billion-context-pi 0.0.6 → 0.1.25

package/README.md

@@ -1,9 +1,9 @@
-# pai-acp
+# billion-context-pi
 
 [English](./README.md) | [中文](./README.zh-CN.md)
 
 <p align="center">
-<strong>Active Context Pruning</strong> for <a href="https://pi.dev">Pi</a>
+<strong>Billion-Context</strong> for <a href="https://pi.dev">Pi</a>
 <br />
 The model decides <em>when</em> and <em>what</em> to compress — not a hard limit.
 </p>
@@ -11,22 +11,22 @@ The model decides <em>when</em> and <em>what</em> to compress — not a hard lim
 ---
 
 <p align="center">
-<a href="https://www.npmjs.com/package/pai-acp"><img src="https://img.shields.io/npm/v/pai-acp.svg?style=flat-square" alt="npm"></a>
-<a href="https://github.com/ranxianglei/pai-acp/blob/master/LICENSE"><img src="https://img.shields.io/npm/l/pai-acp.svg?style=flat-square" alt="license"></a>
-<a href="https://github.com/ranxianglei/pai-acp"><img src="https://img.shields.io/badge/GitHub-ranxianglei%2Fpai--acp-181717?style=flat-square&logo=github" alt="GitHub"></a>
+<a href="https://www.npmjs.com/package/billion-context-pi"><img src="https://img.shields.io/npm/v/billion-context-pi.svg?style=flat-square" alt="npm"></a>
+<a href="https://github.com/ranxianglei/billion-context-pi/blob/master/LICENSE"><img src="https://img.shields.io/npm/l/billion-context-pi.svg?style=flat-square" alt="license"></a>
+<a href="https://github.com/ranxianglei/billion-context-pi"><img src="https://img.shields.io/badge/GitHub-ranxianglei%2Fbillion--context--pi-181717?style=flat-square&logo=github" alt="GitHub"></a>
 </p>
 
 <p align="center">
-<code>pi install npm:pai-acp</code>
+<code>pi install npm:billion-context-pi</code>
 </p>
 
 ---
 
 ## Why?
 
-When conversations get long, the model runs out of context. Most tools hard-truncate — silently dropping earlier messages. **ACP** gives the model a `compress` tool: the LLM decides **when** and **what** to compress into high-fidelity summaries, preserving critical details (file paths, decisions, error strings) while reclaiming context space.
+When conversations get long, the model runs out of context. Most tools hard-truncate — silently dropping earlier messages. **billion-context** gives the model a `compress` tool: the LLM decides **when** and **what** to compress into high-fidelity summaries, preserving critical details (file paths, decisions, error strings) while reclaiming context space.
 
-Unlike Pi's built-in auto-compaction (which replaces everything with a single summary), ACP:
+Unlike Pi's built-in auto-compaction (which replaces everything with a single summary), billion-context:
 - **Preserves structure** — compressed ranges become labeled blocks you can decompress later
 - **Multi-tier** — summaries can be further distilled (T1 → T2 → T3) as sessions grow
 - **Searchable** — `search_context` finds information inside compressed blocks without decompressing
@@ -40,19 +40,19 @@ This means:
 ## Install
 
 ```bash
-pi install npm:pai-acp
+pi install npm:billion-context-pi
 ```
 
 That's it. The extension auto-loads on next Pi startup. No configuration needed — it reads your model's context window automatically.
 
-> **Uninstall `pi-subagents` first (optional, recommended).** pai-acp ships its own `acp_delegate` sub-agent tool (see below) that replaces pi-subagents at a fraction of the context cost (~600 tok vs ~7K tok/turn). If you have pi-subagents installed, remove it to avoid duplicate delegation tools:
+> **Uninstall `pi-subagents` first (optional, recommended).** billion-context-pi ships its own `acp_delegate` sub-agent tool (see below) that replaces pi-subagents at a fraction of the context cost (~600 tok vs ~7K tok/turn). If you have pi-subagents installed, remove it to avoid duplicate delegation tools:
 > ```bash
 > pi remove npm:pi-subagents
 > ```
 
 ## How it works
 
-ACP intercepts Pi's `context` event (fired before each LLM call) and runs an 8-stage pipeline:
+billion-context intercepts Pi's `context` event (fired before each LLM call) and runs an 8-stage pipeline:
 
 ```
 assign refs → sync blocks → prune → filter → hide calls → recommend → nudge → emergency truncate
@@ -60,7 +60,17 @@ assign refs → sync blocks → prune → filter → hide calls → recommend
 
 Each message gets an invisible `<acp>` ref tag (`m00001`, `m00002`, ...) visible to the model but not the user. The model uses these refs to specify compression ranges.
 
-Pi's built-in auto-compaction is cancelled — ACP is the sole context manager.
+Pi's built-in auto-compaction is cancelled — billion-context is the sole context manager.
+
+## Plugin compatibility & ordering
+
+billion-context takes over context management by intercepting Pi's `context` event. **Pi has no plugin priority mechanism** — when multiple extensions register handlers for the same event, they run in a fixed sequence (load order), with no `priority`/`weight` field and no way for the user to control the order. The `context` event specifically is a *pipeline*: every handler receives the previous handler's output, there is no short-circuit, and the **last** handler has the final say over what reaches the model.
+
+This has two practical implications:
+
+1. **Keep exactly one context-compression plugin installed.** If you run two compression plugins together (e.g. billion-context-pi alongside another), both will rewrite the message list and clobber each other's work — compressed ranges can be re-expanded or corrupted. Pi's built-in auto-compaction is already cancelled automatically by billion-context-pi, but any *third-party* compression/compaction extension should be uninstalled.
+
+2. **Even with a single compression plugin, interference is still possible in rare cases.** Load order under Pi is determined by filesystem discovery order (`fs.readdirSync` over `.pi/extensions/` → global → packages), which is not fully deterministic. If another (non-compression) extension also hooks the `context` event and happens to load *after* billion-context-pi, it could modify the compressed output. billion-context-pi rebuilds its working set from the session log rather than the chained input, which makes it robust to handlers that run *before* it — but it cannot defend against a handler that runs *after* it. This is a limitation of Pi's extension model; if you observe unexpected context behavior, check whether other installed extensions intercept the `context` event.
 
 ## Model-facing tools
 
@@ -101,7 +111,7 @@ Rich status display for the user:
 ╭─────────────────────────────────────────────╮
 │           ACP Context Analysis              │
 ╰─────────────────────────────────────────────╯
- pai-acp@0.1.14
+ billion-context-pi@0.1.14
 
 Context: 12% (120K / 1.0M)
 Growth: +15K since last nudge
@@ -121,7 +131,7 @@ Blocks: 3 active (3.7K summary, 15.2K original compressed)
 
 ## Configuration
 
-pai-acp works out of the box with no configuration. Three optional keys can be set in a JSON config file.
+billion-context-pi works out of the box with no configuration. Three optional keys can be set in a JSON config file.
 
 ### Config file
 
@@ -132,7 +142,9 @@ Create `~/.pi/acp.json` (global) and/or `<project>/.pi/acp.json` (project-local,
   "debug": false,
   "autoUpdate": true,
   "modelContextLimit": 200000,
-  "delegate": true
+  "delegate": true,
+  "toolBashDefaultTimeout": 60,
+  "toolOutputMaxBytes": 200000
 }
 ```
 
@@ -142,8 +154,10 @@ Create `~/.pi/acp.json` (global) and/or `<project>/.pi/acp.json` (project-local,
 | `autoUpdate` | `true` | On Pi startup, check npm for a newer version and auto-install it (throttled to one check per 3 minutes). Disable to avoid all startup network calls. |
 | `modelContextLimit` | *(auto)* | Override the context limit (in tokens). Defaults to the model's `contextWindow`. |
 | `delegate` | `true` | Enable the `acp_delegate` tools (delegate/wait/cancel) and their system-prompt section. Set `false` to skip registering them (e.g. you use a different sub-agent extension, or run headless where async injection adds no value). |
+| `toolBashDefaultTimeout` | `60` | Seconds injected into the `bash` tool when the model omits `timeout`. Pi has **no** default of its own, so without this a forgotten timeout can hang for thousands of seconds. On timeout the model is guided to re-run with a larger `timeout`. `0` restores Pi's unbounded behavior. |
+| `toolOutputMaxBytes` | `200000` | Hard byte cap on tool result text (~5000 lines at ~40 B/line; applied via the `tool_result` hook). Stops runaway output that Pi's own 50KB/2000-line cap can't catch (e.g. tools Pi doesn't cap). When it fires the model is told how to see the full output — for `bash` the full output is in its temp file (`BashToolDetails.fullOutputPath`); set lower (e.g. `8192`) for a tighter context budget, or `0` to disable. |
 
-> **Only these four keys are read from `acp.json`.** Other tuning knobs (`preserveRecentMessages`, `protectedTools`, nudge thresholds) are code-level and not user-overridable.
+> **Only these six keys are read from `acp.json`.** Other tuning knobs (`preserveRecentMessages`, `protectedTools`, nudge thresholds) are code-level and not user-overridable.
 
 ### Environment variables
 
@@ -159,7 +173,7 @@ The model receives detailed guidance (in its system prompt) on **when** to compr
 
 ### What gets protected
 
-ACP protects three categories of content from compression:
+billion-context protects three categories of content from compression:
 
 1. **Always-protected tools** — `compress` calls are hard-protected (they're load-bearing metadata; compressing them breaks decompress and the "summary is historical" contract).
 2. **Soft recent-zone** — the last N messages (default 5) and last ~5K tokens are soft-protected so the model keeps its working set. Tool results from `decompress`, `search_context`, `read`, and `bash` are **excluded** from this zone: they're large and meant to be compressible once consumed, so they don't eat the protected budget.

package/README.zh-CN.md

@@ -1,7 +1,7 @@
 [English](./README.md) | [中文](./README.zh-CN.md)
 
 <p align="center">
-<strong>主动上下文剪枝</strong> — <a href="https://pi.dev">Pi</a> 的 ACP 插件
+<strong>Billion-Context</strong> — <a href="https://pi.dev">Pi</a> 的上下文压缩插件
 <br />
 由模型决定<em>何时</em>压缩、压缩<em>什么</em> — 而非硬性截断。
 </p>
@@ -9,22 +9,22 @@
 ---
 
 <p align="center">
-<a href="https://www.npmjs.com/package/pai-acp"><img src="https://img.shields.io/npm/v/pai-acp.svg?style=flat-square" alt="npm"></a>
-<a href="https://github.com/ranxianglei/pai-acp/blob/master/LICENSE"><img src="https://img.shields.io/npm/l/pai-acp.svg?style=flat-square" alt="license"></a>
-<a href="https://github.com/ranxianglei/pai-acp"><img src="https://img.shields.io/badge/GitHub-ranxianglei%2Fpai--acp-181717?style=flat-square&logo=github" alt="GitHub"></a>
+<a href="https://www.npmjs.com/package/billion-context-pi"><img src="https://img.shields.io/npm/v/billion-context-pi.svg?style=flat-square" alt="npm"></a>
+<a href="https://github.com/ranxianglei/billion-context-pi/blob/master/LICENSE"><img src="https://img.shields.io/npm/l/billion-context-pi.svg?style=flat-square" alt="license"></a>
+<a href="https://github.com/ranxianglei/billion-context-pi"><img src="https://img.shields.io/badge/GitHub-ranxianglei%2Fbillion--context--pi-181717?style=flat-square&logo=github" alt="GitHub"></a>
 </p>
 
 <p align="center">
-<code>pi install npm:pai-acp</code>
+<code>pi install npm:billion-context-pi</code>
 </p>
 
 ---
 
-## 为什么选择 ACP
+## 为什么选择 billion-context
 
-当对话变长,模型的上下文会耗尽。多数工具采用硬截断 —— 静默丢弃早期消息。**ACP** 把 `compress` 工具交给模型:由 LLM 决定**何时**压缩、压缩**什么**,将内容压缩成高保真摘要,在回收上下文空间的同时保留关键细节(文件路径、决策、错误字符串)。
+当对话变长,模型的上下文会耗尽。多数工具采用硬截断 —— 静默丢弃早期消息。**billion-context** 把 `compress` 工具交给模型:由 LLM 决定**何时**压缩、压缩**什么**,将内容压缩成高保真摘要,在回收上下文空间的同时保留关键细节(文件路径、决策、错误字符串)。
 
-与 Pi 内置的自动压缩(把所有内容替换成单个摘要)不同,ACP:
+与 Pi 内置的自动压缩(把所有内容替换成单个摘要)不同,billion-context:
 
 - **保留结构** — 压缩的范围变成带标签的块,可后续解压
 - **多级压缩** — 摘要可被进一步蒸馏(T1 → T2 → T3),随会话增长保持有界
@@ -39,19 +39,19 @@
 ## 安装
 
 ```bash
-pi install npm:pai-acp
+pi install npm:billion-context-pi
 ```
 
 完成。扩展在下次 Pi 启动时自动加载。无需配置 —— 它会自动读取模型的上下文窗口。
 
-> **建议先卸载 `pi-subagents`(可选,推荐)。** pai-acp 自带 `acp_delegate` 子代理工具(见下文),以极低的上下文成本(~600 tok vs ~7K tok/轮)替代 pi-subagents。如果你已安装 pi-subagents,卸载它以避免重复的委派工具:
+> **建议先卸载 `pi-subagents`(可选,推荐)。** billion-context-pi 自带 `acp_delegate` 子代理工具(见下文),以极低的上下文成本(~600 tok vs ~7K tok/轮)替代 pi-subagents。如果你已安装 pi-subagents,卸载它以避免重复的委派工具:
 > ```bash
 > pi remove npm:pi-subagents
 > ```
 
 ## 工作原理
 
-ACP 拦截 Pi 的 `context` 事件(每次 LLM 调用前触发),运行一个 8 阶段管线:
+billion-context 拦截 Pi 的 `context` 事件(每次 LLM 调用前触发),运行一个 8 阶段管线:
 
 ```
 assign refs → sync blocks → prune → filter → hide calls → recommend → nudge → emergency truncate
@@ -59,7 +59,17 @@ assign refs → sync blocks → prune → filter → hide calls → recommend
 
 每条消息获得一个不可见的 `<acp>` 引用标签(`m00001`、`m00002`、...),对模型可见但用户不可见。模型用这些引用来指定压缩范围。
 
-Pi 内置的自动压缩会被取消 —— ACP 是唯一的上下文管理者。
+Pi 内置的自动压缩会被取消 —— billion-context 是唯一的上下文管理者。
+
+## 插件兼容性与排序
+
+billion-context 通过拦截 Pi 的 `context` 事件接管上下文管理。**Pi 没有插件优先级机制** —— 当多个扩展为同一个事件注册 handler 时,它们按固定顺序(加载顺序)执行,没有 `priority`/`weight` 字段,用户也无法控制顺序。`context` 事件尤其是一个*管线*:每个 handler 都接收上一个 handler 的输出,没有短路,**最后一个** handler 对发给模型的内容拥有最终决定权。
+
+这带来两个实际影响:
+
+1. **只保留一个上下文压缩插件。** 如果同时运行两个压缩插件(例如 billion-context-pi 和另一个),它们都会改写消息列表、互相覆盖 —— 已压缩的范围可能被重新展开或破坏。Pi 的内置自动压缩已由 billion-context-pi 自动取消,但任何*第三方*压缩/compaction 扩展都应卸载。
+
+2. **即使只有一个压缩插件,在少数情况下仍可能出现干扰。** Pi 下的加载顺序由文件系统发现顺序(`fs.readdirSync` 遍历 `.pi/extensions/` → 全局 → 包)决定,并不完全确定。如果另一个(非压缩类)扩展也 hook 了 `context` 事件、且恰好加载在 billion-context-pi *之后*,它可能修改压缩后的输出。billion-context-pi 从会话日志重建工作集(而非链式输入),这让它对*排在它之前*的 handler 鲁棒 —— 但无法防御*排在它之后*的 handler。这是 Pi 扩展模型的固有限制;若你观察到上下文行为异常,请检查是否有其他已安装扩展拦截了 `context` 事件。
 
 ## 模型工具
 
@@ -100,7 +110,7 @@ Pi 内置的自动压缩会被取消 —— ACP 是唯一的上下文管理者
 ╭─────────────────────────────────────────────╮
 │           ACP Context Analysis              │
 ╰─────────────────────────────────────────────╯
- pai-acp@0.1.14
+ billion-context-pi@0.1.14
 
 Context: 12% (120K / 1.0M)
 Growth: +15K since last nudge
@@ -120,7 +130,7 @@ Blocks: 3 active (3.7K summary, 15.2K original compressed)
 
 ## 配置
 
-pai-acp 开箱即用,无需任何配置。可以在 JSON 配置文件中设置三个可选 key。
+billion-context-pi 开箱即用,无需任何配置。可以在 JSON 配置文件中设置三个可选 key。
 
 ### 配置文件
 
@@ -131,7 +141,9 @@ pai-acp 开箱即用,无需任何配置。可以在 JSON 配置文件中设置
   "debug": false,
   "autoUpdate": true,
   "modelContextLimit": 200000,
-  "delegate": true
+  "delegate": true,
+  "toolBashDefaultTimeout": 60,
+  "toolOutputMaxBytes": 200000
 }
 ```
 
@@ -141,8 +153,10 @@ pai-acp 开箱即用,无需任何配置。可以在 JSON 配置文件中设置
 | `autoUpdate` | `true` | Pi 启动时检查 npm 是否有更新版本并自动安装(限频:每 3 分钟最多一次检查)。禁用以避免所有启动时的网络请求。 |
 | `modelContextLimit` | *(自动)* | 覆盖上下文上限(token 数)。默认为模型的 `contextWindow`。 |
 | `delegate` | `true` | 启用 `acp_delegate` 工具(delegate/wait/cancel)及其系统提示词段落。设为 `false` 则不注册这些工具(例如你用了别的子代理扩展,或跑 headless 场景异步注入没有意义)。 |
+| `toolBashDefaultTimeout` | `60` | 当模型未指定 `timeout` 时注入 `bash` 工具的超时秒数。Pi **本身没有默认超时**,不加这个,一次遗漏的超时可能挂起几千秒。超时后会提示模型用更大的 `timeout` 重跑。设为 `0` 恢复 Pi 的无界行为。 |
+| `toolOutputMaxBytes` | `200000` | 工具结果文本硬上限(字节,约 5000 行 @ ~40 字节/行,通过 `tool_result` hook 应用)。用于兜住 Pi 自身 50KB/2000 行截断管不到的输出(例如 Pi 未加限制的工具)。触发截断时会告诉模型如何查看完整输出——对 `bash`,完整输出在其临时文件(`BashToolDetails.fullOutputPath`)中;设更小(如 `8192`)可更省上下文,设 `0` 关闭。 |
 
-> **只有这四个 key 会被 `acp.json` 读取。** 其他调优参数(`preserveRecentMessages`、`protectedTools`、nudge 阈值)是代码级的,不向用户开放。
+> **只有这六个 key 会被 `acp.json` 读取。** 其他调优参数(`preserveRecentMessages`、`protectedTools`、nudge 阈值)是代码级的,不向用户开放。
 
 ### 环境变量
 
@@ -158,7 +172,7 @@ pai-acp 开箱即用,无需任何配置。可以在 JSON 配置文件中设置
 
 ### 哪些内容会被保护
 
-ACP 保护三类内容不被压缩:
+billion-context 保护三类内容不被压缩:
 
 1. **永久保护的工具** — `compress` 调用被硬保护(它们是承载关键元数据的;压缩它们会破坏 decompress 和"摘要是历史"的契约)。
 2. **软近期区** — 最后 N 条消息(默认 5)和最后约 5K token 被软保护,让模型保留工作集。来自 `decompress`、`search_context`、`read`、`bash` 的工具结果被**排除**出此区:它们体量大、消费后就该能压缩,所以不该占用保护预算。

package/dist/config.d.ts

@@ -20,6 +20,24 @@ export interface AdapterConfig {
      *  section. Default: true. Set `delegate: false` (adapter config or
      *  ~/.pi/acp.json) to skip registering them. */
     delegate?: boolean;
+    /** Default timeout in seconds injected into the bash tool when the model
+     *  omits `timeout`. Pi has NO built-in default, so without this a command
+     *  that the model forgets to time out can hang for thousands of seconds.
+     *  Default: 60 (catches hangs quickly). On timeout the model is guided to
+     *  re-run with a larger `timeout`. Set to 0 to disable (restore Pi's
+     *  unbounded behavior). */
+    toolBashDefaultTimeout?: number;
+    /** Hard byte cap applied to tool result text via the `tool_result` hook.
+     *  Default: 200000 (~200KB, roughly 5000 lines at ~40 bytes/line) — a
+     *  generous ceiling that stops runaway output. Pi already caps bash/read/grep
+     *  at 50KB/2000 lines (bash full output is saved to a temp file), so this
+     *  default mainly caps tools Pi doesn't cap. Set lower (e.g. 8192) for a
+     *  tighter context budget, or 0 to disable. When capped, oversized text is
+     *  head-truncated with a notice telling the model how to see the full output
+     *  (bash: read BashToolDetails.fullOutputPath). */
+    toolOutputMaxBytes?: number;
     coreOverrides?: Partial<Config>;
 }
+export declare const DEFAULT_TOOL_BASH_TIMEOUT = 60;
+export declare const DEFAULT_TOOL_OUTPUT_MAX_BYTES = 200000;
 export declare function resolveConfig(adapter: AdapterConfig, liveContextLimit: number): Config;

package/dist/index.js

@@ -611,9 +611,13 @@ var TAG_CLOSE = LT + "/acp" + GT;
 function acpTag(ref, tokens, type) {
   return TAG_OPEN + 'tokens="' + formatTokens(tokens) + '" type="' + type + '"' + GT + ref + TAG_CLOSE;
 }
-function renderMessage(message, map, countTokens) {
+function renderMessage(message, map, countTokens, strategy) {
   const ref = refForRaw(map, message.id);
   if (!ref || ref === BLOCKED_REF) return message;
+  if (strategy === "none") return message;
+  if (strategy === "text-only" && message.contentType !== "text") {
+    return message;
+  }
   const ownTagRe = new RegExp(
     "^" + escapeRegex(TAG_OPEN) + "[^>]*" + GT + escapeRegex(ref) + escapeRegex(TAG_CLOSE) + "\\n?"
   );
@@ -624,21 +628,24 @@ function renderMessage(message, map, countTokens) {
   if (!cleanText) return { ...message, text: prefix };
   return { ...message, text: prefix + cleanText };
 }
-function renderVisibleRefs(messages, state, countTokens = (text) => Math.ceil(text.length / 4)) {
+function renderVisibleRefs(messages, state, countTokens = (text) => Math.ceil(text.length / 4), strategy = "all") {
   const map = state.messageRefs;
   return messages.map(
-    (message) => renderMessage(message, map, countTokens)
+    (message) => renderMessage(message, map, countTokens, strategy)
   );
 }
-var renderRefsNode = {
-  name: "render-refs",
-  run(io, ctx) {
-    return {
-      ...io,
-      messages: renderVisibleRefs(io.messages, io.state, ctx.countTokens)
-    };
-  }
-};
+function createRenderRefsNode(strategy) {
+  return {
+    name: "render-refs",
+    run(io, ctx) {
+      return {
+        ...io,
+        messages: renderVisibleRefs(io.messages, io.state, ctx.countTokens, strategy)
+      };
+    }
+  };
+}
+var renderRefsNode = createRenderRefsNode("all");
 var ALWAYS_PROTECTED_TOOLS = ["compress"];
 var NEVER_PRESERVE_RECENT_TOOLS = [
   "decompress",
@@ -1009,7 +1016,9 @@ function createCore(ports = {}) {
       state: input.state,
       effects: {}
     };
-    const result = runPipeline(defaultNodes(), initial, ctx);
+    const strategy = input.renderTags ?? "all";
+    const nodes = buildNodes(strategy);
+    const result = runPipeline(nodes, initial, ctx);
     return {
       messages: result.messages,
       state: result.state,
@@ -1039,7 +1048,10 @@ function createCore(ports = {}) {
     };
   }
   function defaultNodes() {
-    return [
+    return buildNodes("all");
+  }
+  function buildNodes(strategy) {
+    const base = [
       assignRefsNode,
       syncBlocksNode,
       pruneNode,
@@ -1047,9 +1059,10 @@ function createCore(ports = {}) {
       hideCompressCallsNode,
       recommendNode,
       nudgeNode,
-      emergencyTruncateNode,
-      renderRefsNode
+      emergencyTruncateNode
     ];
+    if (strategy === "none") return base;
+    return [...base, createRenderRefsNode(strategy)];
   }
   return { processTurn, applyCompression, defaultNodes, decompress, search, status };
 }
@@ -2342,6 +2355,8 @@ function makePreview(text, query, len) {
 }
 
 // src/config.ts
+var DEFAULT_TOOL_BASH_TIMEOUT = 60;
+var DEFAULT_TOOL_OUTPUT_MAX_BYTES = 2e5;
 function resolveConfig(adapter, liveContextLimit) {
   const envLimit = process.env.ACP_MODEL_CONTEXT_LIMIT;
   const envLimitNum = envLimit ? Number(envLimit) : NaN;
@@ -2359,7 +2374,15 @@ var REF_TAG = new RegExp("^(?:<acp\\s[^>]*>m\\d{5}</acp>|\\[m\\d{1,5}\\])\\s?\\n
 function entriesToCoreMessages(entries) {
   const out = [];
   for (const entry of entries) {
-    if (entry.type !== "message") continue;
+    if (entry.type !== "message") {
+      if (entry.type === "custom_message") {
+        const text = extractText(entry.content);
+        if (text.length > 0) {
+          out.push({ id: entry.id, role: "user", contentType: "text", text });
+        }
+      }
+      continue;
+    }
     const cores = projectMessage(entry.message, entry.id);
     out.push(...cores);
   }
@@ -7183,7 +7206,7 @@ async function handleCompress(args, runtime, ctx, toolCallId) {
     config
   });
   await runtime.save(applied.state, ctx);
-  const { blocksCreated, tokensCompressed, errors } = applied.result;
+  const { blocksCreated, tokensCompressed, errors, warnings } = applied.result;
   const afterTokens = Math.max(0, beforeTokens - tokensCompressed);
   const newBlocks = applied.state.blocks.slice(-blocksCreated);
   debug.event("compress-out", {
@@ -7200,6 +7223,7 @@ async function handleCompress(args, runtime, ctx, toolCallId) {
     newBlocks: newBlocks.map((b) => ({ blockId: b.blockId, tier: b.tier, summaryLen: b.summary.length, directMsgCount: b.directMessageIds.length, effectiveMsgCount: b.effectiveMessageIds.length, summary: b.summary }))
   });
   const lines = [`\u25A3 ACP | ${formatK2(beforeTokens)} \u2192 ${formatK2(afterTokens)} tokens (~${formatK2(tokensCompressed)} reclaimed, ${blocksCreated} block${blocksCreated > 1 ? "s" : ""})`];
+  if (warnings.length > 0) lines.push("\u26A0\uFE0F " + warnings.join("; "));
   if (errors.length > 0) lines.push("Errors: " + errors.join("; "));
   return lines.join("\n");
 }
@@ -8185,7 +8209,7 @@ async function statusReport(runtime, ctx) {
   const activeBlocksList = state.blocks.filter((b) => b.active);
   const totalBlocksList = state.blocks;
   const lines = [];
-  const versionStr = "0.0.6" ? `billion-context-pi@${"0.0.6"}` : "";
+  const versionStr = "0.1.25" ? `billion-context-pi@${"0.1.25"}` : "";
   lines.push("\u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E");
   lines.push("\u2502           ACP Context Analysis              \u2502");
   lines.push("\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F");
@@ -8327,6 +8351,116 @@ When a background delegate finishes, an automated completion notification is inj
 - Arrive asynchronously: if you have moved on to other work, only act on a notification if it is relevant to the current task; otherwise note it and continue.
 `;
 
+// src/tool-guardrails.ts
+import {
+  isBashToolResult,
+  isToolCallEventType
+} from "@earendil-works/pi-coding-agent";
+function resolveBashTimeout(input, defaultTimeout) {
+  if (input.timeout !== void 0) return void 0;
+  const d = defaultTimeout ?? DEFAULT_TOOL_BASH_TIMEOUT;
+  if (!Number.isFinite(d) || d <= 0) return void 0;
+  return d;
+}
+function capToolOutput(content, maxBytes, fullPath) {
+  const max = maxBytes ?? DEFAULT_TOOL_OUTPUT_MAX_BYTES;
+  if (!Number.isFinite(max) || max <= 0) return void 0;
+  const kept = [];
+  const texts = [];
+  for (const c of content) {
+    if (c.type === "text") texts.push(c.text);
+    else kept.push(c);
+  }
+  if (texts.length === 0) return void 0;
+  const combined = texts.join("\n");
+  const total = Buffer.byteLength(combined, "utf8");
+  if (total <= max) return void 0;
+  const head = keepHead(combined, max);
+  const dropped = total - Buffer.byteLength(head, "utf8");
+  kept.push({ type: "text", text: head + buildCapNotice(dropped, max, fullPath) });
+  return kept;
+}
+var TIMEOUT_RE = /Command timed out after (\d+) seconds/;
+function detectBashTimeout(content) {
+  for (const c of content) {
+    if (c.type !== "text") continue;
+    const m = c.text.match(TIMEOUT_RE);
+    if (m) return Number(m[1]);
+  }
+  return void 0;
+}
+function appendTimeoutNotice(content, secs) {
+  const notice = buildTimeoutNotice(secs);
+  const next = [...content];
+  for (let i = next.length - 1; i >= 0; i--) {
+    const part = next[i];
+    if (part && part.type === "text") {
+      next[i] = { type: "text", text: part.text + notice };
+      return next;
+    }
+  }
+  next.push({ type: "text", text: notice });
+  return next;
+}
+function keepHead(str, maxBytes) {
+  const buf = Buffer.from(str, "utf8");
+  if (buf.length <= maxBytes) return str;
+  let end = maxBytes;
+  while (end > 0) {
+    const b = buf[end];
+    if (b === void 0 || (b & 192) !== 128) break;
+    end--;
+  }
+  let head = buf.subarray(0, end).toString("utf8");
+  const nl = head.lastIndexOf("\n");
+  if (nl >= Math.floor(maxBytes / 2)) head = head.slice(0, nl);
+  return head;
+}
+function buildCapNotice(dropped, maxBytes, fullPath) {
+  const where = fullPath ? `Full output saved to: ${fullPath} \u2014 read it to see everything.` : "To see more, narrow the query or redirect output to a file and read the relevant slice.";
+  return `
+
+[ACP guardrail: output capped at ${formatBytes(maxBytes)} (~${formatBytes(dropped)} dropped). ${where}]`;
+}
+function buildTimeoutNotice(secs) {
+  const suggested = Math.min(Math.max(Math.ceil(secs * 2), 120), 3600);
+  return `
+
+[ACP guardrail: command killed after ${secs}s. To give it more time, re-run the bash tool with a larger \`timeout\` argument (e.g. \`"timeout": ${suggested}\`).]`;
+}
+function formatBytes(n) {
+  return n >= 1024 ? `${(n / 1024).toFixed(1)}KB` : `${n}B`;
+}
+function wireToolGuardrails(pi, runtime) {
+  pi.on("tool_call", (event) => {
+    if (!isToolCallEventType("bash", event)) return;
+    const t = resolveBashTimeout(event.input, runtime.adapter.toolBashDefaultTimeout);
+    if (t !== void 0) {
+      event.input.timeout = t;
+      debug.event("guardrail-bash-timeout", { applied: t });
+    }
+  });
+  pi.on("tool_result", (event) => {
+    const isBash = isBashToolResult(event);
+    const fullPath = isBash ? event.details?.fullOutputPath : void 0;
+    const timeoutSecs = isBash && event.isError ? detectBashTimeout(event.content) : void 0;
+    let modified;
+    const max = runtime.adapter.toolOutputMaxBytes;
+    if (max !== void 0 && max > 0) {
+      const next = capToolOutput(event.content, max, fullPath);
+      if (next) {
+        modified = next;
+        debug.event("guardrail-output-cap", { max, hadPath: !!fullPath });
+      }
+    }
+    if (timeoutSecs !== void 0) {
+      modified = appendTimeoutNotice(modified ?? event.content, timeoutSecs);
+      debug.event("guardrail-bash-timeout-notice", { secs: timeoutSecs });
+    }
+    if (modified) return { content: modified };
+  });
+}
+
 // src/update.ts
 import { readFile, writeFile as writeFile3, mkdir as mkdir3 } from "fs/promises";
 import { join as join5, dirname as dirname3 } from "path";
@@ -8433,7 +8567,7 @@ async function checkForUpdate(autoUpdate, notify) {
     const data = await res.json();
     const latest = data.version;
     if (!latest) return;
-    const current = runtimeVersion ?? "0.0.6";
+    const current = runtimeVersion ?? "0.1.25";
     debug.event("update-check", {
       current,
       latest,
@@ -8613,7 +8747,7 @@ async function loadUserConfig(cwd) {
 function join8(...parts) {
   return path3.join(...parts);
 }
-var KNOWN = /* @__PURE__ */ new Set(["debug", "autoUpdate", "modelContextLimit", "delegate"]);
+var KNOWN = /* @__PURE__ */ new Set(["debug", "autoUpdate", "modelContextLimit", "delegate", "toolBashDefaultTimeout", "toolOutputMaxBytes"]);
 function pickKnown(parsed) {
   const out = {};
   for (const [k, v] of Object.entries(parsed)) {
@@ -8641,6 +8775,7 @@ function createAcpExtension(adapter = {}) {
     wireSessionLifecycle(pi, runtime);
     wireContextTransform(pi, runtime);
     wireSystemPrompt(pi, runtime);
+    wireToolGuardrails(pi, runtime);
     pi.registerTool(makeCompressTool(runtime));
     pi.registerTool(makeDecompressTool(runtime));
     pi.registerTool(makeSearchTool(runtime));
@@ -8767,7 +8902,12 @@ ${prompt}` };
 function collectOriginals(entries) {
   const map = /* @__PURE__ */ new Map();
   for (const entry of entries) {
-    if (entry.type === "message") map.set(entry.id, entry.message);
+    if (entry.type === "message") {
+      map.set(entry.id, entry.message);
+    } else if (entry.type === "custom_message") {
+      const content = typeof entry.content === "string" ? [{ type: "text", text: entry.content }] : entry.content;
+      map.set(entry.id, { role: "user", content });
+    }
   }
   return map;
 }