auto-model-router 0.2.32 → 0.3.1

package/src/upstream/ollama.ts

@@ -0,0 +1,275 @@
+/**
+ * Ollama Cloud transport: Ollama's OpenAI-compatible `/v1/chat/completions`,
+ * either on ollama.com directly (API key) or through a local daemon that
+ * proxies `:cloud` models under the signed-in account.
+ *
+ * Same shape as the OpenRouter client, with the differences Ollama's
+ * compatibility layer imposes applied to the rendered body just before it
+ * goes out:
+ *
+ *  - the `ollama/` catalog prefix is stripped from `model`;
+ *  - `models[]` (OpenRouter's fallback cascade) and `session_id` are removed;
+ *  - `tool_choice` is removed (documented as unsupported);
+ *  - OpenRouter's `reasoning: {effort}` object becomes `reasoning_effort`;
+ *  - `cache_control` markers are stripped from content parts (Anthropic-style
+ *    breakpoints mean nothing here and could be rejected);
+ *  - `stream_options.include_usage` is set so the final chunk carries usage.
+ *
+ * Ollama returns no `usage.cost`, so the ledger's predicted figure stands in
+ * as the reported one; the catalog price is the published per-token rate.
+ *
+ * Plan limits are the other difference. Ollama meters cloud usage against
+ * monthly credits and a per-plan concurrency cap (1/3/10), so 402 and 429 are
+ * routine, not exceptional. Both trip a circuit breaker: the composite catalog
+ * hides every Ollama model while it is open, so a turn falls straight through
+ * to OpenRouter instead of paying a doomed dispatch first.
+ */
+
+import type { RouterConfig } from "../config/types.ts";
+import { OLLAMA_SLUG_PREFIX, ollamaModelId } from "../catalog/ollama-catalog.ts";
+import { createLogger } from "../util/log.ts";
+import type { StreamEvent, UpstreamChunk } from "../wire/types.ts";
+import { parseSse } from "./sse-parse.ts";
+import { UpstreamError, type Dispatch, type DispatchOptions, type UpstreamClient, type UpstreamErrorKind } from "./types.ts";
+
+/** Circuit-breaker view the catalog consults. */
+export interface OllamaAvailability {
+	/** False while a quota/rate-limit cooldown is in force. */
+	available(): boolean;
+	/** Epoch ms the cooldown ends, or null when available. */
+	cooldownUntilMs(): number | null;
+	/** Why the breaker is open, for /health. */
+	lastTrip(): { kind: UpstreamErrorKind; atMs: number; message: string } | null;
+}
+
+export interface OllamaClient extends UpstreamClient, OllamaAvailability {}
+
+function asRec(v: unknown): Record<string, unknown> | null {
+	return typeof v === "object" && v !== null && !Array.isArray(v) ? (v as Record<string, unknown>) : null;
+}
+
+const REASONING_EFFORT_MAP: Record<string, string> = {
+	minimal: "low",
+	low: "low",
+	medium: "medium",
+	high: "high",
+	xhigh: "high",
+	max: "high",
+};
+
+/** Rewrites an OpenRouter-shaped request body into what Ollama accepts. Pure. */
+export function toOllamaBody(body: Record<string, unknown>): Record<string, unknown> {
+	const out: Record<string, unknown> = { ...body };
+	if (typeof out.model === "string") out.model = ollamaModelId(out.model);
+	delete out.models;
+	delete out.session_id;
+	delete out.tool_choice;
+	delete out.stream_options;
+	const reasoning = asRec(out.reasoning);
+	delete out.reasoning;
+	delete out.reasoning_effort;
+	if (reasoning !== null) {
+		if (reasoning.enabled === false) {
+			// Nothing: omitting the field is "no explicit effort" on Ollama.
+		} else if (typeof reasoning.effort === "string") {
+			const mapped = REASONING_EFFORT_MAP[reasoning.effort];
+			if (mapped !== undefined) out.reasoning_effort = mapped;
+		}
+	}
+	if (Array.isArray(out.messages)) {
+		out.messages = out.messages.map((m) => {
+			const msg = asRec(m);
+			if (msg === null || !Array.isArray(msg.content)) return m;
+			return {
+				...msg,
+				content: msg.content.map((part) => {
+					const p = asRec(part);
+					if (p === null || !("cache_control" in p)) return part;
+					const { cache_control: _dropped, ...rest } = p;
+					return rest;
+				}),
+			};
+		});
+	}
+	if (out.stream === true) out.stream_options = { include_usage: true };
+	return out;
+}
+
+/** HTTP status → error kind. 402/429 are plan limits, not model faults. */
+export function classifyOllamaStatus(status: number, body: unknown): UpstreamError {
+	const rec = asRec(body);
+	const errRec = rec ? asRec(rec.error) : null;
+	const msg = errRec?.message ?? rec?.message ?? rec?.error;
+	const message = typeof msg === "string" && msg !== "" ? msg : `Ollama HTTP ${status}`;
+	const fail = (kind: UpstreamErrorKind, retryable: boolean): UpstreamError => new UpstreamError(kind, status, message, retryable, body);
+	if (status === 401) return fail("auth", false);
+	// Out of credits (or a plan gate): the account, not the model. Fail over.
+	if (status === 402) return fail("quota", true);
+	if (status === 403) return /credit|quota|plan|limit|billing/i.test(message) ? fail("quota", true) : fail("moderation", true);
+	if (status === 429) return fail("rate_limit", true);
+	if (status === 404) return fail("model_unavailable", true);
+	if (status === 400) {
+		if (/context|too many tokens|token limit/i.test(message)) return fail("context_length", false);
+		return fail("invalid_request", /support|unsupported|does not/i.test(message));
+	}
+	if (status >= 500) return fail("upstream_error", true);
+	return fail("upstream_error", status === 408);
+}
+
+function transportError(err: unknown): UpstreamError {
+	if (err instanceof UpstreamError) return err;
+	const name = err instanceof Error ? err.name : "";
+	if (name === "TimeoutError") return new UpstreamError("timeout", 0, "Ollama request timed out", true);
+	if (name === "AbortError") return new UpstreamError("aborted", 0, "request aborted", false);
+	return new UpstreamError("network", 0, err instanceof Error ? err.message : String(err), true);
+}
+
+/** Minimal fetch surface, injectable for tests. */
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+
+export function createOllamaClient(cfg: RouterConfig, fetchImpl: FetchLike = fetch): OllamaClient {
+	const o = cfg.ollama;
+	const baseUrl = o.baseUrl.replace(/\/+$/, "");
+	const log = createLogger(cfg.logLevel);
+	let cooldownUntil = 0;
+	let lastTrip: { kind: UpstreamErrorKind; atMs: number; message: string } | null = null;
+
+	const trip = (err: UpstreamError): void => {
+		const ms = err.kind === "quota" ? o.quotaCooldownMs : err.kind === "rate_limit" ? o.rateLimitCooldownMs : 0;
+		if (ms <= 0) return;
+		cooldownUntil = Math.max(cooldownUntil, Date.now() + ms);
+		lastTrip = { kind: err.kind, atMs: Date.now(), message: err.message };
+		log.warn("ollama cloud unavailable; routing around it", { kind: err.kind, cooldownMs: ms, message: err.message });
+	};
+
+	function headers(extra: Record<string, string> = {}): Record<string, string> {
+		const h: Record<string, string> = { "content-type": "application/json", ...extra };
+		if (o.apiKey !== "") h.authorization = `Bearer ${o.apiKey}`;
+		return h;
+	}
+
+	function composeSignal(caller: AbortSignal | undefined): AbortSignal | null {
+		const timeout = o.timeoutMs > 0 ? AbortSignal.timeout(o.timeoutMs) : null;
+		if (caller && timeout) return AbortSignal.any([caller, timeout]);
+		return caller ?? timeout;
+	}
+
+	async function httpError(res: Response): Promise<UpstreamError> {
+		let body: unknown = null;
+		try {
+			body = await res.json();
+		} catch {
+			// Status alone drives classification.
+		}
+		const err = classifyOllamaStatus(res.status, body);
+		trip(err);
+		return err;
+	}
+
+	/** Re-prefixes the served model so state/ledger keys match the catalog slug. */
+	function prefixServed(chunk: UpstreamChunk): UpstreamChunk {
+		let events: StreamEvent[] | null = null;
+		for (let i = 0; i < chunk.events.length; i++) {
+			const ev = chunk.events[i];
+			if (ev !== undefined && ev.type === "start" && !ev.servedSlug.startsWith(OLLAMA_SLUG_PREFIX)) {
+				events ??= [...chunk.events];
+				events[i] = { ...ev, servedSlug: `${OLLAMA_SLUG_PREFIX}${ev.servedSlug}` };
+			}
+		}
+		const raw = typeof chunk.raw.model === "string" && !chunk.raw.model.startsWith(OLLAMA_SLUG_PREFIX) ? { ...chunk.raw, model: `${OLLAMA_SLUG_PREFIX}${chunk.raw.model}` } : chunk.raw;
+		return events === null && raw === chunk.raw ? chunk : { raw, events: events ?? chunk.events };
+	}
+
+	return {
+		available: () => Date.now() >= cooldownUntil,
+		cooldownUntilMs: () => (Date.now() >= cooldownUntil ? null : cooldownUntil),
+		lastTrip: () => lastTrip,
+
+		async dispatch(opts: DispatchOptions): Promise<Dispatch> {
+			const body = toOllamaBody({ ...opts.body, stream: true });
+			let res: Response;
+			try {
+				res = await fetchImpl(`${baseUrl}/chat/completions`, {
+					method: "POST",
+					headers: headers(),
+					body: JSON.stringify(body),
+					signal: composeSignal(opts.signal),
+				});
+			} catch (err) {
+				throw transportError(err);
+			}
+			if (!res.ok) throw await httpError(res);
+			if (!res.body) throw new UpstreamError("upstream_error", res.status, "response had no body", true);
+
+			const parsed = parseSse(res.body, (msg, fields) => log.warn(msg, fields));
+			let resolveId!: (id: string | null) => void;
+			const idPromise = new Promise<string | null>((resolve) => {
+				resolveId = resolve;
+			});
+			let idResolved = false;
+			const resolveOnce = (id: string | null): void => {
+				if (!idResolved) {
+					idResolved = true;
+					resolveId(id);
+				}
+			};
+			const chunks = (async function* (): AsyncGenerator<UpstreamChunk> {
+				try {
+					for await (const chunk of parsed) {
+						const errPayload = chunk.raw.error;
+						if (errPayload !== undefined && errPayload !== null) {
+							const rec = asRec(errPayload) ?? {};
+							const message = typeof rec.message === "string" ? rec.message : "Ollama stream error";
+							throw new UpstreamError("upstream_error", 0, message, true, errPayload);
+						}
+						if (!idResolved && typeof chunk.raw.id === "string") resolveOnce(chunk.raw.id);
+						yield prefixServed(chunk);
+					}
+				} catch (err) {
+					throw transportError(err);
+				} finally {
+					resolveOnce(null);
+				}
+			})();
+			return { chunks, generationId: () => idPromise };
+		},
+
+		async complete(body: Record<string, unknown>, signal: AbortSignal): Promise<{ text: string; costUsd: number | null }> {
+			let res: Response;
+			try {
+				res = await fetchImpl(`${baseUrl}/chat/completions`, {
+					method: "POST",
+					headers: headers(),
+					body: JSON.stringify(toOllamaBody({ ...body, stream: false })),
+					signal: composeSignal(signal),
+				});
+			} catch (err) {
+				throw transportError(err);
+			}
+			if (!res.ok) throw await httpError(res);
+			const json = asRec(await res.json());
+			const choices = json?.choices;
+			const choice0 = Array.isArray(choices) && choices.length > 0 ? asRec(choices[0]) : null;
+			const message = choice0 ? asRec(choice0.message) : null;
+			const content = message?.content;
+			return { text: typeof content === "string" ? content : "", costUsd: null };
+		},
+
+		async fetchModels(signal?: AbortSignal): Promise<unknown[]> {
+			let res: Response;
+			try {
+				res = await fetchImpl(`${baseUrl}/models`, { headers: headers(), signal: composeSignal(signal) });
+			} catch (err) {
+				throw transportError(err);
+			}
+			if (!res.ok) throw await httpError(res);
+			const data = asRec(await res.json())?.data;
+			if (!Array.isArray(data)) throw new UpstreamError("upstream_error", res.status, "models payload had no data array", true);
+			return data;
+		},
+
+		fetchModelsForUser(signal?: AbortSignal): Promise<unknown[]> {
+			return this.fetchModels(signal);
+		},
+	};
+}

package/src/upstream/openrouter.ts

@@ -23,6 +23,21 @@ import {
 const CONTEXT_LENGTH_RE =
 	/context[ _-]?length|context[ _-]?window|maximum context|too many tokens|reduce (?:the |your )?(?:length|prompt)|prompt is too long|token limit/i;
 
+// A 400 that names a MODEL limitation rather than a malformed request: the
+// same body is fine on a sibling. Seen live: "This model only supports single
+// tool-calls at once!" from a model handed history with parallel tool calls —
+// the catalog has no reliable flag for that (`parallel_tool_calls` is listed by
+// 8 of 347 models, including none of the ones that handle it), so it can only
+// be learned reactively. Retryable ⇒ same-tier failover with the slug
+// excluded; still an attributable error, so trust demotes a repeat offender.
+const MODEL_CAPABILITY_RE =
+	/only supports single tool[ -]?calls?|parallel tool[ -]?calls?|does not support (?:tools?|function|tool[ -]?calls?|images?|vision|system)|(?:tool|function)[ -]?call(?:s|ing)? (?:is|are) not supported|unsupported (?:tool|function|parameter|modality|image)/i;
+
+/** Exported for tests: the status/body → UpstreamError mapping. */
+export function classifyUpstreamStatus(status: number, body: unknown): UpstreamError {
+	return classifyStatus(status, body);
+}
+
 function asRec(v: unknown): Record<string, unknown> | null {
 	return typeof v === "object" && v !== null && !Array.isArray(v) ? (v as Record<string, unknown>) : null;
 }
@@ -46,7 +61,10 @@ function classifyStatus(status: number, body: unknown): UpstreamError {
 	if (status === 403) return fail("moderation", true);
 	if (status === 429) return fail("rate_limit", true);
 	if (status === 400) {
-		return CONTEXT_LENGTH_RE.test(message) ? fail("context_length", false) : fail("invalid_request", false);
+		if (CONTEXT_LENGTH_RE.test(message)) return fail("context_length", false);
+		// The model, not the request, is what cannot cope: let failover pick a sibling.
+		if (MODEL_CAPABILITY_RE.test(message)) return fail("invalid_request", true);
+		return fail("invalid_request", false);
 	}
 	// Provider routing may recover a missing model on the next attempt.
 	if (status === 404) return fail("model_unavailable", true);

package/src/upstream/types.ts

@@ -11,6 +11,8 @@ import type { UpstreamChunk, WireError } from "../wire/types.ts";
 export type UpstreamErrorKind =
 	| "auth"
 	| "rate_limit"
+	/** Plan credits or a usage allowance exhausted (Ollama Cloud 402). Account-level, retryable elsewhere. */
+	| "quota"
 	| "context_length"
 	| "model_unavailable"
 	| "invalid_request"

package/src/util/sqlite.ts

@@ -18,7 +18,7 @@ import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 
 /** Bump when a migration is added; guarded below so reopening never regresses it. */
-const USER_VERSION = 14;
+const USER_VERSION = 16;
 
 const MIGRATIONS = `
 CREATE TABLE IF NOT EXISTS catalog_cache (
@@ -76,6 +76,8 @@ CREATE INDEX IF NOT EXISTS idx_ledger_slug ON ledger (slug);
 -- slug ever had; measured on a real ledger, the latency statement went from
 -- 5-10ms and RISING with history to a flat 0.04-0.08ms.
 CREATE INDEX IF NOT EXISTS idx_ledger_slug_created ON ledger (slug, created_at_ms DESC);
+CREATE INDEX IF NOT EXISTS idx_ledger_harness_created ON ledger (harness_id, created_at_ms DESC);
+CREATE INDEX IF NOT EXISTS idx_ledger_slug_harness_created ON ledger (slug, harness_id, created_at_ms DESC);
 
 CREATE TABLE IF NOT EXISTS token_calibration (
   tokenizer TEXT PRIMARY KEY,
@@ -224,6 +226,23 @@ const MIGRATE_V13 = `
 ALTER TABLE conversations ADD COLUMN compaction_plan TEXT;
 `;
 
+// v16: conversations remember the compacted prompt size the current plan was
+// made at, so re-planning can be rationed to real growth (see
+// CompactionConfig.replanGrowthRatio). 0 = unknown; the next plan sets it.
+//
+// The same migration discards every token_calibration row. Until v16 the
+// calibration paired the PRE-compaction, pre-context-block byte count with the
+// POST-compaction billed token count, so every learned ratio absorbed
+// compaction (measured: actual/compacted-estimate = 1.5), and one provider
+// that reports ~8x prompt tokens had dragged the qwen3 family to 1.6
+// bytes/token. Rows are running sums with thousands of samples, so they would
+// never converge on correctly paired data; relearning from zero costs ~20
+// samples per family at the built-in defaults.
+const MIGRATE_V16 = `
+ALTER TABLE conversations ADD COLUMN compaction_plan_tokens INTEGER NOT NULL DEFAULT 0;
+DELETE FROM token_calibration;
+`;
+
 // v9: benchmark_cache holds the external benchmark feeds (Artificial Analysis,
 // BenchLM) that backfill quality scores OpenRouter leaves unpublished. It is a
 // whole new table, created idempotently by the MIGRATIONS block above, so there
@@ -240,6 +259,10 @@ ALTER TABLE conversations ADD COLUMN compaction_plan TEXT;
 // is set. Created idempotently by the MIGRATIONS block above, so the version bump
 // alone records it; no ALTER guard needed.
 
+// v15: idx_ledger_harness_created and idx_ledger_slug_harness_created serve
+// harness-scoped daily spend, trust, and latency windows. Created idempotently
+// by MIGRATIONS; no ALTER guard needed.
+
 export function openDb(path: string): Database {
 	// ":memory:" has no parent directory to create.
 	if (path !== ":memory:") mkdirSync(dirname(path), { recursive: true });
@@ -264,6 +287,7 @@ export function openDb(path: string): Database {
 		const convCols = db.query("PRAGMA table_info(conversations)").all() as { name: string }[];
 		if (!convCols.some((c) => c.name === "context_version")) db.exec(MIGRATE_V11);
 		if (!convCols.some((c) => c.name === "compaction_plan")) db.exec(MIGRATE_V13);
+		if (!convCols.some((c) => c.name === "compaction_plan_tokens")) db.exec(MIGRATE_V16);
 		db.exec(`PRAGMA user_version = ${USER_VERSION}`);
 	}
 	return db;

package/test/cache-estimate.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, test } from "bun:test";
+
+import { estimateUnreportedCache } from "../src/cost/cache-estimate.ts";
+import { EMPTY_USAGE, type UsageCounts } from "../src/cost/types.ts";
+
+/**
+ * Ollama Cloud caches prompt prefixes and bills them at its cached rate but
+ * reports no count (measured 2026-09-07: 12 identical 162k-token requests
+ * moved the plan meter $0.06 against $0.29 at the full rate). The estimate
+ * follows the router's warm-cache rule: same model as the previous turn
+ * within the TTL ⇒ the previous prompt is the cached prefix.
+ */
+
+const base = (over: Partial<UsageCounts> = {}): UsageCounts => ({ ...EMPTY_USAGE, promptTokens: 120_000, completionTokens: 300, ...over });
+const ctx = { previousSlug: "ollama/glm", previousPromptTokens: 100_000, previousAtMs: 1_000_000, servedSlug: "ollama/glm", nowMs: 1_060_000, cacheWarmTtlMs: 300_000 };
+
+describe("estimateUnreportedCache", () => {
+	test("same model within the TTL: the previous prompt is the cached prefix, flagged as estimated", () => {
+		const out = estimateUnreportedCache(base(), ctx);
+		expect(out.cachedTokens).toBe(100_000);
+		expect(out.cachedEstimated).toBe(true);
+		expect(out.promptTokens).toBe(120_000);
+	});
+
+	test("a shorter prompt than the previous one caps the cached count at the prompt", () => {
+		expect(estimateUnreportedCache(base({ promptTokens: 40_000 }), ctx).cachedTokens).toBe(40_000);
+	});
+
+	test("first turn, model switch, or idle past the TTL count as cold", () => {
+		expect(estimateUnreportedCache(base(), { ...ctx, previousSlug: null }).cachedTokens).toBe(0);
+		expect(estimateUnreportedCache(base(), { ...ctx, previousSlug: "ollama/other" }).cachedTokens).toBe(0);
+		expect(estimateUnreportedCache(base(), { ...ctx, nowMs: ctx.previousAtMs + 300_001 }).cachedTokens).toBe(0);
+		expect(estimateUnreportedCache(base(), { ...ctx, previousPromptTokens: 0 }).cachedTokens).toBe(0);
+		expect(estimateUnreportedCache(base(), { ...ctx, cacheWarmTtlMs: 0 }).cachedTokens).toBe(0);
+	});
+
+	test("provider-reported cache counts are never overwritten", () => {
+		const reported = base({ cachedTokens: 5_000 });
+		expect(estimateUnreportedCache(reported, ctx)).toBe(reported);
+		const written = base({ cacheWriteTokens: 5_000 });
+		expect(estimateUnreportedCache(written, ctx)).toBe(written);
+	});
+
+	test("no prompt tokens: nothing to estimate", () => {
+		const empty = base({ promptTokens: 0 });
+		expect(estimateUnreportedCache(empty, ctx)).toBe(empty);
+	});
+});

package/test/catalog.test.ts

@@ -316,4 +316,48 @@ describe("createCatalog key-scoped availability", () => {
 		expect(hydrated?.keyScoped).toBe(true);
 		db.close();
 	});
+
+	test("a refresh that keeps under half the models is recorded as a shrink and surfaced", async () => {
+		const { createCatalog } = await import("../src/catalog/openrouter-catalog.ts");
+		const { openDb } = await import("../src/util/sqlite.ts");
+		const { DEFAULT_CONFIG } = await import("../src/config/defaults.ts");
+
+		// Every usable record, then a 4-model slice of it, then the full set again.
+		const usable = RAW.filter((r) => normalizeCatalogModel(r) !== null);
+		expect(usable.length).toBeGreaterThanOrEqual(20);
+		const responses = [usable, usable.slice(0, 4), usable];
+		let calls = 0;
+		const upstream: any = {
+			dispatch: () => Promise.reject(new Error("unused")),
+			complete: () => Promise.reject(new Error("unused")),
+			fetchModels: async () => usable,
+			fetchModelsForUser: async () => responses[Math.min(calls++, responses.length - 1)],
+		};
+		const cfg = {
+			...DEFAULT_CONFIG,
+			benchmarks: { ...DEFAULT_CONFIG.benchmarks, enabled: false },
+			openrouter: { ...DEFAULT_CONFIG.openrouter, apiKey: "sk-or-test" },
+			logLevel: "silent" as const,
+		};
+		const db = openDb(":memory:");
+		const catalog = createCatalog(cfg, upstream, db);
+
+		const first = await catalog.get();
+		expect(catalog.lastShrink?.()).toBeNull();
+
+		// The shrink is ADOPTED (the key decides what may be dispatched) but flagged.
+		const second = await catalog.refresh();
+		expect(second.models.length).toBe(4);
+		const shrink = catalog.lastShrink?.();
+		expect(shrink).not.toBeNull();
+		expect(shrink!.fromModels).toBe(first.models.length);
+		expect(shrink!.toModels).toBe(4);
+
+		// Recovery clears it.
+		const third = await catalog.refresh();
+		expect(third.models.length).toBe(first.models.length);
+		expect(catalog.lastShrink?.()).toBeNull();
+		db.close();
+	});
+
 });

package/test/classify.test.ts

@@ -263,15 +263,51 @@ describe("scoreHeuristic", () => {
 		expect(scoreHeuristic(contFeatures(400), BASE).tier).toBe("moderate");
 	});
 
-	test("a circular tool call on a deep loop escalates to hard", () => {
-		// The stuck signal raw depth misses: a prior call re-issued verbatim.
-		const deepCircular = scoreHeuristic(contFeatures(90, { circularToolCall: true }), BASE);
+	test("a circular tool call on a FRESH turn escalates to hard", () => {
+		// Off a continuation the stuck signal keeps full weight: the user is
+		// watching a live loop and a pricier model may actually break it.
+		const deepCircular = scoreHeuristic(
+			{ ...contFeatures(90, { circularToolCall: true }), isToolResultContinuation: false },
+			BASE,
+		);
 		expect(deepCircular.tier).toBe("hard");
 	});
 
-	test("a failing tool result on a deep loop is at least moderate", () => {
+	test("a circular tool call on a mechanical continuation is damped, not hard", () => {
+		// Measured: hard escalations on circular calls never shortened the loop
+		// (chain means identical, 5.74 turns, hard vs moderate). 22 of 27 such
+		// hard turns were mechanical continuations paying up to 6x for nothing.
+		const retry = scoreHeuristic(contFeatures(90, { circularToolCall: true }), BASE);
+		const plain = scoreHeuristic(contFeatures(90), BASE);
+		expect(tierIdx(retry.tier)).toBeLessThanOrEqual(tierIdx("moderate"));
+		// Exactly the damped weight, not merely "less than the full one".
+		expect(retry.score - plain.score).toBeCloseTo(BASE.classifier.mechanicalRetryFactor * 0.24, 5);
+	});
+
+	test("a failing tool result on a deep loop is at least simple", () => {
+		// Was 'at least moderate' before the mechanical-retry damp: the flat
+		// +0.26 pushed deep mechanical retry loops into hard. A damped retry
+		// still clears trivial.
 		const deepAndFailing = scoreHeuristic(contFeatures(20, { lastToolFailed: true }), BASE);
-		expect(tierIdx(deepAndFailing.tier)).toBeGreaterThanOrEqual(tierIdx("moderate"));
+		expect(tierIdx(deepAndFailing.tier)).toBeGreaterThanOrEqual(tierIdx("simple"));
+	});
+
+	test("a failed-tool retry on a mechanical continuation is damped, not hard", () => {
+		// A retry after a failed tool call is the most mechanical turn there is;
+		// the flat +0.26 let automated retry loops buy the hard tier ($7.02 of one
+		// measured day vs $0.19 for the same rows as moderate picks). The
+		// continuation keeps only mechanicalRetryFactor of the weight.
+		const retry = scoreHeuristic(contFeatures(20, { lastToolFailed: true }), BASE);
+		const quiet = scoreHeuristic(contFeatures(20), BASE);
+		expect(tierIdx(retry.tier)).toBeLessThan(tierIdx("hard"));
+		expect(retry.score - quiet.score).toBeCloseTo(
+			BASE.classifier.mechanicalRetryFactor * 0.26,
+			5,
+		);
+		// A failure the USER sees (not a tool-result continuation) keeps the full
+		// weight: that genuinely changes what the turn needs.
+		const userSeen = scoreHeuristic(contFeatures(2, { isToolResultContinuation: false, lastToolFailed: true }), BASE);
+		expect(userSeen.score - scoreHeuristic(contFeatures(2, { isToolResultContinuation: false }), BASE).score).toBeCloseTo(0.26, 5);
 	});
 });
 

package/test/compaction.test.ts

@@ -9,6 +9,7 @@ const CFG: CompactionConfig = {
 	enabled: true,
 	budgetTokens: 1,
 	floorRatio: 1,
+	replanGrowthRatio: 1,
 	fitToWindow: false,
 	protectRecentTurns: 2,
 	maxToolResultBytes: 50,

package/test/config-wizard.test.ts

@@ -8,6 +8,7 @@ import { writeRouterConfig } from "../src/cli/config-cmd.ts";
 import {
 	applyAnswers,
 	CLEAR_TOKEN,
+	displayValue,
 	formatValue,
 	getPath,
 	mergeConfigPartial,
@@ -20,6 +21,7 @@ import {
 	type FieldSpec,
 	type WizardIo,
 } from "../src/cli/config-wizard.ts";
+import { DEFAULT_CONFIG } from "../src/config/defaults.ts";
 import { loadConfig } from "../src/config/load.ts";
 
 const cfg = loadConfig({});
@@ -113,6 +115,78 @@ describe("validateField", () => {
 		expect(validateField(opt, CLEAR_TOKEN)).toEqual({ ok: true, value: null });
 		expect(validateField(num, CLEAR_TOKEN).ok).toBe(false);
 	});
+
+	test("a restricted string array rejects unknown items", () => {
+		const tiers: FieldSpec = { path: "escalation.probeTiers", label: "t", kind: "stringArray", options: ["trivial", "simple"] };
+		expect(validateField(tiers, "simple, trivial")).toEqual({ ok: true, value: ["simple", "trivial"] });
+		const bad = validateField(tiers, "simple, hard");
+		expect(bad.ok).toBe(false);
+		if (!bad.ok) expect(bad.error).toContain("hard");
+	});
+
+	test("number arrays parse, bound-check and reject non-numbers", () => {
+		const arms: FieldSpec = { path: "exploration.holdTurns.values", label: "a", kind: "numberArray", min: 1 };
+		expect(validateField(arms, "2, 3,4")).toEqual({ ok: true, value: [2, 3, 4] });
+		expect(validateField(arms, "2, x").ok).toBe(false);
+		expect(validateField(arms, "0, 2").ok).toBe(false);
+	});
+
+	test("secrets display as set/unset", () => {
+		const key: FieldSpec = { path: "openrouter.apiKey", label: "k", kind: "string", optional: true, secret: true };
+		expect(displayValue(key, "sk-abc")).toBe("set");
+		expect(displayValue(key, "")).toBe("unset");
+		expect(displayValue(key, undefined)).toBe("unset");
+		expect(displayValue({ ...key, secret: false }, "sk-abc")).toBe("sk-abc");
+	});
+});
+
+describe("WIZARD_SECTIONS coverage", () => {
+	/** Leaves that are edited as whole records/arrays rather than fields. */
+	const RECORD_PATHS = new Set(["ollama.prices", "ollama.twins", "profiles"]);
+
+	function leaves(obj: unknown, prefix = ""): string[] {
+		if (typeof obj !== "object" || obj === null || Array.isArray(obj)) return [prefix];
+		const out: string[] = [];
+		for (const [k, v] of Object.entries(obj)) {
+			const path = prefix === "" ? k : `${prefix}.${k}`;
+			if (RECORD_PATHS.has(path)) continue;
+			out.push(...leaves(v, path));
+		}
+		return out;
+	}
+
+	test("every config leaf has a wizard field (so /router can edit all of it)", () => {
+		const fields = new Set(WIZARD_SECTIONS.flatMap((s) => s.fields.map((f) => f.path)));
+		const missing = leaves(DEFAULT_CONFIG).filter((p) => !fields.has(p));
+		expect(missing).toEqual([]);
+	});
+
+	test("every wizard field points at a real config path or a known optional", () => {
+		// Optional keys absent from DEFAULT_CONFIG still have to be spelled right;
+		// they are listed here so a typo in a new field path fails loudly.
+		const KNOWN_OPTIONAL = new Set([
+			"server.apiKey", "server.harnessId", "openrouter.referer",
+			"budget.perTurnUsd", "budget.perConversationUsd", "budget.perDayUsd", "filters.maxExpectedWaitMs",
+			...["trivial", "simple", "moderate", "hard"].flatMap((t) => [
+				`tiers.${t}.maxInputPerMtok`, `tiers.${t}.maxOutputPerMtok`, `tiers.${t}.qualityNormalization`, `tiers.${t}.capabilityFloorUsd`,
+			]),
+			...["coding", "vision", "documentation", "data", "chat"].flatMap((t) => [`tasks.${t}.minQuality`, `tasks.${t}.requireImage`, `tasks.${t}.prefer`]),
+			...["trivial", "simple", "moderate", "hard"].map((t) => `exploration.rates.${t}`),
+		]);
+		const known = new Set(leaves(DEFAULT_CONFIG));
+		const unknown = WIZARD_SECTIONS.flatMap((s) => s.fields.map((f) => f.path)).filter((p) => !known.has(p) && !KNOWN_OPTIONAL.has(p));
+		expect(unknown).toEqual([]);
+	});
+
+	test("field paths are unique across sections", () => {
+		const all = WIZARD_SECTIONS.flatMap((s) => s.fields.map((f) => f.path));
+		expect(new Set(all).size).toBe(all.length);
+	});
+
+	test("secrets are exactly the credential keys", () => {
+		const secrets = WIZARD_SECTIONS.flatMap((s) => s.fields.filter((f) => f.secret === true).map((f) => f.path)).sort();
+		expect(secrets).toEqual(["benchmarks.artificialAnalysisApiKey", "context.token", "ollama.apiKey", "openrouter.apiKey", "server.apiKey"]);
+	});
 });
 
 describe("applyAnswers", () => {
@@ -198,13 +272,14 @@ describe("runWizard", () => {
 	});
 
 	test("blank answers keep current values; only edits are written", async () => {
-		// Server section: host, port, apiKey, harnessId.
+		// Server section: host, port, apiKey, harnessId, maxConcurrentTurns.
 		const { partial, changed } = await drive([
 			SECTION.get("Server") ?? "",
 			"", // keep host
 			"9000", // change port
 			"", // keep apiKey
 			"", // keep harnessId
+			"", // keep maxConcurrentTurns
 			"s",
 		]);
 		expect(partial).toEqual({ server: { port: 9000 } });
@@ -248,6 +323,7 @@ describe("runWizard", () => {
 			"n", // injectBreakpoints
 			"", // maxBreakpoints
 			"", // minPromptTokens
+			"", // milestoneTokens
 			"s",
 		]);
 		expect(partial).toEqual({ logLevel: "warn", cache: { injectBreakpoints: false } });