openzoo 0.49.8 → 0.49.9

package/lib/proxy.js

@@ -20,7 +20,11 @@ import {
   corpusRecall,
   decideChatSpill, isOneShotCorpusAsk,
 } from './spill.js';
-import { rewritablePath, modelsListForRequest, ALIAS_IDS, rewriteChatModel, zooModelIds, CLASSIFY_MAX_TOKENS } from './models.js';
+import { rewritablePath, modelsListForRequest, isHarnessAliasId, rewriteChatModel, zooModelIds, CLASSIFY_MAX_TOKENS, raiseReasoningMaxTokens, isAutoModel } from './models.js';
+import {
+  route as routeTask, routeChatBody, fallbackChain, isRetryableStatus,
+  outcomeFromResponse, recordRouteOutcome, autoModelListEntry,
+} from './modelroute.js';
 import { forgetContext } from './contexts.js';
 import { injectBrief } from './brief.js';
 import { withNamespace } from './namespace.js';
@@ -33,6 +37,7 @@ import { priceHoldings } from './livestatus.js';
 import { receiptUsedCogs, receiptDirectUsd, pairActualBilled } from './racesettle.js';
 import { rewriteWrapClientError } from './wrap.js';
 import { fetchHeaders } from './fetch.js';
+import { relay } from './relay.js';
 
 const HOP_BY_HOP = new Set([
   'host', 'connection', 'keep-alive', 'transfer-encoding', 'upgrade',
@@ -82,46 +87,6 @@ async function readBody(req) {
   return Buffer.concat(chunks);
 }
 
-/** Pipe an upstream fetch Response to the client, unbuffered (SSE-safe).
- *
- *  `onReceipt` is called with the gateway's x402 block when it arrives. On a
- *  STREAMED call there is no JSON body to carry that block, so the gateway
- *  emits it as an SSE COMMENT (`: x402 {...}`) after the last frame — comments
- *  are discarded by every compliant client, so nothing downstream sees it, but
- *  without reading it here every spend and savings figure on the status line
- *  would silently read zero the moment real streaming was switched on.
- *
- *  Sniffing NEVER delays a byte: each chunk is written to the client first and
- *  only then scanned. */
-function relay(res, upstream, onReceipt) {
-  const headers = {};
-  upstream.headers.forEach((v, k) => {
-    if (!['transfer-encoding', 'connection', 'content-encoding', 'content-length'].includes(k)) headers[k] = v;
-  });
-  res.writeHead(upstream.status, headers);
-  if (!upstream.body) { res.end(); return Promise.resolve(); }
-  const sse = (upstream.headers.get('content-type') || '').includes('text/event-stream');
-  return new Promise((resolve) => {
-    const body = Readable.fromWeb(upstream.body);
-    body.on('error', () => res.destroy());
-    res.on('close', () => body.destroy());
-    body.on('end', resolve);
-    if (!sse || typeof onReceipt !== 'function') { body.pipe(res); return; }
-    let pending = '';
-    body.on('data', (c) => {
-      res.write(c);
-      pending += c.toString('utf8');
-      const lines = pending.split('\n');
-      pending = lines.pop() ?? '';   // a comment can straddle two chunks
-      for (const line of lines) {
-        if (!line.startsWith(': x402 ')) continue;
-        try { onReceipt(JSON.parse(line.slice(7))); } catch { /* not our frame */ }
-      }
-    });
-    body.on('end', () => res.end());
-  });
-}
-
 function jsonErr(res, status, message, extraFields = {}) {
   res.writeHead(status, { 'content-type': 'application/json' });
   res.end(JSON.stringify({ error: { message }, ...extraFields }));
@@ -814,6 +779,9 @@ async function maybeCacheCorpus(req, bodyBuf, log, stats, extra = {}) {
  * default, so localhost behaviour is unchanged.
  */
 export async function startProxy({ silent = false, requireToken = null, sessionMaxUsd = null, autoTunnel = false } = {}) {
+  // grokui's packed sidecar spawn sets OPENZOO_SILENT=1 so 400s land in
+  // ~/.openzoo/proxy.log instead of Electron's inherited /dev/null.
+  if (process.env.OPENZOO_SILENT === '1') silent = true;
   const client = new PayClient();
   const log = silent ? () => {} : (...a) => console.log(...a);
   // ALWAYS-ON. `silent: true` is used by the editor path to keep startup tidy,
@@ -1197,6 +1165,35 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       return;
     }
 
+    // Local decision � no upstream, no payment. Same keys as Python route().
+    {
+      const routePath = (req.url || '').split('?')[0];
+      if (req.method === 'POST' && (routePath === '/route' || routePath === '/v1/route')) {
+        let payload;
+        try { payload = JSON.parse(bodyBuf.toString('utf8') || '{}'); } catch {
+          jsonErr(res, 400, 'invalid /route body');
+          return;
+        }
+        try {
+          const r = routeTask(payload.text ?? '', {
+            allow_free: payload.allow_free ?? false,
+            bindable: payload.bindable ?? true,
+            context: payload.context,
+            input_tokens: payload.input_tokens,
+            has_image: payload.has_image,
+            needs_tools: payload.needs_tools,
+            needs_json: payload.needs_json,
+            ...(payload.constraints && typeof payload.constraints === 'object' ? payload.constraints : {}),
+          });
+          res.writeHead(200, { 'content-type': 'application/json' });
+          res.end(JSON.stringify(r));
+        } catch (err) {
+          jsonErr(res, 500, `openzoo /route: ${err.message}`);
+        }
+        return;
+      }
+    }
+
     // ANTHROPIC MESSAGES SHAPE. A harness pointed here via ANTHROPIC_BASE_URL
     // (Claude Code, the Anthropic SDKs) speaks POST /v1/messages, not chat
     // completions — this is how such a harness routes its inference through
@@ -1299,6 +1296,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     // carries a model field, not just chat/completions, so /completions,
     // /responses and future shapes all work. Never silent.
     let wantsStream = false;
+    let autoRoute = null;
       if ((req.url || '').includes('/chat/completions') && req.method === 'POST') {
         servedRequests += 1;
         say(`\n<- request #${servedRequests} from ${(req.headers['user-agent'] || 'unknown').slice(0, 40)}`);
@@ -1332,6 +1330,26 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         try { ids = await zooModelIds(); } catch { /* catalog miss: still skip the floor on a tiny classify */ }
         const policy = rewriteChatModel(parsed, ids, { bodyLen: bodyBuf.length });
         parsed = policy.parsed;
+        if (!policy.tiny && (policy.auto || isAutoModel(parsed?.model))) {
+          autoRoute = routeChatBody(parsed, {
+            allow_free: false,
+            bindable: true,
+            // Live quoteable ids only � Auto must never emit :batch / $0 /
+            // missing-price rows that 500 `bad openrouter price` on Fly.
+            ...(ids.length ? { allow_ids: ids } : {}),
+          });
+          if (!autoRoute.model) {
+            jsonErr(res, 422, autoRoute.reason || 'openzoo/auto: no feasible model', { route: autoRoute });
+            return;
+          }
+          parsed = { ...parsed, model: autoRoute.model };
+          const bump = raiseReasoningMaxTokens(parsed);
+          parsed = bump.parsed;
+          say(`openzoo/auto -> ${autoRoute.model} p=${autoRoute.p_success} cleared=${autoRoute.cleared_bar} ${autoRoute.task_class}${autoRoute.bind_first ? ' bind_first' : ''}`);
+          if (!autoRoute.cleared_bar) {
+            say(`openzoo/auto cleared_bar=false � strongest fallback, not a normal pick`);
+          }
+        }
         if (policy.tiny) {
           // `openzoo claude` starts us silent � `log` is a no-op then. say()
           // is the proxy.log channel and never the Claude Code TTY.
@@ -1381,7 +1399,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
             log(`reasoning model ${parsed.model}: max_tokens ${policy.raisedFrom} -> ${policy.raisedTo} (thinking shares the budget; OPENZOO_REASONING_MAX_TOKENS_X=1 disables)`);
           }
         }
-        if (policy.tiny || policy.raised || (policy.to && policy.to !== policy.from)) {
+        if (policy.tiny || policy.raised || autoRoute || (policy.to && policy.to !== policy.from)) {
           bodyBuf = Buffer.from(JSON.stringify(parsed));
         }
         // Tell the agent what it is actually connected to — in band, where it
@@ -1508,9 +1526,9 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         const response = await fetchHeaders(url, init);
         if (response.ok) {
           const payload = await response.json();
-          // Full zoo catalog � never collapse to a single opus-5 or a claude-*
-          // allowlist. Claude Code (ANTHROPIC_BASE_URL + gateway discovery) reads
-          // data[].id / display_name; OpenAI clients keep object:"list".
+          // Quoteable catalog only. Raw OpenRouter dump includes :batch,
+          // $0 / missing prices, and we used to mint openzoo-* twins of each
+          // � Claude Code /model then showed 63 clones and Auto 500'd.
           res.writeHead(200, { 'content-type': 'application/json' });
           res.end(JSON.stringify(modelsListForRequest(payload, req.headers)));
           return;
@@ -1522,7 +1540,12 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       return;
     }
     const probe = req.method === 'GET' && /^\/v1\/models\/(.+)$/.exec(path);
-    if (probe && ALIAS_IDS.includes(decodeURIComponent(probe[1]))) {
+    if (probe && isAutoModel(decodeURIComponent(probe[1]))) {
+      res.writeHead(200, { 'content-type': 'application/json' });
+      res.end(JSON.stringify(autoModelListEntry()));
+      return;
+    }
+    if (probe && isHarnessAliasId(decodeURIComponent(probe[1]))) {
       res.writeHead(200, { 'content-type': 'application/json' });
       res.end(JSON.stringify({ id: decodeURIComponent(probe[1]), object: 'model', owned_by: 'openzoo-alias' }));
       return;
@@ -1592,6 +1615,32 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       } else {
         result = await client.fetch(url, init);
       }
+      // Walk the auto shortlist on 429/5xx � cheapest-first among models that
+      // cleared the bar. Finite: one pass over fallbackChain(), never a loop.
+      if (autoRoute?.cleared_bar && isRetryableStatus(result.response.status)) {
+        const chain = fallbackChain(autoRoute);
+        for (const next of chain) {
+          const failed = result.response.status;
+          try { await result.response.arrayBuffer(); } catch { /* drain */ }
+          say(`openzoo/auto fallback HTTP ${failed} -> ${next}`);
+          const rewriteModel = (buf) => {
+            try {
+              const b = JSON.parse(buf.toString('utf8'));
+              b.model = next;
+              return Buffer.from(JSON.stringify(b));
+            } catch { return buf; }
+          };
+          bodyBuf = rewriteModel(bodyBuf);
+          init.body = bodyBuf;
+          if (cached) {
+            cached = { ...cached, body: rewriteModel(cached.body) };
+            result = await send(cached.body, cached.contextId, cached.topK, corpusCharsForSend(boundChars, cached.contextId, cached.corpus?.length));
+          } else {
+            result = await client.fetch(url, { ...init, body: bodyBuf });
+          }
+          if (!isRetryableStatus(result.response.status)) break;
+        }
+      }
       const { response, paid, receipt } = result;
       if (paid && receipt) {
         if (receipt.ok && typeof receipt.billedUsd === 'number') {
@@ -1636,6 +1685,13 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       // that contract ourselves. An upstream that someday truly streams (SSE
       // content-type) passes straight through the relay below, untouched.
       const upCt = response.headers.get('content-type') || '';
+      const noteAutoOutcome = (status, data, streamed = false) => {
+        if (!autoRoute) return;
+        let ok = outcomeFromResponse(status, data);
+        if (ok == null) return;
+        if (streamed && status >= 200 && status < 300) ok = true;
+        recordRouteOutcome(autoRoute, ok);
+      };
       if (isChat && response.ok && upCt.includes('application/json')) {
         let data = null;
         try { data = await response.clone().json(); } catch { /* not JSON after all */ }
@@ -1694,6 +1750,7 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
           say(`credit -> $${x.billedUsd.toFixed(6)}  ·  session $${sessionSpent.toFixed(6)}`);
         }
         if (data?.object === 'chat.completion') {
+          noteAutoOutcome(response.status, data);
           if (rKey) replayPut(rKey, data, response.headers.get('x-payment-response'));
           // Anthropic-shaped caller gets an Anthropic-shaped answer, streamed
           // or not, so Claude Code and the SDKs parse it natively.
@@ -1792,6 +1849,9 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         return;
       }
 
+      if (autoRoute) {
+        noteAutoOutcome(response.status, null, (upCt.includes('text/event-stream') && response.ok));
+      }
       await relay(res, response, meterStreamed);
     } catch (err) {
       if (err instanceof QuoteTooHighError) {

package/lib/relay.js

@@ -0,0 +1,275 @@
+/**
+ * Pipe an upstream fetch Response to the client.
+ *
+ * Fly (and other CDNs) gzip error bodies. Node fetch does not always inflate
+ * those — MEASURED: a 400 from x402-tokens.fly.dev arrived still gzip-wrapped
+ * with `Content-Encoding: gzip`. The old relay stripped that header and
+ * `Content-Length`, then piped `response.body` RAW. Claude Code printed
+ * `API Error: 400` plus diamond/binary mojibake.
+ *
+ * Contract: never emit a compressed body without Content-Encoding. Prefer
+ * decompressing so the client sees application/json or text (Claude CLI can
+ * parse the error). Unknown encodings keep the header and the bytes together.
+ */
+import zlib from 'node:zlib';
+import { promisify } from 'node:util';
+import { Readable, PassThrough } from 'node:stream';
+
+const gunzipAsync = promisify(zlib.gunzip);
+const inflateAsync = promisify(zlib.inflate);
+const inflateRawAsync = promisify(zlib.inflateRaw);
+const brotliAsync = promisify(zlib.brotliDecompress);
+
+const HOP = new Set(['transfer-encoding', 'connection', 'content-length']);
+
+export function looksGzip(buf) {
+  return Buffer.isBuffer(buf) && buf.length >= 2 && buf[0] === 0x1f && buf[1] === 0x8b;
+}
+
+function headerEncoding(headers) {
+  return String(headers?.get?.('content-encoding') || '').trim();
+}
+
+/** Single known codec, or null if identity / absent / unknown / stacked. */
+export function knownCodec(encoding) {
+  const parts = String(encoding || '')
+    .split(',')
+    .map((s) => s.trim().toLowerCase())
+    .filter((s) => s && s !== 'identity');
+  if (parts.length !== 1) return null;
+  if (parts[0] === 'gzip' || parts[0] === 'x-gzip') return 'gzip';
+  if (parts[0] === 'deflate') return 'deflate';
+  if (parts[0] === 'br') return 'br';
+  return null;
+}
+
+export async function inflateEncoded(buf, encoding) {
+  const codec = knownCodec(encoding) || (looksGzip(buf) ? 'gzip' : null);
+  if (!codec) return buf;
+  // Leftover Content-Encoding after fetch already inflated: do not gunzip JSON.
+  if (codec === 'gzip' && !looksGzip(buf)) return buf;
+  try {
+    if (codec === 'gzip') return await gunzipAsync(buf);
+    if (codec === 'br') return await brotliAsync(buf);
+    try {
+      return await inflateAsync(buf);
+    } catch {
+      return await inflateRawAsync(buf);
+    }
+  } catch (err) {
+    if (!looksBinary(buf)) return buf;
+    throw err;
+  }
+}
+
+function looksBinary(buf) {
+  if (!buf || !buf.length) return false;
+  if (looksGzip(buf)) return true;
+  const n = Math.min(buf.length, 256);
+  let ctrl = 0;
+  for (let i = 0; i < n; i++) {
+    const c = buf[i];
+    if (c === 0 || c < 8 || (c > 13 && c < 32)) ctrl += 1;
+  }
+  return ctrl >= 4;
+}
+
+function copyHeaders(upstream, { decoded }) {
+  const headers = {};
+  upstream.headers.forEach((v, k) => {
+    const key = String(k).toLowerCase();
+    if (HOP.has(key)) return;
+    // Drop Content-Encoding only when the bytes we send are already inflated.
+    if (decoded && key === 'content-encoding') return;
+    headers[k] = v;
+  });
+  return headers;
+}
+
+function preferReadableType(headers, buf) {
+  const ct = String(headers['content-type'] || '');
+  if (ct && !/octet-stream|(?:x-)?gzip|br\b/i.test(ct)) return;
+  const c = buf[0];
+  headers['content-type'] = (c === 0x7b || c === 0x5b)
+    ? 'application/json; charset=utf-8'
+    : 'text/plain; charset=utf-8';
+}
+
+function jsonUpstreamErr(res, status) {
+  res.writeHead(status || 502, { 'content-type': 'application/json' });
+  res.end(JSON.stringify({ error: { message: `upstream HTTP ${status || 502}` } }));
+}
+
+async function readBody(upstream) {
+  if (!upstream.body) return Buffer.alloc(0);
+  const chunks = [];
+  for await (const c of Readable.fromWeb(upstream.body)) chunks.push(c);
+  return Buffer.concat(chunks);
+}
+
+/**
+ * Non-OK: buffer, inflate gzip/br/deflate (or gzip-magic with no header),
+ * send uncompressed JSON/text. Never forward gzip bytes with the encoding
+ * header stripped. Un-decodable compressed bodies become a short JSON error
+ * so Claude / grokui do not paint diamond mojibake — the canvas fold to
+ * `upstream HTTP 400` lives in #65; we just refuse to emit the binary.
+ */
+async function relayError(res, upstream) {
+  const encoding = headerEncoding(upstream.headers);
+  const codec = knownCodec(encoding);
+  let buf;
+  try {
+    buf = await readBody(upstream);
+  } catch {
+    jsonUpstreamErr(res, upstream.status);
+    return;
+  }
+
+  if (codec || looksGzip(buf)) {
+    try {
+      buf = await inflateEncoded(buf, encoding);
+    } catch {
+      jsonUpstreamErr(res, upstream.status);
+      return;
+    }
+    if (looksBinary(buf)) {
+      jsonUpstreamErr(res, upstream.status);
+      return;
+    }
+    const headers = copyHeaders(upstream, { decoded: true });
+    preferReadableType(headers, buf);
+    res.writeHead(upstream.status, headers);
+    res.end(buf);
+    return;
+  }
+
+  if (encoding && !codec) {
+    // Unknown / stacked coding: keep the label with the bytes.
+    res.writeHead(upstream.status, copyHeaders(upstream, { decoded: false }));
+    res.end(buf);
+    return;
+  }
+
+  if (looksBinary(buf)) {
+    jsonUpstreamErr(res, upstream.status);
+    return;
+  }
+  const headers = copyHeaders(upstream, { decoded: true });
+  preferReadableType(headers, buf);
+  res.writeHead(upstream.status, headers);
+  res.end(buf);
+}
+
+function createDecoder(codec) {
+  if (codec === 'gzip') return zlib.createGunzip();
+  if (codec === 'deflate') return zlib.createInflate();
+  if (codec === 'br') return zlib.createBrotliDecompress();
+  return null;
+}
+
+function prependChunk(chunk, rest) {
+  const out = new PassThrough();
+  out.write(chunk);
+  rest.pipe(out);
+  return out;
+}
+
+function attachBody(res, body, onReceipt, sse, resolve) {
+  body.on('error', () => res.destroy());
+  res.on('close', () => body.destroy());
+  if (!sse || typeof onReceipt !== 'function') {
+    body.pipe(res);
+    body.on('end', resolve);
+    return;
+  }
+  let pending = '';
+  body.on('data', (c) => {
+    res.write(c);
+    pending += c.toString('utf8');
+    const lines = pending.split('\n');
+    pending = lines.pop() ?? '';
+    for (const line of lines) {
+      if (!line.startsWith(': x402 ')) continue;
+      try { onReceipt(JSON.parse(line.slice(7))); } catch { /* not our frame */ }
+    }
+  });
+  body.on('end', () => { res.end(); resolve(); });
+}
+
+/**
+ * 2xx stream. Uncompressed (the cheap Fly 200) is the old pipe. Encoded
+ * bodies are inflated when we know the codec, otherwise the encoding
+ * header stays with the bytes.
+ */
+function relayOk(res, upstream, onReceipt) {
+  const encoding = headerEncoding(upstream.headers);
+  const codec = knownCodec(encoding);
+  const sse = (upstream.headers.get('content-type') || '').includes('text/event-stream');
+
+  return new Promise((resolve) => {
+    const raw = Readable.fromWeb(upstream.body);
+    raw.on('error', () => res.destroy());
+    res.on('close', () => raw.destroy());
+
+    if (!encoding) {
+      res.writeHead(upstream.status, copyHeaders(upstream, { decoded: true }));
+      attachBody(res, raw, onReceipt, sse, resolve);
+      return;
+    }
+
+    // Peek so a leftover Content-Encoding on already-plain bytes is stripped,
+    // and a real gzip body is never sent naked.
+    let decided = false;
+    raw.once('data', (chunk) => {
+      if (decided) return;
+      decided = true;
+      const head = Buffer.from(chunk);
+      const gzip = looksGzip(head);
+      if (gzip || (codec && codec !== 'gzip')) {
+        const dec = codec ? createDecoder(codec) : zlib.createGunzip();
+        if (!dec) {
+          res.writeHead(upstream.status, copyHeaders(upstream, { decoded: false }));
+          attachBody(res, prependChunk(head, raw), onReceipt, sse, resolve);
+          return;
+        }
+        dec.write(head);
+        raw.pipe(dec);
+        res.writeHead(upstream.status, copyHeaders(upstream, { decoded: true }));
+        attachBody(res, dec, onReceipt, sse, resolve);
+        return;
+      }
+      // Header leftover on plain JSON/SSE — drop encoding, replay the peek.
+      res.writeHead(upstream.status, copyHeaders(upstream, { decoded: true }));
+      attachBody(res, prependChunk(head, raw), onReceipt, sse, resolve);
+    });
+    raw.once('end', () => {
+      if (decided) return;
+      decided = true;
+      res.writeHead(upstream.status, copyHeaders(upstream, { decoded: true }));
+      res.end();
+      resolve();
+    });
+  });
+}
+
+/** Pipe an upstream fetch Response to the client, unbuffered (SSE-safe).
+ *
+ *  `onReceipt` is called with the gateway's x402 block when it arrives. On a
+ *  STREAMED call there is no JSON body to carry that block, so the gateway
+ *  emits it as an SSE COMMENT (`: x402 {...}`) after the last frame —
+ *  comments are discarded by every compliant client, so nothing downstream
+ *  sees it, but without reading it here every spend and savings figure on
+ *  the status line would silently read zero the moment real streaming was
+ *  switched on.
+ *
+ *  Sniffing NEVER delays a byte: each chunk is written to the client first
+ *  and only then scanned. */
+export function relay(res, upstream, onReceipt) {
+  if (!upstream.body) {
+    res.writeHead(upstream.status, copyHeaders(upstream, { decoded: true }));
+    res.end();
+    return Promise.resolve();
+  }
+  if (!upstream.ok) return relayError(res, upstream);
+  return relayOk(res, upstream, onReceipt);
+}

package/lib/runguard.js

@@ -0,0 +1,31 @@
+/** Pin find(1) to the thread cwd. Unbounded `find /` is a full-disk walk. */
+import path from 'node:path';
+
+export const FIND_MAXDEPTH = Number(process.env.OZ_FIND_MAXDEPTH || 8);
+
+export function guardFindCwd(command, cwd = '.') {
+  if (typeof command !== 'string' || !command) return command;
+  if (!/(?:^|[\s;|&(`])find(?:\s|$)/.test(command)) return command;
+  const root = path.resolve(cwd || '.');
+  return command.replace(/(^|[\s;|&(`])((?:sudo\s+)?)find(\s+)([^;&|`\n]*)/g, (m, pre, sudo, sp, args) => {
+    const tokens = args.match(/"[^"]*"|'[^']*'|\S+/g) || [];
+    const paths = [];
+    let i = 0;
+    while (i < tokens.length && !String(tokens[i]).startsWith('-')) {
+      paths.push(tokens[i]);
+      i++;
+    }
+    const rest = tokens.slice(i);
+    const hasMax = rest.some((t) => t === '-maxdepth');
+    const pin = (raw) => {
+      const unquoted = String(raw).replace(/^['"]|['"]$/g, '');
+      if (!unquoted || unquoted === '.' || unquoted === './') return '.';
+      const abs = path.resolve(root, unquoted);
+      const inside = abs === root || abs.startsWith(root + path.sep);
+      return inside ? raw : '.';
+    };
+    const newPaths = (paths.length ? paths.map(pin) : ['.']);
+    const depth = hasMax ? [] : ['-maxdepth', String(FIND_MAXDEPTH)];
+    return `${pre}${sudo}find${sp}${[...newPaths, ...depth, ...rest].join(' ')}`;
+  });
+}

package/lib/spill.js

@@ -1916,7 +1916,15 @@ function emptySpillDecision(msgs, reason) {
 export function decideChatSpill(body, opts = {}) {
   const msgs = Array.isArray(body?.messages) ? body.messages : null;
   if (!msgs?.length) return emptySpillDecision(msgs, 'no-messages');
-  const minChars = opts.minPrefixChars ?? SPILL_MIN_PREFIX_CHARS;
+  let minChars = opts.minPrefixChars ?? SPILL_MIN_PREFIX_CHARS;
+  const dx = Number(opts.dollarX);
+  const model = String(body?.model || '').trim().toLowerCase();
+  const auto = model === 'openzoo/auto' || model === 'openzoo-auto' || model === 'auto';
+  // Thin HUD / Auto: bind way earlier than 16k. 2.1x session is cheap-model
+  // vs cheap-model because the prefix never cleared the gate.
+  if (auto || (Number.isFinite(dx) && dx > 0 && dx < 5)) {
+    minChars = Math.min(minChars, 2048);
+  }
 
   if (isOneShotCorpusAsk(msgs, minChars)) {
     const last = msgs[msgs.length - 1];