@compr/opscontext-mcp 2.5.2 → 2.5.4

package/dist/cli.js

@@ -226,6 +226,52 @@ function generateMcpJson() {
 // ---------------------------------------------------------------------------
 // Template for pre-commit hook (CE doc freshness + secret scanner)
 // ---------------------------------------------------------------------------
+/**
+ * 🔒 LOCKED [SKIPPING-A-HOOK-MUST-NAME-WHAT-IS-UNENFORCED] — 2026-08-20
+ * ⛔ NEVER print a bare "already exists, skipping" for a hook slot. NEVER overwrite or
+ *    append to a foreign hook either.
+ * WHY: `init` refuses to clobber an existing hook, which is right, but it said so with one
+ *      grey line among a column of green ticks. The user reads "init done" and believes the
+ *      policy gates are live; in that repo they were never installed and enforce nothing.
+ *      This is exactly §E1 arriving through a different door: there, the rule existed and no
+ *      hook called it; here, a hook exists and does not call the rule. Both produce a gate
+ *      that is present in every document and absent at runtime, and neither produces an error.
+ *      A real instance is on this machine: invocme-odoo-connector has a hand-written
+ *      pre-commit, so `init` skipped it, and none of that repo's CE gates have ever run.
+ *      Appending instead is not the fix, and is how that repo ended up with a whole secret
+ *      scanner sitting unreachable behind an earlier `exit 0`.
+ * FIX: on skip, read the existing hook. If it does not invoke the CE CLI, say which gates are
+ *      therefore unenforced and print the one line that wires them in. Silence here reads as
+ *      success.
+ */
+function existingHookInvokesCE(path) {
+    try {
+        const body = readFileSync(path, "utf-8");
+        return /\b(contextengine|opscontext)\b/.test(body);
+    }
+    catch {
+        // Unreadable is not proof of absence; say nothing rather than claim a verdict.
+        return true;
+    }
+}
+function warnSkippedHook(path, slot) {
+    if (existingHookInvokesCE(path))
+        return;
+    const gates = {
+        "pre-commit": "secret-scan, doc-coverage, rule-parity",
+        "commit-msg": "commit-message-required",
+        "post-commit": "audit trail of the push",
+    };
+    const wire = {
+        "pre-commit": 'contextengine hook secret-scan && contextengine hook doc-coverage && contextengine hook rule-parity',
+        "commit-msg": 'contextengine hook commit-message-required "$1"',
+        "post-commit": "contextengine end-session",
+    };
+    console.log(`     ⚠️  that hook never calls ContextEngine, so these enforce NOTHING here:`);
+    console.log(`        ${gates[slot]}`);
+    console.log(`        Wire them by adding this line to ${path}:`);
+    console.log(`          ${wire[slot]}`);
+}
 function generatePreCommitHook() {
     const lines = [];
     lines.push("#!/bin/zsh");
@@ -508,7 +554,8 @@ async function runInit() {
             const postCommitDest = join(hooksDir, "post-commit");
             const commitMsgDest = join(hooksDir, "commit-msg");
             if (existsSync(preCommitDest)) {
-                console.log("  ⏭  .git/hooks/pre-commit already exists — skipping");
+                console.log("  ⏭  .git/hooks/pre-commit already exists — skipping (never overwritten)");
+                warnSkippedHook(preCommitDest, "pre-commit");
                 skipped++;
             }
             else {
@@ -523,7 +570,8 @@ async function runInit() {
             // [COMMIT-MSG-HOOK-MUST-BE-INSTALLED] — without this, every
             // commit_message_required rule is silently unenforced.
             if (existsSync(commitMsgDest)) {
-                console.log("  ⏭  .git/hooks/commit-msg already exists — skipping");
+                console.log("  ⏭  .git/hooks/commit-msg already exists — skipping (never overwritten)");
+                warnSkippedHook(commitMsgDest, "commit-msg");
                 skipped++;
             }
             else {
@@ -536,7 +584,8 @@ async function runInit() {
                 }
             }
             if (existsSync(postCommitDest)) {
-                console.log("  ⏭  .git/hooks/post-commit already exists — skipping");
+                console.log("  ⏭  .git/hooks/post-commit already exists — skipping (never overwritten)");
+                warnSkippedHook(postCommitDest, "post-commit");
                 skipped++;
             }
             else {
@@ -601,11 +650,9 @@ import { listLearnings, learningsToChunks, learningsStats, formatLearnings, save
 import { saveSession, loadSession, listSessions, deleteSession, formatSession, formatSessionList, } from "./sessions.js";
 import { activate, deactivate, getActivationStatus, gateCheck, } from "./activation.js";
 import { syncTierA, syncTierB, loadCommunityStore, communityRulesToChunks, mergeWithDedup, STORE_PATH as COMMUNITY_STORE_PATH, } from "./community-sync.js";
-import { readAuditLog, verifyChain, filterByRange, toCsv, rotateAuditLog, planRotation, listSegments, } from "./audit.js";
+import { readAuditLog, verifyChain, filterByRange, toCsv, rotateAuditLog, planRotation, listSegments, acknowledgeRedaction, } from "./audit.js";
 import { loadRepoPolicy, parsePolicy, formatPolicySummary, formatValidationErrors, repoPolicyPath, } from "./policy.js";
-import { collectRuns, metricsFor, transcriptRoot, emptyTally, addTally, totalTokens, pricingStatus, pricingFor, } from "./transcript-collector.js";
-import { DEFAULT_PRICING, DEFAULT_PRICING_ASOF } from "./default-pricing.js";
-import { runTranscriptHeuristics, DEFAULT_COST_THRESHOLDS, } from "./detector.js";
+import { buildCostReport } from "./cost-report.js";
 import { getStagedFiles, runSecretScan, runDocCoverage, runCommitMessageRequired, runRuleParity, formatSecretViolations, formatDocCoverageViolations, formatSecretViolationsJson, formatDocCoverageViolationsJson, formatCommitMessageViolations, formatCommitMessageViolationsJson, formatRuleParityViolations, formatRuleParityViolationsJson, } from "./hooks.js";
 import { safeAppend } from "./audit.js";
 import { installSkill, locateBundledSkill, buildManagedBlock, syncClaudeMd, } from "./claude-integration.js";
@@ -1917,12 +1964,39 @@ function cliAuditRotate(args) {
         process.exit(2);
     }
 }
+/** Acknowledge deliberately redacted audit records on the chain. [LOCK] [REDACTION-IS-A-CHAINED-RECORD] */
+function cliAuditRedactAck(args) {
+    const idxAt = args.indexOf("--index");
+    const reasonAt = args.indexOf("--reason");
+    const raw = idxAt >= 0 ? args[idxAt + 1] ?? "" : "";
+    const reason = reasonAt >= 0 ? args[reasonAt + 1] ?? "" : "";
+    const indices = raw.split(",").map((x) => Number(x.trim())).filter((n) => Number.isInteger(n) && n >= 0);
+    if (indices.length === 0 || !reason.trim()) {
+        console.error(`usage: contextengine audit-redact-ack --index <i,j,k> --reason "<what was removed and why>"`);
+        console.error(`   Indices are the ones 'audit-verify' lists as altered. Only altered records can be acknowledged.`);
+        process.exit(1);
+    }
+    const r = acknowledgeRedaction(indices, reason, "cli");
+    for (const x of r.rejected)
+        console.error(`  ✗ ${x.index}: ${x.why}`);
+    if (!r.record) {
+        console.error(`\nNothing acknowledged.`);
+        process.exit(1);
+    }
+    console.log(`\n✅ Acknowledged ${r.acknowledged.length} redacted record(s): ${r.acknowledged.join(", ")}`);
+    console.log(`   Chained as audit.redact, hash ${r.record.hash.slice(0, 16)}…`);
+    const after = verifyChain();
+    console.log(`   audit-verify now: ${after.ok ? "OK" : "FAILED"}, ${(after.redactedIndices ?? []).length} redacted, ${(after.tamperedIndices ?? []).length} altered.`);
+}
 async function cliAuditVerify() {
     const report = verifyChain();
     const forks = report.forkIndices ?? [];
+    const redacted = report.redactedIndices ?? [];
     if (report.ok) {
         console.log(`✅ Audit chain verified — ${report.total} record(s).`);
-        console.log(`   No record was altered, and no history is missing.`);
+        console.log(redacted.length === 0
+            ? `   No record was altered, and no history is missing.`
+            : `   No history is missing. ${redacted.length} record(s) redacted and acknowledged on the chain (indices ${redacted.slice(0, 8).join(", ")}${redacted.length > 8 ? ", …" : ""}), 0 altered.`);
         if (forks.length > 0) {
             // [VERIFY-FORK-IS-NOT-TAMPER] — surface this, but do not call it tampering.
             console.log(`\n⚠️  ${forks.length} concurrent-append fork(s) detected (not tampering).`);
@@ -1941,6 +2015,11 @@ async function cliAuditVerify() {
         console.error(`\n   Altered records (content does not match its own hash):`);
         console.error(`     ${t.slice(0, 10).join(", ")}${t.length > 10 ? `, … (+${t.length - 10} more)` : ""}`);
         console.error(`   This is tampering: the record's bytes were changed after it was written.`);
+        console.error(`   If this was a deliberate redaction of a secret, acknowledge it on the chain:`);
+        console.error(`     contextengine audit-redact-ack --index ${t.slice(0, 3).join(",")} --reason "<what was removed and why>"`);
+    }
+    if (redacted.length > 0) {
+        console.error(`\n   Also ${redacted.length} redacted record(s), acknowledged on the chain, not counted above.`);
     }
     if ((report.orphanIndices ?? []).length > 0) {
         const o = report.orphanIndices;
@@ -2325,218 +2404,28 @@ function cliStats() {
     }
 }
 // ---------------------------------------------------------------------------
-// cost — multi-agent spend, read from Claude Code's own transcripts
+// cost — multi-agent spend, read from Claude Code's own transcripts.
+// Rendered by src/cost-report.ts, shared with the MCP tool. [LOCK] [COST-REPORT-ONE-RENDERER]
 // ---------------------------------------------------------------------------
-function fmtTok(n) {
-    if (n >= 1e6)
-        return `${(n / 1e6).toFixed(1)}M`;
-    if (n >= 1e3)
-        return `${(n / 1e3).toFixed(0)}k`;
-    return String(n);
-}
-function fmtDur(ms) {
-    if (ms === null || !Number.isFinite(ms))
-        return "—";
-    const s = Math.round(ms / 1000);
-    if (s < 60)
-        return `${s}s`;
-    const m = Math.floor(s / 60);
-    if (m < 60)
-        return `${m}m${String(s % 60).padStart(2, "0")}s`;
-    return `${Math.floor(m / 60)}h${String(m % 60).padStart(2, "0")}m`;
-}
-/** Resolve cost thresholds + pricing from policy, falling back to defaults. */
-function loadCostThresholds(cwd) {
-    const res = loadRepoPolicy(cwd);
-    if (res && res.ok && res.policy.agent_cost) {
-        const a = res.policy.agent_cost;
-        // [DEFAULT-RATES-SHIP-WITH-THE-PACKAGE] — an agent_cost block that omits
-        // `pricing` must not silently price nothing.
-        const hasOwnRates = a.pricing.length > 0;
-        return {
-            t: {
-                billing_mode: a.billing_mode,
-                pricing: hasOwnRates ? a.pricing : DEFAULT_PRICING,
-                min_cache_efficiency: a.min_cache_efficiency,
-                max_tool_calls_per_agent: a.max_tool_calls_per_agent,
-                max_cost_per_agent_usd: a.max_cost_per_agent_usd,
-                min_fanout_for_canary: a.min_fanout_for_canary,
-                max_failed_share: a.max_failed_share,
-            },
-            source: ".contextengine/policy.json" +
-                (hasOwnRates ? "" : ` (rates: built-in, as of ${DEFAULT_PRICING_ASOF})`),
-        };
-    }
-    return {
-        t: DEFAULT_COST_THRESHOLDS,
-        source: `built-in defaults, rates as of ${DEFAULT_PRICING_ASOF} (no agent_cost in policy.json)`,
-    };
-}
 async function cliCost(argv) {
     const flag = (name) => {
         const i = argv.indexOf(`--${name}`);
         return i >= 0 ? argv[i + 1] : undefined;
     };
-    const json = argv.includes("--json");
     const topRaw = flag("top");
-    const top = topRaw ? Math.max(1, parseInt(topRaw, 10) || 10) : 10;
     const daysRaw = flag("days");
-    const since = daysRaw ? Date.now() - parseInt(daysRaw, 10) * 86_400_000 : undefined;
-    const cwd = process.cwd();
-    const { t, source } = loadCostThresholds(cwd);
-    const runs = collectRuns({
+    const report = buildCostReport({
         session: flag("session"),
         project: flag("project"),
         run: flag("run"),
-        since,
+        top: topRaw ? parseInt(topRaw, 10) || 10 : 10,
+        days: daysRaw ? parseInt(daysRaw, 10) || undefined : undefined,
     });
-    if (!runs.length) {
-        console.log("No multi-agent runs found in " + transcriptRoot());
-        console.log("(fan-outs only: parent sessions are not counted — this measures delegation)");
+    if (argv.includes("--json") && report.json) {
+        console.log(JSON.stringify(report.json, null, 2));
         return;
     }
-    const scored = runs
-        .map((r) => ({ run: r, m: metricsFor(r, t.pricing) }))
-        .sort((a, b) => b.m.cost.total - a.m.cost.total);
-    const signals = runTranscriptHeuristics(runs, t);
-    if (json) {
-        console.log(JSON.stringify({
-            billing_mode: t.billing_mode,
-            cost_is_notional: t.billing_mode === "subscription",
-            thresholds_source: source,
-            runs: scored.map(({ run, m }) => ({
-                runId: run.runId, kind: run.kind, project: run.project, sessionId: run.sessionId,
-                volume: run.totals, intensity: {
-                    agents: m.agents, reported: m.reported, failed: m.failed,
-                    capacityExhausted: m.capacityExhausted, toolCalls: m.toolCalls,
-                    medianToolCalls: m.medianToolCalls, durationMs: run.durationMs,
-                    launchedBeforeFirstReport: m.launchedBeforeFirstReport,
-                },
-                cost: m.cost, cacheEfficiency: Number.isFinite(m.cacheEfficiency) ? m.cacheEfficiency : null,
-                outputShare: m.outputShare,
-            })),
-            signals,
-        }, null, 2));
-        return;
-    }
-    // Aggregate across everything in scope.
-    let vol = emptyTally();
-    let agents = 0, toolCalls = 0, failed = 0, capacity = 0, reported = 0;
-    let cost = 0, withoutCache = 0, unpriced = 0;
-    // Which models carried tokens but matched no rate — named in the output so
-    // the fix is actionable instead of "something was unpriced".
-    const unpricedModels = new Set();
-    for (const { run, m } of scored) {
-        for (const a of run.agents) {
-            for (const [model, tally] of a.tokensByModel) {
-                if (totalTokens(tally) > 0 && !pricingFor(model, t.pricing)) {
-                    unpricedModels.add(model ?? "(no model recorded)");
-                }
-            }
-        }
-        vol = addTally(vol, run.totals);
-        agents += m.agents;
-        toolCalls += m.toolCalls;
-        failed += m.failed;
-        capacity += m.capacityExhausted;
-        reported += m.reported;
-        cost += m.cost.total;
-        withoutCache += m.cost.withoutCache;
-        unpriced += m.cost.unpricedTokens;
-    }
-    const allTok = totalTokens(vol);
-    const cw = vol.cacheWrite5m + vol.cacheWrite1h;
-    console.log("");
-    console.log(`MULTI-AGENT COST — ${scored.length} run(s), ${agents} subagents`);
-    console.log(`thresholds: ${source}`);
-    console.log("");
-    // ── 1. VOLUME ───────────────────────────────────────────────────────────
-    console.log("VOLUME (tokens moved)");
-    const volRow = (label, n) => console.log(`  ${label.padEnd(16)} ${fmtTok(n).padStart(8)}  ${allTok ? ((100 * n) / allTok).toFixed(1).padStart(5) : "  0.0"}%`);
-    volRow("cache read", vol.cacheRead);
-    volRow("cache write", cw);
-    volRow("input (fresh)", vol.input);
-    volRow("output", vol.output);
-    console.log(`  ${"total".padEnd(16)} ${fmtTok(allTok).padStart(8)}`);
-    console.log("");
-    // ── 2. VALUED COST ──────────────────────────────────────────────────────
-    const notional = t.billing_mode === "subscription";
-    let ci = 0, ccw = 0, ccr = 0, co = 0;
-    for (const { m } of scored) {
-        ci += m.cost.input;
-        ccw += m.cost.cacheWrite;
-        ccr += m.cost.cacheRead;
-        co += m.cost.output;
-    }
-    const agg = {
-        input: ci, cacheWrite: ccw, cacheRead: ccr, output: co,
-        total: cost, withoutCache, unpricedTokens: unpriced,
-    };
-    const status = pricingStatus(agg);
-    console.log(`VALUED COST (API list prices)${notional && status !== "unpriced" ? " — NOTIONAL, NOT BILLED" : ""}`);
-    // [NEVER-RENDER-AN-UNKNOWN-AS-A-NUMBER] — with nothing priced there is no
-    // cost to show. Printing a $0.00 table here reads as "this run was free"
-    // and "caching saved 0%", both false.
-    if (status === "unpriced") {
-        console.log(`  UNPRICED — no rate matched any model in this data, so no cost can be`);
-        console.log(`  stated. ${fmtTok(unpriced)} tokens were moved. This is an unknown, not $0.`);
-        console.log("");
-        console.log(`  Models seen without a rate: ${[...unpricedModels].sort().join(", ") || "(unknown)"}`);
-        console.log(`  Add them to .contextengine/policy.json → agent_cost.pricing.`);
-        console.log("");
-    }
-    else {
-        if (notional) {
-            console.log("  This machine runs Claude Code on a subscription: no dollar below is");
-            console.log("  debited. Use these figures to compare approaches, not as spend.");
-        }
-        const costRow = (label, n) => console.log(`  ${label.padEnd(16)} ${("$" + n.toFixed(2)).padStart(8)}  ${cost ? ((100 * n) / cost).toFixed(1).padStart(5) : "  0.0"}%`);
-        costRow("cache read", ccr);
-        costRow("cache write", ccw);
-        costRow("input (fresh)", ci);
-        costRow("output", co);
-        console.log(`  ${"total".padEnd(16)} ${("$" + cost.toFixed(2)).padStart(8)}`);
-        console.log(`  ${"without cache".padEnd(16)} ${("$" + withoutCache.toFixed(2)).padStart(8)}  ` +
-            `caching saved $${(withoutCache - cost).toFixed(2)} (${withoutCache ? (100 * (1 - cost / withoutCache)).toFixed(0) : "0"}%)`);
-        if (status === "partial") {
-            console.log(`  ⚠ ${fmtTok(unpriced)} tokens UNPRICED and NOT in the figures above` +
-                ` (${[...unpricedModels].sort().join(", ") || "unknown model"}) — the total is a floor, not the cost`);
-        }
-        console.log("");
-    }
-    // ── 3. INTENSITY (the capacity proxy) ───────────────────────────────────
-    console.log(`INTENSITY (capacity proxy${notional ? " — the scarce resource here" : ""})`);
-    console.log(`  subagents        ${String(agents).padStart(8)}`);
-    console.log(`  reported         ${String(reported).padStart(8)}`);
-    console.log(`  returned nothing ${String(failed).padStart(8)}${failed ? `  (${((100 * failed) / agents).toFixed(0)}% of the fleet)` : ""}`);
-    console.log(`  died at window   ${String(capacity).padStart(8)}${capacity ? "  ← capacity spent for no result" : ""}`);
-    console.log(`  tool calls       ${String(toolCalls).padStart(8)}  (${(toolCalls / Math.max(1, agents)).toFixed(1)}/agent)`);
-    console.log(`  cache reuse      ${(cw ? (vol.cacheRead / cw).toFixed(1) + "x" : "—").padStart(8)}  ${cw && vol.cacheRead / cw < t.min_cache_efficiency ? "← below floor, prefix is being rebuilt" : "(higher is better)"}`);
-    console.log("");
-    // ── Top runs ────────────────────────────────────────────────────────────
-    console.log(`TOP RUNS BY VALUED COST (${Math.min(top, scored.length)} of ${scored.length})`);
-    console.log(`  ${"cost".padStart(8)} ${"agents".padStart(6)} ${"dead".padStart(4)} ${"tools".padStart(5)} ${"reuse".padStart(6)} ${"dur".padStart(7)}  run`);
-    for (const { run, m } of scored.slice(0, top)) {
-        const reuse = Number.isFinite(m.cacheEfficiency) ? m.cacheEfficiency.toFixed(1) + "x" : "—";
-        console.log(`  ${("$" + m.cost.total.toFixed(2)).padStart(8)} ${String(m.agents).padStart(6)} ` +
-            `${String(m.failed).padStart(4)} ${String(m.medianToolCalls).padStart(5)} ${reuse.padStart(6)} ` +
-            `${fmtDur(run.durationMs).padStart(7)}  ${run.runId} ${run.project.replace(/^-Users-yan-/, "")}`);
-    }
-    console.log("");
-    // ── Signals ─────────────────────────────────────────────────────────────
-    if (!signals.length) {
-        console.log("✅ No context_burn or fanout_without_canary signals.");
-    }
-    else {
-        const crit = signals.filter((s) => s.severity === "critical");
-        console.log(`SIGNALS — ${signals.length} (${crit.length} critical)`);
-        for (const s of signals.slice(0, 20)) {
-            console.log(`  ${s.severity === "critical" ? "🔴" : "⚠️ "} [${s.kind}] ${s.reason}`);
-        }
-        if (signals.length > 20)
-            console.log(`  … ${signals.length - 20} more (use --json)`);
-    }
-    console.log("");
+    console.log(report.text);
 }
 /** Package version, read from the installed package.json rather than hardcoded. */
 function readPackageVersion() {
@@ -2586,6 +2475,7 @@ Usage:
                                        Export hash-chained audit log (evidence aligned with
                                        SOC 2 CC7.2 + ISO 27001 A.12.4.1 — not a certification)
   contextengine audit-verify           Verify audit log chain integrity (tamper detection)
+  contextengine audit-redact-ack       Acknowledge deliberately redacted records on the chain (--index i,j --reason "...")
   contextengine audit-rotate [--keep-days N] [--max-records N] [--dry-run]
                                        Move old history into an archive segment. Archives
                                        whatever is older than N days (default 30) OR beyond
@@ -2791,6 +2681,9 @@ else if (command === "sync-claude-md") {
         process.exit(1);
     });
 }
+else if (command === "audit-redact-ack") {
+    cliAuditRedactAck(process.argv.slice(3));
+}
 else if (command === "audit-rotate") {
     cliAuditRotate(process.argv.slice(3));
 }

package/dist/cost-report.d.ts

@@ -0,0 +1,22 @@
+import { type CostThresholds } from "./detector.js";
+export interface CostReportOptions {
+    session?: string;
+    project?: string;
+    run?: string;
+    days?: number;
+    top?: number;
+}
+export interface CostReport {
+    /** Human-readable report, what the CLI prints. */
+    text: string;
+    /** Structured report, what `--json` prints. null when no runs were found. */
+    json: Record<string, unknown> | null;
+    runs: number;
+}
+/** Resolve cost thresholds + pricing from policy, falling back to defaults. */
+export declare function loadCostThresholds(cwd: string): {
+    t: CostThresholds;
+    source: string;
+};
+export declare function buildCostReport(opts?: CostReportOptions, cwd?: string): CostReport;
+//# sourceMappingURL=cost-report.d.ts.map

package/dist/cost-report.js

@@ -0,0 +1,220 @@
+/**
+ * Multi-agent cost report, shared by the CLI (`contextengine cost`) and the MCP tool
+ * (`agent_cost`). One renderer, two surfaces.
+ *
+ * [LOCKED] [COST-REPORT-ONE-RENDERER] — 2026-08-21
+ * [NEVER] render the cost report in cli.ts or index.ts directly.
+ * WHY: the CLI shipped on 2026-08-20 as 170 lines of console.log; an MCP tool written the same
+ *      way would have been a second copy of every threshold, label and guard (NOTIONAL, UNPRICED,
+ *      floor-not-cost) that drifts the first time one of them is edited.
+ * FIX: buildCostReport() returns { text, json }; cli.ts prints, index.ts responds. Both surfaces
+ *      read the same thresholds from .contextengine/policy.json via loadCostThresholds().
+ */
+import { collectRuns, metricsFor, transcriptRoot, emptyTally, addTally, totalTokens, pricingStatus, pricingFor, } from "./transcript-collector.js";
+import { DEFAULT_PRICING, DEFAULT_PRICING_ASOF } from "./default-pricing.js";
+import { runTranscriptHeuristics, DEFAULT_COST_THRESHOLDS, } from "./detector.js";
+import { loadRepoPolicy } from "./policy.js";
+function fmtTok(n) {
+    if (n >= 1e6)
+        return `${(n / 1e6).toFixed(1)}M`;
+    if (n >= 1e3)
+        return `${(n / 1e3).toFixed(0)}k`;
+    return String(n);
+}
+function fmtDur(ms) {
+    if (ms === null || !Number.isFinite(ms))
+        return "—";
+    const s = Math.round(ms / 1000);
+    if (s < 60)
+        return `${s}s`;
+    const m = Math.floor(s / 60);
+    if (m < 60)
+        return `${m}m${String(s % 60).padStart(2, "0")}s`;
+    return `${Math.floor(m / 60)}h${String(m % 60).padStart(2, "0")}m`;
+}
+/** Resolve cost thresholds + pricing from policy, falling back to defaults. */
+export function loadCostThresholds(cwd) {
+    const res = loadRepoPolicy(cwd);
+    if (res && res.ok && res.policy.agent_cost) {
+        const a = res.policy.agent_cost;
+        // [DEFAULT-RATES-SHIP-WITH-THE-PACKAGE] — an agent_cost block that omits
+        // `pricing` must not silently price nothing.
+        const hasOwnRates = a.pricing.length > 0;
+        return {
+            t: {
+                billing_mode: a.billing_mode,
+                pricing: hasOwnRates ? a.pricing : DEFAULT_PRICING,
+                min_cache_efficiency: a.min_cache_efficiency,
+                max_tool_calls_per_agent: a.max_tool_calls_per_agent,
+                max_cost_per_agent_usd: a.max_cost_per_agent_usd,
+                min_fanout_for_canary: a.min_fanout_for_canary,
+                max_failed_share: a.max_failed_share,
+            },
+            source: ".contextengine/policy.json" +
+                (hasOwnRates ? "" : ` (rates: built-in, as of ${DEFAULT_PRICING_ASOF})`),
+        };
+    }
+    return {
+        t: DEFAULT_COST_THRESHOLDS,
+        source: `built-in defaults, rates as of ${DEFAULT_PRICING_ASOF} (no agent_cost in policy.json)`,
+    };
+}
+export function buildCostReport(opts = {}, cwd = process.cwd()) {
+    const out = [];
+    const line = (s = "") => { out.push(s); };
+    const top = Math.max(1, opts.top ?? 10);
+    const since = opts.days ? Date.now() - opts.days * 86_400_000 : undefined;
+    const { t, source } = loadCostThresholds(cwd);
+    const runs = collectRuns({
+        session: opts.session,
+        project: opts.project,
+        run: opts.run,
+        since,
+    });
+    if (!runs.length) {
+        line("No multi-agent runs found in " + transcriptRoot());
+        line("(fan-outs only: parent sessions are not counted — this measures delegation)");
+        return { text: out.join("\n"), json: null, runs: 0 };
+    }
+    const scored = runs
+        .map((r) => ({ run: r, m: metricsFor(r, t.pricing) }))
+        .sort((a, b) => b.m.cost.total - a.m.cost.total);
+    const signals = runTranscriptHeuristics(runs, t);
+    const json = {
+        billing_mode: t.billing_mode,
+        cost_is_notional: t.billing_mode === "subscription",
+        thresholds_source: source,
+        runs: scored.map(({ run, m }) => ({
+            runId: run.runId, kind: run.kind, project: run.project, sessionId: run.sessionId,
+            volume: run.totals, intensity: {
+                agents: m.agents, reported: m.reported, failed: m.failed,
+                capacityExhausted: m.capacityExhausted, toolCalls: m.toolCalls,
+                medianToolCalls: m.medianToolCalls, durationMs: run.durationMs,
+                launchedBeforeFirstReport: m.launchedBeforeFirstReport,
+            },
+            cost: m.cost, cacheEfficiency: Number.isFinite(m.cacheEfficiency) ? m.cacheEfficiency : null,
+            outputShare: m.outputShare,
+        })),
+        signals,
+    };
+    // Aggregate across everything in scope.
+    let vol = emptyTally();
+    let agents = 0, toolCalls = 0, failed = 0, capacity = 0, reported = 0;
+    let cost = 0, withoutCache = 0, unpriced = 0;
+    // Which models carried tokens but matched no rate — named in the output so
+    // the fix is actionable instead of "something was unpriced".
+    const unpricedModels = new Set();
+    for (const { run, m } of scored) {
+        for (const a of run.agents) {
+            for (const [model, tally] of a.tokensByModel) {
+                if (totalTokens(tally) > 0 && !pricingFor(model, t.pricing)) {
+                    unpricedModels.add(model ?? "(no model recorded)");
+                }
+            }
+        }
+        vol = addTally(vol, run.totals);
+        agents += m.agents;
+        toolCalls += m.toolCalls;
+        failed += m.failed;
+        capacity += m.capacityExhausted;
+        reported += m.reported;
+        cost += m.cost.total;
+        withoutCache += m.cost.withoutCache;
+        unpriced += m.cost.unpricedTokens;
+    }
+    const allTok = totalTokens(vol);
+    const cw = vol.cacheWrite5m + vol.cacheWrite1h;
+    line();
+    line(`MULTI-AGENT COST — ${scored.length} run(s), ${agents} subagents`);
+    line(`thresholds: ${source}`);
+    line();
+    // ── 1. VOLUME ───────────────────────────────────────────────────────────
+    line("VOLUME (tokens moved)");
+    const volRow = (label, n) => line(`  ${label.padEnd(16)} ${fmtTok(n).padStart(8)}  ${allTok ? ((100 * n) / allTok).toFixed(1).padStart(5) : "  0.0"}%`);
+    volRow("cache read", vol.cacheRead);
+    volRow("cache write", cw);
+    volRow("input (fresh)", vol.input);
+    volRow("output", vol.output);
+    line(`  ${"total".padEnd(16)} ${fmtTok(allTok).padStart(8)}`);
+    line();
+    // ── 2. VALUED COST ──────────────────────────────────────────────────────
+    const notional = t.billing_mode === "subscription";
+    let ci = 0, ccw = 0, ccr = 0, co = 0;
+    for (const { m } of scored) {
+        ci += m.cost.input;
+        ccw += m.cost.cacheWrite;
+        ccr += m.cost.cacheRead;
+        co += m.cost.output;
+    }
+    const agg = {
+        input: ci, cacheWrite: ccw, cacheRead: ccr, output: co,
+        total: cost, withoutCache, unpricedTokens: unpriced,
+    };
+    const status = pricingStatus(agg);
+    line(`VALUED COST (API list prices)${notional && status !== "unpriced" ? " — NOTIONAL, NOT BILLED" : ""}`);
+    // [NEVER-RENDER-AN-UNKNOWN-AS-A-NUMBER] — with nothing priced there is no
+    // cost to show. Printing a $0.00 table here reads as "this run was free"
+    // and "caching saved 0%", both false.
+    if (status === "unpriced") {
+        line(`  UNPRICED — no rate matched any model in this data, so no cost can be`);
+        line(`  stated. ${fmtTok(unpriced)} tokens were moved. This is an unknown, not $0.`);
+        line();
+        line(`  Models seen without a rate: ${[...unpricedModels].sort().join(", ") || "(unknown)"}`);
+        line(`  Add them to .contextengine/policy.json → agent_cost.pricing.`);
+        line();
+    }
+    else {
+        if (notional) {
+            line("  This machine runs Claude Code on a subscription: no dollar below is");
+            line("  debited. Use these figures to compare approaches, not as spend.");
+        }
+        const costRow = (label, n) => line(`  ${label.padEnd(16)} ${("$" + n.toFixed(2)).padStart(8)}  ${cost ? ((100 * n) / cost).toFixed(1).padStart(5) : "  0.0"}%`);
+        costRow("cache read", ccr);
+        costRow("cache write", ccw);
+        costRow("input (fresh)", ci);
+        costRow("output", co);
+        line(`  ${"total".padEnd(16)} ${("$" + cost.toFixed(2)).padStart(8)}`);
+        line(`  ${"without cache".padEnd(16)} ${("$" + withoutCache.toFixed(2)).padStart(8)}  ` +
+            `caching saved $${(withoutCache - cost).toFixed(2)} (${withoutCache ? (100 * (1 - cost / withoutCache)).toFixed(0) : "0"}%)`);
+        if (status === "partial") {
+            line(`  ⚠ ${fmtTok(unpriced)} tokens UNPRICED and NOT in the figures above` +
+                ` (${[...unpricedModels].sort().join(", ") || "unknown model"}) — the total is a floor, not the cost`);
+        }
+        line();
+    }
+    // ── 3. INTENSITY (the capacity proxy) ───────────────────────────────────
+    line(`INTENSITY (capacity proxy${notional ? " — the scarce resource here" : ""})`);
+    line(`  subagents        ${String(agents).padStart(8)}`);
+    line(`  reported         ${String(reported).padStart(8)}`);
+    line(`  returned nothing ${String(failed).padStart(8)}${failed ? `  (${((100 * failed) / agents).toFixed(0)}% of the fleet)` : ""}`);
+    line(`  died at window   ${String(capacity).padStart(8)}${capacity ? "  ← capacity spent for no result" : ""}`);
+    line(`  tool calls       ${String(toolCalls).padStart(8)}  (${(toolCalls / Math.max(1, agents)).toFixed(1)}/agent)`);
+    line(`  cache reuse      ${(cw ? (vol.cacheRead / cw).toFixed(1) + "x" : "—").padStart(8)}  ${cw && vol.cacheRead / cw < t.min_cache_efficiency ? "← below floor, prefix is being rebuilt" : "(higher is better)"}`);
+    line();
+    // ── Top runs ────────────────────────────────────────────────────────────
+    line(`TOP RUNS BY VALUED COST (${Math.min(top, scored.length)} of ${scored.length})`);
+    line(`  ${"cost".padStart(8)} ${"agents".padStart(6)} ${"dead".padStart(4)} ${"tools".padStart(5)} ${"reuse".padStart(6)} ${"dur".padStart(7)}  run`);
+    for (const { run, m } of scored.slice(0, top)) {
+        const reuse = Number.isFinite(m.cacheEfficiency) ? m.cacheEfficiency.toFixed(1) + "x" : "—";
+        line(`  ${("$" + m.cost.total.toFixed(2)).padStart(8)} ${String(m.agents).padStart(6)} ` +
+            `${String(m.failed).padStart(4)} ${String(m.medianToolCalls).padStart(5)} ${reuse.padStart(6)} ` +
+            `${fmtDur(run.durationMs).padStart(7)}  ${run.runId} ${run.project.replace(/^-Users-yan-/, "")}`);
+    }
+    line();
+    // ── Signals ─────────────────────────────────────────────────────────────
+    if (!signals.length) {
+        line("✅ No context_burn or fanout_without_canary signals.");
+    }
+    else {
+        const crit = signals.filter((s) => s.severity === "critical");
+        line(`SIGNALS — ${signals.length} (${crit.length} critical)`);
+        for (const s of signals.slice(0, 20)) {
+            line(`  ${s.severity === "critical" ? "🔴" : "⚠️ "} [${s.kind}] ${s.reason}`);
+        }
+        if (signals.length > 20)
+            line(`  … ${signals.length - 20} more (use --json)`);
+    }
+    line();
+    return { text: out.join("\n"), json, runs: scored.length };
+}
+//# sourceMappingURL=cost-report.js.map