zigmini 0.8.0-beta.6 → 0.9.0-beta.1

package/docs/manual.md

@@ -57,6 +57,16 @@ Shift+Enter starts a new line. Enter pressed during Korean IME composition doesn
 
 While the agent works, the 중단 (stop) button shows. Click it to stop the running work.
 
+#### Conversation summaries
+
+Compaction summarizes older conversation content so the same session can continue. When a summary blocks your work, chat shows one start notice and one completion, cancellation or failure notice for that request. Background preparation alone does not add chat notices. Applying a prepared summary while the session is idle doesn't ask you to wait either, so it adds no chat notice. A manual summary keeps its start and terminal notices. Reconnecting replays the stored notices, not a new summary request.
+
+No new setting is required. With `compaction.model` absent or set to `"auto"`, the engine selects an eligible summary model from the current session's provider. The selected model must fit the input. Existing explicit `provider/model` settings stay in effect. An explicit model from another provider sends the conversation being summarized to that provider. The engine does not silently replace an invalid or unavailable explicit model. Existing global, trusted-project and runtime setting precedence stays in effect.
+
+If a summary fails, the engine keeps the previous working context and stops instead of applying an emergency shortened substitute. The notice tells you what to do: check the model setting, log in to the summary provider again, wait for the usage limit to recover, or check account and organization permissions. Other failures require you to resolve the cause and explicitly continue or retry. The gateway does not resend the previous input or start a new session. A cancellation is separate from a failure. A successful summary is not a guarantee that every detail survives; check critical requirements when you continue.
+
+The gateway opens main and work sessions in the engine's existing app mode, so replies are shaped for the chat screen rather than a terminal. You don't need to change any setting. App mode doesn't guarantee that every model answer follows a requested format such as valid JSON, and it doesn't change the summary recovery above.
+
 To start a new conversation, click + in the sidebar. A prompt asks for its name.
 
 #### Slash command menu
@@ -82,6 +92,42 @@ The README's Commands section says that sending `/usage` in chat makes the gatew
 
 ### 2.3 Attachments and references
 
+#### Flow and structure diagrams
+
+Web and Android chat render complete `zigmini-diagram` fenced blocks as diagrams.
+Labels remain readable on narrow screens: scroll inside the diagram to reach
+off-screen nodes. Open its source control to select and copy the original JSON.
+Referencing the message sends its original text, not an image or a local path.
+History and reconnect use the same stored text. No upload or external renderer is needed.
+
+For agents, use this complete block in the assistant's message body:
+
+````markdown
+```zigmini-diagram
+{"version":1,"title":"Request flow","nodes":[{"id":"request","label":"Request"},{"id":"gateway","label":"Gateway"},{"id":"reply","label":"Reply"}],"edges":[{"from":"request","to":"gateway"},{"from":"gateway","to":"reply"}]}
+```
+````
+
+The supported format is a small directed acyclic graph, not Mermaid or arbitrary
+SVG/HTML. Branching edges express a structure. Nodes appear top-to-bottom; nodes
+at the same depth follow their input order.
+
+- Root keys: required `version: 1`, `nodes`, `edges`; optional `title`.
+- Each node has only `id` and `label`. Use 1–16 nodes with unique IDs matching
+  `[A-Za-z][A-Za-z0-9_-]{0,31}`. Labels are nonblank plain text, at most 48 Unicode code points.
+- Each edge has only `from` and `to`, naming existing nodes. Use 0–24 edges.
+  Duplicate edges, self-links and cycles are not supported.
+- The optional title is nonblank plain text, at most 80 Unicode code points.
+  Titles and labels cannot contain control characters U+0000–U+001F or U+007F.
+- JSON is at most 16,384 UTF-16 code units. Extra keys are not supported.
+  Use unindented triple backticks and the exact language name shown above.
+
+Unfinished, invalid or unsupported blocks remain visible as source. When a streamed
+block becomes complete and valid, chat can render it. Diagram text cannot run
+scripts, load URLs or read files. An older client displays the code block instead.
+The concise per-request instruction asks for a diagram only when it helps explain
+a flow or structure; it does not require diagrams in every reply.
+
 #### Images
 
 - Click 이미지 (image) to pick images.
@@ -163,6 +209,20 @@ The profile sits at the bottom of the sidebar.
 
 In a name field, Enter saves and Esc cancels. Leaving the field also saves. Names are stored on the gateway. If that fails, only this browser shows the new name.
 
+#### Security check (보안검사)
+
+- "보안검사 켜짐/꺼짐" (security check on/off) turns the check of your messages on or off. It is on by default and the gateway keeps the choice.
+- When a message or inbox answer contains a detected value that is not allowed, the gateway holds it before sending it to the agent. The same security item appears in the inbox and chat. It shows the complete values to be remembered and their types.
+- Approving sends the original message and remembers the displayed exact values on this gateway. The same values do not prompt again. A different value still needs approval. Existing held messages do not send automatically.
+- Cancel stops only this transmission. It does not stop the existing work. If the held transmission is an inbox answer, the original question remains unanswered and its answer form stays available.
+- On web, a cancelled message can restore its text only in an empty input box of the same conversation. A newer draft is never replaced. Android does not restore a cancelled message to its input box. A transmission with an unconfirmed result is not automatically restored or sent again.
+- Controls lock while the request is processing. HTTP replies, live events and reconnects update the same item. An unconfirmed result means the client has no proof of delivery; use the status check instead of sending again.
+- Remembering happens before dispatch. If saving fails, the message is not sent. If saving succeeds but dispatch fails or cannot be confirmed, the values remain remembered and the result reports both facts.
+- The allowed-value list is private to this installation and survives gateway restarts. Web settings show the list under Security check. On Android, open the gateway settings screen that contains Manual, then open the allowed values.
+- Each entry shows its full value, type, approval time and approving client. Remove one entry or clear the list to check those values again on future transmissions. Removal does not cancel a transmission already approved or erase a sent message.
+- An older app's send-only approval still sends once without remembering values. Remembering requires the new send-and-remember choice. Unapproved original messages are not saved in ordinary question records or history; pending originals are lost on gateway restart.
+- This list affects runtime message and answer checking only. It does not change repository or release security checks.
+
 #### Update (업데이트)
 
 - The current and new versions are shown.
@@ -312,7 +372,13 @@ Tap the Zig face to open it. Slot states include running, waiting for input, wai
 ### 4.6 Notifications
 
 - Each registered gateway has its own notification connection.
-- Channels are "일정 알림" (reminders), "확인 요청" (requests) and "연결 유지" (keep connected).
+- Open web settings to choose the app notification level. In the app, short press the header status tag to open the existing settings screen. Both choices are above Manual, not in work status.
+- "확인함 알림만" (Inbox notifications only) is the default. It keeps the existing confirmation notifications.
+- "모든 답장 알림" (All reply notifications) includes confirmation notifications and each completed main/work agent reply. User messages and streaming fragments do not alert.
+- Both screens edit the same saved gateway value. The app edits only its active gateway. Changing the value does not replay old replies.
+- If saving fails, the last confirmed choice stays selected. Retry reloads the saved value. Select the desired choice after reloading.
+- Schedule reminders and explicit notifications are independent of this choice. The existing visible-web rule for confirmation notifications still applies.
+- Reply notification taps open chat on the sending gateway. Replayed delivery of the same reply does not alert again.
 - Notifications vibrate with no sound.
 - Tapping a notification switches to the gateway that sent it.
 - The keep connected notification lists each gateway's state. If it says "인증 거부, 다시 등록하세요" (auth refused), register the phone again.

package/host/omo-bridge/task-control.ts

@@ -2,6 +2,7 @@ import { readFileSync } from "node:fs";
 import { isDeepStrictEqual } from "node:util";
 import { runtimePaths } from "../../src/runtime/paths.ts";
 import { agentRules } from "../../src/agent-rules.ts";
+import { applyRequestRules, loadRequestRules, type ProviderRequestEvent } from "../../src/agent-request-rules.ts";
 
 // The pinned runtime supplies this SDK surface, just as it does for model-control.ts.
 type Entry = { id: string; type: string; customType?: string; data?: unknown; message?: { role: string; content: unknown; toolName?: string; details?: unknown; toolCallId?: string } };
@@ -18,6 +19,7 @@ interface ExtensionApi {
 	readonly events: { on(name: string, handler: (data: unknown) => void): () => void };
 	on(event: "session_start", handler: (event: unknown, ctx: Context) => void): void;
 	on(event: "before_agent_start", handler: (event: { systemPrompt: string }) => unknown, options: { previewSafe: boolean }): void;
+	on(event: "before_provider_request", handler: (event: ProviderRequestEvent) => unknown): void;
 	registerTool(tool: Tool): void;
 	appendEntry(customType: string, data: unknown): void;
 }
@@ -147,6 +149,8 @@ export default function taskControl(pi: ExtensionApi): void {
 	const rules = agentRules();
 	console.warn(rules.log);
 	const rulesText = rules.text === "" ? "" : `\n\n${rules.text}`;
+	const requestRules = loadRequestRules();
+	pi.on("before_provider_request", (event) => applyRequestRules(event, requestRules));
 
 	for (const kind of ["asked", "replied"] as const) {
 		pi.events.on(`permission_${kind}`, (data) => {

package/host/omo-check/patches/omo-5.1.35-compaction-idle.patch

@@ -0,0 +1,77 @@
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/index.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/index.js
+@@ -138,1 +138,1 @@
+-            const result = await applyGeneratedCompaction(ctx, job.snapshot, () => speculativeGeneration, compaction);
++            const result = await applyGeneratedCompaction(ctx, job.snapshot, () => speculativeGeneration, compaction, undefined, false);
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative.js
+@@ -303,1 +303,1 @@
+-export async function applyGeneratedCompaction(context, snapshot, getCurrentGeneration, compaction, signal) {
++export async function applyGeneratedCompaction(context, snapshot, getCurrentGeneration, compaction, signal, blocking = true) {
+@@ -319,3 +319,4 @@
+     return await context.applyCompaction(compaction, {
+         reason: "extension",
++        blocking,
+         ...(revisionUnchanged || !warmAnchor
+--- a/@code-yeongyu/senpi/dist/core/agent-session.js
++++ b/@code-yeongyu/senpi/dist/core/agent-session.js
+@@ -6195,4 +6195,5 @@
+             this._emit({
+                 type: "compaction_start",
+                 reason: options.reason,
++                blocking: options.blocking,
+                 requestId,
+@@ -6208,4 +6209,5 @@
+                 owner: "compaction",
+                 reason: options.reason,
++                blocking: options.blocking,
+                 requestId,
+                 willRetry: false,
+@@ -6227,4 +6229,5 @@
+             this._emit({
+                 type: "compaction_end",
+                 reason: options.reason,
++                blocking: options.blocking,
+                 result: undefined,
+@@ -6479,4 +6482,5 @@
+             this._emit({
+                 type: "compaction_end",
+                 reason: request.reason,
++                blocking: request.blocking,
+                 result: compactionResult,
+@@ -6591,4 +6595,5 @@
+         this._emit({
+             type: "compaction_end",
+             reason: request.reason,
++            blocking: request.blocking,
+             result: undefined,
+--- a/@code-yeongyu/senpi/dist/core/extensions/types.d.ts
++++ b/@code-yeongyu/senpi/dist/core/extensions/types.d.ts
+@@ -297,3 +297,4 @@
+ export interface ApplyCompactionOptions {
+     reason: CompactionReason;
++    blocking?: boolean;
+     expectedRevision?: number;
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative.d.ts
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative.d.ts
+@@ -22,3 +22,4 @@
+     applyCompaction(precomputed: CompactionResult, options: {
+         reason: "extension";
++        blocking?: boolean;
+         expectedRevision?: number;
+@@ -110,1 +111,1 @@
+-export declare function applyGeneratedCompaction(context: SpeculativeCompactionContext, snapshot: SpeculativeCompactionSnapshot | undefined, getCurrentGeneration: () => number, compaction: CompactionResult | undefined, signal?: AbortSignal): Promise<SpeculativeCompactionResult>;
++export declare function applyGeneratedCompaction(context: SpeculativeCompactionContext, snapshot: SpeculativeCompactionSnapshot | undefined, getCurrentGeneration: () => number, compaction: CompactionResult | undefined, signal?: AbortSignal, blocking?: boolean): Promise<SpeculativeCompactionResult>;
+--- a/@code-yeongyu/senpi/dist/core/agent-session.d.ts
++++ b/@code-yeongyu/senpi/dist/core/agent-session.d.ts
+@@ -140,3 +140,4 @@
+     type: "compaction_start";
+     reason: CompactionReason;
++    blocking?: boolean;
+     requestId?: string;
+@@ -229,4 +230,5 @@
+     type: "compaction_end";
+     failure?: CompactionFailure;
+     reason: CompactionReason;
++    blocking?: boolean;
+     result: CompactionResult | undefined;

package/host/omo-check/patches/omo-5.1.35-compaction-intent.patch

@@ -0,0 +1,212 @@
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/speculative.js
+@@ -13,1 +13,1 @@
+-import { extractTaskIntent, resolveInheritedTaskIntent } from "./task-intent.js";
++import { extractTaskIntent, resolveInheritedTaskIntent, taskIntentSummary, taskIntentMetadata } from "./task-intent.js";
+@@ -268,1 +268,5 @@
+-        const summary = parsedSummary.summaryText;
++        const inheritedIntent = resolveInheritedTaskIntent(snapshot.branchEntries ?? []);
++        if (inheritedIntent && parsedSummary.taskIntent && parsedSummary.taskIntent !== inheritedIntent)
++            throw new SummaryGenerationError("incomplete", "Compaction changed protected task intent");
++        const taskIntent = inheritedIntent ?? parsedSummary.taskIntent;
++        const summary = taskIntentSummary(parsedSummary.summaryText, taskIntent);
+@@ -273,1 +277,0 @@
+-        const taskIntent = parsedSummary.taskIntent ?? resolveInheritedTaskIntent(snapshot.branchEntries ?? []);
+@@ -275,1 +278,1 @@
+-            summary: parsedSummary.summaryText,
++            summary,
+@@ -291,1 +294,1 @@
+-                    summary: parsedSummary.summaryText,
++                    summary,
+@@ -295,1 +298,1 @@
+-                ...(taskIntent ? { taskIntent } : {}),
++                ...(taskIntent ? { taskIntent: taskIntentMetadata(taskIntent) } : {}),
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote.js
+@@ -4,0 +4,3 @@
++import { collectIntentProtection, protectedRemoteInput, taskIntentSummary, retainedUserText } from "./task-intent.js";
++import { estimateTokens } from "../../../compaction/index.js";
++import { resolveEffectiveReserveTokens } from "./policy.js";
+@@ -23,1 +26,1 @@
+-    const input = options.messages
++    const converted = options.messages
+@@ -26,0 +29,1 @@
++    const input = protectedRemoteInput(converted, collectIntentProtection(options.branchEntries));
+@@ -55,0 +59,1 @@
++        ...(typeof options.value.model === "string" ? { observedModel: options.value.model } : {}),
+@@ -71,0 +76,1 @@
++        ...(options.response.observedModel ? { observedProvider: options.model.provider, observedModel: options.response.observedModel } : {}),
+@@ -140,0 +146,1 @@
++        ...(options.response.responseModel ? { observedProvider: options.response.provider, observedModel: options.response.responseModel } : {}),
+@@ -177,0 +184,1 @@
++        streamKind: "auxiliary",
+@@ -334,0 +342,22 @@
++    const protection = collectIntentProtection(event.branchEntries);
++    const protectedInput = protectedRemoteInput([], protection);
++    const model = ctx.model;
++    const settings = ctx.getCompactionSettings?.() ?? event.preparation.settings;
++    const protectionTokens = estimateTokens({ role: "user", content: JSON.stringify(protectedInput) });
++    if (model && protectionTokens > model.contextWindow - resolveEffectiveReserveTokens(model.contextWindow, settings))
++        return { status: "ineligible" }; // Before dispatch only: same-model text compaction is permitted.
++    const attempt = await runOpenAiRemoteCompactionAttempt(ctx, event, emit, dependencies);
++    if (attempt.status !== "accepted") return attempt;
++    const result = attempt.compaction;
++    const checkpointTexts = new Set(convertPendingMessages(buildSessionContext(event.branchEntries).messages.filter((message) => message.role === "compactionSummary"), model).map(retainedUserText));
++    // The accepted native envelope already covers the request checkpoint. Keep its original intent outside it, not a second raw copy of the old summary.
++    const retained = result.details.replacementInput.filter((item) => !checkpointTexts.has(retainedUserText(item)));
++    const replacementInput = protectedRemoteInput(retained, protection);
++    return { status: "accepted", compaction: { ...result,
++        summary: taskIntentSummary(result.summary, protection.taskIntent) + (protection.sources.length ? `\n<source-user-text>\n${JSON.stringify(protection.sources)}\n</source-user-text>` : ""),
++        details: { ...result.details, intentProtection: protection, replacementInput, retainedInputItemCount: replacementInput.length,
++            selectionMode: settings.model === undefined || settings.model === "auto" ? "auto" : "explicit",
++            requestedProvider: model.provider, requestedModel: model.id },
++    } };
++}
++async function runOpenAiRemoteCompactionAttempt(ctx, event, emit, dependencies = {}) {
+@@ -410,0 +440,4 @@
++    const requestTokens = estimateTokens({ role: "user", content: JSON.stringify(request.body) });
++    const requestSettings = ctx.getCompactionSettings?.() ?? event.preparation.settings;
++    if (requestTokens > requestModel.contextWindow - resolveEffectiveReserveTokens(requestModel.contextWindow, requestSettings))
++        return undefined;
+@@ -765,1 +799,1 @@
+-        ...remote.details.replacementInput,
++        ...protectedRemoteInput(remote.details.replacementInput, remote.details.intentProtection),
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote-responses-v2.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote-responses-v2.js
+@@ -109,0 +109,1 @@
++            ...(assistant.responseModel ? { observedProvider: assistant.provider, observedModel: assistant.responseModel } : {}),
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/rejected-recovery.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/rejected-recovery.js
+@@ -6,0 +6,2 @@
++import { getOpenAiRemoteCompactionDetails, convertPendingMessages } from "./openai-remote-convert.js";
++import { protectedRemoteInput } from "./task-intent.js";
+@@ -33,1 +35,6 @@
+-    const tokens = filterContextExcludedMessages(messages).reduce((total, message) => total + estimateTokens(message), 0);
++    const remote = getOpenAiRemoteCompactionDetails(compactionResult.details);
++    const budgetMessages = remote ? [{ role: "user", content: JSON.stringify([
++        ...protectedRemoteInput(remote.replacementInput, remote.intentProtection),
++        ...convertPendingMessages(pendingMessages, model),
++    ]) }] : messages;
++    const tokens = filterContextExcludedMessages(budgetMessages).reduce((total, message) => total + estimateTokens(message), 0);
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote-convert.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote-convert.js
+@@ -1,0 +1,1 @@
++import { protectedRemoteInput } from "./task-intent.js";
+@@ -2,1 +3,1 @@
+-import { sessionEntryToContextMessages } from "../../../session-manager.js";
++import { sessionEntryToContextMessages, getSessionContextEntryId, SESSION_CONTEXT_ENTRY_ID } from "../../../session-manager.js";
+@@ -142,2 +143,6 @@
+-        case "user":
+-            return [{ role: "user", content: convertUserContent(message.content) }];
++        case "user": {
++            const item = { role: "user", content: convertUserContent(message.content) };
++            const sourceId = getSessionContextEntryId(message) ?? message[SESSION_CONTEXT_ENTRY_ID];
++            if (sourceId) Object.defineProperty(item, "__senpiCompactionSourceId", { value: sourceId });
++            return [item];
++        }
+@@ -188,1 +193,1 @@
+-                items.push(...details.replacementInput);
++                items.push(...protectedRemoteInput(details.replacementInput, details.intentProtection));
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/prompts.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/prompts.js
+@@ -9,2 +9,2 @@
+-Immutable provenance of the original task. Do not rewrite it. Newer explicit user steering overrides it.
+-</task-intent>`;
++</task-intent>
++Immutable provenance of the original task. Do not rewrite it. Newer explicit user steering overrides it.`;
+@@ -13,2 +13,2 @@
+-Immutable provenance of the original task. Do not rewrite it. Newer explicit user steering overrides it.
+-</task-intent>`;
++</task-intent>
++Immutable provenance of the original task. Do not rewrite it. Newer explicit user steering overrides it.`;
+@@ -22,1 +22,1 @@
+-R3. Where a previous summary is supplied, treat its User Requests, Final Goal, and Constraints fields as IMMUTABLE. Append, never rewrite, those three sections.
++R3. Preserve original requests and durable constraints as quoted provenance. Latest explicit user steering governs the current goal and next action. An answer-local restriction applies only to that answer.
+@@ -86,1 +86,1 @@
+-R3 enforcement: R3. Where a previous summary is supplied, treat its User Requests, Final Goal, and Constraints fields as IMMUTABLE. Append, never rewrite, those three sections.
++Preserve original requests and durable constraints as quoted provenance. Latest explicit user steering governs the current goal and next action. Keep answer-local restrictions local to their answer.
+@@ -179,1 +179,1 @@
+-Silently determine the current task intent and the minimum context needed for the next turn.
++Preserve the original request and durable constraints from the entire history together with the split turn. Latest explicit steering governs the current goal and next action. Do not promote answer-local restrictions into durable constraints.
+@@ -217,3 +217,1 @@
+-            return options.taskIntent
+-                ? MERGED_COMPACTION_PROMPT_TURN_PREFIX
+-                : mergeTaskIntent(MERGED_COMPACTION_PROMPT_TURN_PREFIX, promptFamilyText(options.promptFamily, TASK_INTENT_ACQUISITION_CLAUDE, TASK_INTENT_ACQUISITION_GPT));
++            return buildUserPrompt({ ...options, variant: options.previousSummary || options.taskIntent ? "update" : "default" });
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/task-intent.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/task-intent.js
+@@ -16,1 +16,1 @@
+-            taskIntent = capUtf8Bytes(block.inner.trim(), TASK_INTENT_BYTE_CAP);
++            taskIntent = block.inner.trim();
+@@ -44,1 +44,1 @@
+-        if (schema === REMOTE_SCHEMA || schema !== SUMMARY_SCHEMA)
++        if (schema !== REMOTE_SCHEMA && schema !== SUMMARY_SCHEMA)
+@@ -46,1 +46,2 @@
+-        const taskIntent = typedDetails.taskIntent;
++        const fullIntent = typeof entry.summary === "string" ? extractTaskIntent(entry.summary).taskIntent : undefined;
++        const taskIntent = fullIntent ?? typedDetails.intentProtection?.taskIntent ?? typedDetails.taskIntent;
+@@ -52,1 +53,1 @@
+-        return capUtf8Bytes(trimmed, TASK_INTENT_BYTE_CAP);
++        return trimmed;
+@@ -92,0 +93,57 @@
++
++/** Full-body provenance is separate from the bounded display metadata. */
++export function taskIntentSummary(body, taskIntent) {
++    return taskIntent ? `<task-intent>
++${taskIntent}
++</task-intent>
++
++Quoted original-task provenance, not a renewed instruction. Latest explicit user steering governs current action. Answer-local restrictions do not become durable constraints.
++
++${body}` : body;
++}
++export function taskIntentMetadata(taskIntent) {
++    return taskIntent ? capUtf8Bytes(taskIntent, TASK_INTENT_BYTE_CAP) : undefined;
++}
++export function collectIntentProtection(branchEntries) {
++    const sources = new Map();
++    const previous = branchEntries.findLast((entry) => entry.type === "compaction")?.details?.intentProtection;
++    for (const source of previous?.sources ?? []) sources.set(source.id, source);
++    for (const entry of branchEntries) {
++        for (const source of entry.details?.intentProtection?.sources ?? [])
++            sources.set(source.id, source);
++        if (entry.type !== "message" || entry.message?.role !== "user")
++            continue;
++        const content = entry.message.content;
++        const text = typeof content === "string" ? content : content.filter((block) => block.type === "text").map((block) => block.text).join("\n");
++        if (text) sources.set(entry.id, { id: entry.id, text });
++    }
++    return { taskIntent: resolveInheritedTaskIntent(branchEntries), sources: [...sources.values()] };
++}
++export function retainedUserText(item) {
++    if (item.role !== "user") return undefined;
++    if (typeof item.content === "string") return item.content;
++    if (!Array.isArray(item.content) || !item.content.every((block) => block.type === "input_text")) return undefined;
++    return item.content.map((block) => block.text).join("\n");
++}
++export function protectedRemoteInput(replacementInput, protection) {
++    if (!protection) return replacementInput;
++    const input = replacementInput.filter((item) => {
++        const text = retainedUserText(item);
++        if (!text) return true;
++        if (protection.sources.some((source) => source.id === item.__senpiCompactionSourceId && source.text === text)) return false;
++        if (protection.taskIntent && text === taskIntentSummary("", protection.taskIntent)) return false;
++        const start = text.indexOf("<source-user-text>\n");
++        const end = text.indexOf("\n</source-user-text>", start);
++        if (start < 0 || end < 0) return true;
++        let records;
++        try { records = JSON.parse(text.slice(start + 19, end)); } catch { return true; }
++        if (!Array.isArray(records) || !records.every((source) => protection.sources.some((known) => known.id === source.id && known.text === source.text))) return true;
++        const canonical = taskIntentSummary(`Quoted user source records; newer explicit steering takes precedence.\n<source-user-text>\n${JSON.stringify(records)}\n</source-user-text>`, protection.taskIntent);
++        return text !== canonical;
++    });
++    const remaining = protection.sources;
++    const text = taskIntentSummary(remaining.length ? `Quoted user source records; newer explicit steering takes precedence.\n<source-user-text>
++${JSON.stringify(remaining)}
++</source-user-text>` : "", protection.taskIntent);
++    return text ? [...input, { type: "message", role: "user", content: [{ type: "input_text", text }] }] : input;
++}
+--- a/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote-schema.js
++++ b/@code-yeongyu/senpi/dist/core/extensions/builtin/compaction/openai-remote-schema.js
+@@ -52,0 +52,1 @@
++        ...(isRecord(value.intentProtection) ? { intentProtection: value.intentProtection } : {}),