chainlesschain 0.166.76 → 0.166.78

package/src/lib/execution-location-target.js

@@ -4,6 +4,10 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { TextDecoder } from "node:util";
+import {
+  readExecutionLocationFailureSite,
+  readExecutionLocationStorageFailure,
+} from "./execution-location-failure-site.js";
 import {
   EXECUTION_LOCATION_TARGET_ATTESTATION_SCHEMA,
   createExecutionLocationTargetAttestation,
@@ -18,7 +22,11 @@ import {
 import { canonicalJson } from "./scheduler-kernel/contract.js";
 import { executionBroker } from "./process-execution-broker/index.js";
 import { assertExecutionLocationRunnerLeaseAuthority } from "./execution-location-runner-lifecycle.js";
-import { ensurePrivateDirectory, repairPrivatePaths } from "./secure-fs.js";
+import {
+  _resolveWindowsAclTimeout,
+  ensurePrivateDirectory,
+  repairPrivatePaths,
+} from "./secure-fs.js";
 import { getSessionAntiRollbackDirectory } from "./session-anti-rollback-anchor.js";
 import {
   MAX_EXECUTION_LOCATION_RESULT_BUNDLE_BYTES,
@@ -657,6 +665,11 @@ function localTargetEnvironment(profile, lifecycleEnvironment) {
     // Windows. Keep all CLI state beneath a dedicated child directory.
     CHAINLESSCHAIN_HOME: path.join(profile.transport.home, ".chainlesschain"),
     CHAINLESSCHAIN_SECURITY_ANCHOR_HOME: profile.transport.securityHome,
+    // This numeric, bounded operation allowance is part of local storage
+    // configuration. Forward no other caller-specific environment or secrets.
+    CC_SECURE_FS_WINDOWS_ACL_TIMEOUT_MS: String(
+      _resolveWindowsAclTimeout(15_000),
+    ),
     FORCE_COLOR: "0",
     HOME: profile.transport.home,
     LOCALAPPDATA: path.join(profile.transport.home, "AppData", "Local"),
@@ -706,6 +719,7 @@ export function prepareLocalTargetState(profile, cliArgs, deps = {}) {
     anchorBase: profile.transport.securityHome,
   });
   const sessionDigest = createHash("sha256").update(sessionId).digest("hex");
+  const platform = deps.platform || process.platform;
   const directories = [
     stateHome,
     path.join(stateHome, "sessions"),
@@ -715,11 +729,19 @@ export function prepareLocalTargetState(profile, cliArgs, deps = {}) {
     path.join(antiRollbackDirectory, "namespace"),
     path.join(antiRollbackDirectory, "records"),
     path.join(antiRollbackDirectory, "records", sessionDigest.slice(0, 2)),
+    // Windows known-folder APIs can return an empty path for nonexistent
+    // isolated profile directories, making first-use caches relative to cwd.
+    ...(platform === "win32"
+      ? [
+          path.join(profile.transport.home, "AppData"),
+          path.join(profile.transport.home, "AppData", "Local"),
+          path.join(profile.transport.home, "AppData", "Roaming"),
+        ]
+      : []),
   ];
   const uniqueDirectories = [...new Set(directories)];
   const ensure = deps.ensurePrivateDirectory || ensurePrivateDirectory;
   const repair = deps.repairPrivatePaths || repairPrivatePaths;
-  const platform = deps.platform || process.platform;
   for (const directory of uniqueDirectories) {
     ensure(
       directory,
@@ -961,6 +983,65 @@ function targetInvocation(profile, cliArgs, deps = {}, options = {}) {
   });
 }
 
+// Target output can contain session text, paths, or credentials. Report only
+// a fixed diagnostic category; this is never an authorization/retry decision.
+function targetCommandFailureCategory(result) {
+  const stderr = String(result?.stderr || "").slice(0, MAX_PROBE_BYTES);
+  if (readExecutionLocationStorageFailure(stderr)) return "windows-acl";
+  const categories = [
+    ["stdin-empty", /session replica stdin is empty/u],
+    ["stdin-read-unavailable", /(?:EAGAIN|EINVAL)[^\r\n]*read/u],
+    ["stdin-identity", /local target stdin file (?:is invalid|changed)/u],
+    [
+      "target-facts-changed",
+      /target facts changed before location handoff append/u,
+    ],
+    ["filesystem-access", /\b(?:EACCES|EPERM)\b|Access is denied/iu],
+    ["filesystem-missing", /\bENOENT\b/u],
+    ["module-load", /\b(?:ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND)\b/u],
+    [
+      "file-identity",
+      /(?:identity changed|pathname and descriptor identities differ|physical, non-symlink|single-link file)/u,
+    ],
+    [
+      "storage-integrity",
+      /(?:[Aa]nti-rollback|[Tt]ranscript digest|[Hh]ash chain|[Aa]nchor|[Rr]eplica)[^\r\n]*(?:invalid|mismatch|failed|conflict)/u,
+    ],
+    [
+      "deployment-authority",
+      /(?:authenticated evolution ingress|evolution deployment)/u,
+    ],
+    ["memory-limit", /heap out of memory|Reached heap limit/iu],
+  ];
+  return (
+    categories.find(([, pattern]) => pattern.test(stderr))?.[0] || "unknown"
+  );
+}
+
+function targetProcessFailure(result) {
+  // Native spawn errors include executable paths and argv. Preserve only fixed
+  // categories and the same content-free diagnostics as a nonzero target exit.
+  // A timeout is an unknown outcome: this function never retries the command.
+  const categories = new Map([
+    ["ETIMEDOUT", "process-timeout"],
+    ["ENOBUFS", "process-output-limit"],
+    ["ENOENT", "process-unavailable"],
+    ["EACCES", "process-access"],
+    ["EPERM", "process-access"],
+  ]);
+  const failureCategory = categories.get(result.error.code) || "process-spawn";
+  const failureSite = readExecutionLocationFailureSite(result.stderr);
+  const storageFailure = readExecutionLocationStorageFailure(result.stderr);
+  const error = new Error(
+    `target process failed (${failureCategory})${failureSite ? ` at ${failureSite}` : ""}${storageFailure ? ` [${storageFailure}]` : ""}`,
+  );
+  error.code = "CC_EXECUTION_LOCATION_TARGET_COMMAND_FAILED";
+  error.failureCategory = failureCategory;
+  if (failureSite) error.failureSite = failureSite;
+  if (storageFailure) error.storageFailure = storageFailure;
+  return error;
+}
+
 function runTargetCommand(profile, cliArgs, deps = {}, options = {}) {
   const invocation = targetInvocation(profile, cliArgs, deps, options);
   const spawnSync =
@@ -976,9 +1057,14 @@ function runTargetCommand(profile, cliArgs, deps = {}, options = {}) {
     ) {
       throw new Error("target command output boundary is invalid");
     }
-    const timeoutMs = Number(
-      options.timeoutMs ?? DEFAULT_TARGET_COMMAND_TIMEOUT_MS,
-    );
+    // Hosted Windows Local targets can spend most of the generic 30-second
+    // window on owner-only ACL checks before the CLI command runs. Keep the
+    // existing bounded 120-second ceiling for this attested target platform.
+    const defaultTimeoutMs =
+      profile.target === "local" && profile.expected.platform === "win32"
+        ? MAX_TARGET_COMMAND_TIMEOUT_MS
+        : DEFAULT_TARGET_COMMAND_TIMEOUT_MS;
+    const timeoutMs = Number(options.timeoutMs ?? defaultTimeoutMs);
     if (
       !Number.isSafeInteger(timeoutMs) ||
       timeoutMs < 1 ||
@@ -1008,12 +1094,20 @@ function runTargetCommand(profile, cliArgs, deps = {}, options = {}) {
           ],
       ...(invocation.spawnOptions || {}),
     });
-    if (result?.error) throw result.error;
+    if (result?.error) throw targetProcessFailure(result);
     if (!result || result.status !== 0) {
+      const failureCategory = targetCommandFailureCategory(result);
+      const failureSite = readExecutionLocationFailureSite(result?.stderr);
+      const storageFailure = readExecutionLocationStorageFailure(
+        result?.stderr,
+      );
       const error = new Error(
-        `target command failed with status ${result?.status ?? "unknown"}`,
+        `target command failed with status ${result?.status ?? "unknown"} (${failureCategory})${failureSite ? ` at ${failureSite}` : ""}${storageFailure ? ` [${storageFailure}]` : ""}`,
       );
       error.code = "CC_EXECUTION_LOCATION_TARGET_COMMAND_FAILED";
+      error.failureCategory = failureCategory;
+      if (failureSite) error.failureSite = failureSite;
+      if (storageFailure) error.storageFailure = storageFailure;
       throw error;
     }
     return options.interactive ? null : result.stdout;
@@ -1187,7 +1281,7 @@ export function probeExecutionLocationTargetResourceLimit(
   } finally {
     invocation.cleanup?.();
   }
-  if (result?.error) throw result.error;
+  if (result?.error) throw targetProcessFailure(result);
   const expectedMarker = `CC_EXECUTION_LOCATION_RESOURCE_PROBE_ARMED:${kind}`;
   const status = Number(result?.status);
   const signal = result?.signal == null ? null : String(result.signal);

package/src/lib/external-agent-adapters.js

@@ -15,6 +15,8 @@ export const EXTERNAL_AGENT_ERROR = Object.freeze({
   TIMEOUT: "EXTERNAL_AGENT_TIMEOUT",
   EXIT_NONZERO: "EXTERNAL_AGENT_EXIT_NONZERO",
   SPAWN_FAILED: "EXTERNAL_AGENT_SPAWN_FAILED",
+  CLEANUP_UNCONFIRMED: "EXTERNAL_AGENT_CLEANUP_UNCONFIRMED",
+  EXECUTION_BLOCKED: "EXTERNAL_AGENT_EXECUTION_BLOCKED",
   PROTOCOL_FAILED: "EXTERNAL_AGENT_PROTOCOL_FAILED",
   UNSUPPORTED_OPTION: "EXTERNAL_AGENT_UNSUPPORTED_OPTION",
 });

package/src/lib/image-file-boundary.js

@@ -0,0 +1,154 @@
+import fs from "node:fs";
+
+// CLI keeps its existing eight-image allowance; IDE composers admit four.
+export const MAX_INPUT_IMAGES = 8;
+export const MAX_INPUT_IMAGE_BYTES = 20 * 1024 * 1024;
+export const MAX_INPUT_IMAGE_PIXELS = 40_000_000;
+const MAX_HEADER_BYTES = 1024 * 1024;
+
+/** Header admission only, not a full codec decode or animation-frame budget. */
+export function inspectImageHeader(data) {
+  const ascii = (start, end) => data.toString("ascii", start, end);
+  if (
+    data.length >= 33 &&
+    data
+      .subarray(0, 8)
+      .equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])) &&
+    data.readUInt32BE(8) === 13 &&
+    ascii(12, 16) === "IHDR"
+  ) {
+    return {
+      mediaType: "image/png",
+      width: data.readUInt32BE(16),
+      height: data.readUInt32BE(20),
+    };
+  }
+  if (data.length >= 13 && ["GIF87a", "GIF89a"].includes(ascii(0, 6))) {
+    return {
+      mediaType: "image/gif",
+      width: data.readUInt16LE(6),
+      height: data.readUInt16LE(8),
+    };
+  }
+  if (data.length >= 30 && ascii(0, 4) === "RIFF" && ascii(8, 12) === "WEBP") {
+    const kind = ascii(12, 16);
+    if (kind === "VP8X")
+      return {
+        mediaType: "image/webp",
+        width: data.readUIntLE(24, 3) + 1,
+        height: data.readUIntLE(27, 3) + 1,
+      };
+    if (
+      kind === "VP8 " &&
+      data[23] === 157 &&
+      data[24] === 1 &&
+      data[25] === 42
+    )
+      return {
+        mediaType: "image/webp",
+        width: data.readUInt16LE(26) & 16383,
+        height: data.readUInt16LE(28) & 16383,
+      };
+    if (kind === "VP8L" && data[20] === 47) {
+      const bits = data.readUInt32LE(21);
+      return {
+        mediaType: "image/webp",
+        width: (bits & 16383) + 1,
+        height: ((bits >>> 14) & 16383) + 1,
+      };
+    }
+  }
+  if (data.length >= 4 && data[0] === 255 && data[1] === 216) {
+    let offset = 2;
+    while (offset + 4 <= data.length) {
+      if (data[offset++] !== 255) break;
+      while (data[offset] === 255) offset++;
+      const marker = data[offset++];
+      if (marker === 217 || marker === 218) break;
+      if (marker === 1 || (marker >= 208 && marker <= 215)) continue;
+      if (offset + 2 > data.length) break;
+      const length = data.readUInt16BE(offset);
+      if (length < 2 || offset + length > data.length) break;
+      if (
+        [
+          192, 193, 194, 195, 197, 198, 199, 201, 202, 203, 205, 206, 207,
+        ].includes(marker) &&
+        length >= 8
+      ) {
+        return {
+          mediaType: "image/jpeg",
+          width: data.readUInt16BE(offset + 5),
+          height: data.readUInt16BE(offset + 3),
+        };
+      }
+      offset += length;
+    }
+  }
+  throw new Error(
+    "Unsupported or malformed image header (dimensions must occur within the first 1 MiB)",
+  );
+}
+
+function readAtMost(io, fd, data) {
+  let offset = 0;
+  while (offset < data.length) {
+    const count = io.readSync(fd, data, offset, data.length - offset, offset);
+    if (count === 0) break;
+    offset += count;
+  }
+  return offset;
+}
+
+/** Pin one regular-file descriptor and cap allocation/read even if it grows. */
+export function readBoundedImage(
+  file,
+  expectedMediaType,
+  remainingBytes,
+  io = fs,
+) {
+  // O_NONBLOCK avoids hanging while opening a FIFO on POSIX. fstat then
+  // rejects all non-regular files; Windows has no O_NONBLOCK flag here.
+  const fd = io.openSync(
+    file,
+    fs.constants.O_RDONLY | (fs.constants.O_NONBLOCK || 0),
+  );
+  try {
+    const before = io.fstatSync(fd);
+    if (!before.isFile()) throw new Error("Image input must be a regular file");
+    if (
+      !Number.isSafeInteger(before.size) ||
+      before.size <= 0 ||
+      before.size > MAX_INPUT_IMAGE_BYTES
+    )
+      throw new Error("Image must contain 1 byte to 20 MiB");
+    if (before.size > remainingBytes)
+      throw new Error("Total image attachments exceed 20 MiB per message");
+    const header = Buffer.alloc(Math.min(before.size, MAX_HEADER_BYTES));
+    const headerSize = readAtMost(io, fd, header);
+    const info = inspectImageHeader(header.subarray(0, headerSize));
+    if (info.mediaType !== expectedMediaType)
+      throw new Error("Image extension does not match its file header");
+    if (
+      !info.width ||
+      !info.height ||
+      info.width * info.height > MAX_INPUT_IMAGE_PIXELS
+    )
+      throw new Error(
+        "Image dimensions must be positive and at most 40 megapixels",
+      );
+    const data = Buffer.alloc(before.size + 1);
+    const count = readAtMost(io, fd, data);
+    const after = io.fstatSync(fd);
+    if (
+      count !== before.size ||
+      after.size !== before.size ||
+      after.mtimeMs !== before.mtimeMs ||
+      after.ctimeMs !== before.ctimeMs ||
+      !data.subarray(0, headerSize).equals(header.subarray(0, headerSize))
+    )
+      throw new Error("Image changed while being read; select it again");
+    return data.subarray(0, count);
+  } finally {
+    io.closeSync(fd);
+  }
+}

package/src/lib/image-input.js

@@ -15,6 +15,11 @@
 import fs from "fs";
 import path from "path";
 import os from "os";
+import {
+  MAX_INPUT_IMAGES,
+  MAX_INPUT_IMAGE_BYTES,
+  readBoundedImage,
+} from "./image-file-boundary.js";
 
 /**
  * Candidate on-disk forms for a path token typed in a prompt, so a path copied
@@ -66,7 +71,10 @@ const EXT_MEDIA = {
 export function resolveImages(paths, deps = {}) {
   const _fs = deps.fs || fs;
   if (!Array.isArray(paths) || paths.length === 0) return [];
-  return paths.map((p) => {
+  if (paths.length > MAX_INPUT_IMAGES)
+    throw new Error(`Attach at most ${MAX_INPUT_IMAGES} images per message`);
+  let remainingBytes = MAX_INPUT_IMAGE_BYTES;
+  return paths.map((p, index) => {
     const ext = path.extname(String(p)).toLowerCase();
     const mediaType = EXT_MEDIA[ext];
     if (!mediaType) {
@@ -74,8 +82,13 @@ export function resolveImages(paths, deps = {}) {
         `Unsupported image type "${ext || p}" — use png/jpg/jpeg/gif/webp.`,
       );
     }
-    const data = _fs.readFileSync(p).toString("base64");
-    return { mediaType, data };
+    try {
+      const data = readBoundedImage(p, mediaType, remainingBytes, _fs);
+      remainingBytes -= data.length;
+      return { mediaType, data: data.toString("base64") };
+    } catch (error) {
+      throw new Error(`Image ${index + 1}: ${error.message}`, { cause: error });
+    }
   });
 }
 

package/src/lib/llm-pricing.js

@@ -15,6 +15,12 @@
  * substring against the model id.
  */
 
+import {
+  DOCUMENTED_OPENAI_MODELS,
+  DOCUMENTED_ANTHROPIC_MODELS,
+  GPT6_PRICING_TERMS,
+} from "./model-context-catalog.js";
+
 /** Providers whose models run locally and cost nothing to call. */
 export const FREE_PROVIDERS = Object.freeze([
   "ollama",
@@ -30,6 +36,11 @@ export const FREE_PROVIDERS = Object.freeze([
  */
 export const PRICE_TABLE = Object.freeze({
   anthropic: [
+    ...Object.entries(DOCUMENTED_ANTHROPIC_MODELS).map(([match, model]) => ({
+      match,
+      ...model.pricing,
+      exact: true,
+    })),
     // Current Anthropic list prices (USD per 1M tokens), verified 2026-06-21
     // against the claude-api reference. The Opus tier dropped to $5/$25 with
     // Opus 4.5 (Nov 2025) — the old $15/$75 applies only to the retired
@@ -47,6 +58,14 @@ export const PRICE_TABLE = Object.freeze({
     { match: "haiku", in: 1, out: 5 },
   ],
   openai: [
+    ...Object.entries(DOCUMENTED_OPENAI_MODELS)
+      .filter(([, model]) => model.pricing)
+      .map(([match, model]) => ({
+        match,
+        ...model.pricing,
+        exact: true,
+        terms: GPT6_PRICING_TERMS,
+      })),
     // GPT-5 family (2026). Matching is longest-pattern-first, so dated/variant
     // ids (gpt-5.5, gpt-5.5-pro, gpt-5.5-instant, …) resolve to the most
     // specific rate; bare "gpt-5" is the catch-all base rate.
@@ -64,6 +83,10 @@ export const PRICE_TABLE = Object.freeze({
     { match: "o1-mini", in: 1.1, out: 4.4 },
     { match: "o1", in: 15, out: 60 },
   ],
+  dashscope: [
+    { match: "qwen-turbo", in: 0.3, out: 0.6 },
+    { match: "qwen-plus", in: 0.8, out: 2 },
+  ],
   deepseek: [
     // DeepSeek V4 launch-list rates for the versioned 2026-04 model ids.
     // Keep these ahead of the legacy aliases so formal budget gates never
@@ -139,9 +162,13 @@ export function mergePricing(overrides, base = PRICE_TABLE) {
           Number(e.out) >= 0,
       )
       .map((e) => ({
+        ...(base[providerKey]?.find(
+          (entry) => entry.match === e.match.toLowerCase(),
+        ) || {}),
         match: e.match.toLowerCase(),
         in: Number(e.in),
         out: Number(e.out),
+        explicitOverride: true,
       }));
     if (valid.length === 0) continue;
     const overridden = new Set(valid.map((v) => v.match));
@@ -171,8 +198,23 @@ export function lookupRate(provider, model, table = PRICE_TABLE) {
   // Longest pattern first so specific beats generic regardless of table order.
   const sorted = [...entries].sort((a, b) => b.match.length - a.match.length);
   for (const e of sorted) {
-    if (m.includes(e.match)) {
-      return { in: e.in, out: e.out, pattern: e.match };
+    if (e.exact ? m === e.match : m.includes(e.match)) {
+      // An unrecognized new version must not inherit an older Opus price.
+      // Explicit operator overrides remain authoritative.
+      if (
+        e.match === "opus" &&
+        Number(/^claude-opus-(\d+)(?:[.-]|$)/u.exec(m)?.[1]) >= 5 &&
+        !e.explicitOverride &&
+        e.in === 5 &&
+        e.out === 25
+      )
+        continue;
+      return {
+        in: e.in,
+        out: e.out,
+        pattern: e.match,
+        ...(e.terms ? { terms: e.terms } : {}),
+      };
     }
   }
   return null;
@@ -210,10 +252,18 @@ export function estimateCost({
   outputTokens = 0,
   cacheReadTokens = 0,
   cacheCreationTokens = 0,
+  requestInputTokens,
+  serviceTier = "standard",
+  regionalProcessing = false,
   table,
 } = {}) {
   const rate = lookupRate(provider, model, table);
-  if (!rate) {
+  const tierMultiplier = rate?.terms
+    ? Object.hasOwn(rate.terms.serviceMultipliers, serviceTier)
+      ? rate.terms.serviceMultipliers[serviceTier]
+      : null
+    : 1;
+  if (!rate || tierMultiplier == null) {
     return {
       inputCost: 0,
       outputCost: 0,
@@ -226,16 +276,34 @@ export function estimateCost({
       rate: null,
     };
   }
+  const promptTokens =
+    requestInputTokens ??
+    Number(inputTokens) + Number(cacheReadTokens) + Number(cacheCreationTokens);
+  const longContext = rate.terms?.longContext;
+  const longPrompt = longContext && promptTokens > longContext.threshold;
+  const inputMultiplier = longPrompt ? longContext.inputMultiplier : 1;
+  const outputMultiplier = longPrompt ? longContext.outputMultiplier : 1;
+  const multiplier = tierMultiplier * (regionalProcessing ? 1.1 : 1);
   // Keep full IEEE-754 precision throughout authority and budget arithmetic.
   // Rounding each component to six decimals lets a real sub-microdollar call
   // become zero and can make a hard `maxUsd` gate pass incorrectly. Display
   // surfaces may format these values, but safety decisions consume the raw sum.
-  const inputCost = (Number(inputTokens) / 1e6) * rate.in;
-  const outputCost = (Number(outputTokens) / 1e6) * rate.out;
+  const inputCost =
+    (Number(inputTokens) / 1e6) * rate.in * inputMultiplier * multiplier;
+  const outputCost =
+    (Number(outputTokens) / 1e6) * rate.out * outputMultiplier * multiplier;
   const cacheReadCost =
-    (Number(cacheReadTokens) / 1e6) * rate.in * cacheReadMultiplier(provider);
+    (Number(cacheReadTokens) / 1e6) *
+    rate.in *
+    (rate.terms?.cacheReadMultiplier ?? cacheReadMultiplier(provider)) *
+    inputMultiplier *
+    multiplier;
   const cacheCreationCost =
-    (Number(cacheCreationTokens) / 1e6) * rate.in * CACHE_WRITE_MULTIPLIER;
+    (Number(cacheCreationTokens) / 1e6) *
+    rate.in *
+    (rate.terms?.cacheWriteMultiplier ?? CACHE_WRITE_MULTIPLIER) *
+    inputMultiplier *
+    multiplier;
   return {
     inputCost,
     outputCost,
@@ -259,15 +327,53 @@ export function estimateCost({
  */
 export function priceRollup(aggregate, { table } = {}) {
   const byModel = (aggregate?.byModel || []).map((row) => {
-    const est = estimateCost({
+    let est = estimateCost({
       provider: row.provider,
       model: row.model,
       inputTokens: row.inputTokens,
       outputTokens: row.outputTokens,
       cacheReadTokens: row.cacheReadTokens,
       cacheCreationTokens: row.cacheCreationTokens,
+      serviceTier: row.serviceTier ?? row.service_tier ?? "standard",
+      regionalProcessing:
+        row.regionalProcessing ?? row.regional_processing ?? false,
       table,
     });
+    if (Array.isArray(row.pricingBuckets)) {
+      const estimates = row.pricingBuckets.map((bucket) =>
+        estimateCost({
+          provider: row.provider,
+          model: row.model,
+          ...bucket,
+          table,
+        }),
+      );
+      est = { ...est, matched: estimates.every((entry) => entry.matched) };
+      for (const field of [
+        "inputCost",
+        "outputCost",
+        "cacheReadCost",
+        "cacheCreationCost",
+        "totalCost",
+      ]) {
+        est[field] = estimates.reduce((sum, entry) => sum + entry[field], 0);
+      }
+    } else if (
+      lookupRate(row.provider, row.model, table)?.terms &&
+      row.calls > 1
+    ) {
+      // A legacy aggregate cannot establish which individual requests crossed
+      // a pricing threshold. Exclude it rather than inventing a bill.
+      est = {
+        ...est,
+        matched: false,
+        inputCost: 0,
+        outputCost: 0,
+        cacheReadCost: 0,
+        cacheCreationCost: 0,
+        totalCost: 0,
+      };
+    }
     return {
       ...row,
       cost: est.totalCost,

package/src/lib/mcp-call-ledger-store.js

@@ -685,10 +685,13 @@ export function assertMcpVerifiedProjectionAuthority(
   const descriptors = Object.getOwnPropertyDescriptors(authority);
   const fields = Object.keys(descriptors);
   if (
-    fields.length !== VERIFIED_PROJECTION_AUTHORITY_FIELDS.size ||
+    fields.length !==
+      VERIFIED_PROJECTION_AUTHORITY_FIELDS.size +
+        (descriptors.replayEvents ? 1 : 0) ||
     fields.some(
       (field) =>
-        !VERIFIED_PROJECTION_AUTHORITY_FIELDS.has(field) ||
+        (!VERIFIED_PROJECTION_AUTHORITY_FIELDS.has(field) &&
+          field !== "replayEvents") ||
         !("value" in descriptors[field]) ||
         !descriptors[field].enumerable,
     )
@@ -704,6 +707,8 @@ export function assertMcpVerifiedProjectionAuthority(
     !Number.isSafeInteger(projectedEventCount) ||
     projectedEventCount < 0 ||
     typeof descriptors.readMessages.value !== "function" ||
+    (descriptors.replayEvents &&
+      typeof descriptors.replayEvents.value !== "function") ||
     projectedEventCount !== acceptedCount ||
     projectedHeadHash !== headHash
   ) {