auxilo-mcp 0.9.13 → 0.9.15

package/bin/auxilo-cli.js

@@ -167,7 +167,7 @@ const CONSENT_TEXT = `
     • SCRUBS it locally (sensitivity filter: API keys, tokens, emails, PII
       are redacted first),
     • EXTRACTS reusable learnings locally through the first model client you
-      have installed (Claude Code, then Codex) or, when neither is
+      are signed in to (Claude Code, then Codex) or, when neither is
       available, a provider key you set yourself. For this step your
       scrubbed transcript goes only to that provider, under your own
       account with them, and any use is charged to that account, never to
@@ -1402,10 +1402,13 @@ async function cmdProvider(flags) {
     return;
   }
 
-  // writeByoConfig throws ONLY on an unresolved home directory (GOV-3 item
-  // 13) — caught here so that reaches a clean reason + exit(1), never a raw
-  // stack (should-fix item 10), matching the fail-closed contract every
-  // other providers.json entry point in this file now follows.
+  // writeByoConfig throws on an unresolved home directory (GOV-3 item 13)
+  // OR, since EXTRACTION-LOW-FOLLOWUPS item 4, on an existing providers.json
+  // path that is not a regular file owned by this account (a symlink or a
+  // foreign owner) — both caught here so they reach a clean reason +
+  // exit(1), never a raw stack (should-fix item 10), matching the
+  // fail-closed contract every other providers.json entry point in this
+  // file now follows.
   let written;
   try {
     written = byoKeyProvider.writeByoConfig({
@@ -1419,6 +1422,10 @@ async function cmdProvider(flags) {
       console.error(`auxilo provider set could not resolve your home directory (reasonCode: provider-home-unresolved). ${err.message}`);
       process.exit(1);
     }
+    if (err && err.reasonCode === 'provider-state-target-unsafe') {
+      console.error(`auxilo provider set refuses to continue: ${err.message} (reasonCode: provider-state-target-unsafe). Remove or replace it, then try again.`);
+      process.exit(1);
+    }
     throw err;
   }
   console.log(`\n✓ Saved to ${written} (mode 0600). This machine will use your own ${vendor} key for extraction when no earlier provider in the order is available.`);

package/lib/extraction-index.js

@@ -14,7 +14,16 @@ const os = require('node:os');
 const path = require('node:path');
 const { findNearDuplicate, scoreChannels } = require('./similarity.js');
 
-const DEFAULT_INDEX_PATH = path.join(os.homedir(), '.auxilo', 'extracted-index.jsonl');
+// TEST-HOME-ISOLATION incident 2: same AUXILO_HOME-over-os.homedir() fallback
+// as scripts/providers/index.js's PROVIDERS_STATE_PATH and
+// scripts/providers/byo-key.js's DEFAULT_PROVIDERS_STATE_PATH (duplicated,
+// not imported — see those files' docblocks). This makes the default resolve
+// through the same seam isolation already uses elsewhere, so a caller that
+// forgets an explicit indexPath is still isolated by construction whenever
+// AUXILO_HOME is set (scripts/test/run-isolated.js sets both AUXILO_HOME and
+// HOME, so this is defense-in-depth, not the primary guard — every call site
+// should still pass an explicit indexPath; see test/no-real-home-writes.test.js).
+const DEFAULT_INDEX_PATH = path.join(process.env.AUXILO_HOME || os.homedir(), '.auxilo', 'extracted-index.jsonl');
 const HYDRATION_PAGE_SIZE = 500;
 const PROMPT_MEMORY_MAX_TOKENS = 1200;
 const PROMPT_MEMORY_MAX_ROWS = 40;

package/mcp-server.js

@@ -198,7 +198,7 @@ async function postBulkChunks(headers, decisions) {
 }
 
 const server = new Server(
-  { name: 'auxilo', version: '0.9.13' },
+  { name: 'auxilo', version: '0.9.15' },
   {
     capabilities: { tools: {} },
     instructions: `You are connected to Auxilo, a knowledge marketplace where AI agents buy and sell operational learnings.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auxilo-mcp",
-  "version": "0.9.13",
+  "version": "0.9.15",
   "mcpName": "io.github.silent-architects/auxilo",
   "description": "MCP server for Auxilo. Your agent stops solving the same problem twice: auto-extracted learnings, free self-unlocks, and earnings when other agents unlock yours.",
   "main": "mcp-server.js",
@@ -32,7 +32,8 @@
   ],
   "scripts": {
     "start": "node mcp-server.js",
-    "test": "node --test test/*.test.js && node tests/test-mobile-nav-overlay.js"
+    "test": "node scripts/test/run-isolated.js",
+    "test:host": "node scripts/test/run-host.js"
   },
   "keywords": [
     "mcp",

package/scripts/extract-local.js

@@ -401,13 +401,24 @@ function judgeUsage(usage, prompt, completion) {
 /**
  * PART C — resolve the extraction_model identity for a runModel result.
  * Prefers the additive `identity` field a provider's runModel result may
- * carry (byo-key.js always sets one: {provider:'byo-key', model, version,
- * vendor}). claude-code.js/codex-cli.js shipped (PART A/B) before this stamp
- * existed and don't set one — rather than touch those provider modules
- * (outside this part's disjoint file scope, AGENTS.md's one-build rule),
- * this falls back to the resolved provider id alone (model/version/vendor
- * null) so every provider gets SOME stamp, never silently none. Best-effort:
- * a resolution failure here must never block extraction itself.
+ * carry. Current state (post Gate-A item a): byo-key.js always sets one
+ * ({provider:'byo-key', model, version:null, vendor}); codex-cli.js sets one
+ * on success ({provider:'codex-cli', model:null, version:<codex --version>,
+ * vendor:null} — its result also carries the same object under the
+ * deprecated `extraction_model` alias, kept for one release only for
+ * test/codex-cli-provider.test.js). claude-code.js is the one provider that
+ * still sets no `identity` on its result — that's the case this function's
+ * fallback exists for: it re-resolves via providers.resolveProvider() and
+ * stamps {provider: resolved.id, model: null, version: null, vendor: null},
+ * so every provider gets SOME stamp, never silently none. That re-resolution
+ * walks scripts/providers/index.js's PROVIDER_ORDER (claude-code →
+ * codex-cli → byo-key); resolveProvider/runModel there fall through from one
+ * provider to the next only on a NON_RETRYABLE_FOR_THIS_PROVIDER reasonCode
+ * (unauthenticated, not installed, a billing helper configured, an
+ * unconfigured BYO key, or an unsafe providers.json mode) — a provider that
+ * merely failed once (a timeout, a model error) is not retried under a
+ * different one. Best-effort throughout: a resolution failure here must
+ * never block extraction itself.
  */
 async function resolveExtractionModelIdentity(runModelResult, opts) {
   if (runModelResult && runModelResult.identity && typeof runModelResult.identity === 'object') {
@@ -447,6 +458,12 @@ async function defaultInvokeModel(transcript, invokeOpts, opts) {
     authStatus: result.authStatus,
     extractionModel: await resolveExtractionModelIdentity(result, opts),
     ...(result.authDiscrepancy !== undefined && { authDiscrepancy: result.authDiscrepancy }),
+    // EXTRACTION-RUN-LOG (0.9.15): additive passthrough for the one-line-per-run
+    // provider summary logged at the end of extractLocally() below. Only
+    // claude-code's runModel() currently sets these (argv/cliVersion); other
+    // providers simply omit them, which the log builder renders as 'n/a'.
+    ...(result.argv !== undefined && { argv: result.argv }),
+    ...(result.cliVersion !== undefined && { cliVersion: result.cliVersion }),
   };
 }
 
@@ -465,7 +482,20 @@ function defaultInvokeJudge(opts) {
       log: opts.log,
       mode: 'judge',
     });
-    return { ok: result.ok, out: result.text, usage: result.usage, reason: result.reason };
+    return {
+      ok: result.ok,
+      out: result.text,
+      usage: result.usage,
+      reason: result.reason,
+      // EXTRACTION-RUN-LOG (0.9.15): threaded through so runAnchoredJudge below
+      // can report the judge call's status/argv/CLI version on the run summary
+      // log line. Additive — every existing invokeJudge stub in this repo's
+      // tests returns a subset of {ok,out,usage,reason} and these three simply
+      // come back undefined for them, changing nothing they assert.
+      reasonCode: result.reasonCode,
+      argv: result.argv,
+      cliVersion: result.cliVersion,
+    };
   };
 }
 
@@ -505,12 +535,26 @@ function parseJudgeDecisions(raw, candidates, rankings) {
 
 async function runAnchoredJudge(candidates, indexState, opts = {}) {
   const input = Array.isArray(candidates) ? candidates : [];
+  // judgeAttempted/judgeSucceeded (EXTRACTION-RUN-LOG, 0.9.15): additive
+  // status fields for the provider-run log line only — every field already on
+  // `empty` (kept/dropped/called/prompt_tokens/completion_tokens) keeps its
+  // exact pre-existing meaning and every existing caller's assertions on those
+  // fields are unaffected. judgeAttempted=true means invokeJudge was actually
+  // called (regardless of outcome); judgeSucceeded=true means it returned
+  // ok:true AND its output parsed into real decisions (the one path that
+  // actually judged anything, as opposed to failing open and keeping
+  // everything). This is a finer distinction than `called` — `called` is
+  // true even for a malformed-JSON response (an attempted-and-failed case) —
+  // so the log builder uses these two instead of `called` to tell
+  // "ran"/"failed"/"skipped(no-candidates)" apart accurately.
   const empty = {
     kept: input.slice(),
     dropped: [],
     called: false,
     prompt_tokens: 0,
     completion_tokens: 0,
+    judgeAttempted: false,
+    judgeSucceeded: false,
   };
   if (!input.length || !indexState || !indexState.usable ||
       !Array.isArray(indexState.rows) || !indexState.rows.length) {
@@ -527,17 +571,29 @@ async function runAnchoredJudge(candidates, indexState, opts = {}) {
     result = await invokeJudge(prompt, { candidates: input, rankings });
   } catch (error) {
     loudLocal(opts, `anchored judge unavailable; keeping all candidates: ${error.message}`);
-    return empty;
+    return { ...empty, judgeAttempted: true };
   }
   if (!result || !result.ok) {
     loudLocal(opts, `anchored judge unavailable; keeping all candidates: ${result && result.reason ? result.reason : 'unknown error'}`);
-    return empty;
+    return {
+      ...empty,
+      judgeAttempted: true,
+      judgeReasonCode: result && result.reasonCode,
+      judgeArgv: result && result.argv,
+      judgeCliVersion: result && result.cliVersion,
+    };
   }
   const parsed = parseJudgeDecisions(result.out, input, rankings);
   const usage = judgeUsage(result.usage, prompt, result.out);
+  const judgeMeta = {
+    judgeAttempted: true,
+    judgeReasonCode: result.reasonCode,
+    judgeArgv: result.argv,
+    judgeCliVersion: result.cliVersion,
+  };
   if (!parsed.ok) {
     loudLocal(opts, `anchored judge malformed; keeping all candidates: ${parsed.reason}`);
-    return { ...empty, called: true, ...usage };
+    return { ...empty, called: true, ...usage, ...judgeMeta, judgeSucceeded: false };
   }
 
   const kept = [];
@@ -564,7 +620,7 @@ async function runAnchoredJudge(candidates, indexState, opts = {}) {
       kept.push(input[index]);
     }
   }
-  return { kept, dropped, called: true, ...usage };
+  return { kept, dropped, called: true, ...usage, ...judgeMeta, judgeSucceeded: true };
 }
 
 /**
@@ -619,6 +675,68 @@ function immutableSet(ids) {
 
 const EXTRACTABLE_SOURCES = immutableSet(EXTRACTABLE_SOURCE_IDS);
 
+// ─── Provider-run log line (EXTRACTION-RUN-LOG, PUNCH-LIST P3, 0.9.15) ─────
+//
+// One line per extractLocally() run, written to the runner's log at the point
+// each run completes — never prompt/transcript content. reasonCode/argv/
+// cliVersion are provider-internal diagnostics only (every provider's own
+// `reason` string is secret-free by the same contract runModel() documents in
+// scripts/providers/index.js), so this line carries no learning text.
+const PRE_SPAWN_SKIP_REASON_CODES = new Set([
+  'cli-unauthenticated',
+  'cli-not-installed',
+  'cli-billing-helper-configured',
+  'cli-settings-isolation-unsupported',
+  'provider-not-configured',
+  'providers-file-mode-unsafe',
+  'provider-not-installed',
+  'no-usable-provider',
+  'no-model-provider-available',
+]);
+
+function formatArgvForLog(argv) {
+  if (!Array.isArray(argv) || !argv.length) return 'n/a';
+  return argv.map((arg) => (arg === '' ? "''" : arg)).join(' ');
+}
+
+/**
+ * `finder` and `judge` report whether each call was actually attempted
+ * (spawned) this run, not whether it succeeded — a spawn that ran and then
+ * hit a model error still counts as "ran" (it happened; the failure is in
+ * `reason`, not in whether isolation applied). `hooks` is `claude-code`-
+ * specific: 'isolated' whenever a claude-code spawn this run carried
+ * --setting-sources (the only state a spawn can be in per the fail-closed
+ * gate in scripts/providers/claude-code.js — it never spawns without the
+ * flag), 'unsupported' when the CLI was found not to support the flag at
+ * all, 'n/a' for a non-claude-code provider (codex-cli/byo-key isolate by a
+ * different mechanism entirely, out of this row's scope).
+ */
+function logProviderRunSummary(opts, runId, modelResult, judged) {
+  try {
+    const log = typeof opts.log === 'function' ? opts.log : console.error;
+    const provider = (modelResult.extractionModel && modelResult.extractionModel.provider) || 'unknown';
+    const finderRan = Boolean(modelResult.ok) || !PRE_SPAWN_SKIP_REASON_CODES.has(modelResult.reasonCode);
+    const finder = finderRan ? 'ran' : 'skipped';
+    let judgeState;
+    if (!judged || !judged.judgeAttempted) judgeState = 'skipped(no-candidates)';
+    else if (judged.judgeSucceeded) judgeState = 'ran';
+    else judgeState = 'failed';
+    const argv = (finderRan && modelResult.argv) || (judged && judged.judgeArgv) || null;
+    const cliVersion = modelResult.cliVersion || (judged && judged.judgeCliVersion) || null;
+    const finderUnsupported = modelResult.reasonCode === 'cli-settings-isolation-unsupported';
+    const judgeUnsupported = Boolean(judged && judged.judgeReasonCode === 'cli-settings-isolation-unsupported');
+    const hooks = provider === 'claude-code'
+      ? ((finderUnsupported || judgeUnsupported) ? 'unsupported' : 'isolated')
+      : 'n/a';
+    log(
+      `[providers] run=${runId || 'unknown'} provider=${provider} cli=${cliVersion || '-'} ` +
+      `finder=${finder} judge=${judgeState} flags=${formatArgvForLog(argv)} hooks=${hooks}`
+    );
+  } catch {
+    // Logging must never block or fail extraction.
+  }
+}
+
 async function extractLocally(transcript, sourceType, opts = {}) {
   if (sourceType && !EXTRACTABLE_SOURCES.has(sourceType)) {
     return { learnings: [], skipped: `local extraction not implemented for "${sourceType}" — agent contributes via auxilo_contribute` };
@@ -660,6 +778,7 @@ async function extractLocally(transcript, sourceType, opts = {}) {
   const modelResult = await invokeModel(transcript, { prompt });
   const { ok, out, reason } = modelResult;
   if (!ok) {
+    logProviderRunSummary(opts, opts.runId, modelResult, null);
     return {
       learnings: [],
       skipped: reason,
@@ -726,6 +845,7 @@ async function extractLocally(transcript, sourceType, opts = {}) {
       `lexical_filter=${lexicalDropped.length}, anchored_judge=${judged.dropped.length}`
     );
   }
+  logProviderRunSummary(opts, opts.runId, modelResult, judged);
   return {
     learnings: judged.kept,
     dedup_dropped: allDropped.length,
@@ -753,4 +873,6 @@ module.exports = {
   extractWithClaudeCode: claudeCodeProvider.extractWithClaudeCode,
   checkClaudeAuthStatus: claudeCodeProvider.checkClaudeAuthStatus,
   resolveClaudeBin: claudeCodeProvider.resolveClaudeBin,
+  // EXTRACTION-RUN-LOG (0.9.15) — exported for direct unit coverage.
+  formatArgvForLog, logProviderRunSummary, PRE_SPAWN_SKIP_REASON_CODES,
 };

package/scripts/providers/byo-key.js

@@ -37,8 +37,23 @@ const os = require('os');
 /** Same literal value as scripts/providers/index.js's PROVIDERS_STATE_PATH —
  * duplicated (not imported) to avoid a circular require (index.js loads this
  * module dynamically via loadOptionalProvider). test/byo-key-provider.test.js
- * pins the two paths equal. */
-const DEFAULT_PROVIDERS_STATE_PATH = path.join(os.homedir(), '.auxilo', 'providers.json');
+ * pins the two paths equal.
+ *
+ * TEST-HOME-ISOLATION: `AUXILO_HOME`, when set, wins over `os.homedir()` —
+ * a dedicated override for auxilo's own state directory, distinct from the
+ * general-purpose `HOME` every other os.homedir()-based path in this repo
+ * reads (settings.json, the VERSION stamp, credentials.json, ...). Per-call
+ * `opts.providersStatePath` (every test in this repo passes one) still wins
+ * over BOTH — this only narrows what an omitted opts falls back to, closing
+ * the gap that let a bare `bin/auxilo-cli.js provider status|clear` call (no
+ * opts seam of its own — see cmdProvider in bin/auxilo-cli.js) or any future
+ * test that forgets its own override reach the real ~/.auxilo/providers.json
+ * (TEST-HOME-ISOLATION incident, 2026-09-06). Evaluated once at module load,
+ * same as before — every entry point that cares (scripts/test/run-isolated.js
+ * for `npm test`, scripts/check-test-count.sh for the CI gate) sets both
+ * AUXILO_HOME and HOME before node starts, so this still resolves correctly
+ * even though it's a frozen constant, not a per-call lookup. */
+const DEFAULT_PROVIDERS_STATE_PATH = path.join(process.env.AUXILO_HOME || os.homedir(), '.auxilo', 'providers.json');
 
 const VENDOR_DEFAULT_BASE_URL = Object.freeze({
   anthropic: 'https://api.anthropic.com/v1',
@@ -70,6 +85,33 @@ function isHomeUnresolved(target) {
   return typeof target !== 'string' || !target || !path.isAbsolute(target);
 }
 
+/**
+ * true iff something already sits at `target` and it is NOT a plain regular
+ * file owned by this process's own uid (EXTRACTION-LOW-FOLLOWUPS item 4).
+ * Guards the pre-rename chmod below: chmod follows symlinks, so a planted
+ * symlink at `target` (pointing at, say, another account's file, or a
+ * device node) would previously get its chmod(0600) applied to whatever it
+ * points at, not to providers.json itself — same-uid threat model only
+ * (matches item 2's TOCTOU acceptance above), but a fail-closed lstat is a
+ * one-line guard against it. ENOENT (nothing there yet) is safe — the write
+ * below creates it fresh with O_EXCL. Any other stat failure, a non-file
+ * (symlink/dir/fifo/device), or a foreign owner all fail CLOSED (refuse),
+ * never silently proceed.
+ */
+function isUnsafeExistingTarget(target, opts = {}) {
+  const lstatSyncImpl = typeof opts.lstatSyncImpl === 'function' ? opts.lstatSyncImpl : fs.lstatSync;
+  let stat;
+  try {
+    stat = lstatSyncImpl(target);
+  } catch (err) {
+    if (err && err.code === 'ENOENT') return false; // nothing there — nothing to protect
+    return true; // cannot verify what's there — fail closed
+  }
+  if (!stat.isFile()) return true; // symlink, directory, fifo, device, … — never chmod/rename onto it
+  if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) return true; // foreign owner
+  return false;
+}
+
 /**
  * ONE writer for every providers.json write (EXTRACT-PER-CLIENT W1 FIX
  * GOV-3 item 1 + should-fix item 9) — writeByoConfig, clearProvidersFile,
@@ -78,14 +120,19 @@ function isHomeUnresolved(target) {
  * right instead of three independent (and, before this fix, drifted) copies
  * of it. Discipline, in order:
  *   1. mkdir the parent dir 0700 (idempotent).
- *   2. If a file already sits at `target`, chmod it 0600 BEFORE the
+ *   2. lstat whatever already sits at `target` and refuse (reasonCode
+ *      'provider-state-target-unsafe') if it exists and is not a regular
+ *      file owned by this uid (EXTRACTION-LOW-FOLLOWUPS item 4) — checked
+ *      BEFORE the chmod below, which would otherwise follow a planted
+ *      symlink.
+ *   3. If a file already sits at `target`, chmod it 0600 BEFORE the
  *      rename lands (belt-and-suspenders — the post-rename chmod below is
  *      the one that actually matters for a stale `.tmp`).
- *   3. Unlink any leftover `${target}.tmp` first (a crashed prior run, or a
+ *   4. Unlink any leftover `${target}.tmp` first (a crashed prior run, or a
  *      planted symlink), THEN create it fresh with `flag:'wx'` (O_EXCL) —
  *      refuses to silently reuse or follow anything already at that path.
- *   4. Atomic rename tmp -> target.
- *   5. chmodSync(target, 0o600) AFTER the rename. This is the literal fix
+ *   5. Atomic rename tmp -> target.
+ *   6. chmodSync(target, 0o600) AFTER the rename. This is the literal fix
  *      for GOV-3 finding 1: writeFileSync's `mode` option only applies on
  *      CREATION, so a stale `.tmp` that survived a crash at 0644 would
  *      rename onto `target` and KEEP 0644, silently falsifying the
@@ -93,7 +140,8 @@ function isHomeUnresolved(target) {
  *      `persistSelected` (scripts/providers/index.js) had this exact gap;
  *      this writer closes it everywhere at once.
  * Throws (does not swallow) when the home directory could not be resolved
- * (isHomeUnresolved) — callers decide how to surface that; see
+ * (isHomeUnresolved) or the existing target is unsafe (reasonCode
+ * 'provider-state-target-unsafe') — callers decide how to surface that; see
  * writeByoConfig/clearProvidersFile below and cmdProvider in
  * bin/auxilo-cli.js, which catches this rather than let a raw stack out
  * (should-fix item 10).
@@ -106,6 +154,11 @@ function writeProvidersStateAtomic(state, opts = {}) {
     throw err;
   }
   fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+  if (isUnsafeExistingTarget(target, opts)) {
+    const err = new Error('refusing to write ~/.auxilo/providers.json — an existing entry at that path is not a regular file owned by this account (possible symlink or foreign owner)');
+    err.reasonCode = 'provider-state-target-unsafe';
+    throw err;
+  }
   if (fs.existsSync(target)) fs.chmodSync(target, 0o600);
   const tmp = `${target}.tmp`;
   try { fs.unlinkSync(tmp); } catch { /* nothing there, or already gone — fine either way */ }
@@ -150,6 +203,12 @@ function readByoConfig(opts = {}) {
  * source discipline; the discipline itself — chmod-then-tmp-write-then-
  * rename, both 0600 — is copied, not the code).
  *
+ * Throws a tagged error (writeProvidersStateAtomic) on 'provider-home-
+ * unresolved' OR, since EXTRACTION-LOW-FOLLOWUPS item 4, on
+ * 'provider-state-target-unsafe' (an existing entry at the target path is
+ * a symlink or owned by a different uid) — cmdProvider in bin/auxilo-cli.js
+ * catches both rather than let a raw stack out.
+ *
  * @param {{provider:string, base_url?:string|null, model:string, api_key:string}} byoConfig
  */
 function writeByoConfig(byoConfig, opts = {}) {
@@ -182,7 +241,11 @@ function writeByoConfig(byoConfig, opts = {}) {
  * rather than guess a location to read/write. A stat/read failure other
  * than ENOENT (e.g. EACCES) returns 'unreadable' rather than rethrow — this
  * function's contract really is "never throws" now (should-fix item 10; the
- * old rethrow on non-ENOENT contradicted this same docblock).
+ * old rethrow on non-ENOENT contradicted this same docblock). The rewrite
+ * path below can now also throw (writeProvidersStateAtomic's
+ * 'provider-state-target-unsafe', EXTRACTION-LOW-FOLLOWUPS item 4) — caught
+ * here too, folded into 'unreadable', so this function's own "never throws"
+ * contract holds regardless of what writeProvidersStateAtomic does.
  *
  * @returns {'removed-file'|'removed-byo'|'noop'|'unreadable'|'unresolved'}
  *   'noop' covers both "no file" and "a file with no `byo` key to clear".
@@ -209,10 +272,18 @@ function clearProvidersFile(opts = {}) {
   }
   delete state.byo;
   if (Object.keys(state).length === 0) {
-    fs.unlinkSync(target);
+    try {
+      fs.unlinkSync(target);
+    } catch {
+      return 'unreadable'; // cannot remove it either — never throws (contract)
+    }
     return 'removed-file';
   }
-  writeProvidersStateAtomic(state, opts);
+  try {
+    writeProvidersStateAtomic(state, opts);
+  } catch {
+    return 'unreadable'; // e.g. provider-state-target-unsafe — never throws (contract)
+  }
   return 'removed-byo';
 }
 
@@ -244,6 +315,8 @@ function baseUrlFor(vendor, configured) {
  * throws.
  */
 function isProvidersFileModeUnsafe(opts = {}) {
+  // EXTRACTION-LOW-FOLLOWUPS item 2 (TOCTOU, accepted on the record): a
+  // window exists between this check and readByoConfig()'s read below; only the same uid could win that race, and that uid already owns the key on disk, so it is accepted rather than replaced with an fd-based check-then-read.
   const target = statePath(opts);
   if (isHomeUnresolved(target)) return true; // can't even name the file — fail closed
   const statSyncImpl = typeof opts.statSyncImpl === 'function' ? opts.statSyncImpl : fs.statSync;
@@ -627,5 +700,7 @@ module.exports = {
   isHomeUnresolved,
   isBaseUrlInsecure,
   writeProvidersStateAtomic,
+  // Exported for direct unit coverage (EXTRACTION-LOW-FOLLOWUPS item 4).
+  isUnsafeExistingTarget,
   MAX_RESPONSE_BYTES,
 };

package/scripts/providers/claude-code.js

@@ -41,6 +41,93 @@ function resolveClaudeBin(opts = {}) {
   return 'claude';
 }
 
+// ─── Child settings/hooks isolation (EXTRACTION-CHILD-HOOKS, PUNCH-LIST P1,
+// 0.9.15) ────────────────────────────────────────────────────────────────
+//
+// Every `claude -p` extraction child previously loaded the OPERATOR'S OWN
+// ~/.claude/settings.json and therefore fired their personal SessionStart
+// hooks (mandate.sh, session-context.sh, ...) — output that reaches the
+// extraction/judge prompt without ever passing the package's scrubber. That
+// is a privacy defect: content from the machine's own hook configuration
+// (potentially personal notes, live queries, etc.) enters a transcript that
+// gets sent to the resolved provider.
+//
+// `--setting-sources <sources>` ("Comma-separated list of setting sources to
+// load (user, project, local)") is documented on both installed CLIs probed
+// during investigation (2.1.12, 2.1.260) — scratchpad hooks-0914/
+// EXTRACTION-CHILD-HOOKS-FINDINGS.md. This build (hooks-0915) tested LIVE
+// whether an EMPTY list (`--setting-sources ''`) — the narrowest, fully
+// cwd-independent value, loading none of user/project/local — is accepted:
+// it is (2.1.12, exit 0, hook_response count 0, well-formed result). Shipping
+// `''` means no fresh-temp-cwd workaround is needed: an empty source list
+// loads nothing regardless of the child's cwd, unlike the `project,local`
+// fallback (which still honors a target repo's own `.claude/settings.json`).
+const SETTING_SOURCES_VALUE = '';
+const SETTING_SOURCES_ARGS = Object.freeze(['--setting-sources', SETTING_SOURCES_VALUE]);
+
+/**
+ * Fail-closed detection of "this CLI build doesn't understand
+ * --setting-sources at all" (an old install predating the flag, or a rename).
+ * Detected from the SAME spawn that already carries the flag — no extra
+ * `--help`/`--version` probe call, so the happy-path spawn count for every
+ * existing caller/test is unchanged. A CLI rejecting an unknown flag exits
+ * non-zero with a message naming the flag (commander.js-style "error:
+ * unknown option '--setting-sources'"); this pattern-matches for that
+ * specific shape rather than treating every non-zero exit as unsupported (a
+ * real model/auth error must NOT be misreported as isolation-unsupported).
+ * Cached module-wide for the lifetime of the process ("once per run"): the
+ * first spawn that hits this failure marks the CLI unsupported and every
+ * subsequent runModel() call in the same process short-circuits BEFORE
+ * spawning again — it must never spawn without the flag, and re-attempting a
+ * doomed spawn every call would be silent waste, not safety.
+ */
+let cachedSettingSourcesUnsupported; // undefined = not yet observed; true once detected
+
+function looksLikeUnsupportedSettingSourcesFlag(res) {
+  if (!res || res.status === 0) return false;
+  const combined = `${String(res.stdout || '')}\n${String(res.stderr || '')}`;
+  return /--setting-sources/.test(combined) && /\b(unknown|unrecognized|invalid)\b.{0,20}\b(option|argument|flag)\b/i.test(combined);
+}
+
+function settingSourcesIsolationUnsupportedResult(authStatus) {
+  return {
+    ok: false,
+    text: '',
+    usage: null,
+    reason: 'installed Claude Code CLI does not support --setting-sources; extraction declines to run a child that would load the operator\'s own settings/hooks unisolated',
+    reasonCode: 'cli-settings-isolation-unsupported',
+    authStatus: authStatus || 'unknown',
+  };
+}
+
+/** Test-only: reset the module-level isolation-support cache between fixtures. */
+function _resetSettingSourcesCacheForTests() {
+  cachedSettingSourcesUnsupported = undefined;
+}
+
+// ─── CLI version, for diagnostics only (no subprocess spawn) ───────────────
+//
+// Resolves the installed package's own package.json version by following the
+// resolved binary's real path (e.g. `/usr/local/bin/claude` -> `.../
+// node_modules/@anthropic-ai/claude-code/cli.js`) and reading the sibling
+// package.json — filesystem-only, so it never adds a spawn to the extraction
+// path (verified live: realpath + package.json read, no `claude --version`
+// call). Best-effort: any failure (bare `claude` unresolved via PATH, an
+// install layout that doesn't carry a sibling package.json, a fixture path in
+// tests) yields null, never throws.
+function getClaudeCliVersion(bin, opts = {}) {
+  const realpathSyncImpl = typeof opts.realpathSyncImpl === 'function' ? opts.realpathSyncImpl : fs.realpathSync;
+  const readFileSyncImpl = typeof opts.readFileSyncImpl === 'function' ? opts.readFileSyncImpl : fs.readFileSync;
+  try {
+    const real = realpathSyncImpl(bin);
+    const pkgPath = path.join(path.dirname(real), 'package.json');
+    const pkg = JSON.parse(readFileSyncImpl(pkgPath, 'utf8'));
+    return pkg && typeof pkg.version === 'string' ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
+
 // ─── Env scrub (EXTRACT-TOOLS-LOCK, PUNCH-LIST) ────────────────────────────
 //
 // SME-confirmed list (claude-code-guide, verified against official docs and
@@ -79,6 +166,20 @@ const SCRUBBED_CLIENT_ENV_VARS = Object.freeze([
   'CLOUD_ML_REGION',
 ]);
 
+// ─── Spawn argv (EXTRACTION-ZERO-TOOL-CALLS control) ───────────────────────
+//
+// Named + frozen so a byte-pinned test (test/extraction-zero-tool-calls.test.js,
+// test/claude-code-provider.test.js) can assert the exact argv without
+// duplicating the literal, and so a future flag change is a conscious,
+// greppable edit here rather than a silent literal tweak buried in the two
+// runXMode() functions below. No behavior change: the two spawnSyncImpl()
+// call sites below now pass these constants instead of inline array literals
+// of the identical contents. 0.9.15 (EXTRACTION-CHILD-HOOKS) appends
+// SETTING_SOURCES_ARGS to both — the child loads none of user/project/local
+// settings, so the operator's own SessionStart hooks never fire.
+const EXTRACT_MODE_ARGV = Object.freeze(['-p', '--no-session-persistence', '--tools', '', ...SETTING_SOURCES_ARGS]);
+const JUDGE_MODE_ARGV = Object.freeze(['-p', '--output-format', 'json', '--no-session-persistence', '--tools', '', ...SETTING_SOURCES_ARGS]);
+
 /**
  * Build the subscription-auth-only environment shared by BOTH the extraction and
  * judge Claude CLI children — one function, no drift between the two spawns.
@@ -154,7 +255,19 @@ function managedSettingsPathForPlatform(opts) {
   // otherwise names a fixed, real, OS-level location no test should touch).
   if (typeof opts.managedSettingsPath === 'string') return opts.managedSettingsPath;
   const platform = typeof opts.platform === 'string' ? opts.platform : process.platform;
-  return MANAGED_SETTINGS_PATH_BY_PLATFORM[platform] || MANAGED_SETTINGS_PATH_BY_PLATFORM.linux;
+  // EXTRACTION-LOW-FOLLOWUPS item 1: a raw `[platform]` index is reachable
+  // (only via the test seam opts.platform, per the row) with a prototype key
+  // ('constructor', 'toString', '__proto__', …) and would return a truthy
+  // Object.prototype value instead of falling through to the Linux default —
+  // fails OPEN with a bogus path silently in place of the real managed-
+  // settings check. hasOwnProperty scopes the lookup to the object's own
+  // enumerable keys, mirroring the guard at scripts/providers/index.js:139,
+  // so an unknown or prototype-polluting key falls CLOSED to the Linux path
+  // exactly like any other unrecognized platform string does today.
+  if (Object.prototype.hasOwnProperty.call(MANAGED_SETTINGS_PATH_BY_PLATFORM, platform)) {
+    return MANAGED_SETTINGS_PATH_BY_PLATFORM[platform];
+  }
+  return MANAGED_SETTINGS_PATH_BY_PLATFORM.linux;
 }
 
 /**
@@ -167,7 +280,7 @@ function managedSettingsPathForPlatform(opts) {
  * that matches Claude Code's own behavior for those files, which this
  * managed path does not share.)
  */
-function managedSettingsBlocksOrUnverifiable(filePath, existsSyncImpl, readFileSyncImpl) {
+function managedSettingsBlocksOrUnverifiable(filePath, existsSyncImpl, readFileSyncImpl, log) {
   let exists;
   try {
     exists = existsSyncImpl(filePath);
@@ -176,7 +289,17 @@ function managedSettingsBlocksOrUnverifiable(filePath, existsSyncImpl, readFileS
   }
   if (!exists) return false;
   const parsed = readJsonSafe(filePath, readFileSyncImpl);
-  if (parsed === null) return true; // present but unreadable/unparseable — fail closed
+  if (parsed === null) {
+    // EXTRACTION-LOW-FOLLOWUPS item 3: this fail-closed branch silently
+    // switches the builder away from claude-code (reasonCode
+    // 'cli-billing-helper-configured', same as a real detected helper) with
+    // no visible signal that the cause was an UNVERIFIABLE managed-settings
+    // file rather than an actual foreign-billing helper. One stderr line
+    // naming the reason code — never the file's contents or any key
+    // material, both of which stay out of every log call in this module.
+    log('[providers] managed-settings.json is present but unreadable/unparseable; failing closed and switching away from claude-code (reasonCode cli-billing-helper-configured)');
+    return true; // present but unreadable/unparseable — fail closed
+  }
   return settingsHasBillingHelper(parsed);
 }
 
@@ -195,8 +318,9 @@ function detectBillingHelperConfigured(opts = {}) {
   const existsSyncImpl = typeof opts.existsSyncImpl === 'function' ? opts.existsSyncImpl : fs.existsSync;
   const homeDir = typeof opts.homeDir === 'string' ? opts.homeDir : os.homedir();
   const cwd = typeof opts.cwd === 'string' ? opts.cwd : process.cwd();
+  const log = typeof opts.log === 'function' ? opts.log : console.error;
 
-  if (managedSettingsBlocksOrUnverifiable(managedSettingsPathForPlatform(opts), existsSyncImpl, readFileSyncImpl)) {
+  if (managedSettingsBlocksOrUnverifiable(managedSettingsPathForPlatform(opts), existsSyncImpl, readFileSyncImpl, log)) {
     return true;
   }
 
@@ -274,6 +398,7 @@ function detect(opts = {}) {
 function runExtractMode(opts) {
   const spawnSyncImpl = typeof opts.spawnSyncImpl === 'function' ? opts.spawnSyncImpl : spawnSync;
   const bin = typeof opts.claudeBin === 'string' ? opts.claudeBin : resolveClaudeBin(opts);
+  if (cachedSettingSourcesUnsupported) return settingSourcesIsolationUnsupportedResult('unknown');
   const authStatus = checkAuthStatus({ spawnSyncImpl, claudeBin: bin, ...opts });
   if (authStatus === 'logged-out') {
     return {
@@ -287,11 +412,18 @@ function runExtractMode(opts) {
   }
   const prompt = typeof opts.prompt === 'string' ? opts.prompt : '';
   const stdin = prompt + String(opts.input || '').slice(0, 200000);
+  // --no-session-persistence (EXTRACT-PER-CLIENT W1 FIX GIVENS): matches the
+  // judge spawn below — an extraction run leaves no session file behind either.
+  // --setting-sources '' (EXTRACTION-CHILD-HOOKS, 0.9.15): the child loads none
+  // of user/project/local settings, so the operator's own SessionStart hooks
+  // never fire and their output never reaches this prompt.
+  const argv = EXTRACT_MODE_ARGV;
+  const cliVersion = getClaudeCliVersion(bin, opts);
   let res;
   try {
     // --no-session-persistence (EXTRACT-PER-CLIENT W1 FIX GIVENS): matches the
     // judge spawn below — an extraction run leaves no session file behind either.
-    res = spawnSyncImpl(bin, ['-p', '--no-session-persistence', '--tools', ''], {
+    res = spawnSyncImpl(bin, argv, {
       input: stdin,
       encoding: 'utf-8',
       env: claudeChildEnv(),
@@ -299,14 +431,18 @@ function runExtractMode(opts) {
       maxBuffer: 20 * 1024 * 1024,
     });
   } catch (error) {
-    return { ok: false, text: '', usage: null, reason: `spawn failed (${bin}): ${error.message}`, reasonCode: 'unknown', authStatus };
+    return { ok: false, text: '', usage: null, reason: `spawn failed (${bin}): ${error.message}`, reasonCode: 'unknown', authStatus, argv, cliVersion };
   }
   if (!res) {
-    return { ok: false, text: '', usage: null, reason: `spawn failed (${bin}): no process result`, reasonCode: 'unknown', authStatus };
+    return { ok: false, text: '', usage: null, reason: `spawn failed (${bin}): no process result`, reasonCode: 'unknown', authStatus, argv, cliVersion };
+  }
+  if (looksLikeUnsupportedSettingSourcesFlag(res)) {
+    cachedSettingSourcesUnsupported = true;
+    return { ...settingSourcesIsolationUnsupportedResult(authStatus), argv, cliVersion };
   }
   const out = String(res.stdout || '');
   if (res.error) {
-    return { ok: false, text: '', usage: null, reason: `spawn failed (${bin}): ${res.error.message}`, reasonCode: 'unknown', authStatus };
+    return { ok: false, text: '', usage: null, reason: `spawn failed (${bin}): ${res.error.message}`, reasonCode: 'unknown', authStatus, argv, cliVersion };
   }
   // Claude prints auth failures ("API Error: 401 ... Please run /login") to stdout.
   if (/Please run \/login|authentication_error|401/i.test(out) || /Please run \/login|authentication_error/i.test(String(res.stderr || ''))) {
@@ -317,6 +453,8 @@ function runExtractMode(opts) {
       reason: 'local model not authenticated in this context (run `claude auth login` once); skipping deterministic extraction',
       reasonCode: 'cli-unauthenticated',
       authStatus,
+      argv,
+      cliVersion,
       ...(authStatus === 'logged-in' && { authDiscrepancy: true }),
     };
   }
@@ -328,9 +466,11 @@ function runExtractMode(opts) {
       reason: `local model exited ${res.status}: ${(out || String(res.stderr || '')).slice(0, 160)}`,
       reasonCode: 'model-error',
       authStatus,
+      argv,
+      cliVersion,
     };
   }
-  return { ok: true, text: out, usage: null, reason: null, authStatus };
+  return { ok: true, text: out, usage: null, reason: null, authStatus, argv, cliVersion };
 }
 
 /**
@@ -353,14 +493,18 @@ function normalizeJudgeUsage(rawUsage) {
   return { input_tokens: inputSum, output_tokens: output };
 }
 
-/** mode:'judge' — binary anchored-dedup decision. Argv byte-identical to pre-move. */
+/** mode:'judge' — binary anchored-dedup decision. Argv byte-identical to pre-move plus
+ * the same --setting-sources '' isolation the extraction spawn above gains (0.9.15). */
 function runJudgeMode(opts) {
   const spawnSyncImpl = typeof opts.spawnSyncImpl === 'function' ? opts.spawnSyncImpl : spawnSync;
   const bin = typeof opts.claudeBin === 'string' ? opts.claudeBin : resolveClaudeBin(opts);
+  if (cachedSettingSourcesUnsupported) return settingSourcesIsolationUnsupportedResult('unknown');
   const prompt = typeof opts.prompt === 'string' ? opts.prompt : '';
+  const argv = JUDGE_MODE_ARGV;
+  const cliVersion = getClaudeCliVersion(bin, opts);
   let res;
   try {
-    res = spawnSyncImpl(bin, ['-p', '--output-format', 'json', '--no-session-persistence', '--tools', ''], {
+    res = spawnSyncImpl(bin, argv, {
       input: prompt,
       encoding: 'utf8',
       env: claudeChildEnv(),
@@ -368,17 +512,21 @@ function runJudgeMode(opts) {
       maxBuffer: 20 * 1024 * 1024,
     });
   } catch (error) {
-    return { ok: false, text: '', usage: null, reason: `judge spawn failed (${bin}): ${error.message}`, reasonCode: 'unknown', authStatus: 'unknown' };
+    return { ok: false, text: '', usage: null, reason: `judge spawn failed (${bin}): ${error.message}`, reasonCode: 'unknown', authStatus: 'unknown', argv, cliVersion };
   }
   if (!res) {
-    return { ok: false, text: '', usage: null, reason: `judge spawn failed (${bin}): no process result`, reasonCode: 'unknown', authStatus: 'unknown' };
+    return { ok: false, text: '', usage: null, reason: `judge spawn failed (${bin}): no process result`, reasonCode: 'unknown', authStatus: 'unknown', argv, cliVersion };
+  }
+  if (looksLikeUnsupportedSettingSourcesFlag(res)) {
+    cachedSettingSourcesUnsupported = true;
+    return { ...settingSourcesIsolationUnsupportedResult('unknown'), argv, cliVersion };
   }
   const stdout = String(res.stdout || '');
   if (res.error) {
-    return { ok: false, text: '', usage: null, reason: `judge spawn failed (${bin}): ${res.error.message}`, reasonCode: 'unknown', authStatus: 'unknown' };
+    return { ok: false, text: '', usage: null, reason: `judge spawn failed (${bin}): ${res.error.message}`, reasonCode: 'unknown', authStatus: 'unknown', argv, cliVersion };
   }
   if (/Please run \/login|authentication_error|401/i.test(stdout) || /Please run \/login|authentication_error/i.test(String(res.stderr || ''))) {
-    return { ok: false, text: '', usage: null, reason: 'local judge model is not authenticated', reasonCode: 'cli-unauthenticated', authStatus: 'unknown' };
+    return { ok: false, text: '', usage: null, reason: 'local judge model is not authenticated', reasonCode: 'cli-unauthenticated', authStatus: 'unknown', argv, cliVersion };
   }
   if (res.status !== 0) {
     return {
@@ -388,18 +536,20 @@ function runJudgeMode(opts) {
       reason: `local judge exited ${res.status}: ${(stdout || String(res.stderr || '')).slice(0, 160)}`,
       reasonCode: 'model-error',
       authStatus: 'unknown',
+      argv,
+      cliVersion,
     };
   }
   let wrapper;
   try {
     wrapper = JSON.parse(stdout);
   } catch {
-    return { ok: false, text: '', usage: null, reason: 'local judge returned malformed JSON wrapper', reasonCode: 'model-error', authStatus: 'unknown' };
+    return { ok: false, text: '', usage: null, reason: 'local judge returned malformed JSON wrapper', reasonCode: 'model-error', authStatus: 'unknown', argv, cliVersion };
   }
   if (!wrapper || typeof wrapper.result !== 'string' || wrapper.is_error === true) {
-    return { ok: false, text: '', usage: null, reason: 'local judge returned no successful result', reasonCode: 'model-error', authStatus: 'unknown' };
+    return { ok: false, text: '', usage: null, reason: 'local judge returned no successful result', reasonCode: 'model-error', authStatus: 'unknown', argv, cliVersion };
   }
-  return { ok: true, text: wrapper.result, usage: normalizeJudgeUsage(wrapper.usage), reason: null, authStatus: 'unknown' };
+  return { ok: true, text: wrapper.result, usage: normalizeJudgeUsage(wrapper.usage), reason: null, authStatus: 'unknown', argv, cliVersion };
 }
 
 /**
@@ -474,4 +624,18 @@ module.exports = {
   // Exported for direct unit coverage (test/extract-w1-fix2.test.js, GOV-3 item 6).
   managedSettingsPathForPlatform,
   MANAGED_SETTINGS_PATH_BY_PLATFORM,
+  // Exported for direct byte-pinned coverage (test/extraction-zero-tool-calls.test.js,
+  // test/claude-code-provider.test.js; TRUST-PAGE control — SITE-PM: put the
+  // zero-tool-call assertion in the test suite). Carries the 0.9.15 argv
+  // (SETTING_SOURCES_ARGS included).
+  EXTRACT_MODE_ARGV,
+  JUDGE_MODE_ARGV,
+  // EXTRACTION-CHILD-HOOKS (0.9.15) — exported for direct unit coverage
+  // (test/claude-code-provider.test.js) and for extract-local.js's provider-run
+  // log line (getClaudeCliVersion).
+  SETTING_SOURCES_VALUE,
+  SETTING_SOURCES_ARGS,
+  getClaudeCliVersion,
+  looksLikeUnsupportedSettingSourcesFlag,
+  _resetSettingSourcesCacheForTests,
 };

package/scripts/providers/index.js

@@ -78,7 +78,13 @@ const PROVIDERS = {
   'byo-key': byoKey,
 };
 
-const PROVIDERS_STATE_PATH = path.join(os.homedir(), '.auxilo', 'providers.json');
+// TEST-HOME-ISOLATION: same AUXILO_HOME-over-os.homedir() fallback as
+// scripts/providers/byo-key.js's DEFAULT_PROVIDERS_STATE_PATH (duplicated,
+// not imported — see that file's docblock; test/byo-key-provider.test.js
+// pins the two byte-equal). opts.providersStatePath, threaded through every
+// resolveProvider()/runModel()/persistSelected() call site in this repo's
+// tests, still wins over both.
+const PROVIDERS_STATE_PATH = path.join(process.env.AUXILO_HOME || os.homedir(), '.auxilo', 'providers.json');
 
 function readProvidersState(statePath) {
   try {
@@ -232,6 +238,11 @@ const NON_RETRYABLE_FOR_THIS_PROVIDER = new Set([
   'cli-billing-helper-configured',
   'provider-not-configured',
   'providers-file-mode-unsafe',
+  // EXTRACTION-CHILD-HOOKS (0.9.15): the resolved claude-code CLI doesn't
+  // support --setting-sources, so it can never run isolated — same
+  // "cannot run at all right now" class as the codes above, safe to try the
+  // next provider in PROVIDER_ORDER rather than reporting a hard failure.
+  'cli-settings-isolation-unsupported',
 ]);
 
 /**

package/scripts/runner.js

@@ -645,6 +645,11 @@ async function postExtractDetailed(transcript, sessionId, sourceType, _scrubRepo
       captureVisibility: opts.captureVisibility || CAPTURE_VISIBILITY,
       log: runnerLog,
       auditLog: auditDropLog,
+      // EXTRACTION-RUN-LOG (0.9.15): the identifier the provider-run summary
+      // log line reports as `run=`. sessionId is already this call's natural
+      // run identity (it's what extraction_id: `client-${sessionId}` uses
+      // below); opts.runId (if a caller supplied one) wins over it.
+      runId: opts.runId || sessionId,
     }));
   } catch (err) {
     throw new Error(`Local extraction failed: ${err.message}`);