Tell plain-launch sessions their model calls are not priced or policy-checked (0.19.0)

[davidcrowe]

Why

Production 2026-09-16: 0 of 69 external tenants have ever used a <harness>-acp launcher. Everyone runs plain claude; nothing tells them what that session does and does not get from ACP.

agenticcontrolplane.com#178 added a notice to the installer's bundled offline engines — which online installs never run, and which the marketplace plugin never touches. This is the port into the govern.mjs that actually executes. Rebased onto #36 (merged): with the transcript collector in, plain claude is priced, so the message leads with what the session has and names only the policy half as missing.

What

One systemMessage, once per session, on the first allowed call of a plain-launch session:

[ACP] Tool calls in this session are checked and logged, and model-call cost is estimated from the session transcript (API-rate equivalent, not a metered charge). Model calls are not policy-checked: plain `claude` sends them straight to the provider, so tool-result redaction and model routing are off. For those, launch with `claude-acp` (~/.acp/bin/claude-acp). Shown once per session.

• Wording tracks the pricing condition. The clause "cost is estimated from the session transcript" is used when the payload names a readable transcript_path — the same condition under which Send transcript model usage on PostToolUse so plain claude sessions get costed (0.18.0) #36 prices the session. A harness that hands over no transcript (nothing priced) gets the plainer "…neither priced nor policy-checked…" form instead. Never a claim the hook cannot back.
• Detection: every launcher is generated from one template whose first act is export ACP_KEY; the hook inherits that env. No ACP_KEY, and no ANTHROPIC_BASE_URL/OPENAI_BASE_URL at agenticcontrolplane.com, means the session was not started by a launcher. Bias to silence on doubt.
• Once per session: marker ~/.acp/session-notices/unpriced-<session_id> (id sanitised to [A-Za-z0-9._-], capped at 120), created with {flag:"wx"} so parallel hook processes for one session cannot both fire. No session_id in the payload → silence, no marker. Markers older than 7 days are pruned; the directory is capped at 200 newest.
• Per harness: named by ACP_CLIENT (claude-acp; codex-acp for both codex and the Codex plugin's codex-plugin; qwen-acp, opencode-acp, pi-acp, hermes-acp, prime-acp, grok-acp, dsh-acp). Cursor has no launcher and gets nothing.
• Launcher absent on disk (marketplace-only claude plugin install): the notice ends with install the \claude-acp` launcher: curl -sf https://agenticcontrolplane.com/install.sh | bash` instead of a path that does not exist.
• Never on: local mode, no-credential, managed-unenrolled, deny, ask. Rides the allow path as ONE JSON object, merged with the tier-divergence notice and the wire warning when they apply (the updatedInput branch now reads the message once, not twice — with an exclusive-create claim a second read would have dropped it). Wrapped in try/catch: any failure is silence.
• Version → 0.19.0. README section added (and the 0.18.0 collector section carried through the merge).

Tests

node --test — 220 pass, 0 fail (16 in test/unpriced-session-notice.test.mjs, spawning the real hook against a stub gateway):

• notice on a plain launch (transcript on the payload → the "estimated from the transcript" form), with no hookSpecificOutput; never says "governance"
• no transcript on the payload, or a missing one → the "neither priced nor policy-checked" form
• silent on the 2nd and 3rd call of the same session; fires once for a new session
• nothing without a session id (and no marker)
• nothing with ACP_KEY in env; nothing with a provider base URL at the proxy
• deny and ask byte-identical with no notice; the notice then rides the session's first allowed call
• wire warning + notice → ONE JSON object carrying both; warning alone on the next call
• codex (both client spellings) names codex-acp; cursor gets nothing
• six parallel hook processes for one session → exactly one notice
• 8-day-old markers pruned, recent ones kept, directory capped at 200
• hostile session ids sanitised and length-capped (no path escape)
• launcher absent on disk → installer wording
• --local mode silent, no marker dir, call still audited locally

wire-warning.test.mjs and transcript-model-usage.test.mjs run as launched sessions (ACP_KEY in env) so their assertions stay about the warning / the PostToolUse body alone.

Not merged, not published to npm, not deployed. Publishing is yours.