@ctrl-spc/cs 0.7.11 → 0.7.12

package/dist/codebases.js

@@ -101,6 +101,32 @@ export async function removeCodebase(client, codebaseId) {
     if (error)
         throw new Error(error.message);
 }
+/** Saved work-item scope is shared by the reader and the dispatch guard. */
+export async function listWorkItemCodebaseTargets(client, workItemId) {
+    const { data, error } = await client.from('cliv2_task_codebase_targets')
+        .select('git_remote_url').eq('task_id', workItemId).order('git_remote_url');
+    if (error)
+        throw new Error(`Could not read the saved work-item codebase targets: ${error.message}`);
+    return (data ?? []).map(row => row.git_remote_url);
+}
+/** The existing database transaction owns membership and final-target guards. */
+export async function editWorkItemCodebaseTarget(client, workItemId, projectId, codebaseId, add) {
+    const codebases = await client.from('cliv2_codebases').select('git_remote_url')
+        .eq('id', codebaseId).eq('project_id', projectId);
+    if (codebases.error)
+        throw new Error(`Could not read the project codebase: ${codebases.error.message}`);
+    if (codebases.data?.length !== 1)
+        throw new Error("Could not read a codebase belonging to this work item's project.");
+    const { data, error } = await client.rpc('cliv2_edit_task_codebase_target', {
+        p_task_id: workItemId, p_git_remote_url: codebases.data[0].git_remote_url, p_add: add,
+    });
+    if (error)
+        throw new Error(`Could not edit the saved work-item codebase targets: ${error.message}`);
+    if (!Array.isArray(data) || !data.every(target => typeof target === 'string')) {
+        throw new Error('The saved work-item codebase targets could not be read back after editing.');
+    }
+    return data;
+}
 /**
  * Record that THIS machine has a codebase's folder checked out — Phase 2
  * per-machine availability. Upserts one path-free row into the owner-scoped

package/dist/panel3/checkout.js

@@ -407,35 +407,10 @@ settings = {}) {
             + `${branch}. Check that ${codebase.name} is a git repository on ${machineName}.`);
     }
 }
-/**
- * ═══ THE CARD IS OVER: COMMIT WHAT IS THERE, THEN TAKE THE COPY AWAY. ═══
- *
- * The commit comes first and is unconditional on there being something to
- * commit, so removing the copy cannot lose work. The BRANCH is never touched:
- * work that never landed survives until a person deals with it.
- *
- * It takes the folder alone, and that is deliberate: a worktree knows its own
- * repository, so the sweep needs neither the located checkout nor the codebase
- * row to clean one up.
- */
-/**
- * ═══ EVERYTHING IN A CARD'S COPY, ON ITS BRANCH. ═══
- *
- * `settleCardWorktree`'s own first three lines, extracted rather than rewritten,
- * because the landing needs the commit BEFORE the merge and the sweep needs it
- * before the removal. Committing in two places with two messages is how one card
- * comes to have two ideas of what its work is.
- *
- * ═══ ITS FAILURE IS COMPOSED, WHICH THE SWEEP NEVER NEEDED. ═══ The sweep
- * writes to stderr, so git's own text was harmless there. On the landing path a
- * failure reaches a person through an agent, and `execFileSync`'s message begins
- * `Command failed: git -C <absolute path>`. So this wraps in `worktreeForCard`'s
- * shape: what was composed here passes through, anything else is replaced.
- */
+/** Commit only for an explicitly selected landing action. Cleanup never commits.
+ * Failures are path-free because the landing result reaches the hosted panel. */
 export function commitCardWork(folder, 
-/* WHAT THE COPY IS, IN WORDS AND NEVER AS A PATH. The sweep has only the
-   folder and says so; the landing has the codebase and the branch and names
-   both, which is what a person reading the failure needs. */
+// Name the codebase and branch in failures, without exposing a local path.
 describe) {
     try {
         git(folder, ['add', '-A']);
@@ -491,11 +466,13 @@ export function mergeIntoBase(source, branch, base, codebaseName) {
     }
 }
 export function settleCardWorktree(folder) {
-    commitCardWork(folder, 'this card\'s working copy');
-    /* FORCE, AFTER THE COMMIT. Everything tracked is now committed on the branch,
-       so what `--force` overrides is only ignored files: an installed
-       `node_modules`, a build output, which the next copy makes again. */
+    // Completion is not permission to commit. Preserve unfinished Git work,
+    // including staged and untracked files, for the person to review or resume.
+    if (git(folder, ['status', '--porcelain']).length > 0)
+        return false;
+    // Only ignored build/dependency files can remain in a clean copy.
     removeWorktree(folder);
+    return true;
 }
 /**
  * Every card copy this machine currently holds, as `<codebase id>/<folder>`

package/dist/panel3/codex-models.js

@@ -0,0 +1,96 @@
+import { spawn } from 'node:child_process';
+import { z } from 'zod';
+import { agentPath } from '../agents.js';
+import { killTree, windowsSafeSpawn } from '../win-shell.js';
+const modelPage = z.object({
+    data: z.array(z.object({
+        model: z.string().min(1),
+        displayName: z.string(),
+        description: z.string(),
+        defaultReasoningEffort: z.string(),
+        supportedReasoningEfforts: z.array(z.object({ reasoningEffort: z.string(), description: z.string() })),
+        isDefault: z.boolean(),
+    })),
+    nextCursor: z.string().nullable(),
+});
+/** Read the installed harness's catalog under its own account/config. No turn,
+ * session, product catalog, or generation is created. Keep provider IDs intact. */
+export async function listCodexModels() {
+    const bin = agentPath('codex');
+    if (!bin)
+        throw new Error('Codex is not installed on this machine.');
+    const { args, shell } = windowsSafeSpawn(bin, ['app-server']);
+    return new Promise((resolve, reject) => {
+        const child = spawn(bin, args, { shell, windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] });
+        const models = [];
+        const cursors = new Set();
+        let buffer = '';
+        let received = 0;
+        let settled = false;
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            killTree(child);
+            if (error)
+                reject(error);
+            else
+                resolve(models);
+        };
+        const timer = setTimeout(() => finish(new Error('Codex model discovery timed out.')), 15_000);
+        const send = (message) => child.stdin.write(`${JSON.stringify(message)}\n`);
+        child.on('error', (error) => finish(error));
+        child.stdin.on('error', (error) => finish(error));
+        child.on('close', () => finish(new Error('Codex exited before returning its available models.')));
+        // Diagnostics can contain local configuration; never return them as catalog data.
+        child.stderr.resume();
+        child.stdout.setEncoding('utf8').on('data', (chunk) => {
+            if (settled)
+                return;
+            received += chunk.length;
+            if (received > 1_000_000)
+                return finish(new Error('Codex model discovery response was too large.'));
+            buffer += chunk;
+            let newline;
+            while (!settled && (newline = buffer.indexOf('\n')) >= 0) {
+                const line = buffer.slice(0, newline);
+                buffer = buffer.slice(newline + 1);
+                if (!line.trim())
+                    continue;
+                try {
+                    const response = JSON.parse(line);
+                    if (response.id !== 1 && response.id !== 2)
+                        continue;
+                    if (response.error)
+                        throw new Error('Codex rejected model discovery. Use the installed default or an explicit user choice.');
+                    if (response.id === 1) {
+                        send({ method: 'initialized' });
+                        send({ id: 2, method: 'model/list', params: { limit: 100, includeHidden: false } });
+                    }
+                    else {
+                        const page = modelPage.parse(response.result);
+                        models.push(...page.data);
+                        if (page.nextCursor !== null) {
+                            if (cursors.has(page.nextCursor))
+                                throw new Error('Codex model discovery repeated a page.');
+                            cursors.add(page.nextCursor);
+                            send({ id: 2, method: 'model/list', params: { limit: 100, includeHidden: false, cursor: page.nextCursor } });
+                        }
+                        else if (models.length === 0) {
+                            finish(new Error('Codex returned no available models.'));
+                        }
+                        else
+                            finish();
+                    }
+                }
+                catch (error) {
+                    finish(error instanceof SyntaxError || error instanceof z.ZodError
+                        ? new Error('Codex returned an invalid available-model list. Use the installed default or an explicit user choice.')
+                        : error instanceof Error ? error : new Error('Codex model discovery failed.'));
+                }
+            }
+        });
+        send({ id: 1, method: 'initialize', params: { clientInfo: { name: 'ctrl_spc_models', version: '1' } } });
+    });
+}

package/dist/panel3/coordinator.js

@@ -1,4 +1,6 @@
 import { returned } from './client.js';
+import { agentPath } from '../agents.js';
+import { harness } from './spawn.js';
 /**
  * Read the designation. `cliv2_orchestrator_preference` carries `unique
  * (user_id)`, so RLS alone (`auth.uid() = user_id`) can never return more than
@@ -14,5 +16,18 @@ import { returned } from './client.js';
 export async function designatedCoordinator(client) {
     const rows = await returned(client.from('cliv2_orchestrator_preference').select('machine_id, agent'), 'read', 'which machine and harness are designated to coordinate');
     const row = rows[0];
+    if (row && (typeof row.machine_id !== 'string' || !['claude', 'codex'].includes(row.agent))) {
+        throw new Error('The saved primary agent is invalid; select Claude Code or Codex again.');
+    }
     return row ? { machineId: row.machine_id, agent: row.agent } : null;
 }
+/** New work follows the shared choice. Existing runs keep their recorded harness. */
+export async function selectedHarness(client, machineId) {
+    const designation = await designatedCoordinator(client);
+    const selected = designation?.machineId === machineId
+        ? designation.agent
+        : harness();
+    if (!agentPath(selected))
+        throw new Error(`${selected} is selected but is not installed on this machine`);
+    return selected;
+}

package/dist/panel3/prompt.js

@@ -333,8 +333,9 @@ export const whatWasAttached = (attachments) => {
             '',
             'THE CODEBASES THIS CARD TOUCHES',
             ...codebases,
-            'For a dispatched piece, its one codebase is named separately below. The other selected',
-            'codebases are separate work, not missing folders, so do not look for or report on them.',
+            'Each worker stays in its separately assigned codebase. The conversation owner remains',
+            'responsible for the whole request across every required codebase, including work delegated',
+            'to other workers. A card attachment or launch brief is not a saved work-item target read.',
         ]),
         ...personAttachmentLines,
     ];
@@ -371,7 +372,9 @@ const LANDING_LINES = {
     ],
     main: [
         'Finished work in this codebase lands on the main branch, and the person is asked first.',
-        'When the card\'s work is done, call `offer_ending` with one sentence saying what was done.',
+        'When the whole assignment is done, first write_report with work_complete=true and its verified',
+        'results, then call `offer_ending` with one sentence saying what was done. Never offer an',
+        'ending while you are planning, waiting for workers, or still owe work in another codebase.',
         'The product writes the question and both answers, and it performs the merge itself if they',
         'choose to put the work back. Landing is the product\'s job and never yours: never merge and',
         'never push.',
@@ -416,9 +419,10 @@ const projectCodebases = (codebases) => {
             : [
                 ...codebases.map((codebase) => (`${codebase.name} — id ${codebase.id} — ${codebase.identity} — `
                     + (codebase.located ? 'located on this machine' : 'not located on this machine'))),
-                'Choose the codebase that contains the work and include its id when you send somebody.',
-                'If several codebases are needed, send one person per codebase. If the request does not make',
-                'the choice clear, call `ask_question` once with `answer_mode` set to `multi_select`, put the',
+                'For an attached work item, read its saved targets; this project list is not its selection.',
+                'Launch one owner for the whole assignment. For several targets, that owner sends a scoped',
+                'worker to each codebase. If the saved record and request do not make the choice clear,',
+                'call `ask_question` once with `answer_mode` set to `multi_select`, put the',
                 'plausible codebase names in `options`, and stop. Do not write a question as your reply.',
             ]),
     ];
@@ -479,6 +483,10 @@ export function levelOnePrompt(cardTitle, messages, produced, attachments = [],
         'Launch one owner for the conversation. Give it the complete responsibility and boundary. If',
         'the request belongs to a registered codebase, name it. If it is record-only work, launch it',
         'without a codebase. The owner talks to the person and may send workers of its own.',
+        'For work on a saved Work Item, read get_work_item for its current saved codebase targets.',
+        'Use those targets, not the project-wide choices or a remembered selection. Do not ask the',
+        'person to repeat a saved selection. If several targets are required, give the ONE owner the',
+        'whole assignment and every required target; it can dispatch a worker in each codebase.',
         'Your only question is a destination or codebase you truly cannot choose. NEVER ask the person',
         'to make a work or product decision. When one registered codebase clearly fits, launch its owner',
         'even if the work itself needs the person to choose between options; the owner asks that question.',
@@ -559,6 +567,9 @@ export const OWNER_COMPLETION_RULES = [
     'without declaring completion, the product starts you again to carry on.',
     'Only when the latest user assignment is fulfilled, call write_report with work_complete=true',
     'and a report explaining what fulfilled it. Check all required steps and verification first.',
+    'Only offer_ending after every requested codebase has its required work verified. Owning',
+    'one working copy does not narrow a multi-codebase request to that copy. Dispatch the remaining',
+    'codebase work and read its results before offering completion.',
     'Then give the final answer and exit. Do not declare completion for an interim status answer.',
     'A failed or skipped required step is unfinished work, even if all workers have returned.',
     'Resolve it or ask for the real required intervention; never convert it into a completion caveat.',
@@ -602,6 +613,9 @@ export function workBrief(level, responsibility, boundary, workItemId, attachmen
                 'When asked to create a workflow, use create_workflow to save it; do not execute the workflow.',
                 'Ask clarifying questions with ask_question only when the missing answer changes its behavior.',
                 'Write the requested tool mentions and per-use permissions in the stage bodies using the tool schema instructions.',
+                'Plain-prose requests must stay plain: do not add unrequested tool permissions or approval templates.',
+                'For edits, read get_workflow first, reword retained stages with reword_stage, and keep their numbered references in edit_workflow. Do not replace retained stages or bypass a protected-body refusal.',
+                'Only you can call get_workflow. If a child is assigned a workflow review, read it yourself first and put the complete relevant workflow content in its brief; do not assign it an unavailable tool call. Authoring and review do not authorize executing the workflow or its stages.',
                 'The saved workflow appears as a reviewable card in this conversation. Do not substitute a plan artifact or a prose-only reply.',
                 '',
                 'TRACEABILITY BEFORE A CODEBASE FILE CHANGES',
@@ -661,7 +675,10 @@ export function workBrief(level, responsibility, boundary, workItemId, attachmen
                 'before you send anybody is a minute they watch a line with no answer coming.',
                 '',
                 'IF YOU SPLIT IT',
-                'Everybody you send works in the SAME copy of the codebase as everybody else, at the same',
+                'Everybody you send to the SAME codebase shares its copy; different codebases have separate',
+                'copies. Read the Work Item\'s current saved targets before file work or dispatch, and use',
+                'only those targets. Preserve the person\'s no-commit, no-merge and no-push instructions in',
+                'every worker boundary and at completion. People in the same copy work at the same',
                 'time. Nothing keeps them out of each other\'s way, so anybody CHANGING files needs a piece',
                 'that touches nobody else\'s files, or has to be sent on their own.',
                 /* ═══ AND A WORKFLOW OVERRIDES THAT DEFAULT, INSIDE THE BLOCK THAT SETS
@@ -1170,9 +1187,12 @@ export function modelChoiceRules(harness) {
     return [
         'MODEL AND EFFORT FOR EACH DISPATCH',
         `You run under ${harness}. Your dispatched children use the same harness.`,
+        'Claude and Codex name harnesses, not model identifiers. A request to use Codex gpt-5.5 means model gpt-5.5 under Codex; do not concatenate a harness label into the model argument. A harness-only request does not specify a model. If you do not know a supported model for the task, omit model to use the installed default rather than inventing an identifier.',
         'The dispatch tool accepts optional model and effort strings. Honor the user\'s exact stated model and effort for the work they apply to, including downstream workers. Copy each requested value byte-for-byte into the dispatch argument: do not expand aliases, normalize spelling or case, or replace it with a canonical provider identifier. Carry those wishes and their scope verbatim in every applicable responsibility and boundary.',
         'When the user requests separate workers or assigns choices to separate parts, call dispatch for those parts. Doing their work yourself does not satisfy that request. If product tools are deferred, discover dispatch before starting; use the product ask_question and write_report tools for questions and completion.',
-        'When the user has not specified a value, choose for this child\'s task using your knowledge of this harness. Pass your choice in the tool arguments; a sentence alone does not select it. Different workers may use different choices.',
+        harness === 'codex'
+            ? 'When the user has not specified a model, call list_codex_models before choosing for this child. Choose a model ID from that live result and an effort it supports, according to the task. If discovery fails, omit autonomous model and effort choices and use installed defaults; do not guess from memory. The list does not override explicit user IDs or aliases. Different workers may use different choices. Pass choices in dispatch arguments; prose alone does not select them.'
+            : 'When the user has not specified a value, choose for this child\'s task using supported Claude aliases such as sonnet or opus. Do not invent version-suffixed aliases such as sonnet-5 or haiku-4.5. If uncertain, omit model to use the installed default. Pass your choice in the tool arguments; a sentence alone does not select it. Different workers may use different choices.',
         'Omitting a value chooses the harness default (or the machine-local model default), never the parent\'s model or effort. No product model catalog exists. Pass provider values unchanged; do not silently substitute after a rejection.',
     ].join('\n');
 }