npm - shraga - Versions diffs - 0.1.88 → 0.1.89 - Mend

shraga 0.1.88 → 0.1.89

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (12) hide show

package/dist/client/assets/{index-BSvY0squ.js → index-B-8NBGtJ.js} +38 -38
package/dist/client/index.html +1 -1
package/package.json +1 -1
package/src/client/components/ConversationHeader.tsx +54 -11
package/src/client/components/ConversationPane.tsx +8 -1
package/src/client/lib/ws.ts +1 -1
package/src/server/claude.ts +14 -3
package/src/server/engine/claude-code.ts +27 -4
package/src/server/engine/index.ts +20 -8
package/src/server/scheduler/builtins.ts +15 -1
package/src/server/scheduler/runner.ts +5 -4
package/src/server/sessions.ts +11 -3

package/dist/client/index.html CHANGED Viewed

@@ -13,7 +13,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/assets/index-BSvY0squ.js"></script>
+    <script type="module" crossorigin src="/assets/index-B-8NBGtJ.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-J2NH6FvE.css">
   </head>
   <body>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "shraga",
-  "version": "0.1.88",
+  "version": "0.1.89",
   "description": "The teammate you delegate coding to — a self-hostable, multi-user AI coding agent web UI (Claude Code, with a pluggable engine seam).",
   "type": "module",
   "main": "./src/index.ts",

package/src/client/components/ConversationHeader.tsx CHANGED Viewed

@@ -11,11 +11,45 @@ interface SessionDirectives {
   engine?: string;
 }
+/** What the chips must report: the engine/model that ACTUALLY ran, and whether that disagrees with
+ *  what this session asks for. Pure, so the rule is testable without a DOM.
+ *
+ *  The bug this replaces: the old code inferred the engine from the model id's SHAPE (bare ⇒ native)
+ *  and threw away the runtime-recorded model whenever the shape disagreed with the requested engine —
+ *  i.e. precisely in the case where a run had silently switched provider. The header was structurally
+ *  incapable of reporting a fallback, so a run that billed Anthropic still showed the Cursor chips.
+ *  Runtime ground truth now arrives as a self-consistent (engine, model) PAIR, so nothing is inferred. */
+export function deriveRuntimeBadges(input: {
+  requestedEngine?: string;
+  requestedModel?: string;
+  /** Engine that ran the last turn (session meta `lastEngine`). */
+  actualEngine?: string;
+  /** Model that engine resolved (session meta `lastModel`). */
+  actualModel?: string;
+}) {
+  const requestedEngine = input.requestedEngine || 'claude-code';
+  const engine = input.actualEngine || requestedEngine;
+  // A mismatch is a fact worth showing, not something to launder away: the last turn ran somewhere
+  // other than where this session currently asks to run.
+  const engineMismatch = input.actualEngine && input.actualEngine !== requestedEngine ? requestedEngine : undefined;
+  const engineIsNative = engine === 'claude-code' || engine === 'cursor';
+  // Only trust the recorded model when we also know which engine recorded it — the pair, or neither.
+  const rawModel =
+    (input.actualEngine ? input.actualModel : undefined) ||
+    input.requestedModel ||
+    (engine === 'cursor' ? 'cursor/composer-2.5' : 'sonnet-4-6');
+  // Provider = the model's prefix; a bare id belongs to the engine that ran it (claude-code ⇒ anthropic,
+  // an add-on engine ⇒ that engine's own provider) — never assume anthropic just because a prefix is absent.
+  const billingProvider = rawModel.includes('/') ? rawModel.split('/')[0] : engine === 'claude-code' ? 'anthropic' : engine;
+  return { engine, engineIsNative, engineMismatch, rawModel, billingProvider };
+}
 function InfoBadges({
   sessionId,
   config,
   sessionDirectives,
   actualModel,
+  actualEngine,
   scheduleId,
   onScheduleClick,
 }: {
@@ -24,19 +58,19 @@ function InfoBadges({
   sessionDirectives?: SessionDirectives;
   /** Model the engine actually resolved at runtime (session meta `lastModel`) — beats configured/requested. */
   actualModel?: string;
+  /** Engine that actually ran the last turn (session meta `lastEngine`). Ground truth, arriving in the
+   *  same `model_resolved` event as `actualModel` — so the pair never has to be inferred from a shape. */
+  actualEngine?: string;
   scheduleId?: string;
   onScheduleClick?: () => void;
 }) {
   const [copied, setCopied] = useState(false);
-  const engine = sessionDirectives?.engine || config.engine || 'claude-code';
-  // The native Claude Code engine records a bare `claude-*` id; a multi-provider add-on engine records
-  // a `provider/model` id. Trust the recorded model only when its shape matches the current engine
-  // family, or a session that has since switched engines would show the previous engine's model.
-  const recordedByNative = actualModel ? !actualModel.includes('/') : undefined;
-  const engineIsNative = engine === 'claude-code' || engine === 'cursor';
-  const trustedActual = recordedByNative !== undefined && recordedByNative === engineIsNative ? actualModel : undefined;
-  const rawModel =
-    trustedActual || sessionDirectives?.model || config.model || (engine === 'cursor' ? 'cursor/composer-2.5' : 'sonnet-4-6');
+  const { engine, engineIsNative, engineMismatch, rawModel, billingProvider } = deriveRuntimeBadges({
+    requestedEngine: sessionDirectives?.engine || config.engine,
+    requestedModel: sessionDirectives?.model || config.model,
+    actualEngine,
+    actualModel,
+  });
   // A multi-provider add-on engine runs any provider's model through its own loop, so it must be
   // distinguishable from a native runtime running the same model. Prefix such a model with the engine
   // name; native engines (claude-code, cursor) show the model plainly. Engine name comes from data.
@@ -46,8 +80,6 @@ function InfoBadges({
   // engine / provider-prefixed model runs on that provider's key (ai.libx.js adapters throw without
   // one). What that key COSTS is plan-dependent and NOT knowable here (Anthropic API is metered;
   // a Cursor key may draw on a Cursor subscription) — so we label the mechanism, not the billing.
-  // Provider = the model's prefix (bare ⇒ anthropic).
-  const billingProvider = rawModel.includes('/') ? rawModel.split('/')[0] : 'anthropic';
   const onSubscription = engine === 'claude-code' && config.claudeAuthSource === 'subscription';
   // Tone: green = claude.ai login (no key); amber = provider key whose usage may be subscription-
   // covered (Cursor); rose = provider key that is genuinely metered (Anthropic/OpenAI/etc.).
@@ -87,6 +119,14 @@ function InfoBadges({
       >
         {onSubscription ? 'sub' : `API·${billingProvider}`}
       </span>
+      {engineMismatch && (
+        <span
+          title={`This session requests the "${engineMismatch}" engine, but the last turn actually ran on "${engine}" — so the chips above report ${engine}, and that provider was billed.`}
+          className="inline-flex items-center rounded-md bg-rose-50 px-1.5 py-0.5 text-[10px] font-medium text-rose-700 ring-1 ring-inset ring-rose-600/20 dark:bg-rose-950/50 dark:text-rose-300 dark:ring-rose-400/30"
+        >
+          ≠ {engineMismatch}
+        </span>
+      )}
       <span className="inline-flex items-center rounded-md bg-amber-50 px-1.5 py-0.5 text-[10px] font-medium text-amber-700 ring-1 ring-inset ring-amber-600/20 dark:bg-amber-950/50 dark:text-amber-300 dark:ring-amber-400/30">
         {permLabel}
       </span>
@@ -127,6 +167,7 @@ export interface ConversationHeaderProps {
   agentConfig: AgentConfig;
   sessionDirectives?: SessionDirectives;
   sessionLastModel?: string;
+  sessionLastEngine?: string;
   sessionScheduleId?: string;
   artifactCount: number;
   getToken: () => Promise<string | null>;
@@ -143,6 +184,7 @@ export function ConversationHeader({
   agentConfig,
   sessionDirectives,
   sessionLastModel,
+  sessionLastEngine,
   sessionScheduleId,
   artifactCount,
   getToken,
@@ -159,6 +201,7 @@ export function ConversationHeader({
         config={agentConfig}
         sessionDirectives={sessionDirectives}
         actualModel={sessionLastModel}
+        actualEngine={sessionLastEngine}
         scheduleId={sessionScheduleId}
         onScheduleClick={onScheduleClick}
       />

package/src/client/components/ConversationPane.tsx CHANGED Viewed

@@ -43,6 +43,9 @@ export function ConversationPane({ nodeId, sessionId }: { nodeId: string; sessio
   const [sessionDirectives, setSessionDirectives] = useState<SessionDirectives | undefined>();
   const [sessionScheduleId, setSessionScheduleId] = useState<string | undefined>();
   const [sessionLastModel, setSessionLastModel] = useState<string | undefined>();
+  // Engine that ACTUALLY ran the last turn — always set/cleared together with sessionLastModel, since
+  // the pair is the runtime ground truth the header reports (neither half may be inferred).
+  const [sessionLastEngine, setSessionLastEngine] = useState<string | undefined>();
   const [multiParticipant, setMultiParticipant] = useState(false);
   const artifacts = useArtifacts(currentSessionId, ws.getToken, ws.token);
@@ -66,9 +69,10 @@ export function ConversationPane({ nodeId, sessionId }: { nodeId: string; sessio
       } else if (event.type === 'directives') {
         // Optimistic-then-confirm pill: drop stale ground-truth so the pill shows the just-requested
         // model. Untagged event — gate on this pane being mid-turn so idle panes don't flicker.
-        if (busyRef.current) setSessionLastModel(undefined);
+        if (busyRef.current) { setSessionLastModel(undefined); setSessionLastEngine(undefined); }
       } else if (event.type === 'model_resolved' && event.sessionId === currentSessionIdRef.current) {
         setSessionLastModel(event.model);
+        setSessionLastEngine(event.engine);
       }
     },
     [ws, nodeId, artifacts],
@@ -113,6 +117,7 @@ export function ConversationPane({ nodeId, sessionId }: { nodeId: string; sessio
       setSessionDirectives(undefined);
       setSessionScheduleId(undefined);
       setSessionLastModel(undefined);
+      setSessionLastEngine(undefined);
       return;
     }
     apiFetch(`/api/sessions/${currentSessionId}/meta`, ws.getToken)
@@ -121,6 +126,7 @@ export function ConversationPane({ nodeId, sessionId }: { nodeId: string; sessio
         setSessionDirectives(meta.directives);
         setSessionScheduleId(meta.scheduleId);
         setSessionLastModel(meta.lastModel);
+        setSessionLastEngine(meta.lastEngine);
         if (meta.runStatus === 'running') conv.setBusy(true);
       })
       .catch(() => {});
@@ -221,6 +227,7 @@ export function ConversationPane({ nodeId, sessionId }: { nodeId: string; sessio
         agentConfig={ws.agentConfig}
         sessionDirectives={sessionDirectives}
         sessionLastModel={sessionLastModel}
+        sessionLastEngine={sessionLastEngine}
         sessionScheduleId={sessionScheduleId}
         artifactCount={artifacts.artifacts.length}
         getToken={ws.getToken}

package/src/client/lib/ws.ts CHANGED Viewed

@@ -26,7 +26,7 @@ export type ServerEvent =
   | { type: 'session_id'; sessionId: string }
   | { type: 'forked'; sourceSessionId: string; sessionId: string }
   | { type: 'done'; sessionId: string; stopReason?: 'end_turn' | 'max_turns_reached' | (string & {}) }
-  | { type: 'model_resolved'; sessionId: string; model: string }
+  | { type: 'model_resolved'; sessionId: string; model: string; engine: string }
   | { type: 'error'; message: string; sessionId?: string }
   | { type: 'workspace_change'; action: 'created' | 'modified' | 'deleted'; path: string }
   | { type: 'disconnected' }

package/src/server/claude.ts CHANGED Viewed

@@ -81,7 +81,7 @@ export type WsEvent =
   | { type: 'question_request'; id: string; questions: AskQuestion[] }
   | { type: 'thinking_delta'; text: string }
   | { type: 'done'; sessionId: string; stopReason?: 'end_turn' | 'max_turns_reached' | (string & {}); builtinHandled?: boolean }
-  | { type: 'model_resolved'; sessionId: string; model: string }
+  | { type: 'model_resolved'; sessionId: string; model: string; engine: string }
   | { type: 'error'; message: string }
   | { type: 'stats'; sample: { t: number; cpu: number; mem: number; load: number; disk: number; diskUsedBytes?: number; diskTotalBytes?: number } };
 // Add-on engines/features emit their OWN events (e.g. a duplex voice brain's `duplex_*`) through the
@@ -356,8 +356,19 @@ export async function* streamChat(opts: {
     console.log(`[stream] turn-context injected (${turnContext.length} chars) for session=${sessionId}`);
   }
-  // Resolve engine and delegate
-  const engine = resolveAndGetEngine(directives as any, config);
+  // Resolve engine and delegate. An unregistered engine is a HARD stop: rerouting to claude-code
+  // would switch provider and billing under the caller while the UI still showed the requested one.
+  // Surfaced as a turn `error` event (not a throw) so every transport — WS, Slack, scheduler, MCP,
+  // webhook — reports it the same way and a scheduled run is marked failed instead of dying.
+  let engine: ReturnType<typeof resolveAndGetEngine>;
+  try {
+    engine = resolveAndGetEngine(directives as any, config);
+  } catch (err) {
+    const message = (err as Error).message;
+    console.error(`[stream] ${message} (user=${opts.uid} session=${sessionId})`);
+    yield { type: 'error', message };
+    return;
+  }
   console.log(`[stream] engine=${engine.name} user=${opts.uid} session=${sessionId}`);
   yield* engine.stream({

package/src/server/engine/claude-code.ts CHANGED Viewed

@@ -10,7 +10,7 @@ import { registerProactiveMessage } from '../slack/sessions.ts';
 import { registerPoll } from '../polls.ts';
 import { getSession, setSessionModel, getSessionModel, type ConvMessage } from '../sessions.ts';
 import { DEFAULT_MODEL } from '../directives.ts';
-import { resolveModelSwitch } from '../model-aliases.ts';
+import { resolveModelSwitch, MODEL_ALIASES } from '../model-aliases.ts';
 import type { WsEvent, AskQuestion, QuestionAnswers, QuestionHandler } from '../claude.ts';
 import type { AgentEngine, EngineStreamOpts, EngineModel } from './types.ts';
 import { getPromptSuffix } from '../prompt-suffix.ts';
@@ -41,6 +41,16 @@ const DESTRUCTIVE_DATA_PATTERNS = [
   />\s*data\/(conversations?|sessions?|schedules?)\//i,
 ];
+/** Is `id` a model this engine can actually run? Anything else — notably a foreign id like
+ *  `cursor/composer-2.5` or the bare `composer-2.5` a schedule pinned for another engine — used to be
+ *  forwarded straight to the Anthropic SDK, billing Anthropic for a model the caller never asked it
+ *  for. Shape-based rather than an exact list so dated ids (`claude-sonnet-4-5-20250929`) still pass.
+ *  An explicit `anthropic/` prefix is this engine's own provider and is stripped first. */
+function isOwnModel(id: string): boolean {
+  const bare = id.startsWith('anthropic/') ? id.slice('anthropic/'.length) : id;
+  return bare.startsWith('claude-') || bare.toLowerCase() in MODEL_ALIASES;
+}
 type DenyResult = { behavior: 'deny'; message: string };
 function checkSensitiveAccess(toolName: string, input: Record<string, unknown>): DenyResult | null {
@@ -303,7 +313,20 @@ export class ClaudeCodeEngine implements AgentEngine {
     // Always pass an explicit model — left unset, the CLI applies its own default
     // (observed: Opus 4.7), not what the UI's "Default" label promises.
-    options['model'] = directives.model ?? config.model ?? DEFAULT_MODEL;
+    const requestedModel = directives.model || config.model || DEFAULT_MODEL;
+    // Refuse a model that isn't ours instead of posting it to Anthropic. Substituting our default
+    // silently would be the same billing lie in a different costume, so this ends the turn.
+    if (!isOwnModel(requestedModel)) {
+      const message =
+        `Model "${requestedModel}" does not belong to the ${this.name} engine, so this run was stopped ` +
+        `rather than billed to Anthropic under another provider's model name. Pick a Claude model, or ` +
+        `request the engine that owns it (e.g. \`[engine:cursor,model:${requestedModel}]\`) and make sure ` +
+        `that engine is registered on this server.`;
+      console.error(`[claude] ${message}`);
+      yield { type: 'error', message };
+      return;
+    }
+    options['model'] = requestedModel;
     const thinkingMode = directives.thinking ?? config.thinking;
     if (thinkingMode) options['thinking'] = thinkingMode === 'enabled' ? { type: 'enabled' } : { type: thinkingMode };
     const effort = directives.effort ?? config.effort;
@@ -412,11 +435,11 @@ export class ClaudeCodeEngine implements AgentEngine {
               prior: opts.sessionId ? getSessionModel(opts.sessionId) : undefined,
             });
             if (sw.notice) yield { type: 'text_delta', text: sw.notice };
-            if (opts.sessionId) setSessionModel(opts.sessionId, m.model);
+            if (opts.sessionId) setSessionModel(opts.sessionId, m.model, this.name);
             // Live ground-truth so the header pill confirms the actually-resolved model mid-turn
             // (catches inline overrides like [opus] and silent rate-limit fallbacks) instead of
             // only updating on session reload.
-            yield { type: 'model_resolved', sessionId: opts.sessionId ?? '', model: m.model };
+            yield { type: 'model_resolved', sessionId: opts.sessionId ?? '', model: m.model, engine: this.name };
           }
           const servers = m.mcp_servers;
           if (Array.isArray(servers) && servers.length > 0) {

package/src/server/engine/index.ts CHANGED Viewed

@@ -15,7 +15,8 @@ export async function initEngines(): Promise<void> {
   // Core always registers the Claude Code engine (the CE default — @anthropic-ai/claude-agent-sdk).
   // Optional engines are registered by an add-on through the same `registerEngine` seam when the
   // SHRAGA_OVERLAY loads (it's imported before the server serves any turn). Bare CE runs Claude Code
-  // only; a directive requesting an unregistered engine falls back to claude-code (resolveAndGetEngine).
+  // only; a directive requesting an unregistered engine FAILS the turn (resolveAndGetEngine) rather
+  // than rerouting to another vendor's billing.
   registerEngine(new ClaudeCodeEngine());
   // Let `[<model>]` name ANY registered engine's model (e.g. `[composer-2.5]`) and imply its engine.
@@ -49,15 +50,26 @@ export function resolveEngine(directives?: { engine?: string }, agentConfig?: {
   return 'claude-code';
 }
+/** Requested engine isn't registered on this boot. Carries an actionable message; callers surface it
+ *  as a turn error (see streamClaude) — never as a reroute to a different vendor's engine/billing. */
+export class EngineUnavailableError extends Error {
+  constructor(public readonly engine: string, available: string[]) {
+    super(
+      `Engine "${engine}" is not available on this server. Registered engines: ${available.join(', ') || 'none'}. ` +
+        `Optional engines register only when enabled at boot (AGENT_ENGINES must list the engine; the native ` +
+        `cursor engine also needs CURSOR_API_KEY) — check the server env and startup log, then retry. ` +
+        `The run was stopped rather than silently re-routed to another provider's billing.`,
+    );
+    this.name = 'EngineUnavailableError';
+  }
+}
 export function resolveAndGetEngine(directives?: { engine?: string }, agentConfig?: { engine?: string }) {
   const name = resolveEngine(directives, agentConfig);
   // An optional engine may be unregistered on a given boot (add-on not loaded, missing API key or
-  // failed init). Don't let that throw and kill every run — including scheduled jobs like the daily
-  // digest, which resolve the engine from the global agent-config. Fall back to the always-present
-  // claude-code engine with a warning instead.
-  if (!hasEngine(name)) {
-    console.warn(`[engine] "${name}" not registered (available: ${getAvailableEngines().join(', ') || 'none'}) — falling back to claude-code`);
-    return getEngine('claude-code');
-  }
+  // failed init). Rerouting to claude-code here silently switched PROVIDER AND BILLING under the
+  // caller — a cursor/agentx run billed Anthropic while the UI still showed the cursor chips. Fail
+  // loudly instead; the degradation is surfaced to whoever asked (user, schedule) as a turn error.
+  if (!hasEngine(name)) throw new EngineUnavailableError(name, getAvailableEngines());
   return getEngine(name);
 }

package/src/server/scheduler/builtins.ts CHANGED Viewed

@@ -138,7 +138,11 @@ export function ensureBuiltinSchedules(schedules: Schedule[]): Schedule[] {
         match: { status: 'error' },
         throttle: { byFields: ['name', 'error'], windowSec: 21600 },
       },
-      task: { kind: 'prompt', prompt: FAILURE_NOTIFIER_PROMPT },
+      // Pinned to the always-registered engine ON PURPOSE. Left unpinned, this run inherits whatever
+      // agent-config.json's global `engine` happens to be — and an optional engine can simply not
+      // register on a given boot (add-on absent, missing API key), which is exactly the failure this
+      // job exists to report. Its own alert must not be the second casualty.
+      task: { kind: 'prompt', prompt: FAILURE_NOTIFIER_PROMPT, engine: 'claude-code' },
       scope: 'system',
       createdBy: { uid: SYSTEM_UID, email: 'system@shraga.local' },
       createdAt: now,
@@ -163,6 +167,16 @@ export function ensureBuiltinSchedules(schedules: Schedule[]): Schedule[] {
       existing.scope = builtin.scope;
       existing.trigger = existing.trigger ?? builtin.trigger;
       existing.createdBy = builtin.createdBy;
+      // A builtin's stored task is preserved (deployments edit the prompt) — with one exception: an
+      // engine/model pin is only meaningful as a PAIR. A stored task with a `model` but no `engine`
+      // was resolved against whatever the ambient global config was at the time, which is how the
+      // failure notifier ended up pinned to `composer-2.5` while running on claude-code. So when the
+      // builtin pins an engine and the stored task pins NONE, adopt the builtin's pair wholesale.
+      // An explicit stored `engine` is a real operator choice and is left untouched.
+      if (builtin.task.kind !== 'job' && existing.task.kind !== 'job' && builtin.task.engine && !existing.task.engine) {
+        existing.task.engine = builtin.task.engine;
+        existing.task.model = builtin.task.model;
+      }
     } else {
       schedules.push(builtin);
     }

package/src/server/scheduler/runner.ts CHANGED Viewed

@@ -219,10 +219,11 @@ export async function runSchedule(
   // task.engine/task.model ride the same prompt-directive channel users type by hand —
   // parseDirectives strips them and resolves aliases. Prepending (vs new plumbing) also persists the
   // choice into the saved prompt, so the session UI shows what the schedule actually requested.
-  if (!resume) {
-    const pins = [task.engine && `engine:${task.engine}`, task.model && `model:${task.model}`].filter(Boolean);
-    if (pins.length) prompt = `[${pins.join(',')}] ${prompt}`;
-  }
+  // Applied on RESUME too: a resume's prompt is a fresh "continue where you left off" string, not the
+  // saved original, so skipping this here silently dropped the schedule's engine/model pin and let the
+  // resumed turn run on the global default — a different engine, and a different vendor's bill.
+  const pins = [task.engine && `engine:${task.engine}`, task.model && `model:${task.model}`].filter(Boolean);
+  if (pins.length) prompt = `[${pins.join(',')}] ${prompt}`;
   // Save the synthesized user prompt to the conversation (skip on resume — task prompt already persisted).
   if (!resume) {

package/src/server/sessions.ts CHANGED Viewed

@@ -38,6 +38,9 @@ export interface SessionMeta {
   directives?: Directives;
   /** Actual model the engine resolved at runtime (from the SDK init message) — ground truth, unlike directives.model which is the request. */
   lastModel?: string;
+  /** Engine that actually ran the last turn — ground truth beside `lastModel`, so the UI can report
+   *  what executed instead of inferring the engine from the model id's shape. */
+  lastEngine?: string;
   forkedFrom?: string;
 }
@@ -189,19 +192,24 @@ export function setSessionDirectives(sessionId: string, directives: NonNullable<
 // Resolved model per running session (set by the engine from the SDK init message).
 // appendMessage stamps assistant messages from this map so every channel records it.
 const liveModels = new Map<string, string>();
+const liveEngines = new Map<string, string>();
 /** Last resolved model for a session (live map first, then persisted lastModel). */
 export function getSessionModel(sessionId: string): string | undefined {
   return liveModels.get(sessionId) ?? loadIndex().find((s) => s.sessionId === sessionId)?.lastModel;
 }
-export function setSessionModel(sessionId: string, model: string): void {
-  if (liveModels.get(sessionId) === model) return;
+/** Record the runtime ground truth for a turn. `engine` is the engine that actually ran it — the
+ *  pair is what the header reports, so neither half may be inferred from the other. */
+export function setSessionModel(sessionId: string, model: string, engine?: string): void {
+  if (liveModels.get(sessionId) === model && (!engine || liveEngines.get(sessionId) === engine)) return;
   liveModels.set(sessionId, model);
+  if (engine) liveEngines.set(sessionId, engine);
   const sessions = loadIndex();
   const s = sessions.find((s) => s.sessionId === sessionId);
-  if (s && s.lastModel !== model) {
+  if (s && (s.lastModel !== model || (engine && s.lastEngine !== engine))) {
     s.lastModel = model;
+    if (engine) s.lastEngine = engine;
     saveIndex(sessions);
   }
 }