Pricing says it plainly: models at the provider's price, the agent rate for what g1t runs around every model call (the gateway, secrets, routing, context and pass-through to your own provider, so your own keys too), everything else at cost plus 20%, your own runners free, no seats; Security and quality comes with the plan with no separate fee, and live activations end. Each agent has an effort setting, Auto to Max, with what a typical task has cost at each level, and Spend's Spend less, keep quality suggests a lower level only when the agent's own past work shows quality held, to apply or dismiss. The pricing, spend and agents guides say how. · b2f857c · flagon-io/g1t

1782	1782		"Start buying AI credit. Returns `url`, a payment page to open in a browser and pay by card; it comes back to the workspace's billing page. `amount_cents` is the credit, in whole dollars from $10 (1000) to $1,000 (100000); any card fee is added on top. The credit is added once the payment goes through. Owners only, as a person: signed in or with a personal access token. A workspace's own token and g1t's agents never buy credit."
1783	1783		}
1784	1784		Op::ListInvoices => {
1785		−	"A workspace's invoices, newest first. `invoices` is every invoice billed to it (the plan, activations, AI credit and usage), each with its `status`, `total_cents`, `currency` and links to view it and its PDF. `usage_invoices` are g1t's itemised invoices for usage, one when each month closes and one each time the card is charged near the limit, with their `lines` in millionths of a dollar; `amount_micros` is the usage, and the card processing fee (`fee_micros`) and tax (`tax_micros`) are on top. Prices exclude tax: Stripe adds it where it applies. `upcoming` is what the next invoice comes to so far. `unavailable` says why `invoices` could not be read just now, when it could not. Members of the workspace only."
	1785	+	"A workspace's invoices, newest first. `invoices` is every invoice billed to it (the plan, AI credit and usage), each with its `status`, `total_cents`, `currency` and links to view it and its PDF. `usage_invoices` are g1t's itemised invoices for usage, one when each month closes and one each time the card is charged near the limit, with their `lines` in millionths of a dollar; `amount_micros` is the usage, and the card processing fee (`fee_micros`) and tax (`tax_micros`) are on top. Prices exclude tax: Stripe adds it where it applies. `upcoming` is what the next invoice comes to so far. `unavailable` says why `invoices` could not be read just now, when it could not. Members of the workspace only."
1786	1786		}
1787	1787		Op::GetBillingDetails => {
1788	1788		"Who a workspace's invoices are made out to: the billing `email`, `name`, `address`, tax ID (`tax_id_type`, `tax_id`), `po_number` and the invoices' `language`, with the default `payment_method` as far as it is safe to show (its kind, brand, last four digits and expiry). `customer` is false until the workspace has been set up to pay. Tax is worked out from the address: `tax_location` says whether it is enough for that (a country, and in the US a ZIP code), `tax_address_needed_at` is set while g1t is holding a charge for want of one, `tax_id_status` is Stripe's check of the tax ID (`pending`, `verified`, `unverified` or `unavailable`), and `tax_exempt` is `none`, `exempt` or `reverse`. Members of the workspace only."

7501	7501		],
7502	7502		"entitled": true
7503	7503		},
7504		−	"notes": "A repository's list includes its workspace's patterns, with `scope` `workspace`. `entitled` says whether they run here: always on a public repository, and on a private one with the Security and quality activation."
	7504	+	"notes": "A repository's list includes its workspace's patterns, with `scope` `workspace`. `entitled` says whether they run here: always on a public repository, and on a private one when the workspace is on the g1t plan."
7505	7505		},
7506	7506		"list_custom_patterns_for_workspace": {
7507	7507		"params": {

9	9		//! scanning/alerts`, `/code-scanning/sarifs`, `/dependency-graph/sbom`),
10	10		//! in g1t's spelling: no version prefix, `snake_case` throughout. The
11	11		//! security service decides who may see and change what, and which parts
12		−	//! need the Security and quality activation (a 402 says so); this module
	12	+	//! need the g1t plan, which Security and quality comes with (a 402 says so); this module
13	13		//! reads the input and gives each answer its public shape.
14	14
15	15		use g1t_contracts::repos::RepoPath;
⋯
177	177		SecurityOp::UpdateSecretAlert => "Dismiss a secret scanning alert (state dismissed, with a reason: false_positive, used_in_tests, revoked or wont_fix, and an optional comment) or reopen it (state open). Revoked marks it fixed; the others let pushes carrying it through. Takes the Write role, or a security manager of the workspace.",
178	178		SecurityOp::ListSecretLocations => "List every place a secret was found: file, line, commit and whether a push or the history scan found it.",
179	179		SecurityOp::BypassPushProtection => "Push past push protection for a blocked secret, with a reason: false_positive or used_in_tests (the alert is closed with that reason) or will_fix_later (it stays open, to be rotated). Recorded on the alert and in the audit log. With delegated bypass on, someone who does not review bypasses makes a request instead, which owners and the repository's admins approve or deny; the answer says which happened. Push again once it is bypassed or approved.",
180		−	SecurityOp::CheckSecretValidity => "Ask a landed secret's issuer whether it still works, and mark the alert active or inactive. The check is the issuer's own read-only identity call over HTTPS; the secret goes nowhere else. Needs validity checks on for the workspace (and the Security and quality activation on a private repository). Formats with no safe check answer unsupported.",
	180	+	SecurityOp::CheckSecretValidity => "Ask a landed secret's issuer whether it still works, and mark the alert active or inactive. The check is the issuer's own read-only identity call over HTTPS; the secret goes nowhere else. Needs validity checks on for the workspace (and the g1t plan on a private repository). Formats with no safe check answer unsupported.",
181	181		SecurityOp::ListBypassRequests => "List a workspace's push protection bypass requests, pending first. Owners and repository admins see every request; anyone else their own. Filter by state (pending, approved, denied, cancelled) or repo.",
182	182		SecurityOp::ReviewBypassRequest => "Approve or deny a bypass request (owners, security managers and the repository's admins, never your own), or cancel your own. An approved request bypasses push protection for that secret, as its requester asked.",
183	183		SecurityOp::ListCustomPatterns => "List custom secret patterns: a repository's own and the ones it inherits from its workspace (with repo), or a workspace's (with workspace).",
184		−	SecurityOp::CreateCustomPattern => "Create a custom secret pattern: a name, a regular expression for the secret, optional regular expressions for what comes right before and after it, and test strings. Patterns run in linear time (no look-around or back-references) and within size limits. With publish true, push protection and scans use it at once and the history is scanned again for it; otherwise it is a draft. A repository's takes Admin; a workspace's, an owner. On a private repository it needs the Security and quality activation.",
	184	+	SecurityOp::CreateCustomPattern => "Create a custom secret pattern: a name, a regular expression for the secret, optional regular expressions for what comes right before and after it, and test strings. Patterns run in linear time (no look-around or back-references) and within size limits. With publish true, push protection and scans use it at once and the history is scanned again for it; otherwise it is a draft. A repository's takes Admin; a workspace's, an owner. On a private repository it needs the g1t plan.",
185	185		SecurityOp::UpdateCustomPattern => "Change a custom pattern, publish it, or turn it back into a draft (publish false). Returns where it matched each test string.",
186	186		SecurityOp::DeleteCustomPattern => "Delete a custom pattern. Alerts it found stay.",
187	187		SecurityOp::DryRunCustomPattern => "Run a pattern over the default branch without saving it: of the repository, or (with workspace) of up to ten of its repositories, or those named in repos. Returns the files read and up to fifty matches each, masked.",
⋯
189	189		SecurityOp::GetCodeAlert => "Get one code scanning alert by number, with its rule, location, activity and the analyses that reported it.",
190	190		SecurityOp::UpdateCodeAlert => "Dismiss a code scanning alert (state dismissed, dismissed_reason false_positive, wont_fix or used_in_tests, optional dismissed_comment) or reopen it (state open). A fixed alert reopens by itself when an analysis reports it again.",
191	191		SecurityOp::ListAnalyses => "List code scanning analyses, newest first: each upload's run of one tool on one commit, with how many results it had and the alerts it opened and fixed.",
192		−	SecurityOp::UploadSarif => "Upload a SARIF 2.1.0 file: sarif is the file gzipped and base64-encoded; commit_sha the full commit; ref refs/heads/<branch> or refs/pull/<number>/head. For the default branch, new results open alerts and results no longer reported fix theirs. For a pull request, its results new to it on lines it changes become review comments and the Code scanning check, which fails at the repository's threshold. Read at once; the answer says complete or failed and why. Needs the Security and quality activation on a private repository.",
	192	+	SecurityOp::UploadSarif => "Upload a SARIF 2.1.0 file: sarif is the file gzipped and base64-encoded; commit_sha the full commit; ref refs/heads/<branch> or refs/pull/<number>/head. For the default branch, new results open alerts and results no longer reported fix theirs. For a pull request, its results new to it on lines it changes become review comments and the Code scanning check, which fails at the repository's threshold. Read at once; the answer says complete or failed and why. Needs the g1t plan on a private repository.",
193	193		SecurityOp::GetSarifUpload => "Get a SARIF upload by id (sar_…): whether it was read, the analyses it made, and what was wrong.",
194	194		SecurityOp::ListVulnerabilityAlerts => "List vulnerability alerts: a package a lockfile resolves with a known advisory, open first and worst first, with the security update g1t opened for it. In a repository, or (with workspace) across a workspace. Filter by state, severity, ecosystem and package.",
195	195		SecurityOp::GetVulnerabilityAlert => "Get one vulnerability alert by id (vul_…).",
⋯
197	197		SecurityOp::FixAlert => "Put g1t on an issue to fix an alert: a code scanning alert (cod_…), a vulnerable dependency (vul_…) or a secret in the code (sec_…; rotating it stays with you). Its pull request lands through the repository's required checks. The agent's run is charged as agent usage. Returns the issue, and whether the agent started.",
198	198		SecurityOp::GetDependencyGraph => "Get the dependency graph: every package the lockfiles on the default branch resolve, per lockfile, with whether it is direct or transitive (where the lockfile says), for development, its license when recorded, its package URL and its open vulnerability alerts.",
199	199		SecurityOp::GetSbom => "Export the dependency graph as an SPDX 2.3 JSON document, in sbom. Every package is named by its package URL.",
200		−	SecurityOp::CompareDependencies => "Compare the dependencies at two commits, branches or tags (basehead, as base...head): what was added and removed per lockfile, with the known vulnerabilities of what was added and whether it passes the repository's dependency review policy. Needs the Security and quality activation on a private repository.",
	200	+	SecurityOp::CompareDependencies => "Compare the dependencies at two commits, branches or tags (basehead, as base...head): what was added and removed per lockfile, with the known vulnerabilities of what was added and whether it passes the repository's dependency review policy. Needs the g1t plan on a private repository.",
201	201		SecurityOp::GetSettings => "Get a repository's security settings: when the Code scanning check fails, dependency review and its policy, its workspace's settings, and whether the paid features are on for it.",
202	202		SecurityOp::UpdateSettings => "Change a repository's security settings: code_scanning_gate (none, errors, critical, high, medium or any), dependency_review, review_fail_on (critical, high, medium, low or none), review_deny_licenses (SPDX ids) and review_comment. Takes the Admin role, or a security manager of the workspace. Require the Code scanning and Dependency review checks in branch protection to gate merges on them.",
203		−	SecurityOp::GetWorkspaceSettings => "Get a workspace's security settings (delegated bypass, validity checks) and whether it has the Security and quality activation.",
	203	+	SecurityOp::GetWorkspaceSettings => "Get a workspace's security settings (delegated bypass, validity checks) and whether it has Security and quality, which comes with the g1t plan.",
204	204		SecurityOp::UpdateWorkspaceSettings => "Turn delegated bypass and validity checks on or off for a workspace. Owners only.",
205		−	SecurityOp::GetOverview => "Get a workspace's security overview: open alerts by type and severity, how many opened and closed in the last days (7 to 90, 30 by default), a daily trend, and for each repository which features are on and what is open, most in need first. Private repositories count with the Security and quality activation only.",
	205	+	SecurityOp::GetOverview => "Get a workspace's security overview: open alerts by type and severity, how many opened and closed in the last days (7 to 90, 30 by default), a daily trend, and for each repository which features are on and what is open, most in need first. Private repositories count only on the g1t plan.",
206	206		}
207	207		}
208	208

542	542		saving. If an old definition has them crossed, the ceiling wins: it is the
543	543		spending limit, and a limit is never crossed.
544	544
	545	+	## Effort
	546	+
	547	+	Each agent has an effort setting: how hard it works. One setting moves
	548	+	three things together, so you never tune them apart:
	549	+
	550	+	\| Effort \| Starts on \| The model reasons \| A session takes at most \|
	551	+	\| --- \| --- \| --- \| --- \|
	552	+	\| Auto (the default) \| Where the work starts \| Medium, and High on a session someone had to steer \| 8 steps, 10 once raised \|
	553	+	\| Low \| The fast tier \| Lightly \| 5 steps \|
	554	+	\| Medium \| Where the work starts: fast for chat replies, standard for sessions \| Moderately \| 8 steps \|
	555	+	\| High \| Standard or above \| Deeply \| 10 steps \|
	556	+	\| Max \| The most capable tier \| As hard as it can \| 12 steps \|
	557	+
	558	+	The floor and the ceiling still hold: an agent at Max with a ceiling of
	559	+	Standard runs on Standard. How hard the model reasons is sent only to
	560	+	g1t's tiers whose model takes it; a model your own route names is sent as
	561	+	it is.
	562	+
	563	+	Set it on the agent's Profile, under Models, or on its Spend
	564	+	tab. Owners change it, and each change is a new version of the agent.
	565	+	Beside the setting, each level shows what a typical task has cost that
	566	+	agent, as budgets count it (the model and the
	567	+	[agent rate](/guides/usage-and-billing/#the-agent-rate)): the median of its
	568	+	finished sessions at that level over the last 28 days, how many there
	569	+	were, and how many were accepted (finished with nobody having to step
	570	+	in). A level it has not run at shows no figure.
	571	+
	572	+	Every session and reply records the level it ran at, which is what the
	573	+	figures and the weekly [suggestions](/guides/spend/#spend-less-keep-quality)
	574	+	are measured from.
	575	+
545	576		### Your own providers
546	577
547	578		Connect a model provider, or any compatible endpoint, in the workspace's
⋯
600	631		\| Your own provider \| Your provider bills you for the model. g1t charges the agent rate for your own model key only. \|
601	632		\| Work in a sandbox \| The above, plus [sandbox time](/guides/usage-and-billing/#sandbox-time) at cost plus 20%. \|
602	633
603		−	The live agent rate is on [g1t.sh/pricing](https://g1t.sh/pricing).
	634	+	The live agent rate is on [g1t.sh/pricing](https://g1t.sh/pricing). Its
	635	+	[effort](#effort) decides most of what a task costs: the tier it starts on,
	636	+	how much the model reasons and how many steps a session may take.
604	637
605	638		### A worked example
606	639
⋯
662	695		\| Sessions \| Every session it is working on, then every one it worked on before, each child under the session that started it. See [sessions](/guides/agent-sessions/). \|
663	696		\| Memory \| What it remembers, by scope, with where each fact came from. Pin, correct or forget facts. See [agent memory](/guides/agent-memory/). \|
664	697		\| Routines \| Work it does on a schedule or when something happens. See [routines](/guides/agent-routines/). \|
665		−	\| Spend \| Spend this month against its budget: by day, kind of work, model and who asked, and its costliest sessions. \|
	698	+	\| Spend \| Its [effort](#effort) and what each level has cost it, suggestions to spend less, and spend this month against its budget: by day, kind of work, model and who asked, and its costliest sessions. \|
666	699		\| Activity \| Its latest replies and sessions, with who asked, the model and the cost. \|
667		−	\| Profile \| Its definition: identity, job, personality, models, budget and what it may do alone, with every saved version. Owners edit a workspace agent here, and a member their own personal agent, in the form or [in words](#change-it-in-words). \|
	700	+	\| Profile \| Its definition: identity, job, personality, models and effort, budget and what it may do alone, with every saved version. Owners edit a workspace agent here, and a member their own personal agent, in the form or [in words](#change-it-in-words). \|
668	701
669	702		The Agents page above them all shows the agent budget, sessions waiting
670	703		on you and working now, every agent with its live sessions and its month's
⋯
724	757		- [Model providers](/guides/models/): connect your own.
725	758		- [Usage and billing](/guides/usage-and-billing/): AI credit, spend limits
726	759		and the agent rate.
	760	+	- [Spend](/guides/spend/): where agent spend went, and how to spend less.

27	27		Settings. Secret scanning,
28	28		push protection, vulnerability alerts, security updates and the dependency
29	29		graph are free everywhere; the rest is free on public repositories and part
30		−	of the Security and quality activation on private ones. See
	30	+	of the g1t plan, as Security and quality, on private ones. See
31	31		[what's free and what's paid](/guides/security/pricing/), and the
32	32		workspace's [security overview](/guides/security/security-overview/).
33	33

17	17		and it blocks merges, for people and agents alike.
18	18
19	19		Code scanning is free on public repositories and part of the
20		−	[Security and quality activation](/guides/security/pricing/) on private
	20	+	g1t plan, as [Security and quality](/guides/security/pricing/), on private
21	21		ones.
22	22
23	23		## Set it up

1	1		---
2	2		title: What's free and what's paid
3		−	description: Which security features are free everywhere, which are free on public repositories, and the Security and quality activation for private ones.
	3	+	description: Which security features are free everywhere, which are free on public repositories, and Security and quality, which comes with the g1t plan for private ones.
4	4		---
5	5
6	6		Keeping secrets out of repositories and vulnerable dependencies out of
7	7		production is free, everywhere. The rest of the security suite is free on
8		−	public repositories and part of the Security and quality activation on
9		−	private ones.
	8	+	public repositories and comes with the g1t plan, as **Security and
	9	+	quality**, on private ones.
10	10
11	11		\| Feature \| Public repositories \| Private repositories \|
12	12		\| --- \| --- \| --- \|
⋯
15	15		\| Vulnerability alerts \| Free \| Free \|
16	16		\| Security updates \| Free \| Free \|
17	17		\| Dependency graph and SBOM \| Free \| Free \|
18		−	\| Custom patterns \| Free \| Activation \|
19		−	\| Validity checks \| Free \| Activation \|
20		−	\| Delegated bypass \| Free \| Activation \|
21		−	\| Code scanning \| Free \| Activation \|
22		−	\| Dependency review \| Free \| Activation \|
23		−	\| Security overview \| Free \| Activation \|
	18	+	\| Custom patterns \| Free \| With the plan \|
	19	+	\| Validity checks \| Free \| With the plan \|
	20	+	\| Delegated bypass \| Free \| With the plan \|
	21	+	\| Code scanning \| Free \| With the plan \|
	22	+	\| Dependency review \| Free \| With the plan \|
	23	+	\| Security overview \| Free \| With the plan \|
24	24		\| Fix with g1t \| Agent usage \| Agent usage \|
25	25
26		−	## The Security and quality activation
	26	+	## Security and quality
27	27
28		−	The activation is a monthly price per workspace, never per person, in the
29		−	workspace's own Stripe subscription: $10 a month today. Its price is in
30		−	g1t's price book, on [g1t.sh/pricing](https://g1t.sh/pricing), with
31		−	the plan's; any change to it is announced there first. It does not need the
32		−	plan, and the plan does not include it.
	28	+	Security and quality has no price of its own. It is on for every private
	29	+	repository of a workspace on the [g1t plan](/guides/usage-and-billing/#the-g1t-plan),
	30	+	and what it runs is charged like everything else g1t runs: security scans
	31	+	at what they cost g1t plus 20%, from the plan's included usage first. There
	32	+	is nothing to turn on.
33	33
34		−	An owner turns it on:
	34	+	A Security and quality subscription a workspace has at Stripe is ended by g1t,
	35	+	without a charge for the next month. Workspaces whose billing g1t covers,
	36	+	and an enterprise's workspaces, have it included.
35	37
36		−	1. Open the workspace's Billing page, `g1t.sh/<owner>/-/billing`.
37		−	2. Under Security and quality, choose Turn on Security and quality.
38		−	3. Pay on Stripe's page, or at once with the card already checked.
	38	+	Without the plan, a private repository's paid features say what they need
	39	+	and who can start the plan; nothing is started without an owner choosing
	40	+	it.
39	41
40		−	Turn off at the period's end ends it when the month paid for ends:
41		−	nothing more is charged, and the paid features stop on private repositories
42		−	then. Alerts already found stay. Workspaces whose billing g1t covers, and
43		−	an enterprise's workspaces, have it included.
44		−
45		−	Without it, a private repository's paid features say what they need and
46		−	who can turn it on; nothing is turned on without an owner choosing it.
47		−
48	42		## Fixes are agent usage
49	43
50	44		Fix with g1t puts g1t's agent on an issue. Its run is charged as any
51		−	agent's: sandbox time and model tokens at cost plus 20%, from the plan's
52		−	included usage first. See [Usage and billing](/guides/usage-and-billing/).
	45	+	agent's: the model at the provider's price with the agent rate, and sandbox
	46	+	time at cost plus 20%, from the plan's included usage first. See [Usage and billing](/guides/usage-and-billing/).
53	47
54	48		Scanning itself (history scans and dependency reads) is metered as before,
55	49		and covered by g1t on free workspaces.

14	14		\| --- \| --- \| --- \|
15	15		\| Secret scanning and push protection \| Free \| Free \|
16	16		\| Bypass with a reason \| Free \| Free \|
17		−	\| Custom patterns \| Free \| Security and quality activation \|
18		−	\| Delegated bypass \| Free \| Security and quality activation \|
19		−	\| Validity checks \| Free \| Security and quality activation \|
	17	+	\| Custom patterns \| Free \| With the g1t plan \|
	18	+	\| Delegated bypass \| Free \| With the g1t plan \|
	19	+	\| Validity checks \| Free \| With the g1t plan \|
20	20
21	21		See [What's free and what's paid](/guides/security/pricing/).
22	22

23	23
24	24		## Private repositories
25	25
26		−	The overview counts private repositories with the
27		−	[Security and quality activation](/guides/security/pricing/). A workspace
28		−	without it, with private repositories, sees each repository's open secret
29		−	and vulnerability alerts as a list instead, which is free, and the
30		−	activation's prompt. A workspace with only public repositories sees the
	26	+	The overview counts private repositories on the g1t plan, which
	27	+	[Security and quality](/guides/security/pricing/) comes with. A workspace
	28	+	without the plan, with private repositories, sees each repository's open
	29	+	secret and vulnerability alerts as a list instead, which is free, and a
	30	+	prompt to start the plan. A workspace with only public repositories sees the
31	31		whole overview free.
32	32
33	33		## API

14	14		\| --- \| --- \| --- \|
15	15		\| Dependency graph and SBOM \| Free \| Free \|
16	16		\| Vulnerability alerts and security updates \| Free \| Free \|
17		−	\| Dependency review \| Free \| Security and quality activation \|
	17	+	\| Dependency review \| Free \| With the g1t plan \|
18	18
19	19		## The dependency graph
20	20

1	1		---
2	2		title: Spend
3		−	description: What the workspace spent and where it went, by agent, person, channel, model and product; the budgets from the workspace down to one task, and what happens at each; a receipt for every task; and how it is priced.
	3	+	description: What the workspace spent and where it went, by agent, person, channel, model and product; suggestions to spend less that are checked against your own past work; the budgets from the workspace down to one task; a receipt for every task; and how it is priced.
4	4		---
5	5
6	6		Spend is the front of the workspace's money:
⋯
53	53
54	54		A slice is part of the page's address (`?by=channel`), so you can share it.
55	55
	56	+	## Spend less, keep quality
	57	+
	58	+	Every week, g1t checks each agent's finished sessions and asks one
	59	+	question: would a cheaper [effort](/guides/agents/#effort) have done the
	60	+	work as well? The answers are under Spend less, keep quality, on Spend
	61	+	for every agent and on each agent's Spend tab for that agent.
	62	+
	63	+	How a suggestion is made:
	64	+
	65	+	1. What counts. Each agent's own sessions that finished in the last 28
	66	+	days, at the effort level each recorded, with what each was charged as
	67	+	budgets count it: the model at the provider's price and the
	68	+	[agent rate](/guides/usage-and-billing/#the-agent-rate). A session is
	69	+	accepted when it finished with nobody having to step in: no one
	70	+	steered it, and it was not stopped or failed. Helpers and subagents
	71	+	count as part of the session that started them.
	72	+	2. What is compared. The level the agent runs at now (for Auto, the
	73	+	level most of its sessions ran at) against the level below.
	74	+	3. When it suggests. Both levels have at least 10 sessions; the
	75	+	cheaper level's sessions were accepted at least as often, give or take
	76	+	5 points, even on a cautious estimate; and a typical session at the
	77	+	cheaper level cost at most 85% of one at the current level.
	78	+	4. What it says. The suggestion names the numbers it rests on, such as
	79	+	*At Medium, 12 of its 12 sessions finished with nobody stepping in,
	80	+	against 19 of 20 at High; a typical one cost $0.21 instead of $0.48*,
	81	+	and about what it would save a month at the agent's recent pace.
	82	+
	83	+	When either level has fewer than 10 sessions, Spend says **Not enough
	84	+	history yet**, with how many it has, instead of suggesting anything. When
	85	+	the cheaper level was measured and did worse, or would save little,
	86	+	nothing is shown.
	87	+
	88	+	To act on one, as an owner:
	89	+
	90	+	1. Open Spend and find Spend less, keep quality.
	91	+	2. Read the reason under the suggestion.
	92	+	3. Choose Apply to change the agent's effort (a new version of the
	93	+	agent, recorded in the [audit log](/guides/audit-log/) with who applied
	94	+	it), or Dismiss to put it away. A dismissed suggestion is not made
	95	+	again for the same setting.
	96	+
	97	+	Applied and dismissed suggestions stay listed under Decided lately for
	98	+	30 days. A suggestion made for a setting that has since changed is put
	99	+	away at the next check.
	100	+
56	101		## Budgets
57	102
58	103		Budgets nest, from the widest to the narrowest. Before every agent reply
⋯
99	144		- Each session of its tree: the agent's own, and every helper and subagent
100	145		it brought in, with their tokens, the model at the provider's price, and
101	146		what each was charged.
	147	+	- Each session's model and the [effort](/guides/agents/#effort) it ran at.
102	148		- Models, at the provider's price: every session's model answers
103	149		together.
104	150		- g1t's agent rate: the rest, at the rate in the price book.
⋯
115	161		\| \| Price \|
116	162		\| --- \| --- \|
117	163		\| Models \| What the model provider charges, with no markup. \|
118		−	\| Agent rate \| Per million tokens an agent's run uses, for context, memory, routing and orchestration. \|
119		−	\| Everything g1t runs \| Sandboxes, builds, hosting, storage and search, at cost plus 20%. \|
120		−	\| Your own model keys \| Your provider bills the model; only the agent rate is charged. Local models the same. \|
	164	+	\| Agent rate \| Per million tokens an agent's run uses, for what g1t runs around every model call: the model gateway, secrets, routing, context and pass-through to your own provider. \|
	165	+	\| Everything else g1t runs \| Sandboxes, builds, hosting, storage, search and security scans, at cost plus 20%. \|
	166	+	\| Your own model keys \| Your provider bills the model; the agent rate still applies. Local models the same. \|
121	167		\| Your own runners \| $0. \|
122	168		\| People \| No seats. \|
	169	+	\| Spending less \| [Effort](/guides/agents/#effort) on each agent, and the weekly suggestions above. \|
123	170
124	171		## In the top bar
125	172
⋯
133	180
134	181		## Next
135	182
	183	+	- [Effort](/guides/agents/#effort): how hard each agent works, and what each level costs.
136	184		- [Agent budgets and spend](/guides/agent-budgets/): who pays for a session tree.
137	185		- [Usage and billing](/guides/usage-and-billing/): the spend limit, caps, AI credit and rates.
138	186		- [Sessions](/guides/agent-sessions/): caps and approving more spend.

97	97		[card processing fee](#card-processing-fee) as its own line, $0.91 a month
98	98		on $20.
99	99
100		−	- $10 of usage each month at cost plus 20%, used first.
	100	+	- $10 of usage each month, used first: models at the provider's price
	101	+	with the [agent rate](#the-agent-rate), everything else g1t runs at cost
	102	+	plus 20%.
101	103		- Everyone in the workspace at one price, never per person.
102	104		- Unlimited projects, previews and repositories.
103	105		- Agents, workflows, the merge queue,
104		−	[deployments](/guides/deployments/) and semantic search.
	106	+	[deployments](/guides/deployments/), semantic search, and
	107	+	[Security and quality](/guides/security/pricing/) on private
	108	+	repositories.
105	109		- 90 days of [audit log](/guides/audit-log/#how-long-it-is-kept), in
106	110		place of a free workspace's 7.
107		−	- Usage past $10 is charged at cost plus 20%, **up to your
	111	+	- Usage past $10 is charged the same way, **up to your
108	112		[spend limit](#limits)**.
109	113
110	114		There are no quotas on the plan: no count of projects, previews,
⋯
117	121		Included usage pays for the month's usage first, at the same prices as
118	122		everything else: agents, sandbox time, builds, app traffic, custom domains,
119	123		storage, git operations, search embeddings and security scans. Past it,
120		−	usage is charged at cost plus 20%. It starts again on the 1st of each
	124	+	usage is charged at the same prices. It starts again on the 1st of each
121	125		month (UTC). Unused included usage does not roll over. Billing shows
122	126		how much of it this month's usage has drawn.
123	127
124	128		### What it costs
125	129
126		−	Every price is what g1t pays plus 20%, except models: they are charged at
127		−	the provider's price with no markup, and g1t's own part is the agent rate.
128		−	The live figures are on [g1t.sh/pricing](https://g1t.sh/pricing).
	130	+	Pricing has four rules:
	131	+
	132	+	1. Models at the provider's price. Tokens on g1t's models are charged
	133	+	what the provider charged, with no markup.
	134	+	2. **The [agent rate](#the-agent-rate) for what runs around every model
	135	+	call.** g1t's model gateway, secrets, routing, context and pass-through
	136	+	to your own provider run on every call an agent makes, so the rate
	137	+	applies on your own model keys too.
	138	+	3. Everything else g1t runs at cost plus 20%. Sandboxes, builds,
	139	+	hosting, storage, git operations, search and security scans: what g1t
	140	+	pays for them, plus 20%.
	141	+	4. Your own runners are free. Jobs on your
	142	+	[own runners](/guides/self-hosted-runners/) cost nothing here.
	143	+
	144	+	There are no seats. The live figures are on
	145	+	[g1t.sh/pricing](https://g1t.sh/pricing).
129	146
130	147		\| What \| Unit \| Costs g1t \| You pay \|
131	148		\| --- \| --- \| --- \| --- \|
⋯
264	281		charged here. Every reply also counts against that agent's own
265	282		[budget](/guides/agents/#budgets). An idle agent costs nothing. See
266	283		[what an agent costs](/guides/agents/#what-an-agent-costs) for a worked
267		−	example.
	284	+	example. How hard each agent works, and so what a typical task costs, is
	285	+	its [effort](/guides/agents/#effort);
	286	+	[Spend](/guides/spend/#spend-less-keep-quality) suggests cheaper settings
	287	+	that held up on past work.
268	288
269	289		## What is charged
270	290
⋯
289	309		it, with no markup; the agent rate on the tokens it used, on a line of its
290	310		own (g1t agent rate: 1,240,000 tokens for work on acme/api#12); and its
291	311		sandbox time. A small change costs a few cents. Tokens counted after a run
292		−	reports are charged when it is settled. Until Oct 22, 2026 the agent rate is
293		−	$0, and from Oct 8, 2026 models carry no markup (before, cost plus 20%); both
294		−	are dated changes on the pricing page.
	312	+	reports are charged when it is settled. The agent rate starts on Oct 22,
	313	+	2026, a dated change on the pricing page.
295	314
296	315		Work a workspace routes to [its own model providers](/guides/models/) is
297	316		paid for at those providers instead. Such a run is charged here for its
⋯
301	320
302	321		### The agent rate
303	322
304		−	The agent rate pays for what g1t adds around the model: context, memory,
305		−	routing and orchestration. It is charged per million tokens a run used,
306		−	on g1t's models and on your own model key alike:
	323	+	The agent rate pays for what g1t runs around every model call: the model
	324	+	gateway that keeps keys out of sandboxes, secrets, routing, context and
	325	+	memory, and the pass-through to your own provider. That runs whichever
	326	+	model answers, so the rate is charged per million tokens a run used, on
	327	+	g1t's models and on your own model key alike:
307	328
308	329		1. g1t's model proxy counts each answer's tokens as it passes: input,
309	330		output, and prompt-cache reads and writes. The sandbox reports what its
⋯
325	346
326	347		## Add-ons
327	348
328		−	An add-on is a monthly price per workspace that turns on more of g1t. Each
329		−	is its own line on the workspace's Stripe subscription and is turned on or
330		−	off from Billing → Add-ons.
	349	+	Billing → Add-ons lists what comes with the plan beside its usage, and
	350	+	whether it is on:
331	351
332	352		\| Add-on \| Price \| What it adds \|
333	353		\| --- \| --- \| --- \|
334		−	\| Security and quality \| $10 a month \| Custom secret patterns, validity checks, delegated bypass, code scanning, dependency review and the security overview on private repositories. Public repositories get all of it free. \|
	354	+	\| Security and quality \| With the plan, no price of its own \| Custom secret patterns, validity checks, delegated bypass, code scanning, dependency review and the security overview on private repositories. Its scans are charged at cost plus 20%. Public repositories get all of it free. \|
	355	+	\| Production deployments \| With the plan \| Previews per pull request and production on g1t.page, metered at cost plus 20%. \|
335	356
336	357		Secret scanning, push protection, vulnerability alerts, security updates,
337		−	the dependency graph and SBOMs are free everywhere, without the add-on. An
338		−	add-on does not need the plan, and the plan does not include one. Agent work
339		−	it starts, such as Fix with g1t, is ordinary usage. See
340		−	[What's free and what's paid](/guides/security/pricing/).
	358	+	the dependency graph and SBOMs are free everywhere, on every plan. Agent
	359	+	work Security and quality starts, such as Fix with g1t, is ordinary
	360	+	usage. See [What's free and what's paid](/guides/security/pricing/).
341	361
342	362		## How prices are set
343	363
⋯
840	860		applies.
841	861		- Invoices lists every invoice Stripe sent (the plan, add-ons, AI
842	862		credit and month-end usage), each with View and PDF.
843		−	- Add-ons lists what can be turned on beside the plan, such as the
844		−	[Security and quality activation](/guides/security/), with its price and
845		−	Turn on or Turn off.
	863	+	- Add-ons lists what comes with the plan, such as
	864	+	[Security and quality](/guides/security/pricing/), and whether it is on.
846	865
847	866		g1t support never takes card details by phone or email.
848	867
⋯
890	909		vulnerability alerts and security updates. The rest of the security suite
891	910		(custom patterns, validity checks, delegated bypass, code scanning,
892	911		dependency review and the security overview) is free on public
893		−	repositories and, on private ones, the Security and quality
894		−	activation: a monthly price per workspace from the price book ($10 today),
895		−	turned on from the Billing page, with or without the plan. See
	912	+	repositories and, on private ones, comes with the plan as **Security and
	913	+	quality**, with no price of its own: its scans are charged at cost plus
	914	+	20%. See
896	915		[what's free and what's paid](/guides/security/pricing/). What the plan changes is how long the log is
897	916		kept: [7 days free, 90 on the plan](/guides/audit-log/#how-long-it-is-kept),
898	917		and longer by arrangement. Single sign-on through your identity provider is not

537	537		[overview](/guides/security/security-overview/). `secret_alerts` is the
538	538		default action. Findings are shown only to those with Write on the
539	539		repository, and to the workspace's security managers; on private repositories, some actions need the
540		−	[Security and quality activation](/guides/security/pricing/), and are
	540	+	g1t plan, as [Security and quality](/guides/security/pricing/), and are
541	541		refused with `402` without it.
542	542
543	543		\| Action \| What it does \| Required \| Scope \|

Binary or large file; its contents are not shown.

2	2		import { type ReactNode, useState } from "react";
3	3		import { Form, NavLink, useLocation, useNavigation, useRouteLoaderData } from "react-router";
4	4
5		−	import type { AgentTemplate, ModelTier, WorkspaceAgent } from "@g1t/contracts";
	5	+	import type { AgentEffortCosts, AgentTemplate, ModelTier, WorkspaceAgent } from "@g1t/contracts";
6	6
7	7		import { type AgentLike, AgentAvatar, PixelCreature } from "./agent-avatar";
8	8		import { StatusDot, statusLabel } from "./chat/marks";
⋯
11	11		import { Skeleton } from "./ui/skeleton";
12	12		import { AUTONOMY, type AgentDraft, PRESETS, TIER_LABELS, cleanHandle, dollarsField } from "../lib/agent-form";
13	13		import { Hint } from "./ui/hint";
	14	+	import { EffortPicker } from "./effort";
	15	+	import { effortSetting } from "../lib/effort";
14	16		import { DEPARTMENTS, RoleFields, SubagentsField } from "./agent-role";
15	17		import type { AgentsLayoutData } from "../routes/workspace/agents/layout";
16	18
⋯
454	456		spaces = [],
455	457		hidden = {},
456	458		personal = false,
	459	+	effortCosts,
457	460		}: {
458	461		/** A personal agent: on no team. */
459	462		personal?: boolean;
460	463		/** Fields the form carries without showing: a drafted agent's scope, skills and face. */
461	464		hidden?: Record<string, string>;
	465	+	/** What each effort level has cost this agent, when it has a history; a new agent has none. */
	466	+	effortCosts?: AgentEffortCosts \| null;
462	467		/** The workspace's teams, to put it on one. */
463	468		teams?: { slug: string; name: string }[];
464	469		/** The Docs spaces the person editing can read, for its required reading. */
⋯
700	705		</p>
701	706		</div>
702	707		</div>
	708	+	<div>
	709	+	<Label hint="Tier, reasoning and steps together">Effort</Label>
	710	+	<EffortPicker value={effortSetting(draft.routing)} costs={effortCosts} />
	711	+	</div>
703	712		<div className="grid gap-5 sm:grid-cols-3">
704	713		<div>
705	714		<Label htmlFor="floor">Floor</Label>

470	470		const planOn = !!plan?.on;
471	471		const rows: { key: string; name: string; about: string; price: string; on: boolean; label: string; control: ReactNode }[] = [];
472	472		if (security) {
473		−	const status = security.subscription?.status;
474	473		rows.push({
475	474		key: "security",
476	475		name: security.plan.title,
477		−	about: `Custom patterns, validity checks, code scanning and dependency review on private repositories. ${
478		−	security.plan.cardFeeCents ? `Plus a ${dollars(security.plan.cardFeeCents * 10_000)} card processing fee a month, and tax where it applies.` : "Plus tax where it applies."
479		−	}`,
480		−	price: `$${(security.plan.monthlyCents / 100).toFixed(security.plan.monthlyCents % 100 ? 2 : 0)} / month`,
	476	+	about: "Custom patterns, validity checks, code scanning and dependency review on private repositories. No price of its own: scans are charged at cost plus 20%.",
	477	+	price: "With the plan",
481	478		on: security.on,
482		−	label: security.included ? "Included" : status === "canceling" ? "Ends at the period's end" : security.on ? "On" : "Off",
483		−	control:
484		−	!owner \|\| !enabled \|\| security.included ? null : (
485		−	<Form method="post">
486		−	<input type="hidden" name="feature" value="security" />
487		−	{!security.on ? (
488		−	<SubmitButton variant="quiet" name="intent" value="subscribe" pending="Opening Stripe…">
489		−	Turn on
490		−	</SubmitButton>
491		−	) : status === "canceling" ? (
492		−	<SubmitButton variant="quiet" name="intent" value="resume" pending="Saving…">
493		−	Keep it on
494		−	</SubmitButton>
495		−	) : (
496		−	<SubmitButton variant="quiet" name="intent" value="cancel" pending="Saving…">
497		−	Turn off
498		−	</SubmitButton>
499		−	)}
500		−	</Form>
501		−	),
	479	+	label: security.on ? "On" : "Needs the plan",
	480	+	control: null,
502	481		});
503	482		}
504	483		rows.push({

Binary or large file; its contents are not shown.