@cleocode/core 2026.8.2 → 2026.8.4

package/dist/llm/local-inference-probe.js

@@ -0,0 +1,174 @@
+/**
+ * Runtime detection of a reachable local inference server (T12082).
+ *
+ * ## Why CLEO should find this by itself
+ *
+ * The auxiliary fallback chain exists so that "context compression, brain dream
+ * cycles, hygiene scans" do not fail silently when the primary provider is
+ * unavailable. Its default chain is `anthropic → openrouter → groq` — all
+ * cloud. When every cloud credential is unusable, the chain is exhausted and
+ * the capability simply stops.
+ *
+ * That is exactly the state this machine was in on 2026-08-06: the anthropic
+ * credential was consent-gated, the openai one returned 401 — and an Ollama
+ * server was running the whole time with `qwen2.5-coder:3b` loaded. The dream
+ * cycle reported "no usable LLM client" while free local inference sat one
+ * HTTP request away. Nothing was broken except that nobody looked.
+ *
+ * A background consolidation pass is precisely the workload that should degrade
+ * to a small local model rather than stop: it is not latency-critical, it is
+ * not user-facing, and a shallow synthesis is worth more than none. So the
+ * chain now ends with a local tier that is included ONLY when a server actually
+ * answers.
+ *
+ * ## Why a probe rather than a config flag
+ *
+ * A config flag would need the operator to know their own machine's state and
+ * keep it current. A 300 ms probe against loopback is cheap, is cached for the
+ * process, and is correct by construction — it reports what is true now.
+ *
+ * @task T12082
+ */
+/** Loopback endpoints checked, in order. Ollama first — it is the common case. */
+const LOCAL_ENDPOINTS = [
+    {
+        name: 'ollama',
+        tagsUrl: 'http://127.0.0.1:11434/api/tags',
+        baseUrl: 'http://127.0.0.1:11434',
+        openAiBaseUrl: 'http://127.0.0.1:11434/v1',
+    },
+    {
+        name: 'lm-studio',
+        tagsUrl: 'http://127.0.0.1:1234/v1/models',
+        baseUrl: 'http://127.0.0.1:1234',
+        openAiBaseUrl: 'http://127.0.0.1:1234/v1',
+    },
+];
+/** Probe timeout. Loopback either answers immediately or is not there. */
+const PROBE_TIMEOUT_MS = 300;
+/** Process-lifetime cache — `undefined` = not yet probed, `null` = none found. */
+let cached;
+/**
+ * Extract model ids from either an Ollama `/api/tags` or an OpenAI `/v1/models`
+ * payload, whichever shape came back.
+ *
+ * @param body - parsed JSON response.
+ * @returns model ids, possibly empty.
+ */
+function extractModels(body) {
+    if (body === null || typeof body !== 'object')
+        return [];
+    const rec = body;
+    // Ollama: { models: [{ name, model, … }] }
+    if (Array.isArray(rec.models)) {
+        return rec.models
+            .map((m) => m !== null && typeof m === 'object'
+            ? (m.name ?? m.model)
+            : undefined)
+            .filter((n) => typeof n === 'string');
+    }
+    // OpenAI-compatible: { data: [{ id }] }
+    if (Array.isArray(rec.data)) {
+        return rec.data
+            .map((m) => (m !== null && typeof m === 'object' ? m.id : undefined))
+            .filter((n) => typeof n === 'string');
+    }
+    return [];
+}
+/**
+ * Detect a reachable local inference server with at least one model loaded.
+ *
+ * Cached for the process lifetime: a background tick may consult this many
+ * times and the answer does not change mid-run in practice.
+ *
+ * Never throws — a probe failure means "not available", which is a normal
+ * result rather than an error.
+ *
+ * @param opts - `force` re-probes, ignoring the cache (tests).
+ * @returns the detected server, or `null` when none answers.
+ *
+ * @example
+ * ```ts
+ * const local = await detectLocalInference();
+ * if (local) console.log(`${local.name} has ${local.models.length} model(s)`);
+ * ```
+ *
+ * @task T12082
+ */
+export async function detectLocalInference(opts = {}) {
+    // Operator opt-out. Two audiences: someone on a shared or metered box who
+    // does not want background work routed to a daemon they run for other
+    // purposes, and the test suite — which must produce the same result whether
+    // or not the developer happens to have Ollama running.
+    if (process.env['CLEO_DISABLE_LOCAL_INFERENCE']?.trim())
+        return null;
+    if (!opts.force && cached !== undefined)
+        return cached;
+    for (const endpoint of LOCAL_ENDPOINTS) {
+        try {
+            const response = await fetch(endpoint.tagsUrl, {
+                signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
+            });
+            if (!response.ok)
+                continue;
+            const models = extractModels(await response.json());
+            // A server with no models loaded cannot serve a completion, so it is not
+            // a usable fallback — treat it as absent rather than advertising it.
+            if (models.length === 0)
+                continue;
+            cached = {
+                name: endpoint.name,
+                baseUrl: endpoint.baseUrl,
+                openAiBaseUrl: endpoint.openAiBaseUrl,
+                models,
+            };
+            return cached;
+        }
+        catch {
+            // Unreachable / timed out / non-JSON — try the next endpoint.
+        }
+    }
+    cached = null;
+    return cached;
+}
+/**
+ * List the models an Ollama daemon actually has pulled.
+ *
+ * The cross-provider selector picks an Ollama model from a RAM heuristic
+ * alone, which answers "what could this machine run", not "what is installed".
+ * Those differ constantly — this machine has 62 GB of RAM and therefore scored
+ * into the `gemma4:e4b` tier while holding only `qwen2.5-coder:3b` and
+ * `qwen2:0.5b`, so the resolved model would have 404'd at the daemon. The fit
+ * heuristic is still right; it just has to be intersected with reality.
+ *
+ * Not cached — the installed set changes whenever the operator pulls a model,
+ * and the call is one loopback request.
+ *
+ * Never throws.
+ *
+ * @param baseUrl - Ollama root URL, e.g. `http://localhost:11434` (no `/v1`).
+ * @returns installed model ids in daemon order, empty when unreachable.
+ *
+ * @task T12082
+ */
+export async function listOllamaModels(baseUrl) {
+    try {
+        const url = `${baseUrl.replace(/\/+$/, '')}/api/tags`;
+        const response = await fetch(url, { signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
+        if (!response.ok)
+            return [];
+        return extractModels(await response.json());
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Clear the probe cache. Tests only.
+ *
+ * @task T12082
+ */
+export function _resetLocalInferenceCacheForTests() {
+    cached = undefined;
+}
+//# sourceMappingURL=local-inference-probe.js.map

package/dist/llm/local-inference-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-inference-probe.js","sourceRoot":"","sources":["../../src/llm/local-inference-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,kFAAkF;AAClF,MAAM,eAAe,GAA6B;IAChD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,iCAAiC;QAC1C,OAAO,EAAE,wBAAwB;QACjC,aAAa,EAAE,2BAA2B;KAC3C;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,iCAAiC;QAC1C,OAAO,EAAE,uBAAuB;QAChC,aAAa,EAAE,0BAA0B;KAC1C;CACF,CAAC;AAkCF,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,kFAAkF;AAClF,IAAI,MAAyC,CAAC;AAE9C;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,GAAG,GAAG,IAA4C,CAAC;IAEzD,2CAA2C;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,MAAM;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YACjC,CAAC,CAAC,CAAE,CAAwB,CAAC,IAAI,IAAK,CAAyB,CAAC,KAAK,CAAC;YACtE,CAAC,CAAC,SAAS,CACd;aACA,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACvD,CAAC;IACD,wCAAwC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,IAAI;aACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aAC1F,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA4B,EAAE;IAE9B,0EAA0E;IAC1E,sEAAsE;IACtE,4EAA4E;IAC5E,uDAAuD;IACvD,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAErE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAEvD,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE;gBAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,SAAS;YAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,yEAAyE;YACzE,qEAAqE;YACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAClC,MAAM,GAAG;gBACP,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,MAAM;aACP,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC;IAC/C,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC"}

package/dist/llm/plugin-facade.js

@@ -10043,6 +10043,27 @@ var init_operations_registry = __esm({
             type: "boolean",
             required: false,
             description: "Commit plan file before dispatching"
+          },
+          // T12089: the plan SCOPE. The workflow regenerates the plan when no
+          // committed plan is supplied, and `cleo release plan` requires
+          // `--saga | --epic | --tasks` — so without one of these the dispatched
+          // run dies at "Prepare bump-PR" after a fully green preflight.
+          //
+          // A param absent from this registry is STRIPPED before the domain handler
+          // sees it, silently. `--tasks` was accepted by the CLI, forwarded by the
+          // handler and by `releaseOpen`, and still arrived empty at the workflow
+          // because this declaration was the fourth hop in the chain.
+          {
+            name: "epic",
+            type: "string",
+            required: false,
+            description: "Epic task ID forwarded as the plan scope (e.g. T9999)"
+          },
+          {
+            name: "tasks",
+            type: "string",
+            required: false,
+            description: "Comma-separated task IDs forwarded as the plan scope for a task-scoped release"
           }
         ]
       },
@@ -15734,6 +15755,13 @@ var init_caamp_markers = __esm({
   }
 });
 
+// packages/contracts/src/collection-keys.ts
+var init_collection_keys = __esm({
+  "packages/contracts/src/collection-keys.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/index.ts
 var init_src = __esm({
   "packages/contracts/src/index.ts"() {
@@ -15802,6 +15830,7 @@ var init_src = __esm({
     init_service_provider();
     init_workgraph();
     init_caamp_markers();
+    init_collection_keys();
   }
 });
 
@@ -24483,7 +24512,9 @@ function computeClassBudget(cls, sample, opts = {}) {
       return Math.max(1, cpus - 2);
     case "test-run":
     case "scoped-build": {
-      const base = Math.max(1, Math.floor(cpus / 4));
+      const estRamBytes = (opts.testRunEstRamMb ?? 24576) * MB;
+      const byMem = Math.floor((availBytes - headroomBytes) / estRamBytes);
+      const base = clamp(1, byMem, Math.max(1, Math.floor(cpus / 4)));
       if (some > floor) return 1;
       if (some > hold) return Math.max(1, Math.floor(base / 2));
       return base;
@@ -24976,6 +25007,11 @@ var init_registry = __esm({
        * });
        * ```
        */
+      // T12071: keyed on the EVENT so the payload shape is checked against
+      // `HookEventPayloadMap`. The previous `<T extends HookPayload>` form inferred
+      // T from the argument, relating the event and the payload not at all — which
+      // is how `PostToolUse` came to be dispatched with `newStatus` instead of
+      // `status` and filled 29% of BRAIN with "status: undefined".
       async dispatch(event, projectRoot, payload) {
         if (!this.config.enabled) return;
         const resolvedEvent = this.resolveEvent(event);
@@ -28257,8 +28293,8 @@ function reuseValid(key, store) {
   return row;
 }
 async function bindAgainst(key, store, establish) {
-  const cached2 = reuseValid(key, store);
-  if (cached2) return cached2;
+  const cached3 = reuseValid(key, store);
+  if (cached3) return cached3;
   const pending = _inflight.get(key);
   if (pending) {
     const row = await pending;
@@ -36067,9 +36103,9 @@ var init_chat_completions = __esm({
           outputTokens: response.usage?.completion_tokens ?? 0
         };
         const promptDetails = response.usage?.["prompt_tokens_details"];
-        const cached2 = promptDetails?.["cached_tokens"];
-        if (typeof cached2 === "number" && cached2 > 0) {
-          usage.cachedTokens = cached2;
+        const cached3 = promptDetails?.["cached_tokens"];
+        if (typeof cached3 === "number" && cached3 > 0) {
+          usage.cachedTokens = cached3;
         }
         return {
           id: response.id ?? `chat-${Date.now().toString(36)}`,
@@ -36311,9 +36347,9 @@ function normalizeUsage(usage) {
   const outputTokens = usage["output_tokens"] ?? 0;
   const normalized = { inputTokens, outputTokens };
   const details = usage["input_tokens_details"];
-  const cached2 = details?.["cached_tokens"];
-  if (typeof cached2 === "number" && cached2 > 0) {
-    normalized.cachedTokens = cached2;
+  const cached3 = details?.["cached_tokens"];
+  if (typeof cached3 === "number" && cached3 > 0) {
+    normalized.cachedTokens = cached3;
   }
   return normalized;
 }
@@ -65486,6 +65522,76 @@ var init_model_runner = __esm({
   }
 });
 
+// packages/core/src/llm/local-inference-probe.ts
+function extractModels(body) {
+  if (body === null || typeof body !== "object") return [];
+  const rec = body;
+  if (Array.isArray(rec.models)) {
+    return rec.models.map(
+      (m) => m !== null && typeof m === "object" ? m.name ?? m.model : void 0
+    ).filter((n) => typeof n === "string");
+  }
+  if (Array.isArray(rec.data)) {
+    return rec.data.map((m) => m !== null && typeof m === "object" ? m.id : void 0).filter((n) => typeof n === "string");
+  }
+  return [];
+}
+async function detectLocalInference(opts = {}) {
+  if (process.env["CLEO_DISABLE_LOCAL_INFERENCE"]?.trim()) return null;
+  if (!opts.force && cached2 !== void 0) return cached2;
+  for (const endpoint of LOCAL_ENDPOINTS) {
+    try {
+      const response = await fetch(endpoint.tagsUrl, {
+        signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
+      });
+      if (!response.ok) continue;
+      const models = extractModels(await response.json());
+      if (models.length === 0) continue;
+      cached2 = {
+        name: endpoint.name,
+        baseUrl: endpoint.baseUrl,
+        openAiBaseUrl: endpoint.openAiBaseUrl,
+        models
+      };
+      return cached2;
+    } catch {
+    }
+  }
+  cached2 = null;
+  return cached2;
+}
+async function listOllamaModels(baseUrl) {
+  try {
+    const url2 = `${baseUrl.replace(/\/+$/, "")}/api/tags`;
+    const response = await fetch(url2, { signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
+    if (!response.ok) return [];
+    return extractModels(await response.json());
+  } catch {
+    return [];
+  }
+}
+var LOCAL_ENDPOINTS, PROBE_TIMEOUT_MS, cached2;
+var init_local_inference_probe = __esm({
+  "packages/core/src/llm/local-inference-probe.ts"() {
+    "use strict";
+    LOCAL_ENDPOINTS = [
+      {
+        name: "ollama",
+        tagsUrl: "http://127.0.0.1:11434/api/tags",
+        baseUrl: "http://127.0.0.1:11434",
+        openAiBaseUrl: "http://127.0.0.1:11434/v1"
+      },
+      {
+        name: "lm-studio",
+        tagsUrl: "http://127.0.0.1:1234/v1/models",
+        baseUrl: "http://127.0.0.1:1234",
+        openAiBaseUrl: "http://127.0.0.1:1234/v1"
+      }
+    ];
+    PROBE_TIMEOUT_MS = 300;
+  }
+});
+
 // packages/core/src/llm/catalog-model-resolver.ts
 var catalog_model_resolver_exports = {};
 __export(catalog_model_resolver_exports, {
@@ -65570,9 +65676,9 @@ var init_catalog_model_resolver = __esm({
 // packages/core/src/llm/cross-provider-selector.ts
 import { totalmem as totalmem2 } from "node:os";
 async function probeOllamaAlive(baseUrl) {
-  const cached2 = _ollamaProbeCache.get(baseUrl);
-  if (cached2 && Date.now() - cached2.checkedAt < OLLAMA_PROBE_TTL_MS) {
-    return cached2.alive;
+  const cached3 = _ollamaProbeCache.get(baseUrl);
+  if (cached3 && Date.now() - cached3.checkedAt < OLLAMA_PROBE_TTL_MS) {
+    return cached3.alive;
   }
   let alive = false;
   try {
@@ -65614,6 +65720,16 @@ function isProvisioned(provider) {
   const cred = resolveCredentials(provider);
   return (cred.apiKey?.trim().length ?? 0) > 0;
 }
+function reconcileOllamaModel(preferred, installed) {
+  if (installed.length === 0) return preferred;
+  if (installed.includes(preferred)) return preferred;
+  const family = preferred.split(":")[0];
+  if (family !== void 0 && family !== "") {
+    const sameFamily = installed.find((m) => m.split(":")[0] === family);
+    if (sameFamily !== void 0) return sameFamily;
+  }
+  return installed[0] ?? preferred;
+}
 function scoreProvider(provider, providerTier, taskTier, ollamaAlive, costInputPerMillion) {
   let score = TIER_BASE[providerTier];
   if (taskTier === "frontier" && providerTier === "frontier") {
@@ -65646,6 +65762,7 @@ function roleTierFor(role) {
 }
 async function selectBestProvisioned(role, opts) {
   const taskTier = roleTierFor(role);
+  const excluded = new Set(opts.exclude ?? []);
   for (const id of BUILTIN_PROVIDER_IDS) {
     const creds = await listCredentials(id);
     const hasExpiredOAuth = creds.some(
@@ -65670,10 +65787,23 @@ async function selectBestProvisioned(role, opts) {
   }
   const provisionedIds = [];
   for (const id of BUILTIN_PROVIDER_IDS) {
+    if (excluded.has(id)) continue;
     if (isProvisioned(id)) {
       provisionedIds.push(id);
     }
   }
+  let localModels = [];
+  if (!excluded.has("ollama") && !provisionedIds.includes("ollama")) {
+    const local = await detectLocalInference();
+    if (local !== null && local.name === "ollama") {
+      provisionedIds.push("ollama");
+      localModels = local.models;
+      logger4.debug(
+        { baseUrl: local.baseUrl, models: local.models },
+        "cross-provider-selector: unlisted ollama daemon is live \u2014 admitting as provisioned"
+      );
+    }
+  }
   if (provisionedIds.length === 0) {
     logger4.warn(
       {
@@ -65690,11 +65820,12 @@ async function selectBestProvisioned(role, opts) {
   const { resolveProviderDefaultModel: resolveProviderDefaultModel2, catalogKeyForProvider: catalogKeyForProvider2 } = await Promise.resolve().then(() => (init_catalog_model_resolver(), catalog_model_resolver_exports));
   const { pickCredentialForProvider: pickCredentialForProvider2 } = await Promise.resolve().then(() => (init_credentials_store(), credentials_store_exports));
   const ollamaProvisioned = provisionedIds.includes("ollama");
-  let ollamaAlive = false;
-  if (ollamaProvisioned) {
+  let ollamaAlive = localModels.length > 0;
+  if (ollamaProvisioned && !ollamaAlive) {
     const profile = await getProviderProfile2("ollama");
     const ollamaBase = profile?.baseUrl ?? "http://localhost:11434";
     ollamaAlive = await probeOllamaAlive(ollamaBase);
+    if (ollamaAlive) localModels = await listOllamaModels(ollamaBase);
   }
   const scored = [];
   for (const id of provisionedIds) {
@@ -65724,6 +65855,7 @@ async function selectBestProvisioned(role, opts) {
     } else {
       model = ollamaDefaultModelForTier(winner.tier, ramBytes);
     }
+    model = reconcileOllamaModel(model, localModels);
     const catalogKey = catalogKeyForProvider2(winner.id);
     const catalogModel = resolveProviderDefaultModel2(catalogKey);
     if (!catalogModel?.startsWith("gemma4")) {
@@ -65767,6 +65899,7 @@ var init_cross_provider_selector = __esm({
     init_credential_pool();
     init_credentials2();
     init_credentials_store();
+    init_local_inference_probe();
     logger4 = getLogger("llm-cross-provider-selector");
     BUILTIN_PROVIDER_IDS = [
       "anthropic",
@@ -65883,6 +66016,7 @@ __export(role_resolver_exports, {
   HYGIENE_FALLBACK_MODEL: () => HYGIENE_FALLBACK_MODEL,
   IMPLICIT_FALLBACK_MODEL: () => IMPLICIT_FALLBACK_MODEL,
   IMPLICIT_FALLBACK_PROVIDER: () => IMPLICIT_FALLBACK_PROVIDER,
+  LOCAL_PLACEHOLDER_TOKEN: () => LOCAL_PLACEHOLDER_TOKEN,
   resolveAnthropicForRole: () => resolveAnthropicForRole,
   resolveLLMForRole: () => resolveLLMForRole
 });
@@ -65986,6 +66120,16 @@ async function selectProviderModel(llm, role, systemKey, profileOverride, projec
     source: "implicit-fallback"
   };
 }
+async function applyProviderExclusions(selected, role, projectRoot, exclude) {
+  if (exclude === void 0 || exclude.length === 0) return selected;
+  if (!exclude.includes(selected.provider)) return selected;
+  try {
+    const substitute = await selectBestProvisioned(role, { projectRoot, exclude });
+    if (substitute !== null) return substitute;
+  } catch {
+  }
+  return selected;
+}
 async function resolveCredentialForRole(provider, credentialLabel, projectRoot) {
   try {
     await new CredentialPool(provider).refreshExpiredOAuth();
@@ -66000,7 +66144,9 @@ async function resolveCredentialForRole(provider, credentialLabel, projectRoot)
           provider,
           apiKey: stored.accessToken,
           source: "cred-file",
-          authType: wireAuthType
+          authType: wireAuthType,
+          // T12081: preserve the stored endpoint (Ollama/LM Studio/vLLM/…).
+          baseUrl: stored.baseUrl ?? null
         },
         usedLabel: stored.label
       };
@@ -66016,7 +66162,9 @@ async function resolveCredentialForRole(provider, credentialLabel, projectRoot)
           provider,
           apiKey: picked.accessToken,
           source: "cred-file",
-          authType: wireAuthType
+          authType: wireAuthType,
+          // T12081: preserve the stored endpoint (Ollama/LM Studio/vLLM/…).
+          baseUrl: picked.baseUrl ?? null
         },
         usedLabel: picked.label
       };
@@ -66026,6 +66174,23 @@ async function resolveCredentialForRole(provider, credentialLabel, projectRoot)
   if (cred.apiKey) {
     return { credential: cred, usedLabel: void 0 };
   }
+  if (provider === "ollama") {
+    const local = await detectLocalInference();
+    if (local !== null && local.name === "ollama") {
+      return {
+        credential: {
+          provider,
+          apiKey: LOCAL_PLACEHOLDER_TOKEN,
+          source: "local-daemon",
+          authType: "api_key",
+          // ROOT url, not the `/v1` form: `deriveApiWire('ollama')` selects the
+          // NATIVE transport, which appends `/api/chat` itself.
+          baseUrl: local.baseUrl
+        },
+        usedLabel: void 0
+      };
+    }
+  }
   return { credential: null, usedLabel: void 0 };
 }
 async function resolveLLMForRole(role, opts) {
@@ -66038,13 +66203,19 @@ async function resolveLLMForRole(role, opts) {
     config2 = void 0;
   }
   const llmBlock = readLlmBlock(config2);
-  const { provider, model, credentialLabel, source } = await selectProviderModel(
+  const selected = await selectProviderModel(
     llmBlock,
     role,
     opts?.systemKey,
     opts?.profileOverride,
     projectRoot
   );
+  const { provider, model, credentialLabel, source } = await applyProviderExclusions(
+    selected,
+    role,
+    projectRoot,
+    opts?.excludeProviders
+  );
   const { credential, usedLabel } = await resolveCredentialForRole(
     provider,
     credentialLabel,
@@ -66070,7 +66241,12 @@ async function resolveLLMForRole(role, opts) {
     credentialMetadata = {
       provider: credential.provider,
       source: credential.source,
-      authType: wireAuthType
+      authType: wireAuthType,
+      // T12081: carry the credential's OWN endpoint. Without it a consumer
+      // building a transport cannot tell that this credential targets a local
+      // or proxied host, and falls back to the provider's public API — which
+      // rejected every Ollama / LM Studio / vLLM / OpenRouter credential 401.
+      baseUrl: credential.baseUrl ?? null
     };
     sealedCredential = makeSealedCredential({
       provider: credential.provider,
@@ -66112,7 +66288,7 @@ async function resolveAnthropicForRole(role, opts) {
     model: llm.model
   };
 }
-var IMPLICIT_FALLBACK_PROVIDER, HYGIENE_FALLBACK_MODEL;
+var IMPLICIT_FALLBACK_PROVIDER, LOCAL_PLACEHOLDER_TOKEN, HYGIENE_FALLBACK_MODEL;
 var init_role_resolver = __esm({
   "packages/core/src/llm/role-resolver.ts"() {
     "use strict";
@@ -66123,10 +66299,12 @@ var init_role_resolver = __esm({
     init_credentials_store();
     init_cross_provider_selector();
     init_fallback_model();
+    init_local_inference_probe();
     init_sealed_credential();
     init_system_of_use_registry();
     init_anthropic_client_factory();
     IMPLICIT_FALLBACK_PROVIDER = "anthropic";
+    LOCAL_PLACEHOLDER_TOKEN = "local";
     HYGIENE_FALLBACK_MODEL = "claude-sonnet-4-6";
   }
 });
@@ -66985,8 +67163,8 @@ var _engineRegistry = /* @__PURE__ */ new Map([
 registerContextEngine("llm-summarization", _engineRegistry.get("compression"));
 var _executorCache = /* @__PURE__ */ new Map();
 async function getLlmExecutor(role) {
-  const cached2 = _executorCache.get(role);
-  if (cached2 !== void 0) return cached2;
+  const cached3 = _executorCache.get(role);
+  if (cached3 !== void 0) return cached3;
   const contextEngine = _engineRegistry.get(role);
   const factory11 = new DefaultLlmExecutorFactory({ contextEngine });
   const executor = await factory11.createForRole(role);