open-multi-agent-kit 0.80.7 → 0.90.0

package/dist/core/agent-session.js

@@ -14,25 +14,23 @@
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname } from "node:path";
-import { clampThinkingLevel, cleanupSessionResources, getSupportedThinkingLevels, isContextOverflow, modelsAreEqual, resetApiProviders, streamSimple, } from "@earendil-works/omk-ai";
+import { clampThinkingLevel, cleanupSessionResources, getSupportedThinkingLevels, isContextOverflow, modelsAreEqual, resetApiProviders, streamSimple, } from "omk-ai";
 import { theme } from "../modes/interactive/theme/theme.js";
 import { stripFrontmatter } from "../utils/frontmatter.js";
 import { resolvePath } from "../utils/paths.js";
 import { sleep } from "../utils/sleep.js";
 import { formatNoApiKeyFoundMessage, formatNoModelSelectedMessage } from "./auth-guidance.js";
 import { executeBashWithOperations } from "./bash-executor.js";
+import { classifyShellCommand } from "./command-safety.js";
 import { calculateContextTokens, collectEntriesForBranchSummary, compact, estimateContextTokens, estimateProjectedContextTokens, generateBranchSummary, prepareCompaction, shouldCompact, } from "./compaction/index.js";
 import { DEFAULT_THINKING_LEVEL } from "./defaults.js";
 import { exportSessionToHtml } from "./export-html/index.js";
 import { createToolHtmlRenderer } from "./export-html/tool-renderer.js";
-import { buildBlockedBashResult, evaluateCommandGate } from "./extensions/builtin/command-safety-gate.js";
+import { buildBlockedBashResult, evaluateCommandGate, isCommandSafetyAssumeYesEnabled, } from "./extensions/builtin/command-safety-gate.js";
 import { ExtensionRunner, wrapRegisteredTools, } from "./extensions/index.js";
 import { emitSessionShutdownEvent } from "./extensions/runner.js";
-import { applyFreedomEnv, bannerOnce, FREEDOM_CONFIG_DEFAULTS, gate, loadFreedomConfig, } from "./freedom/index.js";
-import { assertLoadoutAccess, decideLoadoutAccess, } from "./loadout-access-policy.js";
+import { assertLoadoutAccess, decideLoadoutAccess } from "./loadout-access-policy.js";
 import { expandPromptTemplate } from "./prompt-templates.js";
-import { createMonotonicReadIdFactory, createReadAnchorRegistry, } from "./read-anchor-registry.js";
-import { createReadContentCache } from "./read-content-cache.js";
 import { detectSandboxBackend } from "./sandbox/backend.js";
 import { CURRENT_SESSION_VERSION, getLatestCompactionEntry } from "./session-manager.js";
 import { createSyntheticSourceInfo } from "./source-info.js";
@@ -139,22 +137,9 @@ export class AgentSession {
     _toolDefinitions = new Map();
     _toolPromptSnippets = new Map();
     _toolPromptGuidelines = new Map();
-    // Per-session read/edit anchor coordination. The built-in read and edit tools
-    // share this registry, readId factory, and content cache so anchored
-    // stale-edit protection and content caching work across tool calls within one
-    // session. Reused across reload() so anchors survive an extension reload.
-    _readAnchorRegistry = createReadAnchorRegistry();
-    _readIdFactory = createMonotonicReadIdFactory();
-    _readContentCache = createReadContentCache();
     // Base system prompt (without extension appends) - used to apply fresh appends each turn
     _baseSystemPrompt = "";
     _baseSystemPromptOptions;
-    // Freedom mode (AGENTS.md §0) — loaded once from .omk/config.toml at the
-    // project cwd. The safety floor inside FreedomConfig is always enforced;
-    // approval_policy controls whether ordinary tool calls auto-allow under
-    // yolo mode or fall back to the historical confirm flow.
-    _freedomConfig = FREEDOM_CONFIG_DEFAULTS;
-    _freedomBannerMemo = {};
     constructor(config) {
         this.agent = config.agent;
         this.sessionManager = config.sessionManager;
@@ -172,18 +157,6 @@ export class AgentSession {
         this._loadoutAccessPolicy = config.loadoutAccessPolicy;
         this._configuredBashSandboxPreflight = config.bashSandboxPreflight;
         this._sessionStartEvent = config.sessionStartEvent ?? { type: "session_start", reason: "startup" };
-        // Load freedom config from the project cwd. Returns FREEDOM_CONFIG_DEFAULTS
-        // when .omk/config.toml is absent, so projects without an opt-in see no
-        // behavioral change.
-        try {
-            this._freedomConfig = loadFreedomConfig(this._cwd);
-        }
-        catch (error) {
-            // Surface config errors loudly. The session still starts with defaults
-            // so a single typo cannot brick interactive mode.
-            console.error(`OMK freedom config error: ${error instanceof Error ? error.message : String(error)}. Falling back to defaults.`);
-            this._freedomConfig = FREEDOM_CONFIG_DEFAULTS;
-        }
         // Always subscribe to agent events for internal handling
         // (session persistence, extensions, auto-compaction, retry logic)
         this._unsubscribeAgent = this.agent.subscribe(this._handleAgentEvent);
@@ -197,31 +170,6 @@ export class AgentSession {
     get modelRegistry() {
         return this._modelRegistry;
     }
-    /**
-     * Current freedom-mode configuration loaded from `.omk/config.toml`.
-     * Returns defaults when the file is absent or invalid. The TUI consumes
-     * this through `badgeText()` to render the footer badge; the session
-     * itself consumes it via the safety-floor gate before each tool call.
-     */
-    get freedomConfig() {
-        return this._freedomConfig;
-    }
-    /**
-     * One-shot banner per interactive session. Returns the banner text the
-     * first time it is called when freedom mode is enabled; returns undefined
-     * afterward. The memo lives on the session so re-renders never repeat it.
-     */
-    consumeFreedomBanner() {
-        return bannerOnce(this._freedomConfig, this._freedomBannerMemo);
-    }
-    /**
-     * Apply freedom-mode env exports to a spawn env. Used by bash spawners
-     * that want subprocesses to see OMK_FREEDOM_MODE without reaching into
-     * the freedom module directly.
-     */
-    decorateFreedomEnv(env) {
-        return applyFreedomEnv(env, this._freedomConfig);
-    }
     _getBashSandboxPreflight(override) {
         const preflight = override ?? this._configuredBashSandboxPreflight;
         if (!preflight || preflight.policy.mode === "off" || preflight.backend) {
@@ -572,7 +520,7 @@ export class AgentSession {
         catch {
             // Dispose must succeed even if an abort hook throws.
         }
-        this._extensionRunner.invalidate("This extension ctx is stale after session replacement or reload. Do not use a captured omk or command ctx after ctx.newSession(), ctx.fork(), ctx.switchSession(), or ctx.reload(). For newSession, fork, and switchSession, move post-replacement work into withSession and use the ctx passed to withSession. For reload, do not use the old ctx after await ctx.reload().");
+        this._extensionRunner.invalidate("This extension ctx is stale after session replacement or reload. Do not use a captured extension API or command ctx after ctx.newSession(), ctx.fork(), ctx.switchSession(), or ctx.reload(). For newSession, fork, and switchSession, move post-replacement work into withSession and use the ctx passed to withSession. For reload, do not use the old ctx after await ctx.reload().");
         this._disconnectFromAgent();
         this._eventListeners = [];
         cleanupSessionResources(this.sessionId);
@@ -720,6 +668,107 @@ export class AgentSession {
         }
         return Array.from(unique);
     }
+    /**
+     * Extract the most recent user query text from conversation messages.
+     * Returns undefined when no user message exists or content is empty.
+     * Handles both string content and multimodal (array) content.
+     */
+    _extractCurrentQuery() {
+        const messages = this.messages;
+        if (messages.length === 0) {
+            return undefined;
+        }
+        // Scan recent messages (last 3) for the most recent user message
+        const recent = messages.slice(-3);
+        for (let i = recent.length - 1; i >= 0; i--) {
+            const msg = recent[i];
+            if (!("role" in msg) || msg.role !== "user") {
+                continue;
+            }
+            const content = msg.content;
+            if (typeof content === "string") {
+                const trimmed = content.trim();
+                return trimmed.length > 0 ? trimmed : undefined;
+            }
+            if (Array.isArray(content)) {
+                const textParts = content
+                    .filter((c) => "type" in c && c.type === "text")
+                    .map((c) => c.text);
+                const joined = textParts.join("\n").trim();
+                return joined.length > 0 ? joined : undefined;
+            }
+        }
+        return undefined;
+    }
+    _getContextBudgetOptions() {
+        if (process.env.OMK_CONTEXT_GOVERNOR !== "1") {
+            return undefined;
+        }
+        const contextWindow = this.model?.contextWindow ?? 0;
+        // --- maxPromptTokens ---
+        // Priority 1: explicit env override (user knows best)
+        const envMaxPrompt = parsePositiveIntegerEnv("OMK_CONTEXT_GOVERNOR_MAX_PROMPT_TOKENS");
+        let maxPromptTokens;
+        let responseReserveTokens;
+        if (envMaxPrompt !== undefined) {
+            // User override — use as-is for prompt, derive response reserve normally
+            maxPromptTokens = envMaxPrompt;
+            responseReserveTokens =
+                parsePositiveIntegerEnv("OMK_CONTEXT_GOVERNOR_RESPONSE_RESERVE_TOKENS") ??
+                    this._computeResponseReserve(contextWindow);
+        }
+        else if (contextWindow > 0) {
+            // Dynamic: derive from model contextWindow
+            const envPromptRatio = parsePositiveFloatEnv("OMK_CONTEXT_GOVERNOR_PROMPT_RATIO");
+            const envResponseRatio = parsePositiveFloatEnv("OMK_CONTEXT_GOVERNOR_RESPONSE_RATIO");
+            responseReserveTokens =
+                parsePositiveIntegerEnv("OMK_CONTEXT_GOVERNOR_RESPONSE_RESERVE_TOKENS") ??
+                    this._computeResponseReserve(contextWindow, envResponseRatio);
+            const safetyMargin = Math.floor(contextWindow * SAFETY_MARGIN_RATIO);
+            if (envPromptRatio !== undefined && envPromptRatio > 0 && envPromptRatio < 1) {
+                maxPromptTokens = Math.floor(contextWindow * envPromptRatio);
+            }
+            else {
+                // Default: contextWindow minus reserves and safety margin
+                maxPromptTokens = contextWindow - responseReserveTokens - safetyMargin;
+            }
+        }
+        else {
+            // No model info — legacy fallback
+            maxPromptTokens = LEGACY_MAX_PROMPT_TOKENS;
+            responseReserveTokens =
+                parsePositiveIntegerEnv("OMK_CONTEXT_GOVERNOR_RESPONSE_RESERVE_TOKENS") ?? LEGACY_RESPONSE_RESERVE_TOKENS;
+        }
+        // Enforce floor
+        if (maxPromptTokens < MIN_PROMPT_TOKENS) {
+            maxPromptTokens = MIN_PROMPT_TOKENS;
+        }
+        // Ensure responseReserve does not exceed maxPromptTokens
+        if (responseReserveTokens >= maxPromptTokens) {
+            responseReserveTokens = Math.max(Math.floor(maxPromptTokens / 4), LEGACY_RESPONSE_RESERVE_TOKENS);
+        }
+        return {
+            maxPromptTokens,
+            responseReserveTokens,
+            modelId: this.model?.id ?? "unknown",
+            tokenizerMode: parseTokenizerModeEnv(process.env.OMK_CONTEXT_GOVERNOR_TOKENIZER),
+            activeSkillNames: parseCommaSeparatedEnv(process.env.OMK_CONTEXT_GOVERNOR_ACTIVE_SKILLS),
+            queryContext: this._extractCurrentQuery(),
+        };
+    }
+    /**
+     * Compute responseReserveTokens from contextWindow.
+     * Prefers the model's own maxTokens when available, otherwise uses a ratio.
+     */
+    _computeResponseReserve(contextWindow, overrideRatio) {
+        // Prefer model's maxTokens (actual output limit) if available and reasonable
+        const modelMaxTokens = this.model?.maxTokens;
+        if (modelMaxTokens !== undefined && modelMaxTokens > 0 && modelMaxTokens < contextWindow) {
+            return modelMaxTokens;
+        }
+        const ratio = overrideRatio ?? RESPONSE_RESERVE_RATIO;
+        return Math.max(Math.floor(contextWindow * ratio), LEGACY_RESPONSE_RESERVE_TOKENS);
+    }
     _rebuildSystemPrompt(toolNames) {
         const validToolNames = toolNames.filter((name) => this._toolRegistry.has(name));
         const toolSnippets = {};
@@ -748,6 +797,7 @@ export class AgentSession {
             selectedTools: validToolNames,
             toolSnippets,
             promptGuidelines,
+            contextBudget: this._getContextBudgetOptions(),
         };
         return buildSystemPrompt(this._baseSystemPromptOptions);
     }
@@ -2035,40 +2085,33 @@ export class AgentSession {
         const shellCommandPrefix = this.settingsManager.getShellCommandPrefix();
         const shellPath = this.settingsManager.getShellPath();
         const loadoutAccessPolicy = this._loadoutAccessPolicy;
-        const accessGuard = loadoutAccessPolicy
+        const loadoutAccessGuard = loadoutAccessPolicy
             ? (request) => decideLoadoutAccess(loadoutAccessPolicy, request)
             : undefined;
-        if (loadoutAccessPolicy && this._baseToolsOverride) {
-            throw new Error("loadout cannot use baseToolsOverride because override tools bypass scoped access guards");
-        }
+        const loadoutReadOptions = loadoutAccessGuard
+            ? {
+                canReadPath: (path) => loadoutAccessGuard({ operation: "read", toolName: "read", path }).allowed,
+            }
+            : {};
+        const loadoutWriteOptions = loadoutAccessGuard
+            ? {
+                canWritePath: (path) => loadoutAccessGuard({ operation: "write", toolName: "write", path }).allowed,
+            }
+            : {};
         const baseToolDefinitions = this._baseToolsOverride
             ? Object.fromEntries(Object.entries(this._baseToolsOverride).map(([name, tool]) => [
                 name,
                 createToolDefinitionFromAgentTool(tool),
             ]))
             : createAllToolDefinitions(this._cwd, {
-                read: {
-                    autoResizeImages,
-                    anchorRegistry: this._readAnchorRegistry,
-                    readIdFactory: this._readIdFactory,
-                    contentCache: this._readContentCache,
-                    accessGuard,
-                },
+                read: { autoResizeImages, ...loadoutReadOptions },
                 bash: {
                     commandPrefix: shellCommandPrefix,
                     shellPath,
-                    sandboxPolicy: this._getBashSandboxPreflight(),
-                    accessGuard,
-                },
-                edit: {
-                    anchorRegistry: this._readAnchorRegistry,
-                    contentCache: this._readContentCache,
-                    accessGuard,
+                    ...(loadoutAccessGuard ? { loadoutAccessGuard } : {}),
                 },
-                write: { accessGuard },
-                grep: { accessGuard },
-                find: { accessGuard },
-                ls: { accessGuard },
+                edit: loadoutWriteOptions,
+                write: loadoutWriteOptions,
             });
         this._baseToolDefinitions = new Map(Object.entries(baseToolDefinitions).map(([name, tool]) => [name, tool]));
         const extensionsResult = this._resourceLoader.getExtensions();
@@ -2215,17 +2258,10 @@ export class AgentSession {
      * @param onChunk Optional streaming callback for output
      * @param options.excludeFromContext If true, command output won't be sent to LLM (!! prefix)
      * @param options.operations Custom BashOperations for remote execution
+     * @param options.safetyGate When "headless", pre-classify the command and deny confirm/block-tier verdicts without interactive confirmation
+     * @param options.sandboxPolicy Trusted sandbox preflight for local bash execution (never sourced from RPC payloads)
      */
     async executeBash(command, onChunk, options) {
-        // Freedom-mode safety floor: enforce §0.1 (secrets, privilege, fs
-        // destruction, scope) before spawning any shell. Hard-denied commands
-        // never reach the executor. require-confirm and allow both continue,
-        // because OMK's CLI does not own an interactive confirmation prompt;
-        // the caller decides UX policy from this point on.
-        const freedomDecision = gate({ tool: "bash", args: { command } }, this._freedomConfig);
-        if (freedomDecision.kind === "deny-hard") {
-            throw new Error(`OMK §0.1 safety floor blocked bash: ${freedomDecision.reason}`);
-        }
         // Apply command prefix if configured (e.g., "shopt -s expand_aliases" for alias support)
         const prefix = this.settingsManager.getShellCommandPrefix();
         const shellPath = this.settingsManager.getShellPath();
@@ -2233,6 +2269,15 @@ export class AgentSession {
         if (this._loadoutAccessPolicy) {
             assertLoadoutAccess((request) => decideLoadoutAccess(this._loadoutAccessPolicy, request), { operation: "execute", toolName: "bash", command: resolvedCommand });
         }
+        // Non-negotiable safety floor for headless callers (RPC bash): hard-deny
+        // block-tier commands and credential/secret file access before any shell is
+        // spawned. This mirrors the §0.1 freedom safety floor behavior in omakit.
+        if (options?.safetyGate === "headless") {
+            const floorVerdict = classifyShellCommand(command);
+            if (floorVerdict.risk === "block" || floorVerdict.rule.startsWith("secret.")) {
+                throw new Error(`OMK §0.1 safety floor blocked bash: [${floorVerdict.rule}] ${floorVerdict.reason}`);
+            }
+        }
         // Command-safety parity for non-interactive callers (RPC bash). Interactive
         // `!`/`!!` bash is gated earlier through the user_bash extension event, which
         // keeps its prompt-based approval semantics, so it does not pass safetyGate and
@@ -2241,7 +2286,7 @@ export class AgentSession {
         if (options?.safetyGate === "headless") {
             const decision = await evaluateCommandGate(resolvedCommand, {
                 hasUI: false,
-                headlessConfirmPolicy: "deny",
+                headlessConfirmPolicy: isCommandSafetyAssumeYesEnabled() ? "allow" : "deny",
             });
             if (decision?.deny) {
                 const blocked = buildBlockedBashResult(decision.reason);
@@ -2732,4 +2777,55 @@ export class AgentSession {
         return this._extensionRunner;
     }
 }
+// ---------------------------------------------------------------------------
+// Context budget constants
+// ---------------------------------------------------------------------------
+/** Fraction of contextWindow reserved for model response generation. */
+const RESPONSE_RESERVE_RATIO = 0.2;
+/** Fraction of contextWindow held back as safety margin for token-count imprecision. */
+const SAFETY_MARGIN_RATIO = 0.1;
+// Default prompt budget = contextWindow - responseReserve - safetyMargin.
+// With the defaults above (0.2 + 0.1) this yields ~0.70 of contextWindow, but it
+// stays correct when responseReserve is overridden by model.maxTokens.
+/** Absolute floor for maxPromptTokens — below this the budget is meaningless. */
+const MIN_PROMPT_TOKENS = 4000;
+/** Legacy defaults when no model contextWindow is known. */
+const LEGACY_MAX_PROMPT_TOKENS = 60_000;
+const LEGACY_RESPONSE_RESERVE_TOKENS = 8_192;
+function parsePositiveIntegerEnv(name) {
+    const raw = process.env[name];
+    if (raw === undefined || raw.trim() === "") {
+        return undefined;
+    }
+    const value = Number.parseInt(raw, 10);
+    return Number.isFinite(value) && value > 0 ? value : undefined;
+}
+function parsePositiveFloatEnv(name) {
+    const raw = process.env[name];
+    if (raw === undefined || raw.trim() === "") {
+        return undefined;
+    }
+    const value = Number.parseFloat(raw);
+    return Number.isFinite(value) && value > 0 ? value : undefined;
+}
+function parseTokenizerModeEnv(value) {
+    switch (value) {
+        case "fallback":
+        case "openai-js":
+        case "openai-wasm":
+        case "auto":
+            return value;
+        default:
+            return "fallback";
+    }
+}
+function parseCommaSeparatedEnv(value) {
+    if (value === undefined || value.trim() === "") {
+        return [];
+    }
+    return Array.from(new Set(value
+        .split(",")
+        .map((item) => item.trim())
+        .filter((item) => item.length > 0)));
+}
 //# sourceMappingURL=agent-session.js.map