@iowarp/clio-coder 0.4.1 → 0.4.2

package/src/domains/share/archive.ts

@@ -1,5 +1,17 @@
 import { createHash } from "node:crypto";
-import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, type Stats, statSync } from "node:fs";
+import {
+	existsSync,
+	lstatSync,
+	mkdirSync,
+	mkdtempSync,
+	readdirSync,
+	readFileSync,
+	realpathSync,
+	rmSync,
+	type Stats,
+	statSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
 import path from "node:path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { type ClioSettings, readSettings, settingsPath, updateSettings, validateSettings } from "../../core/config.js";
@@ -18,6 +30,10 @@ import {
 	parseAgentRecipeSchema,
 	parseFleetContract,
 } from "../agents/index.js";
+import { loadManifestFromRoot } from "../extensions/discovery.js";
+import { extensionContentDigest } from "../extensions/integrity.js";
+import { extensionBaseDir, installExtension, listInstalledExtensions } from "../extensions/state.js";
+import type { ExtensionScope } from "../extensions/types.js";
 import { migrateSettingsV1Document } from "../lifecycle/migrations/2026-09-01-settings-v2.js";
 
 export type ShareScope = "project" | "user";
@@ -331,7 +347,14 @@ export function createShareArchive(options: ShareExportOptions = {}): ClioShareA
 		for (const scope of scopes) {
 			const root =
 				scope === "user" ? path.join(clioConfigDir(), "extensions") : path.join(cwd, ".clio-coder", "extensions");
-			addTree(files, "extension", scope, root, `${scope}/extensions`, (rel) => path.basename(rel) !== "state.json");
+			addTree(
+				files,
+				"extension",
+				scope,
+				root,
+				`${scope}/extensions`,
+				(relativePath) => !relativePath.split("/")[0]?.startsWith(".") && path.basename(relativePath) !== "state.json",
+			);
 		}
 	}
 	if (includes.includeSettings) {
@@ -453,6 +476,15 @@ interface ShareImportPreparedPlan {
 	actions: ShareImportAction[];
 	diagnostics: ShareDiagnostic[];
 	targets: ShareImportPreparedTarget[];
+	extensionPackages: ShareImportPreparedExtensionPackage[];
+}
+
+interface ShareImportPreparedExtensionPackage {
+	id: string;
+	scope: ExtensionScope;
+	files: Array<{ relativePath: string; buffer: Buffer }>;
+	contentDigest: string;
+	install: boolean;
 }
 
 function configDirPath(): string {
@@ -608,6 +640,91 @@ function preflightImportTargets(
 	return { targets, diagnostics };
 }
 
+function withStagedExtensionPackage<T>(
+	input: { id: string; files: ReadonlyArray<{ relativePath: string; buffer: Buffer }> },
+	fn: (root: string) => T,
+): T {
+	const stagingParent = mkdtempSync(path.join(tmpdir(), "clio-share-extension-"));
+	const root = path.join(stagingParent, input.id);
+	try {
+		mkdirSync(root, { recursive: true });
+		for (const file of input.files) safeResourceWrite(path.join(root, file.relativePath), file.buffer);
+		return fn(root);
+	} finally {
+		rmSync(stagingParent, { recursive: true, force: true });
+	}
+}
+
+function prepareExtensionPackages(
+	targets: ReadonlyArray<ShareImportPreparedTarget>,
+	options: ShareImportOptions,
+): { packages: ShareImportPreparedExtensionPackage[]; diagnostics: ShareDiagnostic[] } {
+	const diagnostics: ShareDiagnostic[] = [];
+	const grouped = new Map<string, Omit<ShareImportPreparedExtensionPackage, "contentDigest" | "install">>();
+	for (const target of targets) {
+		if (target.entry.type !== "extension") continue;
+		const segments = relativePathSegments(target.entry.relativePath);
+		const id = segments?.[0];
+		const packagePath = segments?.slice(1).join("/");
+		if (!id || !packagePath) {
+			diagnostics.push({
+				type: "error",
+				message: `extension archive path must be <id>/<package-path>: ${pathDiagnostic(target.entry)}`,
+				path: target.entry.relativePath,
+			});
+			continue;
+		}
+		const scope = target.scope as ExtensionScope;
+		const key = `${scope}\0${id}`;
+		const group = grouped.get(key) ?? { id, scope, files: [] };
+		if (group.files.some((file) => file.relativePath === packagePath)) {
+			diagnostics.push({ type: "error", message: `duplicate extension archive path ${target.entry.relativePath}` });
+			continue;
+		}
+		group.files.push({ relativePath: packagePath, buffer: target.buffer });
+		grouped.set(key, group);
+	}
+
+	const packages: ShareImportPreparedExtensionPackage[] = [];
+	for (const group of [...grouped.values()].sort((a, b) => `${a.scope}/${a.id}`.localeCompare(`${b.scope}/${b.id}`))) {
+		try {
+			const contentDigest = withStagedExtensionPackage(group, (root) => {
+				const candidate = loadManifestFromRoot(root);
+				if (!candidate.valid || !candidate.manifest) {
+					throw new Error(candidate.diagnostics.map((diagnostic) => diagnostic.message).join("; ") || "manifest is invalid");
+				}
+				if (candidate.manifest.id !== group.id) {
+					throw new Error(`manifest id ${candidate.manifest.id} does not match archive package ${group.id}`);
+				}
+				return extensionContentDigest(root);
+			});
+			const cwd = path.resolve(options.cwd ?? process.cwd());
+			const targetRoot = path.join(extensionBaseDir(group.scope, cwd), group.id);
+			const existing = listInstalledExtensions(cwd, { scope: group.scope, all: true }).find(
+				(extension) => extension.id === group.id && extension.rootPath === targetRoot,
+			);
+			const alreadyVerified =
+				existing?.valid === true &&
+				existing.provenance?.contentDigest === contentDigest &&
+				existing.observedContentDigest === contentDigest;
+			if (existsSync(targetRoot) && !alreadyVerified && !options.force) {
+				diagnostics.push({
+					type: "conflict",
+					message: `extension ${group.id} is not already installed with the archive's verified digest; re-run with --force to use the canonical installer`,
+					path: targetRoot,
+				});
+			}
+			packages.push({ ...group, contentDigest, install: !alreadyVerified });
+		} catch (error) {
+			diagnostics.push({
+				type: "error",
+				message: `extension ${group.id} in share archive is invalid: ${error instanceof Error ? error.message : String(error)}`,
+			});
+		}
+	}
+	return { packages, diagnostics };
+}
+
 function versionDiagnostics(archive: ClioShareArchive): ShareDiagnostic[] {
 	const current = readClioVersion();
 	const [curMajor, curMinor] = current.split(".");
@@ -657,13 +774,20 @@ function prepareShareImport(filePath: string, options: ShareImportOptions = {}):
 			actions: [],
 			diagnostics: [{ type: "error", message: err instanceof Error ? err.message : String(err), path: filePath }],
 			targets: [],
+			extensionPackages: [],
 		};
 	}
 	const diagnostics: ShareDiagnostic[] = [...versionDiagnostics(archive)];
 	const actions: ShareImportAction[] = [];
 	const preflight = preflightImportTargets(archive, options);
 	if (preflight.diagnostics.length > 0) {
-		return { archive, actions: [], diagnostics: [...diagnostics, ...preflight.diagnostics], targets: [] };
+		return {
+			archive,
+			actions: [],
+			diagnostics: [...diagnostics, ...preflight.diagnostics],
+			targets: [],
+			extensionPackages: [],
+		};
 	}
 	for (const targetInfo of preflight.targets) {
 		const { entry, target, scope, buffer } = targetInfo;
@@ -706,7 +830,9 @@ function prepareShareImport(filePath: string, options: ShareImportOptions = {}):
 		}
 		actions.push({ action: "write", type: entry.type, scope, path: target });
 	}
-	return { archive, actions, diagnostics, targets: preflight.targets };
+	const extensions = prepareExtensionPackages(preflight.targets, options);
+	diagnostics.push(...extensions.diagnostics);
+	return { archive, actions, diagnostics, targets: preflight.targets, extensionPackages: extensions.packages };
 }
 
 function publicImportPlan(prepared: ShareImportPreparedPlan, recovery?: ShareImportRecovery): ShareImportPlan {
@@ -750,10 +876,41 @@ export function importShareArchive(filePath: string, options: ShareImportOptions
 	};
 	let failed: string | undefined;
 	try {
+		for (const extensionPackage of prepared.extensionPackages) {
+			if (!extensionPackage.install) continue;
+			const cwd = path.resolve(options.cwd ?? process.cwd());
+			failed = path.join(extensionBaseDir(extensionPackage.scope, cwd), extensionPackage.id);
+			const result = withStagedExtensionPackage(extensionPackage, (root) =>
+				installExtension(root, {
+					cwd,
+					scope: extensionPackage.scope,
+					...(options.force !== undefined ? { force: options.force } : {}),
+				}),
+			);
+			for (const backup of [result.recovery?.stateBackup, result.recovery?.packageBackup]) {
+				if (backup && !backups.includes(backup)) backups.push(backup);
+			}
+			const errors = result.diagnostics.filter((diagnostic) => diagnostic.type === "error");
+			if (!result.extension || errors.length > 0) {
+				throw new Error(errors.map((diagnostic) => diagnostic.message).join("; ") || "canonical install failed");
+			}
+			if (result.extension.provenance?.contentDigest !== extensionPackage.contentDigest) {
+				throw new Error(`canonical install digest mismatch for extension ${extensionPackage.id}`);
+			}
+			for (const diagnostic of result.diagnostics) {
+				prepared.diagnostics.push({
+					type: "warning",
+					message: diagnostic.message,
+					...(diagnostic.path ? { path: diagnostic.path } : {}),
+				});
+			}
+			if (!written.includes(result.extension.rootPath)) written.push(result.extension.rootPath);
+			failed = undefined;
+		}
 		for (let index = 0; index < prepared.targets.length; index += 1) {
 			const targetInfo = prepared.targets[index];
 			const action = prepared.actions[index];
-			if (!targetInfo || !action || action.action === "skip") continue;
+			if (!targetInfo || !action || action.action === "skip" || targetInfo.entry.type === "extension") continue;
 			failed = targetInfo.target;
 			if (targetInfo.entry.type === "settings") {
 				const path = mergeSettingsFragment(targetInfo.buffer);
@@ -768,7 +925,7 @@ export function importShareArchive(filePath: string, options: ShareImportOptions
 			);
 			failed = undefined;
 		}
-		return plan;
+		return publicImportPlan(prepared, backups.length > 0 ? { written, backups } : undefined);
 	} catch (err) {
 		if (failed) {
 			const expectedBackup = safeResourceBackupPath(failed);
@@ -787,7 +944,7 @@ export function importShareArchive(filePath: string, options: ShareImportOptions
 					...prepared.diagnostics,
 					{
 						type: "error",
-						message: `share import failed while writing${failed ? ` ${failed}` : ""}: ${reason}`,
+						message: `share import failed${failed ? ` while importing ${failed}` : ""}: ${reason}`,
 						...(failed ? { path: failed } : {}),
 					},
 				],

package/src/engine/acp/server.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { realpathSync } from "node:fs";
 import { isAbsolute, resolve as resolvePath } from "node:path";
 import {
+	type AccountabilityEvidenceReadyPayload,
 	BusChannels,
 	type DispatchCompletedPayload,
 	type DispatchEnqueuedPayload,
@@ -209,6 +210,8 @@ interface AcpServerUsage {
 	cacheRead: number;
 	cacheWrite: number;
 	reasoning: number;
+	totalTokens: number;
+	costUsd: number;
 }
 
 function isRecord(value: unknown): value is Record<string, unknown> {
@@ -333,7 +336,10 @@ const ACP_MAX_REPLAY_TOOL_CALLS = 8192;
  * the list is the allowlist, and a client's requested kinds are intersected
  * with it rather than trusted. `safety.loopBlocked` was the first member; the
  * dispatch lifecycle joined it so a client can draw a live fleet board from
- * reported facts instead of inferring one from tool titles or timing.
+ * reported facts instead of inferring one from tool titles or timing;
+ * `accountability.evidenceReady` follows a run's terminal event once its
+ * evidence bundle has landed, so the board can show first-pass success and a
+ * finding count without reading Clio's state tree.
  */
 const ACP_FORWARDABLE_EVENT_KINDS = [
 	"safety.loopBlocked",
@@ -342,6 +348,7 @@ const ACP_FORWARDABLE_EVENT_KINDS = [
 	"dispatch.progress",
 	"dispatch.completed",
 	"dispatch.failed",
+	"accountability.evidenceReady",
 ] as const;
 
 type AcpForwardableEventKind = (typeof ACP_FORWARDABLE_EVENT_KINDS)[number];
@@ -359,6 +366,9 @@ const ACP_MAX_DISPATCH_TASK_PREVIEW_BYTES = 160;
 
 /** Wire bound for the short identifiers a dispatch event carries. */
 const ACP_MAX_DISPATCH_ID_BYTES = 128;
+/** Evidence tags are a closed vocabulary of short identifiers; anything wider is not a tag. */
+const ACP_MAX_EVIDENCE_TAGS = 32;
+const ACP_MAX_EVIDENCE_TAG_BYTES = 64;
 
 /**
  * Progress events forwarded per run before the stream is capped. One run
@@ -521,8 +531,8 @@ function utf8Bytes(value: string): number {
 	return Buffer.byteLength(value, "utf8");
 }
 
-function emptyUsage(): AcpServerUsage {
-	return { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, reasoning: 0 };
+export function emptyUsage(): AcpServerUsage {
+	return { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, reasoning: 0, totalTokens: 0, costUsd: 0 };
 }
 
 function createActivePromptState(): ActivePrompt {
@@ -552,15 +562,33 @@ function finite(value: unknown): number {
 	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
 }
 
-function mergeUsage(into: AcpServerUsage, usage: unknown): void {
+/** Only field `sumRunUsage` (chat-loop-messages.ts) reads for a dollar figure; matched here so ACP never re-derives cost through a separate path. */
+function costTotal(usage: Record<string, unknown>): number {
+	const cost = usage.cost;
+	return isRecord(cost) ? finite(cost.total) : 0;
+}
+
+export function mergeUsage(into: AcpServerUsage, usage: unknown): void {
 	if (!isRecord(usage)) return;
-	into.input +=
+	const input =
 		finite(usage.input) + finite(usage.inputTokens) + finite(usage.input_tokens) + finite(usage.prompt_tokens);
-	into.output +=
+	const output =
 		finite(usage.output) + finite(usage.outputTokens) + finite(usage.output_tokens) + finite(usage.completion_tokens);
-	into.cacheRead += finite(usage.cacheRead) + finite(usage.cacheReadTokens) + finite(usage.cache_read_tokens);
-	into.cacheWrite += finite(usage.cacheWrite) + finite(usage.cacheWriteTokens) + finite(usage.cache_write_tokens);
-	into.reasoning += finite(usage.reasoning) + finite(usage.reasoningTokens) + finite(usage.reasoning_tokens);
+	const cacheRead = finite(usage.cacheRead) + finite(usage.cacheReadTokens) + finite(usage.cache_read_tokens);
+	const cacheWrite = finite(usage.cacheWrite) + finite(usage.cacheWriteTokens) + finite(usage.cache_write_tokens);
+	const reasoning = finite(usage.reasoning) + finite(usage.reasoningTokens) + finite(usage.reasoning_tokens);
+	into.input += input;
+	into.output += output;
+	into.cacheRead += cacheRead;
+	into.cacheWrite += cacheWrite;
+	into.reasoning += reasoning;
+	// Same fallback sumRunUsage uses: prefer the provider's own total, otherwise
+	// sum the four merged categories for this message (reasoning excluded,
+	// matching sumRunUsage, since a provider that reports reasoning separately
+	// still counts it inside output for billing).
+	const explicitTotal = finite(usage.totalTokens) + finite(usage.total_tokens);
+	into.totalTokens += explicitTotal > 0 ? explicitTotal : input + output + cacheRead + cacheWrite;
+	into.costUsd += costTotal(usage);
 }
 
 function mergeMessageUsage(into: AcpServerUsage, message: unknown, seen?: WeakSet<object>): void {
@@ -1857,6 +1885,29 @@ export async function serveClioAcpAgent(options: ClioAcpServerOptions): Promise<
 				});
 			}),
 		);
+		unsubscribeEvents.push(
+			bus.on(BusChannels.AccountabilityEvidenceReady, (payload: AccountabilityEvidenceReadyPayload) => {
+				// Arrives after dispatch.completed or dispatch.failed for the same run,
+				// so it is terminal too: nothing about that run follows it. The
+				// bundle's prose (findings, overview) stays behind; only the summary
+				// counters the projection itself carries cross, and the tags are
+				// filtered to bounded identifiers rather than truncated into new ones.
+				const runId = safeStoredIdentifier(payload.runId, ACP_MAX_DISPATCH_ID_BYTES);
+				const evidenceId = safeStoredIdentifier(payload.evidenceId, ACP_MAX_DISPATCH_ID_BYTES);
+				if (runId === null || evidenceId === null) return;
+				const tags = (Array.isArray(payload.tags) ? payload.tags : [])
+					.map((tag) => safeStoredIdentifier(tag, ACP_MAX_EVIDENCE_TAG_BYTES))
+					.filter((tag): tag is string => tag !== null)
+					.slice(0, ACP_MAX_EVIDENCE_TAGS);
+				forwardEvent("accountability.evidenceReady", null, true, {
+					runId,
+					evidenceId,
+					firstPassSuccess: payload.firstPassSuccess === true,
+					findingCount: safeCount(payload.findingCount),
+					tags,
+				});
+			}),
+		);
 	}
 	const unsubscribeEventStream = (): void => {
 		for (const unsubscribe of unsubscribeEvents) unsubscribe();
@@ -2607,6 +2658,8 @@ function promptResponse(stopReason: string, active: ActivePrompt): AcpPromptResp
 				cacheRead: active.usage.cacheRead,
 				cacheWrite: active.usage.cacheWrite,
 				reasoning: active.usage.reasoning,
+				totalTokens: active.usage.totalTokens,
+				costUsd: active.usage.costUsd,
 			},
 		},
 	};

package/src/engine/apis/llamacpp-residency.ts

@@ -5,7 +5,6 @@ import {
 	type ResidencyAdapter,
 	ResidencyPreconditionError,
 	reconcileResidency,
-	residencyManaged,
 	residentTagProtected,
 } from "./residency.js";
 
@@ -27,8 +26,8 @@ export interface LlamaCppResidencyInput {
 	runtimeId: string;
 	keepModelId: string;
 	/**
-	 * Combined env + target lifecycle opt-out verdict from the caller
-	 * (residencyManagedFor). Defaults to the env-only switch.
+	 * Target lifecycle verdict from the caller (residencyManagedFor). Defaults
+	 * to managed for direct adapter callers.
 	 */
 	managed?: boolean;
 	fetchImpl?: typeof fetch;
@@ -284,7 +283,7 @@ export async function ensureLlamaCppResidency(input: LlamaCppResidencyInput): Pr
 		targetId: input.targetId,
 		runtimeId: input.runtimeId,
 		keepModelId: input.keepModelId,
-		managed: input.managed ?? residencyManaged(),
+		managed: input.managed ?? true,
 		strategy: "router",
 		listResident: async () => {
 			const models = await fetchRouterModels(input, fetchImpl);

package/src/engine/apis/lmstudio.ts

@@ -16,7 +16,7 @@ import { emitResidencyMutation, emitResidencyNotice, reconcileResidency, residen
 import { withResidencyLock } from "./residency-lock.js";
 
 interface LmStudioModelMetadata {
-	clio?: {
+	clioCoder?: {
 		targetId: string;
 		runtimeId: string;
 		lifecycle?: "user-managed" | "clio-coder-managed";
@@ -42,8 +42,8 @@ function responseInstanceId(data: unknown): string | undefined {
 	return typeof id === "string" && id.trim().length > 0 ? id.trim() : undefined;
 }
 
-function metadata(model: Model<Api>): NonNullable<LmStudioModelMetadata["clio"]> | undefined {
-	return (model as Model<Api> & LmStudioModelMetadata).clio;
+function metadata(model: Model<Api>): NonNullable<LmStudioModelMetadata["clioCoder"]> | undefined {
+	return (model as Model<Api> & LmStudioModelMetadata).clioCoder;
 }
 
 function targetForModel(model: Model<"openai-completions">): TargetDescriptor | null {

package/src/engine/apis/ollama-native.ts

@@ -32,7 +32,7 @@ import {
 } from "../../domains/providers/index.js";
 import type { LocalModelQuirks, SamplingProfile } from "../../domains/providers/types/local-model-quirks.js";
 import { calculateEngineCost } from "../ai.js";
-import { createGemmaChannelFilter } from "../gemma-channel-filter.js";
+import { createGemmaChannelFilter, usesGemmaChannelMarkers } from "../gemma-channel-filter.js";
 import { createSentinelStripper } from "../strip-tokenizer-sentinels.js";
 import { remainingContextMaxTokens } from "./output-budget.js";
 import { type ResidencyAdapter, reconcileResidency, residencyManagedFor } from "./residency.js";
@@ -43,7 +43,7 @@ import type { EngineApiProvider } from "./types.js";
 const REASONING_CHARS_PER_TOKEN = 4;
 
 interface ClioRuntimeMetadata {
-	clio?: {
+	clioCoder?: {
 		targetId: string;
 		runtimeId: string;
 		/** Present only when settings set the target lifecycle explicitly. */
@@ -55,11 +55,11 @@ interface ClioRuntimeMetadata {
 }
 
 function clioQuirks(model: Model<"ollama-native">): LocalModelQuirks | undefined {
-	return (model as Model<"ollama-native"> & ClioRuntimeMetadata).clio?.quirks;
+	return (model as Model<"ollama-native"> & ClioRuntimeMetadata).clioCoder?.quirks;
 }
 
 function ollamaTargetId(model: Model<"ollama-native">): string {
-	return (model as Model<"ollama-native"> & ClioRuntimeMetadata).clio?.targetId ?? model.provider;
+	return (model as Model<"ollama-native"> & ClioRuntimeMetadata).clioCoder?.targetId ?? model.provider;
 }
 
 /**
@@ -74,7 +74,7 @@ function ollamaTargetId(model: Model<"ollama-native">): string {
 async function reconcileOllamaResidency(model: Model<"ollama-native">, headers: Record<string, string>): Promise<void> {
 	const baseUrl = model.baseUrl;
 	if (!baseUrl) return;
-	const metadata = (model as Model<"ollama-native"> & ClioRuntimeMetadata).clio;
+	const metadata = (model as Model<"ollama-native"> & ClioRuntimeMetadata).clioCoder;
 	const adapter: ResidencyAdapter = {
 		targetKey: residencyTargetKey("ollama-native", baseUrl),
 		targetId: ollamaTargetId(model),
@@ -384,7 +384,7 @@ function runStream(
 			let doneReason: string | undefined;
 			const sentinelStripper = createSentinelStripper();
 			const resolved = resolveModelRuntimeCapabilitiesForModel(model, thinkingLevel);
-			const channelFilter = resolved.family === "gemma-4" ? createGemmaChannelFilter() : null;
+			const channelFilter = usesGemmaChannelMarkers(resolved.modelId) ? createGemmaChannelFilter() : null;
 			const closeActiveThinking = () => {
 				if (!activeThinking) return;
 				stream.push({

package/src/engine/apis/openai-completions.ts

@@ -28,12 +28,12 @@ import { lmStudioReasoningEffort } from "../../domains/providers/runtimes/common
 import type { ThinkingLevel } from "../../domains/providers/types/capability-flags.js";
 import type { LocalModelQuirks, SamplingProfile } from "../../domains/providers/types/local-model-quirks.js";
 import type { LmStudioTargetSettings } from "../../domains/providers/types/target-descriptor.js";
-import { filterGemmaChannelStream } from "../gemma-channel-filter.js";
+import { filterGemmaChannelStream, usesGemmaChannelMarkers } from "../gemma-channel-filter.js";
 import { HarmonyResponseParser } from "../harmony-response.js";
 import { createSentinelStripper, stripTokenizerSentinels } from "../strip-tokenizer-sentinels.js";
 import { ensureLlamaCppResidency } from "./llamacpp-residency.js";
 import { ensureLmStudioResidency } from "./lmstudio.js";
-import { LOCAL_TOOL_TURN_MAX_OUTPUT_TOKENS, remainingContextMaxTokens } from "./output-budget.js";
+import { remainingContextMaxTokens } from "./output-budget.js";
 import { residencyManagedFor } from "./residency.js";
 import { mergeSamplingOverride } from "./sampling-overrides.js";
 import type { EngineApiProvider } from "./types.js";
@@ -60,7 +60,7 @@ const REASONING_CHARS_PER_TOKEN = 4;
 export { estimateInputTokensFromContext, remainingContextMaxTokens } from "./output-budget.js";
 
 interface ClioRuntimeMetadata {
-	clio?: {
+	clioCoder?: {
 		targetId: string;
 		runtimeId: string;
 		/** Present only when settings set the target lifecycle explicitly. */
@@ -75,11 +75,11 @@ interface ClioRuntimeMetadata {
 }
 
 function chatTemplateKwargsUnsupported(model: Model<Api>): boolean {
-	return (model as Model<Api> & ClioRuntimeMetadata).clio?.chatTemplateKwargsUnsupported === true;
+	return (model as Model<Api> & ClioRuntimeMetadata).clioCoder?.chatTemplateKwargsUnsupported === true;
 }
 
 function clioQuirks(model: Model<"openai-completions">): LocalModelQuirks | undefined {
-	return (model as Model<"openai-completions"> & ClioRuntimeMetadata).clio?.quirks;
+	return (model as Model<"openai-completions"> & ClioRuntimeMetadata).clioCoder?.quirks;
 }
 
 function pickSamplingProfile(
@@ -138,7 +138,7 @@ function backendCompletionTimings(value: unknown, source: BackendTimingsSource):
 }
 
 function backendTimingsSourceForModel(model: Model<Api>): BackendTimingsSource | null {
-	const metadata = (model as Model<Api> & ClioRuntimeMetadata).clio;
+	const metadata = (model as Model<Api> & ClioRuntimeMetadata).clioCoder;
 	if (model.provider === "llamacpp" && metadata?.runtimeId === "llamacpp") return "llamacpp-timings";
 	if (model.provider === "lmstudio" && metadata?.runtimeId === "lmstudio") return "lmstudio-timings";
 	return null;
@@ -371,8 +371,23 @@ function applyThinkingPayload(
 	resolved: ResolvedModelRuntimeCapabilities,
 	model: Model<Api>,
 ): Record<string, unknown> {
-	if (applied.mechanism === "none") return stripThinkingRequestFields(payload);
-	if (applied.mechanism === "always-on") return payload;
+	if (applied.mechanism === "none") {
+		const next = stripThinkingRequestFields(payload);
+		if (resolved.request.chatTemplateKwargs && !chatTemplateKwargsUnsupported(model)) {
+			const existing = isPlainRecord(next.chat_template_kwargs) ? next.chat_template_kwargs : {};
+			next.chat_template_kwargs = { ...existing, ...resolved.request.chatTemplateKwargs };
+		}
+		return next;
+	}
+	if (applied.mechanism === "always-on") {
+		if (resolved.request.chatTemplateKwargs && !chatTemplateKwargsUnsupported(model)) {
+			const next: Record<string, unknown> = { ...payload };
+			const existing = isPlainRecord(next.chat_template_kwargs) ? next.chat_template_kwargs : {};
+			next.chat_template_kwargs = { ...existing, ...resolved.request.chatTemplateKwargs };
+			return next;
+		}
+		return payload;
+	}
 	const next: Record<string, unknown> = { ...payload };
 	if (
 		resolved.request.reasoningEffort &&
@@ -563,21 +578,9 @@ function withRemainingContextBudget<TOptions extends StreamOptions>(
 	context: Context,
 	options: TOptions | undefined,
 ): TOptions {
-	const metadata = runtimeMetadata(model);
-	const localToolOutputLimit =
-		options?.maxTokens === undefined &&
-		(context.tools?.length ?? 0) > 0 &&
-		(model.provider === "llamacpp" || metadata?.runtimeId === "llamacpp")
-			? LOCAL_TOOL_TURN_MAX_OUTPUT_TOKENS
-			: undefined;
 	return {
 		...(options ?? {}),
-		maxTokens: remainingContextMaxTokens(
-			model,
-			context,
-			options,
-			localToolOutputLimit === undefined ? undefined : { maxOutputTokens: localToolOutputLimit },
-		),
+		maxTokens: remainingContextMaxTokens(model, context, options),
 	} as TOptions;
 }
 
@@ -593,8 +596,8 @@ function hasEmptyArguments(args: Record<string, unknown>): boolean {
 	return Object.keys(args).length === 0;
 }
 
-function runtimeMetadata(model: Model<Api>): NonNullable<ClioRuntimeMetadata["clio"]> | undefined {
-	return (model as Model<Api> & ClioRuntimeMetadata).clio;
+function runtimeMetadata(model: Model<Api>): NonNullable<ClioRuntimeMetadata["clioCoder"]> | undefined {
+	return (model as Model<Api> & ClioRuntimeMetadata).clioCoder;
 }
 
 function emptyErrorMessage(model: Model<"openai-completions">, message: string): AssistantMessage {
@@ -936,7 +939,7 @@ export const openAICompletionsApiProvider: EngineApiProvider<"openai-completions
 										(requestModel) => piOpenAICompletions.stream(requestModel, effectiveContext, capturedOptions),
 									),
 							),
-							resolved.family === "gemma-4",
+							usesGemmaChannelMarkers(resolved.modelId),
 						),
 						resolved,
 					),
@@ -969,7 +972,7 @@ export const openAICompletionsApiProvider: EngineApiProvider<"openai-completions
 										(requestModel) => piOpenAICompletions.streamSimple(requestModel, effectiveContext, capturedOptions),
 									),
 							),
-							resolved.family === "gemma-4",
+							usesGemmaChannelMarkers(resolved.modelId),
 						),
 						resolved,
 					),

package/src/engine/apis/output-budget.ts

@@ -13,7 +13,7 @@ const DEFAULT_MAX_OUTPUT_TOKENS = CLIO_MIN_MAX_OUTPUT_TOKENS;
 
 /**
  * Process-wide default output budget requested per turn, sourced from
- * settings.defaults.maxTokens at session start (see
+ * chat.maxOutputTokens at session start (see
  * {@link setGlobalDefaultMaxOutputTokens}). 0 means unset: callers fall back to
  * the model's advertised cap as before.
  */
@@ -30,19 +30,6 @@ export function setGlobalDefaultMaxOutputTokens(value: number): void {
 	globalDefaultMaxOutputTokens = Number.isFinite(value) && value > 0 ? Math.floor(value) : 0;
 }
 
-/**
- * Output ceiling applied to a llama.cpp tool-bearing turn when the caller did
- * not request an explicit limit. It bounds a genuinely runaway local
- * generation without muzzling real work: a single tool call that writes a
- * sizable file (a full HTML page, a multi-function source module) needs far
- * more than a few thousand tokens of argument, and the tool-call argument
- * counts against this same response budget. Narration loops where a local
- * model keeps saying it will call a tool without emitting one are caught
- * separately by assessToolProseLoop, so this number only has to be large
- * enough to let legitimate large outputs through.
- */
-export const LOCAL_TOOL_TURN_MAX_OUTPUT_TOKENS = CLIO_MIN_MAX_OUTPUT_TOKENS;
-
 /**
  * Tokens a preflight context check should hold back for the response: the
  * smaller of the model's advertised output limit and the default output
@@ -84,15 +71,18 @@ export function remainingContextMaxTokens(
 	const modelLimit = model.maxTokens > 0 ? model.maxTokens : Number.POSITIVE_INFINITY;
 	// Precedence for the requested ceiling when the caller gave no explicit
 	// maxTokens: a more-specific tool-turn limit, then the global default, then
-	// the model's advertised cap. Math.min below clamps the result down to the
-	// model cap and the remaining context budget regardless, so the global
-	// default never lets a small model overshoot what it supports.
+	// the model's advertised cap. A model that advertises no cap uses the product
+	// floor instead of requesting its entire remaining context window. Math.min
+	// below clamps the result down to every known boundary, so frontier providers
+	// with a known cap never receive a larger max_tokens value.
 	const defaultLimit =
 		limits?.maxOutputTokens !== undefined && limits.maxOutputTokens > 0
 			? limits.maxOutputTokens
 			: globalDefaultMaxOutputTokens > 0
 				? globalDefaultMaxOutputTokens
-				: modelLimit;
+				: model.maxTokens > 0
+					? modelLimit
+					: DEFAULT_MAX_OUTPUT_TOKENS;
 	const requested = options?.maxTokens ?? defaultLimit;
 	const resolved = Math.min(requested, modelLimit, budget);
 	return Number.isFinite(resolved) ? resolved : DEFAULT_MAX_OUTPUT_TOKENS;