Exploit Agent — Context (context.py)

Sizing, compaction, attack memory, reasoning advisory, sanitization. 637 lines.

Verified symbols

Symbol	Kind	Line
_build_context_profile	def	72
_estimate_tokens	def	117
_estimate_context_tokens	def	126
_context_usage_pct	def	148
_should_compact_context	def	588
_build_compacted_messages	def	530
_build_context_summary	def	437
_parse_reasoning_block	def	171
_build_reasoning_advisory_message	def	192
_refresh_reasoning_advisory_message	def	217
_build_attack_memory_message	def	260
_refresh_attack_memory_message	def	273
_capture_attack_memory	def	287
sanitize_output	def	619
_MODEL_CONTEXT_PROFILES	dict	19
COMPACTED_CONTEXT_MARKER	const	7
ATTACK_MEMORY_MARKER	const	8
REASONING_ADVISORY_MARKER	const	17

Context profiles (context.py:19)

Alias	Window	Compact at	Keep full	Output cap
glm	976K	340K	20	8000
deepseek / deepseek_flash	1M	300K	20	8000
minimax	512K	180K	15	7000
kimi	256K	100K	5	3000
default	128K	~83K	8	4000

_config_model_alias (context.py:60) resolves models.registry alias; models.info.<alias>.context_window overrides context_window_tokens and re-derives compact_at_tokens via same ratio (context.py:96).

Estimation & compaction gate

• _estimate_tokens = max(1, len//3) – conservative for JSON.
• _estimate_context_tokens sums content + json(tool_calls) + tool_name + 4 overhead per message (context.py:126).
• _should_compact_context (context.py:588): is_attack_mode && round>0 && current_tokens >= compact_at && (round - last_compaction) >= gap. Gap = policy.settings.context_summarize_every (_context_compaction_gap at context.py:580, min 1).

_build_compacted_messages (context.py:530)

Returns [system, (memory), summary, ...recent] where:

• recent = last keep_full non-system messages.
• history = remainder + prior summaries.
• summary = _build_context_summary(...) containing TARGET STATE, SERVICE CONTEXT, PLAN STATE, PENDING STEPS, attack memory, PREVIOUS COMPACTED STATE, FAILED/BLOCKED results, OBSERVATIONS, OPERATIONAL NOTES, EVIDENCE REFERENCES, CONTINUATION RULES (context.py:437).
• Prior compaction messages are stripped and folded into previous_summary (context.py:537); attack-memory messages excluded from compaction (context.py:538) then reinserted.

Helpers: _one_line (500), _cap_text, _looks_like_failure (context.py:325), _extract_context_references (context.py:343), _summarize_tool_content via summarizer.summarize_tool_output, _format_tool_outcome (context.py:392), _operational_user_note (context.py:404), _pending_plan_lines.

Attack memory

_attack_memory_context reads policy._attack_memory.format_context(max_chars) (context.py:248). _refresh_attack_memory_message keeps at most one user message (ATTACK_MEMORY_MARKER) at index 1 after system prompt (context.py:273). _capture_attack_memory forwards tool results to store.capture_tool_result (context.py:287). Checked via _is_attack_memory_message (context.py:163).

Reasoning advisory (ULTRATHINK)

_parse_reasoning_block extracts \[REASONING\]…\[/REASONING\], one-lines to 400 chars, sanitizes (context.py:171). _build_reasoning_advisory_message fences as [PRIOR REASONING ADVISORY] advisory, capped at 3 blocks (context.py:192). _refresh_reasoning_advisory_message keeps at most one advisory, placed after attack-memory message if present (context.py:217). Checked via _is_reasoning_advisory_message (context.py:167).

Sanitization

sanitize_output(text, max_length=12000) (context.py:619): strips ANSI (_ANSI_ESCAPE_RE), deletes control chars 0-31 except 9/10/13 + 127-159, on Windows (os.name=="nt") does cp1252 round-trip to avoid charmap errors, truncates with [truncated].

Checkpointing

_checkpoint_messages(session_mgr, messages) (context.py:596) persists messages to session_mgr._state.messages (bounded to last 200 by to_json) only when persist_messages true – called after each compaction and budget-break final (loop.py:1000).

Config keys

Key	Effect
models.registry	Alias resolution
models.info.<alias>.context_window	Window override
exploit.context_summarize_every	Compaction gap
memory.attack_memory_enabled / attack_memory_max_context_chars	Attack memory
reasoning.ultrathink	Advisory enabled

Tests

File	Verified	Covers
tests/test_context_compaction.py	yes	Profiles, estimate, gate, compacted summary
tests/test_attack_memory.py	yes	Capture/format/refresh, truncation
tests/test_reasoning_loop.py	yes	_parse_reasoning_block + refresh
tests/test_ultrathink.py	yes	ULTRATHINK block sanitization