@mafdet/cli 0.4.7 → 0.4.9

package/CHANGELOG.md

@@ -6,6 +6,70 @@ The version is the contract for the JSON output shapes and the exit codes.
 Being 0.x, semver still permits a break in a minor bump; the intent is not to
 use that latitude, and the promise becomes binding at 1.0.0.
 
+## 0.4.9 - 2026-08-12
+
+A fifth audit round: two billing and terminal-safety fixes, and two smaller
+corrections.
+
+**Incomplete usage is no longer priced as though the missing half were zero.**
+A reply carrying `{}`, or only `prompt_tokens`, or only `completion_tokens`,
+was charged with the absent side counted as nothing - so a run under
+`--max-cost-usd` finished successfully having applied the ceiling to a partly
+invented figure. A fractional count did worse: it crashed with an uncaught
+error out of the pricing code. Both token counts and both prices must now be
+present and valid; anything else is reported as unpriced, stops a run that
+asked for a ceiling, and keeps the answer that was generated.
+
+**Errors and diagnostics can no longer carry terminal control sequences.**
+`mafdet doctor` interpolated a model's `apiSurface` straight into its table,
+and a surface-mismatch error did the same into stderr. Rather than cleaning
+those two strings, the cleaning now happens at the two boundaries every
+command already funnels through - the shared error reporter and the diagnostic
+table - so the checks and messages added later are covered too. Redirected
+output and `--json` keep the bytes exactly.
+
+**The context estimate measures UTF-8 bytes**, not UTF-16 code units, and
+counts the whole request body. A Chinese conversation measured about 10%
+smaller than it is on the wire, in the one estimate that must not under-count.
+
+**Unused code is now a compile error** (`noUnusedLocals`,
+`noUnusedParameters`). A dead import survived four review rounds because
+nothing was looking for one; turning the check on found eight more.
+
+## 0.4.8 - 2026-08-12
+
+A fourth audit round: three findings, one of which was a regression I
+introduced in 0.4.6.
+
+**Model identifiers are never rewritten.** 0.4.6 stripped terminal escape
+sequences from the catalogue as it arrived, which sounded like the tidy place
+to do it and was the wrong place: the identifier is what the access
+intersection is computed from, so two distinct ids collapsed into one and a key
+that could call only `safe<escape>` appeared to have access to `safe`. It is
+also what gets sent back to the API and what `--json` reports. Identifiers are
+now left exactly as served; one carrying a control character is refused
+outright - it cannot be a real id - and the cleaning happens where something
+draws text on a terminal, with `--json` and `--plain` keeping the bytes.
+
+**A cost ceiling reports honestly when the response carries no usage.** The
+catalogue check added in 0.4.6 covers a model with no published price; a model
+that has one whose reply arrives without a usage block is only discoverable
+afterwards, and that run finished `completed` with exit 0 - telling you a
+ceiling had held when it had never been applied to anything. It now stops with
+the ceiling's exit code, keeps the answer that was generated, and says that
+usage was missing rather than that the price was.
+
+**Context compaction measures instead of guessing.** The estimate divided the
+last token count by the number of messages and scaled linearly, with a
+hand-tuned allowance for the system prompt - which ignored the tool schemas,
+often the largest part of a request, and assumed a fixed characters-per-token
+ratio that does not hold across English, Chinese, code and JSON. It now uses
+the ratio between the provider's own token count and the exact bytes that
+earned it, applied to the bytes about to be sent, schemas included. It remains
+an estimate: guaranteeing no request ever exceeds the window would need a
+tokenizer or a server-side token count, and the documentation now says so
+rather than implying otherwise.
+
 ## 0.4.7 - 2026-08-12
 
 0.4.6 shipped without the fix it was published for.
@@ -28,7 +92,9 @@ A third audit round. Two of its findings were things the previous round's
 notes recorded as fixed, and the pattern is worth naming: a partial fix logged
 as complete is not looked at again.
 
-**An interactive `mafdet agent` now records your questions.** It saved the
+**An interactive `mafdet agent` now records your questions.** ⚠️ This is what
+0.4.6 was published for and it is **not in 0.4.6** - the wiring was missing and
+the release went out with the old behaviour. Fixed in 0.4.7; see that entry. It saved the
 model's replies, the tool runs and the usage, and none of the prompts - so
 resuming such a session could not continue a conversation that was only half
 there. The TUI wrapped its own reader to record them and the command surface

package/README.md

@@ -3,7 +3,7 @@
 The official Mafdet AI command line: model calls, account queries, and a
 permissioned local agent.
 
-> **0.4.7.** 中文版见 [README.zh-CN.md](./README.zh-CN.md). The CLI never
+> **0.4.9.** 中文版见 [README.zh-CN.md](./README.zh-CN.md). The CLI never
 > advertises a command it cannot serve, so `mafdet help` always lists exactly
 > what works.
 >
@@ -23,8 +23,8 @@ Or build it from this repository:
 
 ```bash
 pnpm --filter @mafdet/cli build
-cd packages/cli && npm pack          # -> mafdet-cli-0.4.7.tgz
-npm install -g ./mafdet-cli-0.4.7.tgz
+cd packages/cli && npm pack          # -> mafdet-cli-0.4.9.tgz
+npm install -g ./mafdet-cli-0.4.9.tgz
 ```
 
 ## The interactive session

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 Mafdet AI 官方命令行：模型调用、账户查询，以及一个受权限约束的本地 Agent。
 
-> **0.4.7。** 英文版见 [README.md](./README.md)。
+> **0.4.9。** 英文版见 [README.md](./README.md)。
 
 ## 环境要求
 

package/dist/agent/context-budget.d.ts

@@ -83,5 +83,46 @@ export declare function compactForBudget(history: ChatMessage[], keepRecent?: nu
  * it is the only honest figure available and it is monotone in the right
  * direction, which is what a loop needs.
  */
-export declare function compactUntilItFits(history: ChatMessage[], contextLength: number | undefined, lastPromptTokens: number, keepRecent?: number): CompactionResult;
+/**
+ * U-1 · Shorten until the estimate fits, using a ratio measured from the last
+ * real request rather than a guess about characters per token.
+ *
+ * The previous version divided the last `prompt_tokens` by the message count
+ * and scaled linearly, with a hand-tuned allowance for the system prompt. That
+ * was wrong twice over: it ignored the tool schemas, which are re-sent every
+ * turn and are often larger than the conversation, and characters per token
+ * is not a constant across English, Chinese, code and JSON.
+ *
+ * What is measured here instead is the ratio between the provider's own token
+ * count and the UTF-8 size of what we sent to earn it. Applied to the bytes we are
+ * about to send - schemas included - it needs no assumption about language or
+ * encoding, because both sides of the ratio came from the same request.
+ *
+ * ⚠️ It is still an estimate, and it is not a proof. Two requests can differ
+ * in their token-per-byte ratio, so this cannot guarantee "never sends an
+ * over-window request"; that would need a tokenizer or a server-side
+ * token-count endpoint. What it does guarantee is that the fixed part is
+ * counted rather than assumed away.
+ */
+export declare function compactUntilItFits(history: ChatMessage[], contextLength: number | undefined, lastPromptTokens: number, 
+/** Size of the request that produced `lastPromptTokens`, in UTF-8 bytes. */
+lastRequestSize: number, 
+/** Size of the request as it stands now, recomputed after each removal. */
+sizeNow: () => number, keepRecent?: number): CompactionResult;
+/**
+ * V-3 · The size of a request, as UTF-8 bytes.
+ *
+ * Named `requestSize` rather than `requestBytes` for a while it was neither:
+ * `String.length` counts UTF-16 code units, so a Chinese conversation measured
+ * about 10% smaller than it is on the wire - and the estimate that uses this
+ * is precisely the one that must not under-count. `Buffer.byteLength` counts
+ * what is actually sent.
+ *
+ * ⚠️ It feeds a heuristic, not a tokenizer. The ratio it participates in is
+ * measured from a real request, which is the best available answer without a
+ * server-side token count - but it cannot prove a request fits the window.
+ */
+export declare function requestSize(messages: readonly ChatMessage[], tools: unknown, 
+/** The rest of the body, so the measurement covers what is really sent. */
+extra?: Record<string, unknown>): number;
 //# sourceMappingURL=context-budget.d.ts.map

package/dist/agent/context-budget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-budget.d.ts","sourceRoot":"","sources":["../../src/agent/context-budget.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAKT;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAsCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,WAAW,CAkBb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,EAAE,MAAM,GAChB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0BpC;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CASlB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,EACxB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CAoClB"}
+{"version":3,"file":"context-budget.d.ts","sourceRoot":"","sources":["../../src/agent/context-budget.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,OAAO,CAAC;AAE/B,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAKT;AAED,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAsCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,WAAW,CAkBb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,EAAE,MAAM,GAChB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0BpC;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CASlB;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,MAAM;AACxB,4EAA4E;AAC5E,eAAe,EAAE,MAAM;AACvB,2EAA2E;AAC3E,OAAO,EAAE,MAAM,MAAM,EACrB,UAAU,GAAE,MAA8B,GACzC,gBAAgB,CA8BlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,KAAK,EAAE,OAAO;AACd,2EAA2E;AAC3E,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,MAAM,CAWR"}

package/dist/agent/context-budget.js

@@ -181,19 +181,38 @@ export function compactForBudget(history, keepRecent = KEEP_RECENT_EXCHANGES) {
  * it is the only honest figure available and it is monotone in the right
  * direction, which is what a loop needs.
  */
-export function compactUntilItFits(history, contextLength, lastPromptTokens, keepRecent = KEEP_RECENT_EXCHANGES) {
+/**
+ * U-1 · Shorten until the estimate fits, using a ratio measured from the last
+ * real request rather than a guess about characters per token.
+ *
+ * The previous version divided the last `prompt_tokens` by the message count
+ * and scaled linearly, with a hand-tuned allowance for the system prompt. That
+ * was wrong twice over: it ignored the tool schemas, which are re-sent every
+ * turn and are often larger than the conversation, and characters per token
+ * is not a constant across English, Chinese, code and JSON.
+ *
+ * What is measured here instead is the ratio between the provider's own token
+ * count and the UTF-8 size of what we sent to earn it. Applied to the bytes we are
+ * about to send - schemas included - it needs no assumption about language or
+ * encoding, because both sides of the ratio came from the same request.
+ *
+ * ⚠️ It is still an estimate, and it is not a proof. Two requests can differ
+ * in their token-per-byte ratio, so this cannot guarantee "never sends an
+ * over-window request"; that would need a tokenizer or a server-side
+ * token-count endpoint. What it does guarantee is that the fixed part is
+ * counted rather than assumed away.
+ */
+export function compactUntilItFits(history, contextLength, lastPromptTokens, 
+/** Size of the request that produced `lastPromptTokens`, in UTF-8 bytes. */
+lastRequestSize, 
+/** Size of the request as it stands now, recomputed after each removal. */
+sizeNow, keepRecent = KEEP_RECENT_EXCHANGES) {
     const startedWith = history.length;
-    const floor = fixedOverhead(history, lastPromptTokens);
-    const perMessage = startedWith > 0 ? Math.max(0, lastPromptTokens - floor) / startedWith : 0;
+    const tokensPerByte = lastRequestSize > 0 ? lastPromptTokens / lastRequestSize : 0;
     let exchanges = 0;
     let turns = 0;
     for (;;) {
-        // T-2 · The floor does not shrink. The system prompt and the tool schemas
-        // are re-sent every turn whatever the history looks like, so treating the
-        // whole measurement as proportional to the message count said a
-        // conversation had come inside the window when only the removable part
-        // had. Everything below the floor is not ours to drop.
-        const estimate = floor + Math.round(perMessage * history.length);
+        const estimate = Math.round(tokensPerByte * sizeNow());
         if (!shouldCompact(contextLength, estimate)) {
             return {
                 removed: startedWith - history.length,
@@ -217,28 +236,27 @@ export function compactUntilItFits(history, contextLength, lastPromptTokens, kee
     }
 }
 /**
- * T-2 · What the next request costs before any history is added.
+ * V-3 · The size of a request, as UTF-8 bytes.
+ *
+ * Named `requestSize` rather than `requestBytes` for a while it was neither:
+ * `String.length` counts UTF-16 code units, so a Chinese conversation measured
+ * about 10% smaller than it is on the wire - and the estimate that uses this
+ * is precisely the one that must not under-count. `Buffer.byteLength` counts
+ * what is actually sent.
  *
- * The system prompt is measurable; the tool schemas are not from here - the
- * loop knows them but this module does not, and CLI-000B found the gateway's
- * own reservation undercounts badly for exactly that reason. So it is
- * approximated from the one message we can size, with a floor that keeps the
- * estimate conservative: over-estimating the fixed part makes compaction try
- * harder, which is the direction that fails safe.
+ * ⚠️ It feeds a heuristic, not a tokenizer. The ratio it participates in is
+ * measured from a real request, which is the best available answer without a
+ * server-side token count - but it cannot prove a request fits the window.
  */
-function fixedOverhead(history, lastPromptTokens) {
-    const system = history.find((m) => m.role === "system");
-    if (system === undefined || lastPromptTokens <= 0)
-        return 0;
-    const chars = (system.content ?? "").length;
-    // Roughly four characters per token, doubled to stand in for the tool
-    // schemas that are sent alongside it and cannot be measured here.
-    const approx = Math.round((chars / 4) * 2);
-    // Bounded by the measurement, because the fixed part cannot exceed the whole
-    // request - but NOT halved. Capping it lower was the unsafe direction: it
-    // let the loop conclude that dropping a few messages had brought a history
-    // inside a window the system prompt alone did not fit in. Over-estimating
-    // makes compaction try harder and, at worst, stop with an honest message;
-    // under-estimating sends a request that fails upstream and is billed.
-    return Math.min(approx, lastPromptTokens);
+export function requestSize(messages, tools, 
+/** The rest of the body, so the measurement covers what is really sent. */
+extra = {}) {
+    try {
+        return Buffer.byteLength(JSON.stringify({ ...extra, messages, tools }), "utf8");
+    }
+    catch {
+        // Circular or unserialisable: fall back to something monotone in the
+        // history length so the loop still makes progress.
+        return messages.length;
+    }
 }

package/dist/agent/loop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc;AAChB,8EAA8E;GAC5E,eAAe;AACjB;;;;GAIG;GACD,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAYD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAkN1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR"}
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../src/agent/loop.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAE1B,iBAAiB;AACjB,eAAO,MAAM,cAAc;;;IAGzB,iFAAiF;;;qBAGnD,MAAM,GAAG,SAAS;CACjD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,WAAW,GACX,WAAW,GACX,SAAS,GACT,UAAU,GACV,WAAW,GACX,cAAc;AAChB,8EAA8E;GAC5E,eAAe;AACjB;;;;GAIG;GACD,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,uDAAuD;IACvD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChC;;;;;GAKG;GACD;IACE,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D;;;;GAIG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAYD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAoO1E;AAqID,+EAA+E;AAC/E,wBAAgB,SAAS,CACvB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,CAOR"}

package/dist/agent/loop.js

@@ -1,5 +1,5 @@
 import { ApiError } from "../api/errors.js";
-import { compactUntilItFits, shouldCompact } from "./context-budget.js";
+import { compactUntilItFits, requestSize, shouldCompact, } from "./context-budget.js";
 import { toolToJsonSchema, } from "./tools/types.js";
 /** Plan §7.4. */
 export const DEFAULT_LIMITS = {
@@ -48,8 +48,8 @@ export async function runAgent(options) {
     };
     /** What the provider counted for the previous request; 0 until one lands. */
     let lastPromptTokens = 0;
-    /** R-5 · Turns whose cost the catalogue could not tell us. */
-    let unpricedTurns = 0;
+    /** U-1 · UTF-8 size of the request that produced `lastPromptTokens`. */
+    let lastRequestSize = 0;
     // T-3 · Known before anything is sent. Waiting for the first response to
     // discover it meant a run with an explicit ceiling still made one billable
     // request that could never be counted against it.
@@ -69,15 +69,6 @@ export async function runAgent(options) {
             report.costMicroUsd >= limits.maxCostMicroUsd) {
             return stop(report, "max_cost");
         }
-        // R-5 · An unpriceable turn counted as 0 towards the ceiling, so
-        // `--max-cost-usd` silently stopped being a ceiling at all and the run
-        // continued spending real money. A limit that cannot be enforced has to
-        // stop the run, not be quietly abandoned.
-        if (limits.maxCostMicroUsd !== undefined && unpricedTurns > 0) {
-            return stop(report, "cost_unknown", `--max-cost-usd cannot be enforced: the catalogue has no price for ` +
-                `${options.model}, so ${unpricedTurns} request(s) could not be counted ` +
-                `towards the ceiling. Re-run without the limit to continue anyway.`);
-        }
         report.turns = turn;
         options.onEvent?.({ type: "turn", turn });
         // §7.4 · Shorten before asking, using what the provider counted last time.
@@ -85,7 +76,10 @@ export async function runAgent(options) {
             // R-2 · Keep going until the estimate is inside the budget. Dropping one
             // exchange and sending anyway left a history that was still over the
             // window: the request failed upstream and was billed for the attempt.
-            const compacted = compactUntilItFits(messages, options.pricing?.contextLength, lastPromptTokens);
+            const compacted = compactUntilItFits(messages, options.pricing?.contextLength, lastPromptTokens, lastRequestSize, () => requestSize(messages, toolSchemas, {
+                model: options.model,
+                tool_choice: "auto",
+            }));
             if (compacted.exhausted) {
                 // F-008 · Nothing left that can be dropped without breaking the
                 // conversation. Sending anyway means a request over the window, which
@@ -107,6 +101,12 @@ export async function runAgent(options) {
             // history, and reusing the old figure would compact again every turn.
             lastPromptTokens = 0;
         }
+        // U-1 · Measured for the request we are about to make, so the ratio the
+        // next compaction uses is the provider's own count over these exact bytes.
+        const sentSize = requestSize(messages, toolSchemas, {
+            model: options.model,
+            tool_choice: "auto",
+        });
         let response;
         try {
             response = await requestWithRateLimitHandling(options, limits, {
@@ -126,7 +126,10 @@ export async function runAgent(options) {
             return stop(report, "error", error instanceof Error ? error.message : String(error));
         }
         const usage = response.usage;
-        lastPromptTokens = usage?.prompt_tokens ?? lastPromptTokens;
+        if (usage?.prompt_tokens !== undefined) {
+            lastPromptTokens = usage.prompt_tokens;
+            lastRequestSize = sentSize;
+        }
         report.promptTokens += usage?.prompt_tokens ?? 0;
         report.completionTokens += usage?.completion_tokens ?? 0;
         // Cost comes from returned usage, never from the reservation: CLI-000B
@@ -144,10 +147,8 @@ export async function runAgent(options) {
             costMicroUsd: turnCost,
             priced: canPrice(options.pricing, usage),
         });
-        if (!canPrice(options.pricing, usage)) {
-            unpricedTurns += 1;
+        if (!canPrice(options.pricing, usage))
             report.unpricedRequests += 1;
-        }
         const choice = response.choices?.[0];
         const message = choice?.message;
         const calls = message?.tool_calls ?? [];
@@ -155,6 +156,17 @@ export async function runAgent(options) {
             report.finalText = message.content;
             options.onEvent?.({ type: "text", text: message.content });
         }
+        // U-2 · After the answer is recorded, so the user keeps what was generated
+        // and paid for. A model the catalogue prices whose reply carried no
+        // `usage` is only discoverable here, and the run used to finish
+        // `completed` with exit 0 - telling the user a ceiling had held when it
+        // had never been applied to anything.
+        if (limits.maxCostMicroUsd !== undefined &&
+            !canPrice(options.pricing, usage)) {
+            return stop(report, "cost_unknown", `--max-cost-usd cannot be enforced: usage was missing or incomplete ` +
+                `in the response for ${options.model}, so this request could not be ` +
+                `counted towards the ceiling.`);
+        }
         if (calls.length === 0) {
             // Keep the answer in the history so a session's next turn has context.
             messages.push({ role: "assistant", content: message?.content ?? "" });
@@ -305,21 +317,46 @@ export function backoffMs(retryAfterSeconds, attempt, random = Math.random) {
     // Full jitter: a fleet of CLIs must not retry in lockstep.
     return Math.round(base * (0.5 + random() * 0.5));
 }
-/** F-012 · Whether `priceTurn` had everything it needed to give an answer. */
+/**
+ * V-1 · Whether this turn can be priced at all.
+ *
+ * "There is a usage object" is not the same as "there is a usage". A reply can
+ * carry `{}`, or only `prompt_tokens`, or a fractional or negative count - and
+ * each of those used to be priced as though the missing half were zero, so a
+ * run under `--max-cost-usd` finished successfully having applied the ceiling
+ * to a number that was partly invented. A fractional count did worse: it threw
+ * out of `priceTurn` as an uncaught RangeError.
+ *
+ * Both token counts and both prices have to be there and be usable. Anything
+ * short of that is unpriced, which the caller reports rather than rounds down.
+ */
+function isTokenCount(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+/** Integer micro-USD, non-negative. Anything else is not a price. */
+function isPrice(value) {
+    return typeof value === "string" && /^\d+$/.test(value);
+}
 function canPrice(model, usage) {
-    return (usage !== undefined &&
-        model?.inputPricePer1mMicroUsd !== undefined &&
-        model?.outputPricePer1mMicroUsd !== undefined);
+    if (usage === undefined)
+        return false;
+    if (!isTokenCount(usage.prompt_tokens))
+        return false;
+    if (!isTokenCount(usage.completion_tokens))
+        return false;
+    return (isPrice(model?.inputPricePer1mMicroUsd) &&
+        isPrice(model?.outputPricePer1mMicroUsd));
 }
 function priceTurn(model, usage) {
-    if (!model?.inputPricePer1mMicroUsd ||
-        !model.outputPricePer1mMicroUsd ||
-        !usage) {
+    // V-1 · One gate, shared with the caller's reporting, so a turn can never be
+    // charged for and reported as unpriced - or the reverse.
+    if (!canPrice(model, usage))
         return 0n;
-    }
-    const ceilDiv = (tokens, price) => (BigInt(Math.max(0, tokens)) * BigInt(price) + 999999n) / 1000000n;
-    return (ceilDiv(usage.prompt_tokens ?? 0, model.inputPricePer1mMicroUsd) +
-        ceilDiv(usage.completion_tokens ?? 0, model.outputPricePer1mMicroUsd));
+    const prompt = usage?.prompt_tokens ?? 0;
+    const completion = usage?.completion_tokens ?? 0;
+    const ceilDiv = (tokens, price) => (BigInt(tokens) * BigInt(price) + 999999n) / 1000000n;
+    return (ceilDiv(prompt, model?.inputPricePer1mMicroUsd ?? "0") +
+        ceilDiv(completion, model?.outputPricePer1mMicroUsd ?? "0"));
 }
 function stop(report, reason, error) {
     report.stopReason = reason;

package/dist/agent/session.js

@@ -38,7 +38,7 @@ export async function runSession(options) {
     let pricing = options.pricing;
     const source = options.readLine
         ? undefined
-        : lineSource(options.input ?? process.stdin, options.stderr);
+        : lineSource(options.input ?? process.stdin);
     const readLine = options.readLine ??
         (() => {
             options.stderr("\n> ");
@@ -253,7 +253,7 @@ export function compactHistory(history) {
  * a queue keeps them, and end-of-input only reports undefined once the queue
  * is actually empty.
  */
-function lineSource(input, write) {
+function lineSource(input) {
     const rl = createInterface({
         input,
         output: process.stderr,

package/dist/agent/tools/run-command.js

@@ -55,7 +55,7 @@ export async function executeCommand(argv, cwd, timeoutMs = COMMAND_TIMEOUT_MS)
             clearTimeout(timer);
             resolve({ code, signal, output: stripAnsi(output), timedOut });
         };
-        child.on("error", (error) => finish(null, null));
+        child.on("error", () => finish(null, null));
         child.on("close", (code, signal) => finish(code, signal));
     });
 }

package/dist/api/models.d.ts

@@ -52,6 +52,21 @@ export declare function intersectModels(dataPlane: readonly DataPlaneModel[], ca
 export declare function fetchAccessibleModels(client: HttpClient): Promise<DataPlaneModel[]>;
 /** GET /models on the business API — public catalogue, no key required. */
 export declare function fetchCatalog(client: HttpClient): Promise<CatalogModel[]>;
+/**
+ * U-3 · Is this a usable model identifier?
+ *
+ * Identity is never rewritten. Sanitising the id at ingestion - which is what
+ * the previous attempt did - merges two distinct ids into one, and the id is
+ * what the *access* intersection is computed from: a key that could call only
+ * `safe<OSC>` was granted `safe`. It is also what gets sent back to the API
+ * and what `--json` reports, and the project's own rule is that a pipe
+ * receives exact bytes.
+ *
+ * So an id carrying a control character is refused instead. It cannot be a
+ * real model id, and refusing is the fail-closed reading of a value we do not
+ * understand.
+ */
+export declare function isUsableModelId(id: string): boolean;
 /**
  * Check the model serves the endpoint the command needs, before spending a
  * request on it. The gateway does answer 400 `model_api_surface_mismatch`, but

package/dist/api/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/api/models.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAQxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,cAAc,EAAE,EACpC,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,SAAS,CAuBX;AAED,8CAA8C;AAC9C,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,cAAc,EAAE,CAAC,CAQ3B;AAED,2EAA2E;AAC3E,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,EAAE,CAAC,CAGzB;AA0BD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,YAAY,GAAG,SAAS,CAY1B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAFhB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM;CAO5B"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/api/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,mDAAmD;IACnD,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAUxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,cAAc,EAAE,EACpC,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,SAAS,CA4BX;AAED,8CAA8C;AAC9C,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,cAAc,EAAE,CAAC,CAG3B;AAED,2EAA2E;AAC3E,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,YAAY,EAAE,CAAC,CAGzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,YAAY,GAAG,SAAS,CAY1B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAFhB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM;CAO5B"}

package/dist/api/models.js

@@ -1,4 +1,3 @@
-import { stripAnsi } from "../agent/command-policy.js";
 /**
  * Agent admission. Every condition is something the catalogue states outright;
  * nothing is inferred from the model id, the provider or the display name —
@@ -7,6 +6,9 @@ import { stripAnsi } from "../agent/command-policy.js";
 export function isAgentEligible(model) {
     if (!model)
         return false;
+    // U-3 · An id we cannot make sense of never drives the agent.
+    if (!isUsableModelId(model.modelId))
+        return false;
     if (!(model.capabilities ?? []).includes("tool_use"))
         return false;
     if ((model.apiSurface ?? "CHAT_COMPLETIONS") !== "CHAT_COMPLETIONS")
@@ -34,6 +36,12 @@ export function intersectModels(dataPlane, catalog) {
     const available = [];
     const unlisted = [];
     for (const id of accessible) {
+        // U-3 · Fail closed on an id we cannot make sense of. It never becomes
+        // callable, never becomes agent-eligible, and is never matched against a
+        // catalogue entry - which is the mistake that let `safe<OSC>` be treated
+        // as `safe`.
+        if (!isUsableModelId(id))
+            continue;
         const meta = byId.get(id);
         if (!meta) {
             unlisted.push(id);
@@ -52,37 +60,30 @@ export function intersectModels(dataPlane, catalog) {
 /** GET /v1/models — the key's access list. */
 export async function fetchAccessibleModels(client) {
     const { data } = await client.getJson("/models");
-    // T-5 · Same reason as `cleanModel`: these ids are printed as the "unlisted"
-    // set, so they reach a terminal without ever passing through the catalogue.
-    return (data.data ?? []).map((model) => ({
-        ...model,
-        id: typeof model.id === "string" ? stripAnsi(model.id) : model.id,
-    }));
+    return data.data ?? [];
 }
 /** GET /models on the business API — public catalogue, no key required. */
 export async function fetchCatalog(client) {
     const { data } = await client.getJson("/models");
-    return (data.data ?? []).map(cleanModel);
+    return data.data ?? [];
 }
 /**
- * T-5 · Strip terminal control sequences from catalogue text, once, here.
+ * U-3 · Is this a usable model identifier?
  *
- * The catalogue is remote data that ends up on a terminal in the picker, in
- * `models list`, in `models show`, in `doctor` and in error messages. F-010
- * was fixed sink by sink across two review rounds and the picker was still
- * missing, which is the argument for doing it where the data enters instead:
- * every renderer downstream, present and future, then has nothing to forget.
+ * Identity is never rewritten. Sanitising the id at ingestion - which is what
+ * the previous attempt did - merges two distinct ids into one, and the id is
+ * what the *access* intersection is computed from: a key that could call only
+ * `safe<OSC>` was granted `safe`. It is also what gets sent back to the API
+ * and what `--json` reports, and the project's own rule is that a pipe
+ * receives exact bytes.
  *
- * The model id is cleaned too. It is sent back to the API, so in principle
- * this changes what we would ask for - but an id carrying a control character
- * is not a model id, and declining to echo one back is right either way.
+ * So an id carrying a control character is refused instead. It cannot be a
+ * real model id, and refusing is the fail-closed reading of a value we do not
+ * understand.
  */
-function cleanModel(model) {
-    const clean = (value) => typeof value === "string" ? stripAnsi(value) : value;
-    return Object.fromEntries(Object.entries(model).map(([key, value]) => [
-        key,
-        Array.isArray(value) ? value.map(clean) : clean(value),
-    ]));
+export function isUsableModelId(id) {
+    // eslint-disable-next-line no-control-regex
+    return id.length > 0 && !/[\u0000-\u001f\u007f-\u009f]/.test(id);
 }
 /**
  * Check the model serves the endpoint the command needs, before spending a

package/dist/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAInD,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAY5D,MAAM,WAAW,QAAS,SAAQ,SAAS;IACzC,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,QAAQ,GACX,OAAO,CAAC,QAAQ,CAAC,CAyFnB"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAKnD,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAY5D,MAAM,WAAW,QAAS,SAAQ,SAAS;IACzC,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,QAAQ,GACX,OAAO,CAAC,QAAQ,CAAC,CAyFnB"}

package/dist/commands/doctor.js

@@ -7,6 +7,7 @@ import { ConfigError } from "../config/config.js";
 import { ExitCode } from "../output/exit-codes.js";
 import { parseFormatFlags, renderJson, renderTable } from "../output/format.js";
 import { formatUsd } from "../output/money.js";
+import { safeForTerminal } from "../output/terminal-safe.js";
 import { keyFingerprint, redact } from "../security/redact.js";
 import { buildRuntime } from "./runtime.js";
 const MINIMUM_NODE_MAJOR = 20;
@@ -141,14 +142,20 @@ function describe(error) {
 function report(checks, format, io) {
     const failed = checks.filter((check) => check.status === "fail").length;
     if (format === "json") {
+        // Exact values, as everywhere else that a machine reads.
         io.stdout(renderJson({ ok: failed === 0, checks }));
     }
     else {
         const mark = { ok: "ok", warn: "warn", fail: "FAIL" };
+        // V-2 · One place every check's detail is drawn, and several of them are
+        // built from remote text - a model's apiSurface, an endpoint, an upstream
+        // error. Cleaning here covers the checks that exist and the ones added
+        // later; cleaning each check's string did not.
+        const tty = io.isTty ?? process.stdout.isTTY === true;
         io.stdout(renderTable(checks, [
             { header: "", value: (c) => mark[c.status] },
-            { header: "CHECK", value: (c) => c.name },
-            { header: "DETAIL", value: (c) => c.detail },
+            { header: "CHECK", value: (c) => safeForTerminal(c.name, tty) },
+            { header: "DETAIL", value: (c) => safeForTerminal(c.detail, tty) },
         ]));
     }
     // Warnings are survivable — a missing scope or an unverified model does not

package/dist/commands/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/commands/models.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAUnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AA0BtB,wBAAsB,aAAa,CACjC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,QAAQ,CAAC,CA6BnB"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/commands/models.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAWnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AA0CtB,wBAAsB,aAAa,CACjC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,QAAQ,CAAC,CA6BnB"}

package/dist/commands/models.js

@@ -2,6 +2,7 @@ import { fetchAccessibleModels, fetchCatalog, intersectModels, } from "../api/mo
 import { ExitCode } from "../output/exit-codes.js";
 import { parseFormatFlags, renderJson, renderPlain, renderRecord, renderTable, } from "../output/format.js";
 import { formatUsd } from "../output/money.js";
+import { safeForTerminal } from "../output/terminal-safe.js";
 import { buildRuntime, reportError, requireApiKey, } from "./runtime.js";
 const USAGE = `Usage:
   mafdet models list [--surface <chat|embeddings|speech>] [--agent] [--json|--plain]
@@ -13,10 +14,21 @@ const SURFACES = {
     speech: "AUDIO_SPEECH",
     realtime: "REALTIME",
 };
-const columns = [
-    { header: "MODEL", value: (m) => m.modelId },
-    { header: "PROVIDER", value: (m) => m.provider ?? "-" },
-    { header: "SURFACE", value: (m) => m.apiSurface ?? "-" },
+/**
+ * U-3 · Terminal-safe only for the table. `--json` keeps the catalogue's
+ * bytes exactly as served, which is the project's stated rule for anything a
+ * script parses - and the identity fields are never rewritten anywhere.
+ */
+const columns = (isTty) => [
+    { header: "MODEL", value: (m) => safeForTerminal(m.modelId, isTty) },
+    {
+        header: "PROVIDER",
+        value: (m) => safeForTerminal(m.provider ?? "-", isTty),
+    },
+    {
+        header: "SURFACE",
+        value: (m) => safeForTerminal(m.apiSurface ?? "-", isTty),
+    },
     {
         header: "CONTEXT",
         value: (m) => String(m.contextLength ?? "-"),
@@ -24,6 +36,10 @@ const columns = [
     },
     { header: "AGENT", value: (m) => (m.agentEligible ? "yes" : "-") },
 ];
+/** Whether a terminal is on the other end of stdout. Injectable for tests. */
+function isTty(io) {
+    return io.isTty ?? process.stdout.isTTY === true;
+}
 export async function modelsCommand(argv, io) {
     const [subcommand, ...rest] = argv;
     if (subcommand !== "list" && subcommand !== "show") {
@@ -88,8 +104,10 @@ function listModels(sets, args, format, io) {
         return ExitCode.Ok;
     }
     io.stdout(format === "plain"
-        ? renderPlain(rows, columns)
-        : renderTable(rows, columns));
+        ? // `--plain` is for `cut` and `awk`, so it keeps the bytes; the table is
+            // for a person and gets cleaned.
+            renderPlain(rows, columns(false))
+        : renderTable(rows, columns(isTty(io))));
     if (format === "table" && sets.unlisted.length > 0) {
         io.stderr(`note: ${sets.unlisted.length} model(s) callable but missing from the catalogue: ${sets.unlisted.join(", ")}\n`);
     }
@@ -117,16 +135,19 @@ function showModel(sets, args, format, io) {
         return ExitCode.Usage;
     }
     if (format === "json") {
+        // U-3 · Exactly as the catalogue served it. A script parsing this needs
+        // the real values, and identity is never rewritten anywhere.
         io.stdout(renderJson(model));
         return ExitCode.Ok;
     }
+    const clean = (text) => safeForTerminal(text, isTty(io));
     io.stdout(renderRecord([
-        ["model", model.modelId],
-        ["name", model.displayName ?? "-"],
-        ["provider", model.provider ?? "-"],
-        ["surface", model.apiSurface ?? "-"],
+        ["model", clean(model.modelId)],
+        ["name", clean(model.displayName ?? "-")],
+        ["provider", clean(model.provider ?? "-")],
+        ["surface", clean(model.apiSurface ?? "-")],
         ["context", String(model.contextLength ?? "-")],
-        ["capabilities", (model.capabilities ?? []).join(", ") || "-"],
+        ["capabilities", clean((model.capabilities ?? []).join(", ")) || "-"],
         ["agent eligible", model.agentEligible ? "yes" : "no"],
         [
             "input / 1M",

package/dist/commands/runtime.d.ts

@@ -16,6 +16,12 @@ export interface CommandIo {
      * Defaults to `process.stdout.isTTY`; tests set it explicitly.
      */
     isTty?: boolean;
+    /**
+     * V-2 · Whether stderr is a terminal. Separate from `isTty` because
+     * `mafdet ... 2> log` redirects one and not the other, and the rule is about
+     * the destination rather than the command.
+     */
+    isErrTty?: boolean;
 }
 export interface Runtime {
     config: LoadedConfig;
@@ -31,5 +37,15 @@ export declare function requireApiKey(config: LoadedConfig): void;
  * Turn any failure into an exit code and a single stderr line. Nothing here
  * prints a raw upstream message: ApiError redacted it at construction.
  */
+/**
+ * V-2 · The one place errors reach a person.
+ *
+ * Every command funnels through here, so this is where untrusted text in an
+ * error message stops being able to drive the terminal. Patching the
+ * individual messages was tried and missed two of them; a message is
+ * assembled from remote data far more often than anyone remembers.
+ *
+ * Redirected stderr keeps the bytes, the same rule as everywhere else.
+ */
 export declare function reportError(error: unknown, io: CommandIo): ExitCode;
 //# sourceMappingURL=runtime.d.ts.map

package/dist/commands/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/commands/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,YAAY,CAAC;IACrB,sCAAsC;IACtC,SAAS,EAAE,UAAU,CAAC;IACtB,yCAAyC;IACzC,YAAY,EAAE,UAAU,CAAC;CAC1B;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAgBnD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CASxD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,GAAG,QAAQ,CAkBnE"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/commands/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,YAAY,CAAC;IACrB,sCAAsC;IACtC,SAAS,EAAE,UAAU,CAAC;IACtB,yCAAyC;IACzC,YAAY,EAAE,UAAU,CAAC;CAC1B;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAgBnD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CASxD;AAED;;;GAGG;AACH;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,GAAG,QAAQ,CAqBnE"}

package/dist/commands/runtime.js

@@ -3,6 +3,7 @@ import { loadConfig } from "../config/load.js";
 import { HttpClient } from "../api/http.js";
 import { ApiError } from "../api/errors.js";
 import { ExitCode } from "../output/exit-codes.js";
+import { safeForTerminal } from "../output/terminal-safe.js";
 export function userAgent(version) {
     // Identifiable, and carrying nothing about the user (plan §9.2).
     return `mafdet-cli/${version}`;
@@ -37,10 +38,21 @@ export function requireApiKey(config) {
  * Turn any failure into an exit code and a single stderr line. Nothing here
  * prints a raw upstream message: ApiError redacted it at construction.
  */
+/**
+ * V-2 · The one place errors reach a person.
+ *
+ * Every command funnels through here, so this is where untrusted text in an
+ * error message stops being able to drive the terminal. Patching the
+ * individual messages was tried and missed two of them; a message is
+ * assembled from remote data far more often than anyone remembers.
+ *
+ * Redirected stderr keeps the bytes, the same rule as everywhere else.
+ */
 export function reportError(error, io) {
+    const safe = (text) => safeForTerminal(text, io.isErrTty ?? process.stderr.isTTY === true);
     if (error instanceof ApiError) {
         const id = error.requestId ? ` (request ${error.requestId})` : "";
-        io.stderr(`mafdet: ${error.message}${id}\n`);
+        io.stderr(`mafdet: ${safe(error.message)}${id}\n`);
         if (error.kind === "rate_limited" &&
             error.retryAfterSeconds !== undefined) {
             io.stderr(`mafdet: retry after ${error.retryAfterSeconds}s\n`);
@@ -48,9 +60,9 @@ export function reportError(error, io) {
         return error.exitCode;
     }
     if (error instanceof ConfigError) {
-        io.stderr(`mafdet: ${error.message}\n`);
+        io.stderr(`mafdet: ${safe(error.message)}\n`);
         return ExitCode.Usage;
     }
-    io.stderr(`mafdet: ${error.message}\n`);
+    io.stderr(`mafdet: ${safe(error.message)}\n`);
     return ExitCode.General;
 }

package/dist/commands/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/commands/sessions.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AA4BnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAgBtB,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAoRD,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAUX,CAAC"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/commands/sessions.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AA4BnD,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAetB,wBAAsB,eAAe,CACnC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,SAAS,GACZ,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAoRD,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAUX,CAAC"}

package/dist/sessions/open.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open.d.ts","sourceRoot":"","sources":["../../src/sessions/open.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,oBAAoB,EAGpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAKrB,OAAO,EAAE,aAAa,EAAe,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;CAC/D,CAAC;AAEN,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,UAAU,CAqFnE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GAC9C,MAAM,CAyBR"}
+{"version":3,"file":"open.d.ts","sourceRoot":"","sources":["../../src/sessions/open.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,oBAAoB,EAGpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAKrB,OAAO,EAAE,aAAa,EAAe,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;CAC/D,CAAC;AAEN,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,UAAU,CAqFnE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GAC9C,MAAM,CAyBR"}

package/dist/tui/adapters/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../src/tui/adapters/models.ts"],"names":[],"mappings":"AAiBA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAKzE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoB1B;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAkB1D;AASD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,KAAK,EAAE,MAAM,GACZ,SAAS,aAAa,EAAE,CAgB1B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,UAAU,CA8Cb"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../src/tui/adapters/models.ts"],"names":[],"mappings":"AAiBA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAKzE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoB1B;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoB1D;AASD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,KAAK,EAAE,MAAM,GACZ,SAAS,aAAa,EAAE,CAgB1B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,GAAG,UAAU,CA8Cb"}

package/dist/tui/adapters/models.js

@@ -8,6 +8,7 @@
 import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, join } from "node:path";
 import { fetchAccessibleModels, fetchCatalog, intersectModels, } from "../../api/models.js";
+import { stripAnsi } from "../../agent/command-policy.js";
 import { buildRuntime } from "../../commands/runtime.js";
 import { parseUserConfig } from "../../config/config.js";
 import { userConfigPath } from "../../config/paths.js";
@@ -38,6 +39,8 @@ export async function loadCatalogue(options) {
 }
 /** One line of facts under a model's name. Only what the catalogue states. */
 export function describeModel(model) {
+    // U-3 · One line drawn on a terminal from remote text. Cleaned here rather
+    // than at ingestion, which would change values the CLI matches and sends.
     const parts = [];
     if (model.provider !== undefined)
         parts.push(model.provider);
@@ -54,7 +57,7 @@ export function describeModel(model) {
             ? `DEPRECATED - use ${model.replacement_model_id}`
             : "DEPRECATED");
     }
-    return parts.join(" - ");
+    return stripAnsi(parts.join(" - "));
 }
 function priceSummary(model) {
     const input = model.inputPricePer1mMicroUsd;

package/dist/tui/agent-surface.js

@@ -53,7 +53,7 @@ export async function promptLine(io, prompt) {
 }
 export async function runAgentSurface(options) {
     const { io, capabilities } = options;
-    const { dim, bold } = palette(capabilities);
+    const { dim } = palette(capabilities);
     const cards = new ToolCardLog();
     const run = options.run ?? runSession;
     const onEvent = (event) => {

package/dist/tui/picker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"picker.d.ts","sourceRoot":"","sources":["../../src/tui/picker.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAW7C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAiHrB;AA6BD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,oBAAoB,GACjC,MAAM,CAaR;AAED,iEAAiE;AACjE,YAAY,EAAE,GAAG,EAAE,CAAC"}
+{"version":3,"file":"picker.d.ts","sourceRoot":"","sources":["../../src/tui/picker.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAW7C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,SAAS,CAC7B,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,UAAU,CAAC,CAsHrB;AA6BD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,oBAAoB,GACjC,MAAM,CAaR;AAED,iEAAiE;AACjE,YAAY,EAAE,GAAG,EAAE,CAAC"}

package/dist/tui/picker.js

@@ -5,6 +5,7 @@
 // difference between "you cannot use this" and "the agent cannot drive this"
 // stays visible instead of looking like a missing model.
 import { describeModel, filterModels } from "./adapters/models.js";
+import { stripAnsi } from "../agent/command-policy.js";
 import { palette } from "./theme.js";
 const ESC = String.fromCharCode(27);
 const CSI = `${ESC}[`;
@@ -40,8 +41,11 @@ export async function pickModel(io, options) {
         else {
             for (const { model, i } of windowOf(matches, index)) {
                 const selected = i === index;
+                // U-3 · Sanitised here, at the terminal, and not at ingestion: the
+                // catalogue's values are identity and are matched, sent and reported
+                // verbatim. Only what is drawn gets cleaned.
                 const name = model.displayName ?? model.modelId;
-                const head = `${model.modelId}${name !== model.modelId ? ` (${name})` : ""}`;
+                const head = stripAnsi(`${model.modelId}${name !== model.modelId ? ` (${name})` : ""}`);
                 lines.push(selected ? accent(`  > ${head}`) : `    ${head}`);
                 lines.push(dim(`      ${describeModel(model)}`));
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mafdet/cli",
-  "version": "0.4.7",
+  "version": "0.4.9",
   "description": "Mafdet AI command line — model calls, account queries, and a permissioned local agent.",
   "type": "module",
   "license": "MIT",