@yeaft/webchat-agent 1.0.504 → 1.0.506

package/yeaft/llm/provider-state.js

@@ -0,0 +1,242 @@
+import { createHash } from 'node:crypto';
+
+export const MAX_PROVIDER_STATE_BYTES = 4 * 1024 * 1024;
+const PROTOCOLS = new Set(['openai-responses', 'anthropic']);
+const hash = value => `sha256:${createHash('sha256').update(JSON.stringify(value)).digest('hex')}`;
+const clone = value => structuredClone(value);
+const nonempty = value => typeof value === 'string' && value.length > 0;
+
+export class ProviderStateError extends Error {
+  constructor(reason) {
+    super(`Provider continuation cannot be replayed safely: ${reason}`);
+    this.name = 'ProviderStateError';
+    this.code = 'PROVIDER_STATE_INVALID';
+  }
+}
+
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.keys(value).sort().map(key => [key, stable(value[key])]));
+}
+
+export function providerProjectionDigest(message) {
+  return hash(stable({ content: message.content || '', toolCalls: (message.toolCalls || []).map(tc => ({
+    id: tc.id, name: tc.name, input: tc.input ?? {},
+  })) }));
+}
+
+export function providerStateBytes(state) {
+  try { return Buffer.byteLength(JSON.stringify(state)); } catch { return Infinity; }
+}
+
+export function requestOwner(identity) {
+  const keys = ['instanceScope', 'ownerScope', 'sessionId', 'vpId', 'threadId'];
+  if (!identity || !keys.every(key => nonempty(identity[key]))) return null;
+  // Persist opaque scope fingerprints, never local absolute paths/usernames.
+  return Object.fromEntries(keys.map(key => [key, hash(identity[key])]));
+}
+
+/** Stable, content-free identity: no prompt, model effort, request id or token. */
+export function createPromptCacheKey(identity, context) {
+  const owner = requestOwner(identity);
+  if (!owner || !validOrigin(context?.origin)) return null;
+  return `yeaft:${hash({ owner, origin: context.origin }).slice(7, 55)}`;
+}
+
+function validOrigin(origin) {
+  return origin && ['providerId', 'endpointFingerprint', 'model', 'credentialScopeId'].every(key => nonempty(origin[key]));
+}
+
+/** Endpoint recognition is exact, never inferred from a Claude/GPT model name.
+ * Unknown/translation endpoints opt in via the existing provider/model config.
+ */
+export function createProviderContext({ protocol, baseUrl, providerId, credentialScopeId, staticApiKey, model, capabilities = {} }) {
+  let endpoint;
+  try {
+    const url = new URL(baseUrl || (protocol === 'anthropic' ? 'https://api.anthropic.com' : 'https://api.openai.com/v1'));
+    url.username = ''; url.password = ''; url.search = ''; url.hash = '';
+    endpoint = url.toString().replace(/\/+$/, '');
+  } catch { endpoint = ''; }
+  const native = protocol === 'anthropic' ? endpoint === 'https://api.anthropic.com'
+    : endpoint === 'https://api.openai.com/v1';
+  // Official static-key routes work with existing configs. Persist only a
+  // full cryptographic fingerprint, stable across restart and changed on key
+  // rotation. Dynamic credentials and unknown proxies still require an explicit
+  // account scope: an expiring access token is not a stable account identity.
+  if (!nonempty(credentialScopeId) && native && nonempty(staticApiKey)) {
+    credentialScopeId = hash(['static-api-key', staticApiKey]);
+  }
+  const enabled = key => capabilities.translation !== true && (capabilities[key] ?? native) === true;
+  return {
+    protocol,
+    origin: { providerId: providerId || protocol, endpointFingerprint: hash(endpoint), model, credentialScopeId },
+    capabilities: {
+      nativeReasoningState: enabled('nativeReasoningState'),
+      promptCaching: enabled('promptCaching'),
+      parallelToolCalls: enabled('parallelToolCalls'),
+    },
+    diagnostics: { capabilitySource: capabilities.translation ? 'translation-disabled' : native ? 'native-endpoint' : 'custom-endpoint-unverified' },
+  };
+}
+
+function projectItems(protocol, items) {
+  const projection = { content: '', toolCalls: [] };
+  for (const item of items) {
+    if (!item || typeof item !== 'object') throw new ProviderStateError('invalid item');
+    if (protocol === 'openai-responses') {
+      if (item.status && !['completed', 'incomplete'].includes(item.status)) throw new ProviderStateError('unfinished item');
+      if (item.type === 'reasoning') {
+        if (!nonempty(item.encrypted_content)) throw new ProviderStateError('reasoning missing encrypted content');
+      } else if (item.type === 'message' && item.role === 'assistant' && Array.isArray(item.content)) {
+        for (const part of item.content) {
+          if (part.type !== 'output_text' || typeof part.text !== 'string') throw new ProviderStateError('unsupported message part');
+          projection.content += part.text;
+        }
+      } else if (item.type === 'function_call' && nonempty(item.call_id) && nonempty(item.name) && typeof item.arguments === 'string') {
+        projection.toolCalls.push({ id: item.call_id, name: item.name, input: JSON.parse(item.arguments) });
+      } else throw new ProviderStateError('unsupported Responses item');
+    } else if (protocol === 'anthropic') {
+      if (item.type === 'thinking' && typeof item.thinking === 'string' && nonempty(item.signature)) continue;
+      if (item.type === 'redacted_thinking' && nonempty(item.data)) continue;
+      if (item.type === 'text' && typeof item.text === 'string') projection.content += item.text;
+      else if (item.type === 'tool_use' && nonempty(item.id) && nonempty(item.name) && item.input && typeof item.input === 'object') {
+        projection.toolCalls.push({ id: item.id, name: item.name, input: item.input });
+      } else throw new ProviderStateError('unsupported or unsigned Anthropic block');
+    }
+  }
+  return projection;
+}
+
+export function createProviderState({ context, identity, items, responseId }) {
+  if (!context?.capabilities?.nativeReasoningState || !validOrigin(context.origin) || !requestOwner(identity)) {
+    if (context?.protocol === 'anthropic' && Array.isArray(items)
+      && items.some(item => item?.type === 'tool_use')
+      && items.some(item => ['thinking', 'redacted_thinking'].includes(item?.type))) {
+      throw new ProviderStateError('signed tool turn requires nativeReasoningState, credentialScopeId and request identity; configure the verified native route and start a new context');
+    }
+    return null;
+  }
+  if (!Array.isArray(items) || !items.length) return null;
+  const state = { version: 1, protocol: context.protocol, origin: clone(context.origin), owner: requestOwner(identity),
+    ...(nonempty(responseId) ? { responseId } : {}), items: clone(items) };
+  if (!PROTOCOLS.has(state.protocol)) return null;
+  if (providerStateBytes(state) > MAX_PROVIDER_STATE_BYTES) throw new ProviderStateError('state exceeds byte budget');
+  try { state.projectionDigest = providerProjectionDigest(projectItems(state.protocol, state.items)); }
+  catch (error) {
+    if (state.protocol === 'anthropic' && items.some(item => item?.type === 'tool_use')
+      && items.some(item => ['thinking', 'redacted_thinking'].includes(item?.type))) throw error;
+    return null; // unsupported/partial optional Responses state is not replayable
+  }
+  // Replay checks the final envelope, including its projection digest.
+  if (providerStateBytes(state) > MAX_PROVIDER_STATE_BYTES) throw new ProviderStateError('state exceeds byte budget');
+  return state;
+}
+
+function signedToolState(state, message) {
+  return state?.protocol === 'anthropic' && message?.toolCalls?.length > 0
+    && (!Array.isArray(state.items) || state.items.some(item => ['thinking', 'redacted_thinking'].includes(item?.type)));
+}
+
+export function bindProviderState(state, message) {
+  if (!state) return null;
+  if (state.projectionDigest !== providerProjectionDigest(message)) {
+    if (signedToolState(state, message)) throw new ProviderStateError('assistant projection changed in signed tool turn');
+    return null;
+  }
+  return state;
+}
+
+/** Returns cloned native payload only after all fences. Never mutates history. */
+export function replayProviderState(message, context, identity) {
+  const state = message?.providerState;
+  if (!state) return null;
+  let reason = '';
+  if (state.version !== 1 || !PROTOCOLS.has(state.protocol)) reason = 'unknown schema';
+  else if (!context?.capabilities?.nativeReasoningState || state.protocol !== context.protocol) reason = 'protocol/capability changed';
+  else if (!validOrigin(context.origin) || hash(state.origin) !== hash(context.origin)) reason = 'origin changed';
+  else if (!requestOwner(identity) || hash(state.owner) !== hash(requestOwner(identity))) reason = 'owner changed';
+  else if (providerStateBytes(state) > MAX_PROVIDER_STATE_BYTES) reason = 'state exceeds byte budget';
+  else {
+    try {
+      if (state.projectionDigest !== providerProjectionDigest(message)
+        || state.projectionDigest !== providerProjectionDigest(projectItems(state.protocol, state.items))) reason = 'projection changed';
+    } catch { reason = 'invalid native items'; }
+  }
+  if (reason) {
+    if (signedToolState(state, message)) throw new ProviderStateError(reason);
+    return null;
+  }
+  return clone(state.items);
+}
+
+/** Mandatory normalization AFTER extraBody; generated input/storage cannot be overridden. */
+export function applyResponsesContinuity(body, { context, identity, input, onProviderDiagnostics }) {
+  body.input = input;
+  delete body.previous_response_id;
+  body.store = false;
+  if (context?.capabilities?.nativeReasoningState && validOrigin(context.origin) && requestOwner(identity)) {
+    body.include = [...new Set([...(Array.isArray(body.include) ? body.include.filter(v => typeof v === 'string') : []), 'reasoning.encrypted_content'])];
+  } else if (Array.isArray(body.include)) {
+    body.include = body.include.filter(item => item !== 'reasoning.encrypted_content');
+    if (!body.include.length) delete body.include;
+  }
+  delete body.prompt_cache_key;
+  const key = context?.capabilities?.promptCaching && createPromptCacheKey(identity, context);
+  if (key) body.prompt_cache_key = key;
+  if (context?.capabilities?.parallelToolCalls) {
+    // Capability permits parallel calls; it must not override an explicit opt-out.
+    if (body.parallel_tool_calls === undefined) body.parallel_tool_calls = true;
+  } else delete body.parallel_tool_calls;
+  onProviderDiagnostics?.({ ...context?.diagnostics, nativeReasoningState: Boolean(body.include?.includes('reasoning.encrypted_content')),
+    promptCaching: key ? 'sent-unverified' : 'not-sent' });
+}
+
+/** At most three cache breakpoints. Never modifies signed assistant blocks. */
+export function applyAnthropicCaching(body, context, onProviderDiagnostics) {
+  // Own the policy after extraBody: do not mix automatic/long-TTL caching or
+  // inherit caller breakpoints on unknown translation endpoints.
+  delete body.cache_control;
+  const withoutCache = block => {
+    if (!block || typeof block !== 'object') return block;
+    const { cache_control, ...rest } = block;
+    return rest;
+  };
+  if (Array.isArray(body.system)) body.system = body.system.map(withoutCache);
+  if (Array.isArray(body.tools)) body.tools = body.tools.map(withoutCache);
+  if (Array.isArray(body.messages)) body.messages = body.messages.map(message => ({ ...message,
+    content: Array.isArray(message.content) ? message.content.map(block => {
+      // Signed native blocks are immutable (and never eligible for caching).
+      return ['thinking', 'redacted_thinking'].includes(block?.type) ? block : withoutCache(block);
+    }) : message.content,
+  }));
+  let sent = false;
+  if (context?.capabilities?.promptCaching && validOrigin(context.origin)) {
+    if (typeof body.system === 'string' && body.system) body.system = [{ type: 'text', text: body.system }];
+    if (Array.isArray(body.system) && body.system.length) {
+      body.system[body.system.length - 1] = { ...body.system.at(-1), cache_control: { type: 'ephemeral' } };
+      sent = true;
+    }
+    if (body.tools?.length) {
+      body.tools[body.tools.length - 1] = { ...body.tools.at(-1), cache_control: { type: 'ephemeral' } };
+      sent = true;
+    }
+    // Latest complete user/tool_result boundary, not every growing message.
+    for (let index = (body.messages?.length || 0) - 1; index >= 0; index--) {
+      const message = body.messages[index];
+      if (message.role !== 'user') continue;
+      if (typeof message.content === 'string' && message.content) message.content = [{ type: 'text', text: message.content }];
+      const last = Array.isArray(message.content) ? message.content.at(-1) : null;
+      if (!['text', 'tool_result'].includes(last?.type)) continue;
+      message.content[message.content.length - 1] = { ...last, cache_control: { type: 'ephemeral' } };
+      sent = true;
+      break;
+    }
+  }
+  onProviderDiagnostics?.({ ...context?.diagnostics, promptCaching: sent ? 'sent-unverified' : 'not-sent' });
+}
+
+export function reasoningUsage(usage, protocol) {
+  const value = protocol === 'anthropic' ? usage?.output_tokens_details?.thinking_tokens : usage?.output_tokens_details?.reasoning_tokens;
+  return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? { reasoningTokens: value } : {};
+}

package/yeaft/llm/router.js

@@ -30,6 +30,7 @@ import {
   isGitHubCopilotProvider,
   normalizeKnownProviderForRuntime,
 } from './known-providers.js';
+import { createProviderContext } from './provider-state.js';
 import { pairSanitize } from '../pair-sanitize.js';
 
 /**
@@ -46,6 +47,7 @@ export function normalizeModelEntry(entry) {
   }
   if (entry && typeof entry === 'object' && typeof entry.id === 'string' && entry.id) {
     const out = { id: entry.id };
+    if (entry.capabilities && typeof entry.capabilities === 'object') out.capabilities = { ...entry.capabilities };
     if (typeof entry.protocol === 'string' && entry.protocol) {
       out.protocol = entry.protocol;
     }
@@ -643,6 +645,11 @@ export class AdapterRouter extends LLMAdapter {
     while (true) {
       const resolved = await this.#resolveAdapter(params.model, dispatchSnapshot);
       const provider = this.#getProviderForModel(params.model, dispatchSnapshot);
+      const providerContext = createProviderContext({ protocol: resolved.protocol, baseUrl: provider?.baseUrl,
+        providerId: provider?.name, credentialScopeId: provider?.credentialScopeId,
+        staticApiKey: provider?.credentialProvider ? undefined : provider?.apiKey, model: resolved.modelId,
+        capabilities: { ...provider?.capabilities, ...resolved.entry?.capabilities },
+      });
       const effortContext = {
         protocol: resolved.protocol,
         supportsEffort: resolved.entry?.supportsEffort,
@@ -653,7 +660,7 @@ export class AdapterRouter extends LLMAdapter {
       const filtered = filterEffortForModel({ ...params, model: resolved.modelId }, resolved);
       const sanitized = sanitizeMessagesForWire(filtered);
       try {
-        yield* resolved.adapter.stream({ ...sanitized, model: resolved.modelId, effortContext, rawExchangeMaxBytes: params.rawExchangeMaxBytes });
+        yield* resolved.adapter.stream({ ...sanitized, model: resolved.modelId, effortContext, providerContext, rawExchangeMaxBytes: params.rawExchangeMaxBytes });
         return;
       } catch (err) {
         this.#annotateAuthError(err, provider, params.model);
@@ -676,6 +683,11 @@ export class AdapterRouter extends LLMAdapter {
     while (true) {
       const resolved = await this.#resolveAdapter(params.model, dispatchSnapshot);
       const provider = this.#getProviderForModel(params.model, dispatchSnapshot);
+      const providerContext = createProviderContext({ protocol: resolved.protocol, baseUrl: provider?.baseUrl,
+        providerId: provider?.name, credentialScopeId: provider?.credentialScopeId,
+        staticApiKey: provider?.credentialProvider ? undefined : provider?.apiKey, model: resolved.modelId,
+        capabilities: { ...provider?.capabilities, ...resolved.entry?.capabilities },
+      });
       const effortContext = {
         protocol: resolved.protocol,
         supportsEffort: resolved.entry?.supportsEffort,
@@ -686,7 +698,7 @@ export class AdapterRouter extends LLMAdapter {
       const filtered = filterEffortForModel({ ...params, model: resolved.modelId }, resolved);
       const sanitized = sanitizeMessagesForWire(filtered);
       try {
-        return await resolved.adapter.call({ ...sanitized, model: resolved.modelId, effortContext });
+        return await resolved.adapter.call({ ...sanitized, model: resolved.modelId, effortContext, providerContext });
       } catch (err) {
         this.#annotateAuthError(err, provider, params.model);
         if (err?.statusCode !== 401 || refreshedCredential

package/yeaft/llm/usage-accounting.js

@@ -30,6 +30,8 @@ export function normalizeTokenUsage(usage = {}) {
     outputTokens,
     cacheReadTokens,
     cacheWriteTokens,
+    ...(typeof usage.reasoningTokens === 'number' && Number.isFinite(usage.reasoningTokens) && usage.reasoningTokens >= 0
+      ? { reasoningTokens: usage.reasoningTokens } : {}),
     totalTokens: explicitTotal || inputTokens + outputTokens + cacheInputTokens,
   };
 }
@@ -41,6 +43,7 @@ function addUsage(total, usage) {
   total.cacheReadTokens += normalized.cacheReadTokens;
   total.cacheWriteTokens += normalized.cacheWriteTokens;
   total.totalTokens += normalized.totalTokens;
+  if (normalized.reasoningTokens !== undefined) total.reasoningTokens = (total.reasoningTokens || 0) + normalized.reasoningTokens;
 }
 
 /**

package/yeaft/models.js

@@ -694,6 +694,7 @@ export function normalizeProviderModels(provider) {
     }
     if (entry && typeof entry === 'object' && typeof entry.id === 'string' && entry.id.trim()) {
       const norm = { id: entry.id.trim() };
+      if (entry.capabilities && typeof entry.capabilities === 'object') norm.capabilities = { ...entry.capabilities };
       const ctx = coercePositiveInt(entry.contextWindow);
       const max = coercePositiveInt(entry.maxOutput);
       if (ctx !== undefined) norm.contextWindow = ctx;
@@ -731,8 +732,10 @@ export function serializeModelForPersistence(entry) {
   const proto = typeof entry.protocol === 'string' && entry.protocol.trim()
     ? entry.protocol.trim()
     : undefined;
-  if (ctx === undefined && max === undefined && proto === undefined) return entry.id;
+  const capabilities = entry.capabilities && typeof entry.capabilities === 'object' ? { ...entry.capabilities } : undefined;
+  if (ctx === undefined && max === undefined && proto === undefined && capabilities === undefined) return entry.id;
   const obj = { id: entry.id };
+  if (capabilities !== undefined) obj.capabilities = capabilities;
   if (ctx !== undefined) obj.contextWindow = ctx;
   if (max !== undefined) obj.maxOutput = max;
   if (proto !== undefined) obj.protocol = proto;

package/yeaft/snapshot-filter.js

@@ -76,6 +76,7 @@ export function filterSnapshotForVp(snapshot, vpId) {
         const copy = { ...m };
         delete copy.toolCalls;
         delete copy.thinkingBlocks;
+        delete copy.providerState;
         out.push(copy);
       }
       continue;

package/yeaft/sub-agent/output-log.js

@@ -36,6 +36,7 @@
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
+import { snapshotEffortDecision } from '../effort.js';
 
 const DEFAULT_DIR = path.join(os.homedir(), '.yeaft', 'sub-agents');
 const MAX_BYTES = 2 * 1024 * 1024;      // 2 MiB before rotation
@@ -204,6 +205,9 @@ function serialize(evt) {
       ? evt.error
       : (evt.error.message || String(evt.error));
   }
+  if (evt.parentEffortDecision && (evt.type === 'sub_agent_spawned' || evt.type === 'sub_agent_effort_snapshot')) {
+    out.parentEffortDecision = snapshotEffortDecision(evt.parentEffortDecision);
+  }
   if (evt.status) out.status = evt.status;
   if (typeof evt.tokens === 'number') out.tokens = evt.tokens;
   return out;

package/yeaft/sub-agent/prompt-queue.js

@@ -1,3 +1,5 @@
+import { snapshotEffortDecision } from '../effort.js';
+
 /**
  * Queue a sub-agent continuation with the Project context that is authoritative
  * for the parent turn which submitted it. Keeping the snapshot on the queue
@@ -12,6 +14,7 @@ export function enqueueSubAgentPrompt(agent, prompt, projectContext = {}) {
   if (!Array.isArray(agent.pendingPrompts)) agent.pendingPrompts = [];
   agent.pendingPrompts.push({
     prompt,
+    parentEffortDecision: snapshotEffortDecision(projectContext.parentEffortDecision),
     projectSessionIds: Array.isArray(projectContext.projectSessionIds)
       ? projectContext.projectSessionIds.slice()
       : [],

package/yeaft/sub-agent/runner.js

@@ -36,6 +36,7 @@
  */
 
 import { Engine } from '../engine.js';
+import { snapshotEffortDecision } from '../effort.js';
 import { SubAgentToolRegistry, resolveSubAgentBudget, createExecutionStats } from './execution-control.js';
 import { getPersona } from '../personas.js';
 import { buildSpawnedPreamble } from './spawned-prompt.js';
@@ -150,6 +151,8 @@ export function startSubAgent(agent, deps = {}) {
   if (!agent || typeof agent !== 'object') return;
   if (agent.__driverStarted) return; // idempotent
   agent.__driverStarted = true;
+  // Re-freeze restored JSON snapshots; never consult live parent config here.
+  agent.parentEffortDecision = snapshotEffortDecision(agent.parentEffortDecision);
 
   let subEngine = null;
   let outputLog = null;
@@ -200,7 +203,7 @@ export function startSubAgent(agent, deps = {}) {
     if (agent.taskId && deps.taskManager && agent.parentSessionId) {
       try { deps.taskManager.setTaskLogPath(agent.parentSessionId, agent.taskId, agent.outputFile); } catch { /* ignore */ }
     }
-    outputLog.write({ type: 'sub_agent_spawned', agentId: agent.id, agentName: agent.name, mission: agent.mission || agent.task || '' });
+    outputLog.write({ type: 'sub_agent_spawned', agentId: agent.id, agentName: agent.name, mission: agent.mission || agent.task || '', parentEffortDecision: agent.parentEffortDecision });
 
     // Compose the system-prompt-overlay we want injected.
     const preamble = buildSpawnedPreamble({
@@ -357,6 +360,7 @@ async function driveSubAgent(agent, subEngine, vpPersona, deps) {
     if (typeof entry === 'string') {
       return {
         prompt: entry,
+        parentEffortDecision: snapshotEffortDecision(agent.parentEffortDecision),
         projectSessionIds: Array.isArray(deps.projectSessionIds)
           ? deps.projectSessionIds.slice()
           : [],
@@ -371,6 +375,7 @@ async function driveSubAgent(agent, subEngine, vpPersona, deps) {
     if (!entry || typeof entry !== 'object' || typeof entry.prompt !== 'string') return null;
     return {
       prompt: entry.prompt,
+      parentEffortDecision: snapshotEffortDecision(entry.parentEffortDecision ?? agent.parentEffortDecision),
       projectSessionIds: Array.isArray(entry.projectSessionIds)
         ? entry.projectSessionIds.slice()
         : [],
@@ -389,6 +394,7 @@ async function driveSubAgent(agent, subEngine, vpPersona, deps) {
     if (agent.mission && !agent.__missionSeeded) {
       agent.pendingPrompts.push({
         prompt: agent.mission,
+        parentEffortDecision: agent.parentEffortDecision,
         projectSessionIds: Array.isArray(deps.projectSessionIds)
           ? deps.projectSessionIds.slice()
           : [],
@@ -454,13 +460,18 @@ async function driveSubAgent(agent, subEngine, vpPersona, deps) {
       const priorUsageTokens = agent.usage?.tokens || 0;
       let turnUsageTokens = 0;
       try {
+        agent.activeParentEffortDecision = queuedPrompt.parentEffortDecision;
+        emit({ type: 'sub_agent_effort_snapshot', parentEffortDecision: queuedPrompt.parentEffortDecision });
         const stream = subEngine.query({
           prompt: queuedPrompt.prompt,
           messages: agent.engineMessages,
           signal: agent.abortController?.signal,
-          scenario: 'chat',
+          scenario: 'sub_agent',
+          isSubAgent: true,
+          parentEffortDecision: queuedPrompt.parentEffortDecision,
           vpPersona,
           sessionId: agent.parentSessionId || deps.parentSessionId || null,
+          threadId: agent.id,
           // SpawnAgent records the caller-provided cwd on the agent. Thread it
           // into the child Engine just like a parent query's workDir so child
           // file tools resolve relative paths in the requested workspace.

package/yeaft/tools/agent.js

@@ -28,6 +28,7 @@ import { resolveSubAgentBudget } from '../sub-agent/execution-control.js';
 import { STATUS, isTerminalAgentStatus } from '../sub-agent/status.js';
 import { diagnoseAgentLiveness, makeLiveness } from '../sub-agent/liveness.js';
 import { TASK_RESULT_DELIVERY } from '../tasks/store.js';
+import { captureParentEffortDecision } from '../effort.js';
 
 /** In-memory sub-agent registry. */
 const agents = new Map();
@@ -407,6 +408,8 @@ liveness，不要盲目循环。`
       expected_output: spec.expected_output,
       persona: spec.persona,
       personaData: persona || null,
+      // Capture at the tool boundary, before fire-and-forget startup can yield.
+      parentEffortDecision: captureParentEffortDecision(ctx),
       budget: spec.budget,
       cwd: cwd || ctx?.cwd || process.cwd(),
       status: STATUS.CREATED,

package/yeaft/tools/send-message.js

@@ -8,6 +8,7 @@
 import { defineTool } from './types.js';
 import { agentBelongsToCaller, getAgentRegistry } from './agent.js';
 import { enqueueSubAgentPrompt } from '../sub-agent/prompt-queue.js';
+import { captureParentEffortDecision } from '../effort.js';
 import { isTerminalAgentStatus, isPromptableAgentStatus, STATUS, describeAgentStatus } from '../sub-agent/status.js';
 
 export default defineTool({
@@ -117,6 +118,7 @@ stale/stalled，否则必须使用更大的有界 timeout 再次调用 WaitAgent
     // Queue as a pending prompt the driver will pull. This wakes the
     // driver out of its idle wait and starts a new turn.
     enqueueSubAgentPrompt(agent, message, {
+      parentEffortDecision: captureParentEffortDecision(ctx),
       projectSessionIds: ctx?.parentEngineDeps?.projectSessionIds,
       projectLabel: ctx?.parentEngineDeps?.projectLabel,
       projectInstruction: ctx?.parentEngineDeps?.projectInstruction,

package/yeaft/web-bridge.js

@@ -107,7 +107,7 @@ import { loadSessionConfig, normalizeSessionConfig, resolveSessionConfig, Sessio
 import { updateSessionConfig } from './sessions/session-crud.js';
 import { createCoordinator } from './sessions/coordinator.js';
 import { seedDefaultSession } from './sessions/seed-default.js';
-import { trimHistoryCacheForRuntime, trimSnapshotForBudget } from './history-window.js';
+import { trimHistoryCacheForRuntime } from './history-window.js';
 import { persistYeaftAttachments, attachmentsForPersistence, persistedAttachmentPreviewPayload } from './attachments.js';
 import { normalizeSessionMessageQuote, sessionMessageQuotePrompt } from './session-message-quote.js';
 import { ConversationStore, parseSeqFromId, projectVisibleSessionMessages } from './conversation/persist.js';
@@ -1442,14 +1442,13 @@ function projectPersistedToHistoryEntry(m, { includeReflections = false } = {})
   // in the runtime history owner so a restart does not create a tool arc with
   // its required thinking prefix missing. `filterSnapshotForVp` strips these
   // blocks from other VPs before any provider request.
-  if (Array.isArray(m.thinkingBlocks) && m.thinkingBlocks.length > 0) {
+  if (m.providerState) entry.providerState = m.providerState;
+  if (!m.providerState && Array.isArray(m.thinkingBlocks) && m.thinkingBlocks.length > 0) {
     const thinkingBlocks = m.thinkingBlocks
       .filter(tb => tb
-        && typeof tb.signature === 'string'
-        && tb.signature
         && (tb.redacted === true
           ? typeof tb.data === 'string'
-          : typeof tb.thinking === 'string'))
+          : typeof tb.thinking === 'string' && typeof tb.signature === 'string' && tb.signature))
       .map(tb => tb.redacted === true
         ? { redacted: true, data: tb.data, signature: tb.signature }
         : { thinking: tb.thinking, signature: tb.signature });
@@ -1462,13 +1461,14 @@ function projectPersistedToHistoryEntry(m, { includeReflections = false } = {})
   if (Array.isArray(m.attachments) && m.attachments.length > 0) entry.attachments = m.attachments;
   if (m.quote && typeof m.quote === 'object') entry.quote = m.quote;
   if (Array.isArray(m.todos)) entry.todos = m.todos;
-  if ((entry.role === 'user' || entry.role === 'assistant') && !entry.content && !entry.attachments && !entry.images && !entry.toolCalls && !entry.thinkingBlocks && !entry.todos && !entry.askUserResults) return null;
+  if ((entry.role === 'user' || entry.role === 'assistant') && !entry.content && !entry.attachments && !entry.images && !entry.toolCalls && !entry.thinkingBlocks && !entry.providerState && !entry.todos && !entry.askUserResults) return null;
   return entry;
 }
 
 function projectPersistedToVisibleHistoryEntry(m) {
   if (!isVisibleConversationRow(m)) return null;
   const entry = projectPersistedToHistoryEntry(m);
+  if (entry) { delete entry.providerState; delete entry.thinkingBlocks; }
   return entry && (entry.role === 'user' || entry.role === 'assistant') ? entry : null;
 }
 
@@ -2264,6 +2264,7 @@ async function routeEnvelopeToVpThread(sessionId, vpId, envelope) {
       related = false;
     } else {
       persistInboundMessageOnceByMsgId({
+        envelope,
         msgId: envelope?.msg?.id,
         text,
         sessionId,
@@ -2364,6 +2365,7 @@ function ensureDriverRunning(sessionId, vpId, threadId = 'main') {
           const isInternal = injectedBy === 'route_forward' || injectedBy === 'task_result';
           const senderVpId = isInternal ? (meta.senderVpId || envelope?.msg?.from || null) : null;
           persistInboundMessageOnceByMsgId({
+            envelope,
             msgId: envMsgId,
             text,
             sessionId,
@@ -5672,14 +5674,10 @@ async function runVpTurn({ prompt, promptParts = null, sessionId, vpId, threadId
         markEngineTerminal,
         markTurnEnd,
       };
-      // Always trim the snapshot before passing to engine.query. This is a
-      // deterministic provider-request window; it never calls an LLM or
-      // changes the persisted transcript. See `trimSnapshotForBudget`.
+      // The runtime cache is already bounded. Preserve its candidates here:
+      // Engine allocates recent + related turns together at each provider boundary.
       const trimStart = perfNowMs();
-      const trimmedMessages = trimSnapshotForBudget(baseSnapshot, {
-        messageTokenBudget: session?.config?.messageTokenBudget,
-        language: session?.config?.language,
-      });
+      const trimmedMessages = baseSnapshot;
       if (perfTraceId) {
         recordAgentPerfTrace(ctx.CONFIG, {
           traceId: perfTraceId,
@@ -5707,6 +5705,7 @@ async function runVpTurn({ prompt, promptParts = null, sessionId, vpId, threadId
         // each write a copy of the user message, and history replay
         // would render the user's prompt N times.
         userAlreadyPersisted: true,
+        currentUserMessage: inboundEnvelope?._persistedUserMessage || null,
         askUser: ({ question, options }, toolCall = null) => new Promise((resolve, reject) => {
           const requestId = `ask_${randomUUID()}`;
           const signal = vpAbort.signal;
@@ -6102,7 +6101,7 @@ function appendTurnToSessionHistory(sessionId, threadId, vpId, prompts, assistan
  * @returns {boolean} true if this call wrote the row, false if a prior
  *   call already wrote it (dedup hit).
  */
-function persistInboundMessageOnceByMsgId({ msgId, text, sessionId, threadId = 'main', role, speakerVpId, attachments, quote, internal = false, ts = null, clientMessageId = null }) {
+function persistInboundMessageOnceByMsgId({ envelope = null, msgId, text, sessionId, threadId = 'main', role, speakerVpId, attachments, quote, internal = false, ts = null, clientMessageId = null }) {
   if (!session?.conversationStore) return false;
   // No msgId means no dedup key — caller is responsible for guarding.
   // Both call sites already do (`if (envMsgId && text)` and
@@ -6111,8 +6110,11 @@ function persistInboundMessageOnceByMsgId({ msgId, text, sessionId, threadId = '
   // every call would mint a unique id and write a duplicate row, which
   // is the exact bug this helper exists to prevent.
   if (!msgId || typeof msgId !== 'string') return false;
-  const dedupKey = `${msgId}::${threadId || 'main'}`;
-  if (_persistedUserMsgIds.has(dedupKey)) return false;
+  const dedupKey = `${sessionId || ''}::${msgId}::${threadId || 'main'}`;
+  if (_persistedUserMsgIds.has(dedupKey)) {
+    if (envelope) envelope._persistedUserMessage = _persistedInboundRows.get(dedupKey) || null;
+    return false;
+  }
   // Mark BEFORE the empty-text bail. If a later same-id call arrives
   // with non-empty text (e.g. a route_forward injection that the first
   // caller passed in with empty text), the Set must already remember
@@ -6131,6 +6133,7 @@ function persistInboundMessageOnceByMsgId({ msgId, text, sessionId, threadId = '
       const v = iter.next();
       if (v.done) break;
       _persistedUserMsgIds.delete(v.value);
+      _persistedInboundRows.delete(v.value);
     }
   }
   try {
@@ -6170,7 +6173,9 @@ function persistInboundMessageOnceByMsgId({ msgId, text, sessionId, threadId = '
     if (ts && typeof ts === 'string') {
       record.time = ts;
     }
-    session.conversationStore.append(record);
+    const persisted = session.conversationStore.append(record);
+    _persistedInboundRows.set(dedupKey, persisted);
+    if (envelope) envelope._persistedUserMessage = persisted;
     return true;
   } catch (err) {
     console.warn(
@@ -6186,6 +6191,7 @@ function persistInboundMessageOnceByMsgId({ msgId, text, sessionId, threadId = '
  * starts with no stale msg-ids.
  */
 const _persistedUserMsgIds = new Set();
+const _persistedInboundRows = new Map();
 
 /**
  * Abort every in-flight VP turn and clear all queued envelopes across
@@ -7734,6 +7740,7 @@ export async function resetYeaftSession() {
   // History-dedup cache is keyed by per-session coordinator msg ids;
   // a fresh session resets the id space, so clear the cache too.
   _persistedUserMsgIds.clear();
+  _persistedInboundRows.clear();
   // vp-status: nuke the broker table too. Drivers above have just
   // been aborted, so any in-flight `settleIdle` from their outer
   // `finally` blocks is racing this reset. Clearing here makes the