@wardby/cli 0.3.0 → 0.4.1

package/dist/mcp/webhooks/ingress.js

@@ -9,7 +9,7 @@ function extractCodingTask(req) {
     const parsed = CodingTaskOverrideSchema.safeParse(req.body.task);
     return parsed.success ? parsed.data : undefined;
 }
-export async function handleWebhookIngress(webhookId, req, db, executor) {
+export async function handleWebhookIngress(webhookId, req, db, executor, issueTrackers) {
     const secret = extractSecret(req);
     if (!secret) {
         return { status: 401, body: { error: "invalid_secret", error_description: "No webhook secret presented." } };
@@ -18,11 +18,18 @@ export async function handleWebhookIngress(webhookId, req, db, executor) {
     if (req.body.task !== undefined && codingTask === undefined) {
         return { status: 400, body: { error: "invalid_task" } };
     }
-    const result = await resolveWebhookRun(webhookId, secret, db, executor, codingTask);
+    // `wardbyIssue`, not `issue`: forwarded third-party payloads (GitHub, Jira)
+    // carry their own top-level `issue` object, which is not ours to read.
+    const result = await resolveWebhookRun(webhookId, secret, db, executor, codingTask, {
+        issue: req.body.wardbyIssue,
+        issueTrackers,
+    });
     if (result.ok) {
         return { status: 202, body: { runId: result.runId } };
     }
     switch (result.reason) {
+        case "invalid_issue":
+            return { status: 400, body: { error: "invalid_issue", error_description: result.message } };
         case "not_found":
             return { status: 404, body: { error: "not_found" } };
         case "invalid_secret":

package/dist/providers/auth/self-hosted.d.ts

@@ -4,6 +4,13 @@ import { Credentials } from "../../mcp/auth/self-hosted/credentials.js";
 import { Sessions } from "../../mcp/auth/self-hosted/session.js";
 import type { AuthorizeParams, RegisterClientParams, SelfHostedAuthConfig, TokenParams, TokenResult } from "./authorization-server.js";
 export type { AuthorizeParams, RegisterClientParams, SelfHostedAuthConfig, TokenParams, TokenResult, } from "./authorization-server.js";
+/**
+ * Whether `requested` is one of a client's registered redirect URIs. A native
+ * app's loopback redirect may differ from its registration only in port: it
+ * listens on whatever port the OS hands it (RFC 8252 §7.3). Everything else —
+ * scheme, host, path, query — must match exactly, with no userinfo or fragment.
+ */
+export declare function redirectMatches(registered: readonly string[], requested: string): boolean;
 export declare class SelfHostedAuthProvider implements AuthProvider {
     readonly db: PrismaClient;
     readonly credentials: Credentials;
@@ -39,8 +46,8 @@ export declare class SelfHostedAuthProvider implements AuthProvider {
                 clientId: string;
             };
         } & {
-            id: string;
             createdAt: Date;
+            id: string;
             state: string | null;
             clientId: string;
             expiresAt: Date;

package/dist/providers/auth/self-hosted.js

@@ -7,13 +7,49 @@ import { SCOPES_SUPPORTED, limitScope } from "../../mcp/auth/resource-server.js"
 import { canonicalUrl } from "../../mcp/transport/http-limits.js";
 import { Credentials, DAY, decodeKey, lockUser } from "../../mcp/auth/self-hosted/credentials.js";
 import { Sessions } from "../../mcp/auth/self-hosted/session.js";
+const LOOPBACK_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+/**
+ * Whether `requested` is one of a client's registered redirect URIs. A native
+ * app's loopback redirect may differ from its registration only in port: it
+ * listens on whatever port the OS hands it (RFC 8252 §7.3). Everything else —
+ * scheme, host, path, query — must match exactly, with no userinfo or fragment.
+ */
+export function redirectMatches(registered, requested) {
+    if (registered.includes(requested))
+        return true;
+    let want;
+    try {
+        want = new URL(requested);
+    }
+    catch {
+        return false;
+    }
+    if (want.protocol !== "http:" || !LOOPBACK_HOSTS.includes(want.hostname))
+        return false;
+    return registered.some((value) => {
+        try {
+            const have = new URL(value);
+            return (have.protocol === "http:" &&
+                have.hostname === want.hostname &&
+                have.pathname === want.pathname &&
+                have.search === want.search &&
+                !want.username &&
+                !want.password &&
+                !requested.includes("#") // URL.hash is "" for a bare "#"
+            );
+        }
+        catch {
+            return false;
+        }
+    });
+}
 function validRedirect(value) {
     try {
         const u = new URL(value);
         return (!value.includes("#") &&
             !u.username &&
             !u.password &&
-            (u.protocol === "https:" || (u.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname))));
+            (u.protocol === "https:" || (u.protocol === "http:" && LOOPBACK_HOSTS.includes(u.hostname))));
     }
     catch {
         return false;
@@ -104,7 +140,8 @@ export class SelfHostedAuthProvider {
             throw new Error("Invalid resource.");
         const client = await this.db.oAuthClient.findUnique({ where: { clientId: p.clientId } });
         const metadata = client?.metadata;
-        if (!metadata?.redirect_uris?.includes(p.redirectUri) || !metadata.grant_types?.includes("authorization_code"))
+        if (!redirectMatches(metadata?.redirect_uris ?? [], p.redirectUri) ||
+            !metadata?.grant_types?.includes("authorization_code"))
             throw new Error("Invalid client or redirect.");
         const scope = limitScope(p.scope, SCOPES_SUPPORTED);
         const request = await this.db.oAuthAuthorizationRequest.create({

package/dist/providers/coding-proxy/memory-ledger.d.ts

@@ -1,4 +1,4 @@
-import type { CreateProxySessionInput, ProxyLedger, ProxyRequest, ProxySession, ProxyUsage, ReserveProxyRequestInput, ReserveProxyRequestResult } from "./types.js";
+import { type CreateProxySessionInput, type ProxyLedger, type ProxyRequest, type ProxySession, type ProxyUsage, type ReserveProxyRequestInput, type ReserveProxyRequestResult } from "./types.js";
 /** Deterministic contract adapter. Sharing one instance simulates a proxy restart. */
 export declare class MemoryProxyLedger implements ProxyLedger {
     private readonly sessions;

package/dist/providers/coding-proxy/memory-ledger.js

@@ -1,3 +1,4 @@
+import { normalizeProxyModelTerms, } from "./types.js";
 function cloneSession(session) {
     return {
         ...session,
@@ -5,6 +6,9 @@ function cloneSession(session) {
         deadlineAt: new Date(session.deadlineAt),
         budgetExhaustedAt: session.budgetExhaustedAt ? new Date(session.budgetExhaustedAt) : null,
         upstreamFailure: session.upstreamFailure ?? null,
+        terms: session.terms
+            ? { version: session.terms.version, entry: { ...session.terms.entry, efforts: [...session.terms.entry.efforts] } }
+            : null,
     };
 }
 function cloneRequest(request) {
@@ -26,7 +30,12 @@ export class MemoryProxyLedger {
         }
         if (this.sessionByCapability.has(input.capabilityHash))
             throw new Error("proxy_capability_collision");
-        const session = { ...input, allowedModels: [...input.allowedModels], status: "active" };
+        const session = {
+            ...input,
+            allowedModels: [...input.allowedModels],
+            status: "active",
+            terms: input.terms ? normalizeProxyModelTerms(input.terms) : null,
+        };
         this.sessions.set(session.id, session);
         this.sessionByCapability.set(session.capabilityHash, session.id);
     }

package/dist/providers/coding-proxy/metering.d.ts

@@ -1,4 +1,4 @@
-import { type ModelPricing } from "../llm/pricing.js";
+import { type ModelPricing } from "../llm/pricing-core.js";
 import type { PricingSnapshot, ProxyUsage } from "./types.js";
 export declare function parseAuthoritativeUsage(value: unknown): ProxyUsage;
 export declare function parseAnthropicAuthoritativeUsage(value: unknown): ProxyUsage;
@@ -21,4 +21,5 @@ export declare class AnthropicSseUsageTracker {
     private stopped;
     consume(frame: string): TerminalUsage;
 }
+/** The rates a request is billed at, tagged with their version. Picks only the price fields: a catalog entry's routing/shape fields stay out of the ledger. */
 export declare function pricingSnapshot(version: string, pricing: ModelPricing): PricingSnapshot;

package/dist/providers/coding-proxy/metering.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { computeCost } from "../llm/pricing.js";
+import { computeCost } from "../llm/pricing-core.js";
 const MAX_SAFE_TOKENS = 2_000_000_000;
 function tokenCount(value, name) {
     if (!Number.isSafeInteger(value) || value < 0 || value > MAX_SAFE_TOKENS) {
@@ -182,6 +182,17 @@ export class AnthropicSseUsageTracker {
         }
     }
 }
+/** The rates a request is billed at, tagged with their version. Picks only the price fields: a catalog entry's routing/shape fields stay out of the ledger. */
 export function pricingSnapshot(version, pricing) {
-    return { version, ...pricing };
+    const snapshot = {
+        version,
+        encoding: pricing.encoding,
+        inputPerMTok: pricing.inputPerMTok,
+        outputPerMTok: pricing.outputPerMTok,
+    };
+    if (pricing.cachedInputPerMTok !== undefined)
+        snapshot.cachedInputPerMTok = pricing.cachedInputPerMTok;
+    if (pricing.cacheWritePerMTok !== undefined)
+        snapshot.cacheWritePerMTok = pricing.cacheWritePerMTok;
+    return snapshot;
 }

package/dist/providers/coding-proxy/prisma-ledger.js

@@ -1,3 +1,6 @@
+import { logger } from "../../core/logger.js";
+import { normalizeProxyModelTerms } from "./types.js";
+const log = logger.child({ module: "coding-proxy-ledger" });
 /** How long a ledger transaction waits for a pool connection (Prisma's
  *  default is 2 s). A model request fails outright when this runs out, so it
  *  gets more room than the default; its pool is also kept apart from the
@@ -31,8 +34,21 @@ function sessionFromRow(row) {
         registryTokenHash: row.registryTokenHash,
         budgetExhaustedAt: row.budgetExhaustedAt ?? null,
         upstreamFailure: row.upstreamFailure ?? null,
+        terms: sessionTerms(row),
     };
 }
+/**
+ * The session's stored model terms. Null only when both columns are null (a session from before
+ * the catalog, which prices from the shipped fallback); terms that are partly present or cannot be
+ * read throw, so the session is refused rather than billed at fallback rates.
+ */
+function sessionTerms(row) {
+    const version = row.pricingVersion ?? null;
+    const stored = row.catalogEntry ?? null;
+    if (version === null && stored === null)
+        return null;
+    return normalizeProxyModelTerms({ version, entry: stored });
+}
 function requestFromRow(row) {
     const pricing = row.pricingSnapshot;
     const hasUsage = row.inputTokens !== null && row.outputTokens !== null;
@@ -81,19 +97,22 @@ export class PrismaProxyLedger {
     }
     async createSession(input) {
         const models = JSON.stringify(input.allowedModels);
+        const terms = input.terms ? normalizeProxyModelTerms(input.terms) : undefined;
         await this.db.$executeRaw `
       INSERT INTO "CodingProxySession"
         ("id", "runId", "capabilityHash", "credentialRef", "protocol", "allowedModels", "deadlineAt",
-         "budgetUsd", "status", "registryTokenHash", "createdAt", "updatedAt")
+         "budgetUsd", "status", "registryTokenHash", "pricingVersion", "catalogEntry", "createdAt", "updatedAt")
       VALUES
         (${input.id}, ${input.runId}, ${input.capabilityHash}, ${input.credentialRef}, ${input.protocol}, ${models}::jsonb,
-         ${input.deadlineAt}, ${input.budgetUsd}, 'active', ${input.registryTokenHash}, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+         ${input.deadlineAt}, ${input.budgetUsd}, 'active', ${input.registryTokenHash},
+         ${terms?.version ?? null}, ${terms ? JSON.stringify(terms.entry) : null}::jsonb,
+         CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
     `;
     }
     async findSessionByCapabilityHash(capabilityHash) {
         const rows = await this.db.$queryRaw `
       SELECT "id", "runId", "capabilityHash", "credentialRef", "protocol", "allowedModels", "deadlineAt", "budgetUsd", "status", "registryTokenHash",
-             "budgetExhaustedAt", "upstreamFailure"
+             "budgetExhaustedAt", "upstreamFailure", "pricingVersion", "catalogEntry"
       FROM "CodingProxySession" WHERE "capabilityHash" = ${capabilityHash}
     `;
         return rows[0] ? sessionFromRow(rows[0]) : null;
@@ -194,20 +213,54 @@ export class PrismaProxyLedger {
               "completedAt" = CURRENT_TIMESTAMP, "updatedAt" = CURRENT_TIMESTAMP
           WHERE "id" = ${requestId} AND "status" IN ('reserved', 'uncertain')
         `;
-            await tx.$executeRaw `
+            const [updatedRun] = await tx.$queryRaw `
           UPDATE "Run" AS r
-          SET "tokensIn" = totals."tokensIn", "tokensOut" = totals."tokensOut", "costUsd" = totals."costUsd"
+          SET "tokensIn" = totals."tokensIn", "tokensOut" = totals."tokensOut", "costUsd" = totals."costUsd",
+              "turns" = totals."turns"
           FROM (
             SELECT s."runId", COALESCE(SUM(q."inputTokens"), 0)::integer AS "tokensIn",
                    COALESCE(SUM(q."outputTokens"), 0)::integer AS "tokensOut",
-                   COALESCE(SUM(q."actualCostUsd"), 0) AS "costUsd"
+                   COALESCE(SUM(q."actualCostUsd"), 0) AS "costUsd",
+                   COUNT(*)::integer AS "turns"
             FROM "CodingProxySession" s
             JOIN "CodingProxyRequest" q ON q."sessionId" = s."id" AND q."status" = 'completed'
             WHERE s."id" = ${prior.sessionId}
             GROUP BY s."runId"
           ) AS totals
           WHERE r."id" = totals."runId"
+          RETURNING r."id"
         `;
+            // Per-model usage (RunModelUsage), recomputed for this request's model and set, never incremented.
+            // Best effort inside a savepoint: Run totals and the ledger are the budget truth, so a failed
+            // write here (e.g. a role without the RunModelUsage grant) must never fail the completion.
+            await tx.$executeRaw `SAVEPOINT run_model_usage`;
+            try {
+                await tx.$executeRaw `
+            INSERT INTO "RunModelUsage"
+              ("runId", "model", "freshInputTokens", "cachedInputTokens", "cacheWriteTokens", "outputTokens", "costUsd")
+            SELECT s."runId", q."model",
+                   COALESCE(SUM(COALESCE(q."inputTokens", 0) - COALESCE(q."cachedInputTokens", 0)), 0)::integer,
+                   COALESCE(SUM(q."cachedInputTokens"), 0)::integer,
+                   COALESCE(SUM(q."cacheWriteTokens"), 0)::integer,
+                   COALESCE(SUM(q."outputTokens"), 0)::integer,
+                   COALESCE(SUM(q."actualCostUsd"), 0)
+            FROM "CodingProxySession" s
+            JOIN "CodingProxyRequest" q ON q."sessionId" = s."id" AND q."status" = 'completed'
+            WHERE s."id" = ${prior.sessionId} AND q."model" = ${prior.model}
+            GROUP BY s."runId", q."model"
+            ON CONFLICT ("runId", "model") DO UPDATE SET
+              "freshInputTokens" = EXCLUDED."freshInputTokens",
+              "cachedInputTokens" = EXCLUDED."cachedInputTokens",
+              "cacheWriteTokens" = EXCLUDED."cacheWriteTokens",
+              "outputTokens" = EXCLUDED."outputTokens",
+              "costUsd" = EXCLUDED."costUsd"
+          `;
+                await tx.$executeRaw `RELEASE SAVEPOINT run_model_usage`;
+            }
+            catch (err) {
+                await tx.$executeRaw `ROLLBACK TO SAVEPOINT run_model_usage`;
+                log.warn({ err, runId: updatedRun?.id, sessionId: prior.sessionId, model: prior.model }, "could not record the run's model usage");
+            }
             const request = await requestById(tx, requestId);
             if (!request)
                 throw new Error("proxy_completion_not_persisted");

package/dist/providers/coding-proxy/proxy.d.ts

@@ -1,9 +1,15 @@
-import { type ModelPricing } from "../llm/pricing.js";
-import type { CredentialResolver, ProxyAuditSink, ProxyLedger, ProxyProtocol } from "./types.js";
+import type { ModelPricing } from "../llm/pricing-core.js";
+import type { CredentialResolver, ProxyAuditSink, ProxyLedger, ProxyModelTerms, ProxyProtocol } from "./types.js";
 export declare const PROXY_MAX_BODY_BYTES: number;
 export declare const PROXY_MAX_OUTPUT_TOKENS = 1000000;
 export declare const PROXY_DEFAULT_MAX_OUTPUT_TOKENS = 4096;
 export declare const CLAUDE_CODE_ANTHROPIC_BETAS: readonly ["claude-code-20250219", "context-management-2025-06-27", "effort-2025-11-24", "interleaved-thinking-2025-05-14", "mid-conversation-system-2026-04-07", "prompt-caching-scope-2026-01-05", "thinking-token-count-2026-05-13"];
+/**
+ * Betas Claude Code sends only for some models. per-turn-control is sent for Claude Opus 5.5; it is
+ * required only by an effort-only system message (per-turn effort), and every body field is still
+ * checked against the reviewed shape, so the header alone unlocks nothing.
+ */
+export declare const OPTIONAL_ANTHROPIC_BETAS: readonly ["per-turn-control-2026-07-01"];
 /**
  * The longest run_command timeout the Claude tool runner offers the model (its MAX_TIMEOUT_MS,
  * src/claude-tool-runner/command.mjs; the proxy tests keep the two equal). A lower limit here let the
@@ -35,6 +41,8 @@ export interface CreateCodingProxySession {
     allowedModels: string[];
     deadlineAt: Date;
     budgetUsd: number;
+    /** The run's catalog entry recorded at dispatch; the session then prices and shapes requests from it. */
+    terms?: ProxyModelTerms;
 }
 export interface CreatedCodingProxySession {
     id: string;
@@ -76,6 +84,8 @@ export declare class CodingProxy {
     /** The code of the first upstream failure relayed for this session's run, if any. */
     upstreamFailure(sessionId: string): Promise<string | null>;
     execute(input: ExecuteProxyRequest, sink: ProxyResponseSink): Promise<void>;
+    /** A session's model terms: its stored catalog entry, or the fallback for sessions from before the catalog. */
+    private termsFor;
     private authenticate;
     private trackActive;
     private handleDuplicate;

package/dist/providers/coding-proxy/proxy.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { getModelPricing, PRICING_VERSION } from "../llm/pricing.js";
-import { getAnthropicPricing } from "../llm/pricing-anthropic.js";
+import { shippedCatalog } from "../llm/catalog.js";
+import { SHIPPED_CATALOG_VERSION } from "../llm/catalog-shipped.js";
 import { deriveRegistryToken } from "../../coding/registry/token.js";
 import { AnthropicSseUsageTracker, actualCostUsd, estimateReservationUsd, fingerprintRequest, parseAnthropicAuthoritativeUsage, parseAuthoritativeUsage, pricingSnapshot, safeUpstreamErrorCode, terminalUsageFromSseFrame, } from "./metering.js";
 import { createPinnedProxyFetch } from "./secure-fetch.js";
@@ -20,7 +20,13 @@ const MAX_UPSTREAM_JSON_BYTES = 16 * 1024 * 1024;
 /** A rejected upstream's error body is read only this far, for its error code. */
 const MAX_UPSTREAM_ERROR_BYTES = 64 * 1024;
 const REQUEST_KEY_PATTERN = /^[\x21-\x7e]{1,200}$/;
-const APPROVED_ANTHROPIC_BETAS = new Set(CLAUDE_CODE_ANTHROPIC_BETAS);
+/**
+ * Betas Claude Code sends only for some models. per-turn-control is sent for Claude Opus 5.5; it is
+ * required only by an effort-only system message (per-turn effort), and every body field is still
+ * checked against the reviewed shape, so the header alone unlocks nothing.
+ */
+export const OPTIONAL_ANTHROPIC_BETAS = ["per-turn-control-2026-07-01"];
+const APPROVED_ANTHROPIC_BETAS = new Set([...CLAUDE_CODE_ANTHROPIC_BETAS, ...OPTIONAL_ANTHROPIC_BETAS]);
 const WARDBY_COMMAND_TOOL = "mcp__wardby_tools__run_command";
 const STRUCTURED_OUTPUT_TOOL = "StructuredOutput";
 const MAX_COMMAND_BYTES = 16 * 1024;
@@ -588,19 +594,35 @@ function parseAnthropicBeta(value) {
     return { header: normalized.join(","), values: new Set(normalized) };
 }
 /**
- * Models that take manual extended thinking (`{type: "enabled", budget_tokens}`) instead of adaptive
- * thinking, and no effort level: Claude Haiku 4.5, which returns a 400 for adaptive thinking. The
- * pinned Claude Agent SDK sends it `budget_tokens` = max_tokens - 1 and no `output_config`
+ * Models whose catalog entry says `thinkingMode: "manual"` take manual extended thinking
+ * (`{type: "enabled", budget_tokens}`) instead of adaptive thinking, and no effort level (Claude
+ * Haiku 4.5 in the shipped catalog, which returns a 400 for adaptive thinking). The pinned Claude
+ * Agent SDK sends it `budget_tokens` = max_tokens - 1 and no `output_config`
  * (fixtures/anthropic-sdk-request-haiku-4-5.json). Every other model stays adaptive-only.
  */
-const MANUAL_THINKING_MODELS = new Set(["claude-haiku-4-5"]);
 /** Anthropic's minimum manual thinking budget. */
 const MIN_THINKING_BUDGET_TOKENS = 1024;
 function requireAnthropicBeta(values, beta) {
     if (!values.has(beta))
         throw new CodingProxyError(400, "anthropic_beta_required");
 }
-function parseAnthropicRequest(rawBody, betaHeader) {
+/**
+ * An `output_config` (top-level, or on an effort-only system message): only an effort level, and
+ * only one the run's catalog entry lists. Budget is still reserved from max_tokens per request, so
+ * effort only changes how much of it the model uses. Effort doesn't exist on a manual-thinking
+ * model; the SDK never sends it there.
+ */
+function validateEffortConfig(value, { thinkingMode, efforts }, betas) {
+    if (thinkingMode === "manual")
+        throw new CodingProxyError(400, "unsupported_anthropic_feature");
+    requireAnthropicBeta(betas, "effort-2025-11-24");
+    const output = record(value);
+    onlyKeys(output, ["effort"]);
+    if (typeof output.effort !== "string" || !efforts.includes(output.effort)) {
+        throw new CodingProxyError(400, "unsupported_anthropic_feature");
+    }
+}
+function parseAnthropicRequest(rawBody, betaHeader, shape) {
     const beta = parseAnthropicBeta(betaHeader);
     if (Buffer.byteLength(rawBody) > PROXY_MAX_BODY_BYTES)
         throw new CodingProxyError(413, "payload_too_large");
@@ -641,12 +663,22 @@ function parseAnthropicRequest(rawBody, betaHeader) {
         validateTextBlocks(body.system);
     for (const value of body.messages) {
         const message = record(value);
-        onlyKeys(message, ["role", "content"]);
+        onlyKeys(message, message.role === "system" ? ["role", "content", "output_config"] : ["role", "content"]);
         if (message.role !== "user" && message.role !== "assistant" && message.role !== "system") {
             throw new CodingProxyError(400, "unsupported_anthropic_feature");
         }
         if (message.role === "system") {
             requireAnthropicBeta(beta.values, "mid-conversation-system-2026-04-07");
+            if (message.output_config !== undefined) {
+                // An effort-only system message (Claude Opus 5.5's per-turn effort): no content at all, and
+                // the same effort rule as the top-level output_config.
+                requireAnthropicBeta(beta.values, "per-turn-control-2026-07-01");
+                if (!Array.isArray(message.content) || message.content.length !== 0) {
+                    throw new CodingProxyError(400, "unsupported_anthropic_feature");
+                }
+                validateEffortConfig(message.output_config, shape, beta.values);
+                continue;
+            }
             if (typeof message.content === "string") {
                 if (Buffer.byteLength(message.content) > MAX_TOOL_TEXT_BYTES) {
                     throw new CodingProxyError(400, "unsupported_anthropic_feature");
@@ -674,7 +706,7 @@ function parseAnthropicRequest(rawBody, betaHeader) {
         if (typeof metadata.user_id !== "string")
             throw new CodingProxyError(400, "invalid_anthropic_request");
     }
-    const manualThinking = MANUAL_THINKING_MODELS.has(body.model);
+    const manualThinking = shape.thinkingMode === "manual";
     if (body.thinking !== undefined) {
         requireAnthropicBeta(beta.values, "interleaved-thinking-2025-05-14");
         requireAnthropicBeta(beta.values, "thinking-token-count-2026-05-13");
@@ -709,16 +741,8 @@ function parseAnthropicRequest(rawBody, betaHeader) {
             throw new CodingProxyError(400, "unsupported_anthropic_feature");
         }
     }
-    if (body.output_config !== undefined) {
-        // Effort doesn't exist on a manual-thinking model; the SDK never sends it there.
-        if (manualThinking)
-            throw new CodingProxyError(400, "unsupported_anthropic_feature");
-        requireAnthropicBeta(beta.values, "effort-2025-11-24");
-        const output = record(body.output_config);
-        onlyKeys(output, ["effort"]);
-        if (output.effort !== "high")
-            throw new CodingProxyError(400, "unsupported_anthropic_feature");
-    }
+    if (body.output_config !== undefined)
+        validateEffortConfig(body.output_config, shape, beta.values);
     const normalized = { ...body };
     delete normalized.metadata;
     const encoded = JSON.stringify(normalized);
@@ -734,13 +758,13 @@ function parseAnthropicRequest(rawBody, betaHeader) {
         anthropicBeta: beta.header,
     };
 }
-function parseRequest(protocol, rawBody, anthropicBeta) {
+function parseRequest(protocol, rawBody, anthropicBeta, shape) {
     if (protocol !== "anthropic-messages" && anthropicBeta !== undefined) {
         throw new CodingProxyError(400, "invalid_anthropic_beta");
     }
     try {
         return protocol === "anthropic-messages"
-            ? parseAnthropicRequest(rawBody, anthropicBeta)
+            ? parseAnthropicRequest(rawBody, anthropicBeta, shape)
             : parseOpenAiRequest(rawBody);
     }
     catch (error) {
@@ -809,10 +833,18 @@ export class CodingProxy {
                 });
         this.now = options.now ?? (() => new Date());
         this.audit = options.audit ?? (() => undefined);
+        // The fallback for sessions created before the catalog (no stored terms): the
+        // proxy has no catalog store, only the shipped catalog compiled into it.
         this.getPricing =
             options.pricing ??
-                ((model, protocol) => (protocol === "anthropic-messages" ? getAnthropicPricing(model) : getModelPricing(model)));
-        this.priceVersion = options.pricingVersion ?? PRICING_VERSION;
+                ((model, protocol) => {
+                    const entry = shippedCatalog().require(model);
+                    const expected = protocol === "anthropic-messages" ? "anthropic" : "openai";
+                    if (entry.provider !== expected)
+                        throw new Error("unknown_model");
+                    return entry;
+                });
+        this.priceVersion = options.pricingVersion ?? `shipped:${SHIPPED_CATALOG_VERSION}`;
     }
     async createSession(input) {
         if (input.protocol !== "openai-responses" && input.protocol !== "anthropic-messages") {
@@ -822,8 +854,16 @@ export class CodingProxy {
         if (models.length < 1 || models.length > 8 || models.some((model) => !model || model.length > 100)) {
             throw new Error("invalid_proxy_model_allowlist");
         }
-        for (const model of models)
-            this.getPricing(model, input.protocol);
+        if (input.terms) {
+            const expected = input.protocol === "anthropic-messages" ? "anthropic" : "openai";
+            if (models.length !== 1 || input.terms.entry.modelId !== models[0] || input.terms.entry.provider !== expected) {
+                throw new Error("invalid_proxy_model_terms");
+            }
+        }
+        else {
+            for (const model of models)
+                this.getPricing(model, input.protocol);
+        }
         if (!Number.isFinite(input.budgetUsd) || input.budgetUsd <= 0)
             throw new Error("invalid_proxy_budget");
         if (input.deadlineAt.getTime() <= this.now().getTime())
@@ -843,6 +883,7 @@ export class CodingProxy {
             deadlineAt: input.deadlineAt,
             budgetUsd: input.budgetUsd,
             registryTokenHash,
+            terms: input.terms,
         });
         this.audit({ type: "session.created", runId: input.runId });
         return {
@@ -874,9 +915,15 @@ export class CodingProxy {
             this.audit({ type: "request.rejected", runId: session.runId, reason: "protocol_mismatch" });
             throw new CodingProxyError(403, "protocol_mismatch");
         }
+        // A session from before the model catalog has no stored entry: take the shape from the shipped one.
+        const entry = session.terms?.entry ?? shippedCatalog().get(session.allowedModels[0]);
+        const shape = {
+            thinkingMode: entry?.thinkingMode ?? "adaptive",
+            efforts: entry?.efforts ?? [],
+        };
         let parsed;
         try {
-            parsed = parseRequest(input.protocol, input.rawBody, input.anthropicBeta);
+            parsed = parseRequest(input.protocol, input.rawBody, input.anthropicBeta, shape);
         }
         catch (error) {
             // The session is already authenticated and no credential has been
@@ -891,16 +938,16 @@ export class CodingProxy {
             this.audit({ type: "request.rejected", runId: session.runId, model: parsed.model, reason: "model_not_allowed" });
             throw new CodingProxyError(403, "model_not_allowed");
         }
-        let pricing;
+        let terms;
         try {
-            pricing = this.getPricing(parsed.model, session.protocol);
+            terms = this.termsFor(session, parsed.model);
         }
         catch {
             this.audit({ type: "request.rejected", runId: session.runId, model: parsed.model, reason: "unknown_model" });
             throw new CodingProxyError(400, "unknown_model");
         }
         const requestKey = safeRequestKey(input.requestKey, parsed.fingerprint);
-        const snapshot = pricingSnapshot(this.priceVersion, pricing);
+        const snapshot = pricingSnapshot(terms.version, terms.pricing);
         const reservationUsd = estimateReservationUsd(Buffer.byteLength(parsed.encoded), parsed.maxOutputTokens, snapshot);
         const reservation = await this.ledger.reserve({
             id: randomUUID(),
@@ -1034,6 +1081,21 @@ export class CodingProxy {
             cleanupActive();
         }
     }
+    /** A session's model terms: its stored catalog entry, or the fallback for sessions from before the catalog. */
+    termsFor(session, model) {
+        if (session.terms) {
+            return {
+                pricing: session.terms.entry,
+                version: session.terms.version,
+                thinkingMode: session.terms.entry.thinkingMode,
+            };
+        }
+        return {
+            pricing: this.getPricing(model, session.protocol),
+            version: this.priceVersion,
+            thinkingMode: shippedCatalog().get(model)?.thinkingMode ?? "adaptive",
+        };
+    }
     async authenticate(bearer) {
         if (!bearer || bearer.length > 100)
             throw new CodingProxyError(401, "invalid_capability");

package/dist/providers/coding-proxy/types.d.ts

@@ -1,10 +1,24 @@
-import type { ModelPricing } from "../llm/pricing.js";
+import { type CatalogEntry } from "../llm/catalog-types.js";
+import type { ModelPricing } from "../llm/pricing-core.js";
 export type ProxySessionStatus = "active" | "cancelled";
 export type ProxyRequestStatus = "reserved" | "completed" | "released" | "uncertain";
 export type ProxyProtocol = "openai-responses" | "anthropic-messages";
 export interface PricingSnapshot extends ModelPricing {
     version: string;
 }
+/** The model terms a coding run was dispatched under: its catalog entry and that entry's price version. */
+export interface ProxyModelTerms {
+    version: string;
+    entry: CatalogEntry;
+}
+/**
+ * Validates and copies model terms, for both ledgers on write and the database ledger on read.
+ * Throws invalid_proxy_session_terms: unreadable terms must refuse the session, never fall back.
+ */
+export declare function normalizeProxyModelTerms(terms: {
+    version: unknown;
+    entry: unknown;
+}): ProxyModelTerms;
 export interface ProxyUsage {
     inputTokens: number;
     outputTokens: number;
@@ -27,6 +41,8 @@ export interface ProxySession {
     budgetExhaustedAt?: Date | null;
     /** The code of the first upstream failure the proxy relayed for this session. */
     upstreamFailure?: string | null;
+    /** The run's catalog entry, copied at session creation; null on sessions from before the catalog. */
+    terms?: ProxyModelTerms | null;
 }
 export interface ProxyRequest {
     id: string;
@@ -51,6 +67,7 @@ export interface CreateProxySessionInput {
     deadlineAt: Date;
     budgetUsd: number;
     registryTokenHash: string;
+    terms?: ProxyModelTerms;
 }
 export interface ReserveProxyRequestInput {
     id: string;

package/dist/providers/coding-proxy/types.js

@@ -1 +1,12 @@
-export {};
+import { parseStoredEntry } from "../llm/catalog-types.js";
+/**
+ * Validates and copies model terms, for both ledgers on write and the database ledger on read.
+ * Throws invalid_proxy_session_terms: unreadable terms must refuse the session, never fall back.
+ */
+export function normalizeProxyModelTerms(terms) {
+    const entry = parseStoredEntry(terms.entry);
+    if (typeof terms.version !== "string" || terms.version.length === 0 || !entry) {
+        throw new Error("invalid_proxy_session_terms");
+    }
+    return { version: terms.version, entry };
+}