chainlesschain 0.166.114 → 0.166.117

package/src/lib/evolution/evolution-evidence-projector.js

@@ -11,12 +11,15 @@
 
 import { createHash, randomBytes } from "node:crypto";
 import {
+  AGENT_MODEL_REQUEST_LIMITS,
+  AGENT_MODEL_IMAGE_LIMITS,
   projectAgentOpaqueTransportBlock,
   snapshotAgentModelRequest,
 } from "./agent-model-projection.js";
 import { snapshotSkillDecisionPayload } from "./skill-decision-projection.js";
 import {
   createEvidenceJsonTextBoundary,
+  AGENT_CODE_TEXT_RESULT_TOOLS,
   EVIDENCE_JSON_POLICY,
   isAgentToolArgumentsPath,
 } from "./evidence-json-text.js";
@@ -93,6 +96,8 @@ const TRUSTED_PAYLOAD_COMMITMENT_PURPOSE =
 const LEGACY_LOCAL_UI_TENANT_ID_PATTERN = /^local-ui-[a-f0-9]{32}$/u;
 const FORMATTED_LOCAL_UI_TENANT_ID_PATTERN =
   /^local-ui-(?:[a-f0-9]{8}-){3}[a-f0-9]{8}$/u;
+const ENCODED_LOCAL_UI_TENANT_ID_PATTERN =
+  /^local-ui-(?:[a-p]{8}-){3}[a-p]{8}$/u;
 
 const INPUT_KEYS = new Set(["sourceEnvelope", "payload"]);
 const SOURCE_VERIFICATION_KEYS = new Set([
@@ -513,13 +518,41 @@ export const EVOLUTION_AGENT_MODEL_PROJECTION_RULESET_V2_DIGEST = `sha256:${crea
     "utf8",
   )
   .digest("hex")}`;
-const AGENT_MODEL_RULESET = Object.freeze({
+const AGENT_MODEL_RULESET_V3 = Object.freeze({
   ...AGENT_MODEL_RULESET_V2,
   schema: "chainlesschain.evolution-agent-model-projection-rules/v3",
   version: 3,
   opaqueTransportPolicy:
     "digest-bound-base64-image-and-signed-thinking-no-plaintext-projection-v1",
 });
+export const EVOLUTION_AGENT_MODEL_PROJECTION_RULESET_V3_DIGEST = `sha256:${createHash(
+  "sha256",
+)
+  .update(
+    `${AGENT_MODEL_RULESET_V3.schema}\0${JSON.stringify(AGENT_MODEL_RULESET_V3)}`,
+    "utf8",
+  )
+  .digest("hex")}`;
+const AGENT_MODEL_RULESET = Object.freeze({
+  ...AGENT_MODEL_RULESET_V3,
+  schema: "chainlesschain.evolution-agent-model-projection-rules/v4",
+  version: 4,
+  codeTextPolicy: "paired-code-source-and-result-literal-scan-v1",
+  codeTextResultTools: AGENT_CODE_TEXT_RESULT_TOOLS,
+  // ArtifactPorts caps the complete durable record at 1 MiB. Reserve room for
+  // provenance/findings and the record envelope; no storage limit is relaxed.
+  maxModelBytes: AGENT_MODEL_REQUEST_LIMITS.maxBytes - 128 * 1024,
+  maxStringChars: AGENT_MODEL_REQUEST_LIMITS.maxBytes - 128 * 1024,
+  maxNodes: AGENT_MODEL_REQUEST_LIMITS.maxNodes,
+  maxDepth: AGENT_MODEL_REQUEST_LIMITS.maxDepth,
+  decodedDepthPolicy: "independent-bounded-json-depth-v1",
+  imageBudget: AGENT_MODEL_IMAGE_LIMITS,
+  jsonTextPolicy: Object.freeze({
+    ...EVIDENCE_JSON_POLICY,
+    version: 2,
+    maxNodes: AGENT_MODEL_REQUEST_LIMITS.maxNodes,
+  }),
+});
 export const EVOLUTION_AGENT_MODEL_PROJECTION_RULESET_DIGEST = `sha256:${createHash(
   "sha256",
 )
@@ -550,6 +583,7 @@ const SUPPORTED_RULESETS = new Map([
   [RAW_RULESET_V3_DIGEST, RAW_RULESET_V3],
   [AGENT_MODEL_RULESET_V1_DIGEST, AGENT_MODEL_RULESET_V1],
   [EVOLUTION_AGENT_MODEL_PROJECTION_RULESET_V2_DIGEST, AGENT_MODEL_RULESET_V2],
+  [EVOLUTION_AGENT_MODEL_PROJECTION_RULESET_V3_DIGEST, AGENT_MODEL_RULESET_V3],
   [EVOLUTION_AGENT_MODEL_PROJECTION_RULESET_DIGEST, AGENT_MODEL_RULESET],
 ]);
 
@@ -625,6 +659,7 @@ const AGENT_VALUE_PATTERNS = Object.freeze([
 function valuePatterns(ruleset) {
   return ruleset === SKILL_DECISION_RULESET ||
     ruleset === AGENT_MODEL_RULESET ||
+    ruleset === AGENT_MODEL_RULESET_V3 ||
     ruleset === AGENT_MODEL_RULESET_V2 ||
     ruleset === AGENT_MODEL_RULESET_V1
     ? AGENT_VALUE_PATTERNS
@@ -688,7 +723,12 @@ function assertExactRecord(
   }
 }
 
-function canonicalJson(value, seen = new Set(), depth = 0) {
+function canonicalJson(
+  value,
+  seen = new Set(),
+  depth = 0,
+  maximumBytes = 2 * 1024 * 1024,
+) {
   if (depth > 32) {
     throw projectionError(
       EVOLUTION_PROJECTION_INVALID_CODE,
@@ -710,10 +750,12 @@ function canonicalJson(value, seen = new Set(), depth = 0) {
     output = JSON.stringify(value);
   }
   if (output !== undefined) {
-    if (Buffer.byteLength(output, "utf8") > 2 * 1024 * 1024) {
+    if (Buffer.byteLength(output, "utf8") > maximumBytes) {
       throw projectionError(
         EVOLUTION_PROJECTION_INVALID_CODE,
-        "projection exceeds the 2 MiB admission limit",
+        maximumBytes === 2 * 1024 * 1024
+          ? "projection exceeds the 2 MiB admission limit"
+          : "Agent image transport exceeds its canonical byte budget",
       );
     }
     return output;
@@ -755,7 +797,9 @@ function canonicalJson(value, seen = new Set(), depth = 0) {
           "projection arrays must use enumerable own data entries",
         );
       }
-      entries.push(canonicalJson(descriptor.value, seen, depth + 1));
+      entries.push(
+        canonicalJson(descriptor.value, seen, depth + 1, maximumBytes),
+      );
     }
     output = `[${entries.join(",")}]`;
   } else {
@@ -782,24 +826,29 @@ function canonicalJson(value, seen = new Set(), depth = 0) {
         );
       }
       fields.push(
-        `${JSON.stringify(key)}:${canonicalJson(descriptor.value, seen, depth + 1)}`,
+        `${JSON.stringify(key)}:${canonicalJson(descriptor.value, seen, depth + 1, maximumBytes)}`,
       );
     }
     output = `{${fields.join(",")}}`;
   }
   seen.delete(value);
-  if (Buffer.byteLength(output, "utf8") > 2 * 1024 * 1024) {
+  if (Buffer.byteLength(output, "utf8") > maximumBytes) {
     throw projectionError(
       EVOLUTION_PROJECTION_INVALID_CODE,
-      "projection exceeds the 2 MiB admission limit",
+      maximumBytes === 2 * 1024 * 1024
+        ? "projection exceeds the 2 MiB admission limit"
+        : "Agent image transport exceeds its canonical byte budget",
     );
   }
   return output;
 }
 
-function digest(value, domain) {
+function digest(value, domain, maximumBytes) {
   return `sha256:${createHash("sha256")
-    .update(`${domain}\0${canonicalJson(value)}`, "utf8")
+    .update(
+      `${domain}\0${canonicalJson(value, new Set(), 0, maximumBytes)}`,
+      "utf8",
+    )
     .digest("hex")}`;
 }
 
@@ -877,17 +926,32 @@ function normalizeId(value, label, maximum = 256) {
   return value;
 }
 
-function normalizeTenantId(value, label) {
-  if (
+function isLocalUiTenantId(value) {
+  return (
     typeof value === "string" &&
     (LEGACY_LOCAL_UI_TENANT_ID_PATTERN.test(value) ||
-      FORMATTED_LOCAL_UI_TENANT_ID_PATTERN.test(value))
-  ) {
-    return value;
-  }
+      FORMATTED_LOCAL_UI_TENANT_ID_PATTERN.test(value) ||
+      ENCODED_LOCAL_UI_TENANT_ID_PATTERN.test(value))
+  );
+}
+
+function normalizeTenantId(value, label) {
+  if (isLocalUiTenantId(value)) return value;
   return normalizeId(value, label);
 }
 
+function normalizeLocalAttestationId(value, label, tenantId, suffix) {
+  // A bound local identity is already admitted as tenant metadata. Inspect its
+  // fixed reference structure without treating its random digits as content;
+  // preserve the original signed bytes and scan every other identifier fully.
+  const scanValue =
+    isLocalUiTenantId(tenantId) && value === `local-ui-${tenantId}-${suffix}`
+      ? `local-ui-local-identity-${suffix}`
+      : value;
+  normalizeId(scanValue, label);
+  return value;
+}
+
 function normalizeDigest(
   value,
   label,
@@ -946,7 +1010,6 @@ function normalizeOpaqueUri(value, { label, schemes, tenantId }) {
       `${label} is invalid`,
     );
   }
-  assertNoKnownSecrets(value);
   if (
     /[?#@\\%\s]/u.test(value) ||
     hasUriControlOrWhitespace(value) ||
@@ -985,7 +1048,11 @@ function normalizeOpaqueUri(value, { label, schemes, tenantId }) {
     parsed.port ||
     parsed.search ||
     parsed.hash ||
-    parsed.hostname !== formatLocalUiTenantReferenceId(tenantId) ||
+    (parsed.hostname !== formatLocalUiTenantReferenceId(tenantId) &&
+      !(
+        LEGACY_LOCAL_UI_TENANT_ID_PATTERN.test(tenantId) &&
+        parsed.hostname === tenantId
+      )) ||
     !decodedPath.startsWith("/") ||
     decodedPath
       .split("/")
@@ -996,6 +1063,14 @@ function normalizeOpaqueUri(value, { label, schemes, tenantId }) {
       `${label} is outside the tenant-scoped URI policy`,
     );
   }
+  // Only the exact, bound local host is identity metadata. Keep the complete
+  // original path in the scan, and never rewrite persisted URI/digest bytes.
+  const localPrefix = `${scheme}://${parsed.hostname}`;
+  const scanValue =
+    isLocalUiTenantId(tenantId) && value.startsWith(`${localPrefix}/`)
+      ? `${scheme}://local-ui-identity${value.slice(localPrefix.length)}`
+      : value;
+  assertNoKnownSecrets(scanValue);
   return value;
 }
 
@@ -1268,6 +1343,43 @@ function sanitizeString(value, path, findings, injections, ruleset, patterns) {
   return output;
 }
 
+function isAgentCodeTextPath(payload, path, resultToolNames) {
+  if (
+    path[0] !== "messages" ||
+    !/^\d+$/u.test(path[1] ?? "") ||
+    !Array.isArray(payload?.messages)
+  ) {
+    return false;
+  }
+  const message = payload.messages[Number(path[1])];
+  if (!message || typeof message !== "object") return false;
+  if (
+    path[2] === "tool_calls" &&
+    /^\d+$/u.test(path[3] ?? "") &&
+    path[4] === "function" &&
+    path[5] === "arguments"
+  ) {
+    const call = message.tool_calls?.[Number(path[3])];
+    const fields = path.slice(6);
+    if (fields[0] === "$json") fields.shift();
+    return call?.function?.name === "run_code" && fields[0] === "code";
+  }
+  if (path[2] === "content" && message.role === "tool") {
+    const callId = message.tool_call_id;
+    return payload.messages.some(
+      (candidate) =>
+        candidate?.role === "assistant" &&
+        Array.isArray(candidate.tool_calls) &&
+        candidate.tool_calls.some(
+          (call) =>
+            call?.id === callId &&
+            resultToolNames.includes(call?.function?.name),
+        ),
+    );
+  }
+  return false;
+}
+
 function sanitizePayload(
   payload,
   ruleset = RULESET,
@@ -1278,8 +1390,10 @@ function sanitizePayload(
   let nodes = 0;
   let truncated = false;
   const jsonText = ruleset.jsonTextPolicy
-    ? createEvidenceJsonTextBoundary((message) =>
-        projectionError(EVOLUTION_PROJECTION_INVALID_CODE, message),
+    ? createEvidenceJsonTextBoundary(
+        (message) =>
+          projectionError(EVOLUTION_PROJECTION_INVALID_CODE, message),
+        ruleset.jsonTextPolicy,
       )
     : null;
   const visit = (value, path, depth, layer = 0) => {
@@ -1295,7 +1409,7 @@ function sanitizePayload(
     }
     const toolArguments = jsonText && isAgentToolArgumentsPath(path);
     const opaqueTransportBlock =
-      ruleset === AGENT_MODEL_RULESET
+      ruleset === AGENT_MODEL_RULESET || ruleset === AGENT_MODEL_RULESET_V3
         ? projectAgentOpaqueTransportBlock(value, path.join("."))
         : null;
     if (opaqueTransportBlock !== null) return opaqueTransportBlock;
@@ -1309,11 +1423,25 @@ function sanitizePayload(
       const plain = (text) =>
         sanitizeString(text, path, findings, injections, ruleset, patterns);
       if (!jsonText) return plain(value);
+      const codeText =
+        ruleset.codeTextPolicy ===
+          "paired-code-source-and-result-literal-scan-v1" &&
+        isAgentCodeTextPath(payload, path, ruleset.codeTextResultTools);
       const output = jsonText(value, {
         layer,
         objectOnly: toolArguments,
+        codeText,
         visit: (decoded, nextLayer) =>
-          visit(decoded, [...path, "$json"], depth + 1, nextLayer),
+          visit(
+            decoded,
+            [...path, "$json"],
+            // Serialized JSON has its own unchanged depth/layer limits. Its
+            // traversal must not charge protocol nesting as decoded depth.
+            ruleset.decodedDepthPolicy === "independent-bounded-json-depth-v1"
+              ? 0
+              : depth + 1,
+            nextLayer,
+          ),
         plain,
         equal: (left, right) => canonicalJson(left) === canonicalJson(right),
       });
@@ -2291,8 +2419,18 @@ function validateAttestation(value, receipt) {
       "projection attestation is invalid or unbound",
     );
   }
-  normalizeId(value.keyId, "attestation keyId");
-  normalizeId(value.issuer, "attestation issuer");
+  normalizeLocalAttestationId(
+    value.keyId,
+    "attestation keyId",
+    receipt.tenantId,
+    "attestation",
+  );
+  normalizeLocalAttestationId(
+    value.issuer,
+    "attestation issuer",
+    receipt.tenantId,
+    "evolution-projector",
+  );
   return deepFreeze(cloneCanonical(value));
 }
 
@@ -3007,7 +3145,7 @@ function validateBundleIntegrity(bundle) {
   validateRedactionSummary(model.redactionSummary);
   if (
     !Array.isArray(model.injectionFindings) ||
-    model.injectionFindings.length > RULESET.maxNodes * 2
+    model.injectionFindings.length > ruleset.maxNodes * 2
   ) {
     throw projectionError(
       EVOLUTION_PROJECTION_INVALID_CODE,
@@ -3149,12 +3287,14 @@ function validateBundleIntegrity(bundle) {
     }
     if (
       ruleset === AGENT_MODEL_RULESET ||
+      ruleset === AGENT_MODEL_RULESET_V3 ||
       ruleset === AGENT_MODEL_RULESET_V2 ||
       ruleset === AGENT_MODEL_RULESET_V1
     ) {
       snapshotAgentModelRequest(model.content, {
         allowStructuredArgumentText: ruleset !== AGENT_MODEL_RULESET_V1,
-        allowOpaqueTransportBlocks: ruleset === AGENT_MODEL_RULESET,
+        allowOpaqueTransportBlocks:
+          ruleset === AGENT_MODEL_RULESET || ruleset === AGENT_MODEL_RULESET_V3,
       });
       if (
         model.truncated ||
@@ -3439,6 +3579,9 @@ export class EvolutionEvidenceProjector {
     const sourceInputDigest = digest(
       payload,
       "chainlesschain.evolution-raw-plaintext/v2",
+      ruleset === AGENT_MODEL_RULESET
+        ? AGENT_MODEL_IMAGE_LIMITS.maxCanonicalRequestBytes
+        : undefined,
     );
     const sourceEnvelopeDigest = digest(
       input.sourceEnvelope,

package/src/lib/evolution/governed-model-turn.js

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { types } from "node:util";
 import { captureAgentEvolutionRuntimeComposition } from "./agent-evolution-runtime-composition-brand.js";
 import { captureAgentEvolutionIngress } from "./agent-evolution-ingress.js";
-import { formatOpaqueHexId } from "./opaque-hex-id.js";
+import { encodeOpaqueHexId } from "./opaque-hex-id.js";
 
 export function readEvolutionCompositionFactory(dependencies = {}) {
   if (
@@ -44,7 +44,7 @@ export async function prepareGovernedModelTurn(
   }
   if (typeof factory !== "function")
     throw new TypeError("Invalid evolution composition factory");
-  const runId = `${mode}-${formatOpaqueHexId(
+  const runId = `${mode}-${encodeOpaqueHexId(
     randomUUID().replaceAll("-", ""),
   )}`;
   const composition = captureAgentEvolutionRuntimeComposition(

package/src/lib/evolution/local-ui-evolution-deployment.js

@@ -21,7 +21,7 @@ import {
   flushWindowsLocalNtfsDirectory,
 } from "./evolution-windows-directory-durability.js";
 import { withFileLockAsync } from "../with-file-lock.js";
-import { formatOpaqueHexId } from "./opaque-hex-id.js";
+import { encodeOpaqueHexId } from "./opaque-hex-id.js";
 import {
   configureEvolutionDeployment,
   getEvolutionDeploymentStatus,
@@ -660,7 +660,7 @@ export async function initializeDefaultLocalUiEvolutionDeployment(
         removeIncompleteStage(stagePath, parent);
         fs.mkdirSync(stagePath, { mode: 0o700 });
         privateDirectory(stagePath);
-        const tenantId = `local-ui-${formatOpaqueHexId(
+        const tenantId = `local-ui-${encodeOpaqueHexId(
           randomUUID().replaceAll("-", ""),
         )}`;
         const paths = writeDeployment(stagePath, destination, tenantId);

package/src/lib/evolution/local-ui-evolution-runtime.js

@@ -25,7 +25,7 @@ import { loadLocalUiEvolutionDeployment } from "./local-ui-evolution-deployment.
 import { createLocalUiEvolutionFileSystem } from "./evolution-windows-directory-durability.js";
 import {
   formatLocalUiTenantReferenceId,
-  formatOpaqueHexId,
+  encodeOpaqueHexId,
 } from "./opaque-hex-id.js";
 
 const SOURCE_ENVELOPE_SCHEMA = "chainlesschain.local-ui-source-envelope/v1";
@@ -84,7 +84,7 @@ function sha256(value) {
 }
 
 function sourceRefSegment(value, purpose) {
-  return formatOpaqueHexId(
+  return encodeOpaqueHexId(
     createHash("sha256")
       .update(
         `chainlesschain.local-ui-source-ref/v1\0${purpose}\0${value}`,
@@ -615,9 +615,9 @@ export async function createLocalUiEvolutionComposition({
       witness,
     },
     evidenceIdGenerator: async () =>
-      `evidence-${formatOpaqueHexId(randomUUID().replaceAll("-", ""))}`,
+      `evidence-${encodeOpaqueHexId(randomUUID().replaceAll("-", ""))}`,
     ingressIdGenerator: () =>
-      `ingress-${formatOpaqueHexId(randomUUID().replaceAll("-", ""))}`,
+      `ingress-${encodeOpaqueHexId(randomUUID().replaceAll("-", ""))}`,
     secure: true,
     fsImpl,
   });

package/src/lib/evolution/opaque-hex-id.js

@@ -18,6 +18,14 @@ export function formatOpaqueHexId(value) {
   return groups.join("-");
 }
 
+// Keep every hexadecimal nibble while preventing generated identifiers from
+// resembling payment-card or phone numbers across their group separators.
+export function encodeOpaqueHexId(value) {
+  return formatOpaqueHexId(value).replace(/[0-9]/gu, (digit) =>
+    String.fromCharCode(103 + Number(digit)),
+  );
+}
+
 export function formatLocalUiTenantReferenceId(value) {
   const prefix = "local-ui-";
   if (typeof value !== "string" || !value.startsWith(prefix)) return value;

package/src/lib/image-token-estimate.js

@@ -0,0 +1,59 @@
+// Context planning estimates vision work separately from base64 transport.
+// Providers and models meter images differently. These are planning reserves;
+// provider usage receipts remain authoritative for token and cost settlement.
+export const IMAGE_TOKEN_RESERVE = 8192;
+export const LOW_DETAIL_IMAGE_TOKEN_RESERVE = 1024;
+const BASE64_ALPHABET =
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+export function inspectCanonicalImageDataUrl(url) {
+  if (typeof url !== "string") return null;
+  const match =
+    /^data:image\/(?:png|jpeg|gif|webp);base64,([A-Za-z0-9+/]+={0,2})$/u.exec(
+      url,
+    );
+  if (!match || match[1].length % 4 !== 0) return null;
+  const data = match[1];
+  const padding = data.endsWith("==") ? 2 : data.endsWith("=") ? 1 : 0;
+  const finalValue = BASE64_ALPHABET.indexOf(data[data.length - padding - 1]);
+  if (
+    (padding === 2 && finalValue % 16 !== 0) ||
+    (padding === 1 && finalValue % 4 !== 0)
+  )
+    return null;
+  return {
+    decodedBytes: (data.length / 4) * 3 - padding,
+    encodedBytes: data.length,
+  };
+}
+
+export function imageTransportEstimate(messages) {
+  let bytes = 0;
+  let tokens = 0;
+  for (const message of messages) {
+    if (message?.role !== "user" || !Array.isArray(message.content)) continue;
+    for (const block of message.content) {
+      if (
+        block?.type !== "image_url" ||
+        Object.keys(block).sort().join() !== "image_url,type" ||
+        !block.image_url ||
+        Object.keys(block.image_url).some(
+          (key) => !["url", "detail"].includes(key),
+        )
+      )
+        continue;
+      const { url, detail } = block.image_url;
+      if (
+        typeof url !== "string" ||
+        (detail !== undefined && !["auto", "low", "high"].includes(detail)) ||
+        !inspectCanonicalImageDataUrl(url)
+      )
+        continue;
+      // Canonical base64 data URLs are ASCII and need no JSON escaping.
+      bytes += url.length;
+      tokens +=
+        detail === "low" ? LOW_DETAIL_IMAGE_TOKEN_RESERVE : IMAGE_TOKEN_RESERVE;
+    }
+  }
+  return { bytes, tokens };
+}

package/src/lib/read-file-loop-guard.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { EXPLORATION_TOOLS } from "./task-progress-tracker.js";
 import { isToolRecoveryPaused } from "./tool-recovery-result.js";
+import { hostToolOutputIdentity } from "./tool-result-preview.js";
 const MAX_FILES = 12;
 
 function keyFor(filePath, args) {
@@ -250,7 +251,7 @@ export class ReadFileLoopGuard {
           if (page.error || !page.readSpan) return page;
           page.readRecovery = {
             action: "continued",
-            requestedRange,
+            ...(requestedRange !== undefined ? { requestedRange } : {}),
             resumedRange: page.range,
           };
           newContent = true;
@@ -258,7 +259,7 @@ export class ReadFileLoopGuard {
           return {
             path: filePath,
             fileVersion,
-            range: page.range,
+            ...(page.range !== undefined ? { range: page.range } : {}),
             hashed: args.hashed === true,
             alreadyRead: true,
             contentOmitted: true,
@@ -353,14 +354,16 @@ export class ReadFileLoopGuard {
     } else if (
       (tool === "run_code" || tool === "run_shell") &&
       typeof result?.output === "string" &&
-      result.output.length >= 8000
+      (result.output.length >= 8000 ||
+        hostToolOutputIdentity(result)?.chars >= 8000)
     ) {
       // Arbitrary code may just dump the same file again. Compare returned
       // evidence, not code spelling or timings. Never cache/skip execution:
       // identical stdout does not imply identical filesystem side effects.
-      const fingerprint = createHash("sha256")
-        .update(result.output)
-        .digest("hex");
+      const identity = hostToolOutputIdentity(result);
+      const fingerprint = identity
+        ? `${identity.chars}:${identity.digest}`
+        : createHash("sha256").update(result.output).digest("hex");
       if (this.largeOutputs.has(fingerprint)) this.batch.duplicates++;
       else {
         this.largeOutputs.add(fingerprint);

package/src/lib/session-history-origins.js

@@ -1,4 +1,7 @@
-import { canonicalDigest } from "@chainlesschain/context-memory-kernel";
+import {
+  canonicalDigest,
+  canonicalJson,
+} from "@chainlesschain/context-memory-kernel";
 import {
   contextItemsToMessages,
   messagesToContextItems,
@@ -33,6 +36,19 @@ const historyBearing = (entry) =>
   );
 const fingerprint = (messages) =>
   canonicalDigest(messages.map(encodePersistedMessage));
+const sameContextItemContent = (left, right) => {
+  if (typeof left?.content === "string" || typeof right?.content === "string") {
+    return (
+      typeof left?.content === "string" &&
+      typeof right?.content === "string" &&
+      left.content === right.content
+    );
+  }
+  if (left?.contentRef === undefined || right?.contentRef === undefined) {
+    return false;
+  }
+  return canonicalJson(left.contentRef) === canonicalJson(right.contentRef);
+};
 
 /**
  * Origins belong to positions in the current display history, never to equal
@@ -128,7 +144,7 @@ export function createSessionHistoryOrigins() {
         if (context) {
           const originals = messagesToContextItems(
             context.map((entry) => entry.message),
-            { sessionId: canonical.sessionId },
+            { sessionId: canonical.sessionId, allowExternalization: true },
           );
           const byDigest = new Map(
             originals.map((item) => [item.digest, item]),
@@ -140,7 +156,9 @@ export function createSessionHistoryOrigins() {
             context.slice(
               item.sourceRef.eventSequence,
               item.sourceRef.eventSequence +
-                contextItemsToMessages([item]).length,
+                contextItemsToMessages([item], {
+                  sessionId: canonical.sessionId,
+                }).length,
             );
           entries = [...canonical.outputItems]
             .sort(
@@ -150,12 +168,14 @@ export function createSessionHistoryOrigins() {
                 left.itemId.localeCompare(right.itemId, "en"),
             )
             .flatMap((item) => {
-              const messages = contextItemsToMessages([item]);
+              const messages = contextItemsToMessages([item], {
+                sessionId: canonical.sessionId,
+              });
               const source = bySequence.get(item.sourceRef.eventSequence);
               if (
                 item.sourceRef.store === "cli-jsonl-session" &&
                 source?.sourceRef.digest === item.sourceRef.digest &&
-                source.content === item.content
+                sameContextItemContent(source, item)
               ) {
                 return itemEntries(source);
               }

package/src/lib/session-transcript-history.js

@@ -77,7 +77,11 @@ function isContextCompaction(data) {
         }));
     return (
       canonicalDigest(
-        content(contextItemsToMessages(canonical.outputItems)),
+        content(
+          contextItemsToMessages(canonical.outputItems, {
+            sessionId: canonical.sessionId,
+          }),
+        ),
       ) === canonicalDigest(content(data.messages))
     );
   } catch {