@link-assistant/hive-mind 2.8.4 → 2.8.6

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @link-assistant/hive-mind
 
+## 2.8.6
+
+### Patch Changes
+
+- 0140e87: Verify required Codex Agent Skills against the catalog the model actually receives instead of trusting plugin enablement, so a plugin reported as installed but whose skills are invisible is reported with an actionable diagnostic rather than passing the preflight.
+
+## 2.8.5
+
+### Patch Changes
+
+- 9a1cbf4: Fix false positives and false negatives in CI/CD (issue #2082). Release and Helm scripts now fail on non-zero exit codes instead of silently continuing, npm publish verification retries registry propagation without republishing, version bumps retry a rejected push on top of the new remote HEAD, shell test assertions fail the build, every workflow job declares a timeout, and jobs use `!cancelled()` so concurrency cancellation is respected. Releases on main now queue rather than cancel, so a run cannot be interrupted between publishing to npm and pushing the version bump.
+
+  Linting now also covers the `tests/` tree, which `npm run lint` and `eslint.config.mjs` both excluded — the lint job reported success while never reading the largest source tree in the repository. Enabling it surfaced real defects across 59 files, including `assert.match` regexes with unescaped literal indentation that made assertions pass for the wrong reason.
+
+  Stops leaking `CLAUDE_CODE_EFFORT_LEVEL` from the parent shell into the Claude process. `getClaudeEnv()` builds the child environment from `process.env` and sanitised an inherited `MAX_THINKING_TOKENS`, but not the effort level, so any path that computed no level passed the parent's value through — giving `haiku` an effort level it does not support, and `--think off` one despite thinking being disabled. Since Claude Code exports this variable, the leak applied whenever hive-mind ran under it. The emitted effort level is now a function of the selected model and think level only.
+
 ## 2.8.4
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.8.4",
+  "version": "2.8.6",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",
@@ -21,8 +21,8 @@
     "test:queue": "node tests/solve-queue.test.mjs",
     "test:limits-display": "node tests/limits-display.test.mjs",
     "test:usage-limit": "node tests/test-usage-limit.mjs",
-    "lint": "eslint 'src/**/*.{js,mjs,cjs}' 'scripts/**/*.{js,mjs,cjs}' 'eslint-rules/**/*.{js,mjs,cjs}'",
-    "lint:fix": "eslint 'src/**/*.{js,mjs,cjs}' 'scripts/**/*.{js,mjs,cjs}' 'eslint-rules/**/*.{js,mjs,cjs}' --fix",
+    "lint": "eslint 'src/**/*.{js,mjs,cjs}' 'scripts/**/*.{js,mjs,cjs}' 'eslint-rules/**/*.{js,mjs,cjs}' 'tests/**/*.{js,mjs,cjs}'",
+    "lint:fix": "eslint 'src/**/*.{js,mjs,cjs}' 'scripts/**/*.{js,mjs,cjs}' 'eslint-rules/**/*.{js,mjs,cjs}' 'tests/**/*.{js,mjs,cjs}' --fix",
     "check:duplication": "jscpd .",
     "format": "prettier --write \"**/*.{js,mjs,json,md}\" --ignore-path .prettierignore",
     "format:check": "prettier --check \"**/*.{js,mjs,json,md}\" --ignore-path .prettierignore",

package/src/codex-capability-preflight.lib.mjs

@@ -155,6 +155,61 @@ const parseJsonCommand = (result, label) => {
 
 const catalogEntries = catalog => [...(catalog?.installed || []), ...(catalog?.available || [])];
 
+// Issue #2084: `codex plugin list` reports enablement, not model visibility.
+//
+// Codex renders the skills the model can actually see into a
+// `<skills_instructions>` block in the prompt. `codex debug prompt-input`
+// prints that prompt, so parsing the block is the only client-side signal that
+// matches what the model receives. Entries are rendered as
+// `- <name>: <description> (file: <path>)`, where `<name>` is bare for skills
+// under `$CODEX_HOME/skills` and `<plugin>:<skill>` for plugin-provided ones.
+const SKILLS_INSTRUCTIONS_BLOCK = /<skills_instructions>([\s\S]*?)<\/skills_instructions>/u;
+const SKILL_CATALOG_ENTRY = /(?:^|\\n)\s*-\s+([a-z0-9][a-z0-9_-]*(?::[a-z0-9][a-z0-9_-]*)?)\s*:/giu;
+
+export const parseModelVisibleSkills = (promptInput = '') => {
+  // `codex debug prompt-input` emits JSON, so newlines inside the prompt arrive
+  // as the two-character escape `\n`. Match both that and real newlines.
+  const block = SKILLS_INSTRUCTIONS_BLOCK.exec(String(promptInput).replace(/\r\n/gu, '\n').replace(/\n/gu, '\\n'));
+  if (!block) return null;
+  const skills = new Set();
+  for (const match of block[1].matchAll(SKILL_CATALOG_ENTRY)) skills.add(match[1].toLowerCase());
+  return skills;
+};
+
+// Verification is advisory when the probe itself cannot run: an older Codex
+// without `debug prompt-input`, or a sandbox that blocks it, must not fail a
+// run that the previous verification would have allowed.
+const readModelVisibleSkills = async ({ command, env, runCommand, log }) => {
+  const result = await runCommand({ command, args: ['debug', 'prompt-input', 'hive-mind capability probe'], env });
+  if (result.code !== 0) {
+    await log(
+      `   ⚠️  Could not read the model-visible skill catalog: ${String(result.stderr || result.stdout)
+        .trim()
+        .slice(0, 200)}`,
+      { verbose: true }
+    );
+    return null;
+  }
+  const skills = parseModelVisibleSkills(result.stdout);
+  if (!skills) await log('   ⚠️  Codex prompt did not contain a <skills_instructions> block; skipping skill visibility verification', { verbose: true });
+  return skills;
+};
+
+const verifyModelVisibleSkills = async ({ command, env, runCommand, log, requiredSkills }) => {
+  if (!requiredSkills || requiredSkills.length === 0) return;
+  const visible = await readModelVisibleSkills({ command, env, runCommand, log });
+  if (!visible) return;
+
+  await log(`   🔎 Model-visible skills (${visible.size}): ${[...visible].sort().join(', ') || 'none'}`, { verbose: true });
+  const invisible = requiredSkills.filter(skill => !visible.has(skill.toLowerCase()));
+  if (invisible.length === 0) {
+    await log(`   ✅ Verified ${requiredSkills.length} required skill(s) are visible to the model`);
+    return;
+  }
+
+  throw new CodexCapabilityPreflightError(`Codex reports the required plugins as installed, but the model cannot see: ${invisible.join(', ')}. ` + `Codex exposes a plugin's skills only while its payload is materialized under ` + `CODEX_HOME/plugins/cache/<marketplace>/<plugin>/<version>/skills. ` + `Visible skills were: ${[...visible].sort().join(', ') || 'none'}.`, { missing: invisible });
+};
+
 const skillParts = skill => {
   const separator = skill.indexOf(':');
   return separator === -1 ? { namespace: null, name: skill } : { namespace: skill.slice(0, separator), name: skill.slice(separator + 1) };
@@ -341,6 +396,7 @@ async function provisionCodexCapabilities({ owner, repo, issueNumber, projectDir
   }
   if (plugins.length === 0) {
     await log('   ✅ Required Agent Skills are already available from standard skill directories');
+    await verifyModelVisibleSkills({ command, env: baseEnv, runCommand, log, requiredSkills: requirements.skills });
     return { required: true, plugins, skills: requirements.skills, codexHome: null, baseCodexHome };
   }
 
@@ -365,6 +421,13 @@ async function provisionCodexCapabilities({ owner, repo, issueNumber, projectDir
   const unverified = plugins.filter(plugin => !verified.has(plugin));
   if (unverified.length > 0) throw new CodexCapabilityPreflightError(`Codex capability installation did not verify successfully: ${unverified.join(', ')}`, { missing: unverified });
 
+  // Issue #2084: enablement is not exposure. The failing run reached this point
+  // with `superpowers@openai-curated` reported as "installed, enabled" while
+  // the model saw zero `superpowers:*` skills, so the run proceeded and then
+  // stalled on the repository's mandatory preflight. Confirm the requirement
+  // against the catalog the model actually receives.
+  await verifyModelVisibleSkills({ command, env: scopedEnv, runCommand, log, requiredSkills: requirements.skills });
+
   await log(`   Codex capability state: ${codexHome}`, { verbose: true });
   return { required: true, plugins, skills: requirements.skills, codexHome, baseCodexHome };
 }

package/src/config.lib.mjs

@@ -627,6 +627,16 @@ export const getClaudeEnv = (options = {}) => {
     env.MAX_THINKING_TOKENS = String(options.thinkingBudget ?? 0);
   }
 
+  // Remove any inherited CLAUDE_CODE_EFFORT_LEVEL from process.env, mirroring the
+  // MAX_THINKING_TOKENS sanitisation above (Issue #2082). Without this, an effort
+  // level exported by the parent shell survives into the child whenever the logic
+  // below does not compute one — e.g. a model that supports no effort levels at all
+  // (haiku), or --think off. hive-mind's own agents run under Claude Code, which
+  // exports this variable, so the leak fired in exactly the common case: `haiku
+  // --think high` inherited effort=max from the parent. The value below must be a
+  // function of the selected model and think level, never of the ambient shell.
+  delete env.CLAUDE_CODE_EFFORT_LEVEL;
+
   // Set CLAUDE_CODE_EFFORT_LEVEL for models that support it (Issue #1238, Issue #1620)
   if (options.model && supportsEffortLevel(options.model)) {
     const effortOptions = {