dsh-lcx-codex 0.4.3 → 0.5.0-pre.1

package/lib/pi086-responses-allowlist.js

@@ -0,0 +1,131 @@
+// Generated by scripts/generate-pi086-allowlist.mjs from the Pi 0.86.0
+// openai-responses catalog snapshot in data/pi086-responses-models.json.
+// Source: Issue #90 Step 0(c) probe/dump.mjs, runtime/pi-catalog/catalog-v0.86.0.json.
+// Keep provider and model paired: an id on another provider has separate authority.
+const responsesModels = {
+    "cloudflare-ai-gateway": [
+        "gpt-4.1",
+        "gpt-4.1-mini",
+        "gpt-4.1-nano",
+        "gpt-4o",
+        "gpt-4o-mini",
+        "gpt-5",
+        "gpt-5-mini",
+        "gpt-5-nano",
+        "gpt-5.1",
+        "gpt-5.4",
+        "gpt-5.4-mini",
+        "gpt-5.4-nano",
+        "gpt-5.4-pro",
+        "gpt-5.5",
+        "gpt-5.5-pro",
+        "gpt-5.6-luna",
+        "gpt-5.6-sol",
+        "gpt-5.6-terra",
+        "gpt-6-astra",
+        "o3",
+        "o3-mini",
+        "o4-mini"
+    ],
+    "github-copilot": [
+        "gpt-5-mini",
+        "gpt-5.3-codex",
+        "gpt-5.4",
+        "gpt-5.4-mini",
+        "gpt-5.4-nano",
+        "gpt-5.5",
+        "gpt-5.6-luna",
+        "gpt-5.6-sol",
+        "gpt-5.6-terra",
+        "gpt-6-astra",
+        "grok-4.5",
+        "grok-4.6",
+        "mai-code-1-flash-picker",
+        "mai-code-1.1-flash"
+    ],
+    "openai": [
+        "gpt-4",
+        "gpt-4-turbo",
+        "gpt-4.1",
+        "gpt-4.1-mini",
+        "gpt-4.1-nano",
+        "gpt-4o",
+        "gpt-4o-2024-05-13",
+        "gpt-4o-2024-08-06",
+        "gpt-4o-2024-11-20",
+        "gpt-4o-mini",
+        "gpt-5",
+        "gpt-5-chat-latest",
+        "gpt-5-mini",
+        "gpt-5-nano",
+        "gpt-5-pro",
+        "gpt-5.1",
+        "gpt-5.2",
+        "gpt-5.2-chat-latest",
+        "gpt-5.2-pro",
+        "gpt-5.3-chat-latest",
+        "gpt-5.3-codex",
+        "gpt-5.3-codex-spark",
+        "gpt-5.4",
+        "gpt-5.4-mini",
+        "gpt-5.4-nano",
+        "gpt-5.4-pro",
+        "gpt-5.5",
+        "gpt-5.5-pro",
+        "gpt-5.6-luna",
+        "gpt-5.6-sol",
+        "gpt-5.6-terra",
+        "gpt-6-astra",
+        "gpt-realtime-2.1",
+        "o1",
+        "o1-pro",
+        "o3",
+        "o3-mini",
+        "o3-pro",
+        "o4-mini"
+    ],
+    "opencode": [
+        "gpt-5",
+        "gpt-5-codex",
+        "gpt-5-nano",
+        "gpt-5.1",
+        "gpt-5.1-codex",
+        "gpt-5.1-codex-max",
+        "gpt-5.1-codex-mini",
+        "gpt-5.2",
+        "gpt-5.2-codex",
+        "gpt-5.3-codex",
+        "gpt-5.4",
+        "gpt-5.4-mini",
+        "gpt-5.4-nano",
+        "gpt-5.4-pro",
+        "gpt-5.5",
+        "gpt-5.5-pro",
+        "gpt-5.6-luna",
+        "gpt-5.6-sol",
+        "gpt-5.6-terra",
+        "gpt-6-astra",
+        "grok-4.5",
+        "grok-4.6",
+        "grok-build-0.1",
+        "muse-spark-1.2",
+        "muse-spark-1.2-contributor-free",
+        "muse-spark-1.3",
+        "muse-spark-1.3-contributor-free"
+    ],
+    "opencode-go": [
+        "gpt-5.6-luna",
+        "grok-4.6",
+        "muse-spark-1.2-contributor",
+        "muse-spark-1.3-contributor"
+    ],
+    "xai": [
+        "grok-4.3",
+        "grok-4.5",
+        "grok-4.6"
+    ]
+};
+export function wasPi086ResponsesModel(provider, model) {
+    const ids = responsesModels[provider];
+    return ids?.includes(model) ?? false;
+}

package/lib/responses-request.js

@@ -66,7 +66,7 @@ export function responsesGenerationEnvelope({ model = "unknown", reasoningEffort
     return result;
 }
 /**
- * Build the shared LCX-owned request envelope while retaining Pi 0.85.1 Responses semantics.
+ * Build the shared LCX-owned request envelope while retaining Pi 0.86.0 Responses semantics.
  * Production LCX ordinary/compact/replay construction places the DSH system prompt in canonical input.
  * @param {BuildResponsesBodyOptions} options
  */
@@ -84,7 +84,7 @@ export function buildResponsesBody({ model, input, tools, sessionId, promptCache
     const longRetention = retention === "long" && compat.supportsExplicitPromptCacheMode !== true
         ? promptCacheRetention ?? (compat.supportsLongCacheRetention === true ? "24h" : undefined)
         : undefined;
-    // Pi 0.85.1 uses explicit 30m only for long retention; short is implicit.
+    // Pi 0.86.0 uses explicit 30m only for long retention; short is implicit.
     const currentCache = retention === "long" && compat.supportsLongCacheRetention === true && compat.supportsExplicitPromptCacheMode === true;
     const explicitCache = retention === "none" && compat.supportsExplicitPromptCacheMode === true;
     const promptCacheOptions = currentCache

package/lib/responses-stream.js

@@ -1,8 +1,16 @@
 // @ts-check
 import { createAssistantMessageEventStream, processResponsesStream, } from "./pi-responses-runtime.js";
-import { ToolCallId } from "@deepseek-ai/dsh-llm";
+import { abortError } from "./abort-error.js";
+import { IMAGE_OFFLOAD_REQUIRED_CODE, ToolCallId } from "@deepseek-ai/dsh-llm";
 import { fetchSseWithRetry } from "./transport.js";
+import { sanitizeContextDetails } from "./search-accounting.js";
 import { createGrokNativeReplayEnvelope, grokPendingSourcesStart, sanitizeGrokVisibleText, } from "./grok-native-search.js";
+/** Durable LCX-only pressure evidence; canonical usage stays on Pi/DSH billing. */
+function responseUsageMarker(meta) {
+    return { version: 1, inputTokenScope: meta.inputTokenScope,
+        ...(meta.inputTokenScope === 'aggregate' && meta.contextDetails
+            ? { contextDetails: meta.contextDetails, contextProvenance: 'provider-context-details' } : {}) };
+}
 function emptyUsage() {
     return {
         input: 0,
@@ -159,7 +167,35 @@ export function managedFailure(error, signal) {
     };
 }
 /** @param {unknown} error @param {AbortSignal} [signal] */
+/**
+ * The host image-offload contract, when this failure carries it.
+ *
+ * `IMAGE_OFFLOAD_REQUIRED` is not an LCX failure class: it is a request the
+ * route makes of DSH's durable image-offload owner, which matches on the exact
+ * code and `offloadImages` count before recording an `image/offload` decision
+ * and retrying. Normalizing it into the closed LCX taxonomy would drop both
+ * fields and turn a recoverable step into a terminal turn failure.
+ * @param {unknown} error
+ * @returns {LlmFailure | undefined}
+ */
+function imageOffloadFailure(error) {
+    if (!isObject(error))
+        return undefined;
+    const source = isObject(error.failure) ? error.failure : error;
+    if (source.code !== IMAGE_OFFLOAD_REQUIRED_CODE)
+        return undefined;
+    const offloadImages = source.offloadImages;
+    if (!Number.isSafeInteger(offloadImages) || offloadImages <= 0)
+        return undefined;
+    const message = typeof source.message === "string" && source.message.length > 0
+        ? source.message
+        : "Request images exceed the route budget";
+    return { message, code: IMAGE_OFFLOAD_REQUIRED_CODE, offloadImages: offloadImages };
+}
 export function managedFailureChunk(error, signal) {
+    const offload = imageOffloadFailure(error);
+    if (offload !== undefined)
+        return { type: "finish", reason: { kind: "error", failure: offload } };
     const managed = managedFailure(error, signal);
     const failure = {
         message: managed.message,
@@ -180,9 +216,9 @@ async function readWithSignal(reader, signal) {
     if (!signal)
         return reader.read();
     if (signal.aborted)
-        throw signal.reason;
+        throw abortError(signal);
     return new Promise((resolve, reject) => {
-        const onAbort = () => reject(signal.reason);
+        const onAbort = () => reject(abortError(signal));
         signal.addEventListener("abort", onAbort, { once: true });
         reader.read().then(resolve, reject).finally(() => {
             signal.removeEventListener("abort", onAbort);
@@ -285,8 +321,7 @@ async function* responseEvents(response, options = {}) {
     try {
         while (true) {
             if (options.signal?.aborted)
-                throw (options.signal.reason ??
-                    Object.assign(new Error("request aborted"), { code: "LCX_ABORTED" }));
+                throw abortError(options.signal);
             const { done, value } = await readWithSignal(reader, options.signal);
             if (done)
                 break;
@@ -654,6 +689,7 @@ async function* normalizedResponseEvents(source, meta = {}, options = {}) {
     const isServerToolItem = (value) => isObject(value) && (options.serverToolTypes?.has(String(value.type ?? "")) === true ||
         options.isServerToolItem?.(value) === true);
     const observeServerTool = (item) => {
+        meta.inputTokenScope = "aggregate";
         const type = String(item.type);
         if (type === "custom_tool_call" && typeof item.call_id === "string")
             nativeServerSearchEchoCallIds.add(item.call_id);
@@ -683,6 +719,22 @@ async function* normalizedResponseEvents(source, meta = {}, options = {}) {
         if (!isObject(raw))
             continue;
         const event = /** @type {UnknownRecord} */ raw;
+        if (options.serverToolTypes && ['response.completed', 'response.failed', 'response.incomplete'].includes(String(event.type))) {
+            meta.contextDetails = sanitizeContextDetails(isObject(event.response) && isObject(event.response.usage)
+                ? event.response.usage.context_details : undefined);
+        }
+        // Scope is response-local evidence, including failed/incomplete terminal samples.
+        if (options.serverToolTypes && isObject(event.response)) {
+            const response = event.response;
+            const usage = isObject(response.usage) ? response.usage : {};
+            const details = isObject(usage.server_side_tool_usage_details) ? usage.server_side_tool_usage_details : {};
+            if (Number(usage.num_server_side_tools_used ?? 0) > 0 ||
+                Number(details.web_search_calls ?? 0) > 0 || Number(details.x_search_calls ?? 0) > 0)
+                meta.inputTokenScope = "aggregate";
+            if (Array.isArray(response.output))
+                if (response.output.some(isServerToolItem))
+                    meta.inputTokenScope = "aggregate";
+        }
         const index = Number.isInteger(event.output_index)
             ? Number(event.output_index)
             : 0;
@@ -872,7 +924,7 @@ async function* normalizedResponseEvents(source, meta = {}, options = {}) {
                 meta.nativeServerSearchEchoCallIds = [...nativeServerSearchEchoCallIds];
                 const usage = isObject(response.usage) ? response.usage : {};
                 const details = isObject(usage.server_side_tool_usage_details) ? usage.server_side_tool_usage_details : {};
-                meta.inputTokenScope = serverToolIds.size > 0 || nativeOutput.some(isServerToolItem)
+                meta.inputTokenScope = meta.inputTokenScope === "aggregate" || serverToolIds.size > 0 || nativeOutput.some(isServerToolItem)
                     || Number(usage.num_server_side_tools_used ?? 0) > 0
                     || Number(details.web_search_calls ?? 0) > 0 || Number(details.x_search_calls ?? 0) > 0
                     ? "aggregate" : "request";
@@ -1222,7 +1274,7 @@ async function* toDshChunks(events, signal, wireMeta, nativeReplayRoute) {
                     reason,
                     ...(replay === undefined && !nativeReplayRoute ? {} : { replayState: {
                             ...replay,
-                            response: { ...replay?.response, ...(nativeReplayRoute ? { lcxUsage: { version: 1, inputTokenScope: wireMeta?.inputTokenScope ?? "aggregate" } } : {}) },
+                            response: { ...replay?.response, ...(nativeReplayRoute && wireMeta?.inputTokenScope ? { lcxUsage: responseUsageMarker(wireMeta) } : {}) },
                         } }),
                 };
                 return;
@@ -1252,7 +1304,7 @@ async function* toDshChunks(events, signal, wireMeta, nativeReplayRoute) {
                     reason: normalizedFailure.code === "ABORTED"
                         ? { kind: "aborted", failure: normalizedFailure }
                         : { kind: "error", failure: normalizedFailure },
-                    ...(nativeReplayRoute ? { replayState: { response: { lcxUsage: { version: 1, inputTokenScope: "aggregate" } } } } : {}),
+                    ...(nativeReplayRoute && wireMeta?.inputTokenScope ? { replayState: { response: { lcxUsage: responseUsageMarker(wireMeta) } } } : {}),
                 };
                 return;
             }
@@ -1312,8 +1364,7 @@ export async function* streamResponsesRequest({ baseURL, provider, model, piMode
                     wireMeta.responseModel.length > 0)
                     output.responseModel = wireMeta.responseModel;
                 if (signal?.aborted)
-                    throw (signal.reason ??
-                        Object.assign(new Error("request aborted"), { code: "LCX_ABORTED" }));
+                    throw abortError(signal);
                 if (output.stopReason === "pending")
                     throw Object.assign(new Error("Responses stream ended without a stop reason"), { code: "LCX_INVALID_SSE" });
                 if (output.stopReason === "aborted" || output.stopReason === "error")
@@ -1344,7 +1395,7 @@ export async function* streamResponsesRequest({ baseURL, provider, model, piMode
             while (true) {
                 const result = await chunks.next();
                 if (watchdog.signal.aborted)
-                    throw watchdog.signal.reason;
+                    throw abortError(watchdog.signal);
                 if (result.done) {
                     exhausted = true;
                     watchdog.disarm();

package/lib/route.js

@@ -4,6 +4,7 @@ import { SessionId } from "@deepseek-ai/dsh-session";
 import "@deepseek-ai/dsh-settings";
 import { attributionHeaders, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { getBuiltinModels, getBuiltinProviders, } from "./pi-responses-runtime.js";
+import { wasPi086ResponsesModel } from "./pi086-responses-allowlist.js";
 /** @param {unknown} value */
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -15,16 +16,6 @@ function isPositiveInteger(value) {
 function isPositiveFinite(value) {
     return typeof value === "number" && Number.isFinite(value) && value > 0;
 }
-function asLlmSettingsSection(value) {
-    if (!isRecord(value))
-        return undefined;
-    const providers = value.providers;
-    if (providers === undefined)
-        return {};
-    if (!isRecord(providers))
-        return undefined;
-    return { providers: providers };
-}
 /** @param {unknown} value */
 export function normalizeBaseURL(value) {
     return String(value ?? "").trim().replace(/\/+$/u, "");
@@ -98,22 +89,24 @@ function retryAttempts(policy, fallback = 3) {
     catch { }
     return fallback;
 }
-/** @param {RouteContext | null | undefined} ctx @param {string} namespace */
-export function settingsValue(ctx, namespace) {
-    return asLlmSettingsSection(ctx?.settings?.get(namespace));
-}
-/** The DSH 0.1.5 contract exposes deferred provider diagnostics separately from saved settings. */
-function providerDirectoryUsable(ctx, provider) {
-    const llm = ctx?.llm;
-    const list = llm?.listConfigurableProviders;
-    if (typeof list !== "function")
-        return true;
+/** Follow the live directory entry to its SettingsForms profile. */
+function configuredProviderProfile(ctx, provider) {
+    // Only llm-pi-ai profiles: other provider plugins' profiles are not LCX routes (Decision 8).
     try {
-        const entry = list.call(llm).find((candidate) => candidate.provider === provider && candidate.settingsNs === "llm-pi-ai");
-        return typeof entry?.error !== "string" || entry.error.trim() === "";
+        const entry = ctx?.llm.listConfigurableProviders().find((candidate) => candidate.provider === provider && candidate.settingsNs === "llm-pi-ai");
+        if (!entry || (typeof entry.error === "string" && entry.error.trim()))
+            return undefined;
+        const descriptor = ctx?.settings.describe().find((candidate) => candidate.ns === entry.settingsNs);
+        let value = descriptor?.value;
+        for (const segment of entry.settingsPath) {
+            if (!isRecord(value))
+                return undefined;
+            value = value[segment];
+        }
+        return isRecord(value) ? value : undefined;
     }
     catch {
-        return false;
+        return undefined;
     }
 }
 /** @type {Set<keyof ResponsesCompat>} */
@@ -135,6 +128,9 @@ function copyResponsesCompat(target, source) {
 /** @param {unknown} provider @param {unknown} modelId */
 function builtinResponsesModel(provider, modelId) {
     const providerName = String(provider ?? "");
+    // A newer plugin-Pi catalog must not grant LCX a route that Pi 0.86 lacked.
+    if (!wasPi086ResponsesModel(providerName, String(modelId ?? "")))
+        return undefined;
     const builtinProvider = getBuiltinProviders().find((candidate) => candidate === providerName);
     if (builtinProvider === undefined)
         return undefined;
@@ -210,10 +206,9 @@ function isLcxCapabilityRoute(provider, model) {
 export function resolveResponsesRouteConfig(ctx, options, policy) {
     const provider = String(options?.provider ?? "");
     const model = String(options?.model ?? "");
-    if (!provider.trim() || !/^gpt-/iu.test(model) || !providerDirectoryUsable(ctx, provider))
+    if (!provider.trim() || !/^gpt-/iu.test(model))
         return undefined;
-    const section = settingsValue(ctx, "llm-pi-ai");
-    const profile = section?.providers?.[provider];
+    const profile = configuredProviderProfile(ctx, provider);
     const lcxCapabilityRoute = isLcxCapabilityRoute(provider, model);
     if (!isRecord(profile))
         return undefined;
@@ -268,10 +263,9 @@ export function resolveResponsesRouteConfig(ctx, options, policy) {
 export function resolveGrokResponsesRouteConfig(ctx, options, policy) {
     const provider = String(options?.provider ?? "");
     const model = String(options?.model ?? "");
-    if (!provider.trim() || !/^grok/iu.test(model) || !providerDirectoryUsable(ctx, provider))
+    if (!provider.trim() || !/^grok/iu.test(model))
         return undefined;
-    const section = settingsValue(ctx, "llm-pi-ai");
-    const configured = section?.providers?.[provider];
+    const configured = configuredProviderProfile(ctx, provider);
     if (!isRecord(configured))
         return undefined;
     const selectedBuiltin = builtinResponsesModel(provider, model);
@@ -337,9 +331,6 @@ export async function resolveApiKey(ctx, config) {
     const resolved = await ctx?.credentials.resolve(credentialRef(config.apiKeyEnv));
     if (resolved?.value.trim())
         return resolved.value.trim();
-    const ambient = String(process.env[config.apiKeyEnv] ?? "").trim();
-    if (ambient)
-        return ambient;
     const error = new Error(`DSH provider credential is unavailable: ${config.apiKeyEnv}`);
     error.code = "LCX_CREDENTIAL_UNAVAILABLE";
     throw error;

package/lib/search-accounting.js

@@ -1,5 +1,11 @@
 export const object = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 const count = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+/** Copy only complete, safe counters; provider extensions never enter durable metadata. */
+export function sanitizeContextDetails(value) {
+    if (!object(value) || !count(value.input_tokens) || !count(value.output_tokens))
+        return;
+    return { input_tokens: value.input_tokens, output_tokens: value.output_tokens };
+}
 export const zeroBuckets = () => ({ uncachedInputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0 });
 export const isSearchTool = (name) => name === 'web_search' || name === 'websearch_gpt_advanced';
 export function auxiliaryUsageOf(event, toolName) {
@@ -69,6 +75,12 @@ export function addTurnUsage(base, records) {
 }
 /** The metadata is presentation/accounting state; it never changes request messages. */
 export function aggregateContextOf(event) {
+    const mark = contextMarkerOf(event);
+    if (mark === undefined)
+        return;
+    return mark?.version === 1 && mark.inputTokenScope === 'aggregate';
+}
+function contextMarkerOf(event) {
     if (!object(event) || !['assistant/message', 'assistant/attempt'].includes(event.type) || !object(event.data))
         return;
     const chunks = Array.isArray(event.data.stream) ? event.data.stream.filter((e) => e.type === 'chunk').map((e) => e.chunk) : [];
@@ -77,10 +89,14 @@ export function aggregateContextOf(event) {
         return;
     const replay = chunks.findLast((c) => c?.type === 'finish')?.replayState;
     const mark = replay?.response?.lcxUsage;
-    if (mark?.version === 1 && ['request', 'aggregate'].includes(mark.inputTokenScope))
-        return mark.inputTokenScope === 'aggregate';
-    // Read the already-installed local candidate without rewriting its logs.
-    if (sample.inputTokenScope === 'aggregate' || sample.inputTokenScope === 'request')
-        return sample.inputTokenScope === 'aggregate';
-    return replay?.grokNative?.kind === 'xai-responses-native-search' && replay.grokNative.version === 3;
+    if (object(mark) && mark.version === 1 && ['request', 'aggregate'].includes(mark.inputTokenScope))
+        return mark;
+    // Without a valid durable scope marker, preserve DSH's ordinary usage baseline.
+    return null;
+}
+export function providerContextOf(event) {
+    const mark = contextMarkerOf(event);
+    if (mark?.inputTokenScope !== 'aggregate' || mark.contextProvenance !== 'provider-context-details')
+        return;
+    return sanitizeContextDetails(mark.contextDetails);
 }

package/lib/search-usage.js

@@ -1,13 +1,25 @@
 import { z } from 'zod';
-import { SessionSeq } from '@deepseek-ai/dsh-session';
-import { addUsage, aggregateContextOf, auxiliaryUsageOf, isSearchTool, zeroBuckets } from './search-accounting.js';
+import { canonicalHeader, headerEquals } from '@deepseek-ai/dsh-session';
+import { addUsage, aggregateContextOf, auxiliaryUsageOf, isSearchTool, providerContextOf, zeroBuckets } from './search-accounting.js';
 const n = z.number().int().nonnegative();
-const schema = z.object({ auxiliary: z.object({ uncachedInputTokens: n, outputTokens: n, cacheReadTokens: n, cacheWriteTokens: n }).strict(), aggregateContext: z.boolean() }).strict();
+const schema = z.object({ auxiliary: z.object({ uncachedInputTokens: n, outputTokens: n, cacheReadTokens: n, cacheWriteTokens: n }).strict(), aggregateContext: z.boolean(),
+    contextDetails: z.object({ input_tokens: n, output_tokens: n }).strict().optional(), contextProvenance: z.literal('provider-context-details').optional() }).strict();
+const headerKey = (header) => header === undefined ? undefined : JSON.stringify(canonicalHeader(header));
 /** Separate, durable extension: the host's own usage projection remains primary-call billing. */
 export const searchUsageProjection = {
-    key: 'lcxSearchUsage', stateVersion: 2, stateSchema: schema.extend({ pending: z.record(z.string(), z.string()) }),
+    key: 'lcxSearchUsage', stateVersion: 3, stateSchema: schema.extend({ pending: z.record(z.string(), z.string()), headerKey: z.string().optional(), sampleHeaderKey: z.string().optional() }),
     init: () => ({ auxiliary: zeroBuckets(), aggregateContext: false, pending: {} }),
     apply(state, event) {
+        if (event.type === 'request/header')
+            return { ...state, headerKey: headerKey(event.data.header) };
+        // DSH measure anchors assistant/message only. Attempts must not transplant a
+        // newer context sample onto an older successful measurement anchor.
+        if (event.type === 'assistant/message' || event.type === 'assistant/attempt') {
+            const contextDetails = event.type === 'assistant/message' ? providerContextOf(event) : undefined;
+            return { ...state, aggregateContext: aggregateContextOf(event) ?? state.aggregateContext, contextDetails,
+                contextProvenance: contextDetails ? 'provider-context-details' : undefined,
+                sampleHeaderKey: contextDetails ? state.headerKey : undefined };
+        }
         if (event.type === 'tool/call' && isSearchTool(event.data.name))
             return { ...state, pending: { ...state.pending, [event.data.callId]: event.data.name } };
         const callId = event.type === 'tool/result' ? event.data.message.source.callId : undefined;
@@ -16,17 +28,17 @@ export const searchUsageProjection = {
         if (callId && Object.hasOwn(state.pending, callId)) {
             const pending = { ...state.pending };
             delete pending[callId];
-            return { auxiliary, aggregateContext, pending };
+            return { ...state, auxiliary, aggregateContext, pending };
         }
         if (event.type === 'turn/end' && Object.keys(state.pending).length)
-            return { auxiliary, aggregateContext, pending: {} };
+            return { ...state, auxiliary, aggregateContext, pending: {} };
         return auxiliary === state.auxiliary && aggregateContext === state.aggregateContext ? state : { ...state, auxiliary, aggregateContext };
     },
-    wire: { viewSchema: schema, view: ({ auxiliary, aggregateContext }) => ({ auxiliary, aggregateContext }) },
+    wire: { viewSchema: schema, view: ({ auxiliary, aggregateContext, contextDetails, contextProvenance }) => ({ auxiliary, aggregateContext, ...(contextDetails ? { contextDetails, contextProvenance } : {}) }) },
 };
 const installed = new WeakMap();
 /** Own a reversible adapter on the public measure method, never a DSH file or private fold. */
-export function installSearchMeasurement(meter) {
+export function installSearchMeasurement(meter, projections) {
     const existing = installed.get(meter);
     if (existing) {
         existing.refs++;
@@ -37,17 +49,19 @@ export function installSearchMeasurement(meter) {
         } };
     }
     const original = meter.measure, descriptor = Object.getOwnPropertyDescriptor(meter, 'measure');
-    const cursors = new WeakMap();
     function measure(session, header) {
         const value = original.call(this, session, header);
-        let state = cursors.get(session) ?? { seq: 0, aggregate: false };
-        while (state.seq < session.seq) {
-            const e = session.eventAt(SessionSeq(state.seq++));
-            if (e?.type === 'assistant/message')
-                state.aggregate = aggregateContextOf(e) ?? false;
+        const state = projections.stateOf(session, 'lcxSearchUsage');
+        if (!state?.aggregateContext)
+            return value;
+        const effectiveHeader = header ?? session.requestHeader();
+        if (state.contextDetails && state.sampleHeaderKey !== undefined && effectiveHeader !== undefined
+            && headerEquals(JSON.parse(state.sampleHeaderKey), canonicalHeader(effectiveHeader))) {
+            const tokens = state.contextDetails.input_tokens;
+            return Object.freeze({ ...value, baseline: Object.freeze({ kind: 'estimated', tokens }),
+                totalTokens: Math.max(0, tokens + value.surfaceDeltaTokens) });
         }
-        cursors.set(session, state);
-        if (!state.aggregate || value.baseline.kind !== 'usage')
+        if (value.baseline.kind !== 'usage')
             return value;
         // The official measure already prices retained images/files and surface replacements.
         // Only discard its unsuitable aggregate anchor; keep its current surface and node prices.
@@ -80,7 +94,7 @@ function release(meter) {
 }
 export function installSearchUsage(ctx) {
     ctx.inject(['sessionProjections'], c => { c.sessionProjections.register(searchUsageProjection); });
-    ctx.inject(['tokenMeter'], c => {
-        c.effect(() => installSearchMeasurement(c.tokenMeter), 'lcx search context measurement');
+    ctx.inject(['tokenMeter', 'sessionProjections'], c => {
+        c.effect(() => installSearchMeasurement(c.tokenMeter, c.sessionProjections), 'lcx search context measurement');
     });
 }

package/lib/service-mutex.js

@@ -1,8 +1,4 @@
-function abortReason(signal) {
-    if (signal?.reason instanceof Error)
-        return signal.reason;
-    return new DOMException("The operation was aborted", "AbortError");
-}
+import { abortError } from "./abort-error.js";
 export class ServiceMutex {
     locked = false;
     closed = false;
@@ -14,7 +10,7 @@ export class ServiceMutex {
         if (this.closed)
             return Promise.reject(this.closeReason ?? new Error("service mutex closed"));
         if (signal?.aborted)
-            return Promise.reject(abortReason(signal));
+            return Promise.reject(abortError(signal));
         if (!this.locked) {
             this.locked = true;
             return Promise.resolve(() => this.release());
@@ -27,7 +23,7 @@ export class ServiceMutex {
                     if (index >= 0)
                         this.queue.splice(index, 1);
                     signal.removeEventListener("abort", onAbort);
-                    reject(abortReason(signal));
+                    reject(abortError(signal));
                 };
                 waiter.onAbort = onAbort;
                 signal.addEventListener("abort", onAbort, { once: true });
@@ -43,7 +39,7 @@ export class ServiceMutex {
             if (waiter.signal && waiter.onAbort)
                 waiter.signal.removeEventListener("abort", waiter.onAbort);
             if (waiter.signal?.aborted) {
-                waiter.reject(abortReason(waiter.signal));
+                waiter.reject(abortError(waiter.signal));
                 continue;
             }
             waiter.resolve(() => this.release());

package/lib/token-budget.js

@@ -1,4 +1,10 @@
 export const PORTABLE_BUDGET_ERROR_CODE = "LCX_PORTABLE_BUDGET_EXCEEDED";
+export const PORTABLE_UNSUPPORTED_CONTENT_CODE = "LCX_CHECKPOINT_PORTABLE_UNSUPPORTED_CONTENT";
+function unsupportedContent(kind) {
+    return Object.assign(new Error(`LCX cannot budget unsupported message content: ${String(kind)}`), {
+        code: PORTABLE_UNSUPPORTED_CONTENT_CODE,
+    });
+}
 const MAX_BUDGET_INPUT_CHARS = 2_000_000;
 const CONSERVATIVE_IMAGE_TOKEN_COST = 2_048;
 const CJK = /[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}]/u;
@@ -98,7 +104,7 @@ function visibleContent(content) {
     const parts = [];
     for (const part of content) {
         if (!isObject(part) || typeof part.type !== "string")
-            return undefined;
+            throw unsupportedContent("missing block type");
         if (["text", "input_text", "output_text"].includes(part.type)) {
             if (typeof part.text !== "string")
                 return undefined;
@@ -120,27 +126,11 @@ function visibleContent(content) {
             parts.push({ type: "tool-call", id, name, arguments: argumentsText });
             continue;
         }
-        if (part.type === "tool-result") {
-            const toolCallId = safeScalar(part.toolCallId);
-            const toolName = safeScalar(part.toolName ?? part.name ?? "unknown");
-            const nested = visibleContent(part.content);
-            if (toolCallId === undefined ||
-                toolName === undefined ||
-                nested === undefined)
-                return undefined;
-            parts.push({
-                type: "tool-result",
-                toolCallId,
-                toolName,
-                content: nested,
-            });
-            continue;
-        }
         if (["image", "input_image", "output_image", "dsh_image_attachment"].includes(part.type)) {
             parts.push({ type: part.type, image: true });
             continue;
         }
-        return undefined;
+        throw unsupportedContent(part.type);
     }
     return parts;
 }
@@ -177,12 +167,16 @@ export function modelVisibleBudgetView(item) {
     }
     if (item.type !== undefined && item.type !== "message")
         return undefined;
-    if (!["developer", "system", "user", "assistant"].includes(String(item.role ?? "")))
-        return undefined;
+    if (!["developer", "system", "user", "assistant", "tool"].includes(String(item.role ?? "")))
+        throw unsupportedContent(item.role);
     const content = visibleContent(item.content);
+    if (item.role === "tool" && safeScalar(item.toolCallId) === undefined)
+        throw unsupportedContent("tool message without toolCallId");
     return content === undefined
         ? undefined
-        : { role: String(item.role), content };
+        : item.role === "tool"
+            ? { role: "tool", toolCallId: safeScalar(item.toolCallId), content }
+            : { role: String(item.role), content };
 }
 /**
  * Images have provider/model-dependent costs. Count each known image block with