amicus 4.4.1 → 4.5.1

package/src/sidecar/progress.js

@@ -130,6 +130,39 @@ function writeProgress(sessionDir, stage, extra = {}) {
   writeFileAtomic(progressPath, JSON.stringify(data), { mode: 0o600 });
 }
 
+/**
+ * FR-1 (v4.5): stamp a TERMINAL stage into progress.json on a failure path,
+ * preserving previously recorded usage. Extracted from headless.js's A3 outer
+ * catch so the early-return paths and the exception path can never drift.
+ *
+ * writeProgress REBUILDS progress.json (no merge) — a bare terminal write would
+ * delete whatever real spend the last flush recorded, trading a stale-stage bug
+ * for a cost under-report on exactly the legs that failed. So the prior usage is
+ * read back and re-attached; `extra` fields beyond usage are deliberately
+ * dropped (readProgress derives message counts from conversation.jsonl).
+ *
+ * Runs on error paths: must never throw and never mask the original error.
+ *
+ * @param {string} sessionDir
+ * @param {string} errorMessage - the failure being recorded (stage derives from it)
+ * @returns {boolean} true if the terminal record was written
+ */
+function writeTerminalProgressSafe(sessionDir, errorMessage) {
+  try {
+    let priorUsage = null;
+    try {
+      const prior = JSON.parse(fs.readFileSync(path.join(sessionDir, 'progress.json'), 'utf-8'));
+      if (prior && prior.usage) { priorUsage = prior.usage; }
+    } catch { /* no readable prior record: write the terminal stage without usage */ }
+    const { resolveTerminalState } = require('./session-finalize');
+    const stage = resolveTerminalState({ error: errorMessage }).status;
+    writeProgress(sessionDir, stage, priorUsage ? { usage: priorUsage } : {});
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Read progress from a session's conversation.jsonl and progress.json files.
  *
@@ -242,6 +275,7 @@ function readProgress(sessionDir) {
 module.exports = {
   readProgress,
   writeProgress,
+  writeTerminalProgressSafe,
   extractLatest,
   computeLastActivity,
   STAGE_LABELS,

package/src/sidecar/start.js

@@ -35,7 +35,7 @@ function generateTaskId() {
 
 /** Create session directory and save metadata */
 function createSessionMetadata(taskId, project, options) {
-  const { model, prompt, briefing, noUi, headless, agent, thinking } = options;
+  const { model, prompt, briefing, noUi, headless, agent, thinking, pack } = options;
 
   const sessionDir = SessionPaths.sessionDir(project, taskId);
   fs.mkdirSync(sessionDir, { recursive: true, mode: 0o700 });
@@ -65,7 +65,8 @@ function createSessionMetadata(taskId, project, options) {
     thinking: thinking || 'medium',
     status: 'running',
     pid: existing.pid || process.pid,
-    createdAt: existing.createdAt || new Date().toISOString()
+    createdAt: existing.createdAt || new Date().toISOString(),
+    ...(pack ? { pack } : {}), // v4.5 Task 13: absent-not-null; ...existing above preserves a prior write when this call omits pack.
   };
 
   writeFileAtomic(metaPath, JSON.stringify(metadata, null, 2), { mode: 0o600 });
@@ -153,7 +154,7 @@ async function startSidecar(options) {
     contextMaxTokens = 80000, noUi, headless = false, timeout = 15,
     agent, mcp, mcpConfig, summaryLength = 'normal', thinking,
     client, sessionDir, noMcp, excludeMcp, opencodePort, coworkProcess, includeContext = true,
-    position = 'right', json = false, modelInput = null
+    position = 'right', json = false, modelInput = null, pack = null
   } = options;
 
   const effectivePrompt = prompt || briefing;
@@ -182,7 +183,7 @@ async function startSidecar(options) {
   );
 
   const sessDir = createSessionMetadata(taskId, effectiveProject, {
-    model, prompt: effectivePrompt, noUi: effectiveHeadless, agent, thinking
+    model, prompt: effectivePrompt, noUi: effectiveHeadless, agent, thinking, pack
   });
   saveInitialContext(sessDir, systemPrompt, userMessage);
   acquireLock(sessDir, effectiveHeadless ? 'headless' : 'interactive');

package/src/sidecar/workspace-auto-open.js

@@ -0,0 +1,83 @@
+/**
+ * Workspace Auto-Open Decision Helper
+ *
+ * Pure helper to determine whether the Council Workspace should auto-open
+ * on MCP council runs from Claude Code (local). Returns the decision and reason.
+ *
+ * Decision order (spec §6 guard 4):
+ * 1. uiParam === false → 'param-suppressed' (explicit user request beats everything, checked first)
+ * 2. Hard guards (always checked, beat even explicit true):
+ *    - electron package-missing → 'electron-absent'
+ *    - electron binary-missing → 'electron-broken: …' (#76: package present but
+ *      the exe never arrived — a repairable state the old boolean conflated
+ *      with never-installed; the reason names the dir and the fix)
+ *    - platform === 'linux' && !env.DISPLAY → 'no-display'
+ * 3. uiParam === true → 'ok' (explicit request overrides config and client gate, never hard guards)
+ * 4. autoOpenConfig === false → 'config-disabled'
+ * 5. client !== 'code-local' → 'client-not-code-local'
+ * 6. else → 'ok'
+ *
+ * @param {object} options
+ * @param {string} options.client - The client type (e.g., 'code-local', 'cowork', 'code-web')
+ * @param {boolean} [options.electronUsable] - Legacy boolean probe (used only when electronState is absent)
+ * @param {'ok'|'package-missing'|'binary-missing'} [options.electronState] - 3-state probe (#76); takes precedence
+ * @param {string|null} [options.electronDir] - Resolved electron dir, named in the electron-broken reason
+ * @param {string} options.platform - The platform (e.g., 'win32', 'darwin', 'linux')
+ * @param {object} options.env - Environment variables object
+ * @param {boolean} options.autoOpenConfig - The config.workspace.autoOpen setting
+ * @param {boolean|undefined} options.uiParam - Explicit UI parameter (true, false, or undefined)
+ * @returns {{open: boolean, reason: string}}
+ */
+function shouldAutoOpenWorkspace({
+  client,
+  electronUsable,
+  electronState,
+  electronDir,
+  platform,
+  env,
+  autoOpenConfig,
+  uiParam,
+}) {
+  // Step 1: uiParam === false beats everything (checked first)
+  if (uiParam === false) {
+    return { open: false, reason: 'param-suppressed' };
+  }
+
+  // Step 2: Hard guards (always checked, beat even explicit uiParam === true).
+  // electronState (3-state, #76) wins over the legacy electronUsable boolean,
+  // whose false collapses to package-missing (the old 'electron-absent').
+  const state = electronState || (electronUsable ? 'ok' : 'package-missing');
+  if (state === 'package-missing') {
+    return { open: false, reason: 'electron-absent' };
+  }
+  if (state === 'binary-missing') {
+    const where = electronDir ? ` under ${electronDir}` : '';
+    return { open: false, reason: `electron-broken: binary missing${where} — run \`amicus doctor --fix\`` };
+  }
+
+  if (platform === 'linux' && !env.DISPLAY) {
+    return { open: false, reason: 'no-display' };
+  }
+
+  // Step 3: uiParam === true overrides config and client gate (but not hard guards)
+  if (uiParam === true) {
+    return { open: true, reason: 'ok' };
+  }
+
+  // Step 4: autoOpenConfig === false
+  if (autoOpenConfig === false) {
+    return { open: false, reason: 'config-disabled' };
+  }
+
+  // Step 5: client !== 'code-local'
+  if (client !== 'code-local') {
+    return { open: false, reason: 'client-not-code-local' };
+  }
+
+  // Step 6: else
+  return { open: true, reason: 'ok' };
+}
+
+module.exports = {
+  shouldAutoOpenWorkspace,
+};

package/src/sidecar/workspace-window.js

@@ -59,4 +59,49 @@ async function launchWorkspaceWindow({ project, runId = '' }, deps = {}) {
   });
 }
 
-module.exports = { launchWorkspaceWindow };
+/**
+ * v4.5 auto-open: fire-and-forget Workspace launch for the MCP path.
+ * DELIBERATELY different from launchWorkspaceWindow above:
+ * - never provisions (isElectronUsable check only — ensureElectron can
+ *   DOWNLOAD Electron, which auto-open guard 3 forbids);
+ * - no stdout relay (the caller may be an MCP stdio server whose stdout IS
+ *   the JSON-RPC channel — relaying would corrupt the protocol);
+ * - detached + unref, returns immediately (the sibling's promise resolves
+ *   only when the window CLOSES, which no request path may wait on).
+ * @param {{project: string, runId?: string}} opts
+ * @param {{isElectronUsable?: Function, resolveElectronBinary?: Function, spawn?: Function}} [deps]
+ * @returns {{launched: boolean, reason?: string}}
+ */
+function launchWorkspaceWindowDetached({ project, runId = '' }, deps = {}) {
+  const usable = deps.isElectronUsable || require('./electron-install').isElectronUsable;
+  const resolveExe = deps.resolveElectronBinary || require('./electron-install').resolveElectronBinary;
+  const spawnFn = deps.spawn || spawn;
+  if (!usable()) { return { launched: false, reason: 'electron-absent' }; }
+  const electronPath = resolveExe() || getElectronPath();
+  const mainPath = path.join(__dirname, '..', '..', 'electron', 'main.js');
+  const env = {
+    ...process.env,
+    AMICUS_MODE: 'council-workspace',
+    AMICUS_PROJECT: project,
+    AMICUS_RUN_ID: runId || '',
+    AMICUS_FOLD_NONCE: generateFoldNonce(),
+  };
+  try {
+    const proc = spawnFn(electronPath, [mainPath], { env, detached: true, stdio: 'ignore' });
+    // Node emits spawn failures (ENOENT/EACCES/corrupt binary) as an async
+    // 'error' event on the child; an unlistened ChildProcess 'error' is an
+    // uncaught exception. The MCP server (`amicus mcp`) installs no
+    // uncaughtException handler (bin/amicus.js only does that for
+    // start/continue), so that would kill the JSON-RPC channel. Best-effort:
+    // just log it, matching the fire-and-forget contract of this function.
+    proc.on('error', (err) => logger.debug('Workspace auto-open child failed (best-effort)', { error: err.message }));
+    proc.unref();
+    logger.info('Auto-opened council workspace (detached)', { runId: runId || '(run list)' });
+    return { launched: true };
+  } catch (err) {
+    logger.debug('Workspace auto-open spawn failed (best-effort)', { error: err.message });
+    return { launched: false, reason: `spawn-failed: ${err.message}` };
+  }
+}
+
+module.exports = { launchWorkspaceWindow, launchWorkspaceWindowDetached };

package/src/template/apply.js

@@ -0,0 +1,88 @@
+// src/template/apply.js
+'use strict';
+
+/**
+ * @module template/apply
+ * F9 (v4.5): the one seam that turns (--template, --prompt, --artifact, --var)
+ * into a rendered briefing + template-sourced promptMeta. Used by the three CLI
+ * run commands and by pack-resolve for a pack's briefing.template (which is how
+ * templates reach MCP callers — MCP has no template params of its own).
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { ERROR_CODES } = require('../utils/error-doc');
+const { resolveTemplate } = require('./store');
+const { renderTemplate } = require('./render');
+
+const ARTIFACT_CAP_BYTES = 256 * 1024;
+
+/**
+ * @param {{templateRef: string, prompt?: string, artifactFile?: string,
+ *          varList?: string[], project: string}} opts
+ * @returns {{prompt, promptMeta, notices} | {error: {code, message, hint}}}
+ */
+function applyTemplate({ templateRef, prompt, artifactFile, varList, project }) {
+  const tpl = resolveTemplate(templateRef);
+  if (tpl.error) {
+    return { error: { code: ERROR_CODES.TEMPLATE_NOT_FOUND, message: tpl.error, hint: 'amicus template list' } };
+  }
+
+  const vars = {};
+  // F4 (Task-5 review): parseArgs' inline `--var=k=v` form takes the single-value
+  // branch, not the array-accumulation one, so varList arrives as a bare string
+  // instead of a one-element array — wrap it rather than let `for..of` iterate
+  // its characters. parseArgs itself is unchanged (plan-mandated, shared with
+  // --exclude-mcp); this coercion is the seam that absorbs both shapes.
+  const varArr = Array.isArray(varList)
+    ? varList
+    : (varList !== undefined && varList !== null) ? [varList] : [];
+  for (const entry of varArr) {
+    const eq = String(entry).indexOf('=');
+    if (eq < 1) {
+      return { error: { code: ERROR_CODES.BAD_ARGS, message: `Error: --var expects key=value, got '${entry}'`, hint: null } };
+    }
+    vars[String(entry).slice(0, eq)] = String(entry).slice(eq + 1);
+  }
+
+  let artifact; let artifactPath;
+  if (artifactFile !== undefined) {
+    artifactPath = path.resolve(String(artifactFile));
+    let raw;
+    try {
+      raw = fs.readFileSync(artifactPath);
+    } catch (err) {
+      return { error: { code: ERROR_CODES.TEMPLATE_RENDER, message: `Error: cannot read --artifact ${artifactFile}: ${err.message}`, hint: null } };
+    }
+    if (raw.length > ARTIFACT_CAP_BYTES) {
+      return { error: { code: ERROR_CODES.TEMPLATE_RENDER, message: `Error: --artifact ${artifactFile} is ${raw.length} bytes; the cap is 256 KB`, hint: null } };
+    }
+    artifact = raw.toString('utf-8');
+    if (artifact.charCodeAt(0) === 0xFEFF) { artifact = artifact.slice(1); }
+  }
+
+  const res = renderTemplate(tpl.text, {
+    prompt,
+    artifact,
+    artifactPath,
+    date: new Date().toISOString().slice(0, 10),
+    project: String(project),
+    vars,
+  });
+  if (res.error) {
+    return { error: { code: ERROR_CODES.TEMPLATE_RENDER, message: res.error, hint: null } };
+  }
+
+  return {
+    prompt: res.text,
+    promptMeta: {
+      source: 'template',
+      file: tpl.path,
+      chars: res.text.length,
+      template: { name: tpl.name, hash: tpl.hash },
+    },
+    notices: res.notices,
+  };
+}
+
+module.exports = { applyTemplate, ARTIFACT_CAP_BYTES };

package/src/template/render.js

@@ -0,0 +1,86 @@
+// src/template/render.js
+'use strict';
+
+/**
+ * @module template/render
+ * F9 (v4.5): strict {{variable}} rendering for briefing templates. Expansion
+ * happens ONLY in template files (spec carried decision 7) — --prompt text is
+ * always literal, so this module never sees non-template input.
+ *
+ * v4.5 variable set. {{input}} is deliberately ABSENT — it ships with v4.6's
+ * --input-from; on v4.5 it fails as an unknown variable, which is accurate.
+ * No {{model}}: prompts are built once per wave, model-independent.
+ */
+
+const VAR_RE = /\{\{\s*([A-Za-z_][\w.]*)\s*\}\}/g;
+const KNOWN_VARIABLES = ['prompt', 'artifact', 'artifact_path', 'date', 'project', 'var.<key>'];
+
+function knownList() {
+  return KNOWN_VARIABLES.map((v) => `{{${v}}}`).join(', ');
+}
+
+/**
+ * Render a template with strict typo-safety rules:
+ * unknown variable -> error; slot present without its data -> error; data
+ * passed without its slot -> error ("silently dropped"); unused --var -> notice.
+ *
+ * @param {string} text - raw template text
+ * @param {{prompt?: string, artifact?: string, artifactPath?: string,
+ *          date: string, project: string, vars?: Object<string,string>}} data
+ * @returns {{text: string, notices: string[]} | {error: string}}
+ */
+function renderTemplate(text, data) {
+  const vars = data.vars || {};
+  const used = new Set();
+  for (const m of String(text).matchAll(VAR_RE)) { used.add(m[1]); }
+
+  for (const name of used) {
+    if (name.startsWith('var.')) {
+      const key = name.slice(4);
+      if (!(key in vars)) {
+        return { error: `Error: template uses {{var.${key}}} but no --var ${key}=<value> was given` };
+      }
+      continue;
+    }
+    if (!['prompt', 'artifact', 'artifact_path', 'date', 'project'].includes(name)) {
+      return { error: `Error: Unknown template variable {{${name}}}. Known: ${knownList()}` };
+    }
+  }
+
+  if (used.has('prompt') && data.prompt === undefined) {
+    return { error: 'Error: template has {{prompt}} but no --prompt/--prompt-file was given' };
+  }
+  if (!used.has('prompt') && data.prompt !== undefined) {
+    return { error: 'Error: --prompt/--prompt-file was given but the template has no {{prompt}} slot — the text would be silently dropped' };
+  }
+  const usesArtifact = used.has('artifact') || used.has('artifact_path');
+  if (used.has('artifact') && data.artifact === undefined) {
+    return { error: 'Error: template has {{artifact}} but no --artifact <file> was given' };
+  }
+  if (used.has('artifact_path') && data.artifactPath === undefined) {
+    return { error: 'Error: template has {{artifact_path}} but no --artifact <file> was given' };
+  }
+  if (!usesArtifact && (data.artifact !== undefined || data.artifactPath !== undefined)) {
+    return { error: 'Error: --artifact was given but the template has no {{artifact}}/{{artifact_path}} slot — the file would be silently dropped' };
+  }
+
+  const notices = [];
+  for (const key of Object.keys(vars)) {
+    if (!used.has(`var.${key}`)) {
+      notices.push(`Notice: --var ${key}=… is not used by this template`);
+    }
+  }
+
+  const rendered = String(text).replace(VAR_RE, (_, name) => {
+    if (name === 'prompt') { return data.prompt; }
+    if (name === 'artifact') { return data.artifact; }
+    if (name === 'artifact_path') { return data.artifactPath; }
+    if (name === 'date') { return data.date; }
+    if (name === 'project') { return data.project; }
+    return vars[name.slice(4)];
+  });
+
+  return { text: rendered, notices };
+}
+
+module.exports = { renderTemplate, KNOWN_VARIABLES };

package/src/template/store.js

@@ -0,0 +1,106 @@
+// src/template/store.js
+'use strict';
+
+/**
+ * @module template/store
+ * F9 (v4.5): briefing templates are Markdown files in <configDir>/templates/
+ * (peer of packs/). Name = basename sans .md. Built-ins are embedded strings,
+ * shadowed by a same-named user file — exactly the built-in-bench precedent
+ * (config.js getCouncilWithSource). No save/rm: your editor is the manager.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+// Lazy so jest.doMock / AMICUS_CONFIG_DIR re-pointing works per-test.
+function _getConfigDir() { return require('../utils/config').getConfigDir(); }
+
+/**
+ * v4.5 ships `review` only. `critique`/`refine` are {{input}}-centric and
+ * arrive with v4.6's chaining (--input-from).
+ */
+const BUILTIN_TEMPLATES = Object.freeze({
+  review: [
+    '# Review briefing',
+    '',
+    'You are reviewing the artifact below against the caller\'s focus.',
+    '',
+    '## Focus',
+    '',
+    '{{prompt}}',
+    '',
+    '## Artifact ({{artifact_path}})',
+    '',
+    '{{artifact}}',
+    '',
+    '## Instructions',
+    '',
+    '- Ground every finding in the artifact text and cite its location.',
+    '- Give each finding a severity: critical / major / minor / nit.',
+    '- If you find nothing at a severity, say so explicitly.',
+    '- End with a one-paragraph overall verdict.',
+    '',
+  ].join('\n'),
+});
+
+/** @returns {string} the user templates directory (peer of packs/) */
+function templatesDir() {
+  return path.join(_getConfigDir(), 'templates');
+}
+
+function hashText(text) {
+  return crypto.createHash('sha256').update(text, 'utf-8').digest('hex').slice(0, 12);
+}
+
+function stripBom(text) {
+  return text.charCodeAt(0) === 0xFEFF ? text.slice(1) : text;
+}
+
+/**
+ * @param {string} nameOrPath - a path when it contains a path separator or
+ *   ends in `.md`; otherwise a template name.
+ * @returns {{name, path: string|null, text, hash, builtin: boolean} | {error: string}}
+ */
+function resolveTemplate(nameOrPath) {
+  const v = String(nameOrPath);
+  const isPath = v.endsWith('.md') || v.includes('/') || v.includes(path.sep);
+  if (isPath) {
+    const abs = path.resolve(v);
+    let text;
+    try {
+      text = stripBom(fs.readFileSync(abs, 'utf-8'));
+    } catch (err) {
+      return { error: `Error: cannot read template ${v}: ${err.message}` };
+    }
+    return { name: path.basename(abs, '.md'), path: abs, text, hash: hashText(text), builtin: false };
+  }
+  const userFile = path.join(templatesDir(), `${v}.md`);
+  try {
+    const text = stripBom(fs.readFileSync(userFile, 'utf-8'));
+    return { name: v, path: userFile, text, hash: hashText(text), builtin: false };
+  } catch { /* fall through to built-ins */ }
+  if (Object.prototype.hasOwnProperty.call(BUILTIN_TEMPLATES, v)) {
+    const text = BUILTIN_TEMPLATES[v];
+    return { name: v, path: null, text, hash: hashText(text), builtin: true };
+  }
+  return { error: `Error: Template '${v}' not found (looked in ${templatesDir()} and built-ins)` };
+}
+
+/** @returns {Array<{name, builtin: boolean, shadowed: boolean}>} name-sorted */
+function listTemplates() {
+  const out = new Map();
+  for (const name of Object.keys(BUILTIN_TEMPLATES)) {
+    out.set(name, { name, builtin: true, shadowed: false });
+  }
+  let entries = [];
+  try { entries = fs.readdirSync(templatesDir()); } catch { /* no user dir yet */ }
+  for (const f of entries) {
+    if (!f.endsWith('.md')) { continue; }
+    const name = path.basename(f, '.md');
+    out.set(name, { name, builtin: false, shadowed: Object.prototype.hasOwnProperty.call(BUILTIN_TEMPLATES, name) });
+  }
+  return [...out.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+
+module.exports = { templatesDir, resolveTemplate, listTemplates, BUILTIN_TEMPLATES };

package/src/utils/config.js

@@ -401,14 +401,57 @@ function getCouncilWithSource(name, catalog = []) {
   return { members: null, builtin: false };
 }
 
+/**
+ * Per-member alias/catalog classification — the SAME check `resolveCouncilMembers`
+ * (below) uses to decide the real run path's bench, extracted so `amicus council
+ * show` (council/presets-cli.js) can reuse it verbatim instead of re-deriving a
+ * parallel (and, pre-v4.5-Wave-2, drifted) check. Each member is resolved to its
+ * full model id (alias → id via effective aliases; a member containing '/' is
+ * taken as-is) and that id checked against the cached catalog. Tri-state catalog
+ * rule: an EMPTY catalog (offline / never fetched) never drops anything —
+ * "unknown" is not "delisted" — and a local-vendor member is never dropped on
+ * catalog absence either way (v4.2 §4.4: a local server may simply have been off
+ * at the last refresh; the leg itself fails pre-flight with the actionable
+ * local_endpoint_unreachable error if it is truly down). Only a NON-EMPTY
+ * catalog that omits the resolved id is a definitive drop.
+ * @param {string[]} members raw council members (aliases or provider/model ids)
+ * @param {Array<{id:string}>} [catalog]
+ * @returns {{models:string[], dropped:string[], droppedMembers:Array<{member:string, reason:string}>}}
+ *   `dropped` is the flat member-ref list (unchanged shape, pre-v4.5-Wave-2
+ *   callers keep working); `droppedMembers` additively pairs each with WHY.
+ */
+function classifyCouncilMembers(members, catalog = []) {
+  const aliases = getEffectiveAliases();
+  const known = new Set((Array.isArray(catalog) ? catalog : []).map(m => m && m.id).filter(Boolean));
+  const { isLocalProvider } = require('./local-providers');
+  const models = [];
+  const dropped = [];
+  const droppedMembers = [];
+  for (const member of members) {
+    const id = member.includes('/') ? member : aliases[member];
+    if (!id) { // alias no longer resolves
+      dropped.push(member);
+      droppedMembers.push({ member, reason: 'alias no longer resolves to a known model' });
+      continue;
+    }
+    const vendor = typeof id === 'string' ? id.split('/')[0] : '';
+    if (isLocalProvider(vendor)) { models.push(member); continue; }
+    if (known.size > 0 && !known.has(id)) { // delisted model
+      dropped.push(member);
+      droppedMembers.push({ member, reason: 'resolved id is not present in the cached model catalog' });
+      continue;
+    }
+    models.push(member);
+  }
+  return { models, dropped, droppedMembers };
+}
+
 /**
  * Expand a saved council into a runnable members list, degrading gracefully.
- * Each member is resolved to its full model id (alias → id via effective
- * aliases; a member containing '/' is taken as-is) and that id checked against
- * the cached catalog. Unresolvable aliases and delisted ids are dropped with a
- * warning rather than fail-fast-aborting the whole wave. The catalog check is
- * skipped when the catalog is empty (offline). Returns members RAW (alias or
- * id) — leg-time validation resolves them again.
+ * Unresolvable aliases and delisted ids are dropped with a warning rather than
+ * fail-fast-aborting the whole wave (classification: classifyCouncilMembers
+ * above). Returns members RAW (alias or id) — leg-time validation resolves
+ * them again.
  *
  * Resolution order: user config (`config.councils`) is checked first; when
  * `name` is absent there, the built-in benches (`free`/`budget`/`frontier`)
@@ -416,7 +459,7 @@ function getCouncilWithSource(name, catalog = []) {
  * shadows a built-in of the same name.
  * @param {string} name
  * @param {Array<{id:string}>} [catalog]
- * @returns {{models:string[], dropped:string[]} | {error:string}}
+ * @returns {{models:string[], dropped:string[], droppedMembers:Array<{member:string, reason:string}>} | {error:string}}
  */
 function resolveCouncilMembers(name, catalog = []) {
   const { members } = getCouncilWithSource(name, catalog);
@@ -426,23 +469,7 @@ function resolveCouncilMembers(name, catalog = []) {
   if (!Array.isArray(members) || members.length === 0) {
     return { error: `Council '${name}' is empty. Run 'amicus setup' to populate it.` };
   }
-  const aliases = getEffectiveAliases();
-  const known = new Set((Array.isArray(catalog) ? catalog : []).map(m => m && m.id).filter(Boolean));
-  const { isLocalProvider } = require('./local-providers');
-  const models = [];
-  const dropped = [];
-  for (const member of members) {
-    const id = member.includes('/') ? member : aliases[member];
-    if (!id) { dropped.push(member); continue; }                 // alias no longer resolves
-    const vendor = typeof id === 'string' ? id.split('/')[0] : '';
-    // v4.2 §4.4: a local server may simply have been off at the last catalog
-    // refresh — that is "unknown", not "delisted". Never drop a local-vendor
-    // member on catalog absence; the leg itself fails pre-flight with the
-    // actionable local_endpoint_unreachable error if the server is truly down.
-    if (isLocalProvider(vendor)) { models.push(member); continue; }
-    if (known.size > 0 && !known.has(id)) { dropped.push(member); continue; } // delisted model
-    models.push(member);
-  }
+  const { models, dropped, droppedMembers } = classifyCouncilMembers(members, catalog);
   if (models.length < 2) {
     return {
       error: `Council '${name}' has fewer than 2 usable members` +
@@ -450,7 +477,7 @@ function resolveCouncilMembers(name, catalog = []) {
         '. Run \'amicus setup\' to refresh it.',
     };
   }
-  return { models, dropped };
+  return { models, dropped, droppedMembers };
 }
 
 /** @returns {{prefer:'direct'|'openrouter', migration_notified:Object}} routing config with defaults */
@@ -503,6 +530,17 @@ function hasTierOnboarded() {
   return !!(config.routing && config.routing.tier_onboarded === true);
 }
 
+/**
+ * v4.5 auto-open (spec §6 guard 4): the Workspace auto-opens on MCP council
+ * runs from Claude Code (local) unless config.workspace.autoOpen === false. Only an
+ * explicit false disables — absent/junk values stay ON (opt-out semantics).
+ * @returns {boolean}
+ */
+function getWorkspaceAutoOpen() {
+  const config = loadConfig() || {};
+  return !(config.workspace && config.workspace.autoOpen === false);
+}
+
 /**
  * Persist the one-time onboarding-notice flag, preserving any other routing
  * keys (prefer, tier, migration_notified). Best-effort: swallows any
@@ -562,6 +600,7 @@ module.exports = {
   getCouncils,
   getCouncil,
   getCouncilWithSource,
+  classifyCouncilMembers,
   resolveCouncilMembers,
   getRoutingConfig,
   resolveGatewayMode,
@@ -571,4 +610,5 @@ module.exports = {
   setCostTier,
   hasTierOnboarded,
   markTierOnboarded,
+  getWorkspaceAutoOpen,
 };