codehere 0.7.1 → 1.0.1

package/dist/infrastructure/orchestration/claude-code-adapter.js

@@ -22,6 +22,7 @@ import { randomUUID } from 'crypto';
 import { ProgressAggregator } from './progress-aggregator.js';
 import { snapshotCwd, extractArtifacts } from './artifacts-extractor.js';
 import { applyMemoryPrefix } from './memory-injector.js';
+import { mirrorToolCallToAudit } from '../hooks/mirror-tool-call-to-audit.js';
 // Runtime-error fingerprints → structured codehere:error events with recovery hints.
 // Matched against any stderr line or assistant-text content we see on the stream.
 const ERROR_PATTERNS = [
@@ -76,7 +77,78 @@ const HEADLESS_FLAGS = [
     'Glob',
     'MultiEdit',
     'NotebookEdit',
+    // AskUserQuestion is now SURFACED by codehere (Layer 3): the agent's question
+    // renders as a card, the user answers, and --resume continues the same session
+    // (SPIKE 0 confirmed real claude emits the question cleanly + resumes without
+    // the thinking-signature wall). So it's pre-granted alongside the rest.
+    'AskUserQuestion',
+    // ExitPlanMode stays disallowed — no plan-approval surface yet, so it would
+    // still dead-end the headless run.
+    '--disallowedTools',
+    'ExitPlanMode',
 ];
+/**
+ * Resume a completed claude session for a follow-up turn — STANDALONE (no live
+ * session object). claude keeps its own session store, so `claude --resume
+ * <session_id>` continues with full context regardless of whether codehere kept
+ * the session in memory. This is what lets a goal be continued AFTER a daemon
+ * restart, by reconstructing from the persisted (nativeSessionId, cwd).
+ * (resume-after-restart fix, dogfood 2026-06-09.)
+ */
+export function resumeClaudeMessage(nativeSessionId, cwd, text) {
+    const startedAt = Date.now();
+    return new Promise((resolve, reject) => {
+        const env = { ...process.env };
+        // Subscription-first, same auth the ORIGINAL spawn used: every reachable
+        // daemon spawn path runs with preferSubscription=true (session-manager
+        // hardcodes it; readiness only emits false in the not_installed state,
+        // which can't spawn) — so the session being resumed was created with these
+        // keys stripped, and resuming must match or the auth context would differ
+        // mid-goal. If a preferSubscription=false spawn path ever becomes
+        // reachable, persist the preference and honor it here.
+        delete env.ANTHROPIC_API_KEY;
+        delete env.ANTHROPIC_AUTH_TOKEN;
+        delete env.CLAUDE_API_KEY;
+        const sp = resolveAgentSpawn('claude-code', 'claude', ['-p', text, '--resume', nativeSessionId, ...HEADLESS_FLAGS], text);
+        const child = spawn(sp.command, sp.args, { cwd, env: env, stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        child.on('error', reject);
+        child.stdout?.on('data', (c) => (stdout += c.toString('utf-8')));
+        child.stderr?.on('data', (c) => (stderr += c.toString('utf-8')));
+        child.on('exit', (code) => {
+            if (code !== 0) {
+                reject(new Error(`claude --resume exited ${code}: ${stderr.slice(0, 200)}`));
+                return;
+            }
+            // The final 'result' event repeats the assistant's last text — prefer it
+            // alone when present (joining both doubled the reply on the first real run).
+            const fragments = [];
+            let resultText;
+            for (const line of stdout.split('\n')) {
+                const t = line.trim();
+                if (!t)
+                    continue;
+                try {
+                    const o = JSON.parse(t);
+                    if (o.type === 'assistant' && o.message?.content) {
+                        for (const b of o.message.content)
+                            if (b.type === 'text' && b.text)
+                                fragments.push(b.text);
+                    }
+                    else if (o.type === 'result' && typeof o.result === 'string') {
+                        resultText = o.result;
+                    }
+                }
+                catch {
+                    /* non-JSON line — skip */
+                }
+            }
+            const replyText = (resultText ?? fragments.join('')).trim();
+            resolve({ result: replyText || '(the agent left no text response)', durationMs: Date.now() - startedAt });
+        });
+    });
+}
 export function spawnClaudeCode(prompt, options = {}) {
     const sessionId = randomUUID();
     const startedAt = Date.now();
@@ -98,6 +170,7 @@ export function spawnClaudeCode(prompt, options = {}) {
     let artifactsSnapshot;
     let textAccum = ''; // accumulates assistant text + result summary for test-count parsing
     let usageSnapshot; // token accumulator (principle #7)
+    let modelSeen; // real model id from assistant events → per-model cost
     let errorEmitted = false;
     const emit = (event) => {
         buffer.push(event);
@@ -109,13 +182,44 @@ export function spawnClaudeCode(prompt, options = {}) {
             buffer.push(snapEvt);
             emitter.emit('event', snapEvt);
         }
-        // Accumulate text for test-summary parsing (Layer 3).
+        // Accumulate text for test-summary parsing (Layer 3) + mirror tool calls to
+        // the hash-chained audit.
         if (event.type === 'assistant') {
             const msg = event.data?.message;
+            if (!modelSeen && msg?.model)
+                modelSeen = msg.model; // capture the real model for per-model pricing
             if (msg?.content) {
                 for (const b of msg.content) {
                     if (b.type === 'text' && b.text)
                         textAccum += b.text + '\n';
+                    else if (b.type === 'tool_use' && b.name) {
+                        // Audit-trail backstop for claude (#proof-pillar). Claude's PreToolUse
+                        // hook is the BLOCKING gate, but headless `claude -p` (how codehere
+                        // spawns it) does NOT execute that hook into the audit — MEASURED twice
+                        // 2026-06-08: a spawned claude REVIEW (read-only) left 0 entries, and a
+                        // spawned claude WRITE produced ONLY this mirror's entry (no hook entry
+                        // under the session). So the hook is silent for spawned claude and the
+                        // mirror is the SOLE audit source — no double-count. Mirror each
+                        // tool_use post-hoc like the other 4 adapters so "what every agent did"
+                        // is provable for claude too. mirrored:true marks it.
+                        // CAVEAT: if a future claude DOES fire PreToolUse hooks in headless mode,
+                        // hooked tools (Bash/Edit/Write/MultiEdit/NotebookEdit) would double —
+                        // then dedup on (sessionId,toolName,action) in the audit readers, or
+                        // mirror only the hook's complement. Not needed today (hook is silent).
+                        const params = (b.input ?? {});
+                        const toolInput = (typeof params.command === 'string' && params.command) ||
+                            (typeof params.file_path === 'string' && params.file_path) ||
+                            (typeof params.path === 'string' && params.path) ||
+                            (typeof params.pattern === 'string' && params.pattern) ||
+                            JSON.stringify(params).slice(0, 500);
+                        mirrorToolCallToAudit({
+                            sessionId,
+                            agent: 'claude-code',
+                            toolName: b.name,
+                            toolInput: String(toolInput),
+                            cwd,
+                        });
+                    }
                 }
             }
         }
@@ -133,6 +237,7 @@ export function spawnClaudeCode(prompt, options = {}) {
                     cacheCreationTokens: d.usage.cache_creation_input_tokens
                         ? Number(d.usage.cache_creation_input_tokens)
                         : undefined,
+                    ...(modelSeen ? { model: modelSeen } : {}),
                 };
             }
         }
@@ -327,6 +432,11 @@ export function spawnClaudeCode(prompt, options = {}) {
         agent: 'claude-code',
         canAppendMessage: true,
         memoryInjection: injected.record,
+        // claude's own session_id, captured from the init event — persisted so a
+        // follow-up turn can resume even after a daemon restart (resume-after-restart).
+        get nativeSessionId() {
+            return claudeSessionId;
+        },
         get status() {
             return statusValue;
         },
@@ -405,13 +515,17 @@ export function spawnClaudeCode(prompt, options = {}) {
                         reject(new Error(`claude -c exited ${code}: ${stderr.slice(0, 200)}`));
                         return;
                     }
-                    // Parse stream-json — extract assistant message text from the
-                    // 'assistant' typed lines and the final 'result' line.
+                    // Parse stream-json. Route every line through the SAME emit() pipeline
+                    // as the original run (Layer 3 merge): emit() ingests into the shared
+                    // aggregator, refreshes stepsSnapshot, and notifies session-manager —
+                    // so the continuation's steps (say/think/tool/output) merge into
+                    // session.steps, ride SSE, and show in the timeline. Was text-only.
                     const lines = stdout.split('\n').filter((l) => l.trim());
                     const fragments = [];
                     for (const line of lines) {
                         try {
                             const obj = JSON.parse(line);
+                            emit({ type: obj.type ?? 'message', timestamp: Date.now(), data: obj });
                             if (obj.type === 'assistant' && obj.message?.content) {
                                 for (const block of obj.message.content) {
                                     if (block.type === 'text' && block.text)

package/dist/infrastructure/orchestration/codex-adapter.js

@@ -16,6 +16,9 @@
 import { spawn, execFileSync } from 'child_process';
 import { EventEmitter } from 'events';
 import { randomUUID } from 'crypto';
+import { existsSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
 import { startRecording } from './cassette-recorder.js';
 import { ProgressAggregator } from './progress-aggregator.js';
 import { snapshotCwd, extractArtifacts } from './artifacts-extractor.js';
@@ -108,7 +111,7 @@ export function spawnCodex(prompt, options = {}) {
         //   - mcp_tool_call (MCP servers) — NEW, mirrored as Tool with server prefix
         //   - collab_tool_call (SUBAGENT FAN-OUT, multi-agent v2 GA 2026-05-18) — NEW
         //     · spawn_agent / send_input / wait / close_agent / resume_agent
-        //     · mirrored to audit as "Subagent" toolName so /history shows the
+        //     · mirrored to audit as "Subagent" toolName so the audit feed shows the
         //       child-spawn activity. Without this, multi-agent Codex tasks fall
         //       silently through (audit + cost claim breach per CRIT-1).
         //     · Token usage of children remains UNDER-REPORTED in this fix —
@@ -172,7 +175,7 @@ export function spawnCodex(prompt, options = {}) {
             }
             else if (item.type === 'collab_tool_call') {
                 // SUBAGENT FAN-OUT — the v0.7 fix that closes CRIT-1's audit gap.
-                // Mirror every collab call to the audit log so /history shows the
+                // Mirror every collab call to the audit log so the audit feed shows the
                 // subagent activity. Tool naming convention: "Subagent.<tool>".
                 const collabTool = String(item.tool ?? 'collab');
                 const receivers = (item.receiver_thread_ids ?? []).join(',');
@@ -239,17 +242,21 @@ export function spawnCodex(prompt, options = {}) {
             const errObj = event.data?.error;
             const message = String(errObj?.message ?? '');
             if (message) {
+                errorEmitted = true;
+                // A recognized error gets codehere's curated message + recovery. An
+                // UNRECOGNIZED one (e.g. ChatGPT-plan "You've hit your usage limit — try
+                // again Jul 14") must NOT be swallowed: surface codex's REAL words so the
+                // user sees the actual, actionable reason instead of a generic guess.
                 const hit = scanForKnownError(message);
-                if (hit) {
-                    errorEmitted = true;
-                    const errEvent = {
-                        type: 'codehere:error',
-                        timestamp: Date.now(),
-                        data: { code: hit.code, message: hit.message, recovery: hit.recovery },
-                    };
-                    buffer.push(errEvent);
-                    emitter.emit('event', errEvent);
-                }
+                const errEvent = {
+                    type: 'codehere:error',
+                    timestamp: Date.now(),
+                    data: hit
+                        ? { code: hit.code, message: hit.message, recovery: hit.recovery }
+                        : { code: 'agent_error', message, recovery: '' },
+                };
+                buffer.push(errEvent);
+                emitter.emit('event', errEvent);
             }
         }
         if (!errorEmitted) {
@@ -458,7 +465,15 @@ export function spawnCodex(prompt, options = {}) {
                 // codex exec resume <SESSION_ID> -  → reads prompt from stdin
                 // Route follow-ups through the mock seam too — under CODEHERE_MOCK=1 this
                 // hits the mock REPL, not real codex. (Was a real-spend leak.)
-                const sp2 = resolveAgentSpawn('codex', 'codex', ['exec', '--json', '--skip-git-repo-check', '--dangerously-bypass-approvals-and-sandbox', 'resume', codexThreadId, '-'], text);
+                const sp2 = resolveAgentSpawn('codex', 'codex', [
+                    'exec',
+                    '--json',
+                    '--skip-git-repo-check',
+                    '--dangerously-bypass-approvals-and-sandbox',
+                    'resume',
+                    codexThreadId,
+                    '-',
+                ], text);
                 const followup = spawn(sp2.command, sp2.args, {
                     cwd,
                     env: spawnEnv,
@@ -529,9 +544,30 @@ export const CodexAdapter = {
                 installHint: { command: 'npm install -g @openai/codex', url: 'https://github.com/openai/codex-cli' },
             };
         }
-        // Codex supports ChatGPT account auth via `codex login` (similar to Claude
-        // Code's OAuth) OR OPENAI_API_KEY. Can't verify without calling out — let
-        // runtime catch real failures.
+        // Codex supports two auth paths, both detectable fs/env-only (no spawn —
+        // same honesty fix gemini/opencode got May 1: returning 'ready' on install
+        // alone sent users into a ~40s spawn that errored "not logged in" with no
+        // next step):
+        //   file: $CODEX_HOME/auth.json (default ~/.codex/auth.json, mode 600) —
+        //         written by `codex login` (ChatGPT account OAuth) or a stored key
+        //   env:  OPENAI_API_KEY (billed API path)
+        const codexHome = process.env.CODEX_HOME || join(homedir(), '.codex');
+        const codexAuthPath = join(codexHome, 'auth.json');
+        const hasFileAuth = existsSync(codexAuthPath);
+        const hasEnvAuth = !!process.env.OPENAI_API_KEY;
+        if (!hasFileAuth && !hasEnvAuth) {
+            return {
+                id: this.id,
+                label: this.label,
+                state: 'needs_auth',
+                installed: true,
+                authHint: {
+                    command: 'codex login  # ChatGPT account (Plus/Pro) — no per-token billing',
+                    url: 'https://github.com/openai/codex#authentication',
+                    detail: `Codex found on PATH but no auth detected (${codexAuthPath} missing and no OPENAI_API_KEY). Cheapest path: \`codex login\` with a ChatGPT Plus/Pro account (flat, no per-token charge). Or set OPENAI_API_KEY for the billed API.`,
+                },
+            };
+        }
         return { id: this.id, label: this.label, state: 'ready', installed: true };
     },
 };

package/dist/infrastructure/orchestration/conductor-adapter.js

@@ -36,6 +36,8 @@
  */
 import { EventEmitter } from 'events';
 import { randomUUID } from 'crypto';
+import { loadBudget, isOverBudget } from '../cost/budget-config.js';
+import { computeSpendToday, estimateCostUsd } from '../cost/spend-aggregator.js';
 const ROUTING_RULES = [
     {
         triggers: ['review', 'audit', 'explain', 'understand', 'analyze', 'analyse', 'why', 'what does'],
@@ -235,19 +237,49 @@ function spawnConductor(prompt, options, lookup) {
     const emitter = new EventEmitter();
     const buffer = [];
     let statusValue = 'running';
-    // Look up installed specialists (excluding Conductor itself to avoid recursion)
-    const installedAgentIds = lookup()
-        .filter((a) => a.id !== 'conductor' && a.isInstalled())
+    // Look up usable specialists (excluding Conductor itself to avoid recursion).
+    // READY, not merely installed — user-#1 dogfood (2026-06-07): Auto routed a
+    // task to aider whose readiness already said billed_key_required; it died on
+    // its startup banner and the run landed as a green "completed" that did
+    // nothing. Mock mode keeps the installed-only pool (mock spawns never hit
+    // real vendors; CI has no real CLIs to be "ready").
+    const conductorMockMode = process.env.CODEHERE_MOCK === '1' || process.env.CODEHERE_MOCK === 'true';
+    const installedAgents = lookup().filter((a) => a.id !== 'conductor' && a.isInstalled());
+    const installedAgentIds = installedAgents
+        .filter((a) => conductorMockMode || !a.checkReadiness || a.checkReadiness().state === 'ready')
         .map((a) => a.id);
-    const decision = pickSpecialist(prompt, installedAgentIds);
-    // If nothing's installed, emit an error event and return a non-running session.
+    // Cost-bounded fail-over (Phase 2 Pillar 2 · Ega-approved 2026-06-08): when
+    // today's spend has hit the daily budget, conductor routes to a FREE specialist
+    // (gemini/opencode) instead of burning more — the cost-bounded promise. Explicit
+    // paid-agent picks are refused upstream (429); conductor, the auto choice, fails
+    // over HERE, observed in the routing event. If no free agent is ready it falls
+    // through to the honest no-eligible-agent error below — it NEVER spawns a paid
+    // agent over budget.
+    const budgetCfg = loadBudget();
+    const budgetBounded = budgetCfg.dailyUsd !== null && isOverBudget(computeSpendToday().totalUsd, budgetCfg);
+    const eligibleAgentIds = budgetBounded
+        ? installedAgentIds.filter((id) => estimateCostUsd(id, { inputTokens: 1, outputTokens: 1 }) === 0)
+        : installedAgentIds;
+    const decision = pickSpecialist(prompt, eligibleAgentIds);
+    // If the pool is empty, emit an error event and return a non-running session.
+    // Two distinct causes deserve two distinct messages: nothing installed vs
+    // installed-but-not-ready (e.g. every vendor unbilled/unauthed — telling that
+    // user to "install" a vendor they already have would misdirect them).
     if (!decision) {
         statusValue = 'error';
         const errEvent = {
             type: 'error',
             timestamp: Date.now(),
             data: {
-                message: 'Conductor has no specialists to delegate to. Install at least one of: Claude Code, Codex, Aider, OpenCode.',
+                message: budgetBounded
+                    ? `Daily budget reached and no FREE agent (gemini, opencode) is ready to fail over to. ` +
+                        `Raise the cap (\`codehere budget set <amount>\`) or set up a free agent (e.g. \`export GEMINI_API_KEY=…\` — free tier), then retry. ` +
+                        `codehere won't spend over your budget.`
+                    : installedAgents.length === 0
+                        ? 'Conductor has no specialists to delegate to. Install at least one of: Claude Code, Codex, Aider, OpenCode.'
+                        : 'Conductor found installed agents, but none are ready to run (' +
+                            installedAgents.map((a) => a.id).join(', ') +
+                            '). Run `codehere health` to see what each one needs — usually an API key or billing.',
             },
         };
         buffer.push(errEvent);
@@ -261,8 +293,10 @@ function spawnConductor(prompt, options, lookup) {
         data: {
             conductorSessionId: sessionId,
             delegatedTo: decision.agentId,
-            reason: decision.reason,
+            // Surface the cost-bounded fail-over so it's never a silent vendor switch.
+            reason: budgetBounded ? `daily budget reached · routed to a free agent · ${decision.reason}` : decision.reason,
             promptExcerpt: prompt.slice(0, 200),
+            ...(budgetBounded ? { budgetBounded: true } : {}),
         },
     };
     // Buffer replay on subscribe() handles delivery to the first subscriber. Do
@@ -320,6 +354,11 @@ function spawnConductor(prompt, options, lookup) {
         startedAt,
         prompt,
         agent: 'conductor',
+        // 1.3 · the specialist's runtime sessionId IS the id the audit hook keys
+        // this task's tool calls by. Persisting it lets cross-vendor attribution
+        // join the chain for conductor-routed (Auto) tasks — without it, every such
+        // task reads "couldn't attribute" even though its writes are in the chain.
+        delegateSessionId: specialistSession.sessionId,
         get status() {
             return statusValue;
         },

package/dist/infrastructure/orchestration/context-handoff.js

@@ -9,7 +9,7 @@
  * Protocol:
  *   1. loadHandoffContext(cwd, { fromSessionId?, sessionId?, maxAgeMs? })
  *      — scans .codehere/context-packs.jsonl for the most relevant pack
- *   2. enrichPromptWithHandoff(prompt, cwd, handoff)
+ *   2. enrichPromptWithHandoff(prompt, handoff)  — 2-arg (LOW #9: this header used to claim a cwd arg the signature never had)
  *      — merges the handoff context into a prompt string
  *   3. session handoff is automatic during failover (wired in session-manager)
  *
@@ -102,6 +102,37 @@ export function enrichPromptWithHandoff(prompt, handoff) {
         prompt,
     ].join('\n');
 }
+/**
+ * Prepend a conversational hand-off preamble so a DIFFERENT agent picking up an
+ * open thread actually receives what the prior agent was asked + what it did —
+ * not a blind restart. This is the cross-agent hand-off the room promises
+ * ("any agent picks up where the last left off"). The summary it injects is the
+ * SAME one the user sees in the room hand-off render, so the agent and the human
+ * read one truth. Pure: the caller looks up the parent turn; this just formats.
+ * Returns the prompt unchanged when there's no usable parent context.
+ */
+export function enrichPromptWithThreadHandoff(prompt, parent) {
+    if (!parent || !parent.agent)
+        return prompt;
+    const cut = (s, n) => {
+        const t = String(s ?? '')
+            .trim()
+            .replace(/\s+/g, ' ');
+        return t.length > n ? t.slice(0, n - 1) + '…' : t;
+    };
+    const askedLine = parent.prompt ? `They were asked: "${cut(parent.prompt, 300)}"` : null;
+    const didLine = cut(parent.summary, 600)
+        ? `What they did: ${cut(parent.summary, 600)}`
+        : 'What they did: (no summary was recorded — inspect the files they touched before continuing)';
+    return [
+        `[Continuing a thread — the agent "${parent.agent}" worked on this project immediately before you.]`,
+        ...(askedLine ? [askedLine] : []),
+        didLine,
+        `Build on that work — do not redo it. Handle the request below as the next step in the same thread.`,
+        `---`,
+        prompt,
+    ].join('\n');
+}
 // ── Failover handoff (P2 integration point) ────────────────────────────────────
 /**
  * Build a handoff context for a failover target.
@@ -128,17 +159,4 @@ export function buildFailoverHandoff(cwd, { failedAgent, failedPrompt }) {
         status: 'failed',
     };
 }
-// ── Handoff summary (for UI / API) ─────────────────────────────────────────────
-/**
- * Generate a human-readable handoff summary for the dashboard.
- */
-export function formatHandoffSummary(handoff) {
-    const ageMs = Date.now() - handoff.timestamp;
-    const ageStr = ageMs < 60_000
-        ? `${Math.round(ageMs / 1000)}s ago`
-        : ageMs < 3600_000
-            ? `${Math.round(ageMs / 60_000)}m ago`
-            : `${Math.round(ageMs / 3600_000)}h ago`;
-    return `Previous session (${handoff.agent}) completed ${ageStr}. ${handoff.nodeCount} nodes, ${handoff.edgeCount} edges in workspace graph.`;
-}
 //# sourceMappingURL=context-handoff.js.map

package/dist/infrastructure/orchestration/detect-ollama.js

@@ -0,0 +1,75 @@
+/**
+ * Detect a local Ollama install with at least one model — so codehere can offer
+ * a RELIABLE, FREE, LOCAL second vendor (aider → ollama) instead of depending on
+ * flaky free tiers or the user's cloud billing. This is the unlock for the
+ * cross-vendor wedge (V2) on a machine that has Ollama: a local model that
+ * completes real coding tasks with no rate limits and no key.
+ *
+ * Cheap + cached: `ollama list` is shelled at most once per TTL window; if Ollama
+ * isn't installed/running the call fails fast and we cache "not available", so the
+ * common no-Ollama path costs ~one bounded spawn every 30s, never per task.
+ */
+import { execFileSync } from 'node:child_process';
+let cache;
+let cachedAt = 0;
+const TTL_MS = 30_000;
+/** Embedding / non-chat models aider can't drive as a coder. Routing to one
+ *  would fail silently, so they're never auto-picked (self-audit 2026-06-09). */
+const NON_CHAT = /embed|rerank|bge|nomic|minilm|e5-|gte-|clip|whisper|moondream|llava-phi/i;
+/** Pick the model to run: an explicit CODEHERE_OLLAMA_MODEL override if it's
+ *  actually installed, else the first GENERATIVE model. We don't guess a "best"
+ *  coder (a /coder/ bias picked an 18GB model — slow); we only EXCLUDE models
+ *  aider can't use. The user knows their hardware — CODEHERE_OLLAMA_MODEL is the
+ *  knob (refuter + self-audit 2026-06-09). */
+function pickModel(models) {
+    if (models.length === 0)
+        return undefined;
+    const override = process.env.CODEHERE_OLLAMA_MODEL;
+    if (override && models.includes(override))
+        return override; // explicit wins, even if "non-chat"
+    // :cloud tags are ollama's CLOUD-proxied models — no local weights, billed
+    // account required. Auto-picking one breaks this module's whole promise
+    // (reliable, free, local) with "couldn't reach the model provider" — hit
+    // live 2026-07-02 when glm-5.2:cloud was first in `ollama list`. Explicit
+    // override above still allows them; auto-pick never does.
+    return models.find((m) => !NON_CHAT.test(m) && !/:cloud$/i.test(m)) ?? undefined;
+}
+/** Detect a usable local Ollama. Never throws. */
+export function detectOllama() {
+    const now = Date.now();
+    if (cache && now - cachedAt < TTL_MS)
+        return cache;
+    let info = { available: false };
+    try {
+        // Short timeout: this is a SYNC call and readiness runs it on the daemon's
+        // event loop (the UI polls readiness), so a HUNG ollama must not block the
+        // daemon for long. 700ms once per TTL window is a tolerable worst case; the
+        // common (fast or absent) paths return in ~20ms (refuter 2026-06-09).
+        const out = execFileSync('ollama', ['list'], {
+            timeout: 700,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        // `ollama list` prints a header row then "NAME  ID  SIZE  MODIFIED" rows.
+        const models = out
+            .split('\n')
+            .slice(1)
+            .map((l) => l.trim().split(/\s+/)[0])
+            .filter((m) => m && m !== 'NAME');
+        const model = pickModel(models);
+        if (model)
+            info = { available: true, model };
+    }
+    catch {
+        /* ollama not installed / not serving → not available */
+    }
+    cache = info;
+    cachedAt = now;
+    return info;
+}
+/** @internal test seam — clear the memoized detection. */
+export function __resetOllamaCache() {
+    cache = undefined;
+    cachedAt = 0;
+}
+//# sourceMappingURL=detect-ollama.js.map

package/dist/infrastructure/orchestration/failover-config.js

@@ -23,7 +23,7 @@ import { readFileSync, existsSync } from 'fs';
 import { homedir } from 'os';
 import { join } from 'path';
 import { validateFailoverChain } from './failover-policy.js';
-const GLOBAL_CONFIG_PATH = join(homedir(), '.codehere', 'config.json');
+const GLOBAL_CONFIG_PATH = join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'config.json');
 /**
  * Load failover configuration from ~/.codehere/config.json.
  * Returns undefined if the config file does not exist or has no failover section.
@@ -64,14 +64,4 @@ export function loadFailoverConfig() {
         return undefined;
     }
 }
-/**
- * Get the resolved failover chain: user-configured if present, else default.
- * Pure function — no I/O. Caller loads config and passes it in.
- */
-export function resolveChain(userChain) {
-    if (userChain && userChain.length > 0)
-        return userChain;
-    // Re-export the default from failover-policy
-    return ['claude-code', 'codex', 'aider', 'opencode', 'gemini'];
-}
 //# sourceMappingURL=failover-config.js.map