@stigmer/runner 0.1.0-dev.20261017020314.g644422724c27

package/src/shared/context-bridge.ts

@@ -0,0 +1,51 @@
+/**
+ * The rollover context bridge.
+ *
+ * When a channel conversation's session hits its bounds (turn cap or
+ * inactivity window), the cloud broker rolls it over into a fresh session
+ * and stamps a compact digest of the previous conversation — subject plus
+ * the newest user/assistant exchanges — into the fresh session's
+ * `SessionSpec.metadata` under {@link CONTEXT_BRIDGE_METADATA_KEY}. Both
+ * harnesses read it here and present it as prompt context, so the user
+ * does not experience total amnesia at the rotation.
+ *
+ * The cloud composes the CONTENT; this module owns the PRESENTATION
+ * framing. Each harness wraps {@link formatContextBridgeText} in its own
+ * section syntax (XML tag for cursor's first-message prompt, markdown
+ * heading for the native system prompt).
+ */
+
+/**
+ * `SessionSpec.metadata` key carrying the bridge digest. Pinned verbatim
+ * to `ChannelRuntimeConstants.CONTEXT_BRIDGE_METADATA_KEY` in
+ * stigmer-cloud, with mirror guard tests on both sides — a drift degrades
+ * to a plain context reset (the bridge is simply never read), never worse.
+ */
+export const CONTEXT_BRIDGE_METADATA_KEY = "stigmer.ai/context-bridge";
+
+/**
+ * How the digest is introduced to the model, shared by both harnesses so
+ * the behavioral contract ("known background, don't announce it") cannot
+ * drift between them.
+ */
+const CONTEXT_BRIDGE_PREAMBLE =
+  "Background from your previous conversation with this user, carried over " +
+  "when the conversation was rotated. Treat it as context you already " +
+  "know; the user may continue as if nothing changed. Do not repeat it " +
+  "back or mention the rotation unless asked.";
+
+/**
+ * Read the bridge digest from a session's spec metadata map. Returns
+ * undefined when absent or blank — the caller renders no section.
+ */
+export function readContextBridge(
+  metadata: Record<string, string> | undefined,
+): string | undefined {
+  const value = metadata?.[CONTEXT_BRIDGE_METADATA_KEY]?.trim();
+  return value ? value : undefined;
+}
+
+/** The framed bridge body (preamble + digest), ready for section wrapping. */
+export function formatContextBridgeText(bridge: string): string {
+  return `${CONTEXT_BRIDGE_PREAMBLE}\n\n${bridge.trim()}`;
+}

package/src/shared/conversation-attachment.ts

@@ -0,0 +1,141 @@
+/**
+ * The runner-synthesized conversation participation attachment — a cheap
+ * local predicate,
+ * not the channel module's discovery machinery.
+ *
+ * When the session IS a live channel conversation, the runner
+ * synthesizes ONE MCP attachment serving `escalate_to_human`, so the
+ * agent can flag its own conversation for human attention
+ * (escalate-and-continue: the agent keeps serving; nothing is paged).
+ *
+ * The conditioning signal is two session resource labels, stamped
+ * server-side from the JWT on every channel-created Session, each
+ * answering its own question:
+ *
+ *   - `stigmer.ai/channel-id` answers "which channel serves this
+ *     session?". Every conversation a channel serves carries it, a
+ *     chat-link (web channel) guest session included, so it alone does
+ *     not say there is a provider conversation to escalate.
+ *   - `stigmer.ai/channel-conversation-key` answers "which provider
+ *     conversation is this?" (a Slack thread, a WhatsApp chat). Only a
+ *     Slack or WhatsApp conversation carries it; a chat-link session
+ *     never does.
+ *
+ * Escalation acts on exactly one provider conversation, so the tool
+ * attaches only when BOTH labels are present: a chat-link session, with
+ * the channel id and no conversation key, gets no tool. These are the
+ * same fields the cloud's channel messaging reach reads to answer exactly
+ * this question. They are deliberately NOT SessionSpec.metadata keys:
+ * none of those asserts "this is a channel conversation" (sender identity
+ * is who wrote, the bridge is rollover provenance), and a new key would
+ * reach existing live conversations only at rollover. The labels are not
+ * authorization — a spoofed label buys a tool the server refuses (the
+ * reach derives identity from the session token, never from labels the
+ * runner read).
+ *
+ * ONE connection shape — HTTP against the bridge's /conversation route
+ * with the execution's session-scoped credential as the Bearer token —
+ * and deliberately NO stdio fallback, diverging from both siblings:
+ * escalate is cloud-only (OSS refuses FAILED_PRECONDITION) AND
+ * session-token-only (a stdio child's startup API key carries no
+ * session_id claim, so even cloud would refuse PERMISSION_DENIED). A
+ * stdio shape would be a tool that can only fail; no bridge endpoint
+ * means honest absence instead.
+ *
+ * Also deliberately NO prompt section (the siblings' <available_*>
+ * pattern): the tool description carries the full when-to-use contract,
+ * and a standing section would spend every channel turn's context to
+ * restate what the tool listing already shows.
+ *
+ * Approval-free by construction, and FORCED, not convenient: channel
+ * surfaces run APPROVAL_MODE_UNATTENDED, where a gated tool resolves as
+ * skip-and-adapt — a gated escalation would never fire. It is no plugin's
+ * server, so the approval default reads no mark from it and cannot gate
+ * it, and its tools sit outside every tool list (see
+ * synthesized-attachment.ts). Callers inject AFTER resolve.
+ */
+
+import { CONVERSATION_MCP_SERVER } from "@stigmer/tool-vocabulary";
+
+import type { ResolvedMcpServer } from "./mcp-resolver.js";
+import type { SynthesizedAttachmentOptions } from "./synthesized-attachment.js";
+
+/**
+ * The synthesized attachment's slug. Reserved: no plugin server is named
+ * like it (theirs start `plugin_`), and one that were would be shadowed by
+ * the synthesized attachment, with a warning.
+ * Runner-internal (the resolved-server name and shadow key — the
+ * mcp-server never sees it); pinned by this module's test.
+ */
+export const CONVERSATION_ATTACHMENT_SLUG = CONVERSATION_MCP_SERVER;
+
+/**
+ * The bridge route serving the conversation-only roster. The cross-repo
+ * string: pinned here and in the mcp-server's conversation integration
+ * test — a drift strands every synthesized attachment on a 404.
+ */
+export const CONVERSATION_ROUTE = "/conversation";
+
+/**
+ * The session label naming the serving channel. Pinned verbatim to the
+ * cloud's channel runtime constant of the same name (mirror guard in this
+ * module's test and on the cloud's side). Drift degrades to honest
+ * absence — the tool silently stops attaching, escalation never fires
+ * from a tool that was never offered — never worse.
+ */
+export const CHANNEL_ID_LABEL = "stigmer.ai/channel-id";
+
+/**
+ * The session label naming the provider conversation (a Slack thread, a
+ * WhatsApp chat) the session serves. Pinned verbatim to the cloud's
+ * channel runtime constant CONVERSATION_KEY_LABEL, with the same
+ * honest-absence drift as {@link CHANNEL_ID_LABEL}.
+ */
+export const CONVERSATION_KEY_LABEL = "stigmer.ai/channel-conversation-key";
+
+/**
+ * Read the serving channel id of a session that is a live provider
+ * conversation: the channel id, present only when the conversation key is
+ * present too. A session serving a channel with no conversation key (a
+ * chat-link guest session) reads as absent, as do blank and
+ * whitespace-only values: the labels are stamped complete or not at all,
+ * and a blank one must not synthesize a tool.
+ */
+export function readChannelConversationId(
+  labels: Record<string, string> | undefined,
+): string | undefined {
+  const channelId = labels?.[CHANNEL_ID_LABEL]?.trim();
+  const conversationKey = labels?.[CONVERSATION_KEY_LABEL]?.trim();
+  if (channelId === undefined || channelId === "") return undefined;
+  if (conversationKey === undefined || conversationKey === "") return undefined;
+  return channelId;
+}
+
+/**
+ * Synthesize the conversation attachment for a channel-conversation
+ * session. Returns undefined when the session serves no channel
+ * conversation OR no bridge endpoint is configured (the deliberate
+ * no-stdio divergence — see the file header).
+ */
+export function synthesizeConversationAttachment(
+  channelId: string | undefined,
+  options: SynthesizedAttachmentOptions,
+): ResolvedMcpServer | undefined {
+  if (channelId === undefined) {
+    return undefined;
+  }
+  if (options.bridgeEndpoint === null || options.bridgeEndpoint === "") {
+    return undefined;
+  }
+
+  // Approval-free by construction: see file header.
+  return {
+    slug: CONVERSATION_ATTACHMENT_SLUG,
+    home: { kind: "platform" },
+    connectionType: "http",
+    url: options.bridgeEndpoint.replace(/\/+$/, "") + CONVERSATION_ROUTE,
+    headers: options.credential !== null && options.credential !== ""
+      ? { Authorization: `Bearer ${options.credential}` }
+      : undefined,
+  };
+}

package/src/shared/conversation-catchup.ts

@@ -0,0 +1,93 @@
+/**
+ * Conversation catchup: what happened on
+ * a live channel conversation that the agent has not seen — customer messages
+ * handled by a human teammate, the teammate's replies, platform notices,
+ * notes, and the agent's own earlier escalations. A line
+ * whose send is known-undelivered carries a `(not delivered)` speaker
+ * annotation and an in-flight one carries `(sending)` — the digest no longer
+ * implies every public-lane line reached the customer. The
+ * digest also closes the feedback loop on send OUTCOMES: the agent's own
+ * dead-lettered sends surface as `You (not delivered):` lines, and a send
+ * that failed only after an earlier digest already conveyed it surfaces as a
+ * `System:` delivery-failure notice at the moment the failure became known.
+ *
+ * The cloud composes the CONTENT (bare `Customer:` / `Teammate:` / `System:` /
+ * `You escalated:` / `Note:` lines, oldest first) on the execution spec's
+ * `conversation_catchup` field, fresh per turn. This module owns the
+ * PRESENTATION framing; the digest is prepended to the TURN'S USER MESSAGE on
+ * both harnesses — never the system prompt — because it is per-turn
+ * conversation content that must persist in the conversation history: the
+ * native system prompt is rebuilt per invocation and would forget the digest
+ * one turn later, while a message rides the checkpointer/agent store forever.
+ *
+ * Unlike its metadata-keyed siblings (context-bridge, sender-identity,
+ * session-context) there is no string key to mirror-guard: the value rides a
+ * TYPED proto field, so codegen enforces the cross-repo contract. The
+ * degradation posture still holds — an absent or blank digest renders
+ * nothing, and a runner predating this module simply ignores the field: the
+ * agent re-enters blind, exactly the behavior before catchup existed, never worse.
+ */
+
+import type { ConversationCatchup } from "@stigmer/apis/ai/stigmer/agentic/run/v1/spec_pb";
+
+/**
+ * How the digest is introduced to the model, shared by both harnesses so the
+ * behavioral contract ("known history, don't answer or announce it") cannot
+ * drift between them. Deliberately takeover-neutral: a digest can exist with
+ * no human handoff at all (a failed turn's re-composed window), so the
+ * preamble asserts only what is always true.
+ *
+ * The send-status annotations get an explicit exception from the
+ * don't-re-answer contract: a `(not delivered)` teammate reply is words the
+ * customer never got, so treating it as settled history would silently
+ * abandon whatever it was meant to convey. The preamble defines the
+ * annotations — model-facing meaning lives here (presentation), while the
+ * content's composer owns which lines earn them.
+ *
+ * The send-outcome lines extend the same
+ * exception to the agent's OWN sends: `You (not delivered):` lines and
+ * `System:` delivery-failure notices mean the customer never got those
+ * words. The behavioral contract is deliberate: treat the
+ * failure as unfinished conversation business — weigh what still needs
+ * saying and re-say it naturally in the next turn — but never resend the
+ * failed text verbatim: a multi-chunk send can partially land, and a
+ * word-for-word repeat risks the customer reading the same message twice.
+ */
+const CONVERSATION_CATCHUP_PREAMBLE =
+  "Below is activity from this conversation that you have not seen — " +
+  "oldest first. It may include customer messages that were handled by a " +
+  "human teammate, the teammate's own replies, notices sent to the " +
+  "customer, internal notes, and escalations you raised earlier. Treat it " +
+  "as conversation history you already know: do not answer or re-answer " +
+  "these messages, do not repeat or summarize them back, and do not " +
+  "mention any handoff unless asked. One exception: lines marked " +
+  "(not delivered) never reached the customer, and lines marked (sending) " +
+  "were still on their way when this summary was built — the customer may " +
+  "not have seen those words, so weigh that when deciding what still needs " +
+  "saying. That includes your own words: a line marked " +
+  "You (not delivered), or a System line reporting that a message was not " +
+  "delivered, means the customer never received it. Treat such a failure " +
+  "as unfinished business — if what it said still matters, work it " +
+  "naturally into your reply in your own words, but never resend the " +
+  "failed text word-for-word (part of it may have reached the customer, " +
+  "and an exact repeat reads as a duplicate). " +
+  "Continue from the customer's newest message.";
+
+/**
+ * Read the catchup digest from an execution spec's `conversation_catchup`.
+ * Returns undefined when the field is absent or the digest is blank — the
+ * caller renders no section. The field itself is present on EVERY channel
+ * turn (its `window_end` is cloud watermark bookkeeping this module must
+ * never read); only a non-empty digest means there is something to say.
+ */
+export function readConversationCatchup(
+  catchup: ConversationCatchup | undefined,
+): string | undefined {
+  const digest = catchup?.digest?.trim();
+  return digest ? digest : undefined;
+}
+
+/** The framed catchup body (preamble + digest), ready for section wrapping. */
+export function formatConversationCatchupText(digest: string): string {
+  return `${CONVERSATION_CATCHUP_PREAMBLE}\n\n${digest.trim()}`;
+}

package/src/shared/cost-guard.ts

@@ -0,0 +1,63 @@
+/**
+ * RunConfig.max_cost_usd enforcement as a hard stop on a harness turn: the
+ * bound the turn runs with (`status.run_config`, the control plane's one
+ * resolution), never the request's own.
+ *
+ * The one enforcement of the cap, for every harness: the turn runtime
+ * (`harness/run-turn.ts`) calls `costCapExceeded` on each usage delta an
+ * adapter reports, and on an overrun stops the turn through the same abort
+ * the stall watchdog and a platform STOP use, then settles `costCapArm`
+ * (`harness/terminal-table.ts`): RUN_TERMINATED, work checkpointed, the
+ * conversation continuing on the next message — the recursion-limit
+ * precedent, `toolCallLimitArm`.
+ *
+ * Why a hard stop rather than a middleware: the Cursor activity was the
+ * guard's only caller until the turn runtime took it over in #1070, and
+ * Cursor's only control point is cancelling the in-flight run. The runtime
+ * kept that shape for every engine, because it is where the running estimate
+ * advances. Until #1096 the native harness also capped inside its graph
+ * (`cost-cap.ts`: tools blocked at the threshold, one final tool-free round
+ * to summarize); that middleware now only advises, near the cap
+ * (`middleware/cost-advisory.ts`).
+ *
+ * The running figure is the runtime usage accumulator's local pricing-table
+ * estimate (`harness/usage-accumulator.ts`; authoritative billing is the
+ * BiDi proxy) — acceptable for a safety net. The cost advisory warns from
+ * its own tally on the same estimation basis, which can differ slightly: it
+ * prices cache writes at the input rate.
+ */
+
+import { COST_LIMIT_ERROR_PREFIX, formatTryStop } from "@stigmer/eval-runtime";
+
+/**
+ * Whether the per-execution cost budget has been exhausted.
+ *
+ * `maxCostUsd <= 0` means "no cap" (the proto contract: 0/unset disables the
+ * ceiling). The boundary is inclusive: reaching the cap exactly stops the run.
+ */
+export function costCapExceeded(maxCostUsd: number, estimatedCostUsd: number): boolean {
+  return maxCostUsd > 0 && estimatedCostUsd >= maxCostUsd;
+}
+
+/**
+ * Stable prefix of the cost-limit terminal error: consumers that need to
+ * distinguish "ran out of cost budget" from other TERMINATED causes match
+ * on it, because RunStatus carries no structured termination reason. The
+ * wording lives in `@stigmer/eval-runtime` (`try-stop.ts`), which the
+ * eval run reads it back with, so the two cannot drift.
+ */
+export { COST_LIMIT_ERROR_PREFIX };
+
+/** The terminal `status.error` for a cost-cap stop. */
+export function formatCostLimitError(maxCostUsd: number, estimatedCostUsd: number): string {
+  return formatTryStop({ kind: "cost-limit", estimatedCostUsd, maxCostUsd });
+}
+
+/**
+ * User-facing system message for a cost-cap stop. Parallel to the
+ * recursion-limit copy: honest about the limit, clear that nothing is lost.
+ */
+export const COST_LIMIT_USER_COPY =
+  "The agent reached the cost limit for this message. " +
+  "Work completed so far has been saved. " +
+  "Send another message to continue where the agent left off.";

package/src/shared/declared-preferences.ts

@@ -0,0 +1,84 @@
+/**
+ * Declared preferences (stigmer/stigmer#293): standing free-text
+ * preferences the organization and the calling user declared once — "keep
+ * answers terse", "we deploy to us-east-1" — that every eligible execution
+ * receives without the user re-typing them.
+ *
+ * The server composes the CONTENT at execution create: the create pipeline
+ * snapshots `Organization.spec.preferences.standing_context` and (cloud, for
+ * first-party human callers only) the caller
+ * `IdentityAccount.spec.preferences.standing_context` verbatim onto the
+ * execution status's `declared_preferences` field. This module owns the
+ * PRESENTATION — the preamble and the per-scope attribution — so the framing
+ * cannot drift between harnesses.
+ *
+ * Like conversation-catchup (its typed-field sibling) there is no metadata
+ * key to mirror-guard: the value rides a TYPED proto field, so codegen
+ * enforces the cross-repo contract. Degradation is safe by construction: an
+ * absent or blank field renders nothing, and a runner predating this module
+ * simply ignores it — the agent runs without preferences, exactly the
+ * pre-#293 behavior, never worse.
+ */
+
+import type { DeclaredPreferences } from "@stigmer/apis/ai/stigmer/agentic/run/v1/spec_pb";
+
+/**
+ * How the preferences are introduced to the model, shared by both harnesses
+ * so the behavioral contract cannot drift between them. Same posture as the
+ * session-context channel: calibration material, never authority — the task
+ * always outranks a standing preference.
+ */
+const DECLARED_PREFERENCES_PREAMBLE =
+  "Standing preferences declared by the organization and/or the user you " +
+  "are assisting. Treat them as background you already know: use them to " +
+  "calibrate depth, defaults, and tone. Do not repeat them back, quote " +
+  "them, or mention that you received them. They are context, not " +
+  "instructions that override your task.";
+
+/**
+ * The non-blank preference scopes of an execution, in presentation order.
+ * At least one scope is set (the read function returns undefined otherwise).
+ */
+export interface DeclaredPreferencesContent {
+  /** The organization's standing context, trimmed; absent when blank. */
+  orgContext?: string;
+  /** The calling user's standing context, trimmed; absent when blank. */
+  userContext?: string;
+}
+
+/**
+ * Read the declared preferences from an execution status's
+ * `declared_preferences`. Returns undefined when the field is absent or both
+ * scopes are blank — the caller renders no section. Blank-is-absent applies
+ * PER SCOPE: an org-only snapshot renders only the org subsection.
+ */
+export function readDeclaredPreferences(
+  preferences: DeclaredPreferences | undefined,
+): DeclaredPreferencesContent | undefined {
+  const orgContext = preferences?.orgContext?.trim() || undefined;
+  const userContext = preferences?.userContext?.trim() || undefined;
+  if (!orgContext && !userContext) {
+    return undefined;
+  }
+  return { orgContext, userContext };
+}
+
+/**
+ * The framed preferences body (preamble + labeled per-scope subsections),
+ * ready for section wrapping. Attribution is explicit — the model must know
+ * WHO declared what. Organization first, user last: the user's refinement
+ * reads last and so naturally wins where the two conflict, without this
+ * module encoding any override rule.
+ */
+export function formatDeclaredPreferencesText(
+  content: DeclaredPreferencesContent,
+): string {
+  const sections: string[] = [DECLARED_PREFERENCES_PREAMBLE];
+  if (content.orgContext) {
+    sections.push(`Declared by the organization:\n${content.orgContext}`);
+  }
+  if (content.userContext) {
+    sections.push(`Declared by the user:\n${content.userContext}`);
+  }
+  return sections.join("\n\n");
+}

package/src/shared/eval-case/__tests__/agent-mock.test.ts

@@ -0,0 +1,126 @@
+/**
+ * Pins the agent mock's request and reading (`agent-mock.ts`): the
+ * instructions as the system prompt, the server's earlier calls as the
+ * conversation and this call last; an `ABORT:` first line ends the run only
+ * when the mock may abort. The model itself (`chatAgentMockModel`) is the
+ * eval's judge model or the runner's default, built with the try's proxy
+ * scope, and its answer is priced from its usage on that model's pricing.
+ */
+
+import { AIMessage } from "@langchain/core/messages";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { Config } from "../../../config.js";
+
+const built = vi.hoisted(() => ({ calls: [] as unknown[], reply: undefined as unknown }));
+
+vi.mock("../../model-client.js", () => ({
+  buildChatModel: (args: unknown) => {
+    built.calls.push(args);
+    return Promise.resolve({ model: { invoke: () => Promise.resolve(built.reply) } });
+  },
+}));
+vi.mock("../../model-registry.js", () => ({ getDefaultModel: () => Promise.resolve("default-model") }));
+vi.mock("../../model-pricing.js", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("../../model-pricing.js")>()),
+  ensureLoaded: () => Promise.resolve(),
+  getModelPricing: (model: string) => ({
+    model,
+    inputPricePerMillion: 1,
+    outputPricePerMillion: 10,
+    cacheWritePricePerMillion: 2,
+    cacheReadPricePerMillion: 0.5,
+  }),
+}));
+
+const { agentMockMessages, chatAgentMockModel, readAnswer } = await import("../agent-mock.js");
+
+describe("agentMockMessages", () => {
+  it("frames the instructions, replays the server's history, and asks this call last", () => {
+    const messages = agentMockMessages({
+      server: "tracker",
+      tool: "get_issue",
+      instructions: "You are an issue tracker.",
+      abortWhen: "the issue id is negative",
+      input: { id: 12 },
+      history: [{ tool: "create_issue", input: { title: "Crash" }, answer: "Created #12" }],
+    });
+    expect(messages.map((m) => [m.getType(), m.content])).toEqual([
+      [
+        "system",
+        [
+          "You are standing in for the MCP server 'tracker' while a plugin is tested.",
+          "Answer each tool call exactly as that server would, following these instructions, and reply with the tool's result only.",
+          "",
+          "You are an issue tracker.",
+          "",
+          "You may end the test only when one of these conditions holds: the issue id is negative",
+          "To end it, reply with a single first line `ABORT: <the reason>` and nothing else.",
+        ].join("\n"),
+      ],
+      ["human", 'Tool: create_issue\nInput: {"title":"Crash"}'],
+      ["ai", "Created #12"],
+      ["human", 'Tool: get_issue\nInput: {"id":12}'],
+    ]);
+  });
+
+  it("says nothing of ending the test when the mock may not", () => {
+    const [system] = agentMockMessages({ server: "s", tool: "t", instructions: "Answer.", abortWhen: "", input: undefined, history: [] });
+    expect(String(system?.content)).not.toContain("ABORT");
+  });
+});
+
+describe("readAnswer", () => {
+  it("reads an ABORT first line as the end of the run, only when the mock may abort", () => {
+    expect(readAnswer("ABORT: the issue id is negative", true, 0.1)).toEqual({ kind: "abort", reason: "the issue id is negative", costUsd: 0.1 });
+    expect(readAnswer("ABORT:", true, 0)).toEqual({ kind: "abort", reason: "the mock ended the run", costUsd: 0 });
+    expect(readAnswer("ABORT: no", false, 0)).toEqual({ kind: "answer", text: "ABORT: no", costUsd: 0 });
+    expect(readAnswer("Issue #12\nABORT: later line", true, 0)).toEqual({ kind: "answer", text: "Issue #12\nABORT: later line", costUsd: 0 });
+  });
+});
+
+describe("chatAgentMockModel", () => {
+  const config = { proxyEndpoint: "https://proxy.test", stigmerTokenRef: { current: "tok" } } as unknown as Config;
+  const request = { server: "s", tool: "t", instructions: "Answer.", abortWhen: "never", input: { a: 1 }, history: [] };
+
+  beforeEach(() => {
+    built.calls = [];
+  });
+
+  it("asks the named model through the try's proxy scope and prices its usage", async () => {
+    const reply = new AIMessage({ content: "ABORT: never mind" });
+    reply.usage_metadata = {
+      input_tokens: 1_000_000,
+      output_tokens: 100_000,
+      total_tokens: 1_100_000,
+      input_token_details: { cache_read: 200_000, cache_creation: 300_000 },
+    };
+    built.reply = reply;
+    const answer = await chatAgentMockModel({ modelName: "judge", config, executionId: "aex_1" })(request);
+    expect(built.calls).toEqual([
+      {
+        modelName: "judge",
+        proxyEndpoint: "https://proxy.test",
+        stigmerToken: "tok",
+        headerScope: { executionId: "aex_1" },
+        temperature: null,
+        maxTokens: 4096,
+      },
+    ]);
+    // 0.5M fresh input at 1, 0.1M output at 10, 0.3M written at 2, 0.2M read at 0.5.
+    expect(answer).toEqual({ kind: "abort", reason: "never mind", costUsd: 0.5 + 1 + 0.6 + 0.1 });
+  });
+
+  it("falls back to the runner's default model, reads text parts, and prices an answer without usage at 0", async () => {
+    built.reply = new AIMessage({ content: [{ type: "text", text: "Created " }, { type: "image_url", image_url: "x" }, { type: "text", text: "#4" }] });
+    const bare = { proxyEndpoint: null, stigmerTokenRef: { current: null } } as unknown as Config;
+    const answer = await chatAgentMockModel({ modelName: "", config: bare, executionId: "aex_2" })({ ...request, abortWhen: "" });
+    expect(built.calls).toEqual([expect.objectContaining({ modelName: "default-model", proxyEndpoint: undefined, stigmerToken: undefined })]);
+    expect(answer).toEqual({ kind: "answer", text: "Created #4", costUsd: 0 });
+  });
+
+  it("reads content that is neither text nor parts as an empty answer", async () => {
+    built.reply = { content: 7 };
+    const answer = await chatAgentMockModel({ modelName: "judge", config, executionId: "aex_3" })({ ...request, abortWhen: "" });
+    expect(answer).toEqual({ kind: "answer", text: "", costUsd: 0 });
+  });
+});