@pugi/cli 0.1.0-beta.12 → 0.1.0-beta.13

package/dist/core/repl/session.js

@@ -39,6 +39,7 @@ import { existsSync, readdirSync, statSync } from 'node:fs';
 import { resolve as resolvePath } from 'node:path';
 import { CancellationToken } from './cancellation.js';
 import { DispatchFSM } from './dispatch-fsm.js';
+import { computeCostUsd, formatCostUsd, formatTokens } from './model-pricing.js';
 const MAX_TRANSCRIPT_ROWS = 500;
 const MAX_TOOL_CALLS = 200;
 const MAX_RECONNECT_ATTEMPTS = 10;
@@ -315,6 +316,19 @@ export class ReplSession {
             toolCalls: [],
             transcript: [],
             tokensDownstreamTotal: 0,
+            // α7 cost-meter sprint — cost accumulators land at zero on boot.
+            // `sessionStartedAtEpochMs` is set at construction time (vs the
+            // server-side `agent.session.opened` event) so the elapsed slot
+            // on the status row starts ticking the moment the REPL mounts.
+            sessionTokensIn: 0,
+            sessionTokensOut: 0,
+            sessionCostUsd: 0,
+            sessionStartedAtEpochMs: this.now(),
+            recentTurns: [],
+            turnTokensIn: 0,
+            turnTokensOut: 0,
+            turnCostUsd: 0,
+            lastTurnDelta: null,
             briefStartedAtEpochMs: undefined,
             pendingAsk: null,
             pendingAskSource: null,
@@ -322,6 +336,7 @@ export class ReplSession {
             pendingPlanReviewSource: null,
             dispatchState: 'idle',
             dispatchToolLabel: null,
+            lastCompletedOutcome: null,
         };
         // α6.9: mirror every FSM transition into the public state so the
         // status-bar surface can rerender on the next frame. Local listener
@@ -359,6 +374,7 @@ export class ReplSession {
                 apiUrl: this.options.apiUrl,
                 apiKey: this.options.apiKey,
                 workspace: this.options.workspace,
+                cyberZoo: this.options.cyberZoo,
             });
             this.patch({ sessionId, connection: 'connecting' });
             this.openStream();
@@ -617,6 +633,10 @@ export class ReplSession {
                 this.dispatchCost();
                 return verdict;
             }
+            case 'quota': {
+                await this.dispatchQuota();
+                return verdict;
+            }
             case 'status': {
                 this.dispatchStatus();
                 return verdict;
@@ -709,6 +729,42 @@ export class ReplSession {
                 }
                 return verdict;
             }
+            case 'mcp': {
+                // β4 Sl7 (2026-05-26): /mcp [sub] [args...] forwards to the
+                // runtime command. We deliberately route through the same
+                // entry-point used by `pugi mcp` from a fresh shell so the
+                // surface stays single-sourced. `serve` is refused inline —
+                // booting an MCP server inside an active REPL would compete
+                // with the REPL itself for stdio, which is exactly the wrong
+                // thing to do.
+                if (verdict.args[0] === 'serve') {
+                    this.appendSystemLine('/mcp serve is not safe inside the REPL (it competes for stdio). ' +
+                        'Run `pugi mcp serve` from a fresh shell instead.');
+                    return verdict;
+                }
+                try {
+                    const { runMcpCommand } = await import('../../runtime/commands/mcp.js');
+                    const lines = [];
+                    await runMcpCommand(verdict.args, {
+                        workspaceRoot: process.cwd(),
+                        writeOutput: (_payload, text) => {
+                            const trimmed = text.replace(/\n+$/u, '');
+                            if (trimmed.length > 0)
+                                lines.push(trimmed);
+                        },
+                    });
+                    for (const line of lines)
+                        this.appendSystemLine(line);
+                    if (lines.length === 0) {
+                        this.appendSystemLine('/mcp: no output.');
+                    }
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    this.appendSystemLine(`/mcp failed: ${message}`);
+                }
+                return verdict;
+            }
             case 'stub': {
                 this.appendSystemLine(verdict.message);
                 return verdict;
@@ -997,13 +1053,90 @@ export class ReplSession {
         }
     }
     dispatchCost() {
-        const { tokensDownstreamTotal, agents } = this.state;
+        // α7 cost-meter sprint — full breakdown matching the TUI status row
+        // footer. The session totals line mirrors the footer format
+        // (`↑ <in> ↓ <out> · $X.XX · <elapsed>`) so the operator scans the
+        // same numbers in two places. Per-turn list shows the last 5 turns
+        // oldest → newest; an empty list renders one system line so the
+        // operator knows the surface is wired (`No completed turns yet.`).
+        const { sessionTokensIn, sessionTokensOut, sessionCostUsd, sessionStartedAtEpochMs, recentTurns, agents, } = this.state;
         const active = agents.filter((a) => a.status === 'queued' || a.status === 'thinking').length;
-        const lineTokens = `Tokens this session: ${tokensDownstreamTotal.toLocaleString()} (in+out).`;
-        const lineAgents = `Active dispatches: ${active} of cap.`;
-        this.appendSystemLine(lineTokens);
-        this.appendSystemLine(lineAgents);
-        this.appendSystemLine('Full per-persona budget breakdown lands in α6.5.');
+        const elapsedMs = Math.max(0, this.now() - sessionStartedAtEpochMs);
+        const elapsedLabel = formatElapsedShort(elapsedMs);
+        this.appendSystemLine(`Session: ↑ ${formatTokens(sessionTokensIn)} ↓ ${formatTokens(sessionTokensOut)} · ${formatCostUsd(sessionCostUsd)} · ${elapsedLabel}`);
+        this.appendSystemLine(`Active dispatches: ${active} of cap.`);
+        if (recentTurns.length === 0) {
+            this.appendSystemLine('No completed turns yet — brief the workforce to charge the meter.');
+            return;
+        }
+        this.appendSystemLine(`Recent turns (last ${recentTurns.length}):`);
+        for (let i = 0; i < recentTurns.length; i += 1) {
+            const turn = recentTurns[i];
+            const idx = (i + 1).toString().padStart(2, ' ');
+            this.appendSystemLine(`  ${idx}. ↑ ${formatTokens(turn.tokensIn)} ↓ ${formatTokens(turn.tokensOut)} · ${formatCostUsd(turn.costUsd)}`);
+        }
+    }
+    /**
+     * α7 cost-meter sprint — `/quota` slash handler. Fetches the live
+     * `/api/pugi/usage` snapshot and renders three lines: plan tier,
+     * monthly window, and per-counter `used/cap (pct%)`. Failure modes
+     * (offline, unauth, older admin-api) collapse to a single one-line
+     * `Could not fetch quota…` system message so the surface never throws
+     * from a keystroke handler.
+     *
+     * The fetch is best-effort with a 4s timeout — mirrors the `whoami`
+     * pattern in `runtime/cli.ts` so the operator gets the same UX on the
+     * REPL slash and the CLI command.
+     */
+    async dispatchQuota() {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 4000);
+        try {
+            const url = `${this.options.apiUrl.replace(/\/+$/, '')}/api/pugi/usage`;
+            const res = await fetch(url, {
+                method: 'GET',
+                headers: {
+                    authorization: `Bearer ${this.options.apiKey}`,
+                    accept: 'application/json',
+                },
+                signal: controller.signal,
+            });
+            if (!res.ok) {
+                this.appendSystemLine(`Could not fetch quota: HTTP ${res.status}.`);
+                return;
+            }
+            const body = (await res.json());
+            const tier = typeof body.tier === 'string' ? body.tier : '(unknown)';
+            const tierLabel = QUOTA_TIER_LABELS[tier] ?? tier;
+            const month = typeof body.billingMonth === 'string' ? body.billingMonth : '(unknown month)';
+            const resetAt = typeof body.resetAt === 'string' ? body.resetAt : null;
+            const resetLine = resetAt ? ` · resets ${formatResetWindow(resetAt, this.now())}` : '';
+            this.appendSystemLine(`Plan: ${tierLabel} · ${month}${resetLine}`);
+            const used = body.used ?? {};
+            const caps = body.quotas ?? {};
+            const counters = [
+                ['sync', used.sync, caps.sync],
+                ['review', used.review, caps.review],
+                ['engine', used.engine, caps.engine],
+            ];
+            for (const [name, value, cap] of counters) {
+                const v = typeof value === 'number' ? value : 0;
+                if (cap === null || cap === undefined) {
+                    this.appendSystemLine(`  ${name.padEnd(7, ' ')} ${v.toLocaleString()} / unlimited`);
+                }
+                else {
+                    const pct = cap > 0 ? Math.round((v / cap) * 100) : 0;
+                    this.appendSystemLine(`  ${name.padEnd(7, ' ')} ${v.toLocaleString()} / ${cap.toLocaleString()} (${pct}%)`);
+                }
+            }
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            this.appendSystemLine(`Could not fetch quota: ${msg}.`);
+        }
+        finally {
+            clearTimeout(timer);
+        }
     }
     dispatchStatus() {
         const sessionId = this.state.sessionId ?? '(unbound)';
@@ -1194,7 +1327,10 @@ export class ReplSession {
             this.appendSystemLine(capLine);
         }
         this.appendOperatorLine(brief);
-        this.patch({ briefStartedAtEpochMs: this.now() });
+        // Reset `lastCompletedOutcome` so a fresh dispatch does not
+        // inherit the prior turn's status-bar label (e.g. a stale
+        // "replied" sticking around while the next dispatch is in flight).
+        this.patch({ briefStartedAtEpochMs: this.now(), lastCompletedOutcome: null });
         // α6.9 + R3 P1 (Codex triple-review 2026-05-25): supersede the
         // prior dispatch when one is in flight. Steps in order:
         //
@@ -1521,6 +1657,7 @@ export class ReplSession {
                 apiUrl: this.options.apiUrl,
                 apiKey: this.options.apiKey,
                 workspace: this.options.workspace,
+                cyberZoo: this.options.cyberZoo,
             });
             this.patch({ sessionId, connection: 'connecting' });
             this.openStream();
@@ -1677,8 +1814,22 @@ export class ReplSession {
             }
             case 'agent.tokens': {
                 const delta = event.tokensIn + event.tokensOut;
+                // α7 cost-meter sprint — bind a client-side USD figure to this
+                // frame. The model slug rides on the event (optional for back-
+                // compat); the price ladder in `model-pricing.ts` falls back to
+                // a Sonnet-tier rate when the slug is missing, so the meter is
+                // always populated. Negative / NaN values are clamped to zero
+                // inside `computeCostUsd` so a buggy upstream never credits the
+                // meter.
+                const deltaCostUsd = computeCostUsd(event.tokensIn, event.tokensOut, event.model);
                 this.patch({
                     tokensDownstreamTotal: this.state.tokensDownstreamTotal + delta,
+                    sessionTokensIn: this.state.sessionTokensIn + event.tokensIn,
+                    sessionTokensOut: this.state.sessionTokensOut + event.tokensOut,
+                    sessionCostUsd: this.state.sessionCostUsd + deltaCostUsd,
+                    turnTokensIn: this.state.turnTokensIn + event.tokensIn,
+                    turnTokensOut: this.state.turnTokensOut + event.tokensOut,
+                    turnCostUsd: this.state.turnCostUsd + deltaCostUsd,
                     agents: this.state.agents.map((a) => a.taskId === event.taskId
                         ? {
                             ...a,
@@ -1698,10 +1849,36 @@ export class ReplSession {
                 }
                 this.askBuffer.delete(event.taskId);
                 this.askBufferPending.delete(event.taskId);
+                // Honour the work-done signal from admin-api.
+                // `outcome === 'replied'` means the turn was a pure text reply
+                // with no delegate XML and no tool call — render it as
+                // "replied" so the operator can tell the difference between
+                // "the orchestrator just talked" and "real work shipped".
+                // Older servers omit the field; default to 'shipped' so the
+                // existing wire stays back-compat.
+                const completedStatus = event.outcome === 'replied' ? 'replied' : 'shipped';
                 this.patch({
                     agents: this.state.agents.map((a) => a.taskId === event.taskId
-                        ? { ...a, status: 'shipped', detail: 'shipped' }
+                        ? { ...a, status: completedStatus, detail: completedStatus }
                         : a),
+                    // Mirror the outcome to top-level state so the status-bar
+                    // can render `replied` instead of the legacy `shipped`
+                    // label when the FSM lands in `completed`. Without this
+                    // the bottom-bar would still say "shipped" while the
+                    // agent-tree said "replied", restoring the same
+                    // contradiction this PR is fixing (Codex triple-review P2).
+                    //
+                    // r2: gate on the same stale-dispatch check that
+                    // advanceFsmOnDispatchEnd applies. If this completion
+                    // belongs to a SUPERSEDED dispatch (a newer dispatchBrief
+                    // already bumped dispatchSeq before this late terminal
+                    // arrived), don't let the status-bar label flip to the
+                    // stale outcome — the current turn is the live one.
+                    // The agent-tree row patch above is still safe because
+                    // it only updates the row keyed by taskId.
+                    ...(this.isStaleTaskEvent(event.taskId)
+                        ? {}
+                        : { lastCompletedOutcome: completedStatus }),
                 });
                 // α6.9: transition the FSM to `completed` when no other
                 // dispatch is still in flight. The check uses the agents list
@@ -1709,6 +1886,12 @@ export class ReplSession {
                 // the dispatch alive; the FSM only goes terminal when the last
                 // agent ships.
                 this.advanceFsmOnDispatchEnd('completed', 'agent_completed', event.taskId);
+                // α7 cost-meter sprint — flush the per-turn delta when the
+                // LAST agent settles. Decoupled from the FSM gate so a test
+                // fixture (or a single-agent dispatch that never reached
+                // `awaiting_response` — happens on instant SSE replay) still
+                // gets the row written into recentTurns + lastTurnDelta.
+                this.maybeFlushTurnOnAgentSettle(event.taskId);
                 if (target) {
                     // If the persona actually produced a reply via incremental
                     // agent.step events, render that reply in the transcript so
@@ -1774,6 +1957,10 @@ export class ReplSession {
                 // operator sees the bottom-bar settle back to `idle` after the
                 // last block clears.
                 this.advanceFsmOnDispatchEnd('completed', 'agent_blocked', event.taskId);
+                // α7 cost-meter sprint — flush the per-turn delta (blocked
+                // still counts as a billable turn — the operator paid for the
+                // tokens that landed before the refusal).
+                this.maybeFlushTurnOnAgentSettle(event.taskId);
                 return;
             }
             case 'agent.failed': {
@@ -1797,6 +1984,10 @@ export class ReplSession {
                 // `completed` so the bottom-bar surface tracks the dispatch
                 // collectively.
                 this.advanceFsmOnDispatchEnd('failed', 'agent_failed', event.taskId);
+                // α7 cost-meter sprint — flush the per-turn delta when the
+                // dispatch fails (the operator still paid for whatever tokens
+                // landed before the failure).
+                this.maybeFlushTurnOnAgentSettle(event.taskId);
                 return;
             }
         }
@@ -1835,13 +2026,25 @@ export class ReplSession {
      * after a manual `cancel()` finds the FSM already in `aborted` and
      * is silently dropped.
      */
+    /**
+     * 2026-05-26 — shared stale-task check used by both the FSM advance
+     * gate AND the status-bar `lastCompletedOutcome` mirror. Lifts the
+     * R2 dispatchSeq compare out of `advanceFsmOnDispatchEnd` so other
+     * agent.completed-handler side-effects (status-bar label, future
+     * metric counters) can apply the same guard without duplicating it.
+     * Returns true iff the task's stamped dispatchSeq is older than the
+     * current dispatchSeq — i.e. a newer dispatchBrief() superseded it
+     * and the late terminal event must not corrupt live-turn state.
+     */
+    isStaleTaskEvent(taskId) {
+        const taskSeq = this.taskDispatchSeq.get(taskId);
+        return taskSeq !== undefined && taskSeq < this.dispatchSeq;
+    }
     advanceFsmOnDispatchEnd(outcome, reason, taskId) {
         // R2 P1 fix (Codex triple-review 2026-05-25): a terminal event
         // for a SUPERSEDED dispatch must NOT advance the live FSM or null
-        // the live token. If the event carries a taskId and the stamped
-        // dispatchSeq for that task is older than the current dispatchSeq,
-        // the event belongs to a prior dispatch that was replaced by a
-        // newer `dispatchBrief()`. Silently drop the FSM advance.
+        // the live token. Delegates to isStaleTaskEvent so the agent.completed
+        // status-bar mirror in the handler above uses the same gate.
         if (taskId !== undefined) {
             const taskSeq = this.taskDispatchSeq.get(taskId);
             if (taskSeq !== undefined && taskSeq < this.dispatchSeq) {
@@ -1873,6 +2076,63 @@ export class ReplSession {
         this.currentDispatchToken = null;
         this.patch({ briefStartedAtEpochMs: undefined });
     }
+    /**
+     * α7 cost-meter sprint — gate the per-turn flush on "this was the
+     * LAST in-flight agent". Mirrors the `stillActive` guard inside
+     * `advanceFsmOnDispatchEnd` so a multi-agent dispatch only emits a
+     * single recentTurns row + a single lastTurnDelta flash.
+     *
+     * Idempotent: if no tokens have been billed this turn, the inner
+     * `flushTurnAccumulator` short-circuits without pushing an empty row.
+     */
+    maybeFlushTurnOnAgentSettle(taskId) {
+        const stillActive = this.state.agents.some((a) => a.status === 'queued' || a.status === 'thinking');
+        if (stillActive)
+            return;
+        this.flushTurnAccumulator(taskId);
+    }
+    /**
+     * α7 cost-meter sprint — flush the per-turn accumulator into
+     * `recentTurns` + `lastTurnDelta`. Idempotent + safe to call from any
+     * terminal-state branch (`agent.completed` / `agent.blocked` /
+     * `agent.failed`). When no tokens have been billed this turn
+     * (instant abort, cap-warning gate), the helper short-circuits
+     * without pushing an empty row.
+     */
+    flushTurnAccumulator(taskId) {
+        const turnTokensIn = this.state.turnTokensIn;
+        const turnTokensOut = this.state.turnTokensOut;
+        const turnCostUsd = this.state.turnCostUsd;
+        if (turnTokensIn === 0 && turnTokensOut === 0) {
+            // Idempotent zero-flush — never push an empty row into recentTurns.
+            return;
+        }
+        const turnId = taskId !== undefined ? taskId : `turn-${this.dispatchSeq}-${this.now()}`;
+        const newTurn = {
+            id: turnId,
+            tokensIn: turnTokensIn,
+            tokensOut: turnTokensOut,
+            costUsd: turnCostUsd,
+            completedAt: new Date(this.now()).toISOString(),
+        };
+        // Keep the buffer capped at 5 entries (oldest first). The push
+        // order matches the surface contract: `/cost` paginates oldest →
+        // newest so the operator scans top-down chronologically.
+        const recent = [...this.state.recentTurns, newTurn];
+        const trimmed = recent.length > 5 ? recent.slice(-5) : recent;
+        this.patch({
+            recentTurns: trimmed,
+            lastTurnDelta: {
+                tokensIn: turnTokensIn,
+                tokensOut: turnTokensOut,
+                costUsd: turnCostUsd,
+                completedAtEpochMs: this.now(),
+            },
+            turnTokensIn: 0,
+            turnTokensOut: 0,
+            turnCostUsd: 0,
+        });
+    }
     /* ------------- transcript helpers -------------- */
     /**
      * Look up the persona slug for a running task. Used by the tool call
@@ -2255,6 +2515,62 @@ function formatAgeSeconds(deltaMs) {
 export function knownRoles() {
     return listRoles();
 }
+/**
+ * α7 cost-meter sprint — render a session-elapsed ms delta as the
+ * status-row's compact `XmYs` / `XhYm` shape. Distinct from
+ * `formatAgeSeconds` above because `/cost` needs minute-granularity
+ * uniformly (operator wants `2m44s`, not `2m`). Pure / branch-cheap;
+ * the TUI status row + `/cost` both call this on every render.
+ */
+function formatElapsedShort(elapsedMs) {
+    if (!Number.isFinite(elapsedMs) || elapsedMs <= 0)
+        return '0s';
+    const totalSec = Math.floor(elapsedMs / 1000);
+    if (totalSec < 60)
+        return `${totalSec}s`;
+    const min = Math.floor(totalSec / 60);
+    const sec = totalSec % 60;
+    if (min < 60)
+        return `${min}m${sec.toString().padStart(2, '0')}s`;
+    const hr = Math.floor(min / 60);
+    const restMin = min % 60;
+    return `${hr}h${restMin.toString().padStart(2, '0')}m`;
+}
+/**
+ * α7 cost-meter sprint — public-facing tier labels for the `/quota`
+ * slash. Mirrors `TIER_PRICE_LABEL` in `runtime/cli.ts` (kept in sync
+ * via `pricing.spec.ts` gate). Falls through to the raw slug when an
+ * unknown tier ships from a forward-compat admin-api build.
+ */
+const QUOTA_TIER_LABELS = Object.freeze({
+    free: 'Free',
+    founder: 'Founder ($20/mo)',
+    builder: 'Builder ($99/mo)',
+    team: 'Team ($199/mo)',
+});
+/**
+ * α7 cost-meter sprint — render the time-until-reset window for the
+ * `/quota` plan line. `resetAt` is the ISO string admin-api returns;
+ * `now` is the current epoch ms (injected for test determinism). Falls
+ * back to the raw ISO string when parsing fails so the operator never
+ * sees an empty hint.
+ */
+function formatResetWindow(resetAtIso, nowEpochMs) {
+    const resetMs = Date.parse(resetAtIso);
+    if (!Number.isFinite(resetMs))
+        return resetAtIso;
+    const deltaMs = resetMs - nowEpochMs;
+    if (deltaMs <= 0)
+        return 'now';
+    const days = Math.floor(deltaMs / (24 * 60 * 60 * 1000));
+    if (days >= 2)
+        return `in ${days}d`;
+    const hours = Math.floor(deltaMs / (60 * 60 * 1000));
+    if (hours >= 1)
+        return `in ${hours}h`;
+    const minutes = Math.max(1, Math.floor(deltaMs / (60 * 1000)));
+    return `in ${minutes}m`;
+}
 /* ------------------------------------------------------------------ */
 /* Tool call synthesiser - α6.12                                      */
 /* ------------------------------------------------------------------ */

package/dist/core/repl/slash-commands.js

@@ -45,7 +45,9 @@ export const SLASH_STUB_MESSAGES = Object.freeze({
     // runtime but the type record stays exhaustive.
     privacy: '',
     budget: 'Run `pugi budget` from a fresh shell; in-REPL summary lands in α6.5.',
-    mcp: 'Run `pugi config mcp list` from a fresh shell; in-REPL palette lands in α6.5.',
+    // β4 Sl7 (2026-05-26): /mcp graduated from stub to a real handler
+    // that forwards to `runMcpCommand`. Stub message removed from the
+    // exhaustive record so the type narrows correctly.
     undo: 'Run `pugi undo` from a fresh shell; in-REPL undo lands in α6.5.',
 });
 export const SLASH_COMMAND_HELP = Object.freeze([
@@ -66,14 +68,15 @@ export const SLASH_COMMAND_HELP = Object.freeze([
     // Pugi tools
     { name: 'web', args: '<url>', gloss: 'Fetch a URL into context', group: 'Pugi tools' },
     { name: 'diff', args: '', gloss: 'Show pending diff', group: 'Pugi tools' },
-    { name: 'cost', args: '', gloss: 'Token usage + budget', group: 'Pugi tools' },
+    { name: 'cost', args: '', gloss: 'Session token + USD totals + last 5 turn breakdown', group: 'Pugi tools' },
+    { name: 'quota', args: '', gloss: 'Plan tier + monthly usage caps (sync / review / engine)', group: 'Pugi tools' },
     { name: 'status', args: '', gloss: 'Backend + tenant status', group: 'Pugi tools' },
     { name: 'consensus', args: '[ref]', gloss: '3-model consensus review (codex · claude · deepseek)', group: 'Pugi tools' },
     // Settings
     { name: 'config', args: '', gloss: 'Show config', group: 'Settings', stub: true },
     { name: 'privacy', args: '', gloss: 'Show privacy mode + contract', group: 'Settings' },
     { name: 'budget', args: '', gloss: 'Show usage budget', group: 'Settings', stub: true },
-    { name: 'mcp', args: '', gloss: 'List MCP servers', group: 'Settings', stub: true },
+    { name: 'mcp', args: '[sub]', gloss: 'MCP servers — list / trust / deny / install / serve / perms', group: 'Settings' },
     { name: 'undo', args: '', gloss: 'Undo last write', group: 'Settings', stub: true },
     // Meta
     { name: 'help', args: '', gloss: 'Show this help overlay', group: 'Meta' },
@@ -218,6 +221,10 @@ export function parseSlashCommand(input) {
         case 'cost': {
             return { kind: 'cost' };
         }
+        case 'quota':
+        case 'usage': {
+            return { kind: 'quota' };
+        }
         case 'status': {
             return { kind: 'status' };
         }
@@ -256,11 +263,18 @@ export function parseSlashCommand(input) {
             // skills.
             return { kind: 'init' };
         }
+        case 'mcp': {
+            // β4 Sl7: tokenize the tail. Empty tail -> `list` (matches CLI).
+            // Quoting / shell-escapes are NOT supported — the slash surface is
+            // intentionally simple; complex installs (env vars, multi-word
+            // args) go through `pugi mcp install` from a fresh shell.
+            const tokens = tail.length === 0 ? [] : tail.split(/\s+/).filter((s) => s.length > 0);
+            return { kind: 'mcp', args: tokens };
+        }
         case 'compact':
         case 'memory':
         case 'config':
         case 'budget':
-        case 'mcp':
         case 'undo': {
             const stubName = name;
             return {

package/dist/core/settings.js

@@ -28,6 +28,17 @@ const pugiSettingsSchema = z.object({
         telemetry: z.enum(['off', 'anonymous', 'community']).default('off'),
     })
         .default({}),
+    // beta.13 P1 fix 2026-05-26: ui.cyberZoo gates the cyber-zoo splash +
+    // ambient art in the REPL. Schema must declare the key explicitly
+    // because Zod's strip pass swallows unknown keys, which is how the
+    // initial `pugi init` write (which serialises `ui.cyberZoo`) was
+    // bypassed by the runtime reader — the value never made it past the
+    // schema gate so admin-api always saw the historical 'on' default.
+    ui: z
+        .object({
+        cyberZoo: z.enum(['on', 'off']).default('on'),
+    })
+        .default({}),
     artifacts: z
         .object({
         defaultPath: z.string().default('.pugi/artifacts'),
@@ -38,6 +49,12 @@ const pugiSettingsSchema = z.object({
     // fetcher. Default-off matches the spec posture; the schema must
     // declare it explicitly because Zod's strict-pass strips unknown
     // keys and would silently swallow the operator's intent.
+    //
+    // β1b T4 (2026-05-26): added `web.search.enabled` to gate the
+    // Brave-Search-backed `web_search` tool. Distinct from `web.fetch`
+    // because search queries themselves are an egress event that can
+    // leak operator intent — an operator may want fetch without
+    // implicitly enabling search-as-egress.
     web: z
         .object({
         fetch: z
@@ -45,6 +62,32 @@ const pugiSettingsSchema = z.object({
             enabled: z.boolean().optional(),
         })
             .optional(),
+        search: z
+            .object({
+            enabled: z.boolean().optional(),
+        })
+            .optional(),
+    })
+        .optional(),
+    // β7 L9 — per-language LSP toggle. When omitted, every supported
+    // server is available subject to binary detection on PATH. When
+    // present, only languages set to `true` are launched (false silently
+    // skips that language even if the binary is installed). Use this in
+    // workspaces where a heavyweight server (rust-analyzer indexing a
+    // monorepo, pyright on a fresh venv) wastes resources for the
+    // current task. The `pugi lsp servers` subcommand surfaces the
+    // current toggle state per server.
+    //
+    // Schema is intentionally permissive (`optional()` on the section AND
+    // on every per-language flag) so a partial config keeps the
+    // backwards-compatible "every language enabled" default.
+    lsp: z
+        .object({
+        typescript: z.boolean().optional(),
+        javascript: z.boolean().optional(),
+        python: z.boolean().optional(),
+        go: z.boolean().optional(),
+        rust: z.boolean().optional(),
     })
         .optional(),
     // β1 Pl9 (#74) — per-command budget overrides. Optional. Partial