@yeaft/webchat-agent 1.0.517 → 1.0.519

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.517",
+  "version": "1.0.519",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/workbench/file-ops.js

@@ -1,6 +1,6 @@
-import { readFile, writeFile, readdir, stat, unlink, rename, mkdir, rm, copyFile, cp } from 'fs/promises';
+import { readFile, realpath, writeFile, readdir, stat, unlink, rename, mkdir, rm, copyFile, cp } from 'fs/promises';
 import { existsSync } from 'fs';
-import { join, basename, dirname, extname } from 'path';
+import { join, basename, dirname, extname, isAbsolute, relative, resolve } from 'path';
 import { platform } from 'os';
 import ctx from '../context.js';
 import { resolveAndValidatePath, BINARY_EXTENSIONS } from './utils.js';
@@ -9,6 +9,19 @@ import { sendWorkbenchResult } from './request-routing.js';
 export const MAX_WORKBENCH_PREVIEW_BYTES = 20 * 1024 * 1024;
 export const WORKBENCH_FILE_CHUNK_BYTES = 1024 * 1024;
 
+async function validateResponseImagePath(filePath, workDir) {
+  const canonicalRoot = await realpath(resolve(workDir));
+  const canonicalFile = await realpath(resolveAndValidatePath(filePath, canonicalRoot));
+  const relativePath = relative(canonicalRoot, canonicalFile);
+  const outside = relativePath === '..'
+    || relativePath.startsWith(`..${platform() === 'win32' ? '\\' : '/'}`)
+    || isAbsolute(relativePath);
+  if (outside) throw new Error('Response image is outside the active workspace.');
+  const mimeType = BINARY_EXTENSIONS[extname(canonicalFile).toLowerCase()];
+  if (!mimeType?.startsWith('image/')) throw new Error('Response preview only supports image files.');
+  return canonicalFile;
+}
+
 async function reportFileTransferDropped(msg, base) {
   const errorResult = {
     ...base,
@@ -64,7 +77,9 @@ export async function handleReadFile(msg) {
   const workDir = msg.workDir || conv?.workDir || ctx.CONFIG.workDir;
 
   try {
-    const resolved = resolveAndValidatePath(filePath, workDir);
+    const resolved = msg.responseImagePreview
+      ? await validateResponseImagePath(filePath, workDir)
+      : resolveAndValidatePath(filePath, workDir);
     const ext = extname(resolved).toLowerCase();
     const mimeType = BINARY_EXTENSIONS[ext];
 

package/workbench/file-reference-resolver.js

@@ -1,5 +1,5 @@
-import { readdir, stat } from 'node:fs/promises';
-import { basename, join, relative, resolve } from 'node:path';
+import { readdir, realpath, stat } from 'node:fs/promises';
+import { basename, isAbsolute, join, relative, resolve } from 'node:path';
 import { platform } from 'node:os';
 import ctx from '../context.js';
 import { resolveAndValidatePath } from './utils.js';
@@ -10,15 +10,28 @@ const MAX_SCANNED_ENTRIES = 5000;
 const MAX_DEPTH = 10;
 const SKIP_DIRS = new Set(['.git', 'node_modules', '__pycache__', '.next', '.nuxt', 'dist', 'build', '.cache', 'bin', 'obj']);
 
-async function isFile(path) {
-  try { return (await stat(path)).isFile(); } catch { return false; }
-}
-
 function comparable(value) {
   const normalized = String(value || '').replaceAll('\\', '/');
   return platform() === 'win32' ? normalized.toLowerCase() : normalized;
 }
 
+function isInsideWorkspace(root, candidate) {
+  const relativePath = relative(root, candidate);
+  return relativePath === '' || (relativePath !== '..'
+    && !relativePath.startsWith(`..${platform() === 'win32' ? '\\' : '/'}`)
+    && !isAbsolute(relativePath));
+}
+
+async function canonicalWorkspaceFile(candidate, canonicalRoot) {
+  try {
+    const canonicalPath = await realpath(candidate);
+    if (!isInsideWorkspace(canonicalRoot, canonicalPath) || !(await stat(canonicalPath)).isFile()) return null;
+    return canonicalPath;
+  } catch {
+    return null;
+  }
+}
+
 async function findUniqueBasenames(workDir, requestedPaths, {
   maxScannedEntries = MAX_SCANNED_ENTRIES,
   maxDepth = MAX_DEPTH,
@@ -67,24 +80,30 @@ export async function resolveFileReferences(references, workDir, scanOptions) {
   const unique = [...new Set((Array.isArray(references) ? references : [])
     .map(value => typeof value === 'string' ? value.trim() : '')
     .filter(Boolean))].slice(0, MAX_REFERENCES);
-  const exactMatches = await Promise.all(unique.map(async requestedPath => {
-    const exactPath = resolveAndValidatePath(requestedPath, workDir);
-    return await isFile(exactPath) ? exactPath : null;
-  }));
-  const unresolved = unique.filter((_path, index) => !exactMatches[index]);
-  const basenameScan = await findUniqueBasenames(workDir, unresolved, scanOptions);
   const root = resolve(workDir);
+  const canonicalRoot = await realpath(root);
+  const exactCandidates = unique.map(requestedPath => resolveAndValidatePath(requestedPath, root));
+  const exactMatches = await Promise.all(exactCandidates.map(exactPath => (
+    canonicalWorkspaceFile(exactPath, canonicalRoot)
+  )));
+  const unresolved = unique.filter((_path, index) => (
+    !exactMatches[index] && isInsideWorkspace(root, exactCandidates[index])
+  ));
+  const basenameScan = await findUniqueBasenames(root, unresolved, scanOptions);
 
-  return unique.flatMap((requestedPath, index) => {
+  const resolvedEntries = await Promise.all(unique.map(async (requestedPath, index) => {
     const matches = basenameScan.matches.get(comparable(basename(requestedPath))) || [];
-    const fallbackPath = basenameScan.complete && matches.length === 1 ? matches[0] : null;
+    const fallbackPath = basenameScan.complete && matches.length === 1
+      ? await canonicalWorkspaceFile(matches[0], canonicalRoot)
+      : null;
     const matchedPath = exactMatches[index] || fallbackPath;
-    if (!matchedPath) return [];
-    return [{
+    if (!matchedPath) return null;
+    return {
       requestedPath,
-      resolvedPath: relative(root, matchedPath).replaceAll('\\', '/') || basename(matchedPath),
-    }];
-  });
+      resolvedPath: relative(canonicalRoot, matchedPath).replaceAll('\\', '/') || basename(matchedPath),
+    };
+  }));
+  return resolvedEntries.filter(Boolean);
 }
 
 export async function handleResolveFileReferences(msg) {

package/yeaft/conversation/persist.js

@@ -413,6 +413,9 @@ function serializeMessage(msg) {
   if (msg.model) fm.push(`model: ${msg.model}`);
   if (msg.effort) fm.push(`effort: ${msg.effort}`);
   if (Number.isInteger(msg.llmCallCount) && msg.llmCallCount > 0) fm.push(`llmCallCount: ${msg.llmCallCount}`);
+  for (const key of ['inputTokens', 'outputTokens', 'totalTokens', 'totalMs']) {
+    if (Number.isFinite(msg[key]) && msg[key] >= 0) fm.push(`${key}: ${Math.round(msg[key])}`);
+  }
   if (msg.turnNumber != null) fm.push(`turnNumber: ${msg.turnNumber}`);
   if (msg.toolCallId) fm.push(`toolCallId: ${msg.toolCallId}`);
   if (msg.eventType) fm.push(`eventType: ${msg.eventType}`);
@@ -564,6 +567,10 @@ export function parseMessage(raw) {
       case 'model': msg.model = value; break;
       case 'effort': msg.effort = value; break;
       case 'llmCallCount': msg.llmCallCount = parseInt(value, 10); break;
+      case 'inputTokens': msg.inputTokens = parseInt(value, 10); break;
+      case 'outputTokens': msg.outputTokens = parseInt(value, 10); break;
+      case 'totalTokens': msg.totalTokens = parseInt(value, 10); break;
+      case 'totalMs': msg.totalMs = parseInt(value, 10); break;
       case 'turnNumber': msg.turnNumber = parseInt(value, 10); break;
       case 'toolCallId': msg.toolCallId = value; break;
       case 'eventType': msg.eventType = value; break;

package/yeaft/debug-trace.js

@@ -332,10 +332,27 @@ function messagesPrefixLength(prevMessages, nextMessages) {
   return i;
 }
 
+function normalizeRequestInputBreakdown(value) {
+  if (!value || typeof value !== 'object') return null;
+  const normalized = {};
+  for (const key of [
+    'systemPromptTokens',
+    'historyMessageTokens',
+    'toolDefinitionTokens',
+    'currentTurnTokens',
+    'totalEstimatedTokens',
+  ]) {
+    const number = Number(value[key]);
+    normalized[key] = Number.isFinite(number) && number >= 0 ? Math.floor(number) : 0;
+  }
+  return normalized;
+}
+
 function buildRequestSnapshot(info = {}) {
   return {
     systemPrompt: String(info.systemPrompt || ''),
     messages: Array.isArray(info.messages) ? cloneJsonValue(info.messages) : [],
+    requestInputBreakdown: normalizeRequestInputBreakdown(info.requestInputBreakdown),
     rawRequest: info.rawRequest ?? null,
   };
 }
@@ -346,6 +363,7 @@ function buildRequestDelta(previous, next) {
       base: true,
       systemPrompt: next.systemPrompt || '',
       messages: Array.isArray(next.messages) ? next.messages : [],
+      requestInputBreakdown: next.requestInputBreakdown || null,
     };
     const rawRequestDelta = buildRawRequestDelta(null, next.rawRequest);
     if (rawRequestDelta) delta.rawRequestDelta = rawRequestDelta;
@@ -355,6 +373,9 @@ function buildRequestDelta(previous, next) {
   if ((next.systemPrompt || '') !== (previous.systemPrompt || '')) {
     delta.systemPrompt = next.systemPrompt || '';
   }
+  if (!stableEqual(next.requestInputBreakdown || null, previous.requestInputBreakdown || null)) {
+    delta.requestInputBreakdown = next.requestInputBreakdown || null;
+  }
   const prevMessages = Array.isArray(previous.messages) ? previous.messages : [];
   const nextMessages = Array.isArray(next.messages) ? next.messages : [];
   const prefix = messagesPrefixLength(prevMessages, nextMessages);
@@ -371,16 +392,18 @@ function buildRequestDelta(previous, next) {
 }
 
 function applyRequestDelta(previous, delta = {}) {
-  const base = previous || { systemPrompt: '', messages: [], rawRequest: null };
+  const base = previous || { systemPrompt: '', messages: [], requestInputBreakdown: null, rawRequest: null };
   const next = {
     systemPrompt: base.systemPrompt || '',
     messages: Array.isArray(base.messages) ? [...base.messages] : [],
+    requestInputBreakdown: normalizeRequestInputBreakdown(base.requestInputBreakdown),
     rawRequest: base.rawRequest ?? null,
   };
   if (delta.base) {
     const nextBase = {
       systemPrompt: delta.systemPrompt || '',
       messages: Array.isArray(delta.messages) ? delta.messages : [],
+      requestInputBreakdown: normalizeRequestInputBreakdown(delta.requestInputBreakdown),
       rawRequest: Object.prototype.hasOwnProperty.call(delta, 'rawRequest') ? delta.rawRequest : null,
     };
     if (Object.prototype.hasOwnProperty.call(delta, 'rawRequestDelta')) {
@@ -389,6 +412,9 @@ function applyRequestDelta(previous, delta = {}) {
     return nextBase;
   }
   if (typeof delta.systemPrompt === 'string') next.systemPrompt = delta.systemPrompt;
+  if (Object.prototype.hasOwnProperty.call(delta, 'requestInputBreakdown')) {
+    next.requestInputBreakdown = normalizeRequestInputBreakdown(delta.requestInputBreakdown);
+  }
   if (Array.isArray(delta.messages)) {
     next.messages = delta.messages;
   } else if (Array.isArray(delta.messagesAppend)) {
@@ -639,6 +665,7 @@ function expandTrace(trace) {
       // its actual source loop. Messages remain limited to the final loop.
       systemPrompt: '',
       messages: [],
+      requestInputBreakdown: snapshot.requestInputBreakdown || null,
       response: loop.response || '',
       toolCalls: Array.isArray(loop.toolCalls) ? loop.toolCalls : [],
       usage,
@@ -966,6 +993,7 @@ export class DebugTrace {
       trace.baseRequest = {
         systemPrompt: snapshot.systemPrompt,
         messages: Array.isArray(snapshot.messages) ? cloneJsonValue(snapshot.messages) : [],
+        requestInputBreakdown: snapshot.requestInputBreakdown,
         rawRequest: snapshot.rawRequest ?? null,
       };
     }

package/yeaft/engine.js

@@ -33,7 +33,13 @@ import {
   DEFAULT_PROJECT_DOC_MAX_BYTES,
 } from './sessions/project-doc.js';
 import { archiveToolResults } from './archive/tool-results.js';
-import { trimSnapshotForBudget, estimateMessageTokens, buildHistoryBuckets, fitProviderRequestToContext } from './history-window.js';
+import {
+  trimSnapshotForBudget,
+  estimateMessageTokens,
+  estimateMessagesTokens as estimateHistoryMessagesTokens,
+  buildHistoryBuckets,
+  fitProviderRequestToContext,
+} from './history-window.js';
 import { recallConversationTurns } from './conversation/history-index.js';
 import { parseSeqFromId } from './conversation/persist.js';
 import { isVpForeign, readContent as readScopeContent } from './memory/store.js';
@@ -413,6 +419,41 @@ export function estimateMessagesTokens(system, messages) {
   return total;
 }
 
+/**
+ * Estimate the input composition of the exact provider request copy. These are
+ * diagnostic estimates only; provider usage remains authoritative for billing.
+ * `historyMessageCount` is the final post-fit boundary between historical rows
+ * and current-turn rows.
+ *
+ * @param {{ systemPrompt?:string, messages?:Array<object>, historyMessageCount?:number, toolDefs?:Array<object> }} input
+ * @returns {{systemPromptTokens:number, historyMessageTokens:number, toolDefinitionTokens:number, currentTurnTokens:number, totalEstimatedTokens:number}}
+ */
+export function estimateProviderInputBreakdown({
+  systemPrompt = '',
+  messages = [],
+  historyMessageCount = 0,
+  toolDefs = [],
+} = {}) {
+  const source = Array.isArray(messages) ? messages : [];
+  const split = Math.max(0, Math.min(
+    source.length,
+    Number.isInteger(historyMessageCount) ? historyMessageCount : 0,
+  ));
+  const systemPromptTokens = approxTokens(typeof systemPrompt === 'string' ? systemPrompt : '');
+  const historyMessageTokens = estimateHistoryMessagesTokens(source.slice(0, split));
+  const currentTurnTokens = estimateHistoryMessagesTokens(source.slice(split));
+  const toolDefinitionTokens = Array.isArray(toolDefs) && toolDefs.length > 0
+    ? approxTokens(JSON.stringify(toolDefs))
+    : 0;
+  return {
+    systemPromptTokens,
+    historyMessageTokens,
+    toolDefinitionTokens,
+    currentTurnTokens,
+    totalEstimatedTokens: systemPromptTokens + historyMessageTokens + toolDefinitionTokens + currentTurnTokens,
+  };
+}
+
 export const GROUP_CONTEXT_PRESSURE_RATIO = 0.8;
 
 export function shouldAllowGroupReflection({
@@ -2814,6 +2855,8 @@ export class Engine {
       reportedSkillError = skillResolutionError;
       systemPrompt = buildCurrentSystemPrompt();
       if (executionPolicy?.prompt) systemPrompt += `\n\n${executionPolicy.prompt}`;
+      let requestDebugMessages = [];
+      let requestInputBreakdown = null;
 
       try {
         // Resolve effort per provider request so a saved Session effort takes
@@ -2941,6 +2984,7 @@ export class Engine {
           language: requestConfig.language,
         });
         wireMessages = fittedRequest.messages;
+        historyMessageCount = fittedRequest.meta.historyMessagesAfter;
         if (fittedRequest.meta.droppedHistoryMessages > 0
           || fittedRequest.meta.droppedCurrentMessages > 0
           || providerContextScale < 1) {
@@ -2996,6 +3040,17 @@ export class Engine {
           }
         }
 
+        // Freeze diagnostics only after every provider-only trim/sweep has
+        // completed, so debug describes the exact request copy rather than the
+        // durable transcript or an earlier preflight candidate.
+        requestDebugMessages = wireMessages.map(mapDebugMessage);
+        requestInputBreakdown = estimateProviderInputBreakdown({
+          systemPrompt,
+          messages: wireMessages,
+          historyMessageCount: Math.min(historyMessageCount, wireMessages.length),
+          toolDefs,
+        });
+
         // Capture only the provider route before the visible boundary. The
         // returned async iterable must not make a request or write durable
         // state; both the retry continuation and Work Center EngineTurn remain
@@ -3281,7 +3336,8 @@ export class Engine {
             latencyMs,
             responseText,
             systemPrompt,
-            messages: conversationMessages.map(mapDebugMessage),
+            messages: requestDebugMessages,
+            requestInputBreakdown,
             toolCalls: toolCalls.map(tc => ({ id: tc.id, name: tc.name, input: tc.input })),
             usage: {
               inputTokens: totalUsage.inputTokens || 0,
@@ -3549,7 +3605,8 @@ export class Engine {
           // error path too — failure traces are the most valuable for
           // hydration.
           systemPrompt,
-          messages: conversationMessages.map(mapDebugMessage),
+          messages: requestDebugMessages,
+          requestInputBreakdown,
           toolCalls: toolCalls.map(tc => ({ id: tc.id, name: tc.name, input: tc.input })),
           usage: {
             inputTokens: totalUsage.inputTokens || 0,
@@ -3575,7 +3632,8 @@ export class Engine {
           loopNumber: turnNumber,
           model: currentModel,
           systemPrompt,
-          messages: conversationMessages.map(mapDebugMessage),
+          messages: requestDebugMessages,
+          requestInputBreakdown,
           response: responseText || `Error: ${err.message}`,
           toolCalls: toolCalls.map(tc => ({ id: tc.id, name: tc.name, input: tc.input })),
           usage: {
@@ -3654,7 +3712,8 @@ export class Engine {
         // in-memory — without these columns the user can never see
         // history from before the panel was opened.
         systemPrompt,
-        messages: conversationMessages.map(mapDebugMessage),
+        messages: requestDebugMessages,
+        requestInputBreakdown,
         toolCalls: toolCalls.map(tc => ({ id: tc.id, name: tc.name, input: tc.input })),
         usage: {
           inputTokens: totalUsage.inputTokens || 0,
@@ -3749,7 +3808,8 @@ export class Engine {
         loopNumber: turnNumber,
         model: currentModel,
         systemPrompt,
-        messages: conversationMessages.map(mapDebugMessage),
+        messages: requestDebugMessages,
+        requestInputBreakdown,
         response: responseText,
         toolCalls: toolCalls.map(tc => ({ id: tc.id, name: tc.name, input: tc.input })),
         usage: {
@@ -4926,13 +4986,19 @@ export class Engine {
       // Loop back to call adapter again with tool results
     }
 
+    const totalMs = Date.now() - queryStartedAt;
+    const totalTokens = cumulativeInputTokens + cumulativeOutputTokens;
     // Store final provider metadata on the response row itself. Debug events
-    // are transient; the response card must retain the last successful model,
-    // effort, and call count after a reload.
+    // are transient; the response card must retain model, call count, token
+    // usage, and duration after a reload.
     const llmCountMessage = lastPersistedAssistantTextMessage || lastPersistedAssistantMessage;
     if (llmCountMessage && typeof this.#conversationStore?.update === 'function') {
       const updated = this.#conversationStore.update(llmCountMessage, {
         llmCallCount: turnNumber,
+        inputTokens: cumulativeInputTokens,
+        outputTokens: cumulativeOutputTokens,
+        totalTokens,
+        totalMs,
         ...(lastSuccessfulModel ? { model: lastSuccessfulModel } : {}),
         ...(lastSuccessfulEffort ? { effort: lastSuccessfulEffort } : {}),
       });
@@ -4948,8 +5014,10 @@ export class Engine {
       type: 'turn_close',
       turnId: queryTurnId,
       threadId,
-      totalMs: Date.now() - queryStartedAt,
-      totalTokens: cumulativeInputTokens + cumulativeOutputTokens,
+      totalMs,
+      inputTokens: cumulativeInputTokens,
+      outputTokens: cumulativeOutputTokens,
+      totalTokens,
       loopCount: turnNumber,
       ...(lastSuccessfulModel ? { model: lastSuccessfulModel } : {}),
       ...(lastSuccessfulEffort ? { effort: lastSuccessfulEffort } : {}),

package/yeaft/web-bridge.js

@@ -1408,6 +1408,9 @@ function projectPersistedToHistoryEntry(m, { includeReflections = false } = {})
   if (m.imageAssetAnchor) entry.imageAssetAnchor = true;
   if (m.responseKind === 'progress' || m.responseKind === 'result') entry.responseKind = m.responseKind;
   if (Number.isInteger(m.llmCallCount) && m.llmCallCount > 0) entry.llmCallCount = m.llmCallCount;
+  for (const key of ['inputTokens', 'outputTokens', 'totalTokens', 'totalMs']) {
+    if (Number.isFinite(m[key]) && m[key] >= 0) entry[key] = m[key];
+  }
   if (typeof m.model === 'string' && m.model) entry.model = m.model;
   if (typeof m.effort === 'string' && m.effort) entry.effort = m.effort;
   if (m.incomplete === true) entry.incomplete = true;
@@ -1551,6 +1554,10 @@ function projectVisibleHistoryChunkMessages(messages = []) {
       ...(m.speakerVpId ? { speakerVpId: m.speakerVpId } : {}),
       ...(m.responseKind === 'progress' || m.responseKind === 'result' ? { responseKind: m.responseKind } : {}),
       ...(Number.isInteger(m.llmCallCount) && m.llmCallCount > 0 ? { llmCallCount: m.llmCallCount } : {}),
+      ...(Number.isFinite(m.inputTokens) && m.inputTokens >= 0 ? { inputTokens: m.inputTokens } : {}),
+      ...(Number.isFinite(m.outputTokens) && m.outputTokens >= 0 ? { outputTokens: m.outputTokens } : {}),
+      ...(Number.isFinite(m.totalTokens) && m.totalTokens >= 0 ? { totalTokens: m.totalTokens } : {}),
+      ...(Number.isFinite(m.totalMs) && m.totalMs >= 0 ? { totalMs: m.totalMs } : {}),
       ...(typeof m.model === 'string' && m.model ? { model: m.model } : {}),
       ...(typeof m.effort === 'string' && m.effort ? { effort: m.effort } : {}),
       ...(m.incomplete === true ? { incomplete: true } : {}),
@@ -4568,6 +4575,8 @@ function handleEngineEvent(event, hctx) {
         turnId: event.turnId,
         threadId: event.threadId,
         totalMs: event.totalMs,
+        inputTokens: event.inputTokens,
+        outputTokens: event.outputTokens,
         totalTokens: event.totalTokens,
         loopCount: event.loopCount,
         ...(typeof event.model === 'string' && event.model ? { model: event.model } : {}),
@@ -5660,7 +5669,7 @@ async function runVpTurn({ prompt, promptParts = null, sessionId, vpId, threadId
     resetQueryTimer();
 
     // Emit turn_start so frontend can create the message block.
-    sendSessionEvent({ type: 'vp_turn_start', vpId, threadId, turnId, sessionId, title: thread?.title || '' }, envelope);
+    sendSessionEvent({ type: 'vp_turn_start', vpId, threadId, turnId, sessionId, title: thread?.title || '', ts: turnStartAt }, envelope);
     // vp-status: LLM call about to start, no text/tool yet → 'thinking'.
     try {
       getVpStatusBroker().transition({ sessionId, vpId, threadId, title: thread?.title || '', state: 'thinking', turnId, messageCount: thread?.messageIds?.length || 0 });