opencode-context-indicator 1.2.0 → 1.2.2

package/README.md

@@ -10,7 +10,7 @@ arguments and the residual "other" bucket.
 The package ships a **dual V1 + V2 plugin** (one entry works in both OpenCode
 generations) plus an optional TUI module (`./tui` entry) that renders a **live
 sidebar** and a **zero-LLM `/cx` breakdown panel** with measured contributors
-and a redacted export. The V2 path is **tested against opencode v2.0.22**; the
+and a redacted export. The V2 path is **tested against opencode v2.0.25**; the
 V1 path against 1.18.29+.
 
 > **V1 is feature-frozen.** It is kept working for compatibility (bug fixes
@@ -50,6 +50,14 @@ For every served request the plugin estimates how the context window is split:
 * `ctx` is OpenCode's native overflow count: `tokens.total` when present, else
   `input + output + cache.read + cache.write`. Percentages are **not clamped**
   at 100% — exceeding the window stays visible.
+* The denominator is the **opencode v2.0.23 compaction ceiling**: `window =
+  limit.input || limit.context`; `reserve = max(floor(window * 0.1), window >=
+  32_000 ? 16_000 : 0)`; the ceiling is `window - reserve`. When opencode
+  carries a `compaction.buffer` configured in its own settings, the plugin
+  cannot read that value (it is not exposed to plugins), so the default
+  reserve formula is used — set `OPENCODE_CONTEXT_INDICATOR_COMPACT_BUFFER`
+  to override the reserve for testing or custom setups (non-negative integer <=
+  1e9; invalid values are silently ignored).
 
 ### Toast (V1 only)
 
@@ -296,7 +304,7 @@ and `$TMPDIR` (usually `/tmp`) elsewhere:
 | File | Purpose |
 | --- | --- |
 | `context-breakdown.log` | Human-readable live snapshot + bounded final summaries |
-| `opencode-context-indicator-state.json` | Machine-readable snapshot consumed by the TUI sidebar and the `/cx` panel |
+| `opencode-context-indicator-state.json` | Machine-readable snapshot consumed by the TUI sidebar and the `/cx` panel. Fields per entry: `sessionID`, `parentID`, `role`, `agent`, `model`, `providerID`, `ctx`, `input`, `usable` (compaction ceiling), `reserve` (tokens reserved for compaction), `limit` (context window), `reasoning`, `categories{user,assistant,reasoning,toolArgs,system,toolSchemas,other}`, `updatedAt`. |
 | `context-events.log` | Raw event tap — **only** when `DEBUG_EVENTS` is flipped to `true` in the source (off by default) |
 
 The live `context-breakdown.log` snapshot is **rewritten** (never grows); final
@@ -429,13 +437,13 @@ the sidebar instead.
   gracefully (the breakdown falls back to throttled `session.messages` fetches
   and toasts keep working).
 * **OpenCode ≥ 2.0.16** for the V2 path (built and verified against
-  **2.0.22**).
+  **2.0.25**).
 * **TUI sidebar**: terminal TUI only, requires the OpenTUI rendering stack that
   ships with OpenCode. `@opentui/core` and `solid-js` are **optional** peer
   dependencies resolved by OpenCode at runtime; the main plugin installs and runs
   fine without them (the sidebar simply is not available). `@opentui/solid` is
-  instead shipped as a **pinned direct dependency** (exact `0.5.14`, matching
-  the OpenTUI stack OpenCode 2.0.22 ships): OpenCode's
+  instead shipped as a **pinned direct dependency** (exact `0.5.16`, matching
+  the OpenTUI stack OpenCode 2.0.25 ships): OpenCode's
   TUI loader does not expose a host instance of it, so for npm-installed plugins
   the JSX pragma would otherwise fail to resolve `@opentui/solid/jsx-runtime`
   (upstream: opencode issue #33884 — `node_modules` plugins are excluded from the
@@ -497,9 +505,10 @@ caller.
 ### Running tests
 
 ```bash
-npm run test:prepublish       # fast gate: tarball + tui.tsx + resolve + T1–T12 unit
+npm run test:prepublish       # fast gate: tarball + tui.tsx + resolve + T1–T16i unit checks
 npm run test:e2e              # full E2E: isolated plugin load + one "Say OK" round-trip
 npm run test:e2e:quick        # E2E load-only, no LLM call
+npm run test:drift            # OpenTUI pin vs the latest RELEASED opencode (also in CI)
 ```
 
 `prepublishOnly` runs **both** gates automatically on `npm publish`
@@ -516,8 +525,8 @@ STEP 80 s, ~3 min total.
 |---|---|---|
 | (a) tarball composition | `package.json` `files[]` expands to the base files plus every `lib/*` module (count asserted dynamically) | no test/node_modules/tsconfig in the tarball |
 | (b) pragma regression | esbuild `--jsx=automatic` → `@opentui/solid/jsx-runtime` present, `react/jsx-runtime` absent | a removed/broken pragma kills the sidebar on npm install |
-| (c) resolve chain | replica install → `import.meta.resolve` for all tui.tsx imports | broken peer/optional dep silently breaks the sidebar |
-| (d) unit harness T1–T12 | all limit/agent/state fix assertions | regressions in modelLimits, writeStateFile, hydrate |
+| (c) resolve chain | replica install: host-bridged + peer packages resolve; local tui.tsx relative imports resolve via node from the entry (resolve-bridge.cjs) | broken peer/optional dep or a bad local import silently breaks the sidebar |
+| (d) unit harness T1–T16i | limit/agent/state fix assertions plus measureContributors and redacted-export checks (34 total) | regressions in modelLimits, writeStateFile, hydrate, contributors, export |
 | (e) corporate-identifier scan | no forbidden identifiers in the published surface + test tree | compliance |
 | (f) non-English scan | no non-ASCII letters (`\p{L}` above U+007F) in any repo file | English-only source rule |
 
@@ -525,7 +534,7 @@ STEP 80 s, ~3 min total.
 
 | Check | What | Why |
 |---|---|---|
-| A — plugin load | spins a private `opencode --standalone` PTY, asserts `msg="loading plugin" → opencode-context-indicator` and that the `file:///` entrypoint is **this checkout** | catches a plugin that no longer imports cleanly, or a config pointing at the published npm copy |
+| A — plugin load | spins a private `opencode --standalone` PTY against an **isolated global config** (`OPENCODE_CONFIG_DIR` → `%TEMP%/oci-e2e-config`, sole plugin entry = this checkout's `file://` URL), then asserts **from the host opencode log** (atomic lines, immune to PTY interleaving) that the plugin loaded and its `entrypoint` is **this checkout's `index.js`** — both fail-closed | catches a plugin that no longer imports cleanly, or an isolated config the host did not honor |
 | B — live update | one `opencode run "Say OK" --standalone` round-trip; asserts the LLM answered **and** the isolated `state.json` gained a session with `ctx > 0` | catches a regression in the `session.idle` → `writeStateFile` path |
 
 The E2E is fully **non-invasive** to your running OpenCode Desktop:
@@ -534,7 +543,14 @@ The E2E is fully **non-invasive** to your running OpenCode Desktop:
 - `OPENCODE_DB` points at a throwaway DB in `%TEMP%` (your sessions are untouched);
 - `OPENCODE_CONTEXT_INDICATOR_STATE_FILE` points at a throwaway state file in `%TEMP%`
   — the live `opencode-context-indicator-state.json` is never read or written;
+- `OPENCODE_CONFIG_DIR` points at a throwaway global config written by the script
+  (plugins: this checkout; `update: "disable"`) **for Check A only** — the load
+  source is deterministic and fail-closed instead of following your live config;
+  Check B uses your real global config read-only (the round-trip needs the
+  provider/model defined there). Your real config is never modified;
 - `OPENCODE_DISABLE_PROJECT_CONFIG=1` avoids project-level config;
+- any `opencode-cli` instance the test itself spawned is force-killed after each
+  check (`serve --service` — your Desktop background service — is never touched);
 - exactly **one** minimal LLM call (`Say OK`) is made, in the isolated session.
 
 The script prints `[e2e] running against ISOLATED opencode instance — your running
@@ -547,10 +563,20 @@ model.
 
 ### CI
 
-`.github/workflows/ci.yml` runs `test/prepublish.mjs` on every push/PR and additionally
-does a standalone esbuild transpile check (pragmas, no React). The Node-pty E2E is not
-run in CI (requires the OpenCode Desktop binary) and is skipped gracefully when the CLI
-is absent (`[SKIP] opencode CLI not found`).
+`.github/workflows/ci.yml` runs on every push/PR to `main`, on `workflow_dispatch`,
+and on a daily schedule (GitHub auto-parks scheduled workflows after 60 days of
+repo inactivity — a push or manual run re-enables them):
+
+1. `npx --no-install tsc --noEmit` — typecheck of the TUI entry (`tui.tsx` + its
+   `lib/*` imports);
+2. `test/prepublish.mjs` — the full fast gate (a)–(f), including the standalone
+   esbuild transpile check (pragmas, no React);
+3. `test/drift-watch.mjs` — the OpenTUI pin must match the OpenTUI catalog of the
+   **latest released** opencode; red CI means "bump the pin before the next
+   release".
+
+The Node-pty E2E is not run in CI (requires the OpenCode binary) and is skipped
+gracefully when the CLI is absent (`[SKIP] opencode CLI not found`).
 
 ---
 

package/index.js

@@ -112,8 +112,8 @@
  *   Every live/final log write ALSO rewrites
  *     %TEMP%\opencode-context-indicator-state.json   (os.tmpdir())
  *   — a machine-readable { sessionID: { model, providerID, ctx, usable,
- *     limit, categories{...}, updatedAt } } snapshot consumed by the optional
- *   TUI sidebar in ./tui.tsx (package entry "./tui"). Written atomically
+ *     reserve, limit, categories{...}, updatedAt } } snapshot consumed by the
+ *   optional TUI sidebar in ./tui.tsx (package entry "./tui"). Written atomically
  *   (temp + rename), keyed by session, bounded to MAX_TRACKED_SESSIONS, and
  *   strictly additive: any failure is swallowed and never affects the log.
  *
@@ -123,9 +123,10 @@
  *
  *   - Metric: the native opencode overflow count — tokens.total when present,
  *     else input + output + cache.read + cache.write — compared against the
- *     model's usable window (limit.input − reserved, else limit.context −
- *     maxOutput). Percentages are NOT clamped at 100% — exceeding the window
- *     must stay visible.
+ *     model's compaction ceiling (opencode v2.0.23 calculateCeiling): window =
+  *     limit.input || limit.context, reserve = max(10% of window, 16k when
+  *     window >= 32k), usable = window - reserve. Percentages are NOT
+  *     clamped at 100% - exceeding the ceiling must stay visible.
  *   - Category estimates use a unicode-aware heuristic (see estimateTokens):
  *     Cyrillic ~2.5 chars/token, CJK ~1.5, latin/ASCII ~4. These are ESTIMATES,
  *     not a tokenizer; "other" is the residual input − sum of estimates.
@@ -165,6 +166,7 @@ import {
   getUsableContext,
   hydrateModelLimitsFromState,
   modelLimits,
+  reserveFor,
 } from "./lib/limits.js";
 import { sessionAgentCache, sessionParentCache } from "./lib/cache.js";
 import {
@@ -189,6 +191,7 @@ export {
   hydrateModelLimitsFromState,
   getUsableContext,
   getModelLimit,
+  reserveFor,
   collectSessionReport,
   renderSessionRow,
   shortSummaryText,

package/lib/commands.js

@@ -272,6 +272,12 @@ async function collectSessionReport(ctx, sessionID, state, deadline) {
   const usableInfo = getUsableContext(providerID, modelID);
   const usable =
     usableInfo?.usable ?? entry?.usable ?? getModelLimit(providerID, modelID) ?? null;
+  const reserve =
+    usableInfo?.reserved != null
+      ? usableInfo.reserved
+      : Number.isFinite(entry?.reserve) && entry.reserve > 0
+        ? entry.reserve
+        : null;
   const parentID = entry?.parentID ?? null;
   const updatedAt =
     entry?.updatedAt ||
@@ -284,6 +290,7 @@ async function collectSessionReport(ctx, sessionID, state, deadline) {
     providerID,
     ctxTokens,
     usable,
+    reserve,
     categories,
     source,
     updatedAt,
@@ -384,6 +391,14 @@ function shortSummaryText(r) {
   } else {
     lines.push("_category breakdown unavailable (no cache/state entry yet)_");
   }
+  // Compact-at line: show the new ceiling and, when known, the reserve.
+  if (r.usable && r.usable > 0) {
+    let compact = `compact at ${fmt(r.usable)}`;
+    if (r.reserve != null && r.reserve > 0) {
+      compact += ` (${fmt(r.reserve)} reserve)`;
+    }
+    lines.push(compact);
+  }
   lines.push(`updated ${timeOnly(r.updatedAt)} (${sourceTag(r.source)})`);
   return lines.join("\n");
 }

package/lib/contributors.js

@@ -0,0 +1,288 @@
+// lib/contributors.js
+//
+// Pure contributor-measurement helpers extracted from tui.tsx for unit testing.
+// All functions are stateless transforms of their arguments.
+//
+// Extracted 1:1 (behaviour + WHY comments, stripped of TS syntax):
+//   estimateTokensLocal, asRecord, safeText, measureContributors,
+//   contributorLine, exportFileName, buildRedactedPayload, panelDenom, panelRole.
+
+// ---------------------------------------------------------------------------
+// Token estimation (mirrors lib/estimate.js but self-contained — tui.tsx
+// loads standalone and must NOT import lib/*).
+// ---------------------------------------------------------------------------
+
+// Unicode heuristic — estimate, not a tokenizer. Cyrillic ~2.5, CJK ~1.5,
+// latin/ASCII ~4 chars/token.
+function estimateTokensLocal(s) {
+  let other = 0;
+  let cyr = 0;
+  let cjk = 0;
+  for (let i = 0; i < s.length; i++) {
+    const cp = s.codePointAt(i);
+    if (cp > 0xffff) i++; // astral pair — consume the low surrogate
+    if (cp < 0x80) other++;
+    else if (
+      (cp >= 0x0400 && cp <= 0x04ff) || // Cyrillic
+      (cp >= 0x0500 && cp <= 0x052f) || // Cyrillic Supplement
+      (cp >= 0x2de0 && cp <= 0x2dff) || // Cyrillic Extended-A
+      (cp >= 0xa640 && cp <= 0xa69f) || // Cyrillic Extended-B
+      (cp >= 0x1c80 && cp <= 0x1c8f) // Cyrillic Extended-C
+    )
+      cyr++;
+    else if (
+      (cp >= 0x4e00 && cp <= 0x9fff) || // CJK Unified Ideographs
+      (cp >= 0x3400 && cp <= 0x4dbf) || // CJK Extension A
+      (cp >= 0xf900 && cp <= 0xfaff) || // CJK Compatibility Ideographs
+      (cp >= 0x3040 && cp <= 0x30ff) || // Hiragana + Katakana
+      (cp >= 0xac00 && cp <= 0xd7af) || // Hangul Syllables
+      (cp >= 0x3000 && cp <= 0x303f) || // CJK Symbols and Punctuation
+      (cp >= 0xff00 && cp <= 0xffef) // Halfwidth/Fullwidth Forms
+    )
+      cjk++;
+    else other++;
+  }
+  return Math.round(other / 4 + cyr / 2.5 + cjk / 1.5);
+}
+
+// Live message data is untrusted: coerce every field defensively, never throw.
+function asRecord(v) {
+  return v && typeof v === "object" ? v : null;
+}
+
+// One-line sanitisation for untrusted labels (agent / model). Drops zero-width
+// + bidi control chars, collapses C0/C1 controls, caps at 32 code points
+// (surrogate-safe). Only labels are ever rendered — never message content.
+function safeText(v) {
+  try {
+    const s = v == null ? "" : String(v);
+    const cleaned = s
+      .replace(/[\u200B-\u200F\u202A-\u202E\u2066-\u2069]/g, "")
+      .replace(/[\u0000-\u001F\u007F-\u009F\u2028\u2029]/g, " ");
+    const cps = Array.from(cleaned);
+    return cps.length > 32 ? cps.slice(0, 31).join("") + "~" : cleaned;
+  } catch {
+    return "";
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Contributor measurement
+// ---------------------------------------------------------------------------
+
+// Char counts per (message, bucket). `asst.text` = assistant text,
+// `asst.rsn` = reasoning, `asst.tool` = tool CALL arguments (streaming raw
+// string or JSON.stringify of the input object), `asst.result` = tool RESULT
+// outputs (text content of completed/error tool states). Sorted descending by
+// estimated tokens.
+//
+// Returns an array of plain objects (no class/prototype dependency):
+//   { kind, ref, chars, tokensEstimate, tool, preview }
+function measureContributors(messages) {
+  const out = [];
+  // Bounded preview: control chars collapse to spaces, bidi/zero-width stripped,
+  // capped at 26 code points with a "~" tail. Local rendering only.
+  const previewOf = (sample) => {
+    const cleaned = sample
+      .replace(/[\u200B-\u200F\u202A-\u202E\u2066-\u2069]/g, "")
+      .replace(/[\u0000-\u001F\u007F-\u009F\u2028\u2029]+/g, " ")
+      .trim();
+    const cps = Array.from(cleaned);
+    return cps.length > 26 ? cps.slice(0, 25).join("") + "~" : cleaned;
+  };
+  const add = (kind, ref, sample, tool, previewOverride) => {
+    if (sample.length === 0) return;
+    out.push({
+      kind,
+      ref,
+      chars: sample.length,
+      tokensEstimate: estimateTokensLocal(sample),
+      tool: tool || "",
+      preview: previewOverride !== undefined ? previewOverride : previewOf(sample),
+    });
+  };
+  // Human clock ref: "21:04" from the message's own creation time — far more
+  // actionable than an array ordinal. Falls back to "#N" when time is absent.
+  const hhmm = (ms) => {
+    if (typeof ms !== "number" || !Number.isFinite(ms) || ms <= 0) return "";
+    try {
+      const d = new Date(ms);
+      if (Number.isNaN(d.getTime())) return "";
+      const pad = (x) => String(x).padStart(2, "0");
+      return `${pad(d.getHours())}:${pad(d.getMinutes())}`;
+    } catch {
+      return "";
+    }
+  };
+  for (let i = 0; i < messages.length; i++) {
+    const m = asRecord(messages[i]);
+    if (!m) continue;
+    const timeRec = asRecord(m.time);
+    const ref = hhmm(timeRec && timeRec.created) || `#${i + 1}`;
+    const type = typeof m.type === "string" ? m.type : "";
+    if (type === "user") {
+      if (typeof m.text === "string") add("user.text", ref, m.text);
+      continue;
+    }
+    if (type !== "assistant") continue;
+    const content = Array.isArray(m.content) ? m.content : [];
+    let text = "";
+    let rsn = "";
+    for (const rawPart of content) {
+      const part = asRecord(rawPart);
+      if (!part) continue;
+      const pt = typeof part.type === "string" ? part.type : "";
+      if (pt === "text") {
+        if (typeof part.text === "string") text += part.text;
+      } else if (pt === "reasoning") {
+        if (typeof part.text === "string") rsn += part.text;
+      } else if (pt === "tool") {
+        const state = asRecord(part.state);
+        if (!state) continue;
+        // Per-tool-part contributors: each tool call carries its own name and
+        // measured size (one message can hold several tool calls). The raw
+        // args JSON is measured but NOT previewed — the tool name is the
+        // useful identifier; result text previews fine.
+        const toolName =
+          typeof part.name === "string" && part.name ? safeText(part.name) : "";
+        let toolArgs = "";
+        let result = "";
+        if (typeof state.input === "string") {
+          toolArgs += state.input;
+        } else if (state.input != null) {
+          try {
+            toolArgs += JSON.stringify(state.input) || "";
+          } catch {
+            /* unstringifiable input: skip its chars */
+          }
+        }
+        const c = state.content;
+        if (Array.isArray(c)) {
+          for (const rawItem of c) {
+            const item = asRecord(rawItem);
+            if (item && item.type === "text" && typeof item.text === "string")
+              result += item.text;
+          }
+        }
+        add("asst.tool", ref, toolArgs, toolName, ""); // raw args: no preview
+        add("asst.result", ref, result, toolName);
+      }
+    }
+    add("asst.text", ref, text);
+    add("asst.rsn", ref, rsn);
+  }
+  return out.sort((a, b) => b.tokensEstimate - a.tokensEstimate);
+}
+
+// Human line for one measured contributor: role in full words, the message's
+// own clock time, the bucket (with the tool name for tool buckets), the token
+// estimate, and a bounded single-line preview. Never contains a full session id
+// or file paths.
+function contributorLine(c, rank) {
+  const dot = c.kind.indexOf(".");
+  const who = dot >= 0 ? c.kind.slice(0, dot) : c.kind;
+  const bucket = dot >= 0 ? c.kind.slice(dot + 1) : "";
+  const role = who === "asst" ? "assistant" : who;
+  const what =
+    bucket === "rsn"
+      ? "reasoning"
+      : bucket === "tool"
+        ? "tool args"
+        : bucket === "result"
+          ? "tool result"
+          : "";
+  const tool = c.tool ? ` (${c.tool})` : "";
+  const whatFull = what ? `${what}${tool}` : "";
+  const head = `${rank}. ${role} ${c.ref}${whatFull ? ` ${whatFull}` : ""} \u2014 ${c.tokensEstimate}`;
+  return c.preview ? `${head}  "${c.preview}"` : head;
+}
+
+// ---------------------------------------------------------------------------
+// Redacted export helpers (pure)
+// ---------------------------------------------------------------------------
+
+// Filename for a redacted export snapshot:
+// context-<id8>-<yyyymmdd-HHMMSSmmm>.json
+function exportFileName(sessionID, now) {
+  const id8 = String(sessionID).slice(0, 8);
+  const pad = (n) => String(n).padStart(2, "0");
+  const stamp =
+    `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}` +
+    `-${pad(now.getHours())}${pad(now.getMinutes())}` +
+    `${pad(now.getSeconds())}${String(now.getMilliseconds()).padStart(3, "0")}`;
+  return `context-${id8}-${stamp}.json`;
+}
+
+// Build the redacted export payload. All IO (mkdirSync/writeFileSync) and
+// toasts stay in tui.tsx as the thin exportRedacted() wrapper.
+//
+// Fields: generatedAt, session{id8-prefixed id, model, providerID},
+// family[role/model/ctx/usable/limit/pct/updated], contributors[kind/tool/ref/
+// chars/tokensEstimate].  NO message text, NO full session id, NO tool output
+// content, NO contributor preview text.
+//
+// panelDenom / panelRole are passed as parameters so this file stays pure and
+// tui.tsx controls their source.
+function buildRedactedPayload({ sessionID, root, rows, contributors, now, panelDenom, panelRole, num }) {
+  const id8 = String(sessionID).slice(0, 8);
+  return {
+    generatedAt: now.toISOString(),
+    session: {
+      id: `${id8}...`,
+      model: safeText(root && root.model != null ? root.model : ""),
+      providerID: safeText(root && root.providerID != null ? root.providerID : ""),
+    },
+    family: rows.map((e, i) => {
+      const d = panelDenom(e);
+      const ctxVal = num(e && e.ctx);
+      return {
+        role: panelRole(e, i === 0),
+        model: safeText(e && e.model != null ? e.model : ""),
+        ctx: ctxVal,
+        usable: e && e.usable != null ? num(e.usable) : null,
+        limit: e && e.limit != null ? num(e.limit) : null,
+        pct: d > 0 ? Math.round((ctxVal / d) * 100) : null,
+        updated: safeText(e && e.updatedAt != null ? e.updatedAt : ""),
+      };
+    }),
+    contributors: contributors.map((c) => ({
+      kind: c.kind,
+      tool: c.tool || null,
+      ref: c.ref,
+      chars: c.chars,
+      tokensEstimate: c.tokensEstimate,
+    })),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Panel helpers (pure, shared with tui.tsx)
+// ---------------------------------------------------------------------------
+
+// Per-row denominator with the same fallback cascade as the server table:
+// usable, else limit, else 0.
+function panelDenom(e) {
+  const u = e && typeof e.usable === "number" && e.usable > 0 ? e.usable : 0;
+  if (u > 0) return u;
+  const l = e && typeof e.limit === "number" && e.limit > 0 ? e.limit : 0;
+  return l;
+}
+
+// Role label for a state entry: "main" for root, "sub" or "sub:<agent>" for
+// descendants.
+function panelRole(e, isMain) {
+  if (isMain) return "main";
+  return e && e.agent ? `sub:${safeText(e.agent)}` : "sub";
+}
+
+export {
+  estimateTokensLocal,
+  asRecord,
+  safeText,
+  measureContributors,
+  contributorLine,
+  exportFileName,
+  buildRedactedPayload,
+  panelDenom,
+  panelRole,
+};

package/lib/limits.js

@@ -6,6 +6,16 @@
 // client.config.providers(), ensureModelLimits for V2 via ctx.model.list()).
 // hydrateModelLimitsFromState() seeds the maps from the shared state.json
 // snapshot via ./state.js. Extracted 1:1 (code + WHY comments) from index.js.
+//
+// Compaction ceiling (v2.0.23): opencode's core calculateCeiling() in
+// packages/core/src/session/compaction.ts derives the auto-compaction trigger
+// ceiling as window - reserve, where window = limit.input || limit.context
+// (null/zero falls through to the context window) and
+//   reserve = max(floor(window * 0.1), window >= 32_000 ? 16_000 : 0)
+// A compaction.buffer configured in opencode itself is NOT visible to the
+// plugin (the plugin cannot read opencode's internal compaction config); the
+// env var OPENCODE_CONTEXT_INDICATOR_COMPACT_BUFFER overrides the reserve for
+// testing and power users only (positive finite integer <= 1e9, ignore invalid).
 
 import { finitePos, withTimeout } from "./estimate.js";
 import { logErr, readStateSnapshot } from "./state.js";
@@ -67,32 +77,73 @@ function getModelLimit(providerID, modelID) {
   return typeof rec.context === "number" && rec.context > 0 ? rec.context : null;
 }
 
-// Native opencode usable window (see packages/opencode/src/session/overflow.ts):
-//   usable = limit.input ? limit.input − reserved : limit.context − maxOutput
-//   reserved = compaction.reserved ?? min(20_000, maxOutput)
-//   maxOutput = model.limit.output
-// Returns { usable, limit, maxOutput, reserved } or null when not derivable
-// (callers then degrade to count / limit.context, or to no percentage at all).
-function getUsableContext(providerID, modelID) {
+// Compute the reserve for a given window, matching opencode v2.0.23
+// packages/core/src/session/compaction.ts calculateCeiling().  Returns null when
+// window is not a finite positive number.
+function reserveFor(window, bufferOverride) {
+  if (
+    typeof window !== "number" ||
+    !Number.isFinite(window) ||
+    window <= 0
+  ) return null;
+  // bufferOverride: accept only finite, non-negative integers <= 1e9.
+  if (
+    typeof bufferOverride === "number" &&
+    Number.isFinite(bufferOverride) &&
+    bufferOverride >= 0 &&
+    bufferOverride <= 1e9
+  ) {
+    return bufferOverride;
+  }
+  // Default reserve formula (mirror of opencode core):
+  //   max(floor(window * 0.1), window >= 32_000 ? 16_000 : 0)
+  return Math.max(
+    Math.floor(window * 0.1),
+    window >= 32_000 ? 16_000 : 0,
+  );
+}
+
+// Native opencode compaction ceiling (v2.0.23 calculateCeiling):
+//   window = limit.input || limit.context  (zero/null falls through to context)
+//   reserve = reserveFor(window)  [or bufferOverride when provided]
+//   usable  = window - reserve
+// Returns { usable, limit: window, maxOutput, reserved } or null when not
+// derivable (callers then degrade to count / limit.context, or no percentage).
+// The per-model compaction.reserved and the old min(20000, maxOutput) no longer
+// participate in this calculation; opencode's internal buffer is not visible.
+function getUsableContext(providerID, modelID, bufferOverride) {
   const rec = getModelLimitRecord(providerID, modelID);
   if (!rec) return null;
   const context =
     typeof rec.context === "number" && rec.context > 0 ? rec.context : null;
   const input =
     typeof rec.input === "number" && rec.input > 0 ? rec.input : null;
+  if (input == null && context == null) return null;
+  // Mirror core's limit.input || limit.context (zero/null falls through to context).
+  const window = input != null && input > 0 ? input : context;
+  if (window == null || !(window > 0)) return null;
+
+  // When bufferOverride is omitted, read it from the env var once per call.
+  let resolvedBuffer = bufferOverride;
+  if (resolvedBuffer === undefined) {
+    const raw = process.env.OPENCODE_CONTEXT_INDICATOR_COMPACT_BUFFER;
+    // Strict digits-only: reject "5000abc", "5e3", " 5000", "", "-1" and other
+    // partial parses (parseInt/parseFloat stop at the first non-digit).
+    if (typeof raw === "string" && /^\d+$/.test(raw)) {
+      const parsed = parseInt(raw, 10);
+      if (Number.isFinite(parsed) && parsed >= 0 && parsed <= 1e9) {
+        resolvedBuffer = parsed;
+      }
+    }
+  }
+
+  const reserve = reserveFor(window, resolvedBuffer);
+  if (reserve == null) return null;
+  const usable = window - reserve;
+  if (usable <= 0) return null;
   const maxOutput =
     typeof rec.output === "number" && rec.output > 0 ? rec.output : 0;
-  if (input == null && context == null) return null;
-  // Mirrors opencode overflow.ts: reserved = min(20000, maxOutput), i.e. 0 when
-  // the model declares no output limit (NOT a 20000 default — that would
-  // understate the usable window).
-  const reserved =
-    typeof rec.reserved === "number" && rec.reserved >= 0
-      ? rec.reserved
-      : Math.min(20000, maxOutput);
-  const usable = input != null ? input - reserved : context - maxOutput;
-  if (!(usable > 0)) return null;
-  return { usable, limit: context, maxOutput, reserved };
+  return { usable, limit: window, maxOutput, reserved: reserve };
 }
 
 // Store a model limit record under `<providerID>:<modelID>`. Written by
@@ -366,13 +417,18 @@ function hydrateModelLimitsFromState() {
         }
       }
 
-      // Build the record: precise usable-as-input when known (so getUsableContext
-      // re-derives EXACTLY the persisted window), else the raw context window.
+      // Build the record: seed the raw window (context, preferring limit when
+      // present) so the NEW formula derives the ceiling fresh on every call.
+      // The old precise-usable-as-input seeding (which caused double-reserve
+      // under the new formula) is retired: getUsableContext is now a pure
+      // function of the window and needs no pre-derived state.
       let rec = null;
-      if (best.usable != null) {
-        rec = { context: best.limit, input: best.usable, output: null, reserved: 0 };
-      } else if (best.limit != null) {
+      if (best.limit != null) {
         rec = { context: best.limit, input: null, output: null, reserved: null };
+      } else if (best.usable != null) {
+        // No limit in snapshot: fall back to persisted usable as a best-effort
+        // window (it was the ceiling before the formula change, close enough).
+        rec = { context: best.usable, input: null, output: null, reserved: null };
       }
       if (rec == null) continue;
       modelLimits.set(key, rec);
@@ -396,6 +452,7 @@ export {
   modelKey,
   getModelLimit,
   getUsableContext,
+  reserveFor,
   setModelLimit,
   ensureProviderLimits,
   ensureModelLimits,

package/lib/state.js

@@ -331,14 +331,23 @@ function writeStateFile(
     }
     try {
       const bd = breakdownCache.get(sessionID) || null;
-      const limit = getModelLimit(providerID, modelID);
       const usableInfo = getUsableContext(providerID, modelID);
+      // Persist the EFFECTIVE window (limit.input || limit.context — the same
+      // window the ceiling was derived from), not the raw context window: on a
+      // cold instance hydrateModelLimitsFromState seeds context = limit, so a
+      // mismatched limit would re-derive a WRONG (too large) ceiling for models
+      // where limit.input < limit.context.
+      const limit =
+        usableInfo != null && usableInfo.limit != null
+          ? usableInfo.limit
+          : getModelLimit(providerID, modelID);
       const denom =
         usableInfo != null
           ? usableInfo.usable
           : limit != null && limit > 0
             ? limit
             : null;
+      const reserve = usableInfo != null ? usableInfo.reserved : null;
       const total =
         typeof ctxTokens === "number" && ctxTokens > 0
           ? ctxTokens
@@ -433,6 +442,12 @@ function writeStateFile(
             : sameModelAsPrev && finitePos(prevEntry.usable)
               ? prevEntry.usable
               : null,
+        reserve:
+          reserve != null
+            ? reserve
+            : sameModelAsPrev && finitePos(prevEntry.reserve)
+              ? prevEntry.reserve
+              : null,
         limit:
           limit != null
             ? limit