dual-brain 7.1.3 → 7.1.4

package/bin/dual-brain.mjs

@@ -82,8 +82,9 @@ Options:
 /**
  * Print a compact auth status table to stdout.
  * @param {{ claude: object, openai: object }} auth  Result from detectAuth()
+ * @param {object} [profile]  Optional loaded profile to cross-check enabled state
  */
-function printAuthTable(auth) {
+function printAuthTable(auth, profile) {
   const W = 55; // inner width (wide enough for source labels)
   const hbar = '═'.repeat(W);
   const pad = (s) => {
@@ -91,15 +92,21 @@ function printAuthTable(auth) {
     return s + ' '.repeat(Math.max(0, W - visible.length));
   };
 
+  const claudeDisabled = profile?.providers?.claude?.enabled === false;
+  const openaiDisabled = profile?.providers?.openai?.enabled === false;
+
+  const claudeDisabledNote = claudeDisabled ? ' (auth ok, but disabled in profile)' : '';
+  const openaiDisabledNote = openaiDisabled ? ' (auth ok, but disabled in profile)' : '';
+
   const claudeLine1 = auth.claude.found
-    ? `  Claude:  ✓ found via ${auth.claude.source}`
+    ? `  Claude:  ✓ found via ${auth.claude.source}${claudeDisabledNote}`
     : `  Claude:  ✗ not found`;
   const claudeLine2 = auth.claude.found
     ? `           ${auth.claude.masked}`
     : `           run: dual-brain auth setup`;
 
   const openaiLine1 = auth.openai.found
-    ? `  OpenAI:  ✓ found via ${auth.openai.source}`
+    ? `  OpenAI:  ✓ found via ${auth.openai.source}${openaiDisabledNote}`
     : `  OpenAI:  ✗ not found`;
   const openaiLine2 = auth.openai.found
     ? `           ${auth.openai.masked}`
@@ -122,7 +129,7 @@ async function cmdInit(rl) {
 
   // --- Step 1: Auth preflight ---
   const auth = await detectAuth();
-  printAuthTable(auth);
+  printAuthTable(auth, loadProfile(cwd));
 
   const noneFound = !auth.claude.found && !auth.openai.found;
   if (noneFound) {
@@ -166,7 +173,8 @@ async function cmdAuth(subArgs = [], rl) {
   }
 
   const auth = await detectAuth();
-  printAuthTable(auth);
+  const profile = loadProfile(process.cwd());
+  printAuthTable(auth, profile);
 
   // If anything is missing, point to setup command
   if (!auth.claude.found || !auth.openai.found) {
@@ -339,10 +347,20 @@ async function cmdStatus(args = []) {
   const totalTokens = Object.values(sessionStats).reduce((s, v) => s + v.tokens, 0);
   console.log(`\nSession: ${totalCalls} dispatch${totalCalls !== 1 ? 'es' : ''}, ${totalTokens} tokens observed`);
 
-  // Models
+  // Models — only list enabled providers
   console.log('\nAvailable models:');
-  if (available.claude.length) console.log(`  Claude : ${available.claude.join(', ')}`);
-  if (available.openai.length) console.log(`  OpenAI : ${available.openai.join(', ')}`);
+  const claudeEnabled = profile?.providers?.claude?.enabled !== false;
+  const openaiEnabled = profile?.providers?.openai?.enabled !== false;
+  if (claudeEnabled && available.claude.length) {
+    console.log(`  Claude : ${available.claude.join(', ')}`);
+  } else if (!claudeEnabled) {
+    console.log(`  Claude : (disabled — run "dual-brain init" to enable)`);
+  }
+  if (openaiEnabled && available.openai.length) {
+    console.log(`  OpenAI : ${available.openai.join(', ')}`);
+  } else if (!openaiEnabled) {
+    console.log(`  OpenAI : (disabled — run "dual-brain init" to enable)`);
+  }
 
   // Head model
   console.log(`\nHead model : ${getHeadModel(profile)}`);
@@ -680,8 +698,15 @@ async function dashboardScreen(rl, ask) {
   const env = detectEnvironment();
 
   // Build status lines for box
-  const claudeStatus = auth.claude.found ? `🟢 Claude ${badge('connected')}` : `🔴 Claude ${badge('missing')}`;
-  const openaiStatus = auth.openai.found ? `🟢 OpenAI ${badge('connected')}` : `🔴 OpenAI ${badge('missing')}`;
+  // If auth is found but provider is disabled in profile, show warning instead of green
+  const claudeProviderEnabled = profile?.providers?.claude?.enabled !== false;
+  const openaiProviderEnabled = profile?.providers?.openai?.enabled !== false;
+  const claudeStatus = auth.claude.found
+    ? (claudeProviderEnabled ? `🟢 Claude ${badge('connected')}` : `⚠️  Claude ${badge('warning')} disabled`)
+    : `🔴 Claude ${badge('missing')}`;
+  const openaiStatus = auth.openai.found
+    ? (openaiProviderEnabled ? `🟢 OpenAI ${badge('connected')}` : `⚠️  OpenAI ${badge('warning')} disabled`)
+    : `🔴 OpenAI ${badge('missing')}`;
   const envLabel = env.hasReplitTools ? 'Replit + replit-tools' : env.isReplit ? 'Replit' : 'local';
 
   // Enforcement check

package/mcp-server/index.mjs

@@ -283,7 +283,7 @@ async function handleRequest(msg) {
   } catch (err) {
     const code = err.code ?? -32000;
     const message = err.message ?? 'Internal error';
-    return errorResponse(id, code, message, err.stack);
+    return errorResponse(id, code, message);
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dual-brain",
-  "version": "7.1.3",
+  "version": "7.1.4",
   "description": "AI orchestration across Claude + OpenAI subscriptions — smart routing, budget awareness, and dual-brain collaboration",
   "type": "module",
   "bin": {
@@ -46,10 +46,50 @@
     "node": ">=20.0.0"
   },
   "files": [
-    "src/*.mjs",
+    "src/profile.mjs",
+    "src/detect.mjs",
+    "src/decide.mjs",
+    "src/dispatch.mjs",
+    "src/playbook.mjs",
+    "src/health.mjs",
+    "src/repo.mjs",
+    "src/session.mjs",
+    "src/decompose.mjs",
+    "src/brief.mjs",
+    "src/redact.mjs",
+    "src/index.mjs",
+    "src/tui.mjs",
+    "src/install-hooks.mjs",
+    "src/update-check.mjs",
     "bin/*.mjs",
-    "hooks/*.mjs",
-    "hooks/*.sh",
+    "hooks/enforce-tier.mjs",
+    "hooks/cost-logger.mjs",
+    "hooks/cost-report.mjs",
+    "hooks/dual-brain-review.mjs",
+    "hooks/dual-brain-think.mjs",
+    "hooks/quality-gate.mjs",
+    "hooks/test-orchestrator.mjs",
+    "hooks/setup-wizard.mjs",
+    "hooks/health-check.mjs",
+    "hooks/install-git-hooks.mjs",
+    "hooks/session-report.mjs",
+    "hooks/budget-balancer.mjs",
+    "hooks/gpt-work-dispatcher.mjs",
+    "hooks/profiles.mjs",
+    "hooks/summary-checkpoint.mjs",
+    "hooks/decision-ledger.mjs",
+    "hooks/control-panel.mjs",
+    "hooks/risk-classifier.mjs",
+    "hooks/failure-detector.mjs",
+    "hooks/vibe-router.mjs",
+    "hooks/plan-generator.mjs",
+    "hooks/vibe-memory.mjs",
+    "hooks/wave-orchestrator.mjs",
+    "hooks/task-classifier.mjs",
+    "hooks/model-registry.mjs",
+    "hooks/auto-update-wrapper.mjs",
+    "hooks/head-guard.mjs",
+    "hooks/auto-update.sh",
     "mcp-server/*.mjs",
     "mcp-server/README.md",
     "install.mjs",

package/src/decide.mjs

@@ -449,6 +449,35 @@ export function parsePreferences(preferences) {
   return signals;
 }
 
+// ─── Internal: safety floor for critical-risk tasks ───────────────────────────
+
+/**
+ * Ensure critical-risk tasks are never handled by the cheapest (haiku/gpt-4.1-mini) model.
+ * Cost-saver mode is the main culprit; escalate silently but emit a stderr warning.
+ * @param {string} model
+ * @param {string} provider
+ * @param {string[]} available
+ * @param {'low'|'medium'|'high'|'critical'} risk
+ * @returns {string}
+ */
+function applyCriticalRiskFloor(model, provider, available, risk) {
+  if (risk !== 'critical') return model;
+
+  const cheapModels = { claude: 'haiku', openai: 'gpt-4.1-mini' };
+  const floorModels = { claude: 'sonnet', openai: 'gpt-4.1' };
+
+  if (model === cheapModels[provider]) {
+    const floor = floorModels[provider];
+    const escalated = available.includes(floor) ? floor : available[available.length - 1] ?? model;
+    process.stderr.write(
+      `[dual-brain] Warning: cost-saver selected ${model} for a critical-risk task. ` +
+      `Escalating to ${escalated} (safety floor).\n`
+    );
+    return escalated;
+  }
+  return model;
+}
+
 // ─── Exported: decideRoute ────────────────────────────────────────────────────
 
 /**
@@ -508,6 +537,9 @@ export function decideRoute({ profile = {}, detection = {}, cwd } = {}) {
   // Apply profile mode bias (cost-saver / quality-first / preferences) using patched profile
   model = applyProfileBias(model, profileWithEffectiveBias, provider, available[provider]);
 
+  // Safety floor: critical-risk tasks must never use haiku/gpt-4.1-mini even in cost-saver mode
+  model = applyCriticalRiskFloor(model, provider, available[provider], detection.risk);
+
   // Apply preferModel signal from preferences (override after all other picks)
   if (prefSignals.preferModel) {
     const wantedModel = prefSignals.preferModel;

package/src/index.mjs

@@ -8,7 +8,7 @@
 
 export { loadProfile, saveProfile, ensureProfile, runOnboarding, rememberPreference, forgetPreference, getActivePreferences, getAvailableProviders, isSoloBrain, getHeadModel, detectAuth, detectEnvironment, setupAuth, getActiveKey, removeAuthKey, disableKey, rotateToNextKey } from './profile.mjs';
 export { detectTask, classifyIntent, classifyRisk, estimateComplexity, inferTier, extractPaths } from './detect.mjs';
-export { decideRoute, getModelCapabilities, getAvailableModels, estimateBudgetPressure, shouldDualBrain, explainDecision } from './decide.mjs';
+export { decideRoute, getModelCapabilities, getAvailableModels, shouldDualBrain, explainDecision } from './decide.mjs';
 export { dispatch, buildCommand, detectRuntime, compressResult, dispatchDualBrain } from './dispatch.mjs';
 export { loadPlaybook, listPlaybooks, executePlaybook, createRunArtifact } from './playbook.mjs';
 export { getHealth, markHot, markDegraded, markHealthy, checkCooldown, getProviderScore, recordDispatch, getSessionStats, resetHealth, remainingCooldownMinutes } from './health.mjs';

package/src/profile.mjs

@@ -23,7 +23,7 @@
  */
 
 import { createInterface } from 'readline';
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
 import { homedir } from 'os';
 import { dirname, join } from 'path';
 
@@ -348,7 +348,7 @@ function saveAuthKey(provider, key, opts = {}) {
   const cwd = opts.cwd || process.cwd();
   const authFile = AUTH_FILE(cwd);
   const dir = dirname(authFile);
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
 
   const auth = loadAuthKeys(cwd);
   if (!Array.isArray(auth[provider])) auth[provider] = [];
@@ -370,6 +370,7 @@ function saveAuthKey(provider, key, opts = {}) {
   });
 
   writeFileSync(authFile, JSON.stringify(auth, null, 2));
+  chmodSync(authFile, 0o600);
 
   // Inject highest-priority valid key into process.env for this session
   const active = getActiveKey(provider, cwd);
@@ -388,13 +389,14 @@ function saveAuthKey(provider, key, opts = {}) {
 function removeAuthKey(provider, index, cwd) {
   const authFile = AUTH_FILE(cwd);
   const dir = dirname(authFile);
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
 
   const auth = loadAuthKeys(cwd);
   if (!Array.isArray(auth[provider])) return;
 
   auth[provider].splice(index, 1);
   writeFileSync(authFile, JSON.stringify(auth, null, 2));
+  chmodSync(authFile, 0o600);
 }
 
 /**
@@ -406,13 +408,14 @@ function removeAuthKey(provider, index, cwd) {
 function disableKey(provider, index, cwd) {
   const authFile = AUTH_FILE(cwd);
   const dir = dirname(authFile);
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
 
   const auth = loadAuthKeys(cwd);
   if (!Array.isArray(auth[provider]) || !auth[provider][index]) return;
 
   auth[provider][index].enabled = false;
   writeFileSync(authFile, JSON.stringify(auth, null, 2));
+  chmodSync(authFile, 0o600);
 }
 
 /**

package/src/session.mjs

@@ -122,9 +122,10 @@ export function clearSession(cwd = process.cwd()) {
  * @param {object|null} session — from loadSession()
  * @param {object}      repo    — from detectRepo() / loadRepoCache()
  * @param {object}      health  — from getHealth()  (shape: { states: {}, session: {} })
+ * @param {object}      [profile] — optional profile for enabled-state checks
  * @returns {string}
  */
-export function formatSessionCard(session, repo, health) {
+export function formatSessionCard(session, repo, health, profile) {
   const lines = [];
 
   // Line 1: Repo identity
@@ -157,8 +158,11 @@ export function formatSessionCard(session, repo, health) {
     lines.push(`Branch: ${repo.branch}${dirtyNote}`);
   }
 
-  // Line 4: Health summary
+  // Line 4: Health summary — only show enabled providers
   const { states = {} } = health || {};
+  const claudeProviderEnabled = profile?.providers?.claude?.enabled !== false;
+  const openaiProviderEnabled = profile?.providers?.openai?.enabled !== false;
+
   function providerStatus(name) {
     const entries = Object.entries(states).filter(([k]) => k.startsWith(`${name}:`));
     if (entries.length === 0) return 'healthy';
@@ -168,11 +172,21 @@ export function formatSessionCard(session, repo, health) {
     if (statuses.includes('probing'))  return 'probing';
     return 'healthy';
   }
-  const claudeStatus = providerStatus('claude');
-  const openaiStatus = providerStatus('openai');
-  const claudeLabel = claudeStatus === 'healthy' ? 'Claude healthy' : `Claude ${claudeStatus}`;
-  const openaiLabel = openaiStatus === 'healthy' ? 'OpenAI healthy' : `OpenAI ${openaiStatus}`;
-  lines.push(`Health: ${claudeLabel}, ${openaiLabel}`);
+
+  const healthParts = [];
+  if (claudeProviderEnabled) {
+    const claudeStatus = providerStatus('claude');
+    healthParts.push(claudeStatus === 'healthy' ? 'Claude healthy' : `Claude ${claudeStatus}`);
+  } else {
+    healthParts.push('Claude disabled');
+  }
+  if (openaiProviderEnabled) {
+    const openaiStatus = providerStatus('openai');
+    healthParts.push(openaiStatus === 'healthy' ? 'OpenAI healthy' : `OpenAI ${openaiStatus}`);
+  } else {
+    healthParts.push('OpenAI disabled');
+  }
+  lines.push(`Health: ${healthParts.join(', ')}`);
 
   // Line 5: Last task summary (only if session exists)
   if (session) {
@@ -194,6 +208,9 @@ export function formatSessionCard(session, repo, health) {
     }
   }
 
+  // Tip line: always show a call-to-action so non-TTY output is actionable
+  lines.push(`Tip: run "dual-brain --help" or "dual-brain go \\"task\\""`);
+
   return lines.join('\n');
 }
 

package/src/tui.mjs

@@ -4,6 +4,8 @@
  */
 
 import { fileURLToPath } from 'node:url';
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
 
 // ─── Unicode / ASCII mode ─────────────────────────────────────────────────────
 
@@ -172,7 +174,14 @@ export function menu(options, opts = {}) {
 // ─── Self-test ────────────────────────────────────────────────────────────────
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
-  console.log(box('🧠 Dual-Brain v7.0.2', [
+  // Read version dynamically from package.json
+  let selfTestVersion = '0.0.0';
+  try {
+    const pkgPath = join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json');
+    selfTestVersion = JSON.parse(readFileSync(pkgPath, 'utf8')).version;
+  } catch { /* fallback to 0.0.0 */ }
+
+  console.log(box(`🧠 Dual-Brain v${selfTestVersion}`, [
     '🟢 Claude ✅  🟢 OpenAI ✅',
     '🌀 Replit + replit-tools',
   ]));