@aragon-agent/cli 0.6.23 → 0.6.24

package/dist/config/load.js

@@ -411,33 +411,44 @@ function resolveMaxTokens(flags, env, file) {
  * `null`, and `null` is exactly the value being looked for. NO CLI FLAG feeds
  * this - it is a per-installation correction for a model table entry, not a
  * per-invocation choice, so `config set` and the environment variable are the
- * two surfaces the design names.
+ * two surfaces the design names. The model profile bound as Main is the third
+ * (profile-context-window): its window arrives already merged into the `file`
+ * layer by `projectModelProfiles`, and `profileOwned` names it.
+ *
+ * THE ORIGIN CONTRACT (profile-context-window §6.1, shared verbatim with the
+ * save transaction): `origin !== undefined` IF AND ONLY IF `value !== null`.
+ * An explicit AUTO - profile set to auto, `config set contextWindow auto`,
+ * `ARAGON_CONTEXT_WINDOW=auto` - returns `{ value: null }` and NO origin,
+ * because "the user asserted this denominator" and "the user declared AUTO"
+ * are different facts and the meter's override branch only sees the first.
  */
-function resolveContextWindow(env, file) {
+function resolveContextWindow(env, file, profileOwned) {
     const layers = [
         {
             name: 'ARAGON_CONTEXT_WINDOW',
             value: hasOwn(env, 'contextWindow') ? env.contextWindow : undefined,
+            origin: 'env',
         },
         {
             name: 'config.json contextWindow',
             value: hasOwn(file, 'contextWindow') ? file.contextWindow : undefined,
+            origin: profileOwned ? 'profile' : 'config',
         },
     ];
     for (const layer of layers) {
         if (layer.value === undefined)
             continue; // this layer said nothing
         if (layer.value === null || isAutoToken(layer.value))
-            return null; // AUTO
+            return { value: null }; // AUTO
         const n = clampContextWindow(layer.value, null);
         if (n !== null)
-            return n;
+            return { value: n, origin: layer.origin };
         getLogger().warn('config', 'context_window_unusable', {
             source: layer.name,
             value: String(layer.value),
         });
     }
-    return DEFAULT_CONFIG.contextWindow;
+    return { value: DEFAULT_CONFIG.contextWindow };
 }
 /**
  * Rewrite the cli<=0.6.16 persisted team ceiling defaults to 0 and persist the
@@ -513,7 +524,8 @@ export function loadConfig(flags = {}, options = {}) {
     const liveToolOutput = pick(flags.liveToolOutput, env.partial.liveToolOutput, file.liveToolOutput) ??
         DEFAULT_CONFIG.liveToolOutput;
     const maxTokens = resolveMaxTokens(flags, env.partial, file);
-    const contextWindow = resolveContextWindow(env.partial, file);
+    const resolvedWindow = resolveContextWindow(env.partial, file, projection.mainOwnsContextWindow);
+    const contextWindow = resolvedWindow.value;
     // `clampTheme` is also where the v0.3.0 `dark` name is migrated to `cool`,
     // so reading a legacy config file needs no extra step here (§4.5 / R-4).
     const theme = clampTheme(pick(flags.theme, env.partial.theme, file.theme), DEFAULT_CONFIG.theme);
@@ -609,6 +621,12 @@ export function loadConfig(flags = {}, options = {}) {
         liveToolOutput,
         maxTokens,
         contextWindow,
+        // CONDITIONAL SPREAD so a feature-off config object stays byte-identical
+        // (invariant 6): with no override there is no origin KEY, not an undefined
+        // one, and every `toEqual` on a default config keeps passing untouched.
+        ...(resolvedWindow.origin !== undefined
+            ? { contextWindowOrigin: resolvedWindow.origin }
+            : {}),
         theme,
         reducedMotion,
         exitTranscript: flags.exitTranscript !== undefined

package/dist/config/model-profile-resolution.d.ts

@@ -4,6 +4,14 @@ export interface ProfileProjection {
     file: Partial<PersistedConfig>;
     state: ModelProfilesRuntime;
     issues: ProfileValidationIssue[];
+    /**
+     * True when a valid library has Main bound, so the bound profile OWNS the
+     * context-window denominator (profile-context-window tradeoff B). THE ONE
+     * AUTHORITY for "does the profile decide the window" - load.ts and the save
+     * transaction both read it rather than comparing numbers, which would lie on
+     * a coincidental match.
+     */
+    mainOwnsContextWindow: boolean;
 }
 export interface RoleKeyInput {
     config: CliConfig;

package/dist/config/model-profile-resolution.js

@@ -9,8 +9,9 @@ export function projectModelProfiles(file) {
     const issues = validateModelProfiles(file.modelProfiles);
     const state = emptyModelProfileState(issues.length > 0);
     const projected = { ...file };
-    if (issues.length || !file.modelProfiles)
-        return { file: projected, state, issues };
+    if (issues.length || !file.modelProfiles) {
+        return { file: projected, state, issues, mainOwnsContextWindow: false };
+    }
     const library = normalizeModelProfiles(file.modelProfiles);
     projected.modelProfiles = library;
     for (const role of ['main', 'fast']) {
@@ -20,13 +21,19 @@ export function projectModelProfiles(file) {
         state[role] = { selectedId: entry.id, appliedId: entry.id,
             overriddenFields: [], invalid: false };
         const connection = { provider: entry.provider, model: entry.model, baseUrl: entry.baseUrl };
-        if (role === 'main')
-            Object.assign(projected, connection);
-        else
+        if (role === 'main') {
+            // The profile owns the denominator: project BOTH a number and null
+            // (null = AUTO), so "profile set auto" stays distinguishable from
+            // "no profile bound" (profile-context-window tradeoff B).
+            Object.assign(projected, connection, { contextWindow: entry.contextWindow });
+        }
+        else {
             projected.fast = { ...DEFAULT_CONFIG.fast, ...file.fast, ...connection,
                 baseUrl: entry.baseUrl ?? '' };
+        }
     }
-    return { file: projected, state, issues };
+    return { file: projected, state, issues,
+        mainOwnsContextWindow: state.main.appliedId !== null };
 }
 /** Derive binding status from current connections, including session/model overrides. */
 export function resolveModelProfileState(config, profiles = config.modelProfiles, invalid = false) {

package/dist/config/model-profile-store.d.ts

@@ -1,9 +1,11 @@
 import { type ModelProfilesConfig, type ModelRole, type ProfileValidationIssue } from './model-profiles.js';
-import type { CliConfig, CompactionConfig, FastConfig, LogConfig, PersistedConfig } from './schema.js';
-export interface ModelSettingsPatch extends Partial<Omit<PersistedConfig, 'modelProfiles' | 'fast' | 'compaction' | 'log'>> {
+import type { CliConfig, CompactionConfig, FastConfig, LogConfig, PersistedConfig, TeamConfig } from './schema.js';
+export interface ModelSettingsPatch extends Partial<Omit<PersistedConfig, 'modelProfiles' | 'fast' | 'compaction' | 'log' | 'team'>> {
     fast?: Partial<FastConfig>;
     compaction?: Partial<CompactionConfig>;
     log?: Partial<LogConfig>;
+    /** The subagent-model picker writes here (subagent-model D-5/I-5): draft-only until Save. */
+    team?: Partial<TeamConfig>;
 }
 export interface ModelSettingsDraft {
     profiles?: ModelProfilesConfig;

package/dist/config/model-profiles.d.ts

@@ -6,6 +6,8 @@ export interface ModelProfile {
     model: string;
     baseUrl: string | null;
     apiKey: string | null;
+    /** The context window of this model+endpoint; null = AUTO (profile-context-window 5.1). */
+    contextWindow: number | null;
 }
 export interface ModelProfilesConfig {
     version: 1;
@@ -34,6 +36,17 @@ export declare function emptyModelProfiles(): ModelProfilesConfig;
 export declare function emptyModelProfileState(invalid?: boolean): ModelProfilesRuntime;
 /** Validate untrusted input; diagnostics never include supplied values. */
 export declare function validateModelProfiles(value: unknown): ProfileValidationIssue[];
+/**
+ * Disk-tolerance gate for a profile-level context window (profile-context-window 5.3).
+ *
+ * THE SAME TRI-STATE DISCIPLINE as store.ts normalizeContextWindow, kept out of
+ * store.ts on purpose: this file already imports schema.js and store's sibling
+ * model-profile-store.ts already imports this one, so placing it here avoids
+ * widening the existing store <-> model-profile-store cycle. A garbage value on
+ * a hand-edited file degrades to AUTO; it NEVER invalidates the whole library
+ * (invariant 4 - one bad number must not drop the user's credentials).
+ */
+export declare function normalizeProfileContextWindow(value: unknown): number | null;
 /** Normalize a valid library into a safe field whitelist; throws a fixed error if invalid. */
 export declare function normalizeModelProfiles(value: unknown): ModelProfilesConfig;
 /** Create an entry with a stable UUID and a frozen default name. */

package/dist/config/model-profiles.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { ADAPTER_PROVIDERS } from './schema.js';
+import { ADAPTER_PROVIDERS, clampContextWindow, isAutoToken } from './schema.js';
 const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
 /** Return a fresh empty library without initiating a disk migration. */
 export function emptyModelProfiles() {
@@ -91,6 +91,21 @@ export function validateModelProfiles(value) {
     }
     return issues;
 }
+/**
+ * Disk-tolerance gate for a profile-level context window (profile-context-window 5.3).
+ *
+ * THE SAME TRI-STATE DISCIPLINE as store.ts normalizeContextWindow, kept out of
+ * store.ts on purpose: this file already imports schema.js and store's sibling
+ * model-profile-store.ts already imports this one, so placing it here avoids
+ * widening the existing store <-> model-profile-store cycle. A garbage value on
+ * a hand-edited file degrades to AUTO; it NEVER invalidates the whole library
+ * (invariant 4 - one bad number must not drop the user's credentials).
+ */
+export function normalizeProfileContextWindow(value) {
+    if (value === undefined || value === null || isAutoToken(value))
+        return null;
+    return clampContextWindow(value, null);
+}
 /** Normalize a valid library into a safe field whitelist; throws a fixed error if invalid. */
 export function normalizeModelProfiles(value) {
     if (validateModelProfiles(value).length)
@@ -102,7 +117,8 @@ export function normalizeModelProfiles(value) {
         entries: library.entries.map((entry) => ({ id: entry.id, name: entry.name.trim()
                 || [...entry.model.trim()].slice(0, 80).join(''), provider: entry.provider,
             model: entry.model.trim(), baseUrl: entry.baseUrl?.trim() || null,
-            apiKey: entry.apiKey?.trim() || null })) };
+            apiKey: entry.apiKey?.trim() || null,
+            contextWindow: normalizeProfileContextWindow(entry.contextWindow) })) };
 }
 /** Create an entry with a stable UUID and a frozen default name. */
 export function createModelProfile(input) {

package/dist/config/schema.d.ts

@@ -99,6 +99,35 @@ export declare const MAX_CONTEXT_WINDOW = 5000000;
  * this deliberately copies its shape rather than inventing a second convention.
  */
 export declare function clampContextWindow(v: unknown, fallback: number | null): number | null;
+/**
+ * Where the effective `contextWindow` override came from
+ * (profile-context-window §5.2).
+ *
+ * A CLI-LOCAL RUNTIME FACT: never persisted, never promoted into Core's event
+ * shapes. It exists so `/context` can name WHICH surface supplied a
+ * denominator the user asserted - the environment, the legacy top-level key,
+ * or the model profile bound as Main.
+ */
+export type ContextWindowOrigin = 'env' | 'config' | 'profile';
+/**
+ * Parse text typed into the settings screen or the profile editor for a
+ * context window (profile-context-window §5.3).
+ *
+ * THE MIRROR OF `parseMaxTokensInput` BELOW, down to the tri-state shape: it
+ * distinguishes AUTO from "the user typed nonsense", which `clampContextWindow`
+ * cannot - a typo must change NOTHING rather than silently discard the number
+ * the user meant to set. `''` / `'auto'` / `'0'` are AUTO (`isAutoToken`);
+ * a digit run is clamped through THE single gate; anything else is invalid.
+ */
+export declare function parseContextWindowInput(raw: string): {
+    kind: 'auto';
+} | {
+    kind: 'value';
+    value: number;
+    clamped: boolean;
+} | {
+    kind: 'invalid';
+};
 /**
  * Entries kept in `ViewState` at all (tui-render-performance L1 / R5).
  *
@@ -356,6 +385,26 @@ export interface TeamConfig {
      * meaningful while `team.overseer` is true.
      */
     overseerIntervalMs: number;
+    /**
+     * Which model a team child runs on (subagent-model-and-question-controls
+     * D-2). `'main'` = the lead's own connection - the default and the
+     * historical parity behavior; `'fast'` = the fast tier, resolved per
+     * dispatch through `resolveFastTier`; `'profile'` = the entry named by
+     * `team.modelProfileId`.
+     *
+     * A USER-OWNED SETTING, NEVER A TOOL PARAMETER (D-1): `normalizeSubagentSpecs`
+     * keeps silently dropping a stale `model` key, so the MODEL cannot downgrade
+     * its own delegation. This key is the one explicit, visible, reversible
+     * switch the human owns.
+     */
+    model: 'main' | 'fast' | 'profile';
+    /**
+     * The profile entry a `model: 'profile'` dispatch binds to; `null` = not
+     * bound. IGNORED by the other modes. Existence is NOT validated here - a
+     * dangling id degrades to the main model with a disclosed reason at
+     * resolution time (D-4), so deleting a profile can never break a dispatch.
+     */
+    modelProfileId: string | null;
 }
 /**
  * The requirement's ceiling on the fan-out (R-g).
@@ -967,6 +1016,18 @@ export interface CliConfig {
      * would parse and be discarded, with nothing failing.
      */
     contextWindow: number | null;
+    /**
+     * WHERE the override above came from, or `undefined` when there is none
+     * (profile-context-window §5.2). RUNTIME-ONLY, never persisted.
+     *
+     * THE CONTRACT IS AN IFF: `contextWindowOrigin !== undefined` exactly when
+     * `contextWindow !== null`. An explicit AUTO (profile set to auto,
+     * `config set contextWindow auto`, `ARAGON_CONTEXT_WINDOW=auto`) has value
+     * null, so its origin is undefined - "the user asserted this denominator"
+     * and "the user declared AUTO" are different facts, and the meter's
+     * override branch only ever sees the first.
+     */
+    contextWindowOrigin?: ContextWindowOrigin;
     theme: ThemeName;
     reducedMotion: boolean;
     /** Replay a plain-text summary on exit (full-screen only — see §4.4). */

package/dist/config/schema.js

@@ -148,6 +148,27 @@ export function clampContextWindow(v, fallback) {
         return fallback;
     return Math.min(MAX_CONTEXT_WINDOW, Math.max(MIN_CONTEXT_WINDOW, Math.floor(n)));
 }
+/**
+ * Parse text typed into the settings screen or the profile editor for a
+ * context window (profile-context-window §5.3).
+ *
+ * THE MIRROR OF `parseMaxTokensInput` BELOW, down to the tri-state shape: it
+ * distinguishes AUTO from "the user typed nonsense", which `clampContextWindow`
+ * cannot - a typo must change NOTHING rather than silently discard the number
+ * the user meant to set. `''` / `'auto'` / `'0'` are AUTO (`isAutoToken`);
+ * a digit run is clamped through THE single gate; anything else is invalid.
+ */
+export function parseContextWindowInput(raw) {
+    const trimmed = String(raw ?? '').trim();
+    if (isAutoToken(trimmed))
+        return { kind: 'auto' };
+    if (!/^\d+$/.test(trimmed))
+        return { kind: 'invalid' };
+    const value = clampContextWindow(trimmed, null);
+    if (value === null)
+        return { kind: 'invalid' };
+    return { kind: 'value', value, clamped: value !== Number.parseInt(trimmed, 10) };
+}
 /**
  * Entries kept in `ViewState` at all (tui-render-performance L1 / R5).
  *
@@ -457,6 +478,10 @@ export const DEFAULT_TEAM_CONFIG = {
     overseer: true,
     // 0 = the structural cadence default (300 s). See the field docstring.
     overseerIntervalMs: 0,
+    // The parity default: children run the lead's own model until the user
+    // says otherwise (AC-1 - an upgraded config behaves exactly as before).
+    model: 'main',
+    modelProfileId: null,
 };
 const SUBAGENTS_RANGE = { min: 1, max: HARD_MAX_SUBAGENTS };
 const CONCURRENT_RANGE = { min: 1, max: HARD_MAX_SUBAGENTS };
@@ -490,6 +515,17 @@ export function clampTeamConfig(raw) {
         maxTurnsPerSubagent: clampIntAllowingZero(src.maxTurnsPerSubagent, DEFAULT_TEAM_CONFIG.maxTurnsPerSubagent, TURNS_RANGE),
         overseer: bool(src.overseer, DEFAULT_TEAM_CONFIG.overseer),
         overseerIntervalMs: clampIntAllowingZero(src.overseerIntervalMs, DEFAULT_TEAM_CONFIG.overseerIntervalMs, OVERSEER_INTERVAL_RANGE),
+        // typo-changes-nothing, the discipline every enum clamp here follows: a
+        // hand-edited `model: 'fats'` resolves to 'main' (the parity default)
+        // rather than invalidating the file or refusing to launch. A bad
+        // `modelProfileId` (wrong type, or over the 128-codepoint budget
+        // `model-profiles.ts::validText` defines) is nulled the same way;
+        // reference EXISTENCE stays a resolution-time concern (D-4).
+        model: src.model === 'fast' || src.model === 'profile' ? src.model : 'main',
+        modelProfileId: typeof src.modelProfileId === 'string' && src.modelProfileId.length > 0
+            && [...src.modelProfileId].length <= 128
+            ? src.modelProfileId
+            : null,
     };
 }
 /**

package/dist/team/model.d.ts

@@ -0,0 +1,88 @@
+/**
+ * `resolveSubagentModel` — THE single authority on which model a team child
+ * runs (subagent-model-and-question-controls §3.3).
+ *
+ * ASCII ONLY: `src/team/**` is inside the glyph scanner's scope.
+ *
+ * EVERY CONSUMER READS THE CHILD'S MODEL THROUGH THIS FUNCTION AND NOWHERE
+ * ELSE — `createSubagent`, the `task` report header, the settings root row and
+ * `/team model` — following the `resolveFastTier` precedent one directory over:
+ * four call sites each recomputing "which model do children run on?" from raw
+ * config keys is exactly how the report ends up naming a model the children
+ * silently fell back from.
+ *
+ * IT IS RE-RUN ON EVERY DISPATCH AND EVERY RENDER, NOT ONCE (rule 8 / RV-3 of
+ * the fast tier, inherited here): `team.model`, the fast tier and the profile
+ * library are all LIVE keys a settings save, `/fast off` or `/team model` can
+ * rewrite mid-session. A resolution captured at construction would be a
+ * resolution describing a session that no longer exists.
+ *
+ * A CHILD IS NEVER LEFT WITHOUT A MODEL (D-4). Every failure mode — fast tier
+ * off, profile deleted, profile key missing — degrades to the MAIN connection
+ * with a `fallbackReason`, so a dispatch cannot fail because its model setting
+ * went stale. The reason is disclosed, never swallowed: the report header and
+ * the settings summary line both render it.
+ */
+import type { ModelRef, ThinkingLevel } from '@aragon-agent/core';
+import type { ModelProfile, ModelRole } from '../config/model-profiles.js';
+import type { CliConfig } from '../config/schema.js';
+/** Which model children run on. `main` is the default and the historical behavior. */
+export type SubagentModelMode = 'main' | 'fast' | 'profile';
+/** Why a non-main request degraded to the main model (D-4 disclosure). */
+export type SubagentFallbackReason = 
+/** `team.model='fast'` but `resolveFastTier` is not ok (off, unconfigured, no key). */
+'fast_unavailable'
+/** `modelProfileId` is absent from the library (deleted, or never existed). */
+ | 'profile_missing'
+/** The entry exists but carries no key of its own and the shared layer has none. */
+ | 'profile_no_key';
+/** In-memory resolution; recomputed per dispatch/render, never persisted (§6.3). */
+export interface SubagentModelResolution {
+    /** The user's requested mode, verbatim from config (UI highlight reads this). */
+    mode: SubagentModelMode;
+    /** The mode actually in effect; `'main'` whenever a fallback fired. */
+    effective: SubagentModelMode;
+    /** The connection children will use. On fallback, exactly the main connection. */
+    ref: ModelRef;
+    /** main/profile take `config.thinkingLevel`; fast takes `config.fast.thinkingLevel`. */
+    thinkingLevel: ThinkingLevel;
+    /** The role controller key resolution uses: main/profile `'main'`, fast `'fast'`. */
+    keyRole: ModelRole;
+    /** The profile entry a `profile` request hit, dedicated key included; else null. */
+    profile: ModelProfile | null;
+    /** Present only when `effective !== mode`. */
+    fallbackReason?: SubagentFallbackReason;
+}
+/** The `AgentController.hasApiKey` shape, injected so there is one key resolver. */
+export type HasApiKey = (providerId: string, role?: ModelRole) => boolean;
+/** The lead-layer key resolver `resolveSubagentKey` falls back to. */
+export type SharedKeyResolver = (providerId: string, role: ModelRole) => string | undefined;
+/**
+ * Resolve the model every child of the NEXT dispatch will run on.
+ *
+ * Pure, synchronous, no IO — testable as a matrix over config fixtures.
+ *
+ * @param config The live effective config. Read fresh; never snapshot it.
+ * @param hasKey `AgentController.hasApiKey`, which already resolves the
+ *   config-file key, the provider environment variable and the one-shot
+ *   `--api-key` override. Injected rather than reimplemented for the reason
+ *   `resolveFastTier` records: a second key resolver is a second answer to
+ *   "why does it say no key?".
+ */
+export declare function resolveSubagentModel(config: CliConfig, hasKey: HasApiKey): SubagentModelResolution;
+/**
+ * The key a CHILD resolves for a provider, profile-aware (§3.3 / I-4).
+ *
+ * A profile's dedicated key is visible ONLY here: it never reaches env,
+ * `config.apiKeys` or a log line. While the resolution's profile is bound and
+ * the provider matches it, the entry key takes priority over the shared layer;
+ * every other provider (and every non-profile mode) resolves through the
+ * lead's own resolver at `resolution.keyRole` — which is what keeps a `fast`
+ * child entitled to the fast-role key and a `main` child to the main one.
+ *
+ * @param config The live config (carried for parity with the resolver pair).
+ * @param resolution A fresh `resolveSubagentModel` output.
+ * @param providerId The provider the child needs a key for.
+ * @param shared The lead-layer resolver (`controller.resolveKey`).
+ */
+export declare function resolveSubagentKey(config: CliConfig, resolution: SubagentModelResolution, providerId: string, shared: SharedKeyResolver): string | undefined;

package/dist/team/model.js

@@ -0,0 +1,136 @@
+/**
+ * `resolveSubagentModel` — THE single authority on which model a team child
+ * runs (subagent-model-and-question-controls §3.3).
+ *
+ * ASCII ONLY: `src/team/**` is inside the glyph scanner's scope.
+ *
+ * EVERY CONSUMER READS THE CHILD'S MODEL THROUGH THIS FUNCTION AND NOWHERE
+ * ELSE — `createSubagent`, the `task` report header, the settings root row and
+ * `/team model` — following the `resolveFastTier` precedent one directory over:
+ * four call sites each recomputing "which model do children run on?" from raw
+ * config keys is exactly how the report ends up naming a model the children
+ * silently fell back from.
+ *
+ * IT IS RE-RUN ON EVERY DISPATCH AND EVERY RENDER, NOT ONCE (rule 8 / RV-3 of
+ * the fast tier, inherited here): `team.model`, the fast tier and the profile
+ * library are all LIVE keys a settings save, `/fast off` or `/team model` can
+ * rewrite mid-session. A resolution captured at construction would be a
+ * resolution describing a session that no longer exists.
+ *
+ * A CHILD IS NEVER LEFT WITHOUT A MODEL (D-4). Every failure mode — fast tier
+ * off, profile deleted, profile key missing — degrades to the MAIN connection
+ * with a `fallbackReason`, so a dispatch cannot fail because its model setting
+ * went stale. The reason is disclosed, never swallowed: the report header and
+ * the settings summary line both render it.
+ */
+import { resolveFastTier } from '../fast/resolve.js';
+function mainRef(config) {
+    return {
+        providerId: config.provider,
+        modelId: config.model,
+        ...(config.baseUrl ? { baseUrl: config.baseUrl } : {}),
+    };
+}
+function fallbackToMain(config, mode, fallbackReason) {
+    // THE ALWAYS-USABLE ANSWER (D-4): whatever the user asked for that could not
+    // resolve, the caller still gets a working connection — the same provider,
+    // model, base URL and thinking level the lead itself runs on.
+    return {
+        mode,
+        effective: 'main',
+        ref: mainRef(config),
+        thinkingLevel: config.thinkingLevel,
+        keyRole: 'main',
+        profile: null,
+        fallbackReason,
+    };
+}
+/**
+ * Resolve the model every child of the NEXT dispatch will run on.
+ *
+ * Pure, synchronous, no IO — testable as a matrix over config fixtures.
+ *
+ * @param config The live effective config. Read fresh; never snapshot it.
+ * @param hasKey `AgentController.hasApiKey`, which already resolves the
+ *   config-file key, the provider environment variable and the one-shot
+ *   `--api-key` override. Injected rather than reimplemented for the reason
+ *   `resolveFastTier` records: a second key resolver is a second answer to
+ *   "why does it say no key?".
+ */
+export function resolveSubagentModel(config, hasKey) {
+    // `clampTeamConfig` guarantees the enum on every read and write path, so the
+    // default `'main'` here is belt-and-braces rather than a real branch.
+    const mode = config.team.model ?? 'main';
+    if (mode === 'fast') {
+        const tier = resolveFastTier(config, hasKey);
+        if (tier.ok) {
+            return {
+                mode,
+                effective: 'fast',
+                ref: tier.ref,
+                thinkingLevel: config.fast.thinkingLevel,
+                keyRole: 'fast',
+                profile: null,
+            };
+        }
+        return fallbackToMain(config, mode, 'fast_unavailable');
+    }
+    if (mode === 'profile') {
+        // A missing library, a missing id and a dangling id are one outcome
+        // (D-4): degrade to main and say so. Reference EXISTENCE is deliberately
+        // not validated in `clampTeamConfig` — resolution is where it belongs.
+        const id = config.team.modelProfileId;
+        const entry = id
+            ? config.modelProfiles?.entries.find((candidate) => candidate.id === id)
+            : undefined;
+        if (!entry)
+            return fallbackToMain(config, mode, 'profile_missing');
+        // The dedicated entry key wins; without one the shared layer must have a
+        // key for the entry's provider, or the child could not authenticate at all.
+        if (!entry.apiKey && !hasKey(entry.provider, 'main')) {
+            return fallbackToMain(config, mode, 'profile_no_key');
+        }
+        return {
+            mode,
+            effective: 'profile',
+            ref: {
+                providerId: entry.provider,
+                modelId: entry.model,
+                ...(entry.baseUrl ? { baseUrl: entry.baseUrl } : {}),
+            },
+            thinkingLevel: config.thinkingLevel,
+            keyRole: 'main',
+            profile: entry,
+        };
+    }
+    return {
+        mode: 'main',
+        effective: 'main',
+        ref: mainRef(config),
+        thinkingLevel: config.thinkingLevel,
+        keyRole: 'main',
+        profile: null,
+    };
+}
+/**
+ * The key a CHILD resolves for a provider, profile-aware (§3.3 / I-4).
+ *
+ * A profile's dedicated key is visible ONLY here: it never reaches env,
+ * `config.apiKeys` or a log line. While the resolution's profile is bound and
+ * the provider matches it, the entry key takes priority over the shared layer;
+ * every other provider (and every non-profile mode) resolves through the
+ * lead's own resolver at `resolution.keyRole` — which is what keeps a `fast`
+ * child entitled to the fast-role key and a `main` child to the main one.
+ *
+ * @param config The live config (carried for parity with the resolver pair).
+ * @param resolution A fresh `resolveSubagentModel` output.
+ * @param providerId The provider the child needs a key for.
+ * @param shared The lead-layer resolver (`controller.resolveKey`).
+ */
+export function resolveSubagentKey(config, resolution, providerId, shared) {
+    void config; // parity parameter: the pair reads one config, the key does not need it
+    if (resolution.profile && providerId === resolution.ref.providerId) {
+        return resolution.profile.apiKey ?? shared(providerId, 'main');
+    }
+    return shared(providerId, resolution.keyRole);
+}

package/dist/team/report.d.ts

@@ -21,6 +21,7 @@
  * because of one HTTP 429.
  */
 import type { ModelCost } from '@aragon-agent/core';
+import type { SubagentModelResolution } from './model.js';
 import type { DispatchOutcome, SubagentRun } from './types.js';
 export interface ReportOptions {
     /** The lead's model cost table, so the header can state real spend (R-5).
@@ -37,6 +38,16 @@ export interface ReportOptions {
      * rule the fast tier already follows everywhere else).
      */
     fastCost?: ModelCost;
+    /**
+     * The dispatch-time subagent model resolution (subagent-model §3.4).
+     *
+     * ABSENT under the default `team.model: 'main'` mode is what keeps the
+     * parity report byte-identical (I-2): the disclosure line exists only when
+     * children did NOT run the main model, and a resolution that degraded
+     * (fast tier off, profile deleted, profile key missing) says so instead of
+     * silently renaming the model the children fell back to (D-4).
+     */
+    subagentModel?: SubagentModelResolution;
 }
 /**
  * Cut `text` to at most `maxBytes` WITHOUT splitting a UTF-8 sequence.

package/dist/team/report.js

@@ -106,8 +106,31 @@ function buildHeader(outcome, options) {
             `(${counts}) in ${formatDuration(durationMs)}.`
         : `Team dispatch: ${outcome.runs.length} of ${outcome.runs.length} subagents finished ` +
             `(${counts}) in ${formatDuration(durationMs)}.`);
+    // THE PRICE OF THE MODEL CHILDREN ACTUALLY RAN (subagent-model §3.4). The
+    // default main flow always supplies a table, so the ternary's last branch
+    // is the legacy byte-identical shape; an UNPRICED fast or profile child
+    // model says `pricing unknown` - unknown pricing is not zero pricing, and
+    // `$0.00` on a dispatch that is spending money is the C-11 / RV-4 lie.
+    const spend = options.cost
+        ? formatCost(computeCost(outcome.usage, options.cost))
+        : options.subagentModel && options.subagentModel.effective !== 'main'
+            ? 'pricing unknown'
+            : formatCost(computeCost(outcome.usage, options.cost));
     lines.push(`Tokens: in ${formatTokens(outcome.usage.inputTokens)}, out ` +
-        `${formatTokens(outcome.usage.outputTokens)}. Cost: ${formatCost(computeCost(outcome.usage, options.cost))}.`);
+        `${formatTokens(outcome.usage.outputTokens)}. Cost: ${spend}.`);
+    // THE MODEL DISCLOSURE LINE (D-4), immediately after the spend it explains.
+    // Rendered only when children did not run the main model, so the default
+    // report stays byte-identical (I-2) and a degraded request says WHICH mode
+    // was asked for and WHY it fell back rather than quietly renaming it.
+    const subagent = options.subagentModel;
+    if (subagent && subagent.effective !== 'main') {
+        lines.push(`Children ran on ${subagent.ref.providerId}:${subagent.ref.modelId} ` +
+            `(subagent model: ${subagent.effective}).`);
+    }
+    else if (subagent && subagent.fallbackReason) {
+        lines.push(`Subagent model ${subagent.mode} unavailable (${subagent.fallbackReason}); ` +
+            `children ran on the main model.`);
+    }
     for (const conflict of findFileConflicts(outcome.runs)) {
         const who = conflict.labels.map((l) => `"${l}"`).join(' and ');
         lines.push(`WARNING: agents ${who} both wrote ${conflict.path} - review before trusting either.`);