blun-king-cli 9.1.527 → 9.1.536

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 9.1.536 - 2026-09-01
+
+- Keeps productive work alive across private Telegram DMs: direct work commands no longer stop at the reply boundary, and buffered DMs inject one bounded return step unless the user explicitly pauses or stops.
+- Preserves the active work turn when short status steers arrive.
+- Downgrades exhausted empty thinking retries instead of repeating the same effort.
+- Keeps more deferred tool schemas available and delays message offload until real history pressure.
+- Includes the verified TodoList progress policy and a one-line God Mode plus Swarm startup path.
+
+## 9.1.535 - 2026-09-01
+
+- Keeps the current real user instruction complete for its entire active turn instead of aging it out after a fixed number of history messages.
+- Pins all `Read` results produced during that turn so task files and source slices cannot be replaced by historical previews while the agent is still using them.
+- Preserves the existing bounded offload behavior for completed older turns and ignores injected system reminders when locating the active user turn.
+- Adds a packaged regression derived from the F35 live case where a complete 59-line task Read was archived after only four later history messages.
+
+## 9.1.534 - 2026-09-01
+
+- Separates DeepSeek V4's native `max` reasoning effort from the explicit BLUN Swarm action, so selecting Max no longer enables agents or injects the swarm context.
+- Keeps `/effort blun-swarm` as the deliberate session-only agent mode while showing native `max` as `Max` in the effort selector and session header.
+- Adds a mutation-backed packaged-bundle regression for the native Max path and preserved explicit Swarm path.
+
+## 9.1.533 - 2026-09-01
+
+- Adds a profile-gated, session-local model switch for Fredrik between King, GLM 5.3 Flash, and GLM 5.3 without changing the global default or any other King profile.
+- Pins the external provider to the Z.AI Coding Plan endpoint, reads its credential only from a validated profile-relative file, and sends always-on thinking with the explicit `low`, `high`, or `max` effort selected in the TUI.
+- Preserves the selected alias across normal prompts and resume while keeping new sessions on King, and rejects provider, alias, endpoint, effort, secret-path, and catalog widening mutations.
+- Adds focused provider, payload, picker, profile-isolation, secret-format, and mutation regressions to the package gate.
+
+## 9.1.532 - 2026-09-01
+
+- Makes automatic TodoList maintenance compare canonical visible state instead of treating every accepted rewrite as progress, while keeping truthful unchanged refreshes executable and the normal recovery tool catalogue available.
+- Preserves bounded work evidence across unchanged refreshes, asks for a concrete evidence-backed transition after two repeats, emits one non-blocking warning after three, and backs later maintenance off from 8 to at most 64 work calls.
+- Caps new and ordinary visible lists at 32 items, safely migrates oversized legacy lists only through explicit `done` pruning, and preserves bounded maintenance state across resume checkpoints.
+- Adds executable bundle, runtime, checkpoint, compatibility, and seven-mutation regressions derived from read-only fleet measurements of Fredrik, Werner, and Manfred.
+
+## 9.1.531 - 2026-09-01
+
+- Keeps nested `ProgrammaticTool` calls and results fully observable in the Wire while excluding their raw payloads from the next model context.
+- Applies the same isolation marker during replay so resume cannot reintroduce nested payloads into context.
+- Adds a mutation-backed regression for event marking, record preservation, live context exclusion, and resume reuse.
+
+## 9.1.530 - 2026-09-01
+
+- Packages the existing local semantic `CodebaseSearch` runtime and documentation instead of resolving to a source-tree-only path that does not exist after npm installation.
+- Resolves the bundled script relative to `blun.mjs`, preserves an explicit absolute `CODEBASE_INDEX_SCRIPT` override, and fails closed for missing or relative overrides.
+- Adds an executable package, resolver, Python-syntax, compatibility, and mutation regression without changing indexing, querying, permission, or model behavior.
+
+## 9.1.529 - 2026-09-01
+
+- Adds optional `response_format` support for foreground `Agent` calls, returning one canonical validated JSON envelope without changing the existing free-form result path.
+- Compiles a bounded object JSON Schema through BLUN's existing AJV validator before child creation, keeps the schema reminder inside that child, and grants no additional tools or permissions.
+- Allows exactly one cancellation-aware repair turn for invalid output, preserves the schema across automatic continuation, and rejects structured background or swarm execution until their persistence contracts are implemented separately.
+- Adds executable helper, bundled-agent, repair, cancellation, compatibility, and mutation regressions.
+
+## 9.1.528 - 2026-09-01
+
+- Adds a bounded QuickJS `ProgrammaticTool`, adapted from the verified DeepAgents interpreter pattern, so King can coordinate several sequential tool calls without returning every intermediate value to the model context.
+- Keeps every nested call inside BLUN's existing schema validation, preparation, authorization, permission, scheduler, event, and result pipeline; recursive interpreter calls and undeclared tools fail closed.
+- Separates the 120-second wall limit for real tools from the three-second guest-compute budget, propagates cancellation and turn-stop results, and exposes no host filesystem, network, process, package loader, clock, or dynamic evaluation API.
+- Adds 18 runtime tests plus executable bundle, pipeline, mutation, resource-limit, teardown, and host-isolation regressions.
+
 ## 9.1.527 - 2026-09-01
 
 - Adds DeepAgents' `/copy` workflow to copy the latest completed, non-empty assistant response through BLUN's existing cross-platform clipboard path.

package/LIESMICH.txt

@@ -9,7 +9,19 @@ Installation
 ------------
 Die geprüfte Version exakt global installieren:
 
-  npm install -g blun-king-cli@9.1.527
+  npm install -g blun-king-cli@9.1.536
+
+Todo-Fortschritt in 9.1.532
+---------------------------
+Die automatische Todo-Pflege unterscheidet jetzt zwischen einer echten
+Statusaenderung und einer unveraenderten Wiederholung. Unveraenderte,
+wahrheitsgemaesse Listen bleiben ausfuehrbar und sperren weder Datei- noch
+Shell-Werkzeuge. Nach mehrfach belegter Arbeit ohne Listenfortschritt fordert
+King einen konkreten, evidenzgestuetzten naechsten Zustand an und vergroessert
+den Wartungsabstand schrittweise bis auf 64 Werkzeugaufrufe. Neue und
+gewoehnliche sichtbare Listen sind auf 32 Punkte begrenzt; aeltere groessere
+Listen koennen ohne Datenverlust nur durch ausdruecklich als done markierte
+Punkte schrumpfen. Dieser Wartungsstand bleibt im Resume-Checkpoint erhalten.
 
 AgentSpine 0.11.4
 -----------------
@@ -553,6 +565,29 @@ Folgeturns hinweg gespeichert. Solange er offen ist, bleibt `GetMedia`
 verfügbar; King prüft den tatsächlichen Status, statt fälschlich zu behaupten,
 die Medienerzeugung sei nicht verfügbar.
 
+Begrenzte programmatische Werkzeugaufrufe
+-----------------------------------------
+
+Ab BLUN King 9.1.528 kann King bei passenden mehrstufigen Aufgaben mehrere
+aufeinanderfolgende Werkzeugaufrufe in einem isolierten `ProgrammaticTool`
+koordinieren. Zwischenergebnisse bleiben dabei im begrenzten QuickJS-Lauf,
+statt nach jedem Aufruf den Modellkontext zu vergrößern. Das Werkzeug wird wie
+andere nicht zum Kern gehörende Werkzeuge nur bei Bedarf als Schema geladen.
+
+Jeder aufrufbare Werkzeugname muss im Auftrag ausdrücklich freigegeben sein.
+Jeder verschachtelte Aufruf durchläuft weiterhin die vorhandene
+Schema-Validierung, Vorbereitungs- und Autorisierungs-Hooks,
+Freigabeentscheidung, Ablaufplanung sowie `tool.call` und `tool.result`.
+Rekursive Interpreteraufrufe werden abgewiesen. Ein verschachteltes
+`stopTurn`-Ergebnis beendet auch den äußeren Zug.
+
+Der Gast besitzt keinen direkten Zugriff auf Dateisystem, Netzwerk, Prozesse,
+Paketlader, Uhr oder dynamische Codeauswertung. Speicher, Stack, reine
+Rechenzeit, gesamte Laufzeit, Code, Zustand, Argumente, Ergebnisse und Zahl der
+Werkzeugaufrufe sind begrenzt. Langsame echte Werkzeuge verbrauchen dabei nicht
+das getrennte Rechenzeitbudget des Gastes; Abbruch und Zeitgrenze werden bis in
+laufende verschachtelte Aufrufe weitergegeben.
+
 Passende Werkzeuge ohne Such-Zwischenschritt
 ---------------------------------------------
 

package/README.md

@@ -9,9 +9,21 @@ Voraussetzung ist Node.js 24.15 oder neuer. Die geprüfte Version wird exakt
 installiert:
 
 ```powershell
-  npm install -g blun-king-cli@9.1.527
+  npm install -g blun-king-cli@9.1.536
 ```
 
+## Todo-Fortschritt in 9.1.532
+
+Die automatische Todo-Pflege unterscheidet jetzt zwischen einer echten
+Statusänderung und einer unveränderten Wiederholung. Unveränderte, wahrheitsgemäße
+Listen bleiben ausführbar und sperren weder Datei- noch Shell-Werkzeuge. Nach
+mehrfach belegter Arbeit ohne Listenfortschritt fordert King einen konkreten,
+evidenzgestützten nächsten Zustand an und vergrößert den Wartungsabstand
+schrittweise bis auf 64 Werkzeugaufrufe. Neue und gewöhnliche sichtbare Listen
+sind auf 32 Punkte begrenzt; ältere größere Listen können ohne Datenverlust nur
+durch ausdrücklich als `done` markierte Punkte schrumpfen. Dieser Wartungsstand
+bleibt im Resume-Checkpoint erhalten.
+
 ## AgentSpine 0.11.4
 
 Version 9.1.524 aktualisiert die gebündelte AgentSpine-Laufzeit auf 0.11.4 aus dem offiziellen Commit `8034487cdd24498076bac48d3f24400bca5e6ae4`. Vor der Aufnahme in BLUN King wurden die hermetischen Tests, die Host- und Installationsprüfungen, die Acceptance-Suite, das Audit und der Release-Check erfolgreich abgeschlossen.
@@ -556,6 +568,28 @@ Folgeturns hinweg gespeichert. Solange er offen ist, bleibt `GetMedia`
 verfügbar; King prüft den tatsächlichen Status, statt fälschlich zu behaupten,
 die Medienerzeugung sei nicht verfügbar.
 
+## Begrenzte programmatische Werkzeugaufrufe
+
+Ab BLUN King 9.1.528 kann King bei passenden mehrstufigen Aufgaben mehrere
+aufeinanderfolgende Werkzeugaufrufe in einem isolierten `ProgrammaticTool`
+koordinieren. Zwischenergebnisse bleiben dabei im begrenzten QuickJS-Lauf,
+statt nach jedem Aufruf den Modellkontext zu vergrößern. Das Werkzeug wird wie
+andere nicht zum Kern gehörende Werkzeuge nur bei Bedarf als Schema geladen.
+
+Jeder aufrufbare Werkzeugname muss im Auftrag ausdrücklich freigegeben sein.
+Jeder verschachtelte Aufruf durchläuft weiterhin die vorhandene
+Schema-Validierung, Vorbereitungs- und Autorisierungs-Hooks,
+Freigabeentscheidung, Ablaufplanung sowie `tool.call` und `tool.result`.
+Rekursive Interpreteraufrufe werden abgewiesen. Ein verschachteltes
+`stopTurn`-Ergebnis beendet auch den äußeren Zug.
+
+Der Gast besitzt keinen direkten Zugriff auf Dateisystem, Netzwerk, Prozesse,
+Paketlader, Uhr oder dynamische Codeauswertung. Speicher, Stack, reine
+Rechenzeit, gesamte Laufzeit, Code, Zustand, Argumente, Ergebnisse und Zahl der
+Werkzeugaufrufe sind begrenzt. Langsame echte Werkzeuge verbrauchen dabei nicht
+das getrennte Rechenzeitbudget des Gastes; Abbruch und Zeitgrenze werden bis in
+laufende verschachtelte Aufrufe weitergegeben.
+
 ## Passende Werkzeuge ohne Such-Zwischenschritt
 
 Ab BLUN King 9.1.396 vergleicht King die aktuelle Anfrage mit den bereits

package/bin/agent-resume-snapshot.cjs

@@ -1,12 +1,39 @@
 'use strict';
 
 const AGENT_RESUME_SNAPSHOT_SCHEMA_VERSION = 1;
+const MAX_TODO_PROGRESS_EVIDENCE = 8;
+const MAX_TODO_PROGRESS_EVIDENCE_CHARS = 200;
 
 function copyJsonObject(value, fallback) {
   if (value === undefined) return fallback;
   return JSON.parse(JSON.stringify(value));
 }
 
+function normalizeTodoProgressState(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  const nonNegativeInteger = (candidate, maximum) => Number.isSafeInteger(candidate)
+    ? Math.max(0, Math.min(candidate, maximum))
+    : 0;
+  const evidenceRevision = nonNegativeInteger(value.evidenceRevision, Number.MAX_SAFE_INTEGER);
+  return {
+    workCallsSinceRefresh: nonNegativeInteger(value.workCallsSinceRefresh, 64),
+    refreshRequired: value.refreshRequired === true,
+    unchangedRefreshStreak: nonNegativeInteger(value.unchangedRefreshStreak, 3),
+    recentEvidence: Array.isArray(value.recentEvidence)
+      ? value.recentEvidence
+        .filter((entry) => typeof entry === 'string')
+        .slice(-MAX_TODO_PROGRESS_EVIDENCE)
+        .map((entry) => entry.slice(0, MAX_TODO_PROGRESS_EVIDENCE_CHARS))
+      : [],
+    evidenceRevision,
+    lastMaintenanceEvidenceRevision: Math.min(
+      nonNegativeInteger(value.lastMaintenanceEvidenceRevision, Number.MAX_SAFE_INTEGER),
+      evidenceRevision,
+    ),
+    allVisibleWorkCompleted: value.allVisibleWorkCompleted === true,
+  };
+}
+
 function captureMessageTimes(agent) {
   const replayTimes = new Map();
   for (const record of agent.replayBuilder.records) {
@@ -63,6 +90,7 @@ function createAgentResumeSnapshot(agent) {
       allowedTools: agent.tools.allowedTools,
       excludedTools: [...agent.tools.excludedTools],
     },
+    todoProgress: normalizeTodoProgressState(agent.goalTodoPolicyState) ?? null,
     goal: agent.goal.state ?? null,
     turn: {
       turnId: agent.turn.turnId,
@@ -175,6 +203,8 @@ function restoreAgentResumeSnapshot(agent, snapshot) {
       : [];
     if (agent.config.hasProvider) agent.tools.initializeBuiltinTools();
 
+    agent.goalTodoPolicyState = normalizeTodoProgressState(snapshot.todoProgress);
+
     agent.goal.state = snapshot.goal === null
       ? undefined
       : copyJsonObject(snapshot.goal, undefined);
@@ -206,5 +236,6 @@ function restoreAgentResumeSnapshot(agent, snapshot) {
 module.exports = {
   AGENT_RESUME_SNAPSHOT_SCHEMA_VERSION,
   createAgentResumeSnapshot,
+  normalizeTodoProgressState,
   restoreAgentResumeSnapshot,
 };

package/bin/assistant-message-offload-policy.cjs

@@ -1,5 +1,10 @@
 'use strict';
 
+const {
+  hasHistoricalOffloadPressure,
+  historyTextChars,
+} = require('./history-offload-pressure-policy.cjs');
+
 const ASSISTANT_MESSAGE_MAX_CHARS = 4_000;
 const ASSISTANT_MESSAGE_KEEP_RECENT_MESSAGES = 20;
 const ASSISTANT_MESSAGE_PREVIEW_LINES = 5;
@@ -34,6 +39,7 @@ function isSyntheticToolArguments(value) {
 function shouldOffloadHistoricalAssistantMessage(options = {}) {
   const historyIndex = Number(options.historyIndex);
   const historyLength = Number(options.historyLength);
+  const historyChars = Number(options.historyChars);
   const textChars = Number(options.textChars);
   if (
     !Number.isSafeInteger(historyIndex)
@@ -44,7 +50,9 @@ function shouldOffloadHistoricalAssistantMessage(options = {}) {
     || historyIndex >= historyLength
   ) return false;
   const cutoff = Math.max(0, historyLength - ASSISTANT_MESSAGE_KEEP_RECENT_MESSAGES);
-  return historyIndex < cutoff && textChars > ASSISTANT_MESSAGE_MAX_CHARS;
+  return hasHistoricalOffloadPressure({ historyLength, historyChars })
+    && historyIndex < cutoff
+    && textChars > ASSISTANT_MESSAGE_MAX_CHARS;
 }
 
 function createAssistantMessagePreview(text) {
@@ -68,6 +76,7 @@ function createAssistantMessagePreview(text) {
 function shouldCompactHistoricalAssistantToolNarration(options = {}) {
   const historyIndex = Number(options.historyIndex);
   const historyLength = Number(options.historyLength);
+  const historyChars = Number(options.historyChars);
   const textChars = Number(options.textChars);
   const toolCallCount = Number(options.toolCallCount);
   const completedToolCallCount = Number(options.completedToolCallCount);
@@ -83,13 +92,18 @@ function shouldCompactHistoricalAssistantToolNarration(options = {}) {
     || toolCallCount <= 0
   ) return false;
   const cutoff = Math.max(0, historyLength - ASSISTANT_MESSAGE_KEEP_RECENT_MESSAGES);
-  return historyIndex < cutoff
+  return hasHistoricalOffloadPressure({ historyLength, historyChars })
+    && historyIndex < cutoff
     && textChars > ASSISTANT_TOOL_NARRATION_MIN_CHARS
     && completedToolCallCount === toolCallCount;
 }
 
 function compactHistoricalPostTelegramReplyNarration(messages) {
   if (!Array.isArray(messages) || messages.length === 0) return messages;
+  if (!hasHistoricalOffloadPressure({
+    historyLength: messages.length,
+    historyChars: historyTextChars(messages),
+  })) return messages;
 
   const toolNameByCallId = new Map(messages.flatMap((message) => (
     message?.role === 'assistant' && Array.isArray(message.toolCalls)
@@ -175,6 +189,10 @@ function compactCompletedSubagentCall(call, completedIds) {
 
 function compactHistoricalCompletedSubagentPrompts(messages) {
   if (!Array.isArray(messages) || messages.length === 0) return messages;
+  if (!hasHistoricalOffloadPressure({
+    historyLength: messages.length,
+    historyChars: historyTextChars(messages),
+  })) return messages;
 
   const completedIds = completedSubagentResultIds(messages);
   if (completedIds.size === 0) return messages;
@@ -256,6 +274,7 @@ module.exports = {
   compactHistoricalCompletedSubagentPrompts,
   compactHistoricalPostTelegramReplyNarration,
   createAssistantMessagePreview,
+  historyTextChars,
   isSyntheticToolArguments,
   removeSyntheticToolArgumentFailures,
   shouldCompactHistoricalAssistantToolNarration,

package/bin/codebase-search-runtime.cjs

@@ -0,0 +1,23 @@
+'use strict';
+
+const { existsSync } = require('node:fs');
+const { fileURLToPath } = require('node:url');
+const { isAbsolute } = require('node:path');
+
+function resolveCodebaseIndexScript(moduleUrl, envPath) {
+  if (typeof moduleUrl !== 'string' || moduleUrl.length === 0) return '';
+
+  if (typeof envPath === 'string' && envPath.length > 0) {
+    if (!isAbsolute(envPath) || !existsSync(envPath)) return '';
+    return envPath;
+  }
+
+  try {
+    const packaged = fileURLToPath(new URL('./codebase-index/codebase_index.py', moduleUrl));
+    return existsSync(packaged) ? packaged : '';
+  } catch {
+    return '';
+  }
+}
+
+module.exports = { resolveCodebaseIndexScript };

package/bin/empty-response-retry-policy.cjs

@@ -0,0 +1,29 @@
+'use strict';
+
+const EMPTY_LENGTH_EFFORT_DOWNGRADE = Object.freeze({
+  max: 'high',
+  xhigh: 'high',
+  high: 'low',
+  medium: 'low',
+  low: 'off',
+  minimal: 'off',
+});
+
+function nextThinkingEffortForExhaustedEmpty(input = {}) {
+  const budget = Number(input.maxCompletionTokens);
+  const completion = Number(input.completionTokens);
+  if (
+    input.emptyResponseKind !== 'length'
+    || !Number.isFinite(budget)
+    || budget <= 0
+    || !Number.isFinite(completion)
+    || completion < budget
+  ) return undefined;
+
+  return EMPTY_LENGTH_EFFORT_DOWNGRADE[String(input.thinkingEffort || '').toLowerCase()];
+}
+
+module.exports = {
+  EMPTY_LENGTH_EFFORT_DOWNGRADE,
+  nextThinkingEffortForExhaustedEmpty,
+};

package/bin/fredrik-glm-provider.cjs

@@ -0,0 +1,256 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const PROVIDER_ID = 'fredrik:zai';
+const PROVIDER_TYPE = 'openai_compatible';
+const BASE_URL = 'https://api.z.ai/api/coding/paas/v4';
+const MODEL_ALIASES = Object.freeze({
+  'fredrik/glm-5.3-flash': Object.freeze({
+    model: 'glm-5.3-flash',
+    displayName: 'GLM 5.3 Flash',
+  }),
+  'fredrik/glm-5.3': Object.freeze({
+    model: 'glm-5.3',
+    displayName: 'GLM 5.3',
+  }),
+});
+const MODEL_EFFORTS = Object.freeze(['low', 'high', 'max']);
+const MAX_SECRET_BYTES = 4096;
+
+function nonEmpty(value) {
+  if (typeof value !== 'string') return undefined;
+  const trimmed = value.trim();
+  return trimmed.length === 0 ? undefined : trimmed;
+}
+
+function normalizeBaseUrl(value) {
+  const raw = nonEmpty(value);
+  if (raw === undefined) throw new Error('Fredrik GLM base_url is required.');
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new Error('Fredrik GLM base_url is invalid.');
+  }
+  if (
+    parsed.protocol !== 'https:' ||
+    parsed.username !== '' ||
+    parsed.password !== '' ||
+    parsed.search !== '' ||
+    parsed.hash !== '' ||
+    parsed.hostname.toLowerCase() !== 'api.z.ai'
+  ) {
+    throw new Error('Fredrik GLM base_url must use the approved api.z.ai Coding endpoint.');
+  }
+  const normalized = `${parsed.origin}${parsed.pathname.replace(/\/+$/, '')}`;
+  if (normalized !== BASE_URL) {
+    throw new Error('Fredrik GLM base_url must use the approved api.z.ai Coding endpoint.');
+  }
+  return BASE_URL;
+}
+
+function resolveProfileRoot(env = process.env) {
+  const configured = nonEmpty(env.BLUN_HOME);
+  if (configured !== undefined) return path.resolve(configured);
+  const profile = nonEmpty(env.BLUN_PROFILE) ?? 'default';
+  return path.resolve(require('node:os').homedir(), '.blun', 'profile', profile);
+}
+
+function isContained(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative !== '' && !relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative);
+}
+
+function rejectUnsafeRelativePath(value) {
+  const relative = nonEmpty(value);
+  if (relative === undefined) throw new Error('Fredrik GLM api_key_file is required.');
+  if (path.isAbsolute(relative)) throw new Error('Fredrik GLM api_key_file must be profile-relative.');
+  if (relative.includes('\0')) throw new Error('Fredrik GLM api_key_file contains a NUL byte.');
+  if (relative.split(/[\\/]/u).some((part) => part === '..' || part.includes(':'))) {
+    throw new Error('Fredrik GLM api_key_file escapes the profile or uses an alternate data stream.');
+  }
+  return relative;
+}
+
+function assertNoSymlinkPath(root, candidate) {
+  const relative = path.relative(root, candidate);
+  let cursor = root;
+  for (const segment of relative.split(path.sep)) {
+    cursor = path.join(cursor, segment);
+    const info = fs.lstatSync(cursor);
+    if (info.isSymbolicLink()) throw new Error('Fredrik GLM api_key_file must not use links or reparse points.');
+  }
+}
+
+function assertWindowsAcl(filePath) {
+  if (process.platform !== 'win32') return;
+  const script = [
+    '$target = $env:BLUN_SECRET_ACL_PATH',
+    '$unsafe = @("S-1-1-0", "S-1-5-11", "S-1-5-32-545")',
+    '$writeMask = [System.Security.AccessControl.FileSystemRights]::Write -bor [System.Security.AccessControl.FileSystemRights]::Modify -bor [System.Security.AccessControl.FileSystemRights]::FullControl -bor [System.Security.AccessControl.FileSystemRights]::CreateFiles -bor [System.Security.AccessControl.FileSystemRights]::AppendData -bor [System.Security.AccessControl.FileSystemRights]::WriteData',
+    'foreach ($rule in (Get-Acl -LiteralPath $target).Access) {',
+    '  if ($rule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { continue }',
+    '  $sid = $rule.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value',
+    '  if ($unsafe -contains $sid -and (($rule.FileSystemRights -band $writeMask) -ne 0)) { exit 23 }',
+    '}',
+    'exit 0',
+  ].join('; ');
+  const result = spawnSync('powershell.exe', ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', script], {
+    encoding: 'utf8',
+    windowsHide: true,
+    timeout: 5000,
+    env: { ...process.env, BLUN_SECRET_ACL_PATH: filePath },
+  });
+  if (result.status === 23) throw new Error('Fredrik GLM api_key_file ACL is too permissive.');
+  if (result.status !== 0) throw new Error('Fredrik GLM api_key_file ACL could not be verified.');
+}
+
+function readApiKeyFile(provider, env = process.env) {
+  if (provider?.type !== PROVIDER_TYPE) throw new Error('Fredrik GLM provider type is invalid.');
+  if (provider.apiKey !== undefined || provider.env !== undefined || provider.oauth !== undefined || provider.customHeaders !== undefined) {
+    throw new Error('Fredrik GLM accepts only api_key_file authentication.');
+  }
+  normalizeBaseUrl(provider.baseUrl);
+  const profileRoot = resolveProfileRoot(env);
+  const relative = rejectUnsafeRelativePath(provider.apiKeyFile);
+  if (relative.replaceAll('\\', '/') !== 'secrets/zai-api-key.txt') {
+    throw new Error('Fredrik GLM api_key_file must use the approved profile-relative path.');
+  }
+  const candidate = path.resolve(profileRoot, relative);
+  if (!isContained(profileRoot, candidate)) throw new Error('Fredrik GLM api_key_file escapes the profile root.');
+  let rootReal;
+  let candidateReal;
+  try {
+    rootReal = fs.realpathSync(profileRoot);
+    assertNoSymlinkPath(profileRoot, candidate);
+    candidateReal = fs.realpathSync(candidate);
+  } catch (error) {
+    if (error instanceof Error && /links or reparse points/u.test(error.message)) throw error;
+    throw new Error('Fredrik GLM api_key_file could not be resolved safely.');
+  }
+  if (!isContained(rootReal, candidateReal)) throw new Error('Fredrik GLM api_key_file escapes the resolved profile root.');
+  let info;
+  try {
+    info = fs.statSync(candidateReal);
+  } catch {
+    throw new Error('Fredrik GLM api_key_file could not be inspected safely.');
+  }
+  if (!info.isFile()) throw new Error('Fredrik GLM api_key_file must be a regular file.');
+  if (info.size < 1 || info.size > MAX_SECRET_BYTES) throw new Error('Fredrik GLM api_key_file has an invalid size.');
+  assertWindowsAcl(candidateReal);
+  let raw;
+  try {
+    raw = fs.readFileSync(candidateReal);
+  } catch {
+    throw new Error('Fredrik GLM api_key_file could not be read safely.');
+  }
+  if (raw[0] === 0xef && raw[1] === 0xbb && raw[2] === 0xbf) throw new Error('Fredrik GLM api_key_file must not contain a BOM.');
+  if (raw.includes(0)) throw new Error('Fredrik GLM api_key_file must not contain NUL bytes.');
+  const text = raw.toString('utf8');
+  if (Buffer.from(text, 'utf8').compare(raw) !== 0) throw new Error('Fredrik GLM api_key_file must be valid UTF-8.');
+  const lines = text.replace(/\r?\n$/u, '').split(/\r?\n/u);
+  if (lines.length !== 1 || lines[0].trim().length === 0 || lines[0] !== lines[0].trim()) {
+    throw new Error('Fredrik GLM api_key_file must contain exactly one non-empty line.');
+  }
+  return lines[0];
+}
+
+function isConfiguredAlias(alias, entry) {
+  const expected = MODEL_ALIASES[alias];
+  const capabilities = Array.isArray(entry?.capabilities) ? entry.capabilities : [];
+  const efforts = Array.isArray(entry?.supportEfforts) ? entry.supportEfforts : [];
+  return (
+    expected !== undefined &&
+    entry?.provider === PROVIDER_ID &&
+    entry.model === expected.model &&
+    entry.displayName === expected.displayName &&
+    entry.defaultEffort === 'max' &&
+    efforts.length === MODEL_EFFORTS.length &&
+    efforts.every((effort, index) => effort === MODEL_EFFORTS[index]) &&
+    capabilities.includes('always_thinking') &&
+    capabilities.includes('tool_use')
+  );
+}
+
+function configuredModels(models) {
+  const out = {};
+  for (const alias of Object.keys(MODEL_ALIASES)) {
+    const entry = models?.[alias];
+    if (isConfiguredAlias(alias, entry)) out[alias] = entry;
+  }
+  return out;
+}
+
+function configuredProvider(providers) {
+  const provider = providers?.[PROVIDER_ID];
+  if (provider?.type !== PROVIDER_TYPE) return undefined;
+  if (
+    provider.apiKey !== undefined ||
+    provider.env !== undefined ||
+    provider.oauth !== undefined ||
+    provider.customHeaders !== undefined ||
+    provider.apiKeyFile !== 'secrets/zai-api-key.txt'
+  ) return undefined;
+  try {
+    normalizeBaseUrl(provider.baseUrl);
+  } catch {
+    return undefined;
+  }
+  return provider;
+}
+
+function isAllowedRuntimeAlias(alias, models) {
+  return alias === 'blun/king' || isConfiguredAlias(alias, models?.[alias]);
+}
+
+function normalizeEffort(effort) {
+  if (!MODEL_EFFORTS.includes(effort)) throw new Error('GLM 5.3 supports only low, high, or max reasoning effort.');
+  return effort;
+}
+
+function requestControls(effort) {
+  return Object.freeze({
+    thinking: Object.freeze({ type: 'enabled' }),
+    reasoning_effort: normalizeEffort(effort),
+  });
+}
+
+function safeDiagnostic(alias, models, providers, credentialPresent = false) {
+  const entry = models?.[alias];
+  if (!isConfiguredAlias(alias, entry)) throw new Error('Unknown Fredrik GLM alias.');
+  const provider = configuredProvider(providers);
+  if (provider === undefined) throw new Error('Fredrik GLM provider is not configured safely.');
+  return Object.freeze({
+    alias,
+    alias_source: 'profile-config',
+    provider: PROVIDER_ID,
+    provider_type: PROVIDER_TYPE,
+    model: entry.model,
+    base_host: 'api.z.ai',
+    credential_source: 'profile-file',
+    credential_present: credentialPresent === true,
+    credential_fingerprint: null,
+    wire_format: 'openai-chat-completions',
+    health: 'untested',
+  });
+}
+
+module.exports = Object.freeze({
+  PROVIDER_ID,
+  PROVIDER_TYPE,
+  BASE_URL,
+  MODEL_ALIASES,
+  MODEL_EFFORTS,
+  normalizeBaseUrl,
+  readApiKeyFile,
+  configuredModels,
+  configuredProvider,
+  isAllowedRuntimeAlias,
+  isConfiguredAlias,
+  normalizeEffort,
+  requestControls,
+  safeDiagnostic,
+});

package/bin/history-offload-pressure-policy.cjs

@@ -0,0 +1,33 @@
+'use strict';
+
+const HISTORY_OFFLOAD_MIN_MESSAGES = 64;
+const HISTORY_OFFLOAD_MIN_CHARS = 1_000_000;
+
+function messageTextChars(message) {
+  if (!Array.isArray(message?.content)) return 0;
+  return message.content.reduce((total, part) => (
+    total + (part?.type === 'text' && typeof part.text === 'string' ? part.text.length : 0)
+  ), 0);
+}
+
+function historyTextChars(messages) {
+  if (!Array.isArray(messages)) return 0;
+  return messages.reduce((total, message) => total + messageTextChars(message), 0);
+}
+
+function hasHistoricalOffloadPressure(options = {}) {
+  const historyLength = Number(options.historyLength);
+  const historyChars = Number(options.historyChars);
+  return Number.isSafeInteger(historyLength)
+    && Number.isSafeInteger(historyChars)
+    && historyLength >= HISTORY_OFFLOAD_MIN_MESSAGES
+    && historyChars >= HISTORY_OFFLOAD_MIN_CHARS;
+}
+
+module.exports = {
+  HISTORY_OFFLOAD_MIN_CHARS,
+  HISTORY_OFFLOAD_MIN_MESSAGES,
+  hasHistoricalOffloadPressure,
+  historyTextChars,
+  messageTextChars,
+};