Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CHANGELOG.md`:
- Line 12: Confirm the correct PR number (907 vs 906) and update the changelog
entry that currently ends with "(`#906`)" to match the actual PR number used in
the PR header (e.g., replace with "(`#907`)" if PR `#907` is correct); ensure the PR
reference in the CHANGELOG.md matches the PR header and any other occurrences of
the PR identifier in the changelog text.

In `@packages/opencode/src/altimate/native/connections/register.ts`:
- Around line 474-477: Validate numeric inputs before computing estimatedCost:
ensure costPerTib (from params.cost_per_tib_usd or DEFAULT_COST_PER_TIB_USD) and
estimate.bytesScanned are finite numbers and non-negative using
Number.isFinite(...) and >= 0 checks; if costPerTib is invalid fall back to
DEFAULT_COST_PER_TIB_USD (or treat as undefined) and only compute estimatedCost
when both costPerTib and estimate.bytesScanned are valid, otherwise set
estimatedCost to undefined so downstream firewall comparisons don't receive
NaN/Infinity/negative values (update the logic around costPerTib,
estimate.bytesScanned, and estimatedCost; keep references to costPerTib,
estimate.bytesScanned, estimatedCost, DEFAULT_COST_PER_TIB_USD and TIB_BYTES).

In `@packages/opencode/src/altimate/tools/sql-cost-estimate.ts`:
- Around line 34-35: The current catch on Config.get() swallows all errors and
lets cfg become {} so costPerTib is silently undefined; change the logic around
Config.get() (the call to Config.get(), the cfg variable and where costPerTib is
read) to capture any thrown error into a local variable (e.g. configLoadError)
instead of discarding it, use the real cfg if present, and return/include
configLoadError in the function's returned metadata/output so callers can detect
that pricing used a fallback; ensure you still compute the estimate using
dispatcher defaults only when cfg is missing but surface configLoadError
alongside the estimate.

In `@packages/opencode/src/altimate/tools/sql-execute.ts`:
- Around line 133-143: The current catch block around
Dispatcher.call("sql.estimate_cost") returns silently, which lets queries bypass
configured governance budgets on transient estimator failures; change the catch
to not simply return—if governance (or governance?.cost_per_tib_usd / budget) is
configured, treat an estimation failure as a conservative failure: log the error
and throw or reject to block the query (enforce the cost firewall), otherwise
(no governance configured) allow the query to proceed; update the catch to
reference Dispatcher.call("sql.estimate_cost"), the local variable estimate, and
governance to decide whether to fail-fast or continue.

---

Outside diff comments:
In `@packages/opencode/src/agent/agent.ts`:
- Around line 155-194: The plan and general agent configs still inherit the
permissive defaults (\"*\": \"allow\") so over-budget SQL bypasses the new cost
confirmation; update the plan and general role definitions (the objects named
plan and general where PermissionNext.merge(...) and
PermissionNext.fromConfig(...) are used) to explicitly set sql_execute_cost:
\"ask\" (or change the merged defaults to include sql_execute_cost: \"ask\") so
that both plan and general enforce the same cost firewall as builder and
analyst; ensure you add the sql_execute_cost: \"ask\" entry alongside any
existing sql_execute/sql_execute_write settings in those
PermissionNext.fromConfig blocks.

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/opencode/src/altimate/native/connections/register.ts">

<violation number="1" location="packages/opencode/src/altimate/native/connections/register.ts:474">
P1: Missing validation of `cost_per_tib_usd` and `estimated_cost_usd` allows NaN/negative costs to silently bypass the cost firewall guard.</violation>
</file>

<file name="packages/opencode/src/altimate/tools/sql-cost-estimate.ts">

<violation number="1" location="packages/opencode/src/altimate/tools/sql-cost-estimate.ts:55">
P2: Fallbacking missing `cost_per_tib_usd` to 0 can misleadingly show `$0.00/TiB` (free scanning) when the rate is actually unknown. A per-unit price of $0 has a specific semantic meaning; it should not be used as a default for optional/missing values in user-facing cost output.</violation>
</file>

<file name="packages/opencode/src/altimate/tools/sql-execute.ts">

<violation number="1" location="packages/opencode/src/altimate/tools/sql-execute.ts:141">
P1: The blanket `catch { return }` means any transient error (network timeout, connector crash, etc.) silently disables the cost firewall and lets the query run unguarded. This is distinct from the `!estimate.supported` path which correctly handles warehouses that can't estimate. When the user has explicitly configured a budget, a transient failure should at minimum log a warning or prompt rather than silently bypassing the guard.</violation>
</file>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/opencode/src/cli/cmd/tui/component/dialog-status.tsx`:
- Around line 15-16: The unit index calculation can produce -1 for fractional
values (bytes between 0 and 1); clamp it to zero before indexing to avoid
undefined units: replace the current index computation using Math.min/Math.floor
with a clamped value (for example compute iRaw = Math.floor(Math.log(bytes) /
Math.log(1024)) and then i = Math.max(0, Math.min(iRaw, units.length - 1))), and
ensure the existing return uses this clamped i (references: i, bytes, units in
dialog-status.tsx).

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/opencode/src/cli/cmd/tui/component/dialog-status.tsx">

<violation number="1" location="packages/opencode/src/cli/cmd/tui/component/dialog-status.tsx:15">
P2: Clamp unit index to `Math.max(0, ...)` to avoid `units[-1]` (which is `undefined`) when `bytes` is between 0 and 1. `Math.log` of a fractional value is negative, producing a negative index after `Math.floor`.</violation>
</file>

      const raw = stats.totalBytesProcessed ?? stats.query?.totalBytesProcessed
      const bytesScanned = raw !== null && raw !== undefined ? Number(raw) : undefined

      if (raw === null || raw === undefined) {

      const bytesScanned = assigned !== null && assigned !== undefined ? Number(assigned) : undefined

    const estimate = await connector.estimateCost(params.sql)
    // Only apply BigQuery's default pricing if the warehouse type is BigQuery.
    // Other warehouses should explicitly provide a cost factor or use driver-specific estimations.
    const defaultCostPerTib = warehouseType === "bigquery" ? DEFAULT_COST_PER_TIB_USD : undefined;
    const costPerTib = params.cost_per_tib_usd ?? defaultCostPerTib
    const estimatedCost =
      estimate.bytesScanned != null && costPerTib != null ? (estimate.bytesScanned / TIB_BYTES) * costPerTib : undefined

  // Disabled unless at least one threshold is set.
  if (maxCost === undefined && maxBytes === undefined) return

  } catch (error) {
    // Estimation failed — fail open (run the query) rather than blocking work.
    console.warn("Cost estimation failed:", error)
    return
  }

  const overCost = maxCost !== undefined && estimate.estimated_cost_usd !== undefined && estimate.estimated_cost_usd > maxCost
  const overBytes = maxBytes !== undefined && estimate.bytes_scanned !== undefined && estimate.bytes_scanned > maxBytes

    if (result.estimated_cost_usd != null) {
      lines.push(`Estimated cost:       ${formatCost(result.estimated_cost_usd)} (at ${formatCost(result.cost_per_tib_usd ?? NaN)}/TiB)`)
    }

    const costPerTib = params.cost_per_tib_usd ?? DEFAULT_COST_PER_TIB_USD
    const estimatedCost =
      estimate.bytesScanned !== undefined && estimate.bytesScanned !== null ? (estimate.bytesScanned / TIB_BYTES) * costPerTib : undefined

  const units = ["B", "KB", "MB", "GB", "TB", "PB"]
  const i = Math.max(0, Math.min(Math.floor(Math.log(bytes) / Math.log(1024)), units.length - 1))
  return `${(bytes / Math.pow(1024, i)).toFixed(i === 0 ? 0 : 2)} ${units[i]}`

  const firewallEnabled = createMemo(() => {
    const g = governance()
    return !!g && ((g.max_query_cost_usd !== null && g.max_query_cost_usd !== undefined) || (g.max_bytes_scanned !== null && g.max_bytes_scanned !== undefined))
  })

          <Show when={governance()?.max_query_cost_usd !== undefined && governance()?.max_query_cost_usd !== null}>
            <box flexDirection="row" gap={1}>
              <text flexShrink={0} style={{ fg: theme.success }}>
                •
              </text>
              <text fg={theme.text}>
                <b>Max cost</b>{" "}
                <span style={{ fg: theme.textMuted }}>${governance()?.max_query_cost_usd?.toFixed(2)}/query</span>
              </text>
            </box>
          </Show>
          <Show when={governance()?.max_bytes_scanned !== undefined && governance()?.max_bytes_scanned !== null}>
            <box flexDirection="row" gap={1}>
              <text flexShrink={0} style={{ fg: theme.success }}>
                •
              </text>
              <text fg={theme.text}>
                <b>Max scan</b>{" "}
                <span style={{ fg: theme.textMuted }}>{formatBytes(governance()?.max_bytes_scanned ?? 0)}/query</span>
              </text>
            </box>
          </Show>