chainlesschain 0.166.100 → 0.166.102

package/src/runtime/agent-core.js

@@ -61,7 +61,11 @@ import {
 } from "../lib/task-progress-tracker.js";
 import { TOOL_RECOVERY_PAUSED_CODE } from "../lib/tool-recovery-result.js";
 import { haiku55ThinkingParams } from "../lib/provider-options.js";
-import { projectUsagePricingContext } from "../lib/usage-pricing-context.js";
+import {
+  projectUsagePricingContext,
+  projectEnvelopePricingContext,
+  preserveRequestedServiceTierEvidence,
+} from "../lib/usage-pricing-context.js";
 import broker from "../lib/process-execution-broker/index.js";
 import os from "os";
 import { createHash, randomUUID } from "node:crypto";
@@ -88,6 +92,7 @@ import sharedHookEvents from "../lib/settings-hook-events.js";
 import {
   resolveAgentOutputBudget,
   resolveModelCapabilityProfile,
+  resolveModelServiceTier,
 } from "../lib/model-capabilities.js";
 import {
   createOpenAIResponsesBody,
@@ -198,6 +203,7 @@ import {
   settleManagedToolCheckpoint,
 } from "../lib/managed-tool-checkpoint.js";
 import { sessionBudgetAdmissionError } from "../lib/session-budget-production-root.js";
+import { projectRuntimeTokenUsage } from "../lib/runtime-usage-ledger.js";
 import {
   createMcpCallLedger,
   McpEffect,
@@ -1538,18 +1544,19 @@ function filesystemIdentity(stats) {
 function sameFilesystemObjectIdentity(left, right) {
   return Boolean(
     left &&
-    right &&
-    left.dev === right.dev &&
-    left.ino === right.ino &&
-    left.type === right.type,
+      right &&
+      left.dev === right.dev &&
+      left.ino === right.ino &&
+      left.type === right.type,
   );
 }
 
 function sameFilesystemIdentity(left, right, { content = false } = {}) {
   return Boolean(
     sameFilesystemObjectIdentity(left, right) &&
-    left.nlink === right.nlink &&
-    (!content || (left.size === right.size && left.mtimeNs === right.mtimeNs)),
+      left.nlink === right.nlink &&
+      (!content ||
+        (left.size === right.size && left.mtimeNs === right.mtimeNs)),
   );
 }
 
@@ -3440,8 +3447,9 @@ export async function executeTool(name, args, context = {}) {
     GUARDED_FILE_MUTATION_TOOLS.has(name) &&
     settingsVerdict.decision !== "allow"
   ) {
-    const { sensitiveFileReason, autoExecConfigReason } =
-      await import("../lib/sensitive-file-guard.js");
+    const { sensitiveFileReason, autoExecConfigReason } = await import(
+      "../lib/sensitive-file-guard.js"
+    );
     const guarded = fileMutationPaths(name, args)
       .map((candidatePath) => ({
         path: candidatePath,
@@ -3476,8 +3484,9 @@ export async function executeTool(name, args, context = {}) {
     GUARDED_FILE_MUTATION_TOOLS.has(name) &&
     settingsVerdict.decision !== "allow"
   ) {
-    const { sessionStorePathReason } =
-      await import("../lib/session-store-guard.js");
+    const { sessionStorePathReason } = await import(
+      "../lib/session-store-guard.js"
+    );
     const guarded = fileMutationPaths(name, args)
       .map((candidatePath) => ({
         path: candidatePath,
@@ -4222,8 +4231,9 @@ export async function executeTool(name, args, context = {}) {
     context.externalToolExecutors
   ) {
     try {
-      const { collectIdeDiagnostics, formatIdeDiagnostics } =
-        await import("../lib/ide-context.js");
+      const { collectIdeDiagnostics, formatIdeDiagnostics } = await import(
+        "../lib/ide-context.js"
+      );
       const diags = await collectIdeDiagnostics(
         {
           mcpClient: context.mcpHostClient || context.mcpClient,
@@ -4765,8 +4775,9 @@ export async function _getSharedCodeIntel(cwd) {
   const root = path.resolve(cwd || process.cwd());
   let entry = _codeIntelPool.get(root);
   if (!entry) {
-    const { CodeIntelligence } =
-      await import("../lib/lsp/code-intelligence.js");
+    const { CodeIntelligence } = await import(
+      "../lib/lsp/code-intelligence.js"
+    );
     // Re-check AFTER the await: two concurrent callers (the parallel read-only
     // batch runs several `code_intelligence` calls at once) both observed an
     // empty pool before this `await import`, so without this guard both would
@@ -4855,8 +4866,9 @@ async function _postEditDiagnostics(filePath, cwd, additionalDirectories) {
   }
   let hasServer = false;
   try {
-    const { languageIdForFile, resolveServer } =
-      await import("../lib/lsp/lsp-server-registry.js");
+    const { languageIdForFile, resolveServer } = await import(
+      "../lib/lsp/lsp-server-registry.js"
+    );
     const languageId = languageIdForFile(filePath);
     if (!languageId) return null; // unsupported file type — no LSP, no cost
     hasServer = Boolean(resolveServer(languageId, root));
@@ -4879,8 +4891,9 @@ async function _postEditDiagnostics(filePath, cwd, additionalDirectories) {
       // the model sees the most severe diagnostics first and can't be flooded by
       // a pathological diagnostics dump. Budget is overridable via
       // CC_EDIT_DIAGNOSTICS_TOKENS (default 2000).
-      const { capDiagnostics } =
-        await import("../lib/lsp/diagnostics-scheduler.js");
+      const { capDiagnostics } = await import(
+        "../lib/lsp/diagnostics-scheduler.js"
+      );
       const budget = Number(process.env.CC_EDIT_DIAGNOSTICS_TOKENS) || 2000;
       const { kept } = capDiagnostics(diags, { maxTokens: budget });
       return kept.length ? kept : null;
@@ -4944,12 +4957,14 @@ async function _getSubtreeLoader(cwd, sessionScope = "__legacy__") {
   }
   let loader = scopedLoaders.get(sessionScope);
   if (!loader) {
-    const { SubtreeInstructionLoader } =
-      await import("../lib/project-instructions.js");
+    const { SubtreeInstructionLoader } = await import(
+      "../lib/project-instructions.js"
+    );
     let instructionExcludes;
     try {
-      const { readStringArraySetting } =
-        await import("../lib/settings-loader.cjs");
+      const { readStringArraySetting } = await import(
+        "../lib/settings-loader.cjs"
+      );
       instructionExcludes = readStringArraySetting("instructionExcludes", {
         cwd: root,
       });
@@ -4994,8 +5009,9 @@ async function _prepareSubtreeInstructions(
     }
     const fresh = [...discovered.values()];
     if (!fresh || !fresh.length) return null;
-    const { DEFAULT_MAX_FILE_BYTES } =
-      await import("../lib/project-instructions.js");
+    const { DEFAULT_MAX_FILE_BYTES } = await import(
+      "../lib/project-instructions.js"
+    );
     const out = [];
     const errors = [];
     for (const f of fresh) {
@@ -5102,8 +5118,9 @@ async function _withSubtreeInstructions(
 async function filterSkillsByCwd(skills, cwd) {
   try {
     if (!Array.isArray(skills) || skills.every((s) => !s?.paths)) return skills;
-    const { filterSkillsByRelCwd, relCwdForCwd } =
-      await import("../lib/skill-path-scope.js");
+    const { filterSkillsByRelCwd, relCwdForCwd } = await import(
+      "../lib/skill-path-scope.js"
+    );
     const { findProjectRoot } = await import("../lib/project-detector.js");
     const root = (cwd && findProjectRoot(cwd)) || cwd || "";
     return filterSkillsByRelCwd(skills, relCwdForCwd(cwd, root));
@@ -5118,8 +5135,9 @@ async function promoteBrowserGeneratedArtifact(
 ) {
   if (!filePath) return { artifact: null, error: null };
   try {
-    const { ArtifactStore, publicArtifactMetadata } =
-      await import("../lib/artifact-store.js");
+    const { ArtifactStore, publicArtifactMetadata } = await import(
+      "../lib/artifact-store.js"
+    );
     const entry = new ArtifactStore().publish({
       filePath,
       title,
@@ -5172,8 +5190,9 @@ async function promoteBrowserDownload(
 async function publishBrowserEvidence(envelope, sessionId) {
   if (!envelope?.envelopeDigest) return { artifact: null, error: null };
   try {
-    const { ArtifactStore, publicArtifactMetadata } =
-      await import("../lib/artifact-store.js");
+    const { ArtifactStore, publicArtifactMetadata } = await import(
+      "../lib/artifact-store.js"
+    );
     const {
       browserEvidenceDigest,
       canonicalBrowserEvidenceJson,
@@ -5236,8 +5255,9 @@ async function publishBrowserEvidence(envelope, sessionId) {
 }
 
 async function resolveBrowserUploadArtifact(artifactId, sessionId) {
-  const { ArtifactStore, publicArtifactMetadata } =
-    await import("../lib/artifact-store.js");
+  const { ArtifactStore, publicArtifactMetadata } = await import(
+    "../lib/artifact-store.js"
+  );
   const store = new ArtifactStore();
   return store.withIndexSnapshot((entries) => {
     const matches = entries.filter((entry) => entry.id === artifactId);
@@ -6218,8 +6238,9 @@ async function executeToolInner(
       // through PowerShell via explicit argv (`powershell.exe -NoProfile
       // [-ExecutionPolicy <p>] -Command <cmd>`). The unconfigured path keeps
       // the historical default shell byte-identical (useDefaultShell=true).
-      const { resolveShellInvocation } =
-        await import("../lib/shell-selector.cjs");
+      const { resolveShellInvocation } = await import(
+        "../lib/shell-selector.cjs"
+      );
       let shellInv = resolveShellInvocation({
         command: args.command,
         requested: args.shell,
@@ -6992,8 +7013,9 @@ async function executeToolInner(
         let removeSettingsAuthorityListener = null;
         if (needsEgress) {
           try {
-            const { startEgressProxyWorker } =
-              await import("../lib/sandbox-egress-worker.js");
+            const { startEgressProxyWorker } = await import(
+              "../lib/sandbox-egress-worker.js"
+            );
             if (dockerEgress) {
               privateSocketDir = fs.mkdtempSync(
                 path.join(os.tmpdir(), "cc-egress-"),
@@ -7034,8 +7056,9 @@ async function executeToolInner(
           // Proxy startup and dynamic imports are asynchronous. Re-read the
           // live authority after they settle and before sandbox dispatch.
           if (dockerEgress && proxyHandle?.socketPath) {
-            const { createDockerEgressAuthorityMonitor } =
-              await import("../lib/sandbox-egress-authority-monitor.js");
+            const { createDockerEgressAuthorityMonitor } = await import(
+              "../lib/sandbox-egress-authority-monitor.js"
+            );
             authorityMonitor = createDockerEgressAuthorityMonitor({
               sessionId: sessionId || null,
               policyVersion:
@@ -7655,8 +7678,9 @@ async function executeToolInner(
         !ruleAllowed &&
         typeof approvalGate.decide === "function"
       ) {
-        const { APPROVAL_RISK, APPROVAL_DECISION } =
-          await import("@chainlesschain/session-core");
+        const { APPROVAL_RISK, APPROVAL_DECISION } = await import(
+          "@chainlesschain/session-core"
+        );
         const gate = await approvalGate.decide({
           sessionId,
           riskLevel: APPROVAL_RISK.HIGH,
@@ -7867,8 +7891,9 @@ async function executeToolInner(
 
     case "slash_command": {
       try {
-        const { getCommand, expandCommand, discoverCommands } =
-          await import("../lib/slash-commands.js");
+        const { getCommand, expandCommand, discoverCommands } = await import(
+          "../lib/slash-commands.js"
+        );
         const raw = String(args.command || "").trim();
         if (!raw) {
           return attachDescriptor({
@@ -8079,8 +8104,9 @@ async function executeToolInner(
 
     case "notify": {
       try {
-        const { sendAgentNotification } =
-          await import("../lib/agent-notify.js");
+        const { sendAgentNotification } = await import(
+          "../lib/agent-notify.js"
+        );
         const outcome = await sendAgentNotification({
           title: args.title,
           body: args.body,
@@ -8094,8 +8120,9 @@ async function executeToolInner(
 
     case "schedule": {
       try {
-        const { AgentScheduleStore } =
-          await import("../lib/agent-schedule-store.js");
+        const { AgentScheduleStore } = await import(
+          "../lib/agent-schedule-store.js"
+        );
         const { parseDuration } = await import("../lib/loop.js");
         const store = new AgentScheduleStore();
         const action = String(args.action || "").toLowerCase();
@@ -8218,8 +8245,9 @@ async function executeToolInner(
       // Only METADATA returns to the conversation (the transcript never
       // carries the file body); `cc artifacts` lists/inspects/cleans.
       try {
-        const { ArtifactStore, publicArtifactMetadata } =
-          await import("../lib/artifact-store.js");
+        const { ArtifactStore, publicArtifactMetadata } = await import(
+          "../lib/artifact-store.js"
+        );
         const store = new ArtifactStore();
         const entry = store.publish({
           filePath: path.resolve(cwd, String(args.path || "")),
@@ -8309,8 +8337,9 @@ async function executeToolInner(
           !ruleAllowed &&
           typeof approvalGate.decide === "function"
         ) {
-          const { APPROVAL_RISK, APPROVAL_DECISION } =
-            await import("@chainlesschain/session-core");
+          const { APPROVAL_RISK, APPROVAL_DECISION } = await import(
+            "@chainlesschain/session-core"
+          );
           const summary = Array.isArray(args.actions)
             ? args.actions
                 .map((a) => a?.type)
@@ -8435,8 +8464,9 @@ async function executeToolInner(
     case "search_files": {
       if (typeof args.path === "string" && args.path.length > 0) {
         const file = path.resolve(cwd, args.path);
-        const { credentialFileReason } =
-          await import("../lib/credential-guard.js");
+        const { credentialFileReason } = await import(
+          "../lib/credential-guard.js"
+        );
         const reason =
           credentialFileReason(file) ||
           (fs.existsSync(file)
@@ -9181,6 +9211,22 @@ async function executeToolInner(
     }
 
     case "list_skills": {
+      const limit = args.limit ?? 20;
+      const offset = args.offset ?? 0;
+      if (
+        !Number.isSafeInteger(limit) ||
+        limit < 1 ||
+        limit > 64 ||
+        !Number.isSafeInteger(offset) ||
+        offset < 0 ||
+        offset > 10_000
+      ) {
+        return attachDescriptor({
+          error:
+            "Skill directory limit must be 1–64 and offset must be 0–10000.",
+          code: "CC_SKILL_DIRECTORY_PAGE_INVALID",
+        });
+      }
       let skills = await filterSkillsByCwd(
         skillLoader.getResolvedSkills().filter(skillAllowed),
         cwd,
@@ -9270,6 +9316,19 @@ async function executeToolInner(
           }
         }
       }
+      if (!routing) {
+        const key = (skill) =>
+          `${skill.id}\u0000${skill.source || ""}\u0000${skill.executionIdentity?.contentDigest || ""}`;
+        skills = [...skills].sort((left, right) =>
+          key(left) < key(right) ? -1 : key(left) > key(right) ? 1 : 0,
+        );
+      }
+      const totalCount = routing?.matchedCount ?? skills.length;
+      const candidateCount = skills.length;
+      skills = skills.slice(offset, offset + limit);
+      const nextOffset =
+        offset + skills.length < candidateCount ? offset + skills.length : null;
+      const hasMore = offset + skills.length < totalCount;
       skillLoader.recordDescriptorUse?.(skills, {
         sessionId,
         turnId,
@@ -9277,6 +9336,19 @@ async function executeToolInner(
       });
       return attachDescriptor({
         count: skills.length,
+        totalCount,
+        offset,
+        limit,
+        hasMore,
+        nextOffset,
+        ...(hasMore
+          ? {
+              hint:
+                nextOffset == null
+                  ? "Refine query or category to search beyond the top 64 matches."
+                  : "Use nextOffset for the next page, or query/category to narrow the directory.",
+            }
+          : {}),
         ...(routing
           ? {
               routing: {
@@ -10700,8 +10772,9 @@ async function _executeSpawnSubAgent(args, ctx) {
   // the breadth counter increments so spawnedCount is this-spawn-exclusive.
   if (ctx.subAgentContract) {
     try {
-      const { enforceRecursionLimits } =
-        await import("../lib/subagent-contract.js");
+      const { enforceRecursionLimits } = await import(
+        "../lib/subagent-contract.js"
+      );
       const recur = enforceRecursionLimits({
         depth: currentDepth,
         spawnedCount: ctx.subAgentBudget?.spawned || 0,
@@ -10887,8 +10960,9 @@ async function _executeSpawnSubAgent(args, ctx) {
   let inheritedMcp = null;
   let inheritedHooks = null;
   try {
-    const { filterInheritedMcp, filterInheritedHooks } =
-      await import("../lib/subagent-inheritance.js");
+    const { filterInheritedMcp, filterInheritedHooks } = await import(
+      "../lib/subagent-inheritance.js"
+    );
     inheritedMcp = filterInheritedMcp(
       {
         extraToolDefinitions: ctx.extraToolDefinitions,
@@ -10921,8 +10995,9 @@ async function _executeSpawnSubAgent(args, ctx) {
   // repo, refuse the spawn instead of silently running in the parent checkout.
   if (subIsolation === "worktree") {
     try {
-      const { resolveIsolationFailClosed } =
-        await import("../lib/subagent-contract.js");
+      const { resolveIsolationFailClosed } = await import(
+        "../lib/subagent-contract.js"
+      );
       const { isGitRepo } = await import("../lib/git-integration.js");
       const iso = resolveIsolationFailClosed({
         requested: "worktree",
@@ -10941,8 +11016,9 @@ async function _executeSpawnSubAgent(args, ctx) {
   let profile = null;
   if (profileName) {
     try {
-      const { getSubAgentProfile } =
-        await import("../lib/sub-agent-profiles.js");
+      const { getSubAgentProfile } = await import(
+        "../lib/sub-agent-profiles.js"
+      );
       profile = getSubAgentProfile(profileName);
       if (!profile) {
         return {
@@ -11010,8 +11086,9 @@ async function _executeSpawnSubAgent(args, ctx) {
   let childApprovalGate = null;
   if (effectiveContract?.permissionMode) {
     try {
-      const { resolvePermissionMode, resolveEnabledTools } =
-        await import("./headless-runner.js");
+      const { resolvePermissionMode, resolveEnabledTools } = await import(
+        "./headless-runner.js"
+      );
       const perm = resolvePermissionMode(effectiveContract.permissionMode);
       if (perm.readOnly) {
         allowedTools = resolveEnabledTools({ allowedTools, readOnly: true });
@@ -11271,8 +11348,9 @@ async function _executeSpawnSubAgent(args, ctx) {
   let subWorktreeOptions = null;
   if (subIsolation === "worktree") {
     try {
-      const { normalizeSparsePaths } =
-        await import("../lib/worktree-sparse.js");
+      const { normalizeSparsePaths } = await import(
+        "../lib/worktree-sparse.js"
+      );
       const sparse = normalizeSparsePaths(
         args.sparsePaths ?? mdSparsePaths ?? null,
       );
@@ -11474,10 +11552,11 @@ async function _executeSpawnSubAgent(args, ctx) {
 
   // Resolve the registry ONCE before the try so the failure path can also move
   // the sub-agent out of `_active` (the success path does this via complete()).
-  const { SubAgentRegistry } =
-    await import("../lib/sub-agent-registry.js").catch(() => ({
-      SubAgentRegistry: null,
-    }));
+  const { SubAgentRegistry } = await import(
+    "../lib/sub-agent-registry.js"
+  ).catch(() => ({
+    SubAgentRegistry: null,
+  }));
   let registry = null;
   if (SubAgentRegistry) {
     try {
@@ -11797,6 +11876,12 @@ function _openAIProviderRequestReceipt(response, data, clientRequestId) {
  * @returns {Promise<object>} response with .message
  */
 export async function chatWithTools(rawMessages, options) {
+  if (options.serviceTier != null) {
+    resolveModelServiceTier(
+      resolveModelCapabilityProfile(options),
+      options.serviceTier,
+    );
+  }
   const evolutionIngress =
     options.evolutionIngress == null
       ? null
@@ -11826,8 +11911,9 @@ export async function chatWithTools(rawMessages, options) {
     options.contextMemoryPreplanned !== true &&
     options.contextMemorySkipPlanning !== true
   ) {
-    const { prepareCanonicalProviderContext } =
-      await import("../lib/context-memory-kernel/provider-context.js");
+    const { prepareCanonicalProviderContext } = await import(
+      "../lib/context-memory-kernel/provider-context.js"
+    );
     const prepared = await prepareCanonicalProviderContext(rawMessages, {
       ...options,
       contextMemoryToolDefinitions: tools,
@@ -11860,6 +11946,11 @@ export async function chatWithTools(rawMessages, options) {
 
   throwIfAborted(signal);
 
+  // Host accounting starts only after request admission. A rejected model
+  // projection never reaches the provider; failures after this boundary must
+  // still retain conservative usage accounting regardless of error metadata.
+  await options.onProviderCallStart?.();
+
   if (provider === "ollama") {
     const apiUrl = `${baseUrl}/api/chat`;
     // Multimodal (`cc agent --image`): ollama wants `{content, images:[base64]}`
@@ -12184,6 +12275,7 @@ export async function chatWithTools(rawMessages, options) {
       reasoning: _openAIResponsesReasoningParams(options, modelProfile),
       stream: typeof options.onToken === "function",
       modelProfile,
+      serviceTier: options.serviceTier,
     });
     if (typeof options.onToken === "function") {
       return await _retryStreamingChat(
@@ -12237,6 +12329,11 @@ export async function chatWithTools(rawMessages, options) {
     }
     const data = await response.json();
     const out = normalizeOpenAIResponsesResponse(data);
+    if (out.usage)
+      out.usage = preserveRequestedServiceTierEvidence(
+        out.usage,
+        options.serviceTier,
+      );
     delete out.responseId;
     const providerReceipt = supportsOpenAIRequestIdentity
       ? _openAIProviderRequestReceipt(response, data, providerRequestId)
@@ -12373,6 +12470,7 @@ export async function chatWithTools(rawMessages, options) {
         input_tokens: promptTokens - cached,
         output_tokens: completionTokens,
         cache_read_input_tokens: cached,
+        ...projectEnvelopePricingContext(data.usage, data),
       };
     }
   }
@@ -13061,6 +13159,11 @@ async function _chatOpenAIResponsesStreaming(
     return out;
   }
   const out = finalizeOpenAIResponsesStream(state);
+  if (out.usage)
+    out.usage = preserveRequestedServiceTierEvidence(
+      out.usage,
+      body.service_tier,
+    );
   const responseId = out.responseId || state.responseId;
   delete out.responseId;
   const providerReceipt = _openAIProviderRequestReceipt(
@@ -13471,6 +13574,19 @@ function _workflowNestedToolOutcomeUnknown(binding, toolName, result) {
   return error;
 }
 
+function _takeCompactionProviderReceipt(call, workflowEffectId) {
+  if (!call?.providerReceipt || call.providerReceiptEmitted) return null;
+  call.providerReceiptEmitted = true;
+  return {
+    type: "provider-request-receipt",
+    callId: call.callId,
+    workflowEffectId,
+    callSequence: call.callSequence,
+    source: "semantic-compaction",
+    ...call.providerReceipt,
+  };
+}
+
 function _workflowCompactionOutcomeUnknown(
   cause,
   code = "CC_WORKFLOW_COMPACTION_PROVIDER_OUTCOME_UNKNOWN",
@@ -13870,6 +13986,21 @@ function _instrumentAutoCompactorUsage(compactor, options) {
         this,
         requestBinding ? [...args, requestBinding] : args,
       );
+      // Keep validated provider-returned usage private to this actual call.
+      // It is not settled yet: the host consumes token-usage exactly once.
+      try {
+        call.returnedUsage = projectRuntimeTokenUsage({
+          callId: call.callId,
+          provider: result?.provider || call.provider,
+          model: result?.model || call.model,
+          source: call.source,
+          usage: result?.usage,
+        });
+        if (result?.callId && result.callId !== call.callId)
+          call.returnedUsage = null;
+      } catch {
+        call.returnedUsage = null;
+      }
       call.providerReceipt = providerRequestId
         ? _snapshotProviderRequestReceipt(
             result?.providerReceipt,
@@ -13879,6 +14010,7 @@ function _instrumentAutoCompactorUsage(compactor, options) {
         : null;
       return result;
     } catch (error) {
+      call.returnedUsage = null;
       if (workflowEffectId) {
         throw _workflowCompactionOutcomeUnknown(error);
       }
@@ -13953,8 +14085,9 @@ async function _getAutoCompactor(options) {
   let canonicalRequired = false;
   try {
     const { feature } = await import("../lib/feature-flags.js");
-    const { resolveCliContextMemoryCutover } =
-      await import("../lib/context-memory-kernel/authority.js");
+    const { resolveCliContextMemoryCutover } = await import(
+      "../lib/context-memory-kernel/authority.js"
+    );
     const cutover = resolveCliContextMemoryCutover({
       env: options.contextMemoryEnv || process.env,
       scopeKey: options.sessionId
@@ -13963,8 +14096,9 @@ async function _getAutoCompactor(options) {
     });
     canonicalRequired = cutover.canonical;
     if (feature("PROMPT_COMPRESSOR") || cutover.canonical) {
-      const { PromptCompressor } =
-        await import("../harness/prompt-compressor.js");
+      const { PromptCompressor } = await import(
+        "../harness/prompt-compressor.js"
+      );
       const llmQuery =
         typeof options.compactionLlmQuery === "function"
           ? options.compactionLlmQuery
@@ -14014,8 +14148,9 @@ async function _getAutoCompactor(options) {
       compressor = _instrumentAutoCompactorUsage(compressor, options);
       if (cutover.canonical) {
         const compatibilitySummarizer = compressor;
-        const { compactLiveMessagesCanonical } =
-          await import("../lib/context-memory-kernel/live-compaction.js");
+        const { compactLiveMessagesCanonical } = await import(
+          "../lib/context-memory-kernel/live-compaction.js"
+        );
         compressor = {
           canonicalKernel: true,
           shouldAutoCompact: (messages) =>
@@ -14026,8 +14161,8 @@ async function _getAutoCompactor(options) {
               compressOptions,
               sessionId: options.sessionId,
               operationId: `auto-${randomUUID()}`,
-              provider: options.provider,
-              model: options.model,
+              provider: options.provider || "ollama",
+              model: options.model || "unknown",
               env: options.contextMemoryEnv || process.env,
               persist: options.persistCompaction !== false,
               trigger: "auto",
@@ -14337,6 +14472,12 @@ function permissionDecision(callId, tool, result) {
 }
 
 export async function* agentLoop(messages, options) {
+  if (options.serviceTier != null) {
+    resolveModelServiceTier(
+      resolveModelCapabilityProfile(options),
+      options.serviceTier,
+    );
+  }
   const executionPolicy = captureAgentExecutionPolicy(options, {
     hermetic: true,
   });
@@ -14351,8 +14492,9 @@ export async function* agentLoop(messages, options) {
       : captureAgentEvolutionIngress(options.evolutionIngress);
   let llmCall = configuredChatFn || chatWithTools;
   if (evolutionIngress !== null && configuredChatFn) {
-    const { captureCanonicalFallbackChatFn } =
-      await import("./fallback-model.js");
+    const { captureCanonicalFallbackChatFn } = await import(
+      "./fallback-model.js"
+    );
     llmCall = captureCanonicalFallbackChatFn(
       configuredChatFn,
       evolutionIngress,
@@ -14361,8 +14503,9 @@ export async function* agentLoop(messages, options) {
   // Shared iteration budget — replaces hardcoded MAX_ITERATIONS.
   // When options.iterationBudget is provided (e.g. from parent agent),
   // the same budget instance is shared, so parent+child consume from one pool.
-  const { IterationBudget, WarningLevel } =
-    await import("../lib/iteration-budget.js");
+  const { IterationBudget, WarningLevel } = await import(
+    "../lib/iteration-budget.js"
+  );
   const budget = options.iterationBudget || new IterationBudget();
   const { HostResourceBudget } = await import("../lib/host-resource-budget.js");
   const hostResourceBudget =
@@ -14712,8 +14855,9 @@ export async function* agentLoop(messages, options) {
     options.strictUsageTelemetry !== true &&
     workflowEffectId == null
   ) {
-    const { makeRunnableProviderFallback } =
-      await import("../lib/runnable-provider.js");
+    const { makeRunnableProviderFallback } = await import(
+      "../lib/runnable-provider.js"
+    );
     llmCall = makeRunnableProviderFallback(llmCall, {
       onFallback: ({ from, to, reason, fromModel, toModel }) => {
         // Telemetry: a provider/model fallback is a reliability signal — count
@@ -15062,6 +15206,37 @@ export async function* agentLoop(messages, options) {
             !["committed", "degraded"].includes(stats.canonicalReceipt.status)
           ) {
             automaticCompactionSettlementBlocked = true;
+            const unsettledCall = compactionUsageState.calls.at(-1);
+            if (unsettledCall) {
+              const providerReceipt = _takeCompactionProviderReceipt(
+                unsettledCall,
+                workflowEffectId,
+              );
+              if (providerReceipt) yield providerReceipt;
+              if (
+                unsettledCall.returnedUsage &&
+                stats.summaryUsageUnknown !== true
+              ) {
+                yield {
+                  type: "token-usage",
+                  ...unsettledCall.returnedUsage,
+                  runId,
+                };
+              } else {
+                yield {
+                  type: "compaction-usage-unknown",
+                  callId: unsettledCall.callId,
+                  runId,
+                  provider: unsettledCall.provider,
+                  model: unsettledCall.model,
+                  source: "semantic-compaction",
+                  code: "provider_usage_unsettled",
+                  reason:
+                    stats.summaryUsageUnknownReason ||
+                    "provider_transport_outcome_unknown",
+                };
+              }
+            }
             yield {
               type: "compaction-degraded",
               runId,
@@ -15080,6 +15255,20 @@ export async function* agentLoop(messages, options) {
               backgroundSubAgents,
               backgroundUsageFailureState,
             );
+            if (workflowEffectId) {
+              throw _markWorkflowCompactionFailureReported(
+                _workflowCompactionOutcomeUnknown(
+                  null,
+                  "CC_WORKFLOW_COMPACTION_SETTLEMENT_UNKNOWN",
+                  "Workflow-bound semantic compaction requires reconciliation",
+                ),
+              );
+            }
+            yield {
+              type: "run-ended",
+              runId,
+              reason: "compaction-settlement-failed",
+            };
             return;
           }
           const observerFailure = compactionUsageState.calls.find(
@@ -15092,16 +15281,11 @@ export async function* agentLoop(messages, options) {
           }
           compactionUsageCall = compactionUsageState.calls.at(-1) || null;
           const compactionUsage = _compactionTokenUsage(stats);
-          if (compactionUsageCall?.providerReceipt) {
-            yield {
-              type: "provider-request-receipt",
-              callId: compactionUsageCall.callId,
-              workflowEffectId,
-              callSequence: compactionUsageCall.callSequence,
-              source: "semantic-compaction",
-              ...compactionUsageCall.providerReceipt,
-            };
-          }
+          const providerReceipt = _takeCompactionProviderReceipt(
+            compactionUsageCall,
+            workflowEffectId,
+          );
+          if (providerReceipt) yield providerReceipt;
           if (stats.degraded === true) {
             const usageOutcomeUnknown = stats.summaryUsageUnknown === true;
             const projectedStats = usageOutcomeUnknown
@@ -15177,6 +15361,11 @@ export async function* agentLoop(messages, options) {
                 ),
               );
             }
+            yield {
+              type: "run-ended",
+              runId,
+              reason: "compaction-usage-unknown",
+            };
             return;
           }
           if (
@@ -15239,6 +15428,11 @@ export async function* agentLoop(messages, options) {
                   ),
                 );
               }
+              yield {
+                type: "run-ended",
+                runId,
+                reason: "compaction-settlement-failed",
+              };
               return;
             }
             if (!hermeticExecution) {
@@ -15303,6 +15497,80 @@ export async function* agentLoop(messages, options) {
         }
         compactionUsageCall =
           compactionUsageCall || compactionUsageState?.calls?.at(-1) || null;
+        const { getRejectedCompactionUsage } = await import(
+          "../lib/context-memory-kernel/live-compaction.js"
+        );
+        const rejectedUsage = getRejectedCompactionUsage(_e);
+        const returnedUsage = compactionUsageCall?.returnedUsage;
+        const providerReceipt = _takeCompactionProviderReceipt(
+          compactionUsageCall,
+          workflowEffectId,
+        );
+        if (providerReceipt) yield providerReceipt;
+        const knownPlanRejection =
+          rejectedUsage &&
+          returnedUsage &&
+          (!rejectedUsage.callId ||
+            rejectedUsage.callId === returnedUsage.callId) &&
+          (!rejectedUsage.receipt.callId ||
+            rejectedUsage.receipt.callId === returnedUsage.callId) &&
+          rejectedUsage.provider === returnedUsage.provider &&
+          rejectedUsage.model === returnedUsage.model &&
+          [
+            "input_tokens",
+            "output_tokens",
+            "cache_read_input_tokens",
+            "cache_creation_input_tokens",
+          ].every(
+            (field) =>
+              rejectedUsage.usage[field] === returnedUsage.usage[field],
+          );
+        if (knownPlanRejection || (!rejectedUsage && returnedUsage)) {
+          automaticCompactionSettlementBlocked = true;
+          // Yield through the existing host ledger/budget settlement path;
+          // never claim a callback or an error flag already paid this debt.
+          yield { type: "token-usage", ...returnedUsage, runId };
+          yield {
+            type: "compaction-degraded",
+            runId,
+            code: _e.code,
+            reason: knownPlanRejection
+              ? "canonical_compaction_plan_rejected"
+              : "canonical_compaction_settlement_failed",
+            summaryMode: "none",
+          };
+          await _awaitBackgroundUsageSettlement(
+            backgroundSubAgents,
+            backgroundUsageFailureState,
+          );
+          if (workflowEffectId) {
+            if (knownPlanRejection) {
+              const error = new Error(
+                "Workflow-bound compaction plan was rejected; the task is incomplete",
+                { cause: _e },
+              );
+              error.code = "CC_WORKFLOW_COMPACTION_PLAN_REJECTED";
+              error.contextOutcome = "aborted";
+              error.usageOutcome = "known";
+              throw error;
+            }
+            const error = _workflowCompactionOutcomeUnknown(
+              _e,
+              "CC_WORKFLOW_COMPACTION_SETTLEMENT_UNKNOWN",
+              "Workflow-bound semantic compaction settlement is unknown",
+            );
+            error.usageOutcome = "known";
+            throw _markWorkflowCompactionFailureReported(error);
+          }
+          yield {
+            type: "run-ended",
+            runId,
+            reason: knownPlanRejection
+              ? "compaction-plan-rejected"
+              : "compaction-settlement-failed",
+          };
+          return;
+        }
         if (compactionUsageCall) {
           automaticCompactionSettlementBlocked = true;
           yield {
@@ -15326,6 +15594,11 @@ export async function* agentLoop(messages, options) {
                 : _workflowCompactionOutcomeUnknown(_e),
             );
           }
+          yield {
+            type: "run-ended",
+            runId,
+            reason: "compaction-usage-unknown",
+          };
           return;
         }
         yield {
@@ -15667,8 +15940,9 @@ export async function* agentLoop(messages, options) {
     // the run-level ids (turn.id correlates with the agent.iteration counter).
     let canonicalProviderContext = null;
     if (options.contextMemorySkipPlanning !== true) {
-      const { prepareCanonicalProviderContext } =
-        await import("../lib/context-memory-kernel/provider-context.js");
+      const { prepareCanonicalProviderContext } = await import(
+        "../lib/context-memory-kernel/provider-context.js"
+      );
       canonicalProviderContext = await prepareCanonicalProviderContext(
         callMessages,
         {