auxilo-mcp 0.9.25 → 0.9.27

package/README.md

@@ -175,6 +175,10 @@ node mcp-server.js   # the MCP server (stdio)
 
 The live API runs on [Fly.io](https://fly.io) from the repo `Dockerfile`.
 
+### One machine
+
+The money ledgers are guarded by locks held in memory in one running process. The server is meant to run as one machine with one data volume. Do not run a second machine against the same data, and do not start an overlapping deploy where the old and new process both run against the same files at once — the locks on one machine cannot see or coordinate with a second one, so two processes writing the same ledger files at the same time can corrupt them or double-spend a balance. This must not change until the ledgers move to a shared store that more than one process can safely coordinate through.
+
 ## Links
 
 - Site: [auxilo.io](https://auxilo.io)

package/bin/auxilo-cli.js

@@ -167,12 +167,12 @@ const CONSENT_TEXT = `
     • READS the session transcript on your machine,
     • SCRUBS it locally (sensitivity filter: API keys, tokens, emails, PII
       are redacted first),
-    • EXTRACTS reusable learnings locally through the first model client you
-      are signed in to (Claude Code, then Codex) or, when neither is
-      available, a provider key you set yourself. For this step your
-      scrubbed transcript goes only to that provider, under your own
-      account with them, and any use is charged to that account, never to
-      Auxilo. It is never sent to Auxilo, raw or scrubbed.
+    • EXTRACTS reusable learnings locally through Claude Code, when you
+      are signed in to it, or a provider key you set yourself. For this
+      step your scrubbed transcript goes only to that provider, under
+      your own account with them, and any use is charged to that
+      account, never to Auxilo. It is never sent to Auxilo, raw or
+      scrubbed.
     • UPLOADS only the finished learning drafts (title, body, category,
       tags, task context, outcome) to Auxilo (${'POST /learn'}). Everything
       waits in your review queue until you approve it, one learning at a
@@ -180,8 +180,8 @@ const CONSENT_TEXT = `
       waits for operator review. A draft that any screen flags (sensitive,
       duplicate, uncertain quality) waits in your private queue for
       \`auxilo review\`. Auto-publish for learnings that pass every screen is
-      off unless you turn it on in your dashboard. Your share of a paid
-      unlock by another agent goes to your Auxilo account, 70% of what they
+      off unless you turn it on in your dashboard. Your earnings from a paid
+      unlock by another agent go to your Auxilo account, 70% of what they
       paid on a direct unlock and 60% via discovery. A repeat unlock by the
       same buyer within 30 days earns nothing. Earnings depend on whether
       other agents unlock your learnings and are not guaranteed. Earnings
@@ -645,7 +645,7 @@ const CLI_CLEAN_LANE_CALIBRATED_PROVIDERS = ['claude-code'];
  * that with two read-only, no-detect sources of TRUTH, in priority order:
  * (1) AUXILO_EXTRACTION_PROVIDER, if set, is a certain fact about the
  *     current session's config — reading it is not a guess — validated
- *     against providers.PROVIDER_ORDER exactly as resolveProvider() itself
+ *     against providers.KNOWN_PROVIDER_IDS exactly as resolveProvider() itself
  *     validates an override, without calling it.
  * (2) Otherwise, providers.json's `selected` field — the LAST provider a
  *     genuine resolveProvider() full-scan actually chose and persisted
@@ -661,10 +661,10 @@ const CLI_CLEAN_LANE_CALIBRATED_PROVIDERS = ['claude-code'];
 function lastRecordedProviderResolution() {
   const override = process.env.AUXILO_EXTRACTION_PROVIDER;
   if (override) {
-    if (providers.PROVIDER_ORDER.includes(override)) return { ok: true, id: override };
+    if (providers.KNOWN_PROVIDER_IDS.includes(override)) return { ok: true, id: override };
     return {
       ok: false,
-      reason: `AUXILO_EXTRACTION_PROVIDER="${override}" is not a known provider (expected one of: ${providers.PROVIDER_ORDER.join(', ')})`,
+      reason: `AUXILO_EXTRACTION_PROVIDER="${override}" is not a known provider (expected one of: ${providers.KNOWN_PROVIDER_IDS.join(', ')})`,
     };
   }
   try {
@@ -709,7 +709,9 @@ function extractionProviderLine(resolution) {
  * 'no-model-provider-available' (nothing even LOOKED usable at the detect()
  * stage) — this is the selection-fall-through exhaustion code from
  * scripts/providers/index.js's runModel(), where every provider in
- * PROVIDER_ORDER was actually tried and each failed for its own reason.
+ * AUTOMATIC_PROVIDER_ORDER was actually tried and each failed for its own
+ * reason. codex-cli remains reachable only through the explicit override,
+ * which never enters this fallback walk.
  */
 const STATUS_WORTHY_SKIP_REASON_CODES = Object.freeze([
   'cli-billing-helper-configured',
@@ -1513,7 +1515,7 @@ async function cmdProvider(flags) {
     }
     throw err;
   }
-  console.log(`\n✓ Saved to ${written} (mode 0600). This machine will use your own ${vendor} key for extraction when no earlier provider in the order is available.`);
+  console.log(`\n✓ Saved to ${written} (mode 0600). This machine drafts through Claude Code first when you are signed in to it; your ${vendor} key only takes over when Claude Code is not usable, and once it does, it keeps drafting even after Claude Code becomes usable again.`);
 }
 
 // ─── Entry point ────────────────────────────────────────────────────────────
@@ -1575,9 +1577,11 @@ available on your account every subcommand says so and changes nothing.
            learnings keep their 7-day retraction window.`,
     provider: `Usage: auxilo provider <status|set|clear>
 
-Configure a bring-your-own (BYO) model provider key for local extraction —
-used only when no earlier provider in the fixed order (claude-code,
-codex-cli) is available. Auxilo never sees or bills this key.
+Configure a bring-your-own (BYO) model provider key for local extraction.
+Claude Code drafts first when you are signed in to it; your key only
+takes over when Claude Code is not usable, and once it does, it keeps
+drafting even after Claude Code becomes usable again. Auxilo never sees
+or bills this key.
 
   status   Show the configured vendor and model (never the key itself).
   set      Configure a vendor, model, and key. Interactive ONLY: the key is

package/mcp-server.js

@@ -77,7 +77,7 @@ function unlockPaymentRequired(status, data, http_endpoint) {
     status: 'payment_required',
     content_advisory: UNTRUSTED_PREVIEW_ADVISORY,
     cost: `${price} USDC on Base (set by contributor)`,
-    how_to_pay: 'Pass an x402 payment via the x_payment argument, or configure an API key with unlock credits (npx auxilo setup).',
+    how_to_pay: 'Pass an x402 payment via the x_payment argument, or configure an API key with a funded balance (npx auxilo setup).',
     http_endpoint,
     payment_details: fencePaymentChallenge(data),
   };
@@ -198,7 +198,7 @@ async function postBulkChunks(headers, decisions) {
 }
 
 const server = new Server(
-  { name: 'auxilo', version: '0.9.25' },
+  { name: 'auxilo', version: '0.9.27' },
   {
     capabilities: { tools: {} },
     instructions: `You are connected to Auxilo, a knowledge marketplace where AI agents buy and sell operational learnings.
@@ -217,7 +217,7 @@ RATE AFTER YOU USE: After unlocking and applying a learning from the Auxilo mark
 
 DEDUP BEFORE SUBMITTING: Search auxilo_knowledge for your topic before contributing to avoid duplicates.
 
-You earn 70% of every direct sale (60% discovery-driven). The builder who connected you earns a revenue share from your contributions.`
+When another agent unlocks one of your contributions, the builder who connected you earns 70% of what that agent paid on a direct unlock and 60% when Auxilo search surfaced it.`
   }
 );
 
@@ -298,7 +298,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
             },
             required: ['specificity', 'actionability', 'novelty', 'completeness', 'total'],
           },
-          contributor_wallet: { type: 'string', description: 'Your Base wallet (0x...) for revenue share' },
+          contributor_wallet: { type: 'string', description: 'Your Base wallet (0x...) for earnings' },
           unlock_price: { type: 'number', description: 'Price in USD to unlock this learning (min $0.05, default auto-calculated). Set higher for deep, high-value knowledge.' },
           contributor_agent: { type: 'string', description: 'Optional: identify yourself' },
           related_skills: { type: 'array', items: { type: 'string' }, description: 'Optional: related Auxilo skill IDs' },
@@ -362,7 +362,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_withdraw',
-      description: 'Check how your earnings are paid out, and how to receive any legacy accrued balance. HOW PAYOUT WORKS NOW: earnings from sales settled on-chain are paid directly to your linked, verified wallet at the moment of sale — there is no balance to withdraw for those, because Auxilo never holds your share. LEGACY BALANCE: earnings accrued before direct settlement sit in your account\'s pending balance; withdraw them from your dashboard at https://auxilo.io/dashboard (bank payout via Stripe; $0.50 minimum, $0.25 flat fee), where you sign in with the email on your account. This tool reports your current balances and payout status; it does not move funds. To be paid at sale time going forward: auxilo_accept_terms, then auxilo_verify_wallet, then auxilo_link_wallet.',
+      description: 'Check how your earnings are paid out, and how to receive any legacy accrued balance. HOW PAYOUT WORKS NOW: earnings from sales settled on-chain are paid directly to your linked, verified wallet at the moment of sale — there is no balance to withdraw for those, because Auxilo never holds your earnings. LEGACY BALANCE: earnings accrued before direct settlement sit in your account\'s pending balance; withdraw them from your dashboard at https://auxilo.io/dashboard (bank payout via Stripe; $0.50 minimum, $0.25 flat fee), where you sign in with the email on your account. This tool reports your current balances and payout status; it does not move funds. To be paid at sale time going forward: auxilo_accept_terms, then auxilo_verify_wallet, then auxilo_link_wallet.',
       inputSchema: {
         type: 'object',
         properties: {
@@ -408,7 +408,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'auxilo_account_earnings',
-      description: 'View aggregate and per-learning earnings for your authenticated Auxilo account. Authenticates with your configured API key automatically, or pass a session_token (JWT). Returns total gross, contributor share, pending balance, total withdrawn, whether withdrawal is available (can_withdraw), and held_pending_assent — undisbursable receipts recorded before you accepted the current Terms, released to your withdrawable balance when you accept via auxilo_accept_terms. Earnings from on-chain-settled sales are paid to your wallet at sale time and appear in settlement history, not in pending balance. Free.',
+      description: 'View aggregate and per-learning earnings for your authenticated Auxilo account. Authenticates with your configured API key automatically, or pass a session_token (JWT). Returns total gross, contributor earnings, pending balance, total withdrawn, whether withdrawal is available (can_withdraw), and held_pending_assent — undisbursable receipts recorded before you accepted the current Terms, released to your withdrawable balance when you accept via auxilo_accept_terms. Earnings from on-chain-settled sales are paid to your wallet at sale time and appear in settlement history, not in pending balance. Free.',
       inputSchema: {
         type: 'object',
         properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auxilo-mcp",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "mcpName": "io.github.silent-architects/auxilo",
   "description": "MCP server for Auxilo. Your agent stops solving the same problem twice: auto-extracted learnings, free self-unlocks, and earnings when other agents unlock yours.",
   "main": "mcp-server.js",

package/scripts/extract-local.js

@@ -15,6 +15,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const crypto = require('crypto');
 const {
   loadIndexForExtraction,
   readExtractionIndex,
@@ -373,9 +374,10 @@ function resolveExtractionModelIdentity(runModelResult) {
     && typeof runModelResult.identity.provider === 'string'
     && runModelResult.identity.provider
   ) {
-    return runModelResult.identity;
+    const identity = runModelResult.identity;
+    return { ...identity, model: identity.observed_model || null };
   }
-  return { provider: 'unknown', model: null, version: null, vendor: null };
+  return { provider: 'unknown', model: null, requested_model: null, observed_model: null, identity_unresolved: 'missing', version: null, vendor: null };
 }
 
 /**
@@ -402,6 +404,8 @@ async function defaultInvokeModel(transcript, invokeOpts, opts) {
     reasonCode: result.reasonCode,
     authStatus: result.authStatus,
     extractionModel: resolveExtractionModelIdentity(result),
+    ...(result.hold && { hold: result.hold }),
+    ...(result.deferred && { deferred: result.deferred }),
     ...(result.authDiscrepancy !== undefined && { authDiscrepancy: result.authDiscrepancy }),
     // EXTRACTION-RUN-LOG (0.9.15): additive passthrough for the one-line-per-run
     // provider summary logged at the end of extractLocally() below. Only
@@ -432,6 +436,9 @@ function defaultInvokeJudge(opts) {
       out: result.text,
       usage: result.usage,
       reason: result.reason,
+      identity: result.identity,
+      ...(result.hold && { hold: result.hold }),
+      ...(result.deferred && { deferred: result.deferred }),
       // EXTRACTION-RUN-LOG (0.9.15): threaded through so runAnchoredJudge below
       // can report the judge call's status/argv/CLI version on the run summary
       // log line. Additive — every existing invokeJudge stub in this repo's
@@ -526,11 +533,16 @@ async function runAnchoredJudge(candidates, indexState, opts = {}) {
       judgeReasonCode: result && result.reasonCode,
       judgeArgv: result && result.argv,
       judgeCliVersion: result && result.cliVersion,
+      ...(result && result.hold && { hold: result.hold }),
+      ...(result && result.deferred && { deferred: result.deferred }),
     };
   }
   const parsed = parseJudgeDecisions(result.out, input, rankings);
   const usage = judgeUsage(result.usage, prompt, result.out);
   const judgeMeta = {
+    identity: result.identity,
+    ...(result.hold && { hold: result.hold }),
+    ...(result.deferred && { deferred: result.deferred }),
     judgeAttempted: true,
     judgeReasonCode: result.reasonCode,
     judgeArgv: result.argv,
@@ -681,13 +693,14 @@ function formatArgvForLog(argv) {
  * PRE_SPAWN_SKIP_REASON_CODES, so they render finder=skipped, not ran. The
  * observed defect lines (finder=ran, flags=n/a) come from a DIFFERENT case:
  * scripts/providers/index.js's runModel() falls through from claude-code to
- * the next configured provider (e.g. codex-cli) whenever claude-code's own
- * attempt fails with a NON_RETRYABLE_FOR_THIS_PROVIDER reasonCode, and
- * returns that OTHER provider's result directly when it stops there. That
- * provider's result carries no `argv` field at all (argv is a
- * claude-code-only concept), so there is no shipped argv being hidden here —
- * 'unknown' remains the correct, honest `hooks` value regardless of which
- * provider is named.
+ * the next automatic provider (byo-key) whenever claude-code's own attempt
+ * fails with a NON_RETRYABLE_FOR_THIS_PROVIDER reasonCode, and returns that
+ * OTHER provider's result directly when it stops there. codex-cli is not in
+ * that automatic walk; it remains reachable only through the explicit env
+ * override, which never falls through. A non-Claude provider's result carries
+ * no `argv` field at all (argv is a claude-code-only concept), so there is no
+ * shipped argv being hidden here — 'unknown' remains the correct, honest
+ * `hooks` value regardless of which provider is named.
  *
  * EXTRACTION-MODEL-PROVENANCE (PUNCH-LIST P1) closed the mismatch this
  * docblock used to describe as a known, deferred gap: a fallthrough
@@ -735,6 +748,8 @@ function logProviderRunSummary(opts, runId, modelResult, judged) {
 }
 
 async function extractLocally(transcript, sourceType, opts = {}) {
+  opts = { ...opts, source: sourceType || '', sessionId: opts.sessionId || opts.runId || crypto.randomUUID(),
+    jobSha: opts.jobSha || crypto.createHash('sha256').update(transcript).digest('hex'), routeContext: opts.routeContext || {} };
   if (sourceType && !EXTRACTABLE_SOURCES.has(sourceType)) {
     return { learnings: [], skipped: `local extraction not implemented for "${sourceType}" — agent contributes via auxilo_contribute` };
   }
@@ -779,6 +794,8 @@ async function extractLocally(transcript, sourceType, opts = {}) {
     return {
       learnings: [],
       skipped: reason,
+      ...(modelResult.hold && { hold: modelResult.hold }),
+      ...(modelResult.deferred && { deferred: modelResult.deferred }),
       ...(modelResult.reasonCode !== undefined && { reasonCode: modelResult.reasonCode }),
       ...(modelResult.authStatus !== undefined && { authStatus: modelResult.authStatus }),
       ...(modelResult.authDiscrepancy !== undefined && {
@@ -791,7 +808,9 @@ async function extractLocally(transcript, sourceType, opts = {}) {
   // own opts.invokeModel that doesn't report one (every existing test does
   // this) — extraction_model then simply never appears, byte-identical to
   // pre-PART-C behavior.
-  const extractionModel = modelResult.extractionModel || null;
+  const extractionModel = modelResult.extractionModel
+    ? { ...modelResult.extractionModel, model: modelResult.extractionModel.observed_model || null }
+    : null;
   const parsed = parseExtractionOutput(out, opts);
   const promptDropResult = applyPromptMemoryDrops(
     parsed.prompt_drops,
@@ -829,7 +848,10 @@ async function extractLocally(transcript, sourceType, opts = {}) {
       lexicalKept.push(drop.candidate);
     }
   }
-  const judged = await runAnchoredJudge(lexicalKept, filterState, opts);
+  const judged = modelResult.hold || modelResult.deferred
+    ? { kept: lexicalKept, dropped: [], called: false, prompt_tokens: 0, completion_tokens: 0,
+      ...(modelResult.hold && { hold: modelResult.hold }), ...(modelResult.deferred && { deferred: modelResult.deferred }) }
+    : await runAnchoredJudge(lexicalKept, filterState, opts);
   const allDropped = [
     ...promptDropResult.dropped,
     ...lexicalDropped,
@@ -845,6 +867,9 @@ async function extractLocally(transcript, sourceType, opts = {}) {
   logProviderRunSummary(opts, opts.runId, modelResult, judged);
   return {
     learnings: judged.kept,
+    ...(judged.hold && { hold: judged.hold }),
+    ...(judged.deferred && { deferred: judged.deferred }),
+    ...providers.finishJob(opts.routeContext),
     dedup_dropped: allDropped.length,
     drop_audit: allDropped.map((drop) => drop.audit),
     prompt_memory_tokens: promptMemory.estimated_tokens,

package/scripts/providers/byo-key.js

@@ -537,6 +537,7 @@ async function runModel(opts = {}) {
       usage: null,
       reason: 'cannot resolve ~/.auxilo/providers.json — the home directory did not resolve to an absolute path',
       reasonCode: 'provider-home-unresolved',
+      refusal: 'pre-invocation',
       authStatus: 'unknown',
     };
   }
@@ -552,6 +553,7 @@ async function runModel(opts = {}) {
       usage: null,
       reason: '~/.auxilo/providers.json is not owner-read-only; refusing to use the stored key until its permissions are fixed (chmod 600 ~/.auxilo/providers.json) or the file is removed (`auxilo provider clear`)',
       reasonCode: 'providers-file-mode-unsafe',
+      refusal: 'pre-invocation',
       authStatus: 'unknown',
     };
   }
@@ -563,6 +565,7 @@ async function runModel(opts = {}) {
       usage: null,
       reason: 'no BYO provider key configured — run `auxilo provider set`',
       reasonCode: 'provider-not-configured',
+      refusal: 'pre-invocation',
       authStatus: 'unknown',
     };
   }
@@ -575,8 +578,9 @@ async function runModel(opts = {}) {
       ok: false,
       text: '',
       usage: null,
-      reason: `configured base_url "${config.base_url}" is not https:// — refusing to send the transcript or the key over an insecure connection`,
+      reason: 'configured base URL is not https; refusing the request',
       reasonCode: 'provider-base-url-insecure',
+      refusal: 'pre-invocation',
       authStatus: 'unknown',
     };
   }
@@ -587,7 +591,7 @@ async function runModel(opts = {}) {
   const fetchImpl = typeof opts.fetchImpl === 'function' ? opts.fetchImpl : fetch;
   const timeoutMs = opts.timeoutMs || 120000;
 
-  const identity = { provider: 'byo-key', model: config.model, version: null, vendor };
+  const identity = { provider: 'byo-key', model: null, requested_model: config.model, observed_model: null, identity_unresolved: 'missing', version: null, vendor };
 
   const controller = typeof AbortController === 'function' ? new AbortController() : null;
   const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;
@@ -595,6 +599,8 @@ async function runModel(opts = {}) {
 
   try {
     let res;
+    const gate = require('./route-binding.js').invocationGate(opts);
+    if (gate) return gate;
     try {
       res = await fetchImpl(request.url, {
         method: 'POST',
@@ -611,7 +617,7 @@ async function runModel(opts = {}) {
         ok: false,
         text: '',
         usage: null,
-        reason: `BYO provider request failed: ${error.message}`,
+        reason: 'BYO provider request failed',
         reasonCode: 'provider-error',
         authStatus: 'unknown',
         identity,
@@ -634,7 +640,7 @@ async function runModel(opts = {}) {
         ok: false,
         text: '',
         usage: null,
-        reason: `BYO provider returned HTTP ${res.status}`,
+        reason: Number.isInteger(res.status) ? `BYO provider returned HTTP ${res.status}` : 'BYO provider request failed',
         reasonCode: 'provider-error',
         authStatus: 'unknown',
         identity,
@@ -660,13 +666,19 @@ async function runModel(opts = {}) {
         ok: false,
         text: '',
         usage: null,
-        reason: `BYO provider returned a non-JSON body: ${error.message}`,
+        reason: 'BYO provider returned a non-JSON body',
         reasonCode: 'provider-error',
         authStatus: 'unknown',
         identity,
       };
     }
 
+    const observed = data && (vendor === 'gemini' ? data.modelVersion : data.model);
+    if (typeof observed === 'string' && observed.trim()) {
+      identity.observed_model = observed;
+      identity.model = observed;
+      delete identity.identity_unresolved;
+    }
     return {
       ok: true,
       text: extractText(vendor, data),
@@ -675,6 +687,8 @@ async function runModel(opts = {}) {
       authStatus: 'unknown',
       identity,
     };
+  } catch {
+    return { ok: false, text: '', usage: null, reason: 'BYO provider request failed', reasonCode: 'provider-error', authStatus: 'unknown' };
   } finally {
     clearTimer();
   }
@@ -689,6 +703,7 @@ module.exports = {
   writeByoConfig,
   clearProvidersFile,
   resolveVendor,
+  baseUrlFor,
   DEFAULT_PROVIDERS_STATE_PATH,
   // Exported for direct unit coverage (test/byo-key-provider.test.js,
   // test/extract-w1-fix2.test.js) AND for scripts/providers/index.js, which