dowafu 0.4.0 → 0.5.0

package/dist/report.js

@@ -3,6 +3,7 @@
 // 實際並行數，靜態估算無法精確預測。
 import { stripFrontmatter } from "./ticket.js";
 import { FIXED_CLOSING_LINE, FIXED_CLOSING_LINE_EN } from "./audit.js";
+import { estimateHardCapUsd } from "./cost.js";
 import { m } from "./messages.js";
 export function effectiveCap(spoke, cli) {
     return spoke.providerConfig.maxSpokeTokens ?? cli.maxSpokeTokens;
@@ -11,9 +12,7 @@ export function effectiveCharsPerToken(spoke, cli) {
     return spoke.providerConfig.charsPerToken ?? cli.charsPerToken;
 }
 function formatProvidersSource(src, lang) {
-    if (src.kind === "bundled")
-        return m(lang, "providersBundled", src.formatVersion);
-    return m(lang, "providersExplicit", src.path ?? "", src.formatVersion);
+    return m(lang, "providersDatabase");
 }
 // v1.10 §10：三態不得合併——「未忽略」是需要處理的狀態，「無法判定」不是，措辭須區分。
 //
@@ -21,13 +20,16 @@ function formatProvidersSource(src, lang) {
 // 已訂輸出目錄屬呼叫端 cwd，checkGitignore 檢查的也是 cwd 所屬的 repo——cwd 與
 // --repo-root 指的目標專案是兩回事（v1.11 §10 修的正是這個基準不一致）。「目標專案」
 // 這個詞在 cwd ≠ repoRoot 時會指錯對象，故改為不預設兩者相同的措辭。
-function formatGitignoreWarning(status, outDir, lang) {
+// 票 cost-cap §E #1：先前檢查的是 outDir（`db:<id>` 這種假路徑，git 永遠判不出結果，
+// 於是被寫死成 "unknown"、印出編出來的理由）。產物已搬進 DB（v1.11 §24.5），真正該檢查
+// 的是資料庫檔案本身的位置——呼叫端（cli.ts）改傳實際解析出的 DB 路徑。
+function formatGitignoreWarning(status, dbPath, lang) {
     if (status === "ignored")
         return null;
     if (status === "not_ignored") {
-        return m(lang, "gitignoreNotIgnored", outDir);
+        return m(lang, "gitignoreNotIgnored", dbPath);
     }
-    return m(lang, "gitignoreUnknown", outDir);
+    return m(lang, "gitignoreUnknown", dbPath);
 }
 // plan_i18n_v1.2.md §6.3：呼叫前提示 lens 收尾句落在哪一個 FIXED_CLOSING_LINE*——只提示不擋
 // （同既有 gitignore 警告），讓 lens 檔案本身的收尾句指示（如「回報最後一行固定為：...」）
@@ -63,13 +65,12 @@ function formatLensClosingLineNotice(spoke, lang) {
 // **這一行讓那個檔不必被找到。** 順帶也解決 `--providers` 覆寫之後 hub 讀到錯的那一份。
 // 缺價目時明講「無價目資料」而不是印 0——與 cost.ts 的 null 語意一致（§4：「無法估算」
 // 與「估算出來是零」不是同一件事）。
-function formatModelPricing(spoke, lang) {
-    const pricing = spoke.providerConfig.pricing?.[spoke.model];
+export function formatModelPricing(pricing, pricingAsOf, lang) {
     if (!pricing)
-        return m(lang, "modelPricingMissing", spoke.model);
+        return m(lang, "noPricingData");
     const cached = pricing.cachedInputPerM !== undefined ? m(lang, "modelPricingCachedSuffix", pricing.cachedInputPerM) : "";
-    const asOf = spoke.providerConfig.pricingAsOf
-        ? m(lang, "modelPricingAsOfSuffix", spoke.providerConfig.pricingAsOf)
+    const asOf = pricingAsOf
+        ? m(lang, "modelPricingAsOfSuffix", pricingAsOf)
         : "";
     return m(lang, "modelPricing", pricing.inputPerM, pricing.outputPerM, cached, asOf);
 }
@@ -88,7 +89,19 @@ export function buildReport(ticketId, spokes, estimates, allowlistEstimates, cli
             `[${spoke.providerConfig.api}] effort=${spoke.effort ?? "—"} lang=${spoke.lang} ` +
             `store=${spoke.providerConfig.store === false ? "false" : "n/a"} ` +
             `est. ${est.toLocaleString()}  cap ${cap.toLocaleString()}`);
-        lines.push(`  ${formatModelPricing(spoke, lang)}`);
+        const pricing = spoke.providerConfig.pricing?.[spoke.model];
+        lines.push(`  ${pricing ? formatModelPricing(pricing, spoke.providerConfig.pricingAsOf, lang) : m(lang, "modelPricingMissing", spoke.model)}`);
+        if (spoke.allowedReadsRelative.length === 0) {
+            lines.push(m(lang, "allowedReadsListEmpty"));
+        }
+        else {
+            for (const path of spoke.allowedReadsRelative.slice(0, 8)) {
+                lines.push(m(lang, "allowedReadsListEntry", path));
+            }
+            const remaining = spoke.allowedReadsRelative.length - 8;
+            if (remaining > 0)
+                lines.push(m(lang, "allowedReadsListFolded", remaining));
+        }
         const closingLineNotice = formatLensClosingLineNotice(spoke, lang);
         if (closingLineNotice)
             lines.push(`  ${closingLineNotice}`);
@@ -134,6 +147,17 @@ export function buildReport(ticketId, spokes, estimates, allowlistEstimates, cli
         lines.push(m(lang, "sequentialReadCostNote"));
     }
     lines.push(m(lang, "worstCaseTotal", worstTotal.toLocaleString()));
+    // 票 cost-cap §B／§C：各 spoke 的絕對上界（B-2 算式）加總，不是取最大（B-3 #2）。
+    // 缺任一 spoke 的價目資料就整體回 null（不得把「不知道」的那部分當 $0 相加）。
+    const hardCapParts = spokes.map((spoke) => {
+        const est = estByAgent.get(spoke.agent) ?? 0;
+        const pricing = spoke.providerConfig.pricing?.[spoke.model];
+        return estimateHardCapUsd(est, cli.maxToolCalls, pricing);
+    });
+    const totalHardCapUsd = hardCapParts.some((p) => p === null)
+        ? null
+        : hardCapParts.reduce((s, p) => s + p, 0);
+    lines.push(totalHardCapUsd !== null ? m(lang, "hardCapLine", totalHardCapUsd.toFixed(4)) : m(lang, "hardCapMissingPricing"));
     lines.push(m(lang, "concurrencyLine", cli.concurrency));
     const byProvider = new Map();
     for (const spoke of spokes) {
@@ -149,13 +173,13 @@ export function buildReport(ticketId, spokes, estimates, allowlistEstimates, cli
         lines.push(m(lang, "tpmPeakCaveat"));
     }
     const allowedCount = spokes.reduce((s, spoke) => s + spoke.allowedReadsResolved.length, 0);
-    lines.push(m(lang, "allowedReadsSummary", allowedCount, outDir));
+    lines.push(m(lang, "allowedReadsSummary", allowedCount));
     // 2026-08-15：待審段落疑似被切斷的警告，排在 gitignore 警告之前——後者關係到產物落在哪，
     // 前者關係到這次派工有沒有意義（付全額、審半份）。
     if (meta.strayHeadings.length > 0) {
         lines.push(m(lang, "strayHeadingsWarning", meta.reviewTextChars, meta.strayHeadings));
     }
-    const gitignoreWarning = formatGitignoreWarning(meta.gitignoreStatus, outDir, lang);
+    const gitignoreWarning = formatGitignoreWarning(meta.gitignoreStatus, meta.dbPath ?? outDir, lang);
     if (gitignoreWarning)
         lines.push(gitignoreWarning);
     return lines.join("\n");

package/dist/runner.js

@@ -26,6 +26,24 @@ function sleep(ms) {
 async function executeToolCall(call, spoke, repoRoot) {
     const requestedPath = typeof call.args.path === "string" ? call.args.path : "";
     const startedAt = Date.now();
+    // D1: DB tickets carry a content snapshot. Do this before checkAllowlist so no
+    // runtime path resolution or file read can leak back into the ticket workflow.
+    if (spoke.readableContent) {
+        const stored = spoke.readableContent.get(requestedPath);
+        if (stored === undefined) {
+            return {
+                resultText: allowlistRejectMessage(spoke.lang),
+                log: { path: requestedPath, allowed: false, reason: "not_in_allowlist", startedAt, durationMs: Date.now() - startedAt },
+            };
+        }
+        const buf = Buffer.from(stored, "utf8");
+        let content = stored;
+        if (buf.byteLength > MAX_FILE_BYTES) {
+            const suffix = spoke.lang === "en" ? FILE_TRUNCATED_SUFFIX_EN : FILE_TRUNCATED_SUFFIX;
+            content = buf.subarray(0, MAX_FILE_BYTES).toString("utf8") + suffix;
+        }
+        return { resultText: content, log: { path: requestedPath, allowed: true, startedAt, durationMs: Date.now() - startedAt } };
+    }
     const check = checkAllowlist(spoke.allowSet, requestedPath, repoRoot);
     if (!check.allowed) {
         return {

package/dist/ticket-store.js

@@ -0,0 +1,195 @@
+import { readFile } from "node:fs/promises";
+import fs from "node:fs";
+import path from "node:path";
+import { DispatchError } from "./types.js";
+import { m } from "./messages.js";
+import { now } from "./db.js";
+import { parseAgentTicket, parseDispatchTable } from "./ticket.js";
+import { isModelEnabled, loadProviders } from "./providers-store.js";
+import { getCommandName } from "./pkg-info.js";
+import { formatModelPricing } from "./report.js";
+import { DEFAULT_MAX_TOOL_CALLS, estimateHardCapUsd } from "./cost.js";
+function parseDoc(raw, name, lang) {
+    try {
+        const value = JSON.parse(raw);
+        if (!value || typeof value !== "object" || !Array.isArray(value.spokes) || typeof value.shared !== "string")
+            throw new Error();
+        return value;
+    }
+    catch {
+        throw new DispatchError(m(lang, "ticketCorrupt", name), 2);
+    }
+}
+export function getTicketDoc(db, name, lang) {
+    const row = db.prepare("SELECT doc FROM tickets WHERE name = ?").get(name);
+    if (!row?.doc)
+        throw new DispatchError(m(lang, "ticketNotFound", name), 2);
+    return parseDoc(row.doc, name, lang);
+}
+function put(db, name, doc) {
+    db.prepare("UPDATE tickets SET doc = ? WHERE name = ?").run(JSON.stringify(doc), name);
+}
+export function createTicket(db, name, shared, lang) {
+    if (!name || name.includes(path.sep) || name === "." || name === "..")
+        throw new DispatchError(m(lang, "ticketNameInvalid", name), 2);
+    try {
+        db.prepare("INSERT INTO tickets (name, doc, created_at) VALUES (?, ?, ?)").run(name, JSON.stringify({ shared, spokes: [] }), now());
+    }
+    catch {
+        throw new DispatchError(m(lang, "ticketAlreadyExists", name), 2);
+    }
+}
+export function addSpoke(db, name, spoke, lang) {
+    const doc = getTicketDoc(db, name, lang);
+    if (doc.spokes.some((item) => item.agent === spoke.agent))
+        throw new DispatchError(m(lang, "duplicateAgentInDispatchTable", spoke.agent, 2), 2);
+    parseAgentTicket(spoke.body, lang);
+    const providers = loadProviders(db, lang);
+    // 熱修補（缺口三）：表整個是空的時候，「白名單為空」這句話會把人帶去查白名單，
+    // 而該做的是把出貨檔匯進來。兩種成因要分開講。
+    if (Object.keys(providers).length === 0) {
+        throw new DispatchError(m(lang, "providersDbEmpty", getCommandName()), 2);
+    }
+    const provider = providers[spoke.provider];
+    if (!provider || !provider.models.includes(spoke.model)) {
+        throw new DispatchError(m(lang, "modelNotWhitelisted", spoke.agent, spoke.model, spoke.provider, provider?.models.join(", ") ?? ""), 2);
+    }
+    if (!isModelEnabled(db, spoke.provider, spoke.model))
+        throw new DispatchError(m(lang, "modelDisabled", spoke.model, getCommandName()), 6);
+    doc.spokes.push({ ...spoke, allow: [] });
+    put(db, name, doc);
+}
+function isUnderDocs(repoRoot, target) {
+    const docs = path.resolve(repoRoot, "_docs");
+    return target === docs || target.startsWith(docs + path.sep);
+}
+export async function addAllow(db, name, agent, rel, repoRoot, lang) {
+    const doc = getTicketDoc(db, name, lang);
+    const spoke = doc.spokes.find((item) => item.agent === agent);
+    if (!spoke)
+        throw new DispatchError(m(lang, "ticketSpokeNotFound", name, agent), 2);
+    const resolved = path.resolve(repoRoot, rel);
+    if (isUnderDocs(repoRoot, resolved))
+        throw new DispatchError(m(lang, "allowedReadsUnderDocs", agent, rel), 2);
+    try {
+        fs.realpathSync(resolved);
+    }
+    catch {
+        throw new DispatchError(m(lang, "allowedReadsPathNotFound", agent, rel), 2);
+    }
+    const content = await readFile(resolved, "utf8");
+    const i = spoke.allow.findIndex((item) => item.path === rel);
+    if (i >= 0)
+        spoke.allow[i] = { path: rel, content };
+    else
+        spoke.allow.push({ path: rel, content });
+    put(db, name, doc);
+}
+export async function importTicketDirectory(db, dir, name, repoRoot, lang) {
+    const dispatch = await readFile(path.join(dir, "_dispatch.md"), "utf8");
+    const shared = await readFile(path.join(dir, "_shared.md"), "utf8");
+    const rows = parseDispatchTable(dispatch, lang);
+    createTicket(db, name, shared, lang);
+    try {
+        for (const row of rows) {
+            const body = await readFile(path.join(dir, `${row.agent}.md`), "utf8");
+            addSpoke(db, name, { ...row, body }, lang);
+            const parsed = parseAgentTicket(body, lang);
+            for (const rel of parsed.allowedReads)
+                await addAllow(db, name, row.agent, rel, repoRoot, lang);
+        }
+    }
+    catch (err) {
+        db.prepare("DELETE FROM tickets WHERE name = ?").run(name);
+        throw err;
+    }
+}
+function getTicketPricing(db, provider, model) {
+    const row = db.prepare(`SELECT p.chars_per_token, p.pricing_source, m.input_per_m, m.cached_input_per_m, m.cache_write_per_m, m.output_per_m
+       FROM providers p LEFT JOIN models m ON m.provider = p.name AND m.model = ?
+      WHERE p.name = ?`).get(model, provider);
+    if (!row)
+        return { charsPerToken: null, pricing: undefined, pricingAsOf: undefined };
+    const hasPrice = row.input_per_m !== null && row.input_per_m !== undefined && row.output_per_m !== null && row.output_per_m !== undefined;
+    let pricingAsOf;
+    try {
+        const source = row.pricing_source === null ? null : JSON.parse(String(row.pricing_source));
+        if (source && typeof source === "object" && typeof source.asOf === "string") {
+            pricingAsOf = source.asOf;
+        }
+    }
+    catch {
+        // A ticket summary must still disclose that this model lacks usable price metadata.
+    }
+    return {
+        charsPerToken: row.chars_per_token === null || row.chars_per_token === undefined ? null : Number(row.chars_per_token),
+        pricing: hasPrice
+            ? {
+                inputPerM: Number(row.input_per_m),
+                outputPerM: Number(row.output_per_m),
+                ...(row.cached_input_per_m === null || row.cached_input_per_m === undefined ? {} : { cachedInputPerM: Number(row.cached_input_per_m) }),
+                ...(row.cache_write_per_m === null || row.cache_write_per_m === undefined ? {} : { cacheWritePerM: Number(row.cache_write_per_m) }),
+            }
+            : undefined,
+        pricingAsOf,
+    };
+}
+// 票 cost-cap §B 的估算輸入沿用「估算 X tokens」那個既有數字（允許清單內容大小，不是真正
+// 的 systemPrompt＋firstUserText）——formatTicket 純吃 DB doc，沒有 repoRoot／lens 檔案系統
+// 可讀，算不出 report.ts 那份真正的初始 prompt 估算。兩邊金額因此不會精確相等（這裡通常較大、
+// 較保守），使用者已裁示接受這個落差（2026-09-06，「這估算都是高估為主的參考值」「本來就
+// 不可能精確的一個值」）。
+function estimateSpokeHardCapUsd(db, spoke, maxToolCalls) {
+    const chars = spoke.allow.reduce((sum, item) => sum + item.content.length, 0);
+    const details = getTicketPricing(db, spoke.provider, spoke.model);
+    const estimatedTokens = Math.ceil(chars / (details.charsPerToken ?? 1));
+    return estimateHardCapUsd(estimatedTokens, maxToolCalls, details.pricing);
+}
+// 工單 approve-tool §A-1 之二：硬上限的數值出口——formatTicket 與 MCP 的 dispatch_approve
+// 共用同一份算法，不得各算各的（否則「摘要上寫 $1.77、核准時卻說金額不符」，使用者無從判斷
+// 誰對）。各 spoke 相加，缺任一 spoke 的價目資料就整體回 null，不得把「不知道」當 $0 相加。
+export function getTicketHardCapUsd(db, name, lang, maxToolCalls = DEFAULT_MAX_TOOL_CALLS) {
+    const doc = getTicketDoc(db, name, lang);
+    const parts = doc.spokes.map((spoke) => estimateSpokeHardCapUsd(db, spoke, maxToolCalls));
+    return parts.some((p) => p === null) ? null : parts.reduce((sum, p) => sum + p, 0);
+}
+export function formatTicket(db, name, lang, maxToolCalls = DEFAULT_MAX_TOOL_CALLS) {
+    const doc = getTicketDoc(db, name, lang);
+    const lines = [m(lang, "ticketShowHeader", name)];
+    for (const spoke of doc.spokes) {
+        const chars = spoke.allow.reduce((sum, item) => sum + item.content.length, 0);
+        const details = getTicketPricing(db, spoke.provider, spoke.model);
+        const estimatedTokens = Math.ceil(chars / (details.charsPerToken ?? 1));
+        lines.push(`  ${spoke.agent}  ${spoke.provider}/${spoke.model}  allow=${spoke.allow.map((a) => a.path).join(", ") || "—"}  ${m(lang, "ticketEstimateTokens", estimatedTokens)}`);
+        lines.push(`  ${details.pricing ? formatModelPricing(details.pricing, details.pricingAsOf, lang) : m(lang, "modelPricingMissing", spoke.model)}`);
+        if (!details.pricing)
+            lines.push(`  ${m(lang, "noPricingData")}`);
+    }
+    const reruns = db.prepare(`SELECT count(*) AS runs, sum(cost_usd) AS total, max(finished_at) AS last
+       FROM jobs WHERE ticket = ? AND status = 'completed'`).get(name);
+    if (Number(reruns.runs) > 0) {
+        if (reruns.total === null)
+            lines.push(m(lang, "ticketCompletedRunsNoPricing", Number(reruns.runs), reruns.last ?? "—"));
+        else
+            lines.push(m(lang, "ticketCompletedRuns", Number(reruns.runs), reruns.total.toFixed(4), reruns.last ?? "—"));
+    }
+    const totalHardCapUsd = getTicketHardCapUsd(db, name, lang, maxToolCalls);
+    if (totalHardCapUsd !== null) {
+        // C-2：新工單（runs=0）或歷史 completed 全無可用價目資料（total===null）時，「典型」
+        // 整段不出現，只印硬上限——不留任何代表 0 的佔位符。
+        const runs = Number(reruns.runs);
+        if (runs > 0 && reruns.total !== null) {
+            lines.push(m(lang, "hardCapWithTypicalLine", (reruns.total / runs).toFixed(4), runs, totalHardCapUsd.toFixed(4)));
+        }
+        else {
+            lines.push(m(lang, "hardCapLine", totalHardCapUsd.toFixed(4)));
+        }
+    }
+    else {
+        lines.push(m(lang, "hardCapMissingPricing"));
+    }
+    return lines.join("\n");
+}
+export function hasResults(db, ticket) {
+    return Boolean(db.prepare("SELECT 1 FROM results WHERE job_id = ? LIMIT 1").get(ticket));
+}

package/dist/ticket.js

@@ -4,6 +4,7 @@ import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { DispatchError } from "./types.js";
 import { m } from "./messages.js";
+import { getTicketDoc } from "./ticket-store.js";
 const FORMAT_MARKER = "<!-- format: v1 -->";
 function splitTableRow(line) {
     const trimmed = line.trim().replace(/^\|/, "").replace(/\|$/, "");
@@ -167,7 +168,7 @@ export function parseAgentTicket(markdown, lang) {
     return { questions, allowedReads };
 }
 // 檔案系統存取層：讀工單目錄、組出完整 Ticket。
-export async function loadTicket(ticketDir, lang) {
+async function loadTicketDirectory(ticketDir, lang) {
     const dispatchPath = path.join(ticketDir, "_dispatch.md");
     const sharedPath = path.join(ticketDir, "_shared.md");
     let dispatchText;
@@ -200,3 +201,23 @@ export async function loadTicket(ticketDir, lang) {
     }
     return { ticketDir, rows, shared, perAgent };
 }
+export async function loadTicket(source, nameOrLang, maybeLang) {
+    if (typeof source === "string")
+        return loadTicketDirectory(source, nameOrLang);
+    const name = nameOrLang;
+    const lang = maybeLang;
+    const doc = getTicketDoc(source, name, lang);
+    const shared = parseSharedDoc(doc.shared, lang);
+    const rows = doc.spokes.map(({ agent, provider, model, effort }) => ({ agent, provider, model, effort }));
+    const perAgent = new Map();
+    const allowedContent = new Map();
+    const ticketDir = `ticket/${name}`;
+    allowedContent.set(`${ticketDir}/_shared.md`, doc.shared);
+    for (const spoke of doc.spokes) {
+        perAgent.set(spoke.agent, parseAgentTicket(spoke.body, lang));
+        allowedContent.set(`${ticketDir}/${spoke.agent}.md`, spoke.body);
+        for (const allowed of spoke.allow)
+            allowedContent.set(allowed.path, allowed.content);
+    }
+    return { ticketDir, ticketName: name, rows, shared, perAgent, allowedContent };
+}

package/dist/validate.js

@@ -8,9 +8,7 @@ import { DispatchError } from "./types.js";
 import { stripFrontmatter } from "./ticket.js";
 import { buildAllowSet } from "./whitelist.js";
 import { m } from "./messages.js";
-function apiKeyEnvFor(provider) {
-    return `${provider.toUpperCase()}_API_KEY`;
-}
+import { getCommandName } from "./pkg-info.js";
 async function readAgentBody(agentsDir, agent, lang) {
     const agentDefPath = path.join(agentsDir, `${agent}.md`);
     let text;
@@ -29,22 +27,38 @@ function isUnderDocsDir(repoRoot, resolved) {
 export async function resolveSpokes(ticket, providers, repoRoot, 
 // plan_i18n_v1.3.md §一之3 第 3 點：必填、不得有預設值——有預設值的話呼叫端漏傳會
 // 靜默回退成舊來源，連紅字都沒有，等同「傳了但傳的是舊來源」那種型別系統看不見的錯誤。
-lang, agentsDir = path.join(repoRoot, ".claude", "agents")) {
+lang, 
+// 熱修補：本參數原本有 `= () => true` 的預設值，於是 cli.ts 的接線被拿掉之後
+// 463 條測試全綠——「函式對」不代表「有人在對的時機叫它」。上面那段講 lang 的理由
+// 一字不改地適用於這裡，故改為必填並移到 agentsDir 之前（必填參數不得跟在選填之後）。
+isModelEnabled, 
+// 同上：必填、不得有預設值。0.5.0 起 API key 的唯一來源是 DB 的 `provider_keys` 表，
+// 而本模組不持有 db handle——比照 isModelEnabled 收一個回呼，由 cli.ts 接上。
+// 原本這裡直接讀 `process.env[`${PROVIDER}_API_KEY`]`，key 搬進 DB 之後那段就成了
+// 一道「更早的、只認環境變數」的閘門，會在 createAdapterFor 之前先攔下所有派工。
+hasApiKey, agentsDir = path.join(repoRoot, ".claude", "agents")) {
     const resolved = [];
+    // 熱修補（缺口三）：同 ticket-store——空表要講「去匯入」，
+    // 不要讓 providerUndefinedInRow 把人帶去查工單裡的 provider 名稱。
+    if (Object.keys(providers).length === 0) {
+        throw new DispatchError(m(lang, "providersDbEmpty", getCommandName()), 2);
+    }
     for (const row of ticket.rows) {
         const providerConfig = providers[row.provider];
         if (!providerConfig) {
             throw new DispatchError(m(lang, "providerUndefinedInRow", row.agent, row.provider), 2);
         }
         // §18：只檢查本次工單用到的 provider，缺即中止。
-        const envName = apiKeyEnvFor(row.provider);
-        if (!process.env[envName]) {
-            throw new DispatchError(m(lang, "missingEnvVar", envName, row.agent, row.provider), 2);
+        if (!hasApiKey(row.provider)) {
+            throw new DispatchError(m(lang, "apiKeyNotConfigured", row.agent, row.provider, getCommandName()), 2);
         }
-        // §5：model 須在 providers.json 的 models 白名單內；白名單為空 = 不做型號檢查。
-        if (providerConfig.models.length > 0 && !providerConfig.models.includes(row.model)) {
+        // A-1: parser guarantees this whitelist is non-empty; never leave a bypass.
+        if (!providerConfig.models.includes(row.model)) {
             throw new DispatchError(m(lang, "modelNotWhitelisted", row.agent, row.model, row.provider, providerConfig.models.join(", ")), 2);
         }
+        if (!isModelEnabled(row.provider, row.model)) {
+            throw new DispatchError(m(lang, "modelDisabled", row.model, getCommandName()), 6);
+        }
         // §4：effort 填了但不在該 provider 的 allowed 內即中止（含 allowed 為空陣列）。
         if (row.effort !== undefined && !providerConfig.reasoning.allowed.includes(row.effort)) {
             const list = providerConfig.reasoning.allowed.length > 0
@@ -65,24 +79,45 @@ lang, agentsDir = path.join(repoRoot, ".claude", "agents")) {
         }
         // §4「針對 hub 會寫錯」：_docs/ 一律拒絕；允許清單逐一驗證存在，任一不存在即中止並指名。
         const allowedReadsResolved = [];
-        for (const rel of agentTicket.allowedReads) {
-            const resolvedPath = path.resolve(repoRoot, rel);
-            if (isUnderDocsDir(repoRoot, resolvedPath)) {
-                throw new DispatchError(m(lang, "allowedReadsUnderDocs", row.agent, rel), 2);
+        const allowedReadsContent = [];
+        const readableContent = ticket.allowedContent ? new Map() : undefined;
+        if (ticket.allowedContent) {
+            const dbContent = readableContent;
+            for (const rel of agentTicket.allowedReads) {
+                const content = ticket.allowedContent.get(rel);
+                if (content === undefined)
+                    throw new DispatchError(m(lang, "allowedReadsPathNotFound", row.agent, rel), 2);
+                allowedReadsResolved.push(rel);
+                allowedReadsContent.push(content);
+                dbContent.set(rel, content);
             }
-            let real;
-            try {
-                real = fs.realpathSync(resolvedPath);
-            }
-            catch {
-                throw new DispatchError(m(lang, "allowedReadsPathNotFound", row.agent, rel), 2);
+            const sharedKey = `${ticket.ticketDir}/_shared.md`;
+            const ownKey = `${ticket.ticketDir}/${row.agent}.md`;
+            dbContent.set(sharedKey, ticket.allowedContent.get(sharedKey) ?? "");
+            dbContent.set(ownKey, ticket.allowedContent.get(ownKey) ?? "");
+        }
+        else {
+            for (const rel of agentTicket.allowedReads) {
+                const resolvedPath = path.resolve(repoRoot, rel);
+                if (isUnderDocsDir(repoRoot, resolvedPath)) {
+                    throw new DispatchError(m(lang, "allowedReadsUnderDocs", row.agent, rel), 2);
+                }
+                let real;
+                try {
+                    real = fs.realpathSync(resolvedPath);
+                }
+                catch {
+                    throw new DispatchError(m(lang, "allowedReadsPathNotFound", row.agent, rel), 2);
+                }
+                allowedReadsResolved.push(real);
             }
-            allowedReadsResolved.push(real);
         }
         const agentBody = await readAgentBody(agentsDir, row.agent, lang);
         const sharedPath = path.join(ticket.ticketDir, "_shared.md");
         const ownAgentPath = path.join(ticket.ticketDir, `${row.agent}.md`);
-        const allowSet = buildAllowSet([sharedPath, ownAgentPath, ...allowedReadsResolved]);
+        const allowSet = ticket.allowedContent
+            ? new Set(ticket.allowedContent.keys())
+            : buildAllowSet([sharedPath, ownAgentPath, ...allowedReadsResolved]);
         resolved.push({
             agent: row.agent,
             provider: row.provider,
@@ -94,6 +129,8 @@ lang, agentsDir = path.join(repoRoot, ".claude", "agents")) {
             allowSet,
             allowedReadsResolved,
             allowedReadsRelative: agentTicket.allowedReads,
+            allowedReadsContent: ticket.allowedContent ? allowedReadsContent : undefined,
+            readableContent,
             lang,
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dowafu",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Send a section of your design doc to external LLMs for review. They read only the files you whitelist, and nothing is billed until you confirm.",
   "keywords": [
     "llm",
@@ -46,7 +46,6 @@
     "prepublishOnly": "npm run test && npm run lint && npm run typecheck && npm run build"
   },
   "dependencies": {
-    "dotenv": "^16.4.5",
     "openai": "^4.68.4"
   },
   "devDependencies": {

package/providers.json

@@ -14,11 +14,11 @@
     "charsPerToken": 1.0,
     "tpmLimit": 200000,
     "maxSpokeTokens": null,
-    "pricingSource": { "url": "https://developers.openai.com/api/docs/pricing", "asOf": "2026-08-09" },
+    "pricingSource": { "url": "https://developers.openai.com/api/docs/pricing", "asOf": "2026-09-02", "note": "gpt-5.6-sol 為優惠價，官方頁載明至 2026-11-21" },
     "pricing": {
       "gpt-5.6-luna": { "inputPerM": 0.20, "cachedInputPerM": 0.02, "outputPerM": 1.20 },
       "gpt-5.6-terra": { "inputPerM": 2.00, "cachedInputPerM": 0.20, "outputPerM": 12.00 },
-      "gpt-5.6-sol": { "inputPerM": 5.00, "cachedInputPerM": 0.50, "outputPerM": 30.00 }
+      "gpt-5.6-sol": { "inputPerM": 4.00, "cachedInputPerM": 0.40, "outputPerM": 20.00 }
     }
   },
   "deepseek": {
@@ -37,8 +37,8 @@
     "maxSpokeTokens": null,
     "pricingSource": {
       "url": "https://api-docs.deepseek.com/quick_start/pricing/",
-      "asOf": "2026-08-14",
-      "note": "本表填的是 2026-08-16 16:00 UTC 起生效的尖峰價。在此之前官方仍收舊價（flash 0.0028／0.14／0.28、pro 0.003625／0.435／0.87），所以生效前本表偏高。離峰（尖峰時段 01:00-04:00 與 06:00-10:00 UTC 以外）為尖峰的一半；本檔一個型號只放得下一組價，取尖峰＝取上限。"
+      "asOf": "2026-09-02",
+      "note": "離峰（尖峰時段 01:00-04:00 與 06:00-10:00 UTC 以外）為尖峰的一半；本檔一個型號只放得下一組價，取尖峰＝取上限。"
     },
     "pricing": {
       "deepseek-v4-flash": { "inputPerM": 0.44, "cachedInputPerM": 0.014, "outputPerM": 1.32 },
@@ -55,15 +55,16 @@
       "allowed": ["minimal", "low", "medium", "high"],
       "default": "high"
     },
-    "models": ["gemini-3.1-flash-lite", "gemini-3.5-flash-lite", "gemini-3.6-flash"],
+    "models": ["gemini-3.1-flash-lite", "gemini-3.5-flash-lite", "gemini-3.6-flash", "gemini-3.7-flash"],
     "charsPerToken": 1.0,
     "tpmLimit": null,
     "maxSpokeTokens": null,
-    "pricingSource": { "url": "https://ai.google.dev/gemini-api/docs/pricing", "asOf": "2026-08-09", "note": "文字／圖片／影片價；音訊另計。output 價含 thinking tokens" },
+    "pricingSource": { "url": "https://ai.google.dev/gemini-api/docs/pricing", "asOf": "2026-09-02", "note": "文字／圖片／影片價；音訊另計。output 價含 thinking tokens。gemini-3.6-flash／gemini-3.7-flash 為優惠價，官方頁載明至 2026-12-31；2027-01-01 起漲為 $1.50 in／$7.50 out（兩者皆是）" },
     "pricing": {
       "gemini-3.1-flash-lite": { "inputPerM": 0.25, "cachedInputPerM": 0.025, "outputPerM": 1.50 },
       "gemini-3.5-flash-lite": { "inputPerM": 0.30, "cachedInputPerM": 0.03, "outputPerM": 2.50 },
-      "gemini-3.6-flash": { "inputPerM": 1.50, "cachedInputPerM": 0.15, "outputPerM": 7.50 }
+      "gemini-3.6-flash": { "inputPerM": 0.75, "cachedInputPerM": 0.075, "outputPerM": 3.75 },
+      "gemini-3.7-flash": { "inputPerM": 0.75, "cachedInputPerM": 0.075, "outputPerM": 3.75 }
     }
   },
   "anthropic": {
@@ -76,14 +77,15 @@
       "allowed": ["low", "medium", "high", "xhigh", "max"],
       "default": "high"
     },
-    "models": ["claude-opus-5", "claude-sonnet-5"],
+    "models": ["claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5-20251001"],
     "charsPerToken": 1.0,
     "tpmLimit": null,
     "maxSpokeTokens": null,
-    "pricingSource": { "url": "https://platform.claude.com/docs/en/about-claude/pricing", "asOf": "2026-08-09", "note": "sonnet-5 為 2026-08-31 前的優惠價，之後為 3.00／15.00" },
+    "pricingSource": { "url": "https://platform.claude.com/docs/en/about-claude/pricing", "asOf": "2026-09-02", "note": "claude-sonnet-5 的 $2／$10 原為上市優惠價（原訂 2026-08-31 到期、2026-09-01 漲為 $3／$15）；官方頁已載明該調漲不會發生，此價已成常態價。" },
     "pricing": {
       "claude-opus-5": { "inputPerM": 5.00, "cachedInputPerM": 0.50, "cacheWritePerM": 6.25, "outputPerM": 25.00 },
-      "claude-sonnet-5": { "inputPerM": 2.00, "cachedInputPerM": 0.20, "cacheWritePerM": 2.50, "outputPerM": 10.00 }
+      "claude-sonnet-5": { "inputPerM": 2.00, "cachedInputPerM": 0.20, "cacheWritePerM": 2.50, "outputPerM": 10.00 },
+      "claude-haiku-4-5-20251001": { "inputPerM": 1.00, "cachedInputPerM": 0.10, "cacheWritePerM": 1.25, "outputPerM": 5.00 }
     }
   }
 }