@worca/app 1.1.1 → 1.2.0-rc.2

package/src/core/ask/turn.mjs

@@ -16,7 +16,7 @@ import { join, dirname, resolve as pathResolve } from 'node:path';
 import { mkdir, writeFile, unlink } from 'node:fs/promises';
 
 import { runClaude } from '../claude-runner.mjs';
-import { resolveModelEnv, resolveModelCost } from '../config.mjs';
+import { resolveModelEnv, resolveModelCost, estimateCost, liveCostRates as defaultLiveCostRates } from '../config.mjs';
 import { worcaHome } from '../projects.mjs';
 import { generateTitle } from '../title.mjs';
 import { createTurnReducer } from './events.mjs';
@@ -40,6 +40,7 @@ class AskTurn extends EventEmitter {
     model, effort, resumeSessionId = null,
     firstTurn = false, firstText = '', deterministicTitle = null,
     mock = null, attachmentNames = {},
+    pinnedScope = null,
     deps = {},
   } = {}) {
     super();
@@ -57,6 +58,8 @@ class AskTurn extends EventEmitter {
     this.deterministicTitle = deterministicTitle ?? null;
     this.mock = mock || null;
     this.attachmentNames = attachmentNames || {};
+    // #397: {projectKey}|{workspaceId}|null — the user-pinned scope at POST time.
+    this.pinnedScope = pinnedScope && typeof pinnedScope === 'object' ? pinnedScope : null;
     this.deps = {
       runClaudeImpl: deps.runClaudeImpl ?? runClaude,
       store: {
@@ -84,6 +87,11 @@ class AskTurn extends EventEmitter {
       onFrame: deps.onFrame ?? (() => {}),
       onOutOfTurn: deps.onOutOfTurn ?? (() => {}),
       onCommentMutation: deps.onCommentMutation ?? (() => {}),
+      onWorktreeMutation: deps.onWorktreeMutation ?? (() => {}),
+      // DISPLAY-ONLY rates for the footer's live "≈" estimate (config.mjs
+      // liveCostRates: override → list price → null). Injectable so tests pin
+      // the frame arithmetic without the catalog.
+      liveCostRates: deps.liveCostRates ?? defaultLiveCostRates,
     };
     this.abort = new AbortController();
     this.status = 'created';
@@ -93,6 +101,7 @@ class AskTurn extends EventEmitter {
     this.sessionId = this.resumeSessionId;
     this.scratchDir = null;
     this.titlePromise = Promise.resolve();
+    this._titleKicked = false;
     this._completed = false;
   }
 
@@ -125,10 +134,23 @@ class AskTurn extends EventEmitter {
   async _onProposal(input) {
     const d = this.deps;
     const cardId = d.newAskId('card');
+    const raw = input && typeof input === 'object' ? input : {};
+    // #397: a proposal that names NO target falls back to the user-pinned scope.
+    // Mirrors the MCP child's own defaulting, so this authoritative re-validation
+    // builds the same card the model was shown.
+    const pin = this.pinnedScope;
+    const hasTarget = (typeof raw.projectKey === 'string' && raw.projectKey.trim())
+      || (typeof raw.workspaceId === 'string' && raw.workspaceId.trim());
+    const inp = pin && !hasTarget ? { ...raw, ...pin } : raw;
     try {
-      const r = await d.validateProposal(input && typeof input === 'object' ? input : {}, { cardId });
+      const r = await d.validateProposal(inp, { cardId });
       if (r && r.ok) {
-        this.reducer.addBlock({ kind: 'card', id: cardId, state: 'proposed', card: r.card });
+        // #397 guardrail: a proposal targeting a DIFFERENT project/workspace than
+        // the pinned one is accepted but flagged — the card renders the mismatch
+        // instead of silently absorbing it.
+        const scopeMismatch = !!pin && ((pin.projectKey && r.card.projectKey !== pin.projectKey)
+          || (pin.workspaceId && r.card.workspaceId !== pin.workspaceId));
+        this.reducer.addBlock({ kind: 'card', id: cardId, state: 'proposed', card: r.card, ...(scopeMismatch ? { scopeMismatch: true } : {}) });
         // commentIds are propose_run INPUT only: they never enter the card block (its
         // key set is pinned in test/ask-proposal.test.mjs) nor CARD_PATCH_KEYS. Parked
         // against the card id until the user starts the run; unknown ids are dropped,
@@ -148,6 +170,10 @@ class AskTurn extends EventEmitter {
 
   _makeReducer() {
     const d = this.deps;
+    // One settings read per attempt, never per frame. null → the frames carry
+    // estimatedCostUsd:null and the footer keeps today's behaviour.
+    let liveRates = null;
+    try { liveRates = d.liveCostRates(this.model) ?? null; } catch { liveRates = null; }
     this.reducer = createTurnReducer({
       onFrame: (f) => this._frame(f),
       now: d.now,
@@ -165,6 +191,13 @@ class AskTurn extends EventEmitter {
       // The MCP child cannot broadcast; the parent turns its comment writes into
       // the same poke the REST routes emit.
       onCommentMutation: (e) => { try { this.deps.onCommentMutation(e); } catch { /* a broken sink never breaks the turn */ } },
+      // Same shape for worktrees: open/remove/navigate in the child → the server
+      // broadcasts the thread's worktree envelope (ui/server.mjs emitAskWorktrees).
+      onWorktreeMutation: (e) => { try { this.deps.onWorktreeMutation(e); } catch { /* a broken sink never breaks the turn */ } },
+      // DISPLAY ONLY — never a sink input: prices the running usage sum (main +
+      // sub-agent tokens) at the TURN model's rates; the "≈" in the footer owns
+      // that approximation. _complete() reads summary.costUsd, not this.
+      estimateLiveCost: liveRates ? (usage) => estimateCost(usage, liveRates) : null,
     });
     return this.reducer;
   }
@@ -275,6 +308,11 @@ class AskTurn extends EventEmitter {
       const scratchDir = join(d.worcaHome(), 'tmp', 'ask');
       this.scratchDir = scratchDir;
       await d.fs.mkdir(scratchDir, { recursive: true });
+      // D13 title runs CONCURRENTLY with the turn from here — the haiku call
+      // cwd's into scratchDir, so not a line earlier. Idempotent: the call after
+      // _attempts below is the backstop for a mkdir/write failure, so "fires
+      // after ANY terminal status of the first turn" stays true.
+      this._kickoffTitle();
       const homeBase = process.env.WORCA_HOME?.trim()
         ? pathResolve(process.env.WORCA_HOME)
         : dirname(d.worcaHome());
@@ -387,12 +425,14 @@ class AskTurn extends EventEmitter {
   }
 
   _kickoffTitle() {
-    if (!this.firstTurn) return;
+    if (!this.firstTurn || this._titleKicked) return;
+    this._titleKicked = true;
     const d = this.deps;
-    // Fire-and-forget after ANY terminal status of the first turn (§7.4).
+    // Fire-and-forget: kicked off at the START of the first turn (right after
+    // the scratch dir exists) and backstopped after its terminal status (§7.4).
     // Stored for test determinism, never awaited by run() (orchestrator.mjs:3821).
-    // NO signal: after a user stop this.abort is already aborted and would kill
-    // the call before it spawns. permissionMode 'dontAsk' is the B-1 fix.
+    // NO signal: a user stop aborts this.abort mid-turn and would kill the call
+    // before it spawns. permissionMode 'dontAsk' is the B-1 fix.
     this.titlePromise = Promise.resolve()
       .then(() => d.generateTitle(this.firstText, {
         cwd: this.scratchDir || join(d.worcaHome(), 'tmp', 'ask'),
@@ -400,12 +440,18 @@ class AskTurn extends EventEmitter {
         disableSlashCommands: true, envScrub: true, envAllowlist: [],
         permissionMode: 'dontAsk',
       }))
-      .then((title) => {
-        if (!title || title === this.deterministicTitle) return;
-        // setThreadTitle's onlyIf is the rename guard: a PATCHed or deleted
-        // thread makes the UPDATE match 0 rows and the frame is suppressed.
+      .then((generated) => {
+        // The route stamps NOTHING before the 202 (the header reads "Ask Worca"
+        // until this frame lands), so an empty result — generateTitle swallows
+        // every failure/abort/refusal into '' — falls back to the route's
+        // deterministicTitle (sanitized first 80 chars, or "New chat"). That is
+        // the ONLY moment the prompt text may become the title.
+        const title = generated || this.deterministicTitle;
+        if (!title) return;
+        // `onlyIf: null` (title IS NULL) is the rename guard: a PATCHed or
+        // deleted thread makes the UPDATE match 0 rows and the frame is suppressed.
         let applied = false;
-        try { applied = d.store.setThreadTitle(this.threadId, title, { onlyIf: this.deterministicTitle }); }
+        try { applied = d.store.setThreadTitle(this.threadId, title, { onlyIf: null }); }
         catch { /* deleted thread */ }
         if (applied) {
           try { d.onOutOfTurn({ type: 'ask-title', title }); } catch { /* sink */ }

package/src/core/chat/command-router.mjs

@@ -14,6 +14,7 @@ import { parseCommand } from './parser.mjs';
 import { BOOKEND_EXECUTION_IDS } from '../../shared/graph/constants.mjs';
 import { createAllowlistGuard, parseIdList } from './allowlist.mjs';
 import { runRef, fmtUsd, fmtMs } from './renderers.mjs';
+import { giveUpOption, describePauseReason, pauseConsequences } from '../failure-policy.mjs';
 
 const md = (value) => ({ kind: 'markdown', value });
 const reply = (text, severity = 'info') => ({ title: null, body: [md(text)], severity });
@@ -44,7 +45,7 @@ const HELP_TEXT = [
   '`/status [*ref]` — run detail · `/cost [*ref]` — run cost',
   '`/pause [*ref]` · `/stop [*ref]` · `/resume [*ref]`',
   '`/approve [*ref]` — continue past a gate · `/retry [*ref]` — another cycle',
-  '`/abort [*ref]` — abort a recovery prompt',
+  '`/abort [*ref]` — give up on a recovery prompt (pauses the run; nothing is discarded)',
   '`/answer [*ref] <n|text> [| …]` — answer clarify questions (option number, or text for free-text)',
   '`/projects` · `/use <name>` — scope commands to one project',
   '`/mute 30m|2h|1d` · `/unmute` — silence notifications for this chat',
@@ -174,7 +175,8 @@ export function createCommandRouter({ actions, chatContext, logger = () => {} })
         const r = t.row;
         return reply([runLine({ ...r, runId: r.id }),
           ...(fmtUsd(r.totalCostUsd) ? [`   **Cost:** ${fmtUsd(r.totalCostUsd)}`] : []),
-          ...(r.pauseReason ? [`   **Pause reason:** ${r.pauseReason}`] : []),
+          ...(r.pauseReason ? [`   **Pause reason:** ${describePauseReason(r.pauseReason) || r.pauseReason}`] : []),
+          ...(r.pauseDetail ? [`   **${pauseConsequences(r.pauseReason).severity === 'error' ? 'Error' : 'Cause'}:** ${r.pauseDetail}`] : []),
         ].join('\n'));
       }
       const r = t.run;
@@ -322,14 +324,16 @@ export function createCommandRouter({ actions, chatContext, logger = () => {} })
       if (verb === 'abort') return reply(`Gates have no abort — \`/approve ${ref}\`, \`/retry ${ref}\`, or \`/stop ${ref}\`.`, 'warning');
       payload = { decision: verb === 'approve' ? 'continue' : 'another' };
     } else if (pq.kind === 'recovery') {
-      payload = { decision: verb === 'abort' ? 'abort' : 'retry' };
+      // /abort is the give-up choice; what it does (pause or abort) is the row's
+      // option (failure-policy.mjs) — the option id is the wire decision.
+      payload = { decision: verb === 'abort' ? giveUpOption(pq.recovery?.options).id : 'retry' };
     } else {
       return reply(`\`${ref}\` is waiting on ${pq.kind} — use \`/answer ${ref} <n>\`.`, 'warning');
     }
     await actions.answer(t.run.runId, pq.id, payload);
     const what = pq.kind === 'gate'
       ? (payload.decision === 'continue' ? 'approved — continuing' : 'sent back for another cycle')
-      : (payload.decision === 'retry' ? 'retrying' : 'aborting');
+      : (payload.decision === 'retry' ? 'retrying' : payload.decision === 'abort' ? 'aborting the run' : 'pausing the run');
     return reply(`✅ \`${ref}\` ${what}.`, 'success');
   }
 

package/src/core/chat/notifier.mjs

@@ -14,6 +14,7 @@ import { readPluginConfig } from '../plugin-config.mjs';
 import { parseIdList } from './allowlist.mjs';
 import { createRateLimiter } from './rate-limiter.mjs';
 import { renderDone, renderError, renderQuestion } from './renderers.mjs';
+import { pauseConsequences } from '../failure-policy.mjs';
 
 /**
  * @param {{channelHost: object, getPrefs: () => {notify:object, channels:object},
@@ -89,7 +90,11 @@ export function createNotifier({ channelHost, getPrefs, chatContext, logger = ()
         const status = payload?.status || 'done';
         if (status === 'error') return; // the richer 'error' event already went out
         const prefs = getPrefsSafe().notify;
-        if (status === 'paused' ? prefs.paused === false : prefs.done === false) return;
+        // Which preference gates a pause follows its reason (failure-policy.mjs):
+        // an error-pause IS the failure notification (no 'error' event precedes
+        // it), so notify.error gates it, not notify.paused.
+        const gate = status === 'paused' ? prefs[pauseConsequences(payload?.reason).notifyPref] : prefs.done;
+        if (gate === false) return;
         deliver(renderDone(meta(), payload || {}));
       }));
 

package/src/core/chat/renderers.mjs

@@ -9,6 +9,8 @@
 // ordinals and embeds the exact reply commands (/approve, /retry, /answer n…)
 // using the run-id wildcard-suffix convention the command router resolves.
 
+import { pauseConsequences, describePauseReason, giveUpOption } from '../failure-policy.mjs';
+
 const md = (value) => ({ kind: 'markdown', value });
 
 export function fmtMs(ms) {
@@ -41,10 +43,6 @@ function head(icon, meta) {
   return parts;
 }
 
-const PAUSE_REASONS = {
-  cost_pipeline: 'pipeline cost limit reached',
-  cost_total: 'total cost limit reached',
-};
 
 /**
  * done event: status done|stopped|paused (+reason for limit pauses).
@@ -53,11 +51,20 @@ const PAUSE_REASONS = {
 export function renderDone(meta, payload = {}) {
   const status = payload.status || 'done';
   if (status === 'paused') {
-    const reason = payload.reason ? (PAUSE_REASONS[payload.reason] || payload.reason) : null;
-    const parts = head('⏸', meta);
+    // The icon, severity and wording follow the pause's reason (failure-policy.mjs):
+    // an error-pause IS the failure notification (no 'error' event precedes it).
+    const { severity } = pauseConsequences(payload.reason);
+    const isError = severity === 'error';
+    const reason = payload.reason ? (describePauseReason(payload.reason) || payload.reason) : null;
+    const parts = head(isError ? '\u{1F534}' : '⏸', meta);
     parts.push(`   **Status:** paused${reason ? ` — ${reason}` : ''}`);
+    if (payload.detail && payload.reason) {
+      // Already bounded (PAUSE_DETAIL_MAX, middle-clipped so the runner's trailing
+      // cause survives) — a head clip here would throw exactly that tail away.
+      parts.push(`   **${isError ? 'Error' : 'Cause'}:** ${String(payload.detail)}`);
+    }
     parts.push(`   Resume from the worca-cc UI, or reply: /resume ${runRef(meta.runId)}`);
-    return mdMsg(parts.join('\n'), 'warning');
+    return mdMsg(parts.join('\n'), isError ? 'error' : 'warning');
   }
   if (status === 'stopped') {
     const parts = head('⏹', meta);
@@ -109,7 +116,7 @@ export function renderQuestion(meta, payload = {}) {
     }
     parts.push(kind === 'gate'
       ? `   Reply: /approve ${ref} to continue · /retry ${ref} for another cycle`
-      : `   Reply: /approve ${ref} to retry · /abort ${ref} to abort`);
+      : `   Reply: /approve ${ref} to retry · /abort ${ref} to ${giveUpOption(payload.recovery?.options).id === 'abort' ? 'abort the run' : 'pause the run'}`);
     return mdMsg(parts.join('\n'), 'warning');
   }
 

package/src/core/claude-runner.mjs

@@ -34,9 +34,11 @@
 
 import { spawn } from 'node:child_process';
 import { createInterface } from 'node:readline';
-import { prepareModelEnv } from './model-env.mjs';
+import { prepareModelEnv, envFlag, describeModelEnv } from './model-env.mjs';
+import { effectiveDebugSpawn } from './settings.mjs';
 import { classifyError, strongestClass } from './recoverable-error.mjs';
 import { explainUnspawnableClaude, resolveClaudeBin } from './preflight.mjs';
+import { hostGuardEnabled, hostGuardHookEntry, hostGuardSystemPrompt } from './host-guard.mjs';
 import { writeFile, mkdir, appendFile, readFile, access } from 'node:fs/promises';
 import { constants as FS, mkdtempSync, writeFileSync, rmSync } from 'node:fs';
 import { dirname, join } from 'node:path';
@@ -56,9 +58,14 @@ export function sigkillGraceMs() {
 }
 
 /** What `--settings` carries, or null when there is nothing to carry (no hook
- *  telemetry, no permission rules) — then the flag is omitted entirely. */
-export function buildSettingsPayload(permissionRules) {
+ *  telemetry, no permission rules, no host guard) — then the flag is omitted
+ *  entirely. `hostGuard` (set by runReal, gated by hostGuardEnabled) merges the
+ *  host-process-protection PreToolUse hook into the SAME single payload; the
+ *  returned `hook` flag stays telemetry-only (it drives --include-hook-events,
+ *  which the guard does not need). */
+export function buildSettingsPayload(permissionRules, { hostGuard = false } = {}) {
   const hook = buildHookSettings();
+  const guard = hostGuard && hostGuardEnabled() ? hostGuardHookEntry() : null;
   const hasRules = !!permissionRules && Object.values(permissionRules).some((a) => Array.isArray(a) && a.length);
   // Present-but-malformed rules (e.g. `{deny: 'Bash(curl:*)'}`) make the object
   // truthy while hasRules stays false, so the whole policy would drop out of
@@ -69,9 +76,13 @@ export function buildSettingsPayload(permissionRules) {
       && Object.values(permissionRules).some((a) => a != null && !Array.isArray(a))) {
     console.warn('[worca] guardrails: permissionRules is malformed (deny/allow/ask must be arrays of strings) — ignoring it; this spawn carries NO permission rules');
   }
-  if (!hook && !hasRules) return null;
+  if (!hook && !hasRules && !guard) return null;
   const settings = {};
-  if (hook) settings.hooks = hook.hooks;
+  if (hook) settings.hooks = { ...hook.hooks };
+  if (guard) {
+    settings.hooks = settings.hooks ?? {};
+    settings.hooks.PreToolUse = [...(settings.hooks.PreToolUse ?? []), guard];
+  }
   if (hasRules) settings.permissions = permissionRules;
   return { hook: !!hook, settings };
 }
@@ -100,6 +111,21 @@ export function argvLength(bin, args) {
   return String(bin || '').length + args.reduce((n, a) => n + String(a).length + 3, 0);
 }
 
+const ARGV_VALUE_PREVIEW = 64;
+
+/** A copy of `args` safe to log: EVERY token longer than ARGV_VALUE_PREVIEW is
+ *  shortened to a 64-char prefix + "…(<N> chars)". Token-level, not flag-aware, on
+ *  purpose: an inline prompt, the `--settings` JSON (uncapped for a custom rule
+ *  set), `--allowedTools`, `--mcp-config` — any free-text value buildClaudeArgs
+ *  adds later — is capped without this list having to track it. Flags and short
+ *  values pass through verbatim, so argv order is always preserved. Pure. */
+export function redactArgvForLog(args) {
+  return args.map((a) => {
+    const v = String(a);
+    return v.length > ARGV_VALUE_PREVIEW ? `${v.slice(0, ARGV_VALUE_PREVIEW)}…(${v.length} chars)` : v;
+  });
+}
+
 /** Log each npm-shim resolution once per process, not once per spawn. */
 const _resolveNoted = new Set();
 
@@ -107,9 +133,15 @@ const _resolveNoted = new Set();
  *  explanation when that is what actually went wrong (ENOENT on a bare name
  *  whose only PATH hit is claude.cmd; EINVAL on an explicit .cmd). */
 function spawnFailure(bin, err, prefix) {
-  const hint = /ENOENT|EINVAL/.test(String(err && err.code || err && err.message || ''))
-    ? explainUnspawnableClaude(bin) : null;
-  return new Error(`${prefix}: ${err.message}${hint ? ` — ${hint}` : ''}`);
+  const unspawnable = /ENOENT|EINVAL/.test(String(err && err.code || err && err.message || ''));
+  const hint = unspawnable ? explainUnspawnableClaude(bin) : null;
+  const out = new Error(`${prefix}: ${err.message}${hint ? ` — ${hint}` : ''}`);
+  // An unspawnable CLI (not installed / not on PATH) is user-fixable, not a
+  // pipeline bug: stamp the recovery class so the orchestrator's gate pauses
+  // the run for manual resume instead of hard-failing it (ENOENT matches no
+  // message-sniff pattern, so without the stamp it would classify null).
+  if (unspawnable) out.errorClass = 'network';
+  return out;
 }
 
 // Cap for the stderr detail embedded in a non-zero-exit Error message. The
@@ -150,10 +182,30 @@ export function buildEffortArgs(effort) {
  * and the baseline sub-agent lifecycle (tool_use/tool_result) is unaffected.
  */
 export function subagentHooksEnabled() {
-  const v = process.env.WORCA_SUBAGENT_HOOKS;
-  return !!v && v !== '0' && v.toLowerCase() !== 'false';
+  return envFlag('WORCA_SUBAGENT_HOOKS');
+}
+
+/**
+ * Opt-in spawn diagnostics, DEFAULT OFF. A NON-EMPTY WORCA_DEBUG_SPAWN in the
+ * environment wins (envFlag rule: any value but "0"/"false" turns it on, so an
+ * exported "0" is an explicit OFF); otherwise the stored `debugSpawnEnabled`
+ * setting applies — read fresh per spawn (settings.mjs#effectiveDebugSpawn, the
+ * one precedence rule the settings API also reports), so the UI checkbox reaches
+ * the next spawn in this process AND in a CLI run with no restart and no env
+ * mutation. OFF ⇒ runReal emits NO spawn-debug event and does not touch
+ * argv/env, so the spawn path is byte-identical to today. (The once-per-process
+ * "routing env applied" confirmation below is a separate, always-on line: it
+ * fires only for a model env that carries an ANTHROPIC_* routing key, once per
+ * distinct model + env, never per spawn.) Read directly in runReal (not a
+ * runClaude option) so it bypasses the runClaude→runReal gate by construction.
+ */
+export function debugSpawnEnabled() {
+  return effectiveDebugSpawn().enabled;
 }
 
+/** Once per process per distinct (model, described env): see runReal. */
+const _routingNoted = new Set();
+
 // ── Sub-agent telemetry + the --settings seam ────────────────────────────────
 // Telemetry is GATED (subagentHooksEnabled) and OFF by default. When on it adds
 // `--include-hook-events` (surfaces hook lifecycle on the SAME stdout stream)
@@ -179,10 +231,11 @@ export function buildHookSettings() {
  * [] when there is nothing to say, so the baseline argv is byte-identical.
  * @param {{deny?:string[],allow?:string[],ask?:string[]}|null|undefined} permissionRules
  * @param {string|null} [settingsFile] staged path (GH #380): `--settings <path>` carries the same JSON
+ * @param {{hostGuard?:boolean}} [opts] host-process guard (runReal sets it; see buildSettingsPayload)
  * @returns {string[]}
  */
-export function buildSettingsArgs(permissionRules, settingsFile = null) {
-  const payload = buildSettingsPayload(permissionRules);
+export function buildSettingsArgs(permissionRules, settingsFile = null, { hostGuard = false } = {}) {
+  const payload = buildSettingsPayload(permissionRules, { hostGuard });
   if (!payload) return [];
   const args = [];
   if (payload.hook) args.push('--include-hook-events');
@@ -245,8 +298,7 @@ export function buildSpawnEnv(envScrub, envAllowlist) {
  */
 export function mockEnabled(opts) {
   if (opts && opts.mock) return true;
-  const v = process.env.WORCA_MOCK ?? process.env.ORCH_MOCK;
-  return !!v && v !== '0' && v.toLowerCase() !== 'false';
+  return envFlag('WORCA_MOCK', 'ORCH_MOCK');
 }
 
 /**
@@ -403,7 +455,7 @@ export function buildClaudeArgs({
   // way in because the legacy body below already owns a local `tools` (the
   // --allowedTools union).
   tools: builtinTools, strictMcpConfig, settingSources, disableSlashCommands, includePartialMessages,
-  maxTurns, maxBudgetUsd, appendSubagentSystemPrompt,
+  maxTurns, maxBudgetUsd, appendSubagentSystemPrompt, hostGuard,
 }, delivery = {}) {
   // delivery (GH #380, set only by planClaudeInvocation's staged branch):
   //   promptViaStdin   -> bare `-p`; the prompt is written to the child's stdin
@@ -426,7 +478,7 @@ export function buildClaudeArgs({
   // SINGLE inline JSON (two --settings flags would be last-wins at the CLI). [] when
   // there is neither, so the baseline argv is unchanged; a CLI that rejects these
   // flags would only ever fail when the operator opted in.
-  for (const a of buildSettingsArgs(permissionRules, settingsFile)) args.push(a);
+  for (const a of buildSettingsArgs(permissionRules, settingsFile, { hostGuard })) args.push(a);
   if (mcpConfigPath) args.push('--mcp-config', mcpConfigPath);
   const tools = Array.isArray(allowedTools) ? allowedTools.slice() : [];
   for (const s of (Array.isArray(mcpServerGrants) ? mcpServerGrants : [])) {
@@ -496,7 +548,7 @@ export function planClaudeInvocation(opts, { bin = DEFAULT_BIN, dir = null, limi
     files.push({ path: systemPromptFile, content: opts.systemPrompt });
   }
   let settingsFile = null;
-  const payload = buildSettingsPayload(opts.permissionRules);
+  const payload = buildSettingsPayload(opts.permissionRules, { hostGuard: opts.hostGuard });
   if (payload) {
     settingsFile = join(dir, 'settings.json');
     files.push({ path: settingsFile, content: JSON.stringify(payload.settings) });
@@ -547,6 +599,23 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
     } else if (wireModel !== model) {
       console.warn(`[worca] model ${JSON.stringify(model ?? '')}: wire model ${JSON.stringify(wireModel)}`);
     }
+    // Confirm a resolved card's routing env actually reached a spawn — even when
+    // the wire id equals the catalog id, the case the wire-model line above stays
+    // silent for (that silence is exactly what hid a gateway card whose
+    // ANTHROPIC_MODEL matched its catalog id). Fires only for an env that carries
+    // an ANTHROPIC_* routing key (Ask Worca merges a CLAUDE_CODE_* knob into
+    // EVERY turn's env, which is not routing) and once per process per distinct
+    // line, like _resolveNoted — never per spawn. describeModelEnv prints the
+    // routing keys readable (endpoint, wire id — the diagnostic) and every other
+    // key as `<set, N chars>`: ANTHROPIC_AUTH_TOKEN and plugin {secret} values live
+    // in this map and no part of them may reach a log. Worded WITHOUT the
+    // substrings "wire model"/"modelEnv" — test/spawn-args.test.mjs counts by those.
+    const routingApplied = safeModelEnv && Object.keys(safeModelEnv).some((k) => k.startsWith('ANTHROPIC_'))
+      ? describeModelEnv(safeModelEnv) : null;
+    if (routingApplied) {
+      const line = `[worca] model ${JSON.stringify(model ?? '')}: routing env applied: ${routingApplied}`;
+      if (!_routingNoted.has(line)) { _routingNoted.add(line); console.warn(line); }
+    }
 
     // Windows + npm-installed Claude Code: the bare name is a .cmd shim Node
     // cannot spawn; resolveClaudeBin swaps in the package's native claude.exe.
@@ -562,10 +631,20 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
     // ARGV_INLINE_LIMIT). The staging dir, when any, is removed on every
     // terminal path below (finish) and on a failed spawn.
     const limit = Number.isFinite(argvInlineLimit) && argvInlineLimit > 0 ? argvInlineLimit : ARGV_INLINE_LIMIT;
+    // Host guard (host-guard.mjs, 2026-08-31 incident): every REAL spawn — any
+    // role, custom agent, plugin agent, ask chat — carries the protection
+    // preamble, the PreToolUse hook (hostGuard -> the --settings payload), and
+    // WORCA_HOST_PID (below). One kill-switch: WORCA_HOST_GUARD=0. Mock spawns
+    // nothing, so runMock stays untouched.
+    const guardOn = hostGuardEnabled();
+    const guardedSystemPrompt = guardOn
+      ? [hostGuardSystemPrompt(process.pid), systemPrompt].filter(Boolean).join('\n\n')
+      : systemPrompt;
     let plan;
     try {
       plan = stageClaudeInvocation({
-        prompt, systemPrompt, permissionMode, model: wireModel, effort, allowedTools, resumeSessionId,
+        prompt, systemPrompt: guardedSystemPrompt, hostGuard: guardOn,
+        permissionMode, model: wireModel, effort, allowedTools, resumeSessionId,
         mcpConfigPath, mcpServerGrants, permissionRules,
         tools, strictMcpConfig, settingSources, disableSlashCommands, includePartialMessages,
         maxTurns, maxBudgetUsd, appendSubagentSystemPrompt,
@@ -594,6 +673,29 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
     let spawnEnv = guardrailEnv;
     if (safeModelEnv) spawnEnv = { ...(guardrailEnv ?? process.env), ...safeModelEnv };
 
+    // WORCA_HOST_PID rides every guarded spawn (the hook reads it; scrub would
+    // drop it — WORCA_ is not an allowlisted prefix — so it is added AFTER).
+    if (guardOn) spawnEnv = { ...(spawnEnv ?? process.env), WORCA_HOST_PID: String(process.pid) };
+
+    // Opt-in spawn diagnostics (WORCA_DEBUG_SPAWN, default off — byte-identical spawn
+    // path when unset). Everything here is derived from values already computed above
+    // (safeModelEnv is null or non-empty, so the routing field is either the described
+    // env — secrets as `<set, N chars>` — or "(none)"). Emitted right before spawn so
+    // it reflects the exact bin/argv/env handed to the child, ONCE, as the same
+    // `stderr` event the child's own stderr rides (run-harness logs it at `warn`
+    // into the run stream and live-log.ndjson; nothing here also console.warns, so
+    // a run never prints the line twice). Field is `routingEnv`, not `modelEnv`:
+    // test/spawn-args.test.mjs counts "modelEnv" warnings for the dropped-key path.
+    if (debugSpawnEnabled()) {
+      const summary =
+        `[worca] spawn-debug: bin=${JSON.stringify(resolved.bin)} `
+        + `argv=${JSON.stringify(redactArgvForLog(args))} `
+        + `promptViaStdin=${plan.stdin != null} staged=${plan.staged} `
+        + `envScrub=${guardrailEnv ? 'on' : 'off'} childEnvKeys=${Object.keys(spawnEnv ?? process.env).length} `
+        + `routingEnv=[${safeModelEnv ? describeModelEnv(safeModelEnv) : '(none)'}]`;
+      safeEmit(onEvent, { type: 'stderr', stream: 'err', text: summary });
+    }
+
     let child;
     try {
       child = spawn(resolved.bin, args, {

package/src/core/config.mjs

@@ -57,14 +57,16 @@ export { EFFORTS };
  * The `[1m]` suffix selects the 1M-token long-context variant. Opus 4.6–4.8 and
  * Sonnet 4.6 1M ids were verified to resolve via `claude --model`; Haiku 4.5 1M
  * is intentionally omitted — the CLI rejects it ("long context beta is not yet
- * available for this subscription"). Fable 5 needs no `[1m]` suffix: its context
- * window is 1M by default (verified to resolve via `claude --model`). Opus 5
+ * available for this subscription"). Fable 5.1 needs no `[1m]` suffix: its context
+ * window is 1M by default (verified to resolve via `claude --model`, CLI 2.1.257).
+ * It replaced Fable 5 (`claude-fable-5`) on 2026-09-01; db.mjs V26 moves every
+ * stored pin on the retired id to the successor, so nothing keeps it here. Opus 5
  * (`claude-opus-5`) and Sonnet 5 (`claude-sonnet-5`) are likewise 1M-only and
  * carry no `[1m]` twin.
  */
 export const PREDEFINED_MODELS = [
   { id: 'claude-opus-5',          label: 'Opus 5',          efforts: ['medium', 'high', 'xhigh', 'max'] },
-  { id: 'claude-fable-5',         label: 'Fable 5 (1M)',    efforts: ['medium', 'high', 'xhigh', 'max'] },
+  { id: 'claude-fable-5-1',       label: 'Fable 5.1 (1M)',  efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-8',        label: 'Opus 4.8',        efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-8[1m]',    label: 'Opus 4.8 (1M)',   efforts: ['medium', 'high', 'xhigh', 'max'] },
   { id: 'claude-opus-4-7',        label: 'Opus 4.7',        efforts: ['medium', 'high', 'xhigh', 'max'] },
@@ -413,6 +415,47 @@ export function resolveModelCost(modelId, cliCostUsd, usage, costCfg = undefined
   return cliCostUsd;
 }
 
+// ── display-only list prices ──────────────────────────────────────────────────
+// USD per MILLION tokens for the built-in ids, from Anthropic's published
+// pricing (platform.claude.com/docs/en/pricing — snapshot 2026-06-24). DISPLAY
+// APPROXIMATION ONLY: it feeds the chat footer's live "≈" estimate while a turn
+// streams (ask/events.mjs `estimatedCostUsd`). The CLI's result.total_cost_usd,
+// re-priced by resolveModelCost, stays the ONLY figure any message row, thread
+// total, ledger or budget ever books — nothing here is read by those paths.
+// Ids missing here get no estimate (null), which is the pre-existing behaviour;
+// `[1m]` twins and dated ids resolve to their base row (the long-context premium
+// is not modelled). cacheWrite = 1.25× input (5-minute TTL), cacheWrite1h = 2×
+// input, cacheRead = 0.1× input except Fable 5.1 (0.025×). Refresh by hand when
+// Anthropic moves a price. PREDEFINED_MODELS itself stays untouched — its entry
+// shape is pinned (test/config-models-global.test.mjs:205).
+export const PREDEFINED_LIST_PRICES = Object.freeze({
+  'claude-fable-5-1':  { input: 10, output: 50, cacheRead: 0.25, cacheWrite: 12.5, cacheWrite1h: 20 },
+  'claude-opus-5':     { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-opus-4-8':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-opus-4-7':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-opus-4-6':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-sonnet-5':   { input: 2,  output: 10, cacheRead: 0.2,  cacheWrite: 2.5,  cacheWrite1h: 4 },
+  'claude-sonnet-4-6': { input: 3,  output: 15, cacheRead: 0.3,  cacheWrite: 3.75, cacheWrite1h: 6 },
+  'claude-haiku-4-5':  { input: 1,  output: 5,  cacheRead: 0.1,  cacheWrite: 1.25, cacheWrite1h: 2 },
+});
+
+const FREE_RATES = Object.freeze({ input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cacheWrite1h: 0 });
+
+/** The per-Mtok rates a DISPLAY estimate may price `modelId` with: the operator's
+ *  modelCostConfig override when one exists ({free} → all-zero rates, so a free
+ *  model estimates $0 instead of a list price), else the built-in list price,
+ *  else null (no estimate). Never throws. */
+export function liveCostRates(modelId) {
+  const id = typeof modelId === 'string' ? modelId.trim() : '';
+  if (!id) return null;
+  let cfg = null;
+  try { cfg = modelCostConfig(id); } catch { cfg = null; }
+  if (cfg && cfg.free === true) return FREE_RATES;
+  if (cfg && cfg.perMtok && typeof cfg.perMtok === 'object') return cfg.perMtok;
+  const base = id.toLowerCase().replace(/\[1m\]$/, '').replace(/-\d{8}$/, '');
+  return PREDEFINED_LIST_PRICES[base] ?? null;
+}
+
 /**
  * All selectable models for a project = the effective catalog (predefined ⊕
  * global ⊕ this project's legacy custom models). Legacy custom models