auxilo-mcp 0.9.25 → 0.9.26

package/bin/auxilo-cli.js

@@ -167,12 +167,12 @@ const CONSENT_TEXT = `
     • READS the session transcript on your machine,
     • SCRUBS it locally (sensitivity filter: API keys, tokens, emails, PII
       are redacted first),
-    • EXTRACTS reusable learnings locally through the first model client you
-      are signed in to (Claude Code, then Codex) or, when neither is
-      available, a provider key you set yourself. For this step your
-      scrubbed transcript goes only to that provider, under your own
-      account with them, and any use is charged to that account, never to
-      Auxilo. It is never sent to Auxilo, raw or scrubbed.
+    • EXTRACTS reusable learnings locally through Claude Code, when you
+      are signed in to it, or a provider key you set yourself. For this
+      step your scrubbed transcript goes only to that provider, under
+      your own account with them, and any use is charged to that
+      account, never to Auxilo. It is never sent to Auxilo, raw or
+      scrubbed.
     • UPLOADS only the finished learning drafts (title, body, category,
       tags, task context, outcome) to Auxilo (${'POST /learn'}). Everything
       waits in your review queue until you approve it, one learning at a
@@ -645,7 +645,7 @@ const CLI_CLEAN_LANE_CALIBRATED_PROVIDERS = ['claude-code'];
  * that with two read-only, no-detect sources of TRUTH, in priority order:
  * (1) AUXILO_EXTRACTION_PROVIDER, if set, is a certain fact about the
  *     current session's config — reading it is not a guess — validated
- *     against providers.PROVIDER_ORDER exactly as resolveProvider() itself
+ *     against providers.KNOWN_PROVIDER_IDS exactly as resolveProvider() itself
  *     validates an override, without calling it.
  * (2) Otherwise, providers.json's `selected` field — the LAST provider a
  *     genuine resolveProvider() full-scan actually chose and persisted
@@ -661,10 +661,10 @@ const CLI_CLEAN_LANE_CALIBRATED_PROVIDERS = ['claude-code'];
 function lastRecordedProviderResolution() {
   const override = process.env.AUXILO_EXTRACTION_PROVIDER;
   if (override) {
-    if (providers.PROVIDER_ORDER.includes(override)) return { ok: true, id: override };
+    if (providers.KNOWN_PROVIDER_IDS.includes(override)) return { ok: true, id: override };
     return {
       ok: false,
-      reason: `AUXILO_EXTRACTION_PROVIDER="${override}" is not a known provider (expected one of: ${providers.PROVIDER_ORDER.join(', ')})`,
+      reason: `AUXILO_EXTRACTION_PROVIDER="${override}" is not a known provider (expected one of: ${providers.KNOWN_PROVIDER_IDS.join(', ')})`,
     };
   }
   try {
@@ -709,7 +709,9 @@ function extractionProviderLine(resolution) {
  * 'no-model-provider-available' (nothing even LOOKED usable at the detect()
  * stage) — this is the selection-fall-through exhaustion code from
  * scripts/providers/index.js's runModel(), where every provider in
- * PROVIDER_ORDER was actually tried and each failed for its own reason.
+ * AUTOMATIC_PROVIDER_ORDER was actually tried and each failed for its own
+ * reason. codex-cli remains reachable only through the explicit override,
+ * which never enters this fallback walk.
  */
 const STATUS_WORTHY_SKIP_REASON_CODES = Object.freeze([
   'cli-billing-helper-configured',
@@ -1513,7 +1515,7 @@ async function cmdProvider(flags) {
     }
     throw err;
   }
-  console.log(`\n✓ Saved to ${written} (mode 0600). This machine will use your own ${vendor} key for extraction when no earlier provider in the order is available.`);
+  console.log(`\n✓ Saved to ${written} (mode 0600). This machine drafts through Claude Code first when you are signed in to it; your ${vendor} key only takes over when Claude Code is not usable, and once it does, it keeps drafting even after Claude Code becomes usable again.`);
 }
 
 // ─── Entry point ────────────────────────────────────────────────────────────
@@ -1575,9 +1577,11 @@ available on your account every subcommand says so and changes nothing.
            learnings keep their 7-day retraction window.`,
     provider: `Usage: auxilo provider <status|set|clear>
 
-Configure a bring-your-own (BYO) model provider key for local extraction —
-used only when no earlier provider in the fixed order (claude-code,
-codex-cli) is available. Auxilo never sees or bills this key.
+Configure a bring-your-own (BYO) model provider key for local extraction.
+Claude Code drafts first when you are signed in to it; your key only
+takes over when Claude Code is not usable, and once it does, it keeps
+drafting even after Claude Code becomes usable again. Auxilo never sees
+or bills this key.
 
   status   Show the configured vendor and model (never the key itself).
   set      Configure a vendor, model, and key. Interactive ONLY: the key is

package/mcp-server.js

@@ -198,7 +198,7 @@ async function postBulkChunks(headers, decisions) {
 }
 
 const server = new Server(
-  { name: 'auxilo', version: '0.9.25' },
+  { name: 'auxilo', version: '0.9.26' },
   {
     capabilities: { tools: {} },
     instructions: `You are connected to Auxilo, a knowledge marketplace where AI agents buy and sell operational learnings.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auxilo-mcp",
-  "version": "0.9.25",
+  "version": "0.9.26",
   "mcpName": "io.github.silent-architects/auxilo",
   "description": "MCP server for Auxilo. Your agent stops solving the same problem twice: auto-extracted learnings, free self-unlocks, and earnings when other agents unlock yours.",
   "main": "mcp-server.js",

package/scripts/extract-local.js

@@ -681,13 +681,14 @@ function formatArgvForLog(argv) {
  * PRE_SPAWN_SKIP_REASON_CODES, so they render finder=skipped, not ran. The
  * observed defect lines (finder=ran, flags=n/a) come from a DIFFERENT case:
  * scripts/providers/index.js's runModel() falls through from claude-code to
- * the next configured provider (e.g. codex-cli) whenever claude-code's own
- * attempt fails with a NON_RETRYABLE_FOR_THIS_PROVIDER reasonCode, and
- * returns that OTHER provider's result directly when it stops there. That
- * provider's result carries no `argv` field at all (argv is a
- * claude-code-only concept), so there is no shipped argv being hidden here —
- * 'unknown' remains the correct, honest `hooks` value regardless of which
- * provider is named.
+ * the next automatic provider (byo-key) whenever claude-code's own attempt
+ * fails with a NON_RETRYABLE_FOR_THIS_PROVIDER reasonCode, and returns that
+ * OTHER provider's result directly when it stops there. codex-cli is not in
+ * that automatic walk; it remains reachable only through the explicit env
+ * override, which never falls through. A non-Claude provider's result carries
+ * no `argv` field at all (argv is a claude-code-only concept), so there is no
+ * shipped argv being hidden here — 'unknown' remains the correct, honest
+ * `hooks` value regardless of which provider is named.
  *
  * EXTRACTION-MODEL-PROVENANCE (PUNCH-LIST P1) closed the mismatch this
  * docblock used to describe as a known, deferred gap: a fallthrough

package/scripts/providers/index.js

@@ -10,20 +10,22 @@
  * from ~/.auxilo/providers.json if it is STILL usable (re-verified via its
  * own detect() every call, never trusted blindly — a stale persisted choice
  * falls through to a full re-scan rather than failing) → else the first
- * provider whose detect() is true, in fixed order (claude-code → codex-cli →
- * byo-key) → else ok:false, with a reason naming every provider tried.
+ * provider whose detect() is true, in automatic order (claude-code →
+ * byo-key) → else ok:false, with a reason naming every automatic provider
+ * tried. codex-cli remains available only through the explicit env override.
  *
  * runModel(): resolves via resolveProvider(), then actually RUNS it. A
  * non-override resolution that fails with a reasonCode meaning "this
  * provider cannot run at all" (NON_RETRYABLE_FOR_THIS_PROVIDER — e.g.
  * unauthenticated, not installed, a billing helper is configured) falls
- * through to the next provider in PROVIDER_ORDER rather than reporting a
- * hard failure; a working provider that merely failed once (timeout, model
- * error) does not fall through — that is still the builder's chosen
- * provider having a bad run, not a reason to switch under them. An explicit
- * env override never falls through, honoring the operator's explicit
- * choice. Every provider exhausted → reasonCode 'no-usable-provider' with
- * every attempt's reason summarized in `reason`.
+ * through to the next provider in AUTOMATIC_PROVIDER_ORDER rather than
+ * reporting a hard failure; a working provider that merely failed once
+ * (timeout, model error) does not fall through — that is still the builder's
+ * chosen provider having a bad run, not a reason to switch under them. An
+ * explicit env override, including codex-cli, never falls through, honoring
+ * the operator's explicit choice. Every automatic provider exhausted →
+ * reasonCode 'no-usable-provider' with every attempt's reason summarized in
+ * `reason`.
  *
  * codex-cli.js and byo-key.js don't exist yet (PART B/C). loadOptionalProvider()
  * degrades a missing module into a "not installed yet" stub so this file — and
@@ -71,7 +73,8 @@ function loadOptionalProvider(id, modulePath) {
 const codexCli = loadOptionalProvider('codex-cli', './codex-cli.js');
 const byoKey = loadOptionalProvider('byo-key', './byo-key.js');
 
-const PROVIDER_ORDER = Object.freeze(['claude-code', 'codex-cli', 'byo-key']);
+const KNOWN_PROVIDER_IDS = Object.freeze(['claude-code', 'codex-cli', 'byo-key']);
+const AUTOMATIC_PROVIDER_ORDER = Object.freeze(['claude-code', 'byo-key']);
 const PROVIDERS = {
   'claude-code': claudeCode,
   'codex-cli': codexCli,
@@ -145,19 +148,16 @@ async function resolveProvider(opts = {}) {
     if (!Object.prototype.hasOwnProperty.call(PROVIDERS, override)) {
       return {
         ok: false,
-        reason: `AUXILO_EXTRACTION_PROVIDER="${override}" is not a known provider (expected one of: ${PROVIDER_ORDER.join(', ')})`,
+        reason: `AUXILO_EXTRACTION_PROVIDER="${override}" is not a known provider (expected one of: ${KNOWN_PROVIDER_IDS.join(', ')})`,
       };
     }
     return { ok: true, id: override, module: PROVIDERS[override] };
   }
 
-  const cache = opts.providerCache || defaultCache;
-  if (cache.resolved) return cache.resolved;
-
   // Fast path (EXTRACT-PER-CLIENT W1 FIX, PUNCH-LIST P1, item 3): the
   // persisted `selected` choice — written by a prior successful resolution,
   // possibly in an earlier process — skips re-probing every provider ahead
-  // of it in PROVIDER_ORDER when it is STILL usable (the common
+  // of it in AUTOMATIC_PROVIDER_ORDER when it is STILL usable (the common
   // steady-state case: same builder, same login, repeated extraction
   // calls). "Usable" is re-verified via that provider's own detect() every
   // time, never trusted blindly from the file alone. A stale persisted
@@ -185,6 +185,26 @@ async function resolveProvider(opts = {}) {
   const log = typeof opts.log === 'function' ? opts.log : console.error;
   const statePath = opts.providersStatePath || PROVIDERS_STATE_PATH;
   const persistedState = readProvidersState(statePath);
+
+  // EPC2-2 E0: codex-cli failed the live isolation sentinel and is therefore
+  // ineligible for automatic selection. Treat a cached pre-E0 winner as
+  // absent in memory on EVERY resolution, even if the best-effort migration
+  // below cannot rewrite providers.json. The explicit env override above is
+  // intentionally untouched and remains the only route to codex-cli.
+  if (persistedState.selected === 'codex-cli') {
+    delete persistedState.selected;
+    try {
+      if (typeof byoKey.writeProvidersStateAtomic !== 'function') throw new Error('writer unavailable');
+      byoKey.writeProvidersStateAtomic(persistedState, opts);
+    } catch {
+      log('[providers] could not clear retired automatic codex-cli selection; continuing without it');
+    }
+  }
+
+  const cache = opts.providerCache || defaultCache;
+  if (cache.resolved && cache.resolved.id !== 'codex-cli') return cache.resolved;
+  if (cache.resolved && cache.resolved.id === 'codex-cli') delete cache.resolved;
+
   const persistedId = persistedState.selected;
   if (typeof persistedId === 'string' && Object.prototype.hasOwnProperty.call(PROVIDERS, persistedId)) {
     const persistedMod = PROVIDERS[persistedId];
@@ -203,7 +223,7 @@ async function resolveProvider(opts = {}) {
   }
 
   const tried = [];
-  for (const id of PROVIDER_ORDER) {
+  for (const id of AUTOMATIC_PROVIDER_ORDER) {
     const mod = PROVIDERS[id];
     tried.push(id);
     let available = false;
@@ -224,7 +244,7 @@ async function resolveProvider(opts = {}) {
 
 /**
  * reasonCodes meaning "this provider cannot run at all right now" — safe to
- * try the NEXT provider in PROVIDER_ORDER rather than reporting a hard
+ * try the NEXT provider in AUTOMATIC_PROVIDER_ORDER rather than reporting a hard
  * failure (EXTRACT-PER-CLIENT W1 FIX, PUNCH-LIST P1, item 2). Everything
  * else (timeouts, model errors, malformed output, rate limits) means the
  * chosen provider DID run and failed on THIS call — that is not a signal to
@@ -241,7 +261,8 @@ const NON_RETRYABLE_FOR_THIS_PROVIDER = new Set([
   // EXTRACTION-CHILD-HOOKS (0.9.15): the resolved claude-code CLI doesn't
   // support --setting-sources, so it can never run isolated — same
   // "cannot run at all right now" class as the codes above, safe to try the
-  // next provider in PROVIDER_ORDER rather than reporting a hard failure.
+  // next automatic provider rather than reporting a hard failure. codex-cli
+  // remains reachable only through the explicit override, which never walks.
   'cli-settings-isolation-unsupported',
 ]);
 
@@ -288,9 +309,9 @@ function hasUsableIdentity(identity) {
  *   what lets the per-run `[providers]` log name the provider that actually
  *   ran even when that provider's own failure return carries no identity
  *   (codex-cli and byo-key only self-stamp on their SINGLE success return —
- *   this is the exact fall-through failure case the investigation traced:
- *   claude-code skipped, codex-cli ran and failed, no identity of its own,
- *   the label used to be re-guessed as claude-code by the old fallback).
+ *   the automatic fall-through failure case is now: claude-code skipped,
+ *   byo-key ran and failed, no identity of its own, and the label must name
+ *   byo-key rather than be re-guessed as claude-code by the old fallback).
  * - Every other provider on a SUCCESS: `{provider:'unknown', ...}` —
  *   byo-key.js and codex-cli.js both self-stamp `identity` on their only
  *   success return BY CONTRACT; a success with none means that contract was
@@ -321,10 +342,10 @@ function deriveIdentity(id, result) {
  * byo-key's real model name). Applied to every result this registry
  * returns, success or failure, so the per-run `[providers]` log
  * (scripts/extract-local.js's logProviderRunSummary) names the provider
- * that actually ran even on a failure — that is the fall-through failure
- * case this row's investigation traced (claude-code skipped, codex-cli ran
- * and failed with no identity of its own, the stamp used to be re-guessed
- * as claude-code by the caller).
+ * that actually ran even on a failure — the automatic fall-through failure
+ * case is now claude-code skipped, byo-key ran and failed with no identity
+ * of its own, and the stamp must not be re-guessed as claude-code by the
+ * caller.
  */
 function withIdentity(id, result) {
   if (hasUsableIdentity(result && result.identity)) return result;
@@ -333,19 +354,20 @@ function withIdentity(id, result) {
 
 /**
  * runModel(opts) — resolve a starting provider via resolveProvider(), then
- * walk PROVIDER_ORDER from there, calling each candidate's OWN runModel()
+ * walk AUTOMATIC_PROVIDER_ORDER from there, calling each candidate's OWN runModel()
  * (never a separate detect() pre-check — a provider's runModel() already
  * performs the equivalent authoritative check internally and returns a
  * specific, accurate reason, so a second detect() call would only add a
  * redundant probe without adding information). Falls through to the next
  * provider when the current one's failure reasonCode is in
  * NON_RETRYABLE_FOR_THIS_PROVIDER; when resolveProvider itself found no
- * usable provider at all, the walk starts at PROVIDER_ORDER's beginning so
- * every provider still gets an actual runModel() call and contributes its
- * own reason (not just a single generic "no provider available"). An
- * explicit AUXILO_EXTRACTION_PROVIDER override never falls through — it is
- * the operator's explicit choice, so its own failure reason is reported
- * as-is. When every provider tried is exhausted, returns reasonCode
+ * usable provider at all, the walk starts at AUTOMATIC_PROVIDER_ORDER's
+ * beginning so every automatic provider still gets an actual runModel()
+ * call and contributes its own reason (not just a single generic "no
+ * provider available"). An explicit AUXILO_EXTRACTION_PROVIDER override,
+ * including codex-cli, never falls through — it is the operator's explicit
+ * choice, so its own failure reason is reported as-is. When every provider
+ * tried is exhausted, returns reasonCode
  * 'no-usable-provider' with a bounded summary of every provider's reason in
  * `reason` (no secrets — each provider's own reason string is already
  * secret-free by contract) and NO identity — nothing actually ran to
@@ -375,8 +397,10 @@ async function runModel(opts = {}) {
 
   const log = typeof opts.log === 'function' ? opts.log : console.error;
   const resolved = await resolveProvider(opts);
-  const startIdx = resolved.ok ? PROVIDER_ORDER.indexOf(resolved.id) : -1;
-  const order = startIdx === -1 ? PROVIDER_ORDER.slice() : PROVIDER_ORDER.slice(startIdx);
+  const startIdx = resolved.ok ? AUTOMATIC_PROVIDER_ORDER.indexOf(resolved.id) : -1;
+  const order = startIdx === -1
+    ? AUTOMATIC_PROVIDER_ORDER.slice()
+    : AUTOMATIC_PROVIDER_ORDER.slice(startIdx);
 
   const attempts = [];
   for (const id of order) {
@@ -411,7 +435,8 @@ async function runModel(opts = {}) {
 module.exports = {
   runModel,
   resolveProvider,
-  PROVIDER_ORDER,
+  KNOWN_PROVIDER_IDS,
+  AUTOMATIC_PROVIDER_ORDER,
   PROVIDERS_STATE_PATH,
   NON_RETRYABLE_FOR_THIS_PROVIDER,
 };