fix(ai): address PR #19 review — git restore --worktree gate + compaction head+tail cap

- commandSafety: `git restore --staged --worktree` (and -W) writes the working
  tree, so flag it despite the --staged exemption — a security gate must not
  false-negative here. Adds test cases; the staged-only unstage stays safe.
- compaction: cap the summarizer input by keeping BOTH ends (the opening goal +
  the most recent pre-cut decisions) instead of a plain head slice that dropped
  the latest state closest to the kept tail.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ndemianc

extensions/levelcode-ai/commandSafety.js

@@ -42,7 +42,9 @@ const RULES = [
 	['discard-changes', /\bgit\s+reset\s+--hard\b/i],          // discards the working tree
 	// `git checkout` that targets a path/HEAD/force (not a branch switch, which is safe):
 	['discard-changes', /\bgit\s+checkout\b[^&|;\n]*(\s--(\s|$)|\s\.(\s|$)|\bHEAD\b|--force\b|\s-f\b)/i],
-	// `git restore <path>` overwrites the working tree; `git restore --staged` only unstages (safe) → excluded:
+	// `git restore <path>` overwrites the working tree; `git restore --staged` only unstages (safe).
+	// But `--staged --worktree` (or `-W`) DOES write the working tree, so flag it before the exemption below.
+	['discard-changes', /\bgit\s+restore\b[^\n&|;]*(--worktree\b|\s-W\b)/i],
 	['discard-changes', /\bgit\s+restore\b(?![^\n&|;]*--staged)/i],
 
 	// --- irreversible / high blast radius ---

extensions/levelcode-ai/extension.js

@@ -858,7 +858,15 @@ async function compactAgentMemory() {
 	const cut = findCompactionCut(msgs, KEEP_RECENT);
 	if (cut < 0) { return { ok: false, reason: 'noboundary' }; }
 
-	const flat = msgs.slice(0, cut).map(serializeMsgForSummary).join('\n\n').slice(0, 60000);
+	// Cap the summarizer input, but keep BOTH ends when it's too long: the opening (the original goal +
+	// early constraints, first in the transcript) AND the most recent pre-cut decisions (closest to the
+	// kept tail). Those are the two highest-value regions — a plain head slice would drop the recent
+	// decisions. Only the lower-value middle is dropped, with a marker.
+	const flatFull = msgs.slice(0, cut).map(serializeMsgForSummary).join('\n\n');
+	const CAP = 60000, HEAD = 20000;
+	const flat = flatFull.length <= CAP
+		? flatFull
+		: flatFull.slice(0, HEAD) + '\n\n…[older turns omitted for length]…\n\n' + flatFull.slice(flatFull.length - (CAP - HEAD));
 	const anchor = msgs[cut];   // identity of the boundary we'll cut at — see the recheck after the await
 	const req = await prepProviderRequest({ prompt: true });
 	if (!req.ok) { return { ok: false, reason: 'provider' }; }

extensions/levelcode-ai/test/commandSafety.test.js

@@ -48,6 +48,9 @@ const DANGEROUS = [
 	'git checkout -f main',                     // -f discards local changes on switch
 	'git restore src/',                         // overwrites the working tree
 	'git restore .',
+	'git restore --staged --worktree .',        // --worktree writes the working tree despite --staged
+	'git restore --staged -W src/app.ts',       // -W is the short form of --worktree
+	'git restore -W config.json',
 	'git filter-branch --tree-filter "rm -f pw" HEAD',
 	'git filter-repo --path secrets --invert-paths',
 	'git reflog expire --expire=now --all',