@kontextmind/kxm 0.7.60 → 0.7.63

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.60",
+      "version": "0.7.63",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/docs/contracts/lifecycles.md

@@ -100,7 +100,7 @@ created → accepted → dispatched → executing → result_recorded → termin
 | `dispatched` | Attempt identity and dispatch intent persisted before process start |
 | `executing` | Invocation admitted and the attempt capability is usable. This slice is in-process (no OS process identity yet); later recovery still requires exact process/session proof |
 | `reattaching` | Runtime is verifying the same process/session and event cursor |
-| `result_recorded` | Structured attempt result and referenced receipts are durably stored |
+| `result_recorded` | Structured attempt result and referenced receipts are durably stored. When a producer **refused** (`resultClass: producer_rejected`), the payload may carry `producerError`: a **machine code only** (lowercase-underscore identifier, ≤64 chars, schema-enforced; capability material is redacted before extraction, and anything unclassifiable — including prose — records as `producer_error`). The routing record names the producer that actually ran: a live drive that fails authentication must never read in the log as a simulation |
 | `retry_pending` | Policy permits another physical attempt after the prior attempt became terminal |
 | `blocked_uncertain` | A dependent effect cannot be reconciled safely |
 | `terminal` | The logical assignment outcome is final and immutable: passed, failed, or cancelled |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.60",
+  "version": "0.7.63",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.60",
+  "version": "0.7.63",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/mcp-server.js

@@ -17121,7 +17121,7 @@ async function deliverInboxNotification(messageId, delivered, notify) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.60";
+var VERSION = "0.7.63";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();
 var meshClient;

package/plugins/kxm/dist/runtime-supervisor.js

@@ -24601,15 +24601,29 @@ var KxmRunScheduler = class _KxmRunScheduler {
   }
 };
 function invokeProducer(producer, request) {
+  const reason = (error) => {
+    try {
+      const raw = error instanceof Error ? error.message : error;
+      const message = typeof raw === "string" ? raw : "";
+      let text = message;
+      if (request.capability) text = text.split(request.capability).join("[redacted]");
+      text = text.replace(/kxmcap_[A-Za-z0-9_-]+/g, "[redacted]");
+      const match = /^[a-z][a-z0-9]*(?:_[a-z0-9]+){1,3}/.exec(text);
+      const code = match?.[0] ?? "";
+      return code.length > 0 && code.length <= 64 ? code : "producer_error";
+    } catch {
+      return "producer_error";
+    }
+  };
   let pending;
   try {
     pending = Promise.resolve(producer.produce(request));
-  } catch {
-    return Promise.resolve({ error: true });
+  } catch (error) {
+    return Promise.resolve({ error: true, errorCode: reason(error) });
   }
   return pending.then(
     (result) => ({ result, error: false }),
-    () => ({ error: true })
+    (error) => ({ error: true, errorCode: reason(error) })
   );
 }
 var kxmGateDispatchSeams = {};
@@ -24883,6 +24897,21 @@ function resolveProducerRoute(projectRoot, step, agentId) {
       const parsed = (0, import_yaml5.parse)(readFileSync7(agentFile, "utf8"));
       if (typeof parsed?.model === "string") {
         agentModel = parsed.model;
+      } else if (parsed?.model && typeof parsed.model === "object" && !Array.isArray(parsed.model)) {
+        const declared = parsed.model;
+        const providerOk = typeof declared.provider === "string" && declared.provider.length > 0 && !declared.provider.includes("/");
+        const modelOk = typeof declared.model === "string" && declared.model.length > 0 && !declared.model.startsWith("/") && !declared.model.endsWith("/");
+        if (providerOk && modelOk) {
+          agentModel = `${declared.provider}/${declared.model}`;
+        } else {
+          return {
+            error: {
+              reason: "step_unsupported",
+              field: "model",
+              detail: "producer_route_unsupported: invalid model declaration"
+            }
+          };
+        }
       }
     } catch {
     }
@@ -25413,7 +25442,7 @@ async function drivePanel(context, panel, producer) {
         if (kxmPanelDispatchSeams.failSettleMember?.(member)) {
           throw runtimeError("run_events_illegal", runId, "member settlement write failed");
         }
-        settleMember(context, member, produced.result, produced.error);
+        settleMember(context, member, produced.result, produced.error, produced.errorCode);
       });
       return true;
     } catch (err) {
@@ -25568,7 +25597,7 @@ function producerRoutingRecord(context, dispatch, result, now) {
   }
   return parseRoutingRecordV2(record2);
 }
-function settleMember(context, dispatch, result, produceError) {
+function settleMember(context, dispatch, result, produceError, produceErrorCode) {
   const run = requireRun(context, dispatch.run.runId);
   const state = foldStoredKxmRun(context, run);
   const capability = context.eventStore.capabilityByAttempt(dispatch.attemptId);
@@ -25619,7 +25648,10 @@ function settleMember(context, dispatch, result, produceError) {
       stepId: dispatch.stepId,
       assignmentId: dispatch.assignmentId,
       attemptId: dispatch.attemptId,
-      harness: result?.harness ?? (dispatch.producerId === "pi" ? "pi" : "driver-simulated"),
+      // Label the producer that actually ran: the old fallback printed "driver-simulated"
+      // for every producer that was not literally "pi", so a live oneshot drive that
+      // failed authentication read in the log as a simulation.
+      harness: result?.harness ?? dispatch.producerId,
       provider: result?.provider ?? "simulated",
       requestedModel: result?.requestedModel ?? "simulated",
       effectiveModel: result?.effectiveModel ?? result?.requestedModel ?? "simulated",
@@ -25633,7 +25665,8 @@ function settleMember(context, dispatch, result, produceError) {
     push("assignment.result_recorded", {
       assignmentId: dispatch.assignmentId,
       resultClass: "producer_rejected",
-      status: "result_recorded"
+      status: "result_recorded",
+      ...produceErrorCode !== void 0 ? { producerError: produceErrorCode } : {}
     });
     push("attempt.status_changed", { attemptId: dispatch.attemptId, status: "terminal" });
     push("assignment.terminal", { assignmentId: dispatch.assignmentId, outcome: "failed", status: "terminal" });

package/plugins/kxm/dist/runtime.js

@@ -25113,15 +25113,29 @@ var KxmRunScheduler = class _KxmRunScheduler {
   }
 };
 function invokeProducer(producer, request) {
+  const reason = (error) => {
+    try {
+      const raw = error instanceof Error ? error.message : error;
+      const message = typeof raw === "string" ? raw : "";
+      let text = message;
+      if (request.capability) text = text.split(request.capability).join("[redacted]");
+      text = text.replace(/kxmcap_[A-Za-z0-9_-]+/g, "[redacted]");
+      const match = /^[a-z][a-z0-9]*(?:_[a-z0-9]+){1,3}/.exec(text);
+      const code = match?.[0] ?? "";
+      return code.length > 0 && code.length <= 64 ? code : "producer_error";
+    } catch {
+      return "producer_error";
+    }
+  };
   let pending;
   try {
     pending = Promise.resolve(producer.produce(request));
-  } catch {
-    return Promise.resolve({ error: true });
+  } catch (error) {
+    return Promise.resolve({ error: true, errorCode: reason(error) });
   }
   return pending.then(
     (result) => ({ result, error: false }),
-    () => ({ error: true })
+    (error) => ({ error: true, errorCode: reason(error) })
   );
 }
 var kxmGateDispatchSeams = {};
@@ -25395,6 +25409,21 @@ function resolveProducerRoute(projectRoot, step, agentId) {
       const parsed = (0, import_yaml5.parse)(readFileSync7(agentFile, "utf8"));
       if (typeof parsed?.model === "string") {
         agentModel = parsed.model;
+      } else if (parsed?.model && typeof parsed.model === "object" && !Array.isArray(parsed.model)) {
+        const declared = parsed.model;
+        const providerOk = typeof declared.provider === "string" && declared.provider.length > 0 && !declared.provider.includes("/");
+        const modelOk = typeof declared.model === "string" && declared.model.length > 0 && !declared.model.startsWith("/") && !declared.model.endsWith("/");
+        if (providerOk && modelOk) {
+          agentModel = `${declared.provider}/${declared.model}`;
+        } else {
+          return {
+            error: {
+              reason: "step_unsupported",
+              field: "model",
+              detail: "producer_route_unsupported: invalid model declaration"
+            }
+          };
+        }
       }
     } catch {
     }
@@ -25925,7 +25954,7 @@ async function drivePanel(context, panel, producer) {
         if (kxmPanelDispatchSeams.failSettleMember?.(member)) {
           throw runtimeError("run_events_illegal", runId, "member settlement write failed");
         }
-        settleMember(context, member, produced.result, produced.error);
+        settleMember(context, member, produced.result, produced.error, produced.errorCode);
       });
       return true;
     } catch (err) {
@@ -26080,7 +26109,7 @@ function producerRoutingRecord(context, dispatch, result, now) {
   }
   return parseRoutingRecordV2(record2);
 }
-function settleMember(context, dispatch, result, produceError) {
+function settleMember(context, dispatch, result, produceError, produceErrorCode) {
   const run = requireRun(context, dispatch.run.runId);
   const state = foldStoredKxmRun(context, run);
   const capability = context.eventStore.capabilityByAttempt(dispatch.attemptId);
@@ -26131,7 +26160,10 @@ function settleMember(context, dispatch, result, produceError) {
       stepId: dispatch.stepId,
       assignmentId: dispatch.assignmentId,
       attemptId: dispatch.attemptId,
-      harness: result?.harness ?? (dispatch.producerId === "pi" ? "pi" : "driver-simulated"),
+      // Label the producer that actually ran: the old fallback printed "driver-simulated"
+      // for every producer that was not literally "pi", so a live oneshot drive that
+      // failed authentication read in the log as a simulation.
+      harness: result?.harness ?? dispatch.producerId,
       provider: result?.provider ?? "simulated",
       requestedModel: result?.requestedModel ?? "simulated",
       effectiveModel: result?.effectiveModel ?? result?.requestedModel ?? "simulated",
@@ -26145,7 +26177,8 @@ function settleMember(context, dispatch, result, produceError) {
     push("assignment.result_recorded", {
       assignmentId: dispatch.assignmentId,
       resultClass: "producer_rejected",
-      status: "result_recorded"
+      status: "result_recorded",
+      ...produceErrorCode !== void 0 ? { producerError: produceErrorCode } : {}
     });
     push("attempt.status_changed", { attemptId: dispatch.attemptId, status: "terminal" });
     push("assignment.terminal", { assignmentId: dispatch.assignmentId, outcome: "failed", status: "terminal" });
@@ -28212,6 +28245,9 @@ function createKxmPiProducer(options = {}) {
   }
   function resolveModelForRequest(request) {
     if (request.model) {
+      if (request.provider) {
+        return { provider: request.provider.toLowerCase(), model: request.model, thinking: request.thinking };
+      }
       const parsed2 = parseModelString(request.model);
       return {
         provider: request.provider?.toLowerCase() ?? parsed2.provider,
@@ -28222,6 +28258,9 @@ function createKxmPiProducer(options = {}) {
     if (options.resolveModel) {
       const resolved = options.resolveModel(request.agentId, request.runId);
       if (resolved && resolved.model) {
+        if (resolved.provider) {
+          return { provider: resolved.provider.toLowerCase(), model: resolved.model, thinking: resolved.thinking };
+        }
         const parsed2 = parseModelString(resolved.model);
         return {
           provider: resolved.provider?.toLowerCase() ?? parsed2.provider,

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.60",
+  "version": "0.7.63",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/engine.ts

@@ -854,15 +854,41 @@ function invokeProducer(
   producer: KxmProducer,
   request: KxmProducerRequest,
 ): Promise<{ result?: KxmProducerResult; error: boolean; errorCode?: string }> {
+  // The reason a producer refused is the single most useful fact about a failed attempt,
+  // and it used to be discarded here: a live drive that could not authenticate read in the
+  // event log exactly like a simulation that ran fine. But the message is producer-
+  // controlled text and must never reach durable records as-is — a producer that throws
+  // its capability (the hygiene contract tests exactly that) would persist the secret.
+  // So: redact the attempt capability and anything capability-shaped, then keep only a
+  // leading machine-code identifier (lowercase segments joined by underscores). Anything
+  // else — prose, free text, a redacted-to-empty message — records as producer_error.
+  const reason = (error: unknown): string => {
+    // Never throw while classifying a throw: a producer can reject with anything
+    // (Object.create(null) defeats String(), an Error whose message is not a string
+    // defeats split()), and a throwing classifier would reroute a producer_rejected
+    // settle into the execution-error path — the exact invisibility this exists to fix.
+    try {
+      const raw = error instanceof Error ? error.message : error;
+      const message = typeof raw === "string" ? raw : "";
+      let text = message;
+      if (request.capability) text = text.split(request.capability).join("[redacted]");
+      text = text.replace(/kxmcap_[A-Za-z0-9_-]+/g, "[redacted]");
+      const match = /^[a-z][a-z0-9]*(?:_[a-z0-9]+){1,3}/.exec(text);
+      const code = match?.[0] ?? "";
+      return code.length > 0 && code.length <= 64 ? code : "producer_error";
+    } catch {
+      return "producer_error";
+    }
+  };
   let pending: Promise<KxmProducerResult>;
   try {
     pending = Promise.resolve(producer.produce(request));
-  } catch {
-    return Promise.resolve({ error: true });
+  } catch (error) {
+    return Promise.resolve({ error: true, errorCode: reason(error) });
   }
   return pending.then(
     (result) => ({ result, error: false }),
-    () => ({ error: true }),
+    (error) => ({ error: true, errorCode: reason(error) }),
   );
 }
 
@@ -1284,6 +1310,29 @@ function resolveProducerRoute(
       const parsed = parse(readFileSync(agentFile, "utf8")) as Record<string, unknown>;
       if (typeof parsed?.model === "string") {
         agentModel = parsed.model;
+      } else if (parsed?.model && typeof parsed.model === "object" && !Array.isArray(parsed.model)) {
+        // The agent schema requires the object form (`{provider, model}`); reading only the
+        // string form left every agent without a route unless it was literally named
+        // `implementer`, which alone hit the hard-coded fallback below. A declared model
+        // must actually drive the producer route. Model ids may themselves be namespaced
+        // (`qwen/qwen3-coder-plus` under `openrouter`) — the provider is the only field
+        // that may not contain the separator, because it is what the selector splits on.
+        // A malformed declaration is an error, not an absence: falling through to the
+        // fallback would silently route an agent that declared `openrouter` to Grok.
+        const declared = parsed.model as { provider?: unknown; model?: unknown };
+        const providerOk = typeof declared.provider === "string" && declared.provider.length > 0 && !declared.provider.includes("/");
+        const modelOk = typeof declared.model === "string" && declared.model.length > 0 && !declared.model.startsWith("/") && !declared.model.endsWith("/");
+        if (providerOk && modelOk) {
+          agentModel = `${declared.provider}/${declared.model}`;
+        } else {
+          return {
+            error: {
+              reason: "step_unsupported",
+              field: "model",
+              detail: "producer_route_unsupported: invalid model declaration",
+            },
+          };
+        }
       }
     } catch {
       // ignore
@@ -1755,7 +1804,7 @@ function appendExecuting(context: KxmRuntimeContext, dispatch: PreparedDispatch)
 }
 
 type MemberWork =
-  | { attemptId: string; invoked: true; produced: { result?: KxmProducerResult; error: boolean } }
+  | { attemptId: string; invoked: true; produced: { result?: KxmProducerResult; error: boolean; errorCode?: string } }
   | { attemptId: string; invoked: false; skipped: true }
   | { attemptId: string; invoked: false; appendFailed: true; error: unknown };
 
@@ -1896,7 +1945,7 @@ async function drivePanel(
     });
   };
 
-  const settleInvoked = (member: PreparedDispatch, produced: { result?: KxmProducerResult; error: boolean }): boolean => {
+  const settleInvoked = (member: PreparedDispatch, produced: { result?: KxmProducerResult; error: boolean; errorCode?: string }): boolean => {
     if (produced.result?.effectUncertain) {
       settlementFailed = true;
       stopBirths = true;
@@ -1907,7 +1956,7 @@ async function drivePanel(
         if (kxmPanelDispatchSeams.failSettleMember?.(member)) {
           throw runtimeError("run_events_illegal", runId, "member settlement write failed");
         }
-        settleMember(context, member, produced.result, produced.error);
+        settleMember(context, member, produced.result, produced.error, produced.errorCode);
       });
       return true;
     } catch (err) {
@@ -2069,6 +2118,7 @@ function settleMember(
   dispatch: PreparedDispatch,
   result: KxmProducerResult | undefined,
   produceError: boolean,
+  produceErrorCode?: string,
 ): void {
   const run = requireRun(context, dispatch.run.runId);
   const state = foldStoredKxmRun(context, run);
@@ -2123,7 +2173,10 @@ function settleMember(
       stepId: dispatch.stepId,
       assignmentId: dispatch.assignmentId,
       attemptId: dispatch.attemptId,
-      harness: result?.harness ?? (dispatch.producerId === "pi" ? "pi" : "driver-simulated"),
+      // Label the producer that actually ran: the old fallback printed "driver-simulated"
+      // for every producer that was not literally "pi", so a live oneshot drive that
+      // failed authentication read in the log as a simulation.
+      harness: result?.harness ?? dispatch.producerId,
       provider: result?.provider ?? "simulated",
       requestedModel: result?.requestedModel ?? "simulated",
       effectiveModel: result?.effectiveModel ?? result?.requestedModel ?? "simulated",
@@ -2139,6 +2192,7 @@ function settleMember(
       assignmentId: dispatch.assignmentId,
       resultClass: "producer_rejected",
       status: "result_recorded",
+      ...(produceErrorCode !== undefined ? { producerError: produceErrorCode } : {}),
     });
     push("attempt.status_changed", { attemptId: dispatch.attemptId, status: "terminal" });
     push("assignment.terminal", { assignmentId: dispatch.assignmentId, outcome: "failed", status: "terminal" });

package/plugins/kxm/src/mcp-server.ts

@@ -8,7 +8,7 @@ import { AGENT_COMMANDS_MAP, enforceToolPolicy, getMcpTools, reconcileInbox } fr
 import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 
-const VERSION = "0.7.60";
+const VERSION = "0.7.63";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();
 let meshClient: HubClient | undefined;

package/plugins/kxm/src/pi-producer.ts

@@ -462,6 +462,13 @@ export function createKxmPiProducer(options: KxmPiProducerOptions = {}): KxmPiPr
 
   function resolveModelForRequest(request: KxmProducerRequest): { provider: string; model: string; thinking?: string | undefined } {
     if (request.model) {
+      // A separate provider field means the model id is bare and may itself be
+      // namespaced (`qwen/qwen3-coder-plus` under `openrouter`); reparsing it as a
+      // provider/model selector strips the namespace and sends the wrong model. Only
+      // parse when the provider must come from the string itself.
+      if (request.provider) {
+        return { provider: request.provider.toLowerCase(), model: request.model, thinking: request.thinking };
+      }
       const parsed = parseModelString(request.model);
       return {
         provider: request.provider?.toLowerCase() ?? parsed.provider,
@@ -472,6 +479,9 @@ export function createKxmPiProducer(options: KxmPiProducerOptions = {}): KxmPiPr
     if (options.resolveModel) {
       const resolved = options.resolveModel(request.agentId, request.runId);
       if (resolved && resolved.model) {
+        if (resolved.provider) {
+          return { provider: resolved.provider.toLowerCase(), model: resolved.model, thinking: resolved.thinking };
+        }
         const parsed = parseModelString(resolved.model);
         return {
           provider: resolved.provider?.toLowerCase() ?? parsed.provider,

package/schemas/run-event.schema.json

@@ -364,6 +364,7 @@
         "runPlanHash": { "$ref": "common.schema.json#/$defs/sha256" },
         "capabilityHash": { "$ref": "common.schema.json#/$defs/sha256" },
         "resultClass": { "enum": ["outcome", "outcome_unknown", "producer_rejected", "cancelled"] },
+        "producerError": { "type": "string", "pattern": "^[a-z][a-z0-9]*(?:_[a-z0-9]+){1,3}$", "maxLength": 64, "description": "Machine-code reason a producer refused (produce threw), present only for resultClass producer_rejected. Capability material is redacted before extraction; anything unclassifiable records as producer_error." },
         "status": { "$ref": "common.schema.json#/$defs/lifecycleStatus" },
         "previousStatus": { "$ref": "common.schema.json#/$defs/lifecycleStatus" },
         "outcome": { "$ref": "common.schema.json#/$defs/identifier" },