@mafdet/cli 0.4.6 → 0.4.8

package/CHANGELOG.md

@@ -6,13 +6,65 @@ The version is the contract for the JSON output shapes and the exit codes.
 Being 0.x, semver still permits a break in a minor bump; the intent is not to
 use that latitude, and the promise becomes binding at 1.0.0.
 
+## 0.4.8 - 2026-08-12
+
+A fourth audit round: three findings, one of which was a regression I
+introduced in 0.4.6.
+
+**Model identifiers are never rewritten.** 0.4.6 stripped terminal escape
+sequences from the catalogue as it arrived, which sounded like the tidy place
+to do it and was the wrong place: the identifier is what the access
+intersection is computed from, so two distinct ids collapsed into one and a key
+that could call only `safe<escape>` appeared to have access to `safe`. It is
+also what gets sent back to the API and what `--json` reports. Identifiers are
+now left exactly as served; one carrying a control character is refused
+outright - it cannot be a real id - and the cleaning happens where something
+draws text on a terminal, with `--json` and `--plain` keeping the bytes.
+
+**A cost ceiling reports honestly when the response carries no usage.** The
+catalogue check added in 0.4.6 covers a model with no published price; a model
+that has one whose reply arrives without a usage block is only discoverable
+afterwards, and that run finished `completed` with exit 0 - telling you a
+ceiling had held when it had never been applied to anything. It now stops with
+the ceiling's exit code, keeps the answer that was generated, and says that
+usage was missing rather than that the price was.
+
+**Context compaction measures instead of guessing.** The estimate divided the
+last token count by the number of messages and scaled linearly, with a
+hand-tuned allowance for the system prompt - which ignored the tool schemas,
+often the largest part of a request, and assumed a fixed characters-per-token
+ratio that does not hold across English, Chinese, code and JSON. It now uses
+the ratio between the provider's own token count and the exact bytes that
+earned it, applied to the bytes about to be sent, schemas included. It remains
+an estimate: guaranteeing no request ever exceeds the window would need a
+tokenizer or a server-side token count, and the documentation now says so
+rather than implying otherwise.
+
+## 0.4.7 - 2026-08-12
+
+0.4.6 shipped without the fix it was published for.
+
+Its headline change was that an interactive `mafdet agent` records your
+questions and not only the model's replies. The edit that connected the
+recorder to the session loop matched nothing when it was applied, and the
+version went out with the old behaviour: typecheck passed, the whole suite
+passed, and the unit test for it passed too, because that test drives the
+session loop directly and never touches the command that was supposed to call
+it. A real interactive run found it a few minutes later.
+
+This release contains the wiring, and a test that goes through the command
+rather than around it - verified to fail when the wiring is removed. If you
+installed 0.4.6, upgrade: everything else in it was real, but that one was not.
+
 ## 0.4.6 - 2026-08-12
 
 A third audit round. Two of its findings were things the previous round's
 notes recorded as fixed, and the pattern is worth naming: a partial fix logged
 as complete is not looked at again.
 
-**An interactive `mafdet agent` now records your questions.** It saved the
+**An interactive `mafdet agent` now records your questions.** ⚠️ This is what
+0.4.6 was published for and it is **not in 0.4.6** - the wiring was missing and
+the release went out with the old behaviour. Fixed in 0.4.7; see that entry. It saved the
 model's replies, the tool runs and the usage, and none of the prompts - so
 resuming such a session could not continue a conversation that was only half
 there. The TUI wrapped its own reader to record them and the command surface

package/README.md

@@ -3,7 +3,7 @@
 The official Mafdet AI command line: model calls, account queries, and a
 permissioned local agent.
 
-> **0.4.6.** 中文版见 [README.zh-CN.md](./README.zh-CN.md). The CLI never
+> **0.4.8.** 中文版见 [README.zh-CN.md](./README.zh-CN.md). The CLI never
 > advertises a command it cannot serve, so `mafdet help` always lists exactly
 > what works.
 >
@@ -23,8 +23,8 @@ Or build it from this repository:
 
 ```bash
 pnpm --filter @mafdet/cli build
-cd packages/cli && npm pack          # -> mafdet-cli-0.4.6.tgz
-npm install -g ./mafdet-cli-0.4.6.tgz
+cd packages/cli && npm pack          # -> mafdet-cli-0.4.8.tgz
+npm install -g ./mafdet-cli-0.4.8.tgz
 ```
 
 ## The interactive session

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 Mafdet AI 官方命令行：模型调用、账户查询，以及一个受权限约束的本地 Agent。
 
-> **0.4.6。** 英文版见 [README.md](./README.md)。
+> **0.4.8。** 英文版见 [README.md](./README.md)。
 
 ## 环境要求
 

package/dist/agent/context-budget.d.ts

@@ -83,5 +83,32 @@ export declare function compactForBudget(history: ChatMessage[], keepRecent?: nu
  * it is the only honest figure available and it is monotone in the right
  * direction, which is what a loop needs.
  */
-export declare function compactUntilItFits(history: ChatMessage[], contextLength: number | undefined, lastPromptTokens: number, keepRecent?: number): CompactionResult;
+/**
+ * U-1 · Shorten until the estimate fits, using a ratio measured from the last
+ * real request rather than a guess about characters per token.
+ *
+ * The previous version divided the last `prompt_tokens` by the message count
+ * and scaled linearly, with a hand-tuned allowance for the system prompt. That
+ * was wrong twice over: it ignored the tool schemas, which are re-sent every
+ * turn and are often larger than the conversation, and characters per token
+ * is not a constant across English, Chinese, code and JSON.
+ *
+ * What is measured here instead is the ratio between the provider's own token
+ * count and the exact bytes we sent to earn it. Applied to the bytes we are
+ * about to send - schemas included - it needs no assumption about language or
+ * encoding, because both sides of the ratio came from the same request.
+ *
+ * ⚠️ It is still an estimate, and it is not a proof. Two requests can differ
+ * in their token-per-byte ratio, so this cannot guarantee "never sends an
+ * over-window request"; that would need a tokenizer or a server-side
+ * token-count endpoint. What it does guarantee is that the fixed part is
+ * counted rather than assumed away.
+ */
+export declare function compactUntilItFits(history: ChatMessage[], contextLength: number | undefined, lastPromptTokens: number, 
+/** Bytes of the request that produced `lastPromptTokens`. */
+lastRequestBytes: number, 
+/** Bytes of the request as it stands now, recomputed after each removal. */
+sizeNow: () => number, keepRecent?: number): CompactionResult;
+/** The bytes a request occupies on the wire, schemas and all. */
+export declare function requestBytes(messages: readonly ChatMessage[], tools: unknown): number;
 //# sourceMappingURL=context-budget.d.ts.map

package/dist/agent/context-budget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-budget.d.ts","sourceRoot":"","sources":["../../src/agent/context-budget.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAKT;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAsCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,WAAW,CAkBb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,EAAE,MAAM,GAChB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0BpC;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CASlB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,EACxB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CAoClB"}
+{"version":3,"file":"context-budget.d.ts","sourceRoot":"","sources":["../../src/agent/context-budget.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAKT;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAsCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,WAAW,CAkBb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,EAAE,MAAM,GAChB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0BpC;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CASlB;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM;AACxB,6DAA6D;AAC7D,gBAAgB,EAAE,MAAM;AACxB,4EAA4E;AAC5E,OAAO,EAAE,MAAM,MAAM,EACrB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CA8BlB;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,KAAK,EAAE,OAAO,GACb,MAAM,CAQR"}

package/dist/agent/context-budget.js

@@ -181,19 +181,38 @@ export function compactForBudget(history, keepRecent = KEEP_RECENT_EXCHANGES) {
  * it is the only honest figure available and it is monotone in the right
  * direction, which is what a loop needs.
  */
-export function compactUntilItFits(history, contextLength, lastPromptTokens, keepRecent = KEEP_RECENT_EXCHANGES) {
+/**
+ * U-1 · Shorten until the estimate fits, using a ratio measured from the last
+ * real request rather than a guess about characters per token.
+ *
+ * The previous version divided the last `prompt_tokens` by the message count
+ * and scaled linearly, with a hand-tuned allowance for the system prompt. That
+ * was wrong twice over: it ignored the tool schemas, which are re-sent every
+ * turn and are often larger than the conversation, and characters per token
+ * is not a constant across English, Chinese, code and JSON.
+ *
+ * What is measured here instead is the ratio between the provider's own token
+ * count and the exact bytes we sent to earn it. Applied to the bytes we are
+ * about to send - schemas included - it needs no assumption about language or
+ * encoding, because both sides of the ratio came from the same request.
+ *
+ * ⚠️ It is still an estimate, and it is not a proof. Two requests can differ
+ * in their token-per-byte ratio, so this cannot guarantee "never sends an
+ * over-window request"; that would need a tokenizer or a server-side
+ * token-count endpoint. What it does guarantee is that the fixed part is
+ * counted rather than assumed away.
+ */
+export function compactUntilItFits(history, contextLength, lastPromptTokens, 
+/** Bytes of the request that produced `lastPromptTokens`. */
+lastRequestBytes, 
+/** Bytes of the request as it stands now, recomputed after each removal. */
+sizeNow, keepRecent = KEEP_RECENT_EXCHANGES) {
     const startedWith = history.length;
-    const floor = fixedOverhead(history, lastPromptTokens);
-    const perMessage = startedWith > 0 ? Math.max(0, lastPromptTokens - floor) / startedWith : 0;
+    const tokensPerByte = lastRequestBytes > 0 ? lastPromptTokens / lastRequestBytes : 0;
     let exchanges = 0;
     let turns = 0;
     for (;;) {
-        // T-2 · The floor does not shrink. The system prompt and the tool schemas
-        // are re-sent every turn whatever the history looks like, so treating the
-        // whole measurement as proportional to the message count said a
-        // conversation had come inside the window when only the removable part
-        // had. Everything below the floor is not ours to drop.
-        const estimate = floor + Math.round(perMessage * history.length);
+        const estimate = Math.round(tokensPerByte * sizeNow());
         if (!shouldCompact(contextLength, estimate)) {
             return {
                 removed: startedWith - history.length,
@@ -216,29 +235,14 @@ export function compactUntilItFits(history, contextLength, lastPromptTokens, kee
         turns += step.turns;
     }
 }
-/**
- * T-2 · What the next request costs before any history is added.
- *
- * The system prompt is measurable; the tool schemas are not from here - the
- * loop knows them but this module does not, and CLI-000B found the gateway's
- * own reservation undercounts badly for exactly that reason. So it is
- * approximated from the one message we can size, with a floor that keeps the
- * estimate conservative: over-estimating the fixed part makes compaction try
- * harder, which is the direction that fails safe.
- */
-function fixedOverhead(history, lastPromptTokens) {
-    const system = history.find((m) => m.role === "system");
-    if (system === undefined || lastPromptTokens <= 0)
-        return 0;
-    const chars = (system.content ?? "").length;
-    // Roughly four characters per token, doubled to stand in for the tool
-    // schemas that are sent alongside it and cannot be measured here.
-    const approx = Math.round((chars / 4) * 2);
-    // Bounded by the measurement, because the fixed part cannot exceed the whole
-    // request - but NOT halved. Capping it lower was the unsafe direction: it
-    // let the loop conclude that dropping a few messages had brought a history
-    // inside a window the system prompt alone did not fit in. Over-estimating
-    // makes compaction try harder and, at worst, stop with an honest message;
-    // under-estimating sends a request that fails upstream and is billed.
-    return Math.min(approx, lastPromptTokens);
+/** The bytes a request occupies on the wire, schemas and all. */
+export function requestBytes(messages, tools) {
+    try {
+        return JSON.stringify({ messages, tools }).length;
+    }
+    catch {
+        // Circular or unserialisable: fall back to something monotone in the
+        // history length so the loop still makes progress.
+        return messages.length;
+    }
 }

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc;AAChB,8EAA8E;GAC5E,eAAe;AACjB;;;;GAIG;GACD,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAYD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAkN1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc;AAChB,8EAA8E;GAC5E,eAAe;AACjB;;;;GAIG;GACD,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAYD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA6N1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR"}

package/dist/agent/loop.js

@@ -1,5 +1,5 @@
 import { ApiError } from "../api/errors.js";
-import { compactUntilItFits, shouldCompact } from "./context-budget.js";
+import { compactUntilItFits, requestBytes, shouldCompact, } from "./context-budget.js";
 import { toolToJsonSchema, } from "./tools/types.js";
 /** Plan §7.4. */
 export const DEFAULT_LIMITS = {
@@ -48,8 +48,8 @@ export async function runAgent(options) {
     };
     /** What the provider counted for the previous request; 0 until one lands. */
     let lastPromptTokens = 0;
-    /** R-5 · Turns whose cost the catalogue could not tell us. */
-    let unpricedTurns = 0;
+    /** U-1 · Bytes of the request that produced `lastPromptTokens`. */
+    let lastRequestBytes = 0;
     // T-3 · Known before anything is sent. Waiting for the first response to
     // discover it meant a run with an explicit ceiling still made one billable
     // request that could never be counted against it.
@@ -69,15 +69,6 @@ export async function runAgent(options) {
             report.costMicroUsd >= limits.maxCostMicroUsd) {
             return stop(report, "max_cost");
         }
-        // R-5 · An unpriceable turn counted as 0 towards the ceiling, so
-        // `--max-cost-usd` silently stopped being a ceiling at all and the run
-        // continued spending real money. A limit that cannot be enforced has to
-        // stop the run, not be quietly abandoned.
-        if (limits.maxCostMicroUsd !== undefined && unpricedTurns > 0) {
-            return stop(report, "cost_unknown", `--max-cost-usd cannot be enforced: the catalogue has no price for ` +
-                `${options.model}, so ${unpricedTurns} request(s) could not be counted ` +
-                `towards the ceiling. Re-run without the limit to continue anyway.`);
-        }
         report.turns = turn;
         options.onEvent?.({ type: "turn", turn });
         // §7.4 · Shorten before asking, using what the provider counted last time.
@@ -85,7 +76,7 @@ export async function runAgent(options) {
             // R-2 · Keep going until the estimate is inside the budget. Dropping one
             // exchange and sending anyway left a history that was still over the
             // window: the request failed upstream and was billed for the attempt.
-            const compacted = compactUntilItFits(messages, options.pricing?.contextLength, lastPromptTokens);
+            const compacted = compactUntilItFits(messages, options.pricing?.contextLength, lastPromptTokens, lastRequestBytes, () => requestBytes(messages, toolSchemas));
             if (compacted.exhausted) {
                 // F-008 · Nothing left that can be dropped without breaking the
                 // conversation. Sending anyway means a request over the window, which
@@ -107,6 +98,9 @@ export async function runAgent(options) {
             // history, and reusing the old figure would compact again every turn.
             lastPromptTokens = 0;
         }
+        // U-1 · Measured for the request we are about to make, so the ratio the
+        // next compaction uses is the provider's own count over these exact bytes.
+        const sentBytes = requestBytes(messages, toolSchemas);
         let response;
         try {
             response = await requestWithRateLimitHandling(options, limits, {
@@ -126,7 +120,10 @@ export async function runAgent(options) {
             return stop(report, "error", error instanceof Error ? error.message : String(error));
         }
         const usage = response.usage;
-        lastPromptTokens = usage?.prompt_tokens ?? lastPromptTokens;
+        if (usage?.prompt_tokens !== undefined) {
+            lastPromptTokens = usage.prompt_tokens;
+            lastRequestBytes = sentBytes;
+        }
         report.promptTokens += usage?.prompt_tokens ?? 0;
         report.completionTokens += usage?.completion_tokens ?? 0;
         // Cost comes from returned usage, never from the reservation: CLI-000B
@@ -144,10 +141,8 @@ export async function runAgent(options) {
             costMicroUsd: turnCost,
             priced: canPrice(options.pricing, usage),
         });
-        if (!canPrice(options.pricing, usage)) {
-            unpricedTurns += 1;
+        if (!canPrice(options.pricing, usage))
             report.unpricedRequests += 1;
-        }
         const choice = response.choices?.[0];
         const message = choice?.message;
         const calls = message?.tool_calls ?? [];
@@ -155,6 +150,17 @@ export async function runAgent(options) {
             report.finalText = message.content;
             options.onEvent?.({ type: "text", text: message.content });
         }
+        // U-2 · After the answer is recorded, so the user keeps what was generated
+        // and paid for. A model the catalogue prices whose reply carried no
+        // `usage` is only discoverable here, and the run used to finish
+        // `completed` with exit 0 - telling the user a ceiling had held when it
+        // had never been applied to anything.
+        if (limits.maxCostMicroUsd !== undefined &&
+            !canPrice(options.pricing, usage)) {
+            return stop(report, "cost_unknown", `--max-cost-usd cannot be enforced: the response for ${options.model} ` +
+                `carried no usage, so this request could not be counted towards ` +
+                `the ceiling.`);
+        }
         if (calls.length === 0) {
             // Keep the answer in the history so a session's next turn has context.
             messages.push({ role: "assistant", content: message?.content ?? "" });

package/dist/api/models.d.ts

@@ -52,6 +52,21 @@ export declare function intersectModels(dataPlane: readonly DataPlaneModel[], ca
 export declare function fetchAccessibleModels(client: HttpClient): Promise<DataPlaneModel[]>;
 /** GET /models on the business API — public catalogue, no key required. */
 export declare function fetchCatalog(client: HttpClient): Promise<CatalogModel[]>;
+/**
+ * U-3 · Is this a usable model identifier?
+ *
+ * Identity is never rewritten. Sanitising the id at ingestion - which is what
+ * the previous attempt did - merges two distinct ids into one, and the id is
+ * what the *access* intersection is computed from: a key that could call only
+ * `safe<OSC>` was granted `safe`. It is also what gets sent back to the API
+ * and what `--json` reports, and the project's own rule is that a pipe
+ * receives exact bytes.
+ *
+ * So an id carrying a control character is refused instead. It cannot be a
+ * real model id, and refusing is the fail-closed reading of a value we do not
+ * understand.
+ */
+export declare function isUsableModelId(id: string): boolean;
 /**
  * Check the model serves the endpoint the command needs, before spending a
  * request on it. The gateway does answer 400 `model_api_surface_mismatch`, but

package/dist/api/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/api/models.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAQxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,cAAc,EAAE,EACpC,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,SAAS,CAuBX;AAED,8CAA8C;AAC9C,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,cAAc,EAAE,CAAC,CAQ3B;AAED,2EAA2E;AAC3E,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,EAAE,CAAC,CAGzB;AA0BD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,YAAY,GAAG,SAAS,CAY1B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAFhB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM;CAO5B"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/api/models.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAUxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,cAAc,EAAE,EACpC,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,SAAS,CA4BX;AAED,8CAA8C;AAC9C,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,cAAc,EAAE,CAAC,CAG3B;AAED,2EAA2E;AAC3E,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,EAAE,CAAC,CAGzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,YAAY,GAAG,SAAS,CAY1B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAFhB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM;CAO5B"}

package/dist/api/models.js

@@ -1,4 +1,3 @@
-import { stripAnsi } from "../agent/command-policy.js";
 /**
  * Agent admission. Every condition is something the catalogue states outright;
  * nothing is inferred from the model id, the provider or the display name —
@@ -7,6 +6,9 @@ import { stripAnsi } from "../agent/command-policy.js";
 export function isAgentEligible(model) {
     if (!model)
         return false;
+    // U-3 · An id we cannot make sense of never drives the agent.
+    if (!isUsableModelId(model.modelId))
+        return false;
     if (!(model.capabilities ?? []).includes("tool_use"))
         return false;
     if ((model.apiSurface ?? "CHAT_COMPLETIONS") !== "CHAT_COMPLETIONS")
@@ -34,6 +36,12 @@ export function intersectModels(dataPlane, catalog) {
     const available = [];
     const unlisted = [];
     for (const id of accessible) {
+        // U-3 · Fail closed on an id we cannot make sense of. It never becomes
+        // callable, never becomes agent-eligible, and is never matched against a
+        // catalogue entry - which is the mistake that let `safe<OSC>` be treated
+        // as `safe`.
+        if (!isUsableModelId(id))
+            continue;
         const meta = byId.get(id);
         if (!meta) {
             unlisted.push(id);
@@ -52,37 +60,30 @@ export function intersectModels(dataPlane, catalog) {
 /** GET /v1/models — the key's access list. */
 export async function fetchAccessibleModels(client) {
     const { data } = await client.getJson("/models");
-    // T-5 · Same reason as `cleanModel`: these ids are printed as the "unlisted"
-    // set, so they reach a terminal without ever passing through the catalogue.
-    return (data.data ?? []).map((model) => ({
-        ...model,
-        id: typeof model.id === "string" ? stripAnsi(model.id) : model.id,
-    }));
+    return data.data ?? [];
 }
 /** GET /models on the business API — public catalogue, no key required. */
 export async function fetchCatalog(client) {
     const { data } = await client.getJson("/models");
-    return (data.data ?? []).map(cleanModel);
+    return data.data ?? [];
 }
 /**
- * T-5 · Strip terminal control sequences from catalogue text, once, here.
+ * U-3 · Is this a usable model identifier?
  *
- * The catalogue is remote data that ends up on a terminal in the picker, in
- * `models list`, in `models show`, in `doctor` and in error messages. F-010
- * was fixed sink by sink across two review rounds and the picker was still
- * missing, which is the argument for doing it where the data enters instead:
- * every renderer downstream, present and future, then has nothing to forget.
+ * Identity is never rewritten. Sanitising the id at ingestion - which is what
+ * the previous attempt did - merges two distinct ids into one, and the id is
+ * what the *access* intersection is computed from: a key that could call only
+ * `safe<OSC>` was granted `safe`. It is also what gets sent back to the API
+ * and what `--json` reports, and the project's own rule is that a pipe
+ * receives exact bytes.
  *
- * The model id is cleaned too. It is sent back to the API, so in principle
- * this changes what we would ask for - but an id carrying a control character
- * is not a model id, and declining to echo one back is right either way.
+ * So an id carrying a control character is refused instead. It cannot be a
+ * real model id, and refusing is the fail-closed reading of a value we do not
+ * understand.
  */
-function cleanModel(model) {
-    const clean = (value) => typeof value === "string" ? stripAnsi(value) : value;
-    return Object.fromEntries(Object.entries(model).map(([key, value]) => [
-        key,
-        Array.isArray(value) ? value.map(clean) : clean(value),
-    ]));
+export function isUsableModelId(id) {
+    // eslint-disable-next-line no-control-regex
+    return id.length > 0 && !/[\u0000-\u001f\u007f-\u009f]/.test(id);
 }
 /**
  * Check the model serves the endpoint the command needs, before spending a

package/dist/commands/agent.d.ts

@@ -8,6 +8,14 @@ export interface AgentIo extends CommandIo {
     /** Overridden in tests; production reads the TTY. */
     isInteractive?: boolean;
     approver?: import("../agent/approvals.js").Approver;
+    /**
+     * Overridden in tests; production reads lines from the terminal.
+     *
+     * Injectable because the interactive path could otherwise only be exercised
+     * under a real pty - and `script` cannot allocate one in every CI, so the
+     * wiring here went untested and a broken edit shipped past a full suite.
+     */
+    readLine?: () => Promise<string | undefined>;
 }
 export declare function agentCommand(argv: readonly string[], io: AgentIo): Promise<ExitCode>;
 /**

package/dist/commands/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/commands/agent.ts"],"names":[],"mappings":"AAQA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAiBvE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAmBtB,eAAO,MAAM,gBAAgB,0XAK+C,CAAC;AAE7E,eAAO,MAAM,YAAY,mgBAOmB,CAAC;AAE7C,MAAM,WAAW,OAAQ,SAAQ,SAAS;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,uBAAuB,EAAE,QAAQ,CAAC;CACrD;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,OAAO,GACV,OAAO,CAAC,QAAQ,CAAC,CAgInB;AAoLD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,kBAAkB,EAAE,OAAO,0JAI3E"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/commands/agent.ts"],"names":[],"mappings":"AAQA,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAiBvE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAmBtB,eAAO,MAAM,gBAAgB,0XAK+C,CAAC;AAE7E,eAAO,MAAM,YAAY,mgBAOmB,CAAC;AAE7C,MAAM,WAAW,OAAQ,SAAQ,SAAS;IACxC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,uBAAuB,EAAE,QAAQ,CAAC;IACpD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9C;AAED,wBAAsB,YAAY,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,OAAO,GACV,OAAO,CAAC,QAAQ,CAAC,CAuInB;AAoLD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,kBAAkB,EAAE,OAAO,0JAI3E"}

package/dist/commands/agent.js

@@ -99,7 +99,13 @@ export async function agentCommand(argv, io) {
                     client: runtime.dataPlane,
                     ...(recorder === undefined
                         ? {}
-                        : { onEvent: (event) => recorder.observe(event) }),
+                        : {
+                            onEvent: (event) => recorder.observe(event),
+                            // T-1 · The user's questions. Without this the transcript held
+                            // the replies and none of the prompts, so resuming it could
+                            // not continue a conversation that was only half there.
+                            onGoal: (goal) => recorder.goal(goal),
+                        }),
                     model,
                     pricing: resolved,
                     catalog,
@@ -113,6 +119,7 @@ export async function agentCommand(argv, io) {
                     stderr: io.stderr,
                     signal: io.signal,
                     isTty: isTty(io),
+                    ...(io.readLine === undefined ? {} : { readLine: io.readLine }),
                 });
             }
             finally {

package/dist/commands/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/commands/models.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAUnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AA0BtB,wBAAsB,aAAa,CACjC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,QAAQ,CAAC,CA6BnB"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/commands/models.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAWnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AA0CtB,wBAAsB,aAAa,CACjC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,QAAQ,CAAC,CA6BnB"}

package/dist/commands/models.js

@@ -2,6 +2,7 @@ import { fetchAccessibleModels, fetchCatalog, intersectModels, } from "../api/mo
 import { ExitCode } from "../output/exit-codes.js";
 import { parseFormatFlags, renderJson, renderPlain, renderRecord, renderTable, } from "../output/format.js";
 import { formatUsd } from "../output/money.js";
+import { safeForTerminal } from "../output/terminal-safe.js";
 import { buildRuntime, reportError, requireApiKey, } from "./runtime.js";
 const USAGE = `Usage:
   mafdet models list [--surface <chat|embeddings|speech>] [--agent] [--json|--plain]
@@ -13,10 +14,21 @@ const SURFACES = {
     speech: "AUDIO_SPEECH",
     realtime: "REALTIME",
 };
-const columns = [
-    { header: "MODEL", value: (m) => m.modelId },
-    { header: "PROVIDER", value: (m) => m.provider ?? "-" },
-    { header: "SURFACE", value: (m) => m.apiSurface ?? "-" },
+/**
+ * U-3 · Terminal-safe only for the table. `--json` keeps the catalogue's
+ * bytes exactly as served, which is the project's stated rule for anything a
+ * script parses - and the identity fields are never rewritten anywhere.
+ */
+const columns = (isTty) => [
+    { header: "MODEL", value: (m) => safeForTerminal(m.modelId, isTty) },
+    {
+        header: "PROVIDER",
+        value: (m) => safeForTerminal(m.provider ?? "-", isTty),
+    },
+    {
+        header: "SURFACE",
+        value: (m) => safeForTerminal(m.apiSurface ?? "-", isTty),
+    },
     {
         header: "CONTEXT",
         value: (m) => String(m.contextLength ?? "-"),
@@ -24,6 +36,10 @@ const columns = [
     },
     { header: "AGENT", value: (m) => (m.agentEligible ? "yes" : "-") },
 ];
+/** Whether a terminal is on the other end of stdout. Injectable for tests. */
+function isTty(io) {
+    return io.isTty ?? process.stdout.isTTY === true;
+}
 export async function modelsCommand(argv, io) {
     const [subcommand, ...rest] = argv;
     if (subcommand !== "list" && subcommand !== "show") {
@@ -88,8 +104,10 @@ function listModels(sets, args, format, io) {
         return ExitCode.Ok;
     }
     io.stdout(format === "plain"
-        ? renderPlain(rows, columns)
-        : renderTable(rows, columns));
+        ? // `--plain` is for `cut` and `awk`, so it keeps the bytes; the table is
+            // for a person and gets cleaned.
+            renderPlain(rows, columns(false))
+        : renderTable(rows, columns(isTty(io))));
     if (format === "table" && sets.unlisted.length > 0) {
         io.stderr(`note: ${sets.unlisted.length} model(s) callable but missing from the catalogue: ${sets.unlisted.join(", ")}\n`);
     }
@@ -117,16 +135,19 @@ function showModel(sets, args, format, io) {
         return ExitCode.Usage;
     }
     if (format === "json") {
+        // U-3 · Exactly as the catalogue served it. A script parsing this needs
+        // the real values, and identity is never rewritten anywhere.
         io.stdout(renderJson(model));
         return ExitCode.Ok;
     }
+    const clean = (text) => safeForTerminal(text, isTty(io));
     io.stdout(renderRecord([
-        ["model", model.modelId],
-        ["name", model.displayName ?? "-"],
-        ["provider", model.provider ?? "-"],
-        ["surface", model.apiSurface ?? "-"],
+        ["model", clean(model.modelId)],
+        ["name", clean(model.displayName ?? "-")],
+        ["provider", clean(model.provider ?? "-")],
+        ["surface", clean(model.apiSurface ?? "-")],
         ["context", String(model.contextLength ?? "-")],
-        ["capabilities", (model.capabilities ?? []).join(", ") || "-"],
+        ["capabilities", clean((model.capabilities ?? []).join(", ")) || "-"],
         ["agent eligible", model.agentEligible ? "yes" : "no"],
         [
             "input / 1M",

package/dist/tui/adapters/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../src/tui/adapters/models.ts"],"names":[],"mappings":"AAiBA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAKzE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoB1B;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAkB1D;AASD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,KAAK,EAAE,MAAM,GACZ,SAAS,aAAa,EAAE,CAgB1B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,UAAU,CA8Cb"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../src/tui/adapters/models.ts"],"names":[],"mappings":"AAiBA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAKzE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoB1B;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoB1D;AASD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,KAAK,EAAE,MAAM,GACZ,SAAS,aAAa,EAAE,CAgB1B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,UAAU,CA8Cb"}

package/dist/tui/adapters/models.js

@@ -8,6 +8,7 @@
 import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, join } from "node:path";
 import { fetchAccessibleModels, fetchCatalog, intersectModels, } from "../../api/models.js";
+import { stripAnsi } from "../../agent/command-policy.js";
 import { buildRuntime } from "../../commands/runtime.js";
 import { parseUserConfig } from "../../config/config.js";
 import { userConfigPath } from "../../config/paths.js";
@@ -38,6 +39,8 @@ export async function loadCatalogue(options) {
 }
 /** One line of facts under a model's name. Only what the catalogue states. */
 export function describeModel(model) {
+    // U-3 · One line drawn on a terminal from remote text. Cleaned here rather
+    // than at ingestion, which would change values the CLI matches and sends.
     const parts = [];
     if (model.provider !== undefined)
         parts.push(model.provider);
@@ -54,7 +57,7 @@ export function describeModel(model) {
             ? `DEPRECATED - use ${model.replacement_model_id}`
             : "DEPRECATED");
     }
-    return parts.join(" - ");
+    return stripAnsi(parts.join(" - "));
 }
 function priceSummary(model) {
     const input = model.inputPricePer1mMicroUsd;

package/dist/tui/picker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"picker.d.ts","sourceRoot":"","sources":["../../src/tui/picker.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAW7C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAiHrB;AA6BD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,oBAAoB,GACjC,MAAM,CAaR;AAED,iEAAiE;AACjE,YAAY,EAAE,GAAG,EAAE,CAAC"}
+{"version":3,"file":"picker.d.ts","sourceRoot":"","sources":["../../src/tui/picker.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAW7C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAsHrB;AA6BD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,oBAAoB,GACjC,MAAM,CAaR;AAED,iEAAiE;AACjE,YAAY,EAAE,GAAG,EAAE,CAAC"}

package/dist/tui/picker.js

@@ -5,6 +5,7 @@
 // difference between "you cannot use this" and "the agent cannot drive this"
 // stays visible instead of looking like a missing model.
 import { describeModel, filterModels } from "./adapters/models.js";
+import { stripAnsi } from "../agent/command-policy.js";
 import { palette } from "./theme.js";
 const ESC = String.fromCharCode(27);
 const CSI = `${ESC}[`;
@@ -40,8 +41,11 @@ export async function pickModel(io, options) {
         else {
             for (const { model, i } of windowOf(matches, index)) {
                 const selected = i === index;
+                // U-3 · Sanitised here, at the terminal, and not at ingestion: the
+                // catalogue's values are identity and are matched, sent and reported
+                // verbatim. Only what is drawn gets cleaned.
                 const name = model.displayName ?? model.modelId;
-                const head = `${model.modelId}${name !== model.modelId ? ` (${name})` : ""}`;
+                const head = stripAnsi(`${model.modelId}${name !== model.modelId ? ` (${name})` : ""}`);
                 lines.push(selected ? accent(`  > ${head}`) : `    ${head}`);
                 lines.push(dim(`      ${describeModel(model)}`));
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mafdet/cli",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "Mafdet AI command line — model calls, account queries, and a permissioned local agent.",
   "type": "module",
   "license": "MIT",