mixdog 1.0.2 → 1.0.3

package/src/runtime/media/media-usage.mjs

@@ -0,0 +1,126 @@
+/**
+ * Usage ledger rows for media generations.
+ *
+ * Adapters return (or attach to their error) a normalized `usage` object read
+ * from what the upstream response actually reported:
+ *   { inputTokens, outputTokens, cachedTokens, outputImageTokens, outputVideoTokens,
+ *     costUsd, images, seconds, resolution }
+ * `jobs.mjs` records exactly one row per generation through recordMediaUsage.
+ * Nothing here estimates tokens: a field the provider did not report stays absent.
+ */
+import { getUsageLedger, makeUsageRecord } from '../shared/llm/usage-ledger.mjs';
+import { ACCOUNT_PROVIDERS } from '../shared/provider-accounts.mjs';
+import { currentProviderAccountId } from '../shared/provider-auth-binding.mjs';
+
+const count = (value) => (Number.isFinite(Number(value)) && Number(value) > 0 ? Math.trunc(Number(value)) : 0);
+const pick = (source, ...keys) => {
+  for (const key of keys) if (source?.[key] != null) return source[key];
+  return undefined;
+};
+
+const TICKS_PER_USD = 1e10;
+
+/** Token usage when the provider reported any; null otherwise. */
+function tokenUsage(fields) {
+  const usage = Object.fromEntries(Object.entries(fields).filter(([, value]) => value > 0));
+  return Object.keys(usage).length ? usage : null;
+}
+
+/** Gemini `generateContent` / Antigravity `usageMetadata` (camelCase or snake_case). */
+export function geminiUsage(meta) {
+  if (!meta || typeof meta !== 'object') return null;
+  const details = pick(meta, 'candidatesTokensDetails', 'candidates_tokens_details');
+  const imageTokens = (Array.isArray(details) ? details : [])
+    .filter((entry) => String(entry?.modality || '').toUpperCase() === 'IMAGE')
+    .reduce((sum, entry) => sum + count(pick(entry, 'tokenCount', 'token_count')), 0);
+  return tokenUsage({
+    inputTokens: count(pick(meta, 'promptTokenCount', 'prompt_token_count')),
+    cachedTokens: count(pick(meta, 'cachedContentTokenCount', 'cached_content_token_count')),
+    outputTokens:
+      count(pick(meta, 'candidatesTokenCount', 'candidates_token_count')) +
+      count(pick(meta, 'thoughtsTokenCount', 'thoughts_token_count')),
+    outputImageTokens: imageTokens,
+  });
+}
+
+/** Gemini Interactions API `usage` (omni video). */
+export function interactionsUsage(usage) {
+  if (!usage || typeof usage !== 'object') return null;
+  const videoTokens = (Array.isArray(usage.output_tokens_by_modality) ? usage.output_tokens_by_modality : [])
+    .filter((entry) => String(entry?.modality || '').toLowerCase() === 'video')
+    .reduce((sum, entry) => sum + count(entry?.tokens), 0);
+  return tokenUsage({
+    inputTokens: count(usage.total_input_tokens),
+    cachedTokens: count(usage.total_cached_tokens),
+    outputTokens: count(usage.total_output_tokens) + count(usage.total_thought_tokens),
+    outputVideoTokens: videoTokens,
+  });
+}
+
+/** OpenAI / Codex Responses `usage` from response.completed. */
+export function responsesUsage(usage) {
+  if (!usage || typeof usage !== 'object') return null;
+  return tokenUsage({
+    inputTokens: count(usage.input_tokens),
+    cachedTokens: count(usage.input_tokens_details?.cached_tokens),
+    outputTokens: count(usage.output_tokens),
+  });
+}
+
+/** xAI image/video `usage.cost_in_usd_ticks` (1 USD = 1e10 ticks); the billed cost. */
+export function xaiUsage(usage) {
+  const ticks = usage?.cost_in_usd_ticks;
+  return typeof ticks === 'number' && Number.isFinite(ticks) && ticks >= 0 ? { costUsd: ticks / TICKS_PER_USD } : null;
+}
+
+/** True when the provider reported something billable for the request. */
+export function hasReportedUsage(usage) {
+  if (!usage) return false;
+  // Seconds are only attached once a video generation completed (billed per second).
+  return (
+    typeof usage.costUsd === 'number' ||
+    ['inputTokens', 'outputTokens', 'cachedTokens', 'seconds'].some((k) => usage[k] > 0)
+  );
+}
+
+/** Attach provider-reported usage to a failure so jobs.mjs can still record it. */
+export function withReportedUsage(error, usage) {
+  if (hasReportedUsage(usage)) error.usage = usage;
+  return error;
+}
+
+/**
+ * Append one ledger row for a generation. A ledger failure never fails the
+ * generation; it is logged the way usage-accounting does.
+ */
+export async function recordMediaUsage(args, getLedger = getUsageLedger) {
+  try {
+    const usage = args.usage || {};
+    const row = makeUsageRecord({
+      ts: Date.now(),
+      provider: args.lane,
+      model: args.model,
+      requestedModel: args.model,
+      pricingModel: args.pricingModel,
+      sessionId: args.sessionId,
+      sourceType: args.sourceType,
+      inputTokens: usage.inputTokens,
+      outputTokens: usage.outputTokens,
+      cacheReadTokens: usage.cachedTokens,
+      costUsd: usage.costUsd,
+      media: {
+        reportedCostUsd: usage.costUsd,
+        outputImageTokens: usage.outputImageTokens,
+        outputVideoTokens: usage.outputVideoTokens,
+        images: usage.images,
+        seconds: usage.seconds,
+        resolution: usage.resolution,
+      },
+      account: ACCOUNT_PROVIDERS.includes(args.lane) ? currentProviderAccountId(args.lane) : '',
+      durationMs: args.durationMs,
+    });
+    await getLedger()?.recordQueued(row);
+  } catch (error) {
+    process.stderr.write(`[usage-ledger] RECORD NOT SAVED: ${String(error?.message || error)}\n`);
+  }
+}

package/src/runtime/media/tool.mjs

@@ -280,7 +280,7 @@ function jobView(job) {
   };
 }
 
-async function generate(args, { cwd, signal, deps }) {
+async function generate(args, { cwd, signal, deps, sessionId, sourceType }) {
   const kind = clean(args.kind);
   if (!MEDIA_KINDS.includes(kind)) throw new MediaToolError(`generate requires kind: ${MEDIA_KINDS.join(' | ')}`);
   const prompt = clean(args.prompt);
@@ -314,7 +314,16 @@ async function generate(args, { cwd, signal, deps }) {
     quality: clean(args.quality),
   });
   const references = await readReferences(args.references, cwd, model.controls);
-  const started = await jobs.startMediaJob({ lane: lane.id, kind, model: modelId, prompt, options, references });
+  const started = await jobs.startMediaJob({
+    lane: lane.id,
+    kind,
+    model: modelId,
+    prompt,
+    options,
+    references,
+    sessionId,
+    sourceType,
+  });
   const base = { lane: lane.id, model: modelId, laneSource, options, referenceCount: references.length, prompt };
   if (args.wait === false) {
     return {
@@ -371,7 +380,10 @@ async function cancel(args, { deps }) {
   return { ok: true, ...jobView(jobs.getMediaJob(id)), canceled: canceled === true };
 }
 
-export async function executeMediaTool(args = {}, { cwd = process.cwd(), signal = null, deps = null } = {}) {
+export async function executeMediaTool(
+  args = {},
+  { cwd = process.cwd(), signal = null, deps = null, sessionId = '', sourceType = '' } = {}
+) {
   const action = clean(args.action).toLowerCase();
   try {
     if (!MEDIA_ACTIONS.includes(action))
@@ -388,7 +400,7 @@ export async function executeMediaTool(args = {}, { cwd = process.cwd(), signal
         ),
       });
     }
-    if (action === 'generate') return mediaToolResult(await generate(args, { cwd, signal, deps }));
+    if (action === 'generate') return mediaToolResult(await generate(args, { cwd, signal, deps, sessionId, sourceType }));
     if (action === 'status') return mediaToolResult(await status(args, { cwd, deps }));
     return mediaToolResult(await cancel(args, { deps }));
   } catch (error) {

package/src/runtime/shared/llm/cost.mjs

@@ -39,6 +39,35 @@ export function billableInputTokensForProvider(provider, inputTokens, cacheReadT
   return Math.max(input - (Number(cacheReadTokens) || 0) - (Number(cacheWriteTokens) || 0), 0);
 }
 
+/**
+ * Media billed by something other than the text token slots: image/video output
+ * tokens, whole images, or video seconds (per resolution when the catalog lists
+ * one). A used unit without a catalog rate is reported missing, never free.
+ */
+function mediaCharges(meta, media, imageOut, videoOut) {
+  const n = (value) => (Number.isFinite(Number(value)) && Number(value) > 0 ? Number(value) : 0);
+  const out = { usd: 0, charged: false, missing: [], rates: {} };
+  const bill = (amount, key, rate, scale = 1) => {
+    if (amount <= 0) return;
+    out.charged = true;
+    if (rate == null) out.missing.push(key);
+    else {
+      out.usd += (amount * rate) / scale;
+      out.rates[key] = rate;
+    }
+  };
+  bill(imageOut, 'outputImageCostPerM', meta.outputImageCostPerM, 1_000_000);
+  bill(videoOut, 'outputVideoCostPerM', meta.outputVideoCostPerM, 1_000_000);
+  bill(n(media.images), 'outputCostPerImage', meta.outputCostPerImage);
+  const resolution = String(media.resolution || '').toLowerCase();
+  bill(
+    n(media.seconds),
+    'outputCostPerSecond',
+    meta.outputCostPerSecondByResolution?.[resolution] ?? meta.outputCostPerSecond
+  );
+  return out;
+}
+
 /**
  * Price normalized token slots once. Null means unknown, not a free request.
  * Rates are returned so a durable record keeps the price applied at ingestion.
@@ -68,6 +97,15 @@ export function priceUsage(args) {
     ...(args.serviceTier ? { serviceTier: args.serviceTier } : {}),
     ...(written1h ? { cacheWrite1hTokens: written1h } : {}),
   };
+  // A provider-billed figure for a media request (e.g. xAI cost_in_usd_ticks)
+  // is the price, with or without a catalog row.
+  const media = args.media || null;
+  if (typeof media?.reportedCostUsd === 'number' && Number.isFinite(media.reportedCostUsd) && media.reportedCostUsd >= 0)
+    return {
+      input,
+      costUsd: Number(media.reportedCostUsd.toFixed(6)),
+      rates: { ...provenance, pricingSource: 'provider' },
+    };
   if (args.inputTokensKnown === false || !meta)
     return {
       input,
@@ -107,7 +145,11 @@ export function priceUsage(args) {
   // Fast mode bills 2x standard rates on every fast-capable Opus.
   if (anthropicFast) multiplier *= 2;
   const keys = PRICING_RATE_KEYS;
-  const tokens = [input, n(args.outputTokens), cached, written - written1h];
+  // Image/video output tokens bill above the text output rate; the row still
+  // carries the full output count.
+  const imageOut = media ? Math.min(n(media.outputImageTokens), n(args.outputTokens)) : 0;
+  const videoOut = media ? Math.min(n(media.outputVideoTokens), n(args.outputTokens) - imageOut) : 0;
+  const tokens = [input, n(args.outputTokens) - imageOut - videoOut, cached, written - written1h];
   const tierRates = ratesForPrompt(rateMeta, promptTokens);
   const rates = {
     ...provenance,
@@ -116,6 +158,10 @@ export function priceUsage(args) {
   if (written1h) rates.cacheWrite1hCostPerM = rates.inputCostPerM === null ? null : rates.inputCostPerM * 2;
   const missingRates = keys.filter((key, i) => tokens[i] > 0 && rates[key] === null);
   if (written1h && rates.cacheWrite1hCostPerM === null) missingRates.push('cacheWrite1hCostPerM');
+  const charge = media ? mediaCharges(meta, media, imageOut, videoOut) : { usd: 0, charged: false, missing: [] };
+  missingRates.push(...charge.missing);
+  if (media && !charge.charged && tokens.every((amount) => amount === 0) && !written1h)
+    return { input, costUsd: null, rates: { ...rates, unpricedReason: 'usage-not-reported' } };
   if (missingRates.length) {
     rates.unpricedReason = 'missing-rate';
     rates.missingRates = missingRates;
@@ -124,8 +170,9 @@ export function priceUsage(args) {
   const costUsd =
     (tokens.reduce((sum, amount, i) => sum + amount * (rates[keys[i]] ?? 0), 0) +
       written1h * (rates.cacheWrite1hCostPerM ?? 0)) /
-    1_000_000;
-  return { input, costUsd: Number(costUsd.toFixed(6)), rates };
+      1_000_000 +
+    charge.usd;
+  return { input, costUsd: Number(costUsd.toFixed(6)), rates: { ...rates, ...charge.rates } };
 }
 
 /**

package/src/runtime/shared/llm/model-catalog-projection.mjs

@@ -124,6 +124,10 @@ const LITELLM_NUMBER_FIELDS = [
   'output_cost_per_token',
   'cache_read_input_token_cost',
   'cache_creation_input_token_cost',
+  'output_cost_per_image',
+  'output_cost_per_image_token',
+  'output_cost_per_video_token',
+  'output_cost_per_second',
 ];
 // _normalize tests each of these with `=== true`, so only a true value carries
 // information; anything else is indistinguishable from absent.
@@ -148,9 +152,10 @@ function projectLitellmRow(row) {
   // litellmPricing), not just the base price.
   for (const [field, value] of Object.entries(row)) {
     if (
-      /^(?:input_cost_per_token|output_cost_per_token|cache_read_input_token_cost|cache_creation_input_token_cost)(?:_above_\d+k_tokens)?(?:_priority)?$/.test(
+      (/^(?:input_cost_per_token|output_cost_per_token|cache_read_input_token_cost|cache_creation_input_token_cost)(?:_above_\d+k_tokens)?(?:_priority)?$/.test(
         field
-      ) &&
+      ) ||
+        /^output_cost_per_second_\w+$/.test(field)) &&
       typeof value === 'number' &&
       Number.isFinite(value)
     )

package/src/runtime/shared/llm/model-catalog.mjs

@@ -26,7 +26,7 @@ import {
   cachedProviderModelListsSync,
   providerCachedModelsSync,
 } from './provider-catalog-cache.mjs';
-import { litellmPricing, modelsDevPricing, PRICING_RATE_KEYS } from './model-pricing-rates.mjs';
+import { litellmMediaPricing, litellmPricing, modelsDevPricing, PRICING_RATE_KEYS } from './model-pricing-rates.mjs';
 // Both overlays are narrowed to their read surface before becoming resident;
 // the disk caches below still receive the full payload.
 import { projectLitellmCatalog, projectModelsDevCatalog } from './model-catalog-projection.mjs';
@@ -597,6 +597,7 @@ function _normalize(entry) {
     contextWindow: entry.max_input_tokens || entry.max_tokens || null,
     outputTokens: entry.max_output_tokens || null,
     ...litellmPricing(entry),
+    ...litellmMediaPricing(entry),
     ...(PRICING_RATE_KEYS.some((key) => fastPricing[key] != null) ? { fastPricing } : {}),
     ...(entry.off_peak_multiplier ? { offPeakMultiplier: entry.off_peak_multiplier } : {}),
     supportsVision: entry.supports_vision === true,

package/src/runtime/shared/llm/model-pricing-rates.mjs

@@ -51,6 +51,27 @@ export function litellmPricing(entry, suffix = '') {
   };
 }
 
+/**
+ * Non-token media rates published by LiteLLM: USD per generated image, USD per
+ * generated video second (optionally per resolution, `output_cost_per_second_<res>`),
+ * and USD/M for image / video output tokens, which bill above the text output rate.
+ */
+export function litellmMediaPricing(entry) {
+  const perM = (value) => (validRate(value) ? value * 1_000_000 : null);
+  const byResolution = {};
+  for (const [key, value] of Object.entries(entry || {})) {
+    const match = key.match(/^output_cost_per_second_(.+)$/);
+    if (match && validRate(value)) byResolution[match[1].toLowerCase()] = value;
+  }
+  return {
+    outputImageCostPerM: perM(entry?.output_cost_per_image_token),
+    outputVideoCostPerM: perM(entry?.output_cost_per_video_token),
+    outputCostPerImage: validRate(entry?.output_cost_per_image) ? entry.output_cost_per_image : null,
+    outputCostPerSecond: validRate(entry?.output_cost_per_second) ? entry.output_cost_per_second : null,
+    outputCostPerSecondByResolution: byResolution,
+  };
+}
+
 export function modelsDevPricing(cost) {
   // Structured tiers supersede the older context_over_200k compatibility
   // field; it can coexist with a tier whose actual boundary is not 200k.

package/src/runtime/shared/llm/usage-accounting.mjs

@@ -4,6 +4,13 @@ import { withUsageContext } from './usage-context.mjs';
 import { ACCOUNT_PROVIDERS } from '../provider-accounts.mjs';
 import { currentProviderAccountId } from '../provider-auth-binding.mjs';
 
+// Results and errors already written. A provider-local re-send (model
+// fallback, catalog retry) runs its own accounting and its result or error
+// then returns through the enclosing send, which must not write it again.
+const recorded = new WeakSet();
+const hasTokens = (usage) =>
+  ['inputTokens', 'outputTokens', 'cachedTokens', 'cacheWriteTokens'].some((key) => Number(usage?.[key]) > 0);
+
 /**
  * Runs at the common provider boundary, not inside optional diagnostic IO.
  * Provider-local retries remain owned by the provider. Accounting failure must
@@ -12,7 +19,9 @@ import { currentProviderAccountId } from '../provider-auth-binding.mjs';
 export async function accountProviderSend(provider, instance, send, model, opts = {}) {
   const requestId = randomUUID();
   const startedAt = Date.now();
-  const sessionId = opts.sessionId || opts.session?.id;
+  // usageSessionId: a request isolated under its own provider session id
+  // (compaction's `:compact`) whose spend belongs to the source session.
+  const sessionId = opts.usageSessionId || opts.sessionId || opts.session?.id;
   const sourceType = opts.session?.sourceType || opts.sourceType || opts.requestKind || '';
   const inputTokensInclusive = instance.constructor?.inputExcludesCache !== true;
   let ledger;
@@ -30,16 +39,18 @@ export async function accountProviderSend(provider, instance, send, model, opts
     sourceType,
     inputTokensInclusive,
   };
-  const record = async (result) => {
+  const record = async (result, id, owner) => {
     if (!result?.usage) return;
     // A nested send (e.g. a fallback model re-send) already stamped its own
     // final attempt's tier; the outer context only saw the abandoned attempt.
     result.requestServiceTier ??= identity.requestServiceTier || '';
+    if (recorded.has(owner)) return;
     if (openingError) throw openingError;
     if (!ledger) return;
+    recorded.add(owner);
     const usage = result.usage;
     const row = makeUsageRecord({
-      id: result.responseId ? undefined : requestId,
+      id: result.responseId ? undefined : id,
       ts: Date.now(),
       provider,
       model: result.model || model,
@@ -68,23 +79,32 @@ export async function accountProviderSend(provider, instance, send, model, opts
     // SQLite write no longer runs on the event loop.
     await ledger.recordQueued(row);
   };
-  const save = async (result) => {
+  const save = async (result, id = requestId, owner = result) => {
     try {
-      await record(result);
+      await record(result, id, owner);
     } catch (error) {
       result.usageAccountingError = String(error?.message || error);
       process.stderr.write(`[usage-ledger] RECORD NOT SAVED: ${result.usageAccountingError}\n`);
     }
   };
+  const saveAbandoned = async () => {
+    for (const [index, attempt] of (identity.abandonedUsage || []).entries()) {
+      if (hasTokens(attempt.usage)) await save(attempt, `${requestId}:abandoned:${index}`);
+    }
+  };
   let result;
   try {
     result = await withUsageContext(identity, send);
   } catch (error) {
+    await saveAbandoned();
     // Only provider-reported partial usage is recordable; never invent
     // tokens for a failed request or reinterpret an error as a success.
     if (error?.usage) await save(error);
+    else if (hasTokens(error?.partialUsage))
+      await save({ usage: error.partialUsage, model: error.partialModel }, requestId, error);
     throw error;
   }
+  await saveAbandoned();
   await save(result);
   return result;
 }

package/src/runtime/shared/llm/usage-context.mjs

@@ -11,3 +11,9 @@ export const noteRequestServiceTier = (tier) => {
   const identity = context.getStore();
   if (identity) identity.requestServiceTier = tier || '';
 };
+// A provider-local retry abandons an attempt the provider still billed; the
+// enclosing send records it alongside its own final usage.
+export const noteAbandonedUsage = (usage, model) => {
+  const identity = context.getStore();
+  if (identity && usage) (identity.abandonedUsage ||= []).push({ usage, model });
+};

package/src/runtime/shared/llm/usage-ledger-import.mjs

@@ -43,6 +43,7 @@ export function importTraceRow(row) {
     uncachedInputTokens: raw ? (row.uncached_input_tokens ?? payload.uncached_input_tokens) : undefined,
     cacheReadTokens: raw ? row.cached_tokens : row.cacheReadTokens,
     cacheWriteTokens: raw ? row.cache_write_tokens : row.cacheWriteTokens,
+    cacheWrite1hTokens: raw ? payload.raw_usage?.cache_creation?.ephemeral_1h_input_tokens : undefined,
     costUsd: raw ? undefined : row.costUsd,
     sessionId: row.session_id || row.sessionId,
     sourceType: row.sourceType || row.source_type || payload.sourceType || payload.source_type,

package/src/session-runtime/internal-tool-executor/feature-tools.mjs

@@ -27,7 +27,15 @@ export function createFeatureToolHandlers({ rt, setupTool, officeToolsEnabled, m
     media: async (args, { callerCtx, callerCwd }) => {
       requireEnabled(callerCtx, mediaToolEnabled, 'media');
       const { executeMediaTool } = await import('../../runtime/media/tool.mjs');
-      return await executeMediaTool(args, { cwd: callerCwd, signal: signalFor(callerCtx) });
+      const { getSession } = await import('../../runtime/agent/orchestrator/session/manager/session-crud.mjs');
+      // Generation spend is attributed to the calling session in the usage ledger.
+      const sessionId = sessionIdFor(callerCtx) || '';
+      return await executeMediaTool(args, {
+        cwd: callerCwd,
+        signal: signalFor(callerCtx),
+        sessionId,
+        sourceType: (sessionId && getSession(sessionId)?.sourceType) || '',
+      });
     },
     tidy: async (args, { callerCtx, callerCwd }) => {
       requireEnabled(callerCtx, tidyToolEnabled, 'tidy');

package/src/session-runtime/services/agent-tool/index-write-queue.mjs

@@ -51,6 +51,38 @@ function recordOps(args, run) {
   });
 }
 
+/**
+ * Collapse a sequence of op sets into one op set per argument slot with the
+ * same sequential outcome: every key ever deleted is deleted (so a foreign
+ * writer's key is still removed), then each surviving key is set once with its
+ * final value, ordered as sequential insertion would leave it (an overwrite
+ * keeps its position, a delete/reinsert moves to the end). Set adds are unioned.
+ */
+function compactOps(batch) {
+  const slots = [];
+  for (const ops of batch) {
+    ops.forEach((op, index) => {
+      if (!op) return;
+      let slot = slots[index];
+      if (!slot) {
+        slot = slots[index] = op.add ? { add: new Set() } : { del: new Set(), final: new Map() };
+      }
+      if (slot.add) {
+        for (const value of op.add) slot.add.add(value);
+        return;
+      }
+      for (const key of op.del) {
+        slot.del.add(key);
+        slot.final.delete(key);
+      }
+      for (const [key, json] of op.set) slot.final.set(key, json);
+    });
+  }
+  return slots.map((slot) =>
+    !slot ? null : slot.add ? { add: slot.add } : { del: slot.del, set: slot.final }
+  );
+}
+
 function replayOps(ops, args) {
   args.forEach((arg, index) => {
     const op = ops[index];
@@ -64,6 +96,10 @@ function replayOps(ops, args) {
   });
 }
 
+function replayBatch(batch, args) {
+  replayOps(compactOps(batch), args);
+}
+
 /**
  * @param {object} options
  * @param {string|null} options.file       index file; null → every write is a no-op
@@ -99,9 +135,7 @@ export function createIndexWriteQueue({ file, rewrite, readDoc, onPersisted = ()
         await updateJsonAtomic(
           file,
           (cur) =>
-            rewrite(cur, (...args) => {
-              for (const ops of batch) replayOps(ops, args);
-            }),
+            rewrite(cur, (...args) => replayBatch(batch, args)),
           { lock: true }
         );
         return;
@@ -153,9 +187,7 @@ export function createIndexWriteQueue({ file, rewrite, readDoc, onPersisted = ()
       updateJsonAtomicSync(
         file,
         (cur) =>
-          rewrite(cur, (...args) => {
-            for (const set of ops) replayOps(set, args);
-          }),
+          rewrite(cur, (...args) => replayBatch(ops, args)),
         { lock: true, timeoutMs: EXIT_LOCK_TIMEOUT_MS }
       );
     } catch {

package/src/session-runtime/services/agent-tool/worker-index/row-store.mjs

@@ -101,9 +101,15 @@ export function createWorkerRowStore(file) {
     return rows;
   }
 
+  // Rows and tombstones must come from the same read/projection. In
+  // particular, do not stat and reload the file between the two collections.
+  function readSnapshot() {
+    const rows = readAll();
+    return { rows, tombstones: (projectedView() || cache)?.tombstones || [] };
+  }
+
   function readTombstones() {
-    readAll();
-    return (projectedView() || cache)?.tombstones || [];
+    return readSnapshot().tombstones;
   }
 
   // Single writer path: the mutator runs now over keyed maps against the
@@ -113,6 +119,7 @@ export function createWorkerRowStore(file) {
 
   return {
     readAll,
+    readSnapshot,
     readTombstones,
     write,
     /** Resolves once every write so far is on disk. */

package/src/session-runtime/services/agent-tool/worker-index.mjs

@@ -27,16 +27,19 @@ export function createWorkerIndex({ dataDir, cfgMod, mgr, tags, tagAgents, tagCw
   const activeWorkerKeys = new Set();
 
   function readWorkerRows(context = {}) {
-    const rows = store.readAll();
+    const { rows, tombstones: savedTombstones } = store.readSnapshot();
     if (rows.length === 0) return rows;
-    const tombstones = new Map(readAllTagTombstones().map((row) => [tagTombstoneKey(row), row]));
+    const tombstones = new Map(recoverTombstoneOwners(savedTombstones).map((row) => [tagTombstoneKey(row), row]));
     return rows.filter(
       (row) => rowMatchesContext(row, context) && !tombstoneBlocksWork(row, findTagTombstone(row, tombstones))
     );
   }
 
   function readAllTagTombstones() {
-    const rows = store.readTombstones();
+    return recoverTombstoneOwners(store.readTombstones());
+  }
+
+  function recoverTombstoneOwners(rows) {
     if (!rows.some((row) => !clean(row.parentSessionId || row.ownerSessionId))) return rows;
     const sessions = typeof mgr.listSessions === 'function' ? mgr.listSessions({ includeClosed: true }) : [];
     // Resolve legacy ownership against all sessions, never just the caller's

package/src/session-runtime/services/hook-bus/event-runner.mjs

@@ -11,8 +11,8 @@ import { parseHandlerOutput } from './handlers.mjs';
 import { createHandlerDispatch } from './handler-dispatch.mjs';
 import { handlerDedupeKey, shellCountFor } from './rules.mjs';
 
-// A failed run is reported as a hook:error and skipped; returns the message
-// or null when the run produced usable output.
+// A failed run is reported as a hook:error and blocks PreToolUse; other events
+// skip it. Returns the message or null when the run produced usable output.
 function runFailure(run, handler) {
   if (run.timedOut)
     return `hook ${shellCountFor(handler)} timed out: ${handler.command || handler.url || handler.type}`;
@@ -23,6 +23,12 @@ function runFailure(run, handler) {
   return null;
 }
 
+function failClosed(agg, message) {
+  agg.blocked = true;
+  agg.reason = `PreToolUse policy check failed: ${message}`;
+  return agg;
+}
+
 function foldParsedOutput(agg, parsed) {
   if (parsed.additionalContext) agg.additionalContext.push(parsed.additionalContext);
   if (parsed.updatedInput && !agg.updatedInput) agg.updatedInput = parsed.updatedInput;
@@ -90,12 +96,14 @@ export function createEventRunner({ loadConfig, emit, cursor, pluginData, prompt
       } catch (error) {
         throwIfAborted(signal);
         emit('hook:error', { name: payload.tool_name || eventName, error: error?.message || String(error) });
+        if (eventName === 'PreToolUse') return failClosed(agg, error?.message || String(error));
         continue;
       }
       if (!run) continue;
       const failure = runFailure(run, handler);
       if (failure) {
         emit('hook:error', { name: payload.tool_name || eventName, error: failure });
+        if (eventName === 'PreToolUse') return failClosed(agg, failure);
         continue;
       }
       foldParsedOutput(agg, parseHandlerOutput(run, eventName));

package/src/session-runtime/services/hook-bus/tool-gate.mjs

@@ -65,8 +65,11 @@ export function createToolGate({ loadConfig, loadRules, runEventHandlers, emit,
       return standardDecision(agg, input) ?? legacyDecision(cfg, input);
     } catch (error) {
       throwIfAborted(signal);
-      emit('hook:error', { name: input.name || input.tool_name || 'tool', error: error?.message || String(error) });
-      return null;
+      const message = error?.message || String(error);
+      emit('hook:error', { name: input.name || input.tool_name || 'tool', error: message });
+      const reason = `PreToolUse policy check failed: ${message}`;
+      emit('tool:deny', { ...identityOf(input), reason });
+      return { action: 'deny', reason };
     }
   };
 }

package/src/tui/dist/index.mjs

@@ -47669,7 +47669,11 @@ var LITELLM_NUMBER_FIELDS = [
   "input_cost_per_token",
   "output_cost_per_token",
   "cache_read_input_token_cost",
-  "cache_creation_input_token_cost"
+  "cache_creation_input_token_cost",
+  "output_cost_per_image",
+  "output_cost_per_image_token",
+  "output_cost_per_video_token",
+  "output_cost_per_second"
 ];
 var LITELLM_FLAG_FIELDS = [
   "supports_vision",
@@ -47688,9 +47692,9 @@ function projectLitellmRow(row) {
     if (typeof value === "number" && Number.isFinite(value)) out[field] = value;
   }
   for (const [field, value] of Object.entries(row)) {
-    if (/^(?:input_cost_per_token|output_cost_per_token|cache_read_input_token_cost|cache_creation_input_token_cost)(?:_above_\d+k_tokens)?(?:_priority)?$/.test(
+    if ((/^(?:input_cost_per_token|output_cost_per_token|cache_read_input_token_cost|cache_creation_input_token_cost)(?:_above_\d+k_tokens)?(?:_priority)?$/.test(
       field
-    ) && typeof value === "number" && Number.isFinite(value))
+    ) || /^output_cost_per_second_\w+$/.test(field)) && typeof value === "number" && Number.isFinite(value))
       out[field] = value;
   }
   for (const field of LITELLM_FLAG_FIELDS) {