@kontextmind/kxm 0.7.61 → 0.7.64

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.61",
+      "version": "0.7.64",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/docs/contracts/lifecycles.md

@@ -100,7 +100,7 @@ created → accepted → dispatched → executing → result_recorded → termin
 | `dispatched` | Attempt identity and dispatch intent persisted before process start |
 | `executing` | Invocation admitted and the attempt capability is usable. This slice is in-process (no OS process identity yet); later recovery still requires exact process/session proof |
 | `reattaching` | Runtime is verifying the same process/session and event cursor |
-| `result_recorded` | Structured attempt result and referenced receipts are durably stored |
+| `result_recorded` | Structured attempt result and referenced receipts are durably stored. When a producer **refused** (`resultClass: producer_rejected`), the payload may carry `producerError`: a **machine code only** (lowercase-underscore identifier, ≤64 chars, schema-enforced; capability material is redacted before extraction, and anything unclassifiable — including prose — records as `producer_error`). The routing record names the producer that actually ran: a live drive that fails authentication must never read in the log as a simulation |
 | `retry_pending` | Policy permits another physical attempt after the prior attempt became terminal |
 | `blocked_uncertain` | A dependent effect cannot be reconciled safely |
 | `terminal` | The logical assignment outcome is final and immutable: passed, failed, or cancelled |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.61",
+  "version": "0.7.64",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.61",
+  "version": "0.7.64",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/mcp-server.js

@@ -17121,7 +17121,7 @@ async function deliverInboxNotification(messageId, delivered, notify) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.61";
+var VERSION = "0.7.64";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();
 var meshClient;

package/plugins/kxm/dist/runtime-supervisor.js

@@ -16102,8 +16102,9 @@ function probeHarnessAssignment(options) {
       };
     }
     const authArgs = ["auth", "check"];
-    if (options.model) {
-      authArgs.push("--model", options.model);
+    const qualifiedModel = options.model ? options.provider && options.model.startsWith(`${options.provider}/`) ? options.model : options.provider ? `${options.provider}/${options.model}` : options.model : void 0;
+    if (qualifiedModel) {
+      authArgs.push("--model", qualifiedModel);
     } else if (options.provider) {
       authArgs.push("--provider", options.provider);
     }
@@ -24601,15 +24602,29 @@ var KxmRunScheduler = class _KxmRunScheduler {
   }
 };
 function invokeProducer(producer, request) {
+  const reason = (error) => {
+    try {
+      const raw = error instanceof Error ? error.message : error;
+      const message = typeof raw === "string" ? raw : "";
+      let text = message;
+      if (request.capability) text = text.split(request.capability).join("[redacted]");
+      text = text.replace(/kxmcap_[A-Za-z0-9_-]+/g, "[redacted]");
+      const match = /^[a-z][a-z0-9]*(?:_[a-z0-9]+){1,3}/.exec(text);
+      const code = match?.[0] ?? "";
+      return code.length > 0 && code.length <= 64 ? code : "producer_error";
+    } catch {
+      return "producer_error";
+    }
+  };
   let pending;
   try {
     pending = Promise.resolve(producer.produce(request));
-  } catch {
-    return Promise.resolve({ error: true });
+  } catch (error) {
+    return Promise.resolve({ error: true, errorCode: reason(error) });
   }
   return pending.then(
     (result) => ({ result, error: false }),
-    () => ({ error: true })
+    (error) => ({ error: true, errorCode: reason(error) })
   );
 }
 var kxmGateDispatchSeams = {};
@@ -25428,7 +25443,7 @@ async function drivePanel(context, panel, producer) {
         if (kxmPanelDispatchSeams.failSettleMember?.(member)) {
           throw runtimeError("run_events_illegal", runId, "member settlement write failed");
         }
-        settleMember(context, member, produced.result, produced.error);
+        settleMember(context, member, produced.result, produced.error, produced.errorCode);
       });
       return true;
     } catch (err) {
@@ -25583,7 +25598,7 @@ function producerRoutingRecord(context, dispatch, result, now) {
   }
   return parseRoutingRecordV2(record2);
 }
-function settleMember(context, dispatch, result, produceError) {
+function settleMember(context, dispatch, result, produceError, produceErrorCode) {
   const run = requireRun(context, dispatch.run.runId);
   const state = foldStoredKxmRun(context, run);
   const capability = context.eventStore.capabilityByAttempt(dispatch.attemptId);
@@ -25634,7 +25649,10 @@ function settleMember(context, dispatch, result, produceError) {
       stepId: dispatch.stepId,
       assignmentId: dispatch.assignmentId,
       attemptId: dispatch.attemptId,
-      harness: result?.harness ?? (dispatch.producerId === "pi" ? "pi" : "driver-simulated"),
+      // Label the producer that actually ran: the old fallback printed "driver-simulated"
+      // for every producer that was not literally "pi", so a live oneshot drive that
+      // failed authentication read in the log as a simulation.
+      harness: result?.harness ?? dispatch.producerId,
       provider: result?.provider ?? "simulated",
       requestedModel: result?.requestedModel ?? "simulated",
       effectiveModel: result?.effectiveModel ?? result?.requestedModel ?? "simulated",
@@ -25648,7 +25666,8 @@ function settleMember(context, dispatch, result, produceError) {
     push("assignment.result_recorded", {
       assignmentId: dispatch.assignmentId,
       resultClass: "producer_rejected",
-      status: "result_recorded"
+      status: "result_recorded",
+      ...produceErrorCode !== void 0 ? { producerError: produceErrorCode } : {}
     });
     push("attempt.status_changed", { attemptId: dispatch.attemptId, status: "terminal" });
     push("assignment.terminal", { assignmentId: dispatch.assignmentId, outcome: "failed", status: "terminal" });

package/plugins/kxm/dist/runtime.js

@@ -16125,8 +16125,9 @@ function probeHarnessAssignment(options) {
       };
     }
     const authArgs = ["auth", "check"];
-    if (options.model) {
-      authArgs.push("--model", options.model);
+    const qualifiedModel = options.model ? options.provider && options.model.startsWith(`${options.provider}/`) ? options.model : options.provider ? `${options.provider}/${options.model}` : options.model : void 0;
+    if (qualifiedModel) {
+      authArgs.push("--model", qualifiedModel);
     } else if (options.provider) {
       authArgs.push("--provider", options.provider);
     }
@@ -25113,15 +25114,29 @@ var KxmRunScheduler = class _KxmRunScheduler {
   }
 };
 function invokeProducer(producer, request) {
+  const reason = (error) => {
+    try {
+      const raw = error instanceof Error ? error.message : error;
+      const message = typeof raw === "string" ? raw : "";
+      let text = message;
+      if (request.capability) text = text.split(request.capability).join("[redacted]");
+      text = text.replace(/kxmcap_[A-Za-z0-9_-]+/g, "[redacted]");
+      const match = /^[a-z][a-z0-9]*(?:_[a-z0-9]+){1,3}/.exec(text);
+      const code = match?.[0] ?? "";
+      return code.length > 0 && code.length <= 64 ? code : "producer_error";
+    } catch {
+      return "producer_error";
+    }
+  };
   let pending;
   try {
     pending = Promise.resolve(producer.produce(request));
-  } catch {
-    return Promise.resolve({ error: true });
+  } catch (error) {
+    return Promise.resolve({ error: true, errorCode: reason(error) });
   }
   return pending.then(
     (result) => ({ result, error: false }),
-    () => ({ error: true })
+    (error) => ({ error: true, errorCode: reason(error) })
   );
 }
 var kxmGateDispatchSeams = {};
@@ -25940,7 +25955,7 @@ async function drivePanel(context, panel, producer) {
         if (kxmPanelDispatchSeams.failSettleMember?.(member)) {
           throw runtimeError("run_events_illegal", runId, "member settlement write failed");
         }
-        settleMember(context, member, produced.result, produced.error);
+        settleMember(context, member, produced.result, produced.error, produced.errorCode);
       });
       return true;
     } catch (err) {
@@ -26095,7 +26110,7 @@ function producerRoutingRecord(context, dispatch, result, now) {
   }
   return parseRoutingRecordV2(record2);
 }
-function settleMember(context, dispatch, result, produceError) {
+function settleMember(context, dispatch, result, produceError, produceErrorCode) {
   const run = requireRun(context, dispatch.run.runId);
   const state = foldStoredKxmRun(context, run);
   const capability = context.eventStore.capabilityByAttempt(dispatch.attemptId);
@@ -26146,7 +26161,10 @@ function settleMember(context, dispatch, result, produceError) {
       stepId: dispatch.stepId,
       assignmentId: dispatch.assignmentId,
       attemptId: dispatch.attemptId,
-      harness: result?.harness ?? (dispatch.producerId === "pi" ? "pi" : "driver-simulated"),
+      // Label the producer that actually ran: the old fallback printed "driver-simulated"
+      // for every producer that was not literally "pi", so a live oneshot drive that
+      // failed authentication read in the log as a simulation.
+      harness: result?.harness ?? dispatch.producerId,
       provider: result?.provider ?? "simulated",
       requestedModel: result?.requestedModel ?? "simulated",
       effectiveModel: result?.effectiveModel ?? result?.requestedModel ?? "simulated",
@@ -26160,7 +26178,8 @@ function settleMember(context, dispatch, result, produceError) {
     push("assignment.result_recorded", {
       assignmentId: dispatch.assignmentId,
       resultClass: "producer_rejected",
-      status: "result_recorded"
+      status: "result_recorded",
+      ...produceErrorCode !== void 0 ? { producerError: produceErrorCode } : {}
     });
     push("attempt.status_changed", { attemptId: dispatch.attemptId, status: "terminal" });
     push("assignment.terminal", { assignmentId: dispatch.assignmentId, outcome: "failed", status: "terminal" });

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.61",
+  "version": "0.7.64",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/engine.ts

@@ -854,15 +854,41 @@ function invokeProducer(
   producer: KxmProducer,
   request: KxmProducerRequest,
 ): Promise<{ result?: KxmProducerResult; error: boolean; errorCode?: string }> {
+  // The reason a producer refused is the single most useful fact about a failed attempt,
+  // and it used to be discarded here: a live drive that could not authenticate read in the
+  // event log exactly like a simulation that ran fine. But the message is producer-
+  // controlled text and must never reach durable records as-is — a producer that throws
+  // its capability (the hygiene contract tests exactly that) would persist the secret.
+  // So: redact the attempt capability and anything capability-shaped, then keep only a
+  // leading machine-code identifier (lowercase segments joined by underscores). Anything
+  // else — prose, free text, a redacted-to-empty message — records as producer_error.
+  const reason = (error: unknown): string => {
+    // Never throw while classifying a throw: a producer can reject with anything
+    // (Object.create(null) defeats String(), an Error whose message is not a string
+    // defeats split()), and a throwing classifier would reroute a producer_rejected
+    // settle into the execution-error path — the exact invisibility this exists to fix.
+    try {
+      const raw = error instanceof Error ? error.message : error;
+      const message = typeof raw === "string" ? raw : "";
+      let text = message;
+      if (request.capability) text = text.split(request.capability).join("[redacted]");
+      text = text.replace(/kxmcap_[A-Za-z0-9_-]+/g, "[redacted]");
+      const match = /^[a-z][a-z0-9]*(?:_[a-z0-9]+){1,3}/.exec(text);
+      const code = match?.[0] ?? "";
+      return code.length > 0 && code.length <= 64 ? code : "producer_error";
+    } catch {
+      return "producer_error";
+    }
+  };
   let pending: Promise<KxmProducerResult>;
   try {
     pending = Promise.resolve(producer.produce(request));
-  } catch {
-    return Promise.resolve({ error: true });
+  } catch (error) {
+    return Promise.resolve({ error: true, errorCode: reason(error) });
   }
   return pending.then(
     (result) => ({ result, error: false }),
-    () => ({ error: true }),
+    (error) => ({ error: true, errorCode: reason(error) }),
   );
 }
 
@@ -1778,7 +1804,7 @@ function appendExecuting(context: KxmRuntimeContext, dispatch: PreparedDispatch)
 }
 
 type MemberWork =
-  | { attemptId: string; invoked: true; produced: { result?: KxmProducerResult; error: boolean } }
+  | { attemptId: string; invoked: true; produced: { result?: KxmProducerResult; error: boolean; errorCode?: string } }
   | { attemptId: string; invoked: false; skipped: true }
   | { attemptId: string; invoked: false; appendFailed: true; error: unknown };
 
@@ -1919,7 +1945,7 @@ async function drivePanel(
     });
   };
 
-  const settleInvoked = (member: PreparedDispatch, produced: { result?: KxmProducerResult; error: boolean }): boolean => {
+  const settleInvoked = (member: PreparedDispatch, produced: { result?: KxmProducerResult; error: boolean; errorCode?: string }): boolean => {
     if (produced.result?.effectUncertain) {
       settlementFailed = true;
       stopBirths = true;
@@ -1930,7 +1956,7 @@ async function drivePanel(
         if (kxmPanelDispatchSeams.failSettleMember?.(member)) {
           throw runtimeError("run_events_illegal", runId, "member settlement write failed");
         }
-        settleMember(context, member, produced.result, produced.error);
+        settleMember(context, member, produced.result, produced.error, produced.errorCode);
       });
       return true;
     } catch (err) {
@@ -2092,6 +2118,7 @@ function settleMember(
   dispatch: PreparedDispatch,
   result: KxmProducerResult | undefined,
   produceError: boolean,
+  produceErrorCode?: string,
 ): void {
   const run = requireRun(context, dispatch.run.runId);
   const state = foldStoredKxmRun(context, run);
@@ -2146,7 +2173,10 @@ function settleMember(
       stepId: dispatch.stepId,
       assignmentId: dispatch.assignmentId,
       attemptId: dispatch.attemptId,
-      harness: result?.harness ?? (dispatch.producerId === "pi" ? "pi" : "driver-simulated"),
+      // Label the producer that actually ran: the old fallback printed "driver-simulated"
+      // for every producer that was not literally "pi", so a live oneshot drive that
+      // failed authentication read in the log as a simulation.
+      harness: result?.harness ?? dispatch.producerId,
       provider: result?.provider ?? "simulated",
       requestedModel: result?.requestedModel ?? "simulated",
       effectiveModel: result?.effectiveModel ?? result?.requestedModel ?? "simulated",
@@ -2162,6 +2192,7 @@ function settleMember(
       assignmentId: dispatch.assignmentId,
       resultClass: "producer_rejected",
       status: "result_recorded",
+      ...(produceErrorCode !== undefined ? { producerError: produceErrorCode } : {}),
     });
     push("attempt.status_changed", { attemptId: dispatch.attemptId, status: "terminal" });
     push("assignment.terminal", { assignmentId: dispatch.assignmentId, outcome: "failed", status: "terminal" });

package/plugins/kxm/src/harness.ts

@@ -1118,8 +1118,17 @@ export function probeHarnessAssignment(options: HarnessAssignmentProbeOptions):
     }
 
     const authArgs = ["auth", "check"];
-    if (options.model) {
-      authArgs.push("--model", options.model);
+    // `pi auth check --model` requires a provider-qualified id: a bare model answers
+    // status "invalid", which reads as not_authenticated and hides the real state. When
+    // the caller holds provider and bare model separately (the engine's request shape),
+    // qualify the id; a model that already carries its namespace goes through as-is.
+    const qualifiedModel = options.model
+      ? (options.provider && options.model.startsWith(`${options.provider}/`)
+        ? options.model
+        : options.provider ? `${options.provider}/${options.model}` : options.model)
+      : undefined;
+    if (qualifiedModel) {
+      authArgs.push("--model", qualifiedModel);
     } else if (options.provider) {
       authArgs.push("--provider", options.provider);
     }

package/plugins/kxm/src/mcp-server.ts

@@ -8,7 +8,7 @@ import { AGENT_COMMANDS_MAP, enforceToolPolicy, getMcpTools, reconcileInbox } fr
 import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 
-const VERSION = "0.7.61";
+const VERSION = "0.7.64";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();
 let meshClient: HubClient | undefined;

package/schemas/run-event.schema.json

@@ -364,6 +364,7 @@
         "runPlanHash": { "$ref": "common.schema.json#/$defs/sha256" },
         "capabilityHash": { "$ref": "common.schema.json#/$defs/sha256" },
         "resultClass": { "enum": ["outcome", "outcome_unknown", "producer_rejected", "cancelled"] },
+        "producerError": { "type": "string", "pattern": "^[a-z][a-z0-9]*(?:_[a-z0-9]+){1,3}$", "maxLength": 64, "description": "Machine-code reason a producer refused (produce threw), present only for resultClass producer_rejected. Capability material is redacted before extraction; anything unclassifiable records as producer_error." },
         "status": { "$ref": "common.schema.json#/$defs/lifecycleStatus" },
         "previousStatus": { "$ref": "common.schema.json#/$defs/lifecycleStatus" },
         "outcome": { "$ref": "common.schema.json#/$defs/identifier" },