opencode-acp 1.13.2 → 1.13.6

package/README.md

@@ -309,8 +309,12 @@ Each level overrides the previous, so project settings take priority over global
         // Controls how likely compression is after user messages
         // ("strong" = more likely, "soft" = less likely)
         "nudgeForce": "soft",
-        // Tool names whose completed outputs are appended to the compression
-        "protectedTools": [],
+        // Hard-excluded tool names. The root default is ["skill", "compress"]; an explicit
+        // array replaces the inherited policy. Use [] to compress all tool outputs.
+        // "compress" is always force-protected regardless of this setting — its summary
+        // parameter is the sole record of compressed conversation and cannot be recovered
+        // if lost. Use [] to compress all tool outputs except compress itself.
+        "protectedTools": ["skill", "compress"],
         // Preserve text wrapped in <protect>...</protect> when compressed
         "protectTags": false,
         // Preserve your messages during compression.
@@ -399,7 +403,7 @@ By default, these tools are always protected from pruning:
 
 The `protectedTools` arrays in `commands` and `strategies` add to this default list.
 
-For the `compress` tool, `compress.protectedTools` ensures specific tool outputs are **hard-excluded** from compression ranges (v1.10.0+). When the model compresses a range that includes a protected tool message, that message survives intact in visible context — only the surrounding non-protected messages are compressed. By default `compress.protectedTools` includes only `skill` — this is sufficient in practice, as skill outputs are the one tool type whose content must never be lost to compression.
+For the `compress` tool, `compress.protectedTools` ensures specific tool outputs are **hard-excluded** from compression ranges (v1.10.0+). When the model compresses a range that includes a protected tool message, that message survives intact in visible context — only the surrounding non-protected messages are compressed. The root default is `["skill", "compress"]` (the `compress` entry protects compress tool calls — which carry summaries — from being eaten by subsequent sequential compressions); an explicit array replaces the inherited policy. **`"compress"` is always force-protected regardless of user config** — its `summary` parameter is the sole record of compressed conversation and cannot be recovered if lost. Setting `[]` protects only `compress`; setting `["task"]` protects `task` and `compress`.
 
 ---
 
@@ -471,6 +475,38 @@ For the complete list with root cause analysis, see the [bug tracker](https://gi
 
 ## Changelog
 
+### v1.13.6 — Force-Protect Compress Tool Regardless of User Config (PR #188)
+
+**Problem**: `compress.protectedTools` uses a replace merge policy (PR #177): a user setting `protectedTools: ["skill"]` or `protectedTools: []` silently removed `"compress"` from the protected list. This made compress summaries — the sole record of compressed conversation — vulnerable to being pruned by subsequent sequential compressions, causing irreversible data loss.
+
+**Fix**: Added `FORCE_COMPRESS_PROTECTED = ["compress"]` constant in `lib/config.ts`. In `mergeCompress()`, when a user provides an explicit `protectedTools` array, the constant is spread into the Set to guarantee `"compress"` survives any override. Even `protectedTools: []` now resolves to `["compress"]`. Dual-agent reviewed (Oracle + General, both APPROVE).
+
+Files: `lib/config.ts`, `tests/config-protected-tools.test.ts`, `README.md`, `README.zh-CN.md`. 846 tests pass.
+
+### v1.13.5 — Fix Release CI for Squash Merges (PR #187)
+
+**Problem**: The release detection regex in `.github/workflows/release.yml` only matched standard merge commits (`Merge pull request #N from .../YYYY-MM-DD_release-v...`), not squash merges. PRs #182 (v1.13.3) and #186 (v1.13.4) were squash-merged, so the release workflow silently skipped — no tag, no npm publish, no GitHub Release. npm was stuck at 1.13.2 while master had already moved to 1.13.4.
+
+**Fix**: Added a second pattern to the detection logic: `^release: v[0-9]+\.[0-9]+\.[0-9]+` matches squash merge commit titles that start with the release PR title convention (`release: vVERSION ...`). Both standard and squash merges are now detected. Also bumps version to 1.13.5 to publish all accumulated changes (v1.13.3 quality gate + v1.13.4 compress protection + this CI fix).
+
+Files: `.github/workflows/release.yml`, `package.json`, `README.md`, `README.zh-CN.md`. 843 tests pass (no source code changes).
+
+### v1.13.4 — Protect Compress Tool Calls from Being Compressed (PR #185)
+
+**Problem**: Sequential compressions ate previous summaries. Each compress tool call (which carries the summary in its `summary` parameter) lives a few messages after the range it compressed. When the model issued a new compress whose range started right after the previous one's end, the previous compress call fell inside the new range and was pruned — destroying the accumulated summary chain. Evidence from `ses_07562b88`: 113 messages → 6 messages in one compress call because all previous compress call anchors (b5–b10) were inside the new range.
+
+**Fix**: Added `"compress"` to `COMPRESS_DEFAULT_PROTECTED_TOOLS` in `lib/config.ts`. This makes `filterProtectedToolMessages` hard-exclude compress tool call messages from compression ranges (Bug 39 mechanism). The compress call survives intact in visible context; only surrounding non-protected messages are compressed. Also synced stale `["skill"]` defaults in `dcp.schema.json`, `README.md`, and `README.zh-CN.md` to `["skill", "compress"]`. Users can opt out with `compress.protectedTools: ["skill"]`.
+
+Files: `lib/config.ts`, `dcp.schema.json`, `README.md`, `README.zh-CN.md`. Tests: `tests/protect-compress-calls.test.ts` (6 new tests). 843 pass.
+
+### v1.13.3 — Quality Gate Enforcement + E2E Test Framework + protectedTools Fix (PRs #173, #174, #175, #177, #179)
+
+**Problem**: (1) Compressions with extremely low retention (<1%) or near-zero keyword recall passed silently, causing severe context loss. (2) No end-to-end test infrastructure existed to verify ACP compression through the real opencode→LLM pipeline. (3) `compress.protectedTools` merged with inherited defaults instead of replacing them — an explicit `[]` still protected the inherited set.
+
+**Fix**: (1) PR #173 — New opt-in `qualityGate` config (`enabled: false` by default). Pre-commit evaluation via ROUGE-1 recall + L1 length floor. Rejected compressions return a structured error with recovery guidance (split range or write denser summary). `qualityGateRetryPending` flag tracks rejection state. (2) PR #174 — `scripts/e2e/` framework: fake LLM server (OpenAI-compatible SSE), scripted JSON scenarios, state verifier. 4 baseline scenarios. (3) PR #175 — 18 new proportional baseline adjustment tests. (4) PR #177 — `compress.protectedTools` now replaces inherited defaults; explicit `[]` protects nothing. (5) PR #179 — AGENTS.md §5.1.1.2: absolute prohibition on Agent merging PRs.
+
+Files: `lib/compress/quality-gate/`, `lib/compress/{range,message}.ts`, `lib/config.ts`, `scripts/e2e/`, `tests/proportional-baseline.test.ts`, `tests/quality-gate-enforcement.test.ts`, `AGENTS.md`. Tests: 837 pass.
+
 ### v1.13.2 — Preserve Last User Msg + Config Defaults Tuning (PR #169)
 
 **Problem**: Two issues remained after v1.13.1's notification freeze fix. (1) When the model compressed a range that covered all visible user messages, the next API call had zero user-role messages — zhipuai-lb rejected this with the same HTTP 400 code 1214 (`isRetryable: false`), freezing the session. This was the second path to the same freeze that v1.13.1's empty-notification fix addressed. (2) The default `pruneNotification: "detailed"` fired a toast on every compress call (10–30 per session is typical), which was over-intrusive for a routine background operation. Additionally, `compress.maxSummaryLengthHard: 10000` rejected ~25% of information-dense useful summaries in real sessions.

package/README.zh-CN.md

@@ -278,8 +278,12 @@ ACP 使用自己的配置文件，按以下顺序搜索：
         // Controls how likely compression is after user messages
         // ("strong" = more likely, "soft" = less likely)
         "nudgeForce": "soft",
-        // Tool names whose completed outputs are appended to the compression
-        "protectedTools": [],
+        // Hard-excluded tool names. The root default is ["skill", "compress"]; an explicit
+        // array replaces the inherited policy. Use [] to compress all tool outputs.
+        // "compress" is always force-protected regardless of this setting — its summary
+        // parameter is the sole record of compressed conversation and cannot be recovered
+        // if lost. Use [] to compress all tool outputs except compress itself.
+        "protectedTools": ["skill", "compress"],
         // Preserve text wrapped in <protect>...</protect> when compressed
         "protectTags": false,
         // Preserve your messages during compression.
@@ -367,7 +371,7 @@ ACP 暴露六个可编辑的 prompt：
 
 `commands` 和 `strategies` 中的 `protectedTools` 数组会添加到此默认列表。
 
-对于 `compress` 工具，`compress.protectedTools` 确保特定工具的输出被**硬排除**在压缩范围之外（v1.10.0+）。当模型压缩包含受保护工具消息的范围时，该消息完整保留在可见上下文中 — 只有周围的非受保护消息被压缩。默认仅包含 `skill` —— 实践中这一个就够了，因为 skill 输出是唯一绝不能被压缩丢失的工具类型。
+对于 `compress` 工具，`compress.protectedTools` 确保特定工具的输出被**硬排除**在压缩范围之外（v1.10.0+）。当模型压缩包含受保护工具消息的范围时，该消息完整保留在可见上下文中 — 只有周围的非受保护消息被压缩。根默认值为 `["skill", "compress"]`（`compress` 条目保护携带 summary 的 compress 工具调用，防止被后续顺序压缩吞噬）；显式数组会替换继承的策略。**`"compress"` 无论用户如何配置都会被强制保护** — 其 `summary` 参数是已压缩对话的唯一记录，一旦丢失无法恢复。设置 `[]` 仅保护 `compress`；设置 `["task"]` 保护 `task` 和 `compress`。
 
 ---
 
@@ -439,6 +443,38 @@ ACP 在首次启动时自动将配置从 `dcp.jsonc` 迁移到 `acp.jsonc`，将
 
 ## 更新日志
 
+### v1.13.6 — 强制保护 compress 工具，无视用户配置（PR #188）
+
+**问题**：`compress.protectedTools` 使用替换式合并策略（PR #177）：用户设置 `protectedTools: ["skill"]` 或 `protectedTools: []` 会静默地从保护列表中移除 `"compress"`。这使得 compress 摘要 — 压缩对话的唯一记录 — 容易被后续的顺序压缩裁剪，导致不可恢复的数据丢失。
+
+**修复**：在 `lib/config.ts` 中添加 `FORCE_COMPRESS_PROTECTED = ["compress"]` 常量。在 `mergeCompress()` 中，当用户提供显式 `protectedTools` 数组时，该常量被展开到 Set 中，保证 `"compress"` 在任何覆盖下都保留。即使 `protectedTools: []` 现在也会解析为 `["compress"]`。双 agent 审查通过（Oracle + General，均 APPROVE）。
+
+文件：`lib/config.ts`、`tests/config-protected-tools.test.ts`、`README.md`、`README.zh-CN.md`。846 项测试通过。
+
+### v1.13.5 — 修复 Release CI 对 Squash Merge 的检测（PR #187）
+
+**问题**：`.github/workflows/release.yml` 的发布检测正则只认标准 merge commit（`Merge pull request #N from .../YYYY-MM-DD_release-v...`），不认 squash merge。PR #182（v1.13.3）和 #186（v1.13.4）都是 squash 合并，导致 release workflow 静默跳过 — 没有 tag、没有 npm 发布、没有 GitHub Release。npm 卡在 1.13.2，而 master 已经到了 1.13.4。
+
+**修复**：在检测逻辑中添加第二个模式：`^release: v[0-9]+\.[0-9]+\.[0-9]+` 匹配以 release PR 标题开头的 squash merge commit（`release: vVERSION ...`）。现在标准 merge 和 squash merge 都能被检测到。同时将版本号升到 1.13.5，以发布所有累积的变更（v1.13.3 质量门禁 + v1.13.4 compress 保护 + 本次 CI 修复）。
+
+文件：`.github/workflows/release.yml`、`package.json`、`README.md`、`README.zh-CN.md`。843 测试通过（无源码变更）。
+
+### v1.13.4 — 保护 compress 工具调用不被压缩（PR #185）
+
+**问题**：顺序压缩会吞噬之前的 summary。每个 compress 工具调用（在其 `summary` 参数中携带摘要）位于其压缩范围之后几条消息处。当模型发出新的 compress，其范围紧接前一个范围的结尾开始时，前一个 compress 调用落入新范围内并被裁剪——摧毁累积的摘要链。`ses_07562b88` 的证据：113 条消息在一次 compress 调用中变为 6 条，因为所有之前的 compress 调用锚点（b5–b10）都在新范围内。
+
+**修复**：在 `lib/config.ts` 的 `COMPRESS_DEFAULT_PROTECTED_TOOLS` 中添加 `"compress"`。这使得 `filterProtectedToolMessages` 硬排除 compress 工具调用消息不进入压缩范围（Bug 39 机制）。compress 调用完整保留在可见上下文中；只有周围的非受保护消息被压缩。同时将 `dcp.schema.json`、`README.md` 和 `README.zh-CN.md` 中过时的 `["skill"]` 默认值同步为 `["skill", "compress"]`。用户可通过 `compress.protectedTools: ["skill"]` 退出。
+
+文件：`lib/config.ts`、`dcp.schema.json`、`README.md`、`README.zh-CN.md`。测试：`tests/protect-compress-calls.test.ts`（6 个新测试）。843 pass。
+
+### v1.13.3 — 质量门禁 + E2E 测试框架 + protectedTools 修复（PR #173, #174, #175, #177, #179）
+
+**问题**：（1）极低保留率（<1%）或接近零关键词召回的压缩会静默通过，导致严重的上下文丢失。（2）缺少端到端测试基础设施来验证 ACP 通过真实 opencode→LLM 管道的压缩行为。（3）`compress.protectedTools` 与继承的默认值合并而非替换——显式 `[]` 仍会保护继承的集合。
+
+**修复**：（1）PR #173——新增可选 `qualityGate` 配置（默认 `enabled: false`）。提交前通过 ROUGE-1 召回率 + L1 长度下限评估。被拒绝的压缩返回结构化错误并附带恢复指引（拆分范围或写更密的摘要）。`qualityGateRetryPending` 标志跟踪拒绝状态。（2）PR #174——`scripts/e2e/` 框架：fake LLM 服务器（OpenAI 兼容 SSE）、脚本化 JSON 场景、状态验证器。4 个基线场景。（3）PR #175——18 个新的比例基线调整测试。（4）PR #177——`compress.protectedTools` 现在替换继承的默认值；显式 `[]` 不保护任何工具。（5）PR #179——AGENTS.md §5.1.1.2：绝对禁止 Agent 合并 PR。
+
+文件：`lib/compress/quality-gate/`、`lib/compress/{range,message}.ts`、`lib/config.ts`、`scripts/e2e/`、`tests/proportional-baseline.test.ts`、`tests/quality-gate-enforcement.test.ts`、`AGENTS.md`。测试：837 pass。
+
 ### v1.13.2 — 保留最近用户消息 + 配置默认值调优（PR #169）
 
 **问题**：v1.13.1 的通知冻结修复之后还剩两个问题。（1）当模型压缩的范围覆盖了所有可见的 user 消息时，下一次 API 调用中 user 角色消息数量为零——zhipuai-lb 以同样的 HTTP 400 code 1214（`isRetryable: false`）拒绝，会话冻结。这是 v1.13.1 修复的空通知路径之外，通往同一冻结 bug 的第二条路径。（2）默认 `pruneNotification: "detailed"` 每次压缩都弹 toast（典型会话 10–30 次），对例行后台操作来说过于打扰。另外 `compress.maxSummaryLengthHard: 10000` 在真实会话中拒绝了约 25% 信息密度高的有用摘要。

package/dist/index.js

@@ -1516,7 +1516,8 @@ var DEFAULT_PROTECTED_TOOLS = [
   "write",
   "edit"
 ];
-var COMPRESS_DEFAULT_PROTECTED_TOOLS = ["skill"];
+var COMPRESS_DEFAULT_PROTECTED_TOOLS = ["skill", "compress"];
+var FORCE_COMPRESS_PROTECTED = ["compress"];
 function showConfigWarnings(ctx, configPath, configData, isProject) {
   const invalidKeys = getInvalidConfigKeys(configData);
   const typeErrors = validateConfigTypes(configData);
@@ -1632,7 +1633,7 @@ var defaultConfig = {
     algorithms: {
       "rouge-recall-v1": {
         layer1MinChars: 200,
-        layer1MinRetentionPct: 1,
+        layer1MinRetentionPct: 5,
         layer2MaxRougeF1: 0.05,
         layer2MaxTop20Recall: 0.2
       }
@@ -1765,7 +1766,7 @@ function mergeCompress(base, override) {
     toolOutputNudgeThreshold: override.toolOutputNudgeThreshold,
     iterationNudgeThreshold: override.iterationNudgeThreshold ?? base.iterationNudgeThreshold,
     nudgeForce: override.nudgeForce ?? base.nudgeForce,
-    protectedTools: [.../* @__PURE__ */ new Set([...base.protectedTools, ...override.protectedTools ?? []])],
+    protectedTools: Array.isArray(override.protectedTools) ? [.../* @__PURE__ */ new Set([...override.protectedTools, ...FORCE_COMPRESS_PROTECTED])] : base.protectedTools,
     protectTags: override.protectTags ?? base.protectTags,
     protectUserMessages: override.protectUserMessages ?? base.protectUserMessages,
     maxSummaryLengthHard: override.maxSummaryLengthHard ?? base.maxSummaryLengthHard,
@@ -4445,7 +4446,8 @@ function createSessionState() {
     lastCompaction: 0,
     currentTurn: 0,
     modelContextLimit: void 0,
-    systemPromptTokens: void 0
+    systemPromptTokens: void 0,
+    qualityGateRetryPending: false
   };
 }
 function resetSessionState(state) {
@@ -4485,6 +4487,7 @@ function resetSessionState(state) {
   state.currentTurn = 0;
   state.modelContextLimit = void 0;
   state.systemPromptTokens = void 0;
+  state.qualityGateRetryPending = false;
 }
 async function ensureSessionInitialized(client, state, sessionId, logger, messages, manualModeEnabled, config) {
   if (state.sessionId === sessionId) {
@@ -5974,6 +5977,164 @@ function evaluateBatchQuality(state, rawMessages, entries, config, logger) {
     failures
   };
 }
+function evaluatePreCommitQuality(rawMessages, messageIds, messageTokenById, summary, config, logger) {
+  const qg = config.qualityGate;
+  if (!qg || qg.enabled !== true) return null;
+  ensureBuiltinGatesRegistered();
+  const algoName = qg.algorithm;
+  if (!algoName) {
+    logger.warn("Quality gate enabled but no algorithm specified", {});
+    return null;
+  }
+  const gate = getQualityGate(algoName);
+  if (!gate) {
+    logger.warn("Quality gate algorithm not found in registry", { algorithm: algoName });
+    return null;
+  }
+  if (messageIds.length === 0) return null;
+  const idToMsg = /* @__PURE__ */ new Map();
+  for (const m of rawMessages) {
+    const id = m?.info?.id;
+    if (typeof id === "string") idToMsg.set(id, m);
+  }
+  const chunks = [];
+  let compressedTokens = 0;
+  for (const id of messageIds) {
+    const m = idToMsg.get(id);
+    if (m) chunks.push(extractMessageText(m.parts));
+    compressedTokens += messageTokenById.get(id) || 0;
+  }
+  if (chunks.length === 0) return null;
+  const originalText = chunks.join("\n");
+  const pseudoBlock = {
+    blockId: -1,
+    summary,
+    compressedTokens,
+    directMessageIds: messageIds,
+    effectiveMessageIds: messageIds
+  };
+  const ctx = {
+    block: pseudoBlock,
+    summary,
+    originalChunks: chunks,
+    originalText,
+    originalTokens: Math.ceil(originalText.length / CHARS_PER_TOKEN_ESTIMATE)
+  };
+  const algoConfig = (qg.algorithms && qg.algorithms[algoName]) ?? {};
+  try {
+    return gate.evaluate(ctx, algoConfig);
+  } catch (err) {
+    logger.warn("Pre-commit quality gate threw \u2014 treating as pass", {
+      gate: gate.name,
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return { passed: true, metrics: [] };
+  }
+}
+
+// node_modules/context-compress-algorithms/dist/chunk-ZRHPFN6B.js
+var COMPRESS_PHILOSOPHY = `Compression Philosophy:
+- All compression serves the primary task, but be frugal.
+- Context capacity is precious. Save context by compressing consumed outputs, not by avoiding tools.
+- Compress by need, not by percentage.
+- Work from summaries, not raw tool outputs. All listed ranges (user prompts, tool outputs, code, logs, exploration, intermediate steps) should be compressed to summary format \u2014 the ONLY exceptions are protected content, content the current step is actively using, or critical content you cannot reconstruct.
+- Curate summaries like a well-structured document. User prompts, compressed tool outputs, code, logs, or skill-call intermediate results that are critically important should be preserved \u2014 not by exempting them from compression, but by embedding them in the summary via [[KEEP:mNNNNN]] (auto-expanded verbatim) and [[REF:mNNNNN|description]] (compact link).`;
+var HOW_TO_COMPRESS_RULES = `HOW TO COMPRESS
+
+When you call \`compress\`, the summary you write becomes the only record of the replaced conversation. Make it self-contained and complete: every user request, experiment purpose, and work task in the range must be accurately captured. A later reader (or you, after decompressing) should be able to continue the task WITHOUT needing the original.
+
+KEEP VERBATIM \u2014 never paraphrase or abbreviate these:
+- Full file paths with line numbers, directory prefix on every mention (\`lib/hooks.ts:347\`, \`src/index.ts:12-18\`, \`gatenet_v3/model.py:45\`). Never abbreviate to a bare filename (\`hooks.ts\`, \`model.py\`) \u2014 they are ambiguous and cannot be grepped or decompressed-to later.
+- Function, class, and type signatures (exact names, params, return types) AND critical code lines that encode logic \u2014 the line that IS the finding, not just the function name (e.g. \`kv_keys += define_gate * a_key[i](emb)\` is more useful than "see model_kvnet.py").
+- Error messages and stack traces (exact text \u2014 you need the literal string to grep for it later).
+- Key details from reports and analyses \u2014 not just the conclusion. Keep the comparison numbers and the mechanism, not "X is worse" alone (write "1.76\xD7 PPL gap because KV store is static", not "KVNet underperforms").
+- Decisions and their rationale ("chose X over Y because Z" \u2014 the "because" is load-bearing; without it the decision looks arbitrary).
+- Constraints discovered ("must support Node 22", "no new dependencies", "AGENTS.md forbids \`as any\`").
+- Exact values: versions, config keys, thresholds, magic numbers.
+- User intent \u2014 quote short user messages verbatim. When the message is too long to quote, preserve intent with extra care: do not change scope, constraints, priorities, acceptance criteria, or requested outcomes. Mark them clearly as past quotes (e.g., "User said: ..."), not as current directives. Losing these changes the task itself.
+- The user's overall goal and any changes to it \u2014 the big-picture objective plus how it evolved during the compressed range. Each summary must reflect the goal as it stood at the end of the range, including pivots (e.g., "initially: fix bug X \u2192 pivoted to: refactor module Y after discovering root cause"). Losing the goal or its evolution makes all subsequent work appear unmotivated.
+- Purpose behind each significant action \u2014 preserve not just what was done but why: the hypothesis behind each experiment, the question behind each exploration, the task goal behind each work action. Without purpose, the summary reads as disconnected technical steps with no through-line.
+- Open questions and unresolved TODOs \u2014 losing these changes what work appears to remain.
+- Message refs of key anchors (\`m00420\`, \`m00510\u2013m00520\`) \u2014 they let you or a later reader jump back via decompress to the exact original.
+
+DROP \u2014 extract the signal, discard the vessel:
+- Verbose logs (build/test/\`npm\` output) once you have captured the error line or the result.
+- Duplicate file reads once the needed content is recorded.
+- Consumed exploration \u2014 search hits, agent return values, successful tool outputs \u2014 once you have extracted the facts you need (same rule as dead-ends, but nothing went wrong; the content is simply spent).
+- Dead-end exploration \u2014 but PRESERVE the lesson in one line: "tried X, failed because Y".
+- Back-and-forth discussion and self-corrections once the final position is captured (keep the outcome, drop the journey to it).
+- Repeated status checks (\`git status\`, \`ls\`) once state is known.
+
+For each significant item you DROP (scripts, reports, large analyses, long tool outputs), add a one-line CONTENT description of what it covers \u2014 not where it lives. Bad: "probe script at /path/probe_kvnet.py". Good: "probe_kvnet.py: tests n-gram baseline, generation quality, long-range dependency, position sensitivity, op pipeline, QUERY attention." This lets a later decompress target the right block by relevance, not by guessing locations.
+
+KEEP MARKERS: \`[[KEEP:mNNNNN]]\` expands original message content into the summary (truncated to a max length). Do NOT use KEEP for verbose command output, diagnostic scripts, log dumps, or any content whose value is in the conclusion rather than the raw output \u2014 summarize these or use \`[[REF:mNNNNN|desc]]\` instead.
+
+PRIORITY \u2014 when the summary must be compact, preserve in this order:
+1. User's overall goal, goal evolution, intent, and hard constraints (losing these changes the task).
+2. Decisions and rationale.
+3. Exact technical artifacts: paths, signatures, errors, values.
+4. Conclusions and key findings.
+5. Lessons learned: what failed and why.
+
+Write dense, scannable bullets \u2014 not narrative prose. If the range spans distinct concerns (request \u2192 findings \u2192 decision), group bullets under short thematic headers so a reader can scan to the part they need. Every line must earn its place. Do not mimic the style of existing summaries in context; follow these rules.`;
+
+// lib/compress/quality-gate/rejection.ts
+function formatMetric(result, name) {
+  const m = result.metrics.find((x) => x.name === name);
+  if (!m) return "?";
+  switch (m.format) {
+    case "percent":
+      return `${m.value.toFixed(2)}%`;
+    case "ratio":
+      return m.value.toFixed(4);
+    default:
+      return String(m.value);
+  }
+}
+function computeStats(plan) {
+  let originalTokens = 0;
+  for (const id of plan.messageIds) {
+    originalTokens += plan.messageTokenById.get(id) || 0;
+  }
+  const summaryChars = plan.summary.length;
+  const ratio = originalTokens > 0 ? (originalTokens / Math.max(summaryChars / 4, 1)).toFixed(1) : "?";
+  const retentionPct = originalTokens > 0 ? (summaryChars / (originalTokens * 4) * 100).toFixed(2) : "?";
+  return { originalTokens, summaryChars, ratio, retentionPct };
+}
+function buildQualityRejectionError(plan, result) {
+  const stats = computeStats(plan);
+  const metrics = [
+    `Original: ~${stats.originalTokens} tokens`,
+    `Summary: ${stats.summaryChars} chars`,
+    `Ratio: ${stats.ratio}:1`,
+    `Retention: ${stats.retentionPct}%`,
+    `Gate layer: ${result.layer ?? "unknown"}`,
+    `rougeF1: ${formatMetric(result, "rougeF1")}`,
+    `top20Recall: ${formatMetric(result, "top20Recall")}`
+  ];
+  const message = `\u26A0\uFE0F COMPRESSION REJECTED \u2014 QUALITY GATE FAILURE
+
+Range: ${plan.startId}\u2013${plan.endId}
+${metrics.join("\n")}
+
+\u26A0\uFE0F CRITICAL: Compression is the ONLY mechanism for preserving historical context in this session.
+Once a compression is accepted, the original messages are permanently removed from visible context.
+Your summary becomes the SOLE record. If it fails, subsequent work is built on a broken foundation \u2014
+memory loss \u2192 wrong assumptions \u2192 entire reasoning chain collapse.
+Treat every compression with maximum care.
+
+${HOW_TO_COMPRESS_RULES}
+
+To retry: rewrite a more complete summary that preserves critical details (file paths, decisions,
+exact values, errors). Then add "acknowledgeRisk": true to the compress tool call parameters.
+Without acknowledgeRisk: true, the compression will be rejected again.`;
+  return new Error(message);
+}
+function buildPreemptiveAcknowledgeError() {
+  return new Error(
+    'Parameter "acknowledgeRisk": true was provided, but no quality gate rejection is pending. This parameter is only valid immediately after a compression was rejected by the quality gate. Remove it and try again.'
+  );
+}
 
 // lib/compress/pipeline.ts
 function snapshotCompressionState(state) {
@@ -6242,7 +6403,8 @@ function buildSchema(maxSummaryLengthHard) {
     ),
     dangerous: tool2.schema.boolean().optional().describe(
       "Set to true ONLY when you are certain the most recent message(s) must be compressed. Required when a range includes the tail of the conversation."
-    )
+    ),
+    acknowledgeRisk: tool2.schema.boolean().optional()
   };
 }
 function createCompressMessageTool(ctx) {
@@ -6341,6 +6503,39 @@ function createCompressMessageTool(ctx) {
         }))
       );
       if (phantomError) throw phantomError;
+      const acknowledgeRisk = args.acknowledgeRisk === true;
+      const qualityGateRetryPendingBefore = ctx.state.qualityGateRetryPending;
+      if (acknowledgeRisk && !ctx.state.qualityGateRetryPending) {
+        throw buildPreemptiveAcknowledgeError();
+      }
+      if (acknowledgeRisk) {
+        ctx.state.qualityGateRetryPending = false;
+      } else {
+        ctx.state.qualityGateRetryPending = false;
+        for (const { plan, summaryWithTools } of preparedPlans) {
+          const result = evaluatePreCommitQuality(
+            rawMessages,
+            plan.selection.messageIds,
+            plan.selection.messageTokenById,
+            summaryWithTools,
+            ctx.config,
+            ctx.logger
+          );
+          if (result && !result.passed) {
+            ctx.state.qualityGateRetryPending = true;
+            throw buildQualityRejectionError(
+              {
+                startId: plan.entry.messageId,
+                endId: plan.entry.messageId,
+                summary: summaryWithTools,
+                messageIds: plan.selection.messageIds,
+                messageTokenById: plan.selection.messageTokenById
+              },
+              result
+            );
+          }
+        }
+      }
       const snapshot = snapshotCompressionState(ctx.state);
       const runId = allocateRunId(ctx.state);
       try {
@@ -6385,6 +6580,7 @@ function createCompressMessageTool(ctx) {
         await finalizeSession(ctx, toolCtx, rawMessages, notifications, input.topic);
       } catch (error) {
         restoreCompressionState(ctx.state, snapshot);
+        ctx.state.qualityGateRetryPending = qualityGateRetryPendingBefore;
         throw error;
       }
       return formatResult(plans.length, skippedIssues, skippedCount);
@@ -6420,7 +6616,8 @@ function buildSchema2(maxSummaryLengthHard) {
     ),
     dangerous: tool3.schema.boolean().optional().describe(
       "Set to true ONLY when you are certain the most recent message(s) must be compressed. Required when a range includes the tail of the conversation."
-    )
+    ),
+    acknowledgeRisk: tool3.schema.boolean().optional()
   };
 }
 function createCompressRangeTool(ctx) {
@@ -6572,6 +6769,39 @@ function createCompressRangeTool(ctx) {
         }))
       );
       if (phantomError) throw phantomError;
+      const acknowledgeRisk = args.acknowledgeRisk === true;
+      const qualityGateRetryPendingBefore = ctx.state.qualityGateRetryPending;
+      if (acknowledgeRisk && !ctx.state.qualityGateRetryPending) {
+        throw buildPreemptiveAcknowledgeError();
+      }
+      if (acknowledgeRisk) {
+        ctx.state.qualityGateRetryPending = false;
+      } else {
+        ctx.state.qualityGateRetryPending = false;
+        for (const plan of preparedPlans) {
+          const result = evaluatePreCommitQuality(
+            rawMessages,
+            plan.selection.messageIds,
+            plan.selection.messageTokenById,
+            plan.finalSummary,
+            ctx.config,
+            ctx.logger
+          );
+          if (result && !result.passed) {
+            ctx.state.qualityGateRetryPending = true;
+            throw buildQualityRejectionError(
+              {
+                startId: plan.entry.startId,
+                endId: plan.entry.endId,
+                summary: plan.finalSummary,
+                messageIds: plan.selection.messageIds,
+                messageTokenById: plan.selection.messageTokenById
+              },
+              result
+            );
+          }
+        }
+      }
       const snapshot = snapshotCompressionState(ctx.state);
       const runId = allocateRunId(ctx.state);
       try {
@@ -6623,6 +6853,7 @@ function createCompressRangeTool(ctx) {
         );
       } catch (error) {
         restoreCompressionState(ctx.state, snapshot);
+        ctx.state.qualityGateRetryPending = qualityGateRetryPendingBefore;
         throw error;
       }
       return `Compressed ${totalCompressedMessages} messages into ${COMPRESSED_BLOCK_HEADER}.
@@ -7963,52 +8194,6 @@ ${lines2.join("\n")}`;
 ${lines.join("\n")}`;
 }
 
-// node_modules/context-compress-algorithms/dist/chunk-ZRHPFN6B.js
-var COMPRESS_PHILOSOPHY = `Compression Philosophy:
-- All compression serves the primary task, but be frugal.
-- Context capacity is precious. Save context by compressing consumed outputs, not by avoiding tools.
-- Compress by need, not by percentage.
-- Work from summaries, not raw tool outputs. All listed ranges (user prompts, tool outputs, code, logs, exploration, intermediate steps) should be compressed to summary format \u2014 the ONLY exceptions are protected content, content the current step is actively using, or critical content you cannot reconstruct.
-- Curate summaries like a well-structured document. User prompts, compressed tool outputs, code, logs, or skill-call intermediate results that are critically important should be preserved \u2014 not by exempting them from compression, but by embedding them in the summary via [[KEEP:mNNNNN]] (auto-expanded verbatim) and [[REF:mNNNNN|description]] (compact link).`;
-var HOW_TO_COMPRESS_RULES = `HOW TO COMPRESS
-
-When you call \`compress\`, the summary you write becomes the only record of the replaced conversation. Make it self-contained and complete: every user request, experiment purpose, and work task in the range must be accurately captured. A later reader (or you, after decompressing) should be able to continue the task WITHOUT needing the original.
-
-KEEP VERBATIM \u2014 never paraphrase or abbreviate these:
-- Full file paths with line numbers, directory prefix on every mention (\`lib/hooks.ts:347\`, \`src/index.ts:12-18\`, \`gatenet_v3/model.py:45\`). Never abbreviate to a bare filename (\`hooks.ts\`, \`model.py\`) \u2014 they are ambiguous and cannot be grepped or decompressed-to later.
-- Function, class, and type signatures (exact names, params, return types) AND critical code lines that encode logic \u2014 the line that IS the finding, not just the function name (e.g. \`kv_keys += define_gate * a_key[i](emb)\` is more useful than "see model_kvnet.py").
-- Error messages and stack traces (exact text \u2014 you need the literal string to grep for it later).
-- Key details from reports and analyses \u2014 not just the conclusion. Keep the comparison numbers and the mechanism, not "X is worse" alone (write "1.76\xD7 PPL gap because KV store is static", not "KVNet underperforms").
-- Decisions and their rationale ("chose X over Y because Z" \u2014 the "because" is load-bearing; without it the decision looks arbitrary).
-- Constraints discovered ("must support Node 22", "no new dependencies", "AGENTS.md forbids \`as any\`").
-- Exact values: versions, config keys, thresholds, magic numbers.
-- User intent \u2014 quote short user messages verbatim. When the message is too long to quote, preserve intent with extra care: do not change scope, constraints, priorities, acceptance criteria, or requested outcomes. Mark them clearly as past quotes (e.g., "User said: ..."), not as current directives. Losing these changes the task itself.
-- The user's overall goal and any changes to it \u2014 the big-picture objective plus how it evolved during the compressed range. Each summary must reflect the goal as it stood at the end of the range, including pivots (e.g., "initially: fix bug X \u2192 pivoted to: refactor module Y after discovering root cause"). Losing the goal or its evolution makes all subsequent work appear unmotivated.
-- Purpose behind each significant action \u2014 preserve not just what was done but why: the hypothesis behind each experiment, the question behind each exploration, the task goal behind each work action. Without purpose, the summary reads as disconnected technical steps with no through-line.
-- Open questions and unresolved TODOs \u2014 losing these changes what work appears to remain.
-- Message refs of key anchors (\`m00420\`, \`m00510\u2013m00520\`) \u2014 they let you or a later reader jump back via decompress to the exact original.
-
-DROP \u2014 extract the signal, discard the vessel:
-- Verbose logs (build/test/\`npm\` output) once you have captured the error line or the result.
-- Duplicate file reads once the needed content is recorded.
-- Consumed exploration \u2014 search hits, agent return values, successful tool outputs \u2014 once you have extracted the facts you need (same rule as dead-ends, but nothing went wrong; the content is simply spent).
-- Dead-end exploration \u2014 but PRESERVE the lesson in one line: "tried X, failed because Y".
-- Back-and-forth discussion and self-corrections once the final position is captured (keep the outcome, drop the journey to it).
-- Repeated status checks (\`git status\`, \`ls\`) once state is known.
-
-For each significant item you DROP (scripts, reports, large analyses, long tool outputs), add a one-line CONTENT description of what it covers \u2014 not where it lives. Bad: "probe script at /path/probe_kvnet.py". Good: "probe_kvnet.py: tests n-gram baseline, generation quality, long-range dependency, position sensitivity, op pipeline, QUERY attention." This lets a later decompress target the right block by relevance, not by guessing locations.
-
-KEEP MARKERS: \`[[KEEP:mNNNNN]]\` expands original message content into the summary (truncated to a max length). Do NOT use KEEP for verbose command output, diagnostic scripts, log dumps, or any content whose value is in the conclusion rather than the raw output \u2014 summarize these or use \`[[REF:mNNNNN|desc]]\` instead.
-
-PRIORITY \u2014 when the summary must be compact, preserve in this order:
-1. User's overall goal, goal evolution, intent, and hard constraints (losing these changes the task).
-2. Decisions and rationale.
-3. Exact technical artifacts: paths, signatures, errors, values.
-4. Conclusions and key findings.
-5. Lessons learned: what failed and why.
-
-Write dense, scannable bullets \u2014 not narrative prose. If the range spans distinct concerns (request \u2192 findings \u2192 decision), group bullets under short thematic headers so a reader can scan to the part they need. Every line must earn its place. Do not mimic the style of existing summaries in context; follow these rules.`;
-
 // lib/messages/inject/inject.ts
 var ACP_SUFFIX_SEED = "acp-dynamic-guidance";
 function createSuffixMessage(messages) {