baychat 0.23.1 → 0.25.0

package/dist/relay/acp/runner.js

@@ -34,18 +34,59 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AcpSessionRunner = void 0;
+exports.acpContextObserver = acpContextObserver;
 exports.effectiveMode = effectiveMode;
+exports.looksLikeContextOverflow = looksLikeContextOverflow;
 const os = __importStar(require("os"));
 const runtime_binary_1 = require("../../runtime-binary");
 const spawn_env_1 = require("../spawn-env");
+const fresh_start_1 = require("../fresh-start");
 const agents_1 = require("./agents");
 const approval_1 = require("./approval");
+const context_report_1 = require("../../context-report");
 const client_1 = require("./client");
 const modes_1 = require("./modes");
 const policy_1 = require("./policy");
 const presence_1 = require("./presence");
 const prompt_1 = require("./prompt");
 const types_1 = require("./types");
+/**
+ * Turns one turn's ACP context updates into contract events for the room that woke it.
+ *
+ * A compaction is reported when it has COMPLETED, with the last number before it as
+ * `beforeTokens` and the first number after it as `afterTokens` — or without `afterTokens` when
+ * the turn ends first. There is no `compact_start` for ACP: `in_progress` may end in `failed`,
+ * and a start with no end would leave the app showing a tidy that never happened.
+ */
+function acpContextObserver(report, conversationId) {
+    let lastUsed;
+    let afterCompaction;
+    const base = { runtime: "acp", source: "exact", conversationId };
+    const endCompaction = (after) => {
+        if (!afterCompaction)
+            return;
+        const { before } = afterCompaction;
+        afterCompaction = undefined;
+        report({ ...base, event: "compact_end", ...(before !== undefined ? { beforeTokens: before } : {}), ...(after !== undefined ? { afterTokens: after } : {}) });
+    };
+    return {
+        onContext(update) {
+            if (update.kind === "fresh")
+                return report({ ...base, event: "session_start" });
+            if (update.kind === "compacted") {
+                afterCompaction = { before: lastUsed };
+                return;
+            }
+            const sample = (0, context_report_1.acpUsageFromUpdate)(update);
+            if (!sample)
+                return;
+            endCompaction(sample.used);
+            lastUsed = sample.used;
+            report({ ...base, event: "usage", used: sample.used, size: sample.size });
+        },
+        end: () => endCompaction(),
+    };
+}
 /**
  * How much power ONE turn gets.
  *
@@ -74,6 +115,15 @@ function isBayChatSend(call, mcpServer) {
         return true;
     return call.rawInput.providerIdentifier === mcpServer && call.rawInput.toolName === "send_message";
 }
+/**
+ * Does an ACP turn's failure read as "the context window is full"? The wordings of the providers
+ * behind dsh and Cursor (OpenAI-style `context_length_exceeded`, Anthropic's "prompt is too long",
+ * "maximum context length"), matched loosely: a false positive only offers a fresh start the
+ * owner asked for.
+ */
+function looksLikeContextOverflow(reason) {
+    return /context[_ ]length[_ ]exceeded|maximum context length|context window (is )?(full|exceeded)|prompt is too long|too many tokens/i.test(reason);
+}
 const RETRY_MAX_MS = 60_000;
 const errText = (err) => (err instanceof Error ? err.message : String(err));
 /**
@@ -90,6 +140,10 @@ class AcpSessionRunner {
     said = new Map();
     backoff = new Map();
     retryTimers = new Set();
+    /** A fresh start's first prompt, run as the session's next turn, alone (`freshStart`). */
+    freshTurns = new Map();
+    /** Sessions whose running turn a fresh start stopped: its messages wait, they are not lost. */
+    requeueOnStop = new Map();
     closed = false;
     constructor(deps) {
         this.deps = deps;
@@ -110,6 +164,24 @@ class AcpSessionRunner {
     reset(session) {
         this.deps.registry.setAcpSession(session, undefined);
     }
+    /**
+     * "Fresh start with a handoff" for an ACP session (fresh-start.ts): forget the ACP session, so
+     * the next prompt opens a new one, and make `first` — the note — that prompt, ALONE. A turn
+     * running now (the one that wrote the note, or a person's newer one) is stopped and its messages
+     * go back in the queue behind the note, never recorded lost — except this fresh start's own
+     * note request, which the fresh session must never be asked again.
+     */
+    freshStart(session, first, handoffId) {
+        this.deps.queue.discard(session, (m) => (0, fresh_start_1.isNoteRequestFor)(m, handoffId));
+        this.freshTurns.set(session, first);
+        const running = this.running.get(session);
+        if (running) {
+            this.requeueOnStop.set(session, handoffId);
+            running.abort();
+        }
+        this.reset(session);
+        this.kick(session);
+    }
     setMode(session, wanted) {
         const target = this.deps.registry.get(session);
         if (!target?.acp)
@@ -162,7 +234,10 @@ class AcpSessionRunner {
         for (;;) {
             if (this.closed)
                 return "closed";
-            const turn = this.deps.queue.take(session);
+            const first = this.freshTurns.get(session);
+            if (first)
+                this.freshTurns.delete(session);
+            const turn = first ? { addressed: [first], digest: { messages: [], omitted: 0 } } : this.deps.queue.take(session);
             if (!turn)
                 return "empty";
             let next;
@@ -256,6 +331,7 @@ class AcpSessionRunner {
             return answer.allowed ? "allow" : "reject";
         };
         const caller = (deps.caller ?? presence_1.deviceMcpCaller)(auth);
+        const context = acpContextObserver((event) => deps.reportContext?.(session, event), room);
         const abort = new AbortController();
         let typing;
         let stopGuard;
@@ -287,6 +363,7 @@ class AcpSessionRunner {
                         typing?.stop();
                 },
                 classifyError: (m) => row.classifyError(m),
+                onContext: context.onContext,
                 signal: abort.signal,
             }, { spawn: deps.spawn, log: deps.log, platform });
         }
@@ -294,6 +371,7 @@ class AcpSessionRunner {
             // Every exit — outcome or throw — ends typing and the guard and frees `/stop`, or `/stop` would lie.
             stopGuard?.();
             typing?.stop();
+            context.end();
             this.running.delete(session);
         }
         if (breach !== undefined) {
@@ -306,8 +384,22 @@ class AcpSessionRunner {
                 return "next";
             }
         }
+        // A fresh start stopped this turn: its messages wait behind the note (minus the note request).
+        const requeueFor = this.requeueOnStop.get(session);
+        if (requeueFor !== undefined) {
+            this.requeueOnStop.delete(session);
+            const keep = (m) => !(0, fresh_start_1.isNoteRequestFor)(m, requeueFor);
+            deps.queue.putBack(session, {
+                addressed: turn.addressed.filter(keep),
+                digest: { messages: turn.digest.messages.filter(keep), omitted: turn.digest.omitted },
+            });
+            deps.log(`acp: ${session} turn stopped for a fresh start — its messages wait for the fresh session`);
+            return "next";
+        }
         if (outcome.kind === "completed") {
-            deps.registry.setAcpSession(session, outcome.sessionId);
+            // A fresh start that landed while this turn ran has already forgotten the old session.
+            if (!this.freshTurns.has(session))
+                deps.registry.setAcpSession(session, outcome.sessionId);
             deps.onDelivered(session, turn.addressed);
             this.said.delete(session);
             this.backoff.delete(session);
@@ -336,6 +428,12 @@ class AcpSessionRunner {
         const named = reasons[outcome.cause];
         if (named)
             return drop(outcome.cause, named);
+        // A turn refused because the context is full: say so to BayChat, which tells the session's
+        // owner once (protocol 1.17 `overflow`). It starts nothing: a handoff note needs a turn the
+        // full session cannot take, so starting fresh is the owner's call from the memory sheet.
+        if (looksLikeContextOverflow(outcome.reason)) {
+            deps.reportContext?.(session, { runtime: "acp", source: "exact", event: "overflow", conversationId: room });
+        }
         // Unclassified: the raw reason can name paths on that computer, so the room gets a generic
         // line and the full (already redacted) reason goes to the log only (Ruling R29).
         deps.log(`acp: ${session} could not answer (${outcome.cause}) — ${outcome.reason}`);

package/dist/relay/acp/turn-queue.js

@@ -38,6 +38,9 @@ exports.acpQueuePath = acpQueuePath;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const config_1 = require("../../config");
+const project_brief_1 = require("../project-brief");
+const project_notes_1 = require("../project-notes");
+const context_notice_1 = require("../context-notice");
 const DEFAULT_CAPS = { digestMessages: 20, digestChars: 4_000, maxAddressed: 50 };
 function acpQueuePath() {
     return path.join((0, config_1.configDir)(), "acp-queue.json");
@@ -87,7 +90,17 @@ class AcpTurnQueue {
             }
             const rawOmitted = Number(value.omitted);
             const omitted = Number.isFinite(rawOmitted) && rawOmitted > 0 ? Math.floor(rawOmitted) : 0;
-            this.sessions.set(name, { addressed, digest, omitted });
+            const carried = value.carried && typeof value.carried === "object" ? value.carried : undefined;
+            const carriedNotes = parseCarriedNotes(value.carriedNotes);
+            const carriedNotice = (0, context_notice_1.contextNoticeFrom)(value.carriedNotice);
+            this.sessions.set(name, {
+                addressed,
+                digest,
+                omitted,
+                ...(carried ? { carried } : {}),
+                ...(carriedNotes ? { carriedNotes } : {}),
+                ...(carriedNotice ? { carriedNotice } : {}),
+            });
         }
     }
     add(session, batch) {
@@ -95,6 +108,21 @@ class AcpTurnQueue {
         let addressed = 0;
         let dropped = 0;
         for (const message of batch) {
+            const kept = state.carried?.[message.conversationId];
+            if (kept) {
+                delete state.carried[message.conversationId];
+                if (!message.projectBrief || kept.version >= message.projectBrief.version)
+                    message.projectBrief = kept;
+            }
+            const keptNotes = state.carriedNotes?.[message.conversationId];
+            if (keptNotes) {
+                delete state.carriedNotes[message.conversationId];
+                message.projectNotes = message.projectNotes ? (0, project_notes_1.mergeNotesDeltas)(keptNotes, message.projectNotes) : keptNotes;
+            }
+            if (state.carriedNotice) {
+                message.notice = (0, context_notice_1.laterNotice)(state.carriedNotice, message.notice);
+                delete state.carriedNotice;
+            }
             if (message.shouldRespond === true) {
                 if (state.addressed.length >= this.caps.maxAddressed)
                     dropped += 1;
@@ -115,7 +143,14 @@ class AcpTurnQueue {
         if (!state || state.addressed.length === 0)
             return undefined;
         const turn = { addressed: state.addressed, digest: { messages: state.digest, omitted: state.omitted } };
-        this.sessions.set(session, { addressed: [], digest: [], omitted: 0 });
+        this.sessions.set(session, {
+            addressed: [],
+            digest: [],
+            omitted: 0,
+            ...(state.carried ? { carried: state.carried } : {}),
+            ...(state.carriedNotes ? { carriedNotes: state.carriedNotes } : {}),
+            ...(state.carriedNotice ? { carriedNotice: state.carriedNotice } : {}),
+        });
         this.save();
         return turn;
     }
@@ -134,6 +169,35 @@ class AcpTurnQueue {
         this.sessions.delete(session);
         this.save();
     }
+    /**
+     * Forget the briefs, notes deltas and notice kept for this session: it started fresh, so they
+     * describe a memory it no longer has (the server re-sends the whole set). Waiting messages stay.
+     */
+    forgetCarried(session) {
+        const state = this.sessions.get(session);
+        if (!state || (!state.carried && !state.carriedNotes && !state.carriedNotice))
+            return;
+        delete state.carried;
+        delete state.carriedNotes;
+        delete state.carriedNotice;
+        this.save();
+    }
+    /**
+     * Remove waiting messages this predicate picks (a fresh start's own note request, which the
+     * fresh session must never be asked again). Returns how many.
+     */
+    discard(session, pick) {
+        const state = this.sessions.get(session);
+        if (!state)
+            return 0;
+        const before = state.addressed.length + state.digest.length;
+        state.addressed = state.addressed.filter((m) => !pick(m));
+        state.digest = state.digest.filter((m) => !pick(m));
+        const removed = before - state.addressed.length - state.digest.length;
+        if (removed > 0)
+            this.save();
+        return removed;
+    }
     state(session) {
         let s = this.sessions.get(session);
         if (!s)
@@ -143,8 +207,28 @@ class AcpTurnQueue {
     trimDigest(state) {
         const size = () => state.digest.reduce((n, m) => n + m.content.length, 0);
         while (state.digest.length > this.caps.digestMessages || (state.digest.length > 1 && size() > this.caps.digestChars)) {
-            state.digest.shift();
+            const dropped = state.digest.shift();
             state.omitted += 1;
+            // Its project brief is not dropped with it: the next message for that room carries it.
+            if (dropped.projectBrief && !(0, project_brief_1.carryBrief)(dropped.projectBrief, dropped.conversationId, [...state.digest, ...state.addressed])) {
+                const held = state.carried?.[dropped.conversationId];
+                if (!held || dropped.projectBrief.version >= held.version) {
+                    state.carried = { ...(state.carried ?? {}), [dropped.conversationId]: dropped.projectBrief };
+                }
+            }
+            // …and neither is its notes delta (project-notes.ts) — carried only FORWARD, onto a message
+            // at least as new (an addressed message can be older than the digest's oldest).
+            if (dropped.projectNotes && !(0, project_notes_1.carryNotes)(dropped.projectNotes, dropped, [...state.digest, ...state.addressed])) {
+                const held = state.carriedNotes?.[dropped.conversationId];
+                state.carriedNotes = {
+                    ...(state.carriedNotes ?? {}),
+                    [dropped.conversationId]: held ? (0, project_notes_1.mergeNotesDeltas)(held, dropped.projectNotes) : dropped.projectNotes,
+                };
+            }
+            // …nor BayChat's notice: onto the next message still waiting, else kept for the next one.
+            if (dropped.notice && !(0, context_notice_1.carryNotice)(dropped.notice, [...state.digest, ...state.addressed])) {
+                state.carriedNotice = (0, context_notice_1.laterNotice)(state.carriedNotice, dropped.notice);
+            }
         }
     }
     save() {
@@ -161,3 +245,15 @@ class AcpTurnQueue {
     }
 }
 exports.AcpTurnQueue = AcpTurnQueue;
+/** A persisted `carriedNotes` map, each delta re-parsed (a corrupt entry is dropped). */
+function parseCarriedNotes(raw) {
+    if (!raw || typeof raw !== "object")
+        return undefined;
+    const out = {};
+    for (const [conversationId, value] of Object.entries(raw)) {
+        const delta = (0, project_notes_1.notesDeltaFrom)(value);
+        if (delta)
+            out[conversationId] = delta;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}

package/dist/relay/codex-context.js

@@ -0,0 +1,242 @@
+"use strict";
+// How full a Codex session's context is, read from the log Codex writes anyway.
+//
+// Codex records every model call in its rollout (`~/.codex/sessions/<y>/<m>/<d>/rollout-*.jsonl`)
+// as an `event_msg` whose payload is `token_count`:
+//
+//   {"type":"event_msg","payload":{"type":"token_count","info":{
+//      "total_token_usage":{…13,242,298…},                       ← the whole thread: NEVER used
+//      "last_token_usage":{"input_tokens":59244,…,"total_tokens":59346},   ← what is in the window
+//      "model_context_window":258400}}}
+//
+// (shape from a real rollout, 2026-09-13), and a compaction as a top-level `{"type":"compacted"}`
+// line. The relay already knows each Codex session's thread id — it is how `codex queue` reaches
+// it — so it tails that thread's newest rollout, a few seconds behind, and reports.
+//
+// READ-ONLY, BOUNDED, AND NEVER IN THE WAY. The file is only ever read; a tick reads at most what
+// was appended since the last one (capped); a missing or unreadable rollout is a quiet "nothing
+// to report", said once in the log. Nothing here can delay or fail a delivery.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodexContextTailer = void 0;
+const fs = __importStar(require("fs"));
+const context_report_1 = require("../context-report");
+const resume_1 = require("./resume");
+/** On first sight of a rollout, how far back to look for the current number. */
+const PRIME_BYTES = 512 * 1024;
+/** Most bytes read in one tick; a burst beyond this is skipped to its last PRIME_BYTES. */
+const MAX_TICK_BYTES = 4 * 1024 * 1024;
+/** How often a session's rollout is looked up again (a resume writes a NEW rollout file). */
+const RESOLVE_EVERY_MS = 2 * 60_000;
+/** A compaction whose "after" number never arrives is still reported, without it. */
+const COMPACTION_AFTER_WAIT_MS = 60_000;
+const isRecord = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+class CodexContextTailer {
+    deps;
+    tails = new Map();
+    timer;
+    running = false;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    now() {
+        return (this.deps.now ?? Date.now)();
+    }
+    start(intervalMs = 5_000) {
+        if (this.timer)
+            return;
+        this.timer = setInterval(() => void this.tick(), intervalMs);
+        this.timer.unref?.();
+    }
+    stop() {
+        clearInterval(this.timer);
+        this.timer = undefined;
+    }
+    /** One pass over every Codex session. Never throws; never overlaps itself. */
+    async tick() {
+        if (this.running)
+            return;
+        this.running = true;
+        try {
+            const targets = this.deps.targets();
+            const live = new Set(targets.map((t) => t.session));
+            for (const session of [...this.tails.keys()])
+                if (!live.has(session))
+                    this.tails.delete(session);
+            for (const target of targets) {
+                try {
+                    await this.tickOne(target);
+                }
+                catch (err) {
+                    this.deps.log(`context: could not read ${target.session}'s Codex log: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+        finally {
+            this.running = false;
+        }
+    }
+    emit(session, event) {
+        const conversationId = this.deps.conversationFor?.(session);
+        this.deps.report(session, { runtime: "codex", source: "exact", ...(conversationId ? { conversationId } : {}), ...event });
+    }
+    async tickOne(target) {
+        const now = this.now();
+        let tail = this.tails.get(target.session);
+        if (tail && tail.threadId !== target.threadId) {
+            // `/new` (or a fresh join) gave this BayChat session another Codex thread: a new context.
+            this.tails.delete(target.session);
+            tail = undefined;
+            this.emit(target.session, { event: "session_start" });
+        }
+        if (!tail) {
+            tail = { threadId: target.threadId, offset: 0, remainder: "", resolvedAt: 0, primed: false };
+            this.tails.set(target.session, tail);
+        }
+        if (!tail.file || now - tail.resolvedAt >= RESOLVE_EVERY_MS) {
+            tail.resolvedAt = now;
+            const file = await (this.deps.findRollout ?? defaultFindRollout)(target.threadId);
+            if (!file) {
+                if (!tail.missingSaid)
+                    this.deps.log(`context: no Codex log found for ${target.session} (thread ${target.threadId}) — its context is not reported yet`);
+                tail.missingSaid = true;
+            }
+            else if (file !== tail.file) {
+                // A resumed thread writes a NEW rollout; follow it from its current end.
+                Object.assign(tail, { file, offset: 0, remainder: "", primed: false, missingSaid: false });
+            }
+        }
+        if (tail.compaction && now - tail.compaction.at >= COMPACTION_AFTER_WAIT_MS)
+            this.endCompaction(target.session, tail);
+        if (!tail.file)
+            return;
+        let size;
+        try {
+            size = (await fs.promises.stat(tail.file)).size;
+        }
+        catch {
+            tail.file = undefined; // gone: look it up again next tick
+            return;
+        }
+        if (size < tail.offset)
+            Object.assign(tail, { offset: 0, remainder: "", primed: false });
+        if (!tail.primed) {
+            // First sight: only the CURRENT number matters. History (old compactions) is not news.
+            const start = Math.max(0, size - PRIME_BYTES);
+            const text = await readRange(tail.file, start, size);
+            const lines = (start > 0 ? text.slice(text.indexOf("\n") + 1) : text).split("\n");
+            let latest = null;
+            for (const line of lines)
+                latest = parseTokenCount(line) ?? latest;
+            Object.assign(tail, { offset: size, remainder: "", primed: true });
+            if (latest) {
+                tail.lastUsed = latest.used;
+                this.emit(target.session, { event: "usage", used: latest.used, size: latest.size, autoCompactAt: (0, context_report_1.codexAutoCompactAt)(latest.size) });
+            }
+            return;
+        }
+        if (size === tail.offset)
+            return;
+        let from = tail.offset;
+        if (size - from > MAX_TICK_BYTES) {
+            from = size - PRIME_BYTES;
+            tail.remainder = "";
+        }
+        const text = tail.remainder + (await readRange(tail.file, from, size));
+        tail.offset = size;
+        const lines = text.split("\n");
+        tail.remainder = lines.pop() ?? ""; // an unfinished last line waits for the rest
+        for (const line of lines)
+            this.line(target.session, tail, line);
+    }
+    line(session, tail, line) {
+        if (!line.trim())
+            return;
+        if (line.includes('"compacted"') || line.includes("context_compacted")) {
+            const entry = safeParse(line);
+            const payloadType = isRecord(entry?.payload) ? entry.payload.type : undefined;
+            if (entry?.type === "compacted" || payloadType === "context_compacted") {
+                // One compaction may be written both ways; the first one wins.
+                if (!tail.compaction)
+                    tail.compaction = { before: tail.lastUsed, at: this.now() };
+                return;
+            }
+        }
+        const sample = parseTokenCount(line);
+        if (!sample)
+            return;
+        this.endCompaction(session, tail, sample.used);
+        tail.lastUsed = sample.used;
+        this.emit(session, { event: "usage", used: sample.used, size: sample.size, autoCompactAt: (0, context_report_1.codexAutoCompactAt)(sample.size) });
+    }
+    endCompaction(session, tail, after) {
+        if (!tail.compaction)
+            return;
+        const { before } = tail.compaction;
+        tail.compaction = undefined;
+        // No `trigger`: the rollout does not say whether the person asked for it.
+        this.emit(session, { event: "compact_end", ...(before !== undefined ? { beforeTokens: before } : {}), ...(after !== undefined ? { afterTokens: after } : {}) });
+    }
+}
+exports.CodexContextTailer = CodexContextTailer;
+function safeParse(line) {
+    try {
+        const v = JSON.parse(line);
+        return isRecord(v) ? v : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseTokenCount(line) {
+    if (!line.includes("token_count"))
+        return null;
+    const entry = safeParse(line);
+    return entry?.type === "event_msg" ? (0, context_report_1.codexUsageFromTokenCount)(entry.payload) : null;
+}
+async function readRange(file, start, end) {
+    const handle = await fs.promises.open(file, "r");
+    try {
+        const buf = Buffer.alloc(end - start);
+        await handle.read(buf, 0, buf.length, start);
+        return buf.toString("utf8");
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function defaultFindRollout(threadId) {
+    return (await (0, resume_1.codexRolloutById)(threadId, {}))?.file;
+}

package/dist/relay/compact-command.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMPACT_COMMAND = exports.sanitizeCompactFocus = exports.COMPACT_FOCUS_MAX = exports.COMPACT_TRIGGER = void 0;
+exports.parseCompactCommand = parseCompactCommand;
+exports.compactKeys = compactKeys;
+const compact_focus_1 = require("./compact-focus");
+Object.defineProperty(exports, "COMPACT_FOCUS_MAX", { enumerable: true, get: function () { return compact_focus_1.COMPACT_FOCUS_MAX; } });
+Object.defineProperty(exports, "sanitizeCompactFocus", { enumerable: true, get: function () { return compact_focus_1.sanitizeCompactFocus; } });
+/**
+ * `/compact [focus]` — tidy a session's context now, optionally saying what to keep.
+ *
+ * ── 🔒 THE ONE COMMAND WITH AN ARGUMENT, AND WHY IT IS SAFE TO HAVE ONE ─────────────────
+ *
+ * Every other session command obeys "the wire carries a command NAME, never keystrokes"
+ * (session-commands.ts). This one carries one line of text, because Claude Code's own
+ * `/compact` takes instructions ("/compact keep the API decisions") and a tidy without them
+ * throws away what the person cared about. So the text is allowed in, and caged — the cage is
+ * `compact-focus.ts`, a twin the API applies too when the app asks for a tidy — and it is typed
+ * LITERALLY (`send-keys -l`, via `typeIntoPane`, which refuses `^`, `\` and control characters
+ * again on its own). Anything outside the cage is refused, by reason, and nothing is typed.
+ * Only Claude Code takes a focus; Codex's `/compact` takes none (checked against codex-cli
+ * 0.154.0's command list), so a focus sent to Codex is refused rather than silently dropped.
+ */
+exports.COMPACT_TRIGGER = "/compact";
+exports.COMPACT_COMMAND = {
+    id: "compact",
+    trigger: exports.COMPACT_TRIGGER,
+    summary: `Tidy this session's context now (Claude Code, Codex). Claude Code takes a one-line focus: /compact keep the API decisions — letters, numbers, spaces and ${compact_focus_1.COMPACT_FOCUS_PUNCTUATION}, up to ${compact_focus_1.COMPACT_FOCUS_MAX} characters.`,
+};
+/**
+ * `/compact` or `/compact <focus>` → the parse; anything else → undefined (it is chat).
+ *
+ * The command word is matched exactly and case-insensitively, as the other commands are:
+ * "can you /compact please" and "/compacting" are sentences, not commands.
+ */
+function parseCompactCommand(text) {
+    const trimmed = text.trimStart();
+    if (trimmed.slice(0, exports.COMPACT_TRIGGER.length).toLowerCase() !== exports.COMPACT_TRIGGER)
+        return undefined;
+    // Trailing whitespace only: a SECOND line has non-space after its newline, so it survives
+    // this and is refused below.
+    const tail = trimmed.slice(exports.COMPACT_TRIGGER.length).trimEnd();
+    if (tail === "")
+        return { kind: "compact" };
+    // "/compacting" is a word, not the command: a separator must follow the trigger.
+    if (!/^\s/u.test(tail))
+        return undefined;
+    const checked = (0, compact_focus_1.sanitizeCompactFocus)(tail);
+    if (!checked.ok)
+        return { kind: "refused", reason: `/compact was not run: ${checked.reason}` };
+    return checked.focus ? { kind: "compact", focus: checked.focus } : { kind: "compact" };
+}
+/** What to type for this runtime, or why nothing can be. */
+function compactKeys(runtime, focus) {
+    if (runtime === "claude")
+        return { ok: true, keys: focus ? `${exports.COMPACT_TRIGGER} ${focus}` : exports.COMPACT_TRIGGER };
+    if (runtime === "codex") {
+        return focus
+            ? { ok: false, reason: "Codex's /compact takes no focus. Send /compact on its own to tidy it." }
+            : { ok: true, keys: exports.COMPACT_TRIGGER };
+    }
+    return { ok: false, reason: `/compact is only for Claude Code and Codex sessions; this one runs ${runtime}.` };
+}

package/dist/relay/compact-focus.attacks.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMPACT_FOCUS_ATTACKS = void 0;
+/**
+ * Focus texts BOTH the relay and the API must refuse — the injection attempts the cage in
+ * `compact-focus.ts` exists for. Each is what follows `/compact` in a message (a leading space
+ * included where a person would type one). A twin, byte-identical in
+ * `packages/cli/src/relay/` and `apps/api/src/lib/`; each side runs every entry through its own
+ * copy of `sanitizeCompactFocus`, and the parity test holds the two files together.
+ *
+ * It imports nothing (the two packages resolve imports differently), so the refusal codes are
+ * spelled out here; they are `CompactFocusRefusal`'s, checked by the tests that use them.
+ */
+exports.COMPACT_FOCUS_ATTACKS = [
+    { focus: " keep this\n/clear", code: "MULTILINE", reason: /single line/ },
+    { focus: " keep this\r\nrm -rf ~", code: "MULTILINE", reason: /single line/ },
+    { focus: "\nrm -rf ~", code: "MULTILINE", reason: /single line/ },
+    { focus: " keep\u2028this", code: "MULTILINE", reason: /single line/ },
+    { focus: " keep\u2029this", code: "MULTILINE", reason: /single line/ },
+    { focus: " \u001b[2J\u001b[31mred", code: "CONTROL", reason: /control or invisible/ },
+    { focus: " keep\tthis", code: "CONTROL", reason: /control or invisible/ },
+    { focus: " a\u0003b", code: "CONTROL", reason: /control or invisible/ },
+    { focus: " safe\u202Eesrever", code: "CONTROL", reason: /control or invisible/ },
+    { focus: " zero\u200Bwidth", code: "CONTROL", reason: /control or invisible/ },
+    { focus: " $(rm -rf ~)", code: "CHARACTER", reason: /"\$" is not allowed/ },
+    { focus: " `id`", code: "CHARACTER", reason: /"`" is not allowed/ },
+    { focus: " keep ^C", code: "CHARACTER", reason: /"\^" is not allowed/ },
+    { focus: " back\\slash", code: "CHARACTER", reason: /"\\" is not allowed/ },
+    { focus: " read @~/.ssh/id_rsa", code: "CHARACTER", reason: /"@" is not allowed/ },
+    { focus: " a | b", code: "CHARACTER", reason: /"\|" is not allowed/ },
+    { focus: " a > /etc/passwd", code: "CHARACTER", reason: /">" is not allowed/ },
+    { focus: " #memory", code: "CHARACTER", reason: /"#" is not allowed/ },
+    { focus: " {x}", code: "CHARACTER", reason: /"\{" is not allowed/ },
+    { focus: " /clear", code: "LEADING_SLASH", reason: /cannot start with \// },
+    { focus: ` ${"a".repeat(201)}`, code: "TOO_LONG", reason: /longer than 200/ },
+];