zigmini 0.8.0-beta.6 → 0.8.0-beta.7

package/host/omo-check/patches/omo-5.1.35-compaction-refusal.patch

@@ -0,0 +1,83 @@
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/refusal.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/refusal.js
+@@ -25,7 +25,14 @@
+     const details = refusalDetails(message);
+     return details ? new ClaudeSdkRefusalError(details.content, details.category) : undefined;
+ }
+-export function isClaudeSdkRefusal(error) {
+-    return error instanceof ClaudeSdkRefusalError;
+-}
++export function isClaudeSdkRefusal(error) {
++    return getClaudeSdkRefusal(error) !== undefined;
++}
++export function getClaudeSdkRefusal(error) {
++    if (error instanceof ClaudeSdkRefusalError)
++        return error;
++    if (error !== null && typeof error === "object" && "original" in error)
++        return getClaudeSdkRefusal(error.original);
++    return undefined;
++}
+ //# sourceMappingURL=refusal.js.map
+
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/errors.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/errors.js
+@@ -1,4 +1,5 @@
+-import { rateLimitModelFamily } from "../../../credential-pool/model-scope.js";
++import { rateLimitModelFamily } from "../../../credential-pool/model-scope.js";
++import { isClaudeSdkRefusal } from "./refusal.js";
+ const SDK_ERROR_CLASSIFICATIONS = {
+     authentication_failed: { kind: "auth_error", retryable: true },
+     oauth_org_not_allowed: { kind: "org_not_allowed", retryable: true },
+@@ -75,8 +76,10 @@
+     return new Error(text ? (message.error === "unknown" ? text : `${text} (${message.error})`) : message.error);
+ }
+ /** Classifies Anthropic Subscription error codes and HTTP-shaped fallback text in one place. */
+-export function classifySdkError(error) {
+-    const classification = classifyErrorKind(error);
++export function classifySdkError(error) {
++    if (isClaudeSdkRefusal(error))
++        return OTHER_ERROR;
++    const classification = classifyErrorKind(error);
+     if (classification.kind !== "rate_limit")
+         return classification;
+     const modelFamily = rateLimitModelFamily(errorText(error));
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/stream.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/stream.js
+@@ -9,7 +9,7 @@
+ import { buildDeferredPromptStream, buildPromptBlocks } from "./prompt-bridge.js";
+ import { pinOneShotPromptCacheTtl } from "./prompt-cache-ttl.js";
+ import { dedupeUltraworkBlocks } from "./prompt-directive-dedupe.js";
+-import { refusalError } from "./refusal.js";
++import { getClaudeSdkRefusal, refusalError } from "./refusal.js";
+ import { getSdkBoundary, loadClaudeAgentSdk } from "./sdk-boundary.js";
+ import { emitContinuityObservation } from "./session-observability.js";
+ import { forgetBinding } from "./session-reattach.js";
+@@ -244,8 +244,11 @@
+             // senpi's own history instead of resuming that rewritten transcript.
+             if (nativeCompactionStopped && options?.sessionId)
+                 forgetBinding(options.sessionId);
+-            output.stopReason = options?.signal?.aborted ? "aborted" : "error";
+-            // A failed result still bills its tokens; managed and resident lanes
++            output.stopReason = options?.signal?.aborted ? "aborted" : "error";
++            const refusal = getClaudeSdkRefusal(error);
++            if (refusal)
++                output.stopDetails = { type: "refusal", explanation: refusal.message };
++            // A failed result still bills its tokens; managed and resident lanes
+             // throw before the result reaches this loop, so account for it here.
+             const billed = sdkResultFailureUsage(error);
+             if (billed)
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/deterministic-fallback.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/deterministic-fallback.js
+@@ -97,8 +97,10 @@
+         return true;
+     return error instanceof SummaryRequestError && !error.transient && !error.refused && error.failureKind === undefined;
+ }
+-export function classifyRequiredCompactionFallbackFailure(error) {
+-    if (error instanceof UnsafeRetainedSuffixError)
++export function classifyRequiredCompactionFallbackFailure(error) {
++    if (error instanceof SummaryRequestError && error.refused)
++        return undefined;
++    if (error instanceof UnsafeRetainedSuffixError)
+         return "unsafe-retained-content";
+     if (error instanceof StreamDurationBudgetError ||
+         error instanceof StreamIdleTimeoutError ||

package/host/omo-check/patches/omo-5.1.35-gateway-port.manifest.json

@@ -1,11 +1,11 @@
 {
   "schema": 1,
-  "revision": 4,
+  "revision": 8,
   "upstream": {
     "omo": "5.1.35",
     "senpi": "2026.10.16"
   },
-  "candidate": "<zigmini home>/omo/5.1.35-zgw",
+  "candidate": "<zigmini home>/omo/5.1.35-zgw.8",
   "pristine": "<zigmini home>/omo/5.1.35",
   "entrypoint": "node_modules/@code-yeongyu/senpi/dist/cli.js",
   "patchRoot": "node_modules",
@@ -13,18 +13,25 @@
     "omo-5.1.35-gateway-port.patch",
     "omo-5.1.35-image-replay.patch",
     "omo-5.1.35-question-capability.patch",
-    "omo-5.1.35-phantom-attach.patch"
+    "omo-5.1.35-phantom-attach.patch",
+    "omo-5.1.35-request-rules.patch",
+    "omo-5.1.35-compaction-model.patch",
+    "omo-5.1.35-compaction-refusal.patch",
+    "omo-5.1.35-compaction-preservation.patch",
+    "omo-5.1.35-compaction-intent.patch",
+    "omo-5.1.35-compaction-idle.patch",
+    "omo-5.1.35-turn-stats.patch"
   ],
   "files": [
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/core/agent-session.d.ts",
       "originalSha256": "f824b37b0d19f07e182254d0133cf57526b6a6fde9c8cfad62b6ba5af50cd119",
-      "patchedSha256": "d669bdf3c71d5bef8d4491c912e83fc4229704b0fccfb42932d8a1f924edc8c6"
+      "patchedSha256": "b2457c6da97d27285671cf38de1c2eb48f61a50cbcae6b79b42b0604d9f98bd5"
     },
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/core/agent-session.js",
       "originalSha256": "d861188c06f5354b8279d3158b8e7db1a7d86053a3dfe3b581c4fef52a1bcbbc",
-      "patchedSha256": "8843671f6eff07ceaeb7d90cca3617321fe926efd8e1d48941075f9e6e36d761"
+      "patchedSha256": "60e22e74fb4b607f3a2fc07fbbe4fd773973414e58cf9fb54dec06c0fd1456cb"
     },
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/core/auth-storage.js",
@@ -41,16 +48,46 @@
       "originalSha256": "2f6a8601aa879e11e37322d939ebd0f31ed21b51735d0f71f6833ee85d3b1c75",
       "patchedSha256": "dd2427652a7a1b0bf07a18bddfc9ffc2f48140376eb6349e7ff3c350d508c447"
     },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/compaction/compaction.js",
+      "originalSha256": "1c24c48064542867c58371cf469af8e98984bd44861c464dbd122b79683c4a21",
+      "patchedSha256": "655797b41847962657bc355835d1f08e88d06f21c4b00535aa2d693685c72660"
+    },
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/core/credential-accounts.js",
       "originalSha256": "f98f1758e934135084d2765f73b20e4c22f6a74dce344569c6dfbfe9dc250cbc",
       "patchedSha256": "218862c77a0df2691a521ae99c95e99acc64a8547dd6d6e627ebd98369d34fe0"
     },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/auth-lane.d.ts",
+      "originalSha256": "6a4536363e0c71add5c61f969f1880503df02249914d294412dcf5b284b58f16",
+      "patchedSha256": "7858496cdf2c89533810f310156915f5d3be578a22a81a38de34b8d8d194c8cd"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/auth-lane.js",
+      "originalSha256": "8fd122e765b0f8f395a1d1c14a41f538a46816b9d68b1404004cb604f17bf038",
+      "patchedSha256": "877361fa222bf908c735bc7c8e22028ad6604c36d07c11928c27217d3fb9dad6"
+    },
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/cold-seed-images.js",
       "originalSha256": "f40ff494a945bc5188dca010476cac76ae60f178f67d5391457a04e7f266c16e",
       "patchedSha256": "7c042bc1bfc0240cfd576cdc989f174dd248270219cc834788d22c9df3aa6903"
     },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/errors.js",
+      "originalSha256": "e4fce0dbc87e7d9b19844319a5064c4fbc0681db8574279a67e2094285b41934",
+      "patchedSha256": "52efe8a368e29e425ba75453870f9c72a50889a60a9fdacdcc9339ac3fb75025"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/refusal.js",
+      "originalSha256": "d13ad77fff8128a833494dfd1eb95760bca3f57621c9e3cb36b0370407e58c46",
+      "patchedSha256": "1b4673286c40d615752ec4acfd0fdd17e645c3af275232d9c6b8fad2ace10445"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/stream.js",
+      "originalSha256": "477ec59462bd11ab89b5fcbe018e8f505b7a79a2550aa23f76d0b04e48026d22",
+      "patchedSha256": "edf9fc8a5779ddc92d81d879b7a18214e20be0ec7895c481c09d37d47b390892"
+    },
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/ask-user/pending.js",
       "originalSha256": "0f8156f0cdd1fbc4bb08486d0b8b6ff5f821b9ac5df4cf5056714689fb2bb0c5",
@@ -71,6 +108,116 @@
       "originalSha256": "2e6cb7dd518e11b49b04275bf2e7d8014c834814b05a7cfc2232d1f970f51df9",
       "patchedSha256": "61ed013b8e33a3c4e1d4a9c9e491d0193811721a27afba11fb8cebb089cd805e"
     },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/context-pipeline.js",
+      "originalSha256": "9af989447ef4145f25e58fb421a42d98af5a544b5297c1b66f9577ca285c2fe9",
+      "patchedSha256": "4d87236638509c1e28b29e6964fbab92f91fa477543ecca48d3bd87c6a422cc7"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/context-reduction-handoff.js",
+      "originalSha256": "e02c76847d5060bf9f1527786c0a545143bfc7c5a77ecc194341d48564ebaed1",
+      "patchedSha256": "df205aa25d56439e56ac275e6c903e4dccd812e1b5a2aea5450ae645115c2e76"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/context-reduction-lifecycle.js",
+      "originalSha256": "8ff27c815d2a33f1afbd23dd800157e3abad4324914d9cd776883122697ba003",
+      "patchedSha256": "c27cabce3751e2db42054bf51473673126366ce9aae5ed48dfeeef7066164f50"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/deterministic-fallback.js",
+      "originalSha256": "2e33f9e1afc7320070e1566f5ef52a0b6ecb5e6adc59d9a0c4633773e8fb4b14",
+      "patchedSha256": "c00f5fadcf0d445a5fbe4e542a2a1b6e1c0dca5509822a65602d0fc32dbdde29"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/emergency-prune.js",
+      "originalSha256": "64487d2e21273bd5a735485507e12a10c1039e6ecde548722e8e2c4e4d3b4773",
+      "patchedSha256": "00b8ce5b493f8605abc2f96b1270f40e532f4bc94532c3bf06b18baa81d3b2fe"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/extension-wiring.js",
+      "originalSha256": "0612dc35d11ccee5b4b630dae9504f829ab81bf0aa4c8eab35d1aba617174a3f",
+      "patchedSha256": "c521dfa0dd9b6281ae84cd40e4bbfd2eea50874222a74c89fef97e88a93813d1"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/index.js",
+      "originalSha256": "0ad15ac2a16c8ab7edf986b6a4653f9302c1945e66a1a6f48d6b9ca24ed54b7f",
+      "patchedSha256": "aadd59a28f75ecd99b375ba2e2ca180b73dc3b6553f35508aec6590304f4e487"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/lane-policy.js",
+      "originalSha256": "e701d15afac3e70e880b544e761c378b8a1d7bf7b68f6e21495a010c3bad3406",
+      "patchedSha256": "d16359d291f4c1ddce5f5a2c8d48f09e4c0b14418f3ffc5293a2c22814cbb316"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote-convert.js",
+      "originalSha256": "a2eae1acead0a92eaddaa9a0bea56902a05bd33656635dd90b8d7fe84d9d24a0",
+      "patchedSha256": "cbe0df338fcb246e96c840bf006d6c1ad74bade810850018c9eba2e843997d5c"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote-responses-v2.js",
+      "originalSha256": "9f937de797e3bdabaade5cf1b9dea1f87c7919c93edefe142cd8b2453669a7c4",
+      "patchedSha256": "7cc4498b874e94457c15affae32026db219a066a449c7175075a1ae2e23f654e"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote-schema.js",
+      "originalSha256": "5154b38ef8fa50626edc444d2111ed931dc72bd3616a5845776995012f501e8e",
+      "patchedSha256": "c00d15f2f3cad40f48bffab524ce33afa617a3cd85622b235b2cd105bbbd939c"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote-timeout.d.ts",
+      "originalSha256": "f31c61df9f81ff3b7bacf4565463fc5f582b604cc40a5cd81b2f72c5fe2015db",
+      "patchedSha256": "63f2cac427f164e65feb58fcd413d6b09f6c4010d8b176971ee716f3a75201bc"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote-timeout.js",
+      "originalSha256": "357781e9fc41f840c2048958a784be075595c1dce9c5cf716940bdfe771681d1",
+      "patchedSha256": "93702b16d3e351c812631cf541c175c85a8be1ba2515e8eedad08f54c4bdfcc1"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote.d.ts",
+      "originalSha256": "d4ea95dbd8f857dfeb5120e5bec35865d78cbb79fe4d59f5cae2ffbe4baa1e66",
+      "patchedSha256": "b4873967e45f53cf0647301a486176263e6a5db0843028002990d7f192b443cf"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote.js",
+      "originalSha256": "889de1c53e7fc891a099136866c831bd5dfe8ecc15b2dda8d354657e0ec1377b",
+      "patchedSha256": "657c9132ab806490c8a07fdc09639621ba7e63a2c1cf93b6bdf0484d896e02f7"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/prompts.js",
+      "originalSha256": "5bf074aea446baa51204f29ec00758a93a9cbfc89caa62ffe0a4078dcca0e6b3",
+      "patchedSha256": "2178bdcd1f9acfadc07815309c44a8b35741f1243543333795b5e9e64403a197"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/rejected-recovery.d.ts",
+      "originalSha256": "40e74e75a77ac0f89ef931385e0f88c3a5d188e2aed06ac295ddfac598ea4464",
+      "patchedSha256": "54c5c03818a56d0e6560dcba1fca3bc5163dd29205ddb874f2d5e74f2e76473a"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/rejected-recovery.js",
+      "originalSha256": "dccd1cba630ed1674343fae06b21bc081712668481969692ec6e4a246107ca22",
+      "patchedSha256": "d6fa0fd69d6532647a3f7db7a35cde499a10fc833e593c5dca96e5e49a4476f5"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative-summary.js",
+      "originalSha256": "25dc617e8b999f7b38e638287df81790768279aa78a607e692ccd2b108b88ada",
+      "patchedSha256": "ea31110fdc12aee77dc47114efd9d7d230443b735cef300f60e03a27bfbe4779"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative.d.ts",
+      "originalSha256": "826ec46e212f2378a68bf55fa2ba1b406d6a225e81549983361cf54480388f32",
+      "patchedSha256": "99d2702cf752b45c1d46ffbbf231a9bc1007cdeb919571f7d497b01cada7f931"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative.js",
+      "originalSha256": "99ac70e0088f2b66538b76c4b2acef5c13e5290e3e1645fea71b8a70c41799b4",
+      "patchedSha256": "a41786f41d838c679f8be6e14d8831458c7acb9d43e5aa44d7030e22470b47e3"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/task-intent.js",
+      "originalSha256": "3d78e7e232c172a57af0e919cf0b0b34c98282f235c2d400e4c0bba7f47d545d",
+      "patchedSha256": "85a396201b2b248b74cd9eebb362bd96c713806577b179df8ad99c4ac095889f"
+    },
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/permission-system/events.d.ts",
       "originalSha256": "8fb12fba44abc0066360248855951833eca3684b0d340579db3409afe8a2c767",
@@ -106,10 +253,20 @@
       "originalSha256": "78865611f2018bbd8bcde160bcb7c517e743394cb0c0e0a3f774e55cd7f25b2f",
       "patchedSha256": "11f5b99fbd59963d7426e659c6db4764580d7c89aee8bb3a7d1beab12fba9b72"
     },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/runner.js",
+      "originalSha256": "5bbc9de01f7ec0f4d52ade362c9acba8a27d14ecaef4af06593b04451ce9ebe3",
+      "patchedSha256": "d1fab450b98c832239424fbffa616690678e44527e36ce6299a300fccb123778"
+    },
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/types.d.ts",
       "originalSha256": "990653c416a88b76c5338b75cb58e2d8843b4ca528722571b18ef1fdb9d10cc2",
-      "patchedSha256": "5a646947a3573698bf956cec3395cfc362903fa100ba0920d80e6095add54148"
+      "patchedSha256": "4c914b28970084777b31da70f1199c1a744226c6e7beba516bcfa7cb9d3f011a"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/model-runtime.js",
+      "originalSha256": "e43ff1363e3284a5b3495d5eaaf4b9b6bcefcd6a60f2f8e7f91b98e1ce69c446",
+      "patchedSha256": "350688afcb9da83938130eceda83f033a8cbc7c318e8e44886396826d967ea21"
     },
     {
       "path": "node_modules/@code-yeongyu/senpi/dist/modes/rpc/client-input-handler.js",
@@ -164,12 +321,17 @@
     {
       "path": "node_modules/@earendil-works/pi-ai/dist/types.d.ts",
       "originalSha256": "5440ea974e52f4413f38240dc3f6c435e5e90796e7477fc5de6a500c3c2226c7",
-      "patchedSha256": "64f7fee8c3ddff79facba8dd5eff14777b1aebef188899aca86379e54cfb9656"
+      "patchedSha256": "f8ebe662ba115f2e31b30c2b32d8e3d46581440a87b56c5acf50f853649ea4a4"
     },
     {
       "path": "node_modules/omo-ai/bin/lib/package-paths.js",
       "originalSha256": "da57bd6016ab85a0f65f53cde53ca3b2e8606e2efc515bcb592d637c24401e67",
       "patchedSha256": "b99f4ea56abecc7950f06c67fb0f538148e9baae4027c9b55f5debf130479686"
+    },
+    {
+      "path": "node_modules/@code-yeongyu/senpi/dist/core/extensions/builtin/tps.js",
+      "originalSha256": "c1a22d2520e84f136aa91a770eb49bd42cfbcce57864bfa263e491f45bb08f65",
+      "patchedSha256": "c72d51910bf8e61452cc11d57702075be96d3b5e51c00c30678eb499f2551509"
     }
   ]
 }

package/host/omo-check/patches/omo-5.1.35-request-rules.patch

@@ -0,0 +1,109 @@
+--- a/@code-yeongyu/senpi/dist/core/model-runtime.js
++++ b/@code-yeongyu/senpi/dist/core/model-runtime.js
+@@ -72,7 +72,8 @@
+         ...options,
+         onPayload: async (payload, providerModel) => await onPayload(payload, providerModel, {
+             model,
+-            headers: options.headers ?? {},
++            headers: options.headers ?? {},
++            streamKind: options.streamKind,
+         }),
+     };
+ }
+--- a/@earendil-works/pi-ai/dist/types.d.ts
++++ b/@earendil-works/pi-ai/dist/types.d.ts
+@@ -84,9 +84,10 @@
+ /** Effective model and fully transformed headers for a request payload hook. */
+ export type ProviderRequestMetadata = {
+     model: Model<Api>;
+-    headers: ProviderHeaders;
+-};
+-export type FetchFunction = typeof globalThis.fetch;
++    headers: ProviderHeaders;
++    streamKind?: "main" | "auxiliary";
++};
++export type FetchFunction = typeof globalThis.fetch;
+ export interface ProviderResponse {
+     status: number;
+     headers: Record<string, string>;
+--- a/@code-yeongyu/senpi/dist/core/extensions/runner.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/runner.js
+@@ -1614,7 +1614,7 @@
+                     const event = {
+                         type: "before_provider_request",
+                         payload: currentPayload,
+-                        ...(request ? { model: request.model, headers: request.headers } : {}),
++                        ...(request ? { model: request.model, headers: request.headers, streamKind: request.streamKind } : {}),
+                     };
+                     const handlerResult = await handler(event, this.createContext(ext.path));
+                     if (handlerResult !== undefined) {
+--- a/@code-yeongyu/senpi/dist/core/extensions/types.d.ts
++++ b/@code-yeongyu/senpi/dist/core/extensions/types.d.ts
+@@ -1137,10 +1137,11 @@
+     /** Effective request model after auth/base-url/upstream-model resolution. */
+     model?: Model<Api>;
+     /** Final header transform output for this request. Values are never persisted. */
+-    headers?: ProviderHeaders;
+-}
+-/**
+- * Fired after request headers are assembled, before the provider HTTP call.
++    headers?: ProviderHeaders;
++    streamKind?: "main" | "auxiliary";
++}
++/**
++ * Fired after request headers are assembled, before the provider HTTP call.
+  * Handlers mutate `headers` in place (e.g. to inject tracing/session headers);
+  * the return value is ignored. A `null` value deletes that header.
+  */
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/stream.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/stream.js
+@@ -74,7 +74,7 @@
+             claudeCodeRun = resolveClaudeCodeRun(defaultExecutableDeps());
+             const executable = claudeCodeRun.executable;
+             let oneShotCacheTtl;
+-            const buildOptions = (authLane) => {
++            const buildOptions = async (authLane) => {
+                 const queryOptions = buildAnthropicSubscriptionQueryOptions({
+                     model,
+                     context,
+@@ -97,7 +97,8 @@
+                 if (!useResidentSession) {
+                     oneShotCacheTtl = pinOneShotPromptCacheTtl(queryOptions, authLane ?? providerSettings.tokenInjection ?? "ambient", { ...process.env, ...options?.env });
+                 }
+-                return queryOptions;
++                const replacement = await options?.onPayload?.(queryOptions, model);
++                return replacement === undefined ? queryOptions : replacement;
+             };
+             const recordContinuity = (observation) => {
+                 // Not a failure: carry the observation as details only, with no synthesized error.
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/auth-lane.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/auth-lane.js
+@@ -186,7 +186,7 @@
+         }
+         // Lane-owned variables from buildOptions (the compaction-owner overlay) win over the host.
+         const ambientAttempt = async () => {
+-            const options = input.buildOptions("ambient");
++            const options = await input.buildOptions("ambient");
+             options.env = { ...ambientEnvironment, ...options.env };
+             return createAttemptMessages(input, { accountName: "ambient", accounts: [], authLane: "ambient", options });
+         };
+@@ -215,7 +215,7 @@
+             ...(input.model === undefined ? {} : { model: input.model }),
+         }),
+         runAttempt: async (slot) => {
+-            const options = input.buildOptions(pool.lane);
++            const options = await input.buildOptions(pool.lane);
+             const accounts = pool.accounts.map((account) => ({ ...account }));
+             const prepared = await prepareSlot(pool, slot, signal);
+             options.env = { ...prepared.env, ...options.env };
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/auth-lane.d.ts
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/anthropic-subscription/auth-lane.d.ts
+@@ -18,7 +18,7 @@
+ export type AuthenticatedQueryInput = {
+     prompt: Parameters<SdkQuery>[0]["prompt"];
+     query: SdkQuery;
+-    buildOptions: (lane: AnthropicSubscriptionTokenInjection) => Options;
++    buildOptions: (lane: AnthropicSubscriptionTokenInjection) => Options | Promise<Options>;
+     providerSettings: AnthropicSubscriptionProviderSettings;
+     /** Effective request auth environment; overrides the host for account discovery and SDK spawn. */
+     env?: Record<string, string>;

package/host/omo-check/patches/omo-5.1.35-turn-stats.patch

@@ -0,0 +1,76 @@
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/tps.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/tps.js
+@@ -23,6 +23,8 @@
+     let lastDeltaMs = null;
+     let generationMs = 0;
+     let streamedOutput = 0;
++    let turnId = null;
++    let completedMessages = [];
+     const finishActiveAssistantTiming = () => {
+         if (activeAssistantStartMs === null)
+             return;
+@@ -41,7 +43,11 @@
+         lastDeltaMs = null;
+         thinkingStreamed = false;
+     };
++    pi.on("agent_start", (_event, ctx) => {
++        turnId = ctx.mode === "rpc" ? crypto.randomUUID() : null;
++        completedMessages = [];
++        if (turnId !== null)
++            pi.rpc.emit("zgw.turn_started", { version: 1, turnId });
+-    pi.on("agent_start", () => {
+         activeAssistantStartMs = null;
+         assistantElapsedMs = 0;
+         generationMs = 0;
+@@ -76,6 +82,7 @@
+         // counted in usage.output may be hidden or only summarised after it finished, so it was generated
+         // before the first delta. Such a message (usage.reasoning, or a thinking block whose text never
+         // streamed: Bedrock and omitted display report no reasoning count) is timed from its start.
++        completedMessages.push(event.message);
+         const output = event.message.usage?.output ?? 0;
+         const windowStart = reasonedBeforeFirstDelta(event.message, thinkingStreamed) ? messageStartMs : firstDeltaMs;
+         const counted = event.message.stopReason !== "aborted" && event.message.stopReason !== "error" && output > 0;
+@@ -90,6 +97,43 @@
+         const elapsedMs = assistantElapsedMs;
+         const measuredGenerationMs = generationMs;
+         const measuredOutput = streamedOutput;
++        // Structured RPC metadata stays out of messages and extension_ui_request notifications.
++        const completedTurnId = turnId;
++        turnId = null;
++        const messages = completedMessages;
++        completedMessages = [];
++        const finalMessage = messages.at(-1);
++        const lastAssistant = event.messages.findLast(isAssistantMessage);
++        if (ctx.mode === "rpc" && completedTurnId !== null && !event.aborted && !event.willRetry && !event.abortSource && !ctx.signal?.aborted
++            && finalMessage && (finalMessage.stopReason === "stop" || finalMessage.stopReason === "length")
++            && Number.isInteger(finalMessage.timestamp) && finalMessage.timestamp > 0
++            && lastAssistant?.timestamp === finalMessage.timestamp
++            && !messages.some((message) => message.stopReason === "error" || message.stopReason === "aborted")) {
++            const stats = {};
++            const hasOutput = messages.some((message) => Number.isFinite(message.usage?.output) && message.usage.output > 0);
++            if (hasOutput) {
++                if (Number.isFinite(elapsedMs) && elapsedMs > 0)
++                    stats.modelDurationMs = elapsedMs;
++                const rate = measuredOutput / (measuredGenerationMs / 1000);
++                if (measuredGenerationMs >= MIN_GENERATION_MS && Number.isFinite(rate) && rate > 0)
++                    stats.tokensPerSecond = rate;
++                // Unknown usage must not look like a measured zero-percent cache hit.
++                if (messages.every((message) => [message.usage?.input, message.usage?.cacheRead, message.usage?.cacheWrite]
++                    .every((value) => Number.isFinite(value) && value >= 0))) {
++                    let promptTokens = 0;
++                    let cacheRead = 0;
++                    for (const message of messages) {
++                        promptTokens += message.usage.input + message.usage.cacheRead + message.usage.cacheWrite;
++                        cacheRead += message.usage.cacheRead;
++                    }
++                    const hit = cacheRead / promptTokens * 100;
++                    if (Number.isFinite(promptTokens) && Number.isFinite(cacheRead) && Number.isFinite(hit) && hit >= 0 && hit <= 100)
++                        stats.cacheHitPercent = hit;
++                }
++            }
++            if (Object.keys(stats).length > 0)
++                pi.rpc.emit("zgw.turn_stats", { version: 1, turnId: completedTurnId, finalMessageTimestamp: finalMessage.timestamp, finalMessageIndex: messages.length, stats });
++        }
+         activeAssistantStartMs = null;
+         assistantElapsedMs = 0;
+         generationMs = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zigmini",
-  "version": "0.8.0-beta.6",
+  "version": "0.8.0-beta.7",
   "type": "module",
   "bin": {
     "zigmini": "bin/zigmini"
@@ -21,6 +21,9 @@
     "!host/omo-check/*.ts",
     "!host/omo-check/patches/README.md",
     "assets/",
+    "scripts/secret-rules.ts",
+    "scripts/secret-scan.rules.json",
+    "scripts/secret-scan.allow.json",
     "docs/manual.md",
     "docs/manual.ko.md",
     "LICENSE.md",

package/scripts/secret-rules.ts

@@ -0,0 +1,101 @@
+// Shared pure matching engine for tracked files, Git objects and release artifacts.
+export type Severity = "secret" | "personal";
+export interface Rule {
+	readonly id: string;
+	readonly severity: Severity;
+	readonly pattern: string;
+	readonly flags?: string;
+	readonly group?: number;
+	readonly minEntropy?: number;
+}
+export interface CompiledRule extends Rule { readonly regex: RegExp }
+export interface AllowEntry {
+	readonly value?: string;
+	readonly cidr?: string;
+	readonly domain?: string;
+	/** Exact source paths, or directory prefixes ending in /; omitted for public/reserved values. */
+	readonly files?: readonly string[];
+	readonly rule?: string;
+	readonly reason: string;
+}
+export interface Hit { readonly rule: string; readonly severity: Severity; readonly value: string }
+
+export function entropy(value: string): number {
+	const counts = new Map<string, number>();
+	for (const ch of value) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+	let bits = 0;
+	for (const n of counts.values()) {
+		const p = n / value.length;
+		bits -= p * Math.log2(p);
+	}
+	return bits;
+}
+
+export function compileRules(rules: readonly Rule[]): CompiledRule[] {
+	return rules.map((rule) => {
+		if (!rule.id || (rule.severity !== "secret" && rule.severity !== "personal")) throw new Error(`secret_scan_rule_invalid:${rule.id}`);
+		try {
+			return { ...rule, regex: new RegExp(rule.pattern, `${rule.flags ?? ""}g`) };
+		} catch {
+			throw new Error(`secret_scan_rule_invalid:${rule.id}`);
+		}
+	});
+}
+
+export function validateAllow(entries: readonly AllowEntry[]): AllowEntry[] {
+	return entries.map((entry, index) => {
+		const kinds = [entry.value, entry.cidr, entry.domain].filter((kind) => kind !== undefined).length;
+		if (kinds !== 1 || typeof entry.reason !== "string" || entry.reason.trim() === "") throw new Error(`secret_scan_allow_invalid:${index}`);
+		return entry;
+	});
+}
+
+export function ipv4ToInt(ip: string): number | null {
+	const parts = ip.split(".");
+	if (parts.length !== 4) return null;
+	let value = 0;
+	for (const part of parts) {
+		if (!/^\d{1,3}$/.test(part) || Number(part) > 255) return null;
+		value = value * 256 + Number(part);
+	}
+	return value;
+}
+
+export function inCidr(ip: string, cidr: string): boolean {
+	const [base, bits] = cidr.split("/");
+	const address = ipv4ToInt(ip);
+	const network = ipv4ToInt(base ?? "");
+	const prefix = Number(bits);
+	if (address === null || network === null || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) return false;
+	const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
+	return ((address & mask) >>> 0) === ((network & mask) >>> 0);
+}
+
+export function isAllowed(rule: string, value: string, allow: readonly AllowEntry[], file?: string): boolean {
+	for (const entry of allow) {
+		if (entry.rule !== undefined && entry.rule !== rule) continue;
+		if (entry.files !== undefined && (file === undefined || !entry.files.some((path) => path.endsWith("/") ? file.startsWith(path) : file === path))) continue;
+		if (entry.value !== undefined && (entry.value === value || (rule === "email" && entry.value.toLowerCase() === value.toLowerCase()))) return true;
+		if (entry.cidr !== undefined && rule === "ipv4" && inCidr(value, entry.cidr)) return true;
+		if (entry.domain !== undefined && rule === "email") {
+			const host = value.slice(value.lastIndexOf("@") + 1).toLowerCase();
+			const domain = entry.domain.toLowerCase();
+			if (host === domain || host.endsWith(`.${domain}`)) return true;
+		}
+	}
+	return false;
+}
+
+export function scanLine(text: string, rules: readonly CompiledRule[], allow: readonly AllowEntry[], file?: string): Hit[] {
+	const hits: Hit[] = [];
+	for (const rule of rules) {
+		for (const match of text.matchAll(rule.regex)) {
+			const value = match[rule.group ?? 0];
+			if (!value) continue;
+			if (rule.minEntropy !== undefined && entropy(value) < rule.minEntropy) continue;
+			if (isAllowed(rule.id, value, allow, file)) continue;
+			hits.push({ rule: rule.id, severity: rule.severity, value });
+		}
+	}
+	return hits;
+}