@pugi/cli 0.1.0-beta.1 → 0.1.0-beta.100

package/dist/core/repl/dispatch-fsm.js

@@ -1,5 +1,5 @@
 /**
- * Dispatch FSM — Sprint α6.9 Phase 1 (agent loop FSM + cancellation).
+ * Dispatch FSM — Sprint Phase 1 (agent loop FSM + cancellation).
  *
  * Tracks the lifecycle of a single operator-issued brief from the moment
  * `POST /api/pugi/sessions/:id/brief` fires until the persona returns a
@@ -10,16 +10,16 @@
  *
  * State graph:
  *
- *      idle
- *       │ (brief posted)
- *       ▼
- *   awaiting_response ←──────────┐
- *       │                        │ (next turn)
- *       ▼                        │
- *   tool_running ────────────────┘
- *       │
- *       ▼
- *   completed
+ *     idle
+ *      │ (brief posted)
+ *      ▼
+ *  awaiting_response ←──────────┐
+ *      │                       │ (next turn)
+ *      ▼                       │
+ *  tool_running ────────────────┘
+ *      │
+ *      ▼
+ *  completed
  *
  * Terminal states: `completed`, `failed`, `aborted`. The FSM does not
  * transition out of a terminal state; a fresh brief mints a new FSM
@@ -143,7 +143,7 @@ export class DispatchFSM {
         }
         this.firing = true;
         try {
-            // R2 P2 fix (Codex triple-review 2026-05-25): if `commit` throws -
+            // R2 P2 fix (Codex triple-review): if `commit` throws -
             // either the first move or any queued nested move - we MUST flush
             // the pending queue before propagating the error. Otherwise a
             // later `transition()` call would drain stale entries left over

package/dist/core/repl/engine-bridge.js

@@ -0,0 +1,303 @@
+import { AnvilEngineLoopClient } from '../engine/anvil-client.js';
+import { NativePugiEngineAdapter } from '../engine/native-pugi.js';
+import { loadMcpRegistry as defaultLoadMcpRegistry } from '../mcp/registry.js';
+import { openSession } from '../session.js';
+import { loadHookRegistryOrExit as defaultLoadHookRegistry } from '../../runtime/load-hooks-or-exit.js';
+/**
+ * Translate `pugi-tool-route command="..."` into the SDK's
+ * `EngineTaskKind`. `code` and `fix` pass through verbatim; `build`
+ * maps to `build_task` per `apps/pugi-cli/src/core/engine/native-pugi.ts:1444`
+ * (`toCommandKind`).
+ */
+function commandToTaskKind(command) {
+    if (command === 'build')
+        return 'build_task';
+    return command;
+}
+/**
+ * Translate one `EngineStreamEvent` (rich, adapter-internal vocabulary)
+ * into the REPL bridge's narrow `BridgedEngineEvent` shape (four
+ * variants -- step / tool.start / tool.result / tokens).
+ *
+ * Returns `null` for events the bridge surface deliberately ignores
+ * (`tool.delta` payloads are surfaced via `tool.result` summary;
+ * `thinking.*` and `text.delta` deltas are not part of the bridge
+ * UX contract -- the synthetic agent-tree node renders a single
+ * `detail` line, not a streaming thinking block).
+ *
+ * Mutates `names` so a follow-up `tool.end` can resolve its callId
+ * back to the recorded tool name (`tool.end` carries only `callId`).
+ */
+function translateStreamEvent(event, names) {
+    if (event.type === 'status') {
+        return { type: 'step', detail: event.message };
+    }
+    if (event.type === 'tool.start') {
+        names.set(event.callId, event.name);
+        return {
+            type: 'tool.start',
+            tool: event.name,
+            args: event.arguments,
+        };
+    }
+    if (event.type === 'tool.end') {
+        const name = names.get(event.callId) ?? '';
+        names.delete(event.callId);
+        return {
+            type: 'tool.result',
+            tool: name,
+            ok: event.ok,
+            preview: event.summary,
+        };
+    }
+    // tool.delta / thinking.* / text.delta intentionally dropped.
+    return null;
+}
+/**
+ * Production factory. Returns an `EngineBridge` the REPL bootstrap
+ * passes straight to `new ReplSession({ engineBridge })`.
+ *
+ * Per invocation lifecycle:
+ *   1. `openSession(cwd)` mints a fresh session id and ensures the
+ *      `.pugi/events.jsonl` ledger captures audit lines for the
+ *      bridged turn alongside direct `pugi code` invocations.
+ *   2. `NativePugiEngineAdapter` is constructed eagerly with the
+ *      injected (or default) `EngineLoopClient`. The adapter prewarms
+ *      the real-dispatch import on construction; this happens here for
+ *      free.
+ *   3. `attachStreamListener` subscribes to the adapter's
+ *      `streamEmitter`, fans every translatable `EngineStreamEvent`
+ *      to `input.onEvent`, and detaches on bridge exit.
+ *   4. `adapter.run(task, ctx)` drives the engine loop; the terminal
+ *      `result` event maps to the bridge outcome the REPL renders.
+ *   5. The bridge's `signal` is threaded straight through `ctx.signal`
+ *      so a REPL `/stop` aborts the engine loop mid-turn.
+ *
+ * Failure modes (each must be observable, never silent):
+ *   - Adapter constructor throws (e.g. invalid config) -- the bridge
+ *     promise rejects with the underlying error. The REPL's
+ *     `runEngineBridge` catch surfaces the message on a system line.
+ *   - Network error mid-loop -- adapter yields `result.status='failed'`,
+ *     bridge returns `{ outcome: 'failed', detail: result.summary }`.
+ *   - Operator abort -- adapter honours `ctx.signal`, surfaces an
+ *     `AbortError`; we propagate the rejection so the REPL flips the
+ *     synthetic node to `failed` with a clear detail line.
+ */
+export function createEngineBridge(deps) {
+    const buildClient = deps.clientFactory ?? ((config) => new AnvilEngineLoopClient(config));
+    const loadMcp = deps.loadMcpRegistry ?? defaultLoadMcpRegistry;
+    const loadHooks = deps.loadHookRegistry ??
+        ((opts) => defaultLoadHookRegistry(opts));
+    // PR A — per-bridge-instance caches. Spawning MCP child processes
+    // (multi-second startup for some servers) and parsing hook configuration
+    // are too expensive to repeat per turn AND have no per-turn state. We
+    // load once on the first call, reuse across turns. The MCP registry
+    // shutdown happens at process exit; a future PR will wire it to the
+    // REPL's exit hook so trusted child processes are reaped before the
+    // parent terminates.
+    //
+    // /triple-review P1 round 2: cache stored as in-flight Promise<T>
+    // instead of value + boolean flag. Two concurrent first-turn calls
+    // would otherwise both observe `mcpLoaded === false`, both spawn the
+    // expensive loader, and the second result would overwrite the first —
+    // leaking the first registry's child processes. Storing the promise
+    // means the second caller awaits the same in-flight load, gets the
+    // same instance, and there is no double-spawn. On loader failure the
+    // promise resolves to `undefined` (mirrors the value-cache fallback);
+    // a future retry on transient ENOENT would mint a NEW promise after
+    // explicit invalidation (out of scope for this PR — tracked as P2 fu).
+    let mcpRegistryPromise = null;
+    let hooksPromise = null;
+    const securityHooksParseFailed = { value: false };
+    async function resolveMcpRegistry(root) {
+        if (mcpRegistryPromise === null) {
+            mcpRegistryPromise = (async () => {
+                try {
+                    return await loadMcp(root);
+                }
+                catch (error) {
+                    // PR A — mirror cli.ts:6394 failure mode. A bad `.pugi/mcp.json`
+                    // must not crash the REPL; the operator sees a stderr warning
+                    // and continues without MCP tools. They can fix the file and
+                    // the next REPL launch picks up the new registry.
+                    const msg = error.message;
+                    process.stderr.write(`pugi REPL engine bridge: MCP registry load failed — ${msg}. ` +
+                        `Continuing without MCP tools. Fix .pugi/mcp.json to enable.\n`);
+                    return undefined;
+                }
+            })();
+        }
+        return mcpRegistryPromise;
+    }
+    async function resolveHooks(root, session) {
+        if (hooksPromise === null) {
+            hooksPromise = (async () => {
+                try {
+                    const outcome = await loadHooks({
+                        workspaceRoot: root,
+                        session,
+                        label: 'repl',
+                    });
+                    if (outcome.kind === 'parse-failure-refused') {
+                        // /triple-review P1 round 2: hooks fail-open is a security
+                        // regression vs cli.ts:6440 (hard-exit on parse failure).
+                        // SECURITY: a workspace operator who configured a `PreToolUse
+                        // onFailure: 'block'` rule that refuses bash containing `rm`
+                        // loses that protection the moment the JSON file gets a
+                        // typo. Stderr-only warning scrolls off the TUI.
+                        //
+                        // Mitigation: do NOT load hooks for this REPL session (so
+                        // the operator's mental model — "I have hooks configured" —
+                        // does not silently break), AND mark the bridge as "hooks
+                        // parse failed" so every turn surfaces the warning until
+                        // the file is fixed. The PUGI_HOOKS_BYPASS=1 env var
+                        // (loadHookRegistryOrExit:97-107) is still the explicit
+                        // escape hatch when the operator is mid-edit and acknowledges
+                        // the risk.
+                        securityHooksParseFailed.value = true;
+                        process.stderr.write('pugi REPL engine bridge: SECURITY — hooks parse failed. ' +
+                            'PreToolUse/PostToolUse rules are NOT active for this REPL ' +
+                            'session. Fix .pugi/hooks.json and restart REPL, OR set ' +
+                            'PUGI_HOOKS_BYPASS=1 to acknowledge and continue.\n');
+                        return undefined;
+                    }
+                    return outcome.hooks;
+                }
+                catch (error) {
+                    const msg = error.message;
+                    process.stderr.write(`pugi REPL engine bridge: hooks loader threw — ${msg}. ` +
+                        `Continuing without hooks.\n`);
+                    return undefined;
+                }
+            })();
+        }
+        return hooksPromise;
+    }
+    return async (input) => {
+        const root = deps.cwd();
+        const session = openSession(root);
+        const client = buildClient(deps.config);
+        const [cachedMcpRegistry, cachedHooks] = await Promise.all([
+            resolveMcpRegistry(root),
+            resolveHooks(root, session),
+        ]);
+        if (securityHooksParseFailed.value) {
+            // /triple-review P1 round 2: re-emit the security warning on every
+            // bridged turn so the operator does not miss it after scrollback.
+            // Cheap one-liner, hard to miss in TUI status pane.
+            process.stderr.write('pugi REPL engine bridge: SECURITY reminder — hooks still NOT ' +
+                'loaded for this session (.pugi/hooks.json parse failure).\n');
+        }
+        const adapter = new NativePugiEngineAdapter({
+            client,
+            session,
+            ...(cachedMcpRegistry ? { mcpRegistry: cachedMcpRegistry } : {}),
+            ...(cachedHooks ? { hooks: cachedHooks } : {}),
+            ...(deps.intensityProfile ? { intensityProfile: deps.intensityProfile } : {}),
+        });
+        // Per-call name map for matching `tool.end` -> `tool.start`. New
+        // every invocation so concurrent bridges never cross-pollute.
+        const callNames = new Map();
+        // Subscribe BEFORE `adapter.run()` so the first `tool.start` is
+        // captured. Detach in `finally` regardless of outcome so the
+        // listener does not accumulate across REPL turns (long sessions
+        // would otherwise leak one listener per bridged turn).
+        const onStreamEvent = (streamEvent) => {
+            const translated = translateStreamEvent(streamEvent, callNames);
+            if (translated === null)
+                return;
+            try {
+                input.onEvent(translated);
+            }
+            catch {
+                // Fire-and-forget contract -- a broken consumer must never
+                // tear down the engine loop.
+            }
+        };
+        adapter.streamEmitter.on('event', onStreamEvent);
+        const taskKind = commandToTaskKind(input.command);
+        const task = {
+            id: input.bridgeId,
+            kind: taskKind,
+            prompt: input.brief,
+            workspaceRoot: root,
+            allowedPaths: [root],
+            deniedPaths: [],
+            artifacts: [],
+            permissionMode: 'auto',
+        };
+        let terminalSummary = '';
+        let terminalStatus = 'failed';
+        let filesChangedCount = 0;
+        let detail;
+        try {
+            const events = adapter.run(task, {
+                sessionId: session.id,
+                signal: input.signal,
+            });
+            for await (const event of events) {
+                if (event.type === 'status') {
+                    // Already fanned out via streamEmitter above. The toplevel
+                    // `EngineEvent` `status` event predates the rich emitter and
+                    // is kept for backwards-compat with older adapters; we
+                    // intentionally do not double-fire `onEvent` here.
+                    continue;
+                }
+                // event.type === 'result' -- terminal.
+                terminalStatus = event.result.status;
+                terminalSummary = event.result.summary;
+                filesChangedCount = event.result.filesChanged.length;
+                if (event.result.status !== 'done') {
+                    detail = event.result.summary;
+                }
+            }
+        }
+        finally {
+            adapter.streamEmitter.off('event', onStreamEvent);
+        }
+        // Map engine `EngineResult.status` -> bridge `EngineBridgeOutcome`.
+        //
+        // `needs_verification` ( PUGI-VERIFY-GATE) downgrades a
+        // `completed` engine loop with no verification command to a status
+        // distinct from `done`. PUGI-538c-FU-OUTCOME (2026-06-05) split
+        // the bridge's failure surface: `needs_verification` now maps to
+        // the dedicated `unverified` outcome so the REPL agent-tree pane
+        // surfaces a yellow advisory instead of a red false-fail. Real
+        // verification regressions (`verification_command_failed` -> still
+        // `failed` here via the engine's `failed` status) are unchanged.
+        //
+        // Why the split matters: a fresh customer repo with no Makefile /
+        // no `package.json` test script trips `needs_verification` on
+        // every routed brief. Collapsing that to `failed` (the pre-538c
+        // mapping) produced the trust regression the CEO escalation 2026
+        // -06-04 demanded we fix: customer dogfood saw files land on
+        // disk yet read "failed" on the agent-tree, lost trust, walked
+        // away. The verify-gate contract is preserved: real test failures
+        // ALSO reach this branch via engine status `failed` (gated by
+        // `computeVerificationOutcome` when a verification command ran
+        // and exited non-zero) and still map to `failed`. Only the
+        // "no command available" path softens.
+        //
+        // `blocked` carries through (operator chose the abort / budget
+        // exhausted). `done` -> `shipped` -- the only path that produces
+        // a clean shipped status is a verified engine loop.
+        const outcome = terminalStatus === 'done'
+            ? 'shipped'
+            : terminalStatus === 'needs_verification'
+                ? 'unverified'
+                : terminalStatus === 'blocked'
+                    ? 'blocked'
+                    : 'failed';
+        return {
+            outcome,
+            filesChanged: filesChangedCount,
+            // PUGI-538c scope guard: stream emitter has no typed `tokens`
+            // event today; reporting `0` keeps the bridge contract honest
+            // until the emitter gains a tokens variant (separate follow-up).
+            tokensUsed: 0,
+            finalText: terminalSummary.length > 0 ? terminalSummary : undefined,
+            ...(detail !== undefined ? { detail } : {}),
+        };
+    };
+}
+//# sourceMappingURL=engine-bridge.js.map

package/dist/core/repl/history-search.js

@@ -1,5 +1,5 @@
 /**
- * FZF-style history search - Sprint α6.14.
+ * FZF-style history search - Sprint .
  *
  * Powers the Ctrl+R (reverse) / Ctrl+S (forward) interactive search
  * mode in the REPL input box. Hand-rolled scorer (no dep) tuned for
@@ -8,14 +8,14 @@
  *
  * Scoring model (mirrors fzf v2 mid-priorities, simplified):
  *
- *   - Substring match required. Non-matching candidates score 0.
- *   - Prefix match: +50
- *   - Word-boundary start (' ', '/', '-', '_'): +20
- *   - Camel boundary (`abcD` → 'D'): +10
- *   - Contiguous run bonus: +5 per consecutive char after the first
- *   - Distance penalty: -1 per gap char between query characters
- *   - Recency bonus: +0.5 × (recencyRank / total) so newer entries
- *     break ties in the operator's favour
+ *  - Substring match required. Non-matching candidates score 0.
+ *  - Prefix match: +50
+ *  - Word-boundary start (' ', '/', '-', '_'): +20
+ *  - Camel boundary (`abcD` → 'D'): +10
+ *  - Contiguous run bonus: +5 per consecutive char after the first
+ *  - Distance penalty: -1 per gap char between query characters
+ *  - Recency bonus: +0.5 × (recencyRank / total) so newer entries
+ *    break ties in the operator's favour
  *
  * The result is a list of matches ordered by descending score with
  * the matched character positions preserved so the UI can highlight
@@ -23,12 +23,12 @@
  * or backward (Ctrl+S) modulo the result length.
  *
  * Contract:
- *   - `searchHistory(query, entries, options)` is pure. No I/O.
- *   - Empty query returns ALL entries newest-first so the operator
- *     can browse without typing.
- *   - Matching is case-insensitive on ASCII; non-ASCII characters
- *     compare as-is.
- *   - `cycle(state, direction)` is a no-op when there are no matches.
+ *  - `searchHistory(query, entries, options)` is pure. No I/O.
+ *  - Empty query returns ALL entries newest-first so the operator
+ *    can browse without typing.
+ *  - Matching is case-insensitive on ASCII; non-ASCII characters
+ *    compare as-is.
+ *  - `cycle(state, direction)` is a no-op when there are no matches.
  */
 const DEFAULT_LIMIT = 50;
 const WORD_BOUNDARIES = new Set([' ', '/', '-', '_', '.', ',', ':', ';', '\t']);

package/dist/core/repl/history.js

@@ -1,5 +1,5 @@
 /**
- * Persistent REPL history (per-workspace) - Sprint α6.14.
+ * Persistent REPL history (per-workspace) - Sprint .
  *
  * Stores submitted briefs in `~/.pugi/history/<workspace-slug>.jsonl`,
  * one JSON object per line. The format is line-delimited JSON so the
@@ -11,26 +11,27 @@
  *
  * Contract:
  *
- *   - `append({ home, workspaceSlug, brief })` writes one line. Dedups
- *     a brief that is identical to the immediately preceding entry
- *     (most common operator pattern: Up + Enter to re-run).
- *   - `read({ home, workspaceSlug })` returns entries oldest-first so
- *     the caller can navigate with `index = entries.length - 1` for
- *     "most recent" semantics.
- *   - The file is capped at MAX_ENTRIES; on overflow we keep the most
- *     recent slice and rewrite. Cheap because briefs are short text
- *     and the cap is 1000.
- *   - `slugForCwd(cwd)` normalises a working directory into a safe
- *     filename component (alphanumerics + `-`, lowercase, slashes
- *     collapsed). Empty cwd resolves to `default`.
- *   - Failures (missing $HOME, disk full, EACCES) NEVER throw. History
- *     is operator comfort, not a contract surface; degrading to "no
- *     history this session" is correct.
+ *  - `append({ home, workspaceSlug, brief })` writes one line. Dedups
+ *    a brief that is identical to the immediately preceding entry
+ *    (most common operator pattern: Up + Enter to re-run).
+ *  - `read({ home, workspaceSlug })` returns entries oldest-first so
+ *    the caller can navigate with `index = entries.length - 1` for
+ *    "most recent" semantics.
+ *  - The file is capped at MAX_ENTRIES; on overflow we keep the most
+ *    recent slice and rewrite. Cheap because briefs are short text
+ *    and the cap is 1000.
+ *  - `slugForCwd(cwd)` normalises a working directory into a safe
+ *    filename component (alphanumerics + `-`, lowercase, slashes
+ *    collapsed). Empty cwd resolves to `default`.
+ *  - Failures (missing $HOME, disk full, EACCES) NEVER throw. History
+ *    is operator comfort, not a contract surface; degrading to "no
+ *    history this session" is correct.
  *
  * Brand voice: file is operator-facing if they `cat` it, so the JSON
  * keys stay readable English (`brief`, `ts`). No forbidden words.
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync, renameSync, unlinkSync, } from 'node:fs';
+import { randomBytes } from 'node:crypto';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 /** Cap on stored entries per workspace. Drops oldest on overflow. */
@@ -74,10 +75,19 @@ export function append(input) {
     // half-written file or race a parallel appendFileSync into oblivion.
     // POSIX renameSync is atomic within a directory; on Windows fs.rename
     // is atomic too as long as both paths are on the same volume (the tmp
-    // sibling guarantees that). P2 fix from PR #335 triple-review.
+    // sibling guarantees that). P2 fix from PR triple-review.
     if (existing.length + 1 > MAX_HISTORY_ENTRIES) {
         const trimmed = [...existing.slice(existing.length + 1 - MAX_HISTORY_ENTRIES), entry];
-        const tmpPath = `${path}.tmp`;
+        // β1b #52 : unique-per-call tmp suffix.
+        // Previous form was a fixed `${path}.tmp`, which means two CLI
+        // processes hitting the overflow rewrite at the same moment race
+        // on the same sibling file. Whichever writeFileSync lands second
+        // can corrupt the renameSync target's content (one process's
+        // serialized buffer overwrites the other mid-flight). Append a
+        // pid + monotonic-ish timestamp + 8 hex random bytes so the tmp
+        // names are collision-proof across PIDs, concurrent calls inside
+        // one PID, and rapid re-runs that share the same ms timestamp.
+        const tmpPath = `${path}.${process.pid}.${Date.now()}.${randomBytes(4).toString('hex')}.tmp`;
         try {
             writeFileSync(tmpPath, trimmed.map(serialize).join('\n') + '\n', { mode: 0o600 });
             renameSync(tmpPath, path);

package/dist/core/repl/kill-ring.js

@@ -1,12 +1,12 @@
 /**
- * Kill ring for the REPL input - Sprint α6.14.
+ * Kill ring for the REPL input - Sprint .
  *
  * Tiny LIFO buffer that backs the readline-style kill commands:
  *
- *   Ctrl+U  - kill from cursor to line start
- *   Ctrl+K  - kill from cursor to line end
- *   Ctrl+W  - kill word backwards (whitespace + punctuation delimiter)
- *   Ctrl+Y  - yank the most recent kill at the cursor
+ *  Ctrl+U - kill from cursor to line start
+ *  Ctrl+K - kill from cursor to line end
+ *  Ctrl+W - kill word backwards (whitespace + punctuation delimiter)
+ *  Ctrl+Y - yank the most recent kill at the cursor
  *
  * The ring is bounded (MAX_RING_ENTRIES = 10) so the operator's
  * recent kills are reachable without leaking memory across long

package/dist/core/repl/model-pricing.js

@@ -0,0 +1,135 @@
+/**
+ * Static price ladder keyed by exact model slug.
+ *
+ * Source: provider list-price pages as of. Keep prefix lookup
+ * (`priceForModel`) for forward compat — a `claude-opus-4-8` from a future
+ * model-router rebind falls back onto the `claude-opus-` family entry.
+ */
+const PRICE_LADDER = new Map([
+    // Anthropic Claude family
+    ['claude-opus-4-7', { inputUsdPerM: 15.0, outputUsdPerM: 75.0 }],
+    ['claude-opus-4-6', { inputUsdPerM: 15.0, outputUsdPerM: 75.0 }],
+    ['claude-sonnet-4-6', { inputUsdPerM: 3.0, outputUsdPerM: 15.0 }],
+    ['claude-sonnet-4-5', { inputUsdPerM: 3.0, outputUsdPerM: 15.0 }],
+    ['claude-haiku-4-5', { inputUsdPerM: 0.8, outputUsdPerM: 4.0 }],
+    // OpenAI family — sentinel entries so a `pugi config set` override lands clean.
+    ['gpt-4o', { inputUsdPerM: 2.5, outputUsdPerM: 10.0 }],
+    ['gpt-4o-mini', { inputUsdPerM: 0.15, outputUsdPerM: 0.6 }],
+    ['o3', { inputUsdPerM: 10.0, outputUsdPerM: 40.0 }],
+    ['o3-mini', { inputUsdPerM: 1.1, outputUsdPerM: 4.4 }],
+    // Mistral
+    ['mistral-large', { inputUsdPerM: 2.0, outputUsdPerM: 6.0 }],
+    ['mistral-small', { inputUsdPerM: 0.2, outputUsdPerM: 0.6 }],
+    // Embeddings — input-only; output is zero so the meter shows a
+    // flat per-call cost without inflating the "output" column.
+    ['voyage-3', { inputUsdPerM: 0.12, outputUsdPerM: 0 }],
+    ['voyage-3-large', { inputUsdPerM: 0.18, outputUsdPerM: 0 }],
+]);
+/**
+ * Family-prefix fallback. Used when an unknown slug starts with a
+ * known family stem (e.g. `claude-sonnet-4-7`).
+ */
+const FAMILY_PREFIX = [
+    ['claude-opus-', { inputUsdPerM: 15.0, outputUsdPerM: 75.0 }],
+    ['claude-sonnet-', { inputUsdPerM: 3.0, outputUsdPerM: 15.0 }],
+    ['claude-haiku-', { inputUsdPerM: 0.8, outputUsdPerM: 4.0 }],
+    ['gpt-4o', { inputUsdPerM: 2.5, outputUsdPerM: 10.0 }],
+    ['o3', { inputUsdPerM: 10.0, outputUsdPerM: 40.0 }],
+    ['mistral-', { inputUsdPerM: 2.0, outputUsdPerM: 6.0 }],
+    ['voyage-', { inputUsdPerM: 0.12, outputUsdPerM: 0 }],
+];
+/**
+ * Default ladder when no model slug is known (e.g. the older admin-api
+ * still on the pre- event shape that does not carry `model`). Pinned
+ * to Sonnet-tier so the meter is "honestly conservative" — close to the
+ * default dispatch lane for `reason` + `codegen` tags.
+ */
+const DEFAULT_PRICE = { inputUsdPerM: 3.0, outputUsdPerM: 15.0 };
+/**
+ * Look up the price for a model slug. Resolution order:
+ *  1. Exact match in `PRICE_LADDER`.
+ *  2. Family-prefix match (`startsWith`).
+ *  3. Default Sonnet-tier rate.
+ *
+ * Pure — never throws. The cost meter calls this on every `agent.tokens`
+ * frame so it must stay branch-cheap.
+ */
+export function priceForModel(model) {
+    if (!model || typeof model !== 'string')
+        return DEFAULT_PRICE;
+    const exact = PRICE_LADDER.get(model);
+    if (exact)
+        return exact;
+    for (const [prefix, price] of FAMILY_PREFIX) {
+        if (model.startsWith(prefix))
+            return price;
+    }
+    return DEFAULT_PRICE;
+}
+/**
+ * Compute the USD cost for a single (input, output, model) triple.
+ * Returns a finite number, never NaN/Infinity, capped at zero floor so
+ * a buggy upstream that emits negative deltas (theoretically impossible
+ * via Anvil but we stay defensive) does not credit the operator's meter.
+ *
+ * Pure, deterministic, branch-cheap — called on every `agent.tokens`
+ * event so the hot path keeps the math inline.
+ */
+export function computeCostUsd(tokensIn, tokensOut, model) {
+    const price = priceForModel(model);
+    const safeIn = Number.isFinite(tokensIn) && tokensIn > 0 ? tokensIn : 0;
+    const safeOut = Number.isFinite(tokensOut) && tokensOut > 0 ? tokensOut : 0;
+    const usd = (safeIn * price.inputUsdPerM + safeOut * price.outputUsdPerM) / 1_000_000;
+    return Number.isFinite(usd) && usd > 0 ? usd : 0;
+}
+/**
+ * Format a token count for the status row. Spec (CEO):
+ *  - `<1000` → raw integer (e.g. `42`)
+ *  - `≥1000` → one-decimal `k` (e.g. `1.2k`)
+ *  - `≥1_000_000` → one-decimal `m` (e.g. `1.0m`)
+ *
+ * Negative / NaN inputs render as `0`.
+ */
+export function formatTokens(value) {
+    if (!Number.isFinite(value) || value <= 0)
+        return '0';
+    if (value < 1_000)
+        return Math.floor(value).toString();
+    if (value < 1_000_000)
+        return `${(value / 1_000).toFixed(1)}k`;
+    return `${(value / 1_000_000).toFixed(1)}m`;
+}
+/**
+ * Format USD cost for the status row. Spec (CEO):
+ *  - `≥ $0.01` → `$X.XX` (two decimals)
+ *  - `< $0.01` (but > 0) → `$X.XXX` (three decimals, shows fractions
+ *    of a cent honestly instead of rounding to `$0.00`)
+ *  - `0` / NaN → `$0.00`
+ */
+export function formatCostUsd(usd) {
+    if (!Number.isFinite(usd) || usd <= 0)
+        return '$0.00';
+    if (usd >= 0.01)
+        return `$${usd.toFixed(2)}`;
+    return `$${usd.toFixed(3)}`;
+}
+/**
+ * Format an elapsed-ms duration as `1m2s` / `45s` / `2h3m`. Used by the
+ * status row's session-duration slot. Floors aggressively — we don't
+ * want sub-second decimals stealing column width.
+ */
+export function formatDuration(elapsedMs) {
+    if (!Number.isFinite(elapsedMs) || elapsedMs <= 0)
+        return '0s';
+    const totalSec = Math.floor(elapsedMs / 1000);
+    if (totalSec < 60)
+        return `${totalSec}s`;
+    const min = Math.floor(totalSec / 60);
+    const sec = totalSec % 60;
+    if (min < 60)
+        return `${min}m${sec.toString().padStart(2, '0')}s`;
+    const hr = Math.floor(min / 60);
+    const restMin = min % 60;
+    return `${hr}h${restMin.toString().padStart(2, '0')}m`;
+}
+//# sourceMappingURL=model-pricing.js.map