tumwater 0.1.3 → 0.2.0

package/dist/src/pi/pi-stream.js

@@ -1,7 +1,8 @@
 import { extractRefusal, hasVerdictLine, isNegatedRefusal, isNothingToDo } from "../verdict/reply-contract.js";
-import { applyToolExecutionEvent, piEventType, toolCallCommand, toolUpdateHasContent, } from "./pi-event-line.js";
+import { applyToolExecutionEvent, messageUpdateHasContent, piEventType, toolCallCommand, toolUpdateHasContent, } from "./pi-event-line.js";
 import { describeToolCall } from "../text/phrases.js";
-import { objectOrEmpty, nonNegativeNumber, parseJsonObject } from "../files/json-object.js";
+import { objectOrEmpty, nonNegativeNumber, parseJsonObject, isJsonObject } from "../files/json-object.js";
+import { backendKind, isBackendFailureKind, isPermanentConfigError, TRANSIENT_BACKEND } from "./pi-failure.js";
 /** One wire number from the model server's usage block, or 0 when unusable. Only a finite,
  * non-negative number passes: a string (some OpenAI-compatible servers serialize usage
  * numbers as strings) would turn the `+=` accumulators into string concatenation and then
@@ -12,6 +13,29 @@ import { objectOrEmpty, nonNegativeNumber, parseJsonObject } from "../files/json
 function usageNumber(value) {
     return nonNegativeNumber(value, 0);
 }
+/** The text prefix of a pi `read` result that carries an image (plans/image-input.md
+ * "Detecting a blind read"): such a read's text block begins `Read image file [<path>…]`, and
+ * pi's non-vision note and its processing-failure notes sit inside that block. A text-only
+ * read (a code file) is not phrased this way. */
+const IMAGE_READ_PREFIX = "Read image file [";
+/** pi's note when the current model does not support images — the blind-read signal: the image
+ * is stripped from the request and the agent would answer about a picture it never saw. */
+const BLIND_IMAGE_NOTE = "[Current model does not support images";
+/** The `path` a read tool call's raw args name, or undefined when they carry none — the read
+ * tool opens a file by `path` (with optional `start`/`end` offsets), so the blind read blames
+ * the right file. A torn or foreign args object reads as no path (never throws). */
+function readPathOf(args) {
+    if (!isJsonObject(args))
+        return undefined;
+    return typeof args.path === "string" && args.path ? args.path : undefined;
+}
+/** The text blocks of one tool-execution end's `result` (the same normalization
+ * messageContent applies to a message), or [] when the result is not an object. */
+function resultContent(result) {
+    if (!isJsonObject(result))
+        return [];
+    return messageContent(result);
+}
 /** The content blocks of one pi message, normalized: a `content` that is not an array (torn
  * or foreign wire JSON) reads as no blocks, and a non-object entry reads as an empty block,
  * so the `.filter`/`.some` chains below never throw on a shape the message interface does not
@@ -41,7 +65,7 @@ const CONTEXT_ERROR = /context (size|length|window)?\s*(has been |was )?exceeded
  * Module-private: only PiStreamParser.feedLine below matches against it. */
 const TRANSIENT_SERVER_TIMEOUT = /predict stream timed out/i;
 /** The provider rejecting the request with HTTP 429 — rate limiting. This is the world saying
- * "later", not the session failing: the fleet's single largest error source (BUGS.md 2026-09-21)
+ * "later", not the session failing: the team's single largest error source (BUGS.md 2026-09-21)
  * and by definition retryable. Matched against every error text feedLine sees, since pi renders
  * the provider's status and message variously ("429 \"Rate limit exceeded\"", OpenAI's
  * "Too Many Requests"). Retry-After, when the provider echoes it into the error text, is
@@ -51,90 +75,10 @@ const TRANSIENT_RATE_LIMIT = /\b429\b|too many requests|rate limit/i;
  * retrying. Tolerates the spellings error text actually uses ("Retry-After: 30",
  * "retry after 30s"). Module-private: only PiStreamParser.feedLine matches it. */
 const RETRY_AFTER = /retry[- ]after:?\s*(\d{1,4})/i;
-/** The provider rejecting the request with a permanent 4xx client error — a bad model id,
- * credential, or request shape (the observed `400 … model_not_supported` on a mistyped
- * provider suffix, BUGS.md 2026-10-06). Unlike a 429 or 408/5xx it can never succeed until the
- * configuration changes, so retrying it at suite speed loops forever (a reviewer failure is
- * strike-free by design). 408 (request timeout) and 429 are rate/timeouts, not config errors,
- * and are matched by the transient patterns above; this pattern covers 400/401/403/404 and the
- * provider's own permanent-error spellings. Exported so the landing path can hold a pin
- * instead of re-queuing it. */
-const PERMANENT_CONFIG_ERROR = /\b(?:400|401|403|404)\b|model_not_supported|invalid_request_error/i;
-/** True when an error text names a permanent provider configuration error (see
- * PERMANENT_CONFIG_ERROR). Pure, exported so the landing path and the stderr path classify
- * with one rule. */
-export function isPermanentConfigError(text) {
-    return PERMANENT_CONFIG_ERROR.test(text);
-}
-/** undici's spelling of a severed HTTP stream: the provider (or its own idle timeout) cuts
- * the request while pi is still reading it, and undici's fetch rejects with the bare word
- * "terminated" — the 2026-08-22 idle-timeout diagnosis. Anchored to the END of the error text
- * on purpose: the real message is the bare word, optionally behind a prefix and closing
- * punctuation, while an unrelated error that merely contains the word ("worker terminated
- * with exit code 1") must not read as a backend failure. Module-private: matchBackendFailure
- * below, the parser, and backendKind all share the one instance. */
-const STREAM_SEVERED = /(^|[^a-z])terminated[.!\s]*$/i;
-/** The connection-class backend-failure phrases: fetch-level "Connection error.", the
- * refusals and resets Node surfaces. One home shared by the TRANSIENT_BACKEND gate and the
- * backendKind classifier, so a spelling added to one cannot go missing from the other. */
-const CONNECTION_ERROR = /connection error|connection refused|connection reset|econn(refused|reset)/i;
-/** The timeout-class backend-failure phrase (OpenAI-style "Request timed out"). Shared by the
- * TRANSIENT_BACKEND gate and the backendKind classifier. */
-const TIMEOUT_ERROR = /request timed out/i;
-/** The server-class backend-failure phrases: 5xx status texts, oMLX's model-server pause, and
- * a provider pausing itself fleet-wide with a 503 whose body carries prose rather than any
- * status phrase ("Provider '<name>' is currently failing for model '<id>' and has been paused
- * by the provider"). Shared by the TRANSIENT_BACKEND gate and the backendKind classifier. */
-const SERVER_ERROR = /internal server error|bad gateway|service unavailable|gateway timeout|currently failing for model|paused by the provider/i;
-/** The model-load spelling (oMLX's "Failed to load model"): its backendKind is the
- * "model-load" default, so only the gate names the pattern. */
-const MODEL_LOAD_ERROR = /failed to load model/i;
-/** The backend-failure error texts pi actually surfaces, matched against every error text
- * feedLine sees — the same shapes as the rate-limit regex's various renderings.
- * Deliberately does NOT match the 429 texts: feedLine checks TRANSIENT_RATE_LIMIT first and
- * only falls through here, so a rate limit stays a rate limit (with its Retry-After hint)
- * and never counts as a backend failure. Composed from the per-kind patterns above so each
- * kind's spellings — including the stream-severed one (STREAM_SEVERED) — live in exactly one
- * place. Only matchBackendFailure and PiStreamParser.feedLine match it; backendKind below
- * classifies which phrase matched. */
-const TRANSIENT_BACKEND = new RegExp(`${CONNECTION_ERROR.source}|${TIMEOUT_ERROR.source}|${SERVER_ERROR.source}|${MODEL_LOAD_ERROR.source}|${STREAM_SEVERED.source}`, "i");
-/** Which backend-failure kind an error text belongs to — pure, exported so the parser's
- * classification is unit-testable without a stream (pi-parser.test.ts feeds the texts
- * directly). Each check is the same per-kind pattern the TRANSIENT_BACKEND gate composes, so
- * the gate and the classifier cannot disagree; the order matches that alternation. */
-export function backendKind(text) {
-    if (CONNECTION_ERROR.test(text))
-        return "connection";
-    if (TIMEOUT_ERROR.test(text))
-        return "timeout";
-    if (SERVER_ERROR.test(text))
-        return "server";
-    if (STREAM_SEVERED.test(text))
-        return "stream-severed";
-    return "model-load";
-}
-/** The backend-failure kind `text` names, or undefined when it names none — the stderr
- * classifier (src/pi/pi-backend.ts's classifyExit) needs "no match" distinct from
- * backendKind's "model-load" default. Gated by TRANSIENT_BACKEND, so a text the event path
- * ignores is ignored on stderr too. Pure; exported for pi-backend.ts's classifyExit. */
-export function matchBackendFailure(text) {
-    return TRANSIENT_BACKEND.test(text) ? backendKind(text) : undefined;
-}
-/** The valid `backendKind` values, for validating a translator-supplied string at the wire
- * boundary (the same untrusted-JSON policy every other field read here applies). */
-const BACKEND_FAILURE_KINDS = [
-    "connection",
-    "timeout",
-    "server",
-    "model-load",
-    "stream-severed",
-];
-function isBackendFailureKind(value) {
-    return typeof value === "string" && BACKEND_FAILURE_KINDS.includes(value);
-}
 /** Accumulates pi's JSON event stream into a PiRunResult. Exported for tests. */
 export class PiStreamParser {
     onToolCallStart;
+    image;
     finalText = "";
     /** True once any assistant message contains the nothing-to-do sentinel, so a
      * declaration in an intermediate turn survives later messages overwriting finalText. */
@@ -190,9 +134,10 @@ export class PiStreamParser {
      * the loop's transient retry covers it, waiting out retryAfterSeconds when present. */
     transientRateLimit = false;
     /** True when any event reports a provider-wide failure that is not rate limiting — the
-     * connection down, a 5xx, the model failing to load (TRANSIENT_BACKEND above). Transient in
-     * the same sense: the session is healthy and a later attempt succeeds. The fleet-wide hold
-     * (src/fleet/fleet-hold.ts) consumes it beside the 429 flag, grouped by backendFailureKind. */
+     * connection down, a 5xx, the model failing to load (TRANSIENT_BACKEND, in pi-failure.ts).
+     * Transient in the same sense: the session is healthy and a later attempt succeeds. The
+     * team-wide hold (src/team/team-hold.ts) consumes it beside the 429 flag, grouped by
+     * backendFailureKind. */
     transientBackend = false;
     /** Which kind of backend failure the run saw (backendKind's classification of the same
      * text that set transientBackend) — carried so the hold's storm test can group by kind
@@ -203,7 +148,7 @@ export class PiStreamParser {
     retryAfterSeconds;
     /** True when any error text names a permanent provider configuration error (a 4xx other
      * than 408/429, or the provider's model_not_supported/invalid_request_error spelling): the
-     * request can never succeed until the config changes, so the landing path holds the pin
+     * request can never succeed until the config changes, so the merge path holds the pin
      * rather than re-queuing it at suite speed (BUGS.md 2026-10-06). Matched only when the text
      * did not match rate-limit or a transient backend pattern first. */
     configError = false;
@@ -223,6 +168,12 @@ export class PiStreamParser {
     rateWindows = [];
     /** True when any rate-limit reading reported the account spending into overage. */
     usedOverage = false;
+    /** The one `read` tool call this run made on an image the model cannot see (plans/
+     * image-input.md "Detecting a blind read"): the image path and the seam's effective image
+     * input are reported at once, so the runner can kill an authoring run instead of letting
+     * the agent answer about a picture it never saw. The FIRST blind read wins — later ones
+     * add nothing. */
+    imageBlind;
     /** True when the run's LAST assistant message carried no text and no tool call
      * (thinking-only or empty). A compliant finish always ends with a text block (the
      * SUMMARY/sentinel line), so this signals a generation cut off mid-stream — typically
@@ -242,10 +193,9 @@ export class PiStreamParser {
     /** True when pi auto-compacted the session during (or at the end of) the run. */
     compacted = false;
     /** Incremented for every parsed event that represents real forward progress — message,
-     * turn, and tool boundaries, retries, session events. Streaming deltas (message_update)
-     * never count: pi's JSON protocol strips the cumulative snapshot from them, so they carry
-     * nothing this parser acts on, and a zombie stream's content-free keepalives (message
-     * deltas and content-free tool_execution_updates alike) must not reset the harness's hang
+     * turn, and tool boundaries, retries, session events, and content-bearing updates
+     * (message_update deltas and tool_execution_updates alike). A content-free keepalive never
+     * counts: a zombie stream's periodic empty updates must not reset the harness's hang
      * watchdog. */
     progressCount = 0;
     /** Tool calls started but not yet ended — pi runs one message's tool calls concurrently by
@@ -254,13 +204,20 @@ export class PiStreamParser {
      * empty-content update right after start, and a content-free keepalive must not mask a hang.
      * Feeds runPi's stall warning; entries clear at tool_execution_end. */
     openToolCalls = [];
+    /** Read tool calls started but not yet ended, keyed by pi's toolCallId so concurrent reads
+     * attribute their end to the right start (pi runs one message's tool calls concurrently, so
+     * several can be open at once and end in completion order — the same rule
+     * openToolCalls tracks). The value is the call's `args.path`, captured at start so the
+     * result on end has a path to blame when the read was blind. */
+    readPaths = new Map();
     buffer = "";
     /** `onToolCallStart` observes every tool call as it starts, with pi's tool name ("" when pi
      * omitted it) and raw args — a hook for a caller that audits what a run did (the review
      * gate's suite-rerun tripwire, src/review/suite-rerun.ts) without the parser storing every
      * call of every run. */
-    constructor(onToolCallStart) {
+    constructor(onToolCallStart, image = {}) {
         this.onToolCallStart = onToolCallStart;
+        this.image = image;
     }
     /** Apply a translator-supplied `tumwaterKind`, trusted before the text regexes. An unknown
      * kind is ignored (the same forward-compatible policy as an unknown event type). */
@@ -326,6 +283,33 @@ export class PiStreamParser {
             return;
         this.retryAfterSeconds = Math.max(0, Math.round(value));
     }
+    /** Decide whether one finished `read` call returned an image the model cannot see, and if so
+     * record the FIRST such read and fire the `onBlindRead` hook (plans/image-input.md
+     * "Detecting a blind read"). An image read is a result whose content holds an `image` block,
+     * or a text block starting `Read image file [`; it is blind when that text carries pi's
+     * non-vision note, or when the runner told us the seam's effective image input is false —
+     * the second arm catches a claim doctor's probe proved false, where pi sends the image and
+     * adds no note. pi's processing-failure notes (`[Image omitted: could not be converted…]` /
+     * `…resized…`) are NOT blind on a vision-capable model: they name a conversion/file problem,
+     * not a capability gap (a non-vision model's read carries its own note, which IS blind). */
+    detectBlindRead(path, result) {
+        if (this.imageBlind)
+            return; // the first blind read is the one that stops the run
+        const blocks = resultContent(result);
+        const isImageRead = blocks.some((c) => c.type === "image") ||
+            blocks.some((c) => typeof c.text === "string" && c.text.startsWith(IMAGE_READ_PREFIX));
+        if (!isImageRead)
+            return;
+        const text = blocks
+            .filter((c) => typeof c.text === "string")
+            .map((c) => c.text)
+            .join("\n");
+        const blind = text.includes(BLIND_IMAGE_NOTE) || this.image.imageInput === false;
+        if (!blind)
+            return;
+        this.imageBlind = { path };
+        this.image.onBlindRead?.(path);
+    }
     feed(chunk, onLine) {
         this.buffer += chunk;
         // Scan with an offset instead of slicing the remainder off after every line: each old
@@ -350,12 +334,18 @@ export class PiStreamParser {
             this.buffer = this.buffer.slice(start);
     }
     feedLine(line) {
-        // Streaming deltas are ~72% of log bytes in observed runs, and pi's JSON protocol strips
-        // the cumulative message snapshot from them — they carry only constant-size usage plus a
-        // small delta event, none of which this parser acts on (progress comes from the boundary
-        // events around them). Skip even parsing them.
-        if (piEventType(line) === "message_update")
+        // Streaming deltas are ~72% of log bytes in observed runs. pi's JSON protocol strips the
+        // cumulative message snapshot from them, so the delta event is all they carry — and a
+        // content-free one (a zombie stream's keepalive, or the pre-strip shape) proves nothing:
+        // it must not reset the hang watchdog. A content-bearing delta is real generation, and
+        // counting it is what keeps a long thinking block on a slow model from being quiet-killed
+        // as hung (BUGS.md 2026-10-17) — the same content rule tool_execution_update gets below.
+        // Nothing else in this parser acts on the type, so the line is done either way.
+        if (piEventType(line) === "message_update") {
+            if (messageUpdateHasContent(parseJsonObject(line)))
+                this.progressCount += 1;
             return;
+        }
         // pi's stream is one JSON object per line: a torn, non-JSON, or valid-JSON-scalar line is
         // noise, not an event — parseJsonObject reads it as no data (the same policy parseEventLine
         // applies to the harness event log and parsePiEventLine applies to pi's log lines) instead
@@ -404,10 +394,28 @@ export class PiStreamParser {
         // number). A backend that emits none keeps the summed per-message figure (pi).
         if (event.type === "run_cost")
             this.costUsd = usageNumber(event.total);
-        // Likewise a run_usage replaces the summed output tokens (claude's per-message usage is
-        // the stream-start snapshot, about 8x low).
-        if (event.type === "run_usage")
-            this.outputTokens = usageNumber(event.outputTokens);
+        // Likewise a run_usage replaces the summed per-message token figures (claude's per-message
+        // usage is the stream-start snapshot, about 8x low). OpenCode's export drives a run_usage
+        // that carries the run's whole token split — input, output, cacheRead, cacheWrite — and
+        // replaces all four summed fields, the way run_cost replaces the cost sum; a stream without
+        // one keeps its summed figures. A run_usage bearing only outputTokens (claude) keeps the
+        // historical behavior of replacing just the output sum. The split's sum is a cumulative RUN
+        // total, not a single request, so it never touches peakContextTokens (a per-request peak
+        // the stream keeps computing); the export carries no total and none is invented here.
+        if (event.type === "run_usage") {
+            if (event.input !== undefined || event.cacheRead !== undefined || event.cacheWrite !== undefined) {
+                const input = usageNumber(event.input);
+                const cacheRead = usageNumber(event.cacheRead);
+                const cacheWrite = usageNumber(event.cacheWrite);
+                const output = usageNumber(event.output);
+                this.outputTokens = output;
+                this.promptTokens = input + cacheRead + cacheWrite;
+                this.cacheReadTokens = cacheRead;
+            }
+            else {
+                this.outputTokens = usageNumber(event.outputTokens);
+            }
+        }
         // A canonical rate_limit event carries an account-window reading: collect the newest per
         // type, note any overage, and treat a rejected window as the transient rate limit it is.
         if (event.type === "rate_limit")
@@ -415,11 +423,10 @@ export class PiStreamParser {
         if (event.type === "billing" && (event.billing === "subscription" || event.billing === "api"))
             this.billing = event.billing;
         // Every structured event (turn/tool/message boundaries, retries, session) is real
-        // progress — streaming deltas never are (message_update is skipped above, before
-        // parsing), and neither is a content-free tool_execution_update: bash emits one right
-        // after start, and a zombie stream's keepalive updates must not reset the hang
-        // watchdog any more than a content-free message delta would (the same rule
-        // toolUpdateHasContent applies to the stall clock).
+        // progress, and so is a content-bearing update — but a content-free one never is: bash
+        // emits an empty tool_execution_update right after start, and a zombie stream's keepalive
+        // updates must not reset the hang watchdog any more than a content-free message delta
+        // would (message_update deltas are counted above, before this point, by the same rule).
         if (!(event.type === "tool_execution_update" && !toolUpdateHasContent(event.partialResult)))
             this.progressCount += 1;
         if (event.type === "compaction_start")
@@ -443,6 +450,23 @@ export class PiStreamParser {
             describeToolCall(event.toolName ?? "", event.args) || "tool", command);
             if (event.type === "tool_execution_start")
                 this.onToolCallStart?.(event.toolName ?? "", event.args);
+            // The blind-read detector (plans/image-input.md "Detecting a blind read"): remember
+            // each read call's path from its start, and on its end decide whether the image it
+            // returned was one the model cannot see — so the runner can kill an authoring run
+            // instead of letting the agent answer about a picture it never saw.
+            if (event.type === "tool_execution_start" && event.toolName === "read") {
+                const p = readPathOf(event.args);
+                if (p !== undefined)
+                    this.readPaths.set(String(event.toolCallId), p);
+            }
+            else if (event.type === "tool_execution_end") {
+                const id = String(event.toolCallId);
+                const p = this.readPaths.get(id);
+                if (p !== undefined) {
+                    this.readPaths.delete(id);
+                    this.detectBlindRead(p, event.result);
+                }
+            }
         }
         if (event.type !== "message_end" || event.message?.role !== "assistant")
             return;

package/dist/src/pi/pi-watchdogs.js

@@ -7,6 +7,7 @@
  * handler reads back; run-agent.ts feeds the parser live through the deps accessors, so no
  * notification path is needed when events land. */
 import { bufferedCommandStallMs, commandBuffersOutput } from "./command-shape.js";
+import { streamsToolOutput } from "../agent/backend-traits.js";
 /** Start one pi run's two watchdog clocks: the tick deadline (kills the process tree when it
  * fires, recording whether the run was still progressing) and the quiet/stall interval
  * (quiet-kills a run that stopped making progress and warns on stalled tool calls). Returns
@@ -79,7 +80,7 @@ export function startPiWatchdogs(deps) {
     // only a periodic look at which open tool calls have gone silent.
     // A run that has not yet produced progress is starting, not hung: process creation and
     // model connect are legitimately slow on a loaded machine (a full test suite, a busy
-    // fleet), and charging that startup latency as pi silence quiet-kills runs that never
+    // team), and charging that startup latency as pi silence quiet-kills runs that never
     // had the chance to speak (BUGS.md 2026-09-23). The one extra quiet window that fix
     // granted a zero-progress run still false-killed under merge-check load: the kill runs
     // on an interval against the wall clock, so the firing check can predate the child's
@@ -87,7 +88,7 @@ export function startPiWatchdogs(deps) {
     // but not yet drained (a firing timer phase precedes the poll phase that delivers
     // stdout, and a suspended machine resumes the same way). The 2026-09-23 fix therefore
     // gave a byte-silent run no quiet kill at all, delegating its bound to the tick timeout
-    // — which holds only while tickTimeoutSeconds is near the quiet window's scale (BUGS.md
+    // — which holds only while runTimeoutSeconds is near the quiet window's scale (BUGS.md
     // 2026-09-29: the live 54000 s config left a wedged model connection 15 hours in a
     // concurrency slot). A zero-byte run now gets a finite bound of its own, independent of
     // the tick timeout: max(two quiet windows, 30 min). Startup latency under healthy load
@@ -128,7 +129,7 @@ export function startPiWatchdogs(deps) {
             // ANY of its calls — every one is judged by the buffered wall-clock threshold
             // (plans/agent-backends.md "Watchdogs and progress"); pi keeps its per-command
             // classification, where only a piped or redirected command is buffered.
-            if (deps.agent === "claude" || commandBuffersOutput(call.command || call.label)) {
+            if (!streamsToolOutput(deps.agent) || commandBuffersOutput(call.command || call.label)) {
                 const openMs = Date.now() - call.lastActivityAt;
                 const bufferedStallMs = bufferedCommandStallMs(deps.stallMs);
                 if (openMs >= bufferedStallMs) {

package/dist/src/pi-extension/bounded-output.js

@@ -13,13 +13,26 @@
  *
  * Limits are constants on purpose (opinionated defaults over configuration). The read
  * limit (~12k chars ≈ 300 lines) mirrors the prompt's CONTEXT_BUDGET_RULE; the bash limit
- * is looser because test logs and build output legitimately need more tail.
+ * is looser because test logs and build output legitimately need more tail. Both were tuned on
+ * the 128k local fallback, so a model that declares a smaller window gets them scaled down in
+ * proportion (`outputLimits`): a 12k-char result is twice the share of a 64k window.
  */
+import { windowScale } from "./context-window.js";
 import { writeFullOutput } from "./full-output.js";
 /** Char budget for a `read` tool result (~300 lines, matching CONTEXT_BUDGET_RULE). */
 export const READ_LIMIT_CHARS = 12_000;
 /** Char budget for a `bash` tool result — looser, so test/build tails survive. */
 export const BASH_LIMIT_CHARS = 16_000;
+/** The smallest share of each tuned limit a small window scales it to: a quarter keeps a test
+ * log's tail readable (4,000 chars of bash) even at a 32k window. */
+const MIN_LIMIT_SHARE = 0.25;
+/** The budgets for a model's declared context window: READ_LIMIT_CHARS and BASH_LIMIT_CHARS at
+ * or above the 128k window they were tuned on (and when the window is unknown), scaled down in
+ * proportion below it — 6,000 and 8,000 chars at 64k — and never under a quarter of each. */
+export function outputLimits(contextWindow) {
+    const scale = Math.max(MIN_LIMIT_SHARE, windowScale(contextWindow));
+    return { read: Math.round(READ_LIMIT_CHARS * scale), bash: Math.round(BASH_LIMIT_CHARS * scale) };
+}
 /** Extra code points reserved when snapping cut points to line boundaries, so the
  * snapped head+tail plus marker still fit inside the limit even after rounding. */
 const SNAP_SLACK = 240;
@@ -136,9 +149,10 @@ export function boundBashResult(text, details, writeFullOutput, limitChars = BAS
     const fullPath = details?.fullOutputPath ?? writeFullOutput?.(text) ?? null;
     return boundText(text, limitChars, fullPath);
 }
-/** The pi extension entry point: bound oversized read and bash results in place. */
+/** The pi extension entry point: bound oversized read and bash results in place, at the budgets
+ * for the current model's declared window (read per result, so a model change is honored). */
 export default function boundedOutput(pi) {
-    pi.on("tool_result", (event) => {
+    pi.on("tool_result", (event, ctx) => {
         if (event.toolName !== "read" && event.toolName !== "bash")
             return undefined;
         const blocks = event.content;
@@ -148,9 +162,10 @@ export default function boundedOutput(pi) {
         const textBlock = blocks.find((b) => b?.type === "text" && typeof b.text === "string");
         if (!textBlock || typeof textBlock.text !== "string")
             return undefined;
+        const limits = outputLimits(ctx?.model?.contextWindow);
         const bounded = event.toolName === "read"
-            ? boundReadResult(textBlock.text, event.input)
-            : boundBashResult(textBlock.text, event.details, (text) => writeFullOutput(text, event.toolCallId));
+            ? boundReadResult(textBlock.text, event.input, limits.read)
+            : boundBashResult(textBlock.text, event.details, (text) => writeFullOutput(text, event.toolCallId), limits.bash);
         if (bounded === textBlock.text)
             return undefined;
         return { content: [{ type: "text", text: bounded }] };

package/dist/src/pi-extension/context-budget.js

@@ -9,7 +9,9 @@
  * lossy summary; past it, a run that keeps reading hits the window and lands nothing. context-shake
  * reclaims the oldest bulky tool results first, so the notes now sit above that reclaim line: the
  * 70% note names the crossing, context-shake elides what it can in the same turn_end, and at 85%
- * the note is the stop-reading backstop for a run whose remaining results were not reclaimable. The
+ * the note is the stop-reading backstop for a run whose remaining results were not reclaimable. (On
+ * a window under 128k context-shake crosses earlier, under pi's compaction line — see its
+ * `shakeLimits` — while these notes keep their percentages.) The
  * failure mode the numbers exist for is the fallback's local model (Qwen3.8-27B): its longest ticks
  * peaked at 96–110k tokens (coverage, steward, telemetry, plan; 2026-09-29..10-01) while the
  * prompt's reading budget could only say "your window is finite". On a large-window model the

package/dist/src/pi-extension/context-shake.js

@@ -1,5 +1,6 @@
 /**
- * Bundled pi extension: when a run crosses 70% of its context window, reclaim the space held
+ * Bundled pi extension: when a run crosses 70% of its context window (less on a window under
+ * 128k, where pi compacts sooner — see `shakeLimits`), reclaim the space held
  * by old, bulky `read` and `bash` tool results by replacing each with a short pointer the model
  * can follow back to the full text. Loaded on every pi run via `-e <this file>` from
  * src/pi/pi-args.ts, after bounded-output and before context-budget.
@@ -10,7 +11,7 @@
  * old tool results with recoverable references and keep the recent window intact. pi 1.0.0 can
  * do the same from an extension — a `turn_end` handler appends persisted `context_edit` entries
  * (pi docs, extensions.md "Events and concurrency"; session-format.md "ContextEditEntry"). On a
- * large-window primary (1M) the 70% line sits far above the largest fleet tick, so the
+ * large-window primary (1M) the 70% line sits far above the largest team tick, so the
  * extension plans nothing and costs nothing there.
  *
  * The selection logic is a pure, exported function (`shakePlan`) so every rule is unit-testable
@@ -24,18 +25,45 @@ import { compactTokens } from "../text/format.js";
 import { writeFullOutput } from "./full-output.js";
 import { appendToolResultNote } from "./tool-result-content.js";
 import { readContextUsage } from "./context-usage.js";
-/** The fill percentage at which the first shake pass runs. */
+import { compactionPercent, declaredWindow, windowScale } from "./context-window.js";
+/** The fill percentage at which the first shake pass runs, on the 128k window it was tuned on
+ * (see `shakeLimits` for a smaller one). */
 export const SHAKE_PERCENT = 70;
 /** The fill percentage at which a second pass runs, only when the first did not bring the run
  * back under `SHAKE_PERCENT` (the note-heavy path climbs here again). */
 export const SHAKE_MAX_PERCENT = 85;
 /** The newest slice of context, in estimated tokens, that is never elided — the model still
- * needs what it was just reading. */
+ * needs what it was just reading. Tuned on the 128k window. */
 export const SHAKE_PROTECTED_TOKENS = 20_000;
 /** A tool result shorter than this is left alone: its pointer would save little. */
 export const SHAKE_MIN_CHARS = 2_000;
-/** A pass that would reclaim fewer than this many estimated tokens is not worth the edit. */
+/** A pass that would reclaim fewer than this many estimated tokens is not worth the edit. Tuned
+ * on the 128k window. */
 export const SHAKE_MIN_RECLAIM_TOKENS = 10_000;
+/** How far, in percentage points, the second pass stays under pi's own compaction line: 2.5
+ * puts it at exactly SHAKE_MAX_PERCENT on the 128k window. */
+const COMPACTION_MARGIN_PERCENT = 2.5;
+/** The shake limits for a declared context window. At or above the 128k window they were tuned
+ * on — and when the window is unknown — they are the SHAKE_* constants. Below it:
+ *  - the protected slice and the reclaim floor scale in proportion (10k and 5k tokens at 64k);
+ *  - both passes move under pi's compaction line (window − 16,384), which on a small window
+ *    falls below 85% — at 64k it is 75%, so an 85% pass would never run before pi replaced the
+ *    run's reads with a lossy summary. The second pass sits COMPACTION_MARGIN_PERCENT under
+ *    that line and the first keeps its 15-point lead (57.5% and 72.5% at 64k).
+ * Pure. */
+export function shakeLimits(contextWindow) {
+    const window = declaredWindow(contextWindow);
+    const scale = windowScale(window);
+    const maxPercent = window === null
+        ? SHAKE_MAX_PERCENT
+        : Math.max(0, Math.min(SHAKE_MAX_PERCENT, compactionPercent(window) - COMPACTION_MARGIN_PERCENT));
+    return {
+        percent: Math.max(0, Math.min(SHAKE_PERCENT, maxPercent - (SHAKE_MAX_PERCENT - SHAKE_PERCENT))),
+        maxPercent,
+        protectedTokens: Math.round(SHAKE_PROTECTED_TOKENS * scale),
+        minReclaimTokens: Math.round(SHAKE_MIN_RECLAIM_TOKENS * scale),
+    };
+}
 /** The fixed prefix of every elision pointer, used to recognize a result that was already
  * elided (and must never be elided again). */
 export const ELIDED_PREFIX = "[elided by tumwater:";
@@ -52,7 +80,7 @@ function percentOf(usage) {
     }
     // Both ratio inputs are read through nonNegativeNumber: a NaN/Infinity/negative/string wire
     // value is as unusable as a missing one, and a NaN ratio would slip past shakePlan's
-    // `percent < SHAKE_PERCENT` guard (every comparison against NaN is false) and plan a pass on
+    // `percent < limits.percent` guard (every comparison against NaN is false) and plan a pass on
     // an unknown fill. A non-positive window has no ratio either.
     const tokens = nonNegativeNumber(usage.tokens, null);
     const window = nonNegativeNumber(usage.contextWindow, null);
@@ -85,8 +113,8 @@ function replacementFor(msg, fullOutputPath) {
 }
 /** Whether one message is even a candidate, ignoring the reclaim floor: a bulky, non-error,
  * not-already-elided read or bash result that sits outside the protected newest slice. */
-function isCandidate(msg, newerTokens) {
-    if (newerTokens < SHAKE_PROTECTED_TOKENS)
+function isCandidate(msg, newerTokens, protectedTokens) {
+    if (newerTokens < protectedTokens)
         return false;
     if (msg.role !== "toolResult")
         return false;
@@ -104,14 +132,16 @@ function isCandidate(msg, newerTokens) {
 }
 /**
  * Plan a shake pass: the `context_edit` replacements that reclaim the most space from old
- * bulky tool results. Empty unless the run is at or above `SHAKE_PERCENT`, something outside
- * the newest `SHAKE_PROTECTED_TOKENS` is reclaimable, and the pass clears
- * `SHAKE_MIN_RECLAIM_TOKENS` together. Deterministic and filesystem-free except the injected
+ * bulky tool results. Empty unless the run is at or above the first pass's percent, something
+ * outside the newest protected slice is reclaimable, and the pass clears the reclaim floor
+ * together — all three from `shakeLimits` for the usage's window. Deterministic and
+ * filesystem-free except the injected
  * `writeFullOutput`, which is only called for a bash result pi has not already persisted.
  */
 export function shakePlan(messages, usage, writeFullOutput) {
     const percent = percentOf(usage);
-    if (percent === null || percent < SHAKE_PERCENT)
+    const limits = shakeLimits(usage.contextWindow);
+    if (percent === null || percent < limits.percent)
         return EMPTY_PLAN;
     // Tokens newer than each message, so a candidate is one the model has already moved past.
     const newerTokens = new Array(messages.length).fill(0);
@@ -120,11 +150,11 @@ export function shakePlan(messages, usage, writeFullOutput) {
         newerTokens[i] = running;
         running += estimateTokens(messages[i]?.text ?? "");
     }
-    const candidates = messages.filter((msg, i) => isCandidate(msg, newerTokens[i] ?? 0));
+    const candidates = messages.filter((msg, i) => isCandidate(msg, newerTokens[i] ?? 0, limits.protectedTokens));
     // The pointer is far shorter than the result it replaces, so the full text's tokens are a
     // safe upper bound on the reclaim; bail before touching the writer when even that is short.
     const upperBound = candidates.reduce((sum, msg) => sum + estimateTokens(msg.text), 0);
-    if (upperBound < SHAKE_MIN_RECLAIM_TOKENS)
+    if (upperBound < limits.minReclaimTokens)
         return EMPTY_PLAN;
     const edits = [];
     let reclaimedTokens = 0;
@@ -141,7 +171,7 @@ export function shakePlan(messages, usage, writeFullOutput) {
         edits.push({ targetId: msg.entryId, toolName: msg.toolName, replacement, reclaimedTokens: reclaimed });
         reclaimedTokens += reclaimed;
     }
-    if (reclaimedTokens < SHAKE_MIN_RECLAIM_TOKENS)
+    if (reclaimedTokens < limits.minReclaimTokens)
         return EMPTY_PLAN;
     return { edits, reclaimedTokens, elidedCount: edits.length };
 }
@@ -200,7 +230,8 @@ function textOf(msg) {
         .join("\n");
 }
 /** The pi extension entry point: shake at 70% (and again at 85% when the first pass did not
- * hold), leaving each pointer in the context and the one-line summary on the next result. */
+ * hold) — on a window under 128k, at `shakeLimits`'s lower crossings — leaving each pointer in
+ * the context and the one-line summary on the next result. */
 export default function contextShake(pi) {
     let lastShake = 0;
     let pendingNote = null;
@@ -211,12 +242,14 @@ export default function contextShake(pi) {
         const percent = percentOf(usage);
         if (percent === null)
             return undefined;
-        // One pass per crossing: 70% first, then 85% only if the run climbed back here.
+        // One pass per crossing: the first pass's percent, then the second's only if the run
+        // climbed back there.
         let threshold = 0;
-        if (lastShake < SHAKE_PERCENT && percent >= SHAKE_PERCENT)
-            threshold = SHAKE_PERCENT;
-        else if (lastShake < SHAKE_MAX_PERCENT && percent >= SHAKE_MAX_PERCENT)
-            threshold = SHAKE_MAX_PERCENT;
+        const limits = shakeLimits(usage.contextWindow);
+        if (lastShake < limits.percent && percent >= limits.percent)
+            threshold = limits.percent;
+        else if (lastShake < limits.maxPercent && percent >= limits.maxPercent)
+            threshold = limits.maxPercent;
         if (threshold === 0)
             return undefined;
         lastShake = threshold;