@arbiterforge/ca-pi 0.15.5 → 0.15.7

package/plugins/ca-pi/hooks/_reconciliationlib.py

@@ -23,8 +23,10 @@ import _replylib
 
 ID_RE = re.compile(r"[A-Z][A-Z0-9_-]{0,127}")
 TOKEN_RE = re.compile(r"[A-Za-z0-9_-]{12,128}")
-PENDING_DIR = Path(".codearbiter/.markers/reconciliations")
-ATTEMPT_DIR = Path(".codearbiter/.markers/reconciliation-attempts")
+PENDING_DIR = Path("pending")
+ATTEMPT_DIR = Path("attempts")
+LEGACY_PENDING_DIR = Path(".codearbiter/.markers/reconciliations")
+LEGACY_ATTEMPT_DIR = Path(".codearbiter/.markers/reconciliation-attempts")
 SOURCE_DIR = Path(".codearbiter/.artifacts/authority-sources")
 PROVEN_UNCOMMITTED = frozenset({"REVISION_CONFLICT", "OPERATION_ROLLED_BACK"})
 
@@ -53,6 +55,65 @@ def _attempt(pending: dict[str, Any]) -> Path:
     return ATTEMPT_DIR / f"{_operation_id(pending)}.json"
 
 
+def _state_root(root: Path) -> Path:
+    """Keep operational state outside every repository input root."""
+    try:
+        spool = _artifactauthoritylib._spool_root(root)
+        return _artifactauthoritylib._safe_directory(spool, Path("reconciliations"), create=True)
+    except _artifactauthoritylib.AuthorityError as exc:
+        raise ReconciliationError("Git admin reconciliation storage is unavailable or unsafe") from exc
+
+
+def _legacy_pending(root: Path, artifact_id: str) -> Path:
+    return _legacy_file(root, LEGACY_PENDING_DIR, f"{artifact_id}.json")
+
+
+def _legacy_file(root: Path, directory: Path, filename: str) -> Path:
+    try:
+        parent = _approvallib._safe_directory(root, directory, create=False)
+    except FileNotFoundError:
+        return root / directory / filename
+    except _approvallib.ApprovalError as exc:
+        raise ReconciliationError("legacy reconciliation directory is unsafe") from exc
+    return parent / filename
+
+
+def _state_file(root: Path, directory: Path, filename: str) -> Path:
+    try:
+        parent = _artifactauthoritylib._safe_directory(_state_root(root), directory, create=True)
+    except _artifactauthoritylib.AuthorityError as exc:
+        raise ReconciliationError("Git admin reconciliation directory is unsafe") from exc
+    return parent / filename
+
+
+def _present(path: Path) -> bool:
+    try:
+        path.lstat()
+    except FileNotFoundError:
+        return False
+    return True
+
+
+def _pending_path(root: Path, artifact_id: str) -> Path:
+    current = _state_file(root, PENDING_DIR, f"{artifact_id}.json")
+    legacy = _legacy_pending(root, artifact_id)
+    if _present(current) and _present(legacy):
+        raise ReconciliationError("ambiguous reconciliation state in repository and Git admin storage")
+    return legacy if _present(legacy) else current
+
+
+def _attempt_path(root: Path, pending: dict[str, Any]) -> Path:
+    filename = f"{_operation_id(pending)}.json"
+    legacy = _legacy_file(root, LEGACY_ATTEMPT_DIR, filename)
+    current = _state_file(root, ATTEMPT_DIR, filename)
+    legacy_pending = _present(_legacy_pending(root, pending["artifact_id"]))
+    if (_present(legacy) and _present(current)) or (
+        legacy_pending and _present(current)
+    ) or (not legacy_pending and _present(legacy)):
+        raise ReconciliationError("mixed reconciliation state requires explicit repair")
+    return legacy if legacy_pending else current
+
+
 def _mutation_request(pending: dict[str, Any], receipt: str) -> dict[str, Any]:
     identity = pending["identity"]
     request = {
@@ -72,7 +133,7 @@ def _reconciliation_lock(root: Path, artifact_id: str):
     """Serialize all transitions for one artifact, including authority revocation."""
     if ID_RE.fullmatch(artifact_id) is None:
         raise ReconciliationError("reconciliation ID is invalid")
-    parent = _approvallib._safe_directory(root, PENDING_DIR, create=True)
+    parent = _state_file(root, PENDING_DIR, artifact_id).parent
     path = parent / f"{artifact_id}.lock"
     flags = os.O_RDWR | os.O_CREAT | getattr(os, "O_BINARY", 0) | getattr(os, "O_NOFOLLOW", 0)
     fd = os.open(path, flags, 0o600)
@@ -147,11 +208,11 @@ def _write_attempt(root: Path, pending: dict[str, Any], request: dict[str, Any])
         "format": "codearbiter.reconciliation-attempt/0.1.0",
         "pending_sha256": _digest(_canonical(pending)), "request": request,
     }
-    _write_atomic_new(root, _attempt(pending), _canonical(record))
+    _write_atomic_new(_state_root(root), _attempt(pending), _canonical(record))
 
 
 def _load_attempt(root: Path, pending: dict[str, Any]) -> dict[str, Any] | None:
-    path = root / _attempt(pending)
+    path = _attempt_path(root, pending)
     try:
         info = path.lstat()
     except FileNotFoundError:
@@ -225,6 +286,8 @@ def _arm_reconciliation_unlocked(
     token = token or secrets.token_urlsafe(24)
     if TOKEN_RE.fullmatch(token) is None:
         raise ReconciliationError("reconciliation token is invalid")
+    if _present(_legacy_pending(root, artifact_id)):
+        raise ReconciliationError("PENDING_RECONCILIATION: legacy request must be cancelled or recovered")
     identity, snapshot, record = _current(client, artifact_id, target_id)
     reply = (
         f"reconcile-task {artifact_id} {target_id} {target_state} {token}"
@@ -240,10 +303,11 @@ def _arm_reconciliation_unlocked(
         "prompt_sha256": _digest(reply.encode()),
     }
     relative = _pending(artifact_id)
+    state = _state_root(root)
     created = False
     try:
         pending_bytes = _canonical(pending)
-        _write_atomic_new(root, relative, pending_bytes)
+        _write_atomic_new(state, relative, pending_bytes)
         created = True
         _artifactpromptlib.register(
             root, "reconciliation", artifact_id, reply,
@@ -254,7 +318,7 @@ def _arm_reconciliation_unlocked(
     except Exception:
         if created:
             try:
-                (root / relative).unlink()
+                (state / relative).unlink()
             except OSError:
                 pass
         raise
@@ -267,7 +331,7 @@ def _arm_reconciliation_unlocked(
 
 def _load(root: Path, artifact_id: str) -> dict[str, Any]:
     try:
-        path = root / _pending(artifact_id)
+        path = _pending_path(root, artifact_id)
         info = path.lstat()
         reparse = getattr(info, "st_file_attributes", 0) & 0x400
         if stat.S_ISLNK(info.st_mode) or reparse or not stat.S_ISREG(info.st_mode) or info.st_size > 131072:
@@ -328,7 +392,7 @@ def _cancel_reconciliation_unlocked(root: Path, artifact_id: str, prompt: str) -
         raise ReconciliationError("reconciliation authority binding is unavailable") from exc
     if binding != _digest(_canonical(pending)):
         raise ReconciliationError("pending reconciliation changed after arming")
-    (root / _pending(artifact_id)).unlink()
+    _pending_path(root, artifact_id).unlink()
     _artifactpromptlib.unregister(root, "reconciliation", artifact_id)
     return {"artifact_id": artifact_id, "cancelled": True}
 
@@ -349,7 +413,7 @@ def cancel_orphaned_reconciliation(root: str | Path, artifact_id: str) -> dict[s
                 raise ReconciliationError("reconciliation authority binding is unreadable") from exc
         if binding == _digest(_canonical(pending)):
             raise ReconciliationError("reconciliation route is active; cancel with its exact prompt")
-        (root / _pending(artifact_id)).unlink()
+        _pending_path(root, artifact_id).unlink()
         if binding is not None:
             _artifactpromptlib.unregister(root, "reconciliation", artifact_id)
         return {"artifact_id": artifact_id, "cancelled": True, "orphaned": True}
@@ -379,9 +443,10 @@ def recover_reconciliation(root: str | Path, client: Any, artifact_id: str) -> d
                 raise
             result = None
             committed = False
-        (root / _pending(artifact_id)).unlink()
+        attempt_path = _attempt_path(root, pending)
+        _pending_path(root, artifact_id).unlink()
         _artifactpromptlib.unregister(root, "reconciliation", artifact_id)
-        (root / _attempt(pending)).unlink()
+        attempt_path.unlink()
         return {
             "artifact_id": artifact_id, "committed": committed,
             "revision": result.get("revision") if committed else None,
@@ -407,6 +472,8 @@ def _consume_reconciliation_unlocked(
     parts = prompt.split(" ")
     artifact_id, target_id = parts[1], parts[2]
     pending = _load(root, artifact_id)
+    if _present(_legacy_pending(root, artifact_id)):
+        raise ReconciliationError("legacy reconciliation must be cancelled or recovered before consumption")
     if not isinstance(host, str) or not host or not isinstance(session_id, str) or not session_id:
         raise ReconciliationError("reconciliation host context is invalid")
     try:
@@ -456,9 +523,10 @@ def _consume_reconciliation_unlocked(
             if request is None:
                 raise ReconciliationError("in-flight reconciliation record disappeared")
     result = client.call(pending["operation"], request)
-    (root / _pending(artifact_id)).unlink()
+    attempt_path = _attempt_path(root, pending)
+    _pending_path(root, artifact_id).unlink()
     _artifactpromptlib.unregister(root, "reconciliation", artifact_id)
-    (root / _attempt(pending)).unlink()
+    attempt_path.unlink()
     return {"matched": True, "reconciled": True, "artifact_id": artifact_id, "target_id": target_id, "receipt": request["receipt"], "revision": result.get("revision")}
 
 

package/plugins/ca-pi/hooks/_segmentslib.py

@@ -205,16 +205,76 @@ def model_pill(model, effort=""):
 
 
 def usage_row(label, tin, tout, cost, trail=""):
-    """One row of the Session/Today mini-table: label │ ↓in ↑out │ $cost. in/out are
-    fresh (sent) tokens; `cost` is Claude Code's real session cost (cost.total_cost_usd),
-    not an estimate. `trail` carries extras (session age, burn sparkline)."""
+    """One row of the Session/Today mini-table: label | down-in up-out | cost.
+    in/out are fresh (sent) tokens. `cost` is a pre-rendered cell from
+    cost_cell(), whose label carries the figure's provenance; a bare number is
+    still accepted for callers outside the usage block. `trail` carries extras
+    (the burn sparkline)."""
+    money = cost if isinstance(cost, str) else f"{OK}{usd_fine(cost)}{RESET}"
     base = (f"{GREY}{label:<7}{RESET} {V0}{_VBAR}{RESET} "
             f"{V2}{DN}{RESET} {WHITE}{fmt_tok(tin):>6}{RESET} "
             f"{V2}{UP}{RESET} {WHITE}{fmt_tok(tout):>6}{RESET} {V0}{_VBAR}{RESET} "
-            f"{OK}{usd_fine(cost)}{RESET}")
+            f"{money}")
     return base + (f"  {trail}" if trail else "")
 
 
+# Visible columns of usage_row() before the cost cell: label(7) + separators and
+# two right-aligned 6-column token counts.
+USAGE_ROW_FIXED = 30
+# Coverage reasons that mean observed usage could not be priced at all.
+PRICING_REASONS = frozenset({"unknown_model", "unpriced_modifier", "unknown_cache_ttl",
+                             "unknown_charge", "unknown_iteration", "model_conflict"})
+
+
+def cost_label(scope, allow_host=False, compact=False):
+    """(text, tone) for one Session/Today dollar figure, from the ledger's
+    structured coverage (spec AC-01/02, D-19). The renderer never infers
+    completeness from a number:
+      api≈$N   complete reconstruction at pinned list rates
+      api≥$N   a true lower bound: partial coverage, or still catching up
+      api≈?    no defensible dollar figure: grey when nothing is reconstructed
+               yet (neutral, not a warning), amber when usage exists but
+               none of it could be priced
+      host≈$N  Session only: Claude Code's own estimate, when reconstruction
+               is unavailable (never Today, never mixed with api figures)
+    A trailing `*` marks a stale snapshot, shown because this render lost the
+    ledger lock. `compact` drops the api/host words and keeps the provenance
+    symbol, for narrow boxes."""
+    scope = scope if isinstance(scope, dict) else {}
+    state = scope.get("state") or "unavailable"
+    api = "" if compact else "api"
+    host = scope.get("host") if allow_host else None
+    if state == "unavailable":
+        if isinstance(host, (int, float)) and not isinstance(host, bool) and host >= 0:
+            text, tone = ("h" if compact else "host") + "≈" + usd_fine(host), "host"
+        else:
+            text, tone = api + "≈?", "none"
+    elif state == "complete":
+        text, tone = api + "≈" + usd_fine(scope.get("cost")), "ok"
+    else:
+        reasons = set(scope.get("reasons") or ())
+        used = num(scope.get("in")) + num(scope.get("out")) > 0
+        if num(scope.get("pd")) <= 0 and used and reasons & PRICING_REASONS:
+            text, tone = api + "≈?", "unknown"
+        else:
+            text, tone = api + "≥" + usd_fine(scope.get("cost")), "partial"
+    if scope.get("stale"):
+        text += "*"
+    return text, tone
+
+
+def cost_cell(scope, width, allow_host=False):
+    """The colored cost cell: the full label when it fits `width` visible
+    columns, else the compact form, so a figure is never clipped mid-number."""
+    text, tone = cost_label(scope, allow_host)
+    if len(text) > width:
+        text, tone = cost_label(scope, allow_host, compact=True)
+    # Amber only where coverage genuinely needs attention; "none" (nothing
+    # reconstructed) stays neutral, since amber is a status signal.
+    color = {"ok": OK, "partial": WARN, "unknown": WARN, "host": GREY, "none": GREY}.get(tone, GREY)
+    return f"{color}{text}{RESET}"
+
+
 def seg_lines(data):
     add = get(data, "cost", "total_lines_added")
     rem = get(data, "cost", "total_lines_removed")

package/plugins/ca-pi/hooks/_subagentslib.py

@@ -2,10 +2,12 @@
 # codeArbiter — statusline subagent-rows helpers (extracted from statusline.py,
 # architecture-004).
 #
-# Owns resolving the current session's subagents directory, reading its recent
-# `.jsonl` transcripts (deduped per requestId, same rule as the Session/Today
-# rows), and labeling each subagent from its first user message. Carries no
-# rendering concern — the statusline turns the returned dicts into rows.
+# Owns resolving the current session's subagents directory and turning the
+# accounting scanner's per-child presentation summaries (from the ledger record)
+# into rows, plus labeling a subagent from its first user message (sub_label is
+# called BY that scanner). It never parses a child transcript itself: the render
+# path has one JSONL parser (_ledgerlib). No rendering concern — the statusline
+# turns the returned dicts into rows.
 #
 # Design principles (mirroring _ledgerlib.py):
 #   - Stdlib only; no third-party imports ever.
@@ -14,11 +16,10 @@
 #
 # Public API:
 #   subagent_dir(data, root, sid) -> str|None
-#   read_subagents(sdir) -> (active, recent, shown, (tot_in, tot_out))
+#   read_subagents(sdir, rec=None) -> (active, recent, shown, (tot_in, tot_out))
 #   sub_label(content) -> str
 #   display_model(model_id) -> str
 
-import json
 import os
 import re
 import time
@@ -35,8 +36,7 @@ except Exception:  # pragma: no cover — never let an import break the statusli
 ACTIVE_WINDOW = 150       # secs: a subagent file touched this recently is "active"
 SHOW_WINDOW = 600         # secs: still display recently-finished subagents
 MAX_SUB_ROWS = 4
-MAX_SUB_FILES = 12        # hot-path bound: parse at most this many files / render
-MAX_SUB_LINES = 2500      # per-file line cap
+MAX_SUB_FILES = 12        # rows considered per render (presentation bound, not accounting)
 
 
 def display_model(model_id):
@@ -88,17 +88,24 @@ def subagent_dir(data, root, sid):
     return None
 
 
-def read_subagents(sdir):
-    """Return (active, recent, shown[{label,inp,out,age,active}], (tot_in, tot_out)).
+def read_subagents(sdir, rec=None):
+    """Return (active, recent, shown[{label,model,inp,out,age,active}], (tot_in, tot_out)).
     `active` = files touched within ACTIVE_WINDOW (a liveness proxy); `recent` =
     all files within SHOW_WINDOW (active + recently finished).
 
+    Rows come from the accounting scanner's per-source PRESENTATION SUMMARIES in
+    the ledger record `rec` (spec D-7): label, observed models and owner-attributed
+    tokens, with fork-replayed parent requests excluded. This reader only lists
+    the directory and stats files for liveness. It never opens or parses a child
+    transcript, so the render path has exactly one JSONL parser. A child the
+    scanner has not reached yet shows its fallback name and zero tokens until it
+    has.
+
     ONE result shape on EVERY path (#413). The element types are stable — int,
     int, list, (int|float, int|float) — so a caller may unpack four names
     unconditionally. statusline.py does exactly that, OUTSIDE its safe()
-    wrapper, so an error branch returning a shorter tuple was a hard ValueError
-    that erased the entire subagent section on a routine directory race. An
-    unreadable/absent directory is an EMPTY result, not a different result."""
+    wrapper, so an error branch returning a shorter tuple would be a hard
+    ValueError. An unreadable/absent directory is an EMPTY result."""
     empty = (0, 0, [], (0, 0))
     now = time.time()
     files = []
@@ -117,61 +124,20 @@ def read_subagents(sdir):
         return empty
     files.sort(reverse=True)   # most-recently-touched first
 
+    sources = rec.get("src") if isinstance(rec, dict) else None
+    sources = sources if isinstance(sources, dict) else {}
     active = sum(1 for mtime, _, _, _ in files if now - mtime <= ACTIVE_WINDOW)
     shown, tot_in, tot_out = [], 0, 0
-    for mtime, size, fp, nm in files[:MAX_SUB_FILES]:
+    for mtime, size, _fp, nm in files[:MAX_SUB_FILES]:
         if size > 16 * 1024 * 1024:
             continue
-        reqs = {}
-        models = []
-        label = None
-        try:
-            with open(fp, encoding="utf-8", errors="replace") as f:
-                for i, ln in enumerate(f):
-                    if i > MAX_SUB_LINES:
-                        break
-                    ln = ln.strip()
-                    if not ln:
-                        continue
-                    try:
-                        d = json.loads(ln)
-                    except ValueError:
-                        continue
-                    if not isinstance(d, dict):
-                        # A transcript line may be ANY valid JSON value; only an
-                        # object carries an event. `[]`/`null`/`3`/`"s"` used to
-                        # reach .get() below inside a try that caught OSError
-                        # only, so one such line raised AttributeError out of
-                        # read_subagents and blanked every subagent row (#413).
-                        continue
-                    msg = d.get("message")
-                    if not isinstance(msg, dict):
-                        continue
-                    if label is None and msg.get("role") == "user":
-                        label = sub_label(msg.get("content"))
-                    if msg.get("role") == "assistant":
-                        raw_model = msg.get("model")
-                        if isinstance(raw_model, str) and raw_model.strip():
-                            raw_model = raw_model.strip()
-                            if raw_model not in models:
-                                models.append(raw_model)
-                    u = msg.get("usage")
-                    if isinstance(u, dict):
-                        # dedupe by requestId; fresh input only (cache reads excluded)
-                        # — same definition as the Session/Today rows.
-                        reqs[d.get("requestId") or msg.get("id") or i] = (
-                            num(u.get("input_tokens")) + num(u.get("cache_creation_input_tokens")),
-                            num(u.get("output_tokens")))
-        except Exception:  # noqa: BLE001 — #413: the error boundary is PER FILE
-            # One unreadable or structurally surprising transcript must cost
-            # only its own row, never the rest of the directory. Widened from
-            # OSError so a shape the reader has not anticipated degrades the
-            # same way malformed JSON already does (the module's standing
-            # "never raise on malformed input" contract) instead of escaping
-            # into the statusline and blanking every subagent row.
-            continue
-        inp = sum(v[0] for v in reqs.values())
-        out = sum(v[1] for v in reqs.values())
+        summary = sources.get("c:" + nm)
+        summary = summary if isinstance(summary, dict) else {}
+        tok = summary.get("tok")
+        inp, out = ((num(tok[0]), num(tok[1])) if isinstance(tok, list) and len(tok) == 2
+                    else (0, 0))
+        models = [m for m in (summary.get("models") or []) if isinstance(m, str)]
+        label = summary.get("label") if isinstance(summary.get("label"), str) else None
         tot_in += inp
         tot_out += out
         if len(shown) < MAX_SUB_ROWS: