@mafdet/cli 0.4.3 → 0.4.5

package/CHANGELOG.md

@@ -6,6 +6,113 @@ The version is the contract for the JSON output shapes and the exit codes.
 Being 0.x, semver still permits a break in a minor bump; the intent is not to
 use that latitude, and the promise becomes binding at 1.0.0.
 
+## 0.4.5 - 2026-08-12
+
+A second audit round, and the security fix in it is the important one.
+
+**With no tool-calling model, the interactive session no longer opens.** It
+used to print a warning and then offer every chat model - so the one case with
+nothing safe to offer was the case that offered everything, and the agent then
+ran on a model whose tool calling had never been verified. `mafdet agent`
+refused the same model outright, so the two surfaces disagreed about
+admission. They no longer do.
+
+**A cost ceiling that cannot be enforced stops the run.** When the catalogue
+has no price for a model, each turn counted as zero towards `--max-cost-usd`,
+so the ceiling quietly stopped being one while the run kept spending. Asking
+for a limit we cannot apply now ends the run and says why.
+
+**Context compaction keeps going until the history fits.** It used to drop a
+single tool exchange and send regardless, which changes nothing when the
+history is several times over the window - the request then failed upstream
+and was billed for the attempt.
+
+**A stream is closed when the answer ends.** `[DONE]` means the reply is
+complete, not that the socket is; an upstream that kept the connection open
+held ours too. There is also a total deadline now, because a trickle of bytes
+defeats an idle one.
+
+**More of what reaches the terminal is sanitised**: the answer from `mafdet
+agent`, the interactive session's answer, the session picker, the resume
+notice and the remaining `sessions` columns. The stripper also handles the
+8-bit C1 forms, which do the same things without an escape character.
+
+**An unpriced request is no longer displayed as `$0.00`** in `sessions list`,
+`show` or `usage`, and the JSON carries `unpriced_requests` so a script can
+tell the difference too.
+
+Also: `sessions list` refuses stray arguments like the other subcommands;
+`mafdet agent` documents `--title`, `--no-history` and `--read-only`, shows
+the first-save notice, and closes its recorder even when the session throws;
+resuming no longer asks you to pick a model it is going to ignore, and the
+banner names the model actually in use; and the Windows command-timeout note
+now says the `taskkill` path is written but unverified, rather than describing
+the implementation it replaced.
+
+## 0.4.4 - 2026-08-11
+
+A security fix and twenty-one other corrections, all from an external audit of
+the 0.4.3 release.
+
+**Session ids are now checked before they become paths.** `mafdet sessions
+show`, `usage`, `delete` and `--resume` each joined whatever you typed onto
+the sessions directory, and `join` resolves `..` - so an id like
+`../../../something` reached outside the store. Reading it leaked another
+directory's contents, and `sessions delete ../../../something --yes` removed
+that directory's files. This was present from 0.3.0. It requires you (or a
+script running as you) to pass such a path - the agent has no way to invoke
+these commands - but it was a real destructive defect and it is fixed.
+
+**Resuming a conversation now honours what it says.** Blockers were computed
+and printed and then ignored, so a session whose workspace had been deleted,
+or whose model your key can no longer call, continued anyway - and it
+continued in your _current_ directory rather than the recorded one, which with
+`--allow-write` meant carrying one project's conversation into another
+project's files. A resumed session now runs where it was recorded, on the
+model it was recorded with, and refuses when it cannot.
+
+**Deleting reports what happened.** Every failure used to be swallowed and
+"deleted" printed regardless. It now takes the session lock first and only
+claims success when the directory is gone.
+
+**`--read-only` works in the interactive session.** It existed only in `mafdet
+agent`, so `mafdet --allow-write --read-only` was read-only there and
+write-enabled here.
+
+**Streams have limits.** The request timeout was cleared when the response
+headers arrived, which for a stream is the beginning: a gateway that then went
+quiet hung the CLI indefinitely. There is now a per-chunk idle deadline and a
+byte cap, and both close the connection.
+
+**Terminal control sequences.** A model's reply and a session's title, model
+and workspace are stripped of escape sequences when a terminal is reading
+them. Redirected output still receives exact bytes.
+
+**Context compaction covers conversations without tools**, and when nothing
+can safely be dropped the run stops and says so instead of sending a request
+that is over the window.
+
+**An unpriced request is no longer recorded as costing zero** - unknown and
+free are different claims.
+
+**`approvalMode` and `testCommands` are removed from the config.** They were
+accepted, displayed by `config list`, and read by nothing, so setting
+`auto-edit` looked like it turned approval off. They are removed rather than
+implemented because in a project file both would let a cloned repository raise
+its own permission level. Setting one is now an error explaining why.
+
+**A damaged line in the middle of a transcript is reported** rather than
+skipped in silence, and resuming from one is refused.
+
+Also: `mafdet agent` gains `--title` and `--no-history` (`--resume` stays in
+the interactive session and now says so); the model picker highlights the
+default you saved; `sessions` refuses unknown flags and stray arguments
+instead of ignoring them; `--json --plain` prints a usage error rather than a
+stack trace; the resume lock is released on exit; `mafdet help` describes what
+the agent can actually do; and the README states plainly that approving a
+command means allowing that program to run as you - the workspace bounds the
+agent's own tools, not the program, and is not a sandbox.
+
 ## 0.4.3 - 2026-08-11
 
 A long agent run no longer walks into the model's context window, a one-shot

package/README.md

@@ -3,13 +3,11 @@
 The official Mafdet AI command line: model calls, account queries, and a
 permissioned local agent.
 
-> **0.4.1.** 中文版见 [README.zh-CN.md](./README.zh-CN.md). The CLI never
+> **0.4.5.** 中文版见 [README.zh-CN.md](./README.zh-CN.md). The CLI never
 > advertises a command it cannot serve, so `mafdet help` always lists exactly
 > what works.
 >
-> macOS and Windows are not yet verified. On Windows the command timeout
-> relies on POSIX process groups, so only the direct child is terminated and a
-> grandchild can survive.
+> macOS and Windows are not yet verified. On Windows the command timeout uses `taskkill /T`, which is written but has never been run on a real Windows machine - so whether every grandchild process is reached there is unverified rather than fixed.
 
 ## Requirements
 
@@ -25,8 +23,8 @@ Or build it from this repository:
 
 ```bash
 pnpm --filter @mafdet/cli build
-cd packages/cli && npm pack          # -> mafdet-cli-0.4.1.tgz
-npm install -g ./mafdet-cli-0.4.1.tgz
+cd packages/cli && npm pack          # -> mafdet-cli-0.4.5.tgz
+npm install -g ./mafdet-cli-0.4.5.tgz
 ```
 
 ## The interactive session
@@ -113,6 +111,16 @@ prefixes: `pnpm test` permits `pnpm test --filter web` but never `pnpm publish`.
 `;`, `&&`, backticks and `$( )` are refused with an explanation rather than
 sanitised.
 
+**What approving a command means.** It means allowing that program to run on
+your machine, as you. The workspace bounds which files the agent's own tools
+may touch; it is not a sandbox, and it does not bound the program. `pnpm test`
+can read your home directory, reach the network, or start something that
+outlives the run - because that is what running a program is. A short list of
+obviously destructive names is refused (`sudo`, `su`, `doas`, `chown`,
+`shutdown`, `reboot`, and invoking a program by path), but treat that as a
+guard against slips rather than as containment. Approve prefixes the way you
+would run the command yourself.
+
 In a session: `/model`, `/permissions`, `/diff`, `/cost`, `/compact`, `/exit`.
 
 ## Configuration
@@ -131,8 +139,8 @@ User config lives at `~/.config/mafdet/config.json` (Linux),
 `~/Library/Application Support/mafdet/config.json` (macOS) or
 `%APPDATA%\mafdet\config.json` (Windows).
 
-A project may carry `.mafdet.json` with `model`, `approvalMode` and
-`testCommands` — and nothing else. Credentials and endpoints in a project file
+A project may carry `.mafdet.json` with `model` — and nothing else.
+Credentials and endpoints in a project file
 are rejected outright: cloning a repository must never change where your key
 is sent.
 

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 Mafdet AI 官方命令行：模型调用、账户查询，以及一个受权限约束的本地 Agent。
 
-> **0.4.1。** 英文版见 [README.md](./README.md)。
+> **0.4.5。** 英文版见 [README.md](./README.md)。
 
 ## 环境要求
 
@@ -55,8 +55,9 @@ mafdet doctor
 的默认状态，中文系统为 cp936）也不会变成乱码。管道传入 prompt 也可以，但 PowerShell
 默认按 UTF-16 走管道——建议直接把 prompt 作为参数，或用 `--input <文件>`。
 
-⚠️ **macOS 与 Windows 尚未验收**。Windows 上有一个已知差异：命令超时终止依赖 POSIX 的
-进程组语义，Windows 只会终止直接子进程，孙子进程可能存活。
+⚠️ **macOS 与 Windows 尚未验收**。Windows 上的命令超时终止已改用 `taskkill /T`，
+但**从未在真 Windows 上执行过**——它是否真的能杀到每一个孙子进程，属于**未验证**，
+不是「已修复」。
 
 ## 命令
 
@@ -94,6 +95,13 @@ mafdet doctor
 **没有 shell**：命令被切成 argv 直接执行，所以管道、重定向、`;`、`&&`、反引号、`$( )`
 一律被拒绝并说明原因，而不是尝试"消毒"。
 
+**批准一条命令意味着什么。** 意味着允许那个程序在你的机器上、以你的身份运行。
+工作区限定的是 **Agent 自己的工具**能碰哪些文件，它**不是沙箱**，也约束不了那个程序。
+`pnpm test` 可以读你的家目录、可以联网、可以起一个比这次运行活得更久的进程——
+因为那就是"运行一个程序"的含义。我们会拒绝一小份明显破坏性的名字
+（`sudo`、`su`、`doas`、`chown`、`shutdown`、`reboot`，以及按路径调用），
+但请把它当作**防手滑的护栏，而不是隔离**。批准前缀时，请按"我自己会不会直接敲这条命令"来判断。
+
 会话内命令：`/model`、`/permissions`、`/diff`、`/cost`、`/compact`、`/exit`。
 
 ## 配置
@@ -111,7 +119,7 @@ mafdet doctor
 用户配置位置：Linux `~/.config/mafdet/config.json`、macOS
 `~/Library/Application Support/mafdet/config.json`、Windows `%APPDATA%\mafdet\config.json`。
 
-项目可以放一个 `.mafdet.json`，但**只允许** `model`、`approvalMode`、`testCommands` 三项。
+项目可以放一个 `.mafdet.json`，但**只允许 `model` 一项**。
 里面出现凭据或端点会**直接报错**：克隆一个仓库绝不该改变你的 Key 发往哪里。
 
 ## 退出码

package/dist/agent/command-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-policy.d.ts","sourceRoot":"","sources":["../../src/agent/command-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BlD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,SAAS,MAAM,EAAO,GAChC,cAAc,CAwChB;AAmBD,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAe9C"}
+{"version":3,"file":"command-policy.d.ts","sourceRoot":"","sources":["../../src/agent/command-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BlD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,SAAS,MAAM,EAAO,GAChC,cAAc,CAwChB;AAmBD,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwB9C"}

package/dist/agent/command-policy.js

@@ -129,5 +129,14 @@ export function stripAnsi(text) {
         // Remaining C0 controls. Tab, newline and carriage return survive; the
         // rest can retitle a window, move the cursor or hide what follows, and a
         // model's output is not a trusted source of terminal instructions.
-        .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, ""));
+        .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "")
+        // R-4 · The 8-bit C1 forms of the same sequences. A terminal in 8-bit
+        // mode reads U+009B as CSI and U+009D as OSC - identical instructions to
+        // the ESC forms above, with no ESC to match on. Taken as whole
+        // sequences, so the payload goes with the introducer rather than being
+        // left behind as visible text.
+        .replace(/\u009b[0-?]*[ -/]*[@-~]/g, "")
+        .replace(/\u009d[^\u0007\u009c]*(?:\u0007|\u009c)?/g, "")
+        // Any remaining C1, including NEL (U+0085) and the lone introducers.
+        .replace(/[\u0080-\u009f]/g, ""));
 }

package/dist/agent/context-budget.d.ts

@@ -34,4 +34,51 @@ export interface PruneResult {
  * running out of context.
  */
 export declare function pruneToolExchanges(history: ChatMessage[], keepRecent?: number): PruneResult;
+/**
+ * F-008 · Drop the oldest whole turns.
+ *
+ * The exchange-based prune above cannot help a conversation with no tools in
+ * it - a long back-and-forth of plain questions removed nothing and carried on
+ * requesting, so "a long run no longer walks into the context window" was only
+ * true for tool-using runs.
+ *
+ * A turn starts at a user message and runs to just before the next one, so
+ * cutting on that boundary can never orphan a tool result or leave a tool call
+ * unanswered: CLI-014's rule holds by construction. The system prompt and the
+ * first user message - the goal - always stay.
+ */
+export declare function dropOldestTurns(history: ChatMessage[], keepTurns: number): number;
+export interface CompactionResult extends PruneResult {
+    /** Whole turns dropped, when exchanges were not enough. */
+    readonly turns: number;
+    /** True when nothing could be dropped and the history is still too big. */
+    readonly exhausted: boolean;
+}
+/**
+ * Shorten the history as much as can be done safely.
+ *
+ * Tool exchanges go first because they are the bulk of a long agent run and
+ * the least useful to keep. Only when there are none left does it start
+ * dropping turns, which costs the model more context.
+ *
+ * `exhausted` is the honest outcome when neither helped: the caller must stop
+ * rather than send a request that is over the window, which would fail
+ * upstream and be billed for the attempt.
+ */
+export declare function compactForBudget(history: ChatMessage[], keepRecent?: number): CompactionResult;
+/**
+ * R-2 · Shorten until it fits, or until nothing more can go.
+ *
+ * `compactForBudget` used to return the moment it dropped a single tool
+ * exchange, and the caller then sent the request regardless. One exchange out
+ * of a history three times over the window changes nothing, so the request
+ * still failed upstream - and was billed for the attempt.
+ *
+ * `estimate` maps the current history back to a token count. There is no
+ * tokenizer here (see the note at the top of this file), so it is derived from
+ * the last measurement: tokens per message, applied to what is left. Rough, but
+ * it is the only honest figure available and it is monotone in the right
+ * direction, which is what a loop needs.
+ */
+export declare function compactUntilItFits(history: ChatMessage[], contextLength: number | undefined, lastPromptTokens: number, keepRecent?: number): CompactionResult;
 //# sourceMappingURL=context-budget.d.ts.map

package/dist/agent/context-budget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-budget.d.ts","sourceRoot":"","sources":["../../src/agent/context-budget.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAKT;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAsCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,WAAW,CAkBb"}
+{"version":3,"file":"context-budget.d.ts","sourceRoot":"","sources":["../../src/agent/context-budget.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAKT;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAsCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,WAAW,CAkBb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,EAAE,MAAM,GAChB,MAAM,CAuBR;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CASlB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,EACxB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CA6BlB"}

package/dist/agent/context-budget.js

@@ -103,3 +103,107 @@ export function pruneToolExchanges(history, keepRecent = KEEP_RECENT_EXCHANGES)
     history.push(...kept);
     return { removed, exchanges: droppable.length };
 }
+/**
+ * F-008 · Drop the oldest whole turns.
+ *
+ * The exchange-based prune above cannot help a conversation with no tools in
+ * it - a long back-and-forth of plain questions removed nothing and carried on
+ * requesting, so "a long run no longer walks into the context window" was only
+ * true for tool-using runs.
+ *
+ * A turn starts at a user message and runs to just before the next one, so
+ * cutting on that boundary can never orphan a tool result or leave a tool call
+ * unanswered: CLI-014's rule holds by construction. The system prompt and the
+ * first user message - the goal - always stay.
+ */
+export function dropOldestTurns(history, keepTurns) {
+    const userAt = [];
+    for (let i = 0; i < history.length; i += 1) {
+        if (history[i]?.role === "user")
+            userAt.push(i);
+    }
+    // The first user message is the goal and is not a droppable turn, so there
+    // have to be more than `keepTurns` turns after it before anything can go.
+    if (userAt.length <= keepTurns + 1)
+        return 0;
+    const cut = userAt[userAt.length - keepTurns];
+    if (cut === undefined)
+        return 0;
+    const kept = [];
+    if (history[0]?.role === "system")
+        kept.push(history[0]);
+    const goal = history[userAt[0]];
+    if (goal !== undefined && userAt[0] !== cut)
+        kept.push(goal);
+    kept.push(...history.slice(cut));
+    const removed = history.length - kept.length;
+    if (removed <= 0)
+        return 0;
+    history.length = 0;
+    history.push(...kept);
+    return removed;
+}
+/**
+ * Shorten the history as much as can be done safely.
+ *
+ * Tool exchanges go first because they are the bulk of a long agent run and
+ * the least useful to keep. Only when there are none left does it start
+ * dropping turns, which costs the model more context.
+ *
+ * `exhausted` is the honest outcome when neither helped: the caller must stop
+ * rather than send a request that is over the window, which would fail
+ * upstream and be billed for the attempt.
+ */
+export function compactForBudget(history, keepRecent = KEEP_RECENT_EXCHANGES) {
+    const pruned = pruneToolExchanges(history, keepRecent);
+    const turnsRemoved = dropOldestTurns(history, keepRecent);
+    return {
+        removed: pruned.removed + turnsRemoved,
+        exchanges: pruned.exchanges,
+        turns: turnsRemoved > 0 ? 1 : 0,
+        exhausted: pruned.exchanges === 0 && turnsRemoved === 0,
+    };
+}
+/**
+ * R-2 · Shorten until it fits, or until nothing more can go.
+ *
+ * `compactForBudget` used to return the moment it dropped a single tool
+ * exchange, and the caller then sent the request regardless. One exchange out
+ * of a history three times over the window changes nothing, so the request
+ * still failed upstream - and was billed for the attempt.
+ *
+ * `estimate` maps the current history back to a token count. There is no
+ * tokenizer here (see the note at the top of this file), so it is derived from
+ * the last measurement: tokens per message, applied to what is left. Rough, but
+ * it is the only honest figure available and it is monotone in the right
+ * direction, which is what a loop needs.
+ */
+export function compactUntilItFits(history, contextLength, lastPromptTokens, keepRecent = KEEP_RECENT_EXCHANGES) {
+    const startedWith = history.length;
+    const perMessage = startedWith > 0 ? lastPromptTokens / startedWith : 0;
+    let exchanges = 0;
+    let turns = 0;
+    for (;;) {
+        const estimate = Math.round(perMessage * history.length);
+        if (!shouldCompact(contextLength, estimate)) {
+            return {
+                removed: startedWith - history.length,
+                exchanges,
+                turns,
+                exhausted: false,
+            };
+        }
+        const step = compactForBudget(history, keepRecent);
+        if (step.exhausted) {
+            return {
+                removed: startedWith - history.length,
+                exchanges,
+                turns,
+                // Still over budget with nothing left that is safe to drop.
+                exhausted: true,
+            };
+        }
+        exchanges += step.exchanges;
+        turns += step.turns;
+    }
+}

package/dist/agent/loop.d.ts

@@ -12,7 +12,15 @@ export declare const DEFAULT_LIMITS: {
     maxCostMicroUsd: bigint | undefined;
 };
 export type AgentLimits = typeof DEFAULT_LIMITS;
-export type StopReason = "completed" | "max_turns" | "timeout" | "max_cost" | "cancelled" | "rate_limited" | "error";
+export type StopReason = "completed" | "max_turns" | "timeout" | "max_cost" | "cancelled" | "rate_limited"
+/** F-008 · Over the model's window with nothing left that is safe to drop. */
+ | "context_limit"
+/**
+ * R-5 · A cost ceiling was asked for and cannot be honoured, because the
+ * catalogue has no price for this model. Distinct from `max_cost`, which
+ * means the ceiling was reached.
+ */
+ | "cost_unknown" | "error";
 export interface AgentReport {
     stopReason: StopReason;
     /** The model's last text answer, if it produced one. */
@@ -102,6 +110,11 @@ export type AgentEvent = {
     promptTokens: number;
     completionTokens: number;
     costMicroUsd: bigint;
+    /**
+     * F-012 · False when the catalogue had no price for this model, so a
+     * recorder can tell "we could not work it out" from "it was free".
+     */
+    priced: boolean;
 } | {
     type: "rate_limited";
     waitMs: number;
@@ -115,6 +128,8 @@ export type AgentEvent = {
  | {
     type: "compacted";
     exchanges: number;
+    /** Whole conversation turns dropped, when exchanges were not enough. */
+    turns: number;
     messages: number;
     promptTokens: number;
 };

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAYD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAyJ1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc;AAChB,8EAA8E;GAC5E,eAAe;AACjB;;;;GAIG;GACD,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAYD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA6L1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR"}

package/dist/agent/loop.js

@@ -1,5 +1,5 @@
 import { ApiError } from "../api/errors.js";
-import { pruneToolExchanges, shouldCompact } from "./context-budget.js";
+import { compactUntilItFits, shouldCompact } from "./context-budget.js";
 import { toolToJsonSchema, } from "./tools/types.js";
 /** Plan §7.4. */
 export const DEFAULT_LIMITS = {
@@ -47,6 +47,8 @@ export async function runAgent(options) {
     };
     /** What the provider counted for the previous request; 0 until one lands. */
     let lastPromptTokens = 0;
+    /** R-5 · Turns whose cost the catalogue could not tell us. */
+    let unpricedTurns = 0;
     for (let turn = 1; turn <= limits.maxTurns; turn += 1) {
         if (options.signal?.aborted)
             return stop(report, "cancelled");
@@ -56,23 +58,43 @@ export async function runAgent(options) {
             report.costMicroUsd >= limits.maxCostMicroUsd) {
             return stop(report, "max_cost");
         }
+        // R-5 · An unpriceable turn counted as 0 towards the ceiling, so
+        // `--max-cost-usd` silently stopped being a ceiling at all and the run
+        // continued spending real money. A limit that cannot be enforced has to
+        // stop the run, not be quietly abandoned.
+        if (limits.maxCostMicroUsd !== undefined && unpricedTurns > 0) {
+            return stop(report, "cost_unknown", `--max-cost-usd cannot be enforced: the catalogue has no price for ` +
+                `${options.model}, so ${unpricedTurns} request(s) could not be counted ` +
+                `towards the ceiling. Re-run without the limit to continue anyway.`);
+        }
         report.turns = turn;
         options.onEvent?.({ type: "turn", turn });
         // §7.4 · Shorten before asking, using what the provider counted last time.
-        // Only whole tool exchanges go, and only when the window is known.
         if (shouldCompact(options.pricing?.contextLength, lastPromptTokens)) {
-            const pruned = pruneToolExchanges(messages);
-            if (pruned.exchanges > 0) {
-                options.onEvent?.({
-                    type: "compacted",
-                    exchanges: pruned.exchanges,
-                    messages: pruned.removed,
-                    promptTokens: lastPromptTokens,
-                });
-                // Reset the measurement: the next response measures the shorter
-                // history, and reusing the old figure would compact again every turn.
-                lastPromptTokens = 0;
+            // R-2 · Keep going until the estimate is inside the budget. Dropping one
+            // exchange and sending anyway left a history that was still over the
+            // window: the request failed upstream and was billed for the attempt.
+            const compacted = compactUntilItFits(messages, options.pricing?.contextLength, lastPromptTokens);
+            if (compacted.exhausted) {
+                // F-008 · Nothing left that can be dropped without breaking the
+                // conversation. Sending anyway means a request over the window, which
+                // fails upstream and is billed for the attempt - stopping and saying
+                // so is the only honest option.
+                return stop(report, "context_limit", `the conversation no longer fits in ${options.model}'s context window ` +
+                    `(${lastPromptTokens} input tokens last turn) and cannot be shortened further`);
             }
+            options.onEvent?.({
+                type: "compacted",
+                exchanges: compacted.exchanges,
+                // R-2 · Reported separately: a pure conversation drops turns and no
+                // exchanges, and the display said "dropped 0 earlier tool exchanges".
+                turns: compacted.turns,
+                messages: compacted.removed,
+                promptTokens: lastPromptTokens,
+            });
+            // Reset the measurement: the next response measures the shorter
+            // history, and reusing the old figure would compact again every turn.
+            lastPromptTokens = 0;
         }
         let response;
         try {
@@ -109,7 +131,10 @@ export async function runAgent(options) {
             promptTokens: usage?.prompt_tokens ?? 0,
             completionTokens: usage?.completion_tokens ?? 0,
             costMicroUsd: turnCost,
+            priced: canPrice(options.pricing, usage),
         });
+        if (!canPrice(options.pricing, usage))
+            unpricedTurns += 1;
         const choice = response.choices?.[0];
         const message = choice?.message;
         const calls = message?.tool_calls ?? [];
@@ -267,6 +292,12 @@ export function backoffMs(retryAfterSeconds, attempt, random = Math.random) {
     // Full jitter: a fleet of CLIs must not retry in lockstep.
     return Math.round(base * (0.5 + random() * 0.5));
 }
+/** F-012 · Whether `priceTurn` had everything it needed to give an answer. */
+function canPrice(model, usage) {
+    return (usage !== undefined &&
+        model?.inputPricePer1mMicroUsd !== undefined &&
+        model?.outputPricePer1mMicroUsd !== undefined);
+}
 function priceTurn(model, usage) {
     if (!model?.inputPricePer1mMicroUsd ||
         !model.outputPricePer1mMicroUsd ||

package/dist/agent/session.d.ts

@@ -32,6 +32,8 @@ export interface SessionOptions {
      * the same events are drawn.
      */
     onEvent?: (event: AgentEvent) => void;
+    /** R-4 · False when stdout is a pipe or a file, which get exact bytes. */
+    isTty?: boolean;
     /**
      * A conversation to continue, rebuilt from a saved session (CLI-024).
      * Appended to in place, exactly as the fresh array would be.

package/dist/agent/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/agent/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAY,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAapE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,oEAAoE;IACpE,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAwFzB;AAgHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CA2B7D"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/agent/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAY,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAapE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,oEAAoE;IACpE,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAqGzB;AAgHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CA2B7D"}

package/dist/agent/session.js

@@ -2,6 +2,7 @@ import { createInterface } from "node:readline/promises";
 import { isAgentEligible } from "../api/models.js";
 import { formatUsd } from "../output/money.js";
 import { renderRecord } from "../output/format.js";
+import { safeForTerminal } from "../output/terminal-safe.js";
 import { runAgent } from "./loop.js";
 const HELP = `Session commands:
   /model [id]     Show or switch the model
@@ -80,7 +81,13 @@ export async function runSession(options) {
                 history,
                 approver: options.approver,
                 signal: options.signal,
-                onEvent: options.onEvent ?? ((event) => reportEvent(event, options)),
+                // Both, not either: `onEvent` was replacing the progress display, so
+                // attaching a recorder would have silently blanked the terminal. An
+                // observer is an addition to the rendering, never a substitute for it.
+                onEvent: (event) => {
+                    reportEvent(event, options);
+                    options.onEvent?.(event);
+                },
             });
             summary.turns += report.turns;
             summary.modelRequests += report.modelRequests;
@@ -88,8 +95,12 @@ export async function runSession(options) {
             summary.promptTokens += report.promptTokens;
             summary.completionTokens += report.completionTokens;
             summary.costMicroUsd += report.costMicroUsd;
-            if (report.finalText)
-                options.stdout(`${report.finalText}\n`);
+            // R-4 · The model's answer reaches a terminal here too. The TUI wraps
+            // this writer, but `mafdet agent` without a goal does not, so the
+            // sanitising belongs at the sink rather than at one of its callers.
+            if (report.finalText) {
+                options.stdout(`${safeForTerminal(report.finalText, options.isTty ?? true)}\n`);
+            }
             if (report.stopReason !== "completed") {
                 options.stderr(`[${report.stopReason}${report.error ? `: ${report.error}` : ""}]\n`);
             }

package/dist/api/http.d.ts

@@ -44,10 +44,24 @@ export declare class HttpClient {
     postJson<T>(path: string, body: unknown, options?: RequestOptions): Promise<HttpResponse<T>>;
     /** For `/v1/audio/speech`, which answers with audio bytes. */
     postBinary(path: string, body: unknown, options?: RequestOptions): Promise<HttpResponse<Uint8Array>>;
-    /** Raw streaming response, for the SSE reader to consume. */
+    /**
+     * Raw streaming response, for the SSE reader to consume.
+     *
+     * F-009 · Returns `abort` and the limits the reader should apply. The
+     * request timeout in `send` is cleared once the headers arrive - which for a
+     * stream is the start - so from here on the deadline belongs to whoever is
+     * reading the body, and it needs a way to close the connection rather than
+     * merely stop reading. Generation is what gets billed; dropping our end of
+     * a socket we are no longer reading does not stop it.
+     */
     postStream(path: string, body: unknown, options?: RequestOptions): Promise<{
         response: Response;
         requestId?: string;
+        abort: () => void;
+        limits: {
+            idleTimeoutMs: number;
+            maxBytes: number;
+        };
     }>;
     private send;
     private readJson;