amicus 4.6.1 → 4.6.3

package/src/utils/model-tiers.js

@@ -28,7 +28,13 @@ const { pickCurrent } = require('./quick-picks');
 const { isDirectProvider } = require('./provider-registry');
 const { toDefaultAliases, listCuratedRoutes } = require('./curated-models');
 
-/** Tier regex table: pattern matches the model segment after `<vendor>/` (or `openrouter/<vendor>/`). */
+/**
+ * Tier pattern table: each tier holds a regex — or an ORDERED regex list,
+ * tried first-match-wins — over the model segment after `<vendor>/` (or
+ * `openrouter/<vendor>/`). List order expresses preference, which a single
+ * regex cannot: ids sort numeric-descending, so `-pro` siblings would
+ * otherwise outrank their same-priced base.
+ */
 const TIERS = {
   anthropic: {
     economy: /^claude-haiku-/,
@@ -36,9 +42,17 @@ const TIERS = {
     frontier: /^claude-opus-/,
   },
   openai: {
-    economy: /^gpt-[\d.]+-mini$/,
-    balanced: /^gpt-[\d.]+$/,
-    frontier: /^gpt-[\d.]+-pro$/,
+    // The 5.6 line renamed the flagship into tiers — luna ($0.10/$0.60 per
+    // Mtok in/out), terra ($1/$6), sol ($5/$30), each with a -pro sibling
+    // priced at its base tier; no bare/-mini/-pro 5.6 ids exist. Owner
+    // ruling 2026-08-04: economy→luna, balanced→terra, frontier→sol, each
+    // preferring the base name, then its -pro sibling, then the 5.5-era
+    // naming so a stale catalog still resolves. balanced's primary is the
+    // same bare-or-terra pattern the `gpt` family uses (curated-models.js),
+    // so a future return to bare flagship ids is tracked automatically.
+    economy: [/^gpt-[\d.]+-luna$/, /^gpt-[\d.]+-luna-pro$/, /^gpt-[\d.]+-mini$/],
+    balanced: [/^gpt-[\d.]+(-terra)?$/, /^gpt-[\d.]+-terra-pro$/],
+    frontier: [/^gpt-[\d.]+-sol$/, /^gpt-[\d.]+-sol-pro$/, /^gpt-[\d.]+-pro$/],
   },
   google: {
     economy: /^gemini-[\d.]+-flash-lite/,
@@ -77,9 +91,16 @@ function buildGatewayOnlyAliasMap() {
 
 const GATEWAY_ONLY_ALIAS = buildGatewayOnlyAliasMap();
 
-/** Newest catalog id matching `regex` under `vendor`; direct namespace preferred over OpenRouter's. */
-function pickForTier(catalog, vendor, regex) {
-  return pickCurrent(catalog, '', vendor, regex) || pickCurrent(catalog, 'openrouter/', vendor, regex);
+/**
+ * First match wins over a tier's ordered patterns; within each pattern the
+ * newest matching id is picked, direct namespace preferred over OpenRouter's.
+ */
+function pickForTier(catalog, vendor, patterns) {
+  for (const regex of [].concat(patterns)) {
+    const pick = pickCurrent(catalog, '', vendor, regex) || pickCurrent(catalog, 'openrouter/', vendor, regex);
+    if (pick) { return pick; }
+  }
+  return null;
 }
 
 /** True when the catalog has ANY row (any tier) under this vendor's namespace, in either gateway. */

package/src/utils/no-output-backstop.js

@@ -0,0 +1,48 @@
+/**
+ * @module utils/no-output-backstop
+ * v4.6.2 PR2 (spec §5, D4): fail a headless leg fast when the model produces
+ * ZERO output, reasoning, and tool calls — the "accepted but not serving"
+ * class (the v4.6.1 gemini release-gate incident: requests accepted, zero
+ * tokens, three suites burned 130s timeouts each to learn nothing).
+ *
+ * Pure state machine, loop-driven (no timers of its own — the poll loop
+ * ticks it): armed at leg start, DISARMED PERMANENTLY by the first
+ * `progressed` tick (a 30-90s cold-prefill local model is never affected),
+ * fired when the deadline passes with nothing ever observed. `fired` is
+ * terminal. `ms <= 0` never arms — 0 is the documented escape hatch, which
+ * is why the env resolver uses envNumber (explicit 0 honored) rather than
+ * the `Number(env) || default` idiom.
+ *
+ * PR3's live probe reuses this with a 30s override — ms is an input; only
+ * the exported resolver reads the environment.
+ */
+'use strict';
+
+const { envNumber } = require('./env-num');
+
+const DEFAULT_NO_OUTPUT_BACKSTOP_MS = 120000;
+
+/** @param {object} [env] test seam; defaults to process.env */
+function resolveNoOutputBackstopMs(env) {
+  return envNumber('AMICUS_NO_OUTPUT_BACKSTOP_MS', DEFAULT_NO_OUTPUT_BACKSTOP_MS, env);
+}
+
+/**
+ * @param {{ms:number, startedAt:number}} opts
+ * @returns {{tick:(progressed:boolean, nowMs:number)=>string, state:()=>string}}
+ */
+function createNoOutputBackstop({ ms, startedAt }) {
+  let state = ms > 0 ? 'armed' : 'disarmed';
+  const deadline = startedAt + ms;
+  return {
+    tick(progressed, nowMs) {
+      if (state !== 'armed') { return state; }
+      if (progressed) { state = 'disarmed'; return state; }
+      if (nowMs >= deadline) { state = 'fired'; }
+      return state;
+    },
+    state() { return state; },
+  };
+}
+
+module.exports = { resolveNoOutputBackstopMs, createNoOutputBackstop, DEFAULT_NO_OUTPUT_BACKSTOP_MS };

package/src/utils/remediation-hints.js

@@ -87,6 +87,20 @@ const REMEDIATION_HINTS = Object.freeze({
    */
   sweepSessionIndexTmp:
     'amicus doctor --fix  (sweeps orphaned .sessions-index.json.*.tmp files left by an interrupted write)',
+
+  /**
+   * Orphaned per-session metadata.json.*.tmp files (v4.6.3 PR3 Task 3 / D8):
+   * same producer shape as sweepSessionIndexTmp above, one level down — a
+   * kill between an atomic write's tmp-write and rename leaves a stray temp
+   * file in a session directory forever. `doctor --fix` sweeps files older
+   * than 60s (never a live writer's ms-lived tmp).
+   *
+   * Voice ruling (Christian, 2026-08-03, sweepSessionIndexTmp above): applies
+   * verbatim here — the cause is definitional, not a guess, so this hint also
+   * keeps its confident voice rather than the unverified-cause voice.
+   */
+  sweepSessionMetadataTmp:
+    'amicus doctor --fix  (sweeps orphaned .metadata.json.*.tmp files left by an interrupted write)',
 });
 
 module.exports = REMEDIATION_HINTS;

package/src/utils/result-schema.js

@@ -192,10 +192,32 @@ function buildCatalogDoc({ models, fetchedAt, refreshed = false, search = null,
  * of curated DEFAULT aliases (toGatewayRoutes() vs. the live catalog),
  * distinct from the flat `stale` audit above. Defaults to [] so existing
  * callers that omit it are unaffected.
+ * `drifted` (v4.6.2 PR1, 2A) is additive: stored user-config aliases whose
+ * target is still catalog-live but behind the current quick-pick family
+ * resolution (findDriftedStoredAliases). Defaults to [] so existing callers
+ * that omit it are unaffected. Paired with an additive `driftedCount`
+ * (drifted.length), mirroring the staleCount/stale and
+ * gatewayFindingsCount/gatewayFindings pairs above.
+ * `probe` (v4.6.2 PR3, spec §6 D5) is additive: the `--live` opt-in per-alias
+ * probe outcomes (probeStoredAliases — served/accepted-but-silent/error), one
+ * row per stored alias actually probed. Defaults to [] so every call without
+ * --live (i.e. every existing caller) is unaffected. Paired with an additive
+ * `probeCount` (probe.length), mirroring the driftedCount/drifted pair above.
+ * `probeSkipped` (v4.6.2 PR3 Task 4) is additive: null when the probe ran or
+ * `--live` wasn't requested; otherwise a stable reason slug (e.g.
+ * 'catalog-unavailable') for the one case this function can see — the
+ * `--refresh --check --live` skip (runRefresh returns before this is ever
+ * called) is announced by the caller instead, since that path emits a
+ * model-catalog doc, not this one.
  * @param {{stale: Array<{alias,model,source,suggestions}>, catalogAvailable: boolean,
- *   gatewayFindings?: Array<{alias,gateway,kind,model,expected?}>}} opts
+ *   gatewayFindings?: Array<{alias,gateway,kind,model,expected?}>,
+ *   drifted?: Array<{alias,stored,current}>,
+ *   probe?: Array<{alias,target,outcome,detail,cost}>,
+ *   probeSkipped?: string|null}} opts
  */
-function buildAuditDoc({ stale, catalogAvailable, gatewayFindings = [] }) {
+function buildAuditDoc({
+  stale, catalogAvailable, gatewayFindings = [], drifted = [], probe = [], probeSkipped = null
+}) {
   return {
     schemaVersion: SCHEMA_VERSION,
     type: 'alias-audit',
@@ -204,6 +226,11 @@ function buildAuditDoc({ stale, catalogAvailable, gatewayFindings = [] }) {
     stale,
     gatewayFindingsCount: gatewayFindings.length,
     gatewayFindings,
+    driftedCount: drifted.length,
+    drifted,
+    probeCount: probe.length,
+    probe,
+    probeSkipped,
   };
 }
 

package/src/utils/session-metadata-tmp-sweep.js

@@ -0,0 +1,136 @@
+// src/utils/session-metadata-tmp-sweep.js
+'use strict';
+
+/**
+ * v4.6.3 PR3 Task 3 (D8): orphaned per-session metadata.json.*.tmp sweep for
+ * `amicus doctor --fix`.
+ *
+ * A kill between writeFileAtomic's tmp-write and rename (any of the ~30
+ * metadata.json write sites — session-manager.js, sidecar/session-finalize.js,
+ * etc.) leaves a stray `.metadata.json.<pid>.<hex>.tmp` file in a session
+ * directory forever (the B09 orphan class). This module lists and removes
+ * them; src/cli-handlers-doctor.js composes the result into a check line.
+ * Structurally mirrors utils/session-index-tmp-sweep.js (B15's sibling).
+ *
+ * Enumeration decision (cwd-scoped, index rejected — recorded at plan time,
+ * docs/superpowers/plans/2026-08-05-v463-pr3-cli-doctor-odds.md): this walks
+ * `<process.cwd()>/.claude/amicus_sessions/` — each taskId dir plus its
+ * `subagents/<id>/` children — rather than consulting sessions-index.json.
+ * `amicus doctor` is a per-project surface; the index is best-effort and can
+ * point at OTHER projects (issue #40's cross-project fallback exists exactly
+ * because the index can be stale). Trusting it here to decide which
+ * directories a --fix sweep may unlink from risks touching an unrelated
+ * project on stale data — the wrong failure direction for a destructive
+ * operation. Walking the cwd-scoped tree directly can only ever find/remove
+ * files under the project doctor is already running against.
+ *
+ * Symlink safety (Task 3 review carry, v4.6.3 PR3): every stat in this walk
+ * is lstatSync, never statSync — this module never follows symlinks. A
+ * symlinked taskId or subagents directory could otherwise be traversed and
+ * have files unlinked through the link, effectively outside the sessions
+ * root; lstat closes that off at zero cost.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const HINTS = require('./remediation-hints');
+
+/** Files older than this survive to the next --fix, never a live writer's ms-lived tmp. */
+const AGE_THRESHOLD_MS = 60 * 1000;
+
+/** The cwd-scoped sessions root: <cwd>/.claude/amicus_sessions. */
+function sessionsRoot() {
+  const { SESSIONS_DIR } = require('../session-manager');
+  return path.join(process.cwd(), '.claude', SESSIONS_DIR);
+}
+
+/** True when `basename` is an orphaned metadata tmp file (not e.g. progress.json.*.tmp). */
+function isMetadataTmp(basename) {
+  return basename.startsWith('.metadata.json.') && basename.endsWith('.tmp');
+}
+
+/** List metadata tmp files directly inside `dir`, named relative to `root`. */
+function listTmpIn(dir, root) {
+  let entries;
+  try { entries = fs.readdirSync(dir); } catch { return []; }
+  return entries
+    .filter(isMetadataTmp)
+    .map((basename) => {
+      let mtimeMs = null;
+      try { mtimeMs = fs.lstatSync(path.join(dir, basename)).mtimeMs; } catch { /* raced away — skip below */ }
+      return { name: path.relative(root, path.join(dir, basename)), mtimeMs };
+    })
+    .filter((f) => f.mtimeMs !== null);
+}
+
+/**
+ * List orphaned per-session metadata.json.*.tmp files under the cwd-scoped
+ * sessions root, covering both `<taskId>/` and `<taskId>/subagents/<id>/`.
+ * @returns {Array<{name: string, mtimeMs: number}>}
+ */
+function listSessionMetadataTmpFiles() {
+  const { SUBAGENTS_DIR } = require('../session-manager');
+  const root = sessionsRoot();
+  let taskIds;
+  try { taskIds = fs.readdirSync(root); } catch { return []; }
+  const found = [];
+  for (const taskId of taskIds) {
+    const taskDir = path.join(root, taskId);
+    let stat;
+    try { stat = fs.lstatSync(taskDir); } catch { continue; }
+    if (!stat.isDirectory()) { continue; }
+    found.push(...listTmpIn(taskDir, root));
+
+    const subagentsDir = path.join(taskDir, SUBAGENTS_DIR);
+    let subIds;
+    try { subIds = fs.readdirSync(subagentsDir); } catch { continue; }
+    for (const subId of subIds) {
+      const subDir = path.join(subagentsDir, subId);
+      let subStat;
+      try { subStat = fs.lstatSync(subDir); } catch { continue; }
+      if (!subStat.isDirectory()) { continue; }
+      found.push(...listTmpIn(subDir, root));
+    }
+  }
+  return found;
+}
+
+/** Delete one orphaned tmp file by name (relative to the sessions root; never an absolute/caller path). */
+function unlinkSessionMetadataTmp(name) {
+  const root = sessionsRoot();
+  fs.unlinkSync(path.join(root, name));
+}
+
+/**
+ * Compose the doctor check line for the metadata tmp-orphan sweep. Pure
+ * decision logic (list/sweep side effects come in via `d`); src/cli-handlers-doctor.js
+ * wraps this in guard() the same way it wires the sibling sessions-index-tmp check.
+ * @param {{listSessionMetadataTmpFiles: () => Array<{name:string, mtimeMs:number}>,
+ *   fix?: boolean, now: () => number, unlinkSessionMetadataTmp: (name: string) => void}} d
+ */
+function evaluateSessionMetadataTmpSweep(d) {
+  const id = 'session-metadata-tmp'; const name = 'Session metadata tmp files';
+  const files = d.listSessionMetadataTmpFiles() || [];
+  if (files.length === 0) {
+    return { id, name, status: 'ok', message: '0 orphaned tmp files', hint: null };
+  }
+  if (!d.fix) {
+    return { id, name, status: 'warn', message: `${files.length} orphaned tmp file(s) — run with --fix`, hint: HINTS.sweepSessionMetadataTmp };
+  }
+  const nowMs = d.now();
+  const sweepable = files.filter((f) => (nowMs - f.mtimeMs) > AGE_THRESHOLD_MS);
+  let swept = 0;
+  for (const f of sweepable) {
+    try { d.unlinkSessionMetadataTmp(f.name); swept += 1; } catch { /* best-effort — report what we got */ }
+  }
+  const remaining = files.length - swept;
+  if (remaining === 0) {
+    const fixFields = swept > 0 ? { fixed: true, fixDetail: `swept ${swept} orphaned session-metadata tmp file(s)` } : {};
+    return { id, name, status: 'ok', message: `swept ${swept} orphaned tmp file(s)`, hint: null, ...fixFields };
+  }
+  return { id, name, status: 'warn', message: `swept ${swept}, ${remaining} remaining (too fresh or unremovable)`, hint: HINTS.sweepSessionMetadataTmp };
+}
+
+module.exports = {
+  AGE_THRESHOLD_MS, listSessionMetadataTmpFiles, unlinkSessionMetadataTmp, evaluateSessionMetadataTmpSweep,
+};

package/src/workspace/live-normalize.js

@@ -126,6 +126,7 @@ function normalizeLive(doc) {
     stageName: active ? active.name : null,
     stages,
     seats: legRowsOf(doc).map(seatOf),
+    degrades: Array.isArray(doc.degrades) ? doc.degrades : [],
     // ⚠️ v4.4.1 RN-8 (D1 ruling: delete the promise). `legsTotal`/`legsComplete` used to be
     // mapped here under a comment promising them as "the honest fallback readout if a seat row
     // is ever unavailable" — a UI fallback nobody ever wired. Nothing in electron/workspace-ui/