pi-openai-toolkit 0.7.0 → 0.7.2

package/README.md

@@ -163,6 +163,7 @@ Content-Type: application/json
 - **Validation Criteria**: Must return a valid SSE stream with `response.completed` (status `completed`) containing exactly one output item of `type: "compaction"` with non-empty `encrypted_content`.
 - **Remote Model Override**: `compaction.remoteCompactModel` can assign a same-gateway Responses model as the checkpoint producer while the active model remains the consumer. Its registered model metadata, authentication, headers, and effective base URL are used only for the synthetic compact request. Existing and recursive checkpoints remain replayable by the active model.
 - **Zero Loss Replay**: The opaque encrypted item is stored in `CompactionEntry.details.compactedWindow`. On subsequent requests, it is transparently prepended after fresh preamble instructions alongside live turns, eliminating lossy text re-summaries.
+- **Fail-Closed Replay Guard**: Replay anchors on the Pi-authored compaction summary item by content and replaces it with the opaque compacted window; the post-compaction context is preserved verbatim, so transient messages injected by other extensions no longer block replay. If the summary anchor cannot be found, the toolkit aborts the provider request, shows an error notification, and always writes a content-free `*-replay-failure.json` artifact even when `logProviderPayloads` is disabled. The sentinel-only payload is never sent to the model.
 - **Graceful Multi-Tier Fallback**:
   1. Compatible Responses endpoints → Remote v2 Opaque Compaction.
   2. Gateway failure or non-Responses model → Configured `compaction.model` fallback.

package/README_zh.md

@@ -163,6 +163,7 @@ Content-Type: application/json
 - **校验标准**：接收 SSE 流并验证 `response.completed` 事件（状态为 `completed`），且返回且仅返回一个包含非空 `encrypted_content` 密文的 `type: "compaction"` 数据块。
 - **远端压缩模型覆盖**：`compaction.remoteCompactModel` 可以让同一网关上的另一个 Responses 模型负责生成 checkpoint，而当前活动模型仍是 checkpoint 的消费者。synthetic 压缩请求会使用覆盖模型在注册表中的模型元数据、认证、请求头和实际 Base URL；旧 checkpoint、递归压缩 checkpoint 都仍由当前活动模型重放。
 - **无损重放机制**：密文数据完整存入 `CompactionEntry.details.compactedWindow`。在后续对话中，插件会自动将密文插入在最新的系统指令之后与最新几轮消息之前，实现完全服务端无损上下文还原。
+- **重放失败保护（Fail-Closed）**：重放以 Pi 生成的 compaction summary 哨兵为内容锚点，将其替换为密文压缩窗口；压缩后的其余上下文一律原样保留，因此其他扩展注入的临时消息不再阻断重放。若找不到哨兵锚点，插件会中止 provider 请求、弹出错误通知，并且即使 `logProviderPayloads` 关闭也会写入一份不含内容的安全失败记录 `*-replay-failure.json`。只含哨兵占位符的请求体永远不会发送给模型。
 - **三级优雅降级**：
   1. 支持的 Responses 端点 → 触发 Remote v2 密文无损压缩；
   2. 网关不支持或报错 → 降级调用用户指定的 `compaction.model`；

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-openai-toolkit",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "private": false,
   "type": "module",
   "description": "OpenAI-focused Pi toolkit providing remote Responses compaction and native Web Search.",

package/src/debug.ts

@@ -177,3 +177,61 @@ export function writeDebugArtifact(
 	fs.writeFileSync(filePath, `${JSON.stringify(envelope, null, 2)}\n`, "utf8");
 	return filePath;
 }
+
+/**
+ * Always-written, content-free failure record for an opaque replay failure.
+ *
+ * Unlike regular payload artifacts this is not gated by logProviderPayloads:
+ * a replay failure is a continuity-loss incident, not optional payload logging.
+ * It contains only structural parity signatures and identity metadata; prompt
+ * text, user content, credentials, and encrypted_content are never included
+ * (critical redaction is applied unconditionally).
+ */
+export function writeReplayFailureArtifact(
+	details: {
+		reason: string;
+		parity?: { actual: string[]; expected: string[]; mismatches: string[] };
+		compactionEntryId?: string;
+		provider?: string;
+		api?: string;
+		model?: string;
+	},
+	settings: CompactionConfig,
+	context: ArtifactContext,
+): string | undefined {
+	try {
+		const sessionInfo = toSessionInfo(context);
+		const paths = resolveArtifactPaths(settings, context);
+		const targetDir = selectArtifactDirectory(paths, "provider-request");
+		ensureDir(targetDir);
+
+		const timestamp = new Date().toISOString();
+		const filePath = path.join(targetDir, `${timestamp.replace(/[.:]/g, "-")}-replay-failure.json`);
+		const data = redactCriticalValue({
+			event: "before_provider_request.rewrite-failed",
+			reason: details.reason,
+			parity: details.parity,
+			compactionEntryId: details.compactionEntryId,
+			provider: details.provider,
+			api: details.api,
+			model: details.model,
+		});
+		const envelope: DebugArtifactEnvelope = {
+			extension: COMPACTION_EXTENSION_ID,
+			kind: "provider-request",
+			timestamp,
+			cwd: sessionInfo.cwd,
+			sessionId: sessionInfo.sessionId,
+			sessionFile: sessionInfo.sessionFile,
+			sessionDir: sessionInfo.sessionDir,
+			redaction: { enabled: true },
+			data,
+		};
+		fs.writeFileSync(filePath, `${JSON.stringify(envelope, null, 2)}\n`, "utf8");
+		return filePath;
+	} catch {
+		// The replay failure path itself must never be masked by an artifact write
+		// error; the caller still aborts the provider request.
+		return undefined;
+	}
+}

package/src/extension-runtime.ts

@@ -6,7 +6,7 @@ import type {
 	SessionBeforeCompactEvent,
 } from "@earendil-works/pi-coding-agent";
 import { loadToolkitConfig } from "./config";
-import { writeDebugArtifact } from "./debug";
+import { writeDebugArtifact, writeReplayFailureArtifact } from "./debug";
 import { resolveLatestNativeCompactionEntry } from "./details-store";
 import { runNativeFallbackCompaction } from "./native-fallback";
 import {
@@ -508,6 +508,30 @@ async function handleBeforeProviderRequest(event: BeforeProviderRequestEvent, ct
 			config,
 			ctx,
 		);
+
+		// Fail loud instead of letting Pi send the sentinel-only payload: the
+		// compacted history would be silently lost while the request still succeeds.
+		// A forced redacted failure record is written even when logProviderPayloads
+		// is disabled so the incident is diagnosable without leaking content.
+		writeReplayFailureArtifact(
+			{
+				reason: rewrite.reason,
+				parity: rewrite.parity,
+				compactionEntryId: latestNativeCompactionEntry.id,
+				provider: runtime.provider,
+				api: runtime.api,
+				model: runtime.model,
+			},
+			config,
+			ctx,
+		);
+		if (ctx.hasUI) {
+			ctx.ui.notify(
+				`${COMPACTION_EXTENSION_ID}: native compaction replay failed (${rewrite.reason}); provider request aborted`,
+				"error",
+			);
+		}
+		ctx.abort();
 		return undefined;
 	}
 
@@ -524,12 +548,10 @@ async function handleBeforeProviderRequest(event: BeforeProviderRequestEvent, ct
 			firstKeptEntryIndex: rewrite.segments.firstKeptEntryIndex,
 			originalInputItems: payload.input.length,
 			rewrittenInputItems: rewrite.rewrittenPayload.input.length,
-			freshPreambleItems: rewrite.segments.freshPreamble.length,
-			trailingPreambleItems: rewrite.segments.trailingPreamble.length,
+			leadingItems: rewrite.segments.leading.length,
 			compactionSummaryItems: rewrite.segments.compactionSummary.length,
-			preCompactionKeptItems: rewrite.segments.preCompactionKeptWindow.input.length,
 			compactedItems: rewrite.segments.compactedWindow.length,
-			postCompactionTailItems: rewrite.segments.postCompactionTail.input.length,
+			postItems: rewrite.segments.post.length,
 			payload: rewrite.rewrittenPayload,
 			originalPayload: payload,
 		},

package/src/payload-rewrite.ts

@@ -9,37 +9,16 @@ import type {
 import type { ResponsesCompatibleRequestPayload } from "./runtime";
 import { rewritePayloadWithDeferredToolCarryover } from "./deferred-tool-carryover";
 import type { NativeCompactionEntry } from "./types";
-import {
-	compareResponsesInputParity,
-	serializeMessagesToResponsesInput,
-	type ResponsesInputContentItem,
-	type ResponsesInputItem,
-	type ResponsesInputMessageItem,
-} from "./serializer";
-
-export type FreshAuthoritativePreamble = {
-	instructions?: string;
-	leadingInput: ResponsesInputMessageItem[];
-	trailingInput: ResponsesInputMessageItem[];
-};
-
-export type SerializedReplaySlice = {
-	entries: SessionEntry[];
-	messages: AgentMessage[];
-	input: ResponsesInputItem[];
-};
+import { serializeMessagesToResponsesInput, type ResponsesInputContentItem, type ResponsesInputItem, type ResponsesInputMessageItem } from "./serializer";
 
 export type NativeReplaySegments = {
 	boundaryIndex: number;
 	firstKeptEntryIndex: number;
 	instructions?: string;
-	freshPreamble: ResponsesInputMessageItem[];
-	trailingPreamble: ResponsesInputMessageItem[];
+	leading: ResponsesInputItem[];
 	compactionSummary: ResponsesInputItem[];
-	preCompactionKeptWindow: SerializedReplaySlice;
 	compactedWindow: unknown[];
-	postCompactionTail: SerializedReplaySlice;
-	originalPiReplayInput: ResponsesInputItem[];
+	post: ResponsesInputItem[];
 	replayInput: unknown[];
 };
 
@@ -52,10 +31,9 @@ export type NativeReplayPayloadRewrite = {
 export type NativeReplayPayloadRewriteFailureReason =
 	| "compaction-boundary-not-found"
 	| "first-kept-entry-not-found"
-	| "unsupported-instructions"
 	| "invalid-compacted-window"
 	| "unexpected-compaction-after-boundary"
-	| "expected-pi-replay-mismatch";
+	| "compaction-summary-not-found";
 
 export type NativeReplayPayloadRewriteFailure = {
 	ok: false;
@@ -95,19 +73,6 @@ function isResponsesInputMessageRole(value: unknown): value is ResponsesInputMes
 	return value === "user" || value === "developer" || value === "system";
 }
 
-function isPreambleRole(value: ResponsesInputMessageItem["role"]): value is "developer" | "system" {
-	return value === "developer" || value === "system";
-}
-
-function isResponsesInputMessageItem(value: unknown): value is ResponsesInputMessageItem {
-	if (!isRecord(value) || !isResponsesInputMessageRole(value.role)) {
-		return false;
-	}
-
-	const { content } = value;
-	return typeof content === "string" || (Array.isArray(content) && content.every(isResponsesInputContentItem));
-}
-
 function cloneResponsesInputContentItem(item: ResponsesInputContentItem): ResponsesInputContentItem {
 	return item.type === "input_text"
 		? {
@@ -268,44 +233,36 @@ function toReplayAgentMessage(entry: SessionEntry): AgentMessage | undefined {
 	return undefined;
 }
 
-function isPromptEnvelopeItem(item: unknown): item is ResponsesInputMessageItem {
-	return isResponsesInputMessageItem(item) && isPreambleRole(item.role);
-}
-
-export function extractFreshAuthoritativePreamble(
-	payload: ResponsesCompatibleRequestPayload,
-): FreshAuthoritativePreamble | undefined {
-	if (payload.instructions !== undefined && typeof payload.instructions !== "string") {
-		return undefined;
+function extractUserItemText(item: Record<string, unknown>): unknown {
+	const { content } = item;
+	if (typeof content === "string") {
+		return content;
 	}
 
-	// Developer/system items in Pi's Responses payload are prompt-level instructions,
-	// not transcript entries from session history. Preserve them in the same leading
-	// or trailing position that Pi authored so provider-added suffix prompts like
-	// GPT-5's trailing developer "# Juice: 0 !important" survive replay unchanged.
-	let leadingBoundary = 0;
-	while (leadingBoundary < payload.input.length && isPromptEnvelopeItem(payload.input[leadingBoundary])) {
-		leadingBoundary += 1;
+	if (Array.isArray(content)) {
+		const first = content[0];
+		if (isRecord(first) && first.type === "input_text" && typeof first.text === "string") {
+			return first.text;
+		}
 	}
 
-	let trailingBoundary = payload.input.length;
-	while (trailingBoundary > leadingBoundary && isPromptEnvelopeItem(payload.input[trailingBoundary - 1])) {
-		trailingBoundary -= 1;
-	}
+	return undefined;
+}
 
-	for (let index = leadingBoundary; index < trailingBoundary; index++) {
-		if (isPromptEnvelopeItem(payload.input[index])) {
-			return undefined;
+/**
+ * Locate the Pi-authored compaction summary item. The marker text is unique to
+ * this compaction entry, so a content match on the user item is a reliable
+ * single anchor; nothing else in the payload needs to be prefixed or counted.
+ */
+function findCompactionSummaryIndex(input: readonly unknown[], summaryMarker: string): number {
+	return input.findIndex((item) => {
+		if (!isRecord(item) || item.role !== "user") {
+			return false;
 		}
-	}
 
-	return {
-		...(typeof payload.instructions === "string" ? { instructions: payload.instructions } : {}),
-		leadingInput: payload.input.slice(0, leadingBoundary).map((item) => cloneResponsesInputMessageItem(item as ResponsesInputMessageItem)),
-		trailingInput: payload.input
-			.slice(trailingBoundary)
-			.map((item) => cloneResponsesInputMessageItem(item as ResponsesInputMessageItem)),
-	};
+		const text = extractUserItemText(item);
+		return typeof text === "string" && text.includes("<summary>") && text.includes(summaryMarker);
+	});
 }
 
 function collectReplayMessages(entries: readonly SessionEntry[]): AgentMessage[] {
@@ -321,27 +278,6 @@ function collectReplayMessages(entries: readonly SessionEntry[]): AgentMessage[]
 	return messages;
 }
 
-function createCompactionSummaryAgentMessage(entry: NativeCompactionEntry): AgentMessage {
-	return {
-		role: "compactionSummary",
-		summary: entry.summary,
-		tokensBefore: entry.tokensBefore,
-		timestamp: new Date(entry.timestamp).getTime(),
-	} as AgentMessage;
-}
-
-function createReplaySlice(
-	entries: readonly SessionEntry[],
-	messages: readonly AgentMessage[],
-	input: readonly ResponsesInputItem[],
-): SerializedReplaySlice {
-	return {
-		entries: [...entries],
-		messages: [...messages],
-		input: [...input],
-	};
-}
-
 function findEntryIndexByIdBeforeBoundary(
 	entries: readonly SessionEntry[],
 	entryId: string,
@@ -408,14 +344,6 @@ function buildNativeReplaySegmentsInternal<TApi extends Api>(args: {
 		};
 	}
 
-	const freshPreamble = extractFreshAuthoritativePreamble(args.payload);
-	if (!freshPreamble) {
-		return {
-			ok: false,
-			reason: "unsupported-instructions",
-		};
-	}
-
 	const newerCompactionEntry = args.branchEntries
 		.slice(boundaryIndex + 1)
 		.some((entry) => entry.type === "compaction");
@@ -444,81 +372,40 @@ function buildNativeReplaySegmentsInternal<TApi extends Api>(args: {
 
 	const preCompactionEntries = args.branchEntries.slice(firstKeptEntryIndex, boundaryIndex);
 	const postCompactionEntries = args.branchEntries.slice(boundaryIndex + 1);
-	const preCompactionKeptMessages = collectReplayMessages(preCompactionEntries);
-	const postCompactionTailMessages = collectReplayMessages(postCompactionEntries);
-	const compactionSummaryMessage = createCompactionSummaryAgentMessage(args.compactionEntry);
-	const serializedPiHistoryInput = serializeMessagesToResponsesInput(args.model, [
-		compactionSummaryMessage,
-		...preCompactionKeptMessages,
-		...postCompactionTailMessages,
-	]);
-	const originalPiReplayInput: ResponsesInputItem[] = [
-		...freshPreamble.leadingInput,
-		...serializedPiHistoryInput,
-		...freshPreamble.trailingInput,
-	];
-
-	if (!areEquivalentValues(args.payload.input, originalPiReplayInput)) {
-		const parity = compareResponsesInputParity(args.payload.input, originalPiReplayInput);
+
+	// Pi-authored compaction summary item. Pi 0.84.3 renders the context after a
+	// compaction as [leading prompts][summary item][all post-compaction messages]:
+	// pre-compaction messages never appear in the payload (entry.retainedTail is
+	// never persisted by appendCompaction), so the summary item itself is the only
+	// anchor and the only thing that gets replaced. Everything else is preserved
+	// verbatim, so transient messages injected by other extensions stay intact.
+	const summaryIndex = findCompactionSummaryIndex(args.payload.input, args.compactionEntry.summary);
+	if (summaryIndex < 0) {
 		return {
 			ok: false,
-			reason: "expected-pi-replay-mismatch",
-			parity: {
-				actual: parity.actual,
-				expected: parity.expected,
-				mismatches: parity.mismatches,
-			},
+			reason: "compaction-summary-not-found",
 		};
 	}
 
-	const freshPreambleCount = freshPreamble.leadingInput.length;
-	const trailingPreambleCount = freshPreamble.trailingInput.length;
-	const compactionSummaryCount = serializeMessagesToResponsesInput(args.model, [compactionSummaryMessage]).length;
-	const preCompactionKeptCount = serializeMessagesToResponsesInput(args.model, preCompactionKeptMessages).length;
-	const tailStartIndex = freshPreambleCount + compactionSummaryCount + preCompactionKeptCount;
-	const tailEndIndex = args.payload.input.length - trailingPreambleCount;
-	const actualCompactionSummary = cloneResponsesInputSlice(
-		args.payload.input.slice(freshPreambleCount, freshPreambleCount + compactionSummaryCount),
-	);
-	const actualPreCompactionKeptWindow = cloneResponsesInputSlice(
-		args.payload.input.slice(
-			freshPreambleCount + compactionSummaryCount,
-			freshPreambleCount + compactionSummaryCount + preCompactionKeptCount,
-		),
-	);
-	const actualPostCompactionTail = cloneResponsesInputSlice(args.payload.input.slice(tailStartIndex, tailEndIndex));
-	if (!actualCompactionSummary || !actualPreCompactionKeptWindow || !actualPostCompactionTail) {
+	const leadingInput = cloneResponsesInputSlice(args.payload.input.slice(0, summaryIndex));
+	const actualCompactionSummary = cloneResponsesInputSlice([args.payload.input[summaryIndex]]);
+	const actualPostInput = cloneResponsesInputSlice(args.payload.input.slice(summaryIndex + 1));
+	if (!leadingInput || !actualCompactionSummary || !actualPostInput) {
 		return {
 			ok: false,
-			reason: "expected-pi-replay-mismatch",
+			reason: "compaction-summary-not-found",
 		};
 	}
 
-	const preCompactionKeptWindow = createReplaySlice(
-		preCompactionEntries,
-		preCompactionKeptMessages,
-		actualPreCompactionKeptWindow,
-	);
-	const postCompactionTail = createReplaySlice(
-		postCompactionEntries,
-		postCompactionTailMessages,
-		actualPostCompactionTail,
-	);
 	const baseRewrittenPayload: ResponsesCompatibleRequestPayload = {
 		...args.payload,
-		...(freshPreamble.instructions !== undefined ? { instructions: freshPreamble.instructions } : {}),
-		input: [
-			...freshPreamble.leadingInput,
-			...compactedWindow,
-			...actualPostCompactionTail,
-			...freshPreamble.trailingInput,
-		],
+		input: [...leadingInput, ...compactedWindow, ...actualPostInput],
 	};
 	const carryoverRewrite = rewritePayloadWithDeferredToolCarryover({
 		payload: baseRewrittenPayload,
 		carryover: details.deferredToolCarryover,
 		compactionEntryId: args.compactionEntry.id,
-		checkpointEndIndex: freshPreamble.leadingInput.length + compactedWindow.length,
+		checkpointEndIndex: leadingInput.length + compactedWindow.length,
 		compat: args.model.compat as
 			| { supportsAdditionalTools?: boolean; supportsToolSearch?: boolean }
 			| undefined,
@@ -529,14 +416,11 @@ function buildNativeReplaySegmentsInternal<TApi extends Api>(args: {
 		segments: {
 			boundaryIndex,
 			firstKeptEntryIndex,
-			instructions: freshPreamble.instructions,
-			freshPreamble: freshPreamble.leadingInput,
-			trailingPreamble: freshPreamble.trailingInput,
+			instructions: typeof args.payload.instructions === "string" ? args.payload.instructions : undefined,
+			leading: leadingInput,
 			compactionSummary: actualCompactionSummary,
-			preCompactionKeptWindow,
 			compactedWindow,
-			postCompactionTail,
-			originalPiReplayInput,
+			post: actualPostInput,
 			replayInput: carryoverRewrite.payload.input,
 		},
 		rewrittenPayload: carryoverRewrite.payload,