mirror of
https://github.com/Twigpine/zero.git
synced 2026-11-11 18:00:54 -10:00
Kevin Codex
95ccd5bc32
* feat(tools): universal token-based output ceiling with spill-to-disk
Cap every tool result at the registry boundary (16k estimated tokens,
ZERO_TOOL_OUTPUT_CEILING_TOKENS-tunable, 0 disables) unless the tool
manages its own deliberate budget. Head+tail truncation, full output
spilled to the existing redacted spill dir and re-readable via
grep/read_file, so nothing is lost — only deferred.
This closes the three unbounded paths a single call could flood the
context window through (and then re-bill every following turn):
- web_fetch: up to 256KiB default / 2MiB max of non-HTML body
- skill: full SKILL.md returned uncapped
- MCP-served tools: no budget at all
Self-budgeting tools opt out via an unexported marker interface (an MCP
server can never exempt itself): bash, exec_command (model-raisable),
read_file, read_minified_file, grep, glob, list_directory. Browser
snapshots deliberately stay under the net.
bash itself is tightened to match the unified token model: emit budget
96KiB -> 32KiB per stream (~24k -> ~8k tokens worst case per stream),
while capture retention stays at 96KiB head+tail so the new spill file
covers 6x more of the output than the transcript shows.
* perf(agent): collect post-edit LSP diagnostics off the tool-call path
Inline post-edit diagnostics blocked every edit_file/write_file result on
the language server: a >=300ms quiet-period debounce that reset on each
publish, seconds on the first edit per language, capped at 10s — the
largest recurring latency tax in an edit-heavy session.
Diagnostics are now collected in the background: a file is enqueued the
moment a mutating tool finishes, a single worker checks it while the rest
of the batch executes, and the loop drains completed results just before
building the NEXT provider request, appending errors as a user nudge.
The model always issues another request after an edit turn (to read its
tool results), so it still sees introduced errors at the same decision
point — no tool call ever stalls on the language server.
A file re-edited before its check runs is checked once in its final
state (the checker re-reads the file); re-edited after, it is re-queued
and the newer result wins. A drain that finds the worker still busy
gives up after 3s and delivers on a later turn — results stay accurate
because any further edit re-enqueues the file.
The tools-side inline mechanism (tools.RunOptions.Diagnostics) is kept
for direct API callers; the loop just no longer wires it.
* fix: address review — max-turns diagnostics drain, capture-gap marker, test hardening
- Drain background diagnostics before the max-turns final-answer request
so an error introduced by the LAST turn's edit is reported in the
summary instead of silently dropped (+ regression test).
- spillBashStreams marks the head/tail junction with a capture-gap
marker when boundedBuffer dropped the middle of a stream, so a spilled
log never reads as contiguous when it is not; junction position is
asserted in the test.
- Tests override TMP/TEMP alongside TMPDIR (os.TempDir reads TMP/TEMP on
Windows) via a shared setTestTempDir helper.
- TestBudgetBashCaptureReportsTrueTotal now asserts spill_path meta and
spill file content; exemption-list test gains read_minified_file.
* fix(test): use a real workspace root in async diagnostics tests
filepath.IsAbs("/ws") is false on Windows (no drive letter), so the
collector test's workspace-absolute assertion failed on the windows
smoke job. Root the fake workspace at t.TempDir() — absolute on every
platform — and assert against it.
* fix: pattern-scrub spill files and gate finalization on pending diagnostics
Review follow-ups (Vasanthdev2004):
- Spill files now pass the pattern-based secret scanner (AWS keys,
GitHub/Slack/OpenAI tokens, PEM blocks, JWTs) in addition to the
configured-key scrub. A bash spill runs before formatBashOutput's
scan, so without this a spilled file held in cleartext exactly the
credentials the transcript redacts. Applied centrally in
spillTruncatedOutput, covering bash, exec_command, and ceiling spills.
- Finalization diagnostics gate: a no-tool-call final answer now drains
pending post-edit diagnostics with the full inline-era budget (10s,
vs the 3s per-turn wait) before the run is accepted; introduced
errors append the nudge and give the model one more turn instead of
being silently dropped when no later turn exists. The max-turns
summary path uses the same finalization budget. Free for runs that
never edited — an idle collector returns immediately.
82 lines
3.3 KiB
Go
82 lines
3.3 KiB
Go
package tools
|
|
|
|
import (
|
|
"os"
|
|
"strconv"
|
|
"strings"
|
|
)
|
|
|
|
// Universal output ceiling. Every tool result leaving the registry boundary is
|
|
// capped at a single token-denominated budget unless the tool manages its own
|
|
// deliberate budget (selfBudgeting below). This is the safety net for tools
|
|
// with no cap of their own — web_fetch bodies, skill files, MCP server tools,
|
|
// browser snapshots, anything added later — so no single call can flood the
|
|
// context window with output that is then re-billed on every following turn.
|
|
// Truncation keeps head+tail and spills the full text to disk (re-readable via
|
|
// grep/read_file), so nothing is lost, only deferred.
|
|
|
|
// defaultOutputCeilingTokens is the per-call ceiling in estimated tokens
|
|
// (bytes/4). 16k tokens = 64 KiB — deliberately equal to the search-tool
|
|
// budget: generous enough for a large fetched document, small enough that one
|
|
// call cannot eat a third of a small context window.
|
|
const defaultOutputCeilingTokens = 16_000
|
|
|
|
// outputCeilingEnv overrides the ceiling (in tokens). Zero or negative
|
|
// disables the ceiling entirely; unset or unparsable keeps the default.
|
|
const outputCeilingEnv = "ZERO_TOOL_OUTPUT_CEILING_TOKENS"
|
|
|
|
// selfBudgeting marks a tool that enforces its own deliberate output budget —
|
|
// possibly model-raisable (exec_command) — which the registry ceiling must not
|
|
// second-guess. The method is unexported on purpose: only tools in this
|
|
// package can opt out, so an MCP-served tool can never exempt itself.
|
|
type selfBudgeting interface{ managesOutputBudget() }
|
|
|
|
// The exemption list, kept in one place. Each of these applies its own budget
|
|
// before returning: bash (bashOutputBudgetBytes per stream + spill),
|
|
// exec_command (model-raisable token budget + spill), read tools (128 KiB),
|
|
// search tools (64 KiB).
|
|
func (bashTool) managesOutputBudget() {}
|
|
func (execCommandTool) managesOutputBudget() {}
|
|
func (readFileTool) managesOutputBudget() {}
|
|
func (readMinifiedFileTool) managesOutputBudget() {}
|
|
func (grepTool) managesOutputBudget() {}
|
|
func (globTool) managesOutputBudget() {}
|
|
func (listDirectoryTool) managesOutputBudget() {}
|
|
|
|
func resolveOutputCeilingTokens() int {
|
|
raw := strings.TrimSpace(os.Getenv(outputCeilingEnv))
|
|
if raw == "" {
|
|
return defaultOutputCeilingTokens
|
|
}
|
|
parsed, err := strconv.Atoi(raw)
|
|
if err != nil {
|
|
return defaultOutputCeilingTokens
|
|
}
|
|
return parsed
|
|
}
|
|
|
|
// enforceOutputCeiling truncates an over-ceiling result to head+tail within
|
|
// the token budget, spilling the full (already redaction-scrubbed) output to
|
|
// disk with a recovery hint. Runs after scrubResultSecrets so the transcript
|
|
// and the spill file agree on what was hidden.
|
|
func enforceOutputCeiling(toolName string, result Result) Result {
|
|
ceiling := resolveOutputCeilingTokens()
|
|
if ceiling <= 0 {
|
|
return result
|
|
}
|
|
if len(result.Output) <= ceiling*4 {
|
|
return result
|
|
}
|
|
rawBytes := len(result.Output)
|
|
truncated, _ := truncateExecOutputSpill(result.Output, ceiling, toolName)
|
|
result.Output = truncated
|
|
result.Truncated = true
|
|
if result.Meta == nil {
|
|
result.Meta = map[string]string{}
|
|
}
|
|
result.Meta["raw_bytes"] = strconv.Itoa(rawBytes)
|
|
result.Meta["emitted_bytes"] = strconv.Itoa(len(result.Output))
|
|
result.Meta["estimated_tokens"] = strconv.Itoa(estimatedTokensFromBytes(len(result.Output)))
|
|
return result
|
|
}
|