pi-openai-toolkit 0.7.0 → 0.7.1

package/README.md

@@ -163,6 +163,7 @@ Content-Type: application/json
 - **Validation Criteria**: Must return a valid SSE stream with `response.completed` (status `completed`) containing exactly one output item of `type: "compaction"` with non-empty `encrypted_content`.
 - **Remote Model Override**: `compaction.remoteCompactModel` can assign a same-gateway Responses model as the checkpoint producer while the active model remains the consumer. Its registered model metadata, authentication, headers, and effective base URL are used only for the synthetic compact request. Existing and recursive checkpoints remain replayable by the active model.
 - **Zero Loss Replay**: The opaque encrypted item is stored in `CompactionEntry.details.compactedWindow`. On subsequent requests, it is transparently prepended after fresh preamble instructions alongside live turns, eliminating lossy text re-summaries.
+- **Fail-Closed Replay Guard**: Replay verifies only the compaction summary sentinel plus the kept pre-compaction window derived from session entries; leading/trailing prompts and the post-compaction live tail are preserved verbatim, so transient messages injected by other extensions no longer block replay. If the kept region cannot be verified (e.g. `expected-pi-replay-mismatch` or `compaction-summary-not-found`), the toolkit aborts the provider request, shows an error notification, and always writes a content-free `*-replay-failure.json` artifact even when `logProviderPayloads` is disabled. The sentinel-only payload is never sent to the model.
 - **Graceful Multi-Tier Fallback**:
   1. Compatible Responses endpoints → Remote v2 Opaque Compaction.
   2. Gateway failure or non-Responses model → Configured `compaction.model` fallback.

package/README_zh.md

@@ -163,6 +163,7 @@ Content-Type: application/json
 - **校验标准**：接收 SSE 流并验证 `response.completed` 事件（状态为 `completed`），且返回且仅返回一个包含非空 `encrypted_content` 密文的 `type: "compaction"` 数据块。
 - **远端压缩模型覆盖**：`compaction.remoteCompactModel` 可以让同一网关上的另一个 Responses 模型负责生成 checkpoint，而当前活动模型仍是 checkpoint 的消费者。synthetic 压缩请求会使用覆盖模型在注册表中的模型元数据、认证、请求头和实际 Base URL；旧 checkpoint、递归压缩 checkpoint 都仍由当前活动模型重放。
 - **无损重放机制**：密文数据完整存入 `CompactionEntry.details.compactedWindow`。在后续对话中，插件会自动将密文插入在最新的系统指令之后与最新几轮消息之前，实现完全服务端无损上下文还原。
+- **重放失败保护（Fail-Closed）**：重放只校验 compaction summary 哨兵项以及由 session entries 推导出的压缩前保留窗口；前置/后置 prompt 与压缩后的实时尾部消息一律原样保留，因此其他扩展注入的临时消息不再阻断重放。若保留窗口无法与 session entries 对齐（如 `expected-pi-replay-mismatch`、`compaction-summary-not-found`），插件会中止 provider 请求、弹出错误通知，并且即使 `logProviderPayloads` 关闭也会写入一份不含内容的安全失败记录 `*-replay-failure.json`。只含哨兵占位符的请求体永远不会发送给模型。
 - **三级优雅降级**：
   1. 支持的 Responses 端点 → 触发 Remote v2 密文无损压缩；
   2. 网关不支持或报错 → 降级调用用户指定的 `compaction.model`；

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-openai-toolkit",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "private": false,
   "type": "module",
   "description": "OpenAI-focused Pi toolkit providing remote Responses compaction and native Web Search.",

package/src/debug.ts

@@ -177,3 +177,61 @@ export function writeDebugArtifact(
 	fs.writeFileSync(filePath, `${JSON.stringify(envelope, null, 2)}\n`, "utf8");
 	return filePath;
 }
+
+/**
+ * Always-written, content-free failure record for an opaque replay failure.
+ *
+ * Unlike regular payload artifacts this is not gated by logProviderPayloads:
+ * a replay failure is a continuity-loss incident, not optional payload logging.
+ * It contains only structural parity signatures and identity metadata; prompt
+ * text, user content, credentials, and encrypted_content are never included
+ * (critical redaction is applied unconditionally).
+ */
+export function writeReplayFailureArtifact(
+	details: {
+		reason: string;
+		parity?: { actual: string[]; expected: string[]; mismatches: string[] };
+		compactionEntryId?: string;
+		provider?: string;
+		api?: string;
+		model?: string;
+	},
+	settings: CompactionConfig,
+	context: ArtifactContext,
+): string | undefined {
+	try {
+		const sessionInfo = toSessionInfo(context);
+		const paths = resolveArtifactPaths(settings, context);
+		const targetDir = selectArtifactDirectory(paths, "provider-request");
+		ensureDir(targetDir);
+
+		const timestamp = new Date().toISOString();
+		const filePath = path.join(targetDir, `${timestamp.replace(/[.:]/g, "-")}-replay-failure.json`);
+		const data = redactCriticalValue({
+			event: "before_provider_request.rewrite-failed",
+			reason: details.reason,
+			parity: details.parity,
+			compactionEntryId: details.compactionEntryId,
+			provider: details.provider,
+			api: details.api,
+			model: details.model,
+		});
+		const envelope: DebugArtifactEnvelope = {
+			extension: COMPACTION_EXTENSION_ID,
+			kind: "provider-request",
+			timestamp,
+			cwd: sessionInfo.cwd,
+			sessionId: sessionInfo.sessionId,
+			sessionFile: sessionInfo.sessionFile,
+			sessionDir: sessionInfo.sessionDir,
+			redaction: { enabled: true },
+			data,
+		};
+		fs.writeFileSync(filePath, `${JSON.stringify(envelope, null, 2)}\n`, "utf8");
+		return filePath;
+	} catch {
+		// The replay failure path itself must never be masked by an artifact write
+		// error; the caller still aborts the provider request.
+		return undefined;
+	}
+}

package/src/extension-runtime.ts

@@ -6,7 +6,7 @@ import type {
 	SessionBeforeCompactEvent,
 } from "@earendil-works/pi-coding-agent";
 import { loadToolkitConfig } from "./config";
-import { writeDebugArtifact } from "./debug";
+import { writeDebugArtifact, writeReplayFailureArtifact } from "./debug";
 import { resolveLatestNativeCompactionEntry } from "./details-store";
 import { runNativeFallbackCompaction } from "./native-fallback";
 import {
@@ -508,6 +508,30 @@ async function handleBeforeProviderRequest(event: BeforeProviderRequestEvent, ct
 			config,
 			ctx,
 		);
+
+		// Fail loud instead of letting Pi send the sentinel-only payload: the
+		// compacted history would be silently lost while the request still succeeds.
+		// A forced redacted failure record is written even when logProviderPayloads
+		// is disabled so the incident is diagnosable without leaking content.
+		writeReplayFailureArtifact(
+			{
+				reason: rewrite.reason,
+				parity: rewrite.parity,
+				compactionEntryId: latestNativeCompactionEntry.id,
+				provider: runtime.provider,
+				api: runtime.api,
+				model: runtime.model,
+			},
+			config,
+			ctx,
+		);
+		if (ctx.hasUI) {
+			ctx.ui.notify(
+				`${COMPACTION_EXTENSION_ID}: native compaction replay failed (${rewrite.reason}); provider request aborted`,
+				"error",
+			);
+		}
+		ctx.abort();
 		return undefined;
 	}
 

package/src/payload-rewrite.ts

@@ -17,12 +17,6 @@ import {
 	type ResponsesInputMessageItem,
 } from "./serializer";
 
-export type FreshAuthoritativePreamble = {
-	instructions?: string;
-	leadingInput: ResponsesInputMessageItem[];
-	trailingInput: ResponsesInputMessageItem[];
-};
-
 export type SerializedReplaySlice = {
 	entries: SessionEntry[];
 	messages: AgentMessage[];
@@ -52,10 +46,10 @@ export type NativeReplayPayloadRewrite = {
 export type NativeReplayPayloadRewriteFailureReason =
 	| "compaction-boundary-not-found"
 	| "first-kept-entry-not-found"
-	| "unsupported-instructions"
 	| "invalid-compacted-window"
 	| "unexpected-compaction-after-boundary"
-	| "expected-pi-replay-mismatch";
+	| "expected-pi-replay-mismatch"
+	| "compaction-summary-not-found";
 
 export type NativeReplayPayloadRewriteFailure = {
 	ok: false;
@@ -268,44 +262,50 @@ function toReplayAgentMessage(entry: SessionEntry): AgentMessage | undefined {
 	return undefined;
 }
 
-function isPromptEnvelopeItem(item: unknown): item is ResponsesInputMessageItem {
-	return isResponsesInputMessageItem(item) && isPreambleRole(item.role);
-}
-
-export function extractFreshAuthoritativePreamble(
-	payload: ResponsesCompatibleRequestPayload,
-): FreshAuthoritativePreamble | undefined {
-	if (payload.instructions !== undefined && typeof payload.instructions !== "string") {
-		return undefined;
+function extractUserItemText(item: Record<string, unknown>): unknown {
+	const { content } = item;
+	if (typeof content === "string") {
+		return content;
 	}
 
-	// Developer/system items in Pi's Responses payload are prompt-level instructions,
-	// not transcript entries from session history. Preserve them in the same leading
-	// or trailing position that Pi authored so provider-added suffix prompts like
-	// GPT-5's trailing developer "# Juice: 0 !important" survive replay unchanged.
-	let leadingBoundary = 0;
-	while (leadingBoundary < payload.input.length && isPromptEnvelopeItem(payload.input[leadingBoundary])) {
-		leadingBoundary += 1;
+	if (Array.isArray(content)) {
+		const first = content[0];
+		if (isRecord(first) && first.type === "input_text" && typeof first.text === "string") {
+			return first.text;
+		}
 	}
 
-	let trailingBoundary = payload.input.length;
-	while (trailingBoundary > leadingBoundary && isPromptEnvelopeItem(payload.input[trailingBoundary - 1])) {
-		trailingBoundary -= 1;
-	}
+	return undefined;
+}
 
-	for (let index = leadingBoundary; index < trailingBoundary; index++) {
-		if (isPromptEnvelopeItem(payload.input[index])) {
-			return undefined;
+/**
+ * Locate the Pi-authored compaction summary item. The marker text is unique to
+ * this compaction entry, so a content match on the user item is a reliable
+ * single anchor; nothing else in the payload needs to be prefixed or counted.
+ */
+function findCompactionSummaryIndex(input: readonly unknown[], summaryMarker: string): number {
+	return input.findIndex((item) => {
+		if (!isRecord(item) || item.role !== "user") {
+			return false;
 		}
-	}
 
-	return {
-		...(typeof payload.instructions === "string" ? { instructions: payload.instructions } : {}),
-		leadingInput: payload.input.slice(0, leadingBoundary).map((item) => cloneResponsesInputMessageItem(item as ResponsesInputMessageItem)),
-		trailingInput: payload.input
-			.slice(trailingBoundary)
-			.map((item) => cloneResponsesInputMessageItem(item as ResponsesInputMessageItem)),
-	};
+		const text = extractUserItemText(item);
+		return typeof text === "string" && text.includes("<summary>") && text.includes(summaryMarker);
+	});
+}
+
+/** Count consecutive provider-authored developer/system items at the end of the input. */
+function countTrailingPreambleItems(items: readonly unknown[]): number {
+	let count = 0;
+	for (let index = items.length - 1; index >= 0; index--) {
+		const item = items[index];
+		if (isResponsesInputMessageItem(item) && isPreambleRole(item.role)) {
+			count += 1;
+			continue;
+		}
+		break;
+	}
+	return count;
 }
 
 function collectReplayMessages(entries: readonly SessionEntry[]): AgentMessage[] {
@@ -408,14 +408,6 @@ function buildNativeReplaySegmentsInternal<TApi extends Api>(args: {
 		};
 	}
 
-	const freshPreamble = extractFreshAuthoritativePreamble(args.payload);
-	if (!freshPreamble) {
-		return {
-			ok: false,
-			reason: "unsupported-instructions",
-		};
-	}
-
 	const newerCompactionEntry = args.branchEntries
 		.slice(boundaryIndex + 1)
 		.some((entry) => entry.type === "compaction");
@@ -447,19 +439,38 @@ function buildNativeReplaySegmentsInternal<TApi extends Api>(args: {
 	const preCompactionKeptMessages = collectReplayMessages(preCompactionEntries);
 	const postCompactionTailMessages = collectReplayMessages(postCompactionEntries);
 	const compactionSummaryMessage = createCompactionSummaryAgentMessage(args.compactionEntry);
-	const serializedPiHistoryInput = serializeMessagesToResponsesInput(args.model, [
-		compactionSummaryMessage,
-		...preCompactionKeptMessages,
-		...postCompactionTailMessages,
-	]);
-	const originalPiReplayInput: ResponsesInputItem[] = [
-		...freshPreamble.leadingInput,
-		...serializedPiHistoryInput,
-		...freshPreamble.trailingInput,
-	];
+	const keptWindowSerialized = serializeMessagesToResponsesInput(args.model, preCompactionKeptMessages);
 
-	if (!areEquivalentValues(args.payload.input, originalPiReplayInput)) {
-		const parity = compareResponsesInputParity(args.payload.input, originalPiReplayInput);
+	// Pi-authored compaction summary item. Everything outside the replaced region
+	// is preserved verbatim, so this content anchor is the only location probe
+	// needed; the marker text is unique to this compaction entry.
+	const summaryIndex = findCompactionSummaryIndex(args.payload.input, args.compactionEntry.summary);
+	if (summaryIndex < 0) {
+		return {
+			ok: false,
+			reason: "compaction-summary-not-found",
+		};
+	}
+
+	const keptStart = summaryIndex + 1;
+	const keptEnd = keptStart + keptWindowSerialized.length;
+	const actualKeptWindow = cloneResponsesInputSlice(args.payload.input.slice(keptStart, keptEnd));
+	if (!actualKeptWindow) {
+		return {
+			ok: false,
+			reason: "expected-pi-replay-mismatch",
+		};
+	}
+
+	// The only hard verification: the region immediately after the sentinel must be
+	// exactly the kept pre-compaction window derived from session entries. Content
+	// after this region is preserved as-is, so transient messages injected by other
+	// extensions (which have no session entries) no longer break replay.
+	if (!areEquivalentValues(actualKeptWindow, keptWindowSerialized)) {
+		const parity = compareResponsesInputParity(
+			args.payload.input.slice(keptStart, keptEnd),
+			keptWindowSerialized,
+		);
 		return {
 			ok: false,
 			reason: "expected-pi-replay-mismatch",
@@ -471,71 +482,73 @@ function buildNativeReplaySegmentsInternal<TApi extends Api>(args: {
 		};
 	}
 
-	const freshPreambleCount = freshPreamble.leadingInput.length;
-	const trailingPreambleCount = freshPreamble.trailingInput.length;
-	const compactionSummaryCount = serializeMessagesToResponsesInput(args.model, [compactionSummaryMessage]).length;
-	const preCompactionKeptCount = serializeMessagesToResponsesInput(args.model, preCompactionKeptMessages).length;
-	const tailStartIndex = freshPreambleCount + compactionSummaryCount + preCompactionKeptCount;
-	const tailEndIndex = args.payload.input.length - trailingPreambleCount;
-	const actualCompactionSummary = cloneResponsesInputSlice(
-		args.payload.input.slice(freshPreambleCount, freshPreambleCount + compactionSummaryCount),
-	);
-	const actualPreCompactionKeptWindow = cloneResponsesInputSlice(
-		args.payload.input.slice(
-			freshPreambleCount + compactionSummaryCount,
-			freshPreambleCount + compactionSummaryCount + preCompactionKeptCount,
-		),
-	);
-	const actualPostCompactionTail = cloneResponsesInputSlice(args.payload.input.slice(tailStartIndex, tailEndIndex));
-	if (!actualCompactionSummary || !actualPreCompactionKeptWindow || !actualPostCompactionTail) {
+	const actualCompactionSummary = cloneResponsesInputSlice([args.payload.input[summaryIndex]]);
+	const actualPostCompactionTail = cloneResponsesInputSlice(args.payload.input.slice(keptEnd));
+	if (!actualCompactionSummary || !actualPostCompactionTail) {
+		return {
+			ok: false,
+			reason: "expected-pi-replay-mismatch",
+		};
+	}
+
+	// Keep provider-authored trailing developer/system prompts in place.
+	const trailingCount = countTrailingPreambleItems(actualPostCompactionTail);
+	const trailingPreamble = actualPostCompactionTail.slice(actualPostCompactionTail.length - trailingCount);
+	const liveTail = actualPostCompactionTail.slice(0, actualPostCompactionTail.length - trailingCount);
+
+	const leadingInput = cloneResponsesInputSlice(args.payload.input.slice(0, summaryIndex));
+	if (!leadingInput) {
 		return {
 			ok: false,
 			reason: "expected-pi-replay-mismatch",
 		};
 	}
 
-	const preCompactionKeptWindow = createReplaySlice(
-		preCompactionEntries,
-		preCompactionKeptMessages,
-		actualPreCompactionKeptWindow,
-	);
-	const postCompactionTail = createReplaySlice(
-		postCompactionEntries,
-		postCompactionTailMessages,
-		actualPostCompactionTail,
-	);
 	const baseRewrittenPayload: ResponsesCompatibleRequestPayload = {
 		...args.payload,
-		...(freshPreamble.instructions !== undefined ? { instructions: freshPreamble.instructions } : {}),
 		input: [
-			...freshPreamble.leadingInput,
+			...leadingInput,
 			...compactedWindow,
-			...actualPostCompactionTail,
-			...freshPreamble.trailingInput,
+			...liveTail,
+			...trailingPreamble,
 		],
 	};
 	const carryoverRewrite = rewritePayloadWithDeferredToolCarryover({
 		payload: baseRewrittenPayload,
 		carryover: details.deferredToolCarryover,
 		compactionEntryId: args.compactionEntry.id,
-		checkpointEndIndex: freshPreamble.leadingInput.length + compactedWindow.length,
+		checkpointEndIndex: leadingInput.length + compactedWindow.length,
 		compat: args.model.compat as
 			| { supportsAdditionalTools?: boolean; supportsToolSearch?: boolean }
 			| undefined,
 	});
 
+	const sentinelSerialized = serializeMessagesToResponsesInput(args.model, [compactionSummaryMessage]);
+	const serializedTailInput = serializeMessagesToResponsesInput(args.model, postCompactionTailMessages);
+	const originalPiReplayInput: ResponsesInputItem[] = [
+		...leadingInput,
+		...sentinelSerialized,
+		...keptWindowSerialized,
+		...serializedTailInput,
+		...trailingPreamble,
+	];
+
 	return {
 		ok: true,
 		segments: {
 			boundaryIndex,
 			firstKeptEntryIndex,
-			instructions: freshPreamble.instructions,
-			freshPreamble: freshPreamble.leadingInput,
-			trailingPreamble: freshPreamble.trailingInput,
+			instructions: typeof args.payload.instructions === "string" ? args.payload.instructions : undefined,
+			freshPreamble: leadingInput as ResponsesInputMessageItem[],
+			trailingPreamble: trailingPreamble as ResponsesInputMessageItem[],
 			compactionSummary: actualCompactionSummary,
-			preCompactionKeptWindow,
+			preCompactionKeptWindow: createReplaySlice(
+				preCompactionEntries,
+				preCompactionKeptMessages,
+				actualKeptWindow,
+			),
 			compactedWindow,
-			postCompactionTail,
+			postCompactionTail: createReplaySlice(postCompactionEntries, postCompactionTailMessages, liveTail),
 			originalPiReplayInput,
 			replayInput: carryoverRewrite.payload.input,
 		},