thinkpool-pair 0.7.364 → 0.7.366

package/event-id.mjs

@@ -1,549 +1 @@
-import { randomUUID } from 'node:crypto'
-import { boundStructuredEvent, STRUCTURED_EVENT_CAP } from './event-bounds.mjs'
-import { classifyCodeEvent } from './code-event-contract.mjs'
-
-/* event-id.mjs — stamp a structured event with a stable identity + timestamp
-   BEFORE it is logged + broadcast.
-
-   WHY (the duplicate-message bug, 2026-06-19): structured transcript events
-   (assistant / tool_result / thinking / result) carry NO id from the Claude
-   Agent SDK. The web room's replay-union (src/pages/code/room.jsx, the
-   `code-replay` handler) dedupes ONLY by `cid`: an event with a cid is merged
-   once; an event WITHOUT a cid is appended unconditionally. So an id-less event
-   that arrives both LIVE (`code-event`) and again in a reconnect REPLAY
-   (`code-replay`, which re-sends the whole rolling log) is rendered TWICE.
-   On mobile a background/foreground or network blip routinely triggers that
-   replay — which is exactly when the duplicates appeared.
-
-   Fix at the source: give every structured event a stable `cid` here, once, so
-   the live copy and every replayed copy share an id and the room's existing
-   cid-union collapses them. Idempotent — never overwrites a cid the client
-   already set (chat / whisper / pool / propose carry their own).
-
-   Kept as its own import-safe module so it can be unit-tested
-   (bridge/test-structured-cid.mjs); bridge.mjs runs the bridge on import and
-   cannot be imported by a test. */
-export function stampEvent(evt, gen = randomUUID) {
-  if (!evt || typeof evt !== 'object') return evt
-  if (typeof evt.ts !== 'number') evt.ts = Date.now()
-  if (!evt.cid) evt.cid = gen()
-  return evt
-}
-
-/* C1 (RT-2): a per-term monotonic, CONTIGUOUS sequence counter. Every event that
-   enters a session's replayed log gets `seq = counter.next()`, so the web room can
-   replay-from-cursor and dedup by "drop ≤ seqHi" instead of re-merging the whole
-   log by cid on every reconnect (see src/pages/code/seqDedup.js).
-
-   THE restart property (what makes Slice 3's between-turns restart dup-free): when a
-   bridge restart restores a persisted log, seed the counter from maxSeq(log) so the
-   NEXT seq is strictly above every restored seq. Reusing an old seq would make the
-   client drop the fresh event as a duplicate. */
-export function makeSeqCounter(startAfter = 0) {
-  let n = Number.isFinite(startAfter) ? startAfter : 0
-  return {
-    next: () => ++n,
-    bumpTo: (m) => { if (Number.isFinite(m) && m > n) n = m },
-    current: () => n,
-  }
-}
-
-// Kinds the bridge logs for the live transcript but that the WEB treats as
-// replay-chrome (src/pages/code/code-constants.js REPLAY_CHROME): filtered out of
-// the replay + handled as transient state, never applied as a transcript line. They
-// must NOT consume a per-term seq — the client advances its cursor (seqHi) ONLY over
-// transcript events, so a seq on one of these would leave a hole in the applied
-// sequence → the client sees a false gap → spurious resync storms. So the counter
-// skips them and they ride the log seq-less (the client cid-handles/ignores them).
-// MUST equal REPLAY_CHROME ∩ {kinds the bridge logs} — guarded by bridge/test-seq.mjs
-// S6. (mode/usage/clear/compact/stalled are bridge-chrome and never logged at all, so
-// they never reach the counter.) 2026-07-02: models/queue-add/queue-cancel/propose-done/
-// update-available were MISSING here — they're bridge-logged but web-filtered, so they
-// consumed a seq + set the durable archive floor while the client dropped them, leaving
-// the client's oldest RENDERED seq above the floor → a phantom "load earlier history"
-// pill on a fresh lane (models fires on every session init) that fetched nothing.
-export const NO_SEQ_KINDS = new Set(['system', 'thinking_tokens', 'effort', 'models', 'queue-add', 'queue-cancel', 'propose-done', 'update-available'])
-export const seqable = (evt) => {
-  if (!evt || typeof evt !== 'object') return false
-  return classifyCodeEvent(evt, { strict: false }).known && !NO_SEQ_KINDS.has(evt.kind)
-}
-
-// Highest numeric `seq` across a log of events (0 when none) — the floor a restored
-// session's counter resumes above.
-export function maxSeq(events) {
-  if (!Array.isArray(events)) return 0
-  let m = 0
-  for (const e of events) if (e && typeof e.seq === 'number' && e.seq > m) m = e.seq
-  return m
-}
-
-// Cap a replay event list to a byte budget so the broadcast frame fits under the
-// Realtime size limit. THE BUG (2026-06-26, room XE3IQ): on a fresh reload the client
-// sends replay-request with an EMPTY cursor (seqHi=0), so the bridge replied with the
-// ENTIRE per-term log — multi-thousand events / multiple MB for an established terminal.
-// That frame exceeds Realtime's broadcast size limit and is silently DROPPED (and breaks
-// the socket for the rest of the tick, taking small terminals' replays + the CHANNEL_ERROR
-// churn down with it). The terminal then never refills and every live event is gap-dropped
-// → "messages vanish, agent never responds, only brand-new terminals work".
-// Keep the MOST RECENT events that fit: the client's DB transcript snapshot (code_messages
-// tx:, last 200) already renders older history, and seqDedup.classifyReplay explicitly
-// accepts the seq eviction-jump, so the client's live cursor (seqHi) still reaches current.
-// Empirically a ~266KB frame delivered while multi-MB did not; 150KB is a safe margin.
-// Always keeps at least the newest event so seqHi can advance even if it alone is oversized.
-export const REPLAY_BYTE_BUDGET = 150000
-export function capReplayEvents(events, budget = REPLAY_BYTE_BUDGET) {
-  if (!Array.isArray(events) || events.length === 0) return events
-  let total = 0, i = events.length
-  while (i > 0) {
-    const sz = JSON.stringify(events[i - 1]).length + 1
-    if (i < events.length && total + sz > budget) break
-    total += sz
-    i--
-  }
-  return i === 0 ? events : events.slice(i)
-}
-
-// A (2026-06-26 follow-up): chunk the replay tail into ORDERED, under-budget frames so
-// no event in the recent window is lost (capReplayEvents truncates; this doesn't). Each
-// returned chunk is broadcast as its own `code-replay` — seqDedup.classifyReplay applies
-// them in order (each chunk is contiguous and seq > seqHi), so the client rebuilds the
-// whole window across frames. We keep the MOST RECENT `maxChunks * budget` bytes.
-//
-// 6 → 14 (2026-06-29): 6 chunks = 900KB, but a real session's full log routinely
-// exceeds that (measured: a forge thread = 1.0MB / 7 chunks, a maxed 2000-event
-// lane = 1.7MB / 12 chunks), so the OLDEST turns — incl. the user's first prompt —
-// were dropped on replay and never reached the client ("not seeing full history of
-// terminal N", Max 2026-06-29). The DB transcript snapshot can't cover the gap: it's
-// capped at 200 tx events AND the client can only persist what it received, so the
-// head only ever lived in this in-memory log. The bridge already hard-caps the log at
-// STRUCTURED_LOG_MAX (2000) events ≈ 2.1MB worst case, so 14 chunks (2.1MB) sends the
-// WHOLE retained log on a fresh (cursor-0) replay — chunkReplayEvents still only emits
-// as many chunks as the log needs, so small sessions are unaffected.
-// Returns an array of event-arrays, oldest chunk first; [] when there's nothing to send.
-export const REPLAY_MAX_CHUNKS = 14
-export function chunkReplayEvents(events, budget = REPLAY_BYTE_BUDGET, maxChunks = REPLAY_MAX_CHUNKS) {
-  if (!Array.isArray(events) || events.length === 0) return []
-  // Walk newest→oldest accumulating into the current chunk; start a new chunk when the
-  // next event would overflow the budget. Stop once we have maxChunks. A lone event
-  // larger than the whole budget still gets its own chunk (so seqHi can advance).
-  const chunksRev = []   // newest chunk first while building
-  let cur = [], curBytes = 0
-  for (let i = events.length - 1; i >= 0; i--) {
-    const sz = JSON.stringify(events[i]).length + 1
-    if (cur.length && curBytes + sz > budget) {
-      chunksRev.push(cur)
-      if (chunksRev.length >= maxChunks) { cur = null; break }
-      cur = [], curBytes = 0
-    }
-    cur.push(events[i])   // reversed within the chunk for now
-    curBytes += sz
-  }
-  if (cur && cur.length) chunksRev.push(cur)
-  // chunksRev is newest-chunk-first, each chunk newest-event-first → reverse both axes
-  // to oldest-first so classifyReplay applies them contiguously in arrival order.
-  return chunksRev.reverse().map((c) => c.reverse())
-}
-
-// ── C-RG1/C-RG4 (2026-07-10): the bridge stamps what it trimmed. ──────────────
-// chunkReplayEvents keeps only the newest maxChunks — on a fat lane the OLDEST chunks
-// are dropped. Until now that hole was unannounced: classifyReplay accepted the seq
-// jump, seqHi leapt past it, and because the client's "load earlier" gate compares its
-// OLDEST loaded seq against the archive floor, a hole in the MIDDLE (client holds
-// 1..50 ∪ 900..2000) never surfaced a pill and was unrecoverable — silently, forever.
-//
-// The bridge is the only party that knows. Return the lowest seq we are ACTUALLY
-// sending when events below it were withheld AND are recoverable from the durable
-// JSONL archive; null when nothing was withheld.
-//
-// Floor-aware on purpose. The seq counter is per-SESSION, not per-terminal, so a fresh
-// lane's first turn legitimately lands at seq > 1 — stamping that would resurrect the
-// 2026-07-02 phantom "load earlier" pill (a button that fetches nothing). `cursor` is
-// what the client already holds (0 = nothing, and an `ahead` cursor-reset replay must
-// pass 0). `archiveOldestSeq` is the durable floor (bridge.mjs entry.archiveOldestSeq).
-// Anything at or below max(cursor, floor-1) is not missing: either the client has it,
-// or the archive never had it and no affordance could ever fetch it.
-export function trimmedBeforeSeq(sentFromSeq, cursor = 0, archiveOldestSeq = null) {
-  if (typeof sentFromSeq !== 'number') return null
-  const floor = typeof archiveOldestSeq === 'number' ? archiveOldestSeq : 1
-  const known = Math.max(cursor || 0, floor - 1)
-  return sentFromSeq > known + 1 ? sentFromSeq : null
-}
-
-// The lowest transcript seq in an event list (nulls sort out). Chrome events are
-// seq-less (NO_SEQ_KINDS) and must not anchor the stamp.
-export function firstSeq(events) {
-  if (!Array.isArray(events)) return null
-  for (const e of events) if (e && typeof e.seq === 'number') return e.seq
-  return null
-}
-
-// Bound a SINGLE event so it can never overflow a broadcast frame on its own. The worst
-// offenders are tool_results carrying inline base64 IMAGES (a 592KB screenshot block) —
-// these can't ride a size-capped Realtime broadcast at all (live OR replay). Truncate
-// bulky string fields AND replace oversized content blocks (images, huge text) with a
-// compact, render-SAFE text placeholder — preserving identity (kind/seq/cid/ts/toolUseId)
-// so dedup, ordering, seqHi, and turn structure stay intact. Returns the event UNCHANGED
-// (no clone) when it's already small; clones before mutating so the persisted log is never
-// touched. (Proper fix for inline images = upload to storage + broadcast a URL — separate.)
-export const PER_EVENT_CAP = STRUCTURED_EVENT_CAP
-export function boundEventForBroadcast(evt, cap = PER_EVENT_CAP) {
-  return boundStructuredEvent(evt, cap)
-}
-
-// Detect inline base64 IMAGE blocks on a tool_result event (a screenshot the agent
-// produced — content:[{type:'image', source:{type:'base64', media_type, data}}]).
-// Returns [{ idx, b64, mediaType }] per base64 image block, or [] when none. Pure +
-// import-safe so bridge/test-seq.mjs can exercise it. The bridge uses this to lift
-// images OUT of the event (upload to Storage, swap to a {type:'image', path} ref)
-// BEFORE the base64 ever enters the persisted log or a broadcast frame — so a
-// screenshot renders live AND in replay instead of being stripped to a placeholder
-// by boundEventForBroadcast (which stays the fallback for any block we don't lift).
-export function inlineImageBlocks(evt) {
-  if (!evt || evt.kind !== 'tool_result' || !Array.isArray(evt.content)) return []
-  const out = []
-  evt.content.forEach((b, idx) => {
-    if (b && b.type === 'image' && b.source && b.source.type === 'base64' &&
-        typeof b.source.data === 'string' && b.source.data.length) {
-      out.push({ idx, b64: b.source.data, mediaType: b.source.media_type || 'image/png' })
-    }
-  })
-  return out
-}
-
-// One ordered emission boundary for structured-session events while agent screenshots
-// are lifted out of inline base64. This stays import-safe: bridge.mjs owns room/auth
-// state; these definitions own deadlines, bounded reservations, ordering, and teardown.
-export const SCREENSHOT_OMITTED = '[screenshot omitted — upload failed]'
-export const DEFAULT_IMAGE_UPLOAD_TIMEOUT_MS = 15_000
-export const DEFAULT_IMAGE_QUEUE_MAX_PENDING = 4
-export const DEFAULT_IMAGE_QUEUE_MAX_BYTES = 16_000_000
-
-const sanePositiveInt = (value, fallback) => {
-  const n = Number(value)
-  return Number.isSafeInteger(n) && n > 0 ? n : fallback
-}
-
-export function imageQueueConfig(env = process.env) {
-  return {
-    uploadTimeoutMs: sanePositiveInt(env.TP_CODE_IMAGE_UPLOAD_TIMEOUT_MS, DEFAULT_IMAGE_UPLOAD_TIMEOUT_MS),
-    maxPending: sanePositiveInt(env.TP_CODE_IMAGE_QUEUE_MAX_PENDING, DEFAULT_IMAGE_QUEUE_MAX_PENDING),
-    maxBytes: sanePositiveInt(env.TP_CODE_IMAGE_QUEUE_MAX_BYTES, DEFAULT_IMAGE_QUEUE_MAX_BYTES),
-  }
-}
-
-// Deadline covers fetch AND response parsing. Promise.race is deliberate: AbortSignal is
-// still passed to real fetch, but an injected/broken fetch that ignores it cannot pin the
-// ordered queue forever. activeUploads lets session teardown cancel the deadline now.
-export async function uploadCodeImage({
-  webBase,
-  room,
-  authToken,
-  term,
-  cid,
-  image,
-  fetchImpl = globalThis.fetch,
-  timeoutMs = DEFAULT_IMAGE_UPLOAD_TIMEOUT_MS,
-  activeUploads = new Set(),
-}) {
-  const controller = new AbortController()
-  let timer = null
-  let rejectCancel = null
-  let settled = false
-
-  const cancelled = new Promise((_, reject) => { rejectCancel = reject })
-  const handle = {
-    cancel(reason = new Error('code-image upload cancelled')) {
-      if (settled) return
-      if (timer) { clearTimeout(timer); timer = null }
-      try { controller.abort(reason) } catch { /* AbortController is best-effort */ }
-      rejectCancel(reason instanceof Error ? reason : new Error(String(reason)))
-    },
-  }
-  activeUploads.add(handle)
-  timer = setTimeout(() => handle.cancel(new Error(`code-image upload timed out after ${timeoutMs}ms`)), timeoutMs)
-  timer.unref?.()
-
-  const headers = { 'Content-Type': 'application/json' }
-  if (authToken) headers.Authorization = `Bearer ${authToken}`
-  const request = (async () => {
-    const res = await fetchImpl(`${webBase}/api/code-image`, {
-      method: 'POST',
-      headers,
-      signal: controller.signal,
-      body: JSON.stringify({ code: room, term, cid, idx: image.idx, mediaType: image.mediaType, b64: image.b64 }),
-    })
-    if (!res.ok) throw new Error(`code-image ${res.status}`)
-    const { path } = await res.json()
-    if (!path) throw new Error('code-image: no path')
-    return path
-  })()
-
-  try {
-    return await Promise.race([request, cancelled])
-  } finally {
-    settled = true
-    if (timer) clearTimeout(timer)
-    activeUploads.delete(handle)
-  }
-}
-
-const encodedImageBytes = (image) => Buffer.byteLength(String(image?.b64 || ''), 'ascii')
-
-function stripRawImages(evt, images, placeholder) {
-  for (const image of images) {
-    const block = Array.isArray(evt?.content) ? evt.content[image.idx] : null
-    if (block?.source?.type === 'base64' || image.b64) {
-      evt.content[image.idx] = { type: 'text', text: placeholder }
-    }
-    image.b64 = ''
-  }
-}
-
-export class ImageEventQueue {
-  constructor({
-    upload,
-    maxPending = DEFAULT_IMAGE_QUEUE_MAX_PENDING,
-    maxBytes = DEFAULT_IMAGE_QUEUE_MAX_BYTES,
-    placeholder = SCREENSHOT_OMITTED,
-    onUploadError = () => {},
-    onOverload = () => {},
-  }) {
-    if (typeof upload !== 'function') throw new TypeError('ImageEventQueue requires upload')
-    this.upload = upload
-    this.maxPending = sanePositiveInt(maxPending, DEFAULT_IMAGE_QUEUE_MAX_PENDING)
-    this.maxBytes = sanePositiveInt(maxBytes, DEFAULT_IMAGE_QUEUE_MAX_BYTES)
-    this.placeholder = placeholder
-    this.onUploadError = onUploadError
-    this.onOverload = onOverload
-    this.pendingCount = 0
-    this.pendingBytes = 0
-    this.peakPendingCount = 0
-    this.peakPendingBytes = 0
-    this.activeUploads = new Set()
-    this.tasks = new Set()
-    this.tail = Promise.resolve()
-    this.closed = false
-    this.overloadNotified = false
-  }
-
-  stats() {
-    return {
-      pendingCount: this.pendingCount,
-      pendingBytes: this.pendingBytes,
-      peakPendingCount: this.peakPendingCount,
-      peakPendingBytes: this.peakPendingBytes,
-      activeUploads: this.activeUploads.size,
-      queuedEvents: this.tasks.size,
-    }
-  }
-
-  enqueue(evt, images, emitTail) {
-    if (this.closed || typeof emitTail !== 'function') return false
-    const imgs = Array.isArray(images) ? images : []
-    const count = imgs.length
-    const bytes = imgs.reduce((sum, image) => sum + encodedImageBytes(image), 0)
-    const accepted = count > 0 &&
-      this.pendingCount + count <= this.maxPending &&
-      this.pendingBytes + bytes <= this.maxBytes
-
-    if (count && accepted) {
-      for (const image of imgs) {
-        image._queueBytes = encodedImageBytes(image)
-        image._queueReserved = true
-      }
-      this.pendingCount += count
-      this.pendingBytes += bytes
-      this.peakPendingCount = Math.max(this.peakPendingCount, this.pendingCount)
-      this.peakPendingBytes = Math.max(this.peakPendingBytes, this.pendingBytes)
-    } else if (count) {
-      // Critical memory boundary: discard raw base64 BEFORE this event can join a
-      // chain blocked behind an earlier upload.
-      stripRawImages(evt, imgs, this.placeholder)
-      if (!this.overloadNotified) {
-        this.overloadNotified = true
-        this.onOverload({ count, bytes, maxPending: this.maxPending, maxBytes: this.maxBytes })
-      }
-    }
-
-    // Preserve the old synchronous fast path when no image upload is ahead of us.
-    if (!accepted && this.tasks.size === 0) {
-      emitTail(evt)
-      return true
-    }
-
-    const task = { evt, images: imgs, emitTail, accepted, emitted: false, done: false }
-    this.tasks.add(task)
-    this.tail = this.tail.catch(() => {}).then(() => this._run(task))
-    return true
-  }
-
-  async _run(task) {
-    if (task.done || this.closed) return
-    try {
-      if (task.accepted) {
-        for (const image of task.images) {
-          if (!image._queueReserved || this.closed) continue
-          try {
-            const path = await this.upload(task.evt, image, this.activeUploads)
-            task.evt.content[image.idx] = { type: 'image', path, mediaType: image.mediaType }
-          } catch (error) {
-            task.evt.content[image.idx] = { type: 'text', text: this.placeholder }
-            if (!this.closed) this.onUploadError(error)
-          } finally {
-            image.b64 = ''
-            this._release(image)
-          }
-        }
-      }
-      if (!this.closed && !task.emitted) {
-        task.emitTail(task.evt)
-        task.emitted = true
-      }
-    } finally {
-      task.done = true
-      this.tasks.delete(task)
-    }
-  }
-
-  _release(image) {
-    if (!image?._queueReserved) return
-    image._queueReserved = false
-    this.pendingCount = Math.max(0, this.pendingCount - 1)
-    this.pendingBytes = Math.max(0, this.pendingBytes - (image._queueBytes || 0))
-    image._queueBytes = 0
-  }
-
-  async idle() {
-    await this.tail.catch(() => {})
-  }
-
-  // Session close/provider switch/shutdown is synchronous. Cancel active deadlines,
-  // replace any still-raw image, and flush queued tails in insertion order before the
-  // owner persists/deletes the entry. Later promise continuations see done/closed.
-  close({ flush = true } = {}) {
-    if (this.closed) return
-    this.closed = true
-    const reason = new Error('code-image queue closed')
-    for (const upload of this.activeUploads) upload.cancel(reason)
-    this.activeUploads.clear()
-    for (const task of this.tasks) {
-      stripRawImages(task.evt, task.images, this.placeholder)
-      for (const image of task.images) this._release(image)
-      if (flush && !task.emitted) {
-        try { task.emitTail(task.evt) } catch { /* teardown must continue */ }
-        task.emitted = true
-      }
-      task.done = true
-    }
-    this.tasks.clear()
-    this.pendingCount = 0
-    this.pendingBytes = 0
-  }
-}
-
-// Pure aggregation for the /usage report — replay a session's retained log events and
-// fold every completed turn (kind:'result' with usage) into per-model + total token/cost
-// sums. No side effects, import-safe (bridge/test-usage-summary.mjs exercises it), so the
-// bridge computes /usage by replaying its own durable log — no separate accumulator that a
-// restart would drop. `costUsd` is the SDK's total_cost_usd per turn (BYOK estimate).
-export function summarizeUsage(logEvents) {
-  const results = (Array.isArray(logEvents) ? logEvents : []).filter((e) => e && e.kind === 'result' && e.usage)
-  const per = new Map()
-  let totalIn = 0, totalOut = 0, totalCost = 0, haveCost = false
-  for (const e of results) {
-    const u = e.usage || {}
-    const inTok = (u.input_tokens || 0) + (u.cache_creation_input_tokens || 0) + (u.cache_read_input_tokens || 0)
-    const out = u.output_tokens || 0
-    const cached = u.cache_read_input_tokens || 0
-    const mid = e.model || 'unknown'
-    const r = per.get(mid) || { model: mid, in: 0, out: 0, cached: 0 }
-    r.in += inTok; r.out += out; r.cached += cached; per.set(mid, r)
-    totalIn += inTok; totalOut += out
-    if (typeof e.costUsd === 'number') { totalCost += e.costUsd; haveCost = true }
-  }
-  return { turns: results.length, per: [...per.values()], totalIn, totalOut, totalCost, haveCost }
-}
-
-// Does this model id name a Claude/Anthropic model? Used by two callers with the
-// same question and NO room for a second opinion:
-//   • usageReportLine — token/cost reporting is Claude-only.
-//   • providers.mjs/effectiveLaneModel — a lane on a CUSTOM (non-anthropic) provider
-//     must never be handed an inherited Claude id; the endpoint 400s on it.
-// Exported (not a local const) precisely so there is exactly one definition.
-export const claudeish = (m) => /claude|anthropic|opus|sonnet|haiku|fable/i.test(String(m || ''))
-
-// model id → friendly label for the /usage report: claude-opus-4-8 → "Opus 4.8".
-// Bridge-local twin of the web's prettyModel (structured.jsx); falls back to the raw id.
-// The `[1m]` long-context suffix is PRESERVED. `claude-opus-4-8` and `claude-opus-4-8[1m]`
-// are different models on different rates and summarizeUsage keys them apart — collapsing
-// both to "Opus 4.8" printed two identical, unattributable rows in one report (real log,
-// room 1TV7B59A: `Opus 4.8: 51.8M in … · Opus 4.8: 46.0M in …`). 2026-07-10.
-export function prettyModelId (m) {
-  if (!m) return 'unknown'
-  const raw = String(m)
-  const long = /\[1m\]/i.test(raw) ? ' [1m]' : ''
-  const mm = raw.match(/(opus|sonnet|haiku|fable)-(\d+)(?:-(\d+))?/i)
-  return mm ? `${mm[1][0].toUpperCase()}${mm[1].slice(1)} ${mm[2]}${mm[3] ? '.' + mm[3] : ''}${long}` : raw
-}
-
-// Build the ONE ◆ control line the /usage command emits, from the session's model +
-// retained log. Pure so the whole command — gate, empty-state, and per-model/total/cost
-// formatting — is exercised deterministically (bridge/test-usage-summary.mjs). The bridge
-// handler is a thin wrapper: ctlLine(usageReportLine(s.model, s.log)). `sessionModel` is
-// the resolved model id the /model state tracks; `logEvents` the session's retained log.
-export function usageReportLine (sessionModel, logEvents) {
-  const sum = summarizeUsage(logEvents)
-  // Gate (Max's ask: "make /usage work if users bridge is on claude llms"). The Code bridge
-  // runs the Claude Agent SDK, so a normal lane IS a Claude model — but a session pointed at a
-  // non-Claude base URL/model gets a legible line, not a bogus token report. Only assert this
-  // when we actually know a model (else a fresh empty session would wrongly trip the gate).
-  const anyClaude = claudeish(sessionModel) || sum.per.some((r) => claudeish(r.model))
-  if (!anyClaude && (sessionModel || sum.turns)) return 'usage reporting is available on Claude models only'
-  if (!sum.turns) return 'usage · no completed turns yet this session'
-  const fmtTok = (n) => n >= 1e6 ? (n / 1e6).toFixed(1) + 'M' : n >= 1e3 ? (n / 1e3).toFixed(1) + 'k' : String(n)
-  // Drop models that burned nothing. The SDK stamps a `result` with the resolved id even for
-  // turns that spent no tokens (an interrupt, a no-op /compact), so a real report carried dead
-  // rows like `opus[1m]: 0 in / 0 out` (room 1TV7B59A). If EVERY row is empty, print them all
-  // rather than an eerie modelless line. `total` keys off the printed rows, not the raw set.
-  const rows = sum.per.filter((r) => r.in || r.out).length ? sum.per.filter((r) => r.in || r.out) : sum.per
-  const perStr = rows.map((r) => {
-    const cch = r.cached ? ` (${fmtTok(r.cached)} cached)` : ''
-    return `${prettyModelId(r.model)}: ${fmtTok(r.in)} in${cch} / ${fmtTok(r.out)} out`
-  }).join(' · ')
-  const total = rows.length > 1 ? ` · total ${fmtTok(sum.totalIn)} in / ${fmtTok(sum.totalOut)} out` : ''
-  const cost = sum.haveCost ? ` · ~$${sum.totalCost.toFixed(2)} est` : ''
-  const turns = `${sum.turns} turn${sum.turns === 1 ? '' : 's'}`
-  // No "(no plan/rate-limit meters)" tail any more — the handler appends a second control
-  // line from bridge/plan-meters.mjs carrying the real 5h/weekly utilization + resets, or
-  // an explicit "plan meters unavailable". Neither claim belongs on this token/cost line.
-  return `usage · ${turns} · ${perStr}${total}${cost}`
-}
-
-// Codex exposes exact current-context and lifetime-thread counters in its native
-// rollout telemetry. Keep this separate from usageReportLine: Claude result
-// events are per turn, while Codex's public turn.completed counters are lifetime
-// totals and cannot safely be folded from the retained log.
-export function codexUsageReportLine (sessionModel, snapshot) {
-  const ctx = snapshot?.context
-  const total = snapshot?.total
-  if (!ctx || !total) return 'usage · no completed Codex turn yet'
-  const fmtTok = (n) => n >= 1e6 ? (n / 1e6).toFixed(1) + 'M' : n >= 1e3 ? (n / 1e3).toFixed(1) + 'k' : String(Math.round(n || 0))
-  const used = Math.max(0, Number(ctx.used) || 0)
-  const max = Math.max(0, Number(ctx.max) || 0)
-  const pct = max > 0 ? Math.min(100, Math.max(0, Math.round((used / max) * 100))) : 0
-  const input = Math.max(0, Number(total.input_tokens) || 0)
-  const cached = Math.min(input, Math.max(0, Number(total.cached_input_tokens) || 0))
-  const output = Math.max(0, Number(total.output_tokens) || 0)
-  return `usage · ${prettyModelId(sessionModel)} · context ${fmtTok(used)}/${fmtTok(max)} (${pct}%) · thread ${fmtTok(input)} processed (${fmtTok(cached)} cached) / ${fmtTok(output)} out`
-}
-
-/* The context-carry recap moved to ./recap.mjs (ADR-0010 / S4, 2026-07-09).
- *
- * Why: the WEB CLIENT needs buildRecapFromLog to carry a lane's bridgeless
- * conversation across a bridge wake, and this module imports `node:crypto` —
- * unresolvable in a browser bundle. The pure half lives in an import-free file
- * both sides can load; these re-exports keep every existing bridge-side import
- * (`from './event-id.mjs'`) working untouched, including bridge/recap.test.mjs.
- *
- * recap.mjs must stay in bridge/package.json `files` — event-id.mjs imports it. */
-export { CHECKPOINT_CAP, CURRENT_PERSON_REQUEST_MARKER, RECAP_CAP, appendCurrentPersonRequest, buildCheckpointFromLog, buildRecapFromLog, recapHasCheckpoint, resolveCheckpointCarry } from './recap.mjs'
+import{randomUUID as e}from"node:crypto";import{boundStructuredEvent as t,STRUCTURED_EVENT_CAP as n}from"./event-bounds.mjs";import{classifyCodeEvent as o}from"./code-event-contract.mjs";export function stampEvent(t,n=e){return t&&"object"==typeof t?("number"!=typeof t.ts&&(t.ts=Date.now()),t.cid||(t.cid=n()),t):t}export function makeSeqCounter(e=0){let t=Number.isFinite(e)?e:0;return{next:()=>++t,bumpTo:e=>{Number.isFinite(e)&&e>t&&(t=e)},current:()=>t}}export const NO_SEQ_KINDS=new Set(["system","thinking_tokens","effort","models","queue-add","queue-cancel","propose-done","update-available"]);export const seqable=e=>!(!e||"object"!=typeof e)&&o(e,{strict:!1}).known&&!NO_SEQ_KINDS.has(e.kind);export function maxSeq(e){if(!Array.isArray(e))return 0;let t=0;for(const n of e)n&&"number"==typeof n.seq&&n.seq>t&&(t=n.seq);return t}export const REPLAY_BYTE_BUDGET=15e4;export function capReplayEvents(e,t=15e4){if(!Array.isArray(e)||0===e.length)return e;let n=0,o=e.length;for(;o>0;){const s=JSON.stringify(e[o-1]).length+1;if(o<e.length&&n+s>t)break;n+=s,o--}return 0===o?e:e.slice(o)}export const REPLAY_MAX_CHUNKS=14;export function chunkReplayEvents(e,t=15e4,n=14){if(!Array.isArray(e)||0===e.length)return[];const o=[];let s=[],i=0;for(let r=e.length-1;r>=0;r--){const a=JSON.stringify(e[r]).length+1;if(s.length&&i+a>t){if(o.push(s),o.length>=n){s=null;break}s=[],i=0}s.push(e[r]),i+=a}return s&&s.length&&o.push(s),o.reverse().map(e=>e.reverse())}export function trimmedBeforeSeq(e,t=0,n=null){if("number"!=typeof e)return null;const o="number"==typeof n?n:1;return e>Math.max(t||0,o-1)+1?e:null}export function firstSeq(e){if(!Array.isArray(e))return null;for(const t of e)if(t&&"number"==typeof t.seq)return t.seq;return null}export const PER_EVENT_CAP=n;export function boundEventForBroadcast(e,n=PER_EVENT_CAP){return t(e,n)}export function inlineImageBlocks(e){if(!e||"tool_result"!==e.kind||!Array.isArray(e.content))return[];const t=[];return e.content.forEach((e,n)=>{e&&"image"===e.type&&e.source&&"base64"===e.source.type&&"string"==typeof e.source.data&&e.source.data.length&&t.push({idx:n,b64:e.source.data,mediaType:e.source.media_type||"image/png"})}),t}export const SCREENSHOT_OMITTED="[screenshot omitted — upload failed]";export const DEFAULT_IMAGE_UPLOAD_TIMEOUT_MS=15e3;export const DEFAULT_IMAGE_QUEUE_MAX_PENDING=4;export const DEFAULT_IMAGE_QUEUE_MAX_BYTES=16e6;const s=(e,t)=>{const n=Number(e);return Number.isSafeInteger(n)&&n>0?n:t};export function imageQueueConfig(e=process.env){return{uploadTimeoutMs:s(e.TP_CODE_IMAGE_UPLOAD_TIMEOUT_MS,15e3),maxPending:s(e.TP_CODE_IMAGE_QUEUE_MAX_PENDING,4),maxBytes:s(e.TP_CODE_IMAGE_QUEUE_MAX_BYTES,16e6)}}export async function uploadCodeImage({webBase:e,room:t,authToken:n,term:o,cid:s,image:i,fetchImpl:r=globalThis.fetch,timeoutMs:a=15e3,activeUploads:u=new Set}){const c=new AbortController;let d=null,l=null,p=!1;const h=new Promise((e,t)=>{l=t}),m={cancel(e=new Error("code-image upload cancelled")){if(!p){d&&(clearTimeout(d),d=null);try{c.abort(e)}catch{}l(e instanceof Error?e:new Error(String(e)))}}};u.add(m),d=setTimeout(()=>m.cancel(new Error(`code-image upload timed out after ${a}ms`)),a),d.unref?.();const f={"Content-Type":"application/json"};n&&(f.Authorization=`Bearer ${n}`);const g=(async()=>{const n=await r(`${e}/api/code-image`,{method:"POST",headers:f,signal:c.signal,body:JSON.stringify({code:t,term:o,cid:s,idx:i.idx,mediaType:i.mediaType,b64:i.b64})});if(!n.ok)throw new Error(`code-image ${n.status}`);const{path:a}=await n.json();if(!a)throw new Error("code-image: no path");return a})();try{return await Promise.race([g,h])}finally{p=!0,d&&clearTimeout(d),u.delete(m)}}const i=e=>Buffer.byteLength(String(e?.b64||""),"ascii");function r(e,t,n){for(const o of t){const t=Array.isArray(e?.content)?e.content[o.idx]:null;("base64"===t?.source?.type||o.b64)&&(e.content[o.idx]={type:"text",text:n}),o.b64=""}}export class ImageEventQueue{constructor({upload:e,maxPending:t=4,maxBytes:n=16e6,placeholder:o=SCREENSHOT_OMITTED,onUploadError:i=()=>{},onOverload:r=()=>{}}){if("function"!=typeof e)throw new TypeError("ImageEventQueue requires upload");this.upload=e,this.maxPending=s(t,4),this.maxBytes=s(n,16e6),this.placeholder=o,this.onUploadError=i,this.onOverload=r,this.pendingCount=0,this.pendingBytes=0,this.peakPendingCount=0,this.peakPendingBytes=0,this.activeUploads=new Set,this.tasks=new Set,this.tail=Promise.resolve(),this.closed=!1,this.overloadNotified=!1}stats(){return{pendingCount:this.pendingCount,pendingBytes:this.pendingBytes,peakPendingCount:this.peakPendingCount,peakPendingBytes:this.peakPendingBytes,activeUploads:this.activeUploads.size,queuedEvents:this.tasks.size}}enqueue(e,t,n){if(this.closed||"function"!=typeof n)return!1;const o=Array.isArray(t)?t:[],s=o.length,a=o.reduce((e,t)=>e+i(t),0),u=s>0&&this.pendingCount+s<=this.maxPending&&this.pendingBytes+a<=this.maxBytes;if(s&&u){for(const e of o)e._queueBytes=i(e),e._queueReserved=!0;this.pendingCount+=s,this.pendingBytes+=a,this.peakPendingCount=Math.max(this.peakPendingCount,this.pendingCount),this.peakPendingBytes=Math.max(this.peakPendingBytes,this.pendingBytes)}else s&&(r(e,o,this.placeholder),this.overloadNotified||(this.overloadNotified=!0,this.onOverload({count:s,bytes:a,maxPending:this.maxPending,maxBytes:this.maxBytes})));if(!u&&0===this.tasks.size)return n(e),!0;const c={evt:e,images:o,emitTail:n,accepted:u,emitted:!1,done:!1};return this.tasks.add(c),this.tail=this.tail.catch(()=>{}).then(()=>this._run(c)),!0}async _run(e){if(!e.done&&!this.closed)try{if(e.accepted)for(const t of e.images)if(t._queueReserved&&!this.closed)try{const n=await this.upload(e.evt,t,this.activeUploads);e.evt.content[t.idx]={type:"image",path:n,mediaType:t.mediaType}}catch(n){e.evt.content[t.idx]={type:"text",text:this.placeholder},this.closed||this.onUploadError(n)}finally{t.b64="",this._release(t)}this.closed||e.emitted||(e.emitTail(e.evt),e.emitted=!0)}finally{e.done=!0,this.tasks.delete(e)}}_release(e){e?._queueReserved&&(e._queueReserved=!1,this.pendingCount=Math.max(0,this.pendingCount-1),this.pendingBytes=Math.max(0,this.pendingBytes-(e._queueBytes||0)),e._queueBytes=0)}async idle(){await this.tail.catch(()=>{})}close({flush:e=!0}={}){if(this.closed)return;this.closed=!0;const t=new Error("code-image queue closed");for(const e of this.activeUploads)e.cancel(t);this.activeUploads.clear();for(const t of this.tasks){r(t.evt,t.images,this.placeholder);for(const e of t.images)this._release(e);if(e&&!t.emitted){try{t.emitTail(t.evt)}catch{}t.emitted=!0}t.done=!0}this.tasks.clear(),this.pendingCount=0,this.pendingBytes=0}}export function summarizeUsage(e){const t=(Array.isArray(e)?e:[]).filter(e=>e&&"result"===e.kind&&e.usage),n=new Map;let o=0,s=0,i=0,r=!1;for(const e of t){const t=e.usage||{},a=(t.input_tokens||0)+(t.cache_creation_input_tokens||0)+(t.cache_read_input_tokens||0),u=t.output_tokens||0,c=t.cache_read_input_tokens||0,d=e.model||"unknown",l=n.get(d)||{model:d,in:0,out:0,cached:0};l.in+=a,l.out+=u,l.cached+=c,n.set(d,l),o+=a,s+=u,"number"==typeof e.costUsd&&(i+=e.costUsd,r=!0)}return{turns:t.length,per:[...n.values()],totalIn:o,totalOut:s,totalCost:i,haveCost:r}}export const claudeish=e=>/claude|anthropic|opus|sonnet|haiku|fable/i.test(String(e||""));export function prettyModelId(e){if(!e)return"unknown";const t=String(e),n=/\[1m\]/i.test(t)?" [1m]":"",o=t.match(/(opus|sonnet|haiku|fable)-(\d+)(?:-(\d+))?/i);return o?`${o[1][0].toUpperCase()}${o[1].slice(1)} ${o[2]}${o[3]?"."+o[3]:""}${n}`:t}export function usageReportLine(e,t){const n=summarizeUsage(t);if(!claudeish(e)&&!n.per.some(e=>claudeish(e.model))&&(e||n.turns))return"usage reporting is available on Claude models only";if(!n.turns)return"usage · no completed turns yet this session";const o=e=>e>=1e6?(e/1e6).toFixed(1)+"M":e>=1e3?(e/1e3).toFixed(1)+"k":String(e),s=n.per.filter(e=>e.in||e.out).length?n.per.filter(e=>e.in||e.out):n.per,i=s.map(e=>{const t=e.cached?` (${o(e.cached)} cached)`:"";return`${prettyModelId(e.model)}: ${o(e.in)} in${t} / ${o(e.out)} out`}).join(" · "),r=s.length>1?` · total ${o(n.totalIn)} in / ${o(n.totalOut)} out`:"",a=n.haveCost?` · ~$${n.totalCost.toFixed(2)} est`:"";return`usage · ${n.turns} turn${1===n.turns?"":"s"} · ${i}${r}${a}`}export function codexUsageReportLine(e,t){const n=t?.context,o=t?.total;if(!n||!o)return"usage · no completed Codex turn yet";const s=e=>e>=1e6?(e/1e6).toFixed(1)+"M":e>=1e3?(e/1e3).toFixed(1)+"k":String(Math.round(e||0)),i=Math.max(0,Number(n.used)||0),r=Math.max(0,Number(n.max)||0),a=r>0?Math.min(100,Math.max(0,Math.round(i/r*100))):0,u=Math.max(0,Number(o.input_tokens)||0),c=Math.min(u,Math.max(0,Number(o.cached_input_tokens)||0)),d=Math.max(0,Number(o.output_tokens)||0);return`usage · ${prettyModelId(e)} · context ${s(i)}/${s(r)} (${a}%) · thread ${s(u)} processed (${s(c)} cached) / ${s(d)} out`}export{CHECKPOINT_CAP,CURRENT_PERSON_REQUEST_MARKER,RECAP_CAP,appendCurrentPersonRequest,buildCheckpointFromLog,buildRecapFromLog,recapHasCheckpoint,resolveCheckpointCarry}from"./recap.mjs";

package/evidence-citations.mjs

@@ -1,50 +1 @@
-// Strict, runtime-neutral EvidenceEnvelopeV1 parsing. Only an actual
-// project-context evidence tool result can create room evidence in S1.
-import { createHash } from 'node:crypto'
-import { EVIDENCE_CAP, compactEvidenceEnvelope } from './evidence-compact.mjs'
-
-export { EVIDENCE_CAP, compactEvidenceEnvelope }
-
-export const EVIDENCE_START = '<<<TP_EVIDENCE_V1>>>'
-export const EVIDENCE_END = '<<<END_TP_EVIDENCE_V1>>>'
-const LEVELS = new Set(['exact', 'section', 'source', 'unavailable'])
-const WARNINGS = new Set(['NO_MATCH', 'LOW_LEXICAL_MATCH', 'UNCALIBRATED_RELEVANCE', 'SECTION_ONLY', 'SOURCE_ONLY', 'SOURCE_UNAVAILABLE', 'SPAN_ANCHOR_MISMATCH', 'TRANSCRIPT_BOUNDED'])
-const safeText = (value, max) => typeof value === 'string' && value.length <= max && !/(?:https?:\/\/|file:|bearer\s|token=|signature=|x-amz-|\.\.[\\/]|^\/|[A-Za-z]:[\\/])/i.test(value)
-const isProjectEvidenceTool = (name) => ['mcp__project_context__search_context_evidence', 'mcp__project-context__search_context_evidence'].includes(String(name || ''))
-const textContent = (content) => typeof content === 'string' ? content : Array.isArray(content) ? content.map((part) => typeof part === 'string' ? part : part?.text || '').join('\n') : ''
-const excerptDigest = (value) => createHash('sha256').update(value, 'utf8').digest('hex')
-
-function validCitation(raw) {
-  if (!raw || raw.v !== 1 || !/^ev1_[a-f0-9]{24,64}$/.test(raw.id || '')) return null
-  const source = raw.source || {}, locator = raw.locator || {}, revision = source.revision || {}, assessment = raw.assessment || {}, provenance = raw.provenance || {}
-  if (source.kind !== 'project_prose' || source.collection !== 'repo' || !safeText(source.label, 180) || !safeText(source.path, 500) || !/^[a-f0-9]{40,64}$/i.test(revision.value || '') || !['git', 'content_sha256'].includes(revision.kind)) return null
-  if (!LEVELS.has(locator.level) || !safeText(locator.heading || '', 180)) return null
-  if (!['high', 'medium', 'low', 'unscored'].includes(assessment.relevance) || !['direct', 'partial', 'source_only', 'unavailable'].includes(assessment.confidence) || !Array.isArray(assessment.warnings) || assessment.warnings.some((warning) => !WARNINGS.has(warning))) return null
-  if (provenance.capturedBy !== 'project-context' || provenance.method !== 'fts5_heading') return null
-  const citation = { v: 1, id: raw.id, source: { kind: source.kind, collection: source.collection, label: source.label, path: source.path, revision: { kind: revision.kind, value: revision.value, ...(safeText(revision.indexedAt || '', 80) ? { indexedAt: revision.indexedAt } : {}) } }, locator: { level: locator.level, ...(safeText(locator.heading || '', 180) ? { heading: locator.heading } : {}) }, provenance: { capturedBy: provenance.capturedBy, method: provenance.method, ...(safeText(provenance.retrievedAt || '', 80) ? { retrievedAt: provenance.retrievedAt } : {}), ...(safeText(provenance.query || '', 160) ? { query: provenance.query } : {}), ...(Number.isSafeInteger(provenance.rank) && provenance.rank > 0 ? { rank: provenance.rank } : {}) }, assessment: { relevance: assessment.relevance, confidence: assessment.confidence, warnings: [...new Set(assessment.warnings)].slice(0, 8) } }
-  if (locator.level === 'exact') {
-    if (![locator.charStart, locator.charEnd, locator.lineStart, locator.lineEnd].every(Number.isSafeInteger) || locator.charStart < 0 || locator.charEnd <= locator.charStart || locator.lineStart < 1 || locator.lineEnd < locator.lineStart || !safeText(locator.anchorBefore || '', 96) || !safeText(locator.anchorAfter || '', 96) || !safeText(raw.excerpt || '', 600) || !/^[a-f0-9]{64}$/i.test(raw.excerptSha256 || '') || excerptDigest(raw.excerpt) !== raw.excerptSha256) return null
-    citation.locator = { ...citation.locator, charStart: locator.charStart, charEnd: locator.charEnd, lineStart: locator.lineStart, lineEnd: locator.lineEnd, anchorBefore: locator.anchorBefore, anchorAfter: locator.anchorAfter }
-    citation.excerpt = raw.excerpt
-    citation.excerptSha256 = raw.excerptSha256
-  }
-  return citation
-}
-
-export function parseEvidenceEnvelope(toolName, content) {
-  if (!isProjectEvidenceTool(toolName)) return null
-  const text = textContent(content)
-  const start = text.indexOf(EVIDENCE_START), end = text.indexOf(EVIDENCE_END)
-  if (start < 0 || end < start || text.indexOf(EVIDENCE_START, start + EVIDENCE_START.length) >= 0 || text.indexOf(EVIDENCE_END, end + EVIDENCE_END.length) >= 0) return null
-  let raw
-  try { raw = JSON.parse(text.slice(start + EVIDENCE_START.length, end)) } catch { return null }
-  if (!raw || raw.v !== 1 || !Array.isArray(raw.citations) || raw.citations.length > EVIDENCE_CAP) return null
-  const citations = raw.citations.map(validCitation)
-  if (citations.some((citation) => !citation)) return null
-  const codes = Array.isArray(raw.summary?.warningCodes) ? raw.summary.warningCodes.filter((code) => WARNINGS.has(code)).slice(0, 8) : []
-  const status = ['evidence_found', 'weak_evidence', 'no_evidence'].includes(raw.summary?.status) ? raw.summary.status : null
-  if (!status || !Array.isArray(raw.summary?.searchedCollections) || raw.summary.searchedCollections.some((collection) => collection !== 'repo')) return null
-  return { v: 1, citations, summary: { searchedCollections: ['repo'], directCount: citations.filter((citation) => ['exact', 'section'].includes(citation.locator.level)).length, warningCodes: [...new Set(codes)], status } }
-}
-
-export function evidenceForToolResult(toolName, content) { return parseEvidenceEnvelope(toolName, content) || undefined }
+import{createHash as e}from"node:crypto";import{EVIDENCE_CAP as r,compactEvidenceEnvelope as n}from"./evidence-compact.mjs";export{r as EVIDENCE_CAP,n as compactEvidenceEnvelope};export const EVIDENCE_START="<<<TP_EVIDENCE_V1>>>";export const EVIDENCE_END="<<<END_TP_EVIDENCE_V1>>>";const t=new Set(["exact","section","source","unavailable"]),a=new Set(["NO_MATCH","LOW_LEXICAL_MATCH","UNCALIBRATED_RELEVANCE","SECTION_ONLY","SOURCE_ONLY","SOURCE_UNAVAILABLE","SPAN_ANCHOR_MISMATCH","TRANSCRIPT_BOUNDED"]),i=(e,r)=>"string"==typeof e&&e.length<=r&&!/(?:https?:\/\/|file:|bearer\s|token=|signature=|x-amz-|\.\.[\\/]|^\/|[A-Za-z]:[\\/])/i.test(e);function c(r){if(!r||1!==r.v||!/^ev1_[a-f0-9]{24,64}$/.test(r.id||""))return null;const n=r.source||{},c=r.locator||{},o=n.revision||{},l=r.assessment||{},s=r.provenance||{};if(!("project_prose"===n.kind&&"repo"===n.collection&&i(n.label,180)&&i(n.path,500)&&/^[a-f0-9]{40,64}$/i.test(o.value||"")&&["git","content_sha256"].includes(o.kind)))return null;if(!t.has(c.level)||!i(c.heading||"",180))return null;if(!["high","medium","low","unscored"].includes(l.relevance)||!["direct","partial","source_only","unavailable"].includes(l.confidence)||!Array.isArray(l.warnings)||l.warnings.some(e=>!a.has(e)))return null;if("project-context"!==s.capturedBy||"fts5_heading"!==s.method)return null;const d={v:1,id:r.id,source:{kind:n.kind,collection:n.collection,label:n.label,path:n.path,revision:{kind:o.kind,value:o.value,...i(o.indexedAt||"",80)?{indexedAt:o.indexedAt}:{}}},locator:{level:c.level,...i(c.heading||"",180)?{heading:c.heading}:{}},provenance:{capturedBy:s.capturedBy,method:s.method,...i(s.retrievedAt||"",80)?{retrievedAt:s.retrievedAt}:{},...i(s.query||"",160)?{query:s.query}:{},...Number.isSafeInteger(s.rank)&&s.rank>0?{rank:s.rank}:{}},assessment:{relevance:l.relevance,confidence:l.confidence,warnings:[...new Set(l.warnings)].slice(0,8)}};if("exact"===c.level){if(![c.charStart,c.charEnd,c.lineStart,c.lineEnd].every(Number.isSafeInteger)||c.charStart<0||c.charEnd<=c.charStart||c.lineStart<1||c.lineEnd<c.lineStart||!i(c.anchorBefore||"",96)||!i(c.anchorAfter||"",96)||!i(r.excerpt||"",600)||!/^[a-f0-9]{64}$/i.test(r.excerptSha256||"")||(u=r.excerpt,e("sha256").update(u,"utf8").digest("hex")!==r.excerptSha256))return null;d.locator={...d.locator,charStart:c.charStart,charEnd:c.charEnd,lineStart:c.lineStart,lineEnd:c.lineEnd,anchorBefore:c.anchorBefore,anchorAfter:c.anchorAfter},d.excerpt=r.excerpt,d.excerptSha256=r.excerptSha256}var u;return d}export function parseEvidenceEnvelope(e,n){if(!["mcp__project_context__search_context_evidence","mcp__project-context__search_context_evidence"].includes(String(e||"")))return null;const t=(e=>"string"==typeof e?e:Array.isArray(e)?e.map(e=>"string"==typeof e?e:e?.text||"").join("\n"):"")(n),i=t.indexOf(EVIDENCE_START),o=t.indexOf(EVIDENCE_END);if(i<0||o<i||t.indexOf(EVIDENCE_START,i+20)>=0||t.indexOf(EVIDENCE_END,o+24)>=0)return null;let l;try{l=JSON.parse(t.slice(i+20,o))}catch{return null}if(!l||1!==l.v||!Array.isArray(l.citations)||l.citations.length>r)return null;const s=l.citations.map(c);if(s.some(e=>!e))return null;const d=Array.isArray(l.summary?.warningCodes)?l.summary.warningCodes.filter(e=>a.has(e)).slice(0,8):[],u=["evidence_found","weak_evidence","no_evidence"].includes(l.summary?.status)?l.summary.status:null;return u&&Array.isArray(l.summary?.searchedCollections)&&!l.summary.searchedCollections.some(e=>"repo"!==e)?{v:1,citations:s,summary:{searchedCollections:["repo"],directCount:s.filter(e=>["exact","section"].includes(e.locator.level)).length,warningCodes:[...new Set(d)],status:u}}:null}export function evidenceForToolResult(e,r){return parseEvidenceEnvelope(e,r)||void 0}

package/evidence-compact.mjs

@@ -1,11 +1 @@
-// Browser-safe evidence bounding shared by the bridge and replay client.
-// Parsing and digest verification stay in evidence-citations.mjs (Node-only).
-export const EVIDENCE_CAP = 8
-
-export function compactEvidenceEnvelope(envelope, maxExcerpt = 600) {
-  if (!envelope?.citations?.length) return envelope
-  return { ...envelope, citations: envelope.citations.slice(0, EVIDENCE_CAP).map((citation) => {
-    if (typeof citation.excerpt !== 'string' || citation.excerpt.length <= maxExcerpt) return citation
-    return { ...citation, excerpt: undefined, excerptSha256: undefined, locator: { ...citation.locator, level: 'unavailable' }, assessment: { ...citation.assessment, confidence: 'unavailable', warnings: [...new Set([...citation.assessment.warnings, 'TRANSCRIPT_BOUNDED', 'SOURCE_UNAVAILABLE'])].slice(0, 8) } }
-  }) }
-}
+export const EVIDENCE_CAP=8;export function compactEvidenceEnvelope(e,t=600){return e?.citations?.length?{...e,citations:e.citations.slice(0,8).map(e=>"string"!=typeof e.excerpt||e.excerpt.length<=t?e:{...e,excerpt:void 0,excerptSha256:void 0,locator:{...e.locator,level:"unavailable"},assessment:{...e.assessment,confidence:"unavailable",warnings:[...new Set([...e.assessment.warnings,"TRANSCRIPT_BOUNDED","SOURCE_UNAVAILABLE"])].slice(0,8)}})}:e}