amicus 4.4.0 → 4.4.1

package/electron/fold.js

@@ -66,7 +66,7 @@ function createFoldHandler(state) {
         `Session: ${state.sessionId || state.taskId}`,
         `Client: ${state.client}`,
         `CWD: ${state.cwd}`,
-        `Mode: interactive`,
+        'Mode: interactive',
         '---',
         summary || 'Session ended without summary.'
       ].join('\n');

package/electron/main.js

@@ -142,7 +142,10 @@ function createAmicusWindow() {
   let updateInfo = null;
   const updateInfoRaw = process.env.AMICUS_UPDATE_INFO;
   if (updateInfoRaw) {
-    try { updateInfo = JSON.parse(updateInfoRaw); } catch (_) {}
+    try { updateInfo = JSON.parse(updateInfoRaw); } catch (_) {
+      // A malformed AMICUS_UPDATE_INFO is not worth failing launch over:
+      // updateInfo stays null and the direct check below takes over.
+    }
   }
   if (!updateInfo) {
     const { getUpdateInfo, initUpdateCheck } = require('../src/utils/updater');

package/electron/setup-ui-aliases.js

@@ -22,7 +22,7 @@ const ALIAS_GROUPS = [
  * @returns {string} HTML fragment with search, groups, rows, and add button
  */
 function buildAliasEditorHTML(aliases) {
-  const searchInput = `<input type="text" id="alias-search" class="alias-search" placeholder="Search aliases..." autocomplete="off" spellcheck="false">`;
+  const searchInput = '<input type="text" id="alias-search" class="alias-search" placeholder="Search aliases..." autocomplete="off" spellcheck="false">';
 
   const groups = ALIAS_GROUPS.map(group => {
     const rows = group.keys
@@ -31,10 +31,10 @@ function buildAliasEditorHTML(aliases) {
         const model = aliases[key];
         return `<div class="alias-row" data-alias="${key}">` +
           `<span class="alias-name">${key}</span>` +
-          `<span class="alias-arrow">\u2192</span>` +
+          '<span class="alias-arrow">\u2192</span>' +
           `<span class="alias-model">${model}</span>` +
           `<button class="alias-delete" data-alias="${key}">\u00d7</button>` +
-          `</div>`;
+          '</div>';
       }).join('\n        ');
 
     const count = group.keys.filter(key => aliases[key] !== undefined).length;
@@ -51,9 +51,9 @@ function buildAliasEditorHTML(aliases) {
   const exampleModel = aliases[exampleAlias] || 'openrouter/google/gemini-3.1-flash-lite-preview';
 
   // SVG icons for the example box
-  const terminalIcon = `<svg class="alias-icon-accent" width="16" height="16" viewBox="0 0 16 16" fill="none"><rect x="1" y="2" width="14" height="12" rx="2" stroke-width="1.5"/><path d="M4 6l2.5 2L4 10" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M8.5 10H11" class="alias-icon-faint-path" stroke-width="1.5" stroke-linecap="round"/></svg>`;
-  const arrowIcon = `<svg class="alias-icon-accent" width="20" height="12" viewBox="0 0 20 12" fill="none"><path d="M2 6h14" stroke-width="1.5" stroke-linecap="round"/><path d="M13 2l4 4-4 4" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
-  const modelIcon = `<svg class="alias-icon-ok" width="16" height="16" viewBox="0 0 16 16" fill="none"><circle cx="8" cy="5" r="3" stroke-width="1.5"/><path d="M8 8v3" stroke-width="1.5" stroke-linecap="round"/><circle cx="4" cy="13" r="1.5" stroke-width="1.2"/><circle cx="8" cy="13" r="1.5" stroke-width="1.2"/><circle cx="12" cy="13" r="1.5" stroke-width="1.2"/><path d="M4 11.5L8 11M8 11l4 .5" stroke-width="1" stroke-linecap="round"/></svg>`;
+  const terminalIcon = '<svg class="alias-icon-accent" width="16" height="16" viewBox="0 0 16 16" fill="none"><rect x="1" y="2" width="14" height="12" rx="2" stroke-width="1.5"/><path d="M4 6l2.5 2L4 10" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M8.5 10H11" class="alias-icon-faint-path" stroke-width="1.5" stroke-linecap="round"/></svg>';
+  const arrowIcon = '<svg class="alias-icon-accent" width="20" height="12" viewBox="0 0 20 12" fill="none"><path d="M2 6h14" stroke-width="1.5" stroke-linecap="round"/><path d="M13 2l4 4-4 4" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></svg>';
+  const modelIcon = '<svg class="alias-icon-ok" width="16" height="16" viewBox="0 0 16 16" fill="none"><circle cx="8" cy="5" r="3" stroke-width="1.5"/><path d="M8 8v3" stroke-width="1.5" stroke-linecap="round"/><circle cx="4" cy="13" r="1.5" stroke-width="1.2"/><circle cx="8" cy="13" r="1.5" stroke-width="1.2"/><circle cx="12" cy="13" r="1.5" stroke-width="1.2"/><path d="M4 11.5L8 11M8 11l4 .5" stroke-width="1" stroke-linecap="round"/></svg>';
 
   const exampleBox = `<div class="routing-example">
         <div class="example-label">How it works</div>

package/electron/workspace-ui/live-model.js

@@ -11,7 +11,10 @@
   // or idle-timed-out run would poll forever and never flip to its terminal rendering.
   // Must stay byte-identical to src/workspace/run-detail.js TERMINAL_STATUSES, which itself
   // mirrors the shipped src/observe/live-doc.js TERMINAL set. A drift pin asserts this.
-  var TERMINAL_STATUSES = ['complete', 'partial', 'error', 'crashed', 'aborted', 'timeout', 'idle-timeout'];
+  // ⚠️ v4.4.1 A1: 'timed-out' added alongside 'timeout'. Both spellings are real and are written
+  // by different producers — see src/observe/live-doc.js:18. Inert for the workspace (a council
+  // run.json's status vocabulary is aborted|complete|error|partial), carried for byte-identity.
+  var TERMINAL_STATUSES = ['complete', 'partial', 'error', 'crashed', 'aborted', 'timeout', 'timed-out', 'idle-timeout'];
 
   // ⚠️ DE-ROT (F41): STAGE_LABELS must be mirrored here too. The live loop labels stages that
   // START AFTER the run was opened, and those names are absent from the frozen derived.stageRail,
@@ -54,6 +57,14 @@
     // leg (terminal rows from runStats are already alias-only, so the fallback is exact there).
     var alias = seat.modelInput || seat.model;
     var label = labelOf ? labelOf(alias) : null;
+    // ⚠️ v4.4.1 RN-9: this hand-rolled flip is LOAD-BEARING — do NOT "fix" it into
+    // AmicusRender.display({model: seat.model, label: label}, blindOn). The other two copies
+    // (workspace-panels.js's review/judge titles) were routed through display() because their
+    // pair's `model` IS the identity they must print. Here it is not: the seat's printable
+    // identity is the council ALIAS resolved on the line above (F36 — a live leg's `seat.model`
+    // is the RESOLVED executable id, e.g. `google/gemini-2.5-pro`, which labelMap never keys on),
+    // so display()'s blind-OFF arm would print the resolved id and undo F36. This module is also
+    // node-tested with NO DOM and no window.AmicusRender to call. Deliberate third copy.
     var name = blindOn && label ? label : alias;
     var tokens = (seat.tokensIn === null || seat.tokensIn === undefined) &&
                  (seat.tokensOut === null || seat.tokensOut === undefined)

package/electron/workspace-ui/md-lite.js

@@ -15,16 +15,49 @@
   var UL_RE = /^\s*[-*]\s+/;
   var OL_RE = /^\s*\d+[.)]\s+/;
 
+  /**
+   * Split one line into literal / inline-code segments in a SINGLE linear pass.
+   *
+   * ⚠️ v4.4.1 A1/D1 (Confirmed 4/4), with its SEVERITY CLAIM CORRECTED. The
+   * previous form re-`exec`ed a freshly sliced `rest` each iteration
+   * (`rest = rest.slice(...)`) — quadratic as WRITTEN, but not as it ran. V8's
+   * `String.prototype.slice` returns a SlicedString (parent pointer + offset),
+   * not a copy, so the old code measured ~8 ms at artifact-guard.js's 200 KB cap
+   * and scaled LINEARLY (~2x per doubling out to 2.4 MB). A deliberately-copying
+   * control took 78,232 ms at that same 200 KB — that is the freeze the finding
+   * described, and it is not what shipped. Numbers:
+   * `.superpowers/sdd/task-10-report.md:127-148`.
+   *
+   * What the rewrite removes is therefore a silent dependence on an undocumented
+   * engine optimisation that nothing here states or tests — a latent PORTABILITY
+   * hazard on any engine without sliced strings — and not a live performance
+   * defect or an exploitable-DoS-that-was. The `lastIndex` cursor walks the
+   * ORIGINAL string once and never copies a tail, so linearity is now a property
+   * of the algorithm rather than of the engine.
+   *
+   * Output is identical to the old function for every input: the pattern is
+   * context-free — no `^`, `\b`, lookaround or backreference — so a /g scan
+   * resuming at `lastIndex` lands on exactly the same match positions that
+   * re-`exec`ing the remainder did. The three boundary cases match too: no
+   * match at all yields one literal segment, a trailing match yields no empty
+   * tail segment, and empty input yields [].
+   *
+   * The regex is constructed per call and deliberately NOT hoisted to module
+   * scope: a /g regex carries mutable `lastIndex`, so one shared instance would
+   * leak cursor state between calls and silently drop spans.
+   */
   function parseInline(text) {
     var out = [];
-    var rest = String(text);
-    while (rest.length) {
-      var m = /`([^`\n]+)`/.exec(rest);
-      if (!m) { out.push({ code: false, text: rest }); break; }
-      if (m.index > 0) { out.push({ code: false, text: rest.slice(0, m.index) }); }
+    var s = String(text);
+    var re = /`([^`\n]+)`/g;
+    var pos = 0;
+    var m;
+    while ((m = re.exec(s)) !== null) {
+      if (m.index > pos) { out.push({ code: false, text: s.slice(pos, m.index) }); }
       out.push({ code: true, text: m[1] });
-      rest = rest.slice(m.index + m[0].length);
+      pos = re.lastIndex;
     }
+    if (pos < s.length) { out.push({ code: false, text: s.slice(pos) }); }
     return out;
   }
 
@@ -43,7 +76,11 @@
         continue;
       }
       var h = H_RE.exec(line);
-      if (h) { blocks.push({ t: 'h', level: h[1].length, text: h[2] }); i += 1; continue; }
+      // ⚠️ v4.4.1 D3: trim the heading text. H_RE's `\s+` eats the run of
+      // whitespace after the hashes, but `(.*)$` keeps everything to end of
+      // line — so `# Title   ` rendered a heading with trailing blanks baked
+      // into its text node.
+      if (h) { blocks.push({ t: 'h', level: h[1].length, text: h[2].trim() }); i += 1; continue; }
       if (UL_RE.test(line)) {
         var ul = [];
         while (i < lines.length && UL_RE.test(lines[i])) { ul.push(lines[i].replace(UL_RE, '')); i += 1; }
@@ -91,7 +128,14 @@
       var b = blocks[i];
       var el;
       if (b.t === 'h') {
-        el = d.createElement('h' + Math.min(6, b.level + 2));
+        // ⚠️ v4.4.1 D4: the `Math.min(6, …)` that used to wrap this was
+        // unreachable — H_RE's `#{1,4}` bounds level to 1–4, so the tag is
+        // always h3–h6 and the clamp could never fire. Dead defensive code is
+        // worse than none here: it made the h6 ceiling look enforced when the
+        // real guarantee lives in H_RE. If that `#{1,4}` is ever widened, THIS
+        // line must widen with it — h7 is not an element. The
+        // `'#'.repeat(4) + ' X'` → h6 test pins the true boundary.
+        el = d.createElement('h' + (b.level + 2));
         applyInline(el, parseInline(b.text), d);
       } else if (b.t === 'code') {
         el = d.createElement('pre');

package/electron/workspace-ui/workspace-matrix.js

@@ -175,20 +175,57 @@
     return chairHost;
   }
 
-  /** Wrap every text-node occurrence of needle in <mark> (DOM-safe highlight). */
+  /**
+   * Wrap EVERY occurrence of `needle` in a `<mark>` (DOM-safe: splitText + replaceChild,
+   * never innerHTML).
+   *
+   * ⚠️ v4.4.1 RN-3 + DOC-6: this used to do exactly ONE `indexOf`/`splitText` per collected
+   * text node, so a finding id mentioned twice inside a single text node was highlighted once
+   * — and the reader, drilling in from a dispute cell, believed they had seen every reference
+   * to it in that judge's prose. This docblock nonetheless promised "every occurrence" (DOC-6),
+   * which is what made two `wsgate04` reviewers file the same bug from opposite directions.
+   * Behaviour and doc now agree.
+   *
+   * The rescan continues from `tail`, not from `cursor`, because `splitText` MUTATES the node
+   * being walked: the first call truncates `cursor` to the text BEFORE the match and returns the
+   * match-plus-remainder; the second peels the remainder off into a NEW node the TreeWalker's
+   * already-collected list does not contain. Advancing to that new node is what makes the loop
+   * both complete (it can reach later matches) and terminating (it can never re-find the match
+   * it just replaced).
+   *
+   * NOT idempotent — a second call re-walks the text nodes inside the marks this one created and
+   * nests a second `<mark>`. drillIntoJudge (workspace-panels.js) calls clearHighlight() first
+   * for exactly that reason.
+   *
+   * ⚠️ v4.4.1 M1: clearHighlight() (below) unwraps each `<mark>` back into a plain text node but
+   * never calls `normalize()`, so the sibling text nodes either side of the old mark are left
+   * un-merged — the drill-clear-drill cycle fragments the prose a little more every time. Because
+   * the scan above only ever calls `.indexOf`/`.splitText` on ONE text node at a time, a needle
+   * whose match now straddles one of those leftover boundaries is invisible to it — silently
+   * under-marking on a re-drilled panel, the opposite of this docblock's "every occurrence"
+   * promise. `container.normalize()` below re-merges adjacent text nodes before every scan, so
+   * highlightText is robust to fragmentation regardless of how the container got that way.
+   */
   function highlightText(container, needle) {
-    if (!needle) { return; }
+    if (!needle) { return; }  // also the loop's termination guard: a 0-length needle never advances
+    // v4.4.1 M1: undo any un-merged fragmentation clearHighlight() left behind (it does not
+    // normalize) — without this, a needle whose match spans a leftover node boundary is missed.
+    container.normalize();
     var walker = document.createTreeWalker(container, NodeFilter.SHOW_TEXT);
     var nodes = [];
     while (walker.nextNode()) { nodes.push(walker.currentNode); }
     nodes.forEach(function (node) {
-      var idx = node.nodeValue.indexOf(needle);
-      if (idx === -1) { return; }
-      var after = node.splitText(idx);
-      after.splitText(needle.length);
-      var mark = document.createElement('mark');
-      mark.textContent = needle;
-      after.parentNode.replaceChild(mark, after);
+      var cursor = node;
+      for (;;) {
+        var idx = cursor.nodeValue.indexOf(needle);
+        if (idx === -1) { return; }
+        var match = cursor.splitText(idx);            // `match` now starts with the needle
+        var tail = match.splitText(needle.length);    // `tail` is everything after it
+        var mark = document.createElement('mark');
+        mark.textContent = needle;
+        match.parentNode.replaceChild(mark, match);
+        cursor = tail;
+      }
     });
   }
 

package/electron/workspace-ui/workspace-panels.js

@@ -134,19 +134,30 @@
     // than new).
     var artifacts = A.state.detail.artifacts || {};
     function present(name) { return !!(artifacts[name] && artifacts[name].present); }
+    // ⚠️ v4.4.1 RN-9: these two titles used to hand-roll `A.state.blind && label ? label : m`
+    // inline. Both now go through AmicusRender.display() — the single blind-flip definition the
+    // re-vote title below already used — so the next blind-mode ruling lands in one place instead
+    // of being re-applied by hand in every file that happens to render an identity.
     loaders['reviews-panel'] = { bodyId: 'reviews-body', files: function () {
       return bench.map(function (m) {
         var label = A.state.labelByModel[m];
-        return { name: 'review-' + sanitizeName(m) + '.md', title: (A.state.blind && label ? label : m) };
+        return { name: 'review-' + sanitizeName(m) + '.md', title: window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
       }).filter(function (f) { return present(f.name); });
     } };
     loaders['bundle-panel'] = { bodyId: 'bundle-body', files: function () {
-      return [{ name: 'bundle-stage2.md', title: 'bundle-stage2.md (verbatim)' }];
+      // ⚠️ v4.4.1 RN-4: the presence filter is NOT optional here either. Without it, a run whose
+      // Stage 2 never ran (a one-seat bench, an abort before the cross-review, a cost ceiling)
+      // requested a file the manifest already knows is absent and rendered readRunArtifact's raw
+      // error string in the panel — "absolute host path and all", per this file's own round-2
+      // note above `present()`. reviews-panel and judges-panel have always filtered; this was the
+      // odd one out.
+      return [{ name: 'bundle-stage2.md', title: 'bundle-stage2.md (verbatim)' }]
+        .filter(function (f) { return present(f.name); });
     } };
     loaders['judges-panel'] = { bodyId: 'judges-body', files: function () {
       var files = bench.map(function (m) {
         var label = A.state.labelByModel[m];
-        return { name: 'judge-' + sanitizeName(m) + '.md', title: 'Judge ' + (A.state.blind && label ? label : m) };
+        return { name: 'judge-' + sanitizeName(m) + '.md', title: 'Judge ' + window.AmicusRender.display({ model: m, label: label }, A.state.blind) };
       });
       if (debated) {
         // ⚠️ DE-ROT (F38): on a --debate run, a matrix dispute cell can be a RE-VOTE whose

package/electron/workspace-ui/workspace-render.js

@@ -93,7 +93,13 @@
         ]),
         el('div', { className: 'run-row-sub' }, [
           relTime(row.startedAt),
-          String(row.bench.length) + ' seats',
+          // ⚠️ v4.4.1 RN-12: `String(row.bench.length)` was unguarded. scanCouncilRuns is written
+          // to "never throw on bad input" and degrade to a row instead — but this painter draws
+          // EVERY row, so one row arriving without a `bench` array threw a TypeError that blanked
+          // the entire run list, killing the data layer's degrade-never-throw guarantee one layer
+          // up. (scanCouncilRuns' own error rows take the early return above; this guards the
+          // contract with any OTHER row source, which is what the guarantee is actually worth.)
+          (Array.isArray(row.bench) ? row.bench.length : 0) + ' seats',
           'chair ' + displayModel(row.chair, blindOn, labelOf),
           row.overallVerdict || '',
           row.costDisplay || '',

package/electron/workspace-ui/workspace-verbs.js

@@ -20,6 +20,13 @@
   function doFold() {
     var A = window.AmicusApp;
     var btn = A.$('fold-btn');
+    // ⚠️ v4.4.1 LC-8: this chain had NO rejection handler. workspace:fold's IPC handler catches
+    // its own errors and answers {ok:false, error}, so a REJECTION means the channel itself failed
+    // — and the user saw the Fold button sitting in its pre-click state with no explanation, while
+    // the renderer logged an unhandled rejection (which jest-circus fails the running test on).
+    // Two-argument .then(onFulfilled, onRejected), NOT .then().catch() — see the long note in
+    // startLiveLoop below: with a trailing .catch, a THROW inside onFulfilled would be routed here
+    // too and misreported as a channel failure.
     A.invoke('workspace:fold', A.state.runId).then(function (res) {
       if (res.ok) {
         btn.textContent = 'Folded ✓';
@@ -28,6 +35,9 @@
       } else {
         btn.title = res.error || 'fold failed';
       }
+    }, function (err) {
+      console.error('workspace fold: workspace:fold failed', err);
+      btn.title = 'fold failed — the workspace channel is unavailable' + (err && err.message ? ': ' + err.message : '');
     });
   }
 
@@ -180,7 +190,23 @@
       R.renderBanner(A.$('banner'),
         'No leg activity' + (mins ? ' for ' + mins + 'm' : '') + ' — the run may be dead. Abort to reclaim it; everything on disk stays browsable.',
         'live');
-      A.$('abort-btn').hidden = false; // the remedy ships beside the diagnosis (Task 16 wires it)
+      // ⚠️ v4.4.1 RN-6 — ARBITRATED, and deliberately NOT fixed as the backlog proposed. RN-6
+      // asked for a matching `hidden = true` in the clearing arm below, believing this line is
+      // what puts the Abort button on screen. It is not: workspace-app.js's renderDetail already
+      // sets `$('abort-btn').hidden = isTerminal` on every run-open (:128), and startLiveLoop only
+      // runs on a non-terminal run — so the button is ALREADY visible for the whole life of a live
+      // run, by design, and this assignment is a no-op on every path that reaches it. The proposed
+      // clearing-arm write would HIDE the button the moment a momentary stall recovered, leaving a
+      // healthy, still-running council with no way to abort it: the inverse defect, and worse.
+      // Full reasoning + the regression pin: "the Abort button survives a stall -> recover cycle"
+      // in tests/workspace/live-loop.test.js.
+      //
+      // v4.4.1 M4: this line is NOT "the remedy" (that framing, from Task 16, is what this note
+      // corrects) — it is redundant on every path except one: a run that dies WHILE stalled,
+      // whose terminal openRun() refresh then rejects. On THAT path it leaves Abort visible on a
+      // run that is already dead — a false affordance, not a working safety net. Kept anyway
+      // because it is harmless: aborting a dead run is a no-op.
+      A.$('abort-btn').hidden = false;
     } else if (A.$('banner').classList.contains('live')) {
       // Restores whatever the DURABLE banner actually says (nothing, a schemaVersion mismatch,
       // run.error, …) instead of just blanking it — a live-layer banner (info-unavailable or
@@ -216,7 +242,27 @@
         return;
       }
       stopLiveLoop();
-      A.openRun(A.state.runId); // re-read: status flips to aborted, grey chip, no live poll
+      // ⚠️ v4.4.1 LC-8: the re-read was fire-and-forget (wsgate01 C5) — inconsistent with the
+      // live loop's terminal branch above, which was explicitly given this same handler for this
+      // same reason. If the re-read fails, the status chip never leaves 'running' and the UI shows
+      // a live run that isn't. `.catch` (not the two-argument form) is EXACTLY equivalent here and
+      // matches the sibling at the terminal branch above: there is no onFulfilled for a trailing
+      // .catch to swallow a throw out of, which is the only thing the two-argument form buys.
+      A.openRun(A.state.runId).catch(function (err) { // re-read: status flips to aborted, grey chip, no live poll
+        console.error('workspace abort: post-abort get-run refresh failed', err);
+        window.AmicusRender.renderBanner(A.$('banner'),
+          'Abort succeeded, but refreshing the run failed — reopen the run to see its final state.', '');
+      });
+    }, function (err) {
+      // ⚠️ v4.4.1 LC-8 (same handler, same class): a REJECTED invoke() left `btn.disabled = true`
+      // and the dialog open forever — the confirm button wedged with no way back — plus an
+      // unhandled rejection. workspace:abort-run's IPC handler answers {ok:false} on its own
+      // errors, so reaching here means the channel failed, not the abort.
+      console.error('workspace abort: workspace:abort-run failed', err);
+      btn.disabled = false;
+      $('dialog-abort').hidden = true;
+      window.AmicusRender.renderBanner(A.$('banner'),
+        'Abort failed: the workspace channel is unavailable' + (err && err.message ? ' — ' + err.message : ''), '');
     });
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "mcpName": "io.github.BourbonDog/amicus",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "keywords": [
@@ -43,6 +43,7 @@
     "commands/",
     ".claude-plugin/",
     "CHANGELOG.md",
+    "docs/*.md",
     "scripts/postinstall.js",
     "scripts/setup-hooks.js"
   ],
@@ -50,11 +51,11 @@
     "start": "node --experimental-top-level-await --experimental-vm-modules bin/amicus.js",
     "test": "jest",
     "test:integration": "node scripts/run-integration-keyless.js",
-    "test:integration:live": "jest --testPathIgnorePatterns='worktrees' --testMatch='**/tests/**/*.integration.test.js'",
+    "test:integration:live": "jest --runInBand --testPathIgnorePatterns='worktrees' --testMatch='**/tests/**/*.integration.test.js'",
     "test:all": "jest --testPathIgnorePatterns='/node_modules/' --testPathIgnorePatterns='worktrees' && node scripts/mark-test-passed.js",
     "test:e2e:mcp": "jest tests/mcp-repomix-e2e.integration.test.js --testTimeout=180000 --forceExit",
     "posttest": "node scripts/mark-test-passed.js",
-    "lint": "eslint src/",
+    "lint": "eslint src/ electron/",
     "postinstall": "node scripts/postinstall.js",
     "test:thinking": "node scripts/benchmark-thinking.js",
     "test:thinking:quick": "MODELS=gemini node scripts/benchmark-thinking.js",
@@ -88,6 +89,7 @@
     "ajv": "^8.20.0",
     "chrome-remote-interface": "^0.33.3",
     "eslint": "^8.0.0",
+    "espree": "^9.6.1",
     "jest": "^29.0.0",
     "lint-staged": "^16.3.2",
     "puppeteer": "^24.36.0",
@@ -100,6 +102,9 @@
   "lint-staged": {
     "src/**/*.js": [
       "eslint --fix"
+    ],
+    "electron/**/*.js": [
+      "eslint --fix"
     ]
   }
 }

package/schemas/council-run.schema.json

@@ -48,6 +48,26 @@
         }
       }
     },
+    "sharedServer": {
+      "description": "The run acquired its single shared OpenCode server and threaded it through every wave (v4.4.1 Task 0.5). Present only on a successful acquisition; mutually exclusive with sharedServerUnavailable. `goPid` is the shared server's process id — no wave writes a goPid into its own metadata.json while riding an injected server, so this field is the POSITIVE, direct evidence that one server served the run, replacing the goPid-absence inference.",
+      "type": "object",
+      "required": ["acquired"],
+      "properties": {
+        "acquired": { "const": true },
+        "at": { "type": "string" },
+        "goPid": { "type": ["number", "null"] },
+        "models": { "type": "number" }
+      }
+    },
+    "sharedServerUnavailable": {
+      "description": "The run could not start its single shared OpenCode server and fell back to one server per wave (v4.4.1 Task 0.5). Present only when the acquisition failed. The run CONTINUES — this is never fatal — but the per-wave configuration is the one that races on OpenCode's SQLite, so results may be degraded.",
+      "type": "object",
+      "required": ["error"],
+      "properties": {
+        "error": { "type": "string" },
+        "at": { "type": "string" }
+      }
+    },
     "debate": {
       "type": "object",
       "properties": {

package/schemas/progress.schema.json

@@ -12,6 +12,18 @@
     "updatedAt": { "type": "string", "format": "date-time" },
     "messagesReceived": { "type": "number" },
     "latestTool": { "type": "string" },
+    "toolSettleTimedOut": {
+      "description": "v4.4 B4. The leg was completed while at least one tool call was still non-terminal, after AMICUS_TOOL_SETTLE_GRACE_MS elapsed. Its partial output was kept and it was NOT failed, but its reported cost is a floor. Present only when true.",
+      "const": true
+    },
+    "unsettledToolCalls": {
+      "description": "How many tool calls were still live when the settle grace was exceeded. A count here (progress.json is a compact snapshot); the full list rides the runHeadless result. Present only alongside toolSettleTimedOut.",
+      "type": "number"
+    },
+    "toolSettleAborted": {
+      "description": "v4.4.1 LC-2. Whether the leg's OpenCode session was successfully aborted at the settle ceiling so it would stop billing. `false` means the abort was attempted and failed — the session may still be billing. Present only alongside toolSettleTimedOut.",
+      "type": "boolean"
+    },
     "usage": {
       "type": "object",
       "properties": {

package/schemas/spend.schema.json

@@ -9,8 +9,28 @@
     "schemaVersion": { "const": 2 },
     "type": { "const": "spend" },
     "windowDays": { "type": ["number", "null"] },
-    "total": { "type": "object" },
-    "byModel": { "type": "array", "items": { "type": "object" } },
+    "total": {
+      "type": "object",
+      "properties": {
+        "amount": { "type": "number" },
+        "runs": { "type": "number" },
+        "unpricedRows": { "$ref": "#/$defs/unpricedRows" },
+        "unattributedSubtreeRows": { "$ref": "#/$defs/unattributedSubtreeRows" }
+      }
+    },
+    "byModel": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "model": { "type": "string" },
+          "amount": { "type": "number" },
+          "runs": { "type": "number" },
+          "unpricedRows": { "$ref": "#/$defs/unpricedRows" },
+          "unattributedSubtreeRows": { "$ref": "#/$defs/unattributedSubtreeRows" }
+        }
+      }
+    },
     "credit": { "type": ["object", "null"] },
     "filters": { "type": "object" },
     "groupBy": { "enum": ["model", "wave", "council", "project", "op", "day"] },
@@ -22,7 +42,9 @@
         "properties": {
           "key": { "type": "string" },
           "amount": { "type": "number" },
-          "runs": { "type": "number" }
+          "runs": { "type": "number" },
+          "unpricedRows": { "$ref": "#/$defs/unpricedRows" },
+          "unattributedSubtreeRows": { "$ref": "#/$defs/unattributedSubtreeRows" }
         }
       }
     },
@@ -32,10 +54,36 @@
       "properties": {
         "amount": { "type": "number" },
         "runs": { "type": "number" },
+        "unpricedRows": { "$ref": "#/$defs/unpricedRows" },
+        "unattributedSubtreeRows": { "$ref": "#/$defs/unattributedSubtreeRows" },
         "byStatus": { "type": "object" }
       }
     },
-    "rows": { "type": "array" },
+    "rows": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "description": "A raw spend-ledger.jsonl row (internal v1 shape, echoed verbatim when --rows is passed). Always an object: readSpendRows drops any ledger line that does not parse as one, scalars and arrays included. Only the fields this document makes claims about are pinned beyond that.",
+        "properties": {
+          "subtreeUnknown": {
+            "type": "boolean",
+            "description": "v4.4.1. Present (and always true) only when this leg's own cost resolved but it spawned a child session whose spend could not be determined — the row is PRICED yet its cost is a floor. OMITTED entirely otherwise, so an ordinary row is byte-identical to a pre-4.4.1 one."
+          }
+        }
+      }
+    },
     "rowsTruncated": { "type": "boolean" }
+  },
+  "$defs": {
+    "unpricedRows": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Rows that contributed NOTHING to `amount` (no numeric cost). The bucket's figure omits them entirely: real spend is at least this much."
+    },
+    "unattributedSubtreeRows": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "v4.4.1 CA-2. Rows that ARE priced and DO contribute to `amount`, but whose leg spawned a subagent whose child-session spend could not be determined — the second, independent reason the figure is a floor. A row can be counted in both this and `unpricedRows`; the two are never substitutes."
+    }
   }
 }

package/src/cli-handlers-spend.js

@@ -50,15 +50,22 @@ function parseSinceDays(since) {
  * the arithmetic actually saw. It exists so the renderers can say "$X plus N
  * unknown" instead of coercing null→0 and printing a measured-looking $0.0000
  * (diagnosis §8, final paragraph).
+ *
+ * v4.4.1 CA-2: `unattributedSubtreeRows` is its sibling for the OTHER way the
+ * figure understates. Such a row is fully priced — it is in `amount`, it is in
+ * the `r` bucket, `unpricedRows` never sees it — but the leg spawned a child
+ * session whose spend the walk could not determine, which is exactly what makes
+ * `council run` report `costExact: false` about the same dollars. Without this
+ * counter `amicus spend` disagreed with `council run` and looked complete.
  * @param {Array<object>} rows
  */
 function aggregateSpend(rows) {
-  const total = { amount: 0, tokens: emptyTokens(), runs: rows.length, unpricedRows: 0, sourceMix: { reported: 0, estimated: 0, unknown: 0 } };
+  const total = { amount: 0, tokens: emptyTokens(), runs: rows.length, unpricedRows: 0, unattributedSubtreeRows: 0, sourceMix: { reported: 0, estimated: 0, unknown: 0 } };
   const byModelMap = new Map();
   for (const r of rows) {
     const model = r.model || 'unknown';
     if (!byModelMap.has(model)) {
-      byModelMap.set(model, { model, amount: 0, tokens: emptyTokens(), runs: 0, unpricedRows: 0, sourceMix: { reported: 0, estimated: 0, unknown: 0 } });
+      byModelMap.set(model, { model, amount: 0, tokens: emptyTokens(), runs: 0, unpricedRows: 0, unattributedSubtreeRows: 0, sourceMix: { reported: 0, estimated: 0, unknown: 0 } });
     }
     const bucket = byModelMap.get(model);
     bucket.runs += 1;
@@ -68,6 +75,8 @@ function aggregateSpend(rows) {
     const priced = typeof cost.amount === 'number';
     const amount = priced ? cost.amount : 0;
     if (!priced) { bucket.unpricedRows += 1; total.unpricedRows += 1; }
+    // Beside, never instead of: a row can be both unpriced and subtree-unknown.
+    if (r.subtreeUnknown) { bucket.unattributedSubtreeRows += 1; total.unattributedSubtreeRows += 1; }
     bucket.amount += amount;
     total.amount += amount;
     // Any source string outside {reported,estimated} buckets as unknown —
@@ -178,6 +187,15 @@ function renderHuman({ total, byModel, windowDays, credit, wasted }) {
     out += `${total.unpricedRows} unpriced row(s) — cost unknown and NOT in the total; `
       + 'real spend is at least this much.\n';
   }
+  // v4.4.1 CA-2: a DIFFERENT statement from the line above, and deliberately
+  // worded as one. "We could not see this leg at all" (unpriced) vs "we saw this
+  // leg, and its own cost IS in the total, but not what it spawned" — the second
+  // is why `council run` reports costExact:false on a row that looks complete
+  // here. Both lines can appear at once; a row can be in both counts.
+  if (total.unattributedSubtreeRows > 0) {
+    out += `${total.unattributedSubtreeRows} row(s) spawned a subagent whose CHILD session `
+      + 'spend could NOT be determined — real spend is HIGHER than this total.\n';
+  }
   if (wasted && wasted.runs > 0) {
     out += `Wasted (failed runs): ${formatCost({ amount: wasted.amount, source: 'mixed' })} across ${wasted.runs} rows — see amicus spend --failed\n`;
   }

package/src/cli-handlers-watch.js

@@ -84,6 +84,17 @@ async function handleWatch(args) {
     // at the wrong directory when a run was launched elsewhere.
     const project = args.project || args.cwd || process.cwd();
     const runId = args._[1] ? String(args._[1]) : '';
+    // ⚠️ v4.4.1 DOC-3: validate HERE, not by moving the branch. The branch's
+    // POSITION above the `id is required` gate is load-bearing (bare `--ui`
+    // opens the run-list landing and must keep working), so the runId check is
+    // pushed inside it and made conditional on a runId actually being supplied.
+    // Without this, `amicus watch <typo> --ui` skipped validateTaskId entirely
+    // and surfaced whatever getRunDetail produced — a vaguer error than the
+    // identical typo gets on the terminal path.
+    if (runId) {
+      const uiCheck = validateTaskId(runId);
+      if (!uiCheck.valid) { process.stderr.write(`${uiCheck.error}\n`); return 1; }
+    }
     const { launchWorkspaceWindow } = require('./sidecar/workspace-window');
     const res = await launchWorkspaceWindow({ project, runId });
     if (res.error) { process.stderr.write(`${res.error}\n`); }