@event4u/agent-config 14.8.0 → 14.10.0

package/dist/scripts/ai_council/transport_resolver.js

@@ -0,0 +1,418 @@
+/**
+ * Transport resolution for `mode: auto`, plus the two guards that keep it
+ * honest (Phase 2 of `road-to-zero-ceremony-detection`).
+ *
+ * `modes.ts` answers "which mode did the config ask for" — a pure precedence
+ * walk over four layers. This module answers the next question: when that
+ * answer is `auto`, which concrete transport does THIS machine support right
+ * now, how is it billed, and what happens when the chosen rung fails
+ * mid-invocation.
+ *
+ * ## The `auto` chain
+ *
+ *     cli   — the provider's CLI binary resolves AND a credential is present
+ *     api   — else a key resolves
+ *     ∅     — else unavailable, with a one-line reason
+ *
+ * `manual` is deliberately NOT in the chain. It is free and always "available"
+ * (the human is the transport), so an availability-ranked chain would always
+ * end there and `auto` would silently become "ask the human to copy-paste".
+ * Manual stays an explicit opt-in.
+ *
+ * ## The billing invariant
+ *
+ * Billing is classified from (provider, detected auth source) by
+ * `classifyBilling` in `_lib/environment_detector.ts` — never from the
+ * transport this module picked. That is the property that keeps the existing
+ * per-provider rules intact under `auto`:
+ *
+ * - a VENDOR-OFFICIAL CLI under a subscription login is unmetered, so the USD
+ *   cost gate stays off and `cli_call_budget` guards the plan quota instead;
+ * - a COMMUNITY wrapper (`grok`, `perplexity`) shells out to the same paid API
+ *   and stays metered even though the transport is also spelled `cli`;
+ * - an unknown source is metered — deliberately over-gated.
+ *
+ * `makesProviderCall` below IS transport-derived, and is not a billing term:
+ * it records that `manual` performs no provider call at all, which is why no
+ * amount of billing classification applies to it.
+ *
+ * @see docs/contracts/ai-council-config.md § Transport modes
+ */
+import { classifyBilling, isCommunityCli, strongestAuth, PROVIDER_CLI_META, } from '../_lib/environment_detector.js';
+import { resolve_mode } from './modes.js';
+/** The accepted values of the `mode` key, including the resolver-only `auto`. */
+export const VALID_TRANSPORT_MODES = new Set([
+    'api',
+    'manual',
+    'cli',
+    'auto',
+]);
+/** Auth sources that mean "the provider CLI can authenticate". */
+const CLI_AUTH_SOURCES = new Set(['cli-subscription', 'cli-api-key']);
+/** Auth sources that mean "a stored key exists for the api transport". */
+const KEY_AUTH_SOURCES = new Set(['key-file', 'env-key']);
+function hasSource(report, provider, allowed) {
+    return report.auth.some((a) => a.provider === provider && allowed.has(a.source));
+}
+/** Resolved CLI binary for `provider` from the report, or `null`. */
+function cliBinary(report, provider) {
+    const meta = PROVIDER_CLI_META[provider];
+    if (meta === undefined)
+        return null;
+    const binaryName = meta[0];
+    const host = report.hosts.find((h) => h.binary !== null && stripExeSuffix(basename(h.binary)) === binaryName);
+    return host?.binary ?? null;
+}
+/** Last path segment, separator-agnostic (no `node:path` import needed). */
+function basename(p) {
+    const parts = p.split(/[/\\]/);
+    return parts[parts.length - 1] ?? p;
+}
+/** Strip a Windows executable suffix so `claude.cmd` matches `claude`. */
+function stripExeSuffix(name) {
+    return name.replace(/\.(exe|cmd)$/i, '');
+}
+/**
+ * Resolve one member's transport.
+ *
+ * Explicit `api` / `manual` / `cli` pass through unchanged — this function
+ * never overrides a mode the user or a per-member override asked for. Only
+ * `auto` walks the chain.
+ */
+export function resolveTransport(opts) {
+    const { provider, mode, report } = opts;
+    const auth = strongestAuth(report, provider);
+    const authSource = auth?.source ?? null;
+    const billing = classifyBilling(provider, authSource);
+    if (mode === 'manual') {
+        return {
+            available: true,
+            transport: 'manual',
+            // Classified from the auth source like every other member; it is
+            // simply never consulted because no provider call happens.
+            billing,
+            authSource,
+            makesProviderCall: false,
+            reason: null,
+            absentReason: null,
+        };
+    }
+    if (mode === 'api' || mode === 'cli') {
+        return {
+            available: true,
+            transport: mode,
+            billing,
+            authSource,
+            makesProviderCall: true,
+            reason: null,
+            absentReason: null,
+        };
+    }
+    if (mode !== 'auto') {
+        return unavailable(provider, billing, `mode=${JSON.stringify(mode)} is not one of ` +
+            `${[...VALID_TRANSPORT_MODES].sort().join(', ')}`);
+    }
+    // ── the auto chain ──────────────────────────────────────────────────
+    const override = (opts.binaryOverride ?? null)?.trim() ?? null;
+    const binary = override !== null && override !== '' ? override : cliBinary(report, provider);
+    const cliAuthed = hasSource(report, provider, CLI_AUTH_SOURCES);
+    if (binary !== null && cliAuthed) {
+        return {
+            available: true,
+            transport: 'cli',
+            billing,
+            authSource,
+            makesProviderCall: true,
+            reason: null,
+            absentReason: null,
+        };
+    }
+    const keyPresent = opts.apiKeyPresent ?? hasSource(report, provider, KEY_AUTH_SOURCES);
+    if (keyPresent) {
+        return {
+            available: true,
+            transport: 'api',
+            billing,
+            authSource,
+            makesProviderCall: true,
+            reason: null,
+            absentReason: null,
+        };
+    }
+    return unavailable(provider, billing, autoUnavailableReason(provider, binary, cliAuthed), classifyStaticAbsentReason(binary));
+}
+/**
+ * The single reconciled entry point for "given this member's config, what
+ * transport does it actually run on" (road-to-always-on-orchestration
+ * Phase 3.1). Composes `modes.ts::resolve_mode` (which layer decided the
+ * mode) with `resolveTransport` (what `auto` expands to on THIS machine) so
+ * a caller never has to replicate either step by hand.
+ *
+ * This exists because the two functions previously lived at arm's length:
+ * `resolve_mode` can legitimately return the literal string `'auto'`, and
+ * nothing forced a caller to then route that value through
+ * `resolveTransport` — a hand-rolled `mode === 'api' | 'cli' | 'manual'`
+ * switch (the shape `council_cli.ts::build_members` still uses today) has
+ * no `'auto'` case and treats it as an unrecognised transport instead of
+ * expanding it. `resolveMemberTransport` is the fix: there is no longer a
+ * gap between "which mode was configured" and "which transport that becomes"
+ * for any caller that uses it instead of the two functions separately.
+ */
+export function resolveMemberTransport(opts) {
+    const configuredMode = resolve_mode(opts.provider, {
+        invocationMode: opts.invocationMode ?? null,
+        memberSettings: opts.memberSettings ?? null,
+        globalMode: opts.globalMode ?? null,
+    });
+    const resolved = resolveTransport({
+        provider: opts.provider,
+        mode: configuredMode,
+        report: opts.report,
+        binaryOverride: opts.binaryOverride ?? null,
+        // `exactOptionalPropertyTypes` rejects an explicit `undefined` for an
+        // optional-boolean field, so the key is omitted entirely rather than
+        // forwarded as `apiKeyPresent: undefined`.
+        ...(opts.apiKeyPresent !== undefined ? { apiKeyPresent: opts.apiKeyPresent } : {}),
+    });
+    return { ...resolved, configuredMode };
+}
+function unavailable(_provider, billing, reason, absentReason = null) {
+    return {
+        available: false,
+        transport: null,
+        // Unavailable members never spend, but the class stays over-gated so a
+        // caller that ignores `available` cannot read this as "free".
+        billing,
+        authSource: null,
+        makesProviderCall: false,
+        reason,
+        absentReason,
+    };
+}
+/**
+ * `no_binary` when the CLI binary itself never resolved (whether or not a
+ * credential was found — a credential with nothing to run it against is
+ * still "the binary is missing" from the caller's point of view); `no_auth`
+ * when the binary IS present but neither the cli-auth nor the key rung
+ * resolved. Mirrors `autoUnavailableReason`'s three-way branch below.
+ */
+function classifyStaticAbsentReason(binary) {
+    return binary === null ? 'no_binary' : 'no_auth';
+}
+/** The one-line reason `auto` prints when no rung resolved. */
+function autoUnavailableReason(provider, binary, cliAuthed) {
+    const expected = PROVIDER_CLI_META[provider]?.[0] ?? provider;
+    if (binary === null && !cliAuthed) {
+        return (`no transport available: \`${expected}\` is not on PATH and no key resolves ` +
+            `— install the CLI and log in, or add an api_key_ref`);
+    }
+    if (binary === null) {
+        return (`no transport available: a credential is present but \`${expected}\` is not ` +
+            `on PATH and no key resolves — install the CLI, or add an api_key_ref`);
+    }
+    return (`no transport available: \`${expected}\` is on PATH but not authenticated and no ` +
+        `key resolves — log in to the CLI, or add an api_key_ref`);
+}
+/**
+ * Failure classes that may fall through to the `api` rung.
+ *
+ * All three share one property: the CLI provably never reached the provider,
+ * so retrying on another transport cannot double-charge. Everything absent
+ * from this set — notably `timeout` and `server_error` — may have left a
+ * half-completed call behind, and falling through would risk paying twice for
+ * one question. `quota_exhausted` is excluded for a different reason: the
+ * quota is a cap the user deliberately set, so routing around it would defeat
+ * the guard rather than recover from a fault.
+ */
+const FALLBACK_ELIGIBLE = new Set([
+    'binary_missing',
+    'auth_rejected',
+    'cli_unsupported',
+    // `model_unservable` satisfies the same no-double-charge property in both
+    // of its shapes: the pre-spend gate refuses before any subprocess exists,
+    // and the call-time shape is a provider 400 — rejected at the request
+    // boundary, no generation performed.
+    'model_unservable',
+]);
+/** The base policy: exactly the three-plus-one no-double-charge classes. */
+export const DEFAULT_FALLBACK_POLICY = { apiOnQuota: false };
+/**
+ * Collapse the tri-state plus the grant into the boolean the eligibility rule
+ * needs. `'ask'` without a grant is `false` — never `true` by omission, which
+ * is the one direction that would turn a configured question into silent
+ * metered spend.
+ */
+export function effectiveApiOnQuota(policy) {
+    if (policy.apiOnQuota === 'ask')
+        return policy.billingGrant === true;
+    return policy.apiOnQuota === true;
+}
+/**
+ * Parse a config value into the tri-state, or throw.
+ *
+ * Rejecting is the point. A parser that mapped an unknown value onto a truthy
+ * default would turn a configured `off` into metered spend — the exact failure
+ * the `'ask'` posture exists to prevent, introduced by the code that adds it.
+ * Accepts the Python-ish spellings the council config has always allowed on
+ * the boolean side, plus `ask` on the new one.
+ */
+export function apiOnQuotaView(raw) {
+    // Lenient by design, unlike `parseApiOnQuota`: this feeds a DISPLAY
+    // surface, where throwing on a malformed file would blank the wizard
+    // instead of showing the operator the setting they need to fix. Reading
+    // by value rather than by truthiness is the half that still matters —
+    // `=== true` alone renders `'ask'` as `false`, and the next save
+    // downgrades a configured question to a configured no.
+    return raw === 'ask' ? 'ask' : raw === true;
+}
+export function parseApiOnQuota(raw) {
+    if (typeof raw === 'boolean')
+        return raw;
+    if (raw === undefined || raw === null)
+        return false;
+    if (typeof raw === 'string') {
+        const s = raw.trim().toLowerCase();
+        if (s === 'ask')
+            return 'ask';
+        if (s === 'true' || s === 'yes' || s === 'on' || s === '1')
+            return true;
+        if (s === '' || s === 'false' || s === 'no' || s === 'off' || s === '0') {
+            return false;
+        }
+    }
+    throw new Error(`ai_council.fallback.api_on_quota: expected false | true | 'ask', got ${JSON.stringify(raw)}`);
+}
+/** Normalise a raw client error / skip reason into a `CliFailureClass`. */
+export function classifyCliFailure(raw) {
+    const s = raw.trim().toLowerCase();
+    if (s === 'binary_missing' || s === 'file_not_found')
+        return 'binary_missing';
+    if (s === 'auth_expired' || s === 'auth_rejected' || s === 'unauthorized') {
+        return 'auth_rejected';
+    }
+    if (s === 'cli_unsupported' || s === 'unsupported' || s === 'parse_failed') {
+        return 'cli_unsupported';
+    }
+    // Prefix match, not equality: the detail carries the operator-facing reason
+    // after the code, and that sentence IS the value of this class — collapsing
+    // it back to a bare token would restore the opaque `exit_1` this replaced.
+    // Also matched on the provider's own wording, so a model refused at call
+    // time (one the deny-list has never seen) classifies the same as one the
+    // pre-spend gate caught.
+    if (s.startsWith('model_unservable') ||
+        // The token the PRODUCERS actually write. R2 round 6, finding 4:
+        // `clients.ts` emits `model_unsupported_on_transport` at both sites
+        // (the pre-spend gate at :1857 and the turn-failed path at :2002) and
+        // puts the vendor sentence in `metadata.detail`, never in `error` — so
+        // the class matched nothing a caller could produce and the contract's
+        // fourth eligible class was dead. The token is matched here rather
+        // than renamed at the producers because `code:` values reach the
+        // events log and a rename would break every reader of the history.
+        s.startsWith('model_unsupported_on_transport') ||
+        s.includes('is not supported when using codex')) {
+        return 'model_unservable';
+    }
+    if (s === 'timeout')
+        return 'timeout';
+    if (s === 'cli_quota_exhausted' || s === 'quota_exhausted')
+        return 'quota_exhausted';
+    if (/^exit_5\d\d$/.test(s) || s === 'server_error' || s === 'os')
+        return 'server_error';
+    return 'other';
+}
+/** True when `failure` is eligible to fall through to the `api` rung. */
+export function isFallbackEligible(failure) {
+    return isFallbackEligibleUnder(failure, DEFAULT_FALLBACK_POLICY);
+}
+/**
+ * Policy-aware variant: the base set, plus `quota_exhausted` when the
+ * caller's policy opted in (`ai_council.fallback.api_on_quota`).
+ * `timeout` / `server_error` are ineligible under EVERY policy — a
+ * half-completed call must never be paid for twice, and no opt-in key
+ * exists (or may be added) to override that.
+ */
+export function isFallbackEligibleUnder(failure, policy) {
+    if (FALLBACK_ELIGIBLE.has(failure))
+        return true;
+    return effectiveApiOnQuota(policy) && failure === 'quota_exhausted';
+}
+/**
+ * Maps a mid-flight `CliFailureClass` (a call was actually attempted and
+ * failed) onto the same `AbsentReason` enum a static resolution failure
+ * uses (road-to-always-on-orchestration Phase 3.2/3.4), so a pass artifact
+ * can bucket every absent member — whether it never got a transport at all
+ * or lost one partway through — under one vocabulary. Returns `null` for a
+ * failure class outside the four-value enum (`cli_unsupported`,
+ * `server_error`, `model_unservable`, `other`); a caller falls back to the raw
+ * failure detail for those rather than mis-classifying them.
+ *
+ * `model_unservable` is deliberately unmapped rather than folded into
+ * `no_auth`: the credential is fine, the model is not, and the `detail` string
+ * carries the specific reason. So the bucket a reader sees is still the generic
+ * `unavailable`, while the line beside it now names the cause — an incomplete
+ * improvement, stated as one.
+ */
+export function absentReasonFromCliFailure(failure) {
+    switch (failure) {
+        case 'binary_missing':
+            return 'no_binary';
+        case 'auth_rejected':
+            return 'no_auth';
+        case 'timeout':
+            return 'timeout';
+        case 'quota_exhausted':
+            return 'quota';
+        default:
+            return null;
+    }
+}
+/**
+ * One-shot, per-provider fallback ledger for a single invocation.
+ *
+ * Construct one per council run. `attempt` returns `'api'` at most ONCE per
+ * provider, and only for a fallback-eligible failure class; every later call
+ * for that provider returns `'stop'`. This is the double-spend guard: a
+ * timeout never falls through, and an eligible failure never falls through
+ * twice.
+ */
+export class MidFlightFallback {
+    used = new Set();
+    /** `'api'` to retry on the api rung, `'stop'` to surface the failure. */
+    attempt(provider, failure, policy = DEFAULT_FALLBACK_POLICY) {
+        if (!isFallbackEligibleUnder(failure, policy))
+            return 'stop';
+        if (this.used.has(provider))
+            return 'stop';
+        this.used.add(provider);
+        return 'api';
+    }
+    /**
+     * Give a provider its one fallback back, because the twin never ran.
+     *
+     * R2 round 2, finding 8. `attempt` claims the slot at DECISION time, which
+     * is correct — the claim is what stops a dead binary being retried once per
+     * round. But a claim that is never CONSUMED must not stay spent: when the
+     * projected-spend gate refuses the escalation, no api call happens, and
+     * leaving the provider marked means the seat can never re-decide. Every
+     * later round then re-spawns the dead cli binary and gets `'stop'`, which
+     * is the exact per-round-ledger behaviour the invocation-scoped ledger was
+     * chosen to avoid.
+     *
+     * Called ONLY on a path where the twin was built and then not called.
+     * A provider that actually retried keeps its claim spent — that is the cap
+     * working.
+     */
+    release(provider) {
+        this.used.delete(provider);
+    }
+    /** Providers that have already spent their one fallback. */
+    spent() {
+        return [...this.used].sort();
+    }
+}
+/**
+ * True when `provider`'s CLI transport is a community wrapper — re-exported
+ * so callers reasoning about `auto` do not have to reach into the detector.
+ */
+export { isCommunityCli };
+//# sourceMappingURL=transport_resolver.js.map

package/dist/scripts/ai_council/transport_resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport_resolver.js","sourceRoot":"","sources":["../../../src/scripts/ai_council/transport_resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EACH,eAAe,EACf,cAAc,EACd,aAAa,EACb,iBAAiB,GAIpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAgB1C,iFAAiF;AACjF,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IAC9D,KAAK;IACL,QAAQ;IACR,KAAK;IACL,MAAM;CACT,CAAC,CAAC;AA0CH,kEAAkE;AAClE,MAAM,gBAAgB,GAA4B,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC,CAAC;AAE/F,0EAA0E;AAC1E,MAAM,gBAAgB,GAA4B,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAEnF,SAAS,SAAS,CACd,MAAyB,EACzB,QAAgB,EAChB,OAAgC;IAEhC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,qEAAqE;AACrE,SAAS,SAAS,CAAC,MAAyB,EAAE,QAAgB;IAC1D,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,UAAU,CAChF,CAAC;IACF,OAAO,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,CAAS;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,SAAS,cAAc,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA6B;IAC1D,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEtD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpB,OAAO;YACH,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,QAAQ;YACnB,iEAAiE;YACjE,2DAA2D;YAC3D,OAAO;YACP,UAAU;YACV,iBAAiB,EAAE,KAAK;YACxB,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI;SACrB,CAAC;IACN,CAAC;IAED,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnC,OAAO;YACH,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI;YACf,OAAO;YACP,UAAU;YACV,iBAAiB,EAAE,IAAI;YACvB,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI;SACrB,CAAC;IACN,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAClB,OAAO,WAAW,CACd,QAAQ,EACR,OAAO,EACP,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB;YACzC,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxD,CAAC;IACN,CAAC;IAED,uEAAuE;IACvE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAEhE,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,EAAE,CAAC;QAC/B,OAAO;YACH,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK;YAChB,OAAO;YACP,UAAU;YACV,iBAAiB,EAAE,IAAI;YACvB,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI;SACrB,CAAC;IACN,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACvF,IAAI,UAAU,EAAE,CAAC;QACb,OAAO;YACH,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,KAAK;YAChB,OAAO;YACP,UAAU;YACV,iBAAiB,EAAE,IAAI;YACvB,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI;SACrB,CAAC;IACN,CAAC;IAED,OAAO,WAAW,CACd,QAAQ,EACR,OAAO,EACP,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAClD,0BAA0B,CAAC,MAAM,CAAC,CACrC,CAAC;AACN,CAAC;AAqBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAClC,IAAmC;IAEnC,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE;QAC/C,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3C,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3C,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;KACtC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC;QAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3C,sEAAsE;QACtE,qEAAqE;QACrE,2CAA2C;QAC3C,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAChB,SAAiB,EACjB,OAAqB,EACrB,MAAc,EACd,eAAoC,IAAI;IAExC,OAAO;QACH,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,IAAI;QACf,uEAAuE;QACvE,8DAA8D;QAC9D,OAAO;QACP,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE,KAAK;QACxB,MAAM;QACN,YAAY;KACf,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,SAAS,0BAA0B,CAAC,MAAqB;IACrD,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,+DAA+D;AAC/D,SAAS,qBAAqB,CAC1B,QAAgB,EAChB,MAAqB,EACrB,SAAkB;IAElB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;IAC9D,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO,CACH,6BAA6B,QAAQ,wCAAwC;YAC7E,qDAAqD,CACxD,CAAC;IACN,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,CACH,yDAAyD,QAAQ,YAAY;YAC7E,sEAAsE,CACzE,CAAC;IACN,CAAC;IACD,OAAO,CACH,6BAA6B,QAAQ,6CAA6C;QAClF,yDAAyD,CAC5D,CAAC;AACN,CAAC;AAkBD;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAiC,IAAI,GAAG,CAAC;IAC5D,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,qCAAqC;IACrC,kBAAkB;CACrB,CAAC,CAAC;AA0CH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAmB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACtD,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC;IACrE,OAAO,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACvC,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,sEAAsE;IACtE,iEAAiE;IACjE,uDAAuD;IACvD,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,MAAM,IAAI,KAAK,CACX,wEAAwE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAChG,CAAC;AACN,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,gBAAgB,IAAI,CAAC,KAAK,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC9E,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;QACxE,OAAO,eAAe,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,KAAK,iBAAiB,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;QACzE,OAAO,iBAAiB,CAAC;IAC7B,CAAC;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,yBAAyB;IACzB,IACI,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAChC,iEAAiE;QACjE,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,iEAAiE;QACjE,mEAAmE;QACnE,CAAC,CAAC,UAAU,CAAC,gCAAgC,CAAC;QAC9C,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EACjD,CAAC;QACC,OAAO,kBAAkB,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,KAAK,qBAAqB,IAAI,CAAC,KAAK,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IACrF,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,cAAc,CAAC;IACxF,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,OAAwB;IACvD,OAAO,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACnC,OAAwB,EACxB,MAAsB;IAEtB,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,mBAAmB,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,iBAAiB,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAwB;IAC/D,QAAQ,OAAO,EAAE,CAAC;QACd,KAAK,gBAAgB;YACjB,OAAO,WAAW,CAAC;QACvB,KAAK,eAAe;YAChB,OAAO,SAAS,CAAC;QACrB,KAAK,SAAS;YACV,OAAO,SAAS,CAAC;QACrB,KAAK,iBAAiB;YAClB,OAAO,OAAO,CAAC;QACnB;YACI,OAAO,IAAI,CAAC;IACpB,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IACT,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE1C,yEAAyE;IACzE,OAAO,CACH,QAAgB,EAChB,OAAwB,EACxB,SAAyB,uBAAuB;QAEhD,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,QAAgB;QACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,4DAA4D;IAC5D,KAAK;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;CACJ;AAED;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/server/routes/wizard.js

@@ -17,6 +17,7 @@ import { detectRtk, rtkInstallCommands, RTK_UPSTREAM_REPO } from '../../install/
 import { readSelectedTools, readSelectedPacks, writeSelectedTools } from '../../install/selectedTools.js';
 import { detectAgentSwitch, AGENT_SWITCH_INSTALL_COMMAND, AGENT_SWITCH_REPO } from '../../install/agentSwitchDetection.js';
 import { readDismissedRecommendations, dismissRecommendation } from '../../install/wizardDismissals.js';
+import { apiOnQuotaView } from '../../scripts/ai_council/transport_resolver.js';
 const STATE_REL = join('state', 'wizard-state.json');
 const SETTINGS_REL = join('settings', '.agent-settings.yml');
 const USER_IDENTITY_REL = join('settings', '.agent-user.yml');
@@ -245,7 +246,7 @@ function extractCouncilConfig(body) {
         decision,
         // Anything but a literal `true` reads as off — the same shape the
         // CLI reader uses, so the two never disagree about spend.
-        fallback: { api_on_quota: fallbackCfg['api_on_quota'] === true },
+        fallback: { api_on_quota: apiOnQuotaView(fallbackCfg['api_on_quota']) },
     };
 }
 function detectProjectSignals(root) {
@@ -510,7 +511,7 @@ const aiCouncilPayloadSchema = z.object({
      * the write path is a comment-preserving `replaceScalar`, so an unmodelled
      * block was never at risk. Contract: ai-council-config.md.
      */
-    fallbackApiOnQuota: z.boolean().optional(),
+    fallbackApiOnQuota: z.union([z.boolean(), z.literal('ask')]).optional(),
 }).strict();
 // road-to-reciprocal-ecosystem § Phase 1 — the closed set of dismissible
 // passive-row recommendations. `agent-switch` is the only member today;