@cspeach/cli 1.1.19 → 1.1.20

package/dist/cli.js

@@ -119,6 +119,17 @@ export async function main(argv) {
     }
     if (args[0] === 'config' && args[1] === 'show') {
         const { runConfigShow } = await import('./commands/config-show.js');
+        if (args.length === 2) {
+            // Task 12 — the full dump ends with "# model set by your account admin"
+            // when /v1/me/model-config says the admin's model is enforced. Capped at
+            // 1.5 s and fail-open: offline / signed out ⇒ the output is unchanged.
+            const [{ loadConfig }, { getStore }, { loadCustomerModelConfig }] = await Promise.all([
+                import('./config/loader.js'),
+                import('./auth/api-key.js'),
+                import('./models/server-config.js'),
+            ]);
+            await loadCustomerModelConfig(await loadConfig(), async () => (await (await getStore()).get()) ?? '', { timeoutMs: 1500 }).catch(() => { });
+        }
         await runConfigShow(args.slice(2));
         return 0;
     }

package/dist/commands/auto-compact.js

@@ -1,9 +1,11 @@
 /**
  * Auto-compact orchestration — Phase 2 #9 (2026-05-16).
  *
- * Calls `runCompact` end-of-turn when the session has crossed
- * `compact.auto_threshold_tokens` non-cached input tokens AND enough turns
- * have passed since the last auto-compact run.
+ * Calls `runCompact` end-of-turn when the last model call's full context
+ * (input + cache read + cache write — Task 19, ruling F12) has reached
+ * `compact.auto_threshold_tokens` AND enough turns have passed since the last
+ * auto-compact run. The caller passes the RESOLVED threshold (file > served
+ * `auto_compact_tokens` > 150 000; see models/resolve.ts).
  *
  * Why end-of-turn (not start-of-turn): firing at the end means the cost
  * (one Haiku call to summarise) is amortised over the user's natural
@@ -21,7 +23,11 @@
  */
 import chalk from 'chalk';
 import { saveSession } from '../session/store.js';
-import { runCompact, formatCompactResult, } from './compact.js';
+import { runCompact, planCompaction, canCompact } from './compact.js';
+/** The number the gate compares: the context size, else the legacy counter. */
+function gateTokens(input) {
+    return input.lastContextTokens ?? input.sessionInputTokens ?? 0;
+}
 /**
  * Pure decision function — no IO. Decides whether auto-compact should
  * fire given the current session state and config. Extracted so the
@@ -29,11 +35,11 @@ import { runCompact, formatCompactResult, } from './compact.js';
  * Summariser.
  */
 export function shouldAutoCompact(input) {
-    const { sessionInputTokens, turnNumber, lastAutoCompactTurn, config } = input;
+    const { turnNumber, lastAutoCompactTurn, config } = input;
     if (!config.auto_enabled) {
         return { fire: false, reason: 'disabled' };
     }
-    if (sessionInputTokens < config.auto_threshold_tokens) {
+    if (gateTokens(input) < config.auto_threshold_tokens) {
         return { fire: false, reason: 'below-threshold' };
     }
     // Throttle: don't bounce. If we just ran auto-compact a few turns ago
@@ -43,7 +49,10 @@ export function shouldAutoCompact(input) {
     const turnsSince = lastAutoCompactTurn === undefined
         ? Number.POSITIVE_INFINITY
         : turnNumber - lastAutoCompactTurn;
-    if (turnsSince < config.min_turns_between_auto) {
+    // Final review I4 — a marker ahead of the turn number (a legacy marker from
+    // the old user-message count, which shrinks after a compaction) never
+    // throttles; the loop now passes a monotonic per-session counter.
+    if (turnsSince >= 0 && turnsSince < config.min_turns_between_auto) {
         return { fire: false, reason: 'throttled' };
     }
     return { fire: true };
@@ -58,19 +67,28 @@ export function shouldAutoCompact(input) {
 export async function maybeAutoCompact(params) {
     const { session, config, turnNumber, summarise } = params;
     const emit = params.emit ?? ((line) => console.log(line));
-    const decision = shouldAutoCompact({
+    const gate = {
+        lastContextTokens: session.last_context_tokens,
         sessionInputTokens: session.usage?.input_tokens ?? 0,
+    };
+    const decision = shouldAutoCompact({
+        ...gate,
         turnNumber,
         lastAutoCompactTurn: session.lastAutoCompactTurn,
         config,
     });
     if (!decision.fire)
         return;
-    // Banner BEFORE the work so the user understands the pause they're about
-    // to see. ~3s for a Haiku call on a long history.
-    emit('');
-    emit(chalk.yellow(`⚙  auto-compact: session crossed ${config.auto_threshold_tokens.toLocaleString()} input tokens`
-        + ` — summarising older turns to keep the next turn cheap.`));
+    // Task 19 — at 150k a session can cross the gate with too few user turns
+    // for runCompact to cut anything (it would return "nothing to do"). Stay
+    // silent then, instead of printing the line on every turn (canCompact is
+    // the predicate runCompact's own bail-outs use).
+    if (!canCompact(planCompaction(session.messages, config.keep_recent_turns), config.keep_recent_turns))
+        return;
+    // Task 19 — ONE short line, printed when the work is done so it can carry
+    // the backup path (the one-step rollback). A failure prints its own line.
+    const head = `⚙  auto-compact: context ${gateTokens(gate).toLocaleString('en-US')} tokens ≥ `
+        + `${config.auto_threshold_tokens.toLocaleString('en-US')}`;
     try {
         const result = await runCompact({
             session,
@@ -82,13 +100,12 @@ export async function maybeAutoCompact(params) {
             // runCompact already saved the session inside its happy path, but we
             // mutate one more field (the throttle marker) so re-save to capture it.
             await saveSession(session);
+            emit(chalk.yellow(`${head} — older turns summarised · backup: ${result.backupPath}`));
         }
-        emit(formatCompactResult(result, config.keep_recent_turns));
     }
     catch (err) {
         // Defensive: never let a summariser blow take down the turn.
         const msg = err instanceof Error ? err.message : String(err);
-        emit(chalk.yellow(`⚙  auto-compact bailed: ${msg}`));
-        emit(chalk.dim('   session left intact; /compact still available manually.'));
+        emit(chalk.yellow(`⚙  auto-compact bailed: ${msg} — session left intact; /compact still works.`));
     }
 }

package/dist/commands/compact.js

@@ -216,6 +216,32 @@ export function buildSummaryMessage(summary, droppedTurns, todos) {
         ].join('\n'),
     };
 }
+const THINKING_BLOCK_TYPES = new Set(['thinking', 'redacted_thinking']);
+/** Text left in an assistant message that held only thinking (an interrupted turn): the API rejects empty content. */
+export const THINKING_ONLY_PLACEHOLDER = '(thinking removed by /compact)';
+/**
+ * Task 7 — drop `thinking` / `redacted_thinking` blocks from an assistant
+ * message. User messages and string content are returned unchanged (the same
+ * object); every other block is kept as-is and in order. Never mutates the
+ * input. Idempotent.
+ */
+export function stripThinking(m) {
+    if (m.role !== 'assistant' || !Array.isArray(m.content))
+        return m;
+    const blocks = m.content;
+    if (!blocks.some((b) => THINKING_BLOCK_TYPES.has(b?.type ?? '')))
+        return m;
+    const rest = blocks.filter((b) => !THINKING_BLOCK_TYPES.has(b?.type ?? ''));
+    return { ...m, content: rest.length > 0 ? rest : [{ type: 'text', text: THINKING_ONLY_PLACEHOLDER }] };
+}
+/**
+ * Task 19 — true when `plan` leaves enough older history for runCompact to
+ * summarise. The one predicate runCompact's bail-outs and the auto-compact
+ * silent check share.
+ */
+export function canCompact(plan, keepRecentTurns) {
+    return plan.userPromptCount >= keepRecentTurns && plan.toSummarise.length >= MIN_COMPACT_THRESHOLD;
+}
 /**
  * Top-level compact orchestration. Pure async function — caller wires it
  * into the REPL slash dispatcher. Throws only on catastrophic IO failure
@@ -229,7 +255,8 @@ export async function runCompact(opts) {
     const { session, summarise } = opts;
     const keep = opts.keepRecentTurns ?? KEEP_RECENT_TURNS;
     const plan = planCompaction(session.messages, keep);
-    // Bail if there's not enough older history to be worth compacting.
+    // Bail if there's not enough older history to be worth compacting
+    // (the two checks canCompact combines; kept apart for their messages).
     if (plan.userPromptCount < keep) {
         return {
             performed: false,
@@ -262,7 +289,15 @@ export async function runCompact(opts) {
     // we accept losing the original first prompt because the summary should
     // mention what the goal was.)
     const summaryMsg = buildSummaryMessage(summary, plan.toSummarise.length, session.todos);
-    session.messages = [summaryMsg, ...plan.toKeep];
+    // Task 7 — the API's conversation check rejects a replayed thinking block
+    // whose earlier turns changed (Opus 5.5 binds each block to the exact prefix
+    // that produced it). The summary changed them, so the kept tail goes out
+    // without thinking; text and tool calls stay. The backup above keeps all.
+    const kept = plan.toKeep.map(stripThinking);
+    session.messages = [summaryMsg, ...kept];
+    // Task 19 — the recorded context size described the old history; the next
+    // call records the new one. Clearing it keeps the auto-compact gate honest.
+    delete session.last_context_tokens;
     await saveSession(session);
     return {
         performed: true,

package/dist/commands/config-set.js

@@ -96,7 +96,7 @@ function errUnset(msg) {
  * Internal, loader-derived flags that are never serialised (stripped by
  * saveConfig). They must never be targets of `config set`/`config unset`.
  */
-const INTERNAL_KEYS = new Set(['default_model_set', 'file_keys']);
+const INTERNAL_KEYS = new Set(['default_model_set', 'effort_set', 'file_keys']);
 /**
  * Virtual keys whose values live in the OS keychain, not config.toml. `config
  * unset` cannot remove them — that is a keychain operation — so they are
@@ -266,6 +266,10 @@ export async function runConfigUnset(args) {
     }
     const cfg = await loadConfig();
     const removed = unsetConfigKey(cfg, key);
+    // Task 4 — `effort` and its explicit marker go together: removing the value
+    // without the marker would leave a stale marker for a later bare effort.
+    if (key === 'effort')
+        unsetConfigKey(cfg, 'effort_explicit');
     if (!removed) {
         console.log(chalk.dim(`${key} was not set — nothing to unset.`));
         return;
@@ -459,6 +463,11 @@ export async function runConfigSet(args) {
                 err(`Invalid effort value "${value}". Allowed: ${EFFORT_VALUES.join(', ')}`);
             }
             cfg.effort = value;
+            // Task 4 (ruling F2) — the marker makes this an explicit act: only then
+            // does resolveEffort send output_config.effort. Kept on save even when
+            // the value equals the built-in default (xhigh).
+            cfg.effort_explicit = true;
+            markExplicit(cfg, 'effort_explicit');
             break;
         case 'telemetry':
             if (!TELEMETRY_VALUES.includes(value)) {

package/dist/commands/config-show.js

@@ -2,6 +2,7 @@ import chalk from 'chalk';
 import { loadConfig } from '../config/loader.js';
 import { paint } from '../renderer/theme.js';
 import { formatAttention } from '../renderer/notice-shape.js';
+import { getCustomerModelConfig } from '../models/server-config.js';
 /**
  * Dotted paths of keys that must never appear in plaintext config output.
  * SAP passwords live in the keychain and should never land in config.toml,
@@ -25,6 +26,10 @@ const REDACTED_KEYS = new Set([
 const INTERNAL_KEYS = new Set([
     'default_model_set',
     'file_keys',
+    // Task 4 — effort_set is loader-derived; effort_explicit is the stored
+    // marker behind it (plumbing, not a user-facing setting).
+    'effort_set',
+    'effort_explicit',
 ]);
 function formatTomlValue(value) {
     if (typeof value === 'string')
@@ -138,6 +143,12 @@ export async function runConfigShow(args) {
         console.log(chalk.gray('# ~/.cspeach/config.toml'));
         printConfigAsToml(cfg);
         console.log('');
+        // Task 12 — one trailing line when the account admin's model is enforced
+        // by the proxy (/v1/me/model-config). No snapshot ⇒ output unchanged.
+        const customer = getCustomerModelConfig();
+        if (customer?.model && customer.enforced) {
+            console.log(chalk.gray(`# model set by your account admin: ${customer.model} (enforced)`));
+        }
         return;
     }
     const keyPath = args[0];

package/dist/commands/cost.js

@@ -25,6 +25,9 @@ function summariseCredits(entries) {
     let total = 0;
     let unknown = 0;
     for (const e of entries) {
+        // Final review I6 — a zero-token reader rollup line is not a turn.
+        if (e.kind === 'reader_rollup')
+            continue;
         if (typeof e.credits_charged === 'number')
             total += e.credits_charged;
         else
@@ -73,6 +76,12 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
     emit(panelRow('output', s.totalTokens.output.toLocaleString().padStart(12)));
     emit(panelRow('cache read', s.totalTokens.cacheRead.toLocaleString().padStart(12)));
     emit(panelRow('cache create', s.totalTokens.cacheCreate.toLocaleString().padStart(12)));
+    // Task 18 fix M3 — reader subagent spend (already inside the total above).
+    // USD only: in credits mode the balance delta already carries it.
+    if (s.readerCalls > 0 && !inCredits) {
+        emit('');
+        emit(panelRow('Readers', `${s.readerCalls} run${s.readerCalls === 1 ? '' : 's'}   ${formatCost(s.readerCost)}`));
+    }
     if (s.byModel.length > 1) {
         emit('');
         emit(chalk.bold('By model:'));
@@ -88,9 +97,12 @@ export async function runCostCommand(sessionId, credits = globalCredits.snapshot
         emit(panelRow('Model', modelText(s.byModel[0].model)));
     }
     // Recent turns — last 5, most recent first. Piece 2: one count format, "N of M" (P1's countLabel).
-    const recent = entries.slice(-5).reverse();
+    // Final review I6 — reader rollup lines (interrupted turns) are not turns:
+    // they stay out of the list and the count (summarise() already skips them).
+    const turnEntries = entries.filter((e) => e.kind !== 'reader_rollup');
+    const recent = turnEntries.slice(-5).reverse();
     emit('');
-    emit(chalk.bold(`Recent turns · ${countLabel(recent.length, entries.length)}`));
+    emit(chalk.bold(`Recent turns · ${countLabel(recent.length, turnEntries.length)}`));
     for (const e of recent) {
         const tok = (e.tokens.input + e.tokens.output).toLocaleString();
         // Credits mode: the per-turn figure is what the LEDGER charged (a balance

package/dist/commands/plan-audit.js

@@ -635,6 +635,7 @@ export async function runPhaseAudit(args) {
                 // read-only filter (which still exposes file_read/grep/glob).
                 toolFilter: () => false,
                 modelOverride: auditModel,
+                modelRole: 'audit',
                 suppressSaveHook: true,
                 signal: controller.signal,
             });

package/dist/config/loader.js

@@ -12,6 +12,11 @@ import { sanitiseStandaloneProfile } from '../sap/standalone-profile.js';
 export function isValidWriteMode(v) {
     return v === 'auto' || v === 'approval-gated' || v === 'advisory-only';
 }
+export const DEFAULT_KEEPALIVE = Object.freeze({
+    enabled: true,
+    in_turn_pings: 11,
+    idle_pings: 4,
+});
 export const DEFAULT_CONFIG = {
     proxy_url: 'https://api.cspeach.dev',
     default_model: DEFAULT_SESSION_MODEL,
@@ -46,9 +51,10 @@ export const DEFAULT_CONFIG = {
     compact: {
         keep_recent_turns: 5,
         auto_enabled: true,
-        auto_threshold_tokens: 1_000_000,
+        auto_threshold_tokens: 150_000,
         min_turns_between_auto: 5,
     },
+    keepalive: DEFAULT_KEEPALIVE,
 };
 /**
  * Coerce a possibly-bad `compact` block from disk into a safe CompactConfig.
@@ -78,6 +84,43 @@ function sanitiseCompact(raw) {
         min_turns_between_auto: intInRange(r.min_turns_between_auto, d.min_turns_between_auto, 1, 100),
     };
 }
+/** The old DEFAULT the pre-sparse full save wrote into every config file. */
+const LEGACY_SAVED_AUTO_THRESHOLD = 1_000_000;
+/**
+ * Task 19 (ruling F12) — does the FILE's `[compact]` table set the threshold by
+ * an explicit act? A numeric value counts, except 1_000_000: that is the old
+ * default a full save wrote, so it reads as unset (same reasoning as effort,
+ * F2). The stored value itself is left as-is (so a later save keeps writing
+ * 1_000_000, which stays "unset", instead of baking in a value that would beat
+ * the served `auto_compact_tokens`).
+ */
+function fileSetsAutoThreshold(raw) {
+    if (!raw || typeof raw !== 'object')
+        return false;
+    const v = raw.auto_threshold_tokens;
+    return typeof v === 'number' && Number.isFinite(v) && Math.floor(v) !== LEGACY_SAVED_AUTO_THRESHOLD;
+}
+/**
+ * Coerce a possibly-bad `keepalive` block from disk (same defensive pattern as
+ * sanitiseCompact): missing / wrong type → defaults; counts floored and
+ * clamped (in_turn_pings 0..20, idle_pings 0..10).
+ */
+function sanitiseKeepalive(raw) {
+    const d = DEFAULT_KEEPALIVE;
+    if (!raw || typeof raw !== 'object')
+        return { ...d };
+    const r = raw;
+    const intInRange = (v, fallback, lo, hi) => {
+        if (typeof v !== 'number' || !Number.isFinite(v))
+            return fallback;
+        return Math.min(hi, Math.max(lo, Math.floor(v)));
+    };
+    return {
+        enabled: typeof r.enabled === 'boolean' ? r.enabled : d.enabled,
+        in_turn_pings: intInRange(r.in_turn_pings, d.in_turn_pings, 0, 20),
+        idle_pings: intInRange(r.idle_pings, d.idle_pings, 0, 10),
+    };
+}
 /**
  * Resolve the effective TLS options for a SAP system, applying the legacy
  * `sslVerify: false` → insecure mapping. A configured `ca_cert_path` always
@@ -195,6 +238,13 @@ export async function loadConfig() {
             // `default_model` key (file presence, not the value). Lets an explicit user
             // choice beat a served roles.session_default. Stripped by saveConfig.
             default_model_set: Object.prototype.hasOwnProperty.call(parsed, 'default_model'),
+            // effort_set: INTERNAL flag (ruling F2) — true only when the FILE carries
+            // a string `effort` AND the `effort_explicit = true` marker that
+            // `config set effort` writes. Stripped by saveConfig.
+            effort_set: parsed.effort_explicit === true && typeof parsed.effort === 'string',
+            // compact_threshold_set: INTERNAL flag (Task 19) — only present when true,
+            // so a loaded config without it keeps its exact old shape.
+            ...(fileSetsAutoThreshold(parsed.compact) ? { compact_threshold_set: true } : {}),
             // sap: ALWAYS a fresh top-level object, never the shared DEFAULT_CONFIG.sap
             // reference. Without this, a file lacking `[sap.*]` would leave
             // `merged.sap === DEFAULT_CONFIG.sap`; the onboarding wizard then mutating
@@ -216,6 +266,7 @@ export async function loadConfig() {
             // field (e.g. just `keep_recent_turns = 10`) still gets the four
             // unspecified defaults — and a typo'd field falls through harmlessly.
             compact: sanitiseCompact(parsed.compact),
+            keepalive: sanitiseKeepalive(parsed.keepalive),
             shell_exec: parsed.shell_exec === undefined ? undefined : { allow },
         };
         // Drop the legacy `local_files` key entirely when it isn't a genuine on
@@ -369,7 +420,9 @@ export async function saveConfig(config) {
     const fileKeys = config.file_keys ?? [];
     // Strip the INTERNAL flags — both are derived on load (file presence /
     // file-key snapshot) and must never be written back into config.toml.
-    const { default_model_set: _dropSet, file_keys: _dropKeys, ...toWrite } = config;
+    // effort_set is internal too (Task 4); the stored marker effort_explicit is kept.
+    // compact_threshold_set is internal too (Task 19).
+    const { default_model_set: _dropSet, effort_set: _dropEffortSet, compact_threshold_set: _dropThresholdSet, file_keys: _dropKeys, ...toWrite } = config;
     // Sparse serialisation: drop any key that the file did NOT carry AND whose
     // value is deep-equal to the built-in default. Keys absent from DEFAULT_CONFIG
     // (optional keys like audit_model) never deep-equal a defined value, so any

package/dist/cost/cost-log.js

@@ -15,6 +15,29 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { sessionsDir } from '../config/paths.js';
 import { computeCost } from './pricing.js';
+/**
+ * Task 7 — summarise `message_start.message.input_transformations` (probe P4
+ * shape: `[{ type: 'thinking_dropped', path, reason }]`). Counts the
+ * `thinking_dropped` entries and lists each distinct reason once ('unknown'
+ * when an entry has none). Returns undefined for absent, empty or malformed
+ * input, and when nothing was dropped — so the cost-line key stays absent.
+ */
+export function summariseInputTransformations(raw) {
+    if (!Array.isArray(raw))
+        return undefined;
+    let dropped = 0;
+    const reasons = [];
+    for (const t of raw) {
+        if (!t || typeof t !== 'object' || t.type !== 'thinking_dropped')
+            continue;
+        dropped += 1;
+        const r = t.reason;
+        const reason = typeof r === 'string' && r ? r : 'unknown';
+        if (!reasons.includes(reason))
+            reasons.push(reason);
+    }
+    return dropped > 0 ? { dropped, reasons } : undefined;
+}
 /**
  * Path to a session's cost log file. Co-located with the session JSON so
  * deletion cleans up both atomically.
@@ -39,6 +62,20 @@ export function buildEntry(opts) {
         entry.credits_charged = opts.credits.charged;
         entry.balance_credits = opts.credits.balance;
     }
+    if (opts.served_model !== undefined)
+        entry.served_model = opts.served_model;
+    if (opts.call_index !== undefined)
+        entry.call_index = opts.call_index;
+    if (opts.kind !== undefined)
+        entry.kind = opts.kind;
+    if (opts.refusal_category !== undefined)
+        entry.refusal_category = opts.refusal_category;
+    if (opts.input_transformations !== undefined)
+        entry.input_transformations = opts.input_transformations;
+    if (opts.reader && opts.reader.calls > 0) {
+        entry.reader_cost_usd = Math.round(opts.reader.cost * 10000) / 10000;
+        entry.reader_calls = opts.reader.calls;
+    }
     return entry;
 }
 /**
@@ -90,7 +127,22 @@ export function summarise(entries) {
     const totals = { input: 0, output: 0, cacheRead: 0, cacheCreate: 0 };
     let total = 0;
     const perModel = new Map();
+    const readerByTurn = new Map();
+    let lines = 0;
     for (const e of entries) {
+        if (typeof e.reader_calls === 'number' && e.reader_calls > 0) {
+            const prev = readerByTurn.get(e.turn);
+            if (!prev || e.reader_calls > prev.calls || (e.reader_cost_usd ?? 0) > prev.cost) {
+                readerByTurn.set(e.turn, {
+                    cost: Math.max(prev?.cost ?? 0, e.reader_cost_usd ?? 0),
+                    calls: Math.max(prev?.calls ?? 0, e.reader_calls),
+                });
+            }
+        }
+        // Fix M3 — a zero-token reader rollup line (interrupted turn) is not a model call.
+        if (e.kind === 'reader_rollup')
+            continue;
+        lines += 1;
         total += e.cost;
         totals.input += e.tokens.input;
         totals.output += e.tokens.output;
@@ -109,10 +161,18 @@ export function summarise(entries) {
         slot.tokens.cacheCreate += e.tokens.cacheCreate;
         perModel.set(e.model, slot);
     }
+    let readerCost = 0;
+    let readerCalls = 0;
+    for (const r of readerByTurn.values()) {
+        readerCost += r.cost;
+        readerCalls += r.calls;
+    }
     return {
-        totalCost: Math.round(total * 10000) / 10000,
+        totalCost: Math.round((total + readerCost) * 10000) / 10000,
         totalTokens: totals,
-        turns: entries.length,
+        turns: lines,
         byModel: [...perModel.entries()].map(([model, v]) => ({ model, ...v })),
+        readerCost: Math.round(readerCost * 10000) / 10000,
+        readerCalls,
     };
 }

package/dist/cost/pricing.js

@@ -11,7 +11,9 @@
  * BOTH this file AND the proxy's version. Verify on the public pricing page:
  *   https://www.anthropic.com/pricing
  *
- * Last verified 2026-06-07. Same as proxy.
+ * Last verified 2026-09-27. Same as proxy. The claude-opus-5-5 row comes from
+ * the Opus 5.5 section of the model migration guide. The two tables are pinned
+ * in sync by src/cost/__tests__/pricing-drift-pin.test.ts.
  *
  * 2026-06-07 SYNC: e294cff switched the default model to claude-opus-4-8 AND
  * applied the 3x Opus correction, but only to the proxy copy — this CLI copy
@@ -25,9 +27,11 @@
 import { recordFullNotice } from '../renderer/notice-log.js';
 import { getServerModelConfig } from '../models/server-config.js';
 const PRICING = {
+    // Claude Opus 5.5 (2026-09-27, migration guide) — $4/$20, cache read $0.20
+    // (0.05x input, not 10%), 5-minute cache write $5 (1.25x input).
+    'claude-opus-5-5': { inputPer1M: 4.00, outputPer1M: 20.00, cacheReadPer1M: 0.20, cacheCreatePer1M: 5.00 },
     // Claude 5 family (2026-09-15) — Opus 5 keeps the Opus 4.5+ rate ($5/$25);
     // Sonnet 5 is $2/$10. Cache read = 10% of input, cache write = 1.25x input.
-    'claude-opus-5-5': { inputPer1M: 4.00, outputPer1M: 20.00, cacheReadPer1M: 0.20, cacheCreatePer1M: 5.00 },
     'claude-opus-5': { inputPer1M: 5.00, outputPer1M: 25.00, cacheReadPer1M: 0.50, cacheCreatePer1M: 6.25 },
     'claude-sonnet-5': { inputPer1M: 2.00, outputPer1M: 10.00, cacheReadPer1M: 0.20, cacheCreatePer1M: 2.50 },
     // Claude Opus 4.5+ — input 5, output 25, cache_read 0.50, cache_write 6.25 (1.25x input).

package/dist/lib/spill-labels.js

@@ -0,0 +1,13 @@
+// What a saved (spilled) tool output came from, so the tool_output_read row
+// names the object ("ZTTT_GAME") instead of the internal spill file path.
+// In-memory for this process only: after a resume the row reads "saved output".
+const labels = new Map();
+/** File name only, so '/' and '\' spellings of the same path match. */
+const keyOf = (p) => p.split(/[\\/]/).pop() ?? p;
+export function rememberSpillLabel(filePath, label) {
+    if (label.trim().length > 0)
+        labels.set(keyOf(filePath), label.trim());
+}
+export function spillLabelFor(filePath) {
+    return labels.get(keyOf(filePath));
+}

package/dist/models/resolve.js

@@ -8,6 +8,13 @@
 //
 //     env  >  local config  >  server  >  built-in constant
 //
+// Task 12 (2026-09-27) adds the CUSTOMER layer (GET /v1/me/model-config, the
+// admin-set per-customer override) for session_default and effort, between
+// local and server:  env > local (set) > customer > server > built-in.
+// For managed (enforced) customers this is only a prediction — the proxy
+// enforces and the loop adopts the served model; for BYOK it is a default the
+// developer's local config overrides.
+//
 // Locked invariant: with NOTHING set (no env, default_model_set false, no server
 // snapshot) every role resolves to today's constant — byte-identical to before
 // this feature.
@@ -16,10 +23,11 @@
 // read is getServerModelConfig(), a synchronous in-memory snapshot the caller
 // (or the startup fetch) has already populated. `router` is proxy-side only and
 // is deliberately NOT a CLI role.
+import { DEFAULT_CONFIG } from '../config/loader.js';
 import { DEFAULT_SESSION_MODEL } from '../config/model-defaults.js';
 import { PLAN_TIER_SONNET_MODEL } from '../commands/plan-model-tier.js';
 import { COMPACTION_MODEL } from '../commands/compact.js';
-import { getServerModelConfig } from './server-config.js';
+import { getCustomerModelConfig, getServerModelConfig, isEffort } from './server-config.js';
 /** First non-empty (trimmed) candidate in precedence order, else the built-in. */
 function firstSet(candidates, builtin) {
     for (const c of candidates) {
@@ -31,7 +39,8 @@ function firstSet(candidates, builtin) {
 }
 /**
  * Resolve the model for a pipeline role. Precedence: env > local config >
- * server > built-in constant.
+ * server > built-in constant; `session_default` also reads the customer layer
+ * (Task 12) between local and server.
  *
  * `session_default` reads the local `default_model` ONLY when `default_model_set`
  * is true — i.e. the user's config file explicitly carried the key. The value
@@ -46,6 +55,7 @@ export function resolveModelRole(role, cfg, env = process.env) {
             return firstSet([
                 env.CSPEACH_DEFAULT_MODEL,
                 cfg.default_model_set ? cfg.default_model : undefined,
+                getCustomerModelConfig()?.model ?? undefined,
                 server?.roles.session_default,
             ], DEFAULT_SESSION_MODEL);
         case 'audit':
@@ -59,3 +69,84 @@ export function resolveModelRole(role, cfg, env = process.env) {
         }
     }
 }
+/**
+ * Integration finding N1 (2026-09-28) — the model a call is SENT with. For a
+ * managed session-role call of a customer whose model is ENFORCED
+ * (/v1/me/model-config `enforced: true`), the proxy serves the customer's
+ * model (or, when the row names none, the global session default) whatever
+ * the body asks. The CLI sends that model itself, so everything decided from
+ * the call's model — deferred vs static tools, max_tokens, block_binding,
+ * effort acceptance — is right on call 0, not only after the served id is
+ * adopted. Mirrors the proxy's shouldEnforce: session role only (audit,
+ * compact and reader are never enforced), managed only (BYOK has no proxy to
+ * enforce). Anything else ⇒ `requested` unchanged.
+ */
+export function callModelFor(requested, i) {
+    if (i.providerMode !== 'managed')
+        return requested;
+    if ((i.role ?? 'session_default') !== 'session_default')
+        return requested;
+    const customer = getCustomerModelConfig();
+    if (customer?.enforced !== true)
+        return requested;
+    const enforced = customer.model?.trim() || getServerModelConfig()?.roles.session_default?.trim();
+    return enforced || requested;
+}
+// ── Effort (Task 4, 2026-09-27) ─────────────────────────────────────────────
+//
+// Ruling F2: `output_config.effort` is sent only when effort was set by an
+// explicit act. Precedence:
+//
+//     env CSPEACH_EFFORT  >  `config set effort` (effort_set)  >  served
+//     effort.session_default  >  undefined (⇒ output_config omitted)
+//
+// A bare stored `effort` (the pre-sparse full save wrote effort = "xhigh" into
+// every config.toml) is ignored: loadConfig sets effort_set only when the file
+// also carries the `effort_explicit = true` marker `config set effort` writes.
+// Invalid values at any layer fall through. Task 12 adds the customer layer
+// (/v1/me/model-config) between local and served.
+export function resolveEffort(cfg, env = process.env) {
+    const fromEnv = env.CSPEACH_EFFORT?.trim();
+    if (isEffort(fromEnv))
+        return fromEnv;
+    if (cfg.effort_set === true && isEffort(cfg.effort))
+        return cfg.effort;
+    const customer = getCustomerModelConfig()?.effort;
+    if (isEffort(customer))
+        return customer;
+    const served = getServerModelConfig()?.effort?.session_default;
+    if (isEffort(served))
+        return served;
+    return undefined;
+}
+/**
+ * Probe P1 (2026-09-27): claude-haiku-4-5 rejects `output_config.effort` with
+ * a 400 ("This model does not support the effort parameter."). Every
+ * claude-haiku-4-5* id (incl. dated ids such as claude-haiku-4-5-20251001) is
+ * treated as not accepting effort, so the caller drops it — this covers the
+ * compact role, which runs on Haiku by default.
+ */
+export function modelAcceptsEffort(model) {
+    return !model.trim().toLowerCase().startsWith('claude-haiku-4-5');
+}
+/**
+ * Task 19 (model control, 2026-09-27, ruling F12) — the effective auto-compact
+ * threshold, in context tokens (the last call's input + cache read + cache
+ * write):
+ *
+ *     explicit file `[compact] auto_threshold_tokens`
+ *       > served `auto_compact_tokens` (admin; managed mode)
+ *       > DEFAULT_CONFIG.compact.auto_threshold_tokens (150 000)
+ *
+ * "Explicit" is `cfg.compact_threshold_set` (loadConfig): a stored 1 000 000
+ * is the old full-save default and counts as unset.
+ */
+export function resolveAutoCompactThreshold(cfg) {
+    if (cfg.compact_threshold_set === true && Number.isFinite(cfg.compact?.auto_threshold_tokens)) {
+        return cfg.compact.auto_threshold_tokens;
+    }
+    const served = getServerModelConfig()?.auto_compact_tokens;
+    if (typeof served === 'number' && Number.isFinite(served))
+        return served;
+    return DEFAULT_CONFIG.compact.auto_threshold_tokens;
+}