auxilo-mcp 0.9.17 → 0.9.18

package/bin/auxilo-cli.js

@@ -586,7 +586,7 @@ async function cmdStatus() {
     );
     if (autoupdateLine) console.log(autoupdateLine);
   }
-  console.log(extractionProviderLine(await providers.resolveProvider({})));
+  console.log(extractionProviderLine(lastRecordedProviderResolution()));
   // Lazy require: scripts/runner.js is a heavier module (sources, sensitivity
   // filter, ops-alert) than this one status line needs at require-time for
   // every CLI invocation.
@@ -625,18 +625,58 @@ function runnerSkewLine(skew) {
  */
 const CLI_CLEAN_LANE_CALIBRATED_PROVIDERS = ['claude-code'];
 
+/**
+ * EXTRACTION-MODEL-PROVENANCE (PUNCH-LIST P1): `auxilo status` used to feed
+ * extractionProviderLine() a LIVE `providers.resolveProvider({})` call — a
+ * fresh detect() answering "what would run right now" (and, on a full scan,
+ * capable of writing ~/.auxilo/providers.json's `selected` field as a side
+ * effect of a status check), not "what actually ran". This function replaces
+ * that with two read-only, no-detect sources of TRUTH, in priority order:
+ * (1) AUXILO_EXTRACTION_PROVIDER, if set, is a certain fact about the
+ *     current session's config — reading it is not a guess — validated
+ *     against providers.PROVIDER_ORDER exactly as resolveProvider() itself
+ *     validates an override, without calling it.
+ * (2) Otherwise, providers.json's `selected` field — the LAST provider a
+ *     genuine resolveProvider() full-scan actually chose and persisted
+ *     (scripts/providers/index.js's persistSelected(), only ever called
+ *     after a real detect() succeeded) — read here with a plain
+ *     fs.readFileSync, no detect() invoked, no possibility of writing.
+ * Neither source can misrepresent "would run" as "ran": (1) is what WILL
+ * run (an explicit operator override, not a probe), and (2) is what was
+ * last recorded to have been selected, honestly labeled as such below.
+ * `{ok:false}` (shown as "no recorded provider selection yet") when neither
+ * source has an answer — e.g. a fresh install that has never extracted.
+ */
+function lastRecordedProviderResolution() {
+  const override = process.env.AUXILO_EXTRACTION_PROVIDER;
+  if (override) {
+    if (providers.PROVIDER_ORDER.includes(override)) return { ok: true, id: override };
+    return {
+      ok: false,
+      reason: `AUXILO_EXTRACTION_PROVIDER="${override}" is not a known provider (expected one of: ${providers.PROVIDER_ORDER.join(', ')})`,
+    };
+  }
+  try {
+    const raw = fs.readFileSync(providers.PROVIDERS_STATE_PATH, 'utf8');
+    const parsed = JSON.parse(raw);
+    const id = parsed && typeof parsed === 'object' && typeof parsed.selected === 'string' ? parsed.selected : null;
+    if (id) return { ok: true, id };
+  } catch { /* no recorded selection yet, or the file is unreadable/corrupt */ }
+  return { ok: false, reason: 'no recorded provider selection yet' };
+}
+
 /**
  * EXTRACT-PER-CLIENT W1 PART A/C — one unconditional line naming which
- * extraction model provider resolves, why (env override vs auto-detected),
- * and (PART C) whether that provider's submissions can reach the clean-lane
- * auto-publish path at all (server-side gate: lib/clean-lane.js's
- * CLEAN_LANE_CALIBRATED_PROVIDERS, mirrored above).
+ * extraction model provider resolves, why (env override vs last recorded
+ * selection), and (PART C) whether that provider's submissions can reach
+ * the clean-lane auto-publish path at all (server-side gate:
+ * lib/clean-lane.js's CLEAN_LANE_CALIBRATED_PROVIDERS, mirrored above).
  */
 function extractionProviderLine(resolution) {
   if (resolution && resolution.ok) {
     const via = process.env.AUXILO_EXTRACTION_PROVIDER
       ? 'env override AUXILO_EXTRACTION_PROVIDER'
-      : 'auto-detected';
+      : 'last recorded selection';
     const calibration = CLI_CLEAN_LANE_CALIBRATED_PROVIDERS.includes(resolution.id)
       ? 'clean-lane calibrated'
       : 'review-lane only';
@@ -1639,6 +1679,7 @@ module.exports = {
   parseFlags,
   runnerSkewLine,
   extractionProviderLine,
+  lastRecordedProviderResolution,
   resolveBaseUrl,
   shortFlags,
   groupSummaryRows,

package/mcp-server.js

@@ -198,7 +198,7 @@ async function postBulkChunks(headers, decisions) {
 }
 
 const server = new Server(
-  { name: 'auxilo', version: '0.9.17' },
+  { name: 'auxilo', version: '0.9.18' },
   {
     capabilities: { tools: {} },
     instructions: `You are connected to Auxilo, a knowledge marketplace where AI agents buy and sell operational learnings.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auxilo-mcp",
-  "version": "0.9.17",
+  "version": "0.9.18",
   "mcpName": "io.github.silent-architects/auxilo",
   "description": "MCP server for Auxilo. Your agent stops solving the same problem twice: auto-extracted learnings, free self-unlocks, and earnings when other agents unlock yours.",
   "main": "mcp-server.js",

package/scripts/extract-local.js

@@ -400,37 +400,37 @@ function judgeUsage(usage, prompt, completion) {
 
 /**
  * PART C — resolve the extraction_model identity for a runModel result.
- * Prefers the additive `identity` field a provider's runModel result may
- * carry. Current state (post Gate-A item a): byo-key.js always sets one
- * ({provider:'byo-key', model, version:null, vendor}); codex-cli.js sets one
- * on success ({provider:'codex-cli', model:null, version:<codex --version>,
- * vendor:null} — its result also carries the same object under the
- * deprecated `extraction_model` alias, kept for one release only for
- * test/codex-cli-provider.test.js). claude-code.js is the one provider that
- * still sets no `identity` on its result — that's the case this function's
- * fallback exists for: it re-resolves via providers.resolveProvider() and
- * stamps {provider: resolved.id, model: null, version: null, vendor: null},
- * so every provider gets SOME stamp, never silently none. That re-resolution
- * walks scripts/providers/index.js's PROVIDER_ORDER (claude-code →
- * codex-cli → byo-key); resolveProvider/runModel there fall through from one
- * provider to the next only on a NON_RETRYABLE_FOR_THIS_PROVIDER reasonCode
- * (unauthenticated, not installed, a billing helper configured, an
- * unconfigured BYO key, or an unsafe providers.json mode) — a provider that
- * merely failed once (a timeout, a model error) is not retried under a
- * different one. Best-effort throughout: a resolution failure here must
- * never block extraction itself.
+ *
+ * EXTRACTION-MODEL-PROVENANCE (PUNCH-LIST P1): this function used to fall
+ * back to a FRESH, INDEPENDENT providers.resolveProvider() call whenever the
+ * result carried no `identity` — a re-detect decoupled from which provider
+ * actually produced `runModelResult`, which is what "what would run now"
+ * answers, not "what ran". That re-resolve could also silently rewrite
+ * `~/.auxilo/providers.json` (resolveProvider's full-scan path calls
+ * persistSelected) from what should have been a read-only identity lookup.
+ * Both are gone. `identity` is now ALWAYS attached by
+ * scripts/providers/index.js's runModel() itself — centrally, because that
+ * registry is the only thing that knows which module it actually invoked
+ * for this call (see its withIdentity()/deriveIdentity() — claude-code's own
+ * cliVersion is used there when present, richer than the null/null/null
+ * triple this function used to guess). This function's job shrinks to: use
+ * the identity the result actually carries, or admit the honest
+ * `provider:'unknown'` when none exists (the `no-usable-provider` /
+ * bad-override-name aggregate failures — nothing actually ran to
+ * completion, so there is nothing to attribute). Never re-derives, never
+ * writes, never blocks extraction on failure.
  */
-async function resolveExtractionModelIdentity(runModelResult, opts) {
-  if (runModelResult && runModelResult.identity && typeof runModelResult.identity === 'object') {
+function resolveExtractionModelIdentity(runModelResult) {
+  if (
+    runModelResult
+    && runModelResult.identity
+    && typeof runModelResult.identity === 'object'
+    && typeof runModelResult.identity.provider === 'string'
+    && runModelResult.identity.provider
+  ) {
     return runModelResult.identity;
   }
-  try {
-    const resolved = await providers.resolveProvider(opts);
-    if (resolved && resolved.ok && resolved.id) {
-      return { provider: resolved.id, model: null, version: null, vendor: null };
-    }
-  } catch { /* identity is best-effort; never block extraction on it */ }
-  return null;
+  return { provider: 'unknown', model: null, version: null, vendor: null };
 }
 
 /**
@@ -456,7 +456,7 @@ async function defaultInvokeModel(transcript, invokeOpts, opts) {
     reason: result.reason,
     reasonCode: result.reasonCode,
     authStatus: result.authStatus,
-    extractionModel: await resolveExtractionModelIdentity(result, opts),
+    extractionModel: resolveExtractionModelIdentity(result),
     ...(result.authDiscrepancy !== undefined && { authDiscrepancy: result.authDiscrepancy }),
     // EXTRACTION-RUN-LOG (0.9.15): additive passthrough for the one-line-per-run
     // provider summary logged at the end of extractLocally() below. Only
@@ -704,12 +704,53 @@ function formatArgvForLog(argv) {
  * (spawned) this run, not whether it succeeded — a spawn that ran and then
  * hit a model error still counts as "ran" (it happened; the failure is in
  * `reason`, not in whether isolation applied). `hooks` is `claude-code`-
- * specific: 'isolated' whenever a claude-code spawn this run carried
- * --setting-sources (the only state a spawn can be in per the fail-closed
- * gate in scripts/providers/claude-code.js — it never spawns without the
- * flag), 'unsupported' when the CLI was found not to support the flag at
- * all, 'n/a' for a non-claude-code provider (codex-cli/byo-key isolate by a
- * different mechanism entirely, out of this row's scope).
+ * specific and EVIDENCE-DERIVED (EXTRACT-LOG-HOOKS-EVIDENCE, PUNCH-LIST P2):
+ * it reads the argv this run actually captured rather than inferring
+ * isolation from the provider name plus the absence of a reason code —
+ * 'isolated' ONLY when that argv literally contains --setting-sources (the
+ * flag scripts/providers/claude-code.js's fail-closed gate never spawns
+ * without), 'unsupported' when the CLI was found not to support the flag at
+ * all (existing reason-code path, unchanged), 'unknown' when no argv was
+ * captured this run (finder skipped pre-spawn, or the run that actually
+ * produced this result fell through to a different/no provider — see the
+ * EXTRACT-LOG-HOOKS-EVIDENCE root-cause note below), and 'n/a' for a
+ * non-claude-code provider (codex-cli/byo-key isolate by a different
+ * mechanism entirely, out of this row's scope). Never 'isolated' without an
+ * argv carrying the flag in hand — a safety claim needs evidence, not an
+ * absence of contrary evidence.
+ *
+ * Root cause of the missing-argv runs (EXTRACT-LOG-HOOKS-EVIDENCE
+ * investigation): claude-code.js's own runExtractMode() never omits argv on
+ * a claude-code result that actually reached this line — every return after
+ * `const argv = EXTRACT_MODE_ARGV` carries it, and the two pre-spawn
+ * short-circuits that don't (cached --setting-sources-unsupported,
+ * cli-unauthenticated) both carry reasonCodes already in
+ * PRE_SPAWN_SKIP_REASON_CODES, so they render finder=skipped, not ran. The
+ * observed defect lines (finder=ran, flags=n/a) come from a DIFFERENT case:
+ * scripts/providers/index.js's runModel() falls through from claude-code to
+ * the next configured provider (e.g. codex-cli) whenever claude-code's own
+ * attempt fails with a NON_RETRYABLE_FOR_THIS_PROVIDER reasonCode, and
+ * returns that OTHER provider's result directly when it stops there. That
+ * provider's result carries no `argv` field at all (argv is a
+ * claude-code-only concept), so there is no shipped argv being hidden here —
+ * 'unknown' remains the correct, honest `hooks` value regardless of which
+ * provider is named.
+ *
+ * EXTRACTION-MODEL-PROVENANCE (PUNCH-LIST P1) closed the mismatch this
+ * docblock used to describe as a known, deferred gap: a fallthrough
+ * provider's result used to reach this function carrying no `identity` on
+ * failure (codex-cli/byo-key only self-stamped on success), so
+ * resolveExtractionModelIdentity()'s old fallback re-resolved the label via
+ * a FRESH, INDEPENDENT providers.resolveProvider() call — decoupled from
+ * which provider's runModel() result was actually being logged, and prone to
+ * landing back on 'claude-code' (its detect() only checks the
+ * billing-helper gate + auth status, not whether the earlier attempt
+ * actually spawned). That fallback is gone. `identity` is now attached
+ * centrally by providers/index.js's runModel() to EVERY result it returns —
+ * success or failure, fallthrough or not — because that registry alone
+ * knows which module it actually invoked for a given attempt. The line this
+ * function renders now names the provider that actually ran (or 'unknown'
+ * only when nothing did), not a guess.
  */
 function logProviderRunSummary(opts, runId, modelResult, judged) {
   try {
@@ -725,8 +766,11 @@ function logProviderRunSummary(opts, runId, modelResult, judged) {
     const cliVersion = modelResult.cliVersion || (judged && judged.judgeCliVersion) || null;
     const finderUnsupported = modelResult.reasonCode === 'cli-settings-isolation-unsupported';
     const judgeUnsupported = Boolean(judged && judged.judgeReasonCode === 'cli-settings-isolation-unsupported');
+    const hasSettingSourcesArgv = Array.isArray(argv) && argv.includes('--setting-sources');
     const hooks = provider === 'claude-code'
-      ? ((finderUnsupported || judgeUnsupported) ? 'unsupported' : 'isolated')
+      ? ((finderUnsupported || judgeUnsupported)
+        ? 'unsupported'
+        : (hasSettingSourcesArgv ? 'isolated' : 'unknown'))
       : 'n/a';
     log(
       `[providers] run=${runId || 'unknown'} provider=${provider} cli=${cliVersion || '-'} ` +
@@ -875,4 +919,7 @@ module.exports = {
   resolveClaudeBin: claudeCodeProvider.resolveClaudeBin,
   // EXTRACTION-RUN-LOG (0.9.15) — exported for direct unit coverage.
   formatArgvForLog, logProviderRunSummary, PRE_SPAWN_SKIP_REASON_CODES,
+  // EXTRACTION-MODEL-PROVENANCE (PUNCH-LIST P1) — exported for direct unit
+  // coverage of the "never guess, fail closed to unknown" contract.
+  resolveExtractionModelIdentity,
 };

package/scripts/providers/index.js

@@ -245,6 +245,92 @@ const NON_RETRYABLE_FOR_THIS_PROVIDER = new Set([
   'cli-settings-isolation-unsupported',
 ]);
 
+/**
+ * EXTRACTION-MODEL-PROVENANCE (PUNCH-LIST P1, follow-up to the
+ * EXTRACT-LOG-HOOKS-EVIDENCE row): `identity` on a runModel() result is
+ * provenance — a record of which provider actually produced this text — not
+ * a guess. It must never be re-derived after the fact from a fresh detect(),
+ * because a fresh detect() answers "what would run now", not "what ran".
+ * This registry is the only thing that KNOWS which module's runModel() it
+ * just invoked for a given attempt, so identity is enforced HERE, centrally,
+ * rather than trusted to per-provider convention (the gap this row closes:
+ * before this fix, a provider `ok:true` return that forgot to attach
+ * `identity` would silently fall through to extract-local.js's
+ * resolveExtractionModelIdentity() re-detecting via resolveProvider() —
+ * decoupled from which module actually ran).
+ */
+function hasUsableIdentity(identity) {
+  return Boolean(
+    identity
+    && typeof identity === 'object'
+    && typeof identity.provider === 'string'
+    && identity.provider
+  );
+}
+
+/**
+ * Derive an identity for the module actually invoked as `id`, used only when
+ * that module's own result didn't already carry one. The derivation differs
+ * by outcome, because a SUCCESS identity can reach a published learning and
+ * the clean-lane calibration gate, while a FAILURE identity is purely
+ * diagnostic (extract-local.js returns before stamping anything onto a
+ * candidate on `ok:false` — see its `:824-834`):
+ *
+ * - claude-code: always gets a real, provider-specific identity — it
+ *   already has `cliVersion` in hand on every returned result (success or
+ *   failure), richer than the null/null/null triple this used to guess, and
+ *   claude-code is the one provider documented to never self-stamp
+ *   `identity` at all, so this is filling a KNOWN, structural gap, not
+ *   papering over a violated contract.
+ * - Every other provider on a FAILURE: `{provider:id, model:null,
+ *   version:null, vendor:null}` — naming the module we actually invoked is
+ *   a plain structural fact (we chose to call it), not a guess, and it is
+ *   what lets the per-run `[providers]` log name the provider that actually
+ *   ran even when that provider's own failure return carries no identity
+ *   (codex-cli and byo-key only self-stamp on their SINGLE success return —
+ *   this is the exact fall-through failure case the investigation traced:
+ *   claude-code skipped, codex-cli ran and failed, no identity of its own,
+ *   the label used to be re-guessed as claude-code by the old fallback).
+ * - Every other provider on a SUCCESS: `{provider:'unknown', ...}` —
+ *   byo-key.js and codex-cli.js both self-stamp `identity` on their only
+ *   success return BY CONTRACT; a success with none means that contract was
+ *   violated, so this registry has no provider-reported basis for the
+ *   claim. Confidently naming the module here would look like provenance
+ *   without being backed by anything the provider itself reported — since
+ *   this stamp CAN reach a published learning, the fail-closed, honest
+ *   answer is 'unknown', never a guess dressed up as a fact.
+ */
+function deriveIdentity(id, result) {
+  if (id === 'claude-code') {
+    return {
+      provider: 'claude-code',
+      model: null,
+      version: (result && result.cliVersion) || null,
+      vendor: 'anthropic',
+    };
+  }
+  if (!(result && result.ok)) {
+    return { provider: id, model: null, version: null, vendor: null };
+  }
+  return { provider: 'unknown', model: null, version: null, vendor: null };
+}
+
+/**
+ * Attach a derived identity to `result` IFF it doesn't already carry a
+ * usable one — never overwrites a provider-reported identity (e.g.
+ * byo-key's real model name). Applied to every result this registry
+ * returns, success or failure, so the per-run `[providers]` log
+ * (scripts/extract-local.js's logProviderRunSummary) names the provider
+ * that actually ran even on a failure — that is the fall-through failure
+ * case this row's investigation traced (claude-code skipped, codex-cli ran
+ * and failed with no identity of its own, the stamp used to be re-guessed
+ * as claude-code by the caller).
+ */
+function withIdentity(id, result) {
+  if (hasUsableIdentity(result && result.identity)) return result;
+  return { ...result, identity: deriveIdentity(id, result) };
+}
+
 /**
  * runModel(opts) — resolve a starting provider via resolveProvider(), then
  * walk PROVIDER_ORDER from there, calling each candidate's OWN runModel()
@@ -262,7 +348,9 @@ const NON_RETRYABLE_FOR_THIS_PROVIDER = new Set([
  * as-is. When every provider tried is exhausted, returns reasonCode
  * 'no-usable-provider' with a bounded summary of every provider's reason in
  * `reason` (no secrets — each provider's own reason string is already
- * secret-free by contract). Never throws.
+ * secret-free by contract) and NO identity — nothing actually ran to
+ * completion, so the caller (extract-local.js) stamps `provider:'unknown'`
+ * rather than have this registry guess one. Never throws.
  */
 async function runModel(opts = {}) {
   const mode = opts.mode === 'judge' ? 'judge' : 'extract';
@@ -281,7 +369,8 @@ async function runModel(opts = {}) {
         authStatus: 'unknown',
       };
     }
-    return resolved.module.runModel({ ...opts, mode });
+    const result = await resolved.module.runModel({ ...opts, mode });
+    return withIdentity(resolved.id, result);
   }
 
   const log = typeof opts.log === 'function' ? opts.log : console.error;
@@ -293,7 +382,8 @@ async function runModel(opts = {}) {
   for (const id of order) {
     const mod = PROVIDERS[id];
     // eslint-disable-next-line no-await-in-loop
-    const result = await mod.runModel({ ...opts, mode });
+    const rawResult = await mod.runModel({ ...opts, mode });
+    const result = withIdentity(id, rawResult);
     if (result.ok) return result;
     attempts.push({ id, reasonCode: result.reasonCode, reason: result.reason });
     if (!NON_RETRYABLE_FOR_THIS_PROVIDER.has(result.reasonCode)) {