@jossuealcala/madre 0.7.2 → 1.0.0

package/src/prices.mjs

@@ -0,0 +1,72 @@
+// What a turn would cost at the provider's API list price, for the CLIs that do not say it
+// themselves. Claude Code reports its own figure (`total_cost_usd`); Codex and Gemini report only
+// tokens, and OpenCode reports 0 when the model runs on a subscription. So the room prices those
+// turns from the table below — an estimate, said as one, never a bill.
+//
+// THE TABLE IS ONLY WHAT WAS READ AT THE SOURCE. Every row was read twice on the provider's own
+// pricing page on PRICES_CHECKED; a model that is not here gets no price at all, never a guess
+// from a model that looks like it. Prices are US dollars per million tokens, standard tier, short
+// context (OpenAI ≤ 272K, Google ≤ 200K tokens per request). A turn can make several requests and
+// the room only sees their sum, so the long-context rates are not applied: a turn with one very
+// long request costs more than this says.
+export const PRICES_CHECKED = '2026-10-09';
+// Where they were read. Written down, never reached: MADRE does not fetch prices (no scheme here,
+// so the outbound guard in test/outbound.test.mjs does not take them for destinations).
+export const PRICE_SOURCES = Object.freeze({
+  openai: 'developers.openai.com/api/docs/pricing',
+  google: 'ai.google.dev/gemini-api/docs/pricing',
+});
+
+const LIST = Object.freeze({
+  // OpenAI · input, cached input, output
+  'gpt-6-sol': { input: 2.0, cached: 0.2, output: 10.0 },
+  'gpt-6-luna': { input: 0.1, cached: 0.01, output: 0.5 },
+  'gpt-5.6-sol': { input: 4.0, cached: 0.4, output: 20.0 },
+  'gpt-5.6-terra': { input: 2.0, cached: 0.2, output: 12.0 },
+  'gpt-5.6-luna': { input: 0.2, cached: 0.02, output: 1.2 },
+  'gpt-5.5': { input: 5.0, cached: 0.5, output: 30.0 },
+  // Google · input, context caching, output (thinking included)
+  'gemini-3.1-pro-preview': { input: 2.0, cached: 0.2, output: 12.0 },
+  'gemini-3-flash-preview': { input: 0.5, cached: 0.05, output: 3.0 },
+  'gemini-2.5-pro': { input: 1.25, cached: 0.125, output: 10.0 },
+  'gemini-2.5-flash': { input: 0.3, cached: 0.03, output: 2.5 },
+});
+
+// "openai/gpt-5.6-sol" (OpenCode's provider/model) and "models/gemini-2.5-pro" name the same rows.
+export function listPrice(model) {
+  if (typeof model !== 'string' || !model.trim()) return null;
+  const id = model.trim().toLowerCase().split('/').at(-1);
+  return Object.hasOwn(LIST, id) ? LIST[id] : null;
+}
+
+// How each CLI counts. `cachedIn`: the cached tokens are part of `inputTokens` (OpenAI and Google
+// count them inside the prompt); OpenCode counts them apart. `reasoningIn`: the reasoning tokens
+// are part of `outputTokens` (OpenAI's usage does); Gemini and OpenCode count them apart, and both
+// providers bill them at the output rate.
+const COUNTING = Object.freeze({
+  'codex-json': { cachedIn: true, reasoningIn: true },
+  'gemini-json': { cachedIn: true, reasoningIn: false },
+  'opencode-json': { cachedIn: false, reasoningIn: false },
+});
+
+// Dollars for one model's share of a turn, or null when the model or the counting is unknown.
+export function priceTokens(model, usage, source) {
+  const price = listPrice(model);
+  const counting = COUNTING[source];
+  if (!price || !counting || !usage) return null;
+  const n = (value) => (Number.isFinite(value) && value > 0 ? value : 0);
+  const cached = n(usage.cachedInputTokens);
+  const fresh = counting.cachedIn ? Math.max(0, n(usage.inputTokens) - cached) : n(usage.inputTokens);
+  const output = n(usage.outputTokens) + (counting.reasoningIn ? 0 : n(usage.reasoningTokens));
+  return (fresh * price.input + cached * price.cached + output * price.output) / 1e6;
+}
+
+// A turn's usage with its estimate added, when the CLI did not give a figure of its own. A figure
+// the CLI gave (above zero) is never replaced. The estimate carries which model and which date it
+// was priced at, so the page can say so.
+export function withListPrice(usage, model) {
+  if (!usage || (Number.isFinite(usage.costUsd) && usage.costUsd > 0) || usage.local) return usage;
+  const cost = priceTokens(model, usage, usage.source);
+  if (cost === null) return usage;
+  return { ...usage, costUsd: Math.round(cost * 1e6) / 1e6, costEstimated: true, pricedModel: String(model).split('/').at(-1), pricedAt: PRICES_CHECKED };
+}

package/src/privacy.mjs

@@ -14,7 +14,19 @@
 // What a secret looks like, whatever project it turns up in. The same list the crash reporter
 // has used since the beginning, brought where the room can use it: a credential does not become
 // safe by being in a reply rather than in a stack trace.
+// Widened 2026-10-12 (INI-05 of the 1.0 review): what crosses between projects was cleaned of a few
+// shapes only, and Stripe's live keys, AWS's, private keys, Google's access tokens, a password
+// written as a setting, a bearer token and the credentials inside an address went across as they
+// were. A replacement may be a function of the match, to keep the name and hide only the value.
 const SECRETS = [
+  [/-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g, '[private key]'],
+  [/\b(sk|rk|pk)_(live|test)_[A-Za-z0-9]{16,}\b/g, '[key]'],
+  [/\b(AKIA|ASIA)[0-9A-Z]{16}\b/g, '[key]'],
+  [/\bya29\.[0-9A-Za-z_-]{20,}/g, '[token]'],
+  [/\b(Bearer)\s+[A-Za-z0-9._~+/-]{20,}=*/g, (match, word) => `${word} [token]`],
+  [/\b([a-z][a-z0-9+.-]*:\/\/)[^\s:@/]+:[^\s@/]+@/gi, (match, scheme) => `${scheme}[credentials]@`],
+  [/\b(aws_secret_access_key|password|passwd|pwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token)(\s*[=:]\s*)(["']?)[^\s"']{6,}\3/gi, (match, name, between, quote) => `${name}${between}${quote}[secret]${quote}`],
+  [/\+\d{1,3}[\s-]?\(?\d{2,4}\)?[\s-]?\d{3,4}[\s-]?\d{3,4}\b/g, '[phone]'],
   [/\b(sk|rk|pk)-[A-Za-z0-9_-]{16,}\b/g, '[key]'],
   [/\bAIza[0-9A-Za-z_-]{20,}\b/g, '[key]'],
   [/\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}\b/g, '[token]'],
@@ -120,20 +132,27 @@ export class Privacy {
 
   // The text with every private term replaced by the marker, and the count. The shape guards run
   // too: a key or a home path is caught whether or not anyone thought to name it.
-  redact(text) {
-    if (typeof text !== 'string' || !text) return { text, hits: 0 };
-    let hits = 0;
+  // `kinds` says what was replaced: a term the human named, a key, or a home path. The room's
+  // notice used to call all of them «private terms», so a home path turned into ~ read as a term
+  // that was never written.
+  // `always`: secrets and paths are hidden even where this project switched those guards off —
+  // what one project hands to another (a connection) is not this project's to leave open (INI-05).
+  redact(text, { always = false } = {}) {
+    if (typeof text !== 'string' || !text) return { text, hits: 0, kinds: { terms: 0, secrets: 0, paths: 0 } };
+    const kinds = { terms: 0, secrets: 0, paths: 0 };
     let out = text;
-    if (this.#pattern) out = out.replace(this.#pattern, () => { hits += 1; return this.#marker; });
-    if (this.#secrets) {
-      for (const [pattern, replacement] of SECRETS) out = out.replace(pattern, () => { hits += 1; return replacement; });
+    if (this.#pattern) out = out.replace(this.#pattern, () => { kinds.terms += 1; return this.#marker; });
+    if (this.#secrets || always) {
+      for (const [pattern, replacement] of SECRETS) out = out.replace(pattern, (...match) => { kinds.secrets += 1; return typeof replacement === 'function' ? replacement(...match) : replacement; });
     }
-    if (this.#paths) {
-      if (this.#home) { const parts = out.split(this.#home); hits += parts.length - 1; out = parts.join('~'); }
-      out = out.replace(/\/(Users|home)\/[^/\s"']+/g, () => { hits += 1; return '/$1/…'.replace('$1', RegExp.$1 || 'Users'); });
-      out = out.replace(/[A-Za-z]:\\Users\\[^\\\s"']+/g, () => { hits += 1; return 'C:\\Users\\…'; });
+    if (this.#paths || always) {
+      if (this.#home) { const parts = out.split(this.#home); kinds.paths += parts.length - 1; out = parts.join('~'); }
+      // The folder named as it was (`RegExp.$1` read whatever the last match anywhere left there,
+      // so a /home/ path came back as /Users/).
+      out = out.replace(/\/(Users|home)\/[^/\s"']+/g, (match, top) => { kinds.paths += 1; return `/${top}/…`; });
+      out = out.replace(/[A-Za-z]:\\Users\\[^\\\s"']+/g, () => { kinds.paths += 1; return 'C:\\Users\\…'; });
     }
-    return { text: out, hits };
+    return { text: out, hits: kinds.terms + kinds.secrets + kinds.paths, kinds };
   }
 
   // Every string inside a value (an event payload, a plan), replaced in place of

package/src/quota-sources.mjs

@@ -151,11 +151,3 @@ export function defaultQuotaSources({ env = process.env } = {}) {
   return sources;
 }
 
-// Human-readable window label for the room: "5h" / "7d" / "300m".
-export function windowLabel(minutes) {
-  if (!Number.isFinite(Number(minutes))) return 'window';
-  const m = Number(minutes);
-  if (m % 1440 === 0) return `${m / 1440}d`;
-  if (m % 60 === 0) return `${m / 60}h`;
-  return `${m}m`;
-}

package/src/request-guard.mjs

@@ -22,5 +22,5 @@ export function refuseForeign({ method = 'GET', headers = {} } = {}) {
   const origin = headers.origin;
   if (SAFE.has(method) || origin === undefined) return null;
   if (origin === `http://${headers.host}` || origin === `https://${headers.host}`) return null;
-  return 'A page from somewhere else cannot act in this room.';
+  return 'A page from somewhere else cannot act in this project.';
 }

package/src/review-ask.mjs

@@ -0,0 +1,111 @@
+// Asking for a star or a review (2026-10-10): three times at most, and never again once answered.
+//
+// After twenty minutes of MADRE in use, and on the second and the seventh day after it was first
+// used, the room asks once whether MADRE is being liked: a star on GitHub, or a review on
+// madre.run. Whoever answers — a star, a review, or «don't ask again» — is never asked again; «not
+// now» only lets that moment pass. A later moment that comes first takes the earlier ones with it,
+// so nobody is asked twice in a row, and never twice within a day.
+//
+// Use is counted by the pages themselves: while one is in view it says so once a minute, and the
+// minutes are added here, one per minute however many pages are open. What is kept lives in
+// ~/.pulse/review-ask.json, not in a browser: each room is its own origin, and the same person on
+// another port has been asked already. Nothing here touches the network; the two links are opened
+// by the person, in their browser.
+
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { oneAtATime, writeWhole } from './json-file.mjs';
+
+const FILE = 'review-ask.json';
+const DAY = 24 * 60 * 60 * 1000;
+export const ASK_MOMENTS = [
+  { id: 'm20', reached: (state) => state.minutes >= 20 },
+  { id: 'd2', reached: (state, now) => now - Date.parse(state.first) >= 2 * DAY },
+  { id: 'd7', reached: (state, now) => now - Date.parse(state.first) >= 7 * DAY },
+];
+export const ASK_ANSWERS = ['later', 'star', 'review', 'never'];
+// One minute of use is counted at most once a minute, whichever page says it.
+const TICK_MS = 55 * 1000;
+// Never asked twice within this long, whatever moments have come.
+const QUIET_MS = 20 * 60 * 60 * 1000;
+
+const fresh = () => ({ first: null, minutes: 0, lastTick: null, shown: {}, answer: null, offered: null });
+// A moment handed to one page is not handed to another for this long (WEB-12 of the 1.0 review):
+// every page in view ticks — Home, each project, each half of a split view — and each one asked.
+const OFFER_HOLD_MS = 10 * 60 * 1000;
+
+export async function readAsk(root) {
+  try {
+    const raw = JSON.parse(await readFile(join(root, FILE), 'utf8'));
+    const state = fresh();
+    if (typeof raw?.first === 'string' && Number.isFinite(Date.parse(raw.first))) state.first = raw.first;
+    if (Number.isFinite(raw?.minutes) && raw.minutes >= 0) state.minutes = Math.floor(raw.minutes);
+    if (typeof raw?.lastTick === 'string' && Number.isFinite(Date.parse(raw.lastTick))) state.lastTick = raw.lastTick;
+    if (raw?.shown && typeof raw.shown === 'object') for (const { id } of ASK_MOMENTS) if (typeof raw.shown[id] === 'string') state.shown[id] = raw.shown[id];
+    if (ASK_ANSWERS.includes(raw?.answer) && raw.answer !== 'later') state.answer = raw.answer;
+    if (typeof raw?.offered?.moment === 'string' && Number.isFinite(Date.parse(raw.offered.at))) state.offered = { moment: raw.offered.moment, at: raw.offered.at };
+    return state;
+  } catch {
+    return fresh();
+  }
+}
+
+async function writeAsk(root, state) {
+  await writeWhole(join(root, FILE), `${JSON.stringify(state, null, 2)}\n`);
+}
+
+// The moment that is due now, or null: the latest one reached and not shown yet, unless the person
+// already answered or was asked within the last QUIET_MS.
+export function dueMoment(state, now = Date.now()) {
+  if (state.answer || !state.first) return null;
+  const last = Math.max(0, ...Object.values(state.shown).map((at) => Date.parse(at)).filter(Number.isFinite));
+  if (last && now - last < QUIET_MS) return null;
+  const reached = ASK_MOMENTS.filter((moment) => !state.shown[moment.id] && moment.reached(state, now));
+  return reached.at(-1)?.id ?? null;
+}
+
+// A page in view says so: the first time starts the count, then a minute is added at most once a
+// minute. Answers which moment is due, if any.
+// `quietSince`: a moment that asks for quiet — the day of the bonjour (src/tour.mjs) — keeps every
+// ask away for QUIET_MS after it, as an ask itself would. The minutes still count.
+// One change at a time (src/json-file.mjs): every page in view ticks, from every project.
+export function tickAsk(root, now = Date.now(), options = {}) {
+  return oneAtATime(join(root, FILE), () => tick(root, now, options));
+}
+async function tick(root, now, { quietSince = null } = {}) {
+  const state = await readAsk(root);
+  const at = new Date(now).toISOString();
+  if (!state.first) state.first = at;
+  const last = state.lastTick ? Date.parse(state.lastTick) : 0;
+  if (!last || now - last >= TICK_MS) {
+    if (last) state.minutes += 1;
+    state.lastTick = at;
+    await writeAsk(root, state);
+  }
+  const hushed = quietSince && now - Date.parse(quietSince) < QUIET_MS;
+  const due = hushed ? null : dueMoment(state, now);
+  if (!due) return { due: null, minutes: state.minutes };
+  if (state.offered?.moment === due && now - Date.parse(state.offered.at) < OFFER_HOLD_MS) return { due: null, minutes: state.minutes };
+  state.offered = { moment: due, at: new Date(now).toISOString() };
+  await writeAsk(root, state);
+  return { due, minutes: state.minutes };
+}
+
+// The person answered the moment they were asked at. Every moment reached by then counts as shown,
+// so an earlier one never comes after a later one; any answer but «not now» ends the asking.
+export function answerAsk(root, said, now = Date.now()) {
+  return oneAtATime(join(root, FILE), () => recordAnswer(root, said, now));
+}
+async function recordAnswer(root, { moment, answer }, now) {
+  if (!ASK_ANSWERS.includes(answer)) return { error: 'answer' };
+  if (!ASK_MOMENTS.some(({ id }) => id === moment)) return { error: 'moment' };
+  const state = await readAsk(root);
+  const at = new Date(now).toISOString();
+  if (!state.first) state.first = at;
+  for (const one of ASK_MOMENTS) {
+    if (!state.shown[one.id] && (one.id === moment || one.reached(state, now))) state.shown[one.id] = at;
+  }
+  if (answer !== 'later') state.answer = answer;
+  await writeAsk(root, state);
+  return { answer: state.answer, shown: state.shown };
+}

package/src/room/archivist.mjs

@@ -19,6 +19,12 @@ export function distillDefaults(distill = {}, env = process.env) {
   };
 }
 
+// The project's memory is one, and every conversation alive at once has its archivist (2026-10-12,
+// LOG-06 of the 1.0 review): each asked for the same undistilled batch and paid a provider for it,
+// and the notes came out twice. One batch at a time per memory: whoever finds one being distilled
+// waits for it and then reads what is left.
+const distilling = new WeakMap();   // memory -> the batch being distilled
+
 export class Archivist {
   #memory;
   #settings;
@@ -81,49 +87,61 @@ export class Archivist {
     if (!this.#memory) return null;
     if (this.#running) return this.#running;
     this.#running = (async () => {
-      const batch = this.#memory.undistilled({ maxChars: this.#settings.maxChars });
-      if (!batch.entries.length) return null;
-      const invokers = this.#deps.invokers();
-      const busy = this.#deps.busyAgents();
-      const now = Date.now();
-      for (const [id, until] of this.#bench) if (until <= now) this.#bench.delete(id);
-      const benched = new Set(this.#bench.keys());
-      const candidates = this.#candidates();
-      let agent = pickDistiller(candidates, { preferred: this.#settings.agent, busy, invokers, benched });
-      if (!agent && benched.size) { this.#bench.clear(); agent = pickDistiller(candidates, { preferred: this.#settings.agent, busy, invokers }); }
-      if (!agent) return null;
-      const started = Date.now();
+      while (distilling.has(this.#memory)) await distilling.get(this.#memory).catch(() => null);
+      let release;
+      distilling.set(this.#memory, new Promise((resolve) => { release = resolve; }));
       try {
-        const local = agent.adapter === 'ollama';
-        const brief = this.#memory.briefing();
-        const prompt = distillPrompt({ entries: batch.entries, projectName: this.#deps.projectName(), existing: brief.standing, discarded: brief.discarded, json: local });
-        const result = await invokers[agent.adapter]({ executable: agent.path, projectRoot: this.#deps.projectRoot(), prompt, timeoutMs: local ? this.#deps.localTimeoutMs() : this.#deps.timeoutFor(agent.id), model: local ? null : this.#settings.model, json: local, attachments: [], lease: null, scopes: { web: false, imageGen: false }, imageStudio: null });
-        const memories = parseDistillation(result?.text, { fromSequence: batch.fromSequence, throughSequence: batch.throughSequence });
-        const added = this.#memory.addMemories(memories, { agent: agent.id, fromSequence: batch.fromSequence, throughSequence: batch.throughSequence });
-        this.#memory.markDistilled(batch.sequences);
-        this.#failures.delete(batch.fromSequence);
-        // Local tokens cost nothing and count against no provider budget; they are reported, not charged.
-        if (!local) await this.#deps.recordUsage(agent.id, result?.usage ?? null);
-        const kinds = {};
-        for (const memory of memories) kinds[memory.kind] = (kinds[memory.kind] ?? 0) + 1;
-        const report = { agent: agent.id, local, model: local ? result?.usage?.model ?? null : this.#settings.model, tokens: result?.usage?.totalTokens ?? null, added, parsed: memories.length, considered: batch.entries.length, fromSequence: batch.fromSequence, throughSequence: batch.throughSequence, remaining: batch.remaining, kinds, elapsedMs: Date.now() - started, total: this.#memory.memoryCount() };
-        await this.#deps.emit('memory.distilled', report);
-        return report;
-      } catch (error) {
-        const attempts = (this.#failures.get(batch.fromSequence) ?? 0) + 1;
-        this.#failures.set(batch.fromSequence, attempts);
-        const skipped = attempts >= 3;
-        if (skipped) { this.#memory.markDistilled(batch.sequences); this.#failures.delete(batch.fromSequence); }
-        this.#bench.set(agent.id, Date.now() + BENCH_MS);
-        const next = pickDistiller(candidates, { preferred: this.#settings.agent, busy: new Set(), invokers, benched: new Set(this.#bench.keys()) });
-        const report = { agent: agent.id, error: this.#deps.failureMessage(error), attempts, skipped, next: next?.id ?? null, fromSequence: batch.fromSequence, throughSequence: batch.throughSequence, considered: batch.entries.length, remaining: batch.remaining };
-        await this.#deps.emit('memory.distilled', report);
-        return report;
+        return await this.#distil();
+      } finally {
+        distilling.delete(this.#memory);
+        release();
       }
     })().finally(() => { this.#running = null; });
     return this.#running;
   }
 
+  async #distil() {
+    const batch = this.#memory.undistilled({ maxChars: this.#settings.maxChars });
+    if (!batch.entries.length) return null;
+    const invokers = this.#deps.invokers();
+    const busy = this.#deps.busyAgents();
+    const now = Date.now();
+    for (const [id, until] of this.#bench) if (until <= now) this.#bench.delete(id);
+    const benched = new Set(this.#bench.keys());
+    const candidates = this.#candidates();
+    let agent = pickDistiller(candidates, { preferred: this.#settings.agent, busy, invokers, benched });
+    if (!agent && benched.size) { this.#bench.clear(); agent = pickDistiller(candidates, { preferred: this.#settings.agent, busy, invokers }); }
+    if (!agent) return null;
+    const started = Date.now();
+    try {
+      const local = agent.adapter === 'ollama';
+      const brief = this.#memory.briefing();
+      const prompt = distillPrompt({ entries: batch.entries, projectName: this.#deps.projectName(), existing: brief.standing, discarded: brief.discarded, json: local });
+      const result = await invokers[agent.adapter]({ executable: agent.path, projectRoot: this.#deps.projectRoot(), prompt, timeoutMs: local ? this.#deps.localTimeoutMs() : this.#deps.timeoutFor(agent.id), model: local ? null : this.#settings.model, json: local, attachments: [], lease: null, scopes: { web: false, imageGen: false }, imageStudio: null });
+      const memories = parseDistillation(result?.text, { fromSequence: batch.fromSequence, throughSequence: batch.throughSequence });
+      const added = this.#memory.addMemories(memories, { agent: agent.id, fromSequence: batch.fromSequence, throughSequence: batch.throughSequence });
+      this.#memory.markDistilled(batch.sequences);
+      this.#failures.delete(batch.fromSequence);
+      // Local tokens cost nothing and count against no provider budget; they are reported, not charged.
+      if (!local) await this.#deps.recordUsage(agent.id, result?.usage ?? null);
+      const kinds = {};
+      for (const memory of memories) kinds[memory.kind] = (kinds[memory.kind] ?? 0) + 1;
+      const report = { agent: agent.id, local, model: local ? result?.usage?.model ?? null : this.#settings.model, tokens: result?.usage?.totalTokens ?? null, added, parsed: memories.length, considered: batch.entries.length, fromSequence: batch.fromSequence, throughSequence: batch.throughSequence, remaining: batch.remaining, kinds, elapsedMs: Date.now() - started, total: this.#memory.memoryCount() };
+      await this.#deps.emit('memory.distilled', report);
+      return report;
+    } catch (error) {
+      const attempts = (this.#failures.get(batch.fromSequence) ?? 0) + 1;
+      this.#failures.set(batch.fromSequence, attempts);
+      const skipped = attempts >= 3;
+      if (skipped) { this.#memory.markDistilled(batch.sequences); this.#failures.delete(batch.fromSequence); }
+      this.#bench.set(agent.id, Date.now() + BENCH_MS);
+      const next = pickDistiller(candidates, { preferred: this.#settings.agent, busy: new Set(), invokers, benched: new Set(this.#bench.keys()) });
+      const report = { agent: agent.id, error: this.#deps.failureMessage(error), attempts, skipped, next: next?.id ?? null, fromSequence: batch.fromSequence, throughSequence: batch.throughSequence, considered: batch.entries.length, remaining: batch.remaining };
+      await this.#deps.emit('memory.distilled', report);
+      return report;
+    }
+  }
+
   // Tests: run a distillation that is due by count without waiting for its
   // timer, leave an idle wait alone, and let a run in flight finish.
   async settle() {

package/src/room/budget.mjs

@@ -2,14 +2,26 @@
 // providers' short windows), raw totals for the record, and the seeding of the
 // usage sentinel from the ledger on start.
 
-// What a turn costs against MADRE's local budget. Cache reads are close to
-// free at every provider, so they weigh a tenth; Codex counts cached tokens
-// inside its input, so they are taken out before weighing.
+// Which CLIs count what they read back from a cache INSIDE the input they report: Codex
+// (input_tokens includes cached_input_tokens) and Gemini (its prompt count includes the cached
+// part; stream-json even prints both). Claude and OpenCode report the cache beside the input.
+// Summed as if they were all the same, the economy called 2.1 M tokens «charged as fresh» in a
+// room where the fresh reading was 0.36 M, and counted the same cache twice.
+export const INPUT_HOLDS_CACHE = new Set(['codex-json', 'gemini-json']);
+const num = (value) => (Number.isFinite(Number(value)) ? Number(value) : 0);
+export function freshInput(usage = {}) {
+  const input = num(usage.inputTokens);
+  return INPUT_HOLDS_CACHE.has(usage.source) ? Math.max(0, input - num(usage.cachedInputTokens)) : input;
+}
+
+// What a turn costs against MADRE's local budget. Cache reads are close to free at every
+// provider, so they weigh a tenth, and they are taken out of the input first where a CLI counts
+// them inside it.
 export function budgetTokens(usage = {}) {
   if (usage.local) return 0;
-  const n = (value) => (Number.isFinite(Number(value)) ? Number(value) : 0);
+  const n = num;
   const cached = n(usage.cachedInputTokens);
-  const input = usage.source === 'codex-json' ? Math.max(0, n(usage.inputTokens) - cached) : n(usage.inputTokens);
+  const input = freshInput(usage);
   const fresh = input + n(usage.cacheCreationInputTokens) + n(usage.outputTokens) + n(usage.reasoningTokens);
   if (!fresh && !cached) return n(usage.totalTokens);
   return Math.round(fresh + cached * 0.1);

package/src/room/control.mjs

@@ -2,18 +2,53 @@
 // is taken before, the diff is read after, writes into forbidden zones are
 // restored on the spot, and the checkpoint stays for UNDO. One holder at a time.
 
-import { createCheckpoint, diffCheckpoint, restoreCheckpoint } from '../checkpoint.mjs';
+import { createCheckpoint, diffCheckpoint, restoreCheckpoint, settleControls } from '../checkpoint.mjs';
 import { guardForbidden } from './guard.mjs';
 
 export class ControlDesk {
   #projectRoot;
   #holder = null;             // { agent, messageId, checkpoint, since }
   #checkpoints = new Map();   // id -> checkpoint (for UNDO after the turn)
+  // Every turn writing in the project right now, CREATE or CONTROL, in any conversation. Two at
+  // once cannot be told apart afterwards: each settles against its own photograph and claims, or
+  // puts back, what the other wrote. A README one conversation's OpenCode created was listed as
+  // the work of another conversation's Codex. So the project has one writer at a time.
+  #writers = new Set();
+  #waiting = [];
 
-  constructor({ projectRoot }) {
+  #guardRecord;
+
+  // `guardRecord`: where the locks of a turn are written down, outside the project (room/guard.mjs).
+  constructor({ projectRoot, guardRecord = null }) {
     this.#projectRoot = projectRoot;
+    this.#guardRecord = guardRecord;
   }
   get holder() { return this.#holder; }
+  // Who is writing now, for the line that says why a turn is waiting.
+  writer() { return [...this.#writers][0] ?? null; }
+
+  // The project's one pen: taken the moment it is free, in the same tick it is seen free, so two
+  // turns can never both find it free. Waits otherwise; a stop while waiting rejects, and the
+  // turn ends having written nothing.
+  async #takePen(signal = null, agent = null) {
+    while (this.#writers.size) {
+      await new Promise((resolve, reject) => {
+        const entry = { resolve, reject };
+        this.#waiting.push(entry);
+        signal?.addEventListener?.('abort', () => {
+          this.#waiting = this.#waiting.filter((one) => one !== entry);
+          reject(Object.assign(new Error(String(signal.reason ?? 'stopped')), { code: 'ABORT_ERR' }));
+        }, { once: true });
+      });
+    }
+    const pen = { pen: true, agent };
+    this.#writers.add(pen);
+    return pen;
+  }
+  #wakeOne() {
+    if (this.#writers.size) return;
+    this.#waiting.shift()?.resolve();
+  }
   status() {
     return this.#holder ? { agent: this.#holder.agent, messageId: this.#holder.messageId, checkpointId: this.#holder.checkpoint.id, since: this.#holder.since } : null;
   }
@@ -22,14 +57,25 @@ export class ControlDesk {
   // makes the whole project writable, and what the room should announce.
   // mode 3 (CONTROL) seats one holder for the whole project; mode 2 (CREATE) takes the same
   // photograph without a seat: the project is writable for new files, and settle() puts back
-  // whatever existed before. Several #2 turns may run at once.
-  async begin({ agent, messageId, enabledScopes, mode = 3 }) {
-    const checkpoint = await createCheckpoint(this.#projectRoot, { id: `${new Date().toISOString().replace(/[-:.TZ]/g, '').slice(0, 14)}-${messageId.slice(0, 8)}`, label: `MADRE ${mode === 3 ? 'control' : 'create'} @${agent.id}` });
+  // whatever existed before. One writing turn at a time in the project, across conversations: a
+  // second one waits for the pen (see #writers).
+  async begin({ agent, messageId, enabledScopes, mode = 3, signal = null }) {
+    const pen = await this.#takePen(signal, agent.id);
+    let checkpoint;
+    try {
+      checkpoint = await createCheckpoint(this.#projectRoot, { id: `${new Date().toISOString().replace(/[-:.TZ]/g, '').slice(0, 14)}-${messageId.slice(0, 8)}`, label: `MADRE ${mode === 3 ? 'control' : 'create'} @${agent.id}` });
+    } catch (error) {
+      this.#writers.delete(pen);
+      this.#wakeOne();
+      throw error;
+    }
     checkpoint.agent = agent.id;
     this.#checkpoints.set(checkpoint.id, checkpoint);
     // Prevention first: .env files and MADRE's folders are read-only for the length of the turn.
-    const guard = await guardForbidden(this.#projectRoot);
+    const guard = await guardForbidden(this.#projectRoot, { record: this.#guardRecord });
     const run = { agent: agent.id, messageId, checkpoint, since: new Date().toISOString(), guard, mode, scratchDir: null };
+    this.#writers.delete(pen);
+    this.#writers.add(run);
     if (mode >= 3) this.#holder = run;
     const lease = { leaseId: checkpoint.id, outDir: this.#projectRoot, relativeDir: '.', scopes: { ...enabledScopes, write: true }, control: mode >= 3, airlock: mode === 4, create: mode === 2, checkpoint };
     if (mode < 3) return { run, lease, announcement: null };
@@ -41,6 +87,10 @@ export class ControlDesk {
   // What really changed, with forbidden zones already restored. In a #2 turn every change to
   // a file that existed before (modified, deleted, renamed) is restored too: CREATE adds, only.
   async settle(run) {
+    // What the turn wrote into a repository's own settings, hooks or attributes goes back first,
+    // before git runs again (src/checkpoint.mjs). Not after #4: there the agent runs commands
+    // already, and configuring a remote it was asked to configure is its work.
+    const controls = run.mode === 4 ? [] : await settleControls(run.checkpoint);
     const diff = await diffCheckpoint(this.#projectRoot, run.checkpoint);
     const additive = run.mode === 2;
     // The draft folder MADRE itself hands the agent lives under `.pulse/out/`, and `.pulse/` is a
@@ -58,7 +108,7 @@ export class ControlDesk {
       reverted = [...restored.restored, ...restored.removed];
     }
     const kept = diff.files.filter((file) => !toRevert.has(file.path));
-    const changes = { checkpointId: run.checkpoint.id, agent: run.agent, messageId: run.messageId, mode: run.mode ?? 3, files: kept, stat: diff.stat, forbiddenReverted: reverted.filter((path) => diff.forbidden.includes(path) && !mine(path)), existingReverted: additive ? reverted.filter((path) => !diff.forbidden.includes(path)) : [] };
+    const changes = { checkpointId: run.checkpoint.id, agent: run.agent, messageId: run.messageId, mode: run.mode ?? 3, files: kept, stat: diff.stat, forbiddenReverted: [...controls, ...reverted.filter((path) => diff.forbidden.includes(path) && !mine(path))], existingReverted: additive ? reverted.filter((path) => !diff.forbidden.includes(path)) : [] };
     const count = changes.files.length;
     const notes = [
       changes.forbiddenReverted.length ? `${changes.forbiddenReverted.length} write(s) into forbidden zones were reverted.` : null,
@@ -68,11 +118,24 @@ export class ControlDesk {
     return changes;
   }
 
+  // What changed, or — when git cannot say — that it could not, with the checkpoint still there
+  // for UNDO. A turn that finished is never turned into a failed one by the reading of it: its
+  // answer was lost along with the list when this threw.
+  async settleOrSay(run) {
+    try {
+      return await this.settle(run);
+    } catch (error) {
+      const reason = String(error?.stderr || error?.message || error).split('\n').map((line) => line.trim()).filter(Boolean).at(-1) ?? 'unknown error';
+      return { checkpointId: run.checkpoint.id, agent: run.agent, messageId: run.messageId, mode: run.mode ?? 3, files: [], stat: '', forbiddenReverted: [], existingReverted: [], unreadable: reason, message: `MADRE could not read what @${run.agent} changed (${reason.slice(0, 160)}). The checkpoint taken before the turn is still there: UNDO goes back to it.` };
+    }
+  }
+
   // Whichever way the turn ended, the seat is free again and the locks come off; the checkpoint stays.
   async release(run) {
     if (!run) return;
     await run.guard?.release?.();
     if (this.#holder === run) this.#holder = null;
+    if (this.#writers.delete(run)) this.#wakeOne();
   }
 
   // A photograph with no seat and no locks, for a command the human runs by hand: the human may

package/src/room/economy.mjs

@@ -1,3 +1,5 @@
+import { freshInput } from './budget.mjs';
+
 // What a turn actually costs, and where it went.
 //
 // Pure functions here. The room hands in the blocks a prompt was built from and what the CLI
@@ -60,7 +62,9 @@ export function turnCost(parts = [], usage = null) {
     chars += size;
   }
   const fixed = Object.entries(blocks).reduce((sum, [id, size]) => sum + (ALWAYS.has(id) ? size : 0), 0);
-  const input = Number(usage?.inputTokens ?? 0) || 0;
+  // Fresh reading only: a CLI that counts its cache inside the input has it taken out here, so
+  // every turn's `input` means the same thing whoever answered it.
+  const input = usage ? freshInput(usage) : 0;
   const cached = Number(usage?.cachedInputTokens ?? 0) || 0;
   const created = Number(usage?.cacheCreationInputTokens ?? 0) || 0;
   const output = Number(usage?.outputTokens ?? 0) || 0;
@@ -70,7 +74,7 @@ export function turnCost(parts = [], usage = null) {
   const perToken = input > 0 ? Number((chars / input).toFixed(2)) : null;
   return {
     chars, fixed, carried: chars - fixed, blocks, prefix: stablePrefix(parts),
-    input, cached, created, output,
+    input, cached, created, output, basis: 'fresh',
     cacheShare: input + cached > 0 ? Number((cached / (input + cached)).toFixed(3)) : null,
     charsPerInputToken: perToken,
   };
@@ -164,14 +168,22 @@ export function economy(events = []) {
   for (const event of events) {
     if (event?.type !== 'turn.cost') continue;
     const cost = event.payload;
-    if (cost && typeof cost === 'object') turns.push(cost);
+    if (!cost || typeof cost !== 'object') continue;
+    // Weighed before `input` meant fresh reading for everyone: Codex and Gemini had their cache
+    // inside it. Read the old record the way it was written.
+    const legacy = cost.basis !== 'fresh' && ['codex', 'gemini'].includes(cost.agent);
+    turns.push(legacy ? { ...cost, input: Math.max(0, (Number(cost.input) || 0) - (Number(cost.cached) || 0)), basis: 'fresh' } : cost);
   }
   if (!turns.length) return { turns: 0, blocks: [], agents: [], totals: null, free: { turns: 0, share: 0, paidOutputMedian: null }, ash: ashObservation([]) };
 
+  // What was charged is read from the turns that had a bill. @madre answers on this computer: it
+  // reports the tokens its model read, and those were never charged, so its turns are counted
+  // below as turns with no bill and never added to what was.
+  const billed = turns.filter((turn) => turn.agent !== 'madre');
   const blocks = new Map();
   const agents = new Map();
   const totals = { chars: 0, fixed: 0, carried: 0, prefix: 0, input: 0, cached: 0, created: 0, output: 0 };
-  for (const turn of turns) {
+  for (const turn of billed) {
     for (const key of Object.keys(totals)) totals[key] += Number(turn[key] ?? 0) || 0;
     for (const [id, size] of Object.entries(turn.blocks ?? {})) {
       const seen = blocks.get(id) ?? { id, chars: 0, turns: 0, always: ALWAYS.has(id) };
@@ -180,9 +192,9 @@ export function economy(events = []) {
       blocks.set(id, seen);
     }
     const who = turn.agent ?? 'unknown';
-    const mine = agents.get(who) ?? { agent: who, turns: 0, input: 0, cached: 0, output: 0, chars: 0 };
+    const mine = agents.get(who) ?? { agent: who, turns: 0, input: 0, cached: 0, created: 0, output: 0, chars: 0 };
     mine.turns += 1;
-    for (const key of ['input', 'cached', 'output', 'chars']) mine[key] += Number(turn[key] ?? 0) || 0;
+    for (const key of ['input', 'cached', 'created', 'output', 'chars']) mine[key] += Number(turn[key] ?? 0) || 0;
     agents.set(who, mine);
   }
 
@@ -211,7 +223,7 @@ export function economy(events = []) {
     tokens: totals.cached + tokensFor(spared),
   };
 
-  // Turns the room answered itself. @madre runs on this computer and reports no usage at all, so
+  // Turns the room answered itself. @madre runs on this computer and nothing it reads is billed, so
   // these are not a saving measured against something — they are turns with no bill. The median
   // of what a paid turn cost in THIS room is given beside them so the count has a scale, and it
   // is named as what it is: what other turns cost, not what these would have.
@@ -223,8 +235,24 @@ export function economy(events = []) {
     paidOutputMedian: paidOutputs.length ? median(paidOutputs) : null,
   };
 
+  // What an MCP server carried costs: its tool list rides in every call a CLI makes inside a turn.
+  // Set against the same agent's turns without it, and only once each side has two turns, because
+  // one agent's turns already differ by an order of magnitude from one request to the next.
+  const servers = [];
+  const weighed = billed.filter((turn) => Array.isArray(turn.servers) && !turn.failed);
+  for (const agent of new Set(weighed.map((turn) => turn.agent))) {
+    const own = weighed.filter((turn) => turn.agent === agent);
+    for (const server of new Set(own.flatMap((turn) => turn.servers))) {
+      const carried = own.filter((turn) => turn.servers.includes(server)).map((turn) => Number(turn.input) || 0);
+      const without = own.filter((turn) => !turn.servers.includes(server)).map((turn) => Number(turn.input) || 0);
+      if (carried.length >= 2 && without.length >= 2) servers.push({ agent, server, with: carried.length, without: without.length, medianWith: median(carried), medianWithout: median(without) });
+    }
+  }
+
   return {
     turns: turns.length,
+    billed: billed.length,
+    servers,
     saved,
     free: freeTurns,
     ash: ashObservation(turns),