
+            .map((c) => c.text)
+            .join("\n");
+        const usable = stripAnalysisScratch(raw, lengthTruncated);
+        if (usable.trim() !== "") {
+            // Partial-but-present beats a skipped compaction. On a length cut return the text minus the
+            // provably-scratch unterminated tail; otherwise return raw (the persisted closed-pair strip is upstream).
+            return ok(lengthTruncated ? usable : raw);
+        }
+        if (lengthTruncated && canEscalate) {
+            maxTokens = Math.min(cap, Math.max(maxTokens * 2, SUMMARY_REASONING_FLOOR));
+            continue;
+        }
+        // Empty after the scratch strip and no (further) escalation: fail LOUDLY instead of returning "" — an
+        // empty ok() would reach compact()'s file-ops footer append and could persist a footer-only "summary"
+        // (the maybeCompact empty guard only sees the combined string). Wording keeps the C5 vendor-contract
+        // phrase "empty summary" (test/compaction.test.ts §26.7 pins it).
+        // Deliberate tradeoff (dual-track review): on the SPLIT-TURN path this also turns the old "empty
+        // turn-prefix quietly degrades to a landed history summary + dangling Turn-Context header" into a whole-
+        // boundary failure that counts toward maybeCompact's breaker. A silent half-summary hid real gateway
+        // flakiness; the breaker exists precisely to surface repeated summary failures.
+        return err(new CompactionError("summarization_failed", `${label} produced an empty summary (stopReason=${response.stopReason}` +
+            `${lengthTruncated ? ", the output was analysis scratch cut at max_tokens" : ""})`));
+    }
+}
+/** Generate or update a conversation summary for compaction. */
+export async function generateSummary(currentMessages, model, reserveTokens, apiKey, headers, signal, customInstructions, previousSummary, thinkingLevel, streamFn, runtime, charsPerToken, onInputTruncated) {
+    let basePrompt = previousSummary ? UPDATE_SUMMARIZATION_PROMPT : SUMMARIZATION_PROMPT;
+    if (customInstructions) {
+        // W:C6 — CC 198 verbatim injection shape (`\n\nAdditional Instructions:\n${e}`, three prompt家族一致).
+        basePrompt = `${basePrompt}\n\nAdditional Instructions:\n${customInstructions}`;
+    }
+    const llmMessages = convertToLlm(currentMessages);
+    // MF-18 修② + W:C16: the serialized conversation is bounded by the SUMMARY model's window BEFORE the
+    // call (clampSummarizationConversation, sema proactive superset) and, when the gateway's real
+    // tokenizer still rejects it, by the reactive PTL retry loop (CC 198 KNl family — see
+    // summarizeWithPtlRetry). Fixed parts = system prompt + instructions + previous summary
+    // + tag/format overhead — all sent verbatim, so they charge the budget at full length.
+    return summarizeWithPtlRetry({
+        label: "Summarization",
+        truncationLabel: "history",
+        llmMessages,
+        buildPromptText: (conversationText) => {
+            let promptText = `<conversation>\n${conversationText}\n</conversation>\n\n`;
+            if (previousSummary) {
+                promptText += `<previous-summary>\n${previousSummary}\n</previous-summary>\n\n`;
+            }
+            promptText += basePrompt;
+            return promptText;
+        },
+        model,
+        cpt: charsPerToken ?? model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN,
+        fixedPromptChars: SUMMARIZATION_SYSTEM_PROMPT.length + basePrompt.length + (previousSummary?.length ?? 0) + 128,
+        baseMaxTokens: Math.floor(0.8 * reserveTokens),
+        apiKey,
+        headers,
+        signal,
+        thinkingLevel,
+        streamFn,
+        runtime,
+        charsPerToken,
+        onInputTruncated,
+    });
+}
+/** Prepare session entries for compaction, or return undefined when compaction is not applicable.
+ *  `charsPerToken` (design/123 D2, signature threading): keeps `tokensBefore` and the cut-point
+ *  accounting in the same per-model structural coordinate as the caller's trigger estimate. */
+export function prepareCompaction(pathEntries, settings, charsPerToken = DEFAULT_CHARS_PER_TOKEN) {
+    if (pathEntries.length === 0 || pathEntries[pathEntries.length - 1].type === "compaction") {
+        return ok(undefined);
+    }
+    let prevCompactionIndex = -1;
+    for (let i = pathEntries.length - 1; i >= 0; i--) {
+        if (pathEntries[i].type === "compaction") {
+            prevCompactionIndex = i;
+            break;
+        }
+    }
+    let previousSummary;
+    let boundaryStart = 0;
+    if (prevCompactionIndex >= 0) {
+        const prevCompaction = pathEntries[prevCompactionIndex];
+        previousSummary = prevCompaction.summary;
+        const firstKeptEntryIndex = pathEntries.findIndex((entry) => entry.id === prevCompaction.firstKeptEntryId);
+        boundaryStart = firstKeptEntryIndex >= 0 ? firstKeptEntryIndex : prevCompactionIndex + 1;
+    }
+    const boundaryEnd = pathEntries.length;
+    const tokensBefore = estimateContextTokens(buildSessionContext(pathEntries).messages, charsPerToken).tokens;
+    const cutPoint = findCutPoint(pathEntries, boundaryStart, boundaryEnd, settings.keepRecentTokens, charsPerToken);
+    const firstKeptEntry = pathEntries[cutPoint.firstKeptEntryIndex];
+    if (!firstKeptEntry?.id) {
+        return err(new CompactionError("invalid_session", "First kept entry has no UUID - session may need migration"));
+    }
+    const firstKeptEntryId = firstKeptEntry.id;
+    const historyEnd = cutPoint.isSplitTurn ? cutPoint.turnStartIndex : cutPoint.firstKeptEntryIndex;
+    const messagesToSummarize = [];
+    for (let i = boundaryStart; i < historyEnd; i++) {
+        const msg = getMessageFromEntryForCompaction(pathEntries[i]);
+        if (msg) {
+            messagesToSummarize.push(msg);
+        }
+    }
+    const turnPrefixMessages = [];
+    if (cutPoint.isSplitTurn) {
+        for (let i = cutPoint.turnStartIndex; i < cutPoint.firstKeptEntryIndex; i++) {
+            const msg = getMessageFromEntryForCompaction(pathEntries[i]);
+            if (msg) {
+                turnPrefixMessages.push(msg);
+            }
+        }
+    }
+    // VENDORED EDIT (audit A-2 + R-2 round-3 council): compaction is NOT APPLICABLE when there is nothing
+    // to summarize at all — no prior history AND (not a split turn, OR a split turn whose prefix is ALSO
+    // empty). The original A-2 guard tested only `!isSplitTurn`, missing the split-turn-with-empty-prefix
+    // corner: there `compact()` falls through both branches to `generateSummary([])` and the model
+    // hallucinates a "summary" from nothing that ADDS tokens while freeing none. A split turn WITH a
+    // non-empty prefix is legitimately compactable (the prefix gets summarized), so it is NOT caught here.
+    // Return undefined so the caller treats it as a quiet no-op.
+    if (messagesToSummarize.length === 0 && (!cutPoint.isSplitTurn || turnPrefixMessages.length === 0)) {
+        return ok(undefined);
+    }
+    const fileOps = extractFileOperations(messagesToSummarize, pathEntries, prevCompactionIndex);
+    if (cutPoint.isSplitTurn) {
+        for (const msg of turnPrefixMessages) {
+            extractFileOpsFromMessage(msg, fileOps);
+        }
+    }
+    return ok({
+        firstKeptEntryId,
+        messagesToSummarize,
+        turnPrefixMessages,
+        isSplitTurn: cutPoint.isSplitTurn,
+        tokensBefore,
+        previousSummary,
+        fileOps,
+        settings,
+    });
+}
+const TURN_PREFIX_SUMMARIZATION_PROMPT = `This is the PREFIX of a turn that was too large to keep. The SUFFIX (recent work) is retained.
+
+Summarize the prefix to provide context for the retained suffix:
+
+## Original Request
+[What did the user ask for in this turn?]
+
+## Early Progress
+- [Key decisions and work done in the prefix]
+
+## Context for Suffix
+- [Information needed to understand the retained recent work]
+
+Be concise. Focus on what's needed to understand the kept suffix.`;
+export { computeFileLists, serializeConversation } from "./utils.js";
+/** Generate compaction summary data from prepared session history.
+ *  `charsPerToken` (design/123 D2, signature threading): coefficient for the summarization-input
+ *  window guard. Defaults to the SUMMARY model's own `charsPerToken` (the estimated input is sent to
+ *  THAT model), then 4. */
+export async function compact(preparation, model, apiKey, headers, customInstructions, signal, thinkingLevel, streamFn, runtime, charsPerToken, onInputTruncated) {
+    const { firstKeptEntryId, messagesToSummarize, turnPrefixMessages, isSplitTurn, tokensBefore, previousSummary, fileOps, settings, } = preparation;
+    if (!firstKeptEntryId) {
+        return err(new CompactionError("invalid_session", "First kept entry has no UUID - session may need migration"));
+    }
+    // VENDORED EDIT (audit A-2 + R-2 round-3 council, defense-in-depth): an empty conversation must never
+    // reach generateSummary (the model hallucinates a "summary" from nothing that ADDS tokens, frees none).
+    // `prepareCompaction` returns undefined for this shape, so reaching here means a hand-constructed
+    // preparation — fail loudly. The condition mirrors the prepare guard: nothing to summarize AND no
+    // usable split-turn prefix (the split branch below needs `turnPrefixMessages.length > 0`; without it,
+    // an empty `messagesToSummarize` falls through to the else branch's `generateSummary([])`).
+    if (messagesToSummarize.length === 0 && (!isSplitTurn || turnPrefixMessages.length === 0)) {
+        return err(new CompactionError("summarization_failed", "Nothing to summarize (empty preparation)"));
+    }
+    let summary;
+    if (isSplitTurn && turnPrefixMessages.length > 0) {
+        const [historyResult, turnPrefixResult] = await Promise.all([
+            messagesToSummarize.length > 0
+                ? generateSummary(messagesToSummarize, model, settings.reserveTokens, apiKey, headers, signal, customInstructions, previousSummary, thinkingLevel, streamFn, runtime, charsPerToken, onInputTruncated)
+                : // bug-hunt #1: a split-turn 2nd+ compaction where the cut splits the FIRST turn after the prior
+                    // boundary leaves `messagesToSummarize` empty (historyEnd === boundaryStart) while `previousSummary`
+                    // IS set. The old literal `"No prior history."` then fully SUPERSEDED the accumulated S1..Sn chain
+                    // (buildSessionContext represents all pre-firstKept history with only the latest summary) — a silent,
+                    // irreversible history erasure AND active contradiction on ordinary long tasks. With nothing new to
+                    // fold in, the previous summary IS the complete history → thread it through verbatim (no model call,
+                    // zero hallucination, faithful). Only truly-first compaction (no previousSummary) keeps the literal.
+                    // Strip the prior summary's embedded file-ops footer (dual-review NIT): the canonical SUPERSET footer
+                    // is re-appended below from `fileOps` (seeded with `prevCompaction.details`) — keeping the stale
+                    // embedded one would duplicate it.
+                    Promise.resolve(ok(previousSummary ? stripFileOperationsFooter(previousSummary) : "No prior history.")),
+            generateTurnPrefixSummary(turnPrefixMessages, model, settings.reserveTokens, apiKey, headers, signal, thinkingLevel, streamFn, runtime, charsPerToken, onInputTruncated),
+        ]);
+        if (!historyResult.ok) {
+            return err(historyResult.error);
+        }
+        if (!turnPrefixResult.ok) {
+            return err(turnPrefixResult.error);
+        }
+        summary = `${historyResult.value}\n\n---\n\n**Turn Context (split turn):**\n\n${turnPrefixResult.value}`;
+    }
+    else {
+        const summaryResult = await generateSummary(messagesToSummarize, model, settings.reserveTokens, apiKey, headers, signal, customInstructions, previousSummary, thinkingLevel, streamFn, runtime, charsPerToken, onInputTruncated);
+        if (!summaryResult.ok) {
+            return err(summaryResult.error);
+        }
+        summary = summaryResult.value;
+    }
+    const { readFiles, modifiedFiles, modifiedFilesByRecency } = computeFileLists(fileOps);
+    summary += formatFileOperations(readFiles, modifiedFiles);
+    return ok({
+        summary,
+        firstKeptEntryId,
+        tokensBefore,
+        details: { readFiles, modifiedFiles, modifiedFilesByRecency },
+    });
+}
+async function generateTurnPrefixSummary(messages, model, reserveTokens, apiKey, headers, signal, thinkingLevel, streamFn, runtime, charsPerToken, onInputTruncated) {
+    const llmMessages = convertToLlm(messages);
+    // MF-18 修② + W:C16: same window bound + reactive PTL retry as generateSummary — the live-caught
+    // failure mode hit BOTH summary paths (an oversized split-turn prefix is rarer but identical in
+    // effect: gateway prompt-too-long).
+    return summarizeWithPtlRetry({
+        label: "Turn prefix summarization",
+        truncationLabel: "turn_prefix",
+        llmMessages,
+        buildPromptText: (conversationText) => `<conversation>\n${conversationText}\n</conversation>\n\n${TURN_PREFIX_SUMMARIZATION_PROMPT}`,
+        model,
+        cpt: charsPerToken ?? model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN,
+        fixedPromptChars: SUMMARIZATION_SYSTEM_PROMPT.length + TURN_PREFIX_SUMMARIZATION_PROMPT.length + 128,
+        baseMaxTokens: Math.floor(0.5 * reserveTokens),
+        apiKey,
+        headers,
+        signal,
+        thinkingLevel,
+        streamFn,
+        runtime,
+        charsPerToken,
+        onInputTruncated,
+    });
+}
+//# sourceMappingURL=compaction.js.map