@mmerterden/multi-agent-pipeline 20.29.0 → 20.30.0

package/pipeline/scripts/cost-analyze.mjs

@@ -50,7 +50,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSy
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { costUsd } from "./_cost.mjs";
+import { modelRateLookup, priceUsage as priceRecord } from "./_cost.mjs";
 import { readJsonl } from "./_jsonl.mjs";
 import { runMain } from "../lib/fatal.mjs";
 import { messages, outputLanguage } from "../lib/user-facing.mjs";
@@ -167,58 +167,7 @@ const asNumber = (v, fallback) => {
 
 const TABLE = JSON.parse(readFileSync(join(HERE, "cost-table.json"), "utf-8"));
 
-/**
- * Wire ID -> rate. Transcripts carry the wire value ("claude-opus-5-5"); the
- * price table is keyed by rung, so each rung's `modelId` and `copilotModelId`
- * map to its rate, `legacy` adds previous-generation IDs at their own rates,
- * and `models` overrides the rung rate for a dispatched ID whose model is not
- * the rung's (Copilot CLI's older models bill at their own rate). Matching on
- * the ID rather than the rung name keeps a generation move a data edit, which
- * is the contract cost-table.json states for itself.
- */
-const RATE_BY_MODEL_ID = new Map([
-  ...Object.entries(TABLE.legacy || {}),
-  ...Object.values(TABLE.prices || {}).flatMap((p) =>
-    [p.modelId, p.copilotModelId].filter(Boolean).map((id) => [id, p]),
-  ),
-  ...Object.entries(TABLE.models || {}),
-]);
-const IDS_LONGEST_FIRST = [...RATE_BY_MODEL_ID.keys()].sort((a, b) => b.length - a.length);
-
-function rateFor(modelId) {
-  if (!modelId) return null;
-  const exact = RATE_BY_MODEL_ID.get(modelId);
-  if (exact) return exact;
-  // A dated snapshot id (a known id, a hyphen, a release date) prices as that
-  // id; the longest known id wins, so a current id is never read as a shorter
-  // legacy one. Written as a shape rather than as a literal, because
-  // smoke-model-fallback.sh reads every model id in this tree and requires it
-  // to exist in cost-table.json. An id nobody knows prices as nothing and is
-  // COUNTED as unpriced rather than folded in at zero.
-  const id = IDS_LONGEST_FIRST.find(
-    (known) => modelId.startsWith(`${known}-`) || modelId.startsWith(`${known}[`),
-  );
-  return id ? RATE_BY_MODEL_ID.get(id) : null;
-}
-
-/**
- * Cache WRITES are not a discount, they are a surcharge: Anthropic prices a
- * 1h cache write above fresh input. cost-table.json carries cacheReadPerMtok
- * only, so the write rate is derived here at the published 1.25x of input and
- * labelled as derived - an unpriced component silently dropped would make
- * every long-context session look cheap, which is the direction that hurts.
- */
-const CACHE_WRITE_MULTIPLIER = 1.25;
-
-function priceRecord(rate, u) {
-  const fresh = Number(u.input_tokens || 0);
-  const out = Number(u.output_tokens || 0);
-  const cacheRead = Number(u.cache_read_input_tokens || 0);
-  const cacheWrite = Number(u.cache_creation_input_tokens || 0);
-  const base = costUsd(rate, fresh, out, cacheRead);
-  if (base === null) return null;
-  return base + (cacheWrite / 1_000_000) * (rate.inPerMtok || 0) * CACHE_WRITE_MULTIPLIER;
-}
+const rateFor = modelRateLookup(TABLE);
 
 // --- the series --------------------------------------------------------------
 

package/pipeline/scripts/cost-table.json

@@ -1,6 +1,7 @@
 {
   "_readme": "Per-model unit prices in USD per million tokens. Source: Anthropic public pricing (Claude-family rows verified 2026-10-14 against the current model table; the gpt-* rows remain approximate). Update when Anthropic publishes new tiers. Rung names (fable / opus / sonnet / haiku) are the pipeline's stable identifiers and `modelId` is the wire value they currently resolve to - dispatch reads the rung, so a generation move is a `modelId` edit here plus the phase specs, never a rename of the rungs. `copilotModelId`, where present, is the name Copilot CLI dispatches for the rung: one of the dotted IDs `copilot help config` lists (Copilot rejects any other as not available), the newest of the rung's family there. A rung without one (fable) is not offered on Copilot CLI, where its personas take the opus rung. smoke-model-fallback.sh checks the IDs against `copilot help config` when the CLI is installed. `provider` says which layer a rung belongs to: an `anthropic` rung is reachable from every call site; `free-chain` (the `free` rung) only from bulk-read and delegate, where the multi-agent-toolkit's verified free-model chain answers and the caller's default takes over when it escalates; any other provider from no call site. model-dispatch.sh enforces this. Unknown models render USD as ' - ' and emit a footnote  -  never block PR-body generation. cacheReadPerMtok is the discounted rate for prompt-cache hits, published per model and well below inPerMtok; the renderer prices a phase's tokens_cached at this rate when the tracker records it, so resume/cache reuse is visible in the ledger.",
   "schemaVersion": "1.1.0",
+  "verifiedAt": "2026-10-14",
   "_legacyReadme": "`legacy` prices previous-generation wire IDs a transcript may still name, keyed by the exact ID (a dated snapshot of one prices as it). Dispatch never reads it; cost-analyze consults it after the current `modelId` values and the `models` map. Official Anthropic prices per million tokens.",
   "legacy": {
     "claude-fable-5": { "inPerMtok": 10.0, "outPerMtok": 50.0, "cacheReadPerMtok": 1.0 },

package/pipeline/scripts/office-build.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+/**
+ * office-build.mjs - assemble the office panel page from pipeline/office-src.
+ *
+ * The server's CSP allows one nonce'd inline script, one nonce'd inline style
+ * and data: images, so the page has to be a single file. The sources stay
+ * readable as separate files (shell.html, style.css, world.js, app.js,
+ * strings.json) and this script inlines them into
+ * pipeline/office/index.html: the list of sprite names in pipeline/office/assets
+ * (served by contract-server.mjs at /office/assets/), the strings as a JSON
+ * literal, the two code files in order inside one IIFE.
+ *
+ *   node pipeline/scripts/office-build.mjs          write the page
+ *   node pipeline/scripts/office-build.mjs --check  exit 1 when the page on
+ *                                                   disk is not what the
+ *                                                   sources build to
+ */
+
+import { readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const ROOT = join(import.meta.dirname, "..");
+const SRC = join(ROOT, "office-src");
+const OUT = join(ROOT, "office", "index.html");
+const ASSETS = join(ROOT, "office", "assets");
+const PNG_SIGNATURE = "89504e470d0a1a0a";
+
+// The sprite names the page may load from /office/assets/: every PNG beside
+// the page, checked to be one.
+function atlas() {
+  const out = [];
+  for (const name of readdirSync(ASSETS).sort()) {
+    if (!name.endsWith(".png")) continue;
+    const buf = readFileSync(join(ASSETS, name));
+    if (buf.subarray(0, 8).toString("hex") !== PNG_SIGNATURE) {
+      throw new Error(`${name} is not a PNG file`);
+    }
+    out.push(basename(name, ".png"));
+  }
+  return out;
+}
+
+export function build() {
+  const read = (f) => readFileSync(join(SRC, f), "utf8");
+  const strings = JSON.parse(read("strings.json"));
+  const sprites = atlas();
+  const script = [
+    '"use strict";',
+    "(() => {",
+    `const ATLAS = ${JSON.stringify(sprites)};`,
+    `const STRINGS = ${JSON.stringify(strings)};`,
+    'const spriteUrl = (name) => "/office/assets/" + name + ".png";',
+    read("world.js").trim(),
+    read("app.js").trim(),
+    "})();",
+  ].join("\n");
+  const style = read("style.css").trim();
+  // Text that would close the inline element early, or open an HTML comment
+  // inside it, turns source into markup.
+  if (/<\/script|<!--/i.test(script)) throw new Error("the script contains </script or <!--");
+  if (/<\/style/i.test(style)) throw new Error("style.css contains </style");
+  const shell = read("shell.html");
+  for (const marker of ["/*STYLE*/", "/*SCRIPT*/"]) {
+    if (shell.split(marker).length !== 2) throw new Error(`shell.html needs exactly one ${marker}`);
+  }
+  return shell.replace("/*STYLE*/", () => style).replace("/*SCRIPT*/", () => script);
+}
+
+const isMain = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isMain) {
+  const html = build();
+  if (process.argv.includes("--check")) {
+    let current = "";
+    try {
+      current = readFileSync(OUT, "utf8");
+    } catch {
+      // A missing page is stale by definition.
+    }
+    if (current !== html) {
+      console.error("office/index.html is stale: run node pipeline/scripts/office-build.mjs");
+      process.exit(1);
+    }
+    console.log("office/index.html matches its sources");
+  } else {
+    writeFileSync(OUT, html);
+    console.log(`wrote ${OUT} (${Buffer.byteLength(html)} bytes)`);
+  }
+}

package/pipeline/scripts/office-control.mjs

@@ -0,0 +1,383 @@
+#!/usr/bin/env node
+/**
+ * @file office-control.mjs  -  start, stop and report the office panel: the
+ * one script behind /multi-agent:office-on, office-off and office-status, so
+ * the three commands cannot disagree about what is running.
+ *
+ *   on [--no-open]   start contract-server.mjs in the background with the
+ *                    installed panel page (../office/index.html, passed as
+ *                    MA_OFFICE_PAGE) and an 8 hour lifetime, or reuse the one this script
+ *                    started if it is still alive, then open the browser at
+ *                    /office with a one-time code in the URL fragment,
+ *                    through a 0600 launcher file so the code is never on a
+ *                    command line. The
+ *                    page trades the code for the token on its first load;
+ *                    the code is valid for 10 seconds and one use. The token
+ *                    is never printed and never put in a URL.
+ *   off              stop the server this script started and forget it. The
+ *                    SIGTERM goes only to a pid whose token file still names
+ *                    it, whose command is contract-server.mjs and whose start
+ *                    time matches the token file's, so a reused pid is never
+ *                    signalled. Nothing is left running: no relay, no session,
+ *                    no watcher exists to stop.
+ *   status           running or not, the URL without the token, the idle
+ *                    limit, remote access, the paired devices the phone
+ *                    registry lists, and the last panel actions from
+ *                    office-actions.jsonl. Remote access is "not available in
+ *                    this installation" unless a remote layer is present: a
+ *                    prefs.global.office.remote block, or a separately
+ *                    installed module at ~/.claude/office-remote/. This
+ *                    script only reports it; it carries no remote code.
+ *
+ * State: one 0600 file, ~/.claude/logs/multi-agent/office/office.json, with
+ * the pid, port and token file of the server this script started. Nothing runs
+ * while the panel is closed: the server exits by itself after its idle time.
+ *
+ * Usage:
+ *   office-control.mjs on [--no-open] [--json]
+ *   office-control.mjs off [--json]
+ *   office-control.mjs status [--json]
+ *
+ * Exit: 0 done, 1 could not start, 2 usage.
+ */
+
+import { spawn, spawnSync } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const IDLE_MINUTES = 15;
+const MAX_HOURS = 8;
+/** How far a process's start may sit before its token file's startedAt. */
+const START_SKEW_MS = 120 * 1000;
+
+const home = (env) => env.HOME || homedir();
+const stateDir = (env) => join(home(env), ".claude", "logs", "multi-agent", "office");
+const stateFile = (env) => join(stateDir(env), "office.json");
+const actionsLog = (env) =>
+  join(home(env), ".claude", "logs", "multi-agent", "office-actions.jsonl");
+
+const readJson = (p) => {
+  try {
+    return JSON.parse(readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+};
+
+/** The panel page: next to this scripts directory, in a checkout and in the install. */
+export const pagePath = () => join(HERE, "..", "office", "index.html");
+
+/** Whether a remote layer is present; none ships with the pipeline. */
+export function remoteLayer(env = process.env) {
+  const prefs = readJson(join(home(env), ".claude", "multi-agent-preferences.json"));
+  const block = prefs?.global?.office?.remote;
+  if (block && typeof block === "object" && !Array.isArray(block)) return true;
+  return existsSync(join(home(env), ".claude", "office-remote"));
+}
+
+const remoteText = (env) =>
+  remoteLayer(env) ? "provided by a separate remote layer" : "not available in this installation";
+
+/** The contract server: beside this script, else the install. */
+export function serverScript(env = process.env) {
+  return (
+    [
+      env.MA_CONTRACT_SERVER,
+      join(HERE, "contract-server.mjs"),
+      join(home(env), ".claude", "scripts", "contract-server.mjs"),
+    ]
+      .filter(Boolean)
+      .find((p) => existsSync(p)) ?? null
+  );
+}
+
+const alive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+};
+
+function psField(pid, field) {
+  const r = spawnSync("ps", ["-o", `${field}=`, "-p", String(pid)], {
+    encoding: "utf8",
+    timeout: 5000,
+  });
+  return r.status === 0 ? r.stdout.trim() : "";
+}
+
+/**
+ * Whether `pid` is still the server a state record names: its token file
+ * names the same pid, the process runs contract-server.mjs, and it started
+ * no later than the token file and at most START_SKEW_MS before it.
+ */
+export function isOurServer(s, tokenDoc) {
+  if (!s || !Number.isInteger(s.pid) || !alive(s.pid)) return false;
+  if (!tokenDoc || tokenDoc.pid !== s.pid || typeof tokenDoc.startedAt !== "string") return false;
+  if (!psField(s.pid, "command").includes("contract-server.mjs")) return false;
+  const began = Date.parse(psField(s.pid, "lstart"));
+  const wrote = Date.parse(tokenDoc.startedAt);
+  if (!Number.isFinite(began) || !Number.isFinite(wrote)) return false;
+  return began <= wrote + 1000 && wrote - began <= START_SKEW_MS;
+}
+
+/** The server this script started, if it is still running. */
+export function current(env = process.env) {
+  const s = readJson(stateFile(env));
+  const doc = s ? readJson(s.tokenFile ?? "") : null;
+  if (!isOurServer(s, doc) || !doc.token) return null;
+  return { ...s, token: doc.token };
+}
+
+/** A one-time panel code from the running server (bearer, no Origin). */
+async function panelCode(s) {
+  const r = await fetch(`${s.url}/office/code`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${s.token}` },
+  });
+  if (!r.ok) throw new Error(`the server refused a panel code (${r.status})`);
+  const { code } = await r.json();
+  if (typeof code !== "string") throw new Error("the server returned no panel code");
+  return code;
+}
+
+function writeState(env, record) {
+  mkdirSync(stateDir(env), { recursive: true, mode: 0o700 });
+  chmodSync(stateDir(env), 0o700);
+  writeFileSync(stateFile(env), JSON.stringify(record, null, 2) + "\n", { mode: 0o600 });
+}
+
+async function waitForReady(file, ms) {
+  const until = Date.now() + ms;
+  while (Date.now() < until) {
+    const text = existsSync(file) ? readFileSync(file, "utf8") : "";
+    const nl = text.indexOf("\n");
+    if (nl !== -1) return JSON.parse(text.slice(0, nl));
+    await new Promise((r) => globalThis.setTimeout(r, 100));
+  }
+  return null;
+}
+
+/** How long a launcher file lives: the panel code's own lifetime, plus slack. */
+const LAUNCHER_TTL_MS = 15 * 1000;
+const launcherTtl = (env) => {
+  const n = Number(env.MA_OFFICE_LAUNCHER_TTL_MS);
+  return Number.isInteger(n) && n > 0 && n < LAUNCHER_TTL_MS ? n : LAUNCHER_TTL_MS;
+};
+
+/**
+ * A 0600 page in the 0700 state directory that forwards to the panel with the
+ * code in the fragment. The code lives only in this file and the browser: an
+ * opener's argv is readable by every local user (`ps`), a file in a 0700
+ * directory is not. Its CSP allows nothing but its own inline script, by hash.
+ */
+export function writeLauncher(env, target) {
+  const dir = stateDir(env);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  chmodSync(dir, 0o700);
+  const script = `location.replace(${JSON.stringify(target)})`;
+  const hash = createHash("sha256").update(script).digest("base64");
+  const html =
+    `<!doctype html><meta charset="utf-8">` +
+    `<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'sha256-${hash}'; base-uri 'none'; form-action 'none'">` +
+    `<meta name="referrer" content="no-referrer"><title>Opening the panel</title>` +
+    `<script>${script}</script>`;
+  const file = join(dir, `launch-${randomBytes(12).toString("hex")}.html`);
+  writeFileSync(file, html, { mode: 0o600, flag: "wx" });
+  chmodSync(file, 0o600);
+  return file;
+}
+
+/** Launcher files left by an earlier start, past their lifetime, are removed. */
+function sweepLaunchers(env) {
+  let names;
+  try {
+    names = readdirSync(stateDir(env));
+  } catch {
+    return;
+  }
+  for (const n of names) {
+    if (!/^launch-[0-9a-f]{24}\.html$/.test(n)) continue;
+    const p = join(stateDir(env), n);
+    try {
+      if (Date.now() - statSync(p).mtimeMs > launcherTtl(env)) rmSync(p, { force: true });
+    } catch {
+      // Already gone.
+    }
+  }
+}
+
+/** Removes the launcher after its lifetime, from a detached process whose argv names only the path. */
+function scheduleRemoval(file, env) {
+  const child = spawn(
+    process.execPath,
+    [
+      "-e",
+      "setTimeout(() => { try { require('fs').rmSync(process.argv[1], { force: true }); } catch {} }, Number(process.argv[2]))",
+      file,
+      String(launcherTtl(env)),
+    ],
+    { detached: true, stdio: "ignore" },
+  );
+  child.unref();
+}
+
+function openBrowser(target, env) {
+  if (env.MA_OFFICE_NO_BROWSER === "1") return false;
+  sweepLaunchers(env);
+  const file = writeLauncher(env, target);
+  scheduleRemoval(file, env);
+  const bin = env.MA_OFFICE_OPENER || (process.platform === "darwin" ? "open" : "xdg-open");
+  const r = spawnSync(bin, [`file://${file}`], { stdio: "ignore", timeout: 15000 });
+  return r.status === 0;
+}
+
+/** Start (or reuse) the panel server and open the browser. */
+export async function officeOn({ env = process.env, open = true } = {}) {
+  let s = current(env);
+  let reused = true;
+  if (!s) {
+    reused = false;
+    const server = serverScript(env);
+    if (!server) throw new Error("contract-server.mjs was not found; install the pipeline first");
+    mkdirSync(stateDir(env), { recursive: true, mode: 0o700 });
+    const ready = join(stateDir(env), "ready.json");
+    rmSync(ready, { force: true });
+    const out = openSync(ready, "w", 0o600);
+    const child = spawn(
+      process.execPath,
+      [
+        server,
+        "--port",
+        "0",
+        "--idle-minutes",
+        String(IDLE_MINUTES),
+        "--max-hours",
+        String(MAX_HOURS),
+      ],
+      {
+        env: { ...env, MA_OFFICE_PAGE: env.MA_OFFICE_PAGE || pagePath() },
+        detached: true,
+        stdio: ["ignore", out, "ignore"],
+      },
+    );
+    child.unref();
+    const info = await waitForReady(ready, 15000);
+    rmSync(ready, { force: true });
+    if (!info) throw new Error("the server did not report ready");
+    writeState(env, {
+      pid: info.pid,
+      port: info.port,
+      url: info.url,
+      tokenFile: info.tokenFile,
+      idleMinutes: info.idleMinutes,
+      maxHours: info.maxHours ?? null,
+      startedAt: new Date().toISOString(),
+    });
+    s = current(env);
+    if (!s) throw new Error("the server stopped right after it started");
+  }
+  const page = `${s.url}/office`;
+  const opened = open ? openBrowser(`${page}#code=${await panelCode(s)}`, env) : false;
+  return { running: true, reused, url: page, pid: s.pid, idleMinutes: s.idleMinutes, opened };
+}
+
+/** Stop the server this script started. */
+export function officeOff({ env = process.env } = {}) {
+  const s = readJson(stateFile(env));
+  let stopped = false;
+  if (isOurServer(s, s ? readJson(s.tokenFile ?? "") : null)) {
+    try {
+      process.kill(s.pid, "SIGTERM");
+      stopped = true;
+    } catch {
+      stopped = false;
+    }
+  }
+  rmSync(stateFile(env), { force: true });
+  return { running: false, stopped, remote: remoteText(env) };
+}
+
+function devices(env) {
+  const reg = readJson(join(home(env), ".claude", "logs", "multi-agent", "phone", "devices.json"));
+  return Array.isArray(reg?.devices)
+    ? reg.devices.filter((d) => d && !d.revokedAt).map((d) => ({ name: String(d.name ?? d.id) }))
+    : [];
+}
+
+/** What is running, and what the panel did recently. */
+export function officeStatus({ env = process.env, last = 10 } = {}) {
+  const s = current(env);
+  let actions;
+  try {
+    actions = readFileSync(actionsLog(env), "utf8")
+      .trim()
+      .split("\n")
+      .filter(Boolean)
+      .slice(-last)
+      .map((l) => {
+        const a = JSON.parse(l);
+        return { at: a.at, via: a.via, route: a.route, step: a.step, status: a.status };
+      });
+  } catch {
+    actions = [];
+  }
+  return {
+    running: Boolean(s),
+    url: s ? `${s.url}/office` : null,
+    pid: s?.pid ?? null,
+    idleMinutes: s?.idleMinutes ?? null,
+    remote: remoteText(env),
+    pairedDevices: devices(env),
+    recentActions: actions,
+  };
+}
+
+async function main(argv) {
+  const [cmd, ...rest] = argv;
+  const json = rest.includes("--json");
+  const flags = rest.filter((a) => a !== "--json");
+  let out;
+  try {
+    if (cmd === "on" && flags.every((f) => f === "--no-open")) {
+      out = await officeOn({ open: !flags.includes("--no-open") });
+    } else if (cmd === "off" && !flags.length) out = officeOff();
+    else if (cmd === "status" && !flags.length) out = officeStatus();
+    else {
+      process.stderr.write("usage: office-control.mjs on [--no-open] | off | status [--json]\n");
+      return 2;
+    }
+  } catch (err) {
+    process.stderr.write(`office-control: ${err.message}\n`);
+    return 1;
+  }
+  if (json) process.stdout.write(JSON.stringify(out, null, 2) + "\n");
+  else {
+    for (const [k, v] of Object.entries(out)) {
+      process.stdout.write(`${k}: ${typeof v === "object" ? JSON.stringify(v) : v}\n`);
+    }
+  }
+  return 0;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  main(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+  });
+}