onepass-proxy 0.3.0

package/dist/server.js

@@ -0,0 +1,340 @@
+import * as http from "node:http";
+import * as https from "node:https";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { evictContextSegments, formatThousands } from "./evict.js";
+import { createProxyLogWriter } from "./log.js";
+import { classifyRebuild, describeRebuild, extractUsage, GAUGE_MIN_ESTIMATED_TOKENS, formatDuration, totalContextTokens, } from "./speed.js";
+// Deliberately low (code averages ~3.2–3.5): over-estimating tokens before the first
+// calibration sample trips eviction early rather than letting a session overshoot the cap.
+export const FALLBACK_CHARS_PER_TOKEN = 3.2;
+const CALIBRATION_MIN_TOKENS = 1000;
+/** How many bodies this process has dumped, so that each name carries the order it was written in. */
+let dumpSequence = 0;
+const USAGE_SCAN_LIMIT_CHARS = 262_144;
+const DROPPED_REQUEST_HEADERS = new Set([
+    "host",
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+const DROPPED_RESPONSE_HEADERS = new Set(["connection", "keep-alive", "transfer-encoding", "te", "trailer", "upgrade"]);
+function filterHeaders(headers, dropped) {
+    const filtered = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined || dropped.has(name.toLowerCase()))
+            continue;
+        filtered[name] = value;
+    }
+    return filtered;
+}
+function readEntireBody(request) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        request.on("data", (chunk) => chunks.push(chunk));
+        request.on("end", () => resolve(Buffer.concat(chunks)));
+        request.on("error", reject);
+    });
+}
+function formatTokensShort(tokens) {
+    return tokens >= 1000 ? `${(tokens / 1000).toFixed(1)}k` : String(tokens);
+}
+/** The line the user watches while a session runs. Same numbers the JSONL log records. */
+function formatLiveLine(entry) {
+    const parts = [`[onepass] ${entry.timestamp.slice(11, 19)} ${entry.method} ${entry.path} ${entry.status}`];
+    if (entry.proxyMs !== undefined)
+        parts.push(`proxy ${formatDuration(entry.proxyMs)}`);
+    if (entry.upstreamFirstByteMs !== undefined)
+        parts.push(`first-byte ${formatDuration(entry.upstreamFirstByteMs)}`);
+    parts.push(`total ${formatDuration(entry.durationMs)}`);
+    if (entry.cacheReadInputTokens !== undefined && entry.cacheCreationInputTokens !== undefined) {
+        parts.push(`cache read ${formatTokensShort(entry.cacheReadInputTokens)} / ` +
+            `new ${formatTokensShort(entry.cacheCreationInputTokens)}`);
+    }
+    if (entry.estimatedTokensBefore !== undefined && entry.estimatedTokensSent !== undefined) {
+        parts.push(`est ${formatTokensShort(entry.estimatedTokensBefore)} -> ${formatTokensShort(entry.estimatedTokensSent)} tok, ` +
+            `${entry.stubbedResultCount ?? 0} stubbed (${entry.newlyEvictedCount ?? 0} new)`);
+        // Over the line with nothing taken is the state worth reading off a live log: either the proxy
+        // found nothing it is allowed to evict, or what it found was too small to be worth a trip.
+        if (entry.overThreshold === true && (entry.newlyEvictedCount ?? 0) === 0) {
+            parts.push(entry.heldBackTokens === undefined
+                ? "over T, nothing eligible"
+                : `over T, batch of ${formatTokensShort(entry.heldBackTokens)} held back`);
+        }
+        if (entry.aboveAlarmLine === true)
+            parts.push("ABOVE ALARM LINE (T + 40k)");
+    }
+    const rebuildNote = entry.rebuild === undefined
+        ? ""
+        : entry.rebuild === "unexpected"
+            ? "  <- REBUILD (unexpected)"
+            : `  <- rebuild (${describeRebuild(entry.rebuild)})`;
+    return parts.join(" | ") + rebuildNote;
+}
+export function createProxyServer(config) {
+    const upstream = new URL(config.upstreamUrl);
+    const upstreamIsHttps = upstream.protocol === "https:";
+    const requestModule = upstreamIsHttps ? https : http;
+    const upstreamPort = upstream.port !== "" ? Number(upstream.port) : upstreamIsHttps ? 443 : 80;
+    const agent = upstreamIsHttps ? new https.Agent({ keepAlive: true }) : new http.Agent({ keepAlive: true });
+    const logWriter = createProxyLogWriter(config.logFilePath);
+    const evictedSegmentIds = new Set();
+    // Live chars-per-token ratio, calibrated from the API's reported usage on each response so
+    // the trip threshold is denominated in real tokens rather than a fixed chars ÷ 4 guess.
+    let charsPerToken = FALLBACK_CHARS_PER_TOKEN;
+    // Speed-gauge bookkeeping. Only /v1/messages requests are classified, but a trip on a
+    // count_tokens request changes the prefix for the /v1/messages request that follows it.
+    let previousMessagesRequestAt = null;
+    let trippedSinceLastMessagesRequest = false;
+    function forward(clientRequest, clientResponse, options) {
+        const { bufferedBody, evictionMeta, receivedAt, readUsage, rebuildContext } = options;
+        const timestamp = new Date(receivedAt).toISOString();
+        const method = clientRequest.method ?? "GET";
+        const path = clientRequest.url ?? "/";
+        const headers = filterHeaders(clientRequest.headers, DROPPED_REQUEST_HEADERS);
+        if (bufferedBody !== null)
+            headers["content-length"] = bufferedBody.byteLength;
+        // The usage scan reads the response as plain text, so ask the upstream not to compress.
+        if (readUsage)
+            delete headers["accept-encoding"];
+        let requestBodyBytes = bufferedBody?.byteLength ?? 0;
+        let forwardedAt = null;
+        let firstByteAt = null;
+        let logged = false;
+        const logRequest = (status, usage) => {
+            if (logged)
+                return;
+            logged = true;
+            const rebuild = usage === null || rebuildContext === null
+                ? null
+                : classifyRebuild({
+                    ...rebuildContext,
+                    cacheCreationInputTokens: usage.cacheCreationInputTokens,
+                    contextTotal: totalContextTokens(usage),
+                });
+            const entry = {
+                kind: "request",
+                timestamp,
+                method,
+                path,
+                status,
+                durationMs: Date.now() - receivedAt,
+                ...(forwardedAt !== null ? { proxyMs: forwardedAt - receivedAt } : {}),
+                ...(forwardedAt !== null && firstByteAt !== null ? { upstreamFirstByteMs: firstByteAt - forwardedAt } : {}),
+                requestBodyBytes,
+                sentBodyBytes: bufferedBody?.byteLength ?? requestBodyBytes,
+                ...(usage ?? {}),
+                ...(rebuild !== null ? { rebuild } : {}),
+                ...(evictionMeta ?? {}),
+            };
+            logWriter.append(entry);
+            if (config.quiet !== true)
+                console.log(formatLiveLine(entry));
+        };
+        const upstreamRequest = requestModule.request({
+            host: upstream.hostname,
+            port: upstreamPort,
+            path,
+            method,
+            headers,
+            agent,
+        });
+        upstreamRequest.setNoDelay(true);
+        upstreamRequest.on("response", (upstreamResponse) => {
+            const status = upstreamResponse.statusCode ?? 502;
+            const scanUsage = readUsage && status === 200;
+            let responseHead = "";
+            upstreamResponse.on("data", (chunk) => {
+                firstByteAt ??= Date.now();
+                if (scanUsage && responseHead.length <= USAGE_SCAN_LIMIT_CHARS)
+                    responseHead += chunk.toString("utf8");
+            });
+            upstreamResponse.on("end", () => {
+                const usage = scanUsage ? extractUsage(responseHead) : null;
+                if (usage !== null && bufferedBody !== null) {
+                    const realInputTokens = totalContextTokens(usage);
+                    if (realInputTokens >= CALIBRATION_MIN_TOKENS) {
+                        charsPerToken = Math.min(8, Math.max(2, bufferedBody.byteLength / realInputTokens));
+                    }
+                }
+                logRequest(status, usage);
+            });
+            // A client that hangs up mid-stream never fires `end`, but `close` always fires.
+            upstreamResponse.on("close", () => logRequest(status, null));
+            clientResponse.writeHead(status, filterHeaders(upstreamResponse.headers, DROPPED_RESPONSE_HEADERS));
+            upstreamResponse.pipe(clientResponse);
+        });
+        upstreamRequest.on("error", (err) => {
+            logWriter.append({ kind: "proxy_error", timestamp: new Date().toISOString(), method, path, message: err.message });
+            if (!clientResponse.headersSent) {
+                clientResponse.writeHead(502, { "content-type": "application/json" });
+                clientResponse.end(JSON.stringify({
+                    type: "error",
+                    error: { type: "api_error", message: `onepass proxy: upstream request failed (${err.message})` },
+                }));
+                logRequest(502, null);
+            }
+            else {
+                clientResponse.destroy();
+            }
+        });
+        clientRequest.on("error", () => upstreamRequest.destroy());
+        clientResponse.on("close", () => {
+            if (!clientResponse.writableEnded)
+                upstreamRequest.destroy();
+        });
+        if (bufferedBody !== null) {
+            forwardedAt = Date.now();
+            upstreamRequest.end(bufferedBody);
+        }
+        else {
+            clientRequest.on("data", (chunk) => {
+                requestBodyBytes += chunk.length;
+            });
+            forwardedAt = Date.now();
+            clientRequest.pipe(upstreamRequest);
+        }
+    }
+    async function handle(clientRequest, clientResponse) {
+        const method = clientRequest.method ?? "GET";
+        const pathname = new URL(clientRequest.url ?? "/", "http://proxy.local").pathname;
+        // count_tokens carries the same messages array and must be evicted identically: the
+        // client's context bookkeeping may consume the count, and an un-evicted count describes
+        // a request that will never be sent.
+        const transformable = method === "POST" &&
+            (pathname === "/v1/messages" || pathname === "/v1/messages/count_tokens") &&
+            clientRequest.headers["content-encoding"] === undefined;
+        if (!transformable) {
+            forward(clientRequest, clientResponse, {
+                bufferedBody: null,
+                evictionMeta: null,
+                receivedAt: Date.now(),
+                readUsage: false,
+                rebuildContext: null,
+            });
+            return;
+        }
+        const rawBody = await readEntireBody(clientRequest);
+        const receivedAt = Date.now();
+        if (config.dumpDir !== undefined) {
+            try {
+                mkdirSync(config.dumpDir, { recursive: true });
+                const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+                const suffix = pathname.replace(/[^a-zA-Z0-9]/g, "_");
+                // The name is the clock and then the count, and the eval replays these in name order. The
+                // clock alone is not enough: a millisecond holds more than one request, and two requests
+                // sharing a name would leave the second erasing the first — a request missing from the
+                // middle of an ordered replay with nothing saying so. So every name carries the sequence
+                // this process wrote it in, zero-padded so it sorts as a number, which makes name order
+                // arrival order exactly rather than nearly. `existsSync` then covers the one case the
+                // counter cannot: a second proxy writing into the same directory, which nothing should do.
+                let name = `${stamp}_${String((dumpSequence += 1)).padStart(6, "0")}${suffix}.json`;
+                while (existsSync(join(config.dumpDir, name))) {
+                    name = `${stamp}_${String((dumpSequence += 1)).padStart(6, "0")}${suffix}.json`;
+                }
+                writeFileSync(join(config.dumpDir, name), rawBody);
+            }
+            catch {
+                // Dumping is best-effort; never fail the request over it.
+            }
+        }
+        let forwardBody = rawBody;
+        let evictionMeta = null;
+        try {
+            const parsedBody = JSON.parse(rawBody.toString("utf8"));
+            const requestCharsPerToken = Math.round(charsPerToken * 100) / 100;
+            const outcome = evictContextSegments(parsedBody, evictedSegmentIds, {
+                evictAfterAssistantTurns: config.evictAfterAssistantTurns,
+                protectLastAssistantTurns: config.protectLastAssistantTurns,
+                minSavedChars: config.minSavedChars,
+                tripThresholdTokens: config.tripThresholdTokens,
+                batchMinTokens: config.batchMinTokens,
+                charsPerToken: requestCharsPerToken,
+            });
+            for (const id of outcome.newlyEvictedIds)
+                evictedSegmentIds.add(id);
+            if (outcome.newlyEvictedIds.length > 0) {
+                logWriter.append({
+                    kind: "trip",
+                    timestamp: new Date().toISOString(),
+                    addedToolUseIds: outcome.newlyEvictedIds,
+                    charsRemoved: outcome.newlyEvictedCharsRemoved,
+                    estimatedTokensBefore: outcome.estimatedTokensBefore,
+                    estimatedTokensSent: outcome.estimatedTokensSent,
+                    ...(outcome.pressure ? { pressure: true } : {}),
+                });
+                if (config.quiet !== true) {
+                    console.log(`[onepass] TRIP${outcome.pressure ? " (pressure)" : ""}: evicted ${outcome.newlyEvictedIds.length} segment(s), ` +
+                        `${formatThousands(outcome.newlyEvictedCharsRemoved)} chars removed ` +
+                        `(est ${formatTokensShort(outcome.estimatedTokensBefore)} -> ${formatTokensShort(outcome.estimatedTokensSent)} tok, ` +
+                        `${evictedSegmentIds.size} evicted total)`);
+                }
+            }
+            if (outcome.bodyChanged)
+                forwardBody = Buffer.from(JSON.stringify(outcome.body), "utf8");
+            evictionMeta = {
+                estimatedTokensBefore: outcome.estimatedTokensBefore,
+                estimatedTokensSent: outcome.estimatedTokensSent,
+                overThreshold: outcome.tripped,
+                stubbedResultCount: outcome.stubbedIds.length,
+                newlyEvictedCount: outcome.newlyEvictedIds.length,
+                newlyEvictedCharsRemoved: outcome.newlyEvictedCharsRemoved,
+                ...(outcome.heldBackTokens !== undefined ? { heldBackTokens: outcome.heldBackTokens } : {}),
+                ...(outcome.aboveAlarmLine ? { aboveAlarmLine: true } : {}),
+                charsPerToken: requestCharsPerToken,
+            };
+        }
+        catch {
+            // Unparseable body: forward the original bytes untouched. Never fail a request.
+        }
+        if (evictionMeta !== null && evictionMeta.newlyEvictedCount > 0)
+            trippedSinceLastMessagesRequest = true;
+        let rebuildContext = null;
+        if (pathname === "/v1/messages" && (evictionMeta?.estimatedTokensSent ?? 0) >= GAUGE_MIN_ESTIMATED_TOKENS) {
+            rebuildContext = {
+                firstMessagesRequest: previousMessagesRequestAt === null,
+                tripped: trippedSinceLastMessagesRequest,
+                secondsSincePrevious: previousMessagesRequestAt === null ? null : (receivedAt - previousMessagesRequestAt) / 1000,
+            };
+            previousMessagesRequestAt = receivedAt;
+            trippedSinceLastMessagesRequest = false;
+        }
+        forward(clientRequest, clientResponse, {
+            bufferedBody: forwardBody,
+            evictionMeta,
+            receivedAt,
+            readUsage: evictionMeta !== null,
+            rebuildContext,
+        });
+    }
+    const server = http.createServer((clientRequest, clientResponse) => {
+        handle(clientRequest, clientResponse).catch((err) => {
+            const message = err instanceof Error ? err.message : String(err);
+            logWriter.append({
+                kind: "proxy_error",
+                timestamp: new Date().toISOString(),
+                method: clientRequest.method ?? "GET",
+                path: clientRequest.url ?? "/",
+                message,
+            });
+            if (!clientResponse.headersSent) {
+                clientResponse.writeHead(502, { "content-type": "application/json" });
+                clientResponse.end(JSON.stringify({ type: "error", error: { type: "api_error", message: `onepass proxy: ${message}` } }));
+            }
+            else {
+                clientResponse.destroy();
+            }
+        });
+    });
+    server.on("connection", (socket) => socket.setNoDelay(true));
+    server.on("close", () => {
+        agent.destroy();
+        logWriter.close();
+    });
+    return server;
+}

package/dist/session.js

@@ -0,0 +1,100 @@
+// Reading what a session left behind: the Claude Code transcript (read-only, always) and the
+// proxy's own JSONL log. Both `onepass-report` and `claudep`'s exit line are built from these,
+// which is why they live here rather than inside the reporter.
+import { createReadStream, readFileSync } from "node:fs";
+import { createInterface } from "node:readline";
+import { measureContentChars } from "./evict.js";
+const RECALL_TOOL_NAME = /(^|__)recall_(search|get)$/;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export async function scanTranscript(path) {
+    const stats = {
+        entryCount: 0,
+        firstTimestamp: null,
+        lastTimestamp: null,
+        compactionCount: 0,
+        recallResultCount: 0,
+        recallChars: 0,
+        realUsagePeak: 0,
+        realUsageSamples: 0,
+        realUsageTurnsAbove150k: 0,
+    };
+    const recallToolUseIds = new Set();
+    const lines = createInterface({ input: createReadStream(path, "utf8"), crlfDelay: Infinity });
+    for await (const line of lines) {
+        if (line.trim() === "")
+            continue;
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (!isRecord(entry))
+            continue;
+        stats.entryCount++;
+        if (typeof entry.timestamp === "string") {
+            stats.firstTimestamp ??= entry.timestamp;
+            stats.lastTimestamp = entry.timestamp;
+        }
+        if (entry.isCompactSummary === true || (entry.compactMetadata !== undefined && entry.compactMetadata !== null)) {
+            stats.compactionCount++;
+        }
+        const message = entry.message;
+        if (!isRecord(message))
+            continue;
+        if (entry.type === "assistant" && isRecord(message.usage)) {
+            const usage = message.usage;
+            const asNumber = (value) => (typeof value === "number" ? value : 0);
+            const realContext = asNumber(usage.input_tokens) +
+                asNumber(usage.cache_creation_input_tokens) +
+                asNumber(usage.cache_read_input_tokens);
+            if (realContext > 0) {
+                stats.realUsageSamples++;
+                if (realContext > stats.realUsagePeak)
+                    stats.realUsagePeak = realContext;
+                if (realContext > 150_000)
+                    stats.realUsageTurnsAbove150k++;
+            }
+        }
+        if (!Array.isArray(message.content))
+            continue;
+        for (const block of message.content) {
+            if (!isRecord(block))
+                continue;
+            if (block.type === "tool_use" && typeof block.id === "string" && typeof block.name === "string") {
+                if (RECALL_TOOL_NAME.test(block.name))
+                    recallToolUseIds.add(block.id);
+            }
+            else if (block.type === "tool_result" &&
+                typeof block.tool_use_id === "string" &&
+                recallToolUseIds.has(block.tool_use_id)) {
+                stats.recallResultCount++;
+                stats.recallChars += measureContentChars(block.content);
+            }
+        }
+    }
+    return stats;
+}
+export function parseProxyLog(path) {
+    const requests = [];
+    const trips = [];
+    for (const line of readFileSync(path, "utf8").split("\n")) {
+        if (line.trim() === "")
+            continue;
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (entry.kind === "request" && entry.path.split("?")[0] === "/v1/messages")
+            requests.push(entry);
+        else if (entry.kind === "trip")
+            trips.push(entry);
+    }
+    return { requests, trips };
+}

package/dist/speed.js

@@ -0,0 +1,77 @@
+// The speed gauge: reads the API's reported usage off a response, and decides whether a
+// request made Anthropic re-read the conversation (a "rebuild") instead of serving it from
+// cache. A rebuild costs seconds on that one turn, so an unexplained one is a bug worth
+// seeing. No I/O — the caller owns the per-session bookkeeping this reads.
+/**
+ * Pull the usage numbers out of an Anthropic response — the first `usage` object in the body
+ * (message_start for SSE, top level for JSON). Brace-matched rather than regexed whole: usage
+ * contains nested objects (`cache_creation`, `server_tool_use`).
+ */
+export function extractUsage(responseText) {
+    const keyIndex = responseText.indexOf('"usage"');
+    if (keyIndex === -1)
+        return null;
+    const openIndex = responseText.indexOf("{", keyIndex);
+    if (openIndex === -1)
+        return null;
+    let depth = 0;
+    let closeIndex = -1;
+    for (let i = openIndex; i < responseText.length; i++) {
+        const ch = responseText[i];
+        if (ch === "{")
+            depth++;
+        else if (ch === "}" && --depth === 0) {
+            closeIndex = i;
+            break;
+        }
+    }
+    if (closeIndex === -1)
+        return null;
+    const usageSlice = responseText.slice(openIndex, closeIndex + 1);
+    // The leading quote matters: without it `"input_tokens"` would also match the tail of
+    // `"cache_creation_input_tokens"` and of the nested `cache_creation` ephemeral counters.
+    const read = (wireName) => {
+        const match = new RegExp(`"${wireName}"\\s*:\\s*(\\d+)`).exec(usageSlice);
+        return match === null ? 0 : Number(match[1]);
+    };
+    const usage = {
+        inputTokens: read("input_tokens"),
+        cacheCreationInputTokens: read("cache_creation_input_tokens"),
+        cacheReadInputTokens: read("cache_read_input_tokens"),
+    };
+    return totalContextTokens(usage) > 0 ? usage : null;
+}
+/** Everything Anthropic read for this request, however it got there. */
+export function totalContextTokens(usage) {
+    return usage.inputTokens + usage.cacheCreationInputTokens + usage.cacheReadInputTokens;
+}
+// Claude Code makes several kinds of /v1/messages call — the conversation itself, plus small
+// side calls (title generation, warm-ups) that carry their own separate cache prefix. Only the
+// conversation is gauged: mixing the side calls in makes the session's real first request look
+// like an unexplained rebuild, and a rebuild this small costs no measurable time anyway.
+export const GAUGE_MIN_ESTIMATED_TOKENS = 20_000;
+// A turn always writes a little fresh cache (the new user message and tool results), so a
+// rebuild is a share of the whole context, not any non-zero creation count.
+const REBUILD_SHARE_OF_CONTEXT = 0.2;
+// Anthropic's ephemeral cache entries expire after 5 minutes of not being read.
+const CACHE_TTL_SECONDS = 300;
+export function classifyRebuild(input) {
+    if (input.contextTotal <= 0)
+        return null;
+    if (input.cacheCreationInputTokens / input.contextTotal <= REBUILD_SHARE_OF_CONTEXT)
+        return null;
+    if (input.firstMessagesRequest)
+        return "first";
+    if (input.tripped)
+        return "after-trip";
+    if (input.secondsSincePrevious !== null && input.secondsSincePrevious > CACHE_TTL_SECONDS)
+        return "after-idle";
+    return "unexpected";
+}
+/** "after-trip" -> "after trip"; used in the stdout line and the report. */
+export function describeRebuild(rebuild) {
+    return rebuild.replace("-", " ");
+}
+export function formatDuration(milliseconds) {
+    return milliseconds >= 1000 ? `${(milliseconds / 1000).toFixed(1)}s` : `${milliseconds}ms`;
+}

package/dist/transcript.js

@@ -0,0 +1,79 @@
+// Which transcript on disk belongs to the session asking for it.
+//
+// Recall reads the session's own history back after the proxy has evicted it, so reading the
+// wrong session's history is worse than reading none: it answers confidently out of a
+// conversation the agent was never in. `claudep` names the session id it started, which is the
+// only identifier that cannot be confused between two sessions in one directory. Without one —
+// a proxy the user started by hand — the newest transcript in this directory is the best guess
+// available, and that is what recall did everywhere before session ids existed.
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/** Where Claude Code keeps its sessions. `CLAUDE_CONFIG_DIR` moves the whole directory. */
+export function claudeConfigDir(env = process.env) {
+    const configured = env.CLAUDE_CONFIG_DIR;
+    return configured !== undefined && configured !== "" ? configured : join(homedir(), ".claude");
+}
+/** Claude Code stores each session under a slug of the cwd with separators replaced by dashes. */
+export function transcriptDir(cwd, env = process.env) {
+    return join(claudeConfigDir(env), "projects", cwd.replace(/[/.]/g, "-"));
+}
+/**
+ * A transcript by session id. Every project directory is searched rather than the one the cwd
+ * slugifies to: the slug rule is Claude Code's and can change, while a session id is unique.
+ */
+export function findTranscript(sessionId, env = process.env) {
+    const projects = join(claudeConfigDir(env), "projects");
+    let directories;
+    try {
+        directories = readdirSync(projects);
+    }
+    catch {
+        return null;
+    }
+    for (const directory of directories) {
+        const path = join(projects, directory, `${sessionId}.jsonl`);
+        if (existsSync(path))
+            return path;
+    }
+    return null;
+}
+/** The most recently written transcript for this directory, whoever wrote it. */
+export function newestTranscript(cwd, env = process.env) {
+    const dir = transcriptDir(cwd, env);
+    let names;
+    try {
+        names = readdirSync(dir).filter((name) => name.endsWith(".jsonl"));
+    }
+    catch {
+        return null;
+    }
+    let newest = null;
+    for (const name of names) {
+        const path = join(dir, name);
+        const { mtimeMs } = statSync(path);
+        if (newest === null || mtimeMs > newest.mtimeMs)
+            newest = { path, mtimeMs };
+    }
+    return newest?.path ?? null;
+}
+/**
+ * The transcript this recall server should read. `ONEPASS_SESSION_ID` is set by `claudep`, one
+ * value per session, so two sessions in one directory never read each other's history.
+ */
+export function transcriptForSession(env, cwd) {
+    const sessionId = env.ONEPASS_SESSION_ID;
+    if (sessionId !== undefined && sessionId !== "") {
+        const path = findTranscript(sessionId, env);
+        return path !== null
+            ? { path, reason: "" }
+            : {
+                path: null,
+                // Normal at the very start: the file appears once the session's first turn is written.
+                reason: `No transcript yet for session ${sessionId} under ${join(claudeConfigDir(env), "projects")} — ` +
+                    `it is written as the session runs.`,
+            };
+    }
+    const path = newestTranscript(cwd, env);
+    return path !== null ? { path, reason: "" } : { path: null, reason: `No transcript found under ${transcriptDir(cwd, env)}` };
+}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "onepass-proxy",
+  "version": "0.3.0",
+  "type": "module",
+  "description": "Local HTTP proxy between Claude Code and the Anthropic API that evicts old tool results from outgoing requests, keeping long sessions clear of auto-compact.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Julian-Win-Stack/OnePass.git",
+    "directory": "proxy"
+  },
+  "keywords": [
+    "claude-code",
+    "claude",
+    "anthropic",
+    "context-window",
+    "proxy",
+    "compaction"
+  ],
+  "bin": {
+    "claudep": "dist/claudep.js",
+    "onepass-proxy": "dist/main.js",
+    "onepass-recall": "dist/recall.js",
+    "onepass-report": "dist/report.js"
+  },
+  "files": [
+    "dist",
+    "!dist/*.test.js"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/main.js",
+    "test": "npm run build && node --test dist/*.test.js",
+    "report": "npm run build && node dist/report.js",
+    "prepublishOnly": "npm test"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.7.0"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "zod": "^4.6.2"
+  }
+}