chainlesschain 0.166.101 → 0.166.103

package/src/lib/llm-config-defaults.js

@@ -38,16 +38,18 @@ export async function reconcileConfigLlmProvider(cfgLlm = {}) {
   if (!cfgLlm || !cfgLlm.provider || !cfgLlm.baseUrl) {
     return { llm: cfgLlm, changed: false };
   }
-  const { inferProviderFromBaseUrl, modelForeignToProvider } =
-    await import("./runnable-provider.js");
+  const { inferProviderFromBaseUrl, modelForeignToProvider } = await import(
+    "./runnable-provider.js"
+  );
   const inferred = inferProviderFromBaseUrl(cfgLlm.baseUrl);
   if (!inferred || inferred === cfgLlm.provider) {
     return { llm: cfgLlm, changed: false };
   }
   const corrected = { ...cfgLlm, provider: inferred };
   if (modelForeignToProvider(inferred, cfgLlm.model)) {
-    const { selectModelForTask, TaskType } =
-      await import("./task-model-selector.js");
+    const { selectModelForTask, TaskType } = await import(
+      "./task-model-selector.js"
+    );
     const def = selectModelForTask(inferred, TaskType.CHAT);
     if (def) corrected.model = def;
   }
@@ -88,6 +90,8 @@ export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
     options.provider === cfgLlm.provider
   ) {
     if (!options.baseUrl && cfgLlm.baseUrl) options.baseUrl = cfgLlm.baseUrl;
+    if (options.serviceTier == null && cfgLlm.serviceTier != null)
+      options.serviceTier = cfgLlm.serviceTier;
     backfillApiKey(options, cfgLlm);
     if (!options.model && !opts.explicitModel && cfgLlm.model) {
       options.model = cfgLlm.model;
@@ -96,6 +100,8 @@ export function applyConfigLlmDefaults(options = {}, cfgLlm = {}, opts = {}) {
   }
   if (options.provider || !cfgLlm.provider) return options;
   options.provider = cfgLlm.provider;
+  if (options.serviceTier == null && cfgLlm.serviceTier != null)
+    options.serviceTier = cfgLlm.serviceTier;
   if (opts.explicitModel) {
     options.model = opts.explicitModel;
   } else if (cfgLlm.model) {

package/src/lib/llm-connection-probe.js

@@ -1,5 +1,7 @@
 import { formatProviderResponseError } from "./provider-http-error.js";
 import { estimateCost } from "./llm-pricing.js";
+import { providerFetch } from "./formal-budget-provider-scope.js";
+import { isFormalBudgetError } from "./formal-budget-errors.js";
 
 // Reasoning models spend the same output allowance on thinking before the
 // final answer. A 16-token probe can therefore receive HTTP 200 with only
@@ -180,13 +182,17 @@ export async function probeLlmConnection(
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   let usage = null;
   try {
-    const response = await fetchImpl(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body),
-      signal: controller.signal,
-      redirect: "error",
-    });
+    const response = await providerFetch(
+      url,
+      {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+        signal: controller.signal,
+        redirect: "error",
+      },
+      fetchImpl,
+    );
     if (!response.ok)
       throw new Error(
         await formatProviderResponseError(target.provider, response, {
@@ -232,9 +238,10 @@ export async function probeLlmConnection(
       ? llmProbeReceipt(target, { ok: true, reply, usage })
       : reply;
   } catch (error) {
-    const failure = controller.signal.aborted
-      ? new Error(`Connection test timed out after ${timeoutMs / 1000}s`)
-      : error;
+    const failure =
+      controller.signal.aborted && !isFormalBudgetError(error)
+        ? new Error(`Connection test timed out after ${timeoutMs / 1000}s`)
+        : error;
     if (includeUsage) failure.probe = llmProbeReceipt(target, { usage });
     throw failure;
   } finally {

package/src/lib/llm-pricing.js

@@ -67,6 +67,9 @@ export const PRICE_TABLE = Object.freeze({
         exact: true,
         terms: Object.freeze({
           ...GPT6_PRICING_TERMS,
+          ...(model.serviceMultipliers
+            ? { serviceMultipliers: model.serviceMultipliers }
+            : {}),
           ...(model.cacheReadMultiplier == null
             ? {}
             : { cacheReadMultiplier: model.cacheReadMultiplier }),
@@ -259,9 +262,16 @@ export function normalizePricingTerms(value) {
       Reflect.ownKeys(tiers).length === 0 ||
       Reflect.ownKeys(tiers).some(
         (key) =>
-          !["standard", "default", "auto", "batch", "flex", "fast"].includes(
-            key,
-          ) || !finite(tiers[key]),
+          ![
+            "standard",
+            "default",
+            "auto",
+            "batch",
+            "flex",
+            "fast",
+            "priority",
+            "ultrafast",
+          ].includes(key) || !finite(tiers[key]),
       )
     )
       fail();
@@ -378,7 +388,9 @@ export function estimateCost({
     ? Object.hasOwn(rate.terms.serviceMultipliers, serviceTier)
       ? rate.terms.serviceMultipliers[serviceTier]
       : null
-    : 1;
+    : ["standard", "default"].includes(serviceTier)
+      ? 1
+      : null;
   if (
     !rate ||
     tierMultiplier == null ||

package/src/lib/llm-providers.js

@@ -5,6 +5,8 @@
 /**
  * Built-in provider definitions.
  */
+import { providerFetch } from "./formal-budget-provider-scope.js";
+import { isFormalBudgetError } from "./formal-budget-errors.js";
 export const BUILT_IN_PROVIDERS = {
   ollama: {
     name: "ollama",
@@ -134,8 +136,9 @@ async function _fetchWithTimeout(
   const timer = setTimeout(() => controller.abort(), ms);
   if (timer && typeof timer.unref === "function") timer.unref();
   try {
-    return await fetch(url, { ...opts, signal: controller.signal });
+    return await providerFetch(url, { ...opts, signal: controller.signal });
   } catch (e) {
+    if (isFormalBudgetError(e)) throw e;
     if (controller.signal.aborted) {
       throw new Error(`provider test timed out after ${ms / 1000}s`);
     }

package/src/lib/model-capabilities.js

@@ -263,6 +263,10 @@ export function resolveModelCapabilityProfile({
   const profile = {
     schema: PROFILE_SCHEMA,
     catalogVersion: MODEL_CAPABILITY_CATALOG_VERSION,
+    reviewedAt: documented ? documented.reviewedAt || "2026-10-05" : null,
+    supportedServiceTiers: documented?.serviceTiers
+      ? [...documented.serviceTiers]
+      : ["standard"],
     profileId: `model-capability-v1:${identityDigest.slice(7, 39)}`,
     provider: selectedProvider || "unknown",
     model: selectedModel,
@@ -288,3 +292,25 @@ export function resolveModelCapabilityProfile({
   profile.digest = canonicalDigest(profile, PROFILE_SCHEMA);
   return deepFreeze(profile);
 }
+
+/** Resolve a requested live tier without certifying account availability. */
+export function resolveModelServiceTier(profile, serviceTier) {
+  const requested = serviceTier ?? "standard";
+  if (
+    typeof requested !== "string" ||
+    !profile?.supportedServiceTiers?.includes(requested)
+  ) {
+    throw Object.assign(
+      new RangeError(
+        `Unsupported service tier ${String(requested)} for ${profile?.provider || "unknown"}/${profile?.model || "unknown"}`,
+      ),
+      { code: "CC_MODEL_SERVICE_TIER_UNSUPPORTED" },
+    );
+  }
+  return Object.freeze({
+    requestedServiceTier: requested,
+    requestServiceTier: requested === "standard" ? null : requested,
+    effectiveServiceTier: null,
+    accountVerified: false,
+  });
+}

package/src/lib/model-catalog-review.js

@@ -65,8 +65,12 @@ export function reviewModelCatalog(review, snapshots = {}) {
       "runtimeProtocol",
       "contextWindowTokens",
       "advertisedMaxOutputTokens",
+      "reviewedAt",
     ]) {
-      if (Object.hasOwn(expected, field) && actual[field] !== expected[field])
+      if (
+        Object.hasOwn(expected, field) &&
+        !isDeepStrictEqual(actual[field], expected[field])
+      )
         mismatches.push({
           model: expected.model,
           field,
@@ -80,6 +84,19 @@ export function reviewModelCatalog(review, snapshots = {}) {
         field: "official-source",
         actual: null,
       });
+    if (
+      Object.hasOwn(expected, "supportedServiceTiers") &&
+      !isDeepStrictEqual(
+        actual.supportedServiceTiers,
+        expected.supportedServiceTiers,
+      )
+    )
+      mismatches.push({
+        model: expected.model,
+        field: "supportedServiceTiers",
+        expected: expected.supportedServiceTiers,
+        actual: actual.supportedServiceTiers,
+      });
     for (const field of ["in", "out"]) {
       if (rate?.[field] !== expected.pricing[field])
         mismatches.push({

package/src/lib/model-context-catalog.js

@@ -45,7 +45,7 @@ export const CONTEXT_WINDOWS = Object.freeze({
   }),
 });
 
-export const MODEL_CAPABILITY_CATALOG_VERSION = "2026-10-05";
+export const MODEL_CAPABILITY_CATALOG_VERSION = "2026-10-15";
 
 // Explicit ownership prevents a model name served by an unrelated provider
 // from silently inheriting another provider's catalog window.
@@ -86,6 +86,26 @@ export const LEGACY_MODEL_PROVIDERS = Object.freeze({
 // named models, not endpoint access, account entitlement, or a live CLI run.
 export const DOCUMENTED_OPENAI_MODELS = Object.freeze({
   "gpt-6.1-sol": Object.freeze({
+    reviewedAt: "2026-10-15",
+    serviceTiers: Object.freeze([
+      "standard",
+      "default",
+      "auto",
+      "fast",
+      "priority",
+      "flex",
+      "ultrafast",
+    ]),
+    serviceMultipliers: Object.freeze({
+      standard: 1,
+      default: 1,
+      auto: 1,
+      batch: 0.5,
+      flex: 0.5,
+      fast: 2,
+      priority: 2,
+      ultrafast: 6,
+    }),
     contextWindowTokens: 1050000,
     advertisedMaxOutputTokens: 128000,
     requiresResponsesForTools: true,
@@ -106,6 +126,26 @@ export const DOCUMENTED_OPENAI_MODELS = Object.freeze({
     ]),
   }),
   "gpt-6-astra": Object.freeze({
+    reviewedAt: "2026-10-15",
+    serviceTiers: Object.freeze([
+      "standard",
+      "default",
+      "auto",
+      "fast",
+      "priority",
+      "flex",
+      "ultrafast",
+    ]),
+    serviceMultipliers: Object.freeze({
+      standard: 1,
+      default: 1,
+      auto: 1,
+      batch: 0.5,
+      flex: 0.5,
+      fast: 2,
+      priority: 2,
+      ultrafast: 6,
+    }),
     contextWindowTokens: 1050000,
     advertisedMaxOutputTokens: 128000,
     requiresResponsesForTools: true,

package/src/lib/model-failure-policy.js

@@ -1,4 +1,5 @@
 import { isAbortError } from "./abort-utils.js";
+import { isFormalBudgetError } from "./formal-budget-errors.js";
 
 export function isEvolutionIngressFailure(error) {
   const visited = new Set();
@@ -21,6 +22,7 @@ export function isTerminalModelFailure(error) {
       current.code === "CC_AGENT_EVOLUTION_INGRESS_FAILED" ||
       current.runtimeLedgerPersistence === true ||
       current.workflowEffectOutcomeUnknown === true ||
+      isFormalBudgetError(current) ||
       /^(?:CC|ERR)_SESSION_BUDGET_/u.test(current.code || "") ||
       isAbortError(current)
     ) {

package/src/lib/openai-responses.js

@@ -1,3 +1,5 @@
+import { resolveModelServiceTier } from "./model-capabilities.js";
+
 const RESPONSES_FAILURE_CODE = "CC_OPENAI_RESPONSES_FAILED";
 const MAX_REASONING_ITEMS = 16;
 const MAX_REASONING_SUMMARY_CHARS = 8_192;
@@ -177,7 +179,12 @@ export function createOpenAIResponsesBody({
   reasoning = null,
   stream = false,
   modelProfile = null,
+  serviceTier = null,
 }) {
+  const tier =
+    serviceTier == null
+      ? null
+      : resolveModelServiceTier(modelProfile, serviceTier).requestServiceTier;
   if (
     modelProfile?.advertisedMaxOutputTokens != null &&
     maxOutputTokens > modelProfile.advertisedMaxOutputTokens
@@ -195,6 +202,7 @@ export function createOpenAIResponsesBody({
     ...(maxOutputTokens ? { max_output_tokens: maxOutputTokens } : {}),
     ...(reasoning ? { reasoning } : {}),
     ...(stream ? { stream: true } : {}),
+    ...(tier ? { service_tier: tier } : {}),
   };
 }
 

package/src/lib/plugin-runtime/marketplace-network.js

@@ -3,6 +3,10 @@ import fs from "node:fs";
 import tls from "node:tls";
 import { Worker } from "node:worker_threads";
 import { Agent, ProxyAgent, fetch as undiciFetch } from "undici";
+import {
+  requireUnscopedDescendantControl,
+  requireUnscopedExternalToolAccess,
+} from "../formal-budget-provider-scope.js";
 
 export const MAX_MARKETPLACE_CA_BUNDLE_BYTES = 1024 * 1024;
 export const MAX_MARKETPLACE_PROXY_URL_LENGTH = 4096;
@@ -15,6 +19,7 @@ export const DEFAULT_MARKETPLACE_PAC_TIMEOUT_MS = 2_000;
  * deliberately ignored: callers pass CLI flags or CC_PLUGIN_REGISTRY_* values.
  */
 export function createMarketplaceNetworkTransport(options = {}) {
+  requireUnscopedExternalToolAccess();
   const proxy = normalizeProxyUrl(options.proxyUrl);
   const pac = options.pacFile ? readMarketplacePacFile(options.pacFile) : null;
   if (proxy && pac) {
@@ -49,6 +54,7 @@ export function createMarketplaceNetworkTransport(options = {}) {
 
   return {
     fetch: async (url, fetchOptions = {}) => {
+      requireUnscopedExternalToolAccess();
       const route = pac
         ? parsePacResult(
             await resolveMarketplacePac(pac.script, url, {
@@ -99,11 +105,9 @@ export function readMarketplacePacFile(file) {
   };
 }
 
-export function resolveMarketplacePac(
-  script,
-  url,
-  { timeoutMs = DEFAULT_MARKETPLACE_PAC_TIMEOUT_MS } = {},
-) {
+export function resolveMarketplacePac(script, url, options = {}) {
+  requireUnscopedDescendantControl();
+  const { timeoutMs = DEFAULT_MARKETPLACE_PAC_TIMEOUT_MS } = options;
   const timeout = Number(timeoutMs);
   if (!Number.isInteger(timeout) || timeout < 100 || timeout > 10_000) {
     throw new Error("Marketplace PAC timeout must be between 100 and 10000 ms");

package/src/lib/process-execution-broker/credential-agent.js

@@ -14,6 +14,7 @@
 
 import crypto from "node:crypto";
 import { CredentialTransport } from "./credential-transport.js";
+import { requireUnscopedDescendantControl } from "../formal-budget-provider-scope.js";
 
 const REDACTED_VALUE = "***REDACTED***";
 const DEFAULT_TTL_MS = 60_000;
@@ -644,6 +645,7 @@ class CredentialAgent {
    * self-asserted approval metadata.
    */
   issueCredentialRef(request = {}) {
+    requireUnscopedDescendantControl();
     if (!this.isEnabled()) {
       this._recordAudit({
         event: "credential_ref_issue",
@@ -842,6 +844,7 @@ class CredentialAgent {
    * request object; child-provided claims are not sufficient attestation.
    */
   resolveCredentialRef(refId, request = {}) {
+    requireUnscopedDescendantControl();
     const refFingerprint = this._fingerprint(refId);
     if (!this.isEnabled()) {
       this._recordAudit({
@@ -1002,8 +1005,8 @@ class CredentialAgent {
   _canIssueForContext(context) {
     return Boolean(
       context?.approved === true &&
-      context.approvalId &&
-      normalizeProcessTarget(context.target?.process ?? context.process),
+        context.approvalId &&
+        normalizeProcessTarget(context.target?.process ?? context.process),
     );
   }
 
@@ -1025,6 +1028,7 @@ class CredentialAgent {
    * Strip sensitive and reserved environment variables from spawn options.
    */
   filterEnvironment(env = process.env, context = null) {
+    requireUnscopedDescendantControl();
     const safeEnv = {};
     const redacted = [];
     const reservedRemoved = [];
@@ -1232,6 +1236,7 @@ class CredentialAgent {
    * Apply filtering and issue references for a broker-approved spawn.
    */
   applyWithReport(spawnOptions) {
+    requireUnscopedDescendantControl();
     if (!spawnOptions || typeof spawnOptions !== "object") {
       throw credentialError(
         CREDENTIAL_ERROR_CODES.INVALID_REQUEST,

package/src/lib/process-execution-broker/credential-transport.js

@@ -10,6 +10,7 @@ import net from "node:net";
 import os from "node:os";
 import path from "node:path";
 import { Worker } from "node:worker_threads";
+import { requireUnscopedDescendantControl } from "../formal-budget-provider-scope.js";
 
 const TRANSPORT_VERSION = "local-ipc-v1";
 const DEFAULT_TIMEOUT_MS = 5000;
@@ -34,6 +35,7 @@ export function credentialTransportEndpoint(agentId, options = {}) {
 
 export class CredentialTransport {
   constructor(options = {}) {
+    requireUnscopedDescendantControl();
     if (!options.agentId) {
       throw transportError(
         "CC_CREDENTIAL_INVALID_REQUEST",
@@ -156,6 +158,7 @@ export class CredentialTransport {
   }
 
   registerCredential(record) {
+    requireUnscopedDescendantControl();
     if (!this.isAvailable()) {
       throw (
         this.error ||
@@ -265,6 +268,7 @@ async function connectWithRetry(endpoint, deadline) {
  * approved target process.
  */
 export async function resolveCredentialRefOverTransport(refId, options = {}) {
+  requireUnscopedDescendantControl();
   const env = options.env || process.env;
   const endpoint = options.endpoint || env.CC_CREDENTIAL_ENDPOINT;
   const capabilityToken =

package/src/lib/process-execution-broker/index.js

@@ -30,6 +30,7 @@ import * as fs from "node:fs";
 import * as tty from "node:tty";
 import { createRequire } from "node:module";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { requireUnscopedDescendantControl } from "../formal-budget-provider-scope.js";
 
 const require = createRequire(import.meta.url);
 
@@ -4692,6 +4693,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   spawn(command, args, options = {}) {
+    requireUnscopedDescendantControl();
     assertProcessOwnershipAvailable();
     options = this._withAmbientProcessContext(command, options);
     const executionId = crypto.randomUUID();
@@ -5156,6 +5158,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   spawnSync(command, args, options = {}) {
+    requireUnscopedDescendantControl();
     assertProcessOwnershipAvailable();
     options = this._withAmbientProcessContext(command, options);
     const executionId = crypto.randomUUID();
@@ -5745,6 +5748,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   exec(command, options, callback) {
+    requireUnscopedDescendantControl();
     const opts = typeof options === "function" ? {} : options;
     const cb = typeof options === "function" ? options : callback;
     if (this._requiresExplicitLinuxWorkspaceShell(opts.cwd || process.cwd())) {
@@ -5763,6 +5767,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   execSync(command, options = {}) {
+    requireUnscopedDescendantControl();
     if (
       this._requiresExplicitLinuxWorkspaceShell(options.cwd || process.cwd())
     ) {
@@ -5804,6 +5809,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   execFile(file, args, options, callback) {
+    requireUnscopedDescendantControl();
     if (typeof args === "function") {
       callback = args;
       args = [];
@@ -5897,6 +5903,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   execFileSync(file, args, options = {}) {
+    requireUnscopedDescendantControl();
     if (!Array.isArray(args)) {
       options = args || {};
       args = [];
@@ -5917,6 +5924,7 @@ class ProcessExecutionBroker extends EventEmitter {
   }
 
   fork(modulePath, args, options = {}) {
+    requireUnscopedDescendantControl();
     return this.spawn(process.execPath, [modulePath, ...(args || [])], {
       ...options,
       origin: options.origin || "fork",

package/src/lib/provider-stream.js

@@ -1,3 +1,7 @@
+import {
+  hasFormalBudgetProviderScope,
+  providerFetch,
+} from "./formal-budget-provider-scope.js";
 /**
  * Provider streaming adapters — shared by `cc stream` and the Hosted Session
  * API `stream.run` WS route. Each builder returns an AsyncIterable<string>
@@ -47,16 +51,19 @@ export async function* ollamaTokenStream({
   signal,
   requireCompletion = false,
 }) {
-  const res = await fetch(`${baseUrl}/api/${messages ? "chat" : "generate"}`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(
-      messages
-        ? { model, messages, stream: true }
-        : { model, prompt, stream: true },
-    ),
-    signal,
-  });
+  const res = await providerFetch(
+    `${baseUrl}/api/${messages ? "chat" : "generate"}`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(
+        messages
+          ? { model, messages, stream: true }
+          : { model, prompt, stream: true },
+      ),
+      signal,
+    },
+  );
   if (!res.ok || !res.body) {
     throw new Error(`Ollama ${res.status} ${res.statusText}`);
   }
@@ -88,7 +95,8 @@ export async function* openAIStream({
   signal,
   requireCompletion = false,
 }) {
-  const res = await fetch(`${baseUrl}/chat/completions`, {
+  const governed = hasFormalBudgetProviderScope();
+  const res = await providerFetch(`${baseUrl}/chat/completions`, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
@@ -98,17 +106,24 @@ export async function* openAIStream({
       model,
       messages: messages ?? [{ role: "user", content: prompt }],
       stream: true,
+      ...(governed ? { stream_options: { include_usage: true } } : {}),
     }),
     signal,
   });
   if (!res.ok || !res.body) {
     throw new Error(`${res.status} ${res.statusText}`);
   }
+  let completed = false;
   for await (const raw of responseLines(res.body)) {
     const line = raw.trim();
     if (!line || !line.startsWith("data:")) continue;
     const payload = line.slice(5).trim();
-    if (payload === "[DONE]") return;
+    if (payload === "[DONE]") {
+      completed = true;
+      if (!governed) return;
+      // A governed stream must reach EOF so durable accounting can settle.
+      continue;
+    }
     try {
       const obj = JSON.parse(payload);
       if (requireCompletion && obj.error)
@@ -120,7 +135,7 @@ export async function* openAIStream({
       /* skip */
     }
   }
-  if (requireCompletion)
+  if (requireCompletion && !completed)
     throw new Error("OpenAI stream ended before its completion marker");
 }
 

package/src/lib/sandbox-egress-worker.js

@@ -5,6 +5,7 @@
  */
 import { Worker } from "node:worker_threads";
 import path from "node:path";
+import { requireUnscopedDescendantControl } from "./formal-budget-provider-scope.js";
 
 const RESPONSE_TIMEOUT_MS = 10_000;
 
@@ -15,6 +16,7 @@ function workerError(code) {
 }
 
 export async function startEgressProxyWorker(policy, options = {}) {
+  requireUnscopedDescendantControl();
   const bindHost = options.bindHost || "127.0.0.1";
   const socketPath = options.socketPath || null;
   if (socketPath) {
@@ -156,6 +158,7 @@ export async function startEgressProxyWorker(policy, options = {}) {
       return revision;
     },
     async updatePolicy(nextPolicy, expectedRevision) {
+      requireUnscopedDescendantControl();
       const response = await request("update", {
         policy: nextPolicy,
         expectedRevision,

package/src/lib/skill-retrieval-router.js

@@ -248,6 +248,7 @@ export function routeSkillDescriptors({
     schema: SKILL_RETRIEVAL_RESULT_SCHEMA,
     query: query.trim(),
     selected: returned.length > 0 && !topConflict ? returned[0] : null,
+    matchedCount: candidates.length,
     candidates: Object.freeze(returned.map(Object.freeze)),
     conflicts: Object.freeze(conflicts.map(Object.freeze)),
     rejected: Object.freeze(rejected.map(Object.freeze)),

package/src/lib/stream-retry.js

@@ -18,6 +18,7 @@ import {
   raceWithAbort,
   throwIfAborted,
 } from "./abort-utils.js";
+import { isFormalBudgetError } from "./formal-budget-errors.js";
 
 /** Bounded auto-retry budget for streaming connection drops (Claude-Code 2.1.181). */
 export const STREAM_RETRY_MAX = 2;
@@ -243,6 +244,7 @@ export function resolveStreamRetryMax(env = process.env) {
  * @returns {boolean}
  */
 export function isRetryableStreamError(err, signal) {
+  if (isFormalBudgetError(err)) return false;
   if (isAbortError(err)) return false;
   if (signal && signal.aborted) return false;
   if (!err) return false;

package/src/lib/sub-agent-context.js

@@ -21,6 +21,7 @@ import {
 } from "../runtime/agent-core.js";
 import { feature } from "./feature-flags.js";
 import { isEvolutionIngressFailure } from "./model-failure-policy.js";
+import { isFormalBudgetError } from "./formal-budget-errors.js";
 import { captureAgentEvolutionIngress } from "./evolution/agent-evolution-ingress.js";
 import {
   createWorktree,
@@ -609,6 +610,7 @@ export class SubAgentContext {
     } catch (err) {
       if (
         isEvolutionIngressFailure(err) ||
+        isFormalBudgetError(err) ||
         err?.runtimeLedgerPersistence === true ||
         this._workflowEffectId
       ) {
@@ -1212,6 +1214,7 @@ export class SubAgentContext {
     } catch (err) {
       if (
         isEvolutionIngressFailure(err) ||
+        isFormalBudgetError(err) ||
         err?.runtimeLedgerPersistence === true ||
         this._workflowEffectId
       ) {
@@ -1543,9 +1546,9 @@ export class SubAgentContext {
   isAborted() {
     return Boolean(
       this._signal?.aborted ||
-      this._abortController.signal.aborted ||
-      this._runAbortController?.signal.aborted ||
-      this.sessionBudget?.signal?.aborted,
+        this._abortController.signal.aborted ||
+        this._runAbortController?.signal.aborted ||
+        this.sessionBudget?.signal?.aborted,
     );
   }