@worca/app 1.0.0 → 1.2.0-rc.1

package/src/core/config.mjs

@@ -15,7 +15,7 @@
 import { getDb, prepare, tx } from './db.mjs';
 import { projectKey } from './store.mjs';
 import { loadAgentRegistry, registryToSteps } from './agent-registry.mjs';
-import { EFFORTS, prepareModelEnv } from './model-env.mjs';
+import { EFFORTS, prepareModelEnv, isSubagentModelValue, subagentModelIssue } from './model-env.mjs';
 import { listGlobalModels, addGlobalModel, removeGlobalModel } from './settings.mjs';
 import { listPluginModels, allPluginModels, flattenPluginModelEnv } from './plugin-models.mjs';
 
@@ -57,19 +57,23 @@ export { EFFORTS };
  * The `[1m]` suffix selects the 1M-token long-context variant. Opus 4.6–4.8 and
  * Sonnet 4.6 1M ids were verified to resolve via `claude --model`; Haiku 4.5 1M
  * is intentionally omitted — the CLI rejects it ("long context beta is not yet
- * available for this subscription"). Fable 5 needs no `[1m]` suffix: its context
- * window is 1M by default (verified to resolve via `claude --model`). Opus 5
- * (`claude-opus-5`) is likewise 1M-only and carries no `[1m]` twin.
+ * available for this subscription"). Fable 5.1 needs no `[1m]` suffix: its context
+ * window is 1M by default (verified to resolve via `claude --model`, CLI 2.1.257).
+ * It replaced Fable 5 (`claude-fable-5`) on 2026-09-01; db.mjs V26 moves every
+ * stored pin on the retired id to the successor, so nothing keeps it here. Opus 5
+ * (`claude-opus-5`) and Sonnet 5 (`claude-sonnet-5`) are likewise 1M-only and
+ * carry no `[1m]` twin.
  */
 export const PREDEFINED_MODELS = [
   { id: 'claude-opus-5',          label: 'Opus 5',          efforts: ['medium', 'high', 'xhigh', 'max'] },
-  { id: 'claude-fable-5',         label: 'Fable 5 (1M)',    efforts: ['medium', 'high', 'xhigh', 'max'] },
+  { id: 'claude-fable-5-1',       label: 'Fable 5.1 (1M)',  efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-8',        label: 'Opus 4.8',        efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-8[1m]',    label: 'Opus 4.8 (1M)',   efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-7',        label: 'Opus 4.7',        efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-7[1m]',    label: 'Opus 4.7 (1M)',   efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-6',        label: 'Opus 4.6',        efforts: ['medium', 'high', 'max'] },
   { id: 'claude-opus-4-6[1m]',    label: 'Opus 4.6 (1M)',   efforts: ['medium', 'high', 'max'] },
+  { id: 'claude-sonnet-5',        label: 'Sonnet 5',        efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-sonnet-4-6',      label: 'Sonnet 4.6',      efforts: ['medium', 'high', 'max'] },
   { id: 'claude-sonnet-4-6[1m]',  label: 'Sonnet 4.6 (1M)', efforts: ['medium', 'high', 'max'] },
   { id: 'claude-haiku-4-5',       label: 'Haiku 4.5',       efforts: ['medium', 'high'] },
@@ -84,24 +88,17 @@ function defaultConfig() {
   return { steps: {}, customModels: [] };
 }
 
-/** Keep only known step keys carrying a non-empty model/effort and/or a fanOut/askQuestions boolean. */
+/** Keep only known step keys whose entry survives cleanNodeSel — ONE coercion
+ *  rule for both scopes (a per-step entry IS a node selection; a second
+ *  line-for-line copy here is how the two silently diverge). An unknown
+ *  subagentModel is dropped, never stored. */
 function sanitizeSteps(steps) {
   const out = {};
   const keys = stepKeys();
   for (const [k, v] of Object.entries(steps || {})) {
     if (!keys.has(k) || !v || typeof v !== 'object') continue;
-    const model = typeof v.model === 'string' ? v.model.trim() : '';
-    const effort = typeof v.effort === 'string' ? v.effort.trim() : '';
-    const fanOut = typeof v.fanOut === 'boolean' ? v.fanOut : undefined;
-    const askQuestions = typeof v.askQuestions === 'boolean' ? v.askQuestions : undefined;
-    if (model || effort || fanOut !== undefined || askQuestions !== undefined) {
-      out[k] = {
-        ...(model && { model }),
-        ...(effort && { effort }),
-        ...(fanOut !== undefined && { fanOut }),
-        ...(askQuestions !== undefined && { askQuestions }),
-      };
-    }
+    const sel = cleanNodeSel(v);   // hoisted declaration (defined below)
+    if (sel) out[k] = sel;
   }
   return out;
 }
@@ -172,7 +169,10 @@ export async function readConfig(projectDir) {
  * `custom` is false | 'global' | 'plugin' | 'project' (strings truthy, so
  * existing `m.custom` checks keep working); plugin entries also carry
  * `plugin: '<name>'`; `hasEnv` advertises routing env WITHOUT the values
- * (this shape feeds UI dropdowns).
+ * (this shape feeds UI dropdowns). `routed` advertises an ANTHROPIC_BASE_URL
+ * override the same way (key presence, values never leaked) — computed from the
+ * env objects already in scope here, NEVER by calling modelHasBaseUrlRouting per
+ * entry (that re-reads settings + the plugins lock from disk on every row).
  */
 function composeCatalog(projectCustom = []) {
   const globals = listGlobalModels();
@@ -183,26 +183,27 @@ function composeCatalog(projectCustom = []) {
   const out = [];
   const seen = new Set();
   const unreliable = (lc) => (flagged.has(lc) ? { costUnreliable: true } : {});
+  const routedOf = (env) => !!(env && 'ANTHROPIC_BASE_URL' in env);
   const pluginShape = (id, m, lc) => ({
     id, label: m.label, efforts: [...m.efforts], custom: 'plugin', plugin: m.plugin,
-    hasEnv: !!m.env, ...unreliable(lc),
+    hasEnv: !!m.env, routed: routedOf(m.env), ...unreliable(lc),
   });
   for (const m of PREDEFINED_MODELS) {
     const lc = m.id.toLowerCase();
     const shadow = globalByIdLc.get(lc);
     const pshadow = pluginByIdLc.get(lc);
     out.push(shadow
-      ? { id: m.id, label: shadow.label, efforts: [...shadow.efforts], custom: 'global', hasEnv: !!shadow.env, ...unreliable(lc) }
+      ? { id: m.id, label: shadow.label, efforts: [...shadow.efforts], custom: 'global', hasEnv: !!shadow.env, routed: routedOf(shadow.env), ...unreliable(lc) }
       : pshadow
         ? pluginShape(m.id, pshadow, lc)
-        : { ...m, custom: false, hasEnv: false });
+        : { ...m, custom: false, hasEnv: false, routed: false });
     seen.add(lc);
   }
   for (const m of globals) {
     const lc = m.id.toLowerCase();
     if (seen.has(lc)) continue; // predefined shadow, already emitted
     seen.add(lc);
-    out.push({ id: m.id, label: m.label, efforts: [...m.efforts], custom: 'global', hasEnv: !!m.env, ...unreliable(lc) });
+    out.push({ id: m.id, label: m.label, efforts: [...m.efforts], custom: 'global', hasEnv: !!m.env, routed: routedOf(m.env), ...unreliable(lc) });
   }
   for (const m of plugins) {
     const lc = m.id.toLowerCase();
@@ -213,7 +214,7 @@ function composeCatalog(projectCustom = []) {
   for (const m of projectCustom) {
     if (seen.has(m.id.toLowerCase())) continue; // predefined/global/plugin wins
     seen.add(m.id.toLowerCase());
-    out.push({ id: m.id, label: m.label, efforts: [...EFFORTS], custom: 'project', hasEnv: false });
+    out.push({ id: m.id, label: m.label, efforts: [...EFFORTS], custom: 'project', hasEnv: false, routed: false });
   }
   return out;
 }
@@ -258,11 +259,24 @@ export function costUnreliableModelIds() {
  * @param {string} modelId
  * @param {number|null} costUsd  the reported cost (null when absent)
  * @param {object} [usage]
+ * @param {object|null} [costCfg]  this model's already-looked-up cost override
+ *   (modelCostConfig). Pass it when the caller has one in hand — every lookup is
+ *   a fresh settings.json read (settings.mjs is deliberately uncached), and the
+ *   result path needs the same answer for resolveModelCost. `undefined` = look
+ *   it up here; `null` = "checked, there is none".
  * @returns {'flagged'|'cleared'|null} what changed — 'flagged' asks the caller
  *   to surface its one-per-run warning; null = no observation recorded
  */
-export function observeModelCost(modelId, costUsd, usage) {
+export function observeModelCost(modelId, costUsd, usage, costCfg = undefined) {
   if (!modelHasBaseUrlRouting(modelId)) return null;
+  // An explicit per-model cost override GOVERNS this model's spend (resolveModelCost
+  // below) — the CLI's own figure is never trusted for it, so the "unreliable"
+  // badge is meaningless. Never flag it, and lift any flag left from before the
+  // override existed. Derived state: a DB hiccup here must never fail the run.
+  if (costCfg !== undefined ? costCfg : modelCostConfig(modelId)) {
+    try { prepare('DELETE FROM model_cost_flags WHERE model_id = ?').run(String(modelId).trim()); } catch { /* derived */ }
+    return null;
+  }
   const u = usage && typeof usage === 'object' ? usage : {};
   const tokens = ['input_tokens', 'output_tokens', 'cache_creation_input_tokens', 'cache_read_input_tokens']
     .reduce((n, k) => n + (Number(u[k]) || 0), 0);
@@ -284,6 +298,164 @@ export function observeModelCost(modelId, costUsd, usage) {
   return null; // no cost AND no tokens (e.g. an errored run) — no signal either way
 }
 
+// ── per-model cost override (opt-in) ──────────────────────────────────────────
+// The Claude CLI computes total_cost_usd from its OWN per-model price table keyed
+// on the model NAME — so an on-prem/proxied endpoint (even one that returns no
+// cost) still gets a fabricated dollar figure, which observeModelCost cannot
+// distinguish from a real one once it is positive. A user who KNOWS a model's
+// real price (or that it is free) can pin it in the GLOBAL catalog; that override
+// then wins over whatever the CLI reports. Inspired by worca 0.x's cost_alias /
+// worca.pricing.models mechanism. Opt-in: with no override the CLI value stands.
+//
+// It governs EVERY surface that books spend, because they share one windowed
+// budget (cost-budget.mjs combinedWindowedSpendUsd): the orchestrator's result
+// intake and sub-agent telemetry (orchestrator.mjs), an Ask Worca turn (the
+// `resolveCost` hook ask/turn.mjs injects into the reducer), and the overview
+// agent's telemetry row. Re-pricing only some of them would leave the phantom
+// spend this exists to remove still inflating the budget from the others.
+
+/** The explicit cost override governing a model, or null. Shape: {free:true} |
+ *  {perMtok:{input?,output?,cacheRead?,cacheWrite?,cacheWrite1h?}} (USD per
+ *  million tokens). Resolved with the SAME precedence as the rest of a model's
+ *  configuration (§9.3, mirroring modelHasBaseUrlRouting): the user's GLOBAL
+ *  entry wins outright, else the winning PLUGIN entry's manifest price — a
+ *  plugin shipping a model on its own endpoint is exactly the case that needs
+ *  one. Note a global entry shadows the plugin's price even when it pins none:
+ *  taking over a model id means owning its pricing too, so the two layers can
+ *  never half-merge. Built-ins carry none. Never throws. */
+export function modelCostConfig(modelId) {
+  const id = typeof modelId === 'string' ? modelId.trim() : '';
+  if (!id) return null;
+  const lc = id.toLowerCase();
+  const entry = listGlobalModels().find((m) => m.id.toLowerCase() === lc);
+  if (entry) return entry.cost ?? null;
+  const pm = listPluginModels().find((m) => m.id.toLowerCase() === lc);
+  return pm?.cost ?? null;
+}
+
+/** The four token classes read off a usage object, accepting BOTH spellings in
+ *  play here: the RAW Claude result usage (`input_tokens`, …) that the pipeline
+ *  path carries, and Ask Worca's normalized persisted shape (`input`, `output`,
+ *  `cacheRead`, `cacheCreation` — ask/events.mjs normalizeUsage). Same tokens,
+ *  two names; a missing field counts as 0. Only the raw shape ever carries the
+ *  ephemeral cache-creation breakdown. */
+function usageTokens(u) {
+  const num = (v) => (Number.isFinite(Number(v)) ? Number(v) : 0);
+  const pick = (snake, camel) => (u[snake] != null ? num(u[snake]) : num(u[camel]));
+  const cc = u.cache_creation && typeof u.cache_creation === 'object' ? u.cache_creation : null;
+  return {
+    input: pick('input_tokens', 'input'),
+    output: pick('output_tokens', 'output'),
+    cacheRead: pick('cache_read_input_tokens', 'cacheRead'),
+    cacheWrite: pick('cache_creation_input_tokens', 'cacheCreation'),
+    eph1h: cc ? num(cc.ephemeral_1h_input_tokens) : 0,
+    eph5m: cc ? num(cc.ephemeral_5m_input_tokens) : 0,
+  };
+}
+
+/** True when `usage` is an object that actually reports token counts — i.e. it
+ *  can be priced. A result event that carried NO usage at all is unpriceable and
+ *  must not be silently booked at $0 (resolveModelCost returns NaN for it); an
+ *  object whose counts are genuinely all zero IS priceable, at $0. */
+export function isPriceableUsage(usage) {
+  if (!usage || typeof usage !== 'object') return false;
+  return ['input_tokens', 'output_tokens', 'cache_read_input_tokens', 'cache_creation_input_tokens',
+    'cache_creation', 'input', 'output', 'cacheRead', 'cacheCreation'].some((k) => usage[k] != null);
+}
+
+/** Estimate USD from a `usage` object (either spelling, see usageTokens) and a
+ *  per-million-token rate table (mirrors worca 0.x estimate_cost). Absent rates/
+ *  fields count as 0. When the CLI breaks cache-creation into ephemeral 1h/5m
+ *  buckets they are priced separately (1h falls back to the cacheWrite rate);
+ *  otherwise the flat cache_creation_input_tokens total is priced at cacheWrite. */
+export function estimateCost(usage, perMtok) {
+  if (!perMtok || typeof perMtok !== 'object') return 0;
+  const u = usage && typeof usage === 'object' ? usage : {};
+  const num = (v) => (Number.isFinite(Number(v)) ? Number(v) : 0);
+  const rate = (k) => num(perMtok[k]);
+  const t = usageTokens(u);
+  const cacheWriteCost = (t.eph1h || t.eph5m)
+    ? (t.eph5m * rate('cacheWrite')
+        + t.eph1h * (perMtok.cacheWrite1h != null ? rate('cacheWrite1h') : rate('cacheWrite'))) / 1e6
+    : t.cacheWrite * rate('cacheWrite') / 1e6;
+  return (
+    t.input * rate('input')
+    + t.output * rate('output')
+    + t.cacheRead * rate('cacheRead')
+  ) / 1e6 + cacheWriteCost;
+}
+
+/**
+ * The AUTHORITATIVE cost for a dispatched model: the CLI's own figure unless the
+ * model carries an explicit override, which then wins. {free} → $0; {perMtok} →
+ * recomputed from `usage`. This is what stops a CLI that prices an on-prem model
+ * by name from inflating the ledger. With no override, `cliCostUsd` is returned
+ * verbatim (finite or not — the caller already gates on Number.isFinite).
+ *
+ * ONLY call this on a genuinely cost-bearing event. A {free} model answers 0 for
+ * ANY input, so feeding it a non-result stream frame (whose `cliCostUsd` is NaN)
+ * would turn "nothing to record" into a real $0 the caller then books.
+ *
+ * A {perMtok} model is priced from tokens ALONE, so a result that carried no
+ * usage object at all is UNPRICEABLE: NaN comes back rather than a silent $0, so
+ * the caller's existing "no cost estimate" branch reports it instead of the
+ * operator quietly under-billing a model they explicitly asked to be priced.
+ * @param {string} modelId  the dispatched model id
+ * @param {number} cliCostUsd  the cost the CLI reported (may be NaN)
+ * @param {object} [usage]  the result event's usage object (either spelling)
+ * @param {object|null} [costCfg]  this model's already-looked-up cost override;
+ *   `undefined` = look it up here (see observeModelCost's note on sharing it)
+ * @returns {number}
+ */
+export function resolveModelCost(modelId, cliCostUsd, usage, costCfg = undefined) {
+  const cost = costCfg !== undefined ? costCfg : modelCostConfig(modelId);
+  if (!cost) return cliCostUsd;
+  if (cost.free) return 0;
+  if (cost.perMtok) return isPriceableUsage(usage) ? estimateCost(usage, cost.perMtok) : NaN;
+  return cliCostUsd;
+}
+
+// ── display-only list prices ──────────────────────────────────────────────────
+// USD per MILLION tokens for the built-in ids, from Anthropic's published
+// pricing (platform.claude.com/docs/en/pricing — snapshot 2026-06-24). DISPLAY
+// APPROXIMATION ONLY: it feeds the chat footer's live "≈" estimate while a turn
+// streams (ask/events.mjs `estimatedCostUsd`). The CLI's result.total_cost_usd,
+// re-priced by resolveModelCost, stays the ONLY figure any message row, thread
+// total, ledger or budget ever books — nothing here is read by those paths.
+// Ids missing here get no estimate (null), which is the pre-existing behaviour;
+// `[1m]` twins and dated ids resolve to their base row (the long-context premium
+// is not modelled). cacheWrite = 1.25× input (5-minute TTL), cacheWrite1h = 2×
+// input, cacheRead = 0.1× input except Fable 5.1 (0.025×). Refresh by hand when
+// Anthropic moves a price. PREDEFINED_MODELS itself stays untouched — its entry
+// shape is pinned (test/config-models-global.test.mjs:205).
+export const PREDEFINED_LIST_PRICES = Object.freeze({
+  'claude-fable-5-1':  { input: 10, output: 50, cacheRead: 0.25, cacheWrite: 12.5, cacheWrite1h: 20 },
+  'claude-opus-5':     { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-opus-4-8':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-opus-4-7':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-opus-4-6':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-sonnet-5':   { input: 2,  output: 10, cacheRead: 0.2,  cacheWrite: 2.5,  cacheWrite1h: 4 },
+  'claude-sonnet-4-6': { input: 3,  output: 15, cacheRead: 0.3,  cacheWrite: 3.75, cacheWrite1h: 6 },
+  'claude-haiku-4-5':  { input: 1,  output: 5,  cacheRead: 0.1,  cacheWrite: 1.25, cacheWrite1h: 2 },
+});
+
+const FREE_RATES = Object.freeze({ input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cacheWrite1h: 0 });
+
+/** The per-Mtok rates a DISPLAY estimate may price `modelId` with: the operator's
+ *  modelCostConfig override when one exists ({free} → all-zero rates, so a free
+ *  model estimates $0 instead of a list price), else the built-in list price,
+ *  else null (no estimate). Never throws. */
+export function liveCostRates(modelId) {
+  const id = typeof modelId === 'string' ? modelId.trim() : '';
+  if (!id) return null;
+  let cfg = null;
+  try { cfg = modelCostConfig(id); } catch { cfg = null; }
+  if (cfg && cfg.free === true) return FREE_RATES;
+  if (cfg && cfg.perMtok && typeof cfg.perMtok === 'object') return cfg.perMtok;
+  const base = id.toLowerCase().replace(/\[1m\]$/, '').replace(/-\d{8}$/, '');
+  return PREDEFINED_LIST_PRICES[base] ?? null;
+}
+
 /**
  * All selectable models for a project = the effective catalog (predefined ⊕
  * global ⊕ this project's legacy custom models). Legacy custom models
@@ -388,6 +560,27 @@ function inheritOr(next, prev) {
   return typeof prev === 'boolean' ? prev : undefined;
 }
 
+/**
+ * Tri-state resolution for the STRING tunable (subagentModel), shared by setStep
+ * and setNodeModel. It is preserve-on-absent rather than replace-like model/effort
+ * on purpose: the field arrived after the write APIs shipped, so an older client
+ * (or any caller that only means to change the model) POSTs without it and must
+ * not silently wipe a configured sub-agent policy.
+ *   a valid value -> that value
+ *   '' or null    -> undefined = cleared (an explicit "inherit again")
+ *   absent        -> the previous value
+ * An unknown non-empty string is treated as absent: the enum is validated at the
+ * API boundary, and a typo must not clear a working setting.
+ * @param {unknown} next
+ * @param {unknown} prev
+ * @returns {string|undefined}
+ */
+function inheritOrSubagentModel(next, prev) {
+  if (isSubagentModelValue(next)) return next;
+  if (next === null || next === '') return undefined;
+  return isSubagentModelValue(prev) ? prev : undefined;
+}
+
 /**
  * Set (or clear) the model + effort for one agent step. An empty model => inherit
  * the global/CLI default; an empty effort => model default. Effort must be supported
@@ -411,6 +604,11 @@ export async function setStep(projectDir, step, selection = {}) {
     }
   }
 
+  {
+    const issue = subagentModelIssue(selection.subagentModel);
+    if (issue) throw new Error(issue);
+  }
+
   const key = projectKey(projectDir);
   const cfg = readRaw(projectDir);
   const prev = cfg.steps[step] || {};
@@ -422,12 +620,16 @@ export async function setStep(projectDir, step, selection = {}) {
   // askQuestions mirrors fanOut: preserved when omitted (only the toggle sends
   // it), set when a boolean (spec 2026-07-11 §4), cleared on null.
   const askQuestions = inheritOr(selection.askQuestions, prev.askQuestions);
+  // subagentModel: the sub-agent model policy for a fan-out node. Preserved when
+  // omitted (see inheritOrSubagentModel), cleared on '' / null.
+  const subagentModel = inheritOrSubagentModel(selection.subagentModel, prev.subagentModel);
 
   const steps = { ...cfg.steps };
-  if (!model && !effort && fanOut === undefined && askQuestions === undefined) delete steps[step];
+  if (!model && !effort && !subagentModel && fanOut === undefined && askQuestions === undefined) delete steps[step];
   else steps[step] = {
     ...(model && { model }),
     ...(effort && { effort }),
+    ...(subagentModel && { subagentModel }),
     ...(fanOut !== undefined && { fanOut }),
     ...(askQuestions !== undefined && { askQuestions }),
   };
@@ -523,16 +725,19 @@ export async function promoteCustomModel(projectDir, id) {
 // nested shape from those rows. activeWorkflowId is project_config.active_workflow_id;
 // unknown top-level keys (e.g. webUiTesting) round-trip via project_config.extra.
 
-/** Coerce a per-node selection to a clean {model?,effort?,fanOut?,askQuestions?} or null (all empty). */
+/** Coerce a per-node selection to a clean {model?,effort?,subagentModel?,fanOut?,askQuestions?}
+ *  or null (all empty). */
 function cleanNodeSel(selection) {
   const model = typeof selection?.model === 'string' ? selection.model.trim() : '';
   const effort = typeof selection?.effort === 'string' ? selection.effort.trim() : '';
+  const subagentModel = isSubagentModelValue(selection?.subagentModel) ? selection.subagentModel : '';
   const fanOut = typeof selection?.fanOut === 'boolean' ? selection.fanOut : undefined;
   const askQuestions = typeof selection?.askQuestions === 'boolean' ? selection.askQuestions : undefined;
-  if (!model && !effort && fanOut === undefined && askQuestions === undefined) return null;
+  if (!model && !effort && !subagentModel && fanOut === undefined && askQuestions === undefined) return null;
   return {
     ...(model && { model }),
     ...(effort && { effort }),
+    ...(subagentModel && { subagentModel }),
     ...(fanOut !== undefined && { fanOut }),
     ...(askQuestions !== undefined && { askQuestions }),
   };
@@ -547,17 +752,23 @@ function cleanNodeSel(selection) {
  */
 function readWorkflowsMap(key) {
   getDb();
-  const workflows = {};
+  // NULL-prototype accumulator, deliberately: a stored workflow_id of
+  // '__proto__' would resolve truthy to Object.prototype on a plain `{}` and the
+  // next `.wires[id] =` would throw FOREVER for that project (MAJ-1). With no
+  // prototype, `workflows['__proto__'] = ...` is an ordinary own property, so a
+  // poisoned row degrades to a visible junk entry instead of a permanent 500.
+  const workflows = Object.create(null);
   const ensure = (wf) => {
-    if (!workflows[wf]) workflows[wf] = { nodes: {}, feedbacks: {} };
+    if (!workflows[wf]) workflows[wf] = { nodes: {}, feedbacks: {}, wires: {} };
     return workflows[wf];
   };
   for (const r of prepare(
-    'SELECT workflow_id, node_id, model, effort, fan_out, ask_questions FROM config_workflow_nodes WHERE project_key = ?'
+    'SELECT workflow_id, node_id, model, effort, fan_out, ask_questions, subagent_model FROM config_workflow_nodes WHERE project_key = ?'
   ).all(key)) {
     const sel = {};
     if (r.model) sel.model = r.model;
     if (r.effort) sel.effort = r.effort;
+    if (isSubagentModelValue(r.subagent_model)) sel.subagentModel = r.subagent_model;
     if (r.fan_out !== null && r.fan_out !== undefined) sel.fanOut = !!r.fan_out;
     if (r.ask_questions !== null && r.ask_questions !== undefined) sel.askQuestions = !!r.ask_questions;
     // Only attach a node entry that carries something (matches cleanNodeSel output).
@@ -568,7 +779,17 @@ function readWorkflowsMap(key) {
   ).all(key)) {
     ensure(r.workflow_id).feedbacks[r.fb_id] = { maxCycles: r.max_cycles };
   }
-  return workflows;
+  // v23: per-loop-wire budgets (the graph twin of config_workflow_feedbacks).
+  for (const r of prepare(
+    'SELECT workflow_id, wire_id, max_cycles FROM config_workflow_wires WHERE project_key = ?'
+  ).all(key)) {
+    ensure(r.workflow_id).wires[r.wire_id] = { maxCycles: r.max_cycles };
+  }
+  // Hand callers an ORDINARY object: spread copies with CreateDataProperty, so a
+  // '__proto__' key stays an own enumerable property (a plain assignment would
+  // have hit the setter and silently vanished) while the public shape — what
+  // JSON.stringify and every deepEqual in the suite see — is unchanged.
+  return { ...workflows };
 }
 
 /**
@@ -598,8 +819,8 @@ export async function readRunConfig(projectDir) {
 }
 
 /**
- * Set (or clear) the model+effort+fanOut+askQuestions for one node instance of a
- * workflow. A cleaned selection of null (all blank) deletes the row. fanOut and
+ * Set (or clear) the model+effort+subagentModel+fanOut+askQuestions for one node
+ * instance of a workflow. A cleaned selection of null (all blank) deletes the row. fanOut and
  * askQuestions are preserved when the caller omits them (read from the existing
  * row), set when a boolean, and cleared on an explicit null. Writes only the config_workflow_nodes table
  * (legacy view + extra untouched). Model/effort validate against the effective
@@ -609,7 +830,7 @@ export async function readRunConfig(projectDir) {
  * @param {string} projectDir
  * @param {string} workflowId
  * @param {string} nodeId
- * @param {{model?:string,effort?:string,fanOut?:boolean,askQuestions?:boolean}} selection
+ * @param {{model?:string,effort?:string,subagentModel?:string,fanOut?:boolean,askQuestions?:boolean}} selection
  * @returns {Promise<void>}
  */
 export async function setNodeModel(projectDir, workflowId, nodeId, selection = {}) {
@@ -626,16 +847,22 @@ export async function setNodeModel(projectDir, workflowId, nodeId, selection = {
     }
   }
 
+  {
+    const issue = subagentModelIssue(selection.subagentModel);
+    if (issue) throw new Error(issue);
+  }
+
   const key = projectKey(projectDir);
   getDb();
   const prev = prepare(
-    'SELECT fan_out, ask_questions FROM config_workflow_nodes WHERE project_key = ? AND workflow_id = ? AND node_id = ?'
+    'SELECT fan_out, ask_questions, subagent_model FROM config_workflow_nodes WHERE project_key = ? AND workflow_id = ? AND node_id = ?'
   ).get(key, workflowId, nodeId);
   const prevFanOut = prev && prev.fan_out !== null && prev.fan_out !== undefined ? !!prev.fan_out : undefined;
   const fanOut = inheritOr(selection.fanOut, prevFanOut);
   const prevAsk = prev && prev.ask_questions !== null && prev.ask_questions !== undefined ? !!prev.ask_questions : undefined;
   const askQuestions = inheritOr(selection.askQuestions, prevAsk);
-  const sel = cleanNodeSel({ model: selection.model, effort: selection.effort, fanOut, askQuestions });
+  const subagentModel = inheritOrSubagentModel(selection.subagentModel, prev && prev.subagent_model);
+  const sel = cleanNodeSel({ model: selection.model, effort: selection.effort, subagentModel, fanOut, askQuestions });
 
   tx(() => {
     if (!sel) {
@@ -645,17 +872,19 @@ export async function setNodeModel(projectDir, workflowId, nodeId, selection = {
       return;
     }
     prepare(`
-      INSERT INTO config_workflow_nodes (project_key, workflow_id, node_id, model, effort, fan_out, ask_questions)
-      VALUES (?, ?, ?, ?, ?, ?, ?)
+      INSERT INTO config_workflow_nodes (project_key, workflow_id, node_id, model, effort, fan_out, ask_questions, subagent_model)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(project_key, workflow_id, node_id)
       DO UPDATE SET model = excluded.model, effort = excluded.effort,
-                    fan_out = excluded.fan_out, ask_questions = excluded.ask_questions
+                    fan_out = excluded.fan_out, ask_questions = excluded.ask_questions,
+                    subagent_model = excluded.subagent_model
     `).run(
       key, workflowId, nodeId,
       sel.model ?? null,
       sel.effort ?? null,
       sel.fanOut === undefined ? null : (sel.fanOut ? 1 : 0),
       sel.askQuestions === undefined ? null : (sel.askQuestions ? 1 : 0),
+      sel.subagentModel ?? null,
     );
   });
 }
@@ -681,6 +910,23 @@ export async function setFeedbackCycles(projectDir, workflowId, fbId, maxCycles)
   });
 }
 
+/**
+ * Set the cycle budget for ONE loop wire of a v2 workflow. Coerced to an integer
+ * >= 1 (a loop runs at least once), exactly like setFeedbackCycles — this never
+ * throws, so a stale UI value cannot 500 a save. Writes only config_workflow_wires.
+ */
+export async function setWireCycles(projectDir, workflowId, wireId, maxCycles) {
+  const n = Math.max(1, Math.floor(Number(maxCycles) || 0) || 1);
+  const key = projectKey(projectDir);
+  tx(() => {
+    prepare(`
+      INSERT INTO config_workflow_wires (project_key, workflow_id, wire_id, max_cycles)
+      VALUES (?, ?, ?, ?)
+      ON CONFLICT(project_key, workflow_id, wire_id) DO UPDATE SET max_cycles = excluded.max_cycles
+    `).run(key, workflowId, wireId, n);
+  });
+}
+
 /**
  * Drop every per-project override for one workflow — the New-Pipeline accordion's
  * "Reset to defaults" (newpipeline-ux-design.md §4.5). Deletes the workflow's
@@ -706,6 +952,7 @@ export async function resetWorkflowConfig(projectDir, workflowId) {
   tx(() => {
     prepare('DELETE FROM config_workflow_nodes WHERE project_key = ? AND workflow_id = ?').run(key, id);
     prepare('DELETE FROM config_workflow_feedbacks WHERE project_key = ? AND workflow_id = ?').run(key, id);
+    prepare('DELETE FROM config_workflow_wires WHERE project_key = ? AND workflow_id = ?').run(key, id);
     if (clearLegacy) {
       prepare(`
         INSERT INTO project_config (project_key, steps, custom_models, active_workflow_id, extra)
@@ -746,6 +993,7 @@ export async function resolveRunConfig(projectDir, workflowId) {
   const wf = readWorkflowsMap(projectKey(projectDir))[workflowId] || {};
   return {
     nodes: wf.nodes && typeof wf.nodes === 'object' ? wf.nodes : {},
+    wires: wf.wires && typeof wf.wires === 'object' ? wf.wires : {},
     feedbacks: wf.feedbacks && typeof wf.feedbacks === 'object' ? wf.feedbacks : {},
   };
 }
@@ -864,16 +1112,34 @@ export async function removeGlobalModelAndRefs(id) {
         if (!stepKeysByProject.has(r.projectKey)) continue;
         const filtered = {};
         for (const [k, v] of Object.entries(r.steps)) {
-          if (v?.model && v.model.toLowerCase() === lc) { clearedSteps += 1; continue; }
+          if (v?.model && v.model.toLowerCase() === lc) {
+            // Clear ONLY the dangling ref (and the effort that travels with its
+            // model); fanOut/askQuestions/subagentModel are not the removed
+            // model's business and must survive — mirroring cleanNodeSel's
+            // emptiness rule, the entry itself goes only when nothing is left.
+            clearedSteps += 1;
+            const { model: _m, effort: _e, ...rest } = v;
+            if (Object.keys(rest).length) filtered[k] = rest;
+            continue;
+          }
           filtered[k] = v;
         }
         prepare('UPDATE project_config SET steps = ? WHERE project_key = ?')
           .run(JSON.stringify(filtered), r.projectKey);
       }
       for (const n of refs.nodes) {
-        clearedNodes += prepare(
-          'DELETE FROM config_workflow_nodes WHERE project_key = ? AND workflow_id = ? AND node_id = ?'
-        ).run(n.projectKey, n.workflowId, n.nodeId).changes;
+        // Same rule for node rows: NULL the model+effort, keep the other
+        // tunables, and drop the row only once every column is NULL (matching
+        // readWorkflowsMap, which would not surface an all-NULL row anyway).
+        clearedNodes += prepare(`
+          UPDATE config_workflow_nodes SET model = NULL, effort = NULL
+          WHERE project_key = ? AND workflow_id = ? AND node_id = ?
+        `).run(n.projectKey, n.workflowId, n.nodeId).changes;
+        prepare(`
+          DELETE FROM config_workflow_nodes
+          WHERE project_key = ? AND workflow_id = ? AND node_id = ?
+            AND fan_out IS NULL AND ask_questions IS NULL AND subagent_model IS NULL
+        `).run(n.projectKey, n.workflowId, n.nodeId);
       }
     });
   }

package/src/core/cost-budget.mjs

@@ -54,6 +54,33 @@ export function windowedSpendUsd(windowStartMs) {
   return roundUsd(row?.s || 0);
 }
 
+/** Append one Ask Worca cost event (ask-cost-statistics-design.md §7.1). Same
+ *  no-op gate as recordCostDelta: turns that ended before a `result` frame
+ *  (amountUsd null, §6.2.8 of the ask spec) and $0 mock turns leave no row.
+ *  messageId is the v20 backfill's idempotency key (db.mjs NOT EXISTS on
+ *  l.message_id) — every live caller must pass it. */
+export function recordAskCostDelta({ threadId, messageId = null, amountUsd,
+                                     tokens = null, model = null, tsMs = Date.now() }) {
+  if (!threadId || !Number.isFinite(amountUsd) || amountUsd <= 0) return;
+  prepare(`INSERT INTO ask_cost_ledger (thread_id, message_id, amount_usd, tokens, model, ts)
+    VALUES (?, ?, ?, ?, ?, ?)`).run(threadId, messageId, amountUsd, tokens, model, tsMs);
+}
+
+/** Windowed Ask Worca spend; toMs null = open-ended (budget windows), else ts < toMs. */
+export function askWindowedSpendUsd(fromMs, toMs = null) {
+  const row = toMs == null
+    ? prepare('SELECT SUM(amount_usd) AS s FROM ask_cost_ledger WHERE ts >= ?').get(fromMs)
+    : prepare('SELECT SUM(amount_usd) AS s FROM ask_cost_ledger WHERE ts >= ? AND ts < ?').get(fromMs, toMs);
+  return roundUsd(row?.s || 0);
+}
+
+/** Pipeline + Ask Worca spend since windowStartMs — THE enforcement figure
+ *  (count-everywhere, ask-cost-statistics-design.md D3). windowedSpendUsd /
+ *  allTimeTotals stay pipeline-only for the Statistics split. */
+export function totalWindowSpendUsd(windowStartMs) {
+  return roundUsd(windowedSpendUsd(windowStartMs) + askWindowedSpendUsd(windowStartMs));
+}
+
 /** All-time spend + active time over ALL pipelines (archived included),
  *  falling back to per-step sums when the row total is 0. */
 export function allTimeTotals() {
@@ -86,7 +113,7 @@ export function budgetStatus(now = new Date()) {
   const totalLimitUsd = totalCostLimitUsd();
   const windowStartMs = costWindowStart(now, resetPeriod).getTime();
   const windowEndMs = costWindowEnd(now, resetPeriod).getTime();
-  const windowSpendUsd = windowedSpendUsd(windowStartMs);
+  const windowSpendUsd = totalWindowSpendUsd(windowStartMs);
   const blocked = totalLimitUsd != null && windowSpendUsd >= totalLimitUsd;
   return {
     pipelineLimitUsd,
@@ -96,7 +123,7 @@ export function budgetStatus(now = new Date()) {
     windowEndMs,
     msUntilReset: windowEndMs - now.getTime(),
     windowSpendUsd,
-    allTimeSpendUsd: allTimeTotals().spendUsd,
+    allTimeSpendUsd: roundUsd(allTimeTotals().spendUsd + askWindowedSpendUsd(0)),
     remainingUsd: totalLimitUsd == null ? null : Math.max(0, roundUsd(totalLimitUsd - windowSpendUsd)),
     blocked,
   };