@runuai/host 0.9.166 → 0.9.168

package/lib/agents/codex.ts

@@ -56,11 +56,11 @@ import type {
 
 // The model list is host-agent/src/engine-models.ts (CODEX_MODELS).
 
-// gpt-5.6-sol is Codex's current frontier coding model (the CLI default).
+// gpt-6.1-sol is Codex's current workhorse coding model (the CLI default).
 // Update alongside CODEX_MODELS. When an agent's model is null the adapter
 // omits the override entirely and Codex uses the user's own configured
 // default.
-const CODEX_DEFAULT_MODEL = "gpt-5.6-sol";
+const CODEX_DEFAULT_MODEL = "gpt-6.1-sol";
 
 // Reasoning levels set via `-c model_reasoning_effort=<level>`. "xhigh" is
 // the picker's "Extra high"; gpt-5.6 added "max" and "ultra" (ultra =

package/lib/agents/cursor-period-usage.ts

@@ -0,0 +1,253 @@
+/**
+ * Cursor account room, read from the same dashboard calls the CLI's `/usage`
+ * screen uses. The headless stream does not report it.
+ *
+ * The CLI session access token (not the user API key, and not a team admin
+ * key) calls `aiserver.v1.DashboardService/GetPlanInfo` and
+ * `GetCurrentPeriodUsage` on api2.cursor.sh. A failure, a missing token, or a
+ * shape we do not recognise produces no report. Nothing here logs the token,
+ * an email, or a user id.
+ */
+
+import type { TaskEnvironmentAgentSessionSurface } from "../task-environment/types";
+import type { AgentAccountUsage } from "./types";
+
+/** Same lines Codex uses for a window that is full or close to full. */
+export const CURSOR_PERIOD_WARNING_PERCENT = 90;
+export const CURSOR_PERIOD_LIMITED_PERCENT = 100;
+
+/** One probe per leased credential, including a failed one. */
+export const CURSOR_PERIOD_PROBE_INTERVAL_MS = 5 * 60 * 1000;
+
+/** One bound for the whole probe: reading auth.json and both dashboard calls.
+ *  A hung read must not hold turn_complete after the CLI has finished. */
+export const CURSOR_PERIOD_PROBE_TIMEOUT_MS = 4_000;
+
+export const CURSOR_PERIOD_USAGE_LOG = "cursor period usage unavailable";
+
+export const CURSOR_AUTH_JSON = "/home/node/.config/cursor/auth.json";
+
+const DASHBOARD_ORIGIN = "https://api2.cursor.sh";
+const WEEKLY_PERIOD = "INCLUDED_USAGE_PERIOD_WEEKLY";
+const WEEK_MINUTES = 7 * 24 * 60;
+
+const probedAt = new Map<string, number>();
+
+/** Whether this credential may be probed at `now`. */
+export function cursorPeriodProbeDue(credentialId: string, now: number): boolean {
+  const at = probedAt.get(credentialId);
+  return at === undefined || now - at >= CURSOR_PERIOD_PROBE_INTERVAL_MS;
+}
+
+/** Count a probe, successful or not, so the next one waits out the interval. */
+export function markCursorPeriodProbed(credentialId: string, now: number): void {
+  probedAt.set(credentialId, now);
+}
+
+/** Test hook. Production never clears the gate except by process restart. */
+export function resetCursorPeriodProbes(): void {
+  probedAt.clear();
+}
+
+/** The CLI session access token from `auth.json`, or null. The raw file is not returned. */
+export function cursorAccessTokenFromAuthJson(text: string): string | null {
+  try {
+    const parsed: unknown = JSON.parse(text);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const token = (parsed as { accessToken?: unknown }).accessToken;
+    return typeof token === "string" && token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
+
+function isObj(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function epochMs(value: unknown): number | undefined {
+  const n =
+    typeof value === "number"
+      ? value
+      : typeof value === "string" && /^[0-9]+$/.test(value)
+        ? Number(value)
+        : Number.NaN;
+  return Number.isSafeInteger(n) && n > 0 ? n : undefined;
+}
+
+/** A 0–100 share, as the dashboard sends it. Anything else is not a window. */
+function percent(value: unknown): number | undefined {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > 100) {
+    return undefined;
+  }
+  return value;
+}
+
+function onDemandSpend(period: Record<string, unknown>): boolean {
+  if (!isObj(period.spendLimitUsage)) return false;
+  for (const key of ["individualUsed", "pooledUsed", "totalSpend", "overallUsed"]) {
+    const value = period.spendLimitUsage[key];
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) return true;
+  }
+  return false;
+}
+
+/**
+ * Map a GetPlanInfo body and a GetCurrentPeriodUsage body into one account
+ * observation. Null when the percent fields are missing or not 0–100, so a
+ * schema change sends nothing.
+ */
+export function mapCursorPeriodUsage(
+  plan: unknown,
+  period: unknown,
+  observedAt: number,
+): AgentAccountUsage | null {
+  if (!isObj(period) || !isObj(period.planUsage)) return null;
+  const total = percent(period.planUsage.totalPercentUsed);
+  const api = percent(period.planUsage.apiPercentUsed);
+  if (total === undefined || api === undefined) return null;
+
+  const planInfo = isObj(plan) && isObj(plan.planInfo) ? plan.planInfo : {};
+  const weekly = planInfo.includedUsagePeriod === WEEKLY_PERIOD;
+  const resetsAt = epochMs(planInfo.includedUsageResetsAt);
+  const window = (name: string, usedPercent: number) => ({
+    window: name,
+    ...(weekly ? { windowMinutes: WEEK_MINUTES } : {}),
+    usedPercent,
+    ...(resetsAt === undefined ? {} : { resetsAt }),
+  });
+  const windows = [window("included", total), window("api", api)];
+  const limited = windows.filter((item) => item.usedPercent >= CURSOR_PERIOD_LIMITED_PERCENT);
+  const status =
+    limited.length > 0
+      ? "limited"
+      : windows.some((item) => item.usedPercent >= CURSOR_PERIOD_WARNING_PERCENT)
+        ? "warning"
+        : "allowed";
+  const limitedResets = limited
+    .map((item) => item.resetsAt)
+    .filter((reset): reset is number => reset !== undefined);
+  const usage: AgentAccountUsage = {
+    status,
+    ...(limitedResets.length > 0 ? { resetsAt: Math.max(...limitedResets) } : {}),
+    ...(onDemandSpend(period) ? { usingOverage: true } : {}),
+    windows,
+    source: "cursor-period-usage",
+    observedAt,
+    coverage: { kind: "all-windows" },
+  };
+  return usage;
+}
+
+export async function readCursorAuthFromEnvironment(
+  environment: TaskEnvironmentAgentSessionSurface,
+  signal?: AbortSignal,
+): Promise<string | null> {
+  if (signal?.aborted) return null;
+  let child: Awaited<ReturnType<TaskEnvironmentAgentSessionSurface["spawnSession"]>> | undefined;
+  const kill = (): void => {
+    if (!child) return;
+    void child.terminate("SIGKILL").catch(() => {});
+  };
+  signal?.addEventListener("abort", kill);
+  try {
+    child = await environment.spawnSession({
+      argv: ["cat", "--", CURSOR_AUTH_JSON],
+      user: "node",
+      projectEnvProfile: "task",
+      env: {},
+      maxOutputBytes: 32_768,
+    });
+    if (signal?.aborted) {
+      kill();
+      return null;
+    }
+    let text = "";
+    for await (const chunk of child.stdout) {
+      if (signal?.aborted) {
+        kill();
+        return null;
+      }
+      text += Buffer.from(chunk).toString("utf8");
+      if (text.length > 32_768) {
+        kill();
+        return null;
+      }
+    }
+    if (signal?.aborted) {
+      kill();
+      return null;
+    }
+    const exit = await child.completion;
+    return !signal?.aborted && exit.exitCode === 0 ? text : null;
+  } catch {
+    return null;
+  } finally {
+    signal?.removeEventListener("abort", kill);
+  }
+}
+
+async function postDashboard(
+  fetchImpl: typeof fetch,
+  token: string,
+  method: string,
+  signal: AbortSignal,
+): Promise<unknown | null> {
+  if (signal.aborted) return null;
+  try {
+    const response = await fetchImpl(
+      `${DASHBOARD_ORIGIN}/aiserver.v1.DashboardService/${method}`,
+      {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json",
+          "Connect-Protocol-Version": "1",
+        },
+        body: "{}",
+        signal,
+      },
+    );
+    if (response.status !== 200) return null;
+    return (await response.json()) as unknown;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read both dashboard methods and map them. Null on a non-200, a timeout, a
+ * bad body, or a shape we do not recognise. The token is sent only as the
+ * bearer for these two calls.
+ */
+export async function readCursorPeriodUsage(args: {
+  token: string;
+  fetchImpl?: typeof fetch;
+  timeoutMs?: number;
+  /** When set, this call does not start a second timer. The caller's deadline covers it. */
+  signal?: AbortSignal;
+  now?: number;
+}): Promise<AgentAccountUsage | null> {
+  const fetchImpl = args.fetchImpl ?? fetch;
+  const owned = new AbortController();
+  const onParentAbort = (): void => owned.abort();
+  if (args.signal) {
+    if (args.signal.aborted) owned.abort();
+    else args.signal.addEventListener("abort", onParentAbort);
+  }
+  const timer =
+    args.signal === undefined
+      ? setTimeout(() => owned.abort(), args.timeoutMs ?? CURSOR_PERIOD_PROBE_TIMEOUT_MS)
+      : undefined;
+  try {
+    const [plan, period] = await Promise.all([
+      postDashboard(fetchImpl, args.token, "GetPlanInfo", owned.signal),
+      postDashboard(fetchImpl, args.token, "GetCurrentPeriodUsage", owned.signal),
+    ]);
+    if (owned.signal.aborted || plan === null || period === null) return null;
+    return mapCursorPeriodUsage(plan, period, args.now ?? Date.now());
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+    args.signal?.removeEventListener("abort", onParentAbort);
+  }
+}

package/lib/agents/cursor.ts

@@ -4,7 +4,7 @@
  *
  *   CURSOR_API_KEY=… /home/node/.local/bin/cursor-agent -p "<prompt>" \
  *     --output-format stream-json --stream-partial-output --force --trust \
- *     -m <model> [--resume <sessionId>]
+ *     --model <model> [--resume <sessionId>]
  *
  * One-shot per turn (like Kimi/Grok); sends serialized; continuity via
  * `--resume <sessionId>` captured from the stream. Cursor's stream-json is
@@ -26,6 +26,9 @@
  * `--trust` (skip the workspace-trust prompt). Cursor has no system-prompt
  * flag, so the briefing folds into the first turn's prompt.
  */
+import { stripVTControlCharacters } from "node:util";
+
+import { ENGINE_ACCOUNT_ENV } from "../credential-consumers/engine-anchor";
 import { requireContainerRuntimeOperational } from "../runtime-guard";
 import type {
   TaskEnvironmentAgentSessionSurface,
@@ -38,8 +41,19 @@ import {
   spawnEnvironmentProcess,
   type AgentEnvironmentProcess,
 } from "./proc";
+import {
+  CURSOR_PERIOD_PROBE_TIMEOUT_MS,
+  CURSOR_PERIOD_USAGE_LOG,
+  cursorAccessTokenFromAuthJson,
+  cursorPeriodProbeDue,
+  markCursorPeriodProbed,
+  readCursorAuthFromEnvironment,
+  readCursorPeriodUsage,
+} from "./cursor-period-usage";
+import { rateLimitErrorUsage } from "./rate-limit";
 import { extractResultUsage } from "./usage";
 import type {
+  AgentAccountUsage,
   AgentEvent,
   AgentEventHandler,
   AgentKind,
@@ -57,19 +71,25 @@ const CURSOR_BIN = "/home/node/.local/bin/cursor-agent";
 export const CURSOR_SANDBOX_ENV_RESTORE =
   ". /usr/local/share/uai/env-hook.sh; __uai_env_sync";
 
-// A curated slice of Cursor's ~32 models (full ids from `cursor-agent
-// --list-models`). `auto` lets Cursor pick; the rest are the frontier. The UI
-// also accepts any typed id (unverified round-trip). UPDATE as Cursor's lineup
-// changes.
-const CURSOR_MODELS = [
-  "auto",
+// A curated fallback slice of Cursor's signed-in 2026.10.22 catalog. The
+// newest version of each tier comes first; older known-good ids follow.
+export const CURSOR_MODELS = [
+  "grok-4.7-high",
+  "grok-4.7-high-fast",
   "composer-2.5",
-  "claude-opus-4-8-thinking-high",
+  "composer-2.5-fast",
+  "claude-opus-5-5-high",
+  "claude-fable-5-1-thinking-high",
+  "claude-sonnet-5-5-high",
   "gpt-5.6-sol-high",
+  "gemini-4-argon-high",
+  "kimi-k3-high",
+  "auto",
+  "claude-opus-4-8-thinking-high",
   "cursor-grok-4.5-high",
   "claude-fable-5-thinking-high",
 ];
-const CURSOR_DEFAULT_MODEL = "auto";
+const CURSOR_DEFAULT_MODEL = "grok-4.7-high";
 const CURSOR_EFFORTS: string[] = []; // effort is baked into the model id
 
 // ---------------------------------------------------------------------------
@@ -99,12 +119,30 @@ export interface MappedCursorLine {
   finalText?: string;
   sessionId?: string;
   errorText?: string;
-  /** Token/cost from the result envelope — Cursor uses the Claude-compatible
-   *  shape (usage + total_cost_usd + modelUsage). ADR-071 metering. */
+  /** This model needs paid Cursor credits; the account itself is still usable. */
+  creditRefusal?: boolean;
+  /** Set when `errorText` is a usage cap. Secret-free; source `error-text`. */
+  accountUsage?: AgentAccountUsage;
+  /** Tokens from the result envelope. Claude-shaped lines carry cost;
+   *  cursor-agent 2026.10.x carries camelCase counts and no cost. */
   usage?: AgentUsage;
 }
 
-export function mapCursorLine(line: string): MappedCursorLine {
+/** Cursor Premium can refuse one paid-credit model while the same account can
+ * still run Cursor's Grok and Composer models. This is not account exhaustion:
+ * keep it non-retryable so the orchestrator neither rotates nor cools the
+ * account, and give the person an actionable model-specific error. */
+export function cursorCreditsRequiredMessage(message: string): string | null {
+  const match = stripVTControlCharacters(message).match(
+    /(?:ActionRequiredError:\s*)?([^\r\n]+?)\s+is not included in your weekly usage\b/i,
+  );
+  const model = match?.[1]?.trim();
+  return model
+    ? `${model} needs Cursor credits on this plan; use a Grok or Composer model`
+    : null;
+}
+
+export function mapCursorLine(line: string, now: number = Date.now()): MappedCursorLine {
   const t = line.trim();
   if (!t.startsWith("{")) return {};
   let m: Record<string, unknown>;
@@ -141,15 +179,23 @@ export function mapCursorLine(line: string): MappedCursorLine {
   }
   if (m.type === "result") {
     const errored = m.is_error === true;
+    const rawErrorText = errored
+      ? typeof m.result === "string"
+        ? m.result
+        : "cursor turn failed"
+      : undefined;
+    const creditError = rawErrorText
+      ? cursorCreditsRequiredMessage(rawErrorText)
+      : null;
+    const errorText = creditError ?? rawErrorText;
+    const accountUsage = errorText ? rateLimitErrorUsage(errorText, now) : null;
     return {
       end: true,
       sessionId: typeof m.session_id === "string" ? m.session_id : undefined,
       finalText: typeof m.result === "string" ? m.result : undefined,
-      errorText: errored
-        ? typeof m.result === "string"
-          ? m.result
-          : "cursor turn failed"
-        : undefined,
+      errorText,
+      ...(creditError ? { creditRefusal: true } : {}),
+      ...(accountUsage ? { accountUsage } : {}),
       usage: extractResultUsage(m),
     };
   }
@@ -175,6 +221,9 @@ export class CursorSession implements AgentSession {
   private readonly agentEnv: Record<string, string>;
   private readonly spawner: Spawner;
   private readonly apiKey: string;
+  private readonly readAuthFile: (signal: AbortSignal) => Promise<string | null>;
+  private readonly fetchImpl: typeof fetch;
+  private readonly probeTimeoutMs: number;
 
   private readonly handlers = new Set<AgentEventHandler>();
   private sessionId: string | null = null;
@@ -191,6 +240,14 @@ export class CursorSession implements AgentSession {
     agentEnv?: Record<string, string>;
     spawner?: Spawner;
     apiKey?: string;
+    /** Reads the CLI's auth.json from the task environment. Tests inject this.
+     *  The signal aborts when the probe deadline passes; the default reader
+     *  kills the auth process. */
+    readAuthFile?: (signal: AbortSignal) => Promise<string | null>;
+    /** Dashboard fetch. Tests inject this. Production uses the host's fetch. */
+    fetchImpl?: typeof fetch;
+    /** Whole-probe bound, including the auth.json read. Tests shrink it. */
+    probeTimeoutMs?: number;
   }) {
     this.agentId = args.agent.id;
     this.environment = args.environment;
@@ -205,6 +262,72 @@ export class CursorSession implements AgentSession {
     // key is usually absent anyway.
     this.apiKey =
       args.apiKey ?? this.agentEnv.CURSOR_API_KEY ?? process.env.CURSOR_API_KEY ?? "";
+    this.readAuthFile =
+      args.readAuthFile ?? ((signal) => readCursorAuthFromEnvironment(this.environment, signal));
+    this.fetchImpl = args.fetchImpl ?? fetch;
+    this.probeTimeoutMs = args.probeTimeoutMs ?? CURSOR_PERIOD_PROBE_TIMEOUT_MS;
+  }
+
+  /**
+   * One dashboard probe for a leased account. The read runs after the CLI
+   * child has exited: the CLI rewrites ~/.config/cursor/auth.json at
+   * startup, and a probe overlapped with the turn reads the expired access
+   * token. A missing lease, a probe still inside the five-minute gate, or
+   * any failure sends nothing. The token never leaves this method except
+   * as the bearer of the two dashboard calls.
+   *
+   * The credential is marked before the first await. Two sessions that start
+   * together must not both pass the gate. The returned function is the read;
+   * call it once the child has exited, still before turn_complete.
+   */
+  private probePeriodUsage(): () => Promise<void> {
+    const skip = (): Promise<void> => Promise.resolve();
+    const credentialId = this.agentEnv[ENGINE_ACCOUNT_ENV];
+    if (!credentialId || this.closed) return skip;
+    const now = Date.now();
+    if (!cursorPeriodProbeDue(credentialId, now)) return skip;
+    markCursorPeriodProbed(credentialId, now);
+    return () => this.readPeriodUsage();
+  }
+
+  /** Auth read and both dashboard calls share one deadline. On expiry the
+   *  auth reader is aborted (the default reader kills its process) and this
+   *  promise settles so turn_complete is not held. */
+  private readPeriodUsage(): Promise<void> {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.probeTimeoutMs);
+    let finished = false;
+    const usagePromise = this.collectPeriodUsage(controller.signal);
+    return new Promise((resolve) => {
+      const finish = (usage: AgentAccountUsage | null): void => {
+        if (finished) return;
+        finished = true;
+        clearTimeout(timer);
+        if (!this.closed) {
+          if (!usage) console.warn(CURSOR_PERIOD_USAGE_LOG);
+          else this.emit({ type: "account_usage", usage });
+        }
+        resolve();
+      };
+      controller.signal.addEventListener("abort", () => finish(null));
+      void usagePromise.then(
+        (usage) => finish(controller.signal.aborted ? null : usage),
+        () => finish(null),
+      );
+    });
+  }
+
+  private async collectPeriodUsage(signal: AbortSignal): Promise<AgentAccountUsage | null> {
+    if (signal.aborted) return null;
+    const raw = await this.readAuthFile(signal);
+    if (signal.aborted) return null;
+    const token = raw ? cursorAccessTokenFromAuthJson(raw) : null;
+    if (!token) return null;
+    return readCursorPeriodUsage({
+      token,
+      fetchImpl: this.fetchImpl,
+      signal,
+    });
   }
 
   onEvent(handler: AgentEventHandler): () => void {
@@ -227,6 +350,7 @@ export class CursorSession implements AgentSession {
   private buildRequest(prompt: string): TaskEnvironmentSessionRequest {
     const argv = [
       CURSOR_BIN,
+      "--disable-auto-update",
       "-p",
       prompt,
       "--output-format",
@@ -236,7 +360,9 @@ export class CursorSession implements AgentSession {
       "--trust", // skip the workspace-trust prompt in headless
       "--approve-mcps", // load the gateway MCP servers from ~/.cursor/mcp.json (ADR-057)
     ];
-    if (this.model && this.model !== "auto") argv.push("-m", this.model);
+    // Long form only: the pinned CLI (2026.08.25) and its successors have no
+    // `-m` short flag and exit on it before the turn starts.
+    if (this.model && this.model !== "auto") argv.push("--model", this.model);
     if (this.sessionId) argv.push("--resume", this.sessionId);
     return {
       argv: argv as [string, ...string[]],
@@ -266,6 +392,9 @@ export class CursorSession implements AgentSession {
 
     const child = this.spawner(this.buildRequest(prompt));
     this.current = child;
+    // Mark the gate now, before the child-exit await. The read itself waits
+    // until the CLI has rewritten auth.json.
+    const periodUsage = this.probePeriodUsage();
 
     let acc = "";
     let sawText = false;
@@ -273,6 +402,13 @@ export class CursorSession implements AgentSession {
     // Usage rides the result line but turn_complete fires on process exit;
     // capture it here and attach it below (ADR-071 metering).
     let turnUsage: AgentUsage | undefined;
+    // A result line that already explained the failure owns the error. The
+    // exit path must not add a second "cursor exited N" for the same turn.
+    // A usage cap is tracked on its own: a generic JSON error must not hide
+    // a cap that only shows up on stderr.
+    let sawError = false;
+    let reportedRateLimit = false;
+    let reportedCreditRefusal = false;
     const consume = (chunk: string): void => {
       buf += chunk;
       let nl: number;
@@ -318,7 +454,24 @@ export class CursorSession implements AgentSession {
         }
         if (m.end) {
           if (m.usage) turnUsage = m.usage;
-          if (m.errorText) this.emit({ type: "error", message: m.errorText });
+          if (m.errorText) {
+            sawError = true;
+            if (m.creditRefusal) reportedCreditRefusal = true;
+            if (m.accountUsage) {
+              reportedRateLimit = true;
+              this.emit({ type: "account_usage", usage: m.accountUsage });
+              this.emit({
+                type: "error",
+                message: m.errorText,
+                retryable: "rate_limit",
+                ...(m.accountUsage.resetsAt === undefined
+                  ? {}
+                  : { resetsAt: m.accountUsage.resetsAt }),
+              });
+            } else {
+              this.emit({ type: "error", message: m.errorText });
+            }
+          }
           const finalText = m.finalText ?? acc;
           if (sawText || finalText) {
             this.emit({ type: "message_complete", text: finalText });
@@ -340,18 +493,41 @@ export class CursorSession implements AgentSession {
         if (spawnErr) {
           this.emit({ type: "error", message: `cursor spawn failed: ${spawnErr}` });
         } else if (code !== 0) {
-          const tail = stderr.trim().slice(-500);
-          this.emit({
-            type: "error",
-            message: `cursor exited ${code ?? "null"}${tail ? `: ${tail}` : ""}`,
-          });
+          // Some cursor-agent errors (e.g. an invalid key) are coloured; strip
+          // the escape codes so the cap check and the error a human sees are
+          // plain text. A generic result error must not skip this check.
+          const plain = stripVTControlCharacters(stderr);
+          const tail = plain.trim().slice(-500);
+          const creditRefusal = cursorCreditsRequiredMessage(plain);
+          const message =
+            creditRefusal ??
+            `cursor exited ${code ?? "null"}${tail ? `: ${tail}` : ""}`;
+          const accountUsage = reportedRateLimit ? undefined : rateLimitErrorUsage(plain);
+          if (accountUsage) {
+            this.emit({ type: "account_usage", usage: accountUsage });
+          }
+          if (!sawError || (creditRefusal && !reportedCreditRefusal)) {
+            if (accountUsage) {
+              this.emit({
+                type: "error",
+                message,
+                retryable: "rate_limit",
+                ...(accountUsage.resetsAt === undefined
+                  ? {}
+                  : { resetsAt: accountUsage.resetsAt }),
+              });
+            } else {
+              this.emit({ type: "error", message });
+            }
+          }
         }
-        this.emit({ type: "turn_complete", usage: turnUsage });
         resolve();
       };
       child.on("exit", (code) => finish(code));
       child.on("error", (err) => finish(null, err.message));
     });
+    await periodUsage();
+    if (!this.closed) this.emit({ type: "turn_complete", usage: turnUsage });
   }
 
   async interrupt(): Promise<void> {

package/lib/agents/durable-proc.ts

@@ -1,3 +1,5 @@
+import { StringDecoder } from "node:string_decoder";
+import { agentOutputSource } from "./output-source";
 /**
  * DurableProcess (ADR-061) — LineProcess's durable twin. Instead of holding
  * the agent CLI's pipes, it talks to the in-container runner
@@ -84,6 +86,8 @@ export class DurableProcess {
   private readonly inbox: readonly string[];
   private readonly heartbeat: readonly string[];
 
+  private readonly decoder = new StringDecoder("utf8");
+  private lineOffset = 0;
   private readonly lineHandlers = new Set<LineHandler>();
   private readonly exitHandlers = new Set<ExitHandler>();
 
@@ -108,6 +112,7 @@ export class DurableProcess {
     this.inbox = [...opts.sessionFiles.parts, "inbox.jsonl"];
     this.heartbeat = [...opts.sessionFiles.parts, "heartbeat"];
     this.offset = opts.initialOutboxOffset ?? 0;
+    this.lineOffset = this.offset;
     this.onOffsetAdvance = opts.onOffsetAdvance ?? null;
     this.onCloseRequested = opts.onCloseRequested ?? null;
     if (opts.ready) {
@@ -156,7 +161,7 @@ export class DurableProcess {
         if (read === null) break; // outbox not created yet
         if (read.bytes.length === 0) break;
         this.offset += read.bytes.length;
-        this.lineBuf += read.bytes.toString("utf8");
+        this.lineBuf += this.decoder.write(read.bytes);
         this.drainLines();
         if (this.offset >= read.size) break;
       }
@@ -171,7 +176,7 @@ export class DurableProcess {
     }
     if (this.offset !== before && this.onOffsetAdvance && !this.closed) {
       try {
-        this.onOffsetAdvance(this.offset);
+        this.onOffsetAdvance(this.lineOffset);
       } catch {
         // Persistence hiccup — the next batch retries with a larger offset.
       }
@@ -182,7 +187,9 @@ export class DurableProcess {
   private drainLines(): void {
     let nl: number;
     while ((nl = this.lineBuf.indexOf("\n")) >= 0) {
-      const line = this.lineBuf.slice(0, nl).trim();
+      const rawLine = this.lineBuf.slice(0, nl);
+      this.lineOffset += Buffer.byteLength(rawLine) + 1;
+      const line = rawLine.trim();
       this.lineBuf = this.lineBuf.slice(nl + 1);
       if (line.length === 0) continue;
       if (line.startsWith('{"__uai"')) {
@@ -192,7 +199,7 @@ export class DurableProcess {
       if (this.debug) this.log(`<- ${line.slice(0, 1000)}`);
       for (const h of this.lineHandlers) {
         try {
-          h(line);
+          agentOutputSource.run(this.durableSessionDir + ":" + this.lineOffset, () => h(line));
         } catch {
           // A broken handler must not wedge the tail loop.
         }
@@ -293,7 +300,7 @@ export class DurableProcess {
 
   /** Consumed-outbox byte offset — persist this to survive host restarts. */
   get outboxOffset(): number {
-    return this.offset;
+    return this.lineOffset;
   }
 
   /**