@telora/daemon 0.19.47 → 0.19.74

package/dist/spawn/model-routing.js

@@ -0,0 +1,464 @@
+/**
+ * Model routing seam for the focus-team spawn path.
+ *
+ * Extracted verbatim from focus-executor.ts (behavior-preserving): the pure
+ * model/engine selection helpers, the per-pass local-model routing + host-control
+ * swap decisioning, the single-host GPU conflict surfacing, and the CLI-arg
+ * builder they feed. focus-executor.ts re-exports this surface for backward
+ * compatibility, so external importers keep resolving these symbols from
+ * '../focus-executor.js'.
+ *
+ * Cycle rule: this module must NOT import from '../focus-executor.js'.
+ */
+import { loadEnvConfig, ESCALATION_REASONS } from '@telora/daemon-core';
+import { createEscalation } from '../queries/issues.js';
+import { resolveTeamModel, resolveLocalModelRefPrecedence } from '../model-resolution.js';
+import { getLocalModel, getLocalModelSecret } from '../queries/local-models.js';
+import { codexSafeModelAlias, writeLocalModelCodexHome, TELORA_LOCAL_API_KEY_ENV, } from '../cli/codex-provision.js';
+import { startCodexMcpProxy, shouldRouteLocalModelThroughProxy, } from '../backends/codex/codex-mcp-proxy.js';
+import { detectHostCapability, ensureLoaded, resolveSafeLoadOptions, getStatus, decideSwap, hostRootFromBaseUrl, observeHostSwap, claimResidentHost, detectSingleHostModelConflict, shouldSurfaceHostConflictOnce, } from '../host-control/index.js';
+import { hasActiveTeam } from '../focus-team-state.js';
+/**
+ * Resolve the isolated CODEX_HOME to set on a spawn, or undefined when none
+ * applies. Pure + testable: only a codex-engine spawn against a product that
+ * carries a provisioned codexHome gets the override; every other case (claude
+ * engine, or a cloud product with no codexHome) returns undefined so the spawn
+ * environment is byte-for-byte unchanged.
+ */
+export function codexHomeForSpawn(engineId, config) {
+    return engineId === 'codex' && config.codexHome ? config.codexHome : undefined;
+}
+/**
+ * Select the per-pass local model ref to resolve for this spawn, or null.
+ *
+ * Pure + testable. A ref applies ONLY to a codex-engine spawn. The ref resolves
+ * under the unified Focus > Workflow > Default precedence (single-sourced in
+ * model-resolution.resolveLocalModelRefPrecedence): the focus's per-pass
+ * localModelOverride entry wins; absent that, the stage directive's localModel
+ * is inherited; absent both, null (the pass runs on the engine's default model).
+ * A claude engine or a blank ref returns null so the spawn keeps its
+ * per-product / engine-default behavior unchanged.
+ */
+export function selectLocalModelRef(engineId, pass, localModelOverride, stageDirectiveLocalModel) {
+    if (engineId !== 'codex')
+        return null;
+    return resolveLocalModelRefPrecedence(localModelOverride?.[pass], stageDirectiveLocalModel);
+}
+export function decideLocalModelRouting(ref, coords, apiKey) {
+    if (!ref)
+        return { kind: 'none' };
+    if (!coords)
+        return { kind: 'fallback' };
+    return { kind: 'route', coords, apiKey: apiKey?.trim() ? apiKey : null };
+}
+/**
+ * Pure gate: should the daemon perform a host-control model swap before this
+ * spawn? (Local model host control, D2.) True ONLY when routing resolved a local
+ * model for this pass AND the host advertises the optional control capability.
+ * A non-controllable host (today's behavior: the operator pre-loads the model in
+ * the studio) yields false -> NO swap, spawn proceeds unchanged. A pass with no
+ * routed local model (claude, no override) also yields false. Exported so the
+ * load-or-skip decision is unit-testable with NO HTTP.
+ */
+export function shouldSwapForPass(input) {
+    return input.routing.kind === 'route' && input.capability.controllable;
+}
+/**
+ * Resolve the effective model id for a spawn, applying the single team-model
+ * precedence (focus override -> stage directive -> CLI default) via
+ * resolveTeamModel. This is the SAME helper used at stage respawn, so the two
+ * paths can never diverge on ordering.
+ *
+ * The focus-override slot folds in the selected local-Codex model: when this
+ * pass routes to a controllable Codex home, `codexModel` IS the focus's
+ * explicit pick and must win exactly like a focus pipeline_config.model would.
+ * `directiveModel` has already been filtered through
+ * selectDirectiveModelForSpawn() (nulled when the backend cannot run it, or
+ * when a focus override is present), so it only ever reaches here as a
+ * legitimate stage fallback.
+ *
+ * Pure + testable. Used by spawnFocusTeam to produce effectivePipelineConfig.model.
+ */
+export function resolveEffectiveModel(directiveModel, spawnCodexHome, codexModel, pipelineModel) {
+    const focusOverrideModel = (spawnCodexHome && codexModel ? codexModel : null) ?? pipelineModel ?? null;
+    return resolveTeamModel(focusOverrideModel, directiveModel);
+}
+/**
+ * A cloud model id the Claude backend can run: the full claude-* ids
+ * (claude-opus-4-8, claude-sonnet-4-6, ...) AND the bare aliases Claude Code
+ * accepts (opus, sonnet, haiku, fable -- used across the daemon, e.g.
+ * audit-phase's AUDIT_DEFAULT_MODEL='opus'). Anything else (gpt-5-codex,
+ * gemma-4-12b, ...) is treated as not-Claude so it cannot reach the claude CLI.
+ */
+const CLAUDE_MODEL_PREFIXES = ['claude', 'opus', 'sonnet', 'haiku', 'fable'];
+export function isClaudeModelId(model) {
+    if (typeof model !== 'string')
+        return false;
+    const normalized = model.trim().toLowerCase();
+    return CLAUDE_MODEL_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+}
+/**
+ * Select the pipeline model fallback to feed into resolveEffectiveModel().
+ *
+ * Hosted Codex runs through the user's Codex account. Some registry labels
+ * exposed in the UI (for example gpt-5-codex) are not valid `codex exec
+ * --model` values for every account, and passing them fails the run before the
+ * agent starts. Local-model Codex still needs an explicit model, and Claude
+ * keeps the existing pipeline model behavior.
+ *
+ * Engine-compat (the per-pass bleed guard): product_focuses.pipeline_config.model
+ * is a SINGLE focus-wide value shared across passes, but each pass resolves its
+ * own engine. A pass whose engine resolved to claude can only run a claude-family
+ * model -- so a coding-pass codex model (e.g. gpt-5-codex) selected on the focus
+ * must NOT bleed into a claude review pass. When it would, null it so the claude
+ * backend picks its own default rather than receiving `--model gpt-5-codex` and
+ * erroring out. (The symmetric codex case is handled above + by spawnCodexModel
+ * routing; local-codex models reach the spawn via spawnCodexModel, not here.)
+ */
+export function selectPipelineModelForSpawn(engineId, spawnCodexHome, pipelineModel) {
+    if (engineId === 'codex' && !spawnCodexHome)
+        return null;
+    if (engineId === 'claude' && !isClaudeModelId(pipelineModel))
+        return null;
+    return pipelineModel ?? null;
+}
+/**
+ * Select whether a workflow directive's model may reach the backend.
+ *
+ * The focus pass selection is the source of truth for team launches. Stage
+ * directives contribute prompt/context; their model field is only a legacy
+ * fallback when the focus/pass has no selected model and the backend can run
+ * that model. In particular, never pass a Claude directive model to Codex.
+ */
+export function selectDirectiveModelForSpawn(engineId, directiveModel, focusSelectedModel) {
+    if (!directiveModel)
+        return null;
+    if (focusSelectedModel)
+        return null;
+    if (engineId === 'codex')
+        return null;
+    return directiveModel;
+}
+/**
+ * Build CLI args for the team lead via the selected backend.
+ *
+ * Engine-specific flag construction lives in the backend; resume uses the
+ * backend's dedicated resume-arg builder. Exported for the spawner barrel
+ * surface (legacy ./team-spawner.js consumers).
+ */
+export function buildAgentArgs(backend, config, worktreePath, pipelineConfig, resumeSessionId, allowedTools, readOnly) {
+    // allowedTools comes from the focus role's agent_roles.allowed_tools. The
+    // backend applies least-privilege scoping when non-empty; empty/absent =>
+    // engine default tool set (documented default policy).
+    const base = { config, worktreePath, model: pipelineConfig?.model ?? null, allowedTools, readOnly };
+    return resumeSessionId
+        ? backend.buildResumeArgs({ ...base, resumeSessionId })
+        : backend.buildSpawnArgs(base);
+}
+/**
+ * Phase: resolve the per-pass local-model routing for a codex spawn.
+ *
+ * Wraps the fetch (getLocalModel / getLocalModelSecret) + the pure decision
+ * (selectLocalModelRef -> decideLocalModelRouting) and, on 'route', provisions
+ * the per-model CODEX_HOME (writeLocalModelCodexHome) -- returning the codexHome
+ * the caller points the spawn at. The key VALUE comes from Telora (D8), never a
+ * host env var. Behavior byte-identical to the original inline block; only the
+ * apply-side (session-terminal write on skip, env injection on route) stays in
+ * the caller.
+ */
+export async function resolveLocalModelConfig(args, deps = {}) {
+    const getModel = deps.getLocalModel ?? getLocalModel;
+    const getSecret = deps.getLocalModelSecret ?? getLocalModelSecret;
+    const writeCodexHome = deps.writeLocalModelCodexHome ?? writeLocalModelCodexHome;
+    const localModelRef = selectLocalModelRef(args.engineId, args.enginePass, args.localModelOverride, args.stageDirectiveLocalModel);
+    // getLocalModel + getLocalModelSecret (the DB calls) run only when a ref
+    // exists; decideLocalModelRouting is the pure decision over their results.
+    const coords = localModelRef ? await getModel(localModelRef) : null;
+    const apiKey = localModelRef ? await getSecret(localModelRef) : null;
+    const routing = decideLocalModelRouting(localModelRef, coords, apiKey);
+    switch (routing.kind) {
+        case 'none':
+            return { kind: 'none' };
+        case 'fallback':
+            return { kind: 'fallback', ref: localModelRef };
+        case 'route': {
+            const { codexHome } = writeCodexHome(routing.coords.id, {
+                baseUrl: routing.coords.baseUrl,
+                model: routing.coords.model,
+                wireApi: routing.coords.wireApi ?? undefined,
+                requiresApiKey: routing.apiKey !== null,
+            });
+            return {
+                kind: 'route',
+                codexHome,
+                codexModel: codexSafeModelAlias(routing.coords.model),
+                apiKey: routing.apiKey,
+                coords: routing.coords,
+            };
+        }
+    }
+}
+/**
+ * Surface (do NOT silently swap) two DIFFERENT local models bound to the coding
+ * vs review pass of one focus that share a single GPU host (#9). On a single
+ * card the two bindings force an evict+load swap on every pass alternation and
+ * fight over the GPU (the live incident: 0/56 routing attempts succeeded). The
+ * daemon must make the conflict VISIBLE rather than thrash silently.
+ *
+ * Cheap early-out: only when the focus pins a local model for BOTH passes and
+ * the two refs differ do we resolve coordinates (two getLocalModel reads) and run
+ * the pure detector. A conflict (same host root, different served models) is
+ * raised ONCE per focus per daemon run (shouldSurfaceHostConflictOnce) as a log
+ * line + a single escalation -- never re-raised every poll. Returns whether a new
+ * surfacing was raised this call. Best-effort: an escalation-create failure is
+ * logged, never fatal to the spawn.
+ */
+export async function surfaceSingleHostModelConflict(args, deps = {}) {
+    const getModel = deps.getLocalModel ?? getLocalModel;
+    const makeEscalation = deps.createEscalation ?? createEscalation;
+    const codingRef = args.localModelOverride?.coding?.trim() || null;
+    const reviewRef = args.localModelOverride?.review?.trim() || null;
+    // The conflict needs a distinct local model pinned on BOTH passes.
+    if (!codingRef || !reviewRef || codingRef === reviewRef)
+        return { surfaced: false };
+    const [codingCoords, reviewCoords] = await Promise.all([getModel(codingRef), getModel(reviewRef)]);
+    if (!codingCoords || !reviewCoords)
+        return { surfaced: false };
+    const bindings = [
+        { pass: 'coding', modelId: codingCoords.model, baseUrl: codingCoords.baseUrl },
+        { pass: 'review', modelId: reviewCoords.model, baseUrl: reviewCoords.baseUrl },
+    ];
+    const result = detectSingleHostModelConflict(bindings);
+    if (!result.conflict)
+        return { surfaced: false };
+    if (!shouldSurfaceHostConflictOnce(args.focusId))
+        return { surfaced: false };
+    const detail = `Focus "${args.focusName}" pins two different local models to one GPU host ` +
+        `(${result.root}): coding="${codingCoords.name}" (${codingCoords.model}) vs ` +
+        `review="${reviewCoords.name}" (${reviewCoords.model}). On a single GPU these force an ` +
+        `evict+load swap on every pass alternation and fight over the card. Pin both passes to the ` +
+        `same local model, or move one pass to a different host / a cloud engine.`;
+    console.warn(`[focus-executor] Host-control: ${detail}`);
+    try {
+        await makeEscalation({
+            organizationId: args.organizationId,
+            issueId: null,
+            reasonType: ESCALATION_REASONS.BLOCKED_BY_EXTERNAL,
+            description: detail,
+            whatWasTried: 'Detected at spawn that the coding and review passes resolve to different local models on the same GPU host.',
+            helpNeeded: 'Pin both passes to one local model, or route one pass to a separate host or a cloud engine, so the single GPU is not swapped on every pass.',
+            escalationKind: 'single_host_model_conflict',
+            ...(args.productId ? { productId: args.productId } : {}),
+            focusId: args.focusId,
+            metadata: {
+                host_root: result.root,
+                coding_model: codingCoords.model,
+                review_model: reviewCoords.model,
+            },
+        });
+    }
+    catch (err) {
+        console.warn(`[focus-executor] Failed to file single_host_model_conflict escalation for "${args.focusName}":`, err.message);
+    }
+    return { surfaced: true };
+}
+/**
+ * Phase: resolve the per-product CODEX_HOME default, apply per-pass local-model
+ * routing (fallback / route), select the effective model, and build the CLI
+ * args. Returns 'ready' with the args + the model/env bits the spawn needs.
+ */
+export async function resolveSpawnModel(args) {
+    const { resolvedEngine, enginePass, localModelOverride, stageDirectiveLocalModel, config, directiveModel, pendingFocusOverrideModel, pipelineConfig, backend, worktreePath, resumeId, role, readOnly, focusName, focusId, } = args;
+    // Single source of truth for the focus override at this spawn: a respawn's
+    // snapshot wins over the live pipeline_config.model; otherwise the live config
+    // carries it. Both initial spawn and respawn funnel through resolveTeamModel
+    // below, so the precedence (focus override -> stage -> CLI) is identical.
+    const focusOverrideModel = pendingFocusOverrideModel ?? pipelineConfig?.model ?? null;
+    // Resolve the per-product isolated CODEX_HOME for this spawn (undefined for
+    // claude engines and cloud products with no provisioned codexHome -- those
+    // spawns are byte-for-byte unaffected).
+    let spawnCodexHome = codexHomeForSpawn(resolvedEngine.engineId, config);
+    let spawnCodexModel = config.codexModel;
+    let isLocalModelPass = false;
+    // Per-pass local model routing: if this codex pass selected a registered local
+    // model, resolve it to coordinates, provision a per-model CODEX_HOME, and route
+    // the spawn there -- overriding the per-product codexHome/codexModel for this
+    // pass only. Absent ref => the per-product default above is kept.
+    const localModelConfig = await resolveLocalModelConfig({
+        engineId: resolvedEngine.engineId,
+        enginePass,
+        localModelOverride,
+        stageDirectiveLocalModel,
+    });
+    // The Telora-resolved key VALUE injected into the spawn env (under the fixed
+    // TELORA_LOCAL_API_KEY name) for a routed local-model pass; null otherwise.
+    let spawnLocalModelKey = null;
+    if (localModelConfig.kind === 'fallback') {
+        console.warn(`[focus-executor] Focus "${focusName}" ${enginePass} pass selected local model ` +
+            `${(localModelConfig.ref ?? '').slice(0, 8)} but it is not in the registry; falling back to the ` +
+            `per-product default model.`);
+    }
+    else if (localModelConfig.kind === 'route') {
+        const { codexHome, codexModel, apiKey, coords } = localModelConfig;
+        spawnCodexHome = codexHome;
+        spawnCodexModel = codexModel;
+        spawnLocalModelKey = apiKey;
+        isLocalModelPass = true;
+        console.log(`[focus-executor] Routing "${focusName}" ${enginePass} pass to local model ` +
+            `"${coords.name}" (${coords.model} @ ${coords.baseUrl}); CODEX_HOME=${codexHome}, ` +
+            (apiKey
+                ? `key from Telora (env ${TELORA_LOCAL_API_KEY_ENV}).`
+                : 'unauthenticated endpoint.'));
+        // Host-control swap (D2): on a CONTROLLABLE host, load/unload the selected
+        // per-pass model around this pass -- a sequential single-GPU swap (one model
+        // resident at a time) so the coding-vs-review model runs end-to-end with NO
+        // manual studio swap. On a non-controllable host this is a no-op (today's
+        // behavior: the operator pre-loads the model). A swap FAILURE must NOT spawn
+        // against a not-yet-loaded model: skip this tick (the 30s poll re-attempts).
+        const capability = await detectHostCapability(coords.baseUrl, apiKey);
+        if (shouldSwapForPass({ routing: { kind: 'route', coords, apiKey }, capability })) {
+            const root = hostRootFromBaseUrl(coords.baseUrl);
+            // Fast inline path (#1): if the target is ALREADY resident + ready, spawn
+            // THIS tick -- no detour through the detached swap. A single bounded
+            // /v1/status read; org-prefix-tolerant via decideSwap/modelIdsMatch.
+            let alreadyResident = false;
+            try {
+                const status = await getStatus(coords.baseUrl, apiKey);
+                alreadyResident =
+                    decideSwap({
+                        current: { modelId: status.loadedModelId, ready: status.ready },
+                        target: coords.model,
+                    }).action === 'noop';
+            }
+            catch {
+                // Transient status-read failure -> fall through to the managed async
+                // swap, which retries the load + readiness off the poll-critical path.
+            }
+            if (alreadyResident) {
+                // Claim the per-host residency lock (#4) so a second focus on this host
+                // cannot start a swap that evicts our resident model mid-pass.
+                const claim = claimResidentHost({
+                    root,
+                    targetModel: coords.model,
+                    focusId,
+                    isFocusActive: (id) => hasActiveTeam(id),
+                });
+                if (claim.status === 'busy_other') {
+                    console.log(`[focus-executor] Host-control: host for "${coords.name}" is held by another ` +
+                        `focus's running pass; deferring "${focusName}" ${enginePass} pass to avoid eviction.`);
+                    return { kind: 'still_loading', coords, reason: 'host_busy_other_focus' };
+                }
+                console.log(`[focus-executor] Host-control: model "${coords.name}" (${coords.model}) already ` +
+                    `resident + ready for "${focusName}" ${enginePass} pass.`);
+            }
+            else {
+                // A load is needed. Run it OFF the serial poll loop via the swap manager
+                // (#3) so a cold load (up to the 180s budget) does not stall every other
+                // focus/product. The manager also enforces the per-host residency lock
+                // (#4): a second focus on this host defers rather than evicting an
+                // in-flight model. The load is detached -- never awaited here.
+                const loadTimeoutMs = loadEnvConfig().TELORA_HOST_CONTROL_LOAD_TIMEOUT_MS;
+                const observation = observeHostSwap({
+                    root,
+                    targetModel: coords.model,
+                    focusId,
+                    isFocusActive: (id) => hasActiveTeam(id),
+                    runLoad: async () => {
+                        // D3 sizing seam: hardware-aware safe context that RESERVES the
+                        // candidate model's weights before sizing the KV cache. The weights
+                        // size + native context come from the registry coordinates (the
+                        // local_models sizing-metadata columns); when unset the sizer
+                        // degrades safely (no reservation / ceiling clamp). FAIL-SAFE to the
+                        // fixed DEFAULT_MAX_SEQ_LENGTH when host hardware data is unavailable.
+                        const sizing = await resolveSafeLoadOptions(coords.baseUrl, coords.model, { modelSizeMb: coords.modelSizeMb, nativeContext: coords.nativeContext }, apiKey);
+                        if (sizing.source === 'fallback') {
+                            console.warn(`[focus-executor] Host-control sizing unavailable for "${coords.name}" ` +
+                                `(${coords.model}); falling back to the fixed default context ` +
+                                `${sizing.maxSeqLength}. Check the host's /api/system/hardware endpoint.`);
+                        }
+                        else {
+                            console.log(`[focus-executor] Host-control sizing for "${coords.name}" (${coords.model}): ` +
+                                `max_seq_length=${sizing.maxSeqLength}` +
+                                (sizing.cacheTypeKv ? `, cache_type_kv=${sizing.cacheTypeKv}` : '') +
+                                (sizing.quantRequired ? ' (quant-required, marginal headroom)' : '') +
+                                (sizing.marginal && !sizing.quantRequired ? ' (marginal headroom)' : '') + '.');
+                        }
+                        // Load-scoped POST timeout: a host that blocks /v1/load until the cold
+                        // load completes must not be cut by the generic 5s fetch timeout.
+                        await ensureLoaded(coords.baseUrl, coords.model, {
+                            maxSeqLength: sizing.maxSeqLength,
+                            loadTimeoutMs,
+                            ...(sizing.cacheTypeKv !== undefined ? { cacheTypeKv: sizing.cacheTypeKv } : {}),
+                        }, apiKey);
+                        console.log(`[focus-executor] Host-control: local model "${coords.name}" (${coords.model}) ` +
+                            `loaded + ready (off-loop swap complete).`);
+                    },
+                });
+                if (observation.status === 'loading') {
+                    console.log(`[focus-executor] Host-control: model "${coords.name}" (${coords.model}) is loading ` +
+                        `for "${focusName}" ${enginePass} pass; deferring spawn (load runs off the poll loop).`);
+                    return { kind: 'still_loading', coords, reason: 'model_loading' };
+                }
+                if (observation.status === 'busy_other') {
+                    console.log(`[focus-executor] Host-control: host for "${coords.name}" is held by another ` +
+                        `focus's running pass; deferring "${focusName}" ${enginePass} pass to avoid eviction.`);
+                    return { kind: 'still_loading', coords, reason: 'host_busy_other_focus' };
+                }
+                if (observation.status === 'failed') {
+                    console.error(`[focus-executor] Host-control swap to load "${coords.name}" (${coords.model}) for ` +
+                        `"${focusName}" ${enginePass} pass FAILED: ${observation.error}. Not spawning against ` +
+                        `an unloaded model; will re-attempt next poll.`);
+                    return { kind: 'skip_load', coords, dbMessage: observation.error };
+                }
+                // observation.status === 'ready' -- the detached load completed on a
+                // prior tick; the model is resident and residency is held. Proceed.
+                console.log(`[focus-executor] Host-control: model "${coords.name}" (${coords.model}) ready for ` +
+                    `"${focusName}" ${enginePass} pass (off-loop swap complete).`);
+            }
+        }
+    }
+    // Model selection: ONE precedence (focus override -> stage directive -> CLI),
+    // applied identically at initial spawn and at stage respawn. The engine-compat
+    // prefilters below null out an input the resolved backend cannot run; the
+    // surviving inputs funnel through resolveEffectiveModel -> resolveTeamModel.
+    const focusSelectedModel = selectPipelineModelForSpawn(resolvedEngine.engineId, spawnCodexHome, focusOverrideModel);
+    const effectiveDirectiveModel = selectDirectiveModelForSpawn(resolvedEngine.engineId, directiveModel, spawnCodexModel ?? focusSelectedModel);
+    const effectiveModel = resolveEffectiveModel(effectiveDirectiveModel, spawnCodexHome, spawnCodexModel, focusSelectedModel);
+    const effectivePipelineConfig = effectiveModel !== (pipelineConfig?.model ?? null)
+        ? { ...pipelineConfig, model: effectiveModel }
+        : pipelineConfig;
+    const args2 = buildAgentArgs(backend, config, worktreePath, effectivePipelineConfig, resumeId, role.allowed_tools, readOnly);
+    // Capability-driven (no operator flag): for a registered local-model route
+    // whose endpoint drops Codex's namespace tools (backendDropsNamespaceTools),
+    // insert a localhost translating proxy between Codex and the inference server
+    // so the OSS server still receives the Telora tool schemas. Started LAST --
+    // after every host-control early return -- so a deferred spawn never leaks a
+    // proxy. Points the provisioned CODEX_HOME's base_url at the proxy; the proxy
+    // forwards to the model's real coords.baseUrl. Non-local / native-Responses
+    // passes never route => mcpProxy stays null and the spawn is byte-identical.
+    let mcpProxy = null;
+    if (localModelConfig.kind === 'route' &&
+        shouldRouteLocalModelThroughProxy(isLocalModelPass, localModelConfig.coords)) {
+        const { coords, apiKey } = localModelConfig;
+        try {
+            mcpProxy = await startCodexMcpProxy({ upstreamBaseUrl: coords.baseUrl });
+            writeLocalModelCodexHome(coords.id, {
+                baseUrl: mcpProxy.url,
+                model: coords.model,
+                wireApi: coords.wireApi ?? undefined,
+                requiresApiKey: apiKey !== null,
+            });
+            console.log(`[focus-executor] Local-model MCP proxy engaged for "${coords.name}": ` +
+                `Codex base_url -> ${mcpProxy.url} -> upstream ${coords.baseUrl}.`);
+        }
+        catch (err) {
+            // Best-effort: a proxy that cannot start must not block the spawn; fall
+            // back to the direct (namespace-dropping) path. The fail-loud reception
+            // check only applies when a proxy is present.
+            console.warn(`[focus-executor] Local-model MCP proxy failed to start; spawning direct: ${err.message}`);
+            mcpProxy = null;
+        }
+    }
+    return { kind: 'ready', args: args2, effectiveModel, spawnCodexHome, spawnLocalModelKey, isLocalModelPass, mcpProxy };
+}
+//# sourceMappingURL=model-routing.js.map

package/dist/spawn/model-routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-routing.js","sourceRoot":"","sources":["../../src/spawn/model-routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAA8B,MAAM,4BAA4B,CAAC;AAC5G,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,iCAAiC,GAElC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,sBAAsB,EACtB,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,6BAA6B,EAC7B,6BAA6B,GAG9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGvD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,MAA8B;IAE9B,OAAO,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,IAAgB,EAChB,kBAAoE,EACpE,wBAAwC;IAExC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,8BAA8B,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,EAAE,wBAAwB,CAAC,CAAC;AAC9F,CAAC;AAsBD,MAAM,UAAU,uBAAuB,CACrC,GAAkB,EAClB,MAAoC,EACpC,MAAqB;IAErB,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAGjC;IACC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACnC,cAAyC,EACzC,cAAkC,EAClC,UAA8B,EAC9B,aAAwC;IAExC,MAAM,kBAAkB,GACtB,CAAC,cAAc,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,aAAa,IAAI,IAAI,CAAC;IAC9E,OAAO,gBAAgB,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC7E,MAAM,UAAU,eAAe,CAAC,KAAgC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAgB,EAChB,cAAkC,EAClC,aAAwC;IAExC,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,aAAa,IAAI,IAAI,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,cAAyC,EACzC,kBAA6C;IAE7C,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAqB,EACrB,MAAoB,EACpB,YAAoB,EACpB,cAAqC,EACrC,eAA+B,EAC/B,YAAgC,EAChC,QAAkB;IAElB,0EAA0E;IAC1E,0EAA0E;IAC1E,uDAAuD;IACvD,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,IAAI,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;IACpG,OAAO,eAAe;QACpB,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC;QACvD,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAyBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAOC,EACD,OAAsC,EAAE;IAExC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;IAClE,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,IAAI,wBAAwB,CAAC;IAEjF,MAAM,aAAa,GAAG,mBAAmB,CACvC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,wBAAwB,CACvF,CAAC;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,OAAO,GAAG,uBAAuB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAEvE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;QAClD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;gBACtD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;gBAC/B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;gBAC3B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS;gBAC5C,cAAc,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI;aACxC,CAAC,CAAC;YACH,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,SAAS;gBACT,UAAU,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBACrD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAQD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAMC,EACD,OAAyC,EAAE;IAE3C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;IACrD,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC;IAEjE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAClE,mEAAmE;IACnE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAEpF,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAE/D,MAAM,QAAQ,GAAsB;QAClC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE;QAC9E,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE;KAC/E,CAAC;IACF,MAAM,MAAM,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAEjD,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAE7E,MAAM,MAAM,GACV,UAAU,IAAI,CAAC,SAAS,oDAAoD;QAC5E,IAAI,MAAM,CAAC,IAAI,cAAc,YAAY,CAAC,IAAI,MAAM,YAAY,CAAC,KAAK,OAAO;QAC7E,WAAW,YAAY,CAAC,IAAI,MAAM,YAAY,CAAC,KAAK,oCAAoC;QACxF,4FAA4F;QAC5F,0EAA0E,CAAC;IAC7E,OAAO,CAAC,IAAI,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;IAEzD,IAAI,CAAC;QACH,MAAM,cAAc,CAAC;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,kBAAkB,CAAC,mBAAmB;YAClD,WAAW,EAAE,MAAM;YACnB,YAAY,EACV,6GAA6G;YAC/G,UAAU,EACR,6IAA6I;YAC/I,cAAc,EAAE,4BAA4B;YAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE;gBACR,SAAS,EAAE,MAAM,CAAC,IAAI;gBACtB,YAAY,EAAE,YAAY,CAAC,KAAK;gBAChC,YAAY,EAAE,YAAY,CAAC,KAAK;aACjC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,8EAA8E,IAAI,CAAC,SAAS,IAAI,EAC/F,GAAa,CAAC,OAAO,CACvB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AA8BD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IA4BvC;IACC,MAAM,EACJ,cAAc,EAAE,UAAU,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,EAAE,cAAc,EAChG,yBAAyB,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAC1E,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,GACnC,GAAG,IAAI,CAAC;IACT,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,kBAAkB,GAAG,yBAAyB,IAAI,cAAc,EAAE,KAAK,IAAI,IAAI,CAAC;IAEtF,4EAA4E;IAC5E,2EAA2E;IAC3E,wCAAwC;IACxC,IAAI,cAAc,GAAG,iBAAiB,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,eAAe,GAAG,MAAM,CAAC,UAAU,CAAC;IACxC,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,+EAA+E;IAC/E,gFAAgF;IAChF,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC;QACrD,QAAQ,EAAE,cAAc,CAAC,QAAQ;QACjC,UAAU;QACV,kBAAkB;QAClB,wBAAwB;KACzB,CAAC,CAAC;IACH,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAC7C,IAAI,gBAAgB,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CACV,2BAA2B,SAAS,KAAK,UAAU,6BAA6B;YAChF,GAAG,CAAC,gBAAgB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,sDAAsD;YACjG,4BAA4B,CAC7B,CAAC;IACJ,CAAC;SAAM,IAAI,gBAAgB,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;QACnE,cAAc,GAAG,SAAS,CAAC;QAC3B,eAAe,GAAG,UAAU,CAAC;QAC7B,kBAAkB,GAAG,MAAM,CAAC;QAC5B,gBAAgB,GAAG,IAAI,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,6BAA6B,SAAS,KAAK,UAAU,uBAAuB;YAC5E,IAAI,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,OAAO,iBAAiB,SAAS,IAAI;YACnF,CAAC,MAAM;gBACL,CAAC,CAAC,wBAAwB,wBAAwB,IAAI;gBACtD,CAAC,CAAC,2BAA2B,CAAC,CACjC,CAAC;QAEF,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,UAAU,GAAmB,MAAM,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAEjD,0EAA0E;YAC1E,qEAAqE;YACrE,qEAAqE;YACrE,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACvD,eAAe;oBACb,UAAU,CAAC;wBACT,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;wBAC/D,MAAM,EAAE,MAAM,CAAC,KAAK;qBACrB,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,uEAAuE;YACzE,CAAC;YAED,IAAI,eAAe,EAAE,CAAC;gBACpB,wEAAwE;gBACxE,+DAA+D;gBAC/D,MAAM,KAAK,GAAG,iBAAiB,CAAC;oBAC9B,IAAI;oBACJ,WAAW,EAAE,MAAM,CAAC,KAAK;oBACzB,OAAO;oBACP,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;iBACzC,CAAC,CAAC;gBACH,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;oBAClC,OAAO,CAAC,GAAG,CACT,4CAA4C,MAAM,CAAC,IAAI,uBAAuB;wBAC9E,oCAAoC,SAAS,KAAK,UAAU,0BAA0B,CACvF,CAAC;oBACF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;gBAC5E,CAAC;gBACD,OAAO,CAAC,GAAG,CACT,yCAAyC,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,KAAK,YAAY;oBAClF,yBAAyB,SAAS,KAAK,UAAU,QAAQ,CAC1D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,yEAAyE;gBACzE,uEAAuE;gBACvE,mEAAmE;gBACnE,+DAA+D;gBAC/D,MAAM,aAAa,GAAG,aAAa,EAAE,CAAC,mCAAmC,CAAC;gBAC1E,MAAM,WAAW,GAAG,eAAe,CAAC;oBAClC,IAAI;oBACJ,WAAW,EAAE,MAAM,CAAC,KAAK;oBACzB,OAAO;oBACP,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;oBACxC,OAAO,EAAE,KAAK,IAAI,EAAE;wBAClB,gEAAgE;wBAChE,oEAAoE;wBACpE,gEAAgE;wBAChE,8DAA8D;wBAC9D,qEAAqE;wBACrE,uEAAuE;wBACvE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,KAAK,EACZ,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,EACxE,MAAM,CACP,CAAC;wBACF,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;4BACjC,OAAO,CAAC,IAAI,CACV,yDAAyD,MAAM,CAAC,IAAI,IAAI;gCACxE,IAAI,MAAM,CAAC,KAAK,+CAA+C;gCAC/D,GAAG,MAAM,CAAC,YAAY,mDAAmD,CAC1E,CAAC;wBACJ,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,GAAG,CACT,6CAA6C,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,KAAK,KAAK;gCAC/E,kBAAkB,MAAM,CAAC,YAAY,EAAE;gCACvC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gCACnE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACpE,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAC/E,CAAC;wBACJ,CAAC;wBACD,uEAAuE;wBACvE,kEAAkE;wBAClE,MAAM,YAAY,CAChB,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,KAAK,EACZ;4BACE,YAAY,EAAE,MAAM,CAAC,YAAY;4BACjC,aAAa;4BACb,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACjF,EACD,MAAM,CACP,CAAC;wBACF,OAAO,CAAC,GAAG,CACT,+CAA+C,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,KAAK,IAAI;4BAChF,0CAA0C,CAC3C,CAAC;oBACJ,CAAC;iBACF,CAAC,CAAC;gBAEH,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACrC,OAAO,CAAC,GAAG,CACT,yCAAyC,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,KAAK,eAAe;wBACrF,QAAQ,SAAS,KAAK,UAAU,uDAAuD,CACxF,CAAC;oBACF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;gBACpE,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;oBACxC,OAAO,CAAC,GAAG,CACT,4CAA4C,MAAM,CAAC,IAAI,uBAAuB;wBAC9E,oCAAoC,SAAS,KAAK,UAAU,0BAA0B,CACvF,CAAC;oBACF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;gBAC5E,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACpC,OAAO,CAAC,KAAK,CACX,+CAA+C,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,KAAK,QAAQ;wBACpF,IAAI,SAAS,KAAK,UAAU,iBAAiB,WAAW,CAAC,KAAK,yBAAyB;wBACvF,+CAA+C,CAChD,CAAC;oBACF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;gBACrE,CAAC;gBACD,qEAAqE;gBACrE,oEAAoE;gBACpE,OAAO,CAAC,GAAG,CACT,yCAAyC,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,KAAK,cAAc;oBACpF,IAAI,SAAS,KAAK,UAAU,iCAAiC,CAC9D,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,cAAc,CAAC,QAAQ,EACvB,cAAc,EACd,kBAAkB,CACnB,CAAC;IACF,MAAM,uBAAuB,GAAG,4BAA4B,CAC1D,cAAc,CAAC,QAAQ,EACvB,cAAc,EACd,eAAe,IAAI,kBAAkB,CACtC,CAAC;IACF,MAAM,cAAc,GAAG,qBAAqB,CAC1C,uBAAuB,EACvB,cAAc,EACd,eAAe,EACf,kBAAkB,CACnB,CAAC;IACF,MAAM,uBAAuB,GAAG,cAAc,KAAK,CAAC,cAAc,EAAE,KAAK,IAAI,IAAI,CAAC;QAChF,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,KAAK,EAAE,cAAc,EAAoB;QAChE,CAAC,CAAC,cAAc,CAAC;IACnB,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAE7H,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,QAAQ,GAA+B,IAAI,CAAC;IAChD,IACE,gBAAgB,CAAC,IAAI,KAAK,OAAO;QACjC,iCAAiC,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAC5E,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;QAC5C,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,wBAAwB,CAAC,MAAM,CAAC,EAAE,EAAE;gBAClC,OAAO,EAAE,QAAQ,CAAC,GAAG;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;gBACpC,cAAc,EAAE,MAAM,KAAK,IAAI;aAChC,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CACT,uDAAuD,MAAM,CAAC,IAAI,KAAK;gBACvE,qBAAqB,QAAQ,CAAC,GAAG,gBAAgB,MAAM,CAAC,OAAO,GAAG,CACnE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,wEAAwE;YACxE,8CAA8C;YAC9C,OAAO,CAAC,IAAI,CAAC,4EAA6E,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACnH,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC;AACxH,CAAC"}

package/dist/spawn/process-spawn.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Process-spawn seam for the focus-team spawn path.
+ *
+ * Extracted verbatim from focus-executor.ts (behavior-preserving): the final
+ * phase that takes a fully-resolved spawn (env constituents, args, message,
+ * session, backend) and actually launches the team-lead child process, plus its
+ * fail-closed backend/sandbox/governor gates, the crash-isolated spawn wrapper,
+ * and the terminal session-update payload builders. focus-executor.ts re-exports
+ * this surface for backward compatibility, so external importers keep resolving
+ * these symbols from '../focus-executor.js'.
+ *
+ * Cycle rule: this module must NOT import from '../focus-executor.js'. The two
+ * symbols this seam would otherwise reach back for -- the resource governor and
+ * the orchestrator spawnFocusTeam (staying in focus-executor.ts) -- are threaded
+ * in via SpawnTeamProcessArgs instead.
+ */
+import { spawn, type ChildProcessWithoutNullStreams, type SpawnOptionsWithoutStdio } from 'node:child_process';
+import { type ResourceGovernor } from '@telora/daemon-core';
+import type { DaemonConfig, FocusTeamState } from '../types.js';
+import { createSession } from '../supabase.js';
+import { consumePendingSpawnDirective } from '../directive-executor.js';
+import { type AssemblyManifestEntry } from '../assembly-engine.js';
+import { type AgentBackend } from '../backends/index.js';
+import { setupTeamLogStreams } from '../spawner/helpers.js';
+import type { SpawnFocusTeamParams } from './spawn-decision.js';
+/**
+ * The terminal session-update payload written when the resource governor denies a
+ * slot for this spawn. Pure -- the caller adds `ended_at` and calls updateSession.
+ * Exported so the governor-denied exit_category contract is unit-pinned (the
+ * apply-side -- updateSession + governor.releaseSlot + activeTeams.delete -- stays
+ * in spawnTeamProcess, exercised by spawn-path-unified.test.ts).
+ */
+export declare function governorDeniedSessionUpdate(): {
+    status: string;
+    exit_reason: string;
+    exit_category: string;
+};
+/**
+ * The terminal session-update payload written when a required OS sandbox cannot
+ * initialize and the spawn is refused (fail-closed). Pure -- the caller adds
+ * `ended_at` and calls updateSession. Exported so the sandbox-unavailable
+ * exit_category contract is unit-pinned.
+ */
+export declare function sandboxUnavailableSessionUpdate(message: string): {
+    status: string;
+    exit_reason: string;
+    exit_category: string;
+};
+/**
+ * Inputs to spawnTeamProcess -- the final phase that takes a fully-resolved
+ * spawn (env constituents, args, message, session, backend) and actually
+ * launches the team-lead child process.
+ */
+export interface SpawnTeamProcessArgs {
+    config: DaemonConfig;
+    focusId: string;
+    focusName: string;
+    session: Awaited<ReturnType<typeof createSession>>;
+    teamState: FocusTeamState;
+    backend: AgentBackend;
+    args: string[];
+    /** Composed prompt on a fresh spawn, or the resume-delta when resuming. */
+    messageToSend: string;
+    logs: ReturnType<typeof setupTeamLogStreams>;
+    worktreePath: string;
+    resumeId: string | null;
+    assemblyManifest: AssemblyManifestEntry[];
+    spawnCodexHome: string | undefined;
+    spawnLocalModelKey: string | null;
+    isLocalModelPass: boolean;
+    effectiveModel: string | null;
+    pendingDirective: ReturnType<typeof consumePendingSpawnDirective>;
+    spawnStageName: string | null;
+    params: SpawnFocusTeamParams;
+    /**
+     * The resource governor (or null when none is injected). Threaded in from the
+     * orchestrator because the governor state binding lives in focus-executor.ts;
+     * this seam must not import it back (cycle rule).
+     */
+    governor: ResourceGovernor | null;
+    /**
+     * The orchestrator spawnFocusTeam, threaded in so the resume-failure respawn
+     * (handleTeamProcessClose) can re-enter the spawn path. spawnFocusTeam stays in
+     * focus-executor.ts; threading it here avoids a back-edge import (cycle rule).
+     */
+    spawnFocusTeam: (params: SpawnFocusTeamParams) => Promise<void>;
+}
+export interface BackendSpawnGateResult {
+    allowed: boolean;
+    reason?: string;
+}
+/**
+ * Local-model passes depend on a host CLI, so refuse the process launch when
+ * the backend's existing availability probe says it cannot run. Cloud passes
+ * retain their existing behavior because their authentication can be supplied
+ * by the per-spawn environment after the host-level probe runs.
+ */
+export declare function gateLocalModelBackendSpawn(backend: AgentBackend, config: DaemonConfig, isLocalModelPass: boolean, host?: string): Promise<BackendSpawnGateResult>;
+export declare function backendUnavailableSessionUpdate(reason: string, category?: string): {
+    status: string;
+    exit_reason: string;
+    exit_category: string;
+};
+/** Attach the error listener in the same synchronous stack frame as spawn(). */
+export declare function spawnCrashIsolated(command: string, args: readonly string[], options: SpawnOptionsWithoutStdio, onError: (error: Error) => void, spawnFn?: typeof spawn): ChildProcessWithoutNullStreams;
+/** Ensure a terminal spawn failure is persisted after any in-flight running transition. */
+export declare function persistSpawnFailureAfterRunning(runningTransition: Promise<unknown> | null, persistFailure: () => Promise<unknown>): Promise<void>;
+/**
+ * Final phase: build the levered spawn environment, persist the assembly
+ * manifest, write the session lifecycle (starting -> running), acquire the
+ * governor slot, wrap the command in the sandbox (fail-closed), spawn the
+ * child, write its stdin, and attach the completion/close/error handlers.
+ *
+ * Owns ALL of its early-return cleanups so the team-state map and governor slot
+ * never leak: governor-denied (exit_category 'governor_denied') and
+ * sandbox-unavailable (exit_category 'sandbox_unavailable') both mark the
+ * session terminal, release the governor slot where one was held, remove the
+ * team from activeTeams, and return without spawning. Behavior byte-identical
+ * to the original inline tail of spawnFocusTeam.
+ */
+/**
+ * Close a team's local-model translating proxy if one is engaged, and null it so
+ * the call is idempotent across the multiple teardown paths. No-op for every
+ * hosted/Claude/flag-off team (mcpProxy undefined/null).
+ */
+export declare function closeTeamProxyQuietly(teamState: FocusTeamState): void;
+export declare function spawnTeamProcess(spec: SpawnTeamProcessArgs): Promise<void>;
+//# sourceMappingURL=process-spawn.d.ts.map

package/dist/spawn/process-spawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-spawn.d.ts","sourceRoot":"","sources":["../../src/spawn/process-spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,8BAA8B,EAAE,KAAK,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE/G,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EAEd,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAInE,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EACL,mBAAmB,EAGpB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE;;;;;;GAMG;AACH,wBAAgB,2BAA2B,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAM5G;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,GACd;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAMhE;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC;IACnD,SAAS,EAAE,cAAc,CAAC;IAC1B,OAAO,EAAE,YAAY,CAAC;IACtB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,qBAAqB,EAAE,CAAC;IAC1C,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC;IAClE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,oBAAoB,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,cAAc,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,YAAY,EACpB,gBAAgB,EAAE,OAAO,EACzB,IAAI,SAAa,GAChB,OAAO,CAAC,sBAAsB,CAAC,CAqBjC;AAED,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,EACd,QAAQ,SAAwB,GAC/B;IACD,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,CAMA;AAGD,gFAAgF;AAChF,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,wBAAwB,EACjC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,EAC/B,OAAO,GAAE,OAAO,KAAa,GAC5B,8BAA8B,CAuBhC;AAED,2FAA2F;AAC3F,wBAAsB,+BAA+B,CACnD,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,EAC1C,cAAc,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;;;;;;;;;;;;GAYG;AACH;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,cAAc,GAAG,IAAI,CAKrE;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsQhF"}