pi-openai-toolkit 0.14.5 → 0.14.7

package/src/auto-mode/transcript.ts

@@ -1,133 +1,133 @@
-import type { SessionEntry } from "@earendil-works/pi-coding-agent";
-import {
-	boundReviewText,
-	MAX_TRANSCRIPT_CHARS,
-	MAX_TRANSCRIPT_ENTRY_CHARS,
-	MAX_TRANSCRIPT_RECENT_ENTRIES,
-	MAX_TRANSCRIPT_TOOL_CHARS,
-	TRUNCATION_MARKER,
-} from "./types";
-
-/**
- * A transcript line already reduced to text, with the role kept so the reviewer can
- * tell whose words these are. `[user]` is the only role that carries authorization.
- */
-export type TranscriptLine = {
-	role: "user" | "assistant" | "tool";
-	text: string;
-};
-
-function textOfContent(content: unknown): string {
-	if (typeof content === "string") return content;
-	if (!Array.isArray(content)) return "";
-	return content
-		.map((block) => {
-			if (!block || typeof block !== "object") return "";
-			const record = block as Record<string, unknown>;
-			if (record.type === "text" && typeof record.text === "string") return record.text;
-			if (record.type === "image") return "[image omitted]";
-			if (record.type === "toolCall" && typeof record.name === "string") {
-				const args = record.arguments;
-				return `${record.name} ${typeof args === "object" && args ? JSON.stringify(args) : ""}`.trim();
-			}
-			return "";
-		})
-		.filter(Boolean)
-		.join("\n")
-		.trim();
-}
-
-/**
- * Flatten session entries into reviewer lines. Non-message entries are skipped,
- * except a compaction summary, which is kept as a `[user]`-adjacent context marker
- * because it is the only surviving view of the older conversation.
- */
-export function sessionEntriesToLines(entries: readonly SessionEntry[]): TranscriptLine[] {
-	const lines: TranscriptLine[] = [];
-	for (const entry of entries) {
-		if (entry.type === "compaction" && typeof entry.summary === "string") {
-			const summary = boundReviewText(entry.summary, MAX_TRANSCRIPT_ENTRY_CHARS);
-			if (summary) lines.push({ role: "assistant", text: `[earlier conversation summary] ${summary}` });
-			continue;
-		}
-		if (entry.type !== "message") continue;
-		const message = entry.message as { role?: unknown; content?: unknown };
-		const text = textOfContent(message.content);
-		if (!text) continue;
-		if (message.role === "user") lines.push({ role: "user", text });
-		else if (message.role === "assistant") lines.push({ role: "assistant", text });
-		else if (message.role === "toolResult") lines.push({ role: "tool", text });
-	}
-	return lines;
-}
-
-function renderLine(index: number, line: TranscriptLine): string {
-	const body = boundReviewText(line.text, MAX_TRANSCRIPT_ENTRY_CHARS);
-	return `[${index}] [${line.role}]: ${body}`;
-}
-
-/**
- * Build a bounded transcript the way Codex's guardian does: user turns are the
- * anchors and are protected, tool and assistant evidence gets its own smaller
- * budget so verbose command output cannot crowd out the human conversation that
- * actually establishes authorization.
- *
- * Selection order is newest-first, then rendered in chronological order.
- */
-export function buildReviewTranscript(
-	lines: readonly TranscriptLine[],
-	budgets: {
-		maxTotalChars?: number;
-		maxToolChars?: number;
-		maxRecentEntries?: number;
-	} = {},
-): { text: string; omitted: boolean } {
-	const maxTotalChars = budgets.maxTotalChars ?? MAX_TRANSCRIPT_CHARS;
-	const maxToolChars = budgets.maxToolChars ?? MAX_TRANSCRIPT_TOOL_CHARS;
-	const maxRecentEntries = budgets.maxRecentEntries ?? MAX_TRANSCRIPT_RECENT_ENTRIES;
-
-	const recent = lines.slice(-Math.max(1, maxRecentEntries));
-	const omitted = recent.length < lines.length;
-
-	const userLines: number[] = [];
-	const otherLines: number[] = [];
-	recent.forEach((line, index) => {
-		if (line.role === "user") userLines.push(index);
-		else otherLines.push(index);
-	});
-
-	const selected = new Set<number>();
-	let userChars = 0;
-	// The first user turn carries the task; the latest carries the immediate ask.
-	for (const index of [userLines[0]!, userLines[userLines.length - 1]!, ...userLines.slice(1, -1).reverse()]) {
-		if (index === undefined || selected.has(index)) continue;
-		const cost = recent[index]!.text.length;
-		if (userChars + cost > maxTotalChars) break;
-		selected.add(index);
-		userChars += cost;
-	}
-
-	let toolChars = 0;
-	for (const index of [...otherLines].reverse()) {
-		const cost = recent[index]!.text.length;
-		if (toolChars + cost > maxToolChars) continue;
-		if (userChars + toolChars + cost > maxTotalChars) continue;
-		selected.add(index);
-		toolChars += cost;
-	}
-
-	const ordered = [...selected].sort((a, b) => a - b);
-	const rendered = ordered.map((index) => renderLine(index + 1, recent[index]!));
-	if (omitted) rendered.unshift(`${TRUNCATION_MARKER} earlier conversation entries were omitted.`);
-	return { text: rendered.join("\n"), omitted };
-}
-
-/**
- * Build the reviewer transcript straight from session entries.
- */
-export function transcriptFromEntries(
-	entries: readonly SessionEntry[],
-	budgets?: Parameters<typeof buildReviewTranscript>[1],
-): { text: string; omitted: boolean } {
-	return buildReviewTranscript(sessionEntriesToLines(entries), budgets);
-}
+import type { SessionEntry } from "@earendil-works/pi-coding-agent";
+import {
+	boundReviewText,
+	MAX_TRANSCRIPT_CHARS,
+	MAX_TRANSCRIPT_ENTRY_CHARS,
+	MAX_TRANSCRIPT_RECENT_ENTRIES,
+	MAX_TRANSCRIPT_TOOL_CHARS,
+	TRUNCATION_MARKER,
+} from "./types";
+
+/**
+ * A transcript line already reduced to text, with the role kept so the reviewer can
+ * tell whose words these are. `[user]` is the only role that carries authorization.
+ */
+export type TranscriptLine = {
+	role: "user" | "assistant" | "tool";
+	text: string;
+};
+
+function textOfContent(content: unknown): string {
+	if (typeof content === "string") return content;
+	if (!Array.isArray(content)) return "";
+	return content
+		.map((block) => {
+			if (!block || typeof block !== "object") return "";
+			const record = block as Record<string, unknown>;
+			if (record.type === "text" && typeof record.text === "string") return record.text;
+			if (record.type === "image") return "[image omitted]";
+			if (record.type === "toolCall" && typeof record.name === "string") {
+				const args = record.arguments;
+				return `${record.name} ${typeof args === "object" && args ? JSON.stringify(args) : ""}`.trim();
+			}
+			return "";
+		})
+		.filter(Boolean)
+		.join("\n")
+		.trim();
+}
+
+/**
+ * Flatten session entries into reviewer lines. Non-message entries are skipped,
+ * except a compaction summary, which is kept as a `[user]`-adjacent context marker
+ * because it is the only surviving view of the older conversation.
+ */
+export function sessionEntriesToLines(entries: readonly SessionEntry[]): TranscriptLine[] {
+	const lines: TranscriptLine[] = [];
+	for (const entry of entries) {
+		if (entry.type === "compaction" && typeof entry.summary === "string") {
+			const summary = boundReviewText(entry.summary, MAX_TRANSCRIPT_ENTRY_CHARS);
+			if (summary) lines.push({ role: "assistant", text: `[earlier conversation summary] ${summary}` });
+			continue;
+		}
+		if (entry.type !== "message") continue;
+		const message = entry.message as { role?: unknown; content?: unknown };
+		const text = textOfContent(message.content);
+		if (!text) continue;
+		if (message.role === "user") lines.push({ role: "user", text });
+		else if (message.role === "assistant") lines.push({ role: "assistant", text });
+		else if (message.role === "toolResult") lines.push({ role: "tool", text });
+	}
+	return lines;
+}
+
+function renderLine(index: number, line: TranscriptLine): string {
+	const body = boundReviewText(line.text, MAX_TRANSCRIPT_ENTRY_CHARS);
+	return `[${index}] [${line.role}]: ${body}`;
+}
+
+/**
+ * Build a bounded transcript the way Codex's guardian does: user turns are the
+ * anchors and are protected, tool and assistant evidence gets its own smaller
+ * budget so verbose command output cannot crowd out the human conversation that
+ * actually establishes authorization.
+ *
+ * Selection order is newest-first, then rendered in chronological order.
+ */
+export function buildReviewTranscript(
+	lines: readonly TranscriptLine[],
+	budgets: {
+		maxTotalChars?: number;
+		maxToolChars?: number;
+		maxRecentEntries?: number;
+	} = {},
+): { text: string; omitted: boolean } {
+	const maxTotalChars = budgets.maxTotalChars ?? MAX_TRANSCRIPT_CHARS;
+	const maxToolChars = budgets.maxToolChars ?? MAX_TRANSCRIPT_TOOL_CHARS;
+	const maxRecentEntries = budgets.maxRecentEntries ?? MAX_TRANSCRIPT_RECENT_ENTRIES;
+
+	const recent = lines.slice(-Math.max(1, maxRecentEntries));
+	const omitted = recent.length < lines.length;
+
+	const userLines: number[] = [];
+	const otherLines: number[] = [];
+	recent.forEach((line, index) => {
+		if (line.role === "user") userLines.push(index);
+		else otherLines.push(index);
+	});
+
+	const selected = new Set<number>();
+	let userChars = 0;
+	// The first user turn carries the task; the latest carries the immediate ask.
+	for (const index of [userLines[0]!, userLines[userLines.length - 1]!, ...userLines.slice(1, -1).reverse()]) {
+		if (index === undefined || selected.has(index)) continue;
+		const cost = recent[index]!.text.length;
+		if (userChars + cost > maxTotalChars) break;
+		selected.add(index);
+		userChars += cost;
+	}
+
+	let toolChars = 0;
+	for (const index of [...otherLines].reverse()) {
+		const cost = recent[index]!.text.length;
+		if (toolChars + cost > maxToolChars) continue;
+		if (userChars + toolChars + cost > maxTotalChars) continue;
+		selected.add(index);
+		toolChars += cost;
+	}
+
+	const ordered = [...selected].sort((a, b) => a - b);
+	const rendered = ordered.map((index) => renderLine(index + 1, recent[index]!));
+	if (omitted) rendered.unshift(`${TRUNCATION_MARKER} earlier conversation entries were omitted.`);
+	return { text: rendered.join("\n"), omitted };
+}
+
+/**
+ * Build the reviewer transcript straight from session entries.
+ */
+export function transcriptFromEntries(
+	entries: readonly SessionEntry[],
+	budgets?: Parameters<typeof buildReviewTranscript>[1],
+): { text: string; omitted: boolean } {
+	return buildReviewTranscript(sessionEntriesToLines(entries), budgets);
+}

package/src/auto-mode/types.ts

@@ -1,137 +1,137 @@
-import type { AutoModeConfig } from "../types";
-
-export const AUTO_MODE_ENTRY_TYPE = "pi-openai-toolkit.auto-mode-decision.v1";
-export const AUTO_MODE_STATUS_KEY = "pi-openai-toolkit:auto-mode";
-export const AUTO_MODE_FLAG = "auto";
-export const AUTO_MODE_COMMAND = "auto";
-
-/**
- * Built-in tools that change state outside the conversation. Everything else is
- * read-only by default and only reviewed when the user opts in through
- * `autoMode.extraTools` or `gate: "all"`.
- */
-export const SIDE_EFFECT_TOOLS = ["bash", "write", "edit"] as const;
-
-export const MAX_REVIEW_INPUT_CHARS = 8_000;
-export const MAX_REVIEW_INTENT_CHARS = 2_000;
-export const MAX_REVIEW_REASON_CHARS = 600;
-export const MAX_REVIEW_MODEL_KEY_CHARS = 256;
-
-/** Budgets for the compact transcript handed to the reviewer. */
-export const MAX_TRANSCRIPT_CHARS = 24_000;
-export const MAX_TRANSCRIPT_TOOL_CHARS = 12_000;
-export const MAX_TRANSCRIPT_ENTRY_CHARS = 2_000;
-export const MAX_TRANSCRIPT_RECENT_ENTRIES = 40;
-export const TRUNCATION_MARKER = "<truncated />";
-
-/** Risk of the planned action itself, as scored by the reviewer. */
-export type RiskLevel = "low" | "medium" | "high" | "critical";
-
-/** How far the observed conversation actually authorizes that action. */
-export type UserAuthorization = "unknown" | "low" | "medium" | "high";
-
-/**
- * Why a review could not be completed. Kept separate from `deny` on purpose: an
- * infrastructure failure must never be reported to the agent as a safety verdict.
- */
-export type ReviewFailureCause =
-	| "not-configured"
-	| "timeout"
-	| "cancelled"
-	| "provider-error"
-	| "invalid-output";
-
-/**
- * The reviewer's full verdict. Only `outcome` is required from the model; the
- * remaining fields are back-filled by `parseReviewVerdict` so that a terse
- * `{"outcome":"allow"}` answer is still a usable, recordable decision.
- */
-export type GuardianVerdict = {
-	outcome: "allow" | "deny";
-	riskLevel: RiskLevel;
-	userAuthorization: UserAuthorization;
-	rationale: string;
-};
-
-/**
- * Result of asking the reviewer model about one pending tool call.
- * `unavailable` means the review could not be completed at all; it is never
- * treated as approval.
- */
-export type ReviewOutcome =
-	| {
-			kind: "allow";
-			verdict: GuardianVerdict;
-			reviewerModel: string;
-			evidenceRounds: number;
-	  }
-	| {
-			kind: "deny";
-			verdict: GuardianVerdict;
-			reviewerModel: string;
-			evidenceRounds: number;
-	  }
-	| { kind: "unavailable"; reason: string; cause: ReviewFailureCause };
-
-/** Non-blocking pre-score produced by the trajectory classifier. */
-export type ClassifierRisk = "low" | "high";
-
-/**
- * Why the classifier's cached score could or could not satisfy a gated call.
- * Mirrors the deferral reasons the blocking reviewer exists to cover: anything
- * other than `low_risk` falls through to the synchronous review.
- */
-export type FastDecisionReason =
-	| "low_risk"
-	| "elevated_risk"
-	| "stale_score"
-	| "scoring_failure"
-	| "missing_score"
-	| "authorization_changed"
-	| "requires_synchronous_review";
-
-export type AutoModeDecisionSource =
-	| "reviewer"
-	| "classifier"
-	| "human"
-	| "policy"
-	| "circuit-breaker";
-
-export type AutoModeDecisionRecord = {
-	timestamp: number;
-	toolName: string;
-	toolCallId: string;
-	decision:
-		| "allow"
-		| "deny"
-		| "unavailable-allowed"
-		| "unavailable-blocked"
-		| "turn-interrupted";
-	reason: string;
-	reviewerModel?: string;
-	source: AutoModeDecisionSource;
-	/** Present on reviewer verdicts; omitted for classifier fast paths. */
-	riskLevel?: RiskLevel;
-	userAuthorization?: UserAuthorization;
-	evidenceRounds?: number;
-	/** Only present when `source` is `classifier`. */
-	fastDecision?: FastDecisionReason;
-};
-
-export type AutoModeModelRef = {
-	provider?: string;
-	id?: string;
-};
-
-export type AutoModeGateSource = AutoModeConfig["gate"];
-
-/**
- * Truncate to a bounded single-line-safe diagnostic. Reviewer reasons and tool
- * arguments both originate from untrusted text, so every persisted copy is capped.
- */
-export function boundReviewText(value: unknown, maxChars: number): string {
-	const text = typeof value === "string" ? value : String(value ?? "");
-	const collapsed = text.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "").trim();
-	if (collapsed.length <= maxChars) return collapsed;
-	return `${collapsed.slice(0, Math.max(0, maxChars - 3))}...`;
-}
+import type { AutoModeConfig } from "../types";
+
+export const AUTO_MODE_ENTRY_TYPE = "pi-openai-toolkit.auto-mode-decision.v1";
+export const AUTO_MODE_STATUS_KEY = "pi-openai-toolkit:auto-mode";
+export const AUTO_MODE_FLAG = "auto";
+export const AUTO_MODE_COMMAND = "auto";
+
+/**
+ * Built-in tools that change state outside the conversation. Everything else is
+ * read-only by default and only reviewed when the user opts in through
+ * `autoMode.extraTools` or `gate: "all"`.
+ */
+export const SIDE_EFFECT_TOOLS = ["bash", "write", "edit"] as const;
+
+export const MAX_REVIEW_INPUT_CHARS = 8_000;
+export const MAX_REVIEW_INTENT_CHARS = 2_000;
+export const MAX_REVIEW_REASON_CHARS = 600;
+export const MAX_REVIEW_MODEL_KEY_CHARS = 256;
+
+/** Budgets for the compact transcript handed to the reviewer. */
+export const MAX_TRANSCRIPT_CHARS = 24_000;
+export const MAX_TRANSCRIPT_TOOL_CHARS = 12_000;
+export const MAX_TRANSCRIPT_ENTRY_CHARS = 2_000;
+export const MAX_TRANSCRIPT_RECENT_ENTRIES = 40;
+export const TRUNCATION_MARKER = "<truncated />";
+
+/** Risk of the planned action itself, as scored by the reviewer. */
+export type RiskLevel = "low" | "medium" | "high" | "critical";
+
+/** How far the observed conversation actually authorizes that action. */
+export type UserAuthorization = "unknown" | "low" | "medium" | "high";
+
+/**
+ * Why a review could not be completed. Kept separate from `deny` on purpose: an
+ * infrastructure failure must never be reported to the agent as a safety verdict.
+ */
+export type ReviewFailureCause =
+	| "not-configured"
+	| "timeout"
+	| "cancelled"
+	| "provider-error"
+	| "invalid-output";
+
+/**
+ * The reviewer's full verdict. Only `outcome` is required from the model; the
+ * remaining fields are back-filled by `parseReviewVerdict` so that a terse
+ * `{"outcome":"allow"}` answer is still a usable, recordable decision.
+ */
+export type GuardianVerdict = {
+	outcome: "allow" | "deny";
+	riskLevel: RiskLevel;
+	userAuthorization: UserAuthorization;
+	rationale: string;
+};
+
+/**
+ * Result of asking the reviewer model about one pending tool call.
+ * `unavailable` means the review could not be completed at all; it is never
+ * treated as approval.
+ */
+export type ReviewOutcome =
+	| {
+			kind: "allow";
+			verdict: GuardianVerdict;
+			reviewerModel: string;
+			evidenceRounds: number;
+	  }
+	| {
+			kind: "deny";
+			verdict: GuardianVerdict;
+			reviewerModel: string;
+			evidenceRounds: number;
+	  }
+	| { kind: "unavailable"; reason: string; cause: ReviewFailureCause };
+
+/** Non-blocking pre-score produced by the trajectory classifier. */
+export type ClassifierRisk = "low" | "high";
+
+/**
+ * Why the classifier's cached score could or could not satisfy a gated call.
+ * Mirrors the deferral reasons the blocking reviewer exists to cover: anything
+ * other than `low_risk` falls through to the synchronous review.
+ */
+export type FastDecisionReason =
+	| "low_risk"
+	| "elevated_risk"
+	| "stale_score"
+	| "scoring_failure"
+	| "missing_score"
+	| "authorization_changed"
+	| "requires_synchronous_review";
+
+export type AutoModeDecisionSource =
+	| "reviewer"
+	| "classifier"
+	| "human"
+	| "policy"
+	| "circuit-breaker";
+
+export type AutoModeDecisionRecord = {
+	timestamp: number;
+	toolName: string;
+	toolCallId: string;
+	decision:
+		| "allow"
+		| "deny"
+		| "unavailable-allowed"
+		| "unavailable-blocked"
+		| "turn-interrupted";
+	reason: string;
+	reviewerModel?: string;
+	source: AutoModeDecisionSource;
+	/** Present on reviewer verdicts; omitted for classifier fast paths. */
+	riskLevel?: RiskLevel;
+	userAuthorization?: UserAuthorization;
+	evidenceRounds?: number;
+	/** Only present when `source` is `classifier`. */
+	fastDecision?: FastDecisionReason;
+};
+
+export type AutoModeModelRef = {
+	provider?: string;
+	id?: string;
+};
+
+export type AutoModeGateSource = AutoModeConfig["gate"];
+
+/**
+ * Truncate to a bounded single-line-safe diagnostic. Reviewer reasons and tool
+ * arguments both originate from untrusted text, so every persisted copy is capped.
+ */
+export function boundReviewText(value: unknown, maxChars: number): string {
+	const text = typeof value === "string" ? value : String(value ?? "");
+	const collapsed = text.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "").trim();
+	if (collapsed.length <= maxChars) return collapsed;
+	return `${collapsed.slice(0, Math.max(0, maxChars - 3))}...`;
+}