sprag-cli 3.56.0 → 3.58.0

package/src/commands/brief.js

@@ -25,7 +25,10 @@ export async function run({ hasFlag }) {
     const parts = [];
     try {
       const { runBrief } = await import('../brief.js');
-      const out = await runBrief({ sessionId: ctx.session_id, transcriptPath: ctx.transcript_path });
+      // `root` is the session's cwd for the same reason routeHint takes it below:
+      // the settings that name the model and the compaction window are the
+      // project's, not those of whatever directory the hook was spawned in.
+      const out = await runBrief({ sessionId: ctx.session_id, transcriptPath: ctx.transcript_path, root: ctx.cwd || process.cwd() });
       if (out) parts.push(out);
     } catch (e) { debug('brief:hook', e); /* briefing is best-effort — never block a prompt */ }
     // State the matching delegation rule as a fact about this request. Registered
@@ -34,7 +37,7 @@ export async function run({ hasFlag }) {
     // the match here removes both steps. Silent unless it is sure — see
     // src/route-inject.js.
     try {
-      const { routeHint, sessionModelRank } = await import('../route-inject.js');
+      const { routeHint, routeMatch, matchCaps, sessionModelRank } = await import('../route-inject.js');
       // The payload names the session but not its model, so the rank comes from
       // the transcript: without it a Sonnet session is told to delegate to
       // Sonnet, which saves nothing.
@@ -46,8 +49,16 @@ export async function run({ hasFlag }) {
       // differ. Claude Code sends `cwd` for that reason and the PreToolUse hook
       // already reads it (src/delegation-guard.js). A payload without the field
       // leaves root undefined, which is the behaviour this had before.
-      const hint = routeHint(ctx.prompt, { sessionRank, root: ctx.cwd });
+      const match = routeMatch(ctx.prompt, { sessionRank });
+      const hint = routeHint(ctx.prompt, { sessionRank, root: ctx.cwd, match });
       if (hint) parts.push(hint);
+      // The delegation guard repeats these caps to the subagent, so the limit it
+      // works under is the one this hint states. A prompt with no match clears
+      // the record of the turn before it.
+      try {
+        const { recordRouteCaps } = await import('../route-caps.js');
+        recordRouteCaps(ctx.session_id, matchCaps(match));
+      } catch (e) { debug('brief:route-caps', e); }
     } catch (e) { debug('brief:route-hint', e); }
     if (parts.length) console.log(parts.join('\n'));
     return;

package/src/commands/codex-delegate.js

@@ -3,7 +3,7 @@ import { configureCodexHooks } from '../codex-installer.js';
 import { validateCodexTarget, loadCodexModelRules, addCodexModelRule, removeCodexModelRule } from '../codex-delegation.js';
 import { findCodexCandidate, resolveCodexCandidate } from '../codex-route-scan.js';
 import { codexRoutingSavedTotals, loadCodexLedger } from '../codex-ledger.js';
-import { codexRuleHealth } from '../codex-rule-health.js';
+import { codexRuleHealth, codexRulesInReview } from '../codex-rule-health.js';
 import { signedUsd } from '../money.js';
 import { codexProviderName } from '../agent.js';
 
@@ -15,7 +15,6 @@ export function run({ args, getArg, hasFlag, root }) {
       throw new Error(`${flag} requires a value.`);
     }
   }
-  const rules = loadCodexModelRules();
   if (sub === 'rules') {
     if (args[2] === 'add') {
       if (hasFlag('--global') === hasFlag('--project')) throw new Error('Choose --global or --project for the rule.');
@@ -35,10 +34,11 @@ export function run({ args, getArg, hasFlag, root }) {
     if (!rules.length) console.log('No Codex model rules. Claude rules are not imported.');
     let events = [];
     try { events = Object.values(loadCodexLedger().events); } catch { /* No ledger yet: rules list without outcomes. */ }
+    const inReview = new Set(codexRulesInReview({ rules, events, root: null }).map((x) => x.index));
     rules.forEach((r, i) => {
       const h = codexRuleHealth(r, { events });
       const outcome = h.runs ? ` | measured x${h.runs}, err ${Math.round(h.rate * 100)}%, saved ${signedUsd(h.saved, 4)}` : '';
-      const warn = h.status === 'review' ? ` | rule-health: ${h.errs}/${h.runs} runs failed, narrow the condition or remove (delegate rules rm ${i + 1} --agent codex)` : '';
+      const warn = inReview.has(i + 1) ? ` | rule-health: ${h.errs}/${h.runs} runs failed, narrow the condition or remove (delegate rules rm ${i + 1} --agent codex)` : '';
       console.log(`#${i + 1} ${r.category} | ${r.from} -> ${r.model} | ${r.scope}${r.targetRoot ? ` ${r.targetRoot}` : ''}${outcome}${warn}`);
     });
     return;
@@ -59,7 +59,10 @@ export function run({ args, getArg, hasFlag, root }) {
   }
   console.log(`Codex delegate: ${cfg.codex?.delegate === true ? 'on' : 'off'} (model routing and guidance)`);
   console.log(`Default target: ${cfg.codex?.delegateTarget?.model || 'inherit (no override)'}`);
-  console.log(`Codex rules: ${rules.length}`);
+  // Turning delegation off must work even when the rule file is damaged.
+  let ruleCount;
+  try { ruleCount = String(loadCodexModelRules().length); } catch (e) { ruleCount = `unreadable (${e.message})`; }
+  console.log(`Codex rules: ${ruleCount}`);
   console.log('Explicit spawn models and custom roles are preserved. Targets must be available from your Codex provider.');
   const saved = codexRoutingSavedTotals();
   console.log(saved.priced

package/src/commands/codex.js

@@ -151,6 +151,8 @@ export async function run({ args, version }) {
     if (args[1] === 'savings') {
       const { refreshCodexLedger, loadCodexLedger, codexRoutingSavedTotals } = await import('../codex-ledger.js');
       if (hasFlag('--refresh')) await refreshCodexLedger();
+      // The prompt hook runs this detached to price finished delegations.
+      if (hasFlag('--quiet')) return;
       const events = Object.entries(loadCodexLedger().events).map(([id, e]) => ({ id, ...e })).sort((a, b) => b.ts - a.ts);
       const totals = codexRoutingSavedTotals();
       if (format === 'json') { console.log(JSON.stringify({ agent: 'codex', totals, events }, null, 2)); return; }

package/src/commands/harness.js

@@ -106,6 +106,12 @@ export async function run({ args, hasFlag }) {
       for (const p of r.backedUp) console.log(`Backed up: ${p}`);
       for (const p of r.wrote) console.log(`Wrote:     ${p}`);
       for (const p of r.skipped) console.log(`Skipped:   ${p}`);
+      if (r.brokenBlock) {
+        // Nothing was written to CLAUDE.md, so claiming success would hide it.
+        console.log('\n🅷 Harness not initialized: repair the block markers in CLAUDE.md, then run this again.');
+        process.exitCode = 1;
+        return;
+      }
       console.log('\n🅷 Harness initialized. Statusline will show 🅷 5/5 on next refresh.');
       return;
     }

package/src/commands/install.js

@@ -11,6 +11,11 @@
  * registered globally, and Codex is set up too when ~/.codex exists. `--manual`
  * restores the step-by-step questions (they still need a terminal attached).
  * `--yes` and `--no-input` are accepted as the explicit spelling of the default.
+ *
+ * One question survives the automatic mode: when a statusline that is not ours
+ * is already configured and a terminal is attached, the install asks whether to
+ * merge (theirs first, sprag below; default), replace, or keep. Without a
+ * terminal (postinstall, CI, pipes) it keeps theirs, as before.
  */
 
 import { debug } from '../debug.js';
@@ -21,7 +26,7 @@ class SkipStep extends Error {}
 export async function run({ hasFlag }) {
     const { installAll } = await import('../installer.js');
     const { userLanguage, languageDecided, setUserLanguage } = await import('../config.js');
-    const { canPrompt, confirm } = await import('../prompt.js');
+    const { canPrompt, confirm, choose } = await import('../prompt.js');
     const force = hasFlag('--force');
     // Automatic unless asked otherwise. A question per step turned the install
     // into a dozen answers before any work, and every answer has a sensible
@@ -30,6 +35,9 @@ export async function run({ hasFlag }) {
     // attached, so postinstall, CI and pipes never wait on input.
     const manual = hasFlag('--manual') && !hasFlag('--yes') && !hasFlag('--no-input');
     const interactive = manual && canPrompt();
+    // The foreign-statusline question is asked in the automatic install too: it
+    // is the one decision with no safe default that preserves both parties.
+    const tty = canPrompt();
 
     // Output language, decided first because every line below it — and every
     // briefing the hooks inject from here on — is written in it. Until now it
@@ -82,25 +90,28 @@ export async function run({ hasFlag }) {
       let s = r.statusline;
       // A different statusline is already installed. Replacing it silently
       // would be rude and leaving it silently loses the tool's main surface,
-      // so with a human attached the install asks. Default is "keep yours":
-      // an accidental Enter must not clobber someone's custom statusline.
-      if (s.action === 'skipped' && s.conflict && interactive) {
+      // so with a human attached the install asks. Default is "merge": their
+      // output stays and ours goes below it, so nobody loses anything.
+      if (s.action === 'skipped' && s.conflict && tty) {
+        const { installStatusline } = await import('../installer.js');
         console.log('');
         console.log(lang === 'ko'
           ? `  statusline: 기존 statusline이 이미 설정되어 있습니다: ${s.existingCommand}`
           : `  statusline: an existing statusline is already configured: ${s.existingCommand}`);
-        console.log(lang === 'ko'
-          ? '              교체하면 토큰·캐시·상한 경고가 statusline에 표시됩니다. 기존 설정은 사라집니다.'
-          : '              replacing it shows token/cache/cap warnings in the statusline; the current one is removed.');
-        const replace = await confirm(lang === 'ko'
-          ? '              sprag statusline으로 교체할까요?'
-          : '              Replace it with the sprag statusline?', { defaultValue: false });
-        if (replace) {
-          const { installStatusline } = await import('../installer.js');
+        const pick = await choose(lang === 'ko'
+          ? '              statusline을 어떻게 표시할까요?'
+          : '              How should the statusline be shown?', [
+          { key: 'merge', label: lang === 'ko' ? '함께 표시: 기존 출력 아래에 sprag 줄을 붙입니다' : 'merge: your output first, sprag lines below' },
+          { key: 'replace', label: lang === 'ko' ? '교체: sprag statusline만 표시하고 기존 설정은 지웁니다' : 'replace: sprag statusline only, the old one is removed' },
+          { key: 'keep', label: lang === 'ko' ? '유지: 기존 statusline만 두고 sprag은 표시하지 않습니다' : 'keep: leave yours, no sprag statusline' },
+        ], { defaultIndex: 0, defaultHint: lang === 'ko' ? '(기본값)' : '(default)' });
+        if (pick === 'merge') {
+          s = installStatusline({ merge: true });
+        } else if (pick === 'replace') {
           s = installStatusline({ force: true });
         } else {
           s = { ...s, reason: lang === 'ko'
-            ? '기존 statusline을 유지했습니다. 교체하려면 `sprag install --force`'
+            ? '기존 statusline을 유지했습니다. 바꾸려면 `sprag install --force`'
             : 'kept your statusline — replace later with `sprag install --force`' };
         }
       }

package/src/compact-window.js

@@ -111,6 +111,10 @@ export function isOneMillionModel(model) {
   return typeof model === 'string' && ONE_M_RE.test(model);
 }
 
+// A window Claude Code itself reported for the session (statusline payload).
+// Anything this large can only be the 1M window.
+export const LIVE_1M_MIN = 900_000;
+
 /** Effective autoCompactWindow, with the source that won. */
 export function effectiveWindow(root) {
   const env = process.env.CLAUDE_CODE_AUTO_COMPACT_WINDOW;
@@ -137,10 +141,14 @@ export function effectiveWindow(root) {
  *
  * `reason` names why it is not ok: 'unset' (no autoCompactWindow anywhere) or
  * 'too-large' (set, but above 700k — still lets context run away).
+ *
+ * `liveWindow` is the window Claude Code reported for the running session. The
+ * model id alone misses every model that is 1M without a `[1m]` suffix, so a
+ * reported size settles it whenever the caller has one.
  */
-export function compactWindowStatus({ root = process.cwd() } = {}) {
+export function compactWindowStatus({ root = process.cwd(), liveWindow = null } = {}) {
   const { model, source: modelSource } = resolveModelId(root);
-  const is1m = isOneMillionModel(model);
+  const is1m = isOneMillionModel(model) || (Number.isFinite(liveWindow) && liveWindow >= LIVE_1M_MIN);
   const win = effectiveWindow(root);
   const base = {
     model,
@@ -163,10 +171,10 @@ export function compactWindowStatus({ root = process.cwd() } = {}) {
  * Statusline chip text, or null when there is nothing to say. Kept to the same
  * short shape as the other 🅷⚠ warnings so the line stays single-width.
  */
-export function compactWindowWarningForStatusline(root = process.cwd(), cfg = null) {
+export function compactWindowWarningForStatusline(root = process.cwd(), cfg = null, { liveWindow = null } = {}) {
   if (cfg && cfg.compactWindow && cfg.compactWindow.enabled === false) return null;
   try {
-    const s = compactWindowStatus({ root });
+    const s = compactWindowStatus({ root, liveWindow });
     return s.ok ? null : 'compact-window?';
   } catch (e) {
     debug('compact-window:statusline', e);

package/src/config.js

@@ -9,10 +9,11 @@
  *   Linux:   $XDG_CONFIG_HOME/claude-token-saver/config.json or ~/.config/...
  */
 
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { userDataDir } from './paths.js';
 import { labelPreference } from './statusline-mode.js';
+import { writeStateFile } from './state-file.js';
 
 const CONFIG_DIR = userDataDir();
 const CONFIG_PATH = join(CONFIG_DIR, 'config.json');
@@ -31,8 +32,7 @@ export function loadConfig() {
 }
 
 export function saveConfig(cfg) {
-  if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true });
-  writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2) + '\n');
+  writeStateFile(CONFIG_PATH, JSON.stringify(cfg, null, 2) + '\n');
 }
 
 // Each keyword maps to a single statusline option toggle.

package/src/cost.js

@@ -91,8 +91,11 @@ function detectPricingTier(model) {
 
   if (m.includes('haiku')) {
     if (/haiku[-_.]?4[-_.]?5/.test(m)) return 'claude-haiku-4-5';
-    if (/haiku[-_.]?3[-_.]?5/.test(m)) return 'claude-haiku-3-5';
-    if (/haiku[-_.]?3\b/.test(m)) return 'claude-haiku-3';
+    // The 3.x ids put the version first (`claude-3-5-haiku-20241022`,
+    // `claude-3-haiku-20240307`), so both orders are matched. With only the
+    // family-first order, 3.5 Haiku fell through to the 4.5 rate.
+    if (/haiku[-_.]?3[-_.]?5|3[-_.]?5[-_.]?haiku/.test(m)) return 'claude-haiku-3-5';
+    if (/haiku[-_.]?3\b|\b3[-_.]?haiku/.test(m)) return 'claude-haiku-3';
     return 'claude-haiku-4-5';
   }
 

package/src/ctx-window-cache.js

@@ -0,0 +1,61 @@
+/**
+ * The context window Claude Code reports for each session.
+ *
+ * Only the statusline payload carries it (`context_window.context_window_size`).
+ * The UserPromptSubmit hook gets a session id and a transcript path, so the
+ * briefing used to guess the window from the configured model id, and a model
+ * that is 1M without a `[1m]` suffix was judged against 200k: the 80% warning
+ * fired at 160k while the statusline of the same session said "Ctx 1M". The
+ * statusline records the size it was given here, and the briefing reads it back
+ * by session id before it falls back to guessing.
+ *
+ * State: <stateDir>/ctx-window.json
+ *   { sessions: { [session_id]: { size, ts } } }
+ * Entries untouched for 7 days are pruned on write.
+ */
+
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { userDataDir } from './paths.js';
+import { writeStateFile } from './state-file.js';
+
+const PRUNE_MS = 7 * 24 * 60 * 60 * 1000;
+// The statusline renders every few seconds. An unchanged size is rewritten only
+// this often, which is enough to keep a long session's entry from being pruned.
+const REFRESH_MS = 24 * 60 * 60 * 1000;
+
+export function ctxWindowCachePath() {
+  return join(userDataDir(), 'ctx-window.json');
+}
+
+function load() {
+  try {
+    const s = JSON.parse(readFileSync(ctxWindowCachePath(), 'utf8'));
+    return s && s.sessions && typeof s.sessions === 'object' && !Array.isArray(s.sessions) ? s : { sessions: {} };
+  } catch {
+    return { sessions: {} };
+  }
+}
+
+const validSize = (size) => Number.isFinite(size) && size > 0;
+
+/** Record the window the statusline payload reported. Returns true when the file was written. */
+export function recordLiveWindow(sessionId, size, now = Date.now()) {
+  if (typeof sessionId !== 'string' || sessionId === '' || !validSize(size)) return false;
+  const state = load();
+  const prev = state.sessions[sessionId];
+  if (prev && prev.size === size && now - prev.ts < REFRESH_MS) return false;
+  state.sessions[sessionId] = { size, ts: now };
+  for (const [id, s] of Object.entries(state.sessions)) {
+    if (!s || !Number.isFinite(s.ts) || now - s.ts > PRUNE_MS) delete state.sessions[id];
+  }
+  writeStateFile(ctxWindowCachePath(), JSON.stringify(state) + '\n');
+  return true;
+}
+
+/** The recorded window for a session, or null when the statusline never reported one. */
+export function liveWindowFor(sessionId) {
+  if (typeof sessionId !== 'string' || sessionId === '') return null;
+  const s = load().sessions[sessionId];
+  return s && validSize(s.size) ? s.size : null;
+}

package/src/delegation-guard.js

@@ -26,6 +26,7 @@ import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
 import { loadConfig, saveConfig } from './config.js';
 import { recentToolPaths } from './session-paths.js';
+import { routeCapsFor } from './route-caps.js';
 
 const packageRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -114,7 +115,7 @@ function ratchetImportMissing(home = homedir()) {
  * English-only prompt, an already-imported ratchet.md, or a session with
  * nothing read yet each drop their own section without blocking the others.
  */
-export async function buildAppendix(payload, { cfg = loadConfig(), home = homedir() } = {}) {
+export async function buildAppendix(payload, { cfg = loadConfig(), home = homedir(), routeCaps = routeCapsFor(payload?.session_id) } = {}) {
   const sections = [];
 
   // Read from `model` first — it is the more specific field when both are set
@@ -125,12 +126,17 @@ export async function buildAppendix(payload, { cfg = loadConfig(), home = homedi
 
   const bounds = boundsText();
   if (bounds) {
-    // Hardcoded per the user's model-fitting ratchet rule
-    // (~/.claude/ratchet-model.md): haiku delegations get a tighter leash
-    // (8 tool calls / 1,500 output tokens) than everything else (20 / 8,000).
-    const capLine = isHaiku
-      ? 'Cap for this delegation: 8 tool calls, 1,500 output tokens.'
-      : 'Cap for this delegation: 20 tool calls, 8,000 output tokens.';
+    // Haiku delegations get a tighter leash (8 tool calls / 1,500 output
+    // tokens) than everything else (20 / 8,000). Those are the defaults of the
+    // model-fitting rules. When this turn's prompt matched a rule, the rule's
+    // own calibrated budget for the tier replaces them, so the subagent is told
+    // the same limit the main model was (see route-caps.js). A T1 rule sets no
+    // call count, and the default one stays in that case.
+    const fallback = isHaiku ? { calls: 8, out: 1500 } : { calls: 20, out: 8000 };
+    const matched = routeCaps?.[isHaiku ? 'T2' : 'T1'];
+    const calls = Number.isFinite(matched?.calls) && matched.calls > 0 ? matched.calls : fallback.calls;
+    const out = Number.isFinite(matched?.out) && matched.out > 0 ? matched.out : fallback.out;
+    const capLine = `Cap for this delegation: ${calls} tool calls, ${out.toLocaleString('en-US')} output tokens.`;
     sections.push(['## Bounds and output shape', bounds, capLine].join('\n\n'));
   }
 
@@ -234,7 +240,7 @@ export async function buildAppendix(payload, { cfg = loadConfig(), home = homedi
  * call, so the caller's contract stays "print nothing, let the tool run
  * exactly as given" for every one of them.
  */
-export async function decideForDelegation(payload, { cfg = loadConfig(), home = homedir() } = {}) {
+export async function decideForDelegation(payload, { cfg = loadConfig(), home = homedir(), routeCaps = routeCapsFor(payload?.session_id) } = {}) {
   if (!delegateEnabled(cfg)) return null;
   if (payload?.tool_name !== 'Task' && payload?.tool_name !== 'Agent') return null;
 
@@ -246,7 +252,7 @@ export async function decideForDelegation(payload, { cfg = loadConfig(), home =
   // same tool_name, must not stack the appendix onto itself.
   if (prompt.includes(DELEGATION_MARKER)) return null;
 
-  const appendix = await buildAppendix(payload, { cfg, home });
+  const appendix = await buildAppendix(payload, { cfg, home, routeCaps });
   if (!appendix) return null;
 
   return { updatedInput: { ...toolInput, prompt: `${prompt}\n\n${appendix}` } };

package/src/doc2md.cjs

@@ -307,13 +307,19 @@ function managedPython() {
     : path.join(dir, 'bin', 'python');
 }
 
-const MARKITDOWN_SPEC = 'markitdown[pptx,pdf,xlsx,docx]';
+// Each spec carries an upper bound at the next major line. An open spec takes
+// whatever is newest on the day someone first opens a document, so a breaking
+// release (or a bad one) would reach every new machine with nothing in this
+// repository having changed. The bounds are the lines verified here:
+// markitdown 0.1.7, python-pptx 1.0.2, python-docx 1.2.0, openpyxl 3.1.5.
+// pip gets them as plain argv, with no shell in between, so `<` is safe.
+const MARKITDOWN_SPEC = 'markitdown[pptx,pdf,xlsx,docx]>=0.1,<0.2';
 
 // Editing libraries, installed alongside the converter. Reading is doc2md's
 // own job; editing is the agent's, done per-request with a short script
 // against a COPY of the document. These are the libraries those scripts need,
 // pre-installed so "swap the chart on slide 23" does not stall on pip.
-const EDIT_LIBS = ['python-pptx', 'python-docx', 'openpyxl'];
+const EDIT_LIBS = ['python-pptx>=1.0,<2', 'python-docx>=1.1,<2', 'openpyxl>=3.1,<4'];
 
 /**
  * Build the managed venv and install markitdown into it.
@@ -999,15 +1005,22 @@ function decideForWrite(context, opts = {}) {
   return null;
 }
 
-/** The decision rendered as the JSON Claude Code expects on stdout. */
+/**
+ * The decision rendered as the JSON Claude Code expects on stdout.
+ *
+ * Only a refusal answers the permission question. A note about a document
+ * that could not be converted says nothing about whether the read should be
+ * allowed, and answering `allow` for it approved the call without the prompt
+ * the user would otherwise have seen, sensitive-pattern files included. The
+ * note goes out as context instead, which is also the only form that reaches
+ * the model: an `allow` reason is shown to the user alone.
+ */
 function formatHookOutput(decision) {
   if (!decision) return null;
   return JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: decision.deny ? 'deny' : 'allow',
-      permissionDecisionReason: decision.reason,
-    },
+    hookSpecificOutput: decision.deny
+      ? { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: decision.reason }
+      : { hookEventName: 'PreToolUse', additionalContext: decision.reason },
   });
 }
 
@@ -1016,6 +1029,7 @@ module.exports = {
   MAX_SOURCE_BYTES,
   INSTALL_HINT,
   MARKITDOWN_SPEC,
+  EDIT_LIBS,
   managedPython,
   installConverter,
   ensureConverterInstalled,

package/src/fig2md.cjs

@@ -32,6 +32,11 @@ const { spawnSync } = require('node:child_process');
 // cmd.exe, where `^` is the escape character and would be eaten before npm
 // ever saw it. The range is the same one caret means for a 0.x package.
 const FIG_PARSER_SPEC = 'openfig-core@0.4.x';
+// `--ignore-scripts`: the parser and its three dependencies are plain
+// JavaScript and ship no install script, so nothing is lost, and a release of
+// any of them that adds one cannot run code on the machine of someone who only
+// opened a .fig file.
+const FIG_INSTALL_ARGS = ['install', '--no-audit', '--no-fund', '--silent', '--ignore-scripts', FIG_PARSER_SPEC];
 
 /** Where the on-demand parser install lives, under the tool's state dir. */
 function managedFigDir(userDataDir) {
@@ -63,7 +68,7 @@ function installFigParser(userDataDir, { onProgress = () => {} } = {}) {
   // needs the shell. Elsewhere the shell is avoided, since the package spec
   // would then go through shell quoting for no benefit.
   const isWindows = process.platform === 'win32';
-  const r = spawnSync(isWindows ? 'npm.cmd' : 'npm', ['install', '--no-audit', '--no-fund', '--silent', FIG_PARSER_SPEC], {
+  const r = spawnSync(isWindows ? 'npm.cmd' : 'npm', FIG_INSTALL_ARGS, {
     cwd: dir,
     encoding: 'utf8',
     timeout: 300_000,
@@ -184,6 +189,7 @@ async function convertFig(filePath, userDataDir) {
 
 module.exports = {
   FIG_PARSER_SPEC,
+  FIG_INSTALL_ARGS,
   managedFigDir,
   installFigParser,
   convertFig,

package/src/formatters/statusline.js

@@ -304,9 +304,9 @@ function buildVersionSeg(version, update, c, isIcon, verbose, g) {
  * fallback line. Best-effort: never throws into the statusline (corrupted
  * CLAUDE.md, permission issue, etc. → null).
  */
-function buildHarnessSeg(c, isIcon, g) {
+function buildHarnessSeg(c, isIcon, g, liveWindow = null) {
   try {
-    const harnessInfo = harnessStatusForStatusline(loadConfig());
+    const harnessInfo = harnessStatusForStatusline(loadConfig(), { liveWindow });
     if (!harnessInfo) return null;
     const icon = isIcon ? g.harness : 'H';
     if (harnessInfo.warning) {
@@ -491,7 +491,7 @@ export function formatReport(data, { color = true, verbose = false, timer = true
 
   // Delegation savings — a DIFFERENT number from "Cache saved" above, which
   // covers the prompt cache only. This one is what running work on a cheaper
-  // tier saved, summed from the rule registry route-scan maintains. Hidden
+  // tier saved, the lifetime total of the delegation ledger. Hidden
   // when zero or absent: a permanent "$0" is noise for direct-API users and
   // for anyone who has not delegated yet.
   // "Routing saved" says what earned the money — work that ran on a cheaper
@@ -760,7 +760,7 @@ export function formatReport(data, { color = true, verbose = false, timer = true
   // Silent when the project hasn't opted in (no CLAUDE.md and no .claude/);
   // otherwise renders 🅷 5/5 (green) / 🅷 N/5 (yellow) so the user can spot
   // a missing section at a glance and know to run `harness init`.
-  const harnessSeg = buildHarnessSeg(c, isIcon, g);
+  const harnessSeg = buildHarnessSeg(c, isIcon, g, ctxLive?.size ?? null);
 
   // Version / upgrade chip. Read from a cache written by a detached background
   // check — this render path never touches the network.

package/src/formatters/table.js

@@ -14,8 +14,10 @@ const C = {
   yellow: '\x1b[33m',
   cyan:   '\x1b[36m',
 };
-// Wrap text with ANSI codes — gracefully strips to plain when NO_COLOR set.
-const colorOk = !process.env.NO_COLOR;
+// Wrap text with ANSI codes. Set per report by formatReport: the caller knows
+// about `--no-color` and whether stdout is a terminal, which this module cannot
+// see. NO_COLOR alone is the answer for a caller that passes nothing.
+let colorOk = !process.env.NO_COLOR;
 const r  = (s) => colorOk ? `${C.red}${s}${C.reset}` : s;
 const rb = (s) => colorOk ? `${C.bold}${C.red}${s}${C.reset}` : s;
 const rbl = (s) => colorOk ? `${C.blink}${C.bold}${C.red}${s}${C.reset}` : s;
@@ -28,6 +30,11 @@ function pad(str, len, align = 'left') {
   return s.padEnd(len);
 }
 
+// A loss reads as "-$3", not "$-3". The digits are left as cost.js rounded them.
+function usd(n) {
+  return n < 0 ? `-$${Math.abs(n)}` : `$${n}`;
+}
+
 function pct(n) {
   return (n * 100).toFixed(1) + '%';
 }
@@ -93,7 +100,7 @@ function renderSpikeSection(spikes, contextWindow) {
   }
   for (const spike of spikes) {
     const m = spike.metrics;
-    const ratioLabel = spike.ratio ? `${spike.ratio.toFixed(1)}× p95` : 'single-request > 250k';
+    const ratioLabel = spike.ratio && spike.byRatio !== false ? `${spike.ratio.toFixed(1)}× p95` : 'single-request > 250k';
     lines.push(
       r(`  • ${shortSessionId(m.sessionId)} [${m.projectDir || 'unknown'}]  `) +
         rb(`total input ${formatContextSize(m.totalInput)}`) +
@@ -140,7 +147,7 @@ function renderSpikeSection(spikes, contextWindow) {
       lines.push('');
     }
   }
-  lines.push(rbl('  ▶ 상세 처치법: ') + rb(`${CLI_NAME} last`));
+  lines.push(rbl('  ▶ How to handle it: ') + rb(`${CLI_NAME} last`));
   lines.push('');
   return lines;
 }
@@ -169,12 +176,13 @@ function renderCapWarnSection(caps) {
   lines.push(rb(`    ${CLI_NAME} handoff`));
   lines.push(r('  (writes a HANDOFF-*.md so a fresh session can pick up.)'));
   lines.push('');
-  lines.push(rbl('  ▶ 상세 처치법: ') + rb(`${CLI_NAME} last`));
+  lines.push(rbl('  ▶ How to handle it: ') + rb(`${CLI_NAME} last`));
   lines.push('');
   return lines;
 }
 
-export function formatReport({ summary: sum, trend, ttl, anomalies, cost, options, spikeReport, contextWindow, caps }) {
+export function formatReport({ summary: sum, trend, ttl, anomalies, cost, options, spikeReport, contextWindow, caps }, { color } = {}) {
+  colorOk = color ?? !process.env.NO_COLOR;
   const lines = [];
 
   // Header
@@ -240,17 +248,17 @@ export function formatReport({ summary: sum, trend, ttl, anomalies, cost, option
   const costW = [24, 12];
   const costA = ['left', 'right'];
   lines.push('  ' + tableTop(costW));
-  lines.push('  ' + tableRow(['Actual cost', `$${cost.actual}`], costW, costA));
-  lines.push('  ' + tableRow(['Without cache', `$${cost.noCacheCost}`], costW, costA));
+  lines.push('  ' + tableRow(['Actual cost', usd(cost.actual)], costW, costA));
+  lines.push('  ' + tableRow(['Without cache', usd(cost.noCacheCost)], costW, costA));
   lines.push('  ' + tableSep(costW));
-  lines.push('  ' + tableRow(['Savings', `$${cost.savings} (${pct(cost.savingsRate)})`], costW, costA));
+  lines.push('  ' + tableRow(['Savings', `${usd(cost.savings)} (${pct(cost.savingsRate)})`], costW, costA));
   // Only worth asking of someone who has 1h writes to lose. Everyone else got
   // a `+$0` that read as an endorsement of the 5m bucket they were already
   // stuck in.
   if (cost.extraCostIf5mApplicable === false) {
     lines.push('  ' + tableRow(['Already 5m-only', ttl.gatewayObserved ? 'gateway' : 'yes'], costW, costA));
   } else {
-    lines.push('  ' + tableRow(['Extra cost if 5m-only', `+$${cost.extraCostIf5m}`], costW, costA));
+    lines.push('  ' + tableRow(['Extra cost if 5m-only', cost.extraCostIf5m < 0 ? usd(cost.extraCostIf5m) : `+${usd(cost.extraCostIf5m)}`], costW, costA));
   }
   lines.push('  ' + tableBot(costW));
   if (cost.unpriced > 0) lines.push(`  ${cost.unpriced} session(s) not priced by the gateway are left out.`);

package/src/gateway-auth.js

@@ -21,7 +21,7 @@
 
 import { readFileSync } from 'node:fs';
 import { execSync } from 'node:child_process';
-import { join } from 'node:path';
+import { join, resolve, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { debug } from './debug.js';
 
@@ -40,6 +40,29 @@ export function gatewayBase(env = process.env) {
   return base;
 }
 
+/**
+ * Claude Code 가 신뢰 확인을 받아 둔 폴더인지 판정합니다. 기록은
+ * ~/.claude.json 의 projects[<절대 경로>].hasTrustDialogAccepted 에 있고, 상위
+ * 폴더를 신뢰했으면 하위 폴더에도 적용됩니다. 기록을 읽지 못하면 신뢰하지 않은
+ * 것으로 봅니다.
+ */
+export function isTrustedProject(cwd = process.cwd(), { home = homedir() } = {}) {
+  let projects;
+  try {
+    projects = JSON.parse(readFileSync(join(home, '.claude.json'), 'utf8'))?.projects;
+  } catch {
+    return false;
+  }
+  if (!projects || typeof projects !== 'object') return false;
+  let dir = resolve(cwd);
+  for (;;) {
+    if (projects[dir]?.hasTrustDialogAccepted === true) return true;
+    const parent = dirname(dir);
+    if (parent === dir) return false;
+    dir = parent;
+  }
+}
+
 /**
  * Claude Code 와 같은 방식으로 apiKeyHelper 를 실행해 토큰을 얻습니다.
  * 환경변수에 토큰을 두지 않고 헬퍼 스크립트로 매번 발급받는 구성이 공식 인증
@@ -50,9 +73,14 @@ export function gatewayBase(env = process.env) {
  * 부릅니다. 수 초 간격으로 도는 렌더 경로에서 부르면 통계선이 그만큼 느려집니다.
  */
 export function keyFromApiKeyHelper(cwd = process.cwd()) {
+  // 프로젝트 설정의 헬퍼는 그 저장소가 넣어 둔 셸 명령입니다. Claude Code 는 신뢰
+  // 확인을 거친 폴더에서만 그것을 실행하므로, 같은 기록을 보고 같은 조건으로만
+  // 실행합니다. 그러지 않으면 내려받은 저장소 안에서 이 CLI 를 돌리는 것만으로
+  // 그 저장소의 명령이 실행됩니다.
   const candidates = [
-    join(cwd, '.claude', 'settings.local.json'),
-    join(cwd, '.claude', 'settings.json'),
+    ...(isTrustedProject(cwd)
+      ? [join(cwd, '.claude', 'settings.local.json'), join(cwd, '.claude', 'settings.json')]
+      : []),
     join(homedir(), '.claude', 'settings.json'),
   ];
   for (const p of candidates) {