create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/model-proxy/refusal-scope.js

@@ -0,0 +1,151 @@
+'use strict';
+
+// One entry per (client, feature): the refusal wording whose MEASURED fallback scope is the
+// narrowest the client offers. Evidence and re-measure procedure:
+// docs/auto-mode-native-lead-subagent-latch-2026-10-30.html §1.2 / §7.
+//
+// Measured on Claude Code 2.1.314 (§1.2 P-2 vs P-3/P-4): a 400 whose message names any of the
+// tokens in `forbiddenTokens` (case-insensitive) makes the client turn server-side review off
+// for its WHOLE SESSION -- the host latch `thirdPartyServerClassifierRefused()` fires and the
+// lead process keeps classifying locally after a single subagent was refused. The wording below
+// names none of them, so the client falls back for that ONE CONVERSATION and the session-scoped
+// latch is never set. Re-measure with the `reprobe` command after each Claude Code update; on
+// PASS, bump `measuredOn` in an isolated commit that cites the probe output.
+//
+// `version` is only ever the `\d+\.\d+\.\d+` capture of `entry.userAgent`, never raw header text,
+// so nothing but a version number can reach a log line.
+
+const REFUSAL_SCOPE_UNVERIFIED_PREFIX = '[model-proxy] refusal_scope_unverified';
+
+const REVIEW_UNAVAILABLE_MESSAGE =
+  'This translated route cannot run server-side action review for this request '
+  + '(ctm: review_unavailable_on_route). Send it without that review.';
+
+const REFUSAL_SCOPE_ENTRIES = Object.freeze([
+  Object.freeze({
+    id: 'claude-code/server-review',
+    client: 'claude-code',
+    feature: 'server-review',
+    userAgent: /^claude-cli\/(\d+\.\d+\.\d+)\b/,
+    measuredOn: '2.1.314',
+    scope: 'conversation',
+    status: 400,
+    errorType: 'invalid_request_error',
+    message: REVIEW_UNAVAILABLE_MESSAGE,
+    forbiddenTokens: Object.freeze(['safeguard', 'dangerous-tool-use', 'dangerous_tool_use', 'afk-mode']),
+    reprobe: 'node coding-task-manager/bin/probe-refusal-scope.js',
+  }),
+]);
+
+const SCOPE_VERIFIED = 'verified';
+const SCOPE_UNVERIFIED = 'unverified';
+const SCOPE_UNKNOWN = 'unknown';
+
+// Bound on the once-per-(entry.id, version) warn set: after this many distinct versions the
+// module stops recording AND stops warning, so an oscillating client cannot grow the set or
+// flood the log without limit.
+const MAX_TRACKED_VERSIONS = 64;
+
+// The versions already warned about, keyed `${entry.id}\u0000${version}`. Process-global by
+// design: "once per process" is the contract.
+const warnedVersions = new Set();
+
+function _isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+// One header value by case-insensitive name, or `undefined`. Node lower-cases incoming header
+// names, but a caller-built map may spell them any way, so the lookup never relies on that.
+function _headerValue(headers, name) {
+  if (!_isPlainObject(headers)) return undefined;
+  for (const [key, value] of Object.entries(headers)) {
+    if (typeof key === 'string' && key.toLowerCase() === name) return value;
+  }
+  return undefined;
+}
+
+/**
+ * The registered entry for a (client, feature) pair.
+ * @param {string} client
+ * @param {string} feature
+ * @returns {object|null} the frozen entry, or null when none is registered
+ */
+function refusalEntry(client, feature) {
+  for (const entry of REFUSAL_SCOPE_ENTRIES) {
+    if (entry.client === client && entry.feature === feature) return entry;
+  }
+  return null;
+}
+
+/**
+ * The client version `X.Y.Z`, parsed with `entry.userAgent` out of the request's `user-agent`
+ * header (any case). Only the regex capture is ever returned, so a header that carries more
+ * than a version (e.g. `claude-cli/2.1.314<script>`) yields exactly `2.1.314`.
+ * @param {object|null} entry
+ * @param {unknown} headers
+ * @returns {string|null}
+ */
+function clientVersion(entry, headers) {
+  if (!entry || !(entry.userAgent instanceof RegExp)) return null;
+  const raw = _headerValue(headers, 'user-agent');
+  const value = Array.isArray(raw) ? raw.find((part) => typeof part === 'string') : raw;
+  if (typeof value !== 'string') return null;
+  const match = entry.userAgent.exec(value);
+  return match && typeof match[1] === 'string' ? match[1] : null;
+}
+
+/**
+ * Whether the client's measured fallback scope for this entry still holds for the version seen.
+ * @param {object|null} entry
+ * @param {string|null|undefined} version
+ * @returns {'verified'|'unverified'|'unknown'} 'unknown' when no version could be read
+ */
+function scopeVerification(entry, version) {
+  if (!entry) return SCOPE_UNKNOWN;
+  if (typeof version !== 'string' || version === '') return SCOPE_UNKNOWN;
+  return version === entry.measuredOn ? SCOPE_VERIFIED : SCOPE_UNVERIFIED;
+}
+
+/**
+ * The refusal response for an entry, as fresh objects on every call (a caller may mutate them).
+ * @param {object|null} entry
+ * @returns {{status:number, body:{type:string, error:{type:string, message:string}}}|null}
+ */
+function refusalResponse(entry) {
+  if (!entry) return null;
+  return {
+    status: entry.status,
+    body: {
+      type: 'error',
+      error: { type: entry.errorType, message: entry.message },
+    },
+  };
+}
+
+/**
+ * Warn ONCE per (entry.id, version) per process when the installed client version is not the one
+ * the entry was measured on. A no-op for 'verified'/'unknown' and for a missing entry.
+ * @param {object|null} entry
+ * @param {string|null|undefined} version
+ */
+function warnIfUnverified(entry, version) {
+  if (scopeVerification(entry, version) !== SCOPE_UNVERIFIED) return;
+  const key = `${entry.id}\u0000${version}`;
+  if (warnedVersions.has(key)) return;
+  if (warnedVersions.size >= MAX_TRACKED_VERSIONS) return; // bounded: stop recording and warning
+  warnedVersions.add(key);
+  console.warn(
+    `${REFUSAL_SCOPE_UNVERIFIED_PREFIX} entry=${entry.id} client_version=${version}`
+    + ` measured_on=${entry.measuredOn} reprobe="${entry.reprobe}"`,
+  );
+}
+
+module.exports = {
+  REVIEW_UNAVAILABLE_MESSAGE,
+  REFUSAL_SCOPE_ENTRIES,
+  refusalEntry,
+  clientVersion,
+  scopeVerification,
+  refusalResponse,
+  warnIfUnverified,
+};

package/template/coding-task-manager/lib/model-proxy/request-budget-store.js

@@ -391,10 +391,19 @@ async function readTaskLedger({ ctmSessionId, dataDir = getDataDir(), fsImpl = f
     const terminalRequests = terminal && Number.isSafeInteger(terminal.providerRequests) ? terminal.providerRequests : null;
     const terminalOutput = terminal && Number.isSafeInteger(terminal.outputTokens) ? terminal.outputTokens : null;
     const priced = completes.filter((record) => typeof record.costUsd === 'number' && Number.isFinite(record.costUsd));
+    // C7-A: the journal's own admits/completions are the floor, never a ceiling. CTM's terminal
+    // report is derived runtime telemetry: it can be stale (a runtime restart or a report written
+    // before the proxy actor's own appends land) and it can legitimately lag a completion that the
+    // writer journals after the terminal for an already-admitted id. The admit and known-completion
+    // records are append-only observations made by this store itself, so a smaller terminal snapshot
+    // cannot erase them. Math.max is a lower bound over two views of the SAME work, never an
+    // addition -- a larger legacy terminal snapshot stays the bound -- and a null terminal count is
+    // no bound at all, not a measured 0: usage no record observed stays unmeasured.
+    const knownCompletionOutputTokens = completes.reduce((sum, record) => sum + (record.outputTokens || 0), 0);
     rows.push({
       generation,
-      requests: terminalRequests !== null ? terminalRequests : admits.length,
-      outputTokens: terminalOutput !== null ? terminalOutput : completes.reduce((sum, record) => sum + (record.outputTokens || 0), 0),
+      requests: Math.max(terminalRequests ?? 0, admits.length),
+      outputTokens: Math.max(terminalOutput ?? 0, knownCompletionOutputTokens),
       // WP-2: a v1 admit has no limits.startLease, so the fallback defaults to 1
       // (a v1 journal's endLease is always a number).
       endLease: leases.length ? Math.max(...leases.map((record) => record.lease)) : (admits.length ? admits[0].limits.startLease ?? 1 : 1),

package/template/coding-task-manager/lib/model-proxy/tokens.js

@@ -19,6 +19,11 @@ const LEAD_TOKEN_RE = /^ctml_[0-9a-f]{32}$/;
 const LEAD_HARNESSES = new Set(['codex-cli', 'claude-code']);
 const SAFE_DEPLOYMENT_ID = /^[@A-Za-z0-9][A-Za-z0-9._:/@+-]{0,159}$/;
 const LEAD_PURPOSES = new Set(['routed-primary', 'native-claude-passthrough']);
+// WP-9 §9b L-2 (docs/deepseek-harness-acp-agent-2026-10-28.html D-19): an OPTIONAL mark on a lead
+// token saying its requests must also be written to a per-request usage file. Only 'dsh' exists — the
+// DeepSeek Harness lane, whose ACP wire carries no token counts — and a token without the field is
+// byte-for-byte the binding it has always been (the proxy writes nothing for it).
+const LEAD_USAGE_LOGS = new Set(['dsh']);
 const NATIVE_CLAUDE_ALIAS = 'anthropic-oauth';
 const SAFE_OWNER_ID = /^[A-Za-z0-9][A-Za-z0-9._:@/+\-]{0,255}$/;
 // WP-0A (docs/claude-native-auth-mtls-and-routed-subagents-2026-10-15.html §6.2, D-2/D-7): the
@@ -170,6 +175,10 @@ function _sameLeadRegistration(entry, next) {
     && entry.harness === next.harness
     && entry.providerThreadId === next.providerThreadId
     && entry.transitionId === next.transitionId
+    // D-19: the usage mark is immutable identity like every other field here — an absent value reads as
+    // null, so a replay of the exact same registration stays idempotent while turning the mark on (or
+    // off) for a live token is a rebind, never an upgrade.
+    && (entry.usageLog || null) === (next.usageLog || null)
     // Carrier and fingerprint comparison uses the RESOLVED values: an owner registered before the
     // fields existed (or one whose caller omits them) is on 'legacy-bearer' with no fingerprint, so
     // replaying it as an explicit 'legacy-bearer' stays idempotent while a switch to 'mtls-v1' — or a
@@ -214,8 +223,14 @@ function _liveLeadEntry(token) {
 
 function _normalizeLeadRegistration({ ctmSessionId, aliases, bindings, processGeneration, transitionId,
   purpose = 'routed-primary', delegateScope = false, harness, providerThreadId, nativeTransport,
-  nativeCertFingerprint, nativeSettingsRef } = {}) {
+  nativeCertFingerprint, nativeSettingsRef, usageLog } = {}) {
   if (!LEAD_PURPOSES.has(purpose)) throw new TypeError('registerLeadToken: unknown purpose');
+  // D-19/L-2: `usageLog` is an optional mark, and 'dsh' is the only value it has. `typeof`-first for
+  // the same reason the native fields are: an array- or object-wrapped value must be refused rather
+  // than coerced and then stored as something no downstream comparison could ever match.
+  if (usageLog != null && (typeof usageLog !== 'string' || !LEAD_USAGE_LOGS.has(usageLog))) {
+    throw new TypeError('registerLeadToken: unknown usageLog');
+  }
   if (typeof delegateScope !== 'boolean') throw new TypeError('registerLeadToken: delegateScope must be boolean');
   if (typeof ctmSessionId !== 'string' || !SAFE_OWNER_ID.test(ctmSessionId)) {
     throw new TypeError('registerLeadToken: ctmSessionId required');
@@ -282,7 +297,8 @@ function _normalizeLeadRegistration({ ctmSessionId, aliases, bindings, processGe
     // a settings locator is ever manufactured for it.
     return { ctmSessionId, aliases: new Set(aliases), bindings: [], processGeneration,
       purpose, delegateScope, harness, providerThreadId,
-      ...(nativeTransport === NATIVE_TRANSPORT_MTLS ? { nativeTransport, nativeCertFingerprint, nativeSettingsRef } : {}) };
+      ...(nativeTransport === NATIVE_TRANSPORT_MTLS ? { nativeTransport, nativeCertFingerprint, nativeSettingsRef } : {}),
+      ...(usageLog ? { usageLog } : {}) };
   }
   if (providerThreadId != null && (typeof providerThreadId !== 'string' || !SAFE_OWNER_ID.test(providerThreadId))) {
     throw new TypeError('registerLeadToken: providerThreadId must be a bounded identifier');
@@ -299,7 +315,8 @@ function _normalizeLeadRegistration({ ctmSessionId, aliases, bindings, processGe
   const coherentHarness = harness || derivedHarness;
   return { ctmSessionId, aliases: new Set(aliases), bindings: normalizedBindings,
     processGeneration, purpose, delegateScope, ...(coherentHarness ? { harness: coherentHarness } : {}),
-    ...(providerThreadId ? { providerThreadId } : {}), ...(transitionId != null ? { transitionId } : {}) };
+    ...(providerThreadId ? { providerThreadId } : {}), ...(transitionId != null ? { transitionId } : {}),
+    ...(usageLog ? { usageLog } : {}) };
 }
 
 function registerLeadToken(registration = {}) {
@@ -310,6 +327,11 @@ function registerLeadToken(registration = {}) {
   return _commitLeadRegistration(validated.token, validated.entry);
 }
 
+// WP-1 (§5 D-4, §9 S5): the bounded code a REFUSED revocation replay carries. A static string -- never a
+// token, a fingerprint or any other caller value -- so the native admin path can map it to a 409 without
+// ever echoing input.
+const LEAD_TOKEN_REVOKED_CODE = 'lead_token_revoked';
+
 /**
  * The PURE half of lead-token registration: the field allowlist, the token grammar, and every
  * shape/normalization rule, including the immutable carrier/fingerprint/settings-ref pairing
@@ -329,7 +351,7 @@ function registerLeadToken(registration = {}) {
 function validateLeadTokenRegistration(registration = {}) {
   const allowedFields = new Set(['token', 'ctmSessionId', 'aliases', 'bindings', 'processGeneration',
     'transitionId', 'purpose', 'delegateScope', 'harness', 'providerThreadId', 'nativeTransport',
-    'nativeCertFingerprint', 'nativeSettingsRef']);
+    'nativeCertFingerprint', 'nativeSettingsRef', 'usageLog']);
   if (!registration || typeof registration !== 'object' || Array.isArray(registration)
       || Object.keys(registration).some((key) => !allowedFields.has(key))) {
     throw new TypeError('registerLeadToken: unknown registration field');
@@ -348,6 +370,13 @@ function validateLeadTokenRegistration(registration = {}) {
 function _commitLeadRegistration(token, next) {
   const conflict = _leadRegistrationConflictMessage(token, next);
   if (conflict) throw new TypeError(conflict);
+  // WP-1 (§5 D-4, §9 S5): a REVOKED owner is a tombstone, not an upgrade. Only an EXACT replay of a
+  // revoked registration reaches here (a differing one is already the rebind conflict above), and it is
+  // refused with the bounded code BEFORE the idempotent-replay short-circuit below: acknowledging it as
+  // a successful grant is exactly the lie this fix removes, because the revoke released this owner's
+  // certificate index row too, so the "granted" token resolved to no live owner at all.
+  const revokedRefusal = _revokedLeadRegistrationRefusal(token, next);
+  if (revokedRefusal) throw revokedRefusal;
   // The idempotent-replay case writes the same entry again; that is what makes a replay a no-op.
   const existing = _tokens.get(token);
   if (existing && _sameLeadRegistration(existing, next)) return { token };
@@ -357,6 +386,28 @@ function _commitLeadRegistration(token, next) {
   return { token };
 }
 
+/**
+ * The revocation half of the LIVE registration rules (§5 D-4): an EXACT replay of a revoked lead
+ * registration is refused, with a bounded code and no write. It reads and writes nothing else, so asking
+ * it before a ticket exists and again inside the commit is the same answer.
+ *
+ * A DIFFERING registration of a revoked token is NOT answered here -- the rebind conflict above owns it,
+ * so every immutable-field rule and the duplicate-certificate rule keep their existing refusal. And since
+ * a revoke releases the fingerprint in the same step, a different NEW token may still take that released
+ * certificate over (D-2): this refusal is about the revoked IDENTITY, never about the certificate.
+ *
+ * @returns {Error|null} the coded TypeError the caller must throw, or null when this is not a replay of a
+ *   revoked registration
+ */
+function _revokedLeadRegistrationRefusal(token, next) {
+  const existing = _tokens.get(token);
+  if (!existing || existing.kind !== 'lead' || !existing.revoked) return null;
+  if (!_sameLeadRegistration(existing, next)) return null;
+  const error = new TypeError('registerLeadToken: a revoked token cannot be re-registered');
+  error.code = LEAD_TOKEN_REVOKED_CODE;
+  return error;
+}
+
 /**
  * The read-only LIVE half of lead-token registration: everything that depends on the CURRENT registry.
  *
@@ -454,6 +505,11 @@ function beginLeadTokenRegistration(registration = {}) {
   // there — this early call is what keeps a doomed registration from ever loading a CA or binding a port.
   const conflict = _leadRegistrationConflictMessage(validated.token, validated.entry);
   if (conflict) throw new TypeError(conflict);
+  // WP-1 (§5 D-4): a revoked owner is refused HERE, before the ticket exists, so a doomed replay never
+  // loads a CA and never binds a port. The commit below asks the same question again, so a revocation
+  // that lands while the caller is awaiting is refused there too.
+  const revokedRefusal = _revokedLeadRegistrationRefusal(validated.token, validated.entry);
+  if (revokedRefusal) throw revokedRefusal;
   if (_pendingLeadRegistrations.size >= MAX_PENDING_LEAD_REGISTRATIONS) {
     throw new TypeError('beginLeadTokenRegistration: too many pending registrations');
   }
@@ -474,10 +530,13 @@ function beginLeadTokenRegistration(registration = {}) {
         const result = _commitLeadRegistration(ticket.token, ticket.entry);
         ticket.state = 'committed';
         return { ok: true, token: result.token };
-      } catch {
+      } catch (err) {
         // The live checks refused (a concurrent owner took this certificate, or the token was rebound):
         // the bounded code is all the caller learns — never the underlying message, which is internal.
         ticket.state = 'refused';
+        // ...and a revocation refusal keeps its OWN bounded code, so the native admin path answers 409
+        // `lead_token_revoked` at commit time exactly as it does on the synchronous path (§9 S6).
+        if (err && err.code === LEAD_TOKEN_REVOKED_CODE) return { ok: false, code: LEAD_TOKEN_REVOKED_CODE };
         return { ok: false, code: LEAD_REGISTRATION_TICKET_CODES.REFUSED };
       }
     },
@@ -552,6 +611,10 @@ function leadTokenBinding(token) {
     ...(entry.nativeTransport ? { nativeTransport: entry.nativeTransport } : {}),
     ...(entry.nativeCertFingerprint ? { nativeCertFingerprint: entry.nativeCertFingerprint } : {}),
     ...(entry.nativeSettingsRef ? { nativeSettingsRef: entry.nativeSettingsRef } : {}),
+    // D-19/L-2: the usage mark rides the binding projection exactly as supplied, so the proxy's
+    // completion path can tell a dsh lane from every other lead without a second registry. Absent on
+    // every registration that never set it, so those projections stay byte-for-byte unchanged.
+    ...(entry.usageLog ? { usageLog: entry.usageLog } : {}),
   };
 }
 
@@ -869,6 +932,7 @@ module.exports = {
   NATIVE_CERT_FINGERPRINT_RE,
   NATIVE_SETTINGS_REF_RE,
   LEAD_REGISTRATION_TICKET_CODES,
+  LEAD_TOKEN_REVOKED_CODE,
   MAX_PENDING_LEAD_REGISTRATIONS,
   registerLeadToken,
   validateLeadTokenRegistration,

package/template/coding-task-manager/lib/model-proxy/upstream-outcome.js

@@ -11,6 +11,7 @@ const SAFE_MESSAGES = Object.freeze({
   server_error: 'The provider could not complete the request.',
   model_not_invocable: 'This route cannot invoke this model id; it needs the model’s inference-profile id.',
   model_access_denied: 'The route’s provider account denies access to this model.',
+  model_not_found: 'This route does not serve this model id.',
 });
 
 const SAFE_CODE = /^[A-Za-z0-9_.-]{1,64}$/;
@@ -45,6 +46,14 @@ function _classify(code, status, message) {
   // rate_limit_exceeded) and before the generic invalid/4xx line. The provider's own prose is never copied.
   if (status === 401 || status === 403 || code === '401' || code === '403') return 'model_access_denied';
   if (/on-demand throughput|inference profile/.test(folded) && (status === 400 || status === 422 || code === '400' || code === '422')) return 'model_not_invocable';
+  // WP-1b (§12a rule 2): a 404, or a 400/422 whose prose says the model ID ITSELF is unknown or
+  // unreachable from this account, is the same verdict the document above describes — the route does
+  // not serve this model id — and the switch has to name it truthfully instead of "the request is
+  // invalid". Both run after the four message-driven classes and the two route/model-id lines, and
+  // before the generic invalid/4xx line (which would otherwise swallow a 404 as invalid_prompt).
+  if (status === 404 || code === '404') return 'model_not_found';
+  if ((status === 400 || status === 422 || code === '400' || code === '422')
+    && /model identifier is invalid|model[_ -]?not[_ -]?found|not found or your project does not have access/.test(folded)) return 'model_not_found';
   if (/invalid|model[_ -]?not[_ -]?found|history/.test(folded) || ['400', '404', '422'].includes(code) || [400, 404, 422].includes(status)) return 'invalid_prompt';
   return 'server_error';
 }

package/template/coding-task-manager/lib/native-agent-model-args.js

@@ -16,11 +16,6 @@ const NATIVE_AGENT_MODEL_FLAG = Object.freeze({
   opencode: '--model',
 });
 
-// OpenCode model IDs include the provider ID (`provider/model`). Keep CTM's
-// opinionated default here instead of mutating ~/.config/opencode so terminal
-// launches outside CTM keep the user's own OpenCode defaults.
-const DEFAULT_OPENCODE_MODEL = 'zai/glm-5.2';
-
 function _normalizeProvider(value) {
   const text = String(value || '').trim().toLowerCase().replace(/_/g, '-');
   if (text === 'claude' || text === 'claude-code') return 'anthropic';
@@ -43,14 +38,6 @@ function _inferProviderFromModel(modelId) {
   return '';
 }
 
-function _opencodeDefaultModel(env = process.env) {
-  return String(
-    env?.CTM_OPENCODE_DEFAULT_MODEL
-    || env?.OPENCODE_DEFAULT_MODEL
-    || DEFAULT_OPENCODE_MODEL
-  ).trim();
-}
-
 function nativeProviderForAgent(agentType) {
   return NATIVE_AGENT_PROVIDER[normalizeAgentType(agentType)] || '';
 }
@@ -85,18 +72,18 @@ function selectNativeAgentLaunchModel({
   explicitModelId,
   explicitModelProvider,
   defaultSelection,
-  env = process.env,
 } = {}) {
   const normalizedAgent = normalizeAgentType(agentType);
+  // OpenCode model ids are `provider/model`. Same rule as Claude/Codex: an explicit pick becomes
+  // `--model`; with no pick CTM passes none and the CLI's own default decides (observed on the
+  // first `opencode:message`). CTM never invents an OpenCode default (OpenCode round 2 §5 R-5).
   if (normalizedAgent === 'opencode') {
     const explicitModel = String(explicitModelId || '').trim();
-    const model = explicitModel || _opencodeDefaultModel(env);
-    if (!model) return null;
-    const modelProvider = _normalizeProvider(explicitModelProvider) || _inferProviderFromModel(model) || 'opencode';
+    if (!explicitModel) return null;
     return {
-      model_id: model,
-      model_provider: modelProvider,
-      source: explicitModel ? 'explicit' : 'opencode-default',
+      model_id: explicitModel,
+      model_provider: _normalizeProvider(explicitModelProvider) || _inferProviderFromModel(explicitModel) || 'opencode',
+      source: 'explicit',
     };
   }
 
@@ -129,18 +116,34 @@ function selectNativeAgentLaunchModel({
   return null;
 }
 
-function injectNativeAgentModelArgs({ agentType, args, modelId } = {}) {
+// OpenCode 2's TUI rejects `--model` (it prints usage and exits); OpenCode 1.x
+// accepts it. The launch path is synchronous, so the line comes from the last
+// detection this process recorded (opencode-cli.peekOpencodeLine — sync, no fs, no
+// spawn). R-6 (opencode-v2-model-switch §5.1): that detection is PRIMED by an
+// `await primeOpencodeLine()` at the top of server.js's handleCreate, before any
+// OpenCode argv is built, so an OpenCode launch never decides on an unknown line.
+// The old background opencodeLine() warm-up is gone. Only OpenCode 2's line is
+// treated specially: every other value (including a `null` we could not determine)
+// keeps the pre-existing behaviour exactly.
+function injectNativeAgentModelArgs({ agentType, args, modelId, env, lineOf } = {}) {
   const normalizedAgent = normalizeAgentType(agentType);
   const flag = NATIVE_AGENT_MODEL_FLAG[normalizedAgent];
   const model = String(modelId || '').trim();
   const list = Array.isArray(args) ? args.slice() : [];
   if (!flag || !model) return { args: list, injected: false, reason: 'unsupported' };
+  if (normalizedAgent === 'opencode') {
+    const cli = require('./opencode-cli');
+    const resolveLine = lineOf || (() => cli.peekOpencodeLine());
+    const line = resolveLine(env || process.env);
+    if (line === 'v2') {
+      return { args: list, injected: false, reason: 'opencode-v2-no-tui-model-flag' };
+    }
+  }
   if (hasExplicitNativeModelArg(list)) return { args: list, injected: false, reason: 'explicit-model-arg' };
   return { args: [flag, model, ...list], injected: true, reason: 'injected' };
 }
 
 module.exports = {
-  DEFAULT_OPENCODE_MODEL,
   NATIVE_AGENT_PROVIDER,
   hasExplicitNativeModelArg,
   injectNativeAgentModelArgs,

package/template/coding-task-manager/lib/native-history-control.js

@@ -4,8 +4,10 @@ const { spawn } = require('node:child_process');
 const { StringDecoder } = require('node:string_decoder');
 const path = require('node:path');
 const { codexProxyProviderArgs } = require('./codex-launch-health');
-// S-5: the adapter id and the qualified-version membership test come from the one table.
-const { CODEX_CONTROL_ADAPTER, isQualifiedCodexVersion, isNonElevatedCyberAccessProgram } = require('./codex-harness-qualification');
+// S-5: the adapter id and the non-elevated cyber program set come from the one table. The Codex
+// version is recorded provenance only (WP-0): the two validators below refuse a missing/blank
+// version string but never compare it against a qualified-version table, range or floor.
+const { CODEX_CONTROL_ADAPTER, isNonElevatedCyberAccessProgram } = require('./codex-harness-qualification');
 
 const QUALIFIED_ADAPTER = CODEX_CONTROL_ADAPTER;
 const MAX_FRAME_BYTES = 1024 * 1024;
@@ -52,7 +54,7 @@ function createCodexNativeHistoryControl({ sourceRecipe, targetRecipe } = {}) {
 
 function validateSource(recipe) {
   if (!isRecord(recipe) || recipe.controlAdapterVersion !== QUALIFIED_ADAPTER
-      || !isQualifiedCodexVersion(recipe.programVersion) || !absolute(recipe.executablePath)
+      || !nonempty(recipe.programVersion) || !absolute(recipe.executablePath)
       || !absolute(recipe.codexHome) || !absolute(recipe.homeDir) || !absolute(recipe.workingDirectory)
       || (recipe.tmpDir != null && !absolute(recipe.tmpDir))
       || !validCyberAccessProgram(recipe.cyberAccessProgram)
@@ -67,7 +69,7 @@ function validateSource(recipe) {
 }
 
 function validateTarget(recipe) {
-  if (!isRecord(recipe) || recipe.harness !== 'codex-cli' || !isQualifiedCodexVersion(recipe.harnessVersion)
+  if (!isRecord(recipe) || recipe.harness !== 'codex-cli' || !nonempty(recipe.harnessVersion)
       || !nonempty(recipe.providerId) || !nonempty(recipe.providerName) || !nonempty(recipe.modelId)
       || !Number.isSafeInteger(recipe.proxyPort) || recipe.proxyPort < 1 || recipe.proxyPort > 65535
       || !validAlias(recipe.alias) || !validEnvKey(recipe.authEnvKey)

package/template/coding-task-manager/lib/native-lead-settings-client.js

@@ -219,17 +219,34 @@ async function _ensureGeneratedDirAsync(dirPath, dataDir) {
 // Exclusive creation, so a ref collision is a refusal rather than an adoption of someone else's
 // container. The captured identity is what the later guarded cleanup and the worker's descriptor
 // check both use.
-async function _reserveEmptyDirAsync(dirPath) {
+//
+// S-30: the reserving parent then holds a read-only directory FileHandle (stored in `sink[key]`) for
+// as long as the identity is relied on. dev+ino alone is unsound on ext4 (a removed directory's inode
+// number is reused by the next mkdir), but an inode with an open fd cannot be freed.
+async function _reserveEmptyDirAsync(dirPath, sink, key) {
   try {
     await fs.promises.mkdir(dirPath, { mode: 0o700 });
   } catch {
     // EEXIST (or anything else): never adopt, never delete, never retry with a different name.
     _fail(NATIVE_LEAD_SETTINGS_CLIENT_CODES.RESERVE_FAILED);
   }
+  let handle = null;
+  try {
+    handle = await fs.promises.open(
+      dirPath,
+      fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | (fs.constants.O_NOFOLLOW || 0),
+    );
+  } catch {
+    _fail(NATIVE_LEAD_SETTINGS_CLIENT_CODES.RESERVE_FAILED);
+  }
+  sink[key] = handle; // owned by the reservation from here, so every unwind path closes it
   const detailed = await _lstatDetailed(dirPath);
+  const opened = await handle.stat();
   if (detailed.status !== 'ok'
       || detailed.stat.isSymbolicLink()
       || !detailed.stat.isDirectory()
+      || Number(opened.dev) !== Number(detailed.stat.dev)
+      || Number(opened.ino) !== Number(detailed.stat.ino)
       || (typeof process.getuid === 'function' && Number(detailed.stat.uid) !== process.getuid())
       || (Number(detailed.stat.mode) & 0o077) !== 0) {
     _fail(NATIVE_LEAD_SETTINGS_CLIENT_CODES.RESERVE_FAILED);
@@ -746,6 +763,7 @@ function createNativeLeadSettingsClient(options = {}) {
   const tracked = new Set(); // every in-flight preparation, from its reservation onward
   const adoptions = new Set(); // every in-flight adoption, joined by close() too (D-31)
   const obligations = new Map(); // retained cleanup obligations, keyed for stable reporting
+  const reservations = new Set(); // every reservation holding directory handles, until closed
   const obligationKeys = new Map(); // reservation -> Set<key>, so a LATER verified cleanup clears them
   let obligationSequence = 0;
   let closed = false;
@@ -794,12 +812,14 @@ function createNativeLeadSettingsClient(options = {}) {
       attemptDir,
       authorityCandidateDir,
       descriptor: { attempt: null, authorityCandidate: null },
+      handles: { attempt: null, authorityCandidate: null }, // parent-side only, never serialized
     };
+    reservations.add(reservation);
     try {
       await _ensureGeneratedDirAsync(path.dirname(attemptDir), dataDir);
       await _ensureGeneratedDirAsync(nativeLeadTlsDir({ dataDir }), dataDir);
-      reservation.descriptor.attempt = await _reserveEmptyDirAsync(attemptDir);
-      reservation.descriptor.authorityCandidate = await _reserveEmptyDirAsync(authorityCandidateDir);
+      reservation.descriptor.attempt = await _reserveEmptyDirAsync(attemptDir, reservation.handles, 'attempt');
+      reservation.descriptor.authorityCandidate = await _reserveEmptyDirAsync(authorityCandidateDir, reservation.handles, 'authorityCandidate');
       // The <= 4 KiB owner/ref stamp is written BEFORE dispatch, so a lost reply or a partial worker
       // write still leaves a directory whose identity this client can clean by exact match.
       const stamp = `${JSON.stringify({ version: 1, owner: { ...owner }, settingsRef, fingerprint: null })}\n`;
@@ -833,6 +853,17 @@ function createNativeLeadSettingsClient(options = {}) {
     }
   }
 
+  // Idempotent: each handle is detached before it is closed, so it is closed exactly once.
+  async function _closeReservationHandles(reservation) {
+    const handles = reservation && reservation.handles;
+    if (!handles) return;
+    for (const name of Object.keys(handles)) {
+      const handle = handles[name];
+      handles[name] = null;
+      if (handle) await handle.close().catch(() => { /* expected: a directory fd close cannot lose data; the handle is detached either way */ });
+    }
+  }
+
   // The guarded cleanup of one reservation. The authority CANDIDATE directory is normally already
   // gone (the worker removes its own link on success), so an absent candidate is not an obligation.
   async function _cleanupReservation(reservation) {
@@ -843,7 +874,12 @@ function createNativeLeadSettingsClient(options = {}) {
     const candidate = descriptor.authorityCandidate
       ? await _removeReservedDirGuarded(descriptor.authorityCandidate, NATIVE_LEAD_CANDIDATE_REMOVABLE)
       : { removed: true, alreadyGone: true };
-    if (attempt.removed && candidate.removed) return { cleaned: true };
+    if (attempt.removed && candidate.removed) {
+      // Closed only AFTER the verified removal: the open fd is what kept the guarded check honest.
+      await _closeReservationHandles(reservation);
+      reservations.delete(reservation);
+      return { cleaned: true };
+    }
     return {
       cleaned: false,
       code: NATIVE_LEAD_SETTINGS_CLIENT_CODES.CLEANUP_DEFERRED,
@@ -1456,6 +1492,10 @@ function createNativeLeadSettingsClient(options = {}) {
       // below — a single pass is therefore complete, and a committed host is never touched.
       const uncommitted = Array.from(leases).filter((lease) => lease.kind === 'native-lead-settings' && !lease.isCommitted());
       await Promise.all(uncommitted.map((lease) => lease.release().catch(() => undefined)));
+      // Handles of reservations with no outstanding obligation are closed; retained obligations keep theirs.
+      for (const reservation of reservations) {
+        if (!obligationKeys.has(reservation)) await _closeReservationHandles(reservation);
+      }
       return { ok: obligations.size === 0, obligations: Array.from(obligations.values()) };
     })();
     return closePromise;