muonroi-cli 1.8.4 → 1.9.0

package/dist/src/providers/warm.js

@@ -0,0 +1,145 @@
+/**
+ * src/providers/warm.ts
+ *
+ * Boot-time warm-up of the provider factory registry.
+ *
+ * Root cause it addresses (measured live, 2026-07-16, session 0c6728ba1a25):
+ * an xai session POSTed model `gpt-5.4` to api.x.ai and got 404 "The model
+ * gpt-5.4 does not exist" — an openai model sent to the xai endpoint. The
+ * factory/model guard in `runtime.ts` DID spot the mismatch and tried to
+ * redirect the request to openai's own factory, but the registry had no openai
+ * entry: a session only ever built the factory for ITS OWN provider, so any
+ * sub-task that resolved a model from another provider had nothing to redirect
+ * to and fell through to the wrong endpoint.
+ *
+ * That is the actual hole. Model ids and provider factories travel as two
+ * independent values, so "borrow the session's factory" is the silent default
+ * for every sub-task (compaction, classify, sub-agents, mode switches) and only
+ * some paths remember to re-derive the provider. Warming the registry for every
+ * credentialed provider closes it at the source: the factory for a model's own
+ * provider is then always present, so `resolveModelRuntime` can derive it from
+ * the model itself instead of trusting whatever factory a caller passed.
+ *
+ * Best-effort by construction: a provider that fails to warm is simply absent
+ * (the same state as today), never a boot failure.
+ */
+import { logger } from "../utils/logger.js";
+import { createProviderFactoryAsync, hasProviderFactory } from "./runtime.js";
+import { ALL_PROVIDER_IDS } from "./types.js";
+/**
+ * Build and register a factory for every provider the user has credentials for.
+ *
+ * Runs providers concurrently — each is an independent credential read, and a
+ * serial loop would add every provider's latency to boot.
+ *
+ * Skips providers that already have a factory: the session builds its own with
+ * session-specific options (custom baseURL, OAuth headers), and rebuilding it
+ * from bare defaults here would silently downgrade the live session's wiring.
+ */
+/**
+ * Rebuild ONE provider's factory after its credentials changed mid-session.
+ *
+ * `createProviderFactoryAsync` reads OAuth tokens at CONSTRUCTION and bakes the
+ * resulting auth headers into the factory (runtime.ts: `loadTokensWithRefresh()`
+ * then `authHeaders(tokens)`). Boot warms openai/xai even with no tokens —
+ * `getOAuthProviderConfig` only reports that a provider SUPPORTS OAuth — so the
+ * entry built at boot is an API-key-path factory. Signing in later saved tokens
+ * that nothing re-read: the stale factory stayed registered and the provider
+ * kept failing until the next process start. That is the "OAuth only works
+ * after I restart the session" report; the same held for a key set via `K` on a
+ * provider skipped at boot for "no credentials".
+ *
+ * warmProviderFactories() cannot be reused for this: it deliberately SKIPS a
+ * provider that already has a factory. The registry is last-built-wins, so
+ * building again is what replaces the stale entry.
+ */
+export async function rewarmProviderFactory(id) {
+    try {
+        const { loadUserSettings } = await import("../utils/settings.js");
+        const baseURL = loadUserSettings()?.providers?.[id]?.baseURL;
+        let apiKey;
+        try {
+            const { loadKeyForProvider } = await import("./keychain.js");
+            apiKey = (await loadKeyForProvider(id)) || undefined;
+        }
+        catch (err) {
+            // No stored key is the normal OAuth case, so this is not an error —
+            // but log it: a keychain fault here silently downgrades auth.
+            logger.debug("cli", `[provider-warm] key read failed for ${id}: ${err?.message}`, { error: err });
+            apiKey = undefined;
+        }
+        await createProviderFactoryAsync(id, { ...(apiKey ? { apiKey } : {}), ...(baseURL ? { baseURL } : {}) });
+        logger.info("cli", `[provider-warm] rebuilt ${id} factory after a credential change`, { providerId: id });
+        return true;
+    }
+    catch (err) {
+        logger.warn("cli", `[provider-warm] failed to rebuild factory for ${id}: ${err?.message}`, {
+            error: err,
+            providerId: id,
+        });
+        return false;
+    }
+}
+export async function warmProviderFactories() {
+    const warmed = [];
+    const skipped = [];
+    const { isProviderDisabled } = await import("../utils/settings.js");
+    const { loadUserSettings } = await import("../utils/settings.js");
+    const userSettings = loadUserSettings();
+    await Promise.all(ALL_PROVIDER_IDS.map(async (id) => {
+        try {
+            if (hasProviderFactory(id)) {
+                skipped.push({ id, reason: "already built" });
+                return;
+            }
+            if (isProviderDisabled(id)) {
+                skipped.push({ id, reason: "disabled" });
+                return;
+            }
+            let apiKey;
+            try {
+                const { loadKeyForProvider } = await import("./keychain.js");
+                apiKey = (await loadKeyForProvider(id)) || undefined;
+            }
+            catch {
+                // No stored key for this provider — normal; OAuth may still cover it.
+                apiKey = undefined;
+            }
+            let hasOAuth = false;
+            try {
+                const { getOAuthProviderConfig } = await import("./auth/registry.js");
+                hasOAuth = !!(await getOAuthProviderConfig(id));
+            }
+            catch (err) {
+                logger.debug("cli", `[provider-warm] OAuth probe failed for ${id}: ${err?.message}`, {
+                    error: err,
+                });
+            }
+            if (!apiKey && !hasOAuth) {
+                skipped.push({ id, reason: "no credentials" });
+                return;
+            }
+            // Honour a user-configured endpoint; otherwise each strategy falls back
+            // to its own provider's apiBase, which is what a non-session provider
+            // should use.
+            const baseURL = userSettings?.providers?.[id]?.baseURL;
+            await createProviderFactoryAsync(id, { ...(apiKey ? { apiKey } : {}), ...(baseURL ? { baseURL } : {}) });
+            warmed.push(id);
+        }
+        catch (err) {
+            // Never let one provider's credential problem break boot: absent from
+            // the registry is exactly the pre-warm status quo.
+            logger.warn("cli", `[provider-warm] failed to build factory for ${id}: ${err?.message}`, {
+                error: err,
+                providerId: id,
+            });
+            skipped.push({ id, reason: `error: ${err?.message ?? "unknown"}` });
+        }
+    }));
+    logger.info("cli", `[provider-warm] registry warmed: ${warmed.join(", ") || "(none)"}`, {
+        warmed,
+        skipped,
+    });
+    return { warmed, skipped };
+}
+//# sourceMappingURL=warm.js.map

package/dist/src/providers/wire-debug.js

@@ -90,6 +90,95 @@ function summarizeMessage(m) {
     }
     return { role, contentKind: "string", textChars: 0 };
 }
+/**
+ * Reduce a request body (from AI SDK's `error.requestBodyValues`) to a
+ * PII-safe shape: top-level param key list + each assistant message's field
+ * key list. Values are NEVER persisted — only key names. This is the
+ * diagnostic evidence needed when a provider rejects "an invalid parameter"
+ * (Z.ai 1210, SiliconFlow 20015) and we must see which field was present or
+ * missing on each assistant turn in a multi-step tool loop.
+ */
+function summarizeRequestBodyShape(body) {
+    if (!body || typeof body !== "object")
+        return undefined;
+    const b = body;
+    const paramKeys = Object.keys(b).sort();
+    const configParamValues = extractConfigParamValues(b);
+    const messages = b.messages;
+    if (!Array.isArray(messages)) {
+        return {
+            paramKeys,
+            assistantFieldKeys: [],
+            assistantCount: 0,
+            assistantLens: [],
+            totalReasoningChars: 0,
+            responseFormat: b.response_format ?? undefined,
+            configParamValues,
+        };
+    }
+    const assistantMsgs = messages.filter((m) => m?.role === "assistant");
+    // De-duplicate the field-key signature across assistant messages so a long
+    // history doesn't bloat the log — we only care WHICH fields co-occur.
+    const signatures = new Set();
+    const assistantLens = [];
+    let totalReasoningChars = 0;
+    for (const m of assistantMsgs) {
+        const msg = m;
+        const keys = Object.keys(msg ?? {})
+            .sort()
+            .join(",");
+        signatures.add(keys);
+        const rc = msg?.reasoning_content;
+        const rcLen = typeof rc === "string" ? rc.length : null;
+        if (rcLen !== null)
+            totalReasoningChars += rcLen;
+        const contentLen = typeof msg?.content === "string"
+            ? msg.content.length
+            : Array.isArray(msg?.content)
+                ? msg.content.reduce((n, p) => n + (typeof p?.text === "string" ? p.text.length : 0), 0)
+                : 0;
+        const toolCallsLen = Array.isArray(msg?.tool_calls) ? msg.tool_calls.length : 0;
+        assistantLens.push({ rc: rcLen, content: contentLen, toolCalls: toolCallsLen });
+    }
+    return {
+        paramKeys,
+        assistantFieldKeys: [...signatures],
+        assistantCount: assistantMsgs.length,
+        assistantLens,
+        totalReasoningChars,
+        responseFormat: b.response_format ?? undefined,
+        configParamValues,
+    };
+}
+/**
+ * Scalar SDK-config params whose VALUES are PII-safe (generation config, not
+ * user prompt content) and which are the likely culprits when a provider
+ * rejects with a generic "Invalid API parameter" (Z.ai 1210, SiliconFlow
+ * 20015). `messages` and `tools` are deliberately excluded — their values may
+ * carry prompts/PII, and counts are already captured elsewhere.
+ */
+const CONFIG_PARAM_KEYS = [
+    "reasoning_effort",
+    "verbosity",
+    "tool_choice",
+    "response_format",
+    "max_tokens",
+    "temperature",
+    "top_p",
+    "frequency_penalty",
+    "presence_penalty",
+    "seed",
+    "stop",
+    "parallel_tool_calls",
+];
+function extractConfigParamValues(body) {
+    const out = {};
+    for (const k of CONFIG_PARAM_KEYS) {
+        if (k in body)
+            out[k] = body[k] ?? null;
+    }
+    return out;
+}
 export const wireDebug = {
     enabled: ENABLED,
     /** Log an outgoing streamText/streamObject call. */
@@ -129,6 +218,12 @@ export const wireDebug = {
             statusCode: typeof e?.statusCode === "number" ? e.statusCode : undefined,
             url: typeof e?.url === "string" ? e.url : undefined,
             responseBody: typeof e?.responseBody === "string" ? e.responseBody.slice(0, 4000) : undefined,
+            // Evidence for "Invalid API parameter" (e.g. Z.ai code 1210,
+            // SiliconFlow 20015): capture the SHAPE (key names only — no values,
+            // PII-safe) of every assistant message in the request body so we can
+            // see which field the provider rejected and whether reasoning_content
+            // was present/missing across the multi-step tool-loop history.
+            requestBodyShape: summarizeRequestBodyShape(e?.requestBodyValues),
             cause: e?.cause && typeof e.cause === "object"
                 ? {
                     message: typeof e.cause.message === "string"

package/dist/src/router/decide.d.ts

@@ -14,6 +14,14 @@ export interface DecideOpts {
     signal?: AbortSignal;
     defaultModel: string;
     defaultProvider: string;
+    /**
+     * Optional session id for audit logging. When provided, a `routing`
+     * interaction event is emitted whenever the turn's routed model differs from
+     * `defaultModel` (the stored session.model) — making per-turn overrides
+     * observable instead of silent. Fixes the "session.model lie": a user on
+     * flash could not see when the router silently promoted them to pro.
+     */
+    sessionId?: string;
     /** Override home directory for ledger (testing). */
     homeOverride?: string;
     /** PIL enrichment signals — forwarded to EE context. */
@@ -27,6 +35,11 @@ export interface DecideOpts {
         projectSize?: "small" | "medium" | "large" | null;
         filesTouched?: number;
         mode?: string | null;
+        turnIndex?: number;
+        messageCount?: number;
+        compactionCount?: number;
+        totalSavedTokens?: number;
+        compactionSummary?: string | null;
     };
 }
 export declare function clearRouteCache(): void;

package/dist/src/router/decide.js

@@ -6,7 +6,7 @@
  * If cap breach detected, downgrade chain overrides classifier output (ROUTE-06).
  */
 import { getDefaultEEClient } from "../ee/intercept.js";
-import { getModelByTier, getModelInfo, getModelsForProvider } from "../models/registry.js";
+import { getModelInfo, getModelsForProvider } from "../models/registry.js";
 import { taskTypeToRole } from "../pil/task-tier-map.js";
 import { detectProviderForModel } from "../providers/runtime.js";
 import { ALL_PROVIDER_IDS } from "../providers/types.js";
@@ -14,9 +14,10 @@ import { downgradeChain, emitDowngrade, getDowngradeChain } from "../usage/downg
 import { release, reserve } from "../usage/ledger.js";
 import { midstreamPolicy } from "../usage/midstream.js";
 import { CapBreachError } from "../usage/types.js";
-import { getRoleModel, isCouncilMultiProviderPreferred, isProviderDisabled } from "../utils/settings.js";
+import { getRoleModel, getRoutingPromoteMax, isCouncilMultiProviderPreferred, isProviderDisabled, } from "../utils/settings.js";
 import { classify } from "./classifier/index.js";
 import { callColdRoute } from "./cold.js";
+import { adjustPeakHourModel, getRoutedModelByTier } from "./peak-hour.js";
 import { isInheritProvider } from "./provider-sentinel.js";
 import { routerStore } from "./store.js";
 import { callWarmRoute } from "./warm.js";
@@ -75,6 +76,16 @@ function buildRouteContext(cwd, pil) {
         ctx.filesTouched = pil.filesTouched;
     if (pil?.mode)
         ctx.mode = pil.mode;
+    if (pil?.turnIndex !== undefined)
+        ctx.turnIndex = pil.turnIndex;
+    if (pil?.messageCount !== undefined)
+        ctx.messageCount = pil.messageCount;
+    if (pil?.compactionCount !== undefined)
+        ctx.compactionCount = pil.compactionCount;
+    if (pil?.totalSavedTokens !== undefined)
+        ctx.totalSavedTokens = pil.totalSavedTokens;
+    if (pil?.compactionSummary)
+        ctx.compactionSummary = pil.compactionSummary;
     return ctx;
 }
 // ─── Disabled-provider guard: fallback providers ────────────────────────────
@@ -90,7 +101,7 @@ function resolveEffectiveDefaults(opts) {
     }
     for (const p of FALLBACK_PROVIDERS) {
         if (!isProviderDisabled(p)) {
-            const m = getModelByTier("balanced", p);
+            const m = getRoutedModelByTier("balanced", p);
             // Guard: getModelByTier may return a model from a different provider
             // when the preferred provider has no model for the requested tier.
             if (m && m.provider === p)
@@ -114,7 +125,7 @@ function resolveTierModel(tier, defaultProvider) {
     }
     for (const p of FALLBACK_PROVIDERS) {
         if (!isProviderDisabled(p)) {
-            const m = getModelByTier(tier, p);
+            const m = getRoutedModelByTier(tier, p);
             // Guard: getModelByTier may return a model from a different provider
             // when the preferred provider has no model for the requested tier.
             if (m && m.provider === p)
@@ -126,6 +137,17 @@ function resolveTierModel(tier, defaultProvider) {
     }
     return undefined;
 }
+function applyPeakHourRoute(dec) {
+    const adj = adjustPeakHourModel(dec.model);
+    if (!adj.adjusted)
+        return dec;
+    return {
+        ...dec,
+        model: adj.modelId,
+        provider: adj.provider,
+        reason: `${dec.reason}|${adj.reason}`,
+    };
+}
 // ─── Provider constraint: never route to a provider the user lacks a key for ─
 function constrainToProvider(decision, opts) {
     // Inherit-sentinel: warm path may emit an empty provider to signal
@@ -134,11 +156,11 @@ function constrainToProvider(decision, opts) {
     if (isInheritProvider(decision.provider)) {
         const resolved = detectProviderForModel(decision.model);
         if (resolved && !isProviderDisabled(resolved))
-            return decision;
+            return applyPeakHourRoute(decision);
         if (resolved && isProviderDisabled(resolved)) {
             return constrainToProvider({ ...decision, provider: resolved }, opts);
         }
-        return decision;
+        return applyPeakHourRoute(decision);
     }
     // Provider-only UX: the user enables N providers and pins one as default.
     // Routing rules:
@@ -150,7 +172,7 @@ function constrainToProvider(decision, opts) {
     //     surface a config error elsewhere).
     const decisionDisabled = isProviderDisabled(decision.provider);
     if (!decisionDisabled) {
-        return decision;
+        return applyPeakHourRoute(decision);
     }
     if (isProviderDisabled(opts.defaultProvider)) {
         return {
@@ -158,7 +180,7 @@ function constrainToProvider(decision, opts) {
             reason: `${decision.reason}|provider-not-constrained(default-also-disabled)`,
         };
     }
-    const sameProviderModel = getModelByTier(decision.tier === "hot" ? "fast" : decision.tier === "cold" ? "premium" : "balanced", opts.defaultProvider);
+    const sameProviderModel = getRoutedModelByTier(decision.tier === "hot" ? "fast" : decision.tier === "cold" ? "premium" : "balanced", opts.defaultProvider);
     if (sameProviderModel && sameProviderModel.provider !== opts.defaultProvider) {
         return {
             ...decision,
@@ -167,12 +189,12 @@ function constrainToProvider(decision, opts) {
             reason: `${decision.reason}|provider-constrained(forced-default)`,
         };
     }
-    return {
+    return applyPeakHourRoute({
         ...decision,
         model: sameProviderModel?.id ?? opts.defaultModel,
         provider: sameProviderModel?.provider ?? opts.defaultProvider,
         reason: `${decision.reason}|provider-constrained`,
-    };
+    });
 }
 // ─── Route feedback (HTTP path) ─────────────────────────────────────────────
 /**
@@ -194,12 +216,78 @@ export function reportRouteOutcome(taskHash, outcome, duration) {
         duration: duration ?? null,
     });
 }
+// ─── Tier-promotion cap (cost-ceiling guard) ───────────────────────────────
+const TIER_RANK = {
+    fast: 0,
+    balanced: 1,
+    premium: 2,
+};
+/**
+ * Enforce the user's tier-promotion ceiling. The session default model is the
+ * cost ceiling: the router may downgrade per turn but may not silently promote
+ * beyond `routingPromoteMax` (default "balanced"). See settings.ts.
+ *
+ * When the decision would promote, clamp down to the max allowed tier on the
+ * SAME provider. If no same-provider model exists at the ceiling tier, fall
+ * back to the session default model (the user's explicit pick). The clamp is
+ * skipped for: the `"any"` opt-in, the role path (explicit user roleModels
+ * config is itself the opt-in), cap-halt decisions, and provider-constrained
+ * disabled-provider recoveries (those already move toward the default).
+ */
+function applyPromotionCap(dec, defaultModel) {
+    if (dec.model === "HALT" || dec.model === defaultModel)
+        return dec;
+    const cap = getRoutingPromoteMax();
+    if (cap === "any")
+        return dec;
+    const capRank = cap === "off" ? null : TIER_RANK[cap]; // "balanced" → 1
+    const defaultTier = getModelInfo(defaultModel)?.tier;
+    // "off" means ceiling = the default model's own tier.
+    const maxAllowedRank = capRank === null ? (defaultTier ? TIER_RANK[defaultTier] : 0) : capRank;
+    const decInfo = getModelInfo(dec.model);
+    const decTier = decInfo?.tier;
+    if (!decTier || TIER_RANK[decTier] <= maxAllowedRank)
+        return dec;
+    // Promotion exceeds the ceiling — clamp DOWN to the max allowed tier on the
+    // same provider. Walk down from the ceiling so we pick the highest permitted.
+    const provider = decInfo?.provider ?? detectProviderForModel(dec.model);
+    const targetTiers = capRank === null
+        ? defaultTier
+            ? [defaultTier]
+            : ["fast"]
+        : maxAllowedRank >= 1
+            ? ["balanced", "fast"]
+            : ["fast"];
+    for (const t of targetTiers) {
+        if (TIER_RANK[t] > maxAllowedRank)
+            continue;
+        const m = getRoutedModelByTier(t, provider);
+        if (m && m.provider === provider) {
+            return {
+                ...dec,
+                model: m.id,
+                reason: `${dec.reason} | promo-cap(${decTier}→${t})`,
+            };
+        }
+    }
+    // No cheaper model on the same provider — fall back to the session default.
+    return {
+        ...dec,
+        model: defaultModel,
+        reason: `${dec.reason} | promo-cap(${decTier}→default:${defaultModel})`,
+    };
+}
 /**
  * Apply cap-check to a RouteDecision. Walks the downgrade chain if
  * the reservation would breach the cap. Returns the (possibly downgraded) decision.
+ *
+ * `opts` carries both the ledger homeOverride and the session defaultModel used
+ * by the promotion cap. `exempt` skips the promotion cap — used only for the
+ * role path, where the user's explicit roleModels config is itself the opt-in.
  */
-async function capCheck(dec, homeOverride) {
-    let current = { ...dec };
+async function capCheck(dec, opts, exempt) {
+    let current = exempt ? { ...dec } : applyPromotionCap({ ...dec }, opts.defaultModel);
+    const homeOverride = opts.homeOverride;
     let attempts = 0;
     while (attempts++ < getDowngradeChain().length) {
         // If midstream policy already refuses, halt immediately
@@ -305,14 +393,15 @@ export async function decide(prompt, opts) {
                 providerDisabled: isProviderDisabled(provider),
                 multiProviderPreferred: isCouncilMultiProviderPreferred(),
             })) {
+                const peak = adjustPeakHourModel(roleModelId);
                 const d = {
                     tier: "hot",
-                    model: roleModelId,
-                    provider,
-                    reason: `role:${role}→${roleModelId}`,
+                    model: peak.modelId,
+                    provider: peak.provider,
+                    reason: peak.adjusted ? `role:${role}→${peak.modelId}|${peak.reason}` : `role:${role}→${roleModelId}`,
                     source: "role",
                 };
-                const checked = await capCheck(d, opts.homeOverride);
+                const checked = await capCheck(d, opts, /* exempt */ true);
                 routerStore.setState({ tier: checked.tier, lastDecision: checked, taskHash: null, source: "role" });
                 if (cacheKey && !checked.cap_overridden)
                     setCachedRoute(cacheKey, checked);
@@ -328,7 +417,7 @@ export async function decide(prompt, opts) {
     if (pilTier && pilConf >= 0.6) {
         // Use effective (non-disabled) provider when default is disabled
         const effective = resolveTierModel(pilTier, opts.defaultProvider);
-        let tierModel = effective ?? getModelByTier(pilTier, opts.defaultProvider);
+        let tierModel = effective ?? getRoutedModelByTier(pilTier, opts.defaultProvider);
         // Guard: getModelByTier may cross to another provider when defaultProvider
         // has no model for the requested tier. If that cross-provider is disabled,
         // pin to the default model on the default provider instead.
@@ -338,17 +427,21 @@ export async function decide(prompt, opts) {
             isProviderDisabled(tierModel.provider)) {
             tierModel = undefined;
         }
+        const pilModel = tierModel?.id ?? opts.defaultModel;
+        const peak = adjustPeakHourModel(pilModel);
         const d = {
             tier: "hot",
-            model: tierModel?.id ?? opts.defaultModel,
-            provider: tierModel?.provider ?? opts.defaultProvider,
-            reason: effective
-                ? `pil:${pilTier}(${pilConf.toFixed(2)})-rerouted(disabled-default)`
-                : `pil:${pilTier}(${pilConf.toFixed(2)})`,
+            model: peak.modelId,
+            provider: tierModel?.provider ?? peak.provider,
+            reason: peak.adjusted
+                ? `${effective ? `pil:${pilTier}(${pilConf.toFixed(2)})-rerouted(disabled-default)` : `pil:${pilTier}(${pilConf.toFixed(2)})`}|${peak.reason}`
+                : effective
+                    ? `pil:${pilTier}(${pilConf.toFixed(2)})-rerouted(disabled-default)`
+                    : `pil:${pilTier}(${pilConf.toFixed(2)})`,
             confidence: pilConf,
             source: "pil",
         };
-        const checked = await capCheck(d, opts.homeOverride);
+        const checked = await capCheck(d, opts);
         routerStore.setState({
             tier: checked.tier,
             lastDecision: checked,
@@ -364,7 +457,7 @@ export async function decide(prompt, opts) {
     if (c.tier === "hot") {
         // Use effective (non-disabled) provider when default is disabled
         const effective = c.tierHint ? resolveTierModel(c.tierHint, opts.defaultProvider) : undefined;
-        let tierModel = effective ?? (c.tierHint ? getModelByTier(c.tierHint, opts.defaultProvider) : undefined);
+        let tierModel = effective ?? (c.tierHint ? getRoutedModelByTier(c.tierHint, opts.defaultProvider) : undefined);
         // Same guard as the PIL branch above: drop cross-provider fallback when
         // the cross-provider is disabled, so we don't switch to a provider the
         // user has turned off in the splash modal.
@@ -374,14 +467,20 @@ export async function decide(prompt, opts) {
             isProviderDisabled(tierModel.provider)) {
             tierModel = undefined;
         }
+        const hotModel = tierModel?.id ?? opts.defaultModel;
+        const peak = adjustPeakHourModel(hotModel);
         const d = {
             tier: "hot",
-            model: tierModel?.id ?? opts.defaultModel,
-            provider: tierModel?.provider ?? opts.defaultProvider,
-            reason: effective ? `${c.reason}-rerouted(disabled-default)` : c.reason,
+            model: peak.modelId,
+            provider: tierModel?.provider ?? peak.provider,
+            reason: peak.adjusted
+                ? `${effective ? `${c.reason}-rerouted(disabled-default)` : c.reason}|${peak.reason}`
+                : effective
+                    ? `${c.reason}-rerouted(disabled-default)`
+                    : c.reason,
             confidence: c.confidence,
         };
-        const checked = await capCheck(d, opts.homeOverride);
+        const checked = await capCheck(d, opts);
         routerStore.setState({
             tier: checked.tier,
             lastDecision: checked,
@@ -395,7 +494,7 @@ export async function decide(prompt, opts) {
     // Step 2: Warm path (EE /api/route-model, 250ms timeout)
     const w = await callWarmRoute(prompt, { ...opts, context: routeCtx });
     if (w) {
-        const checked = await capCheck(constrainToProvider(w, opts), opts.homeOverride);
+        const checked = await capCheck(constrainToProvider(w, opts), opts);
         routerStore.setState({
             tier: checked.tier,
             lastDecision: checked,
@@ -409,7 +508,7 @@ export async function decide(prompt, opts) {
     // Step 3: Cold path (EE /api/cold-route, 1s timeout)
     const cd = await callColdRoute(prompt, { ...opts, context: routeCtx });
     if (cd) {
-        const checked = await capCheck(constrainToProvider(cd, opts), opts.homeOverride);
+        const checked = await capCheck(constrainToProvider(cd, opts), opts);
         routerStore.setState({
             tier: "cold",
             lastDecision: checked,
@@ -422,15 +521,18 @@ export async function decide(prompt, opts) {
     }
     // Step 4: Final fallback when EE entirely unreachable
     const effective = resolveEffectiveDefaults(opts);
+    const peak = adjustPeakHourModel(effective.model);
     const fallback = {
         tier: routerStore.getState().degraded ? "degraded" : "hot",
-        model: effective.model,
-        provider: effective.provider,
-        reason: effective.provider !== opts.defaultProvider
-            ? "fallback:ee-unreachable+rerouted(disabled-default)"
-            : "fallback:ee-unreachable",
+        model: peak.modelId,
+        provider: peak.provider,
+        reason: peak.adjusted
+            ? `${effective.provider !== opts.defaultProvider ? "fallback:ee-unreachable+rerouted(disabled-default)" : "fallback:ee-unreachable"}|${peak.reason}`
+            : effective.provider !== opts.defaultProvider
+                ? "fallback:ee-unreachable+rerouted(disabled-default)"
+                : "fallback:ee-unreachable",
     };
-    const checked = await capCheck(fallback, opts.homeOverride);
+    const checked = await capCheck(fallback, opts);
     routerStore.setState({
         lastDecision: checked,
         taskHash: null,

package/dist/src/router/peak-hour.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Peak-hour routing — rules loaded from catalog API `provider_policies.peak_hour`
+ * (vendor-sourced metadata). User settings only toggle enabled + switch/downgrade mode.
+ */
+import type { CatalogProviderPeakHour } from "../models/catalog-client.js";
+import type { ProviderId } from "../providers/types.js";
+import type { ModelInfo } from "../types/index.js";
+import { type PeakHourPolicy } from "../utils/settings.js";
+export type PeakHourMode = "downgrade" | "switch";
+export interface PeakHourAdjustment {
+    modelId: string;
+    provider: ProviderId;
+    adjusted: boolean;
+    reason?: string;
+}
+export declare function hourInTimezone(now: Date, timezone: string): number;
+/** @deprecated Use hourInTimezone — kept for tests referencing UTC+8. */
+export declare function hourUtc8(now: Date): number;
+export declare function peakHourWindows(rule: CatalogProviderPeakHour): Array<{
+    start_hour: number;
+    end_hour: number;
+}>;
+export declare function isPeakHourForProvider(provider: ProviderId, now: Date, userPolicy?: PeakHourPolicy): boolean;
+/** @deprecated Use isPeakHourForProvider(provider, ...) — window is per-provider from catalog. */
+export declare function isPeakHourUtc8(now: Date, userPolicy: PeakHourPolicy): boolean;
+/**
+ * Adjust a concrete model id for peak-hour policy. No-op outside the provider's
+ * catalog-defined window or when user policy is disabled.
+ */
+export declare function adjustPeakHourModel(modelId: string, opts?: {
+    now?: Date;
+    policy?: PeakHourPolicy;
+}): PeakHourAdjustment;
+/** Tier lookup with peak-hour adjustment applied to the resolved model. */
+export declare function getRoutedModelByTier(tier: "fast" | "balanced" | "premium", preferProvider?: string, opts?: {
+    now?: Date;
+    policy?: PeakHourPolicy;
+}): ModelInfo | undefined;