amicus 4.6.3 → 4.7.0

package/src/cli-handlers-council-run.js

@@ -11,82 +11,17 @@
 
 const path = require('path');
 const { failJson, buildErrorDoc, ERROR_CODES } = require('./utils/error-doc');
-const { validateTaskId } = require('./utils/validators');
+const { validateTaskId, validateTag } = require('./utils/validators');
 const { GATEWAY_MODES } = require('./utils/model-descriptor');
 // v4.6 Plan 4 Task 2: renderRunHuman moved to its own leaf (size gate); this
 // file re-exports it below so every existing require() of this path still
 // resolves it unchanged.
 const { renderRunHuman } = require('./cli-council-run-render');
+const { parseList, sanitizeCouncilName, resolveBench } = require('./cli-council-run-bench');
+const { applyTemplateForArgs } = require('./cli-template-args');
 
 const CHAIR_DEFAULT = 'deepseek';
 
-function parseList(value) {
-  return String(value).split(',').map(s => s.trim()).filter(Boolean);
-}
-
-/**
- * Sanitize the internal `--council-name` passthrough before it can reach the
- * spend ledger's `councilName` column (v4.3 Task 4 review fix, spec §7.3:
- * spend docs hold only ids/numbers/paths "by construction"). That value is
- * user-supplied (via mcp-council-run.js, ultimately an MCP caller's `input`),
- * unbounded, and unvalidated — unlike a real `--council <preset>`, which is
- * catalog-validated upstream. Strips control/non-printable characters, trims,
- * and caps length so a hostile/malformed passthrough can't land raw in a
- * `--group-by council` rollup. Precedence is untouched by this: it's applied
- * only to the passthrough branch, never to the catalog-validated preset name.
- * @param {string} name @returns {string|null} sanitized name, or null if empty after cleanup
- */
-function sanitizeCouncilName(name) {
-  // eslint-disable-next-line no-control-regex -- deliberately stripping C0/DEL control chars
-  const cleaned = String(name).replace(/[\x00-\x1F\x7F]/g, '').trim().slice(0, 64);
-  return cleaned || null;
-}
-
-/**
- * Resolve bench models from --models XOR --council (mirrors handleFanout).
- * Also returns `presetName` (v4.3 Task 3, spec §7.1: trimmed --council name,
- * else null) and `droppedMembers`: a preset's own drops, or — bare --models —
- * the parsed `--dropped-members` MCP→child passthrough (v4.6 Plan 4 Task 4b).
- */
-function resolveBench(args, useJson) {
-  const hasModels = typeof args.models === 'string' && args.models.trim();
-  const hasCouncil = args.council !== undefined && args.council !== false;
-  if (hasModels && hasCouncil) {
-    return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
-      message: 'Error: pass exactly one of --models / --council, not both' }) };
-  }
-  if (!hasModels && !hasCouncil) {
-    return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
-      message: 'Error: council run needs --models a,b,c or --council <preset> (at least 2 seats)' }) };
-  }
-  if (hasCouncil) {
-    if (typeof args.council !== 'string' || !args.council.trim()) {
-      return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
-        message: 'Error: --council requires a council name (e.g. --council budget)' }) };
-    }
-    const { resolveCouncilMembers } = require('./utils/config');
-    const { readCache } = require('./utils/model-catalog');
-    const catalog = (readCache() || {}).models || [];
-    const presetName = args.council.trim();
-    const expanded = resolveCouncilMembers(presetName, catalog);
-    if (expanded.error) {
-      return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: ${expanded.error}` }) };
-    }
-    // v4.5 Wave 2 → Plan 4 Task 4: threaded into runCouncil's options — the
-    // sink now announces each dropped member, with reason, on every transport and surface.
-    return { bench: expanded.models, presetName, droppedMembers: expanded.droppedMembers || [] };
-  }
-  if (args['dropped-members'] === undefined) {
-    return { bench: parseList(args.models), presetName: null, droppedMembers: [] };
-  }
-  let dm; try { dm = JSON.parse(args['dropped-members']); } catch { dm = null; }
-  if (!Array.isArray(dm) || !dm.every(d => d && typeof d.member === 'string' && typeof d.reason === 'string')) {
-    return { fail: failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
-      message: 'Error: --dropped-members must be a JSON array of {member, reason} entries' }) };
-  }
-  return { bench: parseList(args.models), presetName: null, droppedMembers: dm };
-}
-
 /**
  * Default real helpers; tests override via depsOverride (mirrors
  * cli-handlers-spend.js's realDeps()/depsOverride convention).
@@ -112,6 +47,27 @@ async function handleCouncilRun(args, depsOverride = {}) {
   // existing application point exactly like a typed --template.
   let packRecord = null;
   const explicitKeys = args.__explicit || new Set();
+  // v4.7 PR6: these all parse as boolean `true` when typed without a value
+  // (src/cli.js:101) and reached runCouncil as `true`, a NaN, or a bogus path.
+  // Voice matches the R5 -o/--out precedent (cli-handlers-council.js:183).
+  for (const flag of ['out-dir', 'claude-review', 'run-id']) {
+    if (!explicitKeys.has(flag)) { continue; }
+    const v = args[flag];
+    if (typeof v !== 'string' || v === '') {
+      return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: --${flag} requires a value` });
+    }
+    if (v.startsWith('-')) {
+      return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: --${flag} cannot start with '-': got '${v}'` });
+    }
+  }
+  // --timeout is DEFAULTS-seeded to 15 (src/cli.js:31), so `!== undefined` proves
+  // nothing; NaN is the real hole — it passes the `<= 0` guard below.
+  if (explicitKeys.has('timeout') && (typeof args.timeout !== 'number' || !Number.isFinite(args.timeout))) {
+    // Do NOT echo args.timeout: parseArgs already ran parseInt, so a typed
+    // `--timeout abc` reads back as NaN and quoting it shows the user a value
+    // they never typed. Boolean `true` (bare flag) has the same problem.
+    return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --timeout requires a number' });
+  }
   if (args.pack !== undefined) {
     const { applyPackToArgs } = require('./pack/pack-resolve');
     const pr = applyPackToArgs({
@@ -146,17 +102,14 @@ async function handleCouncilRun(args, depsOverride = {}) {
     promptRes = { prompt: undefined, promptMeta: null };
   }
   let templateMeta = null;
-  if (args.template !== undefined) {
-    const { applyTemplate } = require('./template/apply');
-    const t = applyTemplate({ templateRef: args.template, prompt: promptRes.prompt,
-      artifactFile: args.artifact, varList: args.var, project: args.cwd || process.cwd() });
-    if (t.error) { return failJson(useJson, t.error); }
-    for (const n of t.notices) { process.stderr.write(n + '\n'); }
-    promptRes = { prompt: t.prompt, promptMeta: t.promptMeta };
-    templateMeta = t.promptMeta.template;
-  } else if (args.artifact !== undefined || args.var !== undefined) {
-    return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --artifact/--var require --template (expansion happens only in template files)' });
-  }
+  const tpl = applyTemplateForArgs(args, promptRes.prompt, useJson);
+  if (tpl.fail !== undefined) { return tpl.fail; }
+  // The trailing `templateMeta =` is NOT copy-paste drift against handleFanout's
+  // otherwise-identical call: it feeds `template: templateMeta` on the run.json
+  // seed below (the `template:` field of the runCouncil options object). Drop it
+  // and every --template council run silently records
+  // `template: null`. handleFanout has no such field, which is why its call is shorter.
+  if (tpl.applied) { promptRes = { prompt: tpl.prompt, promptMeta: tpl.promptMeta }; templateMeta = tpl.templateMeta; }
 
   const benchRes = resolveBench(args, useJson);
   if (benchRes.fail !== undefined) { return benchRes.fail; }
@@ -194,14 +147,29 @@ async function handleCouncilRun(args, depsOverride = {}) {
   }
   const lenses = (typeof args.lenses === 'string' && args.lenses.trim()) ? parseList(args.lenses) : null;
   if (critic && lenses) {
+    // T11-d: no packSuffix() here (unlike the chair/critic-in-bench checks
+    // above) — it would only ever contribute ''. pack-validate.js now rejects
+    // a pack supplying both critic and lenses before this handler ever runs
+    // (PACK_INVALID, pre-spend, via pack-resolve.js's validatePack call), and
+    // pack-resolve.js:140/143 already suppress the mixed pack-field x
+    // explicit-flag crossings (a pack-filled critic is skipped when --lenses
+    // is explicit, and vice versa). So whenever this branch fires, both
+    // critic and lenses are always explicit flags, never pack-attributed.
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
-      message: `Error: --critic and --lenses are mutually exclusive in v4.0${packSuffix('critic') || packSuffix('lenses')}` });
+      message: 'Error: --critic and --lenses are mutually exclusive in v4.0' });
   }
   if (lenses && lenses.length !== bench.length) {
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
       message: `Error: --lenses needs exactly one lens per seat (${bench.length} seats, got ${lenses.length})` });
   }
-  if (args.timeout !== undefined && args.timeout <= 0) {
+  // v4.7 PR6: this check is POST-pack-merge and ungated, so it is the only one a
+  // pack-filled value passes through — `timeout` is a legal council pack option
+  // (pack-validate.js KIND_OPTIONS) and validatePack checks the key name, never
+  // the value type. The old `<= 0` test alone let `{timeout: true}` past (true
+  // coerces to 1) and `{timeout: "abc"}` past as NaN, reproducing the very bug
+  // the typed-flag guard above closes. Same shape as --max-cost's check below.
+  if (args.timeout !== undefined
+      && (typeof args.timeout !== 'number' || !Number.isFinite(args.timeout) || args.timeout <= 0)) {
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --timeout must be a positive number' });
   }
   const mc = args['max-cost'];
@@ -212,6 +180,15 @@ async function handleCouncilRun(args, depsOverride = {}) {
     return failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
       message: `Error: --gateway must be one of: ${GATEWAY_MODES.join(', ')}` });
   }
+  // v4.7 F8 (D13): reject-style (unlike sanitizeCouncilName, which cleans) —
+  // a stored tag is a user-chosen search key, so silent truncation/stripping
+  // would make --search/--group-by tag miss it.
+  if (args.tag !== undefined) {
+    const tagCheck = validateTag(args.tag);
+    if (!tagCheck.ok) {
+      return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: tagCheck.error });
+    }
+  }
   let runId;
   if (args['run-id']) {
     const check = validateTaskId(String(args['run-id']));
@@ -227,6 +204,12 @@ async function handleCouncilRun(args, depsOverride = {}) {
   const runDir = args['out-dir']
     ? path.resolve(project, String(args['out-dir']))
     : path.resolve(project, `council-${runId}`);
+  // v4.7 PR6: MCP has fenced this since v4.5 (mcp-council-run.js:137-141); the CLI
+  // never did, so `--out-dir ../../x` wrote outside the project and exited 0.
+  const { isPathInside } = require('./project-root-allowlist');
+  if (!isPathInside(runDir, project)) {
+    return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: --out-dir must stay inside the project: '${args['out-dir']}' resolves outside ${project}` });
+  }
 
   const { resolveGatewayMode, loadConfig } = require('./utils/config');
   const { resolveFallbackConfig } = require('./sidecar/fallback-chains');
@@ -254,6 +237,7 @@ async function handleCouncilRun(args, depsOverride = {}) {
     councilName,
     template: templateMeta, // F9 (v4.5): null when no --template; additive on the run.json seed (run-state.js).
     pack: packRecord, // v4.5 Task 12 (B7/F5): null when no --pack; additive on the run.json seed (run-state.js).
+    tag: args.tag, // v4.7 F8: undefined when no --tag; Task 3 stores it on the run.json seed.
     droppedMembers: benchRes.droppedMembers, // v4.5 Wave 2: [] when nothing dropped; additive on the run.json seed (run-state.js).
     // v4.1 §4.5b/§4.5d. `--claude-review` is resolved here but VALIDATED by the
     // engine's preflightClaudeReview (run-assemble.js): the reserved-seat and

package/src/cli-handlers-council.js

@@ -60,10 +60,14 @@ function renderRecord(r) {
 }
 function renderStats(agg) {
   if (!agg.length) { return 'No council runs recorded yet.\n'; }
-  return 'model            runs  avg-cred  confirm  fact-err  notes\n' +
-    agg.map(a => `${a.model.padEnd(16)} ${String(a.runs).padStart(4)}  ` +
+  // v4.7 GOA-7 D10: group keys may be executable ids (>16 chars) — size the
+  // model column to the longest key; legacy (alias-keyed) groups get a notes
+  // marker beside low-N.
+  const w = Math.max(16, ...agg.map(a => String(a.model).length));
+  return 'model'.padEnd(w) + ' runs  avg-cred  confirm  fact-err  notes\n' +
+    agg.map(a => `${String(a.model).padEnd(w)} ${String(a.runs).padStart(4)}  ` +
       `${fmt(a.avgStreetCredPeersOnly)}     ${fmt(a.lifetimeConfirmRate)}    ${fmt(a.lifetimeFactErrorRate)}` +
-      `${a.lowN ? '   low-N' : ''}`).join('\n') + '\n';
+      `${a.lowN ? '   low-N' : ''}${a.legacy ? '   legacy' : ''}`).join('\n') + '\n';
 }
 function fmt(v) { return (v === null || v === undefined) ? '  —  ' : v.toFixed(2); }
 
@@ -167,8 +171,16 @@ function runVerdict(args, useJson) {
   // (renameSync TypeError on a non-string path) leaving an orphaned
   // true.tmp-<pid>; the empty string silently falls through to the default
   // path. Name the flag and refuse both — the unknown-flag precedent.
-  if (args.out !== undefined && (typeof args.out !== 'string' || args.out === '')) {
-    return failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: '-o/--out requires a value',
+  // R5 (v4.7): a dash-leading value ('-x') is a well-formed string as far as
+  // parseArgs is concerned (it normalizes, it does not validate) — refuse it
+  // here too, or it resolves straight through to writeVerdictAtomic('-x', ...)
+  // and writes a file literally named '-x' in cwd. Same failure class as R1,
+  // one form short.
+  if (args.out !== undefined && (typeof args.out !== 'string' || args.out === '' || args.out.startsWith('-'))) {
+    return failJson(useJson, { code: ERROR_CODES.BAD_ARGS,
+      message: (typeof args.out !== 'string' || args.out === '')
+        ? '-o/--out requires a value'
+        : `-o/--out cannot start with '-': got '${args.out}'`,
       hint: 'amicus council verdict <tally.json> [--decisions <decisions.json>] [-o|--out <out.json>]' });
   }
   const outPath = args.out || './verdict.json';

package/src/cli-handlers-fanout.js

@@ -0,0 +1,179 @@
+/**
+ * CLI handler for the fanout command (multi-model parallel runs).
+ *
+ * Extracted verbatim from cli-handlers-run.js (v4.7 PR0) to keep that file
+ * under the 300-line gate before F8 adds --tag forwarding. Whole-handler
+ * split precedent: cli-handlers-resume-continue.js.
+ */
+
+'use strict';
+
+const { validateTaskId, validateTag } = require('./utils/validators');
+const { failJson, ERROR_CODES } = require('./utils/error-doc');
+const { GATEWAY_MODES } = require('./utils/model-descriptor');
+const { applyTemplateForArgs } = require('./cli-template-args');
+
+/**
+ * Handle 'amicus fanout' command (F4).
+ * Returns the wave exit code: 0 all complete, 2 partial, 1 none/hard failure,
+ * 130/143 when the wave was signal-aborted.
+ */
+async function handleFanout(args) {
+  const useJson = !!args.json;
+
+  // v4.7 F8 (D13): a retried wave replays each leg's own saved context
+  // byte-identical — there is no fresh session to attach a new --tag to, so
+  // reject the combination before the retry-failed dispatch below.
+  if (args.tag !== undefined && args['retry-failed']) {
+    process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --tag cannot be combined with --retry-failed' }));
+  }
+
+  // --retry-failed <waveId> (v4.3 Task 19, spec 6.1): a completely different
+  // path from the --prompt/--models launch below (no briefing, no required
+  // --models — the original wave's failed legs supply their own saved
+  // context) — dispatch BEFORE any of that validation runs. --models here is
+  // optional and, when present, filters which failed legs get retried.
+  // --pack is likewise ignored on this path (deliberate, same precedent: retry
+  // replays the wave's recorded per-leg config; flags that reshape a wave don't apply).
+  if (args['retry-failed']) {
+    const { retryFailedWave } = require('./sidecar/fanout-retry');
+    const { parseModelsList } = require('./sidecar/fanout-validate');
+    const { exitCode, errorDoc } = await retryFailedWave(String(args['retry-failed']), args.cwd || process.cwd(), {
+      models: parseModelsList(args.models), json: useJson,
+    });
+    if (errorDoc && useJson) { process.stdout.write(JSON.stringify(errorDoc) + '\n'); }
+    return exitCode;
+  }
+  const packRecord = require('./pack/pack-cli').applyPackOrExit(args, 'fanout', useJson);
+
+  // FIX 4 (#61 whole-branch review, cheap parity): handleStart validates
+  // --gateway via validateStartArgs (cli.js) — fanout never did, so a typo'd
+  // value silently fell through to resolveGatewayMode's pass-through instead
+  // of failing fast with a clear error.
+  if (args.gateway !== undefined && !GATEWAY_MODES.includes(args.gateway)) {
+    process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: --gateway must be one of: ${GATEWAY_MODES.join(', ')}` }));
+  }
+
+  const { resolvePromptSource } = require('./utils/prompt-source');
+  let promptRes;
+  if (args.prompt !== undefined || args['prompt-file'] !== undefined || args.template === undefined) {
+    promptRes = resolvePromptSource(args);
+    if (promptRes.error) { process.exit(failJson(useJson, { code: ERROR_CODES.MISSING_PROMPT, message: promptRes.error })); }
+  } else {
+    promptRes = { prompt: undefined, promptMeta: null };
+  }
+  const tpl = applyTemplateForArgs(args, promptRes.prompt, useJson);
+  if (tpl.fail !== undefined) { process.exit(tpl.fail); }
+  if (tpl.applied) { promptRes = { prompt: tpl.prompt, promptMeta: tpl.promptMeta }; }
+  // Council preset: expand a saved council into args.models (mutually exclusive with --models).
+  const hasModels = typeof args.models === 'string' && args.models.trim();
+  const hasCouncil = args.council !== undefined && args.council !== false;
+  if (hasModels && hasCouncil) {
+    process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: pass exactly one of --models / --council, not both' }));
+  }
+  if (!hasModels && !hasCouncil) {
+    process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --models is required (comma-separated aliases or provider/model IDs), or use --council <name>' }));
+  }
+  if (hasCouncil) {
+    if (typeof args.council !== 'string' || !args.council.trim()) {
+      process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --council requires a council name (e.g. --council free)' }));
+    }
+    const { resolveCouncilMembers } = require('./utils/config');
+    const { readCache } = require('./utils/model-catalog');
+    const catalog = (readCache() || {}).models || [];
+    const expanded = resolveCouncilMembers(args.council.trim(), catalog);
+    if (expanded.error) {
+      process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: `Error: ${expanded.error}` }));
+    }
+    if (expanded.dropped && expanded.dropped.length && !useJson) {
+      process.stderr.write(`Notice: dropped unavailable council member(s): ${expanded.dropped.join(', ')}\n`);
+    }
+    args.models = expanded.models.join(',');
+  }
+  if (args['wave-id']) {
+    const check = validateTaskId(String(args['wave-id']));
+    if (!check.valid) {
+      process.exit(failJson(useJson, { code: ERROR_CODES.BAD_SESSION, message: check.error }));
+    }
+  }
+  if (args.agent && String(args.agent).toLowerCase() === 'chat') {
+    process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --agent chat is interactive-only; fanout is headless' }));
+  }
+  if (args.timeout !== undefined && args.timeout <= 0) {
+    process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --timeout must be a positive number' }));
+  }
+  const mc = args['max-cost'];
+  if (mc !== undefined && (typeof mc !== 'number' || !Number.isFinite(mc) || mc <= 0)) {
+    process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --max-cost must be a positive number' }));
+  }
+  // v4.7 F8 (D13): reject-style (unlike sanitizeCouncilName, which cleans) —
+  // a stored tag is a user-chosen search key, so silent truncation/stripping
+  // would make --search/--group-by tag miss it.
+  if (args.tag !== undefined) {
+    const tagCheck = validateTag(args.tag);
+    if (!tagCheck.ok) {
+      process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: tagCheck.error }));
+    }
+  }
+  const { parseModelsList } = require('./sidecar/fanout');
+  if (parseModelsList(args.models).length === 0) {
+    process.exit(failJson(useJson, { code: ERROR_CODES.BAD_ARGS, message: 'Error: --models must contain at least one non-empty entry' }));
+  }
+
+  // Direct require (fanout stays internal — no src/index.js public re-export).
+  const { runFanout } = require('./sidecar/fanout');
+  const { loadConfig, resolveGatewayMode } = require('./utils/config');
+  const { resolveFallbackConfig } = require('./sidecar/fallback-chains');
+  const { readCache } = require('./utils/model-catalog');
+  const cfg = loadConfig() || {};
+  const { exitCode } = await runFanout({
+    models: args.models,
+    prompt: promptRes.prompt,
+    promptMeta: promptRes.promptMeta,
+    waveId: args['wave-id'],
+    project: args.cwd || process.cwd(),
+    agent: args.agent || args.mode,
+    thinking: args.thinking,
+    timeout: args.timeout,
+    summaryLength: args['summary-length'],
+    includeContext: !args['no-context'],
+    sessionId: args['session-id'],
+    contextTurns: args['context-turns'],
+    contextSince: args['context-since'],
+    contextMaxTokens: args['context-max-tokens'],
+    // #10: forward the Cowork parent so MCP-spawned fanout legs pin the right
+    // session (mirrors handleStart's coworkProcess plumbing). Without this the
+    // spawned `--cowork-process` flag is dropped and buildContext gets null.
+    coworkProcess: args['cowork-process'],
+    mcp: args.mcp,
+    mcpConfig: args['mcp-config'],
+    noMcp: args['no-mcp'],
+    excludeMcp: args['exclude-mcp'],
+    noValidateModel: args['no-validate-model'],
+    // #61 Task 7.3: --gateway merged with routing.prefer, applied per leg
+    // by validateFanoutModels' router call.
+    gatewayMode: resolveGatewayMode(args.gateway),
+    json: !!args.json,
+    // v4.7 PR3 rider: `quiet` is a repo-wide known flag, so `fanout --quiet`
+    // parsed and exited 0 while runFanout still printed — forward it.
+    quiet: !!args.quiet,
+    client: args.client,
+    maxCost: args['max-cost'] !== null && args['max-cost'] !== undefined ? args['max-cost'] : cfg.maxCost,
+    noCostGate: !!args['no-cost-gate'],
+    maxCostPerMtok: cfg.maxCostPerMtok,
+    follow: !!args.follow,
+    onComplete: args['on-complete'],
+    // v4.3 Task 18 (spec §6.2): opt-in cheaper-model substitution. --fallback
+    // forces on, --no-fallback forces off; unset defers to config `fallbacks.enabled`.
+    fallback: resolveFallbackConfig({
+      flagFallback: args.fallback === true ? true : (args['no-fallback'] ? false : undefined),
+      config: cfg,
+    }),
+    catalog: (readCache() || {}).models || [],
+    pack: packRecord, // v4.5 Task 13: null when no --pack; additive on wave metadata.json + wave.json.
+    tag: args.tag, // v4.7 F8: undefined when no --tag; Task 3 stores it on wave metadata.
+  });
+  return exitCode;
+}
+
+module.exports = { handleFanout };

package/src/cli-handlers-pack.js

@@ -23,7 +23,9 @@ const { ERROR_CODES, failJson } = require('./utils/error-doc');
 /** Build a pack object from `pack save <name> --kind ... <flags>`. */
 function buildPackFromFlags(name, args) {
   const kind = args.kind;
-  const pack = { schemaVersion: 1, type: 'pack', name, version: args.version || '1.0.0', kind };
+  // `--pack-version`, NOT `--version`: the latter is a global BOOLEAN_FLAG that
+  // bin/amicus.js intercepts before dispatch, so it could never arrive here.
+  const pack = { schemaVersion: 1, type: 'pack', name, version: args['pack-version'] || '1.0.0', kind };
   if (args.description) { pack.description = String(args.description); }
   if (kind === 'solo') { pack.model = args.model; }
   else if (typeof args.bench === 'string') {
@@ -72,12 +74,18 @@ function packFromCouncilRun(name, version, run) {
   };
 }
 
-/** wave branch: a fanout wave's metadata.json (type:'wave'), plus its first leg. */
-function packFromWave(name, version, project, meta) {
-  const fs = require('fs');
-  const path = require('path');
-  const { getSessionDir } = require('./session-manager');
-
+/**
+ * wave branch: a fanout wave's metadata.json (type:'wave'), plus its first leg.
+ * `{fs, path, getSessionDir}` is threaded in from buildPackFromRun's own lazy
+ * require (below) rather than required again here — T14-m7: this file's other
+ * lazy requires (session-manager per cli-handlers-abort.js/cli-handlers-watch.js/
+ * mcp-council-awareness.js; pack-store/pack-validate in handlePack below) are
+ * all function-scoped, deferred until the `--from-run` path actually needs
+ * them, so a second copy of the same require triple here would just be
+ * duplication without buying back any additional laziness — buildPackFromRun
+ * already pays that cost once, on the only branch that reaches this function.
+ */
+function packFromWave(name, version, project, meta, { fs, path, getSessionDir }) {
   const opts = {};
   const firstLeg = Array.isArray(meta.legs) ? meta.legs[0] : null;
   if (firstLeg) {
@@ -114,7 +122,7 @@ function packFromSolo(name, version, meta) {
  */
 function buildPackFromRun(name, id, project, args) {
   const runState = require('./council/run-state');
-  const version = args.version || '1.0.0';
+  const version = args['pack-version'] || '1.0.0'; // see buildPackFromFlags — never args.version
 
   const ptr = runState.readPointer(project, id); // {runId, runDir}|null (run-state.js:156)
   const run = ptr ? runState.readRun(ptr.runDir) : null;
@@ -128,7 +136,9 @@ function buildPackFromRun(name, id, project, args) {
     let meta = null;
     try { meta = JSON.parse(fs.readFileSync(path.join(getSessionDir(project, id), 'metadata.json'), 'utf-8')); }
     catch { return { error: `Session ${id} not found` }; }
-    pack = meta.type === 'wave' ? packFromWave(name, version, project, meta) : packFromSolo(name, version, meta);
+    pack = meta.type === 'wave'
+      ? packFromWave(name, version, project, meta, { fs, path, getSessionDir })
+      : packFromSolo(name, version, meta);
   }
   // T14-m4 (final-review): buildPackFromFlags honors --description (line ~27
   // above); this --from-run path threaded `version` the same way but silently
@@ -152,7 +162,6 @@ function renderPackList(doc) {
     });
     text = 'Packs:\n' + lines.join('\n') + '\n';
   }
-  for (const w of doc.warnings) { text += `Warning: ${w}\n`; }
   return text;
 }
 
@@ -201,6 +210,11 @@ async function handlePack(args) {
     const { packs, warnings } = listPacks();
     const doc = { schemaVersion: SCHEMA_VERSION, type: 'pack-list', dir: packsDir(), packs, warnings };
     process.stdout.write(useJson ? JSON.stringify(doc, null, 2) + '\n' : renderPackList(doc));
+    // T14-m1: warnings are diagnostics, not data — keep them off stdout so
+    // `amicus pack list | grep`/`--json` consumers never see them mixed into
+    // the list itself. `pack save` already writes this identical string to
+    // stderr (above); `--json` is untouched: `warnings` stays a field on doc.
+    if (!useJson) { for (const w of warnings) { process.stderr.write(`Warning: ${w}\n`); } }
     return 0;
   }