comisai 1.0.42 → 1.0.45

package/node_modules/@comis/agent/dist/context-engine/context-engine.js

@@ -19,8 +19,8 @@ import { systemNowMs } from "@comis/core";
 import { LAYER_CIRCUIT_BREAKER_THRESHOLD, CHARS_PER_TOKEN_RATIO, DEFAULT_COMPACTION_PREFIX_ANCHOR_TURNS } from "./constants.js";
 import { computeTokenBudget } from "./token-budget.js";
 import { createThinkingBlockCleaner } from "./thinking-block-cleaner.js";
-import { createSignatureReplayScrubber } from "./signature-replay-scrubber.js";
 import { createSignatureSurrogateGuard } from "./signature-surrogate-guard.js";
+import { createSignatureReplayScrubber } from "./signature-replay-scrubber.js";
 import { createReasoningTagStripper } from "./reasoning-tag-stripper.js";
 import { createHistoryWindowLayer } from "./history-window.js";
 import { createObservationMaskerLayer } from "./observation-masker.js";
@@ -28,9 +28,10 @@ import { createLlmCompactionLayer } from "./llm-compaction.js";
 import { createRehydrationLayer } from "./rehydration.js";
 import { createObjectiveReinforcementLayer } from "./objective-reinforcement.js";
 import { createDeadContentEvictorLayer } from "./dead-content-evictor.js";
+import { createLcdContextEngine } from "./lcd-assembler.js";
+import { sanitizeToolUseResultPairing } from "./transcript-repair.js";
 import { detectRereads } from "./reread-detector.js";
 import { estimateContextCharsWithDualRatio, estimateWithAnchor } from "../safety/token-estimator.js";
-import { createDagContextEngine } from "./dag-reconciliation.js";
 // ---------------------------------------------------------------------------
 // Layer Circuit Breaker (internal)
 // ---------------------------------------------------------------------------
@@ -159,17 +160,24 @@ export function createContextEngine(config, deps) {
     if (!config.enabled) {
         return { transformContext: async (msgs) => msgs, lastBreakpointIndex: undefined, lastTrimOffset: 0 };
     }
-    // DAG mode branch -- entirely different layer pipeline
+    // DAG/LCD mode (the default since Phase 133): when a ContextStorePort +
+    // conversationId are wired (the daemon injects the concrete createLcdStore
+    // unconditionally), return the LCD assembly engine -- history reconstructed
+    // from the store via the codec, verbatim fresh tail, transcript repair last
+    // (the corrected loop fix). With NO store wired (unit tests / non-daemon
+    // callers) it must NOT crash and must NOT no-op: it WARN-logs
+    // (errorKind: "config") and falls through to the pipeline assembly below --
+    // the storeless safety net that makes the dag-default flip non-breaking
+    // (a permanent regression gate -- see context-engine.test.ts c2).
     if (config.version === "dag") {
-        const dagDeps = deps;
-        if (dagDeps.contextStore && dagDeps.conversationId) {
-            return createDagContextEngine(config, dagDeps);
+        if (deps.contextStore && deps.conversationId) {
+            return createLcdContextEngine(config, deps);
         }
-        // Fallback: DAG mode requested but deps missing -- log WARN and fall through to pipeline
         deps.logger.warn({
-            hint: "DAG mode configured but contextStore or conversationId not provided; falling back to pipeline mode",
+            hint: "dag mode selected but no ContextStorePort wired; using pipeline",
             errorKind: "config",
-        }, "DAG context engine deps missing");
+        }, "LCD dag engine unavailable without a context store -- using pipeline");
+        // (fall through to the pipeline assembly below -- never crash, never no-op)
     }
     // Check model capabilities to determine which layers to activate.
     // The model getter is lazy and called once at creation time to build
@@ -197,29 +205,18 @@ export function createContextEngine(config, deps) {
         thinkingCleaner = createThinkingBlockCleaner(config.thinkingKeepTurns, (stats) => { callbackState.thinking = stats; }, deps.getThinkingKeepTurnsOverride);
         layers.push(thinkingCleaner);
     }
-    // Signature replay scrubber: drops thinking signatures (and toolCall
-    // thoughtSignatures) from every assistant message OLDER than the
-    // most recent one. Always-on — no drift-mode gate. The latest
-    // assistant message keeps its signatures so Anthropic's
-    // extended-thinking continuation can validate the immediate next
-    // call's prefix.
-    if (deps.getReplayDriftMode) {
-        const getReplayDriftMode = deps.getReplayDriftMode;
-        layers.push(createSignatureReplayScrubber({
-            getReplayDriftMode,
-            onScrubbed: (stats) => {
-                // Snapshot the latest stats for the post-pipeline DEBUG summary
-                // (canonical field names blocksAffected / toolCallsAffected).
-                callbackState.signatureReplayScrubber = stats;
-                // Also forward stats to the optional per-execute accumulator wired
-                // in by executor-context-engine-setup.ts. The two callbacks are
-                // deliberately separate: the snapshot consumer overwrites per-call,
-                // the accumulator sums across calls.
-                deps.onSignatureReplayScrubbed?.(stats);
-            },
-            logger: deps.logger,
-        }));
-    }
+    // Signature replay scrubber (R5 re-wire): strip signed thinking blocks
+    // from EVERY assistant message (latest included) before the next API call.
+    // Always-on (not gated by model.reasoning): Gemini's thoughtSignature on
+    // toolCall blocks requires this even for non-reasoning models.
+    // Must run AFTER thinkingCleaner and BEFORE signatureSurrogateGuard.
+    layers.push(createSignatureReplayScrubber({
+        logger: deps.logger,
+        onScrubbed: (stats) => {
+            callbackState.signatureReplayScrubber = stats;
+            deps.onSignatureReplayScrubbed?.(stats);
+        },
+    }));
     // Signature surrogate guard (Fix #3): scrub thinkingSignature from blocks
     // whose text contains unpaired UTF-16 surrogates so pi-ai's
     // sanitizeSurrogates() does not produce a sanitized-text-with-original-
@@ -281,10 +278,52 @@ export function createContextEngine(config, deps) {
         }));
     }
     // Objective reinforcement -- re-injects objective after compaction.
-    // Must be the final layer so it runs after compaction and rehydration.
+    // Must run after compaction and rehydration (transcript repair runs after it).
     if (deps.objective) {
         layers.push(createObjectiveReinforcementLayer(deps.objective));
     }
+    // Transcript repair (A2) -- the ABSOLUTE FINAL pipeline layer, mirroring the
+    // DAG/LCD path where `sanitizeToolUseResultPairing` runs last (lcd-assembler).
+    // The pipeline previously had NO final pairing repair: its layers only AVOID
+    // CREATING orphans during windowing/eviction; none DROPS a PRE-EXISTING orphan
+    // toolResult whose toolCall was never persisted (an interrupted/SIGKILLed
+    // turn). Codex's Responses API hard-rejects such a function_call_output with no
+    // function_call (invalid_request_error "No tool call found …") -> error-classifier
+    // maps it to client_request -> "formatting issue, may need to reset" -> the
+    // conversation is stuck forever (the orphan re-sent every turn). Running the
+    // repair last guarantees a provider-valid pairing on ANY input and unsticks the
+    // live conversation at send (no transcript/data file is touched). Must run AFTER
+    // every other layer (rehydration, objective reinforcement) on the fully-assembled
+    // array. DAG path untouched (it already runs this last) -- PIPELINE-path only.
+    // Reuses the shared pure transform (not duplicated); injects `now` via the
+    // sanctioned clock pattern (deps.clock ?? systemNowMs, same as the LCD assembler).
+    layers.push({
+        name: "transcript-repair",
+        async apply(messages) {
+            const now = deps.clock ? deps.clock.now() : systemNowMs();
+            const repaired = sanitizeToolUseResultPairing(messages, now);
+            // sanitizeToolUseResultPairing rebuilds into a fresh array even on a
+            // well-formed transcript (its Pass C re-emits every message). Preserve the
+            // pipeline's pass-through reference-equality contract (the "never no-op the
+            // whole context" / zero-overhead stance, asserted by context-engine.test.ts
+            // b/c2/l) by returning the ORIGINAL reference when the repair changed
+            // nothing -- same length AND every element reference-identical in order.
+            if (repaired === messages)
+                return messages;
+            if (repaired.length === messages.length) {
+                let identical = true;
+                for (let i = 0; i < repaired.length; i++) {
+                    if (repaired[i] !== messages[i]) {
+                        identical = false;
+                        break;
+                    }
+                }
+                if (identical)
+                    return messages;
+            }
+            return repaired;
+        },
+    });
     // If no layers are active, return a pass-through
     if (layers.length === 0) {
         return { transformContext: async (msgs) => msgs, lastBreakpointIndex: undefined, lastTrimOffset: 0 };
@@ -305,6 +344,7 @@ export function createContextEngine(config, deps) {
         rehydrationEnabled,
         channelType: deps.channelType,
         layerCount: layers.length,
+        layerNames: layers.map((l) => l.name),
     }, "Context engine active");
     const engine = {
         // Initialized to undefined (no fence). Set by executor after
@@ -337,6 +377,7 @@ export function createContextEngine(config, deps) {
                 /* eslint-disable @typescript-eslint/no-explicit-any */
                 const initialChars = estimateContextCharsWithDualRatio(messages);
                 /* eslint-enable @typescript-eslint/no-explicit-any */
+                // flat-by-design: pipeline cold-start aggregate (same window as llm-compaction trigger; anchor self-corrects) (TOK-01)
                 const charBasedTokens = Math.ceil(initialChars / CHARS_PER_TOKEN_RATIO);
                 const anchor = deps.getTokenAnchor?.() ?? null;
                 tokensLoaded = estimateWithAnchor(anchor, messages, charBasedTokens);
@@ -385,6 +426,7 @@ export function createContextEngine(config, deps) {
             catch {
                 // Estimation failure should not block the pipeline
             }
+            // flat-by-design: aggregate observability stat — numbers-only log, not budget math (TOK-01)
             const resultTokens = Math.ceil(resultChars / CHARS_PER_TOKEN_RATIO);
             const budgetUtilization = budget.availableHistoryTokens > 0
                 ? resultTokens / budget.availableHistoryTokens
@@ -398,7 +440,8 @@ export function createContextEngine(config, deps) {
             // compacted context are likely the system-adjacent prefix that's still cached.
             if (snap.compaction !== null) {
                 const prevFence = engine.lastBreakpointIndex;
-                const compactedLength = Array.isArray(snap.compaction) ? snap.compaction.length : 0;
+                // Review WR-05: `result` IS the compacted array the fence indexes into; the old Array.isArray(snap.compaction) read the stats OBJECT (always false), silently resetting the fence to -1.
+                const compactedLength = result.length;
                 engine.lastBreakpointIndex = compactedLength > 0
                     ? Math.max(0, Math.floor(compactedLength / 3))
                     : -1;
@@ -447,10 +490,13 @@ export function createContextEngine(config, deps) {
                 // Re-read detection failure should not block the pipeline
             }
             // Build metrics
+            // flat-by-design: aggregate observability stat — numbers-only log, not budget math (TOK-01)
             const tokensMasked = snap.masker ? Math.ceil(snap.masker.totalChars / CHARS_PER_TOKEN_RATIO) : 0;
             const tokensCompacted = snap.compaction
+                // flat-by-design: aggregate observability stat — numbers-only log, not budget math (TOK-01)
                 ? Math.max(0, tokensLoaded - Math.ceil(resultChars / CHARS_PER_TOKEN_RATIO))
                 : 0;
+            // flat-by-design: aggregate observability stat — numbers-only log, not budget math (TOK-01)
             const tokensEvicted = snap.evictor ? Math.ceil(snap.evictor.evictedChars / CHARS_PER_TOKEN_RATIO) : 0;
             const durationMs = systemNowMs() - pipelineStart;
             const metrics = {
@@ -515,7 +561,9 @@ export function createContextEngine(config, deps) {
                     deps.eventBus.emit("context:overflow", {
                         agentId,
                         sessionKey,
+                        // flat-by-design: aggregate observability stat — numbers-only log, not budget math (TOK-01)
                         contextTokens: Math.ceil(snap.overflow.contextChars / CHARS_PER_TOKEN_RATIO),
+                        // flat-by-design: aggregate observability stat — numbers-only log, not budget math (TOK-01)
                         budgetTokens: Math.ceil(snap.overflow.budgetChars / CHARS_PER_TOKEN_RATIO),
                         recoveryAction: snap.overflow.recoveryAction,
                         timestamp,

package/node_modules/@comis/agent/dist/context-engine/errors.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Context-engine error types (Phase 166 CWF-02).
+ *
+ * These named error classes cross the transformContext boundary so the executor
+ * can map them to the correct finishReason without inspecting string messages.
+ */
+import type { ContextWindowCapInfo } from "./types-core.js";
+/**
+ * Stable prefix of every ContextExhaustionError message.
+ *
+ * HR-01 (v2.19): when this error is thrown by the pre-flight during a MID-TURN
+ * continuation, the pi-ai SDK converts the throw into a turn_end with
+ * stopReason:"error" and a STRING errorMessage — the `instanceof` is lost, so
+ * the top-level handleEnvelopeException mapping never runs. The bridge recovers
+ * the signal at that boundary via `isContextExhaustionErrorMessage()`. Sharing
+ * this prefix between the constructor and the predicate keeps the contract from
+ * drifting (no magic literal in the bridge). See design/small-model-orchestration-fidelity.md §4.
+ */
+export declare const CONTEXT_EXHAUSTION_MESSAGE_PREFIX: "Context exhausted: assembled";
+/**
+ * Issue-6 (small-model e2e 2026-06-12 UC-3): WHY the fit failed, so the
+ * degraded reply can point at the right knob. The generic "narrow the ask"
+ * advice was actively misleading when the offender was a persisted oversized
+ * message in HISTORY (the ask was tiny).
+ *
+ *  - `oversized_input`: the CURRENT user message alone cannot fit — "narrow
+ *    the ask" / "shorten the message" is the correct remedy.
+ *  - `oversized_history_message`: a SINGLE earlier message alone cannot fit —
+ *    only clearing the session (or raising the window) helps; with the Issue-1
+ *    assembly bound in place this cause should no longer occur, but the
+ *    classification stays for robustness (e.g. an operator-cranked cap).
+ *  - `fixed_overhead_exceeds_window` (2026-06-22 root-cause fix): the
+ *    NON-EVICTABLE fixed overhead — the system prompt + tool schemas (S =
+ *    getSystemTokensEstimate) — ALONE exceeds the bound, so the turn is
+ *    infeasible regardless of history, thinking level, OR message size. The
+ *    remedy is the WINDOW or the agent's tool/prompt footprint, never "shorten
+ *    your message". This is the failure a `nano`-class model (~16K effective
+ *    window) hits when its ~10K prompt + tool schemas overflow before any user
+ *    text. The window-aware tool-budget fit pass (executor-tool-assembly.ts
+ *    enforceToolBudgetFit) defers tools to prevent this on adequate windows; the
+ *    degenerate window<prompt case still throws, and this cause makes it HONEST
+ *    (it was previously mis-classified `oversized_input`, blaming the message).
+ *  - `aggregate`: the conversation + tools collectively overflow — compaction /
+ *    cap-raise / fewer tools advice applies (the historical behavior).
+ */
+export type ContextExhaustionCause = "oversized_input" | "oversized_history_message" | "fixed_overhead_exceeds_window" | "aggregate";
+/**
+ * Recover the {@link ContextExhaustionCause} from an exhaustion message string
+ * that crossed a type-stripping boundary (`result.errorContext.originalError`
+ * on the top-level path, `lastLlmErrorMessage` on the HR-01 mid-turn path).
+ * Pure; tolerant of undefined/untagged input (→ "aggregate").
+ */
+export declare function parseContextExhaustionCause(message: string | undefined): ContextExhaustionCause;
+/** Returns the capped-window suffix for the exhaustion message, or "" when
+ *  uncapped/unknown. Exported for reuse by the pre-flight WARN hint.
+ *  KNOB-02: branched by source — the served bind gets the Ollama remedy and
+ *  the capabilityClass bind gets the pin remedy ("raise it (0 = uncapped)" is
+ *  the WRONG knob for both: served lives in Ollama, and the executor's class
+ *  cap reads only the operator's capabilityClass pin — WR-01). A budget-knob
+ *  bind with served provenance names the full chain (configured → served → cap). */
+export declare function describeWindowCap(effectiveWindow: number, capInfo?: ContextWindowCapInfo): string;
+/** Thrown by lcd-assembler.transformContext when assembled input cannot fit in the
+ *  effective window even after eviction, preamble trimming, and thinking down-shift.
+ *  Caught by the executor and mapped to finishReason: "context_exhausted".
+ *  Design ref: design/small-model-context-fidelity.md §4 Fix 3 item 2d. */
+export declare class ContextExhaustionError extends Error {
+    readonly effectiveWindow: number;
+    readonly assembledTokens: number;
+    /** Issue-6: why the fit failed (default "aggregate" — the historical shape). */
+    readonly exhaustionCause: ContextExhaustionCause;
+    name: "ContextExhaustionError";
+    constructor(effectiveWindow: number, assembledTokens: number, capInfo?: ContextWindowCapInfo, 
+    /** Issue-6: why the fit failed (default "aggregate" — the historical shape). */
+    exhaustionCause?: ContextExhaustionCause);
+}
+/**
+ * True when an error MESSAGE string is a ContextExhaustionError surfaced across a
+ * boundary that strips the type (the SDK's turn_end-error conversion). Used by the
+ * bridge to map a mid-turn context-exhaustion throw to finishReason:"context_exhausted"
+ * so the executor delivers the honest degraded reply instead of the empty-turn
+ * recovery's "the work was done" synthesis. Pure; tolerant of undefined/empty.
+ */
+export declare function isContextExhaustionErrorMessage(message: string | undefined): boolean;

package/node_modules/@comis/agent/dist/context-engine/errors.js

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Context-engine error types (Phase 166 CWF-02).
+ *
+ * These named error classes cross the transformContext boundary so the executor
+ * can map them to the correct finishReason without inspecting string messages.
+ */
+/**
+ * Stable prefix of every ContextExhaustionError message.
+ *
+ * HR-01 (v2.19): when this error is thrown by the pre-flight during a MID-TURN
+ * continuation, the pi-ai SDK converts the throw into a turn_end with
+ * stopReason:"error" and a STRING errorMessage — the `instanceof` is lost, so
+ * the top-level handleEnvelopeException mapping never runs. The bridge recovers
+ * the signal at that boundary via `isContextExhaustionErrorMessage()`. Sharing
+ * this prefix between the constructor and the predicate keeps the contract from
+ * drifting (no magic literal in the bridge). See design/small-model-orchestration-fidelity.md §4.
+ */
+export const CONTEXT_EXHAUSTION_MESSAGE_PREFIX = "Context exhausted: assembled";
+/**
+ * The `[cause: …]` tag appended to the exhaustion message. Like
+ * {@link CONTEXT_EXHAUSTION_MESSAGE_PREFIX}, the tag is a SHARED CONTRACT
+ * between the constructor and {@link parseContextExhaustionCause}: the error
+ * crosses the SDK's turn_end-error boundary as a bare STRING (HR-01), so the
+ * cause must survive inside the message text. "aggregate" is the unmarked
+ * default — historical messages (no tag) parse as aggregate.
+ */
+const CAUSE_TAG_PATTERN = /\[cause: (oversized_input|oversized_history_message|fixed_overhead_exceeds_window)\]/;
+/**
+ * Recover the {@link ContextExhaustionCause} from an exhaustion message string
+ * that crossed a type-stripping boundary (`result.errorContext.originalError`
+ * on the top-level path, `lastLlmErrorMessage` on the HR-01 mid-turn path).
+ * Pure; tolerant of undefined/untagged input (→ "aggregate").
+ */
+export function parseContextExhaustionCause(message) {
+    const match = typeof message === "string" ? CAUSE_TAG_PATTERN.exec(message) : null;
+    return match ? match[1] : "aggregate";
+}
+/**
+ * Maps a WindowCapSource onto the exact knob an operator must turn — the
+ * message must name the KNOB, not just the number, so an operator (or an
+ * LLM agent reading the log) can fix it without reading budget-capacity-cap.ts
+ * (W1 obs-llm-troubleshooting; the live incident reported "effective window
+ * 32000" against a configured contextWindow of 131072 with no link between them).
+ * KNOB-02: the cap-class entries are `contextEngine.budget.*` config keys; the
+ * `served` entry names the OLLAMA knobs (env / Modelfile); the
+ * `capabilityClass` entry (WR-01) names the operator's
+ * `providers.entries.<id>.capabilities.capabilityClass` PIN — the executor's
+ * DEFAULT_EFFECTIVE_CAP_BY_CLASS cap never reads the budget knobs, so
+ * "raise contextEngine.budget.effectiveContextCapSmall" is a DEAD lever on
+ * that branch. NEVER template `contextEngine.budget.${source}` (for "served" /
+ * "capabilityClass" that renders a nonsense config key that does not exist).
+ */
+const CAP_KNOB_BY_SOURCE = {
+    effectiveContextCapSmall: "contextEngine.budget.effectiveContextCapSmall",
+    effectiveContextCapNano: "contextEngine.budget.effectiveContextCapNano",
+    served: "OLLAMA_CONTEXT_LENGTH (ollama serve env) / PARAMETER num_ctx (Modelfile)",
+    capabilityClass: "providers.entries.<id>.capabilities.capabilityClass",
+};
+/** Returns the capped-window suffix for the exhaustion message, or "" when
+ *  uncapped/unknown. Exported for reuse by the pre-flight WARN hint.
+ *  KNOB-02: branched by source — the served bind gets the Ollama remedy and
+ *  the capabilityClass bind gets the pin remedy ("raise it (0 = uncapped)" is
+ *  the WRONG knob for both: served lives in Ollama, and the executor's class
+ *  cap reads only the operator's capabilityClass pin — WR-01). A budget-knob
+ *  bind with served provenance names the full chain (configured → served → cap). */
+export function describeWindowCap(effectiveWindow, capInfo) {
+    if (capInfo === undefined || capInfo.windowCapSource === "none")
+        return "";
+    if (capInfo.windowCapSource === "served") {
+        return (` (model contextWindow ${capInfo.rawContextWindowTokens} but Ollama serves only ${effectiveWindow}` +
+            ` — fix: OLLAMA_CONTEXT_LENGTH=${capInfo.rawContextWindowTokens} ollama serve,` +
+            ` or Modelfile 'PARAMETER num_ctx ${capInfo.rawContextWindowTokens}')`);
+    }
+    const knob = CAP_KNOB_BY_SOURCE[capInfo.windowCapSource];
+    const servedClause = capInfo.servedWindowTokens !== undefined ? `, Ollama serves ${capInfo.servedWindowTokens},` : "";
+    // WR-01: the remedy must match the lever that actually moves the window —
+    // the budget knobs are numeric ("raise it, 0 = uncapped"); the capability
+    // pin is a class name (raise/remove the pin; the budget knob is inert here).
+    const remedy = capInfo.windowCapSource === "capabilityClass"
+        ? "pin a higher class (or remove the pin)"
+        : "raise it (0 = uncapped)";
+    return (` (model contextWindow ${capInfo.rawContextWindowTokens}${servedClause} capped to ${effectiveWindow}` +
+        ` by ${knob} — ${remedy} or reduce active tool schemas)`);
+}
+/** Thrown by lcd-assembler.transformContext when assembled input cannot fit in the
+ *  effective window even after eviction, preamble trimming, and thinking down-shift.
+ *  Caught by the executor and mapped to finishReason: "context_exhausted".
+ *  Design ref: design/small-model-context-fidelity.md §4 Fix 3 item 2d. */
+export class ContextExhaustionError extends Error {
+    effectiveWindow;
+    assembledTokens;
+    exhaustionCause;
+    name = "ContextExhaustionError";
+    constructor(effectiveWindow, assembledTokens, capInfo, 
+    /** Issue-6: why the fit failed (default "aggregate" — the historical shape). */
+    exhaustionCause = "aggregate") {
+        super(`${CONTEXT_EXHAUSTION_MESSAGE_PREFIX} ${assembledTokens} tokens leaves no room in effective window ${effectiveWindow}` +
+            describeWindowCap(effectiveWindow, capInfo) +
+            // The tag must survive the HR-01 string boundary; "aggregate" stays
+            // unmarked so historical message shapes are byte-identical.
+            (exhaustionCause === "aggregate" ? "" : ` [cause: ${exhaustionCause}]`));
+        this.effectiveWindow = effectiveWindow;
+        this.assembledTokens = assembledTokens;
+        this.exhaustionCause = exhaustionCause;
+    }
+}
+/**
+ * True when an error MESSAGE string is a ContextExhaustionError surfaced across a
+ * boundary that strips the type (the SDK's turn_end-error conversion). Used by the
+ * bridge to map a mid-turn context-exhaustion throw to finishReason:"context_exhausted"
+ * so the executor delivers the honest degraded reply instead of the empty-turn
+ * recovery's "the work was done" synthesis. Pure; tolerant of undefined/empty.
+ */
+export function isContextExhaustionErrorMessage(message) {
+    return typeof message === "string" && message.startsWith(CONTEXT_EXHAUSTION_MESSAGE_PREFIX);
+}

package/node_modules/@comis/agent/dist/context-engine/factored-message-tokens.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The SINGLE factored per-message token estimator shared by the pre-flight fit
+ * check (lcd-preflight.ts) and the protected-fresh-tail total bound
+ * (lcd-fresh-tail-bound.ts `boundFreshTailTotalToResidual`).
+ *
+ * ISSUE #3 (2026-06-22): these two had DIFFERENT estimators — the pre-flight used
+ * `ceil(chars / (CHARS_PER_TOKEN_RATIO × scriptTokenFactor))` (≈3.5:1) while the
+ * fresh-tail bound used `estimateMessageTokens` (≈4:1) plus a ×0.83 fudge to absorb
+ * the gap. The ABSOLUTE gap scales with the residual, so on a SMALL system prompt
+ * (large residual — e.g. OpenAI gpt-5-nano S=1145 → residual ~6279) the fudge was
+ * insufficient and the bounded fresh tail still measured over the pre-flight bound →
+ * exhaustion. Single-sourcing the estimator here makes the bound == the measure for
+ * ANY system-prompt size, with no fudge factor and no possibility of future drift.
+ *
+ * Pure leaf — depends only on the chars/token ratio constant, the script factor, and
+ * the `AgentMessage` type. No cycle risk (imports nothing from lcd-preflight /
+ * lcd-fresh-tail-bound / lcd-assembler).
+ *
+ * @module
+ */
+import type { AgentMessage } from "@earendil-works/pi-agent-core";
+/**
+ * The exact text of one message that the factored estimate counts: string content,
+ * or the `text ?? content` field of each array block (the IN-01 multi-part /
+ * tool-result shape — NOT text+content summed). The concatenation feeds
+ * scriptTokenFactor so the factor is computed over precisely the chars whose length
+ * is divided (TOK-01 identity-by-construction).
+ */
+export declare function messageText(m: AgentMessage): string;
+/**
+ * The factored token estimate for one message: `ceil(chars / (CHARS_PER_TOKEN_RATIO
+ * × scriptTokenFactor(text)))`. This is the pre-flight's per-message formula
+ * (lcd-preflight.ts freshTailMsgTokens) — the authority for "does the fresh tail fit
+ * the window". TOK-01: dense scripts carry ~2-3× tokens/char; ASCII factor 1.0 →
+ * the bare `ceil(chars / 3.5)` form.
+ */
+export declare function factoredMessageTokens(m: AgentMessage): number;

package/node_modules/@comis/agent/dist/context-engine/factored-message-tokens.js

@@ -0,0 +1,38 @@
+import { scriptTokenFactor } from "@comis/core";
+import { CHARS_PER_TOKEN_RATIO } from "./constants.js";
+/**
+ * The exact text of one message that the factored estimate counts: string content,
+ * or the `text ?? content` field of each array block (the IN-01 multi-part /
+ * tool-result shape — NOT text+content summed). The concatenation feeds
+ * scriptTokenFactor so the factor is computed over precisely the chars whose length
+ * is divided (TOK-01 identity-by-construction).
+ */
+export function messageText(m) {
+    const content = m.content;
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    let out = "";
+    for (const block of content) {
+        if (typeof block === "string") {
+            out += block;
+        }
+        else if (block !== null && typeof block === "object") {
+            const b = block;
+            out += b.text ?? b.content ?? "";
+        }
+    }
+    return out;
+}
+/**
+ * The factored token estimate for one message: `ceil(chars / (CHARS_PER_TOKEN_RATIO
+ * × scriptTokenFactor(text)))`. This is the pre-flight's per-message formula
+ * (lcd-preflight.ts freshTailMsgTokens) — the authority for "does the fresh tail fit
+ * the window". TOK-01: dense scripts carry ~2-3× tokens/char; ASCII factor 1.0 →
+ * the bare `ceil(chars / 3.5)` form.
+ */
+export function factoredMessageTokens(m) {
+    const text = messageText(m);
+    return Math.ceil(text.length / (CHARS_PER_TOKEN_RATIO * scriptTokenFactor(text)));
+}

package/node_modules/@comis/agent/dist/context-engine/index.d.ts

@@ -29,17 +29,3 @@ export { DEAD_CONTENT_EVICTION_MIN_AGE } from "./constants.js";
 export { createObjectiveReinforcementLayer } from "./objective-reinforcement.js";
 export { detectRereads } from "./reread-detector.js";
 export type { RereadDetectorResult } from "./reread-detector.js";
-export { runLeafPass, runCondensedPass, resolveFreshTailBoundary, summarizeWithEscalation, truncateAtSentenceBoundary, getDepthPrompt, } from "./dag-compaction.js";
-export type { CompactionDeps, LeafPassConfig, CondensedPassConfig, EscalationConfig, EscalationResult, LeafPassResult, CondensedPassResult, CompactionResult, } from "./types.js";
-export { DEPTH_PROMPTS, DAG_ESCALATION_OVERRUN_TOLERANCE, DAG_SUMMARY_ID_PREFIX, DAG_SUMMARY_ID_BYTES, } from "./constants.js";
-export { shouldCompact, markAncestorsDirty, recomputeDescendantCounts, runDagCompaction, } from "./dag-triggers.js";
-export type { DagCompactionConfig, DagCompactionDeps, DagCompactionEvent, } from "./types.js";
-export { createDagAssemblerLayer } from "./dag-assembler.js";
-export type { DagAssemblerDeps, DagAssemblerConfig } from "./types.js";
-export { XML_WRAPPER_OVERHEAD_TOKENS, RECALL_GUIDANCE } from "./constants.js";
-export { createDagAnnotatorLayer } from "./dag-annotator.js";
-export type { DagAnnotatorConfig, DagAnnotatorDeps } from "./dag-annotator.js";
-export { checkIntegrity } from "./dag-integrity.js";
-export type { IntegrityIssue, IntegrityReport, IntegrityCheckDeps, IntegrityCheckEvent, } from "./types.js";
-export { reconcileJsonlToDag, installDagIngestionHook, createDagContextEngine } from "./dag-reconciliation.js";
-export type { ReconciliationResult, DagContextEngineDeps } from "./types.js";

package/node_modules/@comis/agent/dist/context-engine/index.js

@@ -35,17 +35,3 @@ export { DEAD_CONTENT_EVICTION_MIN_AGE } from "./constants.js";
 export { createObjectiveReinforcementLayer } from "./objective-reinforcement.js";
 // Re-read detector
 export { detectRereads } from "./reread-detector.js";
-// DAG compaction
-export { runLeafPass, runCondensedPass, resolveFreshTailBoundary, summarizeWithEscalation, truncateAtSentenceBoundary, getDepthPrompt, } from "./dag-compaction.js";
-export { DEPTH_PROMPTS, DAG_ESCALATION_OVERRUN_TOLERANCE, DAG_SUMMARY_ID_PREFIX, DAG_SUMMARY_ID_BYTES, } from "./constants.js";
-// DAG triggers
-export { shouldCompact, markAncestorsDirty, recomputeDescendantCounts, runDagCompaction, } from "./dag-triggers.js";
-// DAG assembler
-export { createDagAssemblerLayer } from "./dag-assembler.js";
-export { XML_WRAPPER_OVERHEAD_TOKENS, RECALL_GUIDANCE } from "./constants.js";
-// DAG annotator
-export { createDagAnnotatorLayer } from "./dag-annotator.js";
-// DAG integrity
-export { checkIntegrity } from "./dag-integrity.js";
-// DAG reconciliation and wiring
-export { reconcileJsonlToDag, installDagIngestionHook, createDagContextEngine } from "./dag-reconciliation.js";

package/node_modules/@comis/agent/dist/context-engine/lcd-arbiter-seam.d.ts

@@ -0,0 +1,67 @@
+/**
+ * RETR-02/03/05 — the relevance-first eviction seam, extracted from `lcd-assembler.ts`
+ * so the assembler stays under the 800-line file-size cap (the "keep the body THIN" rule;
+ * mirrors `recall-provenance.ts` / `lcd-store-provenance.ts` extractions). The assembler
+ * CALLS {@link evictUnderArbiter} on the relevance-first path and keeps the verbatim
+ * `evictHistoryUnderBudget` call on the frontier/mid path (byte-identical, LOCKED #2).
+ *
+ * This module wraps the pure {@link marginArbitrate} allocator with the assembly-path
+ * glue: it separates the S4 security-pinned items (RETR-05) out of the relevance-evictable
+ * band as unconditional floors (mirroring `lcd-preflight.ts:114-121`), passes EMPTY LTM/KG
+ * candidate lanes (the C2 boundary — the assembler holds no cross-session LTM; the recall
+ * path owns LTM ranking), and builds the relevance query for the arbiter.
+ *
+ * Architecture cuts: lives in `context-engine/`, imports only `@comis/core` types +
+ * in-package context-engine modules — never `@comis/memory` (agent↛memory) and never the
+ * `rag/` layer (I2). The relevance scorer is INJECTED (`deps.relevanceScorer`); on the C2
+ * assembly path the LTM/KG lanes are empty so the scorer is never actually invoked.
+ *
+ * @module
+ */
+import type { AgentMessage } from "@earendil-works/pi-agent-core";
+import type { BudgetItem } from "./lcd-budget-eviction.js";
+import type { ContextEngineDeps } from "./types.js";
+/** What {@link evictUnderArbiter} returns — only the kept history (the content-free
+ *  context:arbitrated event is emitted INSIDE this seam, so the assembler stays thin). */
+export interface ArbiterSeamResult {
+    /** The kept history messages (floors + discretionary band), in original order. */
+    budgeted: AgentMessage[];
+}
+/**
+ * Run the margin arbiter at the eviction seam for a relevance-first class, and emit the
+ * content-free `context:arbitrated` Glass-Box event.
+ *
+ * RETR-05: S4 security-pinned items (detected fail-closed by `isSecurityRelevantMessage`
+ * against `deps.securityPinMarkers`) are excluded from the relevance-evictable band and
+ * passed as UNCONDITIONAL floors. When no markers are threaded, nothing is pinned here
+ * (the pre-flight harder-eviction remains the backstop).
+ *
+ * RETR-02 event: per-tier kept COUNTS + the discretionary pool TOKENS (OFFERED via
+ * `discretionaryPoolTokens` AND CONSUMED via `poolTokensUsed`, WR-03) + the floor-token
+ * weight + the kept LTM/KG ids (WR-02) + the relevanceFirst BOOLEAN + a timestamp ONLY —
+ * NEVER message/memory/query content (AGENTS.md §2.2/§2.7; T-173-03-04; ids are opaque
+ * memory keys). Reuses the caller's entry-clock read `startMs` (no new ambient clock —
+ * the globals gate). Frontier/mid never call this → the event never fires for them.
+ *
+ * @param deps - the context-engine deps (relevanceScorer, securityPinMarkers, eventBus).
+ * @param evictable - the evictable history band (T0/T1/T2) with supplied tokens.
+ * @param poolTokens - the discretionary pool (budget.availableHistoryTokens, post-Fix-3).
+ * @param liveMessages - the live message array (source of the relevance query).
+ * @param startMs - the assembler's entry-clock read, reused for the event timestamp.
+ * @returns the kept history (the event is emitted as a side effect).
+ */
+export declare function evictUnderArbiter(deps: ContextEngineDeps, evictable: BudgetItem[], poolTokens: number, liveMessages: AgentMessage[], startMs: number): ArbiterSeamResult;
+/**
+ * Emit the EXISTING content-free `context:evicted` event from the LCD eviction seam (O1;
+ * parity with the pipeline engine) when eviction actually dropped history — shared by BOTH
+ * the recency and the arbiter paths. `evictedChars` is derived ONLY from each dropped item's
+ * pre-computed `tokens` (× CHARS_PER_TOKEN_RATIO) — the message text is NEVER read or emitted
+ * (AGENTS.md §2.2 / the lossless store). Reuses the caller's entry-clock `startMs` (no new
+ * clock read; the globals gate bans ambient time). No-op when nothing was dropped.
+ *
+ * @param deps - the context-engine deps (eventBus, agentId, sessionKey).
+ * @param evictable - the evictable history band (its tail beyond keptCount was dropped).
+ * @param keptCount - how many evictable items were kept (the rest are the dropped prefix).
+ * @param startMs - the assembler's entry-clock read, reused for the event timestamp.
+ */
+export declare function emitEvictedEvent(deps: ContextEngineDeps, evictable: BudgetItem[], keptCount: number, startMs: number): void;