amicus 4.3.0 → 4.4.1

package/src/mcp-council-awareness.js

@@ -15,8 +15,14 @@
 const fs = require('fs');
 const path = require('path');
 const runState = require('./council/run-state');
+// The pointer-containment fence. Lives in a dependency-free leaf module
+// (src/utils/path-fence.js) precisely so any surface can require it —
+// requiring it here adds no cycle and keeps ONE implementation of the check
+// shared with the v4.4 workspace reads.
+const { containsOnDisk } = require('./utils/path-fence');
 const { RUNNING_VERSION } = require('./utils/version-info');
 const { enrichLegUsage, markLive, rollupWaveUsage } = require('./observe/live-doc');
+const { buildLegRows } = require('./observe/council-legs');
 
 /**
  * Every wave a stage launched: the primary `waveId` plus the recorded
@@ -94,6 +100,30 @@ function legUsage(project, legId) {
   return enrichLegUsage({ model }, progressUsage);
 }
 
+/**
+ * readPointer PLUS the containment check the pointer file itself cannot
+ * provide. runState.readPointer validates `council-<id>.json`'s {runId, runDir}
+ * JSON only for truthiness (run-state.js:133-139), so a tampered or stale
+ * pointer can point runDir anywhere on disk — and the two callers below do not
+ * merely READ from it, they runState.checkpoint() INTO it (crash detection and
+ * abort), which makes an unfenced pointer a write primitive at an
+ * attacker-chosen path. A real runDir is always nested inside the project:
+ * src/mcp-council-run.js:109 rejects an outDir outside it at creation time, so
+ * nothing legitimate is refused here.
+ *
+ * Fails to null — the SAME "not a council run" signal an absent/corrupt pointer
+ * already produces, so amicus_status / amicus_abort keep their existing
+ * "Session <id> not found in project <cwd>" error contract (mcp-server.js:586,
+ * :1005) and `amicus abort` keeps falling through to its own not-found path.
+ * No new error shape, and — because the fence runs before readRun — no read or
+ * write ever reaches the escaping directory.
+ * @returns {{runId: string, runDir: string}|null}
+ */
+function readFencedPointer(project, taskId) {
+  const ptr = runState.readPointer(project, taskId);
+  return ptr && containsOnDisk(project, ptr.runDir) ? ptr : null;
+}
+
 function elapsedOf(run) {
   const end = run.completedAt || new Date().toISOString();
   const ms = Math.max(0, new Date(end).getTime() - new Date(run.createdAt || end).getTime());
@@ -102,7 +132,7 @@ function elapsedOf(run) {
 
 /** Status payload for a council runId, or null when the id is not a council run. */
 function buildCouncilStatusPayload(project, taskId) {
-  const ptr = runState.readPointer(project, taskId);
+  const ptr = readFencedPointer(project, taskId);
   if (!ptr) { return null; }
   const run = runState.readRun(ptr.runDir);
   if (!run) { return null; }
@@ -132,14 +162,19 @@ function buildCouncilStatusPayload(project, taskId) {
   // least one sub-wave record exists on disk.
   // Cost-by-seat rides the same loop, read-time from progress.json only (A8) —
   // usageLegs stays empty (no `usage` on the payload) until a leg has actually
-  // flushed usage; a leg with none yet contributes nothing (N3).
+  // flushed usage; a leg with none yet contributes nothing (N3). allLegIds
+  // collects every leg id seen regardless of usage — the row builder below
+  // needs just-started legs too (DE-ROT F01: the naive `payload.legs =
+  // usageLegs` would silently drop them).
   const usageLegs = [];
+  const allLegIds = [];
   for (const waveId of active && active.project ? subWaveIds(active) : []) {
     const c = countWaveLegs(active.project, waveId);
     if (!c) { continue; }
     legsTotal = (legsTotal || 0) + c.total;
     legsComplete = (legsComplete || 0) + c.complete;
     for (const legId of waveLegIds(active.project, waveId)) {
+      allLegIds.push(legId);
       const enriched = legUsage(active.project, legId);
       if (enriched.usage) { usageLegs.push(enriched); }
     }
@@ -152,6 +187,15 @@ function buildCouncilStatusPayload(project, taskId) {
     version: RUNNING_VERSION,
   };
   if (usageLegs.length) { payload.usage = rollupWaveUsage(usageLegs); }
+  if (allLegIds.length) {
+    // F34/F36: bench/critic/lenses are the alias-valued fields legRole needs
+    // (roleFor's rule); stageName lets it treat the chair stage as its own
+    // case rather than matching on alias (see council-legs.js's legRole doc).
+    const runCtx = { bench: run.bench, critic: run.critic, lenses: run.lenses, stageName: active.name };
+    const built = buildLegRows(active.project, allLegIds, runCtx);
+    payload.legs = built.rows;
+    if (built.stalled) { payload.stalled = true; payload.stalledForSeconds = built.stalledForSeconds; }
+  }
   if (run.error) { payload.reason = `${run.error.code}: ${run.error.message}`; }
   return markLive(payload);
 }
@@ -161,6 +205,12 @@ function listCouncilRuns(project) {
   const { sanitizePreview } = require('./sidecar/progress-fields');
   const out = [];
   for (const ptr of runState.listPointers(project)) {
+    // Same fence as readFencedPointer, applied per enumerated pointer
+    // (listPointers parses the files itself and is no stricter about runDir).
+    // Skipping is the right failure mode here: an escaping pointer degrades
+    // exactly like the unreadable-run.json case below, so one tampered pointer
+    // can never blank the rest of the list.
+    if (!containsOnDisk(project, ptr.runDir)) { continue; }
     const run = runState.readRun(ptr.runDir);
     if (!run) { continue; }
     let briefing = '';
@@ -204,7 +254,7 @@ function cascadeWave(project, waveId) {
  * @returns {null|{notFound?: true}|{alreadyTerminal: true, status}|{aborted: true, cascaded: number}}
  */
 function abortCouncilRun(project, taskId) {
-  const ptr = runState.readPointer(project, taskId);
+  const ptr = readFencedPointer(project, taskId);
   if (!ptr) { return null; }
   const run = runState.readRun(ptr.runDir);
   if (!run) { return null; }

package/src/observe/council-legs.js

@@ -0,0 +1,240 @@
+// src/observe/council-legs.js
+'use strict';
+
+/**
+ * @module observe/council-legs
+ * Per-leg row builder for the composed council live doc
+ * (buildCouncilStatusPayload in src/mcp-council-awareness.js). Split out of
+ * that file to stay under the 300-line gate (DE-ROT Task 0.5, closes F01:
+ * `usageLegs` was computed then discarded — no `legs[]` ever reached the
+ * payload, so the live Seats panel had no data source).
+ *
+ * One row per leg id, built UNCONDITIONALLY: unlike the usage rollup (gated
+ * on `enriched.usage` in buildCouncilStatusPayload), a live seats panel needs
+ * just-started legs — the ones with no usage yet — just as much as priced
+ * ones. Field names mirror the wave branch (src/mcp-server.js:592-608) so
+ * live-normalize.js (Task 14) has one vocabulary to map, not two.
+ *
+ * `modelInput` + `role` (F36/F34 correction): a live leg's `model` is the
+ * RESOLVED executable id (metadata.model), never the council ALIAS that
+ * run.json's bench/chair/critic/lenses and roleFor's rule are keyed on — so
+ * deriving role from `model` is a silent no-op (Role column permanently
+ * em-dash) and blind mode's labelOf(alias) lookup never matches (real model
+ * id leaks). The alias IS on disk per-leg, though: every council leg goes
+ * through src/sidecar/fanout-leg.js's runSingleAttempt, which calls
+ * `writeLegPatch(legDir, { parentWave, modelInput })` synchronously,
+ * immediately after leg creation (fanout-leg.js:101) — well before any
+ * status poll could reasonably observe it missing. So this module reads
+ * `modelInput` straight off the leg's own metadata.json, no run.json join
+ * needed for the alias itself.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { readProgress, isStalled } = require('../sidecar/progress');
+const { enrichLegUsage, TERMINAL } = require('./live-doc');
+const { roleFor } = require('../council/run-stages');
+const { logger } = require('../utils/logger');
+
+/**
+ * A leg's council role. The chair stage is the one case alias identity
+ * cannot resolve: run-chair.js's fallback chain (ch1/ch2 = run.chair's own
+ * alias, ch3 = a DIFFERENT ledger-promoted alias, ch4 = whichever succeeded)
+ * means a chair leg's modelInput does not reliably equal run.json's `chair`
+ * field while the chain is still in flight (that field is only checkpointed
+ * once the WHOLE chain resolves, src/council/run-chair.js:122) — so alias
+ * matching would miss ch3/ch4 mid-run. The stage that owns the leg is the
+ * authoritative signal instead (plan's F34 correction: "derive role from the
+ * stage that owns the leg"). Every other stage (stage1/stage2/debate-*)
+ * reuses roleFor (src/council/run-stages.js) keyed on modelInput — a
+ * model's seat/critic/lens identity is stable whether it's reviewing
+ * (stage1) or judging (stage2), and a repair/debate leg relaunches the SAME
+ * alias as its origin leg, so the identity carries through unchanged.
+ * @returns {string|null} null when modelInput is unknown (truthful — never a guess)
+ */
+function legRole({ bench, critic, lenses, stageName, modelInput }) {
+  if (!modelInput) { return null; }
+  if (stageName === 'chair') { return 'chair'; }
+  // ⚠️ v4.4.1 LC-4: roleFor's LENS branch does `o.models.indexOf(alias)`, so a
+  // run.json carrying truthy `lenses` with a missing or non-array `bench` throws
+  // a TypeError. This function runs on every status poll, so one malformed
+  // run.json took out three surfaces at once: `amicus status`, the amicus_status
+  // MCP tool, and `amicus watch`. It was unreachable only because
+  // src/council/run.js:72 happens to write `bench` and `lenses` together — an
+  // argument that rests entirely on one writer never changing.
+  //
+  // A role we cannot compute is `null` — the module's existing, documented
+  // degradation (an em-dash in the Role column), never a guess and never a
+  // throw. The non-lens branch never touches `models`, so it stays exact.
+  //
+  // ⚠️ v4.4.1 A2: the guard above was ASYMMETRIC — it validated `bench` and took `lenses` on
+  // trust, but roleFor's lens branch indexes BOTH (`o.lenses[o.models.indexOf(alias)]`). Neither
+  // remaining shape throws, because slug() coerces with String(), so both produced a confident
+  // LIE instead of a crash: `lenses: 'security'` with `bench: ['gpt']` indexes the STRING and
+  // yields `lens:s`, and a `lenses` array shorter than `bench` yields `lens:undefined`. The
+  // length pairing is a real, enforced invariant, not an assumption — cli-handlers-council-run.js:170
+  // refuses `--lenses` unless it has exactly one lens per seat — so a run.json that violates it is
+  // malformed, and the honest answer for a malformed pairing is the same `null` (an em-dash in the
+  // Role column) that LC-4 established, never a guess.
+  if (lenses && (!Array.isArray(bench) || !Array.isArray(lenses) || lenses.length !== bench.length)) {
+    logger.debug('leg role unresolved: run.json lenses/bench are not a matched pair', {
+      modelInput, stageName,
+      benchType: bench === null ? 'null' : typeof bench,
+      lensesType: lenses === null ? 'null' : typeof lenses,
+      benchLength: Array.isArray(bench) ? bench.length : null,
+      lensesLength: Array.isArray(lenses) ? lenses.length : null,
+    });
+    return null;
+  }
+  return roleFor({ models: bench, critic, lenses }, modelInput);
+}
+
+/**
+ * One composed row for a leg, plus the ms-since-activity behind its `stalled`
+ * flag (or null when not stalled/not yet measurable) so the caller can roll
+ * several legs' staleness into one run-level summary without re-parsing
+ * `lastActivityAt` back into a timestamp.
+ * @param {string} project
+ * @param {string} legId
+ * @param {{bench: string[], critic: string|null, lenses: string[]|null, stageName: string}} runCtx
+ * @returns {{row: object, stalledMs: number|null}}
+ */
+function buildLegRow(project, legId, runCtx) {
+  const { getSessionDir } = require('../session-manager');
+  const legDir = getSessionDir(project, legId);
+  let meta = {};
+  // ⚠️ v4.4.1 LC-9: the catch stays ALL-OR-NOTHING on purpose (Appendix A-9) —
+  // it mirrors the wave branch, and a half-parsed metadata object is worse than
+  // an empty one. What was wrong was the SILENCE: a corrupt metadata.json, an
+  // EACCES on the leg dir, and "the file doesn't exist yet" were indistinguishable
+  // and left no trace anywhere, so a leg with corrupt metadata rendered as a
+  // just-started leg forever. `code` is what separates them — ENOENT is the
+  // ordinary just-started case, anything else is a real fault. Logging only; the
+  // branching is untouched.
+  try { meta = JSON.parse(fs.readFileSync(path.join(legDir, 'metadata.json'), 'utf-8')); }
+  catch (metaErr) {
+    logger.debug('leg metadata.json unreadable — rendering the leg with base fields only', {
+      legId, code: metaErr.code || null, error: metaErr.message,
+    });
+  }
+  // Truthful null, never metadata.model as a fallback: showing the resolved
+  // id where the alias was expected is exactly the F36 bug (blind mode would
+  // leak the real model id instead of degrading to an em-dash).
+  const modelInput = meta.modelInput || null;
+  // LC-4: hoisted out of the object literal below so the guard inside legRole is
+  // the only thing standing between a malformed run.json and three live surfaces.
+  const role = legRole({ ...runCtx, modelInput });
+  const row = {
+    taskId: legId, model: meta.model || null, status: meta.status || 'unknown',
+    modelInput, role,
+  };
+  let stalledMs = null;
+  let p = null;
+  try {
+    p = readProgress(legDir);
+    row.messages = p.messages;
+    row.stage = p.stage;
+    row.latestPreview = p.latestPreview;
+    row.lastActivityAt = p.lastActivityAt;
+    row.stalled = row.status === 'running' && isStalled(p.lastActivityMs);
+    if (row.stalled) { stalledMs = p.lastActivityMs; }
+  } catch (progressErr) {
+    // ⚠️ v4.4.1 LC-9: same deal as the metadata catch above — all-or-nothing by
+    // design (A-9), silent by accident. readProgress swallows a malformed
+    // progress.json itself, so reaching here means the leg DIR could not be
+    // stat'd/read at all (EACCES, a vanished session dir) or readProgress threw
+    // on a shape it could not handle — neither of which is "hasn't started yet",
+    // and both of which previously left the row indistinguishable from one.
+    logger.debug('leg progress unreadable — rendering the leg with base fields only', {
+      legId, code: progressErr.code || null, error: progressErr.message,
+    });
+  }
+
+  // council review C3: this is a SEPARATE try from readProgress's above, on
+  // purpose. The old code wrapped both in one try, so a pricing-resolution
+  // failure (an unknown model, a corrupt catalog row) landed in the exact same
+  // catch as "progress.json doesn't exist yet" — an operator (or the workspace's
+  // cost-by-seat panel) could not tell "pricing lookup failed" from "hasn't
+  // billed yet"; both rendered as a permanently blank cost cell. `usageError`
+  // makes the failure mode truthful and distinguishable, additive to the row
+  // (N3's undefined-key discipline still holds: only set usage/usageError when
+  // there is something to say).
+  //
+  // v4.4 B3 (diagnosis §4/§7.3): for a TERMINAL leg, metadata.json's `usage`
+  // block wins over the progress.json snapshot. progress.json's usage is stamped
+  // ONLY on 'receiving' flushes — which fire on text/tool/reasoning GROWTH, i.e.
+  // always strictly before OpenCode's finalization stamp — so on real paid runs
+  // 31 of 35 legs ended with an all-zero snapshot while metadata.json held
+  // thousands of real tokens and a reported cost. Reading the snapshot for a
+  // finished leg made every completed seat look free in the live doc.
+  // headless.js now also writes a terminal 'complete' progress record carrying
+  // the settled usage, which fixes the DATA; this makes the READER prefer the
+  // authoritative source either way, including for every leg already on disk.
+  // A still-RUNNING leg keeps reading progress.json — metadata.usage does not
+  // exist until the leg finalizes, and read-time resolution is what keeps a live
+  // in-flight cost current (live-doc.js's stated design).
+  if (TERMINAL.has(row.status) && meta.usage && meta.usage.cost) {
+    row.usage = meta.usage;
+  } else if (p && p.usage) {
+    try {
+      const enriched = enrichLegUsage(row, p.usage);
+      if (enriched.usage) { row.usage = enriched.usage; }
+    } catch (err) {
+      row.usageError = err.message;
+    }
+  }
+  return { row, stalledMs };
+}
+
+/**
+ * Rows for every leg id, plus a run-level stall rollup. A council run fans
+ * legs across several parallel sub-waves at once (seat wave, chair chain,
+ * lens/critic solos), so — unlike the single-leg wave branch, which only
+ * ever flags its own row — a run-level banner needs one summary rather than
+ * making the caller inspect every row.
+ *
+ * The rollup means exactly what the workspace's dead-run banner claims ("no
+ * leg activity for Xm — the run may be dead"): the run is stalled only when
+ * EVERY still-running leg is stalled. A single stalled leg alongside another
+ * leg that is actively producing (message/cost climbing) must NOT set the
+ * flag — that was the old (max-based) bug, observed live: `glm` sat stalled
+ * for two minutes while `qwen-coder` was visibly working, and the banner
+ * fired anyway. A leg that has already finished (any non-'running' status)
+ * is terminal — it is excluded from the "every leg" population entirely: it
+ * can neither keep the run "healthy" by counting as active, nor drag it
+ * "dead" by counting as stalled. Per-leg `row.stalled` is untouched by this —
+ * it stays the accurate, per-row signal it already was.
+ *
+ * When the run genuinely is stalled, `stalledForSeconds` is the SHORTEST
+ * idle duration among the stalled running legs, not the longest: that is the
+ * honest answer to "how long has the whole run been quiet" — something was
+ * still happening as recently as the most-recently-active (but still
+ * over-threshold) leg's last activity.
+ * @param {string} project
+ * @param {string[]} legIds
+ * @param {{bench: string[], critic: string|null, lenses: string[]|null, stageName: string}} runCtx
+ *   run.json's alias-valued fields (bench/critic/lenses) + the active stage's
+ *   name, threaded through to legRole — this module never reads run.json itself.
+ * @returns {{rows: object[], stalled?: true, stalledForSeconds?: number}}
+ */
+function buildLegRows(project, legIds, runCtx) {
+  const rows = [];
+  let runningCount = 0;
+  const stalledRunningMs = [];
+  for (const legId of legIds) {
+    const { row, stalledMs } = buildLegRow(project, legId, runCtx);
+    rows.push(row);
+    if (row.status === 'running') {
+      runningCount += 1;
+      if (stalledMs !== null) { stalledRunningMs.push(stalledMs); }
+    }
+  }
+  const out = { rows };
+  if (runningCount > 0 && stalledRunningMs.length === runningCount) {
+    out.stalled = true;
+    out.stalledForSeconds = Math.floor(Math.min(...stalledRunningMs) / 1000);
+  }
+  return out;
+}
+
+module.exports = { buildLegRows };

package/src/observe/live-doc.js

@@ -15,13 +15,48 @@
 
 const { resolveUsage, sumWaveUsage } = require('../utils/pricing');
 
-const TERMINAL = new Set(['complete', 'partial', 'error', 'crashed', 'aborted', 'timeout', 'idle-timeout']);
+// ⚠️ v4.4.1 A1: 'timeout' AND 'timed-out' — the codebase genuinely has two spellings for one
+// state, written by two different producers, and this set has to cover both.
+//   'timeout'   — src/utils/result-schema.js:23 statusFromResult, i.e. the LEG/wave-document and
+//                 `--json` run-document vocabulary. Correct, still emitted, stays.
+//   'timed-out' — src/sidecar/session-finalize.js:21 resolveTerminalState, i.e. what actually
+//                 lands in a session's metadata.json `status` and (since LC-3) progress.json's
+//                 terminal stage. It was MISSING here, and this set is the one every observability
+//                 reader consults, so three real consequences followed: `amicus watch <taskId>` on
+//                 a timed-out single session never exited (watch-render.js:138 polls until
+//                 TERMINAL.has(doc.status), and amicus_status stamps metadata.status straight onto
+//                 the doc — mcp-server.js:687); a timed-out leg skipped the "prefer metadata.usage
+//                 over the stale progress.json snapshot" branch in council-legs.js:162 and reported
+//                 an under-counted cost; and markLive kept stamping view:'live' on a finished
+//                 single-session doc.
+// NOTE this is deliberately NOT the same list as src/utils/result-schema.js:13 TERMINAL_STATUSES
+// (the leg set, no 'partial'). Two mirrors of THIS list exist — src/workspace/run-detail.js:26 and
+// electron/workspace-ui/live-model.js:14 — byte-identical, held by drift pins. Edit all three.
+const TERMINAL = new Set(['complete', 'partial', 'error', 'crashed', 'aborted', 'timeout', 'timed-out', 'idle-timeout']);
 
-/** Attach read-time-resolved usage to a leg from its raw progress usage. */
+/**
+ * Attach read-time-resolved usage to a leg from its raw progress usage.
+ *
+ * v4.4.1 CA-1: the terminal progress record carries the leg's enumerated CHILD
+ * (subagent) session spend as `usage.subtree` / `usage.subtreeUnknown`
+ * (src/headless.js). Those must be forwarded, not dropped: the live workspace
+ * and `amicus watch` read progress.json directly, so silently keeping only
+ * {tokens, cost} here would make the GUI's cost-by-seat and its wave rollup
+ * disagree with run.json by exactly the child-session amount — reintroducing
+ * the under-report one surface down from where it was fixed.
+ */
 function enrichLegUsage(leg, progressUsage) {
   if (!progressUsage || !progressUsage.tokens) { return leg; }
-  const resolved = resolveUsage({ model: leg.model, usageTotals: progressUsage });
-  return { ...leg, usage: { tokens: resolved.tokens, cost: resolved.cost } };
+  const resolved = resolveUsage({
+    model: leg.model,
+    usageTotals: progressUsage,
+    subtree: progressUsage.subtree,
+    subtreeUnknown: progressUsage.subtreeUnknown,
+  });
+  const usage = { tokens: resolved.tokens, cost: resolved.cost };
+  if (resolved.subtree) { usage.subtree = resolved.subtree; }
+  if (resolved.subtreeUnknown) { usage.subtreeUnknown = true; }
+  return { ...leg, usage };
 }
 
 /** Stamp view:'live' on a non-terminal composed doc; no-op when terminal. */

package/src/observe/watch-render.js

@@ -29,7 +29,10 @@ const legCost = (leg) => (leg.usage && leg.usage.cost ? formatCost(leg.usage.cos
 const legTokens = (leg) => (leg.usage && leg.usage.tokens ? `${leg.usage.tokens.input || 0}/${leg.usage.tokens.output || 0}` : DASH);
 const truncate = (s, n) => { const t = String(s || ''); return t.length > n ? t.slice(0, n - 1) + '…' : t; };
 
-const STAGE_MARK = { complete: '✓', running: '▶', pending: '·' };
+// `partial` (v4.4.1 F6): a stage that FINISHED but lost seats. Without its own
+// mark it fell through to `pending`, so a degraded Stage 1 rendered as if it had
+// not started — the opposite of reporting loudly.
+const STAGE_MARK = { complete: '✓', running: '▶', partial: '⚠', pending: '·' };
 
 /** The in-place refresh block for a composed wave/council/solo doc. */
 function renderTable(doc, width = 100) {
@@ -93,6 +96,25 @@ function emitJsonChange(doc, prevText) {
  * @returns {Promise<number>} exit code
  */
 async function runWatchLoop(target, args, project, deps = {}) {
+  // Pointer-containment fence, defence in depth. cli-handlers-watch.js's
+  // resolveWatchTarget already refuses a council pointer whose runDir escapes
+  // the project, but this loop is exported, takes `target` from its caller, and
+  // opens events.jsonl straight out of target.runDir below — so it re-checks
+  // rather than trusting the hand-off. Reuses the shared fence
+  // (src/utils/path-fence.js) and reports through the SAME failJson
+  // BAD_SESSION envelope handleWatch uses for an unresolvable id, so a --json
+  // caller still gets exactly one typed error doc.
+  if (target.kind === 'council') {
+    const { containsOnDisk } = require('../utils/path-fence');
+    if (!containsOnDisk(project, target.runDir)) {
+      const { failJson, ERROR_CODES } = require('../utils/error-doc');
+      return failJson(!!args.json, {
+        code: ERROR_CODES.BAD_SESSION,
+        message: `watch: run directory for '${target.id}' resolves outside project ${project}`,
+        hint: 'Pass --project if the run was launched elsewhere.',
+      });
+    }
+  }
   const intervalSec = Math.max(0.5, Number(args.interval) || 2);
   const statusFn = deps.statusFn || ((id, p) => require('../mcp-server').handlers.amicus_status({ taskId: id }, p));
   const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));

package/src/opencode-client.js

@@ -328,15 +328,27 @@ async function createChildSession(client, parentId) {
 }
 
 /**
- * Get child sessions for a parent session
+ * Get child (subagent) sessions for a parent session.
+ *
+ * ⚠️ v4.4.1 LC-7: this was the ONE per-session call that did not thread
+ * `directoryQuery(directory)`, unlike getMessages / createSession /
+ * abortSession. It went unnoticed because nothing called it — on a SHARED
+ * server (one server, many projects) an un-scoped call is the exact
+ * "session not found" failure mode issue #47 fixed everywhere else, and it
+ * would have broken child-session cost attribution on precisely the
+ * configuration that makes attribution matter. Fixed with CA-1, its first
+ * consumer (src/sidecar/child-sessions.js).
  *
  * @param {import('@opencode-ai/sdk').OpencodeClient} client - SDK client
  * @param {string} parentId - Parent session ID
+ * @param {string} [directory] - Optional project directory to scope the call to.
+ *   Omitting it keeps the call byte-for-byte identical to before.
  * @returns {Promise<Array>} Array of child sessions
  */
-async function getChildren(client, parentId) {
+async function getChildren(client, parentId, directory) {
   const result = await client.session.children({
-    path: { id: parentId }
+    path: { id: parentId },
+    ...directoryQuery(directory)
   });
 
   return result.data || [];