@genesislcap/ai-assistant 15.10.3 → 15.10.5

package/dist/esm/main/main.js

@@ -1185,6 +1185,23 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         if (reason !== 'budget-exhausted')
             return;
         const vendor = (_b = (_a = vendorTypeOfLabel(budget === null || budget === void 0 ? void 0 : budget.vendorLabel)) !== null && _a !== void 0 ? _a : budget === null || budget === void 0 ? void 0 : budget.vendor) !== null && _b !== void 0 ? _b : vendorHint;
+        // Meter feed (GENC-1464): snap this vendor's meter to the figures the 402
+        // itself reported, the moment the wall lands. Hosts refresh the meter on
+        // `tool-loop-end`, and a walled turn may never reach one — the user then
+        // stares at the pre-turn figures next to a banner saying the budget is gone
+        // until something else ends a loop (observed live: the meter only caught up
+        // when the user cancelled the stuck interaction). Deliberately NOT under the
+        // per-vendor idempotence guard below, for the same reason as the sweep: a
+        // later 402 for an already-walled vendor carries fresher spend. Both figures
+        // are required (`VendorBudgetFigures` is total, and half a meter is a lie),
+        // and the write goes through the captured `ref` like every other write here,
+        // so a teardown race cannot land it in a new session's store.
+        if (vendor && vendor !== 'none' && (budget === null || budget === void 0 ? void 0 : budget.budgetUsd) != null && (budget === null || budget === void 0 ? void 0 : budget.spentUsd) != null) {
+            ref === null || ref === void 0 ? void 0 : ref.actions.aiAssistant.setVendorBudget({
+                vendor,
+                figures: { budgetUsd: budget.budgetUsd, spentUsd: budget.spentUsd },
+            });
+        }
         if (!vendor || vendor === 'none') {
             if (!this.blocked) {
                 ref === null || ref === void 0 ? void 0 : ref.actions.aiAssistant.setBlocked({ blocked: true, reason: formatBlockedReason(budget) });
@@ -1312,28 +1329,30 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         return `${walled.map(statementFor).join(' ')} ${action}`;
     }
     /**
-     * Copy the driver writes into the TRANSCRIPT when a turn hits the budget wall.
+     * Copy the driver writes into the TRANSCRIPT when a turn hits the budget wall,
+     * or `undefined` to let the driver compose it per wall.
      *
-     * A host-set `blockedReason` still wins, so a white-labelled host does not read
-     * its own explanation in the banner and the shipped default directly below it —
-     * that is the whole reason the driver takes this at all.
+     * A set `blockedReason` still wins — a white-labelled host must not read its
+     * own explanation in the banner and shipped copy directly below it, and the
+     * vendor-agnostic latch's `formatBlockedReason(budget)` form stays advice-free
+     * exactly as before.
      *
-     * What it deliberately is NOT is
-     * {@link FoundationAiAssistant.effectiveBlockedReason}. That getter
-     * composes advice — `"…Switch to Gemini to keep going."` — which is true only
-     * while that vendor has headroom, and the transcript is a permanent record. The
-     * driver reads this once at CONSTRUCTION, and `getOrCreateDriver` keys on the
-     * agents list, so an agents swap *after* a wall re-runs `createDriver` and would
-     * freeze that sentence into every later turn's bubble. Reading the latch's own
-     * copy instead is structurally incapable of carrying the advice: the only
-     * writer of `blockedReason` is the vendor-agnostic branch of
-     * `latchBlockedFrom`, whose `formatBlockedReason(budget)` form has no switch
-     * clause. Per-vendor copy lives in `blockedVendorReasons` and reaches the
-     * banner alone.
+     * `undefined` (the usual case) is NOT the old `DEFAULT_BUDGET_EXHAUSTED_MESSAGE`
+     * fallback: it hands composition to the driver, which builds the bubble from
+     * EACH wall's own 402 — naming the exhausted vendor and advising a switch only
+     * when that refusal's `otherVendorAvailable` positively vouched for headroom
+     * elsewhere. That is immune to the staleness this getter used to guard against
+     * by freezing the copy: construction-time advice could outlive its truth
+     * (`getOrCreateDriver` re-runs on an agents swap and would have baked the
+     * sentence into every later bubble), but per-wall advice is derived from the
+     * refusal it annotates and dies with the turn. Forcing the default here was
+     * also what made the driver's composed bubble unreachable in every real
+     * mount — the banner advised switching while the bubble under it never did
+     * (the GENC-1464 tester finding, root cause).
      */
     get transcriptBudgetExhaustedMessage() {
         var _a;
-        return (_a = this.blockedReason) !== null && _a !== void 0 ? _a : DEFAULT_BUDGET_EXHAUSTED_MESSAGE;
+        return (_a = this.blockedReason) !== null && _a !== void 0 ? _a : undefined;
     }
     /**
      * Name of the agent the user has pinned via the agent picker. `null` means

package/dist/esm/utils/condense-history.js

@@ -40,11 +40,21 @@ function triggerReason(trigger) {
             return 'superseded';
     }
 }
-/** Framework-generated `pointer` stub — advertises that re-calling restores the content. */
-function condenseStub(target, tool, trigger, origLen) {
+/**
+ * Framework-generated stub, shared by `pointer` and `drop`. Names the tool, the superseded key
+ * (the only surviving identifier once args are elided — the model cannot otherwise tell WHICH
+ * file a collapsed `vfs_write` wrote) and the original size.
+ *
+ * `restorable` is the ONLY difference between the two modes: `pointer` promises that re-calling
+ * reproduces the content and is valid solely for idempotent tools; `drop` makes no such promise
+ * and must not carry the clause. Identifying information is not what separates them — a stub too
+ * bare to say what the call did is how GENC-1494 started.
+ */
+function condenseStub(target, tool, trigger, origLen, restorable) {
     const what = target === 'args' ? 'args' : 'result';
     const key = trigger.kind === 'superseded' ? ` ${trigger.by}` : '';
-    return `[${tool}${key} — ${what} elided, ~${origLen} chars (${triggerReason(trigger)}); re-call to restore]`;
+    const restore = restorable ? '; re-call to restore' : '';
+    return `[${tool}${key} — ${what} elided, ~${origLen} chars (${triggerReason(trigger)})${restore}]`;
 }
 /** Stable label for the `context.condensed` meta-event's `trigger` field. */
 function triggerLabel(trigger) {
@@ -81,10 +91,12 @@ function marksDiscontinuity(kind) {
  * Collapse stale tool payloads (declared via `condenseWhen`) out of the
  * model-bound history. Pure over the `history` array — it emits new message
  * objects and never mutates the input messages (mirroring the agent-masking
- * transform). It DOES, however, flip the `reported*` flag on the matching
- * `policies` entry the first time a payload collapses — the report-once gate that
- * keeps `onCondensed` firing once per (tool call, payload) even though the
- * collapse itself re-runs before every provider call.
+ * transform). It DOES, however, write two latches onto the matching `policies`
+ * entry the first time a payload collapses, both because the collapse itself
+ * re-runs before every provider call: the `reported*` flag (the report-once gate
+ * that keeps `onCondensed` firing once per (tool call, payload)) and
+ * `firedTrigger` (which pins the reason so a reason-bearing stub is rendered
+ * once and never rewritten).
  *
  * Triggers (a policy may list several via `on: Trigger[]` — the FIRST to fire
  * collapses the payload; all are monotonic, so the collapse never reverts):
@@ -172,7 +184,20 @@ export function applyCondensation(history, policies, ctx, onCondensed) {
     };
     // The first listed trigger that fires — drives the collapse, the stub reason,
     // and the event label. `undefined` means the payload stays full.
-    const firstFired = (toolCallId, entry) => triggersOf(entry).find((t) => (marksDiscontinuity(t.kind) || withinBatch(entry)) && triggerFires(toolCallId, entry, t));
+    //
+    // Latched on first fire (see `firedTrigger`): re-resolving on every pass lets the reason
+    // change under a payload that has already collapsed, which rewrites any reason-bearing stub
+    // and costs a second cache break. Both payloads of a call share the latch — they are
+    // evaluated in the same pass off the same clocks, so they never disagree about which
+    // trigger fired; only the size floor decides whether each one renders.
+    const firstFired = (toolCallId, entry) => {
+        if (entry.firedTrigger)
+            return entry.firedTrigger;
+        const fired = triggersOf(entry).find((t) => (marksDiscontinuity(t.kind) || withinBatch(entry)) && triggerFires(toolCallId, entry, t));
+        if (fired)
+            entry.firedTrigger = fired;
+        return fired;
+    };
     return history.map((msg) => {
         var _a, _b, _c, _d;
         // Tool-call ARGS live on the assistant message.
@@ -191,16 +216,23 @@ export function applyCondensation(history, policies, ctx, onCondensed) {
                     return tc;
                 changed = true;
                 const result = entry.policy.args;
-                // Args must stay a Record; `drop` is an empty object, otherwise stash the
-                // stub under a single key. Spread `tc` so providerMetadata (e.g. the
-                // Gemini reasoning signature that must round-trip) and UI fields survive.
-                const args = result === 'drop'
-                    ? {}
-                    : {
-                        [CONDENSED_ARGS_KEY]: result === 'pointer'
-                            ? condenseStub('args', tc.name, fired, origLen)
-                            : result.replaceWith,
-                    };
+                // Args must stay a Record, so every mode stashes its stub under a single key.
+                // Spread `tc` so providerMetadata (e.g. the Gemini reasoning signature that must
+                // round-trip) and UI fields survive.
+                //
+                // GENC-1494: `drop` used to collapse args to a bare `{}`. That is indistinguishable
+                // from a call the model made with NO arguments, and the model reads its own history
+                // as fact: a ui-builder run saw its elided `vfs_write` calls as `vfs_write {}` beside
+                // a live `{"status":"buffered","path":"…"}` result, concluded it was calling the tool
+                // without content, and burned two hours re-writing files that were already correct.
+                // A bare marker is not enough either — it still fails to say WHICH file the call
+                // wrote, since `path` went with the args. So `drop` renders the same identifying stub
+                // as `pointer`, minus only the restore promise it cannot honour.
+                const args = {
+                    [CONDENSED_ARGS_KEY]: result === 'drop' || result === 'pointer'
+                        ? condenseStub('args', tc.name, fired, origLen, result === 'pointer')
+                        : result.replaceWith,
+                };
                 if (!entry.reportedArgs) {
                     entry.reportedArgs = true;
                     const stubLen = JSON.stringify(args).length;
@@ -231,11 +263,9 @@ export function applyCondensation(history, policies, ctx, onCondensed) {
                 const tool = (_d = nameById.get(msg.toolResult.toolCallId)) !== null && _d !== void 0 ? _d : msg.toolResult.toolCallId;
                 const result = entry.policy.response; // `fired` is only set when response is declared
                 // Kept non-empty — Anthropic rejects empty tool_result content.
-                const content = result === 'drop'
-                    ? '[elided]'
-                    : result === 'pointer'
-                        ? condenseStub('response', tool, fired, origLen)
-                        : result.replaceWith;
+                const content = result === 'drop' || result === 'pointer'
+                    ? condenseStub('response', tool, fired, origLen, result === 'pointer')
+                    : result.replaceWith;
                 if (!entry.reportedResponse) {
                     entry.reportedResponse = true;
                     onCondensed({

package/dist/esm/utils/condense-history.test.js

@@ -1,5 +1,5 @@
 import { assert, createLogicSuite } from '@genesislcap/foundation-testing';
-import { applyCondensation, CONDENSE_MIN_CHARS, } from './condense-history';
+import { applyCondensation, CONDENSE_MIN_CHARS, CONDENSED_ARGS_KEY, } from './condense-history';
 const suite = createLogicSuite('applyCondensation');
 // Payloads must clear the driver-level floor to be condensed.
 const big = (n = CONDENSE_MIN_CHARS + 500) => 'x'.repeat(n);
@@ -154,11 +154,20 @@ suite('drop / pointer / replaceWith produce distinct collapsed forms', () => {
     ]);
     const { on } = sink();
     const out = applyCondensation(history, policies, ctx(), on);
-    assert.is(out[1].toolResult.content, '[elided]', 'drop is a minimal non-empty placeholder');
+    // `drop` differs from `pointer` ONLY by the restore promise — it still identifies the call,
+    // because a stub too bare to say what the call did is how GENC-1494 started.
+    assert.match(out[1].toolResult.content, /vfs_read/, 'drop names the tool');
+    assert.match(out[1].toolResult.content, /result elided/, 'drop says what was elided');
+    assert.not.match(out[1].toolResult.content, /re-call to restore/, 'drop makes no restore promise');
     assert.match(out[5].toolResult.content, /re-call to restore/, 'pointer carries the restore hint');
     assert.is(out[9].toolResult.content, 'SUMMARY', 'replaceWith is verbatim — no hint appended');
 });
-suite('args drop yields an empty object; pointer stashes a stub under one key', () => {
+// GENC-1494: dropped args must NEVER collapse to `{}`. A bare empty object is
+// indistinguishable from a call the model made with no arguments at all, and the model
+// treats its own history as fact — a ui-builder run read its elided `vfs_write` calls as
+// proof it was writing files with no content and re-wrote them for two hours. A bare marker
+// is not enough either: `path` goes with the args, so the stub must still say WHICH file.
+suite('args drop identifies the call; pointer stashes a stub under one key', () => {
     const history = [
         asstCall('w1', 'vfs_write', { path: 'A', content: big() }),
         toolMsg('w1', 'ok'),
@@ -171,9 +180,45 @@ suite('args drop yields an empty object; pointer stashes a stub under one key',
     ]);
     const { on } = sink();
     const out = applyCondensation(history, policies, ctx(), on);
-    assert.equal(out[0].toolCalls[0].args, {}, 'dropped args is an empty object');
+    const dropped = out[0].toolCalls[0].args;
+    const stub = String(dropped[CONDENSED_ARGS_KEY]);
+    assert.ok(Object.keys(dropped).length > 0, 'dropped args are never empty — that reads as a no-argument call');
+    assert.match(stub, /vfs_write/, 'stub names the tool');
+    assert.match(stub, /\bA\b/, 'stub names the superseded key — which file this call wrote');
+    assert.not.match(stub, /re-call to restore/, 'drop must not promise a restore it cannot honour');
     assert.equal(out[2].toolCalls[0].args, { path: 'A', content: big() }, 'latest write kept');
 });
+// GENC-1494: trigger resolution picks the first LISTED trigger that is currently true, so it
+// used to change after the collapse — with the usual `on: [{superseded}, {agentEnd}]`, a payload
+// collapsed at `agentEnd` re-resolved to `superseded` the moment a newer same-key call landed,
+// rewriting the stub and breaking the prompt cache a second time for an already-collapsed
+// payload. In one reported session that was 22/22 args collapses and 97 response collapses.
+suite('the fired trigger is latched, so a collapsed stub is never rewritten', () => {
+    const history = [asstCall('r1', 'vfs_read', { path: 'A' }), toolMsg('r1', big())];
+    const entry = reg({
+        on: [{ kind: 'superseded', by: 'A' }, { kind: 'agentEnd' }],
+        response: 'pointer', // pointer embeds the reason, so a re-resolve is visible in the text
+    });
+    const policies = new Map([['r1', entry]]);
+    const { events, on } = sink();
+    // Pass 1: the activation has ended but nothing supersedes r1 yet → collapses as agentEnd.
+    const first = applyCondensation(history, policies, ctx({ activationEnded: () => true }), on);
+    assert.match(first[1].toolResult.content, /agent finished/, 'collapses under agentEnd');
+    assert.is(events.length, 1);
+    assert.is(events[0].trigger, 'agentEnd');
+    // Pass 2: a newer read of the SAME key now exists, which would re-resolve the trigger to
+    // `superseded` (it is listed first). The already-collapsed stub must not change.
+    const grown = [
+        ...history,
+        asstCall('r2', 'vfs_read', { path: 'A' }),
+        toolMsg('r2', big()),
+    ];
+    policies.set('r2', reg({ on: { kind: 'superseded', by: 'A' }, response: 'pointer' }));
+    const second = applyCondensation(grown, policies, ctx({ activationEnded: () => true }), on);
+    assert.match(second[1].toolResult.content, /agent finished/, 'reason stays pinned to agentEnd');
+    assert.not.match(second[1].toolResult.content, /superseded/, 'must not re-resolve');
+    assert.is(second[1].toolResult.content, first[1].toolResult.content, 'stub text is byte-stable');
+});
 // ---------------------------------------------------------------------------
 // envelope + metadata invariants
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@genesislcap/ai-assistant",
   "description": "Genesis AI Assistant micro-frontend",
-  "version": "15.10.3",
+  "version": "15.10.5",
   "license": "SEE LICENSE IN license.txt",
   "main": "dist/esm/index.js",
   "types": "dist/ai-assistant.d.ts",
@@ -73,26 +73,26 @@
     }
   },
   "devDependencies": {
-    "@genesislcap/foundation-testing": "15.10.3",
-    "@genesislcap/genx": "15.10.3",
-    "@genesislcap/rollup-builder": "15.10.3",
-    "@genesislcap/ts-builder": "15.10.3",
-    "@genesislcap/uvu-playwright-builder": "15.10.3",
-    "@genesislcap/vite-builder": "15.10.3",
-    "@genesislcap/webpack-builder": "15.10.3",
+    "@genesislcap/foundation-testing": "15.10.5",
+    "@genesislcap/genx": "15.10.5",
+    "@genesislcap/rollup-builder": "15.10.5",
+    "@genesislcap/ts-builder": "15.10.5",
+    "@genesislcap/uvu-playwright-builder": "15.10.5",
+    "@genesislcap/vite-builder": "15.10.5",
+    "@genesislcap/webpack-builder": "15.10.5",
     "@types/dompurify": "^3.0.5",
     "@types/marked": "^5.0.2",
     "esbuild": "0.25.12"
   },
   "dependencies": {
-    "@genesislcap/foundation-ai": "15.10.3",
-    "@genesislcap/foundation-logger": "15.10.3",
-    "@genesislcap/foundation-notifications": "15.10.3",
-    "@genesislcap/foundation-redux": "15.10.3",
-    "@genesislcap/foundation-ui": "15.10.3",
-    "@genesislcap/foundation-utils": "15.10.3",
-    "@genesislcap/rapid-design-system": "15.10.3",
-    "@genesislcap/web-core": "15.10.3",
+    "@genesislcap/foundation-ai": "15.10.5",
+    "@genesislcap/foundation-logger": "15.10.5",
+    "@genesislcap/foundation-notifications": "15.10.5",
+    "@genesislcap/foundation-redux": "15.10.5",
+    "@genesislcap/foundation-ui": "15.10.5",
+    "@genesislcap/foundation-utils": "15.10.5",
+    "@genesislcap/rapid-design-system": "15.10.5",
+    "@genesislcap/web-core": "15.10.5",
     "dompurify": "^3.3.1",
     "marked": "^17.0.3"
   },
@@ -105,5 +105,5 @@
     "access": "public"
   },
   "customElements": "dist/custom-elements.json",
-  "gitHead": "6e5c9bb135b3da6792c4c3a8e632b09b0bc3fbca"
+  "gitHead": "3d50e0bb42cbf0f4a92b4bc74114c2bc7f581e4d"
 }

package/src/components/chat-driver/chat-driver.test.ts

@@ -2898,6 +2898,77 @@ outcome('a host-supplied budgetExhaustedMessage replaces the transcript copy', a
   assert.is(driver.getHistory().at(-1)!.content, 'Contact ops@acme.com');
 });
 
+// ── The composed default bubble (GENC-1464 tester finding) ─────────────────────
+// The blocked banner advises switching when another vendor has headroom; the
+// transcript bubble directly under it used to say only "contact your
+// administrator" regardless. The two surfaces must agree, and the bubble may
+// only advise a switch the proxy positively vouched for.
+
+/** Drive one walled turn and return the transcript's final (bubble) content. */
+const bubbleAfterWall = async (
+  sessionKey: string,
+  e: BudgetExhaustedError,
+  budgetExhaustedMessage?: string,
+): Promise<string> => {
+  clearMetaEventRegistry();
+  const provider: AIProvider = {
+    chat: async (): Promise<ChatMessage> => {
+      throw e;
+    },
+  };
+  const driver = new ChatDriver(makeRegistry(provider), {
+    sessionKey,
+    activityBus: outcomeBus,
+    ...(budgetExhaustedMessage == null ? {} : { budgetExhaustedMessage }),
+  });
+  driver.applyAgent(agent({ name: 'Static', toolDefinitions: [def('noop')], toolHandlers: {} }));
+  await driver.sendMessage('go');
+  return String(driver.getHistory().at(-1)!.content);
+};
+
+outcome(
+  'default bubble advises switching when the 402 vouches for headroom elsewhere',
+  async () => {
+    const content = await bubbleAfterWall(
+      'outcome-bubble-switch',
+      new BudgetExhaustedError('Anthropic', 25, 25.4, undefined, { otherVendorAvailable: true }),
+    );
+    assert.is(
+      content,
+      "You've reached Anthropic's AI usage limit. Switch to another AI provider in Settings to keep going, or contact your administrator to raise it.",
+    );
+  },
+);
+
+outcome('default bubble stays neutral when every other vendor is exhausted too', async () => {
+  const content = await bubbleAfterWall(
+    'outcome-bubble-all-walled',
+    new BudgetExhaustedError('Anthropic', 25, 25.4, undefined, { otherVendorAvailable: false }),
+  );
+  // Advising a switch to a vendor the proxy just said is empty would be worse
+  // than the neutral copy.
+  assert.is(content, DEFAULT_BUDGET_EXHAUSTED_MESSAGE);
+});
+
+outcome('default bubble stays neutral when an older proxy did not say', async () => {
+  const content = await bubbleAfterWall(
+    'outcome-bubble-no-verdict',
+    new BudgetExhaustedError('Anthropic', 25, 25.4),
+  );
+  // `undefined` is "the proxy did not say", not "another vendor is free".
+  assert.is(content, DEFAULT_BUDGET_EXHAUSTED_MESSAGE);
+});
+
+outcome('a host override wins verbatim even when switching would be honest advice', async () => {
+  const content = await bubbleAfterWall(
+    'outcome-bubble-override-wins',
+    new BudgetExhaustedError('Anthropic', 25, 25.4, undefined, { otherVendorAvailable: true }),
+    'Contact ops@acme.com',
+  );
+  // The white-label contract: host copy is never composed onto.
+  assert.is(content, 'Contact ops@acme.com');
+});
+
 // ── A sub-agent's wall is terminal for the parent too (GENC-1464) ──────────────
 // `SubAgentFailureReason.budget_exhausted` is documented as "terminal for the
 // parent too". Nothing parent-side read it, so the parent's tool loop appended
@@ -2947,6 +3018,42 @@ outcome('a sub-agent budget wall ends the parent turn without another model call
   assert.is(driver.getHistory().at(-1)!.content, DEFAULT_BUDGET_EXHAUSTED_MESSAGE);
 });
 
+outcome(
+  "a sub-agent wall with headroom elsewhere composes the parent's switch advice",
+  async () => {
+    // The parent's bubble is composed from the latched `budgetWallDetail` — on the
+    // sub-agent path there is NO error object in scope, only the failure payload
+    // the child attributed (this pins the exact seam a scope bug once lived on).
+    clearMetaEventRegistry();
+    let parentCalls = 0;
+    const provider: AIProvider = {
+      chat: async (
+        _h: ChatMessage[],
+        _u: string,
+        options?: ChatRequestOptions,
+      ): Promise<ChatMessage> => {
+        if ((options?.tools ?? []).some((t) => t.name === 'delegate')) {
+          parentCalls += 1;
+          return callsTool('delegate', `d${parentCalls}`);
+        }
+        throw new BudgetExhaustedError('Anthropic', 25, 25.4, undefined, {
+          otherVendorAvailable: true,
+        });
+      },
+    };
+    const parent = delegatingParent(walledWorker(), () => undefined);
+    const driver = makeDriver(parent, provider, 'outcome-subagent-budget-switch', outcomeBus);
+
+    const result: ChatDriverResult = await driver.sendMessage('go');
+
+    assert.is(result.reason === 'done' ? result.failureReason : undefined, 'budget-exhausted');
+    assert.is(
+      driver.getHistory().at(-1)!.content,
+      "You've reached Anthropic's AI usage limit. Switch to another AI provider in Settings to keep going, or contact your administrator to raise it.",
+    );
+  },
+);
+
 outcome("a sub-agent's wall is attributed to the CHILD's vendor, not the parent's", async () => {
   // A sub-agent can sit on a different vendor from its parent (`applyAgent` reads
   // `config.provider`). The wall reaches the parent only as a tool result, so

package/src/components/chat-driver/chat-driver.ts

@@ -289,8 +289,13 @@ export interface ChatDriverConfig {
    */
   activityBus?: ActivityBus;
   /**
-   * Transcript copy appended when the AI-spend budget wall is hit (GENC-1464).
-   * Defaults to `DEFAULT_BUDGET_EXHAUSTED_MESSAGE`.
+   * Transcript copy appended when the AI-spend budget wall is hit (GENC-1464),
+   * used VERBATIM — set it only to own the copy entirely (white-labelling).
+   * When unset, the driver composes the bubble per wall: the neutral
+   * `DEFAULT_BUDGET_EXHAUSTED_MESSAGE`, upgraded with "switch to another AI
+   * provider" advice only when the 402's `otherVendorAvailable` positively says
+   * another metered vendor still has headroom — the same rule the blocked
+   * banner applies, so the two surfaces can no longer contradict each other.
    *
    * The assistant element already lets a host override the blocked **banner**
    * via `setBlocked(true, reason)`; without this the transcript **bubble** stayed
@@ -652,8 +657,12 @@ export class ChatDriver extends EventTarget implements AiDriver {
   private readonly sessionKey: string;
   /** Injected activity bus; defaults to a no-op off-browser (Node/tests/headless). */
   private readonly activityBus: ActivityBus;
-  /** Transcript copy for a budget wall — see `ChatDriverConfig.budgetExhaustedMessage`. */
-  private readonly budgetExhaustedMessage: string;
+  /**
+   * Host override for the budget-wall transcript copy, used verbatim — see
+   * `ChatDriverConfig.budgetExhaustedMessage`. `undefined` means no override,
+   * and the bubble is composed per wall by {@link ChatDriver.budgetExhaustedBubble}.
+   */
+  private readonly budgetExhaustedMessageOverride?: string;
   /**
    * Set the moment a budget wall is observed anywhere in this turn — this
    * driver's own 402, or a sub-agent's (which surfaces here only as a
@@ -702,13 +711,13 @@ export class ChatDriver extends EventTarget implements AiDriver {
       maxTurnSnapshots = DEFAULT_MAX_TURN_SNAPSHOTS,
       sessionKey = '',
       activityBus = NOOP_ACTIVITY_BUS,
-      budgetExhaustedMessage = DEFAULT_BUDGET_EXHAUSTED_MESSAGE,
+      budgetExhaustedMessage,
     } = config;
     this.maxToolIterations = maxToolIterations;
     this.condenseBatchCalls = condenseBatchCalls;
     this.sessionKey = sessionKey;
     this.activityBus = activityBus;
-    this.budgetExhaustedMessage = budgetExhaustedMessage;
+    this.budgetExhaustedMessageOverride = budgetExhaustedMessage;
     if (typeof toolHandlers === 'function') {
       this.toolHandlersFactory = toolHandlers;
       this.toolHandlers = {};
@@ -870,6 +879,32 @@ export class ChatDriver extends EventTarget implements AiDriver {
    *
    * @internal
    */
+  private budgetExhaustedBubble(wall?: {
+    vendorLabel?: string;
+    otherVendorAvailable?: boolean;
+  }): string {
+    // A host override wins verbatim — the white-label contract on
+    // `ChatDriverConfig.budgetExhaustedMessage` (its copy may not even be
+    // English; composing onto it would mangle it).
+    if (this.budgetExhaustedMessageOverride != null) return this.budgetExhaustedMessageOverride;
+    // Only a POSITIVE `otherVendorAvailable` earns the switch advice. `false`
+    // means every other metered vendor is exhausted too, and `undefined` means
+    // an older proxy did not say — in both cases advertising a switch to a
+    // vendor that may itself be walled is worse than the neutral default. This
+    // mirrors the blocked banner's rule, and closes the gap where the banner
+    // said "switch" while the transcript bubble directly under it said only
+    // "contact your administrator" (GENC-1464 tester finding).
+    if (wall?.otherVendorAvailable !== true) return DEFAULT_BUDGET_EXHAUSTED_MESSAGE;
+    // The label is display copy, nothing more — attribution (which vendor gets
+    // WALLED) stays `budgetDetailOf`'s job. The parameter is the shared shape of
+    // both call sites: the thrown `BudgetExhaustedError` on the direct path, and
+    // the latched `budgetWallDetail` on the sub-agent path.
+    const subject = wall?.vendorLabel
+      ? `${wall.vendorLabel}'s AI usage limit`
+      : 'your AI usage limit';
+    return `You've reached ${subject}. Switch to another AI provider in Settings to keep going, or contact your administrator to raise it.`;
+  }
+
   reportBudgetExhausted(
     e: BudgetExhaustedError,
     pendingUserMessage?: ChatMessage,
@@ -894,7 +929,7 @@ export class ChatDriver extends EventTarget implements AiDriver {
       spentUsd: e.spentUsd,
       isSubAgent: this.isSubAgent,
     });
-    this.appendToHistory({ role: 'assistant', content: this.budgetExhaustedMessage });
+    this.appendToHistory({ role: 'assistant', content: this.budgetExhaustedBubble(e) });
     return this.turnDone('budget-exhausted', budgetDetailOf(e));
   }
 
@@ -2506,7 +2541,14 @@ export class ChatDriver extends EventTarget implements AiDriver {
         if (this.isSubAgent) {
           this.failSubAgent('budget_exhausted', this.budgetWallDetail);
         } else {
-          this.appendToHistory({ role: 'assistant', content: this.budgetExhaustedMessage });
+          // Composed from the DETAIL, not an error object: on this path the wall
+          // arrived as a sub-agent's failure payload — `budgetWallDetail`, first
+          // attribution wins — and an unattributable child wall (detail
+          // undefined) composes the neutral default.
+          this.appendToHistory({
+            role: 'assistant',
+            content: this.budgetExhaustedBubble(this.budgetWallDetail),
+          });
         }
         // Carried onto the result so `loopEndDetail` publishes the refusing
         // vendor rather than falling through to `lastResolvedProvider`, and the

package/src/main/blocked-state.test.ts

@@ -289,6 +289,65 @@ Suite('el.blocked = true after a host reason keeps the reason', () => {
 
 // ── The driver latch (GENC-1464) ───────────────────────────────────────────────
 
+/** The raw stored figures, read the way budget-meter.test.ts reads them. */
+const storedBudgets = (el: FoundationAiAssistant) =>
+  (
+    el as unknown as {
+      _sessionRef: { store: { aiAssistant: { vendorBudgets: Record<string, unknown> } } };
+    }
+  )._sessionRef.store.aiAssistant.vendorBudgets;
+
+Suite('the transcript override is passed only when a blockedReason actually exists', () => {
+  // Forcing DEFAULT_BUDGET_EXHAUSTED_MESSAGE here was what made the driver's
+  // per-wall composed bubble unreachable in every real mount (the banner said
+  // "switch", the bubble under it never did). `undefined` hands composition to
+  // the driver; a set reason — host white-labelling, or the vendor-agnostic
+  // latch's advice-free copy — still wins verbatim.
+  const read = (el: FoundationAiAssistant) =>
+    (el as unknown as { transcriptBudgetExhaustedMessage?: string })
+      .transcriptBudgetExhaustedMessage;
+
+  const el = element();
+  assert.is(read(el), undefined, 'no reason -> the driver composes per wall');
+
+  el.setBlocked(true, 'Contact ops@acme.com');
+  assert.is(read(el), 'Contact ops@acme.com', 'a set reason wins verbatim');
+
+  el.setBlocked(false);
+  assert.is(read(el), undefined, 'unblocking hands composition back to the driver');
+});
+
+Suite('a wall with figures snaps the vendor meter at latch time', () => {
+  // The GENC-1464 stale-meter finding: hosts refresh the meter on
+  // `tool-loop-end`, which a walled turn may never reach — the 402's own
+  // figures are the freshest truth available and must land immediately.
+  const el = element();
+  reachable(el, 'anthropic', 'gemini');
+  latch(el, 'budget-exhausted', { vendorLabel: 'Anthropic', budgetUsd: 20, spentUsd: 20.1 });
+  assert.equal(storedBudgets(el)['anthropic'], { budgetUsd: 20, spentUsd: 20.1 });
+
+  // A later 402 for the same (already-walled) vendor carries fresher spend —
+  // the feed is deliberately outside the idempotence guard, like the sweep.
+  latch(el, 'budget-exhausted', { vendorLabel: 'Anthropic', budgetUsd: 20, spentUsd: 21.5 });
+  assert.equal(storedBudgets(el)['anthropic'], { budgetUsd: 20, spentUsd: 21.5 });
+});
+
+Suite('a figure-less or unattributable wall feeds no meter', () => {
+  // Half a meter is a lie: `VendorBudgetFigures` is total, so one missing
+  // figure means no feed at all — the wall itself still latches.
+  const el = element();
+  reachable(el, 'anthropic', 'gemini');
+  latch(el, 'budget-exhausted', { vendorLabel: 'Anthropic', spentUsd: 21 });
+  assert.is(storedBudgets(el)['anthropic'], undefined);
+  assert.is(el.isVendorBlocked('anthropic'), true, 'the latch itself is unaffected');
+
+  // No vendor resolves: nothing to key the meter on.
+  const el2 = element();
+  reachable(el2, 'anthropic', 'gemini');
+  latch(el2, 'budget-exhausted', { vendorLabel: 'Acme Gateway', budgetUsd: 20, spentUsd: 21 });
+  assert.equal(storedBudgets(el2), {});
+});
+
 Suite('latchBlockedFrom latches only on budget-exhausted', () => {
   const budget = element();
   latch(budget, 'budget-exhausted');