dsh-token-anxiety

LIMITATIONS

Known limitations

- **Root-session tasks only.** The projection fold is per-session and synchronous, so the subagent tree the old dynamic plugin aggregated on demand cannot be folded here. Subagent conversations do not appear in the widget. (The `explain_task` tool itself aggregates the full subagent tree, so its conversation context is complete.) - **Explain is a direct host route, not an agent turn.** The widget's button fetch()es `/token-anxiety/explain` (registered by the host half on the harness webserver), and the host runs the analysis LLM call inline. The analysis lives in the widget's component state, so it does not survive a page reload and it is not part of the session log (deliberately: it never writes a custom session event, so sessions stay loadable). The `explain_task` tool is kept for conversational asks ("why did this cost so much?"). The route sits outside the harness `/api` prefix, so it applies the same browser-trust predicate itself (loopback or `trustedHosts` Host, same-origin Origin, `sec-fetch-site`); the deployment still binds loopback-only. - **Pricing is embedded and dated.** The embedded `PRICING` is the fallback; refreshing it is a host-side action (`POST /token-anxiety/pricing-sync`, see [Configuration](#configuration)) that writes `pricing.override.json`; a restart merges it over the defaults. Editing `PRICING` by hand still works; `stateVersion` derives from the active pricing, so any change discards persisted projection-cache rows.