jeopi-cli 16.4.0 → 16.4.2

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "jeopi-cli",
-	"version": "16.4.0",
+	"version": "16.4.2",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/akillness/jeopi",
 	"author": "Can Boluk",
@@ -57,17 +57,17 @@
 		"@agentclientprotocol/sdk": "0.25.0",
 		"@babel/parser": "^7.29.7",
 		"@mozilla/readability": "^0.6.0",
-		"jeopi-hashline": "16.4.0",
-		"jeopi-stats": "16.4.0",
-		"jeopi-agent-core": "16.4.0",
-		"jeopi-ai": "16.4.0",
-		"jeopi-catalog": "16.4.0",
-		"jeopi-mnemopi": "16.4.0",
-		"jeopi-natives": "16.4.0",
-		"jeopi-tui": "16.4.0",
-		"jeopi-utils": "16.4.0",
-		"jeopi-wire": "16.4.0",
-		"jeopi-snapcompact": "16.4.0",
+		"jeopi-hashline": "16.4.2",
+		"jeopi-stats": "16.4.2",
+		"jeopi-agent-core": "16.4.2",
+		"jeopi-ai": "16.4.2",
+		"jeopi-catalog": "16.4.2",
+		"jeopi-mnemopi": "16.4.2",
+		"jeopi-natives": "16.4.2",
+		"jeopi-tui": "16.4.2",
+		"jeopi-utils": "16.4.2",
+		"jeopi-wire": "16.4.2",
+		"jeopi-snapcompact": "16.4.2",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/context-async-hooks": "^2.7.1",
 		"@opentelemetry/exporter-trace-otlp-proto": "^0.218.0",

package/src/session/agent-session.ts

@@ -109,6 +109,7 @@ import {
 	serviceTierFamily,
 	streamSimple,
 } from "jeopi-ai";
+import { renderDemotedThinking } from "jeopi-ai/dialect";
 import * as AIError from "jeopi-ai/error";
 import { toolWireSchema } from "jeopi-ai/utils/schema";
 import { GeminiHeaderRunDetector, isGeminiThinkingModel } from "jeopi-ai/utils/thinking-loop";
@@ -521,6 +522,17 @@ const RETRY_BACKOFF_MAX_DELAY_MS = 8_000;
 const REFUSAL_BACKOFF_BASE_MS = 2_000;
 const REFUSAL_BACKOFF_MAX_MS = 30_000;
 const REFUSAL_BACKOFF_BUDGET_MS = 30 * 60_000;
+/**
+ * Consecutive-use cap on the `reasoning_extraction` fast-degrade path (strip
+ * unsigned thinking, resend same-model, zero delay — see
+ * `#reasoningExtractionDegradeStreak` below). Bounds the worst case where a
+ * pathological classifier state (documented: 1,164 refusals over ~4 hours in
+ * one incident) refuses every turn's fresh thinking in a row — after this
+ * many back-to-back fast-degrades with no intervening success, fall through
+ * to the Rung-4 ladder above, which already wall-clock-bounds via
+ * {@link REFUSAL_BACKOFF_BUDGET_MS}.
+ */
+const REASONING_EXTRACTION_DEGRADE_STREAK_CAP = 3;
 
 function positiveEnvMs(name: string): number | undefined {
 	const raw = process.env[name];
@@ -1610,13 +1622,31 @@ export class AgentSession {
 	/** Rung-4 classifier-refusal resend streak (post fallback-ladder). */
 	#refusalBackoff: { startedAt: number; attempt: number } | undefined = undefined;
 	/**
-	 * One-shot latch: `reasoning_extraction` classifier refusals are payload-shape-bound
-	 * (see advisor/runtime.ts `#includeThinking` degrade) — resending the identical batch
-	 * predictably re-refuses. Set the first time `#handleRetryableError` strips unsigned
-	 * thinking/redactedThinking from active context and resends on the same model; never
-	 * reset, mirroring the advisor's permanent-for-the-session degrade.
-	 */
-	#reasoningExtractionDegraded = false;
+	 * `reasoning_extraction` classifier refusals are payload-shape-bound (see
+	 * advisor/runtime.ts `#includeThinking` degrade): resending the IDENTICAL
+	 * batch predictably re-refuses, so a bare retry can't help. But this is a
+	 * point-in-time strip of the CURRENT active context, not a persistent
+	 * setting — unlike the advisor's permanent-for-the-session
+	 * `includeThinking` flag, it does not prevent NEW unsigned thinking from a
+	 * LATER turn (a fresh advisor exchange, another interrupt, plain
+	 * continued conversation) from independently triggering its own,
+	 * genuinely-different refusal. A one-shot latch here previously left every
+	 * occurrence after the first to fall through to the generic Rung-4
+	 * backoff ladder unstripped — resending the same unstripped payload until
+	 * the wall-clock budget expired and the turn failed visibly.
+	 *
+	 * Fixed by gating on whether {@link #stripUnsignedThinkingForRefusalDegrade}
+	 * actually found something to strip THIS time (it already returns
+	 * `undefined` when there is nothing new to remove, which is itself proof
+	 * the resend would be payload-identical and degrading again cannot help)
+	 * rather than a permanent flag — each distinct occurrence gets its own
+	 * degrade attempt. Bounded by {@link REASONING_EXTRACTION_DEGRADE_STREAK_CAP}
+	 * consecutive uses (reset on any turn that actually succeeds) so a
+	 * pathological classifier state that refuses every turn's fresh thinking
+	 * in a row still falls through to the wall-clock-bounded ladder instead
+	 * of resending at zero delay indefinitely.
+	 */
+	#reasoningExtractionDegradeStreak = 0;
 	#retryPromise: Promise<void> | undefined = undefined;
 	#retryResolve: (() => void) | undefined = undefined;
 	#activeRetryFallback: ActiveRetryFallbackState | undefined = undefined;
@@ -3327,6 +3357,15 @@ export class AgentSession {
 	 * so live render, reload, and Ctrl+L rebuilds keep showing it; `convertToLlm`
 	 * strips the run from the provider request (incomplete/unsigned thinking is
 	 * rejected on resend) when this continuity message follows the assistant turn.
+	 *
+	 * The reasoning text is rendered through {@link renderDemotedThinking} (keyed
+	 * off `message.model`, the model resuming the turn in the overwhelming
+	 * majority of cases) before it reaches the template — same disguise every
+	 * other thinking-replay site in this codebase already applies before
+	 * sending a model's own prior reasoning back to it as plaintext. Raw,
+	 * undisguised reasoning wrapped in a "your unfinished internal work state"
+	 * frame is exactly the shape Anthropic's `reasoning_extraction` classifier
+	 * flags; this was the one remaining site that still shipped it undisguised.
 	 */
 	#demoteInterruptedThinkingOnUserInterrupt(
 		message: AssistantMessage,
@@ -3335,10 +3374,11 @@ export class AgentSession {
 		const demoted = demoteInterruptedThinking(message);
 		if (!demoted) return undefined;
 		const interruptedAt = Date.now();
+		const disguisedReasoning = renderDemotedThinking(message.model, demoted.reasoning).trimEnd();
 		return {
 			role: "custom",
 			customType: INTERRUPTED_THINKING_MESSAGE_TYPE,
-			content: prompt.render(interruptedThinkingTemplate, { reasoning: demoted.reasoning }),
+			content: prompt.render(interruptedThinkingTemplate, { reasoning: disguisedReasoning }),
 			display: false,
 			details: {
 				interruptedAt,
@@ -3663,6 +3703,7 @@ export class AgentSession {
 					});
 					this.#retryAttempt = 0;
 					this.#refusalBackoff = undefined;
+					this.#reasoningExtractionDegradeStreak = 0;
 				}
 				if (assistantMsg.provider === "opencode-go") {
 					this.#modelRegistry.authStorage.recordUsageCost(assistantMsg.provider, assistantMsg.usage.cost.total, {
@@ -13213,29 +13254,39 @@ export class AgentSession {
 		const errorMessage = message.errorMessage || "Unknown error";
 		// `reasoning_extraction` is payload-shape-bound (see advisor/runtime.ts): resending
 		// the identical batch predictably re-refuses, unlike probabilistic classifier flags
-		// where backoff/fallback genuinely help. Degrade once — strip unsigned
-		// thinking/redactedThinking from active context and resend immediately on the same
-		// model — before falling through to the generic fallback-pin / backoff ladder below,
-		// which would otherwise retry the unchanged, re-refusing payload.
+		// where backoff/fallback genuinely help. Strip unsigned thinking/redactedThinking
+		// from active context and resend immediately on the same model — before falling
+		// through to the generic fallback-pin / backoff ladder below, which would otherwise
+		// retry the unchanged, re-refusing payload. Gated on the strip itself finding
+		// something to remove THIS time (not a one-shot flag): a later turn can
+		// independently accumulate fresh unsigned thinking and trigger its own genuinely
+		// different refusal, and `#stripUnsignedThinkingForRefusalDegrade` already reports
+		// "nothing to strip" via `undefined` when the payload truly is unchanged — which is
+		// itself the correct signal to fall through instead of degrading again. Bounded by
+		// `REASONING_EXTRACTION_DEGRADE_STREAK_CAP` consecutive uses so a pathological
+		// classifier state refusing every turn's fresh thinking in a row still reaches the
+		// wall-clock-bounded ladder instead of resending at zero delay indefinitely.
 		if (
 			classifierRefusal &&
 			message.stopDetails?.category === "reasoning_extraction" &&
-			!this.#reasoningExtractionDegraded
+			this.#reasoningExtractionDegradeStreak < REASONING_EXTRACTION_DEGRADE_STREAK_CAP
 		) {
-			this.#reasoningExtractionDegraded = true;
 			const stripped = this.#stripUnsignedThinkingForRefusalDegrade(this.agent.state.messages);
-			if (stripped) this.agent.replaceMessages(stripped);
-			this.#removeAssistantMessageFromActiveContext(message, "reasoning-extraction-degrade");
-			await this.#emitSessionEvent({
-				type: "auto_retry_start",
-				attempt: this.#retryAttempt,
-				maxAttempts: retrySettings.maxRetries,
-				delayMs: 0,
-				errorMessage,
-				errorId: message.errorId,
-			});
-			this.#scheduleAgentContinue({ delayMs: 1, generation });
-			return true;
+			if (stripped) {
+				this.#reasoningExtractionDegradeStreak++;
+				this.agent.replaceMessages(stripped);
+				this.#removeAssistantMessageFromActiveContext(message, "reasoning-extraction-degrade");
+				await this.#emitSessionEvent({
+					type: "auto_retry_start",
+					attempt: this.#retryAttempt,
+					maxAttempts: retrySettings.maxRetries,
+					delayMs: 0,
+					errorMessage,
+					errorId: message.errorId,
+				});
+				this.#scheduleAgentContinue({ delayMs: 1, generation });
+				return true;
+			}
 		}
 
 		const id = this.#classifyRetryMessage(message);