@wrongstack/core 0.306.3 → 0.306.4

package/dist/defaults/index.js

@@ -9828,6 +9828,24 @@ import {
 } from "@wrongstack/persistence";
 
 // src/security/secret-scrubber.ts
+var JSON_CREDENTIAL_KEY_ANCHORS = [
+  'Key"',
+  'key"',
+  'KEY"',
+  'token"',
+  'Token"',
+  'TOKEN"',
+  'secret"',
+  'Secret"',
+  'SECRET"',
+  'password"',
+  'Password"',
+  'PASSWORD"',
+  'authorization"',
+  'Authorization"',
+  'bearer"',
+  'Bearer"'
+];
 var PATTERNS = [
   // Anchored at the start where possible so partial matches inside larger
   // strings don't trigger false positives.
@@ -9930,6 +9948,30 @@ var PATTERNS = [
     regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
     anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
   },
+  {
+    type: "json_credential_key",
+    // The JSON counterpart to `high_entropy_env`, and the pattern that the
+    // now-deleted `JSON_KEY_ANCHORS` list was written for. Without it those
+    // anchors only widened the cheap pre-scan — `hasCredentialAnchors` said
+    // "this text may hold a secret", every pattern then declined to match, and
+    // the value went out verbatim. `high_entropy_env` cannot cover these: it
+    // requires an UPPERCASE unquoted key (`API_KEY=…`), so `{"apiKey":"…"}`
+    // never matched.
+    //
+    // Tool results are routinely serialised as JSON, and a credential with no
+    // recognisable prefix (Azure, self-hosted gateways, Anthropic/Codex OAuth)
+    // has no other pattern that can catch it — this is the only thing standing
+    // between such a value and the session JSONL, chronicle, HQ broadcast and
+    // the model's own context.
+    //
+    // The key may carry a prefix (`"anthropicApiKey"`), but the credential word
+    // must END the key: `"tokenCount"` and `"maxTokens"` do not match, because
+    // the closing quote has to follow the word immediately.
+    // Value floor of 8 chars keeps enum-ish values (`"authorization":"none"`)
+    // out. Capture groups: 1=key + punctuation, 2=value, 3=closing quote.
+    regex: /("[A-Za-z0-9_]*(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s*:\s*")([^"\\]{8,512})(")/gi,
+    anchor: JSON_CREDENTIAL_KEY_ANCHORS
+  },
   // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
   // The plugin runtime carried 37 patterns while this scrubber — the one that
   // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
@@ -10012,9 +10054,12 @@ var PATTERNS = [
     anchor: "GOCSPX-"
   }
 ];
-var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
+var SIMPLE_PATTERNS = PATTERNS.filter(
+  (p) => p.type !== "high_entropy_env" && p.type !== "json_credential_key"
+);
 var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
 var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
+var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key").regex;
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
@@ -10025,20 +10070,7 @@ var PATTERN_ANCHORS = [
     )
   )
 ];
-var JSON_KEY_ANCHORS = [
-  '"apiKey"',
-  '"api_key"',
-  '"token"',
-  '"secret"',
-  '"password"',
-  '"authorization"',
-  '"bearer"',
-  '"private_key"',
-  '"access_token"',
-  '"refresh_token"',
-  '"client_secret"'
-];
-var ALL_ANCHORS = [...PATTERN_ANCHORS, ...JSON_KEY_ANCHORS];
+var ALL_ANCHORS = PATTERN_ANCHORS;
 function hasCredentialAnchors(text) {
   for (const anchor of ALL_ANCHORS) {
     if (text.includes(anchor)) return true;
@@ -10087,6 +10119,9 @@ var DefaultSecretScrubber = class {
     out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
       return `${lead}${key}=[REDACTED:high_entropy_env]`;
     });
+    out = out.replace(JSON_CREDENTIAL_REGEX, (_match, keyPrefix, _value, closingQuote) => {
+      return `${keyPrefix}[REDACTED:json_credential_key]${closingQuote}`;
+    });
     return out;
   }
   /**
@@ -11017,6 +11052,7 @@ function isEmptyMessage(msg) {
 }
 
 // src/core/context.ts
+import { realpathSync } from "node:fs";
 import * as path13 from "node:path";
 
 // src/utils/tool-wire-compact.ts
@@ -11446,12 +11482,15 @@ var ConversationState = class {
    * cap determines the starting index for the sum but does not gate it.
    */
   overflowCount(arr) {
-    let drop = Context.MAX_MESSAGES > 0 ? Math.max(0, arr.length - Context.MAX_MESSAGES) : 0;
-    if (Context.MAX_MESSAGE_TOKENS <= 0) return this.protocolSafeDropCount(arr, drop);
+    const contextClass = this.ctx.constructor;
+    const maxMessages = contextClass.MAX_MESSAGES;
+    const maxMessageTokens = contextClass.MAX_MESSAGE_TOKENS;
+    let drop = maxMessages > 0 ? Math.max(0, arr.length - maxMessages) : 0;
+    if (maxMessageTokens <= 0) return this.protocolSafeDropCount(arr, drop);
     let total = 0;
     for (let i = drop; i < arr.length; i++) total += arr[i]?._estTokens ?? 0;
-    if (total <= Context.MAX_MESSAGE_TOKENS) return this.protocolSafeDropCount(arr, drop);
-    while (drop < arr.length - 1 && total > Context.MAX_MESSAGE_TOKENS) {
+    if (total <= maxMessageTokens) return this.protocolSafeDropCount(arr, drop);
+    while (drop < arr.length - 1 && total > maxMessageTokens) {
       total -= arr[drop]?._estTokens ?? 0;
       drop++;
     }
@@ -12274,6 +12313,19 @@ var Context = class _Context {
       if (rel.startsWith("..") || path13.isAbsolute(rel)) {
         throw new Error(`Working directory "${resolved}" is outside project root "${root}"`);
       }
+      let realTarget = resolved;
+      let realRoot = root;
+      try {
+        realTarget = realpathSync.native(resolved);
+        realRoot = realpathSync.native(root);
+      } catch {
+      }
+      const realRel = path13.relative(realRoot, realTarget);
+      if (realRel.startsWith("..") || path13.isAbsolute(realRel)) {
+        throw new Error(
+          `Working directory "${resolved}" resolves to "${realTarget}", outside project root "${realRoot}"`
+        );
+      }
     }
     const old = this.workingDir;
     this.workingDir = resolved;
@@ -16526,9 +16578,40 @@ async function readOrBuildShardManifestEntry(opts) {
   return entry;
 }
 
-// src/storage/session-store/summary-builder.ts
+// src/storage/session-store/strict-empty-check.ts
 import { createReadStream as createReadStream3 } from "node:fs";
 import { createInterface as createInterface3 } from "node:readline";
+var EMPTY_SESSION_EVENT_TYPES = /* @__PURE__ */ new Set(["session_start", "session_resumed", "session_end"]);
+async function isStrictlyEmptySessionFile(file) {
+  const input = createReadStream3(file, { encoding: "utf8" });
+  const lines = createInterface3({ input, crlfDelay: Infinity });
+  let sawSessionStart = false;
+  try {
+    for await (const line of lines) {
+      if (!line.trim()) continue;
+      let event;
+      try {
+        event = JSON.parse(line);
+      } catch {
+        return false;
+      }
+      if (event === null || typeof event !== "object" || Array.isArray(event)) return false;
+      const type = event.type;
+      if (typeof type !== "string" || !EMPTY_SESSION_EVENT_TYPES.has(type)) return false;
+      if (type === "session_start") sawSessionStart = true;
+    }
+  } catch {
+    return false;
+  } finally {
+    lines.close();
+    input.destroy();
+  }
+  return sawSessionStart;
+}
+
+// src/storage/session-store/summary-builder.ts
+import { createReadStream as createReadStream4 } from "node:fs";
+import { createInterface as createInterface4 } from "node:readline";
 async function summarizeSessionFile(opts) {
   return summarizeSessionEventSequence({
     id: opts.id,
@@ -16645,8 +16728,8 @@ async function summarizeSessionEventSequence(opts) {
   }
 }
 async function* iterateSessionEvents(file, secretScrubber) {
-  const stream = createReadStream3(file, { encoding: "utf8" });
-  const lines = createInterface3({ input: stream, crlfDelay: Infinity });
+  const stream = createReadStream4(file, { encoding: "utf8" });
+  const lines = createInterface4({ input: stream, crlfDelay: Infinity });
   try {
     for await (const line of lines) {
       if (!line.trim()) continue;
@@ -17542,6 +17625,10 @@ var DefaultSessionStore = class _DefaultSessionStore {
     await deleteSessionArtifacts({ rootDir: this.dir, id, jsonlPath });
     await this.writeTombstone(id);
   }
+  async isEmpty(id) {
+    const canonicalId = await this.resolveId(id);
+    return isStrictlyEmptySessionFile(this.sessionPath(canonicalId, ".jsonl"));
+  }
   async delete(id) {
     if (this.catalogClient) {
       const canonical = await this.resolveId(id);
@@ -21471,6 +21558,12 @@ function findExchangeStart(messages, userIndex) {
 
 // src/execution/auto-compaction-middleware.ts
 var LEVEL_RANK = { warn: 0, soft: 1, hard: 2 };
+function pressureLevelFor(load, thresholds) {
+  if (load >= thresholds.hard) return "hard";
+  if (load >= thresholds.soft) return "soft";
+  if (load >= thresholds.warn) return "warn";
+  return null;
+}
 var MAX_DIGEST_LOG_CHARS = 4e3;
 function truncateDigest(digest) {
   if (digest.length <= MAX_DIGEST_LOG_CHARS) return digest;
@@ -21516,8 +21609,19 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
    * 1 / 2.5 = 0.4.
    */
   static GUARD_GATE_LOAD = 0.4;
+  /**
+   * How much the context must grow between two history-rewriting hygiene
+   * passes, as a fraction of the available input window and as an absolute
+   * floor. Every pass rewrites already-transmitted messages, which forces the
+   * provider to re-cache the whole prompt; spacing the passes out is what lets
+   * the conversation prefix stay cached for the turns in between.
+   */
+  static HYGIENE_GROWTH_RATIO = 0.15;
+  static HYGIENE_MIN_GROWTH_TOKENS = 2e4;
   /** Tracks the most recent no-op attempt so we can avoid re-firing per turn. */
   lastNoopAttempt = null;
+  /** Context size at the last hygiene pass; anchors the growth interval. */
+  lastHygieneTokens = null;
   /**
    * Cached token estimate from the last handler() invocation. When the
    * message count and tool count haven't changed since the last estimate
@@ -21577,55 +21681,9 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
   handler() {
     return async (ctx, next) => {
       if (!this._enabled) return next(ctx);
-      const rawHygiene = eliseAcknowledgedToolResults(ctx.messages, {
-        maxRetainedTokens: this.resolveToolResultRetention(ctx)
-      });
-      const receiptHygiene = collapseAcknowledgedToolReceipts(rawHygiene.messages, {
-        maxPairs: this.resolveToolReceiptRetention(ctx)
-      });
-      if (rawHygiene.changed || receiptHygiene.changed) {
-        ctx.state.replaceMessages(receiptHygiene.messages);
-        ctx.clearFileTracking();
-        this.invalidateTokenCaches(ctx);
-      }
-      const msgCount = ctx.messages.length;
-      const toolCount = (ctx.tools ?? []).length;
-      const revision = ctx.state?.revision ?? -1;
-      let tokens;
-      const anchorAt = typeof ctx.meta?.["realAnchorMsgCount"] === "number" ? ctx.meta["realAnchorMsgCount"] : void 0;
-      const anchored = realAnchoredInputTokens(ctx.messages, ctx.lastRealInputTokens, anchorAt);
-      if (anchored !== null) {
-        tokens = anchored;
-      } else if (this._estimator) {
-        tokens = this._estimator(ctx);
-      } else if (msgCount === this._cachedMsgCount && toolCount === this._cachedToolCount && revision === this._cachedRevision && ctx.systemPrompt === this._cachedSystemRef && ctx.tools === this._cachedToolsRef && this._cachedTokens >= 0) {
-        tokens = this._cachedTokens;
-      } else if (this.tryStashedTokens(ctx, msgCount, toolCount, revision) !== null) {
-        const stashed = this.tryStashedTokens(ctx, msgCount, toolCount, revision);
-        const cal = getCalibrationState(`${ctx.provider?.id ?? "unknown"}/${ctx.model}`);
-        tokens = cal.calibrated ? Math.round(stashed * Math.min(1.5, Math.max(0.5, cal.ratio))) : stashed;
-        this._cachedTokens = tokens;
-        this._cachedMsgCount = msgCount;
-        this._cachedToolCount = toolCount;
-        this._cachedRevision = revision;
-        this._cachedSystemRef = ctx.systemPrompt;
-        this._cachedToolsRef = ctx.tools;
-      } else {
-        tokens = estimateRequestTokensCalibrated(
-          ctx.messages,
-          ctx.systemPrompt,
-          ctx.tools ?? [],
-          `${ctx.provider?.id ?? "unknown"}/${ctx.model}`
-        ).total;
-        this._cachedTokens = tokens;
-        this._cachedMsgCount = msgCount;
-        this._cachedToolCount = toolCount;
-        this._cachedRevision = revision;
-        this._cachedSystemRef = ctx.systemPrompt;
-        this._cachedToolsRef = ctx.tools;
-      }
+      let tokens = this.estimateContextTokens(ctx);
       const runtimeMaxContext = effectiveMaxContext(ctx, this._maxContext);
-      const budget = computeContextWindowBudget(ctx, tokens, runtimeMaxContext);
+      let budget = computeContextWindowBudget(ctx, tokens, runtimeMaxContext);
       const calibratedLoad = budget.load;
       const policy = this.policyProvider?.(ctx);
       const thresholds = policy?.thresholds ?? {
@@ -21639,22 +21697,27 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
       });
       const aggressiveOn = policy?.aggressiveOn ?? this.aggressiveOn;
       const targetLoad = normalizeTargetLoad(policy?.targetLoad, adaptiveThresholds);
-      let load = calibratedLoad;
-      if (calibratedLoad >= _AutoCompactionMiddleware.GUARD_GATE_LOAD) {
-        const guardTotal = estimateRequestTokensUpperBound(
-          ctx.messages,
-          ctx.systemPrompt,
-          ctx.tools ?? [],
-          `${ctx.provider?.id ?? "unknown"}/${ctx.model}`
-        ).total;
-        const guardLoad = guardTotal / budget.availableInputTokens;
-        if (guardLoad > load) load = guardLoad;
-      }
-      const level = load >= adaptiveThresholds.hard ? "hard" : load >= adaptiveThresholds.soft ? "soft" : load >= adaptiveThresholds.warn ? "warn" : null;
+      let load = this.applySendGuard(ctx, calibratedLoad, budget.availableInputTokens);
+      let level = pressureLevelFor(load, adaptiveThresholds);
       if (!level) {
         this.lastNoopAttempt = null;
         return next(ctx);
       }
+      if (this.shouldRunHygiene(level, tokens, budget.availableInputTokens)) {
+        const changed = this.runHistoryHygiene(ctx);
+        tokens = changed ? this.estimateContextTokens(ctx) : tokens;
+        this.lastHygieneTokens = tokens;
+        if (changed) {
+          budget = computeContextWindowBudget(ctx, tokens, runtimeMaxContext);
+          load = this.applySendGuard(ctx, budget.load, budget.availableInputTokens);
+          const relevelled = pressureLevelFor(load, adaptiveThresholds);
+          if (!relevelled) {
+            this.lastNoopAttempt = null;
+            return next(ctx);
+          }
+          level = relevelled;
+        }
+      }
       if (this.shouldSkipNoopRetry(level, tokens)) {
         return next(ctx);
       }
@@ -21671,6 +21734,123 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
       return next(ctx);
     };
   }
+  /**
+   * Full-request token total for the current context.
+   *
+   * Reuses the last estimate when the context hasn't grown since the previous
+   * check — common in autonomous idle loops. The cached value is invalidated
+   * whenever messages or tools change.
+   *
+   * IMPORTANT: the cache is only valid for the deterministic
+   * `estimateRequestTokensCalibrated` path (messages+system+tools → fixed
+   * output). When a custom `_estimator` is provided (e.g. in tests with a
+   * mutable closure, or a dynamic policy provider), always call it fresh — the
+   * estimator owns its own semantics and the middleware cannot safely cache its
+   * result across calls.
+   */
+  estimateContextTokens(ctx) {
+    const msgCount = ctx.messages.length;
+    const toolCount = (ctx.tools ?? []).length;
+    const revision = ctx.state?.revision ?? -1;
+    const anchorAt = typeof ctx.meta?.["realAnchorMsgCount"] === "number" ? ctx.meta["realAnchorMsgCount"] : void 0;
+    const anchored = realAnchoredInputTokens(ctx.messages, ctx.lastRealInputTokens, anchorAt);
+    if (anchored !== null) return anchored;
+    if (this._estimator) return this._estimator(ctx);
+    if (msgCount === this._cachedMsgCount && toolCount === this._cachedToolCount && revision === this._cachedRevision && ctx.systemPrompt === this._cachedSystemRef && ctx.tools === this._cachedToolsRef && this._cachedTokens >= 0) {
+      return this._cachedTokens;
+    }
+    const stashed = this.tryStashedTokens(ctx, msgCount, toolCount, revision);
+    let tokens;
+    if (stashed !== null) {
+      const cal = getCalibrationState(`${ctx.provider?.id ?? "unknown"}/${ctx.model}`);
+      tokens = cal.calibrated ? Math.round(stashed * Math.min(1.5, Math.max(0.5, cal.ratio))) : stashed;
+    } else {
+      tokens = estimateRequestTokensCalibrated(
+        ctx.messages,
+        ctx.systemPrompt,
+        ctx.tools ?? [],
+        `${ctx.provider?.id ?? "unknown"}/${ctx.model}`
+      ).total;
+    }
+    this._cachedTokens = tokens;
+    this._cachedMsgCount = msgCount;
+    this._cachedToolCount = toolCount;
+    this._cachedRevision = revision;
+    this._cachedSystemRef = ctx.systemPrompt;
+    this._cachedToolsRef = ctx.tools;
+    return tokens;
+  }
+  /**
+   * Never-undercount send guard.
+   *
+   * The calibrated estimate can under-count dense content (CJK, base64,
+   * minified) by >1.5×, which would let an over-limit request slip past the
+   * thresholds and reach the provider. Once the calibrated load is high enough
+   * that even the max density factor (2.5×) *could* overflow (load ≥ 1/2.5 =
+   * 0.4), re-check with the upper-bound estimator and escalate to whichever
+   * load is larger. Below 0.4 an overflow is arithmetically impossible, so the
+   * extra scan is skipped.
+   */
+  applySendGuard(ctx, calibratedLoad, availableInputTokens) {
+    if (calibratedLoad < _AutoCompactionMiddleware.GUARD_GATE_LOAD) return calibratedLoad;
+    const guardTotal = estimateRequestTokensUpperBound(
+      ctx.messages,
+      ctx.systemPrompt,
+      ctx.tools ?? [],
+      `${ctx.provider?.id ?? "unknown"}/${ctx.model}`
+    ).total;
+    const guardLoad = guardTotal / availableInputTokens;
+    return guardLoad > calibratedLoad ? guardLoad : calibratedLoad;
+  }
+  /**
+   * Rewrite acknowledged tool protocol in place.
+   *
+   * Tool results are protocol inputs for the immediately following model
+   * response, not unlimited durable prompt memory. Once a later assistant
+   * message proves the provider consumed them, keep a mode-sized raw window and
+   * replace the rest with semantic head/tail receipts, then fold fully-aged
+   * pairs into the history digest.
+   *
+   * Every one of those edits touches a message the provider has already seen,
+   * so each call costs a full prompt re-cache — it belongs behind
+   * {@link shouldRunHygiene}, never on the per-turn path. Content staleness is
+   * not a reason to bypass that gate: the edit/replace tools guard against
+   * acting on an out-of-date read with their own mtime + sha-256 check.
+   *
+   * @returns whether the conversation was rewritten.
+   */
+  runHistoryHygiene(ctx) {
+    const raw = eliseAcknowledgedToolResults(ctx.messages, {
+      maxRetainedTokens: this.resolveToolResultRetention(ctx)
+    });
+    const receipts = collapseAcknowledgedToolReceipts(raw.messages, {
+      maxPairs: this.resolveToolReceiptRetention(ctx)
+    });
+    if (!raw.changed && !receipts.changed) return false;
+    ctx.state.replaceMessages(receipts.messages);
+    ctx.clearFileTracking();
+    this.invalidateTokenCaches(ctx);
+    return true;
+  }
+  /**
+   * Whether the history-rewriting hygiene pass may run this turn.
+   *
+   * Hard pressure always runs it — staying under the window outranks caching.
+   * Otherwise it runs at most once per growth interval, so the conversation
+   * stays append-only (and therefore cacheable by the provider) in between.
+   */
+  shouldRunHygiene(level, tokens, availableInputTokens) {
+    if (level === "hard") return true;
+    const last = this.lastHygieneTokens;
+    if (last === null) return true;
+    const anchor = Math.min(last, tokens);
+    this.lastHygieneTokens = anchor;
+    const interval = Math.max(
+      _AutoCompactionMiddleware.HYGIENE_MIN_GROWTH_TOKENS,
+      Math.floor(availableInputTokens * _AutoCompactionMiddleware.HYGIENE_GROWTH_RATIO)
+    );
+    return tokens - anchor >= interval;
+  }
   /**
    * H1: try to read a pre-computed token total from `ctx.lastRequestTokens`
    * (set by the agent loop's pre-flight or its restash in emitContextPct).
@@ -26767,26 +26947,29 @@ var DefaultProviderRunner = class {
 // src/execution/retry-policy.ts
 import { randomInt } from "node:crypto";
 var MAX_RETRY_AFTER_MS = 6e4;
+var MODEL_RETRIES = 3;
 var MAX_ATTEMPTS_BY_KIND = {
-  rate_limit: 5,
+  rate_limit: MODEL_RETRIES,
+  overloaded: MODEL_RETRIES,
+  server: MODEL_RETRIES,
+  timeout: MODEL_RETRIES,
+  network: MODEL_RETRIES,
+  stream_hang: MODEL_RETRIES,
   quota_exhausted: 0,
-  stream_hang: 2,
-  // proxy-level timeout — retrying 5x wastes ~40s before fallback kicks in
-  overloaded: 3,
-  server: 3,
-  timeout: 2,
-  network: 2,
   auth: 0,
   invalid_request: 0,
   context_overflow: 0,
   content_filter: 0,
   unknown: 0
 };
+var FAILOVER_RETRY_AFTER_MS = 15e3;
 var DefaultRetryPolicy = class {
   shouldRetry(err, attempt) {
     const isProviderErr = err instanceof ProviderError || ProviderError.isProviderError(err);
     if (isProviderErr) {
       if (!err.retryable) return false;
+      const hint = retryAfterMsFromError(err);
+      if (hint !== void 0 && hint >= FAILOVER_RETRY_AFTER_MS) return false;
       return attempt < this.maxAttempts(err);
     }
     const msg = err.message ?? "";
@@ -32074,7 +32257,7 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
 };
 
 // src/security/permission-helpers.ts
-import { realpathSync } from "node:fs";
+import { realpathSync as realpathSync2 } from "node:fs";
 import * as path38 from "node:path";
 function matchesTrust(patterns, subject) {
   return patterns.includes(subject) || matchAny(patterns, subject);
@@ -32159,7 +32342,7 @@ function realpathOfNearestExisting(p) {
   const tail = [];
   for (; ; ) {
     try {
-      return tail.length === 0 ? realpathSync(probe) : path38.join(realpathSync(probe), ...tail);
+      return tail.length === 0 ? realpathSync2(probe) : path38.join(realpathSync2(probe), ...tail);
     } catch {
       const parent = path38.dirname(probe);
       if (parent === probe) return p;
@@ -33922,6 +34105,10 @@ var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "fallbackModels",
   "fallbackBridge",
   "fallbackProfiles",
+  // The profile SELECTOR. No broader than its siblings: a repo that can write
+  // `fallbackModels` and `fallbackProfiles` already controls the chain outright,
+  // and this one can only name a profile the user already defined.
+  "fallbackProfile",
   "favoriteModels",
   "favoriteModelsOnly",
   "modelAvailabilitySchedule",
@@ -33969,6 +34156,10 @@ var KNOWN_DENIED_IN_PROJECT = [
   {
     key: "git",
     reason: "Carries git.identity (GIT_AUTHOR_*/GIT_COMMITTER_* injection): a repo-committed config could spoof the author identity written into the victim's commit history (impersonation)."
+  },
+  {
+    key: "fallbackMaxLastResortCandidates",
+    reason: "Bounds how many of the user's OTHER configured providers may be swept in as last-resort failover. Setting it to 0 from a repo-committed config would silently strip that depth during an outage. It was already stripped in practice (absent from the allow-list) but was missing from the key registry, so this gate never checked it."
   }
 ];
 var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
@@ -33989,11 +34180,13 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "fallbackModels",
   "fallbackBridge",
   "fallbackProfiles",
+  "fallbackProfile",
   "favoriteModels",
   "favoriteModelsOnly",
   "modelAvailabilitySchedule",
   "fallbackAuto",
   "fallbackStickiness",
+  "fallbackMaxLastResortCandidates",
   "hooks",
   "plugins",
   "pluginManager",
@@ -34079,6 +34272,17 @@ var IN_PROJECT_DENIED_PATHS = [
     // operator owns, not the checked-out repository.
     path: "tools.kanbanGovernance",
     reason: "Repo-committed config could disable a Kanban governance gate the operator switched on, letting product mutations run outside any managed card."
+  },
+  {
+    // The bridge spawn path resolves the CLI entry by walking UP from the
+    // project root, so a repo that ships its own `packages/cli/dist/index.js`
+    // gets that file spawned with `process.execPath` on WebUI boot — no
+    // prompt, no banner. Turning the feature on is therefore equivalent to
+    // arbitrary code execution for a hostile checkout, which makes this an
+    // operator-owned switch and never a repo-owned one.
+    // See discover-mailbox-bridge.ts:findWorkspaceCliEntry.
+    path: "features.mailboxBridge",
+    reason: "Enables the mailbox bridge, whose CLI-entry resolution walks up from the project root \u2014 a repo-supplied packages/cli/dist/index.js would be spawned on WebUI boot."
   }
 ];
 function deleteNestedPath(target, path45) {

package/dist/execution/auto-compaction-middleware.d.ts

@@ -78,8 +78,19 @@ export declare class AutoCompactionMiddleware {
      * 1 / 2.5 = 0.4.
      */
     private static readonly GUARD_GATE_LOAD;
+    /**
+     * How much the context must grow between two history-rewriting hygiene
+     * passes, as a fraction of the available input window and as an absolute
+     * floor. Every pass rewrites already-transmitted messages, which forces the
+     * provider to re-cache the whole prompt; spacing the passes out is what lets
+     * the conversation prefix stay cached for the turns in between.
+     */
+    private static readonly HYGIENE_GROWTH_RATIO;
+    private static readonly HYGIENE_MIN_GROWTH_TOKENS;
     /** Tracks the most recent no-op attempt so we can avoid re-firing per turn. */
     private lastNoopAttempt;
+    /** Context size at the last hygiene pass; anchors the growth interval. */
+    private lastHygieneTokens;
     /**
      * Cached token estimate from the last handler() invocation. When the
      * message count and tool count haven't changed since the last estimate
@@ -128,6 +139,59 @@ export declare class AutoCompactionMiddleware {
      *  tokens or compacting. */
     setEnabled(enabled: boolean): void;
     handler(): MiddlewareHandler<Context>;
+    /**
+     * Full-request token total for the current context.
+     *
+     * Reuses the last estimate when the context hasn't grown since the previous
+     * check — common in autonomous idle loops. The cached value is invalidated
+     * whenever messages or tools change.
+     *
+     * IMPORTANT: the cache is only valid for the deterministic
+     * `estimateRequestTokensCalibrated` path (messages+system+tools → fixed
+     * output). When a custom `_estimator` is provided (e.g. in tests with a
+     * mutable closure, or a dynamic policy provider), always call it fresh — the
+     * estimator owns its own semantics and the middleware cannot safely cache its
+     * result across calls.
+     */
+    private estimateContextTokens;
+    /**
+     * Never-undercount send guard.
+     *
+     * The calibrated estimate can under-count dense content (CJK, base64,
+     * minified) by >1.5×, which would let an over-limit request slip past the
+     * thresholds and reach the provider. Once the calibrated load is high enough
+     * that even the max density factor (2.5×) *could* overflow (load ≥ 1/2.5 =
+     * 0.4), re-check with the upper-bound estimator and escalate to whichever
+     * load is larger. Below 0.4 an overflow is arithmetically impossible, so the
+     * extra scan is skipped.
+     */
+    private applySendGuard;
+    /**
+     * Rewrite acknowledged tool protocol in place.
+     *
+     * Tool results are protocol inputs for the immediately following model
+     * response, not unlimited durable prompt memory. Once a later assistant
+     * message proves the provider consumed them, keep a mode-sized raw window and
+     * replace the rest with semantic head/tail receipts, then fold fully-aged
+     * pairs into the history digest.
+     *
+     * Every one of those edits touches a message the provider has already seen,
+     * so each call costs a full prompt re-cache — it belongs behind
+     * {@link shouldRunHygiene}, never on the per-turn path. Content staleness is
+     * not a reason to bypass that gate: the edit/replace tools guard against
+     * acting on an out-of-date read with their own mtime + sha-256 check.
+     *
+     * @returns whether the conversation was rewritten.
+     */
+    private runHistoryHygiene;
+    /**
+     * Whether the history-rewriting hygiene pass may run this turn.
+     *
+     * Hard pressure always runs it — staying under the window outranks caching.
+     * Otherwise it runs at most once per growth interval, so the conversation
+     * stays append-only (and therefore cacheable by the provider) in between.
+     */
+    private shouldRunHygiene;
     /**
      * H1: try to read a pre-computed token total from `ctx.lastRequestTokens`
      * (set by the agent loop's pre-flight or its restash in emitContextPct).

package/dist/execution/compaction-core.d.ts

@@ -63,6 +63,10 @@ export interface AcknowledgedToolReceiptCollapse extends EliseResult {
  * become semantic receipts while their exact payload remains in the session
  * log. Tool ids and provider metadata stay intact so strict provider replay
  * adjacency remains valid.
+ *
+ * Every edit here rewrites a message the provider has already seen, so callers
+ * must run this on a pressure-gated interval rather than per turn — see
+ * `AutoCompactionMiddleware.shouldRunHygiene`.
  */
 export declare function eliseAcknowledgedToolResults(messages: readonly Message[], opts: {
     maxRetainedTokens: number;

package/dist/execution/index.d.ts

@@ -25,7 +25,7 @@ export { OneShotOrchestrator } from './one-shot-llm.js';
 export { type ParallelEngineState, ParallelEternalEngine, type ParallelEternalOptions, type ParallelIterationStage, } from './parallel-eternal-engine.js';
 export { buildRefinerContextSections, DEFAULT_REFINER_RETRY_FEEDBACK, type EnhanceFailureKind, enhanceUserPrompt, gatedEnhancerReasoning, isValidEnglishRefinement, normalizedEqual, parseBilingualEnhancement, recentTextTurns, shouldEnhance, } from './prompt-enhancer.js';
 export { DefaultPromptLoader, type PromptLoaderOptions, renderPrompt } from './prompt-loader.js';
-export { DefaultRetryPolicy } from './retry-policy.js';
+export { DefaultRetryPolicy, MODEL_RETRIES } from './retry-policy.js';
 export { SelectiveCompactor, type SelectiveCompactorOptions } from './selective-compactor.js';
 export { DefaultSkillLoader, type SkillLoaderOptions } from './skill-loader.js';
 export { type CompactorStrategy, createStrategyCompactor, type StrategyCompactorOptions, } from './strategy-compactor.js';