@vantran-se/openchamber-web 1.22.1 → 1.23.0

package/server/lib/relay/tunnel-host.js

@@ -15,7 +15,6 @@ import {
   createFragmentAssembler,
   decodeJsonPayload,
   decodeTunnelFrame,
-  encodeFragmentedMessage,
   encodeJsonPayload,
   encodeTunnelFrame,
 } from './tunnel-codec.js';
@@ -33,7 +32,9 @@ const ALLOWED_WS_PATHS = new Set([
   '/api/event/ws',
   '/api/terminal/ws',
   '/api/dictation/ws',
+  '/api/dev-tunnel',
 ]);
+export const isAllowedRelayWebSocketPath = (pathname) => ALLOWED_WS_PATHS.has(pathname);
 
 // Hop-by-hop headers stripped from tunneled requests; `host` is set by fetch
 // to the loopback origin. content-length is dropped too because the body is
@@ -72,6 +73,11 @@ const BODY_BUFFER_MAX_BYTES = 512 * 1024;
 // completes, so a stalled tunnel converts into an ambiguous transport failure
 // (which the client already retries) instead of a hung loopback request.
 const BODY_DELIVERY_TIMEOUT_MS = 15_000;
+const MAX_PENDING_WS_BYTES = 16 * 1024 * 1024;
+const MAX_PENDING_WS_MESSAGES = 1024;
+// Node ws supports read backpressure. Bun's ws shim does not implement pause;
+// there the bounded queue fails the affected substream explicitly on overflow.
+const CAN_PAUSE_WS_READS = !process.versions.bun;
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
@@ -97,13 +103,17 @@ const isWsClosePayload = (parsed) => Boolean(parsed && typeof parsed === 'object
  *   sendFrame: (plaintextFrame: Uint8Array) => void | Promise<void>,
  *   getBufferedAmount: () => number,
  *   bodyDeliveryTimeoutMs?: number,
+ *   responseChunkBytes?: number,
+ *   cancelPendingFrames?: (streamId: number) => void,
  * }} deps
  */
-export const createTunnelHost = ({ connectionId, getLocalPort, sendFrame, getBufferedAmount, bodyDeliveryTimeoutMs = BODY_DELIVERY_TIMEOUT_MS }) => {
+export const createTunnelHost = ({ connectionId, getLocalPort, sendFrame, getBufferedAmount, bodyDeliveryTimeoutMs = BODY_DELIVERY_TIMEOUT_MS, responseChunkBytes = MAX_TUNNEL_PAYLOAD_BYTES, cancelPendingFrames = () => {} }) => {
   /** @type {Map<number, { kind: 'http', abort: AbortController, body: { enqueue(payload: Uint8Array): void, close(): void, error(error: Error): void } | null, noBody: boolean } | { kind: 'ws', socket: WebSocket, opened: boolean }>} */
   const streams = new Map();
   const assembler = createFragmentAssembler();
   let closed = false;
+  let pendingWsBytes = 0;
+  let pendingWsMessages = 0;
 
   const send = async (frame) => {
     if (closed) return;
@@ -126,6 +136,7 @@ export const createTunnelHost = ({ connectionId, getLocalPort, sendFrame, getBuf
     const stream = streams.get(streamId);
     if (!stream) return;
     dropStream(streamId);
+    cancelPendingFrames(streamId);
     if (stream.kind === 'http') {
       try {
         stream.body?.error(new Error(String(reason ?? 'aborted')));
@@ -203,17 +214,27 @@ export const createTunnelHost = ({ connectionId, getLocalPort, sendFrame, getBuf
       if (STRIPPED_RESPONSE_HEADERS.has(name)) continue;
       responseHeaders[name] = value;
     }
-    await sendJson(TunnelFrameType.HttpResponse, streamId, { status: response.status, headers: responseHeaders });
+    if (closed || stream.abort.signal.aborted) {
+      await response.body?.cancel();
+      return;
+    }
 
     try {
+      await sendJson(TunnelFrameType.HttpResponse, streamId, { status: response.status, headers: responseHeaders });
       if (response.body) {
         for await (const chunk of response.body) {
           if (closed || stream.abort.signal.aborted) return;
           const bytes = chunk instanceof Uint8Array ? chunk : new Uint8Array(chunk);
-          for (const piece of chunkPayload(bytes, MAX_TUNNEL_PAYLOAD_BYTES)) {
+          const pieces = chunkPayload(bytes, responseChunkBytes);
+          // Offer at most one plaintext-frame budget at a time. The scheduler
+          // can batch small slices and interleave streams without buffering the
+          // entire source or encrypting hundreds of tiny messages separately.
+          const groupSize = Math.max(1, Math.floor(MAX_TUNNEL_PAYLOAD_BYTES / responseChunkBytes));
+          for (let offset = 0; offset < pieces.length; offset += groupSize) {
             await waitForBackpressure(stream.abort.signal);
             if (closed || stream.abort.signal.aborted) return;
-            await send(encodeTunnelFrame(TunnelFrameType.HttpBody, streamId, piece));
+            await Promise.all(pieces.slice(offset, offset + groupSize).map(piece =>
+              send(encodeTunnelFrame(TunnelFrameType.HttpBody, streamId, piece))));
           }
         }
       }
@@ -425,7 +446,7 @@ export const createTunnelHost = ({ connectionId, getLocalPort, sendFrame, getBuf
       void sendAbort(streamId, error?.message ?? 'malformed ws open');
       return;
     }
-    if (!ALLOWED_WS_PATHS.has(open.path)) {
+    if (!isAllowedRelayWebSocketPath(open.path)) {
       void sendAbort(streamId, 'Path is not allowed through the relay');
       return;
     }
@@ -446,6 +467,7 @@ export const createTunnelHost = ({ connectionId, getLocalPort, sendFrame, getBuf
     try {
       socket = new WebSocket(url, open.protocols, {
         headers: dialHeaders,
+        maxPayload: MAX_PENDING_WS_BYTES,
       });
     } catch (error) {
       void sendAbort(streamId, error?.message ?? 'ws dial failed');
@@ -453,6 +475,8 @@ export const createTunnelHost = ({ connectionId, getLocalPort, sendFrame, getBuf
     }
     const stream = { kind: 'ws', socket, opened: false };
     streams.set(streamId, stream);
+    let outputChain = Promise.resolve();
+    let socketPendingMessages = 0;
 
     socket.on('open', () => {
       if (streams.get(streamId) !== stream) return;
@@ -463,23 +487,47 @@ export const createTunnelHost = ({ connectionId, getLocalPort, sendFrame, getBuf
       if (streams.get(streamId) !== stream || closed) return;
       const bytes = Buffer.isBuffer(data) ? new Uint8Array(data) : new Uint8Array(Buffer.concat(data));
       const frameType = isBinary ? TunnelFrameType.WsBinary : TunnelFrameType.WsText;
-      void (async () => {
-        for (const frame of encodeFragmentedMessage(frameType, streamId, bytes)) {
+      if (pendingWsBytes + bytes.length > MAX_PENDING_WS_BYTES || pendingWsMessages >= MAX_PENDING_WS_MESSAGES) {
+        abortLocalStream(streamId, 'upstream WebSocket exceeded downstream queue limit');
+        void sendAbort(streamId, 'upstream WebSocket exceeded downstream queue limit');
+        return;
+      }
+      pendingWsBytes += bytes.length;
+      pendingWsMessages += 1;
+      socketPendingMessages += 1;
+      if (CAN_PAUSE_WS_READS) socket.pause();
+      outputChain = outputChain.then(async () => {
+        // Serialize entire messages, including their fragments. A later close
+        // must also wait here or it can overtake the final output.
+        const chunks = chunkPayload(bytes, responseChunkBytes);
+        const groupSize = Math.max(1, Math.floor(MAX_TUNNEL_PAYLOAD_BYTES / responseChunkBytes));
+        for (let offset = 0; offset < chunks.length; offset += groupSize) {
           await waitForBackpressure(null);
           if (streams.get(streamId) !== stream || closed) return;
-          await send(frame);
+          await Promise.all(chunks.slice(offset, offset + groupSize).map((chunk, index) =>
+            send(encodeTunnelFrame(frameType, streamId, chunk, offset + index < chunks.length - 1))));
         }
-      })();
+      }).catch(() => {
+        abortLocalStream(streamId, 'upstream WebSocket forwarding failed');
+        void sendAbort(streamId, 'upstream WebSocket forwarding failed');
+      }).finally(() => {
+        pendingWsBytes -= bytes.length;
+        pendingWsMessages -= 1;
+        socketPendingMessages -= 1;
+        if (CAN_PAUSE_WS_READS && socketPendingMessages === 0 && streams.get(streamId) === stream && socket.readyState === WebSocket.OPEN) socket.resume();
+      });
     });
     socket.on('close', (code, reasonBuffer) => {
-      if (streams.get(streamId) !== stream) return;
-      dropStream(streamId);
-      const reason = reasonBuffer ? reasonBuffer.toString('utf8') : '';
-      if (stream.opened) {
-        void sendJson(TunnelFrameType.WsClose, streamId, { code: code || 1000, reason });
-      } else {
-        void sendAbort(streamId, reason || `upstream ws closed (${code || 'no code'})`);
-      }
+      void outputChain.then(async () => {
+        if (streams.get(streamId) !== stream) return;
+        dropStream(streamId);
+        const reason = reasonBuffer ? reasonBuffer.toString('utf8') : '';
+        if (stream.opened) {
+          await sendJson(TunnelFrameType.WsClose, streamId, { code: code || 1000, reason });
+        } else {
+          await sendAbort(streamId, reason || `upstream ws closed (${code || 'no code'})`);
+        }
+      });
     });
     socket.on('error', (error) => {
       if (streams.get(streamId) !== stream) return;
@@ -510,6 +558,7 @@ export const createTunnelHost = ({ connectionId, getLocalPort, sendFrame, getBuf
     const stream = streams.get(streamId);
     if (!stream || stream.kind !== 'ws') return;
     dropStream(streamId);
+    cancelPendingFrames(streamId);
     let close = { code: 1000, reason: '' };
     try {
       close = decodeJsonPayload(payload, isWsClosePayload);
@@ -518,6 +567,8 @@ export const createTunnelHost = ({ connectionId, getLocalPort, sendFrame, getBuf
     }
     const code = Number.isInteger(close.code) && close.code >= 1000 && close.code <= 4999 ? close.code : 1000;
     try {
+      // A paused receiver still needs to read the peer's close handshake.
+      if (CAN_PAUSE_WS_READS) stream.socket.resume();
       stream.socket.close(code, typeof close.reason === 'string' ? close.reason : '');
     } catch {
       stream.socket.terminate();

package/server/lib/relay/tunnel-host.test.js

@@ -1,7 +1,7 @@
 import { describe, test, expect } from 'bun:test';
 import http from 'node:http';
 
-import { createTunnelHost } from './tunnel-host.js';
+import { createTunnelHost, isAllowedRelayWebSocketPath } from './tunnel-host.js';
 import { decodeTunnelFrame, encodeTunnelFrame, encodeJsonPayload, TunnelFrameType } from './tunnel-codec.js';
 
 const startLoopback = () =>
@@ -145,3 +145,11 @@ describe('tunnel-host HTTP body forwarding', () => {
     await loopback.stop();
   });
 });
+
+describe('relay host WebSocket allowlist', () => {
+  test('allows only the exact dev-server tunnel path', () => {
+    expect(isAllowedRelayWebSocketPath('/api/dev-tunnel')).toBe(true);
+    expect(isAllowedRelayWebSocketPath('/api/dev-tunnel/')).toBe(false);
+    expect(isAllowedRelayWebSocketPath('/api/database/ws')).toBe(false);
+  });
+});

package/server/lib/security/request-security.js

@@ -67,6 +67,7 @@ export const createRequestSecurityRuntime = (deps) => {
 
   const getRequestOriginCandidates = async (req) => {
     const origins = new Set();
+    const hosts = new Set();
     const forwardedProto = typeof req.headers['x-forwarded-proto'] === 'string'
       ? req.headers['x-forwarded-proto'].split(',')[0].trim().toLowerCase()
       : '';
@@ -78,6 +79,7 @@ export const createRequestSecurityRuntime = (deps) => {
     const host = forwardedHost || (typeof req.headers.host === 'string' ? req.headers.host.trim() : '');
 
     if (host) {
+      hosts.add(host.toLowerCase());
       origins.add(`${protocol}://${host}`);
       const [hostname, port] = host.split(':');
       const normalizedHost = typeof hostname === 'string' ? hostname.toLowerCase() : '';
@@ -98,10 +100,10 @@ export const createRequestSecurityRuntime = (deps) => {
     } catch {
     }
 
-    return origins;
+    return { origins, hosts };
   };
 
-  const isRequestOriginAllowed = async (req) => {
+  const isRequestOriginAllowed = (req) => {
     const originHeader = typeof req.headers.origin === 'string' ? req.headers.origin.trim() : '';
     if (!originHeader) {
       return false;
@@ -111,15 +113,28 @@ export const createRequestSecurityRuntime = (deps) => {
       return true;
     }
 
-    let normalizedOrigin = '';
+    let origin;
     try {
-      normalizedOrigin = new URL(originHeader).origin;
+      origin = new URL(originHeader);
     } catch {
       return false;
     }
 
-    const allowedOrigins = await getRequestOriginCandidates(req);
-    return allowedOrigins.has(normalizedOrigin);
+    const forwardedHostHeader = req.headers['x-forwarded-host'];
+    const forwardedHost = (Array.isArray(forwardedHostHeader) ? forwardedHostHeader[0] : forwardedHostHeader || '')
+      .split(',')[0].trim().toLowerCase();
+    const hostHeader = req.headers.host;
+    const host = forwardedHost || (Array.isArray(hostHeader) ? hostHeader[0] : hostHeader || '').trim().toLowerCase();
+    if (host && host === origin.host.toLowerCase()) return true;
+
+    // TLS commonly ends at a cloud edge before an HTTP hop to OpenChamber.
+    // In that setup the browser's Origin is https while a generic reverse
+    // proxy reports the upstream request as http. The external host remains
+    // authoritative, so compare it directly instead of requiring the proxy to
+    // preserve the browser-facing protocol.
+    return getRequestOriginCandidates(req).then((candidates) => (
+      candidates.origins.has(origin.origin) || candidates.hosts.has(origin.host.toLowerCase())
+    ));
   };
 
   return {

package/server/lib/security/request-security.test.js

@@ -9,41 +9,75 @@ describe('request security runtime', () => {
   test('allows packaged client origins for remote client transports', async () => {
     const runtime = createRuntime();
 
-    await expect(runtime.isRequestOriginAllowed({
+    expect(await runtime.isRequestOriginAllowed({
       headers: {
         origin: 'openchamber-ui://app',
         host: '192.168.1.130:1202',
       },
       socket: {},
-    })).resolves.toBe(true);
+    })).toBe(true);
 
-    await expect(runtime.isRequestOriginAllowed({
+    expect(await runtime.isRequestOriginAllowed({
       headers: {
         origin: 'capacitor://localhost',
         host: '192.168.1.130:1202',
       },
       socket: {},
-    })).resolves.toBe(true);
+    })).toBe(true);
 
     // Android Capacitor WebView (androidScheme 'https') reports this origin.
-    await expect(runtime.isRequestOriginAllowed({
+    expect(await runtime.isRequestOriginAllowed({
       headers: {
         origin: 'https://localhost',
         host: '192.168.1.130:1202',
       },
       socket: {},
-    })).resolves.toBe(true);
+    })).toBe(true);
   });
 
   test('rejects unknown origins', async () => {
     const runtime = createRuntime();
 
-    await expect(runtime.isRequestOriginAllowed({
+    expect(await runtime.isRequestOriginAllowed({
       headers: {
         origin: 'https://evil.example.com',
         host: '192.168.1.130:1202',
       },
       socket: {},
-    })).resolves.toBe(false);
+    })).toBe(false);
+  });
+
+  test('allows the external host when TLS terminates before an HTTP proxy hop', async () => {
+    const runtime = createRuntime();
+
+    expect(await runtime.isRequestOriginAllowed({
+      headers: {
+        origin: 'https://devchamber.example.com',
+        host: 'devchamber.example.com',
+        'x-forwarded-proto': 'http',
+      },
+      socket: {},
+    })).toBe(true);
+  });
+
+  test('uses the forwarded external host without trusting a different origin', async () => {
+    const runtime = createRuntime();
+    const request = {
+      headers: {
+        host: '127.0.0.1:3000',
+        'x-forwarded-host': 'devchamber.example.com',
+        'x-forwarded-proto': 'http',
+      },
+      socket: {},
+    };
+
+    expect(await runtime.isRequestOriginAllowed({
+      ...request,
+      headers: { ...request.headers, origin: 'https://devchamber.example.com' },
+    })).toBe(true);
+    expect(await runtime.isRequestOriginAllowed({
+      ...request,
+      headers: { ...request.headers, origin: 'https://evil.example.com' },
+    })).toBe(false);
   });
 });

package/server/lib/session-assist/runtime.js

@@ -11,6 +11,7 @@
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
+import { readMergedSettingsSync } from '../opencode/settings-files.js';
 
 const OPENCHAMBER_SETTINGS_FILE = path.join(
   process.env.OPENCHAMBER_DATA_DIR
@@ -23,16 +24,11 @@ const OPENCHAMBER_SETTINGS_FILE = path.join(
 // off, no small-model calls and no metadata writes happen at all. Existing
 // payloads stay untouched — clients keep showing them and dismissal still works.
 const getSessionAssistTargets = () => {
-  try {
-    const raw = fs.readFileSync(OPENCHAMBER_SETTINGS_FILE, 'utf8');
-    const settings = JSON.parse(raw);
-    return {
-      recap: settings?.sessionRecapEnabled !== false,
-      suggestion: settings?.sessionSuggestionEnabled !== false,
-    };
-  } catch {
-    return { recap: true, suggestion: true };
-  }
+  const settings = readMergedSettingsSync({ fs, path, settingsFilePath: OPENCHAMBER_SETTINGS_FILE });
+  return {
+    recap: settings.sessionRecapEnabled !== false,
+    suggestion: settings.sessionSuggestionEnabled !== false,
+  };
 };
 
 const IDLE_QUIET_MS = 60_000;
@@ -257,6 +253,7 @@ export const createSessionAssistRuntime = ({
         prompt: `The latest exchange in the conversation:\n\n${transcript}\n\nWrite ${requestedFields} in the SAME language as this sample from the conversation: "${languageSample}"`,
         system: buildAssistSystemPrompt(targets),
         directory,
+        sessionID: sessionId,
         preferredProviderID: typeof lastAssistantInfo.providerID === 'string' ? lastAssistantInfo.providerID : undefined,
         preferredModelID: typeof lastAssistantInfo.modelID === 'string' ? lastAssistantInfo.modelID : undefined,
       });

package/server/lib/session-goal/DOCUMENTATION.md

@@ -108,13 +108,26 @@ before touching the filesystem). Rationale: metadata rides every
      stop), with a tick-side safety net. Messages sent while paused leave
      the goal alone; Resume re-arms the loop, and resuming over an aborted
      tail skips the audit and goes straight to a continuation nudge;
-   - terminal checks, cheapest first: assistant turn error → `blocked`;
-     `tokensUsed >= tokenBudget` → `budgetLimited`;
-     `turnsUsed >= MAX_AUTO_TURNS` (20) → `blocked`;
-   - if the latest message is a compaction summary, skip the audit and
-     continue unconditionally — running into the context window mid-work is
-     by definition "in progress, not finished" (the summary is a retelling,
-     not evidence, and must not be judged);
+    - terminal checks, cheapest first: assistant turn error → `blocked`;
+      `tokensUsed >= tokenBudget` → `budgetLimited`;
+      `turnsUsed >= MAX_AUTO_TURNS` (20) → `blocked`;
+    - error classification is independent of `finish`: `MessageAbortedError`
+      keeps the pause/resume behavior; only a `finish: "length"` with no
+      error, or `MessageOutputLengthError`, is an in-progress truncation that
+      skips the audit and continues. Any other non-null error wins over a
+      length finish and blocks with its non-empty `error.name`, or
+      `assistant turn failed` when unnamed;
+    - length recovery is bounded separately from the token budget and
+      auto-continuation cap: the first truncation permits one continuation, but
+      a second consecutive completed, non-summary assistant turn that is also
+      truncated settles the goal as `blocked` (`repeated output truncation`).
+      The consecutive state is derived from the loaded message history, not
+      persisted, using `info.time.created` chronology rather than message IDs.
+      Summary messages are not agent turns; an ordinary completed assistant
+      turn naturally breaks the consecutive condition. Explicit Resume grants
+      one new recovery attempt over the same transcript; the continuation
+      consumes that permission, so another truncation blocks again. Resume
+      does not bypass assistant errors or the token budget;
    - otherwise, small-model audit of the objective + the last assistant turn
      only — no conversation history and no continuation prompts
      (`restrictToPreferredProvider`, session's own provider/model preferred):

package/server/lib/session-goal/create.js

@@ -14,7 +14,7 @@ export const buildGoalIntroText = (tokenBudget) => {
     + '\n</system-reminder>';
 };
 
-const fitObjective = async ({ objective, directory, providerID, modelID, warn }) => {
+const fitObjective = async ({ objective, directory, sessionID, providerID, modelID, warn }) => {
   if (objective.length <= GOAL_OBJECTIVE_CHAR_LIMIT) return objective;
 
   let distilled = null;
@@ -32,6 +32,7 @@ const fitObjective = async ({ objective, directory, providerID, modelID, warn })
         'Write in the same language as the task text.',
       ].join('\n'),
       directory,
+      sessionID,
       preferredProviderID: providerID,
       preferredModelID: modelID,
     });
@@ -66,6 +67,7 @@ export const createSessionGoal = async ({
   const objectiveText = await fitObjective({
     objective: String(objective ?? '').trim(),
     directory,
+    sessionID,
     providerID,
     modelID,
     warn,

package/server/lib/session-goal/runtime.js

@@ -19,6 +19,7 @@ import os from 'os';
 import path from 'path';
 
 import { GOAL_OBJECTIVE_CHAR_LIMIT, readObjective } from './objectives.js';
+import { readMergedSettingsSync } from '../opencode/settings-files.js';
 
 const OPENCHAMBER_SETTINGS_FILE = path.join(
   process.env.OPENCHAMBER_DATA_DIR
@@ -27,15 +28,9 @@ const OPENCHAMBER_SETTINGS_FILE = path.join(
   'settings.json',
 );
 
-const isSessionGoalEnabled = () => {
-  try {
-    const raw = fs.readFileSync(OPENCHAMBER_SETTINGS_FILE, 'utf8');
-    const settings = JSON.parse(raw);
-    return settings?.sessionGoalEnabled !== false;
-  } catch {
-    return true;
-  }
-};
+const isSessionGoalEnabled = () => (
+  readMergedSettingsSync({ fs, path, settingsFilePath: OPENCHAMBER_SETTINGS_FILE }).sessionGoalEnabled !== false
+);
 
 const IDLE_QUIET_MS = 15_000;
 // A goal set while the session is already idle should kick off promptly.
@@ -244,6 +239,57 @@ const messageTokenTotal = (info) => {
   return input + cachedRead + output;
 };
 
+const getErrorName = (error) => error?.name?.trim?.() ?? '';
+
+const isLengthTruncated = (info, errorName = getErrorName(info?.error)) => {
+  const error = info?.error;
+  const hasError = error !== null && error !== undefined;
+  return errorName === 'MessageOutputLengthError' || (!hasError && info?.finish === 'length');
+};
+
+// Summary messages are assistant-shaped, but they are compaction turns rather
+// than agent turns. They must not break or satisfy the consecutive truncation
+// check; only completed, non-summary assistant turns participate. Chronology
+// comes from `time.created`, never from message IDs; array position is only a
+// tie-breaker for equal timestamps.
+const hasRepeatedLengthTail = (messages, latestAssistant, goalCreatedAt) => {
+  const latestInfo = latestAssistant?.info;
+  if (latestInfo?.summary === true) return false;
+  const latestIndex = messages.indexOf(latestAssistant);
+  const latestCreated = latestInfo?.time?.created;
+  if (
+    latestIndex < 0
+    || !(latestInfo?.time?.completed > 0)
+    || !(Number.isFinite(latestCreated) && latestCreated > 0)
+    || !isLengthTruncated(latestInfo)
+  ) return false;
+
+  let previous = null;
+  for (let i = 0; i < messages.length; i += 1) {
+    const info = messages[i]?.info;
+    if (info?.role !== 'assistant' || info.summary === true || !(info.time?.completed > 0)) continue;
+    const created = info.time?.created;
+    // An unknown timestamp cannot safely participate in chronology. Ignore it
+    // rather than letting an unrelated older message hide known chronology.
+    if (!(Number.isFinite(created) && created > 0)) continue;
+    if (i === latestIndex) continue;
+    if (created > latestCreated || (created === latestCreated && i > latestIndex)) continue;
+    if (
+      !previous
+      || created > previous.created
+      || (created === previous.created && i > previous.index)
+    ) {
+      previous = { info, created, index: i };
+    }
+  }
+
+  return Boolean(
+    previous
+    && previous.created > goalCreatedAt
+    && isLengthTruncated(previous.info),
+  );
+};
+
 export const createSessionGoalRuntime = ({
   buildOpenCodeUrl,
   getOpenCodeAuthHeaders,
@@ -378,6 +424,7 @@ export const createSessionGoalRuntime = ({
         prompt: `The goal objective:\n\n<objective>\n${goal.objective}\n</objective>\n\nThe agent's latest turn:\n\n${assistantText}\n\nReturn the verdict JSON. Write the note in the SAME language as this sample from the objective: "${goal.objective.slice(0, 200).replace(/\s+/g, ' ').trim()}"`,
         system: buildAuditSystemPrompt(),
         directory,
+        sessionID: typeof lastAssistantInfo?.sessionID === 'string' ? lastAssistantInfo.sessionID : undefined,
         preferredProviderID: typeof lastAssistantInfo?.providerID === 'string' ? lastAssistantInfo.providerID : undefined,
         preferredModelID: typeof lastAssistantInfo?.modelID === 'string' ? lastAssistantInfo.modelID : undefined,
       });
@@ -608,7 +655,11 @@ export const createSessionGoalRuntime = ({
     // resumed over an aborted tail: that is an explicit "keep going", so it
     // falls through to the continuation below (skipping the audit — an
     // aborted reply is not evidence of anything).
-    const abortedTail = lastAssistantInfo.error?.name === 'MessageAbortedError';
+    const error = lastAssistantInfo.error;
+    const errorName = getErrorName(error);
+    const hasError = error !== null && error !== undefined;
+    const abortedTail = errorName === 'MessageAbortedError';
+    const lengthTail = isLengthTruncated(lastAssistantInfo, errorName);
     if (abortedTail && goal.statusReason !== 'resumed') {
       await writeGoal(sessionId, directory, goal.id, () => ({
         status: 'paused',
@@ -622,13 +673,12 @@ export const createSessionGoalRuntime = ({
       return;
     }
 
-    // Turn error → blocked (prevents runaway auto-continuation into failures).
-    if (!abortedTail && lastAssistantInfo.error && typeof lastAssistantInfo.error === 'object') {
-      const reason = typeof lastAssistantInfo.error.name === 'string' && lastAssistantInfo.error.name
-        ? lastAssistantInfo.error.name
-        : 'assistant turn failed';
+    // Non-length turn error → blocked (prevents runaway auto-continuation into
+    // failures). Recognized length cutoffs are in-progress continuations, not
+    // hard failures.
+    if (!abortedTail && !lengthTail && hasError) {
       await settleGoal({
-        sessionId, directory, goal, status: 'blocked', statusReason: reason, tokensUsed, tokensBaseline, tokensCommitted, lastAccountedMessageID,
+        sessionId, directory, goal, status: 'blocked', statusReason: errorName || 'assistant turn failed', tokensUsed, tokensBaseline, tokensCommitted, lastAccountedMessageID,
       });
       return;
     }
@@ -649,17 +699,28 @@ export const createSessionGoalRuntime = ({
       return;
     }
 
+    // A second consecutive completed, non-summary length-truncated turn is a
+    // bounded recovery failure. Derive this from the loaded transcript rather
+    // than persisting another goal counter.
+    if (lengthTail && goal.statusReason !== 'resumed' && hasRepeatedLengthTail(messages, lastAssistant, goal.createdAt)) {
+      await settleGoal({
+        sessionId, directory, goal, status: 'blocked', statusReason: 'repeated output truncation', tokensUsed, tokensBaseline, tokensCommitted, lastAccountedMessageID,
+      });
+      return;
+    }
+
     // --- Small-model audit: the sole termination authority besides the hard
     // stops above (turn error, budget, continuation cap). The working agent
     // has no channel to settle its own goal.
     //
-    // Exception: when the latest message is a compaction summary, the agent
-    // by definition ran into the context window mid-work — that IS
-    // "in progress, not finished". No audit call; continue unconditionally.
+    // Exception: when the latest message is a compaction summary or was cut off
+    // by the output token limit (length stop), the agent by definition ran into
+    // the context/output limit mid-work — that IS "in progress, not finished".
+    // No audit call; continue unconditionally.
     let audit = null;
     let blockedStreak = 0;
     let auditFailStreak = goal.auditFailStreak;
-    if (lastAssistantInfo.summary === true || abortedTail) {
+    if (lastAssistantInfo.summary === true || abortedTail || lengthTail) {
       blockedStreak = goal.blockedStreak;
     } else {
       audit = await runAudit({ goal: { ...goal, objective: effectiveObjective }, assistantText, directory, lastAssistantInfo: executionInfo ?? lastAssistantInfo });