@oxagen/cli 2.1.4-489 → 2.1.4-495

package/oxagen.mjs

@@ -4839,6 +4839,16 @@ var init_envelope = __esm({
       ]).optional(),
       tool_denial_kind: short.optional(),
       tool_result_tokens: u32.optional(),
+      /**
+       * How `tool_result_tokens` is known (#5339). `reported` is Claude Code's own
+       * count on its OTel tool span. `estimated` is the recorder's: the result's
+       * UTF-8 bytes over four, from the hook that saw the result. A count with no
+       * basis was written before the member existed, and only the OTel span wrote
+       * a count then, so a reader takes it as `reported`. The recorder writes the
+       * two together. The envelope does not require the pair, so a frame from a
+       * host older than the member still parses.
+       */
+      tool_result_tokens_basis: external_exports.enum(TOKEN_SOURCE_BASES).optional(),
       batch_size: u8.optional(),
       batch_index: u8.optional(),
       attribution_skill: short.optional(),
@@ -5615,7 +5625,7 @@ function bundleSkillChars(skill) {
   for (const file of skill.files) chars += file.path.length + file.content.length;
   return chars;
 }
-var TACHO_BATCH_SCHEMA, TACHO_BUNDLE_SCHEMA, TACHO_COMMANDS_SCHEMA, TACHO_ENROLLMENT_CLAIMS_SCHEMA, TACHO_ENFORCEMENT_TIER_ATTR, TACHO_GATEWAY_TIER, TACHO_GATEWAY_SESSION_HEADER, TACHO_GATEWAY_GENESIS_HEADER, TACHO_METERING_ATTR, TACHO_METERING_OBSERVED, TACHO_MODEL_SESSION_HEADER, TACHO_CREDENTIAL_BASIS_ATTR, TACHO_CREDENTIAL_GATEWAY_BROKERED, TACHO_CREDENTIAL_HARNESS_HELD, TACHO_CREDENTIAL_BASES, TACHO_RUN_TOKEN_ATTR, BUNDLE_FEATURE_GATEWAY_TOOLS, BUNDLE_FEATURE_MODEL_PRICES, BUNDLE_FEATURE_MODEL_ALLOWLIST, BUNDLE_FEATURE_INDEPENDENT_MODELS, BUNDLE_FEATURE_HOOK_FAIL_OPEN, BUNDLE_FEATURE_STEERING_MANIFEST, BUNDLE_FEATURE_CONTAINMENT, BUNDLE_FEATURE_DAILY_BUDGET, BUNDLE_FEATURE_STEER_NEXT_STEP, BUNDLE_FEATURE_UNBOUND_REPO, BUNDLE_FEATURE_CEDAR, BUNDLE_FEATURE_SKILLS, BUNDLE_FEATURE_CACHE_KEEP_ALIVE, BUNDLE_FEATURE_WORK_ORDERS, TACHO_BUNDLE_FEATURES, bundleFeaturesSchema, hostEnrollmentIdSchema, tachoPlatformSchema, tachoHarnessSchema, TACHO_HARNESS_LABELS, TACHO_HARNESS_TIERS, WRAPPED_HARNESSES, CONNECTED_HARNESSES, HARNESS_BINARY, MODEL_HARNESS_ROUTES, MODEL_ROUTED_HARNESSES, BROKERABLE_HARNESSES, BROKERABLE_HARNESS_PROVIDER, TACHO_TIER_SUMMARY, CUSTOM_AGENT_NAME_PATTERN, RESERVED_AGENT_NAMES, customAgentNameSchema, tachoHostStatusSchema, tachoBundleModeSchema, tachoCommandSchema, tachoCommandStatusSchema, tachoCommandAckStatusSchema, tachoDeliveryModeSchema, denyGenerationSchema, deliveredCommandSchema, deliveredCommandResponseSchema, WORK_ORDER_ID_PATTERN, WORK_ITEM_ID_PATTERN, workOrderCommandPayloadSchema, WORK_ORDER_CLAIM_PATH, WORK_ORDER_REJECT_PATH, workOrderClaimResponseSchema, workOrderRejectResponseSchema, WORK_ORDER_ENV, WORK_ORDER_ATTR, steeringForceSchema, steeringItemKindSchema, steeringCutReasonSchema, steeringManifestItemSchema, STEERING_MANIFEST_SCHEMA, steeringManifestSchema, steeringManifestFrameSchema, cedarIdSchema, cedarPrincipalSchema, cedarToolSchema, cedarBundleSchema, BUNDLE_SKILLS_MAX, BUNDLE_SKILL_FILES_MAX, BUNDLE_SKILLS_CHARS_MAX, BASE64_PATTERN, bundleSkillFileSchema, bundleSkillSchema, policyBundleSchema, enrollmentClaimsSchema, tachoEventWireSchema, daemonHealthSchema, TACHO_MAX_BATCH, TACHO_MAX_BODY_BYTES, TACHO_MAX_REQUEST_BYTES, TACHO_REQUEST_ENVELOPE_BYTES, tachoBodySchema, tachoBatchSchema, agentDaySpendSchema, controlEnvelopeSchema, ingestResponseSchema, bundleResponseSchema, commandAcknowledgementSchema, commandsResponseSchema, enrollmentResponseSchema, tokenEnrollmentResponseSchema;
+var TACHO_BATCH_SCHEMA, TACHO_BUNDLE_SCHEMA, TACHO_COMMANDS_SCHEMA, TACHO_ENROLLMENT_CLAIMS_SCHEMA, TACHO_ENFORCEMENT_TIER_ATTR, TACHO_GATEWAY_TIER, TACHO_GATEWAY_SESSION_HEADER, TACHO_GATEWAY_GENESIS_HEADER, MCP_STREAMABLE_HTTP_ACCEPT, TACHO_METERING_ATTR, TACHO_METERING_OBSERVED, TACHO_MODEL_SESSION_HEADER, TACHO_CREDENTIAL_BASIS_ATTR, TACHO_CREDENTIAL_GATEWAY_BROKERED, TACHO_CREDENTIAL_HARNESS_HELD, TACHO_CREDENTIAL_BASES, TACHO_RUN_TOKEN_ATTR, BUNDLE_FEATURE_GATEWAY_TOOLS, BUNDLE_FEATURE_MODEL_PRICES, BUNDLE_FEATURE_MODEL_ALLOWLIST, BUNDLE_FEATURE_INDEPENDENT_MODELS, BUNDLE_FEATURE_HOOK_FAIL_OPEN, BUNDLE_FEATURE_STEERING_MANIFEST, BUNDLE_FEATURE_CONTAINMENT, BUNDLE_FEATURE_DAILY_BUDGET, BUNDLE_FEATURE_STEER_NEXT_STEP, BUNDLE_FEATURE_UNBOUND_REPO, BUNDLE_FEATURE_CEDAR, BUNDLE_FEATURE_SKILLS, BUNDLE_FEATURE_CACHE_KEEP_ALIVE, BUNDLE_FEATURE_WORK_ORDERS, TACHO_BUNDLE_FEATURES, bundleFeaturesSchema, hostEnrollmentIdSchema, tachoPlatformSchema, tachoHarnessSchema, TACHO_HARNESS_LABELS, TACHO_HARNESS_TIERS, WRAPPED_HARNESSES, CONNECTED_HARNESSES, HARNESS_BINARY, MODEL_HARNESS_ROUTES, MODEL_ROUTED_HARNESSES, BROKERABLE_HARNESSES, BROKERABLE_HARNESS_PROVIDER, TACHO_TIER_SUMMARY, CUSTOM_AGENT_NAME_PATTERN, RESERVED_AGENT_NAMES, customAgentNameSchema, tachoHostStatusSchema, tachoBundleModeSchema, tachoCommandSchema, tachoCommandStatusSchema, tachoCommandAckStatusSchema, tachoDeliveryModeSchema, denyGenerationSchema, deliveredCommandSchema, deliveredCommandResponseSchema, WORK_ORDER_ID_PATTERN, WORK_ITEM_ID_PATTERN, workOrderCommandPayloadSchema, WORK_ORDER_CLAIM_PATH, WORK_ORDER_REJECT_PATH, workOrderClaimResponseSchema, workOrderRejectResponseSchema, WORK_ORDER_ENV, WORK_ORDER_ATTR, steeringForceSchema, steeringItemKindSchema, steeringCutReasonSchema, steeringManifestItemSchema, STEERING_MANIFEST_SCHEMA, steeringManifestSchema, steeringManifestFrameSchema, cedarIdSchema, cedarPrincipalSchema, cedarToolSchema, cedarBundleSchema, BUNDLE_SKILLS_MAX, BUNDLE_SKILL_FILES_MAX, BUNDLE_SKILLS_CHARS_MAX, BASE64_PATTERN, bundleSkillFileSchema, bundleSkillSchema, policyBundleSchema, enrollmentClaimsSchema, tachoEventWireSchema, daemonHealthSchema, TACHO_MAX_BATCH, TACHO_MAX_BODY_BYTES, TACHO_MAX_REQUEST_BYTES, TACHO_REQUEST_ENVELOPE_BYTES, tachoBodySchema, tachoBatchSchema, agentDaySpendSchema, controlEnvelopeSchema, ingestResponseSchema, bundleResponseSchema, commandAcknowledgementSchema, commandsResponseSchema, enrollmentResponseSchema, tokenEnrollmentResponseSchema;
 var init_wire = __esm({
   "../../packages/tacho/src/wire.ts"() {
     "use strict";
@@ -5631,6 +5641,7 @@ var init_wire = __esm({
     TACHO_GATEWAY_TIER = "gateway";
     TACHO_GATEWAY_SESSION_HEADER = "x-tacho-gateway-session";
     TACHO_GATEWAY_GENESIS_HEADER = "x-tacho-gateway-genesis";
+    MCP_STREAMABLE_HTTP_ACCEPT = "application/json, text/event-stream";
     TACHO_METERING_ATTR = "oxagen.metering";
     TACHO_METERING_OBSERVED = "observed";
     TACHO_MODEL_SESSION_HEADER = "x-oxagen-session";
@@ -11528,7 +11539,10 @@ function normalizeHook(raw, env, options) {
         body2["tool_output_digest"] = digestJcs(
           input.tool_response
         );
-        body2["tool_output_bytes"] = jsonByteLength(input.tool_response);
+        const bytes = jsonByteLength(input.tool_response);
+        body2["tool_output_bytes"] = bytes;
+        body2["tool_result_tokens"] = Math.ceil(bytes / 4);
+        body2["tool_result_tokens_basis"] = "estimated";
       }
       if (failed3) {
         const error = input.error ?? input["error_type"];
@@ -14512,7 +14526,24 @@ function steeringFactsOf(steering) {
     steering_tokens_basis: "estimated"
   };
 }
-var REQUEST_FULL_DIGEST_ATTR, SYSTEM_CONTEXT_PARTS_OMITTED_ATTR, MEMORY_REQUESTS, LISTED_PER_TURN, U32_MAX, NAME_MAX, tokenSourceFacts, SystemContextMemory, SHARED_SYSTEM_CONTEXT_MEMORY, CONVERSATION_FIELDS2, STEERING_ASSEMBLY_PART, SystemContextTracker;
+function contextFactsOf(tokens) {
+  if (tokens <= 0) return {};
+  return {
+    context_frame_tokens: tokens,
+    context_frame_tokens_basis: "estimated"
+  };
+}
+function injectedMarksOf(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((mark) => {
+    if (typeof mark !== "object" || mark === null) return [];
+    const { at, tokens } = mark;
+    if (typeof at !== "string" || typeof tokens !== "number") return [];
+    if (!Number.isFinite(tokens)) return [];
+    return [{ at, tokens: clampU32(tokens) }];
+  });
+}
+var REQUEST_FULL_DIGEST_ATTR, SYSTEM_CONTEXT_PARTS_OMITTED_ATTR, MEMORY_REQUESTS, LISTED_PER_TURN, INJECTED_MARKS_MAX, U32_MAX, NAME_MAX, tokenSourceFacts, SystemContextMemory, SHARED_SYSTEM_CONTEXT_MEMORY, CONVERSATION_FIELDS2, STEERING_ASSEMBLY_PART, SystemContextTracker;
 var init_system_context = __esm({
   "../../packages/tacho/src/claude-code/system-context.ts"() {
     "use strict";
@@ -14524,6 +14555,7 @@ var init_system_context = __esm({
     SYSTEM_CONTEXT_PARTS_OMITTED_ATTR = "oxagen.system_context_parts_omitted";
     MEMORY_REQUESTS = 512;
     LISTED_PER_TURN = 16;
+    INJECTED_MARKS_MAX = 32;
     U32_MAX = 4294967295;
     NAME_MAX = 512;
     tokenSourceFacts = modelFacts.pick({
@@ -14580,11 +14612,16 @@ var init_system_context = __esm({
         this.steering = parts === void 0 ? void 0 : { parts, tokens: state?.steeringTokens ?? sum(parts) };
         this.listedTurn = state?.listedTurn;
         this.listed = [...state?.listed ?? []];
+        this.injected = injectedMarksOf(state?.injected);
+        const floor = state?.injectedFloor;
+        this.injectedFloor = typeof floor === "number" && Number.isFinite(floor) ? clampU32(floor) : 0;
       }
       memory;
       steering;
       listedTurn;
       listed;
+      injected;
+      injectedFloor;
       state() {
         const state = {};
         if (this.steering !== void 0) {
@@ -14593,6 +14630,9 @@ var init_system_context = __esm({
         }
         if (this.listedTurn !== void 0) state.listedTurn = this.listedTurn;
         if (this.listed.length > 0) state.listed = [...this.listed];
+        if (this.injected.length > 0)
+          state.injected = this.injected.map((mark) => ({ ...mark }));
+        if (this.injectedFloor > 0) state.injectedFloor = this.injectedFloor;
         return state;
       }
       /** Take the steering a sealed `steering.manifest` frame names. */
@@ -14600,21 +14640,84 @@ var init_system_context = __esm({
         const steering = steeringContext(body2);
         if (steering !== void 0) this.steering = steering;
       }
+      /**
+       * Note text an Oxagen hook answer handed the agent after its start, at
+       * `at`, when the answer left (#5339). The text joins the conversation, so
+       * every call made from `at` on carries it. Empty text notes nothing.
+       *
+       * The caller passes only text the session's own conversation reads. The
+       * start's text is the steering manifest's to count, and a subagent's text
+       * stays in the subagent's conversation.
+       */
+      noteInjectedContext(text4, at) {
+        const tokens = clampU32(budgetTokens(text4));
+        if (tokens === 0) return;
+        this.markInjected(at, this.injectedTotal() + tokens);
+      }
+      /**
+       * Empty the running total at `at`: a compaction or a `/clear` took the
+       * text out of the conversation. A call made before `at` still reads the
+       * total it was made with.
+       */
+      clearInjectedContext(at) {
+        if (this.injected.length === 0 && this.injectedFloor === 0) return;
+        this.markInjected(at, 0);
+      }
+      injectedTotal() {
+        return this.injected.at(-1)?.tokens ?? this.injectedFloor;
+      }
+      markInjected(at, tokens) {
+        this.injected.push({ at, tokens: clampU32(tokens) });
+        while (this.injected.length > INJECTED_MARKS_MAX) {
+          const oldest = this.injected.shift();
+          if (oldest !== void 0) this.injectedFloor = oldest.tokens;
+        }
+      }
+      /**
+       * The context Oxagen's hooks had handed the session when a call was made
+       * at `at`: the latest mark at or before it. A record can arrive after
+       * later answers left, since OTel exports in batches and the transcript is
+       * read behind the session. A call with no readable time reads the latest
+       * total. A call older than every mark kept reads the total before them.
+       */
+      injectedAt(at) {
+        const when = at === void 0 ? Number.NaN : Date.parse(at);
+        if (Number.isNaN(when)) return this.injectedTotal();
+        for (let index = this.injected.length - 1; index >= 0; index -= 1) {
+          const mark = this.injected[index];
+          if (mark === void 0) continue;
+          const markAt = Date.parse(mark.at);
+          if (Number.isNaN(markAt) || markAt <= when) return mark.tokens;
+        }
+        return this.injectedFloor;
+      }
       /**
        * Measure one model call. `content` is the proxy's exchange body, `attrs`
-       * the frame's attrs, and `turn` a key that changes when the turn does.
+       * the frame's attrs, `turn` a key that changes when the turn does, and
+       * `at` when the call was made.
        */
-      measure(content, attrs2, turn) {
+      measure(content, attrs2, turn, at) {
         const recorded = requestOf(content);
         const resolved = recorded === void 0 ? void 0 : resolveRequest(recorded.request, this.memory);
         if (recorded === void 0 || resolved === void 0)
-          return this.checked(steeringFactsOf(this.steering), {}, () => {
-          });
+          return this.checked(
+            {
+              ...steeringFactsOf(this.steering),
+              ...contextFactsOf(this.injectedAt(at))
+            },
+            {},
+            () => {
+            }
+          );
         const fullDigest = attrs2?.[REQUEST_FULL_DIGEST_ATTR];
         const key = isSha256Digest(fullDigest) ? fullDigest : recorded.request[PRIOR_MEMBER] === void 0 ? digestBytes(recorded.text) : void 0;
         if (key !== void 0) this.memory.set(key, resolved);
-        const steering = resolved.tools.length > 0 ? this.steering : void 0;
-        const facts = steeringFactsOf(steering);
+        const main3 = resolved.tools.length > 0;
+        const steering = main3 ? this.steering : void 0;
+        const facts = {
+          ...steeringFactsOf(steering),
+          ...main3 ? contextFactsOf(this.injectedAt(at)) : {}
+        };
         const parts = [
           ...resolved.system,
           ...resolved.instructions,
@@ -14647,15 +14750,23 @@ var init_system_context = __esm({
       /**
        * The token sources of a model call whose request the recorder never saw:
        * the counted OTel or transcript row of a call the proxy did not carry
-       * (#4493). Only the steering count is known without the request. The tool
-       * definition count, the context frame count, and the system context stay
-       * absent, never zero. Nothing changes on the tracker, so there is nothing
-       * to commit. The caller asks only for a call that carries the session's
-       * conversation, since a side call carries no steering.
-       */
-      measureUnseen() {
-        return this.checked(steeringFactsOf(this.steering), {}, () => {
-        }).facts;
+       * (#4493). Two counts are known without the request: the steering, from
+       * the manifest, and the context frames, from the hook answers noted before
+       * `at`, when the call was made (#5339). The tool definition count and the
+       * system context stay absent, never zero. Nothing changes on the tracker,
+       * so there is nothing to commit. The caller asks only for a call that
+       * carries the session's conversation, since a side call carries neither.
+       */
+      measureUnseen(at) {
+        return this.checked(
+          {
+            ...steeringFactsOf(this.steering),
+            ...contextFactsOf(this.injectedAt(at))
+          },
+          {},
+          () => {
+          }
+        ).facts;
       }
       /**
        * Hand back facts the envelope accepts, or none. A body the envelope
@@ -15295,7 +15406,12 @@ function spanDraft(span, resource) {
         ...s(attrs2, "tool_name") !== void 0 ? { tool_name: s(attrs2, "tool_name") } : {},
         ...s(attrs2, "tool_use_id") !== void 0 ? { tool_use_id: s(attrs2, "tool_use_id") } : {},
         ...n(attrs2, "duration_ms") !== void 0 ? { tool_duration_ms: n(attrs2, "duration_ms") } : {},
-        ...n(attrs2, "result_tokens") !== void 0 ? { tool_result_tokens: n(attrs2, "result_tokens") } : {},
+        // Claude Code's own count, so it is `reported`. A reader prefers it
+        // to the hook's estimate of the same call (#5339).
+        ...n(attrs2, "result_tokens") !== void 0 ? {
+          tool_result_tokens: n(attrs2, "result_tokens"),
+          tool_result_tokens_basis: "reported"
+        } : {},
         ...s(attrs2, "file_path") !== void 0 ? { tool_target: s(attrs2, "file_path") } : {},
         ...s(attrs2, "full_command") !== void 0 ? { tool_target: (s(attrs2, "full_command") ?? "").slice(0, 512) } : {},
         ...s(attrs2, "skill_name") !== void 0 ? { attribution_skill: s(attrs2, "skill_name") } : {},
@@ -16543,16 +16659,18 @@ var init_recorder = __esm({
         if (kind === "agent_stop") this.turnOpen = false;
         const sighting = kind === "llm_call" ? this.llmCallSighting(body2, fields.source ?? "collector") : NO_SIGHTING;
         const duplicate = sighting.attrs ?? {};
+        const ts2 = fields.ts ?? this.now();
         const measured = kind === "llm_call" ? this.systemContext.measure(
           fields.content,
           fields.attrs,
-          this.turnOpen ? `turn:${this.turnSeq}` : `idle:${this.turnSeq}`
+          this.turnOpen ? `turn:${this.turnSeq}` : `idle:${this.turnSeq}`,
+          ts2
         ) : void 0;
         const event = this.seal(
           kind,
           measured !== void 0 ? { ...measured.facts, ...body2 } : body2,
           {
-            ts: fields.ts ?? this.now(),
+            ts: ts2,
             source: fields.source ?? "collector",
             ...fields.hook_event_name !== void 0 ? { hook_event_name: fields.hook_event_name } : {},
             attrs: { ...fields.attrs, ...measured?.attrs, ...duplicate },
@@ -16966,19 +17084,32 @@ var init_recorder = __esm({
        * recorder knows without the call's request (#4493). Only the counted row,
        * the first sighting of its call, takes them. A stamped duplicate is never
        * summed, and the rollup joins a stamped proxy row back for the members the
-       * counted row lacks. The steering count is the one source known without
-       * the request, so the tool definitions and the system context stay absent
-       * (ADR-062, amendment of 2026-10-02). A member the producer set itself
-       * wins, as on a proxied call. Only a call on the session's own
-       * conversation comes here: an OTel record whose `query_source` says so
-       * ({@link onSessionConversation}), or a transcript `assistant` record,
-       * since Claude Code writes no side call to the transcript.
-       */
-      withUnseenRequestSources(body2, attrs2) {
+       * counted row lacks. Two sources are known without the request: the
+       * steering count, and the context frames Oxagen's hooks handed the session
+       * before `ts`, when the call was made (#5339). The tool definitions and the
+       * system context stay absent (ADR-062, amendments of 2026-10-02 and
+       * 2026-10-03). A member the producer set itself wins, as on a proxied call.
+       * Only a call on the session's own conversation comes here: an OTel record
+       * whose `query_source` says so ({@link onSessionConversation}), or a
+       * transcript `assistant` record, since Claude Code writes no side call to
+       * the transcript.
+       */
+      withUnseenRequestSources(body2, attrs2, ts2) {
         if (attrs2[LLM_CALL_DUPLICATE_OF_ATTR] !== void 0) return body2;
-        const facts = this.systemContext.measureUnseen();
+        const facts = this.systemContext.measureUnseen(ts2);
         return Object.keys(facts).length === 0 ? body2 : { ...facts, ...body2 };
       }
+      /**
+       * Note text an Oxagen hook answer handed this session's agent after its
+       * start, at `at`, when the answer left (#5339). Every model call on the
+       * session's own conversation from then on carries the running total as
+       * `context_frame_tokens`. The hook handler calls this only for a live
+       * answer, since a replay's answer reaches no harness. A rollback of the
+       * chain takes the note back with everything else the hook changed.
+       */
+      noteInjectedContext(text4, at) {
+        this.systemContext.noteInjectedContext(text4, at);
+      }
       /**
        * The attrs a `tool_call` carries, or undefined when the chain already
        * holds this call and the row must not be sealed at all.
@@ -17112,6 +17243,9 @@ var init_recorder = __esm({
           this.started = true;
           this.stopped = false;
           body2 = { ...body2, env_snapshot: this.envSnapshot };
+          const source = body2["session_start_source"];
+          if (source === "compact" || source === "clear")
+            this.systemContext.clearInjectedContext(ts2);
         }
         if (draft.kind === "turn_start") {
           if (this.turnOpen) {
@@ -17388,7 +17522,7 @@ var init_recorder = __esm({
         }
         const event = this.seal(
           draft.kind,
-          draft.kind === "llm_call" && draft.source === "otel_log" && onSessionConversation(draft.standard.context.query_source) ? this.withUnseenRequestSources(draft.body, duplicate) : draft.body,
+          draft.kind === "llm_call" && draft.source === "otel_log" && onSessionConversation(draft.standard.context.query_source) ? this.withUnseenRequestSources(draft.body, duplicate, draft.ts) : draft.body,
           {
             ts: draft.ts,
             source: draft.source,
@@ -17471,7 +17605,7 @@ var init_recorder = __esm({
             duplicate = { [LLM_CALL_DUPLICATE_OF_ATTR]: "transcript" };
           }
           if (draft.kind === "llm_call")
-            body2 = this.withUnseenRequestSources(body2, duplicate);
+            body2 = this.withUnseenRequestSources(body2, duplicate, draft.ts);
           let content = draft.content;
           if (this.isSealedPrompt(draft.kind, body2)) {
             content = void 0;
@@ -23363,7 +23497,7 @@ import { readFileSync as readFileSync11 } from "node:fs";
 import { dirname as dirname8, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 function readVersion() {
-  if (true) return "2.1.4-489";
+  if (true) return "2.1.4-495";
   try {
     const here = dirname8(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(
@@ -28339,16 +28473,20 @@ function requestedMcpEndpoint(deps, warnings) {
   }
   return request3.pinned;
 }
-function repointCommands(host, runtime) {
-  const same = host.hook_command === runtime.hookCommand && sameArgv(host.daemon_command, runtime.daemonCommand) && sameArgv(host.mcp_stdio_command ?? [], runtime.mcpStdioCommand);
-  if (same) return void 0;
+function repointCommands(host, runtime, wrapperVersion) {
+  if (sameCommands(host, runtime) && host.wrapper_version === wrapperVersion)
+    return void 0;
   return {
     ...host,
     hook_command: runtime.hookCommand,
     daemon_command: runtime.daemonCommand,
-    mcp_stdio_command: runtime.mcpStdioCommand
+    mcp_stdio_command: runtime.mcpStdioCommand,
+    wrapper_version: wrapperVersion
   };
 }
+function sameCommands(host, runtime) {
+  return host.hook_command === runtime.hookCommand && sameArgv(host.daemon_command, runtime.daemonCommand) && sameArgv(host.mcp_stdio_command ?? [], runtime.mcpStdioCommand);
+}
 function sameArgv(a, b5) {
   return a.length === b5.length && a.every((part2, i2) => part2 === b5[i2]);
 }
@@ -28557,7 +28695,7 @@ ${problems.map((problem) => `  ${problem}`).join("\n")}`
       writeHostFile(deps.paths.hostFile, host);
       deps.out(`      MCP endpoint pinned to ${pinned} (TACHO_MCP_ENDPOINT)`);
     }
-    const repointed = repointCommands(host, deps.runtime);
+    const repointed = repointCommands(host, deps.runtime, deps.wrapperVersion);
     if (repointed !== void 0) {
       if (deps.runtime.transient !== void 0) {
         warnings.push(
@@ -28570,9 +28708,14 @@ ${problems.map((problem) => `  ${problem}`).join("\n")}`
       } else {
         host = { ...repointed, harness_files: harnessFilesRecord(deps.paths) };
         writeHostFile(deps.paths.hostFile, host);
-        deps.out(
-          `      service and hooks now run from ${deps.runtime.binDir} (was ${existing.hook_command})`
-        );
+        if (!sameCommands(existing, deps.runtime))
+          deps.out(
+            `      service and hooks now run from ${deps.runtime.binDir} (was ${existing.hook_command})`
+          );
+        if (existing.wrapper_version !== deps.wrapperVersion)
+          deps.out(
+            `      host.json now records version ${deps.wrapperVersion} (was ${existing.wrapper_version})`
+          );
       }
     }
   } else {
@@ -29906,6 +30049,11 @@ function shimError(id, message) {
     error: { code: -32002, message }
   };
 }
+function answersNoRequest(message) {
+  if (Array.isArray(message) || !("error" in message)) return false;
+  const id = message.id;
+  return id === null || id === void 0;
+}
 function resolveTarget(options, deps) {
   const paths = agentPathsForEnrollment(
     tachoHome(deps.env, deps.home),
@@ -29937,8 +30085,9 @@ async function runMcpStdio(options, deps) {
     const text4 = line.trim();
     if (text4.length === 0) continue;
     let id;
+    let method;
     try {
-      id = JSON.parse(text4).id;
+      ({ id, method } = JSON.parse(text4));
     } catch {
       deps.stdout.write(
         `${JSON.stringify(shimError(null, "the shim received a line that is not JSON"))}
@@ -29946,7 +30095,7 @@ async function runMcpStdio(options, deps) {
       );
       continue;
     }
-    const expectsReply = id !== void 0;
+    const expectsReply = id !== void 0 && typeof method === "string";
     const reply2 = (document) => {
       if (expectsReply) deps.stdout.write(`${JSON.stringify(document)}
 `);
@@ -29961,7 +30110,9 @@ async function runMcpStdio(options, deps) {
         headers: {
           Authorization: `Bearer ${target2.token}`,
           "Content-Type": "application/json",
-          Accept: "application/json",
+          // The two media types the MCP transport requires of a client. The
+          // local gateway always answers with JSON, which this accepts.
+          Accept: MCP_STREAMABLE_HTTP_ACCEPT,
           // Loopback, so this is not a real origin check — it is here so the
           // gateway's guard sees a Host it recognises even behind a proxy
           // that rewrites one.
@@ -29983,8 +30134,12 @@ async function runMcpStdio(options, deps) {
         parsed = void 0;
       }
       if (typeof parsed === "object" && parsed !== null) {
-        if (expectsReply || response.ok) deps.stdout.write(`${body2}
+        if (expectsReply && answersNoRequest(parsed)) {
+          reply2({ ...parsed, id });
+        } else if (expectsReply) {
+          deps.stdout.write(`${body2}
 `);
+        }
       } else if (!response.ok || expectsReply && body2.length > 0) {
         deps.stderr.write(
           `oxagen mcp-stdio: the gateway answered ${response.status}: ${body2.slice(0, 200)}
@@ -30018,6 +30173,7 @@ var init_mcp_stdio = __esm({
     init_agents();
     init_host_file();
     init_paths();
+    init_wire();
     GATEWAY_TIMEOUT_MS = 5 * 6e4;
   }
 });
@@ -34674,12 +34830,45 @@ function readRpcBody(text4) {
     return JSON.parse(trimmed);
   }
   let last;
-  for (const line of trimmed.split(/\r?\n/)) {
-    if (line.startsWith("data:")) last = line.slice(5).trim();
+  for (const event of trimmed.split(/\r?\n\r?\n/)) {
+    const data = event.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(line.startsWith("data: ") ? 6 : 5));
+    const payload = data.join("\n");
+    if (payload.trim().length > 0) last = payload;
   }
   if (last === void 0) return void 0;
   return JSON.parse(last);
 }
+function isRpcErrorObject(value) {
+  if (value === null || typeof value !== "object") return false;
+  const error = value;
+  return typeof error["code"] === "number" && typeof error["message"] === "string";
+}
+function answerFor(id, upstream) {
+  const { status: status2, body: body2 } = upstream;
+  const ok = status2 >= 200 && status2 < 300;
+  const message = body2 !== null && typeof body2 === "object" && !Array.isArray(body2) ? body2 : void 0;
+  const error = message?.["error"];
+  if (isRpcErrorObject(error)) {
+    if (message?.["id"] === id) return { status: status2, body: body2 };
+    return {
+      status: status2,
+      body: { jsonrpc: "2.0", id, error }
+    };
+  }
+  if (ok && message !== void 0 && "result" in message) {
+    if (message["id"] === id) return { status: status2, body: body2 };
+  }
+  const flat = upstream.text.replace(/\s+/g, " ").trim();
+  const what = flat.length === 0 ? "with no body" : `with a body that is not a JSON-RPC answer to this request: ${flat.slice(0, UPSTREAM_EXCERPT_MAX)}`;
+  return {
+    status: ok ? 502 : status2,
+    body: rpcError(
+      id,
+      RPC_INTERNAL_ERROR,
+      `the Oxagen control plane answered HTTP ${status2} ${what}`
+    )
+  };
+}
 function outcomeOf(status2, rpc) {
   if (rpc?.error !== void 0)
     return rpc.error.code === RPC_REFUSED ? "rejected" : "error";
@@ -34733,10 +34922,11 @@ function createMcpGateway(deps) {
         headers: {
           Authorization: `Bearer ${attribution2.apiKey}`,
           "Content-Type": "application/json",
-          // JSON only: the gateway answers one request at a time and has no
-          // stream to hand a client. A server that streams anyway is handled
-          // by `readRpcBody`.
-          Accept: "application/json",
+          // Both media types, as the MCP transport requires. The hosted
+          // server refuses any other Accept with a 406 (#5356). It answers
+          // with an event stream, and `readRpcBody` reads the response out of
+          // it, so the client still gets one JSON answer.
+          Accept: MCP_STREAMABLE_HTTP_ACCEPT,
           "User-Agent": "oxagen-local-gateway",
           "X-Tacho-Host": attribution2.hostEnrollmentId,
           // Which chain this call belongs to. The control plane takes the
@@ -34756,7 +34946,13 @@ function createMcpGateway(deps) {
         signal: controller.signal
       });
       const text4 = await response.text();
-      return { status: response.status, body: readRpcBody(text4) };
+      let body2;
+      try {
+        body2 = readRpcBody(text4);
+      } catch {
+        body2 = void 0;
+      }
+      return { status: response.status, body: body2, text: text4 };
     } finally {
       clearTimeout(timer);
     }
@@ -34809,9 +35005,9 @@ function createMcpGateway(deps) {
         if (name !== void 0) clients.set(context.sessionId, name);
       }
       const startedAt = now();
-      let response;
+      let upstream;
       try {
-        response = await forward(request3, attribution2);
+        upstream = await forward(request3, attribution2);
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         log(`mcp gateway forward failed: ${message}`);
@@ -34825,6 +35021,17 @@ function createMcpGateway(deps) {
           )
         };
       }
+      let response = typeof request3.id === "string" || typeof request3.id === "number" ? answerFor(request3.id, upstream) : { status: upstream.status, body: upstream.body };
+      if (response.body !== upstream.body) {
+        const said = response.body.error?.message;
+        log(
+          `mcp gateway gave ${request3.method} an error with the request's id after HTTP ${upstream.status}: ${said ?? "no message"}`
+        );
+      } else if (upstream.status < 200 || upstream.status >= 300) {
+        log(
+          `mcp gateway: the control plane answered ${request3.method} with HTTP ${upstream.status}`
+        );
+      }
       const rpc = response.body;
       if (request3.method === "tools/list" && rpc?.result !== void 0) {
         const bundle2 = deps.bundle?.();
@@ -34944,7 +35151,7 @@ function toolNameOf(params) {
   const name = params?.["name"];
   return typeof name === "string" && name.length > 0 ? name : "unknown";
 }
-var RPC_INVALID_REQUEST, RPC_INTERNAL_ERROR, RPC_REFUSED, CLAUDE_CODE_TOOL_USE_ID_META, MAX_TOOL_USE_ID_LENGTH, DEFAULT_TIMEOUT_MS3, REFUSAL_RULES_MAX, REFUSAL_RULE_MAX;
+var RPC_INVALID_REQUEST, RPC_INTERNAL_ERROR, RPC_REFUSED, CLAUDE_CODE_TOOL_USE_ID_META, MAX_TOOL_USE_ID_LENGTH, DEFAULT_TIMEOUT_MS3, UPSTREAM_EXCERPT_MAX, REFUSAL_RULES_MAX, REFUSAL_RULE_MAX;
 var init_mcp_gateway = __esm({
   "../../packages/tacho/src/collector/mcp-gateway.ts"() {
     "use strict";
@@ -34958,6 +35165,7 @@ var init_mcp_gateway = __esm({
     CLAUDE_CODE_TOOL_USE_ID_META = "claudecode/toolUseId";
     MAX_TOOL_USE_ID_LENGTH = 512;
     DEFAULT_TIMEOUT_MS3 = 3e4;
+    UPSTREAM_EXCERPT_MAX = 200;
     REFUSAL_RULES_MAX = 64;
     REFUSAL_RULE_MAX = 512;
   }
@@ -38383,6 +38591,11 @@ function drainMidTurn(input, record, deps, events, replay, used = 0) {
   if (continuation !== void 0) texts.push(continuation);
   return texts;
 }
+function noteHandedContext(record, input, replay, text4, at) {
+  if (replay !== void 0 || input.agent_id !== void 0) return;
+  if (text4.length === 0) return;
+  record.recorder.noteInjectedContext(text4, at);
+}
 function hookLedgerKey(raw, harness, hookId) {
   if (hookId !== void 0) return hookId;
   if (harness === "stella" || typeof raw !== "object" || raw === null)
@@ -38685,6 +38898,11 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
       ) : void 0;
       if (block === void 0) record.control.resumeOwed = void 0;
       if (block === void 0) notePrompt(record, promptText(input));
+      const handed = [
+        ...delivered,
+        ...recalled !== void 0 ? [recalled.text] : []
+      ];
+      const context = handed.join(CONTEXT_JOINER);
       events.push(
         ...record.recorder.ingestHook(
           payload,
@@ -38692,11 +38910,16 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
           at,
           (draft) => withReplay({
             ...draft,
-            ...recalled !== void 0 ? {
+            ...recalled !== void 0 || handed.length > 0 ? {
               attrs: {
                 ...draft.attrs,
-                "oxagen.recall_digest": digestText(recalled.text),
-                "oxagen.recalled_memories": String(recalled.count)
+                ...recalled !== void 0 ? {
+                  "oxagen.recall_digest": digestText(recalled.text),
+                  "oxagen.recalled_memories": String(recalled.count)
+                } : {},
+                // How much text the answer hands the agent, as the start
+                // records it (#5339).
+                ...handed.length > 0 ? { "oxagen.delivered_chars": String(context.length) } : {}
               }
             } : {},
             body: {
@@ -38717,16 +38940,13 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
           record
         };
       }
-      const context = [
-        ...delivered,
-        ...recalled !== void 0 ? [recalled.text] : []
-      ];
+      noteHandedContext(record, input, replay, context, at);
       return {
         events,
-        response: context.length > 0 ? {
+        response: handed.length > 0 ? {
           hookSpecificOutput: {
             hookEventName: "UserPromptSubmit",
-            additionalContext: context.join(CONTEXT_JOINER)
+            additionalContext: context
           }
         } : {},
         record
@@ -38995,6 +39215,7 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
       if (operatorBlock(view, record) !== void 0)
         return { events, response: {}, record };
       const texts = drainMidTurn(input, record, deps, events, replay);
+      noteHandedContext(record, input, replay, texts.join(CONTEXT_JOINER), at);
       return {
         events,
         response: texts.length > 0 ? {
@@ -39029,6 +39250,7 @@ async function routeHook(raw, env, deps, replay, harness, agent, hookId) {
         ...drainMidTurn(input, record, deps, events, replay, ask?.length ?? 0),
         ...ask !== void 0 ? [ask] : []
       ];
+      noteHandedContext(record, input, replay, texts.join(CONTEXT_JOINER), at);
       return {
         events,
         response: texts.length > 0 ? { decision: "block", reason: texts.join(CONTEXT_JOINER) } : {},
@@ -47228,7 +47450,17 @@ async function initializeDaemon(options, server, port, ready) {
       `no enrollment at ${paths.hostFile}; run \`oxagen agent enroll\` first`
     );
   }
-  let host = loaded;
+  let host = loaded.wrapper_version === TACHO_VERSION ? loaded : { ...loaded, wrapper_version: TACHO_VERSION };
+  const onDisk = readHostFileLenient(paths.hostFile).host;
+  if (onDisk !== void 0 && onDisk.host_enrollment_id === host.host_enrollment_id && onDisk.wrapper_version !== TACHO_VERSION) {
+    log(
+      `host.json now records version ${TACHO_VERSION} (was ${onDisk.wrapper_version})`
+    );
+    writeHostFile(paths.hostFile, {
+      ...onDisk,
+      wrapper_version: TACHO_VERSION
+    });
+  }
   for (const dir of [paths.dir, paths.wal, paths.spool, paths.quarantine])
     ensureDir(dir);
   const recallMemories = options.memoryRecall ?? options.listen ?? true ? createMemoryRecall({
@@ -47517,10 +47749,10 @@ async function initializeDaemon(options, server, port, ready) {
     const marked = new Set(marks.map(({ session }) => session));
     const unmarked = registry2.list().filter((session) => within4(session) && !marked.has(session));
     if (unmarked.length > 0) {
-      const onDisk = new Set(wal.sessions());
+      const onDisk2 = new Set(wal.sessions());
       for (const session of unmarked) {
         const recorder = session.recorder;
-        if (!onDisk.has(recorder.sessionUuid)) {
+        if (!onDisk2.has(recorder.sessionUuid)) {
           recorder.rollbackToBirth();
           continue;
         }
@@ -47612,8 +47844,8 @@ async function initializeDaemon(options, server, port, ready) {
       bundle_etag: host.bundle.etag,
       // What this daemon's `policyBundleSchema` names, so the control plane
       // can send a gated bundle field without breaking hosts that predate it.
-      // Reported from the running code rather than from `host.json`, which
-      // `enroll` writes once and no upgrade rewrites.
+      // Reported from the running code rather than read off `version`, which
+      // a daemon older than #5365 took from the enrollment, not the upgrade.
       bundle_features: [...TACHO_BUNDLE_FEATURES],
       // Omitted until a read succeeds: absent means nothing was said, and a
       // daemon that could not read the files has nothing to say.
@@ -49811,6 +50043,7 @@ var init_daemon = __esm({
     init_work_orders();
     init_ids();
     init_timestamp();
+    init_version();
     init_wire();
     init_backfill2();
     init_detector();
@@ -52035,7 +52268,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@oxagen/cli",
-      version: "2.1.4-489",
+      version: "2.1.4-495",
       description: "Oxagen governance CLI \u2014 spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
       type: "module",
       main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxagen/cli",
-  "version": "2.1.4-489",
+  "version": "2.1.4-495",
   "description": "Oxagen governance CLI — spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
   "type": "module",
   "bin": {