mixdog 0.9.41 → 0.9.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mixdog",
-  "version": "0.9.41",
+  "version": "0.9.43",
   "private": false,
   "type": "module",
   "description": "Standalone mixdog coding-agent CLI/TUI workspace.",

package/scripts/agent-tag-reuse-smoke.mjs

@@ -4,7 +4,6 @@
 // Validates the unified 4-tier spawn dispatch when an explicit tag is pinned:
 //   1) live + idle  -> spawn reuses the existing session (reused:true, send path)
 //   2) live + busy  -> spawn queues the prompt instead of throwing
-//   3) lingering terminal trace (no live session) -> spawn/send error, no respawn
 //   3) lingering terminal trace -> spawn reaps tag; dead-tag send auto-respawns
 //   4) genuinely new tag -> a fresh spawn (no reused/respawned flag)
 //
@@ -32,7 +31,7 @@ process.env.MIXDOG_AGENT_SPAWN_PREP_TIMEOUT_MS = '50';
 // is the authority; shorten only the test clock, not the configured duration.
 process.env.MIXDOG_AGENT_TERMINAL_REAP_MS = '1000';
 const nativeSetTimeout = globalThis.setTimeout;
-globalThis.setTimeout = (callback, ms, ...args) => nativeSetTimeout(callback, ms === 60_000 ? 500 : ms, ...args);
+globalThis.setTimeout = (callback, ms, ...args) => nativeSetTimeout(callback, ms === 60_000 ? 1000 : ms, ...args);
 
 const { createStandaloneAgent } = await import('../src/standalone/agent-tool.mjs');
 
@@ -119,7 +118,11 @@ async function waitJob(out, pattern, label, tries = 60, context = ctx) {
   throw new Error(`${label} did not match ${pattern}: ${last}`);
 }
 function sessionForTag(tag) {
-  return listSessions().find((s) => s?.agentTag === tag && !s.closed) || null;
+  for (let i = askLog.length - 1; i >= 0; i -= 1) {
+    const session = getSession(askLog[i].sessionId);
+    if (session?.agentTag === tag && !session.closed) return session;
+  }
+  return null;
 }
 function addPeerTerminalRow(tag, sessionId) {
   const file = join(dataDir, 'agent-workers.json');
@@ -137,6 +140,40 @@ function addPeerTerminalRow(tag, sessionId) {
   };
   writeFileSync(file, JSON.stringify(index));
 }
+function addWorkerRow({
+  tag,
+  sessionId,
+  clientHostPid = ctx.clientHostPid,
+  status = 'idle',
+  updatedAt = new Date().toISOString(),
+  agentName = 'worker',
+}) {
+  const file = join(dataDir, 'agent-workers.json');
+  const index = JSON.parse(readFileSync(file, 'utf8'));
+  index.workers[sessionId] = {
+    tag,
+    sessionId,
+    agent: agentName,
+    provider: 'openai-oauth',
+    status,
+    stage: status,
+    updatedAt,
+    clientHostPid,
+    cwd: root,
+  };
+  writeFileSync(file, JSON.stringify(index));
+}
+function addTombstones(rows) {
+  const file = join(dataDir, 'agent-workers.json');
+  const index = JSON.parse(readFileSync(file, 'utf8'));
+  index.tombstones ||= {};
+  for (const row of rows) index.tombstones[`${row.clientHostPid || 0}:${row.tag}`] = row;
+  writeFileSync(file, JSON.stringify(index));
+}
+function tombstonesForTag(tag) {
+  const index = JSON.parse(readFileSync(join(dataDir, 'agent-workers.json'), 'utf8'));
+  return Object.values(index.tombstones || {}).filter((row) => row.tag === tag);
+}
 function hasWorkerRow(sessionId) {
   const index = JSON.parse(readFileSync(join(dataDir, 'agent-workers.json'), 'utf8'));
   return Boolean(index.workers?.[sessionId]);
@@ -165,8 +202,9 @@ async function main() {
   }, ctx);
   assert(/agent task:/.test(firstOut), `first spawn must return a task: ${firstOut}`);
   assert(!/reused: true/.test(firstOut) && !/respawned/.test(firstOut), `fresh tag must not be flagged reused/respawned: ${firstOut}`);
+  const firstSession = await waitSessionForTag('reviewerA', 'first spawn');
   await waitJob(firstOut, /ack: first review pass/, 'first spawn');
-  const sid = (await waitSessionForTag('reviewerA', 'first spawn')).id;
+  const sid = firstSession.id;
   assert(sid, 'reviewerA session should remain live (idle) within the reap window');
 
   // --- tier 1 (the headline bug): re-spawn the SAME tag while idle+live ---
@@ -204,6 +242,7 @@ async function main() {
     type: 'spawn', agent: 'reviewer', tag: 'reviewerA', prompt: 'trace reap respawn', cwd: root,
   }, ctx);
   assert(!/^Error:/.test(traceSpawnOut), `terminal-trace spawn must reap and reuse tag: ${traceSpawnOut}`);
+  assert(/respawned: true/.test(traceSpawnOut), `terminal-trace spawn must flag lost context: ${traceSpawnOut}`);
   await waitJob(traceSpawnOut, /ack: trace reap respawn/, 'trace reap spawn');
   assert(hasWorkerRow('sess_peer_trace'), 'terminal-trace reap must preserve a peer terminal row with the same tag');
   removeWorkerRow('sess_peer_trace');
@@ -225,26 +264,57 @@ async function main() {
   await waitJob(timerPeerStart, /ack: timer peer seed/, 'timer peer seed');
   const timerPeerSession = (await waitSessionForTag('timer-peer', 'timer peer seed')).id;
   addPeerTerminalRow('timer-peer', 'sess_peer_timer');
-  await sleep(700);
+  await sleep(1200);
   assert(getSession(timerPeerSession)?.closed, 'terminal timer must reap its local session');
   assert(hasWorkerRow('sess_peer_timer'), 'terminal timer must preserve a peer row with the same tag');
 
-  // Fully reaped tags have no in-memory map or persisted row. Explicit
-  // cold-spawn identity is enough to create a replacement.
+  // Fully reaped tags retain a terminal-scoped tombstone, so send inherits the
+  // prior agent/cwd without the caller having to reconstruct cold identity.
   const coldStart = await agent.execute({
     type: 'spawn', agent: 'worker', tag: 'cold-reaped', prompt: 'cold reap seed', cwd: root,
   }, ctx);
   await waitJob(coldStart, /ack: cold reap seed/, 'cold reap seed');
   const coldSessionId = (await waitSessionForTag('cold-reaped', 'cold reap seed')).id;
-  await sleep(1200);
+  await sleep(1700);
   assert(!sessionForTag('cold-reaped') && getSession(coldSessionId)?.closed, 'terminal reaper must remove the cold-reaped session');
   const coldSendOut = await agent.execute({
-    type: 'send', agent: 'worker', tag: 'cold-reaped', message: 'cold reap replacement', cwd: root,
+    type: 'send', tag: 'cold-reaped', message: 'cold reap replacement',
   }, ctx);
   assert(!/^Error:/.test(coldSendOut), `fully reaped tag must cold-respawn: ${coldSendOut}`);
   assert(/respawned: true/.test(coldSendOut), `fully reaped send must flag respawned: ${coldSendOut}`);
   await waitJob(coldSendOut, /ack: cold reap replacement/, 'cold reap replacement');
 
+  // Explicit spawn consumes the same tombstone form and also reports that the
+  // previous conversational context was lost.
+  const coldSpawnSeed = await agent.execute({
+    type: 'spawn', agent: 'reviewer', tag: 'cold-spawn-reaped', prompt: 'cold spawn seed', cwd: root,
+  }, ctx);
+  await waitJob(coldSpawnSeed, /ack: cold spawn seed/, 'cold spawn seed');
+  const coldSpawnSessionId = (await waitSessionForTag('cold-spawn-reaped', 'cold spawn seed')).id;
+  await sleep(1700);
+  assert(getSession(coldSpawnSessionId)?.closed, 'terminal reaper must close the cold-spawn seed');
+  const coldSpawnOut = await agent.execute({
+    type: 'spawn', tag: 'cold-spawn-reaped', prompt: 'cold spawn replacement',
+  }, ctx);
+  assert(!/^Error:/.test(coldSpawnOut), `tombstoned tag spawn must respawn: ${coldSpawnOut}`);
+  assert(/respawned: true/.test(coldSpawnOut), `tombstoned tag spawn must flag respawned: ${coldSpawnOut}`);
+  await waitJob(coldSpawnOut, /ack: cold spawn replacement/, 'cold spawn replacement');
+
+  // A stale running row with neither a live session nor a recent heartbeat is
+  // transitioned to a tombstone instead of blocking this tag forever.
+  addWorkerRow({
+    tag: 'stale-running',
+    sessionId: 'sess_stale_running',
+    status: 'running',
+    updatedAt: new Date(Date.now() - 120_000).toISOString(),
+  });
+  const staleRunningOut = await agent.execute({
+    type: 'spawn', tag: 'stale-running', prompt: 'stale running replacement',
+  }, ctx);
+  assert(!/^Error:/.test(staleRunningOut), `stale nonterminal row must transition: ${staleRunningOut}`);
+  assert(/respawned: true/.test(staleRunningOut), `stale nonterminal transition must flag respawned: ${staleRunningOut}`);
+  await waitJob(staleRunningOut, /ack: stale running replacement/, 'stale running replacement');
+
   // A raw session id, typo without retained evidence/identity, and a peer tag
   // must never turn into a local cold spawn.
   const rawSessionOut = await agent.execute({
@@ -264,6 +334,47 @@ async function main() {
   }, ctx);
   assert(/^Error:/.test(peerOut), `peer-terminal tag must remain an error: ${peerOut}`);
 
+  // Let the peer session become a peer-owned tombstone. Neither normal nor
+  // allTerminals dispatch may inherit that terminal identity.
+  await sleep(1700);
+  assert(tombstonesForTag('peer-owned').some((row) => row.clientHostPid === peerCtx.clientHostPid), 'peer-owned tombstone must exist');
+  const peerTombstoneSend = await agent.execute({
+    type: 'send', tag: 'peer-owned', message: 'must not absorb peer tombstone', allTerminals: true,
+  }, ctx);
+  assert(/^Error:/.test(peerTombstoneSend), `allTerminals send must reject peer tombstone: ${peerTombstoneSend}`);
+  const peerTombstoneSpawn = await agent.execute({
+    type: 'spawn', tag: 'peer-owned', prompt: 'must not inherit peer spawn', allTerminals: true,
+  }, ctx);
+  assert(/^Error:/.test(peerTombstoneSpawn), `allTerminals spawn must reject peer tombstone inheritance: ${peerTombstoneSpawn}`);
+
+  // Local evidence wins when a peer tombstone with the same tag coexists.
+  addTombstones([
+    { tag: 'coowned', agent: 'reviewer', cwd: root, clientHostPid: ctx.clientHostPid, reapedAt: new Date().toISOString() },
+    { tag: 'coowned', agent: 'worker', cwd: root, clientHostPid: peerCtx.clientHostPid, reapedAt: new Date().toISOString() },
+  ]);
+  const coownedOut = await agent.execute({
+    type: 'send', tag: 'coowned', message: 'prefer local tombstone', allTerminals: true,
+  }, ctx);
+  assert(!/^Error:/.test(coownedOut), `local tombstone must beat coexisting peer: ${coownedOut}`);
+  assert(/respawned: true/.test(coownedOut), `coexisting local tombstone must respawn: ${coownedOut}`);
+  await waitJob(coownedOut, /ack: prefer local tombstone/, 'coowned local tombstone');
+
+  // Fill the cap with future-dated entries, then let a real reap write one more.
+  // The current write must survive clamping/pruning.
+  const pruneSeed = await agent.execute({
+    type: 'spawn', agent: 'worker', tag: 'prune-current', prompt: 'prune seed', cwd: root,
+  }, ctx);
+  await waitJob(pruneSeed, /ack: prune seed/, 'prune seed');
+  addTombstones(Array.from({ length: 500 }, (_, i) => ({
+    tag: `future-${i}`,
+    agent: 'worker',
+    cwd: root,
+    clientHostPid: ctx.clientHostPid,
+    reapedAt: new Date(Date.now() + 86_400_000 + i).toISOString(),
+  })));
+  await sleep(1700);
+  assert(tombstonesForTag('prune-current').length === 1, 'prune cap must retain the tombstone written this call');
+
   // agent close clears the trace; same tag can spawn fresh again
   addPeerTerminalRow('reviewerA', 'sess_peer_close');
   await agent.execute({ type: 'close', tag: 'reviewerA' }, ctx);
@@ -306,7 +417,10 @@ async function main() {
   removeWorkerRow(staleSessionId);
   addPeerTerminalRow('fallback-peer', 'sess_peer_fallback');
   const fallbackClose = await agent.execute({ type: 'close', tag: 'fallback-peer' }, ctx);
-  assert(/forgotten: true/.test(fallbackClose), `stale close fallback must stay forgotten:true: ${fallbackClose}`);
+  assert(
+    /forgotten: true|target "fallback-peer" not found/.test(fallbackClose),
+    `stale close fallback must forget locally or report no local target: ${fallbackClose}`,
+  );
   assert(hasWorkerRow('sess_peer_fallback'), 'stale close fallback must preserve a peer terminal row with the same tag');
   removeWorkerRow('sess_peer_fallback');
   const fallbackFresh = await agent.execute({

package/scripts/anthropic-oauth-refresh-race-test.mjs

@@ -25,6 +25,7 @@ const { AnthropicOAuthProvider } = await import(
     '../src/runtime/agent/orchestrator/providers/anthropic-oauth.mjs'
 );
 const {
+    DEFAULT_CLI_VERSION,
     _saveCredentialsFile,
     loadCredentials,
     loadCredentialsFromPath,
@@ -48,6 +49,64 @@ function writeCredentials({ accessToken, refreshToken, expiresAt }, path = crede
     });
 }
 
+test('refresh uses the current CLI identity and returns a neutral sanitized 403', async () => {
+    const accessToken = 'fixture-access-must-not-leak';
+    const refreshToken = 'fixture-refresh-must-not-leak';
+    writeCredentials({
+        accessToken,
+        refreshToken,
+        expiresAt: Date.now() + 1_000,
+    });
+    const before = readFileSync(credentialsPath, 'utf8');
+    const originalFetch = globalThis.fetch;
+    let request = null;
+    globalThis.fetch = async (url, options) => {
+        request = { url, options };
+        return {
+            ok: false,
+            status: 403,
+            async text() {
+                return JSON.stringify({
+                    error: 'forbidden',
+                    accessToken,
+                    refresh_token: refreshToken,
+                    echoed: `Bearer ${accessToken}`,
+                });
+            },
+        };
+    };
+    try {
+        assert.equal(DEFAULT_CLI_VERSION, '2.1.207');
+        await assert.rejects(
+            refreshOAuthCredentials(loadCredentials()),
+            (err) => {
+                assert.match(err.message, /token refresh 403/);
+                assert.match(err.message, /claude-cli\/2\.1\.207/);
+                assert.match(err.message, /Possible causes include OAuth client compatibility/);
+                assert.match(err.message, /account or scope policy/);
+                assert.match(err.message, /proxy\/VPN\/WAF/);
+                assert.match(err.message, /regional endpoint restrictions/);
+                assert.match(err.message, /Verify the account has Claude Code access and the required scopes/);
+                assert.match(err.message, /MIXDOG_CLI_VERSION/);
+                assert.match(err.message, /retry sign-in via \/providers/);
+                assert.doesNotMatch(err.message, /rejected the OAuth client identity/);
+                assert.doesNotMatch(err.message, /fixture-access-must-not-leak/);
+                assert.doesNotMatch(err.message, /fixture-refresh-must-not-leak/);
+                return true;
+            },
+        );
+        assert.equal(
+            request.options.headers['user-agent'],
+            'claude-cli/2.1.207 (external, sdk-cli)',
+        );
+        assert.equal(request.options.redirect, 'error');
+        assert.equal(JSON.parse(request.options.body).refresh_token, refreshToken);
+        assert.equal(readFileSync(credentialsPath, 'utf8'), before);
+    } finally {
+        globalThis.fetch = originalFetch;
+    }
+});
+
 test('parallel host preflights refresh once and snapshot the leased generation', async () => {
     writeCredentials({
         accessToken: 'fixture-access-old',

package/scripts/arg-guard-test.mjs

@@ -75,3 +75,19 @@ test('below-min (negative) still errors', () => {
 test('fractional numeric string is not coerced (still errors)', () => {
     assert.match(validateBuiltinArgs('read', { path: 'x.mjs', limit: '3.5' }), /must be an integer/);
 });
+
+test('grep pattern and glob-filter numeric values coerce to strings', () => {
+    const pattern = { pattern: 123 };
+    assert.equal(validateBuiltinArgs('grep', pattern), null);
+    assert.equal(pattern.pattern, '123');
+
+    const patternArray = { pattern: [123, 'a'] };
+    assert.equal(validateBuiltinArgs('grep', patternArray), null);
+    assert.deepEqual(patternArray.pattern, ['123', 'a']);
+
+    const glob = { pattern: 'x', glob: 123 };
+    assert.equal(validateBuiltinArgs('grep', glob), null);
+    assert.equal(glob.glob, '123');
+
+    assert.match(validateBuiltinArgs('grep', { pattern: {} }), /must be string or string\[\]/);
+});

package/scripts/compact-pressure-test.mjs

@@ -1,9 +1,18 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { estimateMessagesTokens } from '../src/runtime/agent/orchestrator/session/context-utils.mjs';
+import {
+    estimateMessagesTokens,
+    estimateRequestReserveTokens,
+    estimateToolSchemaTokens,
+    estimateTokens,
+    IMAGE_VISUAL_TOKEN_ALLOWANCE,
+    summarizeContextMessages,
+} from '../src/runtime/agent/orchestrator/session/context-utils.mjs';
+import { createContextStatus } from '../src/session-runtime/context-status.mjs';
 import {
     compactionTelemetryPressureTokens,
     recordProviderContextBaseline,
+    resolveCompactionPressureTokens,
     rememberCompactTelemetry,
     resolveWorkerCompactPolicy,
     shouldCompactForSession,
@@ -26,6 +35,252 @@ test('Lead/main auto-compaction triggers at 95% of the effective boundary', () =
     assert.equal(agentPolicy.triggerTokens, 90_000, 'agent default 10% headroom must remain unchanged');
 });
 
+test('image payload bytes do not inflate live gauge or fallback compaction estimates', () => {
+    const text = 'Please describe the attached image.';
+    const imageData = 'A'.repeat(400_000);
+    const imagePart = { type: 'image', data: imageData, mimeType: 'image/png' };
+    const messages = [{
+        role: 'user',
+        content: [{ type: 'text', text }, imagePart],
+    }];
+    const plainTextEstimate = estimateTokens(text) + 4;
+    const fallbackEstimate = estimateMessagesTokens(messages);
+    const summaryEstimate = summarizeContextMessages(messages).estimatedTokens;
+
+    assert.equal(estimateMessagesTokens([{ role: 'user', content: text }]), plainTextEstimate,
+        'ordinary string estimates must remain unchanged');
+    assert.equal(fallbackEstimate, plainTextEstimate + IMAGE_VISUAL_TOKEN_ALLOWANCE,
+        'fallback compaction estimate must count text plus a visual image allowance');
+    const largerPayloadEstimate = estimateMessagesTokens([{
+        role: 'user',
+        content: [{ type: 'text', text }, { ...imagePart, data: imageData.repeat(2) }],
+    }]);
+    assert.equal(largerPayloadEstimate, fallbackEstimate,
+        'raw image byte length must not affect the visual allowance');
+    assert.equal(summaryEstimate, fallbackEstimate,
+        'display and fallback compaction must share the image-aware message estimate');
+
+    const session = {
+        id: 'image-context-test',
+        provider: 'openai',
+        contextWindow: 100_000,
+        rawContextWindow: 100_000,
+        compactBoundaryTokens: 100_000,
+        messages: [],
+        liveTurnMessages: messages,
+        tools: [],
+        compaction: {},
+    };
+    const { contextStatus } = createContextStatus({
+        getSession: () => session,
+        getRoute: () => ({ provider: 'openai', model: 'test-model' }),
+        getCurrentCwd: () => '',
+        getMode: () => 'default',
+    });
+    const status = contextStatus();
+    assert.ok(status.usedTokens < status.compaction.triggerTokens,
+        `image-aware live gauge must remain below compaction threshold, got ${status.usedTokens}`);
+    assert.ok(status.usedTokens < status.contextWindow,
+        `raw base64 must not pin the live gauge at 100%, got ${status.usedTokens}/${status.contextWindow}`);
+
+    recordProviderContextBaseline(session, messages, { inputTokens: 80_000, outputTokens: 0 });
+    const policy = { ...policyFor(session), reserveTokens: 0 };
+    assert.equal(
+        shouldCompactForSession(fallbackEstimate, policy, { messages, sessionRef: session }),
+        false,
+        'provider-backed pressure below threshold must remain below threshold',
+    );
+    assert.equal(imagePart.data, imageData,
+        'estimating live context must not sanitize or remove image content');
+});
+
+test('dense ASCII, encoded, and minified payloads do not retain the prose chars/4 estimate', () => {
+    for (const text of [
+        'A1b2C3d4E5f6G7h8'.repeat(100),
+        '%7B%22path%22%3A%22very%2Flong%2Fencoded%2Fvalue%22%7D'.repeat(40),
+        JSON.stringify({ rows: Array.from({ length: 100 }, (_, i) => ({ id: i, value: `item_${i}_abcdef` })) }),
+    ]) {
+        assert.ok(estimateTokens(text) >= Math.ceil(text.length * 0.7),
+            `dense ASCII estimate must be conservative (${estimateTokens(text)}/${text.length})`);
+    }
+    const shortJsonl = Array.from({ length: 200 }, (_, i) => `{"i":${i}}`).join('\n');
+    assert.ok(estimateTokens(shortJsonl) >= shortJsonl.replace(/\s/g, '').length * 0.7,
+        'short JSONL records must receive the structured multiline floor');
+    const spacedShortIdentifiers = 'A1b2C3d4E5 F6G7H8I9J0 '.repeat(100);
+    assert.ok(estimateTokens(spacedShortIdentifiers) >= spacedShortIdentifiers.length * 0.7,
+        'space-separated encoded identifiers below the long-run threshold must receive the dense floor');
+});
+
+test('assistantBlocks and reasoningItems count provider-visible data but not image bytes', () => {
+    const base = { role: 'assistant', content: '' };
+    const assistantBlocks = [
+        { type: 'text', text: 'native assistant replay' },
+        { type: 'tool_use', id: 'call_native', name: 'read', input: '{"path":"x"}' },
+        { type: 'image', data: 'Z'.repeat(300_000), mimeType: 'image/png' },
+    ];
+    const reasoningItems = [{ type: 'reasoning', encrypted_content: 'enc_'.repeat(2_000) }];
+    const estimated = estimateMessagesTokens([{ ...base, assistantBlocks, reasoningItems }]);
+    const noNativeReplay = estimateMessagesTokens([base]);
+    assert.ok(estimated > noNativeReplay + IMAGE_VISUAL_TOKEN_ALLOWANCE,
+        'native assistant blocks and opaque reasoning must contribute tokens');
+    assert.equal(
+        estimateMessagesTokens([{ ...base, assistantBlocks: assistantBlocks.map(block => (
+            block.type === 'image' ? { ...block, data: 'Z'.repeat(600_000) } : block
+        )), reasoningItems }]),
+        estimated,
+        'native replay image bytes must not be tokenized',
+    );
+});
+
+test('image allowance handles identity, detail, dimensions, and multiple accepted forms', () => {
+    const low = { type: 'image_url', image_url: { url: 'https://example.test/a.png', detail: 'low' } };
+    const tiled = {
+        type: 'input_image',
+        image_url: { url: 'https://example.test/b.png', detail: 'high' },
+        dimensions: { width: 2_048, height: 1_024 },
+    };
+    const inline = { inlineData: { data: 'A'.repeat(1_000), mimeType: 'image/png' }, width: 512, height: 512 };
+    const lowEstimate = estimateMessagesTokens([{ role: 'user', content: [low] }]);
+    const tiledEstimate = estimateMessagesTokens([{ role: 'user', content: [tiled] }]);
+    const multiEstimate = estimateMessagesTokens([{ role: 'user', content: [low, tiled, inline] }]);
+    assert.ok(tiledEstimate > lowEstimate, 'high-detail multi-tile image must reserve more than low detail');
+    assert.ok(lowEstimate >= IMAGE_VISUAL_TOKEN_ALLOWANCE + 4,
+        'unverified low-detail metadata must not reduce the conservative image fallback');
+    const unverifiedSmallDimensions = estimateMessagesTokens([{
+        role: 'user',
+        content: [{ type: 'image', data: 'A'.repeat(1_000), width: 1, height: 1, detail: 'low' }],
+    }]);
+    assert.ok(unverifiedSmallDimensions >= IMAGE_VISUAL_TOKEN_ALLOWANCE + 4,
+        'unverified tiny dimensions must not reduce the conservative image fallback');
+    assert.ok(multiEstimate > tiledEstimate + lowEstimate, 'every accepted image form must add visual allowance');
+
+    const session = { provider: 'openai', model: 'm', tools: [], contextWindow: 100_000, compaction: {} };
+    const messages = [{ role: 'user', content: [{ type: 'image', data: 'A'.repeat(1_000), mimeType: 'image/png' }] }];
+    const policy = policyFor(session);
+    recordProviderContextBaseline(session, messages, { inputTokens: 80_000 }, { sendTools: [] });
+    messages[0].content[0].data = 'B'.repeat(1_000);
+    assert.equal(
+        resolveCompactionPressureTokens(estimateMessagesTokens(messages), policy, { messages, sessionRef: session }),
+        estimateMessagesTokens(messages) + policy.reserveTokens,
+        'same-size image replacement must invalidate the measured prefix',
+    );
+});
+
+test('tool reserve and status cache detect nested schema mutation', () => {
+    const tools = [{ name: 'read', parameters: { type: 'object', properties: { path: { type: 'string' } } } }];
+    const beforeSchema = estimateToolSchemaTokens(tools);
+    const beforeReserve = estimateRequestReserveTokens(tools);
+    tools[0].parameters.properties.path.description = 'dense_nested_schema_description_'.repeat(200);
+    assert.ok(estimateToolSchemaTokens(tools) > beforeSchema);
+    assert.ok(estimateRequestReserveTokens(tools) > beforeReserve);
+
+    const session = { id: 'tool-cache', contextWindow: 100_000, messages: [{ role: 'user', content: 'x' }], tools, compaction: {} };
+    const { contextStatus } = createContextStatus({
+        getSession: () => session,
+        getRoute: () => ({ provider: 'openai', model: 'm' }),
+        getCurrentCwd: () => '',
+        getMode: () => 'default',
+    });
+    const statusBefore = contextStatus();
+    tools[0].parameters.properties.path.description += 'more_'.repeat(500);
+    const statusAfter = contextStatus();
+    assert.notEqual(statusAfter, statusBefore);
+    assert.ok(statusAfter.request.toolSchemaTokens > statusBefore.request.toolSchemaTokens);
+});
+
+test('native replay fingerprint detects encrypted reasoning and assistant metadata mutation', () => {
+    const message = {
+        role: 'assistant',
+        content: '',
+        reasoningItems: [{ type: 'reasoning', encrypted_content: 'short' }],
+        assistantBlocks: [{ type: 'tool_use', id: 'c1', name: 'read', input: { path: 'a' }, cache_control: { type: 'ephemeral' } }],
+    };
+    const messages = [message];
+    const first = summarizeContextMessages(messages).estimatedTokens;
+    message.reasoningItems[0].encrypted_content = 'encrypted_'.repeat(1_000);
+    const second = summarizeContextMessages(messages).estimatedTokens;
+    assert.ok(second > first, 'in-place encrypted_content mutation must invalidate the message memo');
+    message.assistantBlocks[0].cache_control.mode = 'metadata_'.repeat(1_000);
+    const third = summarizeContextMessages(messages).estimatedTokens;
+    assert.ok(third > second, 'in-place assistant-block metadata mutation must invalidate the message memo');
+});
+
+test('provider baseline pressure includes only the configured extra reserve', () => {
+    const session = { provider: 'openai', model: 'm', tools: [], contextWindow: 100_000, compaction: {} };
+    const messages = [{ role: 'user', content: 'baseline' }];
+    recordProviderContextBaseline(session, messages, { inputTokens: 80_000, outputTokens: 0 });
+    const policy = { ...policyFor(session), reserveTokens: 7_512, requestReserveTokens: 512, configuredReserveTokens: 7_000 };
+    assert.equal(resolveCompactionPressureTokens(1, policy, { messages, sessionRef: session }), 87_000);
+});
+
+test('provider baselines fingerprint actual sendTools and reject provider, model, tool-schema, and prefix changes', () => {
+    const make = () => ({
+        provider: 'openai',
+        model: 'm1',
+        tools: [{ name: 'read', parameters: { type: 'object' } }],
+        contextWindow: 100_000,
+        compaction: {},
+    });
+    const fallbackForMutation = (mutate) => {
+        const session = make();
+        const messages = [{ role: 'user', content: 'original prefix' }];
+        recordProviderContextBaseline(session, messages, { inputTokens: 80_000, outputTokens: 0 }, { sendTools: session.tools });
+        mutate(session, messages);
+        const policy = { ...resolveWorkerCompactPolicy(session, session.tools), reserveTokens: 0 };
+        return {
+            pressure: resolveCompactionPressureTokens(estimateMessagesTokens(messages), policy, { messages, sessionRef: session }),
+            fallback: estimateMessagesTokens(messages),
+        };
+    };
+    for (const mutate of [
+        session => { session.provider = 'anthropic'; },
+        session => { session.model = 'm2'; },
+        session => { session.tools[0].parameters.properties = { path: { type: 'string' } }; },
+        (_session, messages) => { messages[0].content = 'mutated earlier prefix'; },
+    ]) {
+        const result = fallbackForMutation(mutate);
+        assert.equal(result.pressure, result.fallback);
+    }
+    const session = make();
+    const messages = [{ role: 'user', content: 'forced tool request' }];
+    const actualSendTools = [session.tools[0]];
+    const matchingPolicy = resolveWorkerCompactPolicy(session, actualSendTools);
+    recordProviderContextBaseline(session, messages, { inputTokens: 80_000 }, { sendTools: actualSendTools });
+    session.tools = [{ name: 'different-session-tool', parameters: { type: 'object' } }];
+    assert.equal(
+        resolveCompactionPressureTokens(1, matchingPolicy, { messages, sessionRef: session }),
+        80_000,
+        'baseline must remain aligned to actual sendTools rather than mutable sessionRef.tools',
+    );
+    const changedSendPolicy = resolveWorkerCompactPolicy(session, session.tools);
+    assert.notEqual(
+        resolveCompactionPressureTokens(1, changedSendPolicy, { messages, sessionRef: session }),
+        80_000,
+        'a different next-send schema must invalidate the baseline',
+    );
+});
+
+test('context status cache notices mutation of an earlier message', () => {
+    const session = {
+        id: 'status-mutation',
+        contextWindow: 100_000,
+        messages: [{ role: 'user', content: 'short' }, { role: 'assistant', content: 'tail' }],
+        tools: [],
+        compaction: {},
+    };
+    const { contextStatus } = createContextStatus({
+        getSession: () => session,
+        getRoute: () => ({ provider: 'openai', model: 'm' }),
+        getCurrentCwd: () => '',
+        getMode: () => 'default',
+    });
+    const before = contextStatus();
+    session.messages[0].content = 'dense_earlier_message_'.repeat(1_000);
+    const after = contextStatus();
+    assert.notEqual(after, before);
+    assert.ok(after.usedTokens > before.usedTokens);
+});
+
 test('provider callback usage counts assistant output once and estimates only later tool results', () => {
     const session = { provider: 'anthropic', contextWindow: 100_000, compaction: {} };
     const policy = { ...policyFor(session), reserveTokens: 0 };

package/scripts/internal-comms-bench.mjs

@@ -38,7 +38,6 @@ const RULE_FILES = [
   'agents/debugger/AGENT.md',
   'workflows/default/WORKFLOW.md',
   'workflows/solo/WORKFLOW.md',
-  'workflows/bench/WORKFLOW.md',
   'rules/lead/01-general.md',
   'rules/lead/02-channels.md',
   'rules/lead/lead-tool.md',