@adhdev/daemon-core 0.9.82-rc.507 → 0.9.82-rc.508

package/dist/mesh/model-provider-compat.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Provider ↔ model compatibility guard for brain/slot-derived launch models.
+ *
+ * WHY THIS EXISTS: the difficulty→brain presets (and MAGI slots) carry
+ * provider-agnostic model strings like `opus`/`sonnet`/`haiku`, which are
+ * Anthropic (Claude) model names. When a task lands on a node whose provider is
+ * NOT Anthropic-backed — `codex-cli` (ChatGPT), `antigravity-cli`, `hermes-cli`
+ * — forwarding a `claude-*` model as the launch arg makes that provider convert
+ * it to e.g. `-c model='claude-...'`, and a ChatGPT-account codex then rejects
+ * the launch with a 400. The model string was never meant to be forced onto a
+ * provider that can't honor it (presets are "best-effort at launch").
+ *
+ * The invariant this enforces: **an Anthropic (`claude-*`) model is never passed
+ * as a launch argument to a non-Anthropic provider.** When a preset/slot model is
+ * incompatible with the resolved provider, drop the model (the provider then uses
+ * its own default) and keep only the provider-neutral axis (thinkingLevel).
+ *
+ * This is deliberately conservative: it only strips a model that is *known* to be
+ * Anthropic when the provider is *known* to be non-Anthropic. Unknown models and
+ * unknown providers pass through unchanged so a legitimately provider-specific
+ * model (e.g. an operator who configured `gpt-5-codex` on a codex slot) is not
+ * clobbered.
+ */
+/**
+ * True when `providerType` is an Anthropic-backed provider (Claude). Matching is
+ * case-insensitive and tolerant of surrounding whitespace. An empty/undefined
+ * provider is treated as non-Anthropic (unknown → don't assume Claude).
+ */
+export declare function isAnthropicProvider(providerType: string | undefined | null): boolean;
+/**
+ * True when `model` names an Anthropic (Claude) model — the provider-agnostic
+ * brain-preset aliases (`opus`/`sonnet`/`haiku`) or any explicit `claude-*` id.
+ * Case-insensitive. Non-Anthropic and unknown models return false so they pass
+ * the compatibility check unchanged.
+ */
+export declare function isAnthropicModel(model: string | undefined | null): boolean;
+/**
+ * Compatibility check for a brain/slot-derived launch model against the provider
+ * it would launch on. Returns false ONLY for the concrete failure mode we guard:
+ * an Anthropic model routed to a non-Anthropic provider. Everything else
+ * (no model, non-Anthropic model, Anthropic provider, unknown provider) is
+ * compatible so nothing legitimate is stripped.
+ */
+export declare function isModelCompatibleWithProvider(model: string | undefined | null, providerType: string | undefined | null): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adhdev/daemon-core",
-  "version": "0.9.82-rc.507",
+  "version": "0.9.82-rc.508",
   "description": "ADHDev daemon core — CDP, IDE detection, providers, command execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,8 +47,8 @@
   "author": "vilmire",
   "license": "AGPL-3.0-or-later",
   "dependencies": {
-    "@adhdev/mesh-shared": "0.9.82-rc.507",
-    "@adhdev/session-host-core": "0.9.82-rc.507",
+    "@adhdev/mesh-shared": "0.9.82-rc.508",
+    "@adhdev/session-host-core": "0.9.82-rc.508",
     "@agentclientprotocol/sdk": "^0.16.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/src/mesh/coordinator-prompt.ts

@@ -804,7 +804,9 @@ Follow these recovery rules:
 1. **If "Retry recommended"**: Check \`mesh_view_queue\` first — the daemon may have auto-requeued. If not, re-launch the session on the same node (\`mesh_launch_session\`), then resend the original task (\`mesh_send_task\`). The system message includes the original task text.
 2. **If "Max retries exceeded"**: Do NOT retry on the same node. Either reassign the task to a different node, or inform the user that the task requires manual intervention.
 3. **If no recovery context**: The stop may be intentional (normal completion). Use \`mesh_read_chat\` once to verify, then move on.
-4. **Always record what happened**: After handling a failure, briefly note the outcome in your report to the user.`;
+4. **Always record what happened**: After handling a failure, briefly note the outcome in your report to the user.
+5. **Stuck-but-done vs actually-stuck**: If a delegated session appears stuck but has already produced a verified final summary or diff, stop polling noisy tool/terminal transcript bubbles. Verify with \`mesh_git_status\` or a checkpoint and proceed to landing.
+6. **Refinery falsely blocks a verified-clean branch — manual fast-forward convergence**: When \`mesh_refine_node\` falsely blocks a verified-clean branch (stale preflight, or the submodule-gitlink trivial-fast-forward misjudgment), bypass the refine tool and converge by strict fast-forward — (1) rebase the submodule commit onto the submodule \`origin/main\`, (2) push the submodule ff-only (verify \`git merge-base --is-ancestor\` first), (3) rebase the root branch and re-bump the submodule pointer so the root diff stays non-empty, (4) push the root ff-only. NEVER force-push or reset; abort and report on any non-fast-forward.`;
 
 const ONBOARDING_SECTION = `## Onboarding / Reinit
 
@@ -837,7 +839,7 @@ function buildRulesSection(coordinatorCliType?: string): string {
 
 - **Route, don't implement.** Delegate all code reading, analysis, and execution to node agents. Never read source files or run commands in the coordinator — keep context lean.
 - **Front-load task messages.** Include everything the agent needs (files, problem, expected fix) in \`mesh_enqueue_task\` / \`mesh_send_task\`. Append a structured result request at the end: ask the worker to conclude with a JSON block containing \`status\`, \`changedFiles\`, \`gitStatus\`, \`validationResults\`, \`errors\`, \`nextAction\`. The daemon parses this automatically; you can read it from \`mesh_task_history\`.
-- **Reuse idle sessions.** For follow-up, retry, commit/push, or cleanup on the same issue, send only the delta to the existing idle session. Start fresh only for independent work, provider mismatch, transcript contamination, or required worktree isolation.
+- **Reuse idle sessions.** For follow-up, retry, commit/push, or cleanup on the same issue, send only the delta to the existing idle session. Start a fresh session only when: (a) branch/worktree isolation is required, (b) the existing session had a dispatch failure or provider mismatch, (c) the transcript/runtime is contaminated or interrupted, or (d) the user explicitly asks for a different provider/session. Continuation of the same issue in an already-idle session is allowed and preferred — this rule blocks concurrent unrelated work interleaved into a live (still-generating) session, not sequential same-issue follow-ups.
 - **Worktree affinity.** A worktree is a durable per-branch workspace; keep all of a branch's code_change/fix/review work on its worktree node by targeting \`required_tags: ["worktree=<branch>"]\` or \`target_node_id\`. Get the id/branch from the \`mesh_clone_node\` result or a live \`mesh_status\` — the Configured Nodes snapshot won't list a worktree cloned after launch. Untargeted same-branch follow-ups drift to the base node. Only \`convergence\` (merge/push) runs on the base, never pinned to the worktree.
 - **Classify task difficulty to save tokens.** For each task you enqueue, judge its execution difficulty and pass \`difficulty\`: \`easy\` (extraction, renames, doc tweaks, trivial fixes), \`medium\` (ordinary feature/bugfix work), \`difficult\` (architecture, tricky debugging, multi-file refactors, subtle reasoning), or \`freeform\`. The mesh's per-difficulty brain preset then runs easy tasks on a cheaper model at low reasoning effort and hard tasks on a stronger model at high effort — real token savings on simple work. The current presets are shown in the "Brain presets" section below. You may still pass an explicit \`model\`/\`thinkingLevel\` to override the preset for one task.
 - **Retune node profiles when routing is a poor fit — but only with approval.** A node's capability slots (its provider/model/thinking + difficulty range + capability tags, seen via \`mesh_node_slots_list\`) are what task→node fitness routing matches against. If you notice a persistent mismatch — e.g. every \`difficult\` task lands on a node whose only slot is a cheap model, or a capability a node clearly has isn't declared — you MAY propose a slot change with \`mesh_node_slots_set\` (write=false). That returns current-vs-proposed; present that diff to the user with a one-line reason and apply (write=true) ONLY after they approve. It is a WHOLESALE replacement of the node's slots, so include the slots you want to keep. Never rewrite a node's profile silently or without a clear routing reason.
@@ -845,12 +847,15 @@ function buildRulesSection(coordinatorCliType?: string): string {
 - **Verify via git, not source.** Use \`mesh_git_status\` to confirm side effects. Treat agent summaries as self-reports, not verification.
 - **Limit parallelism.** Start with 1–2 tasks; scale only on success. Never duplicate a session because \`mesh_read_chat\` shows no final message while tool/terminal activity is ongoing. This caps *concurrent* load — it does not mean serialize independent work: when a new, independent request arrives and there is headroom under \`maxParallelTasks\`, dispatch it right away rather than waiting for an in-flight task or a user nudge (read-only diagnosis especially, since it has no merge cost).
 - **Check history first.** Call \`mesh_task_history\` at session start to avoid duplicate work and inform recovery. On failure, read task history before retrying.
+- **Don't reopen already-done work after a resume.** Before reopening a reported issue after context compaction or session resume, check current git state and recent session context. If another session has already completed the work, continue from the existing diff/commit instead of starting a duplicate investigation.
 - **Sequence shared-base-moving merges.** Parallel dispatch is encouraged, but merging one worktree can advance another in-flight worktree's base — especially a shared submodule pointer — turning a clean fast-forward into a diverged rebase (patch-equivalence correctly blocks this). Before merging an in-flight worktree while siblings are also in flight, land in an intentional order, re-clone long-running worktrees from the advanced base, or expect to manually rebase + ff-only the laggards; merging an independent fix mid-flight can strand siblings into a rebase.
 - **Converge branches.** After worktree tasks: refine/fast-forward, or classify as \`pushed_feature_branch_needs_merge\` / \`blocked_review\` / \`cleanup_candidate\` / \`not_mergeable\`. Clean up with \`mesh_remove_node\`.
 - **Refinery is config-driven.** \`mesh_refine_node\` must run validation from \`.adhdev/refine.{json,yaml,yml}\` or \`repo-mesh.refine.*\`. Heuristics are scaffolding only.
 - **Submodule reachability = publish-needed.** \`submodule_reachability_failed\` → classify as \`blocked_review\`, request user approval to push to submodule main, then rerun \`mesh_refine_node\`.
 - **Honor per-node instructions.** When a node carries a 📌 Node instruction in the nodes section, include the relevant parts of that instruction in the task message you send to that node. Don't paraphrase the instruction into your own words — quote it verbatim so the worker agent sees exactly what the user wrote.
 - **Mission status does not update itself.** When a mission's tasks are all done or the work is abandoned, explicitly call \`mesh_mission_upsert\` to set status \`completed\` or \`abandoned\`. Never leave a finished mission in \`active\`. All-cancelled tasks with no further work → \`abandoned\`.
+- **Don't spawn a nested coordinator for simple inspection.** Do not spawn a nested coordinator-like agent for simple inspection tasks. If delegation is required, use explicit provider selection and a fully self-contained, bounded task instruction.
+- **Keep internal traffic out of the transcript.** Internal tool calls, status events, control messages, and debug output must not appear as ordinary user-visible chat transcript content unless explicitly marked user-facing by the producing agent.
 - **Never fabricate tool results.** Always call the actual tool.
 - **Keep the user informed.** One or two sentences after each delegation round.${coordinatorNote}
 

package/src/mesh/mesh-queue-assignment.ts

@@ -23,6 +23,7 @@ import { queuePendingMeshCoordinatorEvent, retractPendingDispatchBlockedEvent }
 import { isWorktreeBootstrapStaleRunning, shouldDeferDispatchForBootstrap } from './worktree-bootstrap-config.js';
 import { isWithinCloneBootstrapGrace } from './mesh-clone-grace.js';
 import { beginTaskDispatchInFlight, endTaskDispatchInFlight } from './mesh-task-inflight.js';
+import { isModelCompatibleWithProvider } from './model-provider-compat.js';
 
 /**
  * CANON: the single canonical coordinator-daemon id this daemon stamps onto every
@@ -2056,9 +2057,27 @@ async function maybeAutoLaunchOneQueueSession(components: DaemonComponents, mesh
                 // Slot-derived model/thinking: an explicit task.model/thinkingLevel
                 // (resolved from the enqueue-time brain) still wins; the matched
                 // slot fills only what the task left blank (ORCHESTRATION_NODE_SLOTS.md).
-                const effectiveModel = (typeof task.model === 'string' && task.model.trim()) ? task.model.trim() : resolved.model;
+                const rawEffectiveModel = (typeof task.model === 'string' && task.model.trim()) ? task.model.trim() : resolved.model;
                 const effectiveThinkingLevel = (typeof task.thinkingLevel === 'string' && task.thinkingLevel.trim()) ? task.thinkingLevel.trim() : resolved.thinkingLevel;
 
+                // CODEX-400 GUARD: the difficulty→brain presets (and MAGI slots) carry
+                // provider-agnostic Anthropic model aliases (opus/sonnet/haiku). Now that
+                // resolved.providerType is definitively known, drop the model if it is a
+                // Claude model but the provider is NOT Anthropic-backed (codex-cli /
+                // antigravity-cli / hermes-cli): forwarding `claude-*` as an initialModel
+                // makes those providers convert it to `-c model='claude-...'`, and a
+                // ChatGPT-account codex then rejects the launch with a 400. Stripping it
+                // lets the provider fall back to its own default model; the provider-neutral
+                // thinkingLevel axis is preserved. This is the single authoritative point
+                // that enforces the invariant across every model source (preset, slot,
+                // explicit) because both remote and local launch consume effectiveModel below.
+                const effectiveModel = isModelCompatibleWithProvider(rawEffectiveModel, resolved.providerType)
+                    ? rawEffectiveModel
+                    : undefined;
+                if (rawEffectiveModel && effectiveModel === undefined) {
+                    LOG.info('MeshQueue', `CODEX-400 GUARD: dropped incompatible launch model '${rawEffectiveModel}' for non-Anthropic provider '${resolved.providerType}' on node ${nodeId} (task ${task.id}); provider will use its own default model`);
+                }
+
                 // Don't spawn a session for a (node, provider) already at its declared
                 // maxParallel cap — it would launch only to fail the claim. The claim
                 // transaction enforces the cap regardless; this just avoids a doomed launch.

package/src/mesh/model-provider-compat.ts

@@ -0,0 +1,73 @@
+/**
+ * Provider ↔ model compatibility guard for brain/slot-derived launch models.
+ *
+ * WHY THIS EXISTS: the difficulty→brain presets (and MAGI slots) carry
+ * provider-agnostic model strings like `opus`/`sonnet`/`haiku`, which are
+ * Anthropic (Claude) model names. When a task lands on a node whose provider is
+ * NOT Anthropic-backed — `codex-cli` (ChatGPT), `antigravity-cli`, `hermes-cli`
+ * — forwarding a `claude-*` model as the launch arg makes that provider convert
+ * it to e.g. `-c model='claude-...'`, and a ChatGPT-account codex then rejects
+ * the launch with a 400. The model string was never meant to be forced onto a
+ * provider that can't honor it (presets are "best-effort at launch").
+ *
+ * The invariant this enforces: **an Anthropic (`claude-*`) model is never passed
+ * as a launch argument to a non-Anthropic provider.** When a preset/slot model is
+ * incompatible with the resolved provider, drop the model (the provider then uses
+ * its own default) and keep only the provider-neutral axis (thinkingLevel).
+ *
+ * This is deliberately conservative: it only strips a model that is *known* to be
+ * Anthropic when the provider is *known* to be non-Anthropic. Unknown models and
+ * unknown providers pass through unchanged so a legitimately provider-specific
+ * model (e.g. an operator who configured `gpt-5-codex` on a codex slot) is not
+ * clobbered.
+ */
+
+/**
+ * Provider types that are Anthropic-backed (accept `claude-*` / opus/sonnet/haiku
+ * model names). Everything else is treated as non-Anthropic for the guard.
+ */
+const ANTHROPIC_PROVIDER_TYPES: ReadonlySet<string> = new Set([
+    'claude-cli',
+]);
+
+/**
+ * True when `providerType` is an Anthropic-backed provider (Claude). Matching is
+ * case-insensitive and tolerant of surrounding whitespace. An empty/undefined
+ * provider is treated as non-Anthropic (unknown → don't assume Claude).
+ */
+export function isAnthropicProvider(providerType: string | undefined | null): boolean {
+    const p = typeof providerType === 'string' ? providerType.trim().toLowerCase() : '';
+    return p.length > 0 && ANTHROPIC_PROVIDER_TYPES.has(p);
+}
+
+/**
+ * True when `model` names an Anthropic (Claude) model — the provider-agnostic
+ * brain-preset aliases (`opus`/`sonnet`/`haiku`) or any explicit `claude-*` id.
+ * Case-insensitive. Non-Anthropic and unknown models return false so they pass
+ * the compatibility check unchanged.
+ */
+export function isAnthropicModel(model: string | undefined | null): boolean {
+    const m = typeof model === 'string' ? model.trim().toLowerCase() : '';
+    if (!m) return false;
+    if (m.startsWith('claude') || m.startsWith('anthropic')) return true;
+    // Provider-agnostic brain-preset aliases (DEFAULT_DIFFICULTY_BRAINS) are Claude
+    // model families; a bare `opus`/`sonnet`/`haiku` (optionally with a suffix like
+    // `opus-4` or `sonnet-4-5`) means an Anthropic model.
+    return /^(opus|sonnet|haiku)(\b|[-_])/.test(m);
+}
+
+/**
+ * Compatibility check for a brain/slot-derived launch model against the provider
+ * it would launch on. Returns false ONLY for the concrete failure mode we guard:
+ * an Anthropic model routed to a non-Anthropic provider. Everything else
+ * (no model, non-Anthropic model, Anthropic provider, unknown provider) is
+ * compatible so nothing legitimate is stripped.
+ */
+export function isModelCompatibleWithProvider(
+    model: string | undefined | null,
+    providerType: string | undefined | null,
+): boolean {
+    if (!isAnthropicModel(model)) return true;      // non-Claude model → no constraint
+    if (isAnthropicProvider(providerType)) return true; // Claude model on Claude provider → fine
+    return false;                                    // Claude model on non-Claude provider → block
+}