flavor-code 1.3.15 → 1.3.16

package/dist/agent/loop.d.ts

@@ -4,7 +4,16 @@ import type { HookBus } from "../hooks/bus.js";
 import type { ModelRegistry } from "../models/registry.js";
 import { type ModelMessage, type ModelTool } from "../models/types.js";
 import type { ToolRuntime } from "../tools/runtime.js";
-import type { AgentEvent, AgentRunRequest } from "./types.js";
+import type { AgentError, AgentEvent, AgentRunRequest } from "./types.js";
+/**
+ * Stop a turn before the V8 heap reaches its hard limit. A retained-memory
+ * leak otherwise ends in a native OOM crash with no recovery; tripping this
+ * watermark saves the session and lets the launcher relaunch on a fresh heap.
+ * 0.8 keeps headroom for compaction payloads and the GC death spiral that
+ * starts near ~0.95.
+ */
+export declare const MEMORY_PRESSURE_HEAP_RATIO = 0.8;
+export declare function memoryPressureError(heapUsed: number, heapLimit: number): AgentError | undefined;
 export interface AgentLoopOptions {
     registry: ModelRegistry;
     modelId: string;

package/dist/agent/types.d.ts

@@ -15,7 +15,7 @@ export interface AgentRunRequest {
     /** Messages supplied while a tool batch is running, injected before the next model call. */
     getSteeringMessages?(): readonly string[];
 }
-export type AgentErrorCode = ProviderErrorCode | "iteration_limit" | "incomplete_stream" | "empty_response";
+export type AgentErrorCode = ProviderErrorCode | "iteration_limit" | "incomplete_stream" | "empty_response" | "memory_pressure";
 export interface AgentError {
     code: AgentErrorCode;
     message: string;

package/dist/{app-DDYOKGCX.js → app-6SEGTMMC.js}

@@ -18,8 +18,9 @@ import {
   thinkingWindow,
   transcriptReducer,
   withTimeout
-} from "./chunk-WB4IJXFT.js";
-import "./chunk-JFKRX2KG.js";
+} from "./chunk-S525EOFQ.js";
+import "./chunk-CIVPKHF4.js";
+import "./chunk-HJOCNKPN.js";
 import {
   Box_default,
   ClockContext,

package/dist/chunk-CIVPKHF4.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module"; const require = createRequire(import.meta.url);
+
+// src/utils/memory-restart.ts
+import { join } from "path";
+var MEMORY_RESTART_EXIT_CODE = 75;
+var MEMORY_RESTART_MARKER_FILE = "memory-restart.json";
+var MEMORY_RESTART_MAX_ATTEMPTS = 3;
+var MEMORY_RESTART_WINDOW_MS = 30 * 60 * 1e3;
+var SESSION_ID_PATTERN = /^session-[A-Za-z0-9_-]+$/u;
+function memoryRestartMarkerPath(workspace) {
+  return join(workspace, ".flavor", "tmp", MEMORY_RESTART_MARKER_FILE);
+}
+function nextMemoryRestartMarker(previous, sessionId, now) {
+  const reusable = previous !== void 0 && previous.sessionId === sessionId && now.getTime() - Date.parse(previous.requestedAt) < MEMORY_RESTART_WINDOW_MS && Number.isInteger(previous.attempts) && previous.attempts > 0;
+  return { sessionId, requestedAt: now.toISOString(), attempts: reusable ? previous.attempts + 1 : 1 };
+}
+function shouldRelaunchForMemoryRestart(marker) {
+  return marker !== void 0 && SESSION_ID_PATTERN.test(marker.sessionId) && Number.isInteger(marker.attempts) && marker.attempts >= 1 && marker.attempts <= MEMORY_RESTART_MAX_ATTEMPTS;
+}
+function memoryRestartArgs(argv, marker) {
+  if (!shouldRelaunchForMemoryRestart(marker)) return void 0;
+  const stripped = [];
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--resume") {
+      if (index + 1 < argv.length && !argv[index + 1].startsWith("-")) index += 1;
+      continue;
+    }
+    if (argument.startsWith("--resume=")) continue;
+    stripped.push(argument);
+  }
+  return [...stripped, "--resume", marker.sessionId];
+}
+function parseMemoryRestartMarker(json) {
+  try {
+    const value = JSON.parse(json);
+    if (typeof value.sessionId !== "string" || typeof value.requestedAt !== "string" || typeof value.attempts !== "number") {
+      return void 0;
+    }
+    return { sessionId: value.sessionId, requestedAt: value.requestedAt, attempts: value.attempts };
+  } catch {
+    return void 0;
+  }
+}
+
+export {
+  MEMORY_RESTART_EXIT_CODE,
+  memoryRestartMarkerPath,
+  nextMemoryRestartMarker,
+  memoryRestartArgs,
+  parseMemoryRestartMarker
+};

package/dist/{chunk-JFKRX2KG.js → chunk-HJOCNKPN.js}

@@ -129,7 +129,7 @@ var FlavorConfigSchema = z.object({
   context: z.object({
     windowTokens: z.number().int().positive().default(2e5),
     reservedOutputTokens: z.number().int().nonnegative().default(2e4),
-    autoCompactBufferTokens: z.number().int().nonnegative().default(13e3),
+    autoCompactBufferTokens: z.number().int().nonnegative().default(27e3),
     warningBufferTokens: z.number().int().nonnegative().default(2e4),
     blockingBufferTokens: z.number().int().nonnegative().default(3e3),
     microcompactKeepRecentToolResults: z.number().int().nonnegative().default(5),

package/dist/{chunk-TQXNF337.js → chunk-LMFN2QEA.js}

@@ -4,7 +4,7 @@ import {
   message,
   redactErrorText,
   redactSecrets
-} from "./chunk-WB4IJXFT.js";
+} from "./chunk-S525EOFQ.js";
 
 // src/rpc/server.ts
 import { createInterface } from "readline";

package/dist/{chunk-WB4IJXFT.js → chunk-S525EOFQ.js}

@@ -1,5 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module"; const require = createRequire(import.meta.url);
+import {
+  MEMORY_RESTART_EXIT_CODE,
+  memoryRestartMarkerPath,
+  nextMemoryRestartMarker,
+  parseMemoryRestartMarker
+} from "./chunk-CIVPKHF4.js";
 import {
   PERMISSION_MODES,
   PermissionModeSchema,
@@ -12,7 +18,7 @@ import {
   redactConfig,
   setProjectMcpServerDisabled,
   updateProtectedFile
-} from "./chunk-JFKRX2KG.js";
+} from "./chunk-HJOCNKPN.js";
 import {
   AuditLogger,
   appendUsageLog,
@@ -5326,9 +5332,10 @@ async function ensureOnce(options) {
 
 // src/production.ts
 import { readFile as readFile22 } from "fs/promises";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync } from "fs";
 import { createHash as createHash18, randomUUID as randomUUID20 } from "crypto";
 import { homedir as homedir2, release as osRelease, tmpdir as tmpdir4, version as osVersion } from "os";
-import { basename as basename6, join as join26, relative as relative20, resolve as resolve28, sep as sep20 } from "path";
+import { basename as basename6, dirname as dirname19, join as join26, relative as relative20, resolve as resolve28, sep as sep20 } from "path";
 
 // src/agent/subagents.ts
 import { z as z5 } from "zod";
@@ -5877,7 +5884,9 @@ import { createHash as createHash4, randomUUID as randomUUID6 } from "crypto";
 var DEFAULT_COMPACTION_POLICY = {
   windowTokens: 2e5,
   reservedOutputTokens: 2e4,
-  autoCompactBufferTokens: 13e3,
+  // 85% of the effective window (180_000 - 27_000 = 153_000): compaction used
+  // to trigger at ~92.8%, which let sessions ride the threshold into heap OOM.
+  autoCompactBufferTokens: 27e3,
   warningBufferTokens: 2e4,
   blockingBufferTokens: 3e3,
   microcompactKeepRecentToolResults: 5,
@@ -6087,6 +6096,13 @@ var ContextManager = class _ContextManager {
   #epoch;
   #visibilityLog = [];
   #activeTransientSystem = /* @__PURE__ */ new Map();
+  /**
+   * The visibility audit log persists every transient system admission and is
+   * serialized in full on every session save. Bound both dimensions or a long
+   * subagent-driven run grows it into hundreds of megabytes (heap OOM).
+   */
+  static VISIBILITY_LOG_MAX_ENTRIES = 1e3;
+  static VISIBILITY_RECORD_CONTENT_LIMIT = 2048;
   constructor(options) {
     if (options.compactAtChars !== void 0 && options.compactAtChars <= 0) throw new Error("compactAtChars must be positive");
     if (options.toolOutputChars <= 0) throw new Error("toolOutputChars must be positive");
@@ -6182,11 +6198,14 @@ var ContextManager = class _ContextManager {
     const record = {
       id,
       role: "system",
-      content,
+      content: limitVisibilityContent(content),
       admittedAt: (/* @__PURE__ */ new Date()).toISOString(),
       scope: "run"
     };
     this.#visibilityLog.push(record);
+    if (this.#visibilityLog.length > _ContextManager.VISIBILITY_LOG_MAX_ENTRIES) {
+      this.#visibilityLog = this.#visibilityLog.slice(-_ContextManager.VISIBILITY_LOG_MAX_ENTRIES);
+    }
     this.#activeTransientSystem.set(id, { role: "system", content });
     return id;
   }
@@ -6210,8 +6229,9 @@ var ContextManager = class _ContextManager {
     const currentStableHash = currentStable === void 0 ? this.#epoch.stableSourceHash : hashMessages(currentStable);
     if (currentStable !== void 0 && currentStableHash !== this.#epoch.stableSourceHash) {
       const value = currentStable.map((message2) => message2.content).join("\n\n");
+      const previous = this.#epoch.sources["system-baseline"] ?? this.#epoch.stableMessages.map((message2) => message2.content).join("\n\n");
       if (this.#epoch.sources["system-baseline"] !== value) {
-        updates.push(contextUpdateMessage("system-baseline", value));
+        updates.push(contextUpdateMessage("system-baseline", deltaSourceValue(previous, value)));
         this.#epoch.sources["system-baseline"] = value;
       }
     } else if (currentStable !== void 0 && this.#epoch.sources["system-baseline"] !== void 0) {
@@ -6222,7 +6242,7 @@ var ContextManager = class _ContextManager {
     for (const key of DYNAMIC_SOURCE_ORDER) {
       const value = next[key];
       if (value === void 0 || value === this.#epoch.sources[key]) continue;
-      updates.push(contextUpdateMessage(key, displaySourceValue(key, value)));
+      updates.push(contextUpdateMessage(key, deltaSourceValue(this.#epoch.sources[key], displaySourceValue(key, value))));
       this.#epoch.sources[key] = value;
     }
     for (const key of DYNAMIC_SOURCE_ORDER) {
@@ -6249,7 +6269,7 @@ var ContextManager = class _ContextManager {
     const legacySummary = snapshot4.summary?.role === "system" && snapshot4.summary.content.startsWith("Conversation summary\n") ? snapshot4.summary.content.slice("Conversation summary\n".length) : void 0;
     this.#compact = snapshot4.compact === void 0 ? legacySummary === void 0 ? void 0 : { summary: legacySummary, compactedAt: (/* @__PURE__ */ new Date(0)).toISOString() } : { ...snapshot4.compact };
     if (snapshot4.epoch !== void 0) this.#epoch = cloneEpoch(snapshot4.epoch);
-    this.#visibilityLog = snapshot4.visibilityLog?.map((item) => ({ ...item })) ?? [];
+    this.#visibilityLog = boundVisibilityLog(snapshot4.visibilityLog);
     this.#activeTransientSystem.clear();
     this.#messages = messages.map((message2) => message2.role === "tool" ? { ...message2, content: truncateToolOutput(message2.content, this.#toolOutputChars) } : cloneMessage2(message2));
     this.#lastRecordedInputTokens = void 0;
@@ -6293,6 +6313,10 @@ var ContextManager = class _ContextManager {
   async prepareForModelCall(signal = new AbortController().signal) {
     signal.throwIfAborted();
     this.refreshContextSources();
+    if (this.#dropStaleContextUpdates()) {
+      this.#lastRecordedInputTokens = void 0;
+      this.#estimatedTokensAtLastRecordedUsage = void 0;
+    }
     if (!this.needsCompaction()) return false;
     const originalMessages = this.#messages;
     const originalRecordedUsage = this.#lastRecordedInputTokens;
@@ -6392,6 +6416,26 @@ var ContextManager = class _ContextManager {
     this.#reportCompactProgress(100);
     return true;
   }
+  #dropStaleContextUpdates() {
+    const latestBySource = /* @__PURE__ */ new Map();
+    for (let index = this.#messages.length - 1; index >= 0; index -= 1) {
+      const source = contextUpdateSource(this.#messages[index]);
+      if (source === void 0 || latestBySource.has(source)) continue;
+      latestBySource.set(source, index);
+    }
+    const next = [];
+    let changed = false;
+    this.#messages.forEach((message2, index) => {
+      const source = contextUpdateSource(message2);
+      if (source !== void 0 && latestBySource.get(source) !== index) {
+        changed = true;
+        return;
+      }
+      next.push(message2);
+    });
+    if (changed) this.#messages = next;
+    return changed;
+  }
   #reportCompactProgress(percentage) {
     const normalized = Math.max(0, Math.min(100, Math.floor(percentage / 10) * 10));
     if (normalized === this.#lastCompactProgress) return;
@@ -6503,6 +6547,33 @@ function contextUpdateMessage(source, content) {
   return { role: "system", content: `Context update [${source}]
 ${content}` };
 }
+var CONTEXT_UPDATE_PREFIX = "Context update [";
+function contextUpdateSource(message2) {
+  if (message2.role !== "system" || typeof message2.content !== "string") return void 0;
+  if (!message2.content.startsWith(CONTEXT_UPDATE_PREFIX)) return void 0;
+  const end = message2.content.indexOf("]\n", CONTEXT_UPDATE_PREFIX.length);
+  if (end < 0) return void 0;
+  return message2.content.slice(CONTEXT_UPDATE_PREFIX.length, end);
+}
+function deltaSourceValue(previous, display) {
+  if (previous === void 0 || !display.startsWith(previous)) return display;
+  return display.slice(previous.length).replace(/^\s+/, "") || display;
+}
+function limitVisibilityContent(content) {
+  const limit = ContextManager.VISIBILITY_RECORD_CONTENT_LIMIT;
+  if (content.length <= limit) return content;
+  return `${content.slice(0, limit)}
+...[truncated; original length: ${content.length} characters]...`;
+}
+function boundVisibilityLog(records) {
+  if (records === void 0) return [];
+  const limit = ContextManager.VISIBILITY_RECORD_CONTENT_LIMIT;
+  const bounded2 = records.map((item) => ({
+    ...item,
+    ...item.content.length <= limit ? {} : { content: limitVisibilityContent(item.content) }
+  }));
+  return bounded2.length > ContextManager.VISIBILITY_LOG_MAX_ENTRIES ? bounded2.slice(-ContextManager.VISIBILITY_LOG_MAX_ENTRIES) : bounded2;
+}
 function cloneEpoch(epoch) {
   return {
     ...epoch,
@@ -6797,6 +6868,9 @@ function reportProgress(callback, percentage) {
   }
 }
 
+// src/agent/loop.ts
+import { getHeapStatistics } from "v8";
+
 // src/models/structured.ts
 import { z as z7 } from "zod";
 var DEFAULT_RETRY_DELAYS = [1e3, 2e3, 4e3];
@@ -7214,6 +7288,18 @@ function envMaxIterations() {
   if (!Number.isInteger(parsed) || parsed <= 0) return void 0;
   return parsed;
 }
+var MEMORY_PRESSURE_HEAP_RATIO = 0.8;
+function memoryPressureError(heapUsed, heapLimit) {
+  if (heapLimit <= 0 || heapUsed < heapLimit * MEMORY_PRESSURE_HEAP_RATIO) return void 0;
+  const mb = (bytes) => Math.round(bytes / 1048576);
+  return {
+    code: "memory_pressure",
+    message: `Heap usage reached ${Math.round(heapUsed / heapLimit * 100)}% of the V8 limit (${mb(heapUsed)}MB of ${mb(heapLimit)}MB); stopping to avoid a crash. The session is saved and will resume after restart.`
+  };
+}
+function currentMemoryPressure() {
+  return memoryPressureError(process.memoryUsage().heapUsed, getHeapStatistics().heap_size_limit);
+}
 var AgentLoop = class {
   #options;
   #iterationLimitMode = "standard";
@@ -7284,6 +7370,11 @@ var AgentLoop = class {
         yield { type: "error", error: { code: "cancelled", message: abortMessage(request.signal) } };
         return;
       }
+      const pressure = currentMemoryPressure();
+      if (pressure !== void 0) {
+        yield { type: "error", error: pressure };
+        return;
+      }
       const softLimit = Math.floor(maxIterations * this.#options.softLimitFactor);
       if (!warned && iteration >= softLimit) {
         warned = true;
@@ -12679,7 +12770,8 @@ var BoundedOutput = class {
   #headLimit;
   #tailLimit;
   #head = Buffer.alloc(0);
-  #tail = Buffer.alloc(0);
+  #tailChunks = [];
+  #tailBytes = 0;
   #complete = Buffer.alloc(0);
   #bytes = 0;
   constructor(limit) {
@@ -12699,15 +12791,24 @@ var BoundedOutput = class {
       const count = Math.min(this.#headLimit - this.#head.length, chunk.length);
       this.#head = Buffer.concat([this.#head, chunk.subarray(0, count)]);
     }
-    if (this.#tailLimit > 0) this.#tail = Buffer.concat([this.#tail, chunk]).subarray(-this.#tailLimit);
+    if (this.#tailLimit > 0) {
+      this.#tailChunks.push(chunk);
+      this.#tailBytes += chunk.length;
+      if (this.#tailBytes >= this.#tailLimit * 2) {
+        const merged = Buffer.concat(this.#tailChunks).subarray(-this.#tailLimit);
+        this.#tailChunks = [merged];
+        this.#tailBytes = merged.length;
+      }
+    }
   }
   metadata() {
     return { truncated: this.truncated, originalBytes: this.#bytes, limitBytes: this.#limit };
   }
   text() {
     if (!this.truncated) return decodeOutput(this.#complete);
+    const tail = Buffer.concat(this.#tailChunks).subarray(-this.#tailLimit);
     const encoding = classifyUtf8(this.#complete) === "invalid" && process.platform === "win32" ? "gb18030" : "utf-8";
-    return `${decodePrefix(this.#head, encoding)}${ELLIPSIS}${decodeSuffix(this.#tail, encoding)}`;
+    return `${decodePrefix(this.#head, encoding)}${ELLIPSIS}${decodeSuffix(tail, encoding)}`;
   }
 };
 var AdaptiveOutputDecoder = class {
@@ -22634,7 +22735,7 @@ async function createProductionRuntime(options) {
           contextEpoch: harness.main.context.snapshot().epoch?.id ?? "legacy"
         });
         const turnId = harnessJournal.startTurn(turnConfig, { prompt, initialUserMessage: runOptions?.initialUserMessage });
-        return durableTurn(persistAndCheckpointAfter(runMain(
+        return monitorMemoryRestart(durableTurn(persistAndCheckpointAfter(runMain(
           harness,
           skills,
           prompt,
@@ -22654,7 +22755,7 @@ async function createProductionRuntime(options) {
           prompt,
           context: harness.main.context.snapshot(),
           label: `turn: ${prompt.slice(0, 80)}`
-        })), harnessJournal, turnId, turnConfig);
+        })), harnessJournal, turnId, turnConfig), () => requestMemoryRestart(workspace, sessionId, emitOutput));
       },
       runSkill: (skill, prompt, signal) => persistAfter(
         runExplicitSkill(harness, skills, skill, prompt, signal, selectedModels.mainError),
@@ -23403,6 +23504,31 @@ async function* durableTurn(source, journal, turnId, config) {
     }
   }
 }
+async function* monitorMemoryRestart(source, onRestartNeeded) {
+  let pressure = false;
+  for await (const event of source) {
+    if (event.type === "error" && event.error.code === "memory_pressure") pressure = true;
+    yield event;
+  }
+  if (pressure) onRestartNeeded();
+}
+function requestMemoryRestart(workspace, sessionId, emitOutput) {
+  try {
+    const markerPath = memoryRestartMarkerPath(workspace);
+    let previous;
+    try {
+      previous = parseMemoryRestartMarker(readFileSync3(markerPath, "utf8"));
+    } catch {
+    }
+    mkdirSync3(dirname19(markerPath), { recursive: true });
+    writeFileSync(markerPath, `${JSON.stringify(nextMemoryRestartMarker(previous, sessionId, /* @__PURE__ */ new Date()))}
+`, "utf8");
+  } catch {
+  }
+  process.exitCode = MEMORY_RESTART_EXIT_CODE;
+  emitOutput({ type: "notice", message: "Memory watermark reached; the session is saved and Flavor is restarting with a fresh heap." });
+  emitOutput({ type: "exit" });
+}
 async function runGitCommit(deps, hint, signal) {
   if (!await isGitRepository(deps.workspace)) return "Not a git repository \u2014 /commit needs git.";
   let summary2 = await changeSummary(deps.workspace);

package/dist/cli-main.js

@@ -3,7 +3,7 @@ import { createRequire } from "node:module"; const require = createRequire(impor
 import {
   FlavorRpcServer,
   TraceRecorder
-} from "./chunk-TQXNF337.js";
+} from "./chunk-LMFN2QEA.js";
 import {
   staticTaskLines
 } from "./chunk-2BF7CVWZ.js";
@@ -23,7 +23,8 @@ import {
   packageVersion,
   redactErrorText,
   runPalBroker
-} from "./chunk-WB4IJXFT.js";
+} from "./chunk-S525EOFQ.js";
+import "./chunk-CIVPKHF4.js";
 import {
   McpServerConfigSchema,
   McpServerNameSchema,
@@ -32,7 +33,7 @@ import {
   readRecoverableFile,
   setProjectSkillDisabled,
   updateProtectedFile
-} from "./chunk-JFKRX2KG.js";
+} from "./chunk-HJOCNKPN.js";
 import "./chunk-RQTYHUMK.js";
 import "./chunk-S32JRDZK.js";
 
@@ -750,7 +751,7 @@ async function runEvaluationFile(path, outputPath) {
     })),
     ...parsed.maxTokens === void 0 ? {} : { maxTokens: parsed.maxTokens }
   };
-  const configured = await import("./load-LTTKVPJZ.js").then(({ loadConfig: loadConfig2 }) => loadConfig2({ cwd: workspace, home: process.env.USERPROFILE ?? process.env.HOME ?? workspace }));
+  const configured = await import("./load-DELQW42K.js").then(({ loadConfig: loadConfig2 }) => loadConfig2({ cwd: workspace, home: process.env.USERPROFILE ?? process.env.HOME ?? workspace }));
   const environment = createExecutionEnvironment(workspace, configured.config.execution) ?? new LocalExecutionEnvironment();
   let report;
   try {
@@ -877,7 +878,7 @@ async function runInteractiveCli(props) {
   const [{ render, AlternateScreen }, { createElement }, { App }] = await Promise.all([
     import("./claude-ink-ORUA7GWG.js"),
     import("react"),
-    import("./app-DDYOKGCX.js")
+    import("./app-6SEGTMMC.js")
   ]);
   const instance = await render(createElement(
     AlternateScreen,

package/dist/cli.js

@@ -1,10 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module"; const require = createRequire(import.meta.url);
+import {
+  MEMORY_RESTART_EXIT_CODE,
+  memoryRestartArgs,
+  memoryRestartMarkerPath,
+  parseMemoryRestartMarker
+} from "./chunk-CIVPKHF4.js";
 import "./chunk-S32JRDZK.js";
 
 // src/launcher.ts
 import { spawn } from "child_process";
-import { realpathSync } from "fs";
+import { realpathSync, readFileSync } from "fs";
 import { release } from "os";
 import { fileURLToPath } from "url";
 function needsWindowsMaglevWorkaround(runtime) {
@@ -14,9 +20,23 @@ function needsWindowsMaglevWorkaround(runtime) {
   if (build !== 26200 || major < 24) return false;
   return !runtime.execArgv.some((argument) => argument === "--no-maglev" || argument === "--jitless");
 }
+function needsRelaunch(runtime) {
+  if (needsWindowsMaglevWorkaround(runtime)) return true;
+  if (!runtime.execArgv.some((argument) => argument === "--report-on-fatalerror")) return true;
+  return !runtime.execArgv.some((argument) => argument.startsWith("--heapsnapshot-near-heap-limit"));
+}
 function cliMainArguments(runtime, mainPath, argv) {
   return [
     ...needsWindowsMaglevWorkaround(runtime) ? ["--no-maglev"] : [],
+    // Fatal V8 errors (heap OOM, native crashes) bypass crash-guard.ts and
+    // leave only an unusable native stack. Ask Node to dump a diagnostic
+    // report next to the working directory so the next crash has a scene.
+    "--report-on-fatalerror",
+    // The 2026-08-29 OOM report showed 4.29GB retained with only ~130K
+    // context tokens, and no static candidate explained the retention.
+    // Capture one heap snapshot as the heap nears its limit so the next
+    // crash leaves a .heapsnapshot retainer trail next to the report.
+    "--heapsnapshot-near-heap-limit=1",
     mainPath,
     ...argv
   ];
@@ -29,26 +49,48 @@ async function launchCli() {
     nodeVersion: process.version,
     execArgv: process.execArgv
   };
-  if (!needsWindowsMaglevWorkaround(runtime)) {
+  if (!needsRelaunch(runtime)) {
     const cli = await import(mainUrl.href);
     await cli.runCli(process.argv);
     return;
   }
-  const child = spawn(
-    process.execPath,
-    cliMainArguments(runtime, fileURLToPath(mainUrl), process.argv.slice(2)),
-    { stdio: "inherit" }
-  );
+  const mainPath = fileURLToPath(mainUrl);
+  let argv = process.argv.slice(2);
+  for (; ; ) {
+    const code = await spawnAndWait(runtime, mainPath, argv);
+    if (code === MEMORY_RESTART_EXIT_CODE) {
+      let marker;
+      try {
+        marker = parseMemoryRestartMarker(readFileSync(memoryRestartMarkerPath(process.cwd()), "utf8"));
+      } catch {
+        marker = void 0;
+      }
+      const resumed = memoryRestartArgs(argv, marker);
+      if (resumed !== void 0) {
+        process.stderr.write(`flavor launcher: heap watermark restart, resuming session ${marker.sessionId}
+`);
+        argv = resumed;
+        continue;
+      }
+      if (marker !== void 0) {
+        process.stderr.write("flavor launcher: heap watermark restart budget exhausted; restart manually and consider a fresh session.\n");
+      }
+    }
+    process.exitCode = code;
+    return;
+  }
+}
+async function spawnAndWait(runtime, mainPath, argv) {
+  const child = spawn(process.execPath, cliMainArguments(runtime, mainPath, argv), { stdio: "inherit" });
   const ignoreSignal = () => {
   };
   process.on("SIGINT", ignoreSignal);
   process.on("SIGBREAK", ignoreSignal);
   try {
-    const code = await new Promise((resolvePromise, reject) => {
+    return await new Promise((resolvePromise, reject) => {
       child.once("error", reject);
       child.once("exit", (exitCode) => resolvePromise(exitCode ?? 1));
     });
-    process.exitCode = code;
   } finally {
     process.off("SIGINT", ignoreSignal);
     process.off("SIGBREAK", ignoreSignal);
@@ -69,5 +111,6 @@ if (process.argv[1]) {
 export {
   cliMainArguments,
   launchCli,
+  needsRelaunch,
   needsWindowsMaglevWorkaround
 };

package/dist/context/manager.d.ts

@@ -67,6 +67,13 @@ export type ContextForkOptions = Partial<Pick<ContextManagerOptions, "summarize"
 export { estimateTokens } from "./compaction.js";
 export declare class ContextManager {
     #private;
+    /**
+     * The visibility audit log persists every transient system admission and is
+     * serialized in full on every session save. Bound both dimensions or a long
+     * subagent-driven run grows it into hundreds of megabytes (heap OOM).
+     */
+    static readonly VISIBILITY_LOG_MAX_ENTRIES = 1000;
+    static readonly VISIBILITY_RECORD_CONTENT_LIMIT = 2048;
     constructor(options: ContextManagerOptions);
     clear(): void;
     /**