tumwater 0.2.0 → 0.4.0

package/dist/src/pi/pi-bin.js

@@ -1,17 +1,16 @@
-import fs from "node:fs";
 import path from "node:path";
-import { resolvedAgentConfig } from "../config/config-views.js";
-import { envPath, findOnPath } from "../files/files.js";
-/** Which agent binary the harness spawns and where that value came from — the per-agent
+import { resolvedBackendConfig } from "../config/config-views.js";
+import { envPath, findOnPath, isExecutableFile } from "../files/files.js";
+/** Which backend binary the harness spawns and where that value came from — the per-backend
  * resolution `TUMWATER_<ID>_BIN` → `backends.<id>.bin` (pi's legacy `agentBin` alias) → the
  * backends' defaults (plans/agent-backends.md "Config"; plans/portability.md §5/7), the
  * executability rule the preflight askers share, and the missing-binary wording they quote.
  * The spawn (src/agent/run-agent.ts) resolves through each backend's resolveBin; the startup
- * gate (gates/startup-gate.ts) walks every enabled seam's agent through the same resolution and
- * executability rule, and doctor (doctor/doctor-checks.ts) asks them for every agent in use
- * (agentsInUse, the startup gate's rule). Each surface quotes this module's wording, so the
+ * gate (gates/startup-gate.ts) walks every enabled seam's backend through the same resolution and
+ * executability rule, and doctor (doctor/doctor-checks.ts) asks them for every backend in use
+ * (backendsInUse, the startup gate's rule). Each surface quotes this module's wording, so the
  * executability verdict and the pi text cannot drift between them. Split out of
- * gates/readiness.ts, which keeps the repo preconditions' shared wording: the agent binary is
+ * gates/readiness.ts, which keeps the repo preconditions' shared wording: the backend binary is
  * the backends' own concern, so its resolution lives beside the spawn instead of in the gate
  * layer. */
 const PI_MISSING_MESSAGE = "pi not found on PATH — install it (https://github.com/badlogic/pi-mono) or add its bin directory to your PATH";
@@ -21,7 +20,7 @@ const PI_MISSING_MESSAGE = "pi not found on PATH — install it (https://github.
  * default; claude's adapter passes TUMWATER_CLAUDE_BIN), and `configKey` is the tumwater.json
  * key the "config" source names (pi's legacy `agentBin`, or `backends.<id>.bin`), so a claude
  * failure names its own var and key rather than pi's. */
-export function agentBinSourceLabel(source, binEnv = "TUMWATER_PI_BIN", configKey = "agentBin") {
+export function backendBinSourceLabel(source, binEnv = "TUMWATER_PI_BIN", configKey = "agentBin") {
     switch (source) {
         case "env":
             return binEnv;
@@ -31,7 +30,7 @@ export function agentBinSourceLabel(source, binEnv = "TUMWATER_PI_BIN", configKe
             return "the PATH default";
     }
 }
-/** The missing-binary message for a resolved agent binary. The default source keeps
+/** The missing-binary message for a resolved backend binary. The default source keeps
  * PI_MISSING_MESSAGE byte-identical (pinned by test/cli.test.ts and test/doctor.test.ts);
  * a configured source gains the resolved value and where it came from, so a wrong
  * `agentBin` never reads as "pi is not installed" — and keeps the install hint, since a
@@ -39,68 +38,60 @@ export function agentBinSourceLabel(source, binEnv = "TUMWATER_PI_BIN", configKe
 export function piMissingMessage(resolved) {
     if (resolved.source === "default")
         return PI_MISSING_MESSAGE;
-    const from = agentBinSourceLabel(resolved.source);
+    const from = backendBinSourceLabel(resolved.source);
     return `pi not found — resolved "${resolved.bin}" from ${from} is not an executable — install it (https://github.com/badlogic/pi-mono) or point ${from} at a working pi binary`;
 }
-/** The missing-binary message for any agent's resolved binary, used by the startup gate's walk
- * over every enabled seam's agent. pi delegates to piMissingMessage so its pinned wording is
- * untouched; any other agent names itself, the resolved value, and where it came from, so a
+/** The missing-binary message for any backend's resolved binary, used by the startup gate's walk
+ * over every enabled seam's backend. pi delegates to piMissingMessage so its pinned wording is
+ * untouched; any other backend names itself, the resolved value, and where it came from, so a
  * wrong `backends.<id>.bin` or `TUMWATER_<ID>_BIN` never reads as a missing pi. */
-export function agentMissingMessage(resolved, agent) {
-    if (agent === "pi")
+export function backendMissingMessage(resolved, backend) {
+    if (backend === "pi")
         return piMissingMessage(resolved);
     if (resolved.source === "default") {
-        return `${agent} not found on PATH — install it or add its bin directory to your PATH`;
+        return `${backend} not found on PATH — install it or add its bin directory to your PATH`;
     }
-    const from = agentBinSourceLabelFor(agent, resolved.source);
-    return `${agent} not found — resolved "${resolved.bin}" from ${from} is not an executable — install it or point ${from} at a working ${agent} binary`;
+    const from = backendBinSourceLabelFor(backend, resolved.source);
+    return `${backend} not found — resolved "${resolved.bin}" from ${from} is not an executable — install it or point ${from} at a working ${backend} binary`;
 }
-/** The environment variable that overrides one agent's binary: `TUMWATER_<ID>_BIN` with the id
- * uppercased — the convention resolveAgentBin and agentMissingMessage share. */
-function agentBinEnv(agent) {
-    return `TUMWATER_${agent.toUpperCase()}_BIN`;
+/** The environment variable that overrides one backend's binary: `TUMWATER_<ID>_BIN` with the id
+ * uppercased — the convention resolveBackendBin and backendMissingMessage share. */
+function backendBinEnv(backend) {
+    return `TUMWATER_${backend.toUpperCase()}_BIN`;
 }
-/** The tumwater.json key that names one agent's binary: pi's legacy `agentBin`, or the
- * per-agent `backends.<id>.bin`. Shared by the missing-binary and spawn-error wording so a
+/** The tumwater.json key that names one backend's binary: pi's legacy `agentBin`, or the
+ * per-backend `backends.<id>.bin`. Shared by the missing-binary and spawn-error wording so a
  * non-pi failure never names pi's key. */
-export function agentBinConfigKey(agent) {
-    return agent === "pi" ? "agentBin" : `backends.${agent}.bin`;
+export function backendBinConfigKey(backend) {
+    return backend === "pi" ? "agentBin" : `backends.${backend}.bin`;
 }
-/** The source label for one agent's resolved binary, deriving the env var and config key from
- * the agent id when the caller has no backend defaults in hand. pi keeps its pinned legacy
- * wording; any other agent names its own `TUMWATER_<ID>_BIN` and `backends.<id>.bin`. One home
- * for the convention agentMissingMessage and doctor's ok detail both read. */
-export function agentBinSourceLabelFor(agent, source) {
-    return agent === "pi"
-        ? agentBinSourceLabel(source)
-        : agentBinSourceLabel(source, agentBinEnv(agent), agentBinConfigKey(agent));
+/** The source label for one backend's resolved binary, deriving the env var and config key from
+ * the backend id when the caller has no backend defaults in hand. pi keeps its pinned legacy
+ * wording; any other backend names its own `TUMWATER_<ID>_BIN` and `backends.<id>.bin`. One home
+ * for the convention backendMissingMessage and doctor's ok detail both read. */
+export function backendBinSourceLabelFor(backend, source) {
+    return backend === "pi"
+        ? backendBinSourceLabel(source)
+        : backendBinSourceLabel(source, backendBinEnv(backend), backendBinConfigKey(backend));
 }
-/** Is the resolved agent binary executable right now? Returns the usable path, or null when
+/** Is the resolved backend binary executable right now? Returns the usable path, or null when
  * the startup gate should refuse to boot and doctor should fail its check. This is the whole
  * executability rule in one place so the two askers cannot drift: a path-shaped value (already
- * normalized against the process cwd by resolveAgentBin) is tested directly with
+ * normalized against the process cwd by resolveBackendBin) is tested directly with
  * accessSync(X_OK) and required to be a regular file — a directory passes X_OK, but can never
  * be spawned, so it is rejected here with exactly the file requirement findOnPath's bare-name
  * branch applies (a bin pointed at a directory would otherwise pass the preflight and die
  * mid-run at the spawn instead of failing the gate with the "not an executable" message). A
  * bare name resolves through PATH. `pathEnv` is injectable so tests need no PATH mutation —
  * the gate and doctor both default it to the process PATH. */
-export function findAgentBinary(resolved, pathEnv = envPath()) {
+export function findBackendBinary(resolved, pathEnv = envPath()) {
     if (resolved.bin.includes("/")) {
-        try {
-            fs.accessSync(resolved.bin, fs.constants.X_OK); // Directories pass X_OK; require a file.
-            if (fs.statSync(resolved.bin).isFile())
-                return resolved.bin;
-            return null;
-        }
-        catch {
-            return null;
-        }
+        return isExecutableFile(resolved.bin) ? resolved.bin : null;
     }
     return findOnPath(resolved.bin, pathEnv);
 }
-/** Normalize a path-shaped agent binary against the harness process's cwd NOW, at
- * resolution time: the spawn runs with each tick's worktree as cwd, so a relative value
+/** Normalize a path-shaped backend binary against the harness process's cwd NOW, at
+ * resolution time: the spawn runs with each run's worktree as cwd, so a relative value
  * left as given would name a different file there than the run preflight and doctor (which
  * evaluate against the process cwd) had already accepted. An absolute path comes back
  * normalized; a bare name — no separator — is left for PATH resolution exactly as before.
@@ -111,10 +102,10 @@ function absBin(value) {
 }
 /** The precedence every backend shares, parameterized by its own env override and default
  * binary name: `<binEnv>` env → the configured entry's bin → `defaultBin`. An empty or
- * whitespace value falls through to the next source, so `TUMWATER_PI_BIN= tumwater run` cannot
+ * whitespace value falls through to the next source, so `TUMWATER_PI_BIN= tumwater start` cannot
  * wedge the team on a typo'd export. This is precedence only — resolvability is checked at the
- * preflight sites (cmdRun and doctor), never here. Private: the backends and the gate resolve
- * through resolveAgentBin, its one caller. */
+ * preflight sites (cmdStart and doctor), never here. Private: the backends and the gate resolve
+ * through resolveBackendBin, its one caller. */
 function resolveBinFrom(binEnv, defaultBin, configured) {
     const env = process.env[binEnv]?.trim();
     if (env)
@@ -124,21 +115,21 @@ function resolveBinFrom(binEnv, defaultBin, configured) {
         return { bin: absBin(cfg), source: "config" };
     return { bin: defaultBin, source: "default" };
 }
-/** Resolve which binary one agent spawns: `TUMWATER_<ID>_BIN` → the effective
- * `backends.<id>.bin` (config-views.ts resolvedAgentConfig, so pi's legacy `agentBin` still
- * names pi) → the agent's default. `agent` defaults to pi, the historical backend; the
+/** Resolve which binary one backend spawns: `TUMWATER_<ID>_BIN` → the effective
+ * `backends.<id>.bin` (config-views.ts resolvedBackendConfig, so pi's legacy `agentBin` still
+ * names pi) → the backend's default. `backend` defaults to pi, the historical backend; the
  * backends pass their own id, binEnv and defaultBin, while the startup gate derives the
- * reserved agents' conventional env name and default binary when it walks every enabled seam. */
-export function resolveAgentBin(config, agent = "pi", defaults = {}) {
-    const binEnv = defaults.binEnv ?? agentBinEnv(agent);
-    const defaultBin = defaults.defaultBin ?? agent;
-    return resolveBinFrom(binEnv, defaultBin, resolvedAgentConfig(config, agent).bin);
+ * reserved backends' conventional env name and default binary when it walks every enabled seam. */
+export function resolveBackendBin(config, backend = "pi", defaults = {}) {
+    const binEnv = defaults.binEnv ?? backendBinEnv(backend);
+    const defaultBin = defaults.defaultBin ?? backend;
+    return resolveBinFrom(binEnv, defaultBin, resolvedBackendConfig(config, backend).bin);
 }
 /** The shared body of a backend's `resolveBin` adapter: resolve this backend's binary through
- * resolveAgentBin above using the backend's own id, binEnv and defaultBin — never pi's, so a
+ * resolveBackendBin above using the backend's own id, binEnv and defaultBin — never pi's, so a
  * claude failure names TUMWATER_CLAUDE_BIN/the claude default. The two registered backends
  * (pi-backend.ts, claude-backend.ts) each expose a one-line `resolveBin` delegating here, so
  * the call convention lives in one place and cannot drift between them. */
-export function resolveBackendBin(config, backend) {
-    return resolveAgentBin(config, backend.id, { binEnv: backend.binEnv, defaultBin: backend.defaultBin });
+export function resolveBinForBackend(config, backend) {
+    return resolveBackendBin(config, backend.id, { binEnv: backend.binEnv, defaultBin: backend.defaultBin });
 }

package/dist/src/pi/pi-listed-models.js

@@ -0,0 +1,53 @@
+import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
+import { piListedModelsPath } from "../paths.js";
+/** The whitespace-split rows of the table `pi --list-models` prints, header first. Null unless
+ * the first non-blank line is the `provider model …` header, so other text (a "No models
+ * matching" reply) is never taken for an empty table. */
+export function parsePiModelTable(stdout) {
+    const rows = stdout.split("\n").map((line) => line.trim().split(/\s+/)).filter((t) => t[0] !== "");
+    const header = rows.shift();
+    if (header?.[0] !== "provider" || header[1] !== "model")
+        return null;
+    return { header, rows };
+}
+/** Read the `images` column of the table `pi --list-models` prints. Null unless the first
+ * non-blank line is the `provider model …` header and it has an `images` column. A row's
+ * `yes`/`no` maps to a boolean; any other value is skipped. */
+export function parsePiModelImages(stdout) {
+    const table = parsePiModelTable(stdout);
+    if (table === null)
+        return null;
+    const { header, rows } = table;
+    const column = header.indexOf("images");
+    if (column < 0)
+        return null;
+    const images = {};
+    for (const row of rows) {
+        const [provider, model] = row;
+        if (model === undefined)
+            continue;
+        if (row[column] === "yes")
+            images[`${provider}/${model}`] = true;
+        else if (row[column] === "no")
+            images[`${provider}/${model}`] = false;
+    }
+    return images;
+}
+/** The saved listing, or null when the file is missing, torn, or has no `images` object. */
+export function readPiListedModels(root) {
+    const saved = readJsonFile(piListedModelsPath(root));
+    const images = saved?.images;
+    if (typeof images !== "object" || images === null || Array.isArray(images))
+        return null;
+    return { checkedAt: typeof saved?.checkedAt === "number" ? saved.checkedAt : 0, images };
+}
+export function writePiListedModels(root, images, now = Date.now()) {
+    writeJsonAtomic(piListedModelsPath(root), { checkedAt: now, images });
+}
+/** Whether pi lists `provider/model` as reading images; null when unlisted or an argument is
+ * missing. No TTL: every doctor run that lists the models rewrites the file. */
+export function piListedImageInput(listed, provider, model) {
+    if (!listed || provider === undefined || model === undefined)
+        return null;
+    return listed.images[`${provider}/${model}`] ?? null;
+}

package/dist/src/pi/pi-models.js

@@ -1,7 +1,7 @@
 import os from "node:os";
 import path from "node:path";
-import { enabledRoleIds } from "../config/config.js";
-import { configForRole, resolverConfig, reviewConfig } from "../config/config-views.js";
+import { enabledRoleIds, loadConfigSafe } from "../config/config.js";
+import { configForRole, resolverConfig, resolvedBackendConfig, reviewConfig } from "../config/config-views.js";
 import { fallbackPair } from "../config/config-fallbacks.js";
 import { seamAgent } from "../config/model-selector.js";
 import { cachedByStat } from "../files/stat-cache.js";
@@ -11,6 +11,7 @@ import { expandHomeTilde } from "../files/files.js";
 import { declaredWindow } from "../pi-extension/context-window.js";
 import { piSettingsPath, readPiDefaultModel } from "./pi-settings.js";
 import { opencodeModelFree, opencodeModelKey, readOpencodeCache } from "../agent/opencode/opencode-catalog.js";
+import { codexHome, readCodexCatalog } from "../agent/codex/codex-catalog.js";
 /** pi's model definitions — the custom providers and models they serve, with each model's
  * declared cost. This is where a local (free) team differs from an API one: unpriced or
  * zero-cost models never accumulate spend against the daily budget cap, so the badge can
@@ -103,8 +104,8 @@ export function readPiProviders(modelsPath) {
  * A missing cache, an unknown model, or an unusable `context` reads null, as an unknown pi
  * model does. */
 export function seamContextWindow(seam, projectRoot, modelsPath = piModelsPath()) {
-    const agent = seamAgent(seam);
-    switch (agent) {
+    const backend = seamAgent(seam);
+    switch (backend) {
         case "pi":
             let { provider, model } = seam;
             if (!provider || !model) {
@@ -121,6 +122,21 @@ export function seamContextWindow(seam, projectRoot, modelsPath = piModelsPath()
             if (seam.model === undefined)
                 return null;
             return declaredWindow(readOpencodeCache(projectRoot).models[opencodeModelKey(seam.model)]?.context);
+        case "codex":
+            // The model catalog (codex-catalog.ts) holds the window part 8/9 parsed from
+            // `context_window × effective_context_window_percent / 100`, read from the team's codex
+            // home (backends.codex.configDir) at this project root — the same home the runs use. An
+            // unknown model, an absent home or a missing catalog reads null (declaredWindow's safe
+            // answer for an unknown window).
+            if (seam.model === undefined)
+                return null;
+            {
+                const { config } = loadConfigSafe(projectRoot);
+                const home = codexHome(resolvedBackendConfig(config ?? {}, "codex"));
+                if (home === undefined)
+                    return null;
+                return declaredWindow(readCodexCatalog(home).get(seam.model)?.contextWindow);
+            }
         default:
             return null;
     }
@@ -193,19 +209,36 @@ function accountUsesOverage(account) {
  * badge never reads n/a while spend it cannot see could still reach the cap. The one central
  * rule: the budget gate, the fallback view, and the status free-ness read all judge seams
  * through it (plans/agent-backends.md "Free-ness" and "Every seam, checked"). The opencode
- * `catalog` is threaded the way the claude `account` is: an absent catalog means "no cache to
- * read", so an opencode seam reads NOT free, the safe direction for a budget gate. */
-export function seamFree(providers, seam, account = null, catalog = null) {
-    const agent = seamAgent(seam);
-    // One free-ness rule per backend: pi's pair price, claude's subscription, opencode's catalog,
-    // and nothing for any other backend (its spend could still reach the cap, so the badge must
-    // not read n/a). The opencode arm reads the gateway-qualified id (part 6b/7) and changes the
-    // pi and claude arms nothing.
-    switch (agent) {
+ * `catalog` is threaded the way the subscription `accounts` lookup is: an absent catalog means
+ * "no cache to read", so an opencode seam reads NOT free, the safe direction for a budget gate.
+ * `accounts` names the per-backend subscription account (part 2a/9): today only a claude seam
+ * asks, and it reads the same account it always did via `accounts((backend) => …)` returning
+ * claude's account for "claude" and null otherwise. */
+export function seamFree(providers, seam, accounts = () => null, catalog = null) {
+    const backend = seamAgent(seam);
+    // One free-ness rule per backend: pi's pair price, the subscription account a backend bills
+    // (claude today), opencode's catalog, and nothing for any other backend (its spend could
+    // still reach the cap, so the badge must not read n/a). The opencode arm reads the
+    // gateway-qualified id (part 6b/7) and changes the pi and subscription arms nothing.
+    switch (backend) {
         case "pi":
             return pairFree(providers, seam.provider, seam.model);
-        case "claude":
+        case "claude": {
+            // The generic subscription arm: read the seam's own backend's account (today always
+            // "claude") so a future subscription backend is judged by its own lookup, not a captured
+            // one. A subscription that is spending into overage is NOT free.
+            const account = accounts(seamAgent(seam));
             return account?.billing === "subscription" && !accountUsesOverage(account);
+        }
+        case "codex": {
+            // The same subscription arm for codex (part 8/9): read the seam's own backend's account
+            // ("codex") so a codex seam is free while it bills a ChatGPT subscription and is not
+            // spending into overage. API-key billing — which this build refuses at the startup gate —
+            // and an absent account read NOT free, so the badge never reads n/a while spend it cannot
+            // see could still reach the cap.
+            const account = accounts(seamAgent(seam));
+            return account?.billing === "subscription" && !accountUsesOverage(account);
+        }
         case "opencode":
             // A null catalog — no cache to read — and an unknown or billed model must all read NOT
             // free (opencodeModelFree's safe direction): the badge never reads n/a while spend it
@@ -222,31 +255,31 @@ export function seamFree(providers, seam, account = null, catalog = null) {
 /** Whether a fallback-config pair may be called free: a `claude/<id>` pair is free while the
  * account bills a subscription and is not using overage, a pi provider/model is free when
  * models.json prices it at zero, and an opencode pair is free when the catalog prices it at
- * zero (part 6b/7). Any other agent namespace, or an unresolvable pair, is refused — the badge
+ * zero (part 6b/7). Any other backend namespace, or an unresolvable pair, is refused — the badge
  * must not read n/a while a backend whose billing it cannot see runs. Exported so the budget
  * gate (src/gates/budget-gates.ts), the status pause set (src/status/status-data.ts) and the
  * free-ness view judge fallback pairs with the same predicate — neither may engage a backend
- * their own badge would not call free. `catalog` is the opencode cache, threaded like `account`;
- * absent, an opencode pair reads NOT free. */
-export function piPairFree(providers, provider, model, account = null, catalog = null) {
-    return seamFree(providers, { provider, model }, account, catalog);
+ * their own badge would not call free. `catalog` is the opencode cache, threaded like the
+ * `accounts` lookup; absent, an opencode pair reads NOT free. */
+export function piPairFree(providers, pair, accounts = () => null, catalog = null) {
+    return seamFree(providers, { agent: pair.backend, provider: pair.provider, model: pair.model }, accounts, catalog);
 }
 /** The free fallback pair the budget gate would engage for the team, or null when none is
  * usable: the price-aware resolution of the default tier (fallbackPair over
  * resolveTierFallbacks' borrow order), so a map whose `default` entry is absent or priced
  * still names the free pair the tier borrows. Null for a missing, unresolvable, or priced
  * pair — the gate's refusal, and the pair the badge/doctor must not advertise. */
-export function fallbackModelPair(config, modelsPath = piModelsPath(), account = null, catalog = null) {
+export function fallbackModelPair(config, modelsPath = piModelsPath(), accounts = () => null, catalog = null) {
     const providers = readPiProviders(modelsPath);
-    return fallbackPair(config, (p) => piPairFree(providers, p.provider, p.model, account, catalog));
+    return fallbackPair(config, (p) => piPairFree(providers, p, accounts, catalog));
 }
 /** True when the configured fallback model (plans/fallback-model.md) is one the budget gate may
  * actually engage: configured at all, resolvable to a provider/model pair, and priced at zero in
  * pi's definitions. False for every other case — no fallback, a half-named pair that would fall
- * through to pi's own default, an unknown id, or a priced one — and the gate then pauses role
- * loops exactly as it did before this feature. */
-export function fallbackModelFree(config, modelsPath = piModelsPath(), account = null, catalog = null) {
-    return fallbackModelPair(config, modelsPath, account, catalog) !== null;
+ * through to pi's own default, an unknown id, or a priced one — and the gate then pauses
+ * roles exactly as it did before this feature. */
+export function fallbackModelFree(config, modelsPath = piModelsPath(), accounts = () => null, catalog = null) {
+    return fallbackModelPair(config, modelsPath, accounts, catalog) !== null;
 }
 /** True when every model the team could use is free: each enabled role's effective
  * provider/model (configForRole — the director included, it is a catalog role, resolved at
@@ -257,10 +290,10 @@ export function fallbackModelFree(config, modelsPath = piModelsPath(), account =
  * free when models.json prices it at zero, and everything else counts as NOT free — the badge
  * must never read n/a while spend it is tracking could still reach the cap. With no enabled
  * roles and review off there are no pairs at all, so the team cannot spend and the answer is
- * true. `account` is the persisted claude billing answer (6a/7's reader), absent meaning "no
- * subscription", and `catalog` the opencode models cache (absent, an opencode seam reads not
- * free). */
-export function teamModelsFree(config, modelsPath = piModelsPath(), account = null, catalog = null) {
+ * true. `accounts` names each seam's own backend's subscription account (claude today),
+ * absent meaning "no subscription", and `catalog` the opencode models cache (absent, an
+ * opencode seam reads not free). */
+export function teamModelsFree(config, modelsPath = piModelsPath(), accounts = () => null, catalog = null) {
     const pairs = [];
     for (const role of enabledRoleIds(config)) {
         const rc = configForRole(config, role);
@@ -281,5 +314,5 @@ export function teamModelsFree(config, modelsPath = piModelsPath(), account = nu
     if (pairs.length === 0)
         return true;
     const providers = readPiProviders(modelsPath);
-    return pairs.every((seam) => seamFree(providers, seam, account, catalog));
+    return pairs.every((seam) => seamFree(providers, seam, accounts, catalog));
 }

package/dist/src/pi/pi-run-result.js

@@ -1,7 +1,7 @@
 /** Whether a run's cost is real money that charges the daily cap (plans/agent-backends.md
  * part 6a): an API-billed run, or a subscription run that saw overage. A plain subscription
  * run's cost is notional — API-equivalent spend that never moves the cap. The one predicate
- * both the tick-usage fold and the merge accumulator split on, so the two cannot drift. */
+ * both the run-usage fold and the merge accumulator split on, so the two cannot drift. */
 export function runCostIsReal(run) {
     return run.billing !== "subscription" || run.usedOverage === true;
 }

package/dist/src/pi/pi-settings.js

@@ -3,7 +3,7 @@ import { cachedByStat } from "../files/stat-cache.js";
 import { isJsonObject } from "../files/json-object.js";
 import { readJsonFile } from "../files/json-files.js";
 /** pi's own saved-default model, read from pi's `settings.json` beside the models catalog —
- * the name a loop row shows when `tumwater.json` resolves no model and pi starts on its own
+ * the name a role row shows when `tumwater.json` resolves no model and pi starts on its own
  * default. This mirrors step 3 of pi 1.2.0's start-up model choice, "saved default from
  * settings" (`findInitialModel` in pi's `dist/core/model-resolver.js`), for a run tumwater
  * starts without `--provider`/`--model`. The reader does NOT model pi's last step: when the

package/dist/src/pi/pi-stream.js

@@ -101,14 +101,14 @@ export class PiStreamParser {
     outputTokens = 0;
     /** Prompt tokens this run sent, summed across assistant turns (usage.input + cacheRead +
      * cacheWrite). The counterpart to outputTokens: an operator compares the two to see how
-     * much of a tick's spend is re-sent context versus generation. */
+     * much of a run's spend is re-sent context versus generation. */
     promptTokens = 0;
     /** The cache-read share of promptTokens (usage.cacheRead summed across turns) — the part
      * the provider served from its prompt cache, billed at the cache-read rate. */
     cacheReadTokens = 0;
     /** Prompt tokens sent up to AND INCLUDING the first assistant turn that carried an edit or
      * write tool call. Before any such turn every turn accumulates; once one is seen the
-     * counter freezes, so it measures the context a tick burns before its first change. */
+     * counter freezes, so it measures the context a run burns before its first change. */
     preEditPromptTokens = 0;
     /** 1-based index of the first assistant turn carrying an edit or write tool call;
      * undefined when the run never edited. */
@@ -121,7 +121,7 @@ export class PiStreamParser {
     errorMessage;
     /** True when any event reports the provider rejecting the context as too large
      * (LM Studio's "Context size has been exceeded"; oMLX rejects over max_context_window).
-     * Diagnostic: every tick starts a fresh session, so nothing needs dropping — but the
+     * Diagnostic: every run starts a fresh session, so nothing needs dropping — but the
      * error names the real cause. */
     contextExceeded = false;
     /** True when any event reports the model server killing an idle predict stream
@@ -131,7 +131,7 @@ export class PiStreamParser {
     transientServerTimeout = false;
     /** True when any event reports the provider rejecting the request with HTTP 429 (rate
      * limiting). Transient by definition: the session is healthy and a later attempt succeeds —
-     * the loop's transient retry covers it, waiting out retryAfterSeconds when present. */
+     * the runner's transient retry covers it, waiting out retryAfterSeconds when present. */
     transientRateLimit = false;
     /** True when any event reports a provider-wide failure that is not rate limiting — the
      * connection down, a 5xx, the model failing to load (TRANSIENT_BACKEND, in pi-failure.ts).
@@ -187,7 +187,7 @@ export class PiStreamParser {
     /** True once any assistant message carried real content — a tool call or non-empty text.
      * A failed run whose every assistant turn is contentless (the provider's error turn has
      * `content: []` and stopReason "error") produced no work of its own, so a dirty worktree
-     * belongs to a prior interrupted tick rather than this run (BUGS.md 2026-10-06). Distinct
+     * belongs to a prior interrupted run rather than this run (BUGS.md 2026-10-06). Distinct
      * from finalMessageContentless, which describes only the LAST message. */
     producedAssistantContent = false;
     /** True when pi auto-compacted the session during (or at the end of) the run. */
@@ -482,7 +482,7 @@ export class PiStreamParser {
             this.declaredNothingToDo = true;
         // The refusal comes only from an anchored `TUMWATER_REFUSED: <reason>` line: a bare
         // sentinel and a mid-sentence mention are not refusals, and a negating reason ("none",
-        // "(n/a …)") clears one — BUGS.md 2026-09-23, four ticks ended ordinary replies with
+        // "(n/a …)") clears one — BUGS.md 2026-09-23, four runs ended ordinary replies with
         // `TUMWATER_REFUSED: none` and the harness destroyed their tested work. The last anchored
         // line wins (the run's final declaration is its verdict); a message WITHOUT a line leaves
         // an earlier declaration standing, so a closing remark cannot erase it.

package/dist/src/pi/pi-watchdogs.js

@@ -1,4 +1,4 @@
-/** The run's watchdog clocks, split out of pi.ts's runPi (2026-10-04, organize): the tick
+/** The run's watchdog clocks, split out of pi.ts's runPi (2026-10-04, organize): the run
  * deadline and the quiet watchdog (quiet-kill plus the stalled-tool-call warning) — the
  * timing policy of one pi run, which changes for different reasons than the spawn, stream,
  * and result-distillation wiring that drives it (src/agent/run-agent.ts keeps those). The
@@ -6,9 +6,8 @@
  * window, the zero-byte grace, the warned-call set) and exposes the flags the run's close
  * handler reads back; run-agent.ts feeds the parser live through the deps accessors, so no
  * notification path is needed when events land. */
-import { bufferedCommandStallMs, commandBuffersOutput } from "./command-shape.js";
-import { streamsToolOutput } from "../agent/backend-traits.js";
-/** Start one pi run's two watchdog clocks: the tick deadline (kills the process tree when it
+import { bufferedCommandStallMs, callBuffersOutput } from "./command-shape.js";
+/** Start one pi run's two watchdog clocks: the run deadline (kills the process tree when it
  * fires, recording whether the run was still progressing) and the quiet/stall interval
  * (quiet-kills a run that stopped making progress and warns on stalled tool calls). Returns
  * the live flags the run's close handler reads and the note/stop calls its data handlers and
@@ -24,14 +23,14 @@ export function startPiWatchdogs(deps) {
     // diff's review can finish instead of timing out mid-verification and being re-read from
     // scratch on the next attempt (BUGS.md 2026-10-07). "Still making progress" means a
     // progress event landed within `progressWindowMs` of the deadline — the quiet watchdog's
-    // own recency window, but never more than half the tick budget, so a quiet window
+    // own recency window, but never more than half the run budget, so a quiet window
     // configured longer than the budget cannot let a run that stopped progressing past the
     // base deadline. The window does not depend on the quiet watchdog being enabled: a
     // progressing gate run earns its extension even when quietTimeoutSeconds is 0. One
     // checkpoint timer snapshots the progress count `progressWindowMs` before the deadline;
     // only progress since that snapshot counts, so a run that progressed early and then
     // stalled keeps today's bound.
-    const progressWindowMs = deps.quietMs > 0 ? Math.min(deps.quietMs, deps.tickTimeoutMs / 2) : deps.tickTimeoutMs / 2;
+    const progressWindowMs = deps.quietMs > 0 ? Math.min(deps.quietMs, deps.runTimeoutMs / 2) : deps.runTimeoutMs / 2;
     let checkpointProgress = 0;
     // Arm (or re-arm) the checkpoint `progressWindowMs` before the upcoming deadline: the
     // progress count at that instant is the bar a run must beat to count as progressing. One
@@ -45,35 +44,35 @@ export function startPiWatchdogs(deps) {
             checkpointProgress = deps.progressCount();
         }, Math.max(0, deadlineMs - progressWindowMs));
     };
-    armCheckpoint(deps.tickTimeoutMs);
+    armCheckpoint(deps.runTimeoutMs);
     let extended = false;
-    let timeoutBudgetMs = deps.tickTimeoutMs;
+    let timeoutBudgetMs = deps.runTimeoutMs;
     let timeout;
     const fireDeadline = () => {
         if (deps.extendOnProgress && !extended && deps.progressCount() > checkpointProgress) {
             extended = true;
-            timeoutBudgetMs = deps.tickTimeoutMs * 2;
-            armCheckpoint(deps.tickTimeoutMs); // the extended deadline gets its own progress window
-            timeout = setTimeout(fireDeadline, deps.tickTimeoutMs); // one more slice; the next firing is final
+            timeoutBudgetMs = deps.runTimeoutMs * 2;
+            armCheckpoint(deps.runTimeoutMs); // the extended deadline gets its own progress window
+            timeout = setTimeout(fireDeadline, deps.runTimeoutMs); // one more slice; the next firing is final
             return;
         }
         timedOut = true;
         // A deadline that fires on a run still making progress killed a slow run, not a hung
         // one: "recent progress" is progress since the checkpoint `progressWindowMs` before this
         // deadline — the same window the extension test uses, so the kill's classification
-        // cannot contradict the extension decision when the quiet window is longer than the tick
+        // cannot contradict the extension decision when the quiet window is longer than the run
         // budget (BUGS.md 2026-09-29, 2026-10-09). A run with no progress event at all — never
         // emitted a byte, or bytes without one structured event — keeps today's discard path: it
         // has not demonstrably begun.
         timedOutProgressing = deps.progressCount() > 0 && deps.progressCount() > checkpointProgress;
         deps.kill();
     };
-    timeout = setTimeout(fireDeadline, deps.tickTimeoutMs);
+    timeout = setTimeout(fireDeadline, deps.runTimeoutMs);
     // Quiet watchdog: a healthy run makes PROGRESS continuously even when slow — messages
     // start and end, turns and tool calls complete. Prolonged lack of progress means a hung
     // tool (an interactive command waiting for input) or a zombie stream (a dead generation
     // whose connection drips content-free keepalive updates for hours) that would otherwise
-    // burn the whole tick timeout. Raw output bytes deliberately do NOT reset the clock:
+    // burn the whole run timeout. Raw output bytes deliberately do NOT reset the clock:
     // keepalives are bytes without progress. Checked on an interval against the wall clock,
     // so it also fires promptly after a machine sleep rather than pausing with a suspended
     // timer. The stall warning below rides the same interval: it needs no kill of its own,
@@ -87,14 +86,14 @@ export function startPiWatchdogs(deps) {
     // first bytes entirely — fork/exec starved by the same load, or bytes already written
     // but not yet drained (a firing timer phase precedes the poll phase that delivers
     // stdout, and a suspended machine resumes the same way). The 2026-09-23 fix therefore
-    // gave a byte-silent run no quiet kill at all, delegating its bound to the tick timeout
+    // gave a byte-silent run no quiet kill at all, delegating its bound to the run timeout
     // — which holds only while runTimeoutSeconds is near the quiet window's scale (BUGS.md
     // 2026-09-29: the live 54000 s config left a wedged model connection 15 hours in a
     // concurrency slot). A zero-byte run now gets a finite bound of its own, independent of
-    // the tick timeout: max(two quiet windows, 30 min). Startup latency under healthy load
+    // the run timeout: max(two quiet windows, 30 min). Startup latency under healthy load
     // stays far below it, so the runs the 2026-09-23 fix protected are still protected; a
     // run that is genuinely wedged before its first byte (dead connection, unscheduled
-    // fork/exec) is reaped at half an hour instead of at the tick timeout. The false
+    // fork/exec) is reaped at half an hour instead of at the run timeout. The false
     // positive it can cost — a machine so loaded the child has not been scheduled in 30
     // minutes — is a quiet kill, which resumes the session and the worktree's edits like
     // an interruption: a restart, not discarded work. Once bytes have flowed the run has
@@ -114,7 +113,7 @@ export function startPiWatchdogs(deps) {
                 continue;
             // A command whose stdout is piped or redirected holds its bytes away from
             // pi until it exits, so "no output" there is the prescribed shape, not
-            // evidence of a hang (BUGS.md 2026-09-28: the tick prompt tells every loop
+            // evidence of a hang (BUGS.md 2026-09-28: the run prompt tells every role
             // to pipe its verification through `tail`, and the resulting false alarms
             // were the digest's top warning cluster, drowning real hangs). Silence is
             // not the only way such a command hangs, though: a leaked grandchild
@@ -129,7 +128,7 @@ export function startPiWatchdogs(deps) {
             // ANY of its calls — every one is judged by the buffered wall-clock threshold
             // (plans/agent-backends.md "Watchdogs and progress"); pi keeps its per-command
             // classification, where only a piped or redirected command is buffered.
-            if (!streamsToolOutput(deps.agent) || commandBuffersOutput(call.command || call.label)) {
+            if (callBuffersOutput(deps.agent, call.command || call.label)) {
                 const openMs = Date.now() - call.lastActivityAt;
                 const bufferedStallMs = bufferedCommandStallMs(deps.stallMs);
                 if (openMs >= bufferedStallMs) {