pi-openai-toolkit 0.15.1 → 0.16.0

package/README.md

@@ -124,6 +124,28 @@ Earlier windows remain retrievable through `history`, but are not all automatica
 
 ## Common tasks
 
+### Checkpoint a managed session with `/compact`
+
+In an active Remote Context session, run `/compact` (optionally followed by checkpoint instructions) to save work in notes and enter one new window in the same Pi session. Toolkit temporarily selects `context.remoteCompaction.model`, waits for a new successful persisted notes checkpoint and window marker, then restores the original model and thinking level before the first new-window request. That model is instructed to read the checkpoint receipt before continuing.
+
+To choose a checkpoint model, merge this into your v2 configuration and replace the model reference with an existing Pi model:
+
+```json
+{
+  "schemaVersion": 2,
+  "defaults": {
+    "context": {
+      "mode": "remote-windows",
+      "remoteCompaction": { "model": "my-gateway/gpt-5.6-luna" }
+    }
+  }
+}
+```
+
+The checkpoint model also needs Remote Context support, the same backend/account, enough context capacity, and the permitted context tools. A gateway model needs its own exact transport opt-in. Missing or `null` uses the current model. An engaged Auto Mode gate must remain eligible on the target; otherwise the handoff is refused. Notes or model failures restore the original selection when still owned by Toolkit; your later explicit model selection wins. Reload only recovers selection, without automatically restarting inference.
+
+This does not generate a conversation summary. Pi's native compact operation is intentionally cancelled to launch the separate handoff, so an SDK/RPC caller can see a cancellation even while checkpoint duty starts. Pi can also reject an empty or already-compacted session before Toolkit's hook runs. Automatic threshold/overflow handling and internal trim maintenance keep their existing behavior. See the [handoff contract](docs/internals.md#managed-manual-compact).
+
 ### Continue a session with server-side compaction
 
 Use `context.mode: "remote-compaction"` for the Responses compaction path (the default), or `"pi"` to relinquish Toolkit context management. Set `context.remoteCompaction.model` only when a separate model should produce the checkpoint. These fields belong under `defaults` or an exact `models` override.
@@ -208,7 +230,7 @@ The global file uses built-ins, then `defaults`, then exact `models["provider/mo
 | --- | --- | --- |
 | `defaults.context.mode` | `"remote-compaction"` | `"pi"`, `"remote-compaction"`, or `"remote-windows"`. |
 | `models[exact].compatibility.transport` | `"standard"` | Exact gateway opt-in with `"codex-gateway"`. |
-| `defaults.context.remoteCompaction.model` | `null` | Optional checkpoint producer. |
+| `defaults.context.remoteCompaction.model` | `null` | Checkpoint producer, or manual checkpoint-duty model in `remote-windows`. |
 | `defaults.context.remoteCompaction.inputSource` | `"legacy"` | Source-specific checkpoint input policy. |
 | `defaults.context.remoteWindows.reminderThresholdPercent` | `5` | `0` disables reminders and exhausted-window fallback. |
 | `defaults.webSearch.route` | `"unmanaged"` | Toolkit search ownership policy. |
@@ -223,7 +245,7 @@ The global file uses built-ins, then `defaults`, then exact `models["provider/mo
 
 Use `/toolkit-config` for effective values and origins, `/toolkit-config validate` for document issues, and `/toolkit-config migration-preview` for a read-only legacy candidate. These commands require a UI and perform no network/auth lookup, tool activation, or file writes. Configuration selection does not verify backend support.
 
-Unknown v2 policy keys and malformed values produce visible scoped errors, independent of debug mode. Each public callback or tool execution uses one immutable snapshot across its awaited helpers; later operations reread the file. Separate Pi events are not one atomic transaction. See the [complete configuration reference](docs/configuration.md) and [editor schema](config.schema.json).
+Unknown v2 policy keys and malformed values produce visible scoped errors, independent of debug mode. Each public callback or tool execution uses one immutable snapshot across its awaited helpers; later independent operations reread the file. A managed `/compact` handoff retains its initiating context-policy snapshot until selection is restored. Separate Pi events are not a general atomic transaction. See the [complete configuration reference](docs/configuration.md) and [editor schema](config.schema.json).
 
 ## Development
 

package/README.zh.md

@@ -124,6 +124,28 @@ pi --model my-gateway/gpt-5.6-luna
 
 ## 常见用法
 
+### 用 `/compact` 为托管会话保存检查点
+
+Remote Context 已激活时，运行 `/compact`，后面可附加检查点要求，即可把工作状态保存到 notes，并在同一 Pi 会话中进入一个新窗口。Toolkit 临时选择 `context.remoteCompaction.model`，等待新的 notes 检查点和窗口标记成功持久化，再在新窗口首次请求前恢复原模型及思考等级，并要求原模型先读取检查点回执再继续工作。
+
+要指定检查点模型，将以下内容合并到 v2 配置，并把模型引用替换为 Pi 中已有的模型：
+
+```json
+{
+  "schemaVersion": 2,
+  "defaults": {
+    "context": {
+      "mode": "remote-windows",
+      "remoteCompaction": { "model": "my-gateway/gpt-5.6-luna" }
+    }
+  }
+}
+```
+
+检查点模型也必须支持 Remote Context，使用相同后端及账号，有足够的上下文容量，并允许使用上下文工具。网关模型还需要单独配置精确的传输协议选项。未设置或为 `null` 时使用当前模型。若 Auto Mode 已启用，目标模型也必须符合其准入条件，否则交接会被拒绝。notes 或模型操作失败时，只要临时选择仍由 Toolkit 管理，就会恢复原模型；用户后来明确选择的模型优先。重载只恢复模型选择，不会自动重新发起推理。
+
+该操作不生成会话摘要。Toolkit 会有意取消 Pi 原生压缩操作，再单独启动检查点交接，因此 SDK/RPC 调用方可能收到取消结果，同时看到检查点任务开始。空会话或刚压缩过的会话也可能在进入 Toolkit 钩子前就被 Pi 拒绝。自动阈值、溢出处理及内部旧窗口清理保持原有行为。详见[交接约定](docs/internals.md#managed-manual-compact)。
+
 ### 使用服务端压缩继续会话
 
 使用 `context.mode: "remote-compaction"` 选择 Responses 压缩路径（默认值），或设为 `"pi"` 交回 Toolkit 的上下文管理权。只有需要独立模型生成检查点时才设置 `context.remoteCompaction.model`。这些字段放在 `defaults` 或精确的 `models` 覆盖下。
@@ -208,7 +230,7 @@ TUI 会显示开启提示、审查活动和底部状态。兼容的 Pi 工具渲
 | --- | --- | --- |
 | `defaults.context.mode` | `"remote-compaction"` | `"pi"`、`"remote-compaction"` 或 `"remote-windows"`。 |
 | `models[exact].compatibility.transport` | `"standard"` | 用 `"codex-gateway"` 显式选择网关协议。 |
-| `defaults.context.remoteCompaction.model` | `null` | 可选的检查点生成模型。 |
+| `defaults.context.remoteCompaction.model` | `null` | 检查点生成模型，或 `remote-windows` 下手动检查点任务使用的模型。 |
 | `defaults.context.remoteCompaction.inputSource` | `"legacy"` | 与检查点来源绑定的输入策略。 |
 | `defaults.context.remoteWindows.reminderThresholdPercent` | `5` | `0` 关闭提醒和窗口耗尽兜底。 |
 | `defaults.webSearch.route` | `"unmanaged"` | Toolkit 搜索管理策略。 |
@@ -223,7 +245,7 @@ TUI 会显示开启提示、审查活动和底部状态。兼容的 Pi 工具渲
 
 使用 `/toolkit-config` 查看有效值及来源，`/toolkit-config validate` 查看文档问题，`/toolkit-config migration-preview` 预览只读的旧格式迁移候选。这些命令需要 UI，不查询网络或认证，不激活工具，也不写文件。选中配置不表示后端支持已验证。
 
-未知 v2 策略键和畸形值会产生可见的分范围错误，不依赖调试模式。每个公开回调或工具执行及其等待的辅助操作使用同一份不可变快照，后续操作重新读取文件；独立 Pi 事件之间不保证原子事务。完整选项见[配置参考](docs/configuration.md)和[编辑器 schema](config.schema.json)。
+未知 v2 策略键和畸形值会产生可见的分范围错误，不依赖调试模式。每个公开回调或工具执行及其等待的辅助操作使用同一份不可变快照，后续独立操作重新读取文件；托管 `/compact` 交接会保留发起时的上下文策略快照，直到模型恢复。独立 Pi 事件之间不保证通用的原子事务。完整选项见[配置参考](docs/configuration.md)和[编辑器 schema](config.schema.json)。
 
 ## 开发
 

package/docs/configuration.md

@@ -57,7 +57,7 @@ Place `context` under `defaults` or an exact `models` entry.
 | Relative field | Default | Contract |
 | --- | --- | --- |
 | `mode` | `"remote-compaction"` | `"pi"` relinquishes Toolkit context management; `"remote-compaction"` uses the eligible Responses checkpoint path; `"remote-windows"` selects Codex windows where supported. |
-| `remoteCompaction.model` | `null` | Exact producer reference; `null` uses the active model. It must share the effective base URL required by the existing compaction path. |
+| `remoteCompaction.model` | `null` | Exact producer reference; `null` uses the active model. In `remote-compaction`, it selects the synthetic checkpoint producer on the same effective base URL. In active `remote-windows`, manual `/compact` temporarily selects it for notes checkpoint duty on the same backend/account. |
 | `remoteCompaction.inputSource` | `"legacy"` | `"legacy"` preserves session/raw-branch input; `"pi-context-hook"` opts into Pi's ordered context projection. Checkpoint provenance must match. |
 | `remoteCompaction.allowContinuityBreak` | `false` | Allow restarting from Pi context after a foreign compaction entry. It does not make malformed opaque checkpoints replayable. |
 | `remoteCompaction.apis` | `["openai-responses", "openai-codex-responses"]` | May narrow this set; `[]` permits no remote-compaction API. Unsupported entries are errors. |
@@ -67,7 +67,13 @@ Place `context` under `defaults` or an exact `models` entry.
 | `remoteWindows.leaveManagedMode` | `"warn"` | `"compact"` also requests a close-out when retired history exceeds 80% of the next model's window and compaction can finish. Print mode remains warning-only; turn-end close-out requires a queued trim. |
 | `remoteWindows.reminderThresholdPercent` | `5` | Integer 0-100. `0` disables both the once-per-window reminder and exhausted-window fallback. |
 
-Native Codex eligibility derives from the actual Pi provider/API. Gateways additionally need the exact transport opt-in below. `remote-windows` retains the compaction chain for models outside window capability. A configured window model whose activation fails does not silently receive a summary fallback. The rollover notes gate, durable history, producer/consumer identities, and checkpoint provenance are unchanged. See [Toolkit internals](internals.md).
+Native Codex eligibility derives from the actual Pi provider/API. Gateways additionally need the exact transport opt-in below. `remote-windows` retains the compaction chain for models outside window capability. A configured window model whose activation fails does not silently receive a summary fallback. Normal `new_context` keeps its persisted-notes, duplicate and cooldown gates. Synthetic Remote V2 producer/consumer identity and checkpoint provenance are unchanged. See [Toolkit internals](internals.md).
+
+In active `remote-windows`, `/compact [instructions]` starts checkpoint duty rather than producing a summary. The selected model must authenticate to the same native backend/account or gateway credential/affinity domain, fit the projected window plus its output reserve, and retain the required permitted context tools. Invalid or unsuitable explicit targets are refused without switching to a fallback model. If Auto Mode is engaged, the target must also be eligible for its gate. The entire handoff uses the initiating context-policy snapshot; no config or global Pi defaults are rewritten.
+
+Only a new persisted successful notes write/append after the handoff and the latest delivered user message authorizes its rollover. After the exact target marker is durable, Toolkit restores the original model/thinking before new-window inference and asks it to read the receipt first. Failure or cancellation restores an owned selection; a later user selection takes priority. Failed restoration blocks further handoff requests until selection/auth is repaired. Reload can recover selection, but does not automatically restart inference.
+
+The SDK native compact call reports its intentional cancellation; the visible handoff is a separate agent operation. Pi's pre-hook “nothing to compact” and “already compacted” outcomes remain. Automatic threshold/overflow compaction and internal pending-trim maintenance do not initiate checkpoint duty. `nativeFallback.model` keeps its existing summary-model meaning.
 
 ---
 
@@ -124,7 +130,7 @@ Place `autoMode` under `defaults` or an exact model. `available` permits engagem
 | `circuitBreaker.recentDenials` | `10` | Integer 0-100; `0` disables this limit. |
 | `circuitBreaker.windowSize` | `50` | Integer 1-200, recent-verdict window size. |
 
-Reviewer and classifier references are not active-session overrides. Classifier scores, denial history, and human decisions never become config entries.
+Reviewer and classifier references are not active-session overrides. Classifier scores, denial history, and human decisions never become config entries. The reviewer and its read-only evidence calls share one cancellable deadline, including dependencies that ignore abort. Denial history resets on actual delivery of a user message, including identical queued messages, not on enqueue or an ordinary tool continuation. Pre-scores are bound to a full structured authorization fingerprint; the bounded review transcript prioritizes recent user instructions and reports omissions.
 
 ---
 

package/docs/internals.md

@@ -9,6 +9,7 @@ Developer-facing reference for [pi-openai-toolkit](../README.md). The README kee
 - [Configuration resolution](#configuration-resolution)
 - [Remote Context protocol](#remote-context-protocol)
 - [Rollover lifecycle](#rollover-lifecycle)
+- [Managed manual compact](#managed-manual-compact)
 - [Remote Compaction v2 wire contract](#remote-compaction-v2-wire-contract)
 - [Auto Mode TUI review renderer](#auto-mode-tui-review-renderer)
 - [Artifacts and debugging](#artifacts-and-debugging)
@@ -20,7 +21,7 @@ Developer-facing reference for [pi-openai-toolkit](../README.md). The README kee
 
 The single global document is loaded through [src/config.ts](../src/config.ts). [src/config/legacy.ts](../src/config/legacy.ts) owns unversioned compatibility; [src/config/v2.ts](../src/config/v2.ts) validates v2 scopes, resolves exact policy, and records leaf origins. [src/config/policy.ts](../src/config/policy.ts) defines effective values independently of persisted session data. See the [configuration reference](configuration.md) for supported fields and migration limits.
 
-Feature entrypoints resolve once per public operation and pass that immutable snapshot through awaited helpers. A separately named compaction producer is resolved from the same decoded document for its own identity. Subsequent callbacks reload; there is no cross-event provider transaction, project lookup, singleton cache, or config state writer. Internal legacy-shaped engine adapters preserve compaction/search algorithms without exposing v2 parsing to consumers. Cross-feature gateway policy belongs to the resolver, not the context enable switch.
+Feature entrypoints resolve once per public operation and pass that immutable snapshot through awaited helpers. A separately named compaction producer is resolved from the same decoded document for its own identity. Subsequent independent callbacks reload; a managed manual handoff retains its initiating context-policy snapshot until selection is restored. There is no general cross-event provider transaction, project lookup, singleton cache, or config state writer. Internal legacy-shaped engine adapters preserve compaction/search algorithms without exposing v2 parsing to consumers. Cross-feature gateway policy belongs to the resolver, not the context enable switch.
 
 Selected invalid policy blocks dependent operations; unrelated model errors remain reportable without replacing the selected model. An engaged auto gate stays blocking when its policy becomes invalid. Image choices are checked before auth, uploads, or paid requests. The human `/toolkit-config` command inspects effective values, validation, or a migration candidate without action APIs or network access. Migration is preview-only; source bytes and unknown/dormant content stay untouched.
 
@@ -81,7 +82,7 @@ State invariants the lifecycle code must keep honest:
 - `new_context` has no force escape hatch: a persisted successful notes checkpoint in the current window is always required before rollover. The model must wait for the notes result to be persisted before retrying.
 - After a marker is accepted for sending, the manager keeps a session/window-anchored pending guard until that exact target marker is persisted or the session changes. A duplicate `new_context` during this persistence gap returns `started: false` and sends no second marker; projected/in-memory messages do not retire the guard.
 - Budget checks are skipped until the current window has produced its own assistant usage. Acting on the previous window's usage anchor would burn the once-per-window reminder on a false alarm.
-- The scheduled trim is consumed exactly once, synchronously, by the first compaction attempt whose boundary window ID matches. Every other compaction path, including a threshold without a scheduled rollover, manual `/compact`, and overflow, is cancelled.
+- Preparing a boundary never consumes its scheduled trim. The manager reconciles the latest persisted compaction and branch state, so only a durable matching boundary consumes it. Missing/late callbacks, aborted preparation and navigation across branches sharing a marker remain retryable. Automatic threshold/overflow and toolkit-owned manual maintenance only trim a matching scheduled window; a user manual `/compact` follows the managed handoff below.
 - A window boundary is persisted as a `codex-context-window` custom message. `session_start` replays boundaries from the branch and rebuilds identity after forks.
 - Retiring windows is a projection-level act: the session branch keeps every retired window until a compaction consumes the scheduled trim. `evaluateWindowBulk()` measures that gap and compares it with the model about to receive it, `decideBulkCliffAction()` maps the report onto the `leaveManagedMode` policy (`warn` default, `compact`), and `decideBulkCloseOut()` only allows the automatic compaction where a compaction can actually finish: never in print mode (the process exits with the turn and would kill the summary), and at turn end only while a rollover trim is queued, because the window policy cancels every other compaction. Each window and model is surfaced once, and every decision writes a `window-bulk.<action>` compaction artifact with its trigger.
 - The close-out runs from `model_select` and `agent_settled`, never from `before_agent_start`: `ExtensionContext.compact()` aborts the running turn, and a hook inside turn processing is exactly the busy lane it must not fight.
@@ -89,12 +90,32 @@ State invariants the lifecycle code must keep honest:
 
 ---
 
+### Managed manual compact
+
+[src/context-management/manual-compact.ts](../src/context-management/manual-compact.ts) owns manual checkpoint duty. It uses public Pi lifecycle and selection APIs; it does not replace the built-in command or patch the scheduler. [src/context-management/window-manager.ts](../src/context-management/window-manager.ts) remains the sole owner of notes pairing, window identity, projection and trim.
+
+1. An active managed `session_before_compact` with reason `manual` validates the source/target policies from one snapshot, actual permitted tools, remaining capacity, backend/account scope and approval eligibility. It records the original model/thinking and cancels the native compact attempt. Internal window-bulk maintenance has a separate in-process owner even though Pi also labels it `manual`.
+2. The matching `session_compact_failed` callback launches duty only after Pi is idle. Public `setModel` changes the session selection, and a visible `sendUserMessage` rebuilds the target's normal prompt/tools. Delivery is observed through `message_start`; return from the fire-and-forget send API is not proof. A delivery timeout restores an abandoned idle selection.
+3. The existing `new_context` gate additionally requires a successful paired notes result after this operation and any later delivered user message. It records the exact target window before queueing a context-only marker, and returns a terminating result. Ordinary tools are blocked during checkpoint duty. Normal `new_context` outside this operation is unchanged.
+4. A terminating result alone does not stop mixed batches or queued messages. At `turn_end`, Toolkit requests abort without awaiting idle; context/request guards also refuse an unsafe continuation. The standard Responses and native Codex transports must not send an already-aborted continuation. Pi can deliver queued user content during that stop; it remains persisted and ordered for the original model.
+5. At `agent_settled`, after Pi has flushed custom messages, the controller verifies the exact durable marker and fresh checkpoint, restores original model/thinking, and sends one visible receipt-reading continuation. Restoring inside marker `message_end` would be too early for persistence and too late for a model snapshot already captured by `prepareNextTurn`.
+
+Versioned `pi-openai-toolkit:manual-compact` custom entries record operation/session/branch/window identities, exact model keys, original thinking and phase. They contain no credentials, transcript copy or note contents. Reload/navigation reads the current branch and only recovers still-owned selection; it never retries notes, rollover or paid inference. A newer user model/thinking selection ends ownership. Failed restoration stays durable and blocks further provider requests until recovery or an explicit user selection.
+
+An engaged Auto Mode gate grants a session/operation-scoped selection lease through [src/auto-mode/model-selection-guard.ts](../src/auto-mode/model-selection-guard.ts). An ineligible target is refused. While switching, a later eligibility change cannot silently disengage the gate: calls remain blocked. The lease neither enables Auto Mode nor widens its allowlist.
+
+The underlying native compact promise still rejects its intentional cancellation. Empty/already-compacted sessions can fail before the extension hook. This is a separate handoff operation, not a fabricated successful native compaction. An observed user cancellation before the owned checkpoint stop restores selection without automatically resuming. Tests use the official Pi runtime, disk-backed sessions, isolated HOME/settings and synthetic Responses/native Codex traffic in [test/pi-managed-compact.test.ts](../test/pi-managed-compact.test.ts); they assert every request's model/thinking, marker/note order, retained tool head and queue preservation.
+
+---
+
 ### Remote Compaction v2 wire contract
 
 v2 is what an uncovered session gets. Any model that Remote Context declines, such as a gateway without an exact transport opt-in, can still compact through v2 when its API appears in `context.remoteCompaction.apis`. The two strategies never compete for one session.
 
 A `compaction_trigger` item appended to the live streaming request yields one output item of `type: "compaction"` with non-empty `encrypted_content`, stored in `CompactionEntry.details.compactedWindow`. On later requests the opaque checkpoint is replayed ahead of live turns, with no text summary. Replay fails closed: if the summary anchor cannot be located, the request is aborted with a notification and a content-free failure artifact. The sentinel-only payload is never sent.
 
+The incremental SSE consumer validates the first terminal event and reconciles its checkpoint with prior item evidence. A valid completed frame ends the operation even if the HTTP body stays open; reader cancellation is best-effort cleanup and is not awaited. Incomplete frames at EOF, conflicting checkpoint evidence and terminal errors cannot become successful checkpoints.
+
 A v2 response with a missing or empty checkpoint is never stored, and the `nativeFallback` tier is skipped. Pi's own threshold drives the next attempt, which may use `remoteCompactModel` when configured. `remoteCompactModel` must resolve to the same effective base URL as the active model.
 
 Pi 0.85.1's `session_before_compact` event supplies preparation and branch data, while the direct Remote V2 client can bypass the provider `context` hook chain. To preserve compatibility, an omitted `context.remoteCompaction.inputSource` keeps the original `"legacy"` behavior: first compaction uses `buildSessionContext()` and falls back to `SessionBeforeCompactEvent.preparation`, while recursion uses the opaque window plus the raw branch tail.
@@ -107,6 +128,8 @@ New checkpoints record `inputProvenance: "pi-context-hook-v1"` or `"legacy-raw-c
 
 ### Auto Mode TUI review renderer
 
+Approval state is scoped to actual user-message delivery. Full structured user content is SHA-256 hashed independently of transcript truncation, and generation-owned classifier completions cannot overwrite newer samples. The bounded transcript selects recent user instructions first and reports omissions. The blocking reviewer and its read-only evidence loop share one deadline that also races uncooperative dependencies; timeout/cancellation is an unavailable review, never approval or a safety denial.
+
 Auto Mode owns the review decision, but Pi owns the built-in tool-block component. Pi 0.85.1 exports `ToolExecutionComponent` without a public decorator interface, so `src/auto-mode/tool-review-tui.ts` installs a narrow, idempotent compatibility patch on its `render()` method. The patch only reads the component's existing tool-call ID and appends one bounded, single-line status after the normal block output; it never changes tool execution, event ordering, or provider payloads.
 
 The extension updates an ephemeral per-call state through the same `tool_call` lifecycle that performs the review:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-openai-toolkit",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "private": false,
   "type": "module",
   "engines": {
@@ -63,6 +63,7 @@
     "src/context-management/window-request.ts",
     "src/context-management/window-bulk.ts",
     "src/context-management/window-manager.ts",
+    "src/context-management/manual-compact.ts",
     "src/context-management/codex-provider.ts",
     "src/context-management/history-notes.ts",
     "src/context-management/tools.ts",
@@ -80,6 +81,7 @@
     "src/auto-mode/extension.ts",
     "src/auto-mode/tool-review-tui.ts",
     "src/auto-mode/policy.ts",
+    "src/auto-mode/model-selection-guard.ts",
     "src/auto-mode/prompt.ts",
     "src/auto-mode/transcript.ts",
     "src/auto-mode/reviewer.ts",

package/src/auto-mode/classifier.ts

@@ -1,165 +1,161 @@
-import type { Api, Model } from "@earendil-works/pi-ai";
-import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
-import { parseModelSpec } from "../runtime";
-import { CLASSIFIER_SYSTEM_PROMPT } from "./prompt";
-import { boundReviewText, type ClassifierRisk, type FastDecisionReason } from "./types";
-
-/** One completed classification of the trajectory, tagged to a tool-call position. */
-export type ScoreRecord = {
-	risk: ClassifierRisk;
-	/** Tool-call counter value when the sample was taken. */
-	scoredAtCall: number;
-	/** Fingerprint of the user turns the score was based on. */
-	authorizationVersion: string;
-	sampledAt: number;
-};
-
-/**
- * Mutable per-session tracker for the non-blocking pre-scorer.
- *
- * The counters reproduce Codex's staleness rule: the agent keeps running while a
- * classification is in flight, so a score is only trustworthy if it is recent
- * enough and nothing the user said has changed underneath it.
- */
-export type ScoreTracker = {
-	latestCallIndex: number;
-	latestScoredIndex: number;
-	latestFailedIndex: number;
-	score?: ScoreRecord;
-};
-
-export function createScoreTracker(): ScoreTracker {
-	return { latestCallIndex: 0, latestScoredIndex: 0, latestFailedIndex: 0 };
-}
-
-/** Reset everything: a new turn or a disengaged mode invalidates prior scoring. */
-export function resetScoreTracker(tracker: ScoreTracker): void {
-	tracker.latestCallIndex = 0;
-	tracker.latestScoredIndex = 0;
-	tracker.latestFailedIndex = 0;
-	tracker.score = undefined;
-}
-
-/**
- * Fingerprint of the user-authored conversation. Any new or edited user turn makes
- * an existing score stale, because the score's authorization premise changed.
- */
-export function authorizationVersion(userText: string): string {
-	const bounded = boundReviewText(userText, 8_000);
-	let hash = 2166136261;
-	for (let index = 0; index < bounded.length; index += 1) {
-		hash ^= bounded.charCodeAt(index);
-		hash = Math.imul(hash, 16777619);
-	}
-	return `${bounded.length}:${(hash >>> 0).toString(36)}`;
-}
-
-export function recordScoredCall(tracker: ScoreTracker, score: ScoreRecord): void {
-	tracker.score = score;
-	tracker.latestScoredIndex = Math.max(tracker.latestScoredIndex, score.scoredAtCall);
-}
-
-export function recordFailedCall(tracker: ScoreTracker, scoredAtCall: number): void {
-	tracker.latestFailedIndex = Math.max(tracker.latestFailedIndex, scoredAtCall);
-}
-
-export type FastDecisionInput = {
-	tracker: ScoreTracker;
-	/** Tool-call counter value for the call being gated. */
-	currentCallIndex: number;
-	authorizationVersion: string;
-	maxLag: number;
-	/** Retries after a denial and widened gates must not take the fast path. */
-	requiresSynchronousReview?: boolean;
-};
-
-/**
- * Decide whether a cached classification can satisfy this gated call without
- * running the blocking reviewer. Anything other than `low_risk` defers to the
- * synchronous review; the classifier never denies an action on its own.
- */
-export function fastApprovalEligible(input: FastDecisionInput): {
-	eligible: boolean;
-	reason: FastDecisionReason;
-} {
-	const defer = (reason: FastDecisionReason) => ({ eligible: false, reason });
-
-	if (input.requiresSynchronousReview) return defer("requires_synchronous_review");
-	if (input.tracker.latestFailedIndex > input.tracker.latestScoredIndex) return defer("scoring_failure");
-
-	const score = input.tracker.score;
-	if (!score) return defer("missing_score");
-
-	const lag = input.currentCallIndex - score.scoredAtCall;
-	if (lag > input.maxLag) return defer("stale_score");
-	if (score.authorizationVersion !== input.authorizationVersion) return defer("authorization_changed");
-	if (score.risk === "low") return { eligible: true, reason: "low_risk" };
-	return defer("elevated_risk");
-}
-
-export type ClassificationResult =
-	| { kind: ClassifierRisk; model: string }
-	| { kind: "failed"; reason: string };
-
-/**
- * Run one non-blocking classification. Output is a single token; anything else is a
- * failed sample rather than a verdict, so a confused classifier costs a review and
- * never an approval or a denial.
- */
-export async function classifyTrajectory(params: {
-	registry: Pick<ModelRegistry, "find" | "complete">;
-	modelSpec: string;
-	prompt: string;
-	timeoutMs: number;
-	signal?: AbortSignal;
-}): Promise<ClassificationResult> {
-	const parsed = parseModelSpec(params.modelSpec);
-	if (!parsed) {
-		return { kind: "failed", reason: `autoMode.classifier.model "${params.modelSpec}" is not provider/model-id.` };
-	}
-	const model = params.registry.find(parsed.provider, parsed.modelId) as Model<Api> | undefined;
-	if (!model) {
-		return { kind: "failed", reason: `Classifier model ${params.modelSpec} is not available.` };
-	}
-	const label = boundReviewText(`${model.provider}/${model.id}`, 256);
-
-	const controller = new AbortController();
-	const abortFromCaller = () => controller.abort();
-	if (params.signal?.aborted) controller.abort();
-	else params.signal?.addEventListener("abort", abortFromCaller);
-	const timer = setTimeout(() => controller.abort(), params.timeoutMs);
-
-	try {
-		const response = await params.registry.complete(
-			model,
-			{
-				systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
-				messages: [
-					{
-						role: "user",
-						content: [{ type: "text", text: params.prompt }],
-						timestamp: Date.now(),
-					},
-				],
-			},
-			{ signal: controller.signal, cacheRetention: "none" },
-		);
-		if (response.stopReason === "error" || response.stopReason === "aborted") {
-			return { kind: "failed", reason: response.errorMessage ?? `Classifier stopped: ${response.stopReason}` };
-		}
-		const text = response.content
-			.filter((block): block is { type: "text"; text: string } => block.type === "text")
-			.map((block) => block.text)
-			.join("")
-			.trim()
-			.toLowerCase();
-		if (/^high\b/.test(text)) return { kind: "high", model: label };
-		if (/^low\b/.test(text)) return { kind: "low", model: label };
-		return { kind: "failed", reason: `Classifier returned unreadable output: ${boundReviewText(text, 80)}` };
-	} catch (error) {
-		return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
-	} finally {
-		clearTimeout(timer);
-		params.signal?.removeEventListener("abort", abortFromCaller);
-	}
-}
+import { createHash } from "node:crypto";
+import type { Api, Model } from "@earendil-works/pi-ai";
+import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
+import { parseModelSpec } from "../runtime";
+import { CLASSIFIER_SYSTEM_PROMPT } from "./prompt";
+import { boundReviewText, type ClassifierRisk, type FastDecisionReason } from "./types";
+
+/** One completed classification of the trajectory, tagged to a tool-call position. */
+export type ScoreRecord = {
+	risk: ClassifierRisk;
+	/** Tool-call counter value when the sample was taken. */
+	scoredAtCall: number;
+	/** Fingerprint of the user turns the score was based on. */
+	authorizationVersion: string;
+	sampledAt: number;
+};
+
+/**
+ * Mutable per-session tracker for the non-blocking pre-scorer.
+ *
+ * The counters reproduce Codex's staleness rule: the agent keeps running while a
+ * classification is in flight, so a score is only trustworthy if it is recent
+ * enough and nothing the user said has changed underneath it.
+ */
+export type ScoreTracker = {
+	latestCallIndex: number;
+	latestScoredIndex: number;
+	latestFailedIndex: number;
+	score?: ScoreRecord;
+};
+
+export function createScoreTracker(): ScoreTracker {
+	return { latestCallIndex: 0, latestScoredIndex: 0, latestFailedIndex: 0 };
+}
+
+/** Reset everything: a new turn or a disengaged mode invalidates prior scoring. */
+export function resetScoreTracker(tracker: ScoreTracker): void {
+	tracker.latestCallIndex = 0;
+	tracker.latestScoredIndex = 0;
+	tracker.latestFailedIndex = 0;
+	tracker.score = undefined;
+}
+
+/**
+ * Fingerprint of the user-authored conversation. Any new or edited user turn makes
+ * an existing score stale, because the score's authorization premise changed.
+ */
+export function authorizationVersion(userText: string): string {
+	return createHash("sha256").update(userText).digest("hex");
+}
+
+export function recordScoredCall(tracker: ScoreTracker, score: ScoreRecord): void {
+	tracker.score = score;
+	tracker.latestScoredIndex = Math.max(tracker.latestScoredIndex, score.scoredAtCall);
+}
+
+export function recordFailedCall(tracker: ScoreTracker, scoredAtCall: number): void {
+	tracker.latestFailedIndex = Math.max(tracker.latestFailedIndex, scoredAtCall);
+}
+
+export type FastDecisionInput = {
+	tracker: ScoreTracker;
+	/** Tool-call counter value for the call being gated. */
+	currentCallIndex: number;
+	authorizationVersion: string;
+	maxLag: number;
+	/** Retries after a denial and widened gates must not take the fast path. */
+	requiresSynchronousReview?: boolean;
+};
+
+/**
+ * Decide whether a cached classification can satisfy this gated call without
+ * running the blocking reviewer. Anything other than `low_risk` defers to the
+ * synchronous review; the classifier never denies an action on its own.
+ */
+export function fastApprovalEligible(input: FastDecisionInput): {
+	eligible: boolean;
+	reason: FastDecisionReason;
+} {
+	const defer = (reason: FastDecisionReason) => ({ eligible: false, reason });
+
+	if (input.requiresSynchronousReview) return defer("requires_synchronous_review");
+	if (input.tracker.latestFailedIndex > input.tracker.latestScoredIndex) return defer("scoring_failure");
+
+	const score = input.tracker.score;
+	if (!score) return defer("missing_score");
+
+	const lag = input.currentCallIndex - score.scoredAtCall;
+	if (lag < 0 || lag > input.maxLag) return defer("stale_score");
+	if (score.authorizationVersion !== input.authorizationVersion) return defer("authorization_changed");
+	if (score.risk === "low") return { eligible: true, reason: "low_risk" };
+	return defer("elevated_risk");
+}
+
+export type ClassificationResult =
+	| { kind: ClassifierRisk; model: string }
+	| { kind: "failed"; reason: string };
+
+/**
+ * Run one non-blocking classification. Output is a single token; anything else is a
+ * failed sample rather than a verdict, so a confused classifier costs a review and
+ * never an approval or a denial.
+ */
+export async function classifyTrajectory(params: {
+	registry: Pick<ModelRegistry, "find" | "complete">;
+	modelSpec: string;
+	prompt: string;
+	timeoutMs: number;
+	signal?: AbortSignal;
+}): Promise<ClassificationResult> {
+	const parsed = parseModelSpec(params.modelSpec);
+	if (!parsed) {
+		return { kind: "failed", reason: `autoMode.classifier.model "${params.modelSpec}" is not provider/model-id.` };
+	}
+	const model = params.registry.find(parsed.provider, parsed.modelId) as Model<Api> | undefined;
+	if (!model) {
+		return { kind: "failed", reason: `Classifier model ${params.modelSpec} is not available.` };
+	}
+	const label = boundReviewText(`${model.provider}/${model.id}`, 256);
+
+	const controller = new AbortController();
+	const abortFromCaller = () => controller.abort();
+	if (params.signal?.aborted) controller.abort();
+	else params.signal?.addEventListener("abort", abortFromCaller);
+	const timer = setTimeout(() => controller.abort(), params.timeoutMs);
+
+	try {
+		const response = await params.registry.complete(
+			model,
+			{
+				systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
+				messages: [
+					{
+						role: "user",
+						content: [{ type: "text", text: params.prompt }],
+						timestamp: Date.now(),
+					},
+				],
+			},
+			{ signal: controller.signal, cacheRetention: "none" },
+		);
+		if (controller.signal.aborted) return { kind: "failed", reason: "Classifier was cancelled or timed out." };
+		if (response.stopReason === "error" || response.stopReason === "aborted") {
+			return { kind: "failed", reason: response.errorMessage ?? `Classifier stopped: ${response.stopReason}` };
+		}
+		const text = response.content
+			.filter((block): block is { type: "text"; text: string } => block.type === "text")
+			.map((block) => block.text)
+			.join("")
+			.trim()
+			.toLowerCase();
+		if (/^high\b/.test(text)) return { kind: "high", model: label };
+		if (/^low\b/.test(text)) return { kind: "low", model: label };
+		return { kind: "failed", reason: `Classifier returned unreadable output: ${boundReviewText(text, 80)}` };
+	} catch (error) {
+		return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
+	} finally {
+		clearTimeout(timer);
+		params.signal?.removeEventListener("abort", abortFromCaller);
+	}
+}