opencode-context-indicator 1.6.0 → 1.7.0

package/lib/state.js

@@ -23,6 +23,8 @@ import { join } from "node:path";
 import { claimOnce } from "./dedup.js";
 import {
   finitePos,
+  isHookMeasuredEntry,
+  isHookSource,
   isSafeSessionKey,
   oneLine,
   safeCount,
@@ -99,6 +101,10 @@ const DEDUP_DIR = join(tmpdir(), "context-indicator.dedup");
 // ~120 ms — a reasonable trade-off between surviving a transient holder and not
 // freezing a plugin tick.
 const STATE_LOCK_FILE = `${STATE_FILE}.lock`;
+// The log file has the same read-merge-write shape (see writeLog) and needs its
+// own lock: sharing the state lock would make every snapshot write contend with
+// the state writers for no reason.
+const LOG_LOCK_FILE = `${LOG_FILE}.lock`;
 const LOCK_MAX_ATTEMPTS = 6;
 const LOCK_RETRY_MS = 20;
 const LOCK_STALE_MS = 5000; // a lock older than this is presumed abandoned
@@ -128,8 +134,15 @@ function logErr(msg, err) {
   }
 }
 
+const FINAL_SUMMARY_MARKER = "\n## final summaries\n";
+const LIVE_MARKER = "\n## live snapshot\n";
+// Line cap for the persisted summary section. `MAX_FINAL_SUMMARIES` bounds the
+// in-memory BLOCKS; the merged on-disk section is capped by lines (blocks are
+// dropped oldest-first) so a burst of notes cannot grow the file forever.
+const MAX_FINAL_SUMMARY_LINES = 400;
+
 // Build the full file content: header + live snapshot + final summaries.
-function renderFile(liveLines) {
+function renderFile(liveLines, summaryBlocks) {
   const lines = [];
   lines.push(
     "# context-breakdown.log",
@@ -142,17 +155,73 @@ function renderFile(liveLines) {
     "",
     "## final summaries",
   );
-  if (finalSummaries.length === 0) {
+  if (!summaryBlocks || summaryBlocks.length === 0) {
     lines.push("(none yet)");
   } else {
-    for (const s of finalSummaries) lines.push(s);
+    for (const s of summaryBlocks) lines.push(s);
   }
   return lines.join("\n") + "\n";
 }
 
+// Every summary block starts with its own `[<ISO timestamp>]` header line (all
+// callers of pushFinalSummary do). Splitting the persisted section on that
+// marker recovers the BLOCK structure: de-duplicating line-by-line would delete
+// the repeated table separator / header rows of a second /context-breakdown
+// block and corrupt the persisted table, and it would drop the blank lines that
+// separate the sections inside a block.
+const SUMMARY_BLOCK_START = /^\[\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/;
+
+function splitSummaryBlocks(lines) {
+  const blocks = [];
+  let cur = null;
+  for (const line of lines) {
+    if (line === "(none yet)") continue;
+    if (cur === null || SUMMARY_BLOCK_START.test(line)) {
+      if (cur !== null) blocks.push(cur.join("\n").trimEnd());
+      cur = [line];
+    } else {
+      cur.push(line);
+    }
+  }
+  if (cur !== null) blocks.push(cur.join("\n").trimEnd());
+  return blocks.filter((b) => b.trim().length > 0);
+}
+
+// The log file is SHARED by every plugin instance while `finalSummaries` and
+// `lastLiveLines` are per-process. Recover both sections from disk so a write
+// from one instance neither drops a note another instance just appended nor
+// blanks a fresher live snapshot with its own stale copy. Best-effort: any
+// read/parse failure yields empty sections and the caller keeps its own data.
+function readPersistedLog() {
+  try {
+    const text = readFileSync(LOG_FILE, "utf8");
+    const at = text.indexOf(FINAL_SUMMARY_MARKER);
+    const head = at < 0 ? text : text.slice(0, at);
+    const liveAt = head.indexOf(LIVE_MARKER);
+    const liveLines =
+      liveAt < 0
+        ? []
+        : head
+            .slice(liveAt + LIVE_MARKER.length)
+            .split("\n")
+            .filter((l) => l.length > 0);
+    const summaryBlocks =
+      at < 0
+        ? []
+        : splitSummaryBlocks(
+            text.slice(at + FINAL_SUMMARY_MARKER.length).split("\n"),
+          );
+    return { liveLines, summaryBlocks };
+  } catch {
+    return { liveLines: [], summaryBlocks: [] };
+  }
+}
+
 // Atomically rewrite the whole log file (bounded by design). The temp+rename
-// makes concurrent writers from multiple plugin instances safe: a reader sees
-// either the previous or the new file, never a half-written one.
+// makes a READER see either the previous or the new file, never a half-written
+// one; the log lock serialises the read-merge-write across instances (without it
+// two writers that read the same snapshot can each drop the other's note - the
+// exact "compaction note vanished" defect this merge exists to fix).
 //
 // The last rendered live snapshot is remembered: callers that only add a final
 // summary / compaction note pass no live lines, and an empty snapshot section
@@ -161,33 +230,65 @@ let lastLiveLines = [];
 
 function writeLog(liveLines) {
   try {
-    if (Array.isArray(liveLines) && liveLines.length > 0) {
-      lastLiveLines = liveLines;
+    const lock = acquireLock(LOG_LOCK_FILE);
+    if (lock && !lock.ok) {
+      // Another instance is rewriting the file right now; its write already
+      // carries the merged section (and our in-memory blocks land on the next
+      // cycle). Skipping is cheaper than a torn merge.
+      logErr("writeLog skipped (log lock busy)");
+      return;
     }
-    const content = renderFile(
-      Array.isArray(liveLines) && liveLines.length > 0 ? liveLines : lastLiveLines,
-    );
-    // Random temp suffix + exclusive create ("wx"): a predictable name could be
-    // pre-created as a symlink for us to follow (CWE-377). "wx" fails instead.
-    const tmp = `${LOG_FILE}.${randomBytes(6).toString("hex")}.tmp`;
-    // Unlike writeStateFile there is no ensureRegularFile(LOG_FILE) guard: the
-    // destination is only ever replaced by rename(2), which swaps the directory
-    // entry and never follows a symlink, so a pre-planted link cannot redirect a
-    // write. The "wx" temp below already blocks the symlink-attack vector.
-    // Create BEFORE the finally-guarded section (mirrors writeStateFile): on an
-    // (astronomically unlikely) EEXIST collision with a peer's temp, THEIR file
-    // must not be cleaned up by us — the write fails and is logged instead.
-    writeFileSync(tmp, content, { encoding: "utf8", flag: "wx" });
     try {
-      renameWithRetry(tmp, LOG_FILE);
-    } finally {
-      // Same hygiene as writeStateFile: a failed rename must not litter %TEMP%
-      // with stale `<hex>.tmp` files.
+      const persisted = readPersistedLog();
+      const hasFreshLive = Array.isArray(liveLines) && liveLines.length > 0;
+      if (hasFreshLive) lastLiveLines = liveLines;
+      const live = hasFreshLive
+        ? liveLines
+        : persisted.liveLines.length > 0
+          ? persisted.liveLines
+          : lastLiveLines;
+      // Blocks, not lines: a repeated markdown table in a second command block
+      // must survive verbatim. Identity is the whole block (its timestamped
+      // header makes it unique).
+      const blocks = persisted.summaryBlocks.slice();
+      const seen = new Set(blocks);
+      for (const raw of finalSummaries) {
+        const block = String(raw).trimEnd();
+        if (!block || seen.has(block)) continue;
+        seen.add(block);
+        blocks.push(block);
+      }
+      // Line bound: drop the oldest blocks first (never the newest note).
+      let totalLines = blocks.reduce((n, b) => n + b.split("\n").length, 0);
+      while (blocks.length > 1 && totalLines > MAX_FINAL_SUMMARY_LINES) {
+        totalLines -= blocks[0].split("\n").length;
+        blocks.shift();
+      }
+      const content = renderFile(live, blocks);
+      // Random temp suffix + exclusive create ("wx"): a predictable name could be
+      // pre-created as a symlink for us to follow (CWE-377). "wx" fails instead.
+      const tmp = `${LOG_FILE}.${randomBytes(6).toString("hex")}.tmp`;
+      // Unlike writeStateFile there is no ensureRegularFile(LOG_FILE) guard: the
+      // destination is only ever replaced by rename(2), which swaps the directory
+      // entry and never follows a symlink, so a pre-planted link cannot redirect
+      // a write. The "wx" temp below already blocks the symlink-attack vector.
+      // Create BEFORE the finally-guarded section (mirrors writeStateFile): on an
+      // (astronomically unlikely) EEXIST collision with a peer's temp, THEIR file
+      // must not be cleaned up by us — the write fails and is logged instead.
+      writeFileSync(tmp, content, { encoding: "utf8", flag: "wx" });
       try {
-        if (existsSync(tmp)) unlinkSync(tmp);
-      } catch {
-        /* ignore */
+        renameWithRetry(tmp, LOG_FILE);
+      } finally {
+        // Same hygiene as writeStateFile: a failed rename must not litter %TEMP%
+        // with stale `<hex>.tmp` files.
+        try {
+          if (existsSync(tmp)) unlinkSync(tmp);
+        } catch {
+          /* ignore */
+        }
       }
+    } finally {
+      if (lock && lock.ok) releaseLock(LOG_LOCK_FILE, lock.token);
     }
   } catch (err) {
     logErr("writeLog failed", err);
@@ -227,21 +328,24 @@ function ensureRegularFile(path) {
 
 // True when the lock file exists and looks abandoned (older than LOCK_STALE_MS).
 // Callers wrap it in try/catch: ENOENT (lock vanished) lands there and retries.
-function isStaleLock() {
-  return Date.now() - statSync(STATE_LOCK_FILE).mtimeMs > LOCK_STALE_MS;
+function isStaleLock(lockPath) {
+  return Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS;
 }
 
 // Returns `{ ok: true, token }` when the lock was taken (caller MUST release with
 // that token), `{ ok: false, token: null }` when it is busy (skip the write), or
 // `null` on an unexpected error — fail-open: the caller writes WITHOUT the lock
 // and must NOT release (nothing was acquired).
-function acquireStateLock() {
+//
+// Parameterised by path: the state file and the log file each have their own
+// read-merge-write critical section and must not serialise against each other.
+function acquireLock(lockPath) {
   const token = randomBytes(8).toString("hex"); // 16 hex chars, per acquisition
   for (let i = 0; i < LOCK_MAX_ATTEMPTS; i++) {
     try {
       // "wx" = exclusive create; fails EEXIST if held, and creates+writes the
       // token in ONE atomic step (no empty-file-then-write gap to race).
-      writeFileSync(STATE_LOCK_FILE, token, { flag: "wx" });
+      writeFileSync(lockPath, token, { flag: "wx" });
       return { ok: true, token };
     } catch (err) {
       if (err && err.code === "EEXIST") {
@@ -254,12 +358,12 @@ function acquireStateLock() {
           // consecutive checks narrow the window to the stat->rename gap
           // (microseconds); the lock stays best-effort: the worst case is a
           // stale single-session entry, self-healed on the next write.
-          if (isStaleLock() && isStaleLock()) {
+          if (isStaleLock(lockPath) && isStaleLock(lockPath)) {
             // Atomic reclaim: only ONE waiter can rename the stale file away;
             // the loser gets ENOENT and keeps waiting — neither can unlink a
             // lock a peer just re-created.
-            const stale = `${STATE_LOCK_FILE}.stale.${randomBytes(4).toString("hex")}`;
-            renameSync(STATE_LOCK_FILE, stale);
+            const stale = `${lockPath}.stale.${randomBytes(4).toString("hex")}`;
+            renameSync(lockPath, stale);
             unlinkSync(stale);
             continue; // retry immediately to claim the now-free lock
           }
@@ -270,7 +374,7 @@ function acquireStateLock() {
       } else {
         // Unexpected error (permissions, tmpdir issue): do not block forever —
         // fail-open so the state file still gets written.
-        logErr("state lock acquire error (proceeding unlocked)", err);
+        logErr("lock acquire error (proceeding unlocked)", err);
         return null;
       }
     }
@@ -280,10 +384,10 @@ function acquireStateLock() {
 
 // Ownership-safe release: unlink ONLY while the lock still holds OUR token. A
 // peer that reclaimed an abandoned lock (or a later acquisition) is left alone.
-function releaseStateLock(token) {
+function releaseLock(lockPath, token) {
   try {
-    if (readFileSync(STATE_LOCK_FILE, "utf8") === token) {
-      unlinkSync(STATE_LOCK_FILE);
+    if (readFileSync(lockPath, "utf8") === token) {
+      unlinkSync(lockPath);
     }
   } catch {
     /* already gone / never created -> nothing to release */
@@ -335,15 +439,15 @@ function writeStateFile(
   opts,
 ) {
   try {
-    if (!sessionID) return;
+    if (!sessionID) return false;
     // A poisoned/odd sessionID ("__proto__", "constructor", …) must never be
     // used as an object key: plain assignment through it would mutate the
     // prototype instead of adding an entry (CWE-1321).
     if (!isSafeSessionKey(sessionID)) {
       logErr(`writeStateFile skipped unsafe session key ${oneLine(sessionID)}`);
-      return;
+      return false;
     }
-    const lock = acquireStateLock();
+    const lock = acquireLock(STATE_LOCK_FILE);
     // {ok:false} => busy: skip (value stays in memory, lands next cycle), as
     // before. null => unexpected error: fail-open, write WITHOUT the lock and do
     // NOT release (nothing was acquired — releasing could nuke a peer's lock).
@@ -351,7 +455,7 @@ function writeStateFile(
       logErr(
         `writeStateFile skipped (state lock busy) session=${oneLine(sessionID)}`,
       );
-      return;
+      return false;
     }
     try {
       const bd = breakdownCache.get(sessionID) || null;
@@ -413,6 +517,26 @@ function writeStateFile(
         : null;
       const pc = prevEntry?.categories || null;
 
+      // Which breakdown is allowed to OWN the persisted categories?
+      //
+      // This file is shared by every plugin instance, and the instance that
+      // answers the Desktop RPC (the window's) never serves a model request, so
+      // its `breakdownCache` entry is always the client-context fallback rebuilt
+      // from the persisted message list. That fallback cannot see the assembled
+      // system prompt or the tool schemas, folds their whole mass into `other`,
+      // and after a compaction it can even read an empty conversation. Letting
+      // it overwrite the hook's measurement — the two writes landed 11 ms apart
+      // in the field — produced "system 0 / tool schemas 0 / other inflated" and
+      // could blank user/assistant. So: a hook-family source (see
+      // isHookSource) always wins; the fallback only fills an entry that no hook
+      // has ever measured.
+      //
+      // Legacy entries (written before `source` was persisted) carry no tag, but
+      // only a hook can produce a non-null system / tool-schema estimate.
+      const prevHookMeasured = isHookMeasuredEntry(prevEntry);
+      const bdFromHook = bd != null && isHookSource(bd.source);
+      const useBd = bd != null && (bdFromHook || !prevHookMeasured);
+
       // Resolve the model identity for THIS write. An unmeasured write from a
       // mirror/idle instance may not know the model (its caches were cleared);
       // an unknown model must not overwrite a known one (that would also drop
@@ -453,29 +577,29 @@ function writeStateFile(
 
       // Coerce every persisted category through the safe numeric helpers: the
       // snapshot is untrusted input and must never inject non-numbers.
-      const catUser = bd ? safeCount(bd.userChars) : safeCount(pc?.user);
-      const catAssistant = bd
+      const catUser = useBd ? safeCount(bd.userChars) : safeCount(pc?.user);
+      const catAssistant = useBd
         ? safeCount(bd.assistantChars)
         : safeCount(pc?.assistant);
-      const catReasoning = bd
+      const catReasoning = useBd
         ? safeCount(bd.reasoningChars)
         : safeCount(pc?.reasoning);
-      const catToolArgs = bd
+      const catToolArgs = useBd
         ? safeCount(bd.toolArgsChars)
         : safeCount(pc?.toolArgs);
       // system / tool schemas are hook-only; a fallback breakdown has them null
       // and must not erase a value the hook already persisted.
       const catSystem =
-        bd && bd.systemChars != null
+        useBd && bd.systemChars != null
           ? safeCount(bd.systemChars)
           : safeCountOrNull(pc?.system);
       const catToolSchemas =
-        bd && bd.toolSchemasChars != null
+        useBd && bd.toolSchemasChars != null
           ? safeCount(bd.toolSchemasChars)
           : safeCountOrNull(pc?.toolSchemas);
       // Tool results are counted by both the hook and the fallback path, so
       // this is a plain counted category (never null): a missing value is 0.
-      const catToolOut = bd
+      const catToolOut = useBd
         ? safeCount(bd.toolOutChars)
         : safeCount(pc?.toolOut);
 
@@ -484,7 +608,7 @@ function writeStateFile(
       // split (an empty one means "no tool results now" — do NOT revive a stale
       // peer value); only fall back to the persisted map when this instance has
       // no live breakdown at all.
-      const toolOutByTool = bd
+      const toolOutByTool = useBd
         ? safeToolOutByTool(bd.toolOutByTool)
         : safeToolOutByTool(prevEntry?.toolOutByTool);
 
@@ -492,14 +616,14 @@ function writeStateFile(
       // (keepTarget=false): state.json is a local temp file, but keeping it
       // path-free matches the redacted-export policy. A present breakdown owns
       // the value; otherwise inherit the persisted one.
-      const reclaim = bd
+      const reclaim = useBd
         ? safeReclaim(bd.reclaim, false)
         : safeReclaim(prevEntry?.reclaim, false);
 
       // Heaviest single items still in the request (top-N). A present breakdown
       // OWNS the list; otherwise inherit the persisted one. Persisted WITHOUT
       // targets (path-free policy, same as reclaim).
-      const top = bd
+      const top = useBd
         ? safeTop(bd.top, false)
         : safeTop(prevEntry?.top, false);
 
@@ -528,8 +652,11 @@ function writeStateFile(
         compactStale = true;
       } else if (compactedAt) {
         const cMs = Date.parse(compactedAt);
+        // Only a breakdown that actually OWNS the categories may clear the
+        // mark: a fallback fetch captured after the compaction never measured
+        // the new context, so it must not declare the entry fresh.
         const measuredMs =
-          bd && typeof bd.capturedAt === "number" ? bd.capturedAt : NaN;
+          useBd && typeof bd.capturedAt === "number" ? bd.capturedAt : NaN;
         if (Number.isFinite(cMs) && Number.isFinite(measuredMs)) {
           compactStale = measuredMs <= cMs;
         } else {
@@ -623,6 +750,20 @@ function writeStateFile(
               : null,
         reasoning: safeCount(reasoningTokens),
         categories,
+        // Provenance of the persisted CATEGORIES (never of the token counts):
+        // "context-hook" / "compaction-hook" (V2) and "transform" /
+        // "system-transform" (V1) = a full payload with the system prompt and
+        // the tool schemas; "client-context" / "fallback" = rebuilt from the
+        // persisted messages. The next write reads it to decide which source may
+        // own the categories - see prevHookMeasured above. An untagged breakdown
+        // is treated as a fallback: never claim hook authority by default.
+        source: useBd
+          ? bd.source || "client-context"
+          : prevHookMeasured
+            ? prevEntry.source || "context-hook"
+            : pc
+              ? "snapshot"
+              : null,
         top,
         previous,
         toolOutByTool,
@@ -649,9 +790,10 @@ function writeStateFile(
       // Random temp suffix + exclusive create (CWE-377), then atomic rename.
       const tmp = `${STATE_FILE}.${randomBytes(6).toString("hex")}.tmp`;
       writeFileSync(tmp, JSON.stringify(all), { encoding: "utf8", flag: "wx" });
+      let renamed = false;
       try {
         ensureRegularFile(STATE_FILE); // never rename over a planted symlink
-        renameWithRetry(tmp, STATE_FILE);
+        renamed = renameWithRetry(tmp, STATE_FILE);
       } finally {
         // A rename that exhausted its retries leaves the temp file behind; drop
         // it so repeated failures cannot litter %TEMP% (best-effort: on a
@@ -662,12 +804,14 @@ function writeStateFile(
           /* best-effort cleanup */
         }
       }
+      return renamed;
     } finally {
       // Release ONLY a lock we actually own (lock === null => fail-open, skip).
-      if (lock && lock.ok) releaseStateLock(lock.token);
+      if (lock && lock.ok) releaseLock(STATE_LOCK_FILE, lock.token);
     }
   } catch (err) {
     logErr("writeStateFile failed", err);
+    return false;
   }
 }
 

package/lib/tui-data.js

@@ -22,11 +22,16 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { isSafeSessionKey, sumCategories } from "./estimate.js";
+import { fmt, num } from "./format.js";
 
 // Re-exported so the panel keeps importing it from this module; the
 // implementation is the shared one (lib/estimate.js) — no second copy to drift.
 export { toolOutEntries } from "./estimate.js";
 
+// Same for the number helpers: lib/format.js is pure (no node builtins), so the
+// Desktop GUI bundle can inline it, while the panel keeps importing them here.
+export { fmt, num };
+
 export const STATE_FILE =
   process.env.OPENCODE_CONTEXT_INDICATOR_STATE_FILE ||
   join(tmpdir(), "opencode-context-indicator-state.json");
@@ -123,15 +128,6 @@ export function collectFamily(snapshot, rootID) {
   return out
 }
 
-export function fmt(n) {
-  if (!Number.isFinite(n)) return "0"
-  return n >= 1000 ? `${(n / 1000).toFixed(1)}k` : String(Math.round(n))
-}
-
-export function num(v) {
-  return typeof v === "number" && Number.isFinite(v) ? v : 0
-}
-
 // Code-point-safe column fit: truncate on code points (never splitting a
 // surrogate pair at a column boundary), mark a truncated cell with a trailing
 // "~" so clipping is VISIBLE (a silently clipped cell reads as two columns

package/lib/v1.js

@@ -6,7 +6,7 @@
 // fallback, subagent aggregation, and the live log assembly). Extracted 1:1
 // (code + WHY comments) from index.js.
 
-import { estJson, estimateTokens, fmt, tokenCountOf } from "./estimate.js";
+import { estJson, estimateTokens, fmt, isHookSource, tokenCountOf } from "./estimate.js";
 import {
   BREAKDOWN_THROTTLE_MS,
   breakdownCache,
@@ -624,7 +624,14 @@ function makeV1(client) {
           ...prev,
           systemChars,
           capturedAt: Date.now(),
-          source: prev.source || "system-transform",
+          // Keep the provenance of a HOOK-family source only. A `fallback`
+          // record (built from session.messages on idle) can also sit in this
+          // cache: tagging the hook's system measurement with it would persist
+          // a non-null system prompt under a NON-hook `source`, which the
+          // authority rule (isHookMeasuredEntry) would then treat as
+          // overwritable by the next message-based fallback - the exact
+          // "system 0 / other inflated" defect, from the V1 side.
+          source: isHookSource(prev.source) ? prev.source : "system-transform",
         });
         pruneMap(breakdownCache, MAX_TRACKED_SESSIONS);
       } catch (err) {