blun-king-cli 9.1.526 → 9.1.536

package/scripts/check-copy-command-regression.js

@@ -0,0 +1,74 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+
+const rootArg = process.argv.find((value) => value.startsWith('--root='));
+const packageRoot = rootArg ? path.resolve(rootArg.slice('--root='.length)) : path.resolve(__dirname, '..');
+const bundle = fs.readFileSync(path.join(packageRoot, 'blun.mjs'), 'utf8');
+
+function extractFunction(name) {
+  const start = bundle.indexOf(`function ${name}(`);
+  assert.notEqual(start, -1, `${name} must exist`);
+  const open = bundle.indexOf('{', start);
+  let depth = 0;
+  for (let index = open; index < bundle.length; index += 1) {
+    if (bundle[index] === '{') depth += 1;
+    if (bundle[index] === '}') depth -= 1;
+    if (depth === 0) return bundle.slice(start, index + 1);
+  }
+  assert.fail(`${name} must have a complete function body`);
+}
+
+assert.match(
+  bundle,
+  /name:\s*"copy"[\s\S]{0,180}descriptionKey:\s*"command\.copy\.description"[\s\S]{0,180}availability:\s*"always"/,
+  '/copy must be registered and available while a turn is running',
+);
+assert.match(bundle, /case "copy":\s*await handleCopyCommand\(host\);\s*return;/, '/copy must dispatch to its handler');
+assert.match(bundle, /await copyTextToClipboard\(text\);/, '/copy must use the existing cross-platform clipboard helper');
+
+const selectorSource = extractFunction('findLatestAssistantResponse');
+const findLatestAssistantResponse = vm.runInNewContext(`(${selectorSource})`);
+assert.equal(
+  findLatestAssistantResponse([
+    { kind: 'assistant', content: '  previous answer  ' },
+    { kind: 'user', content: 'question' },
+    { kind: 'assistant', content: '   ' },
+  ]),
+  '  previous answer  ',
+  'the selector must ignore user and empty assistant entries while preserving response bytes',
+);
+assert.equal(findLatestAssistantResponse([{ kind: 'user', content: 'question' }]), undefined);
+
+const requiredUiStrings = [
+  'Copy the latest assistant response to the clipboard.',
+  'Copied the latest response to the clipboard.',
+  'There is no response to copy yet.',
+  'Could not copy the latest response: {error}',
+  'Neueste Assistentenantwort in die Zwischenablage übernehmen.',
+  'Die neueste Antwort wurde in die Zwischenablage übernommen.',
+  'Es ist noch keine Antwort zum Kopieren verfügbar.',
+  'Die neueste Antwort konnte nicht kopiert werden: {error}',
+  'Copiar la respuesta más reciente del asistente al portapapeles.',
+  'La respuesta más reciente se copió al portapapeles.',
+  'Todavía no hay ninguna respuesta que copiar.',
+  'No se pudo copiar la respuesta más reciente: {error}',
+  'Copier la réponse la plus récente de l’assistant dans le presse-papiers.',
+  'La réponse la plus récente a été copiée dans le presse-papiers.',
+  'Aucune réponse à copier pour le moment.',
+  'Impossible de copier la réponse la plus récente : {error}',
+  'Kopiera assistentens senaste svar till urklipp.',
+  'Det senaste svaret kopierades till urklipp.',
+  'Det finns inget svar att kopiera ännu.',
+  'Det gick inte att kopiera det senaste svaret: {error}',
+  'Zkopírovat nejnovější odpověď asistenta do schránky.',
+  'Nejnovější odpověď byla zkopírována do schránky.',
+  'Zatím není k dispozici žádná odpověď ke zkopírování.',
+  'Nejnovější odpověď se nepodařilo zkopírovat: {error}',
+];
+for (const text of requiredUiStrings) assert.ok(bundle.includes(text), `missing released UI text: ${text}`);
+
+process.stdout.write('Copy command regression gate: PASS\n');

package/scripts/check-current-turn-read-pin-mutation-regression.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const packageRoot = path.resolve(__dirname, '..');
+const gatePath = path.join(packageRoot, 'scripts', 'check-current-turn-read-pin-regression.js');
+const sourcePolicy = fs.readFileSync(
+  path.join(packageRoot, 'bin', 'tool-result-offload-policy.cjs'),
+  'utf8',
+);
+const sourceBundle = fs.readFileSync(path.join(packageRoot, 'blun.mjs'), 'utf8');
+
+const mutations = [
+  {
+    name: 'policy helper removed',
+    policy: sourcePolicy.replace(
+      'function currentTurnReadToolResultIds(messages) {',
+      'function removedCurrentTurnReadToolResultIds(messages) {',
+    ),
+    bundle: sourceBundle,
+  },
+  {
+    name: 'injections accepted as user turns',
+    policy: sourcePolicy.replace(
+      "message?.role === 'user' && message.origin?.kind === 'user'",
+      "message?.role === 'user'",
+    ),
+    bundle: sourceBundle,
+  },
+  {
+    name: 'Read pin filter removed',
+    policy: sourcePolicy,
+    bundle: sourceBundle.replace(
+      ' && !pinnedReadIds.has(message.toolCallId)',
+      '',
+    ),
+  },
+  {
+    name: 'current user instruction no longer skipped',
+    policy: sourcePolicy,
+    bundle: sourceBundle.replace(
+      'if (historyIndex === currentTurnStart) continue;',
+      'if (false && historyIndex === currentTurnStart) continue;',
+    ),
+  },
+];
+
+for (const mutation of mutations) {
+  if (mutation.policy === sourcePolicy && mutation.bundle === sourceBundle) {
+    throw new Error(`mutation marker missing: ${mutation.name}`);
+  }
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'blun-read-pin-mutation-'));
+  try {
+    fs.mkdirSync(path.join(tempRoot, 'bin'), { recursive: true });
+    fs.writeFileSync(path.join(tempRoot, 'bin', 'tool-result-offload-policy.cjs'), mutation.policy);
+    fs.writeFileSync(path.join(tempRoot, 'blun.mjs'), mutation.bundle);
+    const result = spawnSync(process.execPath, [gatePath], {
+      cwd: packageRoot,
+      encoding: 'utf8',
+      env: { ...process.env, BLUN_PACKAGE_UNDER_TEST: tempRoot },
+    });
+    if (result.status === 0) throw new Error(`gate accepted mutation: ${mutation.name}`);
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+process.stdout.write(`current-turn-read-pin-mutation-regression PASS (${mutations.length} mutations rejected)\n`);

package/scripts/check-current-turn-read-pin-regression.js

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const packageRoot = process.env.BLUN_PACKAGE_UNDER_TEST
+  ? path.resolve(process.env.BLUN_PACKAGE_UNDER_TEST)
+  : path.resolve(__dirname, '..');
+const policy = require(path.join(packageRoot, 'bin', 'tool-result-offload-policy.cjs'));
+const bundle = fs.readFileSync(path.join(packageRoot, 'blun.mjs'), 'utf8');
+
+function assert(condition, message) {
+  if (!condition) throw new Error(`CURRENT_TURN_READ_PIN_REGRESSION: ${message}`);
+}
+
+assert(
+  typeof policy.currentTurnReadToolResultIds === 'function',
+  'currentTurnReadToolResultIds policy is missing',
+);
+assert(
+  typeof policy.currentUserTurnStartIndex === 'function',
+  'currentUserTurnStartIndex policy is missing',
+);
+
+const history = [
+  { role: 'user', origin: { kind: 'user' }, content: [{ type: 'text', text: 'old task' }] },
+  {
+    role: 'assistant',
+    toolCalls: [{ id: 'old-read', name: 'Read', arguments: JSON.stringify({ path: 'old.md' }) }],
+  },
+  { role: 'tool', toolCallId: 'old-read', content: [{ type: 'text', text: 'old result' }] },
+  { role: 'user', origin: { kind: 'injection' }, content: [{ type: 'text', text: 'hook' }] },
+  { role: 'user', origin: { kind: 'user' }, content: [{ type: 'text', text: 'current task' }] },
+  {
+    role: 'assistant',
+    toolCalls: [
+      { id: 'task-read', name: 'Read', arguments: JSON.stringify({ path: 'task.md' }) },
+      { id: 'shell-call', name: 'Bash', arguments: JSON.stringify({ command: 'pwd' }) },
+    ],
+  },
+  { role: 'tool', toolCallId: 'task-read', content: [{ type: 'text', text: 'complete task' }] },
+  { role: 'tool', toolCallId: 'shell-call', content: [{ type: 'text', text: '/workspace' }] },
+  {
+    role: 'assistant',
+    toolCalls: [{ id: 'source-read', name: 'Read', arguments: JSON.stringify({ path: 'source.js' }) }],
+  },
+  { role: 'tool', toolCallId: 'source-read', content: [{ type: 'text', text: 'source slice' }] },
+  { role: 'assistant', toolCalls: [] },
+  { role: 'tool', toolCallId: 'unrelated-result', content: [{ type: 'text', text: 'other' }] },
+];
+
+const pinned = policy.currentTurnReadToolResultIds(history);
+assert(pinned instanceof Set, 'policy must return a Set');
+assert(pinned.has('task-read'), 'complete task Read was not pinned');
+assert(pinned.has('source-read'), 'current-turn source Read was not pinned');
+assert(!pinned.has('old-read'), 'Read from a completed older user turn stayed pinned');
+assert(!pinned.has('shell-call'), 'non-Read tool result was pinned');
+assert(
+  policy.currentUserTurnStartIndex(history) === 4,
+  'latest real user message was not selected as the current turn start',
+);
+
+const withoutUserTurn = policy.currentTurnReadToolResultIds([
+  { role: 'user', origin: { kind: 'injection' }, content: [{ type: 'text', text: 'hook' }] },
+  {
+    role: 'assistant',
+    toolCalls: [{ id: 'injected-read', name: 'Read', arguments: '{}' }],
+  },
+]);
+assert(withoutUserTurn.size === 0, 'injection-only history must not create a pinned user turn');
+assert(
+  policy.currentUserTurnStartIndex(withoutUserTurn) === -1,
+  'injection-only history must not create a current user turn',
+);
+
+assert(
+  bundle.includes('const pinnedReadIds = currentTurnReadToolResultIds(history);'),
+  'batch offload does not calculate current-turn Read pins',
+);
+assert(
+  bundle.includes('&& !pinnedReadIds.has(message.toolCallId)'),
+  'batch offload does not exclude pinned Read results',
+);
+assert(
+  bundle.includes('const currentTurnStart = currentUserTurnStartIndex(history);'),
+  'user-message offload does not locate the current turn',
+);
+assert(
+  bundle.includes('if (historyIndex === currentTurnStart) continue;'),
+  'current user instruction can still be offloaded during its own turn',
+);
+
+process.stdout.write('current-turn-read-pin-regression PASS\n');

package/scripts/check-deepseek-native-max-regression.js

@@ -0,0 +1,49 @@
+const fs = require('node:fs');
+const path = require('node:path');
+
+const packageRoot = path.resolve(__dirname, '..');
+const bundlePath = path.join(packageRoot, 'blun.mjs');
+
+function checkBundle(bundle) {
+  const required = [
+    'max: "Max"',
+    'if (effort !== void 0) this.opts.onSessionOnlySelect(effort);',
+    'if (this.isBlunSwarmSelected) this.opts.onBlunSwarmSelect?.();',
+    'if (effort !== void 0) this.opts.onSelect(effort);',
+    'state.swarmMode && state.swarmModeEntry === "effort"',
+  ];
+  for (const marker of required) {
+    if (!bundle.includes(marker)) throw new Error(`missing native-max marker: ${marker}`);
+  }
+
+  const forbidden = [
+    'max: "Swarm"',
+    'usesLegacyServerStageScale',
+  ];
+  for (const marker of forbidden) {
+    if (bundle.includes(marker)) throw new Error(`legacy max-to-swarm path remains: ${marker}`);
+  }
+}
+
+const bundle = fs.readFileSync(bundlePath, 'utf8');
+checkBundle(bundle);
+
+const mutations = [
+  bundle.replace('max: "Max"', 'max: "Swarm"'),
+  bundle.replace(
+    'if (effort !== void 0) this.opts.onSelect(effort);',
+    'if (effort === "max" && this.usesLegacyServerStageScale) this.opts.onBlunSwarmSelect();',
+  ),
+];
+
+for (const [index, mutation] of mutations.entries()) {
+  let rejected = false;
+  try {
+    checkBundle(mutation);
+  } catch {
+    rejected = true;
+  }
+  if (!rejected) throw new Error(`mutation ${index + 1} escaped native-max gate`);
+}
+
+console.log('DeepSeek native max regression gate passed (2 mutations rejected).');

package/scripts/check-empty-response-effort-downgrade-regression.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const packageRoot = process.env.BLUN_PACKAGE_UNDER_TEST
+  ? path.resolve(process.env.BLUN_PACKAGE_UNDER_TEST)
+  : path.resolve(__dirname, '..');
+const policy = require(path.join(packageRoot, 'bin', 'empty-response-retry-policy.cjs'));
+const bundle = fs.readFileSync(path.join(packageRoot, 'blun.mjs'), 'utf8');
+
+const exhausted = (thinkingEffort) => policy.nextThinkingEffortForExhaustedEmpty({
+  emptyResponseKind: 'length',
+  maxCompletionTokens: 32_768,
+  completionTokens: 32_768,
+  thinkingEffort,
+});
+
+assert.equal(exhausted('max'), 'high');
+assert.equal(exhausted('xhigh'), 'high');
+assert.equal(exhausted('high'), 'low');
+assert.equal(exhausted('low'), 'off');
+assert.equal(policy.nextThinkingEffortForExhaustedEmpty({
+  emptyResponseKind: 'length',
+  maxCompletionTokens: 32_768,
+  completionTokens: 2_000,
+  thinkingEffort: 'max',
+}), undefined, 'a non-exhausted response must not downgrade thinking');
+assert.equal(policy.nextThinkingEffortForExhaustedEmpty({
+  emptyResponseKind: 'stop',
+  maxCompletionTokens: 32_768,
+  completionTokens: 32_768,
+  thinkingEffort: 'max',
+}), undefined, 'a stop response must not be treated as budget exhaustion');
+
+for (const needle of [
+  'thinkingEffortRetry = nextThinkingEffortForExhaustedEmpty({',
+  'thinkingEffort: input.llm.thinkingEffort',
+  'const requestProvider = params.thinkingEffortRetry === void 0 ? this.provider : this.provider.withThinking(params.thinkingEffortRetry);',
+  'provider: requestProvider,',
+  'retryThinkingEffort',
+]) {
+  assert.ok(bundle.includes(needle), `empty-response retry wiring missing: ${needle}`);
+}
+
+process.stdout.write('empty-response-effort-downgrade-regression PASS\n');

package/scripts/check-fredrik-glm-mutation-regression.js

@@ -0,0 +1,18 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { REQUIRED_BUNDLE_MARKERS, validateBundleText } = require('./check-fredrik-glm-regression.js');
+
+const bundlePath = path.resolve(__dirname, '..', 'blun.mjs');
+const source = fs.readFileSync(bundlePath, 'utf8');
+assert.deepEqual(validateBundleText(source), []);
+
+for (const marker of REQUIRED_BUNDLE_MARKERS) {
+  const mutated = source.replaceAll(marker, `MUTATED_${marker.length}`);
+  assert.notEqual(mutated, source, `mutation marker missing from source: ${marker}`);
+  assert.notDeepEqual(validateBundleText(mutated), [], `gate accepted mutation: ${marker}`);
+}
+
+process.stdout.write(`fredrik-glm-mutation-regression: ok (${REQUIRED_BUNDLE_MARKERS.length} mutations)\n`);

package/scripts/check-fredrik-glm-regression.js

@@ -0,0 +1,169 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const policy = require('../bin/fredrik-glm-provider.cjs');
+
+const PACKAGE_ROOT = path.resolve(__dirname, '..');
+const BUNDLE_PATH = path.join(PACKAGE_ROOT, 'blun.mjs');
+const TEMPLATE_PATH = path.join(PACKAGE_ROOT, 'fredrik-glm-profile.toml.example');
+
+const REQUIRED_BUNDLE_MARKERS = Object.freeze([
+  'literal("openai_compatible")',
+  'apiKeyFile: string().optional()',
+  'providerName !== FREDRIK_GLM_PROVIDER_ID || !isConfiguredFredrikGlmAlias(model, alias)',
+  'type: providerConfig.type',
+  'apiKey: readFredrikGlmApiKeyFile(provider)',
+  'openAICompatible: true',
+  'const controls = fredrikGlmRequestControls(effectiveThinkingEffort ?? "max")',
+  'requestExtraBody["thinking"] = controls.thinking',
+  'requestExtraBody["reasoning_effort"] = controls.reasoning_effort',
+  'name: "model"',
+  'await handleModelCommand(host, args)',
+  'performModelSwitch(host, selection.alias, selection.thinking, false)',
+  '...configuredFredrikGlmModels(models)',
+  '[FREDRIK_GLM_PROVIDER_ID]: fredrikGlm',
+  'model: status.model ?? BLUN_KING_MODEL_ALIAS',
+  '!isAllowedFredrikRuntimeAlias(resumedStatus.model ?? BLUN_KING_MODEL_ALIAS, this.state.appState.availableModels)',
+]);
+
+const FORBIDDEN_BUNDLE_MARKERS = Object.freeze([
+  '..."model" in patch && patch.model?.trim().length ? { model: BLUN_KING_MODEL_ALIAS }',
+  '..."activeResponderModel" in patch && patch.activeResponderModel != null ? { activeResponderModel: BLUN_KING_MODEL_ALIAS }',
+]);
+
+function validateBundleText(source) {
+  const failures = [];
+  for (const marker of REQUIRED_BUNDLE_MARKERS) {
+    if (!source.includes(marker)) failures.push(`missing:${marker}`);
+  }
+  for (const marker of FORBIDDEN_BUNDLE_MARKERS) {
+    if (source.includes(marker)) failures.push(`forbidden:${marker}`);
+  }
+  const setSessionBlock = source.slice(source.indexOf('\n\tasync setSession(session, options = {}) {'), source.indexOf('\n\tasync syncRuntimeState(', source.indexOf('\n\tasync setSession(session, options = {}) {')));
+  if (!setSessionBlock.includes('!isAllowedFredrikRuntimeAlias(resumedStatus.model ?? BLUN_KING_MODEL_ALIAS')) failures.push('resume-missing-profile-guard');
+  const reloadBlock = source.slice(source.indexOf('\n\tasync reloadCurrentSessionView('), source.indexOf('\n\tasync restoreSession(', source.indexOf('\n\tasync reloadCurrentSessionView(')));
+  if (reloadBlock.includes('session.setModel(BLUN_KING_MODEL_ALIAS')) failures.push('reload-forces-king');
+  return failures;
+}
+
+function exactModels() {
+  return {
+    'fredrik/glm-5.3-flash': {
+      provider: policy.PROVIDER_ID,
+      model: 'glm-5.3-flash',
+      displayName: 'GLM 5.3 Flash',
+      maxContextSize: 1000000,
+      maxOutputSize: 128000,
+      capabilities: ['tool_use', 'always_thinking'],
+      supportEfforts: ['low', 'high', 'max'],
+      defaultEffort: 'max',
+    },
+    'fredrik/glm-5.3': {
+      provider: policy.PROVIDER_ID,
+      model: 'glm-5.3',
+      displayName: 'GLM 5.3',
+      maxContextSize: 1000000,
+      maxOutputSize: 128000,
+      capabilities: ['tool_use', 'always_thinking'],
+      supportEfforts: ['low', 'high', 'max'],
+      defaultEffort: 'max',
+    },
+  };
+}
+
+function run() {
+  const source = fs.readFileSync(BUNDLE_PATH, 'utf8');
+  assert.deepEqual(validateBundleText(source), []);
+
+  assert.equal(policy.BASE_URL, 'https://api.z.ai/api/coding/paas/v4');
+  assert.deepEqual([...policy.MODEL_EFFORTS], ['low', 'high', 'max']);
+  assert.deepEqual(policy.requestControls('low'), { thinking: { type: 'enabled' }, reasoning_effort: 'low' });
+  assert.deepEqual(policy.requestControls('max'), { thinking: { type: 'enabled' }, reasoning_effort: 'max' });
+  assert.throws(() => policy.requestControls('off'), /only low, high, or max/u);
+  assert.equal(policy.normalizeBaseUrl(`${policy.BASE_URL}/`), policy.BASE_URL);
+  for (const bad of ['http://api.z.ai/api/coding/paas/v4', 'https://api.z.ai/api/paas/v4', 'https://api.z.ai/api/coding/paas/v4?key=x', 'https://example.com/api/coding/paas/v4']) {
+    assert.throws(() => policy.normalizeBaseUrl(bad), /approved api\.z\.ai Coding endpoint/u);
+  }
+
+  const models = exactModels();
+  assert.deepEqual(Object.keys(policy.configuredModels(models)), ['fredrik/glm-5.3-flash', 'fredrik/glm-5.3']);
+  assert.equal(policy.isAllowedRuntimeAlias('blun/king', models), true);
+  assert.equal(policy.isAllowedRuntimeAlias('fredrik/glm-5.3', models), true);
+  assert.equal(policy.isAllowedRuntimeAlias('werner/glm-5.3', models), false);
+  const mutated = structuredClone(models);
+  mutated['fredrik/glm-5.3'].supportEfforts = ['low', 'max'];
+  assert.equal(policy.isConfiguredAlias('fredrik/glm-5.3', mutated['fredrik/glm-5.3']), false);
+
+  const providers = {
+    [policy.PROVIDER_ID]: {
+      type: policy.PROVIDER_TYPE,
+      baseUrl: policy.BASE_URL,
+      apiKeyFile: 'secrets/zai-api-key.txt',
+    },
+  };
+  assert.equal(policy.configuredProvider(providers), providers[policy.PROVIDER_ID]);
+  const diagnostic = policy.safeDiagnostic('fredrik/glm-5.3', models, providers, true);
+  assert.deepEqual(diagnostic, {
+    alias: 'fredrik/glm-5.3',
+    alias_source: 'profile-config',
+    provider: 'fredrik:zai',
+    provider_type: 'openai_compatible',
+    model: 'glm-5.3',
+    base_host: 'api.z.ai',
+    credential_source: 'profile-file',
+    credential_present: true,
+    credential_fingerprint: null,
+    wire_format: 'openai-chat-completions',
+    health: 'untested',
+  });
+  assert.equal(JSON.stringify(diagnostic).includes('zai-api-key.txt'), false);
+
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'blun-fredrik-glm-'));
+  try {
+    const secretDir = path.join(root, 'secrets');
+    fs.mkdirSync(secretDir);
+    const secretPath = path.join(secretDir, 'zai-api-key.txt');
+    const canary = 'secret-canary-never-print';
+    fs.writeFileSync(secretPath, `${canary}\n`, { encoding: 'utf8', mode: 0o600 });
+    const read = policy.readApiKeyFile(providers[policy.PROVIDER_ID], { BLUN_HOME: root });
+    assert.equal(read, canary);
+    assert.throws(() => policy.readApiKeyFile({ ...providers[policy.PROVIDER_ID], apiKey: canary }, { BLUN_HOME: root }), /only api_key_file/u);
+    assert.throws(() => policy.readApiKeyFile({ ...providers[policy.PROVIDER_ID], apiKeyFile: '..\\outside.txt' }, { BLUN_HOME: root }), /escapes the profile/u);
+    fs.writeFileSync(secretPath, `${canary}\nsecond\n`, 'utf8');
+    assert.throws(() => policy.readApiKeyFile(providers[policy.PROVIDER_ID], { BLUN_HOME: root }), /exactly one non-empty line/u);
+    fs.writeFileSync(secretPath, `${canary}\n`, 'utf8');
+    if (process.platform === 'win32') {
+      const aclMutation = spawnSync('icacls.exe', [secretPath, '/grant', '*S-1-1-0:(M)'], { encoding: 'utf8', windowsHide: true });
+      assert.equal(aclMutation.status, 0, 'ACL mutation setup failed');
+      assert.throws(() => policy.readApiKeyFile(providers[policy.PROVIDER_ID], { BLUN_HOME: root }), /ACL is too permissive/u);
+    }
+    const missingProvider = { ...providers[policy.PROVIDER_ID], apiKeyFile: 'secrets/zai-api-key.txt' };
+    fs.rmSync(secretPath, { force: true });
+    assert.throws(() => policy.readApiKeyFile(missingProvider, { BLUN_HOME: root }), (error) => {
+      assert.equal(error.message.includes(root), false);
+      return /could not be resolved safely/u.test(error.message);
+    });
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+
+  const template = fs.readFileSync(TEMPLATE_PATH, 'utf8');
+  assert.match(template, /\[providers\."fredrik:zai"\]/u);
+  assert.match(template, /api_key_file = "secrets\/zai-api-key\.txt"/u);
+  assert.equal(template.includes('api_key ='), false);
+  assert.equal(template.includes('default_model'), false);
+  assert.equal(template.includes('werner'), false);
+  assert.equal(template.includes('manfred'), false);
+
+  const pkg = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf8'));
+  assert.equal(pkg.version, '9.1.536');
+  process.stdout.write('fredrik-glm-regression: ok\n');
+}
+
+module.exports = { REQUIRED_BUNDLE_MARKERS, validateBundleText };
+
+if (require.main === module) run();

package/scripts/check-history-pressure-offload-regression.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('node:assert/strict');
+const path = require('node:path');
+
+const packageRoot = process.env.BLUN_PACKAGE_UNDER_TEST
+  ? path.resolve(process.env.BLUN_PACKAGE_UNDER_TEST)
+  : path.resolve(__dirname, '..');
+const userPolicy = require(path.join(packageRoot, 'bin', 'user-message-offload-policy.cjs'));
+const assistantPolicy = require(path.join(packageRoot, 'bin', 'assistant-message-offload-policy.cjs'));
+const skillPolicy = require(path.join(packageRoot, 'bin', 'skill-activation-performance-policy.cjs'));
+
+function textMessage(role, text, origin) {
+  return { role, content: [{ type: 'text', text }], toolCalls: [], ...(origin ? { origin } : {}) };
+}
+
+const smallHistory = Array.from({ length: 25 }, (_, index) => textMessage(
+  index === 0 ? 'user' : 'assistant',
+  'x'.repeat(5_000),
+  index === 0
+    ? { kind: 'skill_activation', skillName: 'test-skill', skillPath: 'C:/test/SKILL.md' }
+    : undefined,
+));
+const smallChars = userPolicy.historyTextChars(smallHistory);
+assert.equal(userPolicy.shouldOffloadHistoricalUserMessage({
+  historyIndex: 0,
+  historyLength: smallHistory.length,
+  historyChars: smallChars,
+  textChars: 5_000,
+}), false, 'message 21 alone must not trigger user-message offload');
+assert.equal(assistantPolicy.shouldOffloadHistoricalAssistantMessage({
+  historyIndex: 1,
+  historyLength: smallHistory.length,
+  historyChars: smallChars,
+  textChars: 5_000,
+}), false, 'message 21 alone must not trigger assistant-message offload');
+assert.equal(assistantPolicy.shouldCompactHistoricalAssistantToolNarration({
+  historyIndex: 1,
+  historyLength: smallHistory.length,
+  historyChars: smallChars,
+  textChars: 500,
+  toolCallCount: 1,
+  completedToolCallCount: 1,
+}), false, 'message 21 alone must not compact completed tool narration');
+assert.strictEqual(
+  skillPolicy.compactHistoricalSkillActivations(smallHistory),
+  smallHistory,
+  'message 21 alone must not compact active skill instructions',
+);
+
+const largeHistory = Array.from({ length: 70 }, (_, index) => textMessage(
+  index === 0 ? 'user' : 'assistant',
+  'y'.repeat(20_000),
+  index === 0
+    ? { kind: 'skill_activation', skillName: 'test-skill', skillPath: 'C:/test/SKILL.md' }
+    : undefined,
+));
+const largeChars = userPolicy.historyTextChars(largeHistory);
+assert.ok(largeChars >= 1_000_000);
+assert.equal(userPolicy.shouldOffloadHistoricalUserMessage({
+  historyIndex: 0,
+  historyLength: largeHistory.length,
+  historyChars: largeChars,
+  textChars: 20_000,
+}), true, 'real history pressure must retain archival offload');
+assert.equal(assistantPolicy.shouldOffloadHistoricalAssistantMessage({
+  historyIndex: 1,
+  historyLength: largeHistory.length,
+  historyChars: largeChars,
+  textChars: 20_000,
+}), true, 'real history pressure must retain assistant archival offload');
+const compactedSkills = skillPolicy.compactHistoricalSkillActivations(largeHistory);
+assert.notStrictEqual(compactedSkills, largeHistory);
+assert.match(compactedSkills[0].content[0].text, /Earlier skill activation compacted/u);
+
+process.stdout.write('history-pressure-offload-regression PASS\n');