bunnyquery 1.14.0 → 1.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bunnyquery",
-  "version": "1.14.0",
+  "version": "1.15.1",
   "description": "Embeddable BunnyQuery AI chat widget + its framework-agnostic chat engine",
   "main": "bunnyquery.js",
   "exports": {

package/src/engine/budget.ts

@@ -32,6 +32,9 @@ export var CONTEXT_WINDOW_BY_MODEL: Record<string, number> = {
 	'claude-sonnet-4-5': 1000000, 'claude-sonnet-4': 200000,
 	'claude-haiku-4-5': 200000, 'claude-3-5-sonnet': 200000,
 	// openai, exact ids
+	// gpt-6.1: OpenAI's listing carries no window; taken as the gpt-6 family's until a
+	// published figure says otherwise (2026-10-12, the default model).
+	'gpt-6.1-sol': 1050000,
 	'gpt-6-astra': 1050000, 'gpt-6-sol': 1050000, 'gpt-6-luna': 1050000,
 	'gpt-5.6-sol': 1050000, 'gpt-5.6-terra': 1050000, 'gpt-5.6-luna': 1050000,
 	'gpt-5.5': 1000000, 'gpt-5.4': 1050000,
@@ -39,7 +42,7 @@ export var CONTEXT_WINDOW_BY_MODEL: Record<string, number> = {
 	'gpt-4.1': 1040000, 'gpt-4o': 128000, 'o1': 200000, 'o1-pro': 200000,
 	// family keys
 	'claude-fable': 1000000, 'claude-opus': 1000000, 'claude-sonnet': 1000000,
-	'claude-haiku': 200000, 'gpt-6': 1050000, 'gpt-5.6': 1050000, 'gpt-5': 128000,
+	'claude-haiku': 200000, 'gpt-6.1': 1050000, 'gpt-6': 1050000, 'gpt-5.6': 1050000, 'gpt-5': 128000,
 };
 // Two rows above are load-bearing rather than redundant, both because the family
 // walk drops trailing segments:
@@ -76,6 +79,7 @@ export var MAX_OUTPUT_BY_MODEL: Record<string, number> = {
 	'claude-sonnet-4-6': 64000, 'claude-haiku-4-5': 64000,
 	'claude-3-5-sonnet': 8000,
 	// openai
+	'gpt-6.1-sol': 128000,
 	'gpt-6-astra': 128000, 'gpt-6-sol': 128000, 'gpt-6-luna': 128000,
 	'gpt-5.6-sol': 128000, 'gpt-5.6-terra': 128000, 'gpt-5.6-luna': 128000,
 	'gpt-5.5': 128000, 'gpt-5.4': 128000,
@@ -83,7 +87,7 @@ export var MAX_OUTPUT_BY_MODEL: Record<string, number> = {
 	'gpt-4.1': 16000, 'gpt-4o': 4000, 'o1': 100000, 'o1-pro': 100000,
 	// family keys
 	'claude-fable': 128000, 'claude-opus': 128000, 'claude-sonnet': 64000,
-	'claude-haiku': 64000, 'gpt-6': 128000, 'gpt-5.6': 128000, 'gpt-5': 128000,
+	'claude-haiku': 64000, 'gpt-6.1': 128000, 'gpt-6': 128000, 'gpt-5.6': 128000, 'gpt-5': 128000,
 };
 
 // The window a project runs at when nobody has touched the setting, clamped per

package/src/engine/config.ts

@@ -23,7 +23,7 @@
  */
 
 import { type AttachmentParser, registerAttachmentParser } from './attachment_parsers';
-import { cachedProjectSettings, loadProjectSettings, webAccessFrom } from './project_settings';
+import { cachedProjectSettings, loadProjectSettings, webAccessFrom, skipDuplicateFilesFrom } from './project_settings';
 
 /**
  * One report about a turn that is streaming, as handed to `onLiveStreamUpdate`.
@@ -243,18 +243,29 @@ export interface ChatEngineConfig {
      * OpenAI's `web_search` are attached to a chat request only when this
      * resolves to true.
      *
-     * OPTIONAL, AND UNSET IS NOT FALSE. When the host leaves it out, the engine
-     * reads the project's own setting (`web_access` in the `bq::settings`
-     * record, see project_settings.ts) and falls back to OFF, so the project
-     * owner's switch on the Project Settings page decides for every client that
-     * does not override it. A host that sets a boolean here overrides the
-     * project for its own page, both ways. Resolution: this option, then the
-     * project setting, then false.
+     * OPTIONAL. The project's own setting (`web_access` in the `bq::settings`
+     * record, see project_settings.ts; off unless the owner turned it on) is the
+     * CEILING, and this option may only restrict below it:
+     *     effective = projectSetting && webAccess !== false
+     * So `false` here turns the web off for this page whatever the project says,
+     * and `true` or unset follows the project. A value above the project setting
+     * has no effect: the owner's switch is what lets an answer out onto the web.
      *
      * Chat turns only. An indexing pass keeps the tools it has today, since the
      * worker hands it rendered pages and extracted text and not a URL to fetch.
      */
     webAccess?: boolean;
+    /**
+     * Whether a chat attachment that the signed-in user already uploaded to this
+     * project (same file name, same size, same uploader) is SKIPPED: not uploaded
+     * again, not indexed again, the turn using the stored copy's url. Same
+     * ceiling rule as `webAccess`, against the project's `skip_duplicate_files`
+     * setting, which is ON unless the owner turned it off:
+     *     effective = projectSetting && skipDuplicateFiles !== false
+     * `false` here lets this page re-upload duplicates on a project that skips
+     * them; `true` or unset follows the project. See duplicates.ts for the check.
+     */
+    skipDuplicateFiles?: boolean;
     /**
      * skapi.forwardRequestFinalize, bound to the consumer's skapi instance.
      * Stores the version of a streamed turn that history should keep (the engine
@@ -484,29 +495,71 @@ export function liveStreamingEnabled(): boolean {
 }
 
 /**
- * The web switch for a chat turn, SYNCHRONOUSLY: the host's `webAccess` option
- * when it is a boolean, else the project's cached `web_access` setting, else
- * false. For a template or a prompt builder, which have nowhere to await. Reads
- * the cache as it stands, so before the settings fetch settles it answers the
- * default; request builders use resolveWebAccess below instead.
+ * THE CEILING RULE, shared by every project switch a host may also set:
+ *     effective = projectSetting && hostOption !== false
+ * The project owner's setting is the most a page can have; a host option can
+ * only take it lower. `override` is a per-call host value (a direct caller of
+ * callClaudeWithMcp passing `webAccess`), which restricts exactly like the config
+ * option: either one being `false` is off.
+ */
+function underCeiling(projectSetting: boolean, option: boolean | undefined, override?: boolean): boolean {
+    if (!projectSetting) return false;
+    if (option === false) return false;
+    if (override === false) return false;
+    return true;
+}
+
+/**
+ * The web switch for a chat turn, SYNCHRONOUSLY: the project's cached
+ * `web_access` setting (off unless the owner turned it on), restricted by the
+ * host's `webAccess` option when that is `false`. For a template or a prompt
+ * builder, which have nowhere to await. Reads the cache as it stands, so before
+ * the settings fetch settles it answers the default; request builders use
+ * resolveWebAccess below instead.
  */
 export function webAccessEnabled(service?: string): boolean {
     const opt = _config ? _config.webAccess : undefined;
-    if (typeof opt === 'boolean') return opt;
-    return webAccessFrom(service ? cachedProjectSettings(service) : null);
+    return underCeiling(webAccessFrom(service ? cachedProjectSettings(service) : null), opt);
 }
 
 /**
- * The same switch, awaiting the project's settings record when the host did not
- * decide. Never rejects: a failed or impossible read (no reader injected, a
- * signed-out visitor on a require_login project) settles as "unset", which is
- * off. Cheap after the first call per project: the store dedupes and caches.
+ * The same switch, awaiting the project's settings record. Never rejects: a
+ * failed or impossible read (no reader injected, a signed-out visitor on a
+ * require_login project) settles as "unset", which is off. Cheap after the first
+ * call per project: the store dedupes and caches. `override` is a per-call host
+ * value that may only restrict (see underCeiling).
  */
-export function resolveWebAccess(service?: string): Promise<boolean> {
+export function resolveWebAccess(service?: string, override?: boolean): Promise<boolean> {
     const opt = _config ? _config.webAccess : undefined;
-    if (typeof opt === 'boolean') return Promise.resolve(opt);
-    if (!service) return Promise.resolve(false);
-    return loadProjectSettings(service).then(webAccessFrom, () => false);
+    if (!service) return Promise.resolve(underCeiling(webAccessFrom(null), opt, override));
+    return loadProjectSettings(service)
+        .then(webAccessFrom, () => false)
+        .then((setting) => underCeiling(setting, opt, override));
+}
+
+/**
+ * The skip-duplicates switch for an upload, SYNCHRONOUSLY: the project's cached
+ * `skip_duplicate_files` setting (on unless the owner turned it off), restricted
+ * by the host's `skipDuplicateFiles` option when that is `false`. Answers the
+ * default before the settings fetch settles; the upload path uses
+ * resolveSkipDuplicateFiles below.
+ */
+export function skipDuplicateFilesEnabled(service?: string): boolean {
+    const opt = _config ? _config.skipDuplicateFiles : undefined;
+    return underCeiling(skipDuplicateFilesFrom(service ? cachedProjectSettings(service) : null), opt);
+}
+
+/**
+ * The same switch, awaiting the project's settings record. Never rejects: a
+ * failed read settles as "unset", which for this switch is ON (the default), so
+ * a project that cannot be read still skips duplicates unless the host said no.
+ */
+export function resolveSkipDuplicateFiles(service?: string): Promise<boolean> {
+    const opt = _config ? _config.skipDuplicateFiles : undefined;
+    if (!service) return Promise.resolve(underCeiling(skipDuplicateFilesFrom(null), opt));
+    return loadProjectSettings(service)
+        .then(skipDuplicateFilesFrom, () => skipDuplicateFilesFrom(null))
+        .then((setting) => underCeiling(setting, opt));
 }
 
 /**

package/src/engine/duplicates.ts

@@ -0,0 +1,115 @@
+/**
+ * Duplicate-upload detection for chat attachments (reliability plan, owner's
+ * yes 2026-10-12): "has the signed-in user already uploaded THIS file to this
+ * project?", answered from the file records the upload path already writes.
+ *
+ * WHAT COUNTS AS THE SAME FILE. Same name, same size in bytes, same uploader.
+ * Every upload creates a `src::<storagePath>` record (table `file_summaries`)
+ * whose `data.size_bytes` is the byte count and whose `user_id` is the
+ * uploader, so a lookup by name narrowed by those two fields finds a file
+ * without reading its bytes. A different user's identical file is NOT a
+ * duplicate: that user's copy sits at a different access group and path and
+ * may be invisible to this one.
+ *
+ * HOW THE NAME IS FOUND. `getUniqueId` with `condition: '<='` is an ENDS-WITH
+ * match on the record id (served from the reversed proxy rows), and a file
+ * record's id ends with the file's name: `src::<name>` for a file at the
+ * root, `src::<folders>/<name>` otherwise. The match is then narrowed to
+ * exactly those two shapes, so `src::report.pdf` is not found by "port.pdf",
+ * and to the `src::` prefix, because the `run::` and `done::` index markers
+ * end with the same path and are not files.
+ *
+ * NEVER THROWS. A failed or refused lookup (a signed-out visitor on a
+ * require_login project, a region without the proxy rows yet, a network
+ * error) answers null, and null means "upload as usual": the check exists to
+ * save an indexing run, and must never be able to cost one.
+ *
+ * TRANSPORT-FREE like the rest of the engine: the caller hands in the skapi
+ * instance it owns. The widget passes its own; a host with no instance simply
+ * does not wire the hook and uploads as before.
+ */
+
+/** The record found, with the storage path the stored file lives at. */
+export type DuplicateUploadMatch = {
+	/** The stored file's db storage path (the record id without `src::`). */
+	storagePath: string;
+	/** The matching `src::` record id. */
+	uniqueId: string;
+	/** The file record as read. */
+	record: any;
+};
+
+export type DuplicateUploadFile = {
+	/** The file name as it is STORED: the last segment of the storage path. */
+	name: string;
+	/** Size in bytes. */
+	size: number;
+};
+
+/** The `src::` records to read before giving up; a name is rarely shared this widely. */
+export const DUPLICATE_LOOKUP_MAX_CANDIDATES = 25;
+
+const SRC_PREFIX = 'src::';
+
+/** Narrow an ends-with listing to real file records for exactly this name. */
+export function isDuplicateCandidateId(uniqueId: unknown, name: string): boolean {
+	if (typeof uniqueId !== 'string' || !name) return false;
+	if (uniqueId.indexOf(SRC_PREFIX) !== 0) return false;
+	if (uniqueId === SRC_PREFIX + name) return true;
+	const tail = '/' + name;
+	return uniqueId.length > SRC_PREFIX.length + tail.length && uniqueId.slice(-tail.length) === tail;
+}
+
+function listOf(res: any): any[] {
+	if (!res) return [];
+	if (Array.isArray(res)) return res;
+	return Array.isArray(res.list) ? res.list : [];
+}
+
+/**
+ * The first `src::` record for `file.name` whose `data.size_bytes` equals
+ * `file.size` and whose `user_id` is `userId`, or null. `opts.service` is passed
+ * through to both skapi calls when given (the widget names the project on every
+ * call); otherwise the instance's own project is queried.
+ */
+export async function findDuplicateUpload(
+	skapi: any,
+	file: DuplicateUploadFile,
+	userId: string,
+	opts?: { service?: string },
+): Promise<DuplicateUploadMatch | null> {
+	try {
+		if (!skapi || typeof skapi.getUniqueId !== 'function' || typeof skapi.getRecords !== 'function') return null;
+		const name = file && typeof file.name === 'string' ? file.name : '';
+		const size = file && typeof file.size === 'number' ? file.size : NaN;
+		if (!name || !(size >= 0) || !userId) return null;
+		const service = opts && opts.service ? { service: opts.service } : {};
+
+		const found = listOf(await skapi.getUniqueId(Object.assign({ unique_id: name, condition: '<=' }, service)));
+		const ids: string[] = [];
+		for (const item of found) {
+			const id = item && typeof item === 'object' ? item.unique_id : item;
+			if (isDuplicateCandidateId(id, name) && ids.indexOf(id) === -1) ids.push(id);
+			if (ids.length >= DUPLICATE_LOOKUP_MAX_CANDIDATES) break;
+		}
+
+		for (const uniqueId of ids) {
+			let record: any = null;
+			try {
+				record = listOf(await skapi.getRecords(Object.assign({ unique_id: uniqueId }, service)))[0] || null;
+			} catch {
+				// One unreadable candidate (another group, a deleted record) is not
+				// the answer; the next one may be.
+				continue;
+			}
+			if (!record || typeof record !== 'object') continue;
+			const data = record.data && typeof record.data === 'object' ? record.data : null;
+			if (!data || data.size_bytes !== size) continue;
+			if (record.user_id !== userId) continue;
+			return { storagePath: uniqueId.slice(SRC_PREFIX.length), uniqueId, record };
+		}
+		return null;
+	} catch {
+		return null;
+	}
+}

package/src/engine/host.ts

@@ -385,6 +385,18 @@ export interface ChatHost {
 	 * setting existed.
 	 */
 	uploadAccessGroup?(storagePath: string): 'public' | 'authorized' | 'private' | undefined | Promise<'public' | 'authorized' | 'private' | undefined>;
+	/**
+	 * "Has the signed-in user already uploaded this file to this project?" Asked
+	 * BEFORE a member's bytes go up, only while the skip-duplicates switch resolves
+	 * on (config.ts resolveSkipDuplicateFiles: the project's `skip_duplicate_files`
+	 * setting, on by default, restricted by the host's `skipDuplicateFiles: false`).
+	 * `file.name` is the name as STORED (the last segment of the storage path the
+	 * host itself produced), `file.size` the byte count. A match means the member
+	 * is neither uploaded nor indexed: the turn takes the stored copy's url and
+	 * the chip says so. Null, a rejection or a missing hook all mean "upload as
+	 * usual"; the engine's findDuplicateUpload is the ready-made implementation.
+	 */
+	findDuplicateUpload?(file: { name: string; size: number }): Promise<{ storagePath: string } | null> | { storagePath: string } | null;
 	/** Map a relative path to the consumer's db storage key (e.g. uid-prefixed). */
 	storagePathFor(relPath: string): string;
 	getMimeType(name: string): string | null;

package/src/engine/index.ts

@@ -34,8 +34,23 @@ export {
 	// template; the awaiting form is what the request builders use.
 	webAccessEnabled,
 	resolveWebAccess,
+	// Same ceiling rule for the upload path's skip-duplicates switch: the project's
+	// `skip_duplicate_files` setting (on by default), restricted by a host's
+	// `skipDuplicateFiles: false`.
+	skipDuplicateFilesEnabled,
+	resolveSkipDuplicateFiles,
 } from './config';
 
+// "Has this user already uploaded this file here?", answered from the `src::` file
+// records. The widget wires it as the host's findDuplicateUpload hook; it never throws.
+export {
+	findDuplicateUpload,
+	isDuplicateCandidateId,
+	DUPLICATE_LOOKUP_MAX_CANDIDATES,
+	type DuplicateUploadMatch,
+	type DuplicateUploadFile,
+} from './duplicates';
+
 export {
 	isServerExtractable,
 	isOfficeFile,
@@ -286,6 +301,11 @@ export {
 	normalizeWebAccess,
 	webAccessFrom,
 	projectWebAccess,
+	// skip duplicate uploads (same record, its own key, on by default)
+	DEFAULT_SKIP_DUPLICATE_FILES,
+	normalizeSkipDuplicateFiles,
+	skipDuplicateFilesFrom,
+	projectSkipDuplicateFiles,
 	// pure readers over a settings `data` object
 	normalizeUploadAccessGroup,
 	normalizeProjectAccessSetting,

package/src/engine/project_settings.ts

@@ -96,6 +96,7 @@ export type ProjectSettingsData = {
 	upload_access_group?: unknown;
 	chat_greeting?: unknown;
 	web_access?: unknown;
+	skip_duplicate_files?: unknown;
 	[key: string]: unknown;
 };
 
@@ -109,12 +110,14 @@ export type ProjectSettingsData = {
  * database alone. Only the literal `true` turns it on: this record is public and
  * a client must never read a value it did not write as permission.
  *
- * Resolution order, applied by the engine where the chat request is built:
- *   1. the host's `webAccess` init/config option, when it is a boolean;
- *   2. this setting, when the project has set it;
- *   3. off.
- * Indexing requests are not governed by this: an indexing pass keeps the tools
- * it has today (see requests.ts notifyAgentSaveAttachment).
+ * Resolution, applied by the engine where the chat request is built (config.ts
+ * resolveWebAccess): THIS SETTING IS THE CEILING and the host may only restrict.
+ *   effective = projectSetting && hostOption !== false
+ * A host's `webAccess: false` turns a project that is on off for its own page;
+ * a host's `true` on a project that is off has no effect, because the owner's
+ * switch is the one that lets an answer out onto the web. Indexing requests are
+ * not governed by this: an indexing pass keeps the tools it has today (see
+ * requests.ts notifyAgentSaveAttachment).
  */
 export const DEFAULT_WEB_ACCESS = false;
 
@@ -128,6 +131,35 @@ export function webAccessFrom(data: ProjectSettingsData | null | undefined): boo
 	return data ? normalizeWebAccess(data.web_access) : DEFAULT_WEB_ACCESS;
 }
 
+/**
+ * Whether an upload that is byte-for-byte the SAME FILE the signed-in user
+ * already has in this project (same name, same size, same uploader) is skipped:
+ * not uploaded again and not indexed again, with the chat turn using the stored
+ * copy. Same record, its own `skip_duplicate_files` key.
+ *
+ * ON BY DEFAULT: a second copy of a file costs a second indexing run, which is
+ * the single most expensive thing a project does, and answers from two copies
+ * of one document double every row. Only the literal `false` turns it off: this
+ * record is public and a client must never read a value it did not write.
+ *
+ * Resolution is the same ceiling rule as `web_access` (config.ts
+ * resolveSkipDuplicateFiles): effective = projectSetting && hostOption !== false.
+ * The host's `skipDuplicateFiles: false` lets its page re-upload duplicates on
+ * a project that skips them; a host's `true` on a project that turned it off has
+ * no effect.
+ */
+export const DEFAULT_SKIP_DUPLICATE_FILES = true;
+
+/** Narrow a stored value to the switch: only the literal `false` is off. */
+export function normalizeSkipDuplicateFiles(value: any): boolean {
+	return value !== false;
+}
+
+/** The switch held in a settings-record `data`, true when unset. */
+export function skipDuplicateFilesFrom(data: ProjectSettingsData | null | undefined): boolean {
+	return data ? normalizeSkipDuplicateFiles(data.skip_duplicate_files) : DEFAULT_SKIP_DUPLICATE_FILES;
+}
+
 /**
  * Longest custom opening line the dashboard will store.
  *
@@ -354,6 +386,15 @@ export function projectWebAccess(service: string): boolean {
 	return webAccessFrom(cachedProjectSettings(service));
 }
 
+/**
+ * Sync convenience: the project's skip-duplicates setting, true until the fetch
+ * settles or when the project never set it. The upload path prefers the
+ * awaiting form (config.ts resolveSkipDuplicateFiles).
+ */
+export function projectSkipDuplicateFiles(service: string): boolean {
+	return skipDuplicateFilesFrom(cachedProjectSettings(service));
+}
+
 /**
  * Adopt a value the caller just WROTE, so the settings page reflects its own
  * save without a re-fetch.

package/src/engine/prompts/index.ts

@@ -15,6 +15,7 @@ export {
 	buildIndexingRenderContinueTemplate,
 	buildIndexingWindowMessage,
 	RENDER_FROM_TOKEN,
+	PAGE_TEXT_TABLE,
 	type IndexingAttachmentInfo,
 	type BuildIndexingUserMessageOptions,
 } from './indexing_user_message';

package/src/engine/prompts/indexing_user_message.ts

@@ -231,6 +231,28 @@ function buildRenderMeta(attachment: IndexingAttachmentInfo): string {
 	);
 }
 
+/**
+ * Verbatim page text for SCANNED pages (reliability plan 3.1, owner's yes 2026-10-12).
+ *
+ * The worker writes a `__PAGES__` record per page. A page WITH a text layer is written
+ * server-side before the model call; a page WITHOUT one (a scan) can only come from the
+ * model, and the worker's `_fill_vision_pages` fills it from a posted record that names
+ * the page (`page`) and carries `page_text`. The signal the model has is the label the
+ * worker puts before each image: "Embedded text layer for this page" appears under the
+ * label exactly when the page has one (the layer ships the text with the first strip of
+ * a page), so "no such block" is "no text layer", and that is the whole rule. Fixed table
+ * name, as the system prompt demands for every content kind. Kept short: the owner pays
+ * output tokens for the transcription itself, not for the instruction.
+ */
+export const PAGE_TEXT_TABLE = 'page_texts';
+const PAGE_TEXT_RULE =
+	`PAGE TEXT for pages WITHOUT a text layer: for EVERY page whose label (its first label, when the page is split ` +
+	`into strips) carries NO "Embedded text layer" block, ALSO post exactly ONE record in table "${PAGE_TEXT_TABLE}" ` +
+	`with data {"page": <its document page number from the label, 1-based>, "page_text": "<the page's complete text ` +
+	`exactly as printed, verbatim, in reading order, nothing summarised or left out>"}, reference "src::" + the storage ` +
+	`path above, in addition to the records above. A page WITH an embedded text layer gets NO such record: its text ` +
+	`is already stored.\n\n`;
+
 // Shared datafy guidance. The placeholder is where the worker splices the note + rendered
 // page images; instructions reference "the page images in this message" so they read
 // correctly whether the images land before or after this text.
@@ -255,6 +277,7 @@ function buildRenderDatafy(placeholder: string): string {
 		`summarising. Where a page carries an embedded text layer it is quoted above that page's image: it is the ` +
 		`exact text and should be preferred over reading the pixels, with the image used for layout, tables, ` +
 		`stamps and handwriting.\n\n` +
+		PAGE_TEXT_RULE +
 		`Save records for THIS window of pages only, then stop and report what you saved. Do NOT try to read ` +
 		`the rest of the file and do NOT worry about the pages after this window: if any remain, the next window ` +
 		`is rendered and sent to you automatically. Report only the pages you were actually shown - never imply ` +

package/src/engine/requests.ts

@@ -56,8 +56,9 @@ const openaiWebSearchTool = () => ({
  * nothing when it is off. Off is the default (project_settings.ts
  * DEFAULT_WEB_ACCESS): the answer then comes from the project's files and
  * database alone, which is what the grounding rules promise. The switch is
- * resolved by the caller (resolveWebAccess: host option, then the project's
- * `web_access` setting, then false) so this stays a pure function of it.
+ * resolved by the caller (resolveWebAccess: the project's `web_access` setting
+ * is the ceiling, a host option may only restrict) so this stays a pure
+ * function of it.
  */
 const webToolsForChat = (platform: 'claude' | 'openai', webAccess: boolean | undefined): any[] => {
 	if (webAccess !== true) return [];
@@ -66,8 +67,11 @@ const webToolsForChat = (platform: 'claude' | 'openai', webAccess: boolean | und
 };
 export const MCP_NAME = 'BunnyQuery';
 
-export const DEFAULT_CLAUDE_MODEL = 'claude-sonnet-5';
-export const DEFAULT_OPENAI_MODEL = 'gpt-5.6-luna';
+// The model a project uses when it never picked one (the settings page shows the same
+// constants). Owner's choice 2026-10-12: Sonnet 5.5 on Claude, GPT-6.1 Sol on OpenAI (both
+// have rows in budget.ts: 1,000,000 / 1,050,000 context, 128,000 output).
+export const DEFAULT_CLAUDE_MODEL = 'claude-sonnet-5-5';
+export const DEFAULT_OPENAI_MODEL = 'gpt-6.1-sol';
 
 const mcpUrl = () => chatEngineConfig().mcpBaseUrl;
 
@@ -637,9 +641,11 @@ export type CallClaudeWithMcpParams = {
 	onResponse?: (res: any) => void;
 	onError?: (err: any) => void;
 	/**
-	 * Attach Claude's `web_fetch` to this turn. Omitted means "ask the engine":
-	 * the host's `webAccess` config option, then the project's `web_access`
-	 * setting, then off. See config.ts resolveWebAccess.
+	 * Attach Claude's `web_fetch` to this turn. A per-call host value under the
+	 * same ceiling rule as the config option: the project's `web_access` setting
+	 * is the most a turn can have, and `false` here (or in the config) takes it
+	 * off. Omitted follows the config option and the project. See config.ts
+	 * resolveWebAccess.
 	 */
 	webAccess?: boolean;
 };
@@ -695,9 +701,9 @@ export async function callClaudeWithMcp({
 	webAccess,
 }: CallClaudeWithMcpParams) {
 	// Resolved HERE and not only in callClaudeWithPublicMcp, so a host calling this
-	// builder directly gets the same switch: an explicit boolean wins, otherwise
-	// the project's setting, otherwise off.
-	const web = typeof webAccess === 'boolean' ? webAccess : await resolveWebAccess(service);
+	// builder directly gets the same switch: the project's setting is the ceiling,
+	// and an explicit `false` (here or in the config) restricts below it.
+	const web = await resolveWebAccess(service, typeof webAccess === 'boolean' ? webAccess : undefined);
 	const mcpServerDefinition: Record<string, any> = {
 		type: 'url',
 		name: mcpServer.name,

package/src/engine/session.ts

@@ -42,7 +42,7 @@ import {
 	type BgTaskEntry,
 } from './requests';
 import { isPagedReadFile, isImageVisionFile, isWindowedReadFile } from './office';
-import { windowedIndexingEnabled, liveStreamingEnabled, streamRecoveryEnabled, chatEngineConfig, resolveForwardRequestFinalize, resolveForwardRequestStream } from './config';
+import { windowedIndexingEnabled, liveStreamingEnabled, streamRecoveryEnabled, chatEngineConfig, resolveForwardRequestFinalize, resolveForwardRequestStream, resolveSkipDuplicateFiles } from './config';
 // The wire-format knowledge. skapi relays the provider's bytes without reading them,
 // so the session hands them straight to this parser and never inspects a frame itself.
 import { createSseParser, type SseParser } from './sse';
@@ -5955,11 +5955,35 @@ export class ChatSession {
 		if (!total) return Promise.reject(new Error('Empty attachment'));
 		var urls: Array<{ name: string; url: string; storagePath: string }> = [];
 		var anyIndexFailed = false;
+		// Members answered by a file the user already has here (see findDuplicate
+		// below). Counted so a folder chip can say how many it reused.
+		var reusedCount = 0;
+		att.reused = false;
 		var chain: Promise<any> = Promise.resolve();
+		// "Already uploaded by this user, same name and size" -> the stored copy's
+		// storage path, else null. Asked only while the skip-duplicates switch
+		// resolves ON (the project's setting is the ceiling, the host may only
+		// restrict), and only of a host that wired the hook. Every failure is null,
+		// so this can save an upload and an indexing run but never block one.
+		var findDuplicate = function (member: any): Promise<string | null> {
+			if (typeof self.host.findDuplicateUpload !== 'function') return Promise.resolve(null);
+			var storedName = String(member.storagePath || '').split('/').filter(Boolean).pop() || member.file.name;
+			return resolveSkipDuplicateFiles(id.projectId).then(function (on) {
+				if (!on) return null;
+				return Promise.resolve(self.host.findDuplicateUpload!({ name: storedName, size: member.file.size }))
+					.then(function (hit: any) {
+						return hit && typeof hit.storagePath === 'string' && hit.storagePath ? hit.storagePath : null;
+					});
+			}).catch(function () { return null; });
+		};
 		members.forEach(function (member: any, idx: number) {
 			chain = chain.then(function () {
 				var hadExists = false;
 				var skipped = false;
+				// The storage path of the file this member DUPLICATES, when the user
+				// already has it here: nothing is uploaded or indexed for it, and the
+				// turn takes the stored copy's url instead.
+				var duplicateOf: string | null = null;
 				// True when the file already existed and we are re-indexing over it
 				// (user chose Reindex, OR Overwrite replaced the bytes). Drives the
 				// delete-then-repost of the stale "src::" record below. Kept separate
@@ -5978,7 +6002,14 @@ export class ChatSession {
 						onProgress: onProg, setAbort: function (abort) { att._abort = abort; },
 					});
 				};
-				return doMemberUpload(true).catch(function (err: any) {
+				return findDuplicate(member).then(function (dup) {
+					if (dup) {
+						duplicateOf = dup;
+						console.log('[chat-engine] skipping an upload the user already has:', member.storagePath, '->', dup);
+						return;
+					}
+					return doMemberUpload(true);
+				}).catch(function (err: any) {
 					var code = err && (err.code || (err.body && err.body.code));
 					var msg = err && (err.message || (err.body && err.body.message) || (typeof err === 'string' ? err : ''));
 					var isExists = code === 'EXISTS' || (msg && /exist/i.test(msg));
@@ -5999,9 +6030,20 @@ export class ChatSession {
 					});
 				}).then(function () {
 					if (skipped) return; // user skipped this member — no url, no index request
-					return self.host.getTemporaryUrl(member.storagePath);
+					// A duplicate takes the STORED copy's url: the same reuse an EXISTS
+					// answer gets when the user keeps the file, minus the prompt and
+					// minus the re-index.
+					return self.host.getTemporaryUrl(duplicateOf || member.storagePath);
 				}).then(function (url: string) {
 					if (skipped) return; // guard the indexing branch for a skipped member
+					if (duplicateOf) {
+						urls.push({ name: member.relPath, url: url, storagePath: duplicateOf });
+						reusedCount += 1;
+						if (att.kind !== 'folder') { att.uploadedUrl = url; att.storagePath = duplicateOf; att.reused = true; }
+						else att.reusedCount = reusedCount;
+						self.host.renderAttachmentChips();
+						return; // not indexed: the stored copy already is
+					}
 					urls.push({ name: member.relPath, url: url, storagePath: member.storagePath });
 					if (att.kind !== 'folder') { att.uploadedUrl = url; att.storagePath = member.storagePath; }
 					var mime = member.file.type || self.host.getMimeType(member.file.name);