@aitne/daemon 0.1.10 → 0.1.11

package/dist/core/agents/recurrence-convert.js

@@ -34,7 +34,7 @@
  * is the monthly `onMissingDay` policy, which cron cannot carry — it is dropped
  * on conversion (a `daysOfMonth` cron uses node-cron's own missing-day
  * behaviour). Sub-hourly intervals (every N minutes) are NOT representable —
- * only the built-in hourly-check supports those, via config.
+ * only the built-in activity-scan supports those, via config.
  */
 /** Zero-pad a single clock field to two digits. */
 function pad2(value) {

package/dist/core/agents/recurring-schedule-adapter.js

@@ -130,6 +130,11 @@ export function createRecurringSchedulePort(db, fallbackTimezone) {
                 ...(input.model !== null ? { model: input.model } : {}),
                 ...(input.tier !== null ? { tier: input.tier } : {}),
                 ...(input.backendId !== null ? { backendId: input.backendId } : {}),
+                // Quiet-hours opt-in (and any future row-local flags) — spread into
+                // every materialised agent_schedule row by generateNextScheduleRow.
+                ...(input.taskContext !== undefined
+                    ? { taskContext: input.taskContext }
+                    : {}),
             });
             return dto.id;
         },
@@ -148,6 +153,9 @@ export function createRecurringSchedulePort(db, fallbackTimezone) {
                 ...(patch.recurrence !== undefined
                     ? { recurrenceRule: specToRecurrenceRule(patch.recurrence) }
                     : {}),
+                ...(patch.taskContext !== undefined
+                    ? { taskContext: patch.taskContext }
+                    : {}),
             }, 
             // Agent-driven edits tag a superseded pending row so the dispatcher /
             // dashboard can attribute the skip to a definition change (§11.3.2).

package/dist/core/alerts.js

@@ -31,9 +31,9 @@ function detectContextFilesMissing(inputs) {
             severity: "error",
             title: `${sorted.length} context file${sorted.length === 1 ? "" : "s"} missing`,
             description: `Missing: ${sorted.slice(0, 3).join(", ")}${sorted.length > 3 ? `, and ${sorted.length - 3} more` : ""}. The agent cannot read or write these until they are recreated.`,
-            // Recovery: "Reinstall context" on /settings/advanced (tarball
+            // Recovery: "Reinstall context" on /settings/danger-zone (tarball
             // backup + re-seed from templates on next restart).
-            href: "/settings/advanced",
+            href: "/settings/danger-zone",
             source: "system",
             dismissable: false,
             detectedAt: iso(inputs.now),
@@ -89,8 +89,8 @@ function detectTemplateUpgrades(inputs) {
             severity: "warning",
             title: `${count} template upgrade${count === 1 ? "" : "s"} pending`,
             description: "Newer template versions ship with this release. Review and merge to pick up format changes.",
-            // Acceptance path: "Reinstall context" on /settings/advanced.
-            href: "/settings/advanced",
+            // Acceptance path: "Reinstall context" on /settings/danger-zone.
+            href: "/settings/danger-zone",
             source: "config",
             dismissable: true,
             detectedAt: iso(inputs.now),
@@ -172,7 +172,7 @@ function detectAuthHealth(inputs) {
                 severity: "error",
                 title: `${b.id} CLI not found on PATH`,
                 description: "Install the CLI or disable this backend so it doesn't get scheduled.",
-                href: "/settings/backends",
+                href: "/settings/models",
                 source: "auth",
                 dismissable: false,
                 detectedAt: iso(inputs.now),
@@ -192,7 +192,7 @@ function detectAuthHealth(inputs) {
             description: b.lastError
                 ? `Last error: ${b.lastError}.`
                 : "Re-authenticate to resume sessions on this backend.",
-            href: "/settings/backends",
+            href: "/settings/models",
             source: "auth",
             dismissable: false,
             detectedAt: iso(inputs.now),

package/dist/core/backends/auth-health-monitor.d.ts

@@ -88,7 +88,7 @@ export interface AuthHealthMonitorOptions {
     now?: () => Date;
     /**
      * Injected morning-routine gate — returning `true` causes `checkAll()`
-     * to short-circuit without probing. Mirrors the existing hourly-check
+     * to short-circuit without probing. Mirrors the existing activity-scan
      * gate (§3.2 of the design doc) so probe DMs never collide with the
      * morning routine. In production, index.ts wires this to
      * `dispatcher.isMorningRoutineActive()`. Tests may pass a fake.
@@ -219,7 +219,7 @@ export declare class AuthHealthMonitor {
      * overlapping cron ticks (e.g. a slow probe still running when the
      * next hour fires) serialize without queueing stacks of probes. The
      * field is set atomically before any `await` to avoid the
-     * microtask-scheduling race that bit `Dispatcher.hourlyCheckInProgress`
+     * microtask-scheduling race that bit `Dispatcher.activityScanInProgress`
      * pre-C1 fix (see `dispatcher.ts`).
      */
     private checkAllInFlight;

package/dist/core/backends/auth-health-monitor.js

@@ -332,7 +332,7 @@ export class AuthHealthMonitor {
      * overlapping cron ticks (e.g. a slow probe still running when the
      * next hour fires) serialize without queueing stacks of probes. The
      * field is set atomically before any `await` to avoid the
-     * microtask-scheduling race that bit `Dispatcher.hourlyCheckInProgress`
+     * microtask-scheduling race that bit `Dispatcher.activityScanInProgress`
      * pre-C1 fix (see `dispatcher.ts`).
      */
     checkAllInFlight = null;

package/dist/core/backends/backend-router.d.ts

@@ -43,7 +43,7 @@ export interface RouterExecuteParams {
      * Concretely: if `requestedTier` is passed and the pinned model's registry
      * tier does NOT match, `resolveBinding` will swap in a canonical model for
      * the requested tier on the same backend (e.g. Pro preset pins
-     * `routine.hourly_check` to Sonnet; `requestedTier: "heavy"` swaps to
+     * `routine.activity_scan` to Sonnet; `requestedTier: "heavy"` swaps to
      * `claude-opus-4-8`). This is the ONLY path through which the three
      * explicit-Opus escape hatches (dashboard chat picker, agent_schedule.model,
      * `/api/agent/run-now {requestedModel}`) can reach Opus on Pro plan.
@@ -171,6 +171,7 @@ export declare class BackendRouter implements IAgentRouter {
     private readonly cores;
     private readonly hasProcessConfigTable;
     private readonly hasBackendDefaultsTable;
+    private readonly hasAgentsTable;
     private readonly notificationDedup;
     constructor(db: Database.Database, config: AgentConfig, cores: IAgentCore[], notifier?: BackendRouterNotifier | undefined, authTelemetry?: AuthTelemetry | undefined, prepareSessionDir?: PrepareSessionDirFn | undefined);
     execute(params: RouterExecuteParams, streamCallbacks?: StreamCallbacks): Promise<AgentResult>;
@@ -197,12 +198,37 @@ export declare class BackendRouter implements IAgentRouter {
      * added once instead of in two diverging code paths.
      */
     private executeFallbackCore;
+    /**
+     * Best-effort `agent_actions` record of the main attempt's billed
+     * spend on paths where the dispatcher's `BackendRouterHandledError`
+     * unwrap will never see `mainFailure` (fallback success, raw fallback
+     * rethrow). No-op when the failure carries no spend.
+     * PREPASS_COST_REDUCTION_PLAN.md N1.
+     */
+    private recordMainFailureSpend;
     resolveBinding(event: Event, options?: {
         processKey?: ProcessKey;
         requestedTier?: ProcessModelTier;
         requestedBackendId?: BackendId;
         requestedModelId?: string;
     }): ResolvedBackendRoute;
+    /**
+     * Read the firing Agent's routing override. `event.data.agentId` is
+     * stamped by `Dispatcher.beginAgentExecution` for every firing that
+     * resolves to an Agent (and propagates to morning Stage A/B via the
+     * parent-data spread); reactive DMs and pre-pass fan-out sub-events carry
+     * no stamp and resolve to `null` here. User Agents are excluded — their
+     * tier / backend / model already arrive as explicit event hints from the
+     * materialised schedule row.
+     */
+    private loadAgentRouteOverride;
+    /** True only when an explicit `backends` row says `enabled = 0`. A missing
+     *  row or table stays permissive — matches the resolver's existing trust
+     *  posture for `process_backend_config` backends. */
+    private isBackendDisabled;
+    /** Apply the Agent's per-execution limit overrides onto a resolved route. */
+    private applyAgentLimitOverrides;
+    private resolveBindingCore;
     private resolveConfiguredBinding;
     /**
      * Returns a modified binding whose `modelId` has been swapped to a canonical

package/dist/core/backends/backend-router.js

@@ -4,6 +4,8 @@ import { createLogger } from "../../logging.js";
 import { BackendDecisiveFailure, BackendQuotaError, } from "../agent-core.js";
 import { DEFAULT_CLAUDE_HIGH_MODEL, DEFAULT_CLAUDE_LITE_MODEL, DEFAULT_CLAUDE_MEDIUM_MODEL, findRegisteredModel, getModelsForBackend, } from "./model-registry.js";
 import { readCachedAuthStatus, recordReactiveAuthFailure, recordReactiveAuthSuccess, } from "./auth-health-monitor.js";
+import { extractFailureSpendInfo, recordFailureSpendRow, } from "./failure-spend.js";
+import { extractAgentRouteOverride, } from "../agents/agent-route-override.js";
 const logger = createLogger("backend-router");
 /**
  * Per-process maxTurns caps, applied when no DB-level process_backend_config
@@ -12,7 +14,7 @@ const logger = createLogger("backend-router");
  */
 const PROCESS_MAX_TURNS = {
     "routine.morning_routine": 50, // avg 17.7, max observed 35 — 300 was 8.5x max
-    "routine.hourly_check": 30, // P90=25, pad for complex observation sets
+    "routine.activity_scan": 30, // P90=25, pad for complex observation sets
     "routine.roadmap_refresh": 25, // single observed run was 13 turns
     "message.dm": 35, // most <15, allow long conversations
     // Setup is high-tier (Opus / gpt-5.4 / Pro — Codex collapses high to
@@ -63,6 +65,7 @@ export class BackendRouter {
     cores;
     hasProcessConfigTable;
     hasBackendDefaultsTable;
+    hasAgentsTable;
     notificationDedup = new Map();
     constructor(db, config, cores, notifier, authTelemetry, prepareSessionDir) {
         this.db = db;
@@ -73,6 +76,7 @@ export class BackendRouter {
         this.cores = Object.fromEntries(cores.map((core) => [core.backendId, core]));
         this.hasProcessConfigTable = this.hasTable("process_backend_config");
         this.hasBackendDefaultsTable = this.hasTable("backend_global_defaults");
+        this.hasAgentsTable = this.hasTable("agents");
     }
     async execute(params, streamCallbacks) {
         const binding = params.preResolvedBinding ?? this.resolveBinding(params.event, {
@@ -332,6 +336,14 @@ export class BackendRouter {
                 ...(params.skillsReplace ? { skillsReplace: true } : {}),
             }, streamCallbacks);
             recordReactiveAuthSuccess(this.db, fallback.backendId, this.authTelemetry);
+            // PREPASS_COST_REDUCTION_PLAN.md N1 — the main attempt may have
+            // billed before failing over (e.g. a Claude max_budget_usd abort
+            // with a partial-usage snapshot). On fallback SUCCESS the
+            // dispatcher's error path never runs, so this is the only place
+            // the main attempt's spend can land in agent_actions; without it
+            // the run shows only the fallback's success row and the main
+            // attempt's cost is invisible.
+            this.recordMainFailureSpend(params.event, mainFailure);
             await this.notifyFallbackSuccess(params.event, binding.processKey, binding.main, mainFailure, fallback);
             return result;
         }
@@ -344,6 +356,11 @@ export class BackendRouter {
             }
             if (!(fallbackError instanceof BackendDecisiveFailure
                 || fallbackError instanceof BackendQuotaError)) {
+                // Raw (unclassified) fallback errors are rethrown without the
+                // router wrap, so the dispatcher's spend unwrap never sees
+                // `mainFailure` — record its spend here before rethrowing.
+                // PREPASS_COST_REDUCTION_PLAN.md N1.
+                this.recordMainFailureSpend(params.event, mainFailure);
                 throw fallbackError;
             }
             await this.handleFallbackFailure(params.event, binding.processKey, binding.main, mainFailure, fallback, fallbackError);
@@ -352,7 +369,154 @@ export class BackendRouter {
                 + `fallback: ${describeBackendFailure(fallbackError)}`, fallbackError, mainFailure, fallbackError);
         }
     }
+    /**
+     * Best-effort `agent_actions` record of the main attempt's billed
+     * spend on paths where the dispatcher's `BackendRouterHandledError`
+     * unwrap will never see `mainFailure` (fallback success, raw fallback
+     * rethrow). No-op when the failure carries no spend.
+     * PREPASS_COST_REDUCTION_PLAN.md N1.
+     */
+    recordMainFailureSpend(event, mainFailure) {
+        const spendInfo = extractFailureSpendInfo(mainFailure);
+        if (spendInfo) {
+            recordFailureSpendRow(this.db, event, spendInfo, describeBackendFailure(mainFailure));
+        }
+    }
     resolveBinding(event, options) {
+        // Built-in Agent override layer (AGENT_DEFINITIONS_DESIGN.md §6.4.1
+        // runtime wiring). When the firing resolved to a built-in Agent whose
+        // operator saved tier / model / limit overrides on the Definition tab,
+        // fold them in UNDER caller-explicit options:
+        //
+        //   caller-explicit (chat picker, run-now hint, fetch-window backend pin)
+        //     > agent override snapshot
+        //       > process_backend_config / process-key defaults
+        //
+        // A caller that passes ANY routing option (tier, backend, or model)
+        // keeps full control and the agent override is skipped WHOLESALE —
+        // routing AND limits. The explicit-caller cases are all envelopes the
+        // caller owns deliberately: run-now / !checks model hints, the
+        // dashboard pickers, the morning-retry medium clamp (a cost cap that
+        // must not be re-widened by an agent override), and the fetch-window
+        // pre-pass — whose budget sizing + attempt-1 binding resolve against
+        // the PARENT routine event (stamped with `agentId`) plus a
+        // `requestedBackendId` pin, so a limits-always rule would leak the
+        // Agent's envelope into its pre-pass sub-sessions while retries
+        // (resolved against unstamped fetcher events) stayed clean.
+        //
+        // With no caller routing intent, the agent's model pin wins over its
+        // own tier (a concrete model is the more specific standing
+        // instruction) and the limit overrides are applied onto the resolved
+        // main + fallback bindings.
+        const agentOverride = this.loadAgentRouteOverride(event);
+        if (agentOverride) {
+            const callerRouted = options?.requestedTier !== undefined
+                || options?.requestedBackendId !== undefined
+                || options?.requestedModelId !== undefined;
+            if (!callerRouted) {
+                const merged = {
+                    ...options,
+                    ...(agentOverride.tier ? { requestedTier: agentOverride.tier } : {}),
+                    ...(agentOverride.modelId && agentOverride.backendId
+                        ? {
+                            requestedBackendId: agentOverride.backendId,
+                            requestedModelId: agentOverride.modelId,
+                        }
+                        : {}),
+                };
+                return this.applyAgentLimitOverrides(this.resolveBindingCore(event, merged), agentOverride);
+            }
+        }
+        return this.resolveBindingCore(event, options);
+    }
+    /**
+     * Read the firing Agent's routing override. `event.data.agentId` is
+     * stamped by `Dispatcher.beginAgentExecution` for every firing that
+     * resolves to an Agent (and propagates to morning Stage A/B via the
+     * parent-data spread); reactive DMs and pre-pass fan-out sub-events carry
+     * no stamp and resolve to `null` here. User Agents are excluded — their
+     * tier / backend / model already arrive as explicit event hints from the
+     * materialised schedule row.
+     */
+    loadAgentRouteOverride(event) {
+        if (!this.hasAgentsTable)
+            return null;
+        const agentId = event.data?.agentId;
+        if (typeof agentId !== "string" || agentId.length === 0)
+            return null;
+        let row;
+        try {
+            row = this.db
+                .prepare("SELECT source, metadata_json FROM agents WHERE id = ? LIMIT 1")
+                .get(agentId);
+        }
+        catch (err) {
+            logger.warn({ err, agentId }, "agent override lookup failed; ignoring");
+            return null;
+        }
+        if (!row || row.source !== "builtin" || !row.metadata_json)
+            return null;
+        let override;
+        try {
+            const metadata = JSON.parse(row.metadata_json);
+            override = extractAgentRouteOverride(metadata.override_snapshot);
+        }
+        catch {
+            // Corrupt metadata_json must never take routing down with it.
+            return null;
+        }
+        // Standing-pin drift guard: the dashboard dropdown only offers enabled
+        // backends at SAVE time, but an agent override persists across later
+        // backend disables. A pin to a now-disabled backend would fail the
+        // firing on every cron tick (hard override drops the fallback), so
+        // drop the pin — tier/limit overrides survive. The chat picker has no
+        // such guard because its pin lives for a single user-initiated turn.
+        if (override?.backendId && this.isBackendDisabled(override.backendId)) {
+            logger.warn({ agentId, backendId: override.backendId, modelId: override.modelId }, "agent model pin targets a disabled backend; ignoring the pin");
+            const stripped = {
+                ...override,
+                modelId: null,
+                backendId: null,
+            };
+            return stripped.tier === null
+                && stripped.maxTurns === null
+                && stripped.maxBudgetUsd === null
+                ? null
+                : stripped;
+        }
+        return override;
+    }
+    /** True only when an explicit `backends` row says `enabled = 0`. A missing
+     *  row or table stays permissive — matches the resolver's existing trust
+     *  posture for `process_backend_config` backends. */
+    isBackendDisabled(backendId) {
+        try {
+            const row = this.db
+                .prepare("SELECT enabled FROM backends WHERE id = ? LIMIT 1")
+                .get(backendId);
+            return row !== undefined && row.enabled === 0;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Apply the Agent's per-execution limit overrides onto a resolved route. */
+    applyAgentLimitOverrides(route, override) {
+        if (override.maxTurns === null && override.maxBudgetUsd === null) {
+            return route;
+        }
+        const applyTo = (binding) => ({
+            ...binding,
+            maxTurns: override.maxTurns ?? binding.maxTurns,
+            maxBudgetUsd: override.maxBudgetUsd ?? binding.maxBudgetUsd,
+        });
+        return {
+            ...route,
+            main: applyTo(route.main),
+            fallback: route.fallback ? applyTo(route.fallback) : null,
+        };
+    }
+    resolveBindingCore(event, options) {
         const processKey = options?.processKey ?? resolveProcessKey(event);
         // TIER_LOCKED hard clamp (DOCS_QA_B7_DESIGN.md S2). When set, this
         // process is pinned to a tier regardless of requestedTier hints,

package/dist/core/backends/claude-code-core.d.ts

@@ -1,55 +1,47 @@
 import { type AgentResult, type BackendModel } from "@aitne/shared";
 import type { AgentConfig } from "../../config.js";
 import type { AgentExecuteParams, AgentResumeParams, AuthCheckResult, DelegatedTaskInvokeParams, DelegatedTaskResultRaw, DelegatedToolInvokeParams, DelegatedToolResult, IAgentCore, McpSessionContext, ReadSensitiveTokenManager, StreamCallbacks } from "../agent-core.js";
-import { BackendQuotaError, BackendDecisiveFailure } from "../agent-core.js";
+import { BackendQuotaError, BackendDecisiveFailure, type BackendQuotaSpend } from "../agent-core.js";
+import { PriceFetcher } from "./price-fetcher.js";
 import type { AgentWriteTracker } from "../../safety/agent-write-tracker.js";
-import { loadFetchWindowSystemPrompt, resetFetchWindowSystemPromptForTest } from "../fetch-window-prompt-loader.js";
+import { loadFetchWindowSystemPrompt, resetFetchWindowSystemPromptForTest } from "../slim-system-prompt-loader.js";
 import { CLAUDE_PROBE_TOOLS_PROMPT, computeDelegatedClaudeTools, computeNativeClaudeTools } from "./claude-probe.js";
 import { AgentTimeoutError, extractClaudeCodeQuotaResetHint, isClaudeCodeQuotaError } from "./claude-errors.js";
 import { checkAuth as checkAuthFn } from "./claude-auth.js";
 export { AgentTimeoutError, CLAUDE_PROBE_TOOLS_PROMPT, computeDelegatedClaudeTools, computeNativeClaudeTools, extractClaudeCodeQuotaResetHint, isClaudeCodeQuotaError, };
 /**
- * Test-only surface: lets `claude-code-core.test.ts` exercise the
- * fetch_window prompt loader without reaching into module internals via
- * `as any` casts. Re-exports the shared loader (now hoisted to
- * `core/fetch-window-prompt-loader.ts`) so the existing test import path
- * keeps working after Phase 1.5's hoist.
+ * Test-only surface: lets `claude-code-core.test.ts` exercise the slim
+ * prompt loader without reaching into module internals via `as any` casts.
+ * Re-exports the shared loaders (hoisted to `core/slim-system-prompt-loader.ts`)
+ * so the existing fetch_window test import path keeps working.
  */
 export declare const _testInternals: {
     loadFetchWindowSystemPrompt: typeof loadFetchWindowSystemPrompt;
     resetFetchWindowSystemPromptForTest: typeof resetFetchWindowSystemPromptForTest;
 };
-/**
- * ClaudeCodeCore intentionally does NOT run a pre-flight `checkAuth()`
- * gate inside `execute()` / `runTurn()`. Codex and Gemini each call
- * `await this.checkAuth()` at the top of `runTurn()` as a cheap way
- * to surface an early `BackendDecisiveFailure("auth")` before paying
- * the latency of spawning the CLI subprocess; Claude uses the
- * `@anthropic-ai/claude-agent-sdk` stream consumer instead, and the
- * SDK's first HTTP round-trip already returns a decisive 401 on its
- * own. A pre-flight here would duplicate work (two credential reads
- * per execute) and isn't needed to prevent accidental token use —
- * the reactive path in `BackendRouter` catches the SDK's 401, maps
- * it to `BackendDecisiveFailure("auth")`, and calls
- * `recordReactiveAuthFailure` exactly as if a pre-flight had run.
- *
- * This asymmetry is deliberate and matched by the corresponding
- * explanatory comments at `codex-core.ts` / `gemini-cli-core.ts`'s
- * `runTurn` pre-flight and at `IAgentCore.checkAuth` in
- * `agent-core.ts`. If you add a new backend, decide the pre-flight
- * question based on the CLI / SDK's own startup cost, not on
- * pattern-matching against one of the existing three.
- */
+/** Visible for testing. */
+export declare function getAttachedPartialSpend(error: unknown): BackendQuotaSpend | null;
 export declare class ClaudeCodeCore implements IAgentCore {
     private readonly config;
     /**
      * Shared AgentWriteTracker. When present, the Write/Edit PreToolUse hook
      * pre-marks vault-scoped writes so the ObsidianWatcher attributes the
      * resulting chokidar event to `actor='agent'` instead of `'user'`. Without
-     * this wiring, the hourly_check dispatcher would re-discover the agent's
+     * this wiring, the activity_scan dispatcher would re-discover the agent's
      * own vault writes every cycle and loop.
      */
     private readonly writeTracker?;
+    /**
+     * PREPASS_COST_REDUCTION_PLAN.md N1 — used only to estimate the
+     * dollar figure of a partial spend snapshot when the SDK stream
+     * terminates abnormally (budget abort, timeout, transport failure).
+     * Success-path cost still comes from the SDK's own metering.
+     * Defaulted like the CLI cores' fetchers so bootstrap stays
+     * unchanged; guarded on `dataDir` because several unit tests
+     * construct the core with a partial config — those fall back to
+     * cap-floor-only estimation in `stampPartialSpend`.
+     */
+    private readonly priceFetcher;
     readonly backendId: "claude";
     private static readonly RETRY_DELAY_MS;
     private static readonly MAX_RETRIES;
@@ -78,10 +70,21 @@ export declare class ClaudeCodeCore implements IAgentCore {
      * Shared AgentWriteTracker. When present, the Write/Edit PreToolUse hook
      * pre-marks vault-scoped writes so the ObsidianWatcher attributes the
      * resulting chokidar event to `actor='agent'` instead of `'user'`. Without
-     * this wiring, the hourly_check dispatcher would re-discover the agent's
+     * this wiring, the activity_scan dispatcher would re-discover the agent's
      * own vault writes every cycle and loop.
      */
-    writeTracker?: AgentWriteTracker | undefined);
+    writeTracker?: AgentWriteTracker | undefined, 
+    /**
+     * PREPASS_COST_REDUCTION_PLAN.md N1 — used only to estimate the
+     * dollar figure of a partial spend snapshot when the SDK stream
+     * terminates abnormally (budget abort, timeout, transport failure).
+     * Success-path cost still comes from the SDK's own metering.
+     * Defaulted like the CLI cores' fetchers so bootstrap stays
+     * unchanged; guarded on `dataDir` because several unit tests
+     * construct the core with a partial config — those fall back to
+     * cap-floor-only estimation in `stampPartialSpend`.
+     */
+    priceFetcher?: PriceFetcher | undefined);
     /** Set the per-daemon-boot read token for subprocess-local daemon API auth. */
     setReadToken(token: string): void;
     setReadTokenManager(manager: ReadSensitiveTokenManager): void;
@@ -150,6 +153,26 @@ export declare class ClaudeCodeCore implements IAgentCore {
      */
     private buildAdvisorSettings;
     private buildSystemPrompt;
+    /**
+     * Resolve the SDK `settingSources` for a session. Returns `["project"]`
+     * for `USER_SCOPE_SHED_PROCESS_KEYS` (dropping the daemon user's `~/.claude`
+     * scope — plugin SKILL.md tree + claude.ai connector schemas — from the
+     * prompt-cache prefix) and the default `["user", "project"]` otherwise. A
+     * fresh array per call: the SDK option type is mutable `SettingSource[]`.
+     *
+     * Applied at both `query()` sites (`executeOnce`, `executeResumeOnce`).
+     * Resume carries no `processKey` (it is always a reactive DM continuation,
+     * never a slim routine), so it always resolves to the full default.
+     */
+    private resolveSettingSources;
+    /**
+     * Whether to force `strictMcpConfig` for a session — true exactly for the
+     * `USER_SCOPE_SHED_PROCESS_KEYS`, as defense-in-depth on top of the
+     * `settingSources` drop (shuts out settings-file-sourced MCP servers; the
+     * daemon's own servers are passed programmatically and unaffected). Resume
+     * carries no `processKey`, so it never qualifies.
+     */
+    private resolveStrictMcpConfig;
     /**
      * Expand CLI-style aliases ("opus", "sonnet") to their current canonical
      * API IDs. Unrecognised strings pass through unchanged so custom or
@@ -166,6 +189,23 @@ export declare class ClaudeCodeCore implements IAgentCore {
     private executeResumeOnce;
     private runWithRetry;
     private isRetryableExecutionError;
+    /**
+     * PREPASS_COST_REDUCTION_PLAN.md N1 — build a spend snapshot from the
+     * stream's partial-usage accumulator and stamp it onto the propagating
+     * error so `classifyExecutionError` / `toBackendQuotaError` (which only
+     * see the error object) can lift it onto the classified failure.
+     *
+     * Dollar figure: estimated from the accumulated tokens via the shared
+     * price fetcher. For the SDK's `max_budget_usd` abort the figure is
+     * additionally floored at the cap — the SDK's own metering crossed it,
+     * so any lower estimate (e.g. usage observed only for the first few
+     * messages) would under-report what was actually billed. `costSource`
+     * is `"sdk_partial"` to mark the figure as a partial reconstruction.
+     *
+     * No-op when nothing recordable exists: no usage observed AND the
+     * error is not a budget abort with a known cap.
+     */
+    private stampPartialSpend;
     /** Visible for testing. */
     classifyExecutionError(error: unknown): BackendQuotaError | BackendDecisiveFailure;
     private toBackendQuotaError;