@worca/app 1.1.1 → 1.2.0-rc.1

package/src/core/claude-runner.mjs

@@ -34,9 +34,11 @@
 
 import { spawn } from 'node:child_process';
 import { createInterface } from 'node:readline';
-import { prepareModelEnv } from './model-env.mjs';
+import { prepareModelEnv, envFlag, describeModelEnv } from './model-env.mjs';
+import { effectiveDebugSpawn } from './settings.mjs';
 import { classifyError, strongestClass } from './recoverable-error.mjs';
 import { explainUnspawnableClaude, resolveClaudeBin } from './preflight.mjs';
+import { hostGuardEnabled, hostGuardHookEntry, hostGuardSystemPrompt } from './host-guard.mjs';
 import { writeFile, mkdir, appendFile, readFile, access } from 'node:fs/promises';
 import { constants as FS, mkdtempSync, writeFileSync, rmSync } from 'node:fs';
 import { dirname, join } from 'node:path';
@@ -56,9 +58,14 @@ export function sigkillGraceMs() {
 }
 
 /** What `--settings` carries, or null when there is nothing to carry (no hook
- *  telemetry, no permission rules) — then the flag is omitted entirely. */
-export function buildSettingsPayload(permissionRules) {
+ *  telemetry, no permission rules, no host guard) — then the flag is omitted
+ *  entirely. `hostGuard` (set by runReal, gated by hostGuardEnabled) merges the
+ *  host-process-protection PreToolUse hook into the SAME single payload; the
+ *  returned `hook` flag stays telemetry-only (it drives --include-hook-events,
+ *  which the guard does not need). */
+export function buildSettingsPayload(permissionRules, { hostGuard = false } = {}) {
   const hook = buildHookSettings();
+  const guard = hostGuard && hostGuardEnabled() ? hostGuardHookEntry() : null;
   const hasRules = !!permissionRules && Object.values(permissionRules).some((a) => Array.isArray(a) && a.length);
   // Present-but-malformed rules (e.g. `{deny: 'Bash(curl:*)'}`) make the object
   // truthy while hasRules stays false, so the whole policy would drop out of
@@ -69,9 +76,13 @@ export function buildSettingsPayload(permissionRules) {
       && Object.values(permissionRules).some((a) => a != null && !Array.isArray(a))) {
     console.warn('[worca] guardrails: permissionRules is malformed (deny/allow/ask must be arrays of strings) — ignoring it; this spawn carries NO permission rules');
   }
-  if (!hook && !hasRules) return null;
+  if (!hook && !hasRules && !guard) return null;
   const settings = {};
-  if (hook) settings.hooks = hook.hooks;
+  if (hook) settings.hooks = { ...hook.hooks };
+  if (guard) {
+    settings.hooks = settings.hooks ?? {};
+    settings.hooks.PreToolUse = [...(settings.hooks.PreToolUse ?? []), guard];
+  }
   if (hasRules) settings.permissions = permissionRules;
   return { hook: !!hook, settings };
 }
@@ -100,6 +111,21 @@ export function argvLength(bin, args) {
   return String(bin || '').length + args.reduce((n, a) => n + String(a).length + 3, 0);
 }
 
+const ARGV_VALUE_PREVIEW = 64;
+
+/** A copy of `args` safe to log: EVERY token longer than ARGV_VALUE_PREVIEW is
+ *  shortened to a 64-char prefix + "…(<N> chars)". Token-level, not flag-aware, on
+ *  purpose: an inline prompt, the `--settings` JSON (uncapped for a custom rule
+ *  set), `--allowedTools`, `--mcp-config` — any free-text value buildClaudeArgs
+ *  adds later — is capped without this list having to track it. Flags and short
+ *  values pass through verbatim, so argv order is always preserved. Pure. */
+export function redactArgvForLog(args) {
+  return args.map((a) => {
+    const v = String(a);
+    return v.length > ARGV_VALUE_PREVIEW ? `${v.slice(0, ARGV_VALUE_PREVIEW)}…(${v.length} chars)` : v;
+  });
+}
+
 /** Log each npm-shim resolution once per process, not once per spawn. */
 const _resolveNoted = new Set();
 
@@ -107,9 +133,15 @@ const _resolveNoted = new Set();
  *  explanation when that is what actually went wrong (ENOENT on a bare name
  *  whose only PATH hit is claude.cmd; EINVAL on an explicit .cmd). */
 function spawnFailure(bin, err, prefix) {
-  const hint = /ENOENT|EINVAL/.test(String(err && err.code || err && err.message || ''))
-    ? explainUnspawnableClaude(bin) : null;
-  return new Error(`${prefix}: ${err.message}${hint ? ` — ${hint}` : ''}`);
+  const unspawnable = /ENOENT|EINVAL/.test(String(err && err.code || err && err.message || ''));
+  const hint = unspawnable ? explainUnspawnableClaude(bin) : null;
+  const out = new Error(`${prefix}: ${err.message}${hint ? ` — ${hint}` : ''}`);
+  // An unspawnable CLI (not installed / not on PATH) is user-fixable, not a
+  // pipeline bug: stamp the recovery class so the orchestrator's gate pauses
+  // the run for manual resume instead of hard-failing it (ENOENT matches no
+  // message-sniff pattern, so without the stamp it would classify null).
+  if (unspawnable) out.errorClass = 'network';
+  return out;
 }
 
 // Cap for the stderr detail embedded in a non-zero-exit Error message. The
@@ -150,10 +182,30 @@ export function buildEffortArgs(effort) {
  * and the baseline sub-agent lifecycle (tool_use/tool_result) is unaffected.
  */
 export function subagentHooksEnabled() {
-  const v = process.env.WORCA_SUBAGENT_HOOKS;
-  return !!v && v !== '0' && v.toLowerCase() !== 'false';
+  return envFlag('WORCA_SUBAGENT_HOOKS');
+}
+
+/**
+ * Opt-in spawn diagnostics, DEFAULT OFF. A NON-EMPTY WORCA_DEBUG_SPAWN in the
+ * environment wins (envFlag rule: any value but "0"/"false" turns it on, so an
+ * exported "0" is an explicit OFF); otherwise the stored `debugSpawnEnabled`
+ * setting applies — read fresh per spawn (settings.mjs#effectiveDebugSpawn, the
+ * one precedence rule the settings API also reports), so the UI checkbox reaches
+ * the next spawn in this process AND in a CLI run with no restart and no env
+ * mutation. OFF ⇒ runReal emits NO spawn-debug event and does not touch
+ * argv/env, so the spawn path is byte-identical to today. (The once-per-process
+ * "routing env applied" confirmation below is a separate, always-on line: it
+ * fires only for a model env that carries an ANTHROPIC_* routing key, once per
+ * distinct model + env, never per spawn.) Read directly in runReal (not a
+ * runClaude option) so it bypasses the runClaude→runReal gate by construction.
+ */
+export function debugSpawnEnabled() {
+  return effectiveDebugSpawn().enabled;
 }
 
+/** Once per process per distinct (model, described env): see runReal. */
+const _routingNoted = new Set();
+
 // ── Sub-agent telemetry + the --settings seam ────────────────────────────────
 // Telemetry is GATED (subagentHooksEnabled) and OFF by default. When on it adds
 // `--include-hook-events` (surfaces hook lifecycle on the SAME stdout stream)
@@ -179,10 +231,11 @@ export function buildHookSettings() {
  * [] when there is nothing to say, so the baseline argv is byte-identical.
  * @param {{deny?:string[],allow?:string[],ask?:string[]}|null|undefined} permissionRules
  * @param {string|null} [settingsFile] staged path (GH #380): `--settings <path>` carries the same JSON
+ * @param {{hostGuard?:boolean}} [opts] host-process guard (runReal sets it; see buildSettingsPayload)
  * @returns {string[]}
  */
-export function buildSettingsArgs(permissionRules, settingsFile = null) {
-  const payload = buildSettingsPayload(permissionRules);
+export function buildSettingsArgs(permissionRules, settingsFile = null, { hostGuard = false } = {}) {
+  const payload = buildSettingsPayload(permissionRules, { hostGuard });
   if (!payload) return [];
   const args = [];
   if (payload.hook) args.push('--include-hook-events');
@@ -245,8 +298,7 @@ export function buildSpawnEnv(envScrub, envAllowlist) {
  */
 export function mockEnabled(opts) {
   if (opts && opts.mock) return true;
-  const v = process.env.WORCA_MOCK ?? process.env.ORCH_MOCK;
-  return !!v && v !== '0' && v.toLowerCase() !== 'false';
+  return envFlag('WORCA_MOCK', 'ORCH_MOCK');
 }
 
 /**
@@ -403,7 +455,7 @@ export function buildClaudeArgs({
   // way in because the legacy body below already owns a local `tools` (the
   // --allowedTools union).
   tools: builtinTools, strictMcpConfig, settingSources, disableSlashCommands, includePartialMessages,
-  maxTurns, maxBudgetUsd, appendSubagentSystemPrompt,
+  maxTurns, maxBudgetUsd, appendSubagentSystemPrompt, hostGuard,
 }, delivery = {}) {
   // delivery (GH #380, set only by planClaudeInvocation's staged branch):
   //   promptViaStdin   -> bare `-p`; the prompt is written to the child's stdin
@@ -426,7 +478,7 @@ export function buildClaudeArgs({
   // SINGLE inline JSON (two --settings flags would be last-wins at the CLI). [] when
   // there is neither, so the baseline argv is unchanged; a CLI that rejects these
   // flags would only ever fail when the operator opted in.
-  for (const a of buildSettingsArgs(permissionRules, settingsFile)) args.push(a);
+  for (const a of buildSettingsArgs(permissionRules, settingsFile, { hostGuard })) args.push(a);
   if (mcpConfigPath) args.push('--mcp-config', mcpConfigPath);
   const tools = Array.isArray(allowedTools) ? allowedTools.slice() : [];
   for (const s of (Array.isArray(mcpServerGrants) ? mcpServerGrants : [])) {
@@ -496,7 +548,7 @@ export function planClaudeInvocation(opts, { bin = DEFAULT_BIN, dir = null, limi
     files.push({ path: systemPromptFile, content: opts.systemPrompt });
   }
   let settingsFile = null;
-  const payload = buildSettingsPayload(opts.permissionRules);
+  const payload = buildSettingsPayload(opts.permissionRules, { hostGuard: opts.hostGuard });
   if (payload) {
     settingsFile = join(dir, 'settings.json');
     files.push({ path: settingsFile, content: JSON.stringify(payload.settings) });
@@ -547,6 +599,23 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
     } else if (wireModel !== model) {
       console.warn(`[worca] model ${JSON.stringify(model ?? '')}: wire model ${JSON.stringify(wireModel)}`);
     }
+    // Confirm a resolved card's routing env actually reached a spawn — even when
+    // the wire id equals the catalog id, the case the wire-model line above stays
+    // silent for (that silence is exactly what hid a gateway card whose
+    // ANTHROPIC_MODEL matched its catalog id). Fires only for an env that carries
+    // an ANTHROPIC_* routing key (Ask Worca merges a CLAUDE_CODE_* knob into
+    // EVERY turn's env, which is not routing) and once per process per distinct
+    // line, like _resolveNoted — never per spawn. describeModelEnv prints the
+    // routing keys readable (endpoint, wire id — the diagnostic) and every other
+    // key as `<set, N chars>`: ANTHROPIC_AUTH_TOKEN and plugin {secret} values live
+    // in this map and no part of them may reach a log. Worded WITHOUT the
+    // substrings "wire model"/"modelEnv" — test/spawn-args.test.mjs counts by those.
+    const routingApplied = safeModelEnv && Object.keys(safeModelEnv).some((k) => k.startsWith('ANTHROPIC_'))
+      ? describeModelEnv(safeModelEnv) : null;
+    if (routingApplied) {
+      const line = `[worca] model ${JSON.stringify(model ?? '')}: routing env applied: ${routingApplied}`;
+      if (!_routingNoted.has(line)) { _routingNoted.add(line); console.warn(line); }
+    }
 
     // Windows + npm-installed Claude Code: the bare name is a .cmd shim Node
     // cannot spawn; resolveClaudeBin swaps in the package's native claude.exe.
@@ -562,10 +631,20 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
     // ARGV_INLINE_LIMIT). The staging dir, when any, is removed on every
     // terminal path below (finish) and on a failed spawn.
     const limit = Number.isFinite(argvInlineLimit) && argvInlineLimit > 0 ? argvInlineLimit : ARGV_INLINE_LIMIT;
+    // Host guard (host-guard.mjs, 2026-08-31 incident): every REAL spawn — any
+    // role, custom agent, plugin agent, ask chat — carries the protection
+    // preamble, the PreToolUse hook (hostGuard -> the --settings payload), and
+    // WORCA_HOST_PID (below). One kill-switch: WORCA_HOST_GUARD=0. Mock spawns
+    // nothing, so runMock stays untouched.
+    const guardOn = hostGuardEnabled();
+    const guardedSystemPrompt = guardOn
+      ? [hostGuardSystemPrompt(process.pid), systemPrompt].filter(Boolean).join('\n\n')
+      : systemPrompt;
     let plan;
     try {
       plan = stageClaudeInvocation({
-        prompt, systemPrompt, permissionMode, model: wireModel, effort, allowedTools, resumeSessionId,
+        prompt, systemPrompt: guardedSystemPrompt, hostGuard: guardOn,
+        permissionMode, model: wireModel, effort, allowedTools, resumeSessionId,
         mcpConfigPath, mcpServerGrants, permissionRules,
         tools, strictMcpConfig, settingSources, disableSlashCommands, includePartialMessages,
         maxTurns, maxBudgetUsd, appendSubagentSystemPrompt,
@@ -594,6 +673,29 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
     let spawnEnv = guardrailEnv;
     if (safeModelEnv) spawnEnv = { ...(guardrailEnv ?? process.env), ...safeModelEnv };
 
+    // WORCA_HOST_PID rides every guarded spawn (the hook reads it; scrub would
+    // drop it — WORCA_ is not an allowlisted prefix — so it is added AFTER).
+    if (guardOn) spawnEnv = { ...(spawnEnv ?? process.env), WORCA_HOST_PID: String(process.pid) };
+
+    // Opt-in spawn diagnostics (WORCA_DEBUG_SPAWN, default off — byte-identical spawn
+    // path when unset). Everything here is derived from values already computed above
+    // (safeModelEnv is null or non-empty, so the routing field is either the described
+    // env — secrets as `<set, N chars>` — or "(none)"). Emitted right before spawn so
+    // it reflects the exact bin/argv/env handed to the child, ONCE, as the same
+    // `stderr` event the child's own stderr rides (run-harness logs it at `warn`
+    // into the run stream and live-log.ndjson; nothing here also console.warns, so
+    // a run never prints the line twice). Field is `routingEnv`, not `modelEnv`:
+    // test/spawn-args.test.mjs counts "modelEnv" warnings for the dropped-key path.
+    if (debugSpawnEnabled()) {
+      const summary =
+        `[worca] spawn-debug: bin=${JSON.stringify(resolved.bin)} `
+        + `argv=${JSON.stringify(redactArgvForLog(args))} `
+        + `promptViaStdin=${plan.stdin != null} staged=${plan.staged} `
+        + `envScrub=${guardrailEnv ? 'on' : 'off'} childEnvKeys=${Object.keys(spawnEnv ?? process.env).length} `
+        + `routingEnv=[${safeModelEnv ? describeModelEnv(safeModelEnv) : '(none)'}]`;
+      safeEmit(onEvent, { type: 'stderr', stream: 'err', text: summary });
+    }
+
     let child;
     try {
       child = spawn(resolved.bin, args, {

package/src/core/config.mjs

@@ -57,14 +57,16 @@ export { EFFORTS };
  * The `[1m]` suffix selects the 1M-token long-context variant. Opus 4.6–4.8 and
  * Sonnet 4.6 1M ids were verified to resolve via `claude --model`; Haiku 4.5 1M
  * is intentionally omitted — the CLI rejects it ("long context beta is not yet
- * available for this subscription"). Fable 5 needs no `[1m]` suffix: its context
- * window is 1M by default (verified to resolve via `claude --model`). Opus 5
+ * available for this subscription"). Fable 5.1 needs no `[1m]` suffix: its context
+ * window is 1M by default (verified to resolve via `claude --model`, CLI 2.1.257).
+ * It replaced Fable 5 (`claude-fable-5`) on 2026-09-01; db.mjs V26 moves every
+ * stored pin on the retired id to the successor, so nothing keeps it here. Opus 5
  * (`claude-opus-5`) and Sonnet 5 (`claude-sonnet-5`) are likewise 1M-only and
  * carry no `[1m]` twin.
  */
 export const PREDEFINED_MODELS = [
   { id: 'claude-opus-5',          label: 'Opus 5',          efforts: ['medium', 'high', 'xhigh', 'max'] },
-  { id: 'claude-fable-5',         label: 'Fable 5 (1M)',    efforts: ['medium', 'high', 'xhigh', 'max'] },
+  { id: 'claude-fable-5-1',       label: 'Fable 5.1 (1M)',  efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-8',        label: 'Opus 4.8',        efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-8[1m]',    label: 'Opus 4.8 (1M)',   efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-7',        label: 'Opus 4.7',        efforts: ['medium', 'high', 'xhigh', 'max'] },
@@ -413,6 +415,47 @@ export function resolveModelCost(modelId, cliCostUsd, usage, costCfg = undefined
   return cliCostUsd;
 }
 
+// ── display-only list prices ──────────────────────────────────────────────────
+// USD per MILLION tokens for the built-in ids, from Anthropic's published
+// pricing (platform.claude.com/docs/en/pricing — snapshot 2026-06-24). DISPLAY
+// APPROXIMATION ONLY: it feeds the chat footer's live "≈" estimate while a turn
+// streams (ask/events.mjs `estimatedCostUsd`). The CLI's result.total_cost_usd,
+// re-priced by resolveModelCost, stays the ONLY figure any message row, thread
+// total, ledger or budget ever books — nothing here is read by those paths.
+// Ids missing here get no estimate (null), which is the pre-existing behaviour;
+// `[1m]` twins and dated ids resolve to their base row (the long-context premium
+// is not modelled). cacheWrite = 1.25× input (5-minute TTL), cacheWrite1h = 2×
+// input, cacheRead = 0.1× input except Fable 5.1 (0.025×). Refresh by hand when
+// Anthropic moves a price. PREDEFINED_MODELS itself stays untouched — its entry
+// shape is pinned (test/config-models-global.test.mjs:205).
+export const PREDEFINED_LIST_PRICES = Object.freeze({
+  'claude-fable-5-1':  { input: 10, output: 50, cacheRead: 0.25, cacheWrite: 12.5, cacheWrite1h: 20 },
+  'claude-opus-5':     { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-opus-4-8':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-opus-4-7':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-opus-4-6':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-sonnet-5':   { input: 2,  output: 10, cacheRead: 0.2,  cacheWrite: 2.5,  cacheWrite1h: 4 },
+  'claude-sonnet-4-6': { input: 3,  output: 15, cacheRead: 0.3,  cacheWrite: 3.75, cacheWrite1h: 6 },
+  'claude-haiku-4-5':  { input: 1,  output: 5,  cacheRead: 0.1,  cacheWrite: 1.25, cacheWrite1h: 2 },
+});
+
+const FREE_RATES = Object.freeze({ input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cacheWrite1h: 0 });
+
+/** The per-Mtok rates a DISPLAY estimate may price `modelId` with: the operator's
+ *  modelCostConfig override when one exists ({free} → all-zero rates, so a free
+ *  model estimates $0 instead of a list price), else the built-in list price,
+ *  else null (no estimate). Never throws. */
+export function liveCostRates(modelId) {
+  const id = typeof modelId === 'string' ? modelId.trim() : '';
+  if (!id) return null;
+  let cfg = null;
+  try { cfg = modelCostConfig(id); } catch { cfg = null; }
+  if (cfg && cfg.free === true) return FREE_RATES;
+  if (cfg && cfg.perMtok && typeof cfg.perMtok === 'object') return cfg.perMtok;
+  const base = id.toLowerCase().replace(/\[1m\]$/, '').replace(/-\d{8}$/, '');
+  return PREDEFINED_LIST_PRICES[base] ?? null;
+}
+
 /**
  * All selectable models for a project = the effective catalog (predefined ⊕
  * global ⊕ this project's legacy custom models). Legacy custom models

package/src/core/db.mjs

@@ -18,7 +18,7 @@
 
 import { createRequire } from 'node:module';
 import { mkdirSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, dirname } from 'node:path';
 import { worcaHome } from './projects.mjs';
 import { maybeMigrateFromFs } from './migrate-fs-to-db.mjs';
 import { SEED_TEMPLATES, NODE_ID_MAP, FB_WIRE_MAP } from './graph/seed-templates.mjs';
@@ -54,7 +54,7 @@ const OPEN_BACKOFF_MS = 15;
 /** Latest schema version. Bump + append a new migration step when the DDL grows.
  *  Exported so migration tests assert "reached the module's current version"
  *  instead of hardcoding the number — a schema bump then touches no test file. */
-export const SCHEMA_VERSION = 25;
+export const SCHEMA_VERSION = 27;
 
 /** Absolute path to the database file: <worcaHome>/worca-cc.db. */
 export function dbPath() {
@@ -103,15 +103,22 @@ function _openConfiguredMigrated() {
 }
 
 /**
- * True when err is a transient SQLite lock/busy that retrying can clear. Prefers the
- * structured errcode (5 = SQLITE_BUSY, 6 = SQLITE_LOCKED) and falls back to the message
- * so a lock is still caught on any node:sqlite build that doesn't populate errcode. A
- * false positive only costs a bounded retry that still re-throws the original error.
+ * True when err is a transient SQLite error that retrying the open can clear. Prefers
+ * the structured errcode — 5 = SQLITE_BUSY, 6 = SQLITE_LOCKED, and primary code 10 =
+ * SQLITE_IOERR (extended codes carry it in the low byte) — and falls back to the
+ * message so a lock is still caught on any node:sqlite build that doesn't populate
+ * errcode. IOERR is here for the first-launch race on Windows: while one process
+ * performs the journal_mode=WAL switch, a competitor opening the same file can get
+ * "disk I/O error" from the -wal/-shm files being created and unlinked under it
+ * (seen on the Windows 11 VM with 12 concurrent openers). A persistent I/O error
+ * still surfaces: the retry is bounded and re-throws the original error. A false
+ * positive only costs that bounded retry.
  */
 function _isBusyError(err) {
   if (err && (err.errcode === 5 || err.errcode === 6)) return true;
+  if (err && Number.isInteger(err.errcode) && (err.errcode & 0xff) === 10) return true;
   const msg = err && err.message ? err.message : String(err);
-  return /locked|busy/i.test(msg);
+  return /locked|busy|disk I\/O error/i.test(msg);
 }
 
 /** Synchronous sleep (node:sqlite is sync; we must block this thread, not yield it). */
@@ -745,6 +752,8 @@ const INCREMENTAL_COLUMNS = {
   workflows:              { domain: 'TEXT', origin: 'TEXT', graph: 'TEXT', archived_at: 'TEXT' },
   config_workflow_nodes:  { ask_questions: 'INTEGER', subagent_model: 'TEXT' },  // v25: sub-agent model policy
   ask_run_links:          { comment_ids: 'TEXT' },        // v22: JSON array of dc_ ids pending at launch
+  ask_attachments:        { kind: "TEXT NOT NULL DEFAULT 'text'",  // v27: text | image | binary (#398)
+                            mime: 'TEXT' },               // v27: sniffed mime; NULL on pre-v27 rows (= text)
 };
 
 /** v23: per-loop-wire cycle budgets, the graph-engine twin of
@@ -1080,6 +1089,77 @@ function applySchemaV25(db) {
   repairSchemaGaps(db, schemaGaps(db));
 }
 
+/** v26 (Fable 5.1 replaces Fable 5 in PREDEFINED_MODELS): a pin left on the
+ *  retired id would render as "(default model)" in every picker — its option is
+ *  gone — and be rejected on the next write (config.mjs `unknown model
+ *  "claude-fable-5"`), while the run itself kept passing the old id to
+ *  `claude --model`. So every stored pin moves to the successor: the
+ *  config_workflow_nodes.model column, the per-role project_config.steps JSON,
+ *  and node defaults inside workflows.graph (nodes[].config.model is the shape
+ *  workflows.mjs validates; a bare nodes[].model is covered too). Ids match
+ *  case-insensitively, as config.mjs compares them. History (pipelines,
+ *  sub_agents.run_model, ask_*) records what actually ran and is left alone.
+ *  A one-word rename is reversible, so unlike V24 it takes no backup. JSON
+ *  that does not parse is left exactly as found — a broken row must not take
+ *  the ladder down. */
+const V26_MODEL_RENAMES = [['claude-fable-5', 'claude-fable-5-1']];
+
+function applySchemaV26(db) {
+  for (const [from, to] of V26_MODEL_RENAMES) renameStoredModelPins(db, from, to);
+}
+
+/** v27 (Ask Worca binary attachments, #398): ask_attachments.kind/mime — plain
+ *  additive columns declared in INCREMENTAL_COLUMNS, applySchemaV25's shape: this
+ *  repairSchemaGaps call is what CREATES them on the ladder path (a DB stamped
+ *  exactly 26), reconcileSchema covers the fast path. Existing rows keep the
+ *  column DEFAULT 'text', which is exactly what every pre-v27 attachment is. */
+function applySchemaV27(db) {
+  repairSchemaGaps(db, schemaGaps(db));
+}
+
+/** Move every stored pin on model id `from` (lower-case) to `to`. Each table
+ *  is guarded like V24's: hand-seeded upgrade fixtures (and a DB from before the
+ *  fs->db import) reach this step without some of them. */
+function renameStoredModelPins(db, from, to) {
+  const hasTable = (t) => hasSqliteTable(db, t);
+  const isFrom = (v) => typeof v === 'string' && v.trim().toLowerCase() === from;
+  const renameIn = (sel) => {
+    if (!sel || typeof sel !== 'object' || !isFrom(sel.model)) return false;
+    sel.model = to;
+    return true;
+  };
+  if (hasTable('config_workflow_nodes')) {
+    db.prepare('UPDATE config_workflow_nodes SET model = ? WHERE lower(trim(model)) = ?').run(to, from);
+  }
+
+  const like = `%${from}%`;   // cheap pre-filter; the JSON walk below decides
+  const setSteps = hasTable('project_config') && db.prepare('UPDATE project_config SET steps = ? WHERE project_key = ?');
+  for (const row of setSteps ? db.prepare('SELECT project_key, steps FROM project_config WHERE steps LIKE ?').all(like) : []) {
+    let steps;
+    try { steps = JSON.parse(row.steps); } catch { continue; }
+    if (!steps || typeof steps !== 'object' || Array.isArray(steps)) continue;
+    let changed = false;
+    for (const sel of Object.values(steps)) changed = renameIn(sel) || changed;
+    if (changed) setSteps.run(JSON.stringify(steps), row.project_key);
+  }
+
+  const hasGraphColumn = () => db.prepare('PRAGMA table_info(workflows)').all().some((c) => c.name === 'graph');
+  const setGraph = hasTable('workflows') && hasGraphColumn()
+    && db.prepare('UPDATE workflows SET graph = ? WHERE id = ?');
+  for (const row of setGraph ? db.prepare('SELECT id, graph FROM workflows WHERE graph LIKE ?').all(like) : []) {
+    let graph;
+    try { graph = JSON.parse(row.graph); } catch { continue; }
+    if (!graph || typeof graph !== 'object' || !Array.isArray(graph.nodes)) continue;
+    let changed = false;
+    for (const node of graph.nodes) {
+      if (!node || typeof node !== 'object') continue;
+      changed = renameIn(node.config) || changed;
+      changed = renameIn(node) || changed;
+    }
+    if (changed) setGraph.run(JSON.stringify(graph), row.id);
+  }
+}
+
 /** Audit channel for V24 (dev convention: one console.warn per decision). */
 const auditV24 = (msg) => console.warn(`[worca] V24: ${msg}`);
 
@@ -1111,7 +1191,8 @@ function usableBackup(bak) {
 }
 
 /**
- * V24 is the ONLY ladder step that rewrites user data, so an existing DB is
+ * V24 is the only ladder step that rewrites user data destructively (V26 renames
+ * one model id, reversibly), so an existing DB is
  * snapshotted BEFORE the transaction opens (`VACUUM INTO` cannot run inside one
  * — measured: "cannot VACUUM from within a transaction"). Skipped for a fresh
  * file (nothing to lose) and for `:memory:` (PRAGMA database_list gives file '').
@@ -1141,7 +1222,7 @@ function backupBeforeV24(db) {
     throw new Error(`worca cannot take the pre-v24 database backup at ${bak}: `
       + `${err && err.message ? err.message : err}. The v2 upgrade rewrites saved `
       + 'pipelines, so it refuses to run without one — free disk space or make '
-      + `${file.replace(/\/[^/]*$/, '')} writable and start worca again.`, { cause: err });
+      + `${dirname(file)} writable and start worca again.`, { cause: err });
   }
 }
 
@@ -1417,6 +1498,8 @@ export function migrate(db) {
     if (current < 23) applySchemaV23(db);            // graph columns + config_workflow_wires
     if (current < 24) applySchemaV24(db, { existing: current >= 1 });  // the v2 break
     if (current < 25) applySchemaV25(db);            // sub-agent model policy + recorded child model
+    if (current < 26) applySchemaV26(db);            // Fable 5 pins -> Fable 5.1 (catalog swap)
+    if (current < 27) applySchemaV27(db);            // ask_attachments.kind/mime (#398)
     db.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
     db.exec('COMMIT');
   } catch (err) {