@youweichen/pi-harness 0.0.0-stage → 1.0.0

package/dist/server/text-sniff.js

@@ -0,0 +1,269 @@
+/**
+ * text-sniff — 文件预览相关的纯函数：扩展名分类、内容嗅探、文本解码
+ * （UTF-8 → GBK → latin1 回退）、十六进制视图、行数统计。
+ *
+ * 全部无副作用、不碰 fs —— 便于单元测试（tests/unit/text-sniff.test.ts）。
+ * 从 agent-service.ts 抽出，行为保持不变。
+ */
+const PREVIEW_IMAGE_EXTS = new Set([
+    "png",
+    "jpg",
+    "jpeg",
+    "gif",
+    "webp",
+    "svg",
+    "bmp",
+    "ico",
+    "avif",
+    "jfif",
+    "tif",
+    "tiff",
+]);
+const PREVIEW_VIDEO_EXTS = new Set([
+    "mp4",
+    "webm",
+    "mov",
+    "mkv",
+    "avi",
+    "m4v",
+    "ogv",
+    "mpg",
+    "mpeg",
+    "wmv",
+    "flv",
+]);
+const PREVIEW_TEXT_EXTS = new Set([
+    // code
+    "ts",
+    "tsx",
+    "js",
+    "jsx",
+    "mjs",
+    "cjs",
+    "jsm",
+    "es6",
+    "vue",
+    "svelte",
+    "py",
+    "pyw",
+    "ipynb",
+    "go",
+    "rs",
+    "c",
+    "h",
+    "cpp",
+    "hpp",
+    "cc",
+    "cxx",
+    "hh",
+    "csh",
+    "java",
+    "kt",
+    "kts",
+    "scala",
+    "sc",
+    "cs",
+    "fs",
+    "fsx",
+    "fsi",
+    "sh",
+    "bash",
+    "zsh",
+    "fish",
+    "bat",
+    "cmd",
+    "ps1",
+    "psd1",
+    "psm1",
+    "rb",
+    "php",
+    "pl",
+    "pm",
+    "tcl",
+    "lua",
+    "r",
+    "rmd",
+    "sql",
+    "swift",
+    "dart",
+    "groovy",
+    "gradle",
+    "tf",
+    "tfvars",
+    "hcl",
+    "nim",
+    "zig",
+    "v",
+    "vala",
+    "d",
+    "clj",
+    "cljs",
+    "cljc",
+    "edn",
+    "ex",
+    "exs",
+    "erl",
+    "hrl",
+    "ml",
+    "mli",
+    // markup / config / data
+    "json",
+    "jsonc",
+    "json5",
+    "jsonl",
+    "md",
+    "mdx",
+    "markdown",
+    "html",
+    "htm",
+    "xhtml",
+    "css",
+    "scss",
+    "sass",
+    "less",
+    "styl",
+    "xml",
+    "dtd",
+    "yaml",
+    "yml",
+    "toml",
+    "ini",
+    "cfg",
+    "conf",
+    "properties",
+    "env",
+    "log",
+    "txt",
+    "text",
+    "csv",
+    "tsv",
+    "lock",
+    "graphql",
+    "gql",
+    "proto",
+    "prisma",
+    "asm",
+    "s",
+]);
+/**
+ * Classify a file name into its preview category. Files with no extension
+ * (README, Makefile, .gitignore, …) are treated as text. Everything not in an
+ * allowlist (exe, jar, dll, zip, …) is "none" — never previewed.
+ */
+export function previewKind(name) {
+    const dot = name.lastIndexOf(".");
+    // A leading dot with nothing after it (.gitignore, .env) counts as no ext.
+    const ext = dot > 0 ? name.slice(dot + 1).toLowerCase() : "";
+    if (["db", "sqlite", "sqlite3", "db3"].includes(ext))
+        return "sqlite";
+    if (PREVIEW_IMAGE_EXTS.has(ext))
+        return "image";
+    if (PREVIEW_VIDEO_EXTS.has(ext))
+        return "video";
+    if (ext === "" || PREVIEW_TEXT_EXTS.has(ext))
+        return "text";
+    return "none";
+}
+/**
+ * Content sniff for the preview: any data that has no NUL bytes and no
+ * meaningful control-char ratio is treated as text — so files with unknown
+ * or absent extensions (jsonl, .log.1, …) still open as text. NULs catch
+ * zip/sqlite/png/… even when the extension claims text.
+ */
+export function looksLikeText(buf) {
+    if (buf.length === 0)
+        return true;
+    if (buf.includes(0))
+        return false;
+    const text = buf.toString("utf8");
+    let control = 0;
+    for (const ch of text) {
+        const c = ch.charCodeAt(0);
+        // Keep \t \n \r \f (and \b); everything else < 0x20 is binary-ish.
+        if (c < 0x20 && c !== 9 && c !== 10 && c !== 12 && c !== 13)
+            control++;
+    }
+    return control / Math.max(text.length, 1) < 0.02;
+}
+/** Decode bytes: strict UTF-8 first, falling back to GBK (Windows legacy
+ *  Chinese files), then latin1 as a last resort — so previews and inline
+ *  attachments never show mojibake for GBK/GB2312 encoded files. */
+export function decodeText(buf) {
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(buf);
+    }
+    catch {
+        try {
+            return new TextDecoder("gbk").decode(buf);
+        }
+        catch {
+            return buf.toString("latin1");
+        }
+    }
+}
+/** Sniff an image MIME type from magic bytes (extension is only a hint).
+ *  Returns null when the bytes don't look like a known raster format —
+ *  callers keep such files as plain path references. */
+export function sniffImageMime(buf, ext) {
+    if (buf.length >= 8 &&
+        buf[0] === 0x89 &&
+        buf[1] === 0x50 &&
+        buf[2] === 0x4e &&
+        buf[3] === 0x47) {
+        return "image/png";
+    }
+    if (buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) {
+        return "image/jpeg";
+    }
+    const head = buf.slice(0, 6).toString("ascii");
+    if (head === "GIF87a" || head === "GIF89a")
+        return "image/gif";
+    if (buf.length >= 12 &&
+        buf.slice(0, 4).toString("ascii") === "RIFF" &&
+        buf.slice(8, 12).toString("ascii") === "WEBP") {
+        return "image/webp";
+    }
+    if (buf.length >= 2 && buf[0] === 0x42 && buf[1] === 0x4d)
+        return "image/bmp";
+    // Unknown but raster-looking extension — trust the extension so existing
+    // image attachments keep working.
+    const known = {
+        ".png": "image/png",
+        ".jpg": "image/jpeg",
+        ".jpeg": "image/jpeg",
+        ".gif": "image/gif",
+        ".webp": "image/webp",
+        ".bmp": "image/bmp",
+    };
+    return known[ext] ?? null;
+}
+/** First few KB of binary data as a classic hex + ASCII dump (preview only). */
+export function hexDump(buf, maxBytes = 4096) {
+    const data = buf.subarray(0, Math.min(buf.length, maxBytes));
+    const rows = [];
+    for (let off = 0; off < data.length; off += 16) {
+        const chunk = data.subarray(off, off + 16);
+        const hex = [...chunk]
+            .map((b) => b.toString(16).padStart(2, "0"))
+            .join(" ");
+        const ascii = [...chunk]
+            .map((b) => (b >= 0x20 && b < 0x7f ? String.fromCharCode(b) : "."))
+            .join("");
+        rows.push(`${off.toString(16).padStart(8, "0")}  ${hex.padEnd(47, " ")}  ${ascii}`);
+    }
+    return rows.join("\n");
+}
+/** Count lines in a buffer; a trailing newline terminates the last line
+ *  instead of starting an empty one — matches the client preview's
+ *  split-based line numbering. */
+export function countLines(buf) {
+    if (buf.length === 0)
+        return 0;
+    const hasTrailingNewline = buf[buf.length - 1] === 10; /* \n */
+    let lines = 0;
+    for (let i = 0; i < buf.length; i++) {
+        if (buf[i] === 10)
+            lines++;
+    }
+    return hasTrailingNewline ? lines : lines + 1;
+}

package/dist/server/thinking-timing.js

@@ -0,0 +1,91 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+/** Per-conversation observed timings. Historical blocks without events stay unknown. */
+export class ThinkingTimings {
+    messages = new Map();
+    observe(timestamp, event, now = Date.now()) {
+        if (!event.type.startsWith("thinking_") || event.contentIndex === undefined)
+            return;
+        let blocks = this.messages.get(timestamp);
+        if (!blocks) {
+            blocks = new Map();
+            this.messages.set(timestamp, blocks);
+            if (this.messages.size > 256)
+                this.messages.delete(this.messages.keys().next().value);
+        }
+        const index = event.contentIndex;
+        let timing = blocks.get(index);
+        if (!timing && event.type !== "thinking_end") {
+            timing = { start: now };
+            blocks.set(index, timing);
+        }
+        if (timing && event.type === "thinking_end")
+            timing.end = now;
+    }
+    finish(timestamp, now = Date.now()) {
+        for (const timing of this.messages.get(timestamp)?.values() ?? [])
+            timing.end ??= now;
+    }
+    finishedDurations(timestamp) {
+        const result = {};
+        for (const [index, timing] of this.messages.get(timestamp) ?? []) {
+            if (timing.end !== undefined)
+                result[index] = Math.max(0, timing.end - timing.start);
+        }
+        return result;
+    }
+    annotate(message, timestamp, now = Date.now()) {
+        const blocks = this.messages.get(timestamp);
+        if (!message || !blocks)
+            return message;
+        return { ...message, content: message.content.map((block, index) => {
+                const timing = blocks.get(index);
+                return block.type === "thinking" && timing ? { ...block, durationMs: Math.max(0, (timing.end ?? now) - timing.start) } : block;
+            }) };
+    }
+}
+/** Preserve measured durations across server restarts without changing SDK transcripts. */
+export class ThinkingDurationStore {
+    filePath;
+    values;
+    constructor(filePath) {
+        this.filePath = filePath;
+        try {
+            const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+            this.values = parsed && typeof parsed === "object" && !Array.isArray(parsed)
+                ? parsed : {};
+        }
+        catch {
+            this.values = {};
+        }
+    }
+    key(sessionFile, timestamp) { return `${sessionFile}\u0000${timestamp}`; }
+    save(sessionFile, timestamp, durations) {
+        if (!sessionFile || !Number.isFinite(timestamp) || timestamp <= 0 || Object.keys(durations).length === 0)
+            return;
+        const key = this.key(sessionFile, timestamp);
+        this.values[key] = durations;
+        const keys = Object.keys(this.values);
+        for (const old of keys.slice(0, Math.max(0, keys.length - 2048)))
+            delete this.values[old];
+        try {
+            mkdirSync(dirname(this.filePath), { recursive: true });
+            const tmp = `${this.filePath}.${process.pid}.tmp`;
+            writeFileSync(tmp, JSON.stringify(this.values));
+            renameSync(tmp, this.filePath);
+        }
+        catch { /* Duration metadata must never interrupt a reply. */ }
+    }
+    annotate(message, sessionFile, timestamp) {
+        if (!message || !sessionFile || !Number.isFinite(timestamp))
+            return message;
+        const durations = this.values[this.key(sessionFile, timestamp)];
+        if (!durations || typeof durations !== "object")
+            return message;
+        return { ...message, content: message.content.map((block, index) => {
+                const durationMs = durations[index];
+                return block.type === "thinking" && block.durationMs === undefined && typeof durationMs === "number" && Number.isFinite(durationMs) && durationMs >= 0
+                    ? { ...block, durationMs } : block;
+            }) };
+    }
+}

package/dist/server/token-auth.js

@@ -0,0 +1,37 @@
+import { timingSafeEqual } from "node:crypto";
+/** Constant-time check that any candidate equals the expected shared token. */
+export function tokenMatches(candidates, expected) {
+    const want = Buffer.from(expected);
+    let ok = false;
+    for (const candidate of candidates) {
+        const got = Buffer.from(candidate);
+        // Length is not secret; equal-length buffers are compared in constant time.
+        if (got.length === want.length && timingSafeEqual(got, want))
+            ok = true;
+    }
+    return ok;
+}
+/** Cookie handed to the browser after a successful token login. */
+export function tokenCookie(token, secure) {
+    return `pi_web_token=${encodeURIComponent(token)}; Path=/; HttpOnly; SameSite=Strict; Max-Age=2592000${secure ? "; Secure" : ""}`;
+}
+/**
+ * Cookies are not scoped by port, so a cookie from an earlier run (other port or
+ * rotated token) would shadow a fresh login and make asset requests fail.
+ * Re-issue the cookie unless the browser already holds the current token.
+ */
+export function needsTokenCookie(cookieHeader, token) {
+    for (const part of (cookieHeader ?? "").split(";")) {
+        const [name, ...rest] = part.trim().split("=");
+        if (name !== "pi_web_token")
+            continue;
+        try {
+            if (decodeURIComponent(rest.join("=")) === token)
+                return false;
+        }
+        catch {
+            /* malformed value: replace it */
+        }
+    }
+    return true;
+}

package/dist/server/tool-output.js

@@ -0,0 +1,97 @@
+/** SDK tool updates are output snapshots; user_bash has a separate delta event. */
+export function toolOutputUpdate(partial) {
+    const content = partial?.content;
+    if (!Array.isArray(content))
+        return null;
+    const text = content.map((c) => c?.type === "text" && typeof c.text === "string" ? c.text : "").join("");
+    return { delta: text, replace: true };
+}
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
+import { tmpdir } from "node:os";
+/** Open only a transcript-referenced workspace file or native bash/MCP/codemode spill file. */
+export async function openToolOutput(cwd, path) {
+    const root = await realpath(cwd);
+    const candidate = resolve(cwd, path);
+    const canonical = await realpath(candidate);
+    const rel = relative(root, canonical);
+    const workspace = rel !== ".." && !rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) && !isAbsolute(rel);
+    const temporary = dirname(canonical) === await realpath(tmpdir()) && /^pi-(?:(?:bash|powershell)-[a-f0-9]{16}\.log|mcp-[a-f0-9]{16}\.[A-Za-z0-9]{1,8}|codemode-[a-f0-9]{16}\.(?:txt|png|jpg|gif|webp))$/.test(basename(canonical));
+    if (!workspace && !temporary)
+        throw Object.assign(new Error("Output access denied"), { code: "EACCES" });
+    if ((await lstat(candidate)).isSymbolicLink())
+        throw Object.assign(new Error("Output access denied"), { code: "EACCES" });
+    const handle = await open(canonical, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || await realpath(candidate) !== canonical)
+            throw Object.assign(new Error("Output access denied"), { code: "EACCES" });
+        return handle;
+    }
+    catch (error) {
+        await handle.close();
+        throw error;
+    }
+}
+import { createHash } from "node:crypto";
+import { StringDecoder } from "node:string_decoder";
+export const toolOutputId = (path) => createHash("sha256").update(path).digest("hex");
+/** Native 1.0.4 model-facing markers, not arbitrary paths from browser requests. */
+export function outputReferences(text) {
+    return [...text.matchAll(/\[Image saved to ([^\r\n]+?) \(image\/(?:png|jpeg|gif|webp), [^\r\n]*?\)\]|\[Binary resource [^\r\n]*? saved to ([^\r\n]+?)\]/g)].map(m => m[1] ?? m[2]);
+}
+/** Bound I/O as well as memory; the final partial line may contain complete markers. */
+async function scanOutputReferences(handle) {
+    const limit = 8 * 1024 * 1024;
+    const buffer = Buffer.alloc(64 * 1024), decoder = new StringDecoder("utf8");
+    const paths = [];
+    let position = 0, fragments = [];
+    while (position < limit) {
+        const { bytesRead } = await handle.read(buffer, 0, Math.min(buffer.length, limit - position), position);
+        if (!bytesRead)
+            break;
+        position += bytesRead;
+        const text = decoder.write(buffer.subarray(0, bytesRead));
+        let start = 0, newline;
+        while ((newline = text.indexOf("\n", start)) !== -1) {
+            fragments.push(text.slice(start, newline));
+            for (const path of outputReferences(fragments.join("")))
+                paths.push(path);
+            fragments = [];
+            start = newline + 1;
+        }
+        if (start < text.length)
+            fragments.push(text.slice(start));
+    }
+    // Do not flush an incomplete UTF-8 sequence at the scan limit.
+    for (const path of outputReferences(fragments.join("")))
+        paths.push(path);
+    return paths;
+}
+export async function toolOutputManifest(cwd, toolName, text, fullPath) {
+    const paths = new Set();
+    if (fullPath)
+        paths.add(fullPath);
+    const nativeResources = toolName === "codemode" || toolName === "read_mcp_resource" || /^mcp__.+?__.+$/.test(toolName);
+    if (nativeResources) {
+        for (const path of outputReferences(text))
+            paths.add(path);
+        if (fullPath) {
+            let handle;
+            try {
+                handle = await openToolOutput(cwd, fullPath);
+                for (const path of await scanOutputReferences(handle))
+                    paths.add(path);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            finally {
+                await handle?.close();
+            }
+        }
+    }
+    return [...paths].map(path => ({ id: toolOutputId(path), name: basename(path), path, default: path === fullPath }));
+}

package/dist/server/tool-text-incidents.js

@@ -0,0 +1,82 @@
+import { isToolTextContinuation, unexecutedToolText } from "./tool-text.js";
+const analyzed = new WeakMap();
+function analyze(message) {
+    const cached = analyzed.get(message);
+    if (cached)
+        return cached;
+    const text = message.content.map(b => b.type === "text" ? b.text : "").join("\n");
+    const value = { text, leak: unexecutedToolText(text) };
+    analyzed.set(message, value);
+    return value;
+}
+/** Replay native history without modifying it. IDs survive reload and branch replay. */
+export function toolTextIncidents(messages, streaming = false) {
+    const incidents = [];
+    let user, current;
+    let sinceReminderTool = false;
+    for (const [index, message] of messages.entries()) {
+        if (message.role === "user") {
+            if (current && isToolTextContinuation(messages, index)) {
+                current.reminders.push(message);
+                current.state = "reminding";
+                sinceReminderTool = false;
+            }
+            else {
+                user = message;
+                current = undefined;
+                sinceReminderTool = false;
+            }
+            continue;
+        }
+        if (message.role !== "assistant" || !user)
+            continue;
+        const hasTool = message.content.some(b => b.type === "toolCall");
+        if (hasTool) {
+            if (current)
+                current.state = "recovered";
+            sinceReminderTool = true;
+            continue;
+        }
+        const { text, leak } = analyze(message);
+        const stoppedByUser = message.stopReason === "aborted" || message.stopReason === "error";
+        if (leak && !stoppedByUser && !current) {
+            current = { incidentId: `tool-text:${user.entryId ?? user.id}:${message.entryId ?? message.id}`, user, first: message, last: message, reminders: [], leaks: [], outputs: [], state: "stopped" };
+            incidents.push(current);
+        }
+        if (!current)
+            continue;
+        if (!leak && !current.reminders.length)
+            current.state = "recovered";
+        if (leak)
+            current.leaks.push(message);
+        if (leak || current.reminders.length && !sinceReminderTool) {
+            current.last = message;
+            current.outputs.push({ message, raw: current.reminders.length ? text : leak?.raw ?? text, attempt: current.reminders.length });
+            current.state = stoppedByUser ? "recovered" : "stopped";
+        }
+    }
+    if (current && current.state !== "recovered")
+        current.state = streaming ? "reminding" : "stopped";
+    return { incidents, current };
+}
+const projected = new WeakMap();
+/** Optional wire metadata; cached objects preserve append-only snapshot identity. */
+export function projectToolTextMessages(messages) {
+    const metadata = new Map();
+    for (const incident of toolTextIncidents(messages).incidents) {
+        for (const output of incident.outputs)
+            metadata.set(output.message.id, { toolText: { incidentId: incident.incidentId, attempt: output.attempt } });
+        incident.reminders.forEach((message, index) => metadata.set(message.id, { origin: "auto-reminder", toolText: { incidentId: incident.incidentId, attempt: index + 1 } }));
+    }
+    return messages.map(message => {
+        const fields = metadata.get(message.id);
+        if (!fields)
+            return message;
+        const key = JSON.stringify(fields), cached = projected.get(message);
+        if (cached?.key === key)
+            return cached.message;
+        const value = { ...message, ...fields };
+        projected.set(message, { key, message: value });
+        return value;
+    });
+}

package/dist/server/tool-text.js

@@ -0,0 +1,67 @@
+export const TOOL_TEXT_CONTINUE_PROMPT = "你上一条回复里的工具调用是以普通文本输出的，没有被执行。请通过工具调用（不要写成文本）重新发起它，然后继续完成任务。";
+/**
+ * Detection of tool calls a model wrote as plain text instead of calling the
+ * tool (DSML or `<invoke>` markup on the text channel). Pure: shared by the
+ * server (auto-continue) and the web UI (recovery card). Detection only: text
+ * is never promoted to an executable call.
+ */
+/** Match protocol markers outside Markdown code, retaining offsets into the original. */
+export function maskMarkdownCode(text) {
+    let fence;
+    const masked = text.split("\n").map(line => {
+        const marker = /^ {0,3}(`{3,}|~{3,})(.*)$/.exec(line);
+        const inCode = !!fence || !!marker;
+        if (marker) {
+            if (!fence)
+                fence = { marker: marker[1][0], length: marker[1].length };
+            else if (marker[1][0] === fence.marker && marker[1].length >= fence.length && !marker[2].trim())
+                fence = undefined;
+        }
+        return inCode ? line.replace(/</g, "\0") : line;
+    }).join("\n");
+    return masked.replace(/(`+)([\s\S]*?)\1(?!`)/g, code => code.replace(/</g, "\0"));
+}
+const D = "(?:[｜|]DSML[｜|])?";
+const INVOKE_OPEN = new RegExp(`<${D}invoke\\s+name=["']([\\w.-]+)["']\\s*>`, "g");
+const PARAMETER = `<${D}parameter\\s+name=["'][\\w.-]+["'][^>]*>[\\s\\S]*?<\\/${D}parameter>`;
+const WRAPPER_CLOSE = `(?:<\\/${D}(?:tool_calls|function_calls)>\\s*)?`;
+/**
+ * The text ENDS with one or more parameters closed by </invoke>. Anchored at the
+ * end, so a call inside a closed code block (text ends with ```) or inline code
+ * (ends with `) never matches, and neither does a call followed by prose.
+ */
+const CALL_TAIL = new RegExp(`(?:${PARAMETER}\\s*)+<\\/${D}invoke>\\s*${WRAPPER_CLOSE}$`);
+const STRICT_START = new RegExp(`(?:<${D}(?:tool_calls|function_calls)>\\s*)?<${D}invoke\\s+name=["'][\\w.-]+["']\\s*>`);
+export function unexecutedToolText(text) {
+    const masked = maskMarkdownCode(text);
+    const start = STRICT_START.exec(masked);
+    if (start) {
+        const tail = masked.slice(start.index);
+        const closed = new RegExp(`<\\/${D}invoke>\\s*${WRAPPER_CLOSE}$`).test(tail);
+        const calls = [...tail.matchAll(new RegExp(`<${D}invoke\\s+name=["']([\\w.-]+)["']\\s*>([\\s\\S]*?)<\\/${D}invoke>`, "g"))];
+        if (closed && calls.length && calls.every(call => new RegExp(PARAMETER).test(call[2]))) {
+            return { before: text.slice(0, start.index).trimEnd(), raw: text.slice(start.index).trim(), tools: [...new Set(calls.map(call => call[1]))] };
+        }
+    }
+    // Fallback on the raw text: the call can still be recognised from its closing
+    // tail when the opening tag is masked (an unclosed ``` earlier in the reply) or
+    // was emitted elsewhere (inside leaked reasoning, or a separate thinking block).
+    const tail = CALL_TAIL.exec(text);
+    if (!tail)
+        return null;
+    const opens = [...text.matchAll(INVOKE_OPEN)];
+    const first = opens.find(open => open.index !== undefined && open.index < tail.index)?.index ?? tail.index;
+    const begin = Math.min(first, tail.index);
+    return { before: text.slice(0, begin).trimEnd(), raw: text.slice(begin).trim(), tools: [...new Set(opens.map(open => open[1]))] };
+}
+/** Recognize the persisted recovery exchange, including pre-fix sessions. This
+ * only preserves task projection; it never grants execution authorization. */
+export function isToolTextContinuation(messages, index) {
+    const message = messages[index], previous = messages[index - 1];
+    if (message?.role !== "user" || message.content.length !== 1 || message.content[0].type !== "text" || message.content[0].text !== TOOL_TEXT_CONTINUE_PROMPT)
+        return false;
+    if (previous?.role !== "assistant" || previous.stopReason === "aborted" || previous.stopReason === "error" || previous.content.some(block => block.type === "toolCall"))
+        return false;
+    const text = previous.content.map(block => block.type === "text" ? block.text : "").join("\n");
+    return !!unexecutedToolText(text);
+}