@cspeach/cli 1.1.18 → 1.1.20

package/dist/cost/cost-log.js

@@ -15,6 +15,29 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { sessionsDir } from '../config/paths.js';
 import { computeCost } from './pricing.js';
+/**
+ * Task 7 — summarise `message_start.message.input_transformations` (probe P4
+ * shape: `[{ type: 'thinking_dropped', path, reason }]`). Counts the
+ * `thinking_dropped` entries and lists each distinct reason once ('unknown'
+ * when an entry has none). Returns undefined for absent, empty or malformed
+ * input, and when nothing was dropped — so the cost-line key stays absent.
+ */
+export function summariseInputTransformations(raw) {
+    if (!Array.isArray(raw))
+        return undefined;
+    let dropped = 0;
+    const reasons = [];
+    for (const t of raw) {
+        if (!t || typeof t !== 'object' || t.type !== 'thinking_dropped')
+            continue;
+        dropped += 1;
+        const r = t.reason;
+        const reason = typeof r === 'string' && r ? r : 'unknown';
+        if (!reasons.includes(reason))
+            reasons.push(reason);
+    }
+    return dropped > 0 ? { dropped, reasons } : undefined;
+}
 /**
  * Path to a session's cost log file. Co-located with the session JSON so
  * deletion cleans up both atomically.
@@ -39,6 +62,20 @@ export function buildEntry(opts) {
         entry.credits_charged = opts.credits.charged;
         entry.balance_credits = opts.credits.balance;
     }
+    if (opts.served_model !== undefined)
+        entry.served_model = opts.served_model;
+    if (opts.call_index !== undefined)
+        entry.call_index = opts.call_index;
+    if (opts.kind !== undefined)
+        entry.kind = opts.kind;
+    if (opts.refusal_category !== undefined)
+        entry.refusal_category = opts.refusal_category;
+    if (opts.input_transformations !== undefined)
+        entry.input_transformations = opts.input_transformations;
+    if (opts.reader && opts.reader.calls > 0) {
+        entry.reader_cost_usd = Math.round(opts.reader.cost * 10000) / 10000;
+        entry.reader_calls = opts.reader.calls;
+    }
     return entry;
 }
 /**
@@ -90,7 +127,22 @@ export function summarise(entries) {
     const totals = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 };
     let total = 0;
     const perModel = new Map();
+    const readerByTurn = new Map();
+    let lines = 0;
     for (const e of entries) {
+        if (typeof e.reader_calls === 'number' && e.reader_calls > 0) {
+            const prev = readerByTurn.get(e.turn);
+            if (!prev || e.reader_calls > prev.calls || (e.reader_cost_usd ?? 0) > prev.cost) {
+                readerByTurn.set(e.turn, {
+                    cost: Math.max(prev?.cost ?? 0, e.reader_cost_usd ?? 0),
+                    calls: Math.max(prev?.calls ?? 0, e.reader_calls),
+                });
+            }
+        }
+        // Fix M3 — a zero-token reader rollup line (interrupted turn) is not a model call.
+        if (e.kind === 'reader_rollup')
+            continue;
+        lines += 1;
         total += e.cost;
         totals.input += e.tokens.input;
         totals.output += e.tokens.output;
@@ -109,10 +161,18 @@ export function summarise(entries) {
         slot.tokens.cacheCreate += e.tokens.cacheCreate;
         perModel.set(e.model, slot);
     }
+    let readerCost = 0;
+    let readerCalls = 0;
+    for (const r of readerByTurn.values()) {
+        readerCost += r.cost;
+        readerCalls += r.calls;
+    }
     return {
-        totalCost: Math.round(total * 10000) / 10000,
+        totalCost: Math.round((total + readerCost) * 10000) / 10000,
         totalTokens: totals,
-        turns: entries.length,
+        turns: lines,
         byModel: [...perModel.entries()].map(([model, v]) => ({ model, ...v })),
+        readerCost: Math.round(readerCost * 10000) / 10000,
+        readerCalls,
     };
 }

package/dist/cost/pricing.js

@@ -11,7 +11,9 @@
  * BOTH this file AND the proxy's version. Verify on the public pricing page:
  *   https://www.anthropic.com/pricing
  *
- * Last verified 2026-06-07. Same as proxy.
+ * Last verified 2026-09-27. Same as proxy. The claude-opus-5-5 row comes from
+ * the Opus 5.5 section of the model migration guide. The two tables are pinned
+ * in sync by src/cost/__tests__/pricing-drift-pin.test.ts.
  *
  * 2026-06-07 SYNC: e294cff switched the default model to claude-opus-4-8 AND
  * applied the 3x Opus correction, but only to the proxy copy — this CLI copy
@@ -22,8 +24,12 @@
  * Unknown models → returns null + records the model name to a process-level
  * Set so we surface them as an obvious warning rather than silently zeroing.
  */
+import { recordFullNotice } from '../renderer/notice-log.js';
 import { getServerModelConfig } from '../models/server-config.js';
 const PRICING = {
+    // Claude Opus 5.5 (2026-09-27, migration guide) — $4/$20, cache read $0.20
+    // (0.05x input, not 10%), 5-minute cache write $5 (1.25x input).
+    'claude-opus-5-5': { inputPer1M: 4.00, outputPer1M: 20.00, cacheReadPer1M: 0.20, cacheCreatePer1M: 5.00 },
     // Claude 5 family (2026-09-15) — Opus 5 keeps the Opus 4.5+ rate ($5/$25);
     // Sonnet 5 is $2/$10. Cache read = 10% of input, cache write = 1.25x input.
     'claude-opus-5': { inputPer1M: 5.00, outputPer1M: 25.00, cacheReadPer1M: 0.50, cacheCreatePer1M: 6.25 },
@@ -90,11 +96,10 @@ export function getRate(model) {
         return PRICING[stripDate];
     if (!seenUnknownModels.has(normalized)) {
         seenUnknownModels.add(normalized);
-        // Best-effort warn; don't crash if the console is unavailable.
-        try {
-            console.warn(JSON.stringify({ msg: 'pricing_unknown_model', model: normalized }));
-        }
-        catch { /* noop */ }
+        // Diagnostics never reach the user's screen (fix round 3, item 1): a raw
+        // console.warn bypassed the Ink/classic writers and printed JSON into the
+        // chat, spinner, goodbye and one-shot stderr. Log file only.
+        recordFullNotice('debug', JSON.stringify({ msg: 'pricing_unknown_model', model: normalized }));
     }
     return null;
 }

package/dist/doctor/checks/forge-rules.js

@@ -19,6 +19,7 @@ import { loadConfig } from '../../config/loader.js';
 import { getConnection } from '../../sap/connection-manager.js';
 import { AdtClient, snapshots } from '@cspeach/sap-client';
 import { sapChecksSkipped, standaloneSkip } from './_standalone-skip.js';
+import { verifySyntax } from '../../tools/verify.js';
 const PROBE_NAME = 'Z_CSPEACH_DOCTOR_PROBE';
 const PROBE_PACKAGE = '$TMP';
 const PROBE_SOURCE = `REPORT ${PROBE_NAME}.\nWRITE / 'cspeach doctor probe — safe to delete'.`;
@@ -84,12 +85,21 @@ export async function checkForgeRules() {
             };
         }
         // Step 4: Verify Rule 10 fired — syntax was checked. Re-run syntaxCheck and confirm clean.
-        const syntax = await adt.syntaxCheck('PROG', PROBE_NAME);
-        if (syntax.hasErrors) {
+        // Re-review item 2 — through verifySyntax (fail closed): a check that did
+        // not run is ok:false with its reason, never a throw out of collectChecks.
+        const syntax = await verifySyntax(adt, PROBE_NAME, 'PROG');
+        if (syntax.didNotRun !== undefined) {
             return {
                 name: 'forge-rules',
                 ok: false,
-                message: `Rule 10: syntax check returned errors on probe: ${syntax.messages[0]?.text ?? 'unknown'}`,
+                message: `Rule 10: syntax check did not run: ${syntax.didNotRun.replace(/^Syntax check did not run:?\s*/i, '')}`,
+            };
+        }
+        if (!syntax.ok) {
+            return {
+                name: 'forge-rules',
+                ok: false,
+                message: `Rule 10: syntax check returned errors on probe: ${syntax.errors[0] ?? 'unknown'}`,
             };
         }
         return {

package/dist/doctor/checks/keychain.js

@@ -1,10 +1,12 @@
-import keychain from '../../auth/keychain.js';
+import keychain, { newProbeAccount } from '../../auth/keychain.js';
 export async function checkKeychain() {
     try {
+        // Round 4 item 7 — per-process probe account (see newProbeAccount).
+        const account = newProbeAccount();
         const probe = `probe-${Date.now()}`;
-        await keychain.setPassword('cspeach', 'probe', probe);
-        const ok = (await keychain.getPassword('cspeach', 'probe')) === probe;
-        await keychain.deletePassword('cspeach', 'probe');
+        await keychain.setPassword('cspeach', account, probe);
+        const ok = (await keychain.getPassword('cspeach', account)) === probe;
+        await keychain.deletePassword('cspeach', account);
         if (ok)
             return { name: 'keychain', ok: true, message: 'OS keychain working' };
         return { name: 'keychain', ok: false, message: 'probe write/read mismatch', hint: 'Per-session fallback mode will be used' };

package/dist/doctor/run.js

@@ -14,8 +14,93 @@ import { checkCredits } from './checks/credits.js';
 import { checkForgeRules } from './checks/forge-rules.js';
 import { checkSystemRoles } from './checks/system-roles.js';
 import { checkStandards } from './checks/standards.js';
-export async function runDoctor() {
-    console.log(chalk.cyan.bold('\nCSPeach — doctor\n'));
+import { paint } from '../renderer/theme.js';
+import { getGlyphs } from '../renderer/glyphs.js';
+import { isNoColor } from '../renderer/color-mode.js';
+import { sanitizeControlChars } from '../renderer/sanitize.js';
+import { CLI_VERSION } from '../lib/version.js';
+const NAME_WIDTH = 20;
+/** Check messages can carry server text (HTTP bodies, SAP errors): one line, no control characters. */
+const oneLine = (s) => sanitizeControlChars(s).replace(/\s*\r?\n\s*/g, ' ').trim();
+/** Human name of the terminal CSPeach is running in (for the doctor title). */
+export function terminalName(env = process.env, platform = process.platform) {
+    if (env['WT_SESSION'])
+        return 'Windows Terminal';
+    const tp = env['TERM_PROGRAM'];
+    if (tp === 'vscode')
+        return 'VS Code terminal';
+    if (tp === 'iTerm.app')
+        return 'iTerm2';
+    if (tp === 'Apple_Terminal')
+        return 'Terminal.app';
+    if (tp)
+        return oneLine(tp);
+    if (env['TERM'])
+        return oneLine(env['TERM']);
+    return platform === 'win32' ? 'Windows console' : 'unknown terminal';
+}
+export function colourLevelName(level, noColor = isNoColor()) {
+    if (noColor)
+        return 'no colour (NO_COLOR)';
+    if (level >= 3)
+        return 'truecolor';
+    if (level === 2)
+        return '256 colours';
+    if (level === 1)
+        return '16 colours';
+    return 'no colour';
+}
+/** 1 when any check failed; a skipped check (C.2 permission skip) is not a failure. */
+export function doctorExitCode(checks) {
+    return checks.some((c) => !c.ok && !c.skipped) ? 1 : 0;
+}
+export function formatDoctorTitle(meta) {
+    return ['', `${chalk.bold('CSPeach doctor')}  ${paint('dim', `${meta.version} · ${meta.terminal} · ${meta.colour}`)}`, ''];
+}
+export function formatDoctorRows(checks) {
+    const g = getGlyphs();
+    const lines = [];
+    let passed = 0;
+    let warnings = 0;
+    let failed = 0;
+    for (const c of checks) {
+        let glyph;
+        if (c.skipped) {
+            glyph = paint('warn', g.attention);
+            warnings++;
+        }
+        else if (c.ok) {
+            glyph = paint('ok', g.done);
+            passed++;
+        }
+        else {
+            glyph = paint('bad', g.failed);
+            failed++;
+        }
+        lines.push(`${glyph} ${oneLine(c.name).padEnd(NAME_WIDTH)} ${paint('dim', oneLine(c.message))}`);
+        if (c.hint && oneLine(c.hint) !== '')
+            lines.push(`  ${paint('dim', 'Next:')} ${oneLine(c.hint)}`);
+    }
+    const summary = `${passed} of ${checks.length} checks passed · ${warnings} warning${warnings === 1 ? '' : 's'} · ${failed} failed`;
+    lines.push('', paint('dim', summary), '');
+    return lines;
+}
+/**
+ * Re-review 2 item 3 — the forge-rules probe writes to SAP (create, lock,
+ * write, snapshot list, delete); any throw there (lock refused, snapshot
+ * store unreadable, connection drop) is a failed row with a readable one-line
+ * message, never a crashed doctor run.
+ */
+async function safeForgeRules() {
+    try {
+        return await checkForgeRules();
+    }
+    catch (err) {
+        const msg = String(err?.message ?? err).replace(/\s+/g, ' ').trim().slice(0, 160);
+        return { name: 'forge-rules', ok: false, message: `Rule 7/10 probe failed: ${msg}` };
+    }
+}
+export async function collectChecks() {
     const cfg = await loadConfig();
     const checks = [];
     checks.push(await checkProxy());
@@ -30,23 +115,19 @@ export async function runDoctor() {
     checks.push(await checkCert());
     checks.push(await checkSkill());
     checks.push(await checkKeychainFallback());
-    checks.push(await checkForgeRules());
+    checks.push(await safeForgeRules());
     checks.push(await checkStandards());
-    let failed = 0;
-    for (const c of checks) {
-        const icon = c.skipped
-            ? chalk.yellow('-  ')
-            : c.ok
-                ? chalk.green('OK ')
-                : chalk.red('X  ');
-        console.log(`  ${icon} ${c.name.padEnd(22)} ${c.message}`);
-        if (c.hint)
-            console.log(chalk.gray(`      -> ${c.hint}`));
-        if (!c.ok && !c.skipped)
-            failed++;
-    }
-    console.log(failed === 0
-        ? chalk.green('\nAll checks passed.\n')
-        : chalk.yellow(`\n${failed} check(s) failed.\n`));
-    return failed === 0 ? 0 : 1;
+    return checks;
+}
+export async function runDoctor(deps = {}) {
+    const print = deps.print ?? ((l) => console.log(l));
+    const meta = deps.meta ?? { version: CLI_VERSION, terminal: terminalName(), colour: colourLevelName(chalk.level) };
+    // Title first: the checks take seconds (network), and the user should see
+    // that doctor is running.
+    for (const l of formatDoctorTitle(meta))
+        print(l);
+    const checks = await (deps.collect ?? collectChecks)();
+    for (const l of formatDoctorRows(checks))
+        print(l);
+    return doctorExitCode(checks);
 }

package/dist/index.js

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 import { main } from './cli.js';
-main(process.argv).then((code) => process.exit(code), (err) => {
+import { gracefulExit } from './lib/graceful-exit.js';
+// Round 7 item 5 — close fetch's sockets before exiting (Windows libuv
+// assertion on process.exit with live undici handles, nodejs/node#56645).
+main(process.argv).then((code) => gracefulExit(code), (err) => {
     console.error('cspeach: unhandled error:', err);
-    process.exit(1);
+    return gracefulExit(1);
 });

package/dist/lib/graceful-exit.js

@@ -0,0 +1,56 @@
+/**
+ * Round 7 item 5 — exit without tearing live network handles down under Node.
+ *
+ * On Windows, process.exit() while fetch (Node's built-in undici) still holds
+ * sockets can abort with the libuv assertion
+ * `!(handle->flags & UV_HANDLE_CLOSING), src\win\async.c line 76`
+ * (known Node bug: nodejs/node#56645, #64322). The matrix saw it once after a
+ * routing cancel + /exit. We close fetch's global dispatcher first and give the
+ * loop a short, capped chance to settle, then exit as before.
+ *
+ * Review r7 M-1 — drain with close() (in-flight requests finish) and only
+ * destroy() when that does not finish inside the cap. A fire-and-forget fetch
+ * that rejects inside the window must not surface as a crash on the way out,
+ * so a no-op unhandledRejection guard is installed for the window only.
+ */
+/** The global symbol Node's bundled undici stores its dispatcher under. */
+export const UNDICI_DISPATCHER = Symbol.for('undici.globalDispatcher.1');
+function capped(p, ms) {
+    let timer;
+    return Promise.race([
+        p.then(() => true, () => true),
+        new Promise((r) => { timer = setTimeout(() => r(false), ms); }),
+    ]).finally(() => { if (timer)
+        clearTimeout(timer); });
+}
+function call(fn, self) {
+    try {
+        return Promise.resolve(fn?.call(self));
+    }
+    catch (e) {
+        return Promise.reject(e);
+    }
+}
+export async function gracefulExit(code, opts = {}) {
+    const exit = opts.exit ?? ((c) => process.exit(c));
+    const graceMs = opts.graceMs ?? 250;
+    process.exitCode = code;
+    const guard = () => { };
+    process.on('unhandledRejection', guard);
+    try {
+        const dispatcher = globalThis[UNDICI_DISPATCHER];
+        if (dispatcher) {
+            let done = false;
+            if (typeof dispatcher.close === 'function')
+                done = await capped(call(dispatcher.close, dispatcher), graceMs);
+            if (!done && typeof dispatcher.destroy === 'function')
+                await capped(call(dispatcher.destroy, dispatcher), graceMs);
+        }
+        // One more loop turn so socket 'close' callbacks run before the teardown.
+        await new Promise((r) => setImmediate(r));
+    }
+    finally {
+        process.off('unhandledRejection', guard);
+    }
+    exit(code);
+}

package/dist/lib/piped-prompt.js

@@ -0,0 +1,65 @@
+// A command head: "/name" followed by a space or the end of the line —
+// "/cost", "/abap-explain ZFOO". A path ("/sap/bc/adt/…", "/usr/sap/…") has
+// a second "/" in its first token and is prose (final review B M-3).
+const SCRIPT_LINE = /(^|\n)[ \t]*\/[A-Za-z][\w-]*(?=[ \t]|\r?\n|$)/;
+export function readPipedPrompt(stdin, opts = {}) {
+    if (stdin.isTTY)
+        return Promise.resolve({ kind: 'repl' });
+    const firstMs = opts.firstMs ?? 250;
+    const endMs = opts.endMs ?? 1500;
+    return new Promise((resolve) => {
+        const chunks = [];
+        let sawData = false;
+        let settled = false;
+        let t1;
+        let t2;
+        const text = () => Buffer.concat(chunks).toString('utf8').replace(/^/, '');
+        const done = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            if (t1)
+                clearTimeout(t1);
+            if (t2)
+                clearTimeout(t2);
+            stdin.off('readable', onReadable);
+            stdin.off('end', onEnd);
+            resolve(r);
+        };
+        const giveBack = () => {
+            if (settled)
+                return;
+            if (chunks.length > 0)
+                stdin.unshift(Buffer.concat(chunks));
+            done({ kind: 'repl' });
+        };
+        const onEnd = () => {
+            const t = text().trim();
+            done(t ? { kind: 'prompt', text: t } : { kind: 'repl' });
+        };
+        const onReadable = () => {
+            // EOF with nothing read: leave it unread so the REPL sees the end.
+            if (!sawData && stdin.readableLength === 0) {
+                done({ kind: 'repl' });
+                return;
+            }
+            let c;
+            while ((c = stdin.read()) !== null)
+                chunks.push(Buffer.isBuffer(c) ? c : Buffer.from(c));
+            if (SCRIPT_LINE.test(text())) {
+                giveBack();
+                return;
+            }
+            if (!sawData) {
+                sawData = true;
+                if (t1)
+                    clearTimeout(t1);
+                t2 = setTimeout(giveBack, endMs);
+            }
+        };
+        stdin.on('readable', onReadable);
+        stdin.on('end', onEnd);
+        t1 = setTimeout(() => { if (!sawData)
+            done({ kind: 'repl' }); }, firstMs);
+    });
+}

package/dist/lib/spill-labels.js

@@ -0,0 +1,13 @@
+// What a saved (spilled) tool output came from, so the tool_output_read row
+// names the object ("ZTTT_GAME") instead of the internal spill file path.
+// In-memory for this process only: after a resume the row reads "saved output".
+const labels = new Map();
+/** File name only, so '/' and '\' spellings of the same path match. */
+const keyOf = (p) => p.split(/[\\/]/).pop() ?? p;
+export function rememberSpillLabel(filePath, label) {
+    if (label.trim().length > 0)
+        labels.set(keyOf(filePath), label.trim());
+}
+export function spillLabelFor(filePath) {
+    return labels.get(keyOf(filePath));
+}

package/dist/lock-contention.js

@@ -1,7 +1,7 @@
 import { select } from '@inquirer/prompts';
-import chalk from 'chalk';
+import { formatAttention } from './renderer/notice-shape.js';
 export async function handleLockConflict(info) {
-    console.log(chalk.yellow(`\n⚠  ${info.object} is locked by ${info.user} since ${info.lockTime}.`));
+    console.log('\n' + formatAttention({ text: `${info.object} is locked`, fact: `by ${info.user} since ${info.lockTime}` }).trimEnd());
     return (await select({
         message: 'How do you want to proceed?',
         choices: [

package/dist/models/resolve.js

@@ -8,6 +8,13 @@
 //
 //     env  >  local config  >  server  >  built-in constant
 //
+// Task 12 (2026-09-27) adds the CUSTOMER layer (GET /v1/me/model-config, the
+// admin-set per-customer override) for session_default and effort, between
+// local and server:  env > local (set) > customer > server > built-in.
+// For managed (enforced) customers this is only a prediction — the proxy
+// enforces and the loop adopts the served model; for BYOK it is a default the
+// developer's local config overrides.
+//
 // Locked invariant: with NOTHING set (no env, default_model_set false, no server
 // snapshot) every role resolves to today's constant — byte-identical to before
 // this feature.
@@ -16,10 +23,11 @@
 // read is getServerModelConfig(), a synchronous in-memory snapshot the caller
 // (or the startup fetch) has already populated. `router` is proxy-side only and
 // is deliberately NOT a CLI role.
+import { DEFAULT_CONFIG } from '../config/loader.js';
 import { DEFAULT_SESSION_MODEL } from '../config/model-defaults.js';
 import { PLAN_TIER_SONNET_MODEL } from '../commands/plan-model-tier.js';
 import { COMPACTION_MODEL } from '../commands/compact.js';
-import { getServerModelConfig } from './server-config.js';
+import { getCustomerModelConfig, getServerModelConfig, isEffort } from './server-config.js';
 /** First non-empty (trimmed) candidate in precedence order, else the built-in. */
 function firstSet(candidates, builtin) {
     for (const c of candidates) {
@@ -31,7 +39,8 @@ function firstSet(candidates, builtin) {
 }
 /**
  * Resolve the model for a pipeline role. Precedence: env > local config >
- * server > built-in constant.
+ * server > built-in constant; `session_default` also reads the customer layer
+ * (Task 12) between local and server.
  *
  * `session_default` reads the local `default_model` ONLY when `default_model_set`
  * is true — i.e. the user's config file explicitly carried the key. The value
@@ -46,6 +55,7 @@ export function resolveModelRole(role, cfg, env = process.env) {
             return firstSet([
                 env.CSPEACH_DEFAULT_MODEL,
                 cfg.default_model_set ? cfg.default_model : undefined,
+                getCustomerModelConfig()?.model ?? undefined,
                 server?.roles.session_default,
             ], DEFAULT_SESSION_MODEL);
         case 'audit':
@@ -59,3 +69,84 @@ export function resolveModelRole(role, cfg, env = process.env) {
         }
     }
 }
+/**
+ * Integration finding N1 (2026-09-28) — the model a call is SENT with. For a
+ * managed session-role call of a customer whose model is ENFORCED
+ * (/v1/me/model-config `enforced: true`), the proxy serves the customer's
+ * model (or, when the row names none, the global session default) whatever
+ * the body asks. The CLI sends that model itself, so everything decided from
+ * the call's model — deferred vs static tools, max_tokens, block_binding,
+ * effort acceptance — is right on call 0, not only after the served id is
+ * adopted. Mirrors the proxy's shouldEnforce: session role only (audit,
+ * compact and reader are never enforced), managed only (BYOK has no proxy to
+ * enforce). Anything else ⇒ `requested` unchanged.
+ */
+export function callModelFor(requested, i) {
+    if (i.providerMode !== 'managed')
+        return requested;
+    if ((i.role ?? 'session_default') !== 'session_default')
+        return requested;
+    const customer = getCustomerModelConfig();
+    if (customer?.enforced !== true)
+        return requested;
+    const enforced = customer.model?.trim() || getServerModelConfig()?.roles.session_default?.trim();
+    return enforced || requested;
+}
+// ── Effort (Task 4, 2026-09-27) ─────────────────────────────────────────────
+//
+// Ruling F2: `output_config.effort` is sent only when effort was set by an
+// explicit act. Precedence:
+//
+//     env CSPEACH_EFFORT  >  `config set effort` (effort_set)  >  served
+//     effort.session_default  >  undefined (⇒ output_config omitted)
+//
+// A bare stored `effort` (the pre-sparse full save wrote effort = "xhigh" into
+// every config.toml) is ignored: loadConfig sets effort_set only when the file
+// also carries the `effort_explicit = true` marker `config set effort` writes.
+// Invalid values at any layer fall through. Task 12 adds the customer layer
+// (/v1/me/model-config) between local and served.
+export function resolveEffort(cfg, env = process.env) {
+    const fromEnv = env.CSPEACH_EFFORT?.trim();
+    if (isEffort(fromEnv))
+        return fromEnv;
+    if (cfg.effort_set === true && isEffort(cfg.effort))
+        return cfg.effort;
+    const customer = getCustomerModelConfig()?.effort;
+    if (isEffort(customer))
+        return customer;
+    const served = getServerModelConfig()?.effort?.session_default;
+    if (isEffort(served))
+        return served;
+    return undefined;
+}
+/**
+ * Probe P1 (2026-09-27): claude-haiku-4-5 rejects `output_config.effort` with
+ * a 400 ("This model does not support the effort parameter."). Every
+ * claude-haiku-4-5* id (incl. dated ids such as claude-haiku-4-5-20251001) is
+ * treated as not accepting effort, so the caller drops it — this covers the
+ * compact role, which runs on Haiku by default.
+ */
+export function modelAcceptsEffort(model) {
+    return !model.trim().toLowerCase().startsWith('claude-haiku-4-5');
+}
+/**
+ * Task 19 (model control, 2026-09-27, ruling F12) — the effective auto-compact
+ * threshold, in context tokens (the last call's input + cache read + cache
+ * write):
+ *
+ *     explicit file `[compact] auto_threshold_tokens`
+ *       > served `auto_compact_tokens` (admin; managed mode)
+ *       > DEFAULT_CONFIG.compact.auto_threshold_tokens (150 000)
+ *
+ * "Explicit" is `cfg.compact_threshold_set` (loadConfig): a stored 1 000 000
+ * is the old full-save default and counts as unset.
+ */
+export function resolveAutoCompactThreshold(cfg) {
+    if (cfg.compact_threshold_set === true && Number.isFinite(cfg.compact?.auto_threshold_tokens)) {
+        return cfg.compact.auto_threshold_tokens;
+    }
+    const served = getServerModelConfig()?.auto_compact_tokens;
+    if (typeof served === 'number' && Number.isFinite(served))
+        return served;
+    return DEFAULT_CONFIG.compact.auto_threshold_tokens;
+}