devflow-kit 3.1.0 → 3.3.0

package/CHANGELOG.md

@@ -5,6 +5,56 @@ All notable changes to Devflow will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.3.0] - 2026-10-09
+
+### Changed
+
+- **Agents ship chosen tiers, efforts and tool sets** ([#422](https://github.com/dean0x/devflow/issues/422)). Fifteen agents now carry a deliberate model, effort, tool policy and `omitClaudeMd` setting, held by a guard to one table. Skim moves from `sonnet` to `haiku`, the only model change. Every agent except Learning, Git and Tracker now ships an effort and no longer follows your session's effort: `high` for Code, Design, Review and Triage, `medium` for the rest. `devflow agents --set <agent> --effort inherit` restores the old behaviour for one agent. Review ships `opus` at `high` effort: an A/B run of the `/code-review` focus agents over two seeded PRs found every seeded bug at `high` that it found at `xhigh`, for about 43% lower cost. Learning keeps its model, its absent effort and its CLAUDE.md context: the cheaper candidates fell short of the capture bar, and without that context it stops retiring entries as Encoded. Code, Research, Scrutinize and Simplify deny one shared list of orchestration and host-UI tools (Scrutinize and Simplify add `Skill`) and keep their MCP and web access; every other agent holds an allowlist. Synthesize and Skim omit CLAUDE.md. Preloads leave where the body never reads them: `testing` from Validate and Test, `software-design` from Evaluate, the five pattern skills from Diagnose, which now loads its focus's skills on demand, and `apply-decisions` from Learning. `devflow learning --configure` marks as recommended the model the Learning agent ships, read from its frontmatter, so a change of the shipped tier moves the recommendation with it.
+- **The gates run in a new order, and a script waits on CI** ([#421](https://github.com/dean0x/devflow/issues/421)). `/implement` now runs Simplify, Scrutinize, Evaluate, then one Validate over the final HEAD, then Test, then pushes and gates CI; a changed-only Validate follows only when a QA fix committed. The alignment and QA loops no longer spawn a Validate of their own, and `/self-review` validates whenever HEAD moved, so a Simplify-only commit is no longer skipped. `ci-wait.cjs` is a head-bound foreground CI wait that replaces re-spawning the Git agent once a minute: it binds the verdict to the pushed head, waits inside node and prints one line. One wait is capped at 570 seconds, and each CI gate allows at most 3 waits and 2 fixes, spawning Code only on a failing verdict. Scrutinize reports one status vocabulary, PASS, FIXED or BLOCKED (READY is gone), and each gate duty has one owner: Naming and Consistency belong to Simplify. In the dynamic-build engine both Gate 1 passes end with Validate. The Git agent now merges locally and validates nothing; the workflow runs a post-merge Validate after every merge, counts the merge as kept only on PASS, and undoes a red merge with `reset --keep`; a refused undo halts the wave and names the red HEAD, and a first Gate 1 that ends ESCALATED or BLOCKED returns early. `/resolve` waits on CI through the same script.
+- **Skills cost less** ([#423](https://github.com/dean0x/devflow/issues/423)). Code preloads six skills (`git`, `testing`, `test-driven-development`, `worktree-support`, `apply-feature-knowledge` and `apply-decisions`) where it preloaded ten: 25,578 bytes of skill text, down from 53,450. `software-design`, `patterns`, `boundary-validation` and `dependency-research` load on demand from a table with one row per operating mode. Every Code spawn now opens its prompt with `OPERATION: <mode>`, including two new modes, `ci-fix` (fix the failing CI checks the gate names) and `edit` (a mechanical change that adds no behaviour), and the orchestrator charter's direct Code delegations do the same. `apply-decisions` reads an entry by finding its heading with `command grep -nF` and then Reading only that section by offset, instead of opening the whole file. `worktree-support` keeps its discovery algorithm in a reference that `/code-review` and `/resolve` read when they need it, rather than in every agent's preload. Skill descriptions are capped by who reads them, at 90 characters for the agent-internal skills and 200 for the user-trigger ones, and 38 shrank. The Git agent's loaded sets are 1,704 characters smaller.
+- **The memory worker reads `agents.memory` and runs lean** ([#424](https://github.com/dean0x/devflow/issues/424)). `background-memory-update` takes its model and effort from `agents.memory` (`devflow agents --set memory ...`), checking each field on its own and falling back to the shipped default for one it cannot use. A bounded `claude --version` probe picks the argv. On Claude Code 2.1.286 or later the worker runs with `--safe-mode`, `--tools Write`, an empty strict MCP config, `--max-turns 3` and an explicit `--effort`, with any inherited `CLAUDE_CODE_EFFORT_LEVEL` cleared so the effort it names is the one that applies; below that, or when the probe fails, it runs a legacy argv that still limits the worker to Write and keeps CLAUDE.md and auto-memory out, but passes no effort, safe mode, MCP isolation or turn cap. A staged file that cannot be removed stops the run before any model call, which is what makes a Write-only tool set safe.
+
+### Fixed
+
+- **Only closing keywords ship an issue in a release.** `Closes`, `Fixes` and `Resolves` ship an issue; a `Refs #N` commit mentions one without closing it, yet it reached the release's Shipped Issues, its back-links and its milestone. It no longer does. The release trace map still counts `Refs` as traced, because that map asks only whether a commit names an issue at all.
+
+---
+
+## [3.2.0] - 2026-10-08
+
+### Added
+
+- **`devflow flags` gains `bash-max-timeout-ms`** ([#418](https://github.com/dean0x/devflow/issues/418)). It sets `BASH_MAX_TIMEOUT_MS`, the ceiling on a foreground Bash command's `timeout` (600000 ms upstream), to a whole number from 600000 to 7200000, and it is unset by default. A run that cannot be split under the ceiling is reported BLOCKED with `devflow flags --set bash-max-timeout-ms=<ms>` as the remedy. The registry now holds 30 flags.
+
+### Changed
+
+- **`devflow agents` carries a shipped effort, takes an `inherit` effort, and sets the memory worker** ([#420](https://github.com/dean0x/devflow/issues/420)). Nothing changes at shipped defaults: no agent ships an `effort:` line yet and every installed `model:` is as before. This is the plumbing the agent-tier tickets build on.
+  - **A shipped effort survives a reapply.** A shipped agent default is now its `model:` and its `effort:` when it has one, read from the same file. A reapply used to remove an `effort:` line from every agent whose mapping had no effort, including one that ships it.
+  - **`--effort inherit` drops an agent's effort line** so it follows the session; `--effort default` removes your override and restores the shipped effort. The EFFORT column reads `default (<shipped effort>)` when an agent ships one.
+  - **`memory` is settable in `devflow agents`** (`--set memory --model sonnet --effort medium`), listed after the agents with state `worker`. It takes Claude models and effort levels only, is not an agent, and is left out of the agent counts.
+  - **A `devflow agents` Learning mapping now decides the Learning model.** The session-start directive used to pass `model="opus"` (or the `learning.json` model) on every spawn, which overrode any mapping. It now takes the first of: a valid project `learning.json` model, the mapping (which sends no model, so the installed frontmatter decides), a valid global `learning.json` model, none. An invalid `learning.json` value falls through instead of becoming `opus`. `devflow learning --configure` says that a mapping outranks the global file.
+  - **A user's `validate` override now reaches the five Validate spawns** in `/implement` and `/resolve`, which passed `model="haiku"`. A new guard fails on any spawn in the prompt sources that names a model.
+- **Commands carry less context** ([#419](https://github.com/dean0x/devflow/issues/419)). Claude Code copies a command's arguments into the prompt at every placeholder, so each command now binds them once, in a `<command-input>` block, and names the bound text `COMMAND_INPUT` afterwards: the compiled commands went from 21 placeholders to 8, and a guard holds the count. A plan handoff now invokes `devflow:implement` with no arguments, because the plan is already in the conversation; with no input, `/implement` names the branch from the plan's title. The orchestrator charter gains a bounded-inline exception (one `git`, `gh` or script command whose output stays under about 40 lines, never a diff, log or test run) and a delegation report cap of about 1,500 tokens. `/implement`, `/code-review`, `/debug` and `/plan` stop loading companion skills their main thread never uses, and the plan and code-review plugins stop requiring the skills only those lines needed. The built-in Explore and Plan spawns in `/explore`, `/debug` and `/plan` ask for a report of at most about 1,500 tokens.
+- **Agents run builds and tests in the foreground, and the full test suite has one owner** ([#418](https://github.com/dean0x/devflow/issues/418)). The Code, Validate and Test agents ran any build that might exceed two minutes in the background and polled it with Monitor, and the dynamic-build engine and prompts repeated the procedure. A silent 250-second foreground run survives inside a Workflow sub-agent, and the platform's stall watchdog fires on model silence after a tool returns, never while a command runs, so polling only added turns. The three bodies now share one `## Running commands` block: an explicit Bash timeout, capture-then-tail in one call, no backgrounding or polling, a scoped command, and BLOCKED with duration and log path on an overrun. A parity guard holds the copies identical, and the engine and the nine dynamic-build prompt sites name the block. Each of the six gate agents carries one `**Gate ownership:**` row: Validate runs the full suite once per HEAD and no other agent does, Code runs targeted tests plus one affected-tests run, and the TDD skill defines "affected tests". `docs/reference/platform-assumptions.md` records what was measured, with the stall investigation.
+- **Every roster agent caps its final message at about 1,500 tokens** ([#418](https://github.com/dean0x/devflow/issues/418)). The 14 roster agents end their Output section with a `Report cap:` line. Longer material goes to a file whose path the message gives, and the fields a command or test parses, or an orchestrator hands to another agent, stay inline in full: Validate's `HEAD:` line and command table, Test's plan evidence and scenario table, Triage's whole ledger and the rest. Validate cuts failure output to 30 lines per failing command and then names the log. The Git agent keeps its output unchanged until its split.
+- **The memory worker runs on Sonnet 5.5 at high effort.** `background-memory-update` now spawns `claude -p --model claude-sonnet-5-5` (it was `claude-sonnet-4-6`), and the `memory` row in `devflow agents` ships `claude-sonnet-5-5` at `high` effort (it was `haiku`), so the shipped default and the model the worker runs are the same value; a test holds the two equal. Memory quality was judged worth more than the saving from Haiku. The worker does not read an `agents.memory` override or pass `--effort` yet. `devflow agents --list` widens its DEFAULT column to the longest shipped default, so a full model identifier is no longer cut.
+
+### Fixed
+
+- **`devflow init` no longer reports removing skills that were never installed** ([#432](https://github.com/dean0x/devflow/issues/432)). The "Removed N skill(s) no selected plugin requires" line now names only skills that were present and actually removed, and is omitted when none were.
+- **`devflow agents` no longer cuts a full model identifier it displays.** `--list` cut the CONFIGURED column at 16 characters, so a mapped `claude-sonnet-4-6` read as `claude-sonnet-4-`; the column now grows to the longest configured value, as DEFAULT does. In the interactive editor, the focused `‹ default (claude-sonnet-5-5) ›` cell on the `memory` row overflowed its column and lost its closing arrow and the unsaved mark; the cell now narrows its own arrows to fit and keeps both.
+- **The Knowledge agent is no longer told to load a skill it already has** ([#419](https://github.com/dean0x/devflow/issues/419)). It preloads `devflow:feature-knowledge` and has no Skill tool, yet the write-back step and `/research` still told it to load that skill.
+- **A re-init reports what it actually did** ([#415](https://github.com/dean0x/devflow/issues/415)). Running `devflow init` again printed `.claudeignore: created` even when nothing changed, and a run without a terminal told you to "Run interactively to auto-install" safe-delete even when it was already set up. The `.claudeignore` row now reads `created`, `already present` or `skipped`, and the safe-delete line reads installed, upgraded or already configured. The hint is gone: a run without a terminal takes the Recommended path, which installs or upgrades the safe-delete block itself.
+- **The Skim agent finds the decisions ledger from a linked worktree** ([#415](https://github.com/dean0x/devflow/issues/415)). It looked for the ledger in the directory it ran in, so in a linked worktree it reported no decisions. It now reads the main worktree's ledger, as the other agents do.
+- **Without `jq`, the hooks' JSON helpers stay silent on stderr, as they already were with it** ([#415](https://github.com/dean0x/devflow/issues/415)). On a machine without `jq`, a hook that read a missing or unparseable file printed a `json-helper error` line, or the shell's own error for a file it could not open, where the `jq` path prints nothing. The `node` fallbacks now discard that output too, and return exactly what they did before.
+- **The captured-turns files stay owner-only after a trim** ([#415](https://github.com/dean0x/devflow/issues/415)). Once a memory or learning queue, or a memory batch a failed refresh left behind, passed 200 turns, the trim to the newest 100 replaced it with a copy made under the hook's umask, so the file came back readable by every user (`0644`) while it holds conversation text. The copy is now made `0600`, the mode the queue is created with.
+- **A corrupt working-memory backup no longer stops the session-start memory hook** ([#415](https://github.com/dean0x/devflow/issues/415)). A truncated or unparseable `.devflow/memory/backup.json` ended the hook before it injected the working memory it had already built. Such a backup is now read as no snapshot, like a missing one.
+- **The working-memory backup is written atomically** ([#415](https://github.com/dean0x/devflow/issues/415)). The pre-compact hook wrote `backup.json` by truncating it and writing it again, so a session start reading it in between could meet a partial file. It now writes a complete copy beside it and renames the copy into place, owner-only (`0600`); a write that fails leaves the previous backup as it was. The copy is created only where nothing already stands, so it never writes through a symbolic link, and each backup first removes any copy a killed run left behind that is over an hour old.
+- **The hooks no longer write, or read into the session, through a symbolic link inside a project's `.devflow` folder** ([#415](https://github.com/dean0x/devflow/issues/415)). The capture and memory hooks skip, and log, any write whose file, or a folder on the way to it, is a link, so a repository cannot point captured conversation text or working memory at a file outside it. They also never read a linked file there into the session or a backup: a linked working memory, backup or decisions file is treated as missing. The learning store no longer reads a linked file either: a linked log, ledger, archive or history file is treated as missing, so nothing of it is listed, shown, backed up or copied into the project. The statusline's learning counts skip a ledger that is a link or larger than 8 MiB, as they skip a missing one. The hooks write nothing under a `.devflow` that is itself a link, and every learning operation that writes, `devflow learning --reset` included, refuses a linked `.devflow` or `.devflow/learning` folder, changing nothing. `devflow init`, the `.gitignore` hook, `devflow learning --configure` and turning learning or memory off hold to the same rule: none of them writes or deletes through a link that leads outside the project, and each says so when it skips one. The session-start hook, the only one that reaches the `.gitignore` step when memory and learning are both off, now writes those skips to its log; it used to record them only in debug mode. `devflow uninstall` holds to the rule too when it removes a legacy project-local install: it deletes and rewrites nothing through a link in the project's `.devflow` or `.claude`, removes the rest, and names each link it skipped. A root `.gitignore` linked to a file inside the project is still updated when no part of that file's path there is named `.git`, in any letter case, so a link into the project's own `.git` folder or a nested repository's is refused.
+- **The release notes name their issue section `Shipped Issues` on every provider** ([#415](https://github.com/dean0x/devflow/issues/415)). The GitHub, Jira and Linear release mechanics told the release agent to append `## Closed Issues`, while the shipped-issues input, the back-link step and every published release say Shipped Issues. All three now name the section `## Shipped Issues`.
+
+---
+
 ## [3.1.0] - 2026-10-06
 
 ### Changed
@@ -1482,6 +1532,8 @@ devflow init
 ---
 
 [Unreleased]: https://github.com/dean0x/devflow/compare/v2.0.0...HEAD
+[3.3.0]: https://github.com/dean0x/devflow/compare/v3.2.0...v3.3.0
+[3.2.0]: https://github.com/dean0x/devflow/compare/v3.1.0...v3.2.0
 [3.1.0]: https://github.com/dean0x/devflow/compare/v3.0.1...v3.1.0
 [3.0.1]: https://github.com/dean0x/devflow/compare/v3.0.0...v3.0.1
 [3.0.0]: https://github.com/dean0x/devflow/compare/v2.5.0...v3.0.0

package/README.md

@@ -30,9 +30,9 @@ you: /implement (hand it the plan)
 
   Git                    branch feat/42-rate-limit-upload
   Code                   implements the plan — your learned decisions, pitfalls, and feature knowledge preloaded
-  Validate               build ✓ typecheck ✓ lint ✓ tests ✓
   Simplify · Scrutinize  cleanup pass, then 9-pillar quality gate
   Evaluate               implementation matches the original request ✓
+  Validate               build ✓ typecheck ✓ lint ✓ tests ✓
   Test                   5/5 QA scenarios pass → PR opened
 
 you: /code-review
@@ -51,7 +51,7 @@ This is the **orchestrated flow** — you stay in the loop between every step. W
 
 ## What you get
 
-**Ambient orchestration.** Your main session becomes the tech lead: a charter injected at session start turns it into a pure orchestrator that delegates work to specialized agents and keeps only judgment mainline. Plan-mode handoffs auto-run `/implement`. Init and forget.
+**Ambient orchestration.** Your main session becomes the tech lead: a charter injected at session start turns it into an orchestrator that delegates work to specialized agents and keeps judgment mainline, with one bounded inline exception for a single short git, gh or script command. Plan-mode handoffs auto-run `/implement`. Init and forget.
 
 **A staffed agent roster.** 17 specialized agents with explicit model assignments — Opus for analysis, Sonnet for execution, Haiku for I/O. Reassign any agent's model with `devflow agents`, including GPT models through external model routing (`devflow proxy`).
 

package/dist/cli/agents-view/render.js

@@ -15,17 +15,29 @@
  *  -1  Unsaved count "  N unsaved changes" (blank if 0)
  *   0  Keybinding footer
  *
- * Columns (chars) — total 79 ≤ 80:
+ * Columns (chars) — total 80 ≤ 80:
  *   PREFIX  :  2  (cursor mark "❯ " or "  ")
- *   AGENT   : 18
- *   MODEL   : 32
- *   EFFORT  : 13
+ *   AGENT   : 12
+ *   MODEL   : 30
+ *   EFFORT  : 22
  *   STATE   : 14
+ *
+ * EFFORT is 22 wide so the longest unconfigured cell, "default (medium)" (16),
+ * fits whole inside the cursor's "‹ … ›" wrapper with the dirty marker
+ * ("‹ default (medium) ● ›", 22) — the shipped effort (D-SHIPPED-EFFORT) and the
+ * unsaved mark are never clipped on the cursor row. The agent names the registry
+ * holds are at most 10 characters ("Scrutinize"); longer orphan keys are
+ * truncated by truncateVisible.
+ *
+ * MODEL has no such slack for a worker row, whose shipped default is a full
+ * model identifier: the focused cell narrows its own wrapper to fit
+ * (D-FOCUSED-CELL-FITS, renderFocusedCell) rather than taking a column from
+ * the 80-column budget.
  */
-import { bold, dim, green, yellow, cyan, gray, stripAnsi, } from '../../core/ansi.js';
+import { bold, dim, green, yellow, cyan, gray, stripAnsi, truncate, } from '../../core/ansi.js';
 import { padToVisible, truncateVisible, sanitizeCell } from '../tui/cells.js';
 import { isDirtyModel, isDirtyEffort, unsavedCount, isOffCycle, rowState, } from './state.js';
-import { AGENT_STATE_LABELS } from '../../core/agent-state.js';
+import { AGENT_STATE_LABELS, formatEffortDisplay } from '../../core/agent-state.js';
 // ---------------------------------------------------------------------------
 // Layout constants
 // ---------------------------------------------------------------------------
@@ -39,9 +51,9 @@ const MIN_VIEWPORT = 1;
 export function computeViewportHeight(termRows) {
     return Math.max(MIN_VIEWPORT, termRows - FIXED_ROWS);
 }
-const COL_AGENT = 18;
-const COL_MODEL = 32;
-const COL_EFFORT = 13;
+const COL_AGENT = 12;
+const COL_MODEL = 30;
+const COL_EFFORT = 22;
 const COL_STATE = 14;
 // ---------------------------------------------------------------------------
 // Name formatter — TUI only
@@ -64,6 +76,41 @@ export function formatAgentName(name) {
         .map(seg => (seg.length === 0 ? seg : seg[0].toUpperCase() + seg.slice(1)))
         .join('-');
 }
+// ---------------------------------------------------------------------------
+// Cell renderers (pure, return styled string)
+// ---------------------------------------------------------------------------
+/**
+ * Wrap the focused field's value in the cursor arrows, with the unsaved mark
+ * after the value when the field is dirty.
+ *
+ * D-FOCUSED-CELL-FITS: the arrows and the unsaved mark are never clipped. A
+ * column is sized for the common value, but a worker row ships a full model
+ * identifier ("default (claude-sonnet-5-5)" is 27 characters), so the spaced
+ * wrapper "‹ default (claude-sonnet-5-5) ● ›" is 33 in a 30-wide MODEL cell and
+ * the closing arrow and the mark would fall off the end. The layout already
+ * spends all 80 columns and no other column has slack (EFFORT needs 22 for
+ * "‹ default (medium) ● ›", STATE needs 14 for "saved-inactive"), so the cell
+ * narrows itself instead. The widest form that fits wins:
+ *   spaced   "‹ value ● ›"
+ *   tight    "‹value●›"           — the padding spaces go, the value stays whole
+ *   clipped  "‹valu…●›"           — only a value wider than the column; the
+ *                                    value gives way, never the wrapper
+ *
+ * Pure function, no I/O.
+ */
+function renderFocusedCell(value, dirty, maxWidth) {
+    const valueWidth = stripAnsi(value).length;
+    const mark = dirty ? '●' : '';
+    const spacedWidth = valueWidth + 4 + (dirty ? 2 : 0);
+    if (spacedWidth <= maxWidth) {
+        return cyan(`‹ ${value}${dirty ? ` ${mark}` : ''} ›`);
+    }
+    const tightBudget = Math.max(1, maxWidth - 2 - mark.length);
+    if (valueWidth <= tightBudget) {
+        return cyan(`‹${value}${mark}›`);
+    }
+    return cyan(`‹${truncate(stripAnsi(value), tightBudget)}${mark}›`);
+}
 /**
  * Render the model cell for a given row, considering cursor/active/dirty state.
  *
@@ -95,7 +142,10 @@ function renderModelCell({ row, isCursor, isActive, maxWidth, modelCycle, }) {
             valueStr += ` ${dim(`${safeDormantModel} saved`)}`;
         }
     }
-    else if (isOffCycle(modelCycle, row.configuredModel)) {
+    else if (!row.worker && isOffCycle(modelCycle, row.configuredModel)) {
+        // A worker row is exempt: its model is never judged against the catalog, and
+        // a full claude- identifier, which no cycle lists, is in the worker domain
+        // (D-WORKER-AGENTS) — readAgentMapping has already dropped anything outside it.
         // Off-cycle pin: model was saved but is no longer in the discovered catalog.
         // The per-row effective cycle (state.ts cycleField) includes it for reachability,
         // but it renders as unavailable to signal the user should update it.
@@ -109,8 +159,7 @@ function renderModelCell({ row, isCursor, isActive, maxWidth, modelCycle, }) {
     let cell;
     if (isCursor && isActive) {
         // Active field on cursor row: wrap in ‹ ›, put ● after value if dirty
-        const inner = dirty ? `${valueStr} ●` : valueStr;
-        cell = cyan(`‹ ${inner} ›`);
+        cell = renderFocusedCell(valueStr, dirty, maxWidth);
     }
     else if (isCursor && dirty) {
         cell = `● ${valueStr}`;
@@ -122,14 +171,16 @@ function renderModelCell({ row, isCursor, isActive, maxWidth, modelCycle, }) {
 }
 /**
  * Render the effort cell for a given row, considering cursor/active/dirty state.
+ *
+ * D-SHIPPED-EFFORT: an unconfigured row shows `default (<shipped effort>)` when
+ * the shipped source carries an effort, through the formatter --list shares.
  */
 function renderEffortCell(row, isCursor, isActive, maxWidth) {
     const dirty = isDirtyEffort(row);
-    const value = row.configuredEffort;
+    const value = formatEffortDisplay(row.configuredEffort, row.shippedEffort);
     let cell;
     if (isCursor && isActive) {
-        const inner = dirty ? `${value} ●` : value;
-        cell = cyan(`‹ ${inner} ›`);
+        cell = renderFocusedCell(value, dirty, maxWidth);
     }
     else if (isCursor && dirty) {
         cell = `● ${value}`;
@@ -159,6 +210,9 @@ function renderStateCell(row, proxyEnabled, maxWidth) {
         case 'unknown':
             cell = dim(AGENT_STATE_LABELS['unknown']);
             break;
+        case 'worker':
+            cell = dim(AGENT_STATE_LABELS['worker']);
+            break;
         default: {
             const _ = state;
             void _;

package/dist/cli/agents-view/state.js

@@ -9,7 +9,9 @@
  *                          Picker names: all aliases for each model; canonical id iff
  *                          the model has no aliases (zero-maintenance, catalog-driven).
  * Model cycle (proxy OFF): default → haiku → sonnet → opus → fable → default
- * Effort cycle:            default → low → medium → high → xhigh → max → default
+ * Effort cycle:            default → low → medium → high → xhigh → max → inherit → default
+ * Worker rows (D-WORKER-AGENTS) cycle only what a worker accepts: the model
+ * cycle is default and the Claude aliases, the effort cycle has no inherit.
  *
  * Dormancy semantics (plan D5 / Phase 1):
  *   When proxy is off and a row's saved model is a GPT model, configuredModel
@@ -28,7 +30,7 @@
  * on the state — never reallocated per keypress. The reducer receives it as
  * state.modelCycle and threads it through without reconstructing.
  */
-import { EFFORT_LEVELS } from '../../core/agent-models.js';
+import { EFFORT_INHERIT, EFFORT_LEVELS, } from '../../core/agent-models.js';
 import { CLAUDE_MODEL_ALIASES, isDormantExternalModel, } from '../../core/external-models.js';
 import { classifyAgentState, } from '../../core/agent-state.js';
 // ---------------------------------------------------------------------------
@@ -125,14 +127,26 @@ export function buildModelCycle(catalog) {
         return base;
     return [...base, ...pickerNames(catalog.models)];
 }
-const EFFORT_CYCLE = ['default', ...EFFORT_LEVELS];
-function cycleNext(cycle, current) {
+/**
+ * The effort cycle of an agent row: default, the levels in order, then the
+ * `inherit` sentinel (D-SHIPPED-EFFORT). `inherit` sits after the levels so the
+ * forward order of the levels is unchanged.
+ */
+export const EFFORT_CYCLE = ['default', ...EFFORT_LEVELS, EFFORT_INHERIT];
+/**
+ * The cycles of a worker row (D-WORKER-AGENTS). A worker takes only Claude
+ * models and has no session effort to inherit, so neither the catalog's external
+ * models nor `inherit` is a stop. Built once at load, never per keypress.
+ */
+const WORKER_MODEL_CYCLE = ['default', ...CLAUDE_MODEL_ALIASES];
+const WORKER_EFFORT_CYCLE = ['default', ...EFFORT_LEVELS];
+export function cycleNext(cycle, current) {
     const idx = cycle.indexOf(current);
     if (idx === -1)
         return cycle[0];
     return cycle[(idx + 1) % cycle.length];
 }
-function cyclePrev(cycle, current) {
+export function cyclePrev(cycle, current) {
     const idx = cycle.indexOf(current);
     if (idx === -1)
         return cycle[cycle.length - 1];
@@ -213,9 +227,14 @@ export function unsavedCount(rows) {
  * model would keep showing 'saved-inactive' even though 'opus' is what gets
  * written. Mirroring the merge rule keeps display and persistence in lockstep.
  *
+ * A worker row (D-WORKER-AGENTS) has no installed file and cannot be dormant,
+ * so it bypasses classification and is always 'worker'.
+ *
  * Pure function, no I/O.
  */
 export function rowState(row, proxyEnabled) {
+    if (row.worker)
+        return 'worker';
     return classifyAgentState({
         configured: persistedModelFor(row),
         proxyEnabled,
@@ -245,11 +264,13 @@ function replaceRow(rows, cursor, newRow) {
  */
 function cycleField(row, field, dir, modelCycle) {
     if (field === 'model') {
+        // A worker row cycles its own Claude-only stops, not the catalog cycle.
+        const baseCycle = row.worker ? WORKER_MODEL_CYCLE : modelCycle;
         // Build effective cycle: splice off-cycle pin at the end if present.
         // This is the ≤ 1 array allocation case (AC-P6): only allocates when offCyclePin != null.
-        const effectiveCycle = row.offCyclePin !== null && isOffCycle(modelCycle, row.offCyclePin)
-            ? [...modelCycle, row.offCyclePin]
-            : modelCycle;
+        const effectiveCycle = row.offCyclePin !== null && isOffCycle(baseCycle, row.offCyclePin)
+            ? [...baseCycle, row.offCyclePin]
+            : baseCycle;
         // cycleNext/cyclePrev handle the case where configuredModel is not in effectiveCycle
         // by falling back to cycle[0] / cycle[last]. This is correct for the off-cycle case
         // where configuredModel IS in effectiveCycle (we splice it in above).
@@ -259,12 +280,14 @@ function cycleField(row, field, dir, modelCycle) {
         return { ...row, configuredModel: next };
     }
     else {
+        const effortCycle = row.worker ? WORKER_EFFORT_CYCLE : EFFORT_CYCLE;
         const next = dir === 'forward'
-            ? cycleNext(EFFORT_CYCLE, row.configuredEffort)
-            : cyclePrev(EFFORT_CYCLE, row.configuredEffort);
-        // Sound narrowing: EFFORT_CYCLE is ['default', ...EFFORT_LEVELS], so next
-        // is always EffortLevel | 'default'. cycleNext/cyclePrev return string
-        // because their signature is intentionally generic (also used for model cycles).
+            ? cycleNext(effortCycle, row.configuredEffort)
+            : cyclePrev(effortCycle, row.configuredEffort);
+        // Sound narrowing: both effort cycles are built from 'default', EFFORT_LEVELS
+        // and (agents only) the inherit sentinel, so next is always StoredEffort | 'default'.
+        // cycleNext/cyclePrev return string because their signature is intentionally
+        // generic (also used for model cycles).
         return { ...row, configuredEffort: next };
     }
 }
@@ -293,8 +316,9 @@ function adjustViewport(cursor, viewportOffset, viewportHeight, rowCount) {
  * the model remains reachable in the per-row effective cycle.
  */
 export function buildRow(input) {
+    const worker = input.worker === true;
     const dormant = isDormantExternalModel(input.savedModel, input.proxyEnabled);
-    const cycle = input.modelCycle ?? [];
+    const cycle = worker ? WORKER_MODEL_CYCLE : (input.modelCycle ?? []);
     // Normalize stored canonical id to picker name (Fix 1: in-memory only, never
     // written back to disk). E.g. 'gpt-5.6-sol' → 'sol' when pickerNameMap is known.
     // This keeps the value in-cycle so it does not become a spurious off-cycle pin.
@@ -316,6 +340,7 @@ export function buildRow(input) {
     return {
         name: input.name,
         shippedDefault: input.shippedDefault,
+        shippedEffort: input.shippedEffort,
         configuredModel,
         originalModel: configuredModel,
         configuredEffort,
@@ -324,6 +349,7 @@ export function buildRow(input) {
         offCyclePin,
         installed: input.installed,
         inRegistry: input.inRegistry,
+        worker,
     };
 }
 // ---------------------------------------------------------------------------