Lure v1.14.2

Lure v1.14.2

Fixed: sandbox runs could not be priced

A sandbox record's target named the agent's container image (sandbox:lure-ref-agent:1.14.0). No prices file lists an image, so Lure's own estimates (--prices, lure compare --prices) came out empty for every sandbox run. The target is now sandbox:<provider>:<model>, for example sandbox:anthropic:claude-haiku-5-5, and the image stays in sandbox.agent_image. An agent profile now needs model:.

The 1.14.1 report's figure was right, but it had been worked out by hand: 8,172 input and 1,619 output Haiku tokens at $0.10 and $0.50 per million (the example prices file) is $0.0016. A test now reproduces it with Lure's own pricing.

New: lure sandbox run --prices FILE --max-cost USD

• Each record gets its estimated cost.
• Lure reads the agent's token counts as each model request returns. Once the running total passes the cap, it stops the agent's processes in the container, mid-attack if need be, and runs no further attack.
• The stopped run is an Error (stop: max_cost) unless a fail rule already matched. Its evidence (gateway log, workspace diff, decoys) is still collected, and the command exits 3.
• A model missing from the prices file is refused before any run.
• The cap can be passed by up to one model request: the one whose tokens crossed it.