johns-harness 2026.9.11 → 2026.9.13

package/README.md

@@ -45,12 +45,18 @@ The wizard sets up credentials, workspace, gateway, and channels. It asks for yo
 | Connect | `johnness channels add --channel telegram --token "<bot token>"` | Connects a chat channel. Discord, Slack, WhatsApp, Signal, iMessage, Matrix, and more are supported. |
 | Check | `johnness doctor` | Health checks and quick fixes for the gateway and channels. |
 
+<!-- JOHNNESS_PATCH_DEVICE_LOGIN_60B -->
 ### Signing in from chat
 Owners and allowlisted senders can send `/login` (or `/relogin`) in Telegram, Discord, or another chat channel.
-Open the link, enter the device code, and sign in to ChatGPT; the harness reconnects automatically.
+Open the link, sign in to ChatGPT if asked, then enter the device code on the same page and tap Approve. In Telegram, tap the code to copy it.
+Enable "Device code authorization for Codex" once in chatgpt.com > Settings > Security; if it was disabled, send `/login` again for a fresh code.
 For headless installs, run `johnness models auth login --device`; no browser or localhost callback needed.
 Expired ChatGPT credentials trigger an owner notice with the `/login` recovery command.
 
+<!-- JOHNNESS_PATCH_DEFAULTS_61 -->
+### Batteries included
+The harness ships the current model catalog and the short aliases `opus`, `sonnet`, `fable`, `astra`, `sol`, `luna`, `terra`, and `gpt`, so `/model opus` works on a fresh install with no `models.providers` block. Channels you configure load without a `plugins.allow` list; only an explicit `enabled: false` or `plugins.deny` turns one off. Updating the harness updates the catalog and aliases for every agent.
+
 ### From source
 
 ```bash

package/dist/auth-profiles-5CHn7vq1.js

@@ -3536,6 +3536,9 @@ async function resolveImplicitBedrockProvider(params) {
 //#region src/agents/model-selection.ts
 const log$1 = createSubsystemLogger("model-selection");
 const ANTHROPIC_MODEL_ALIASES = {
+	"opus-5": "claude-opus-5", // JOHNNESS_PATCH_DEFAULTS_61
+	"sonnet-5": "claude-sonnet-5",
+	"fable-5.1": "claude-fable-5-1",
 	"opus-4.6": "claude-opus-4-6",
 	"opus-4.5": "claude-opus-4-5",
 	"sonnet-4.6": "claude-sonnet-4-6",
@@ -3683,6 +3686,16 @@ function resolveModelRefFromString(params) {
 			ref: aliasMatch.ref,
 			alias: aliasMatch.alias
 		};
+		// JOHNNESS_PATCH_DEFAULTS_61: fall back to the shipped aliases (opus, sonnet, fable,
+		// astra, sol, luna, terra, gpt) when the user config defines none.
+		const builtinTarget = DEFAULT_MODEL_ALIASES[aliasKey];
+		if (builtinTarget) {
+			const builtinRef = parseModelRef(builtinTarget, params.defaultProvider);
+			if (builtinRef) return {
+				ref: builtinRef,
+				alias: aliasKey
+			};
+		}
 	}
 	const parsed = parseModelRef(model, params.defaultProvider);
 	if (!parsed) return null;
@@ -5081,9 +5094,18 @@ let defaultWarnState = { warned: false };
 const DEFAULT_MODEL_ALIASES = {
 	muse: "meta/muse-spark-1.3", // JOHNNESS_PATCH_MUSE_SPARK
 	"muse-spark": "meta/muse-spark-1.3",
-	opus: "anthropic/claude-opus-4-6",
-	sonnet: "anthropic/claude-sonnet-4-6",
-	gpt: "openai/gpt-5.4",
+	// JOHNNESS_PATCH_DEFAULTS_61: current model aliases ship with the harness; user config
+	// aliases (agents.defaults.models[*].alias) still take precedence.
+	opus: "anthropic/claude-opus-5",
+	sonnet: "anthropic/claude-sonnet-5",
+	opus46: "anthropic/claude-opus-4-6",
+	sonnet46: "anthropic/claude-sonnet-4-6",
+	fable: "anthropic/claude-fable-5-1",
+	astra: "openai-codex/gpt-6-astra",
+	sol: "openai-codex/gpt-5.6-sol",
+	luna: "openai-codex/gpt-5.6-luna",
+	terra: "openai-codex/gpt-5.6-terra",
+	gpt: "openai-codex/gpt-5.5",
 	"gpt-mini": "openai/gpt-5-mini",
 	gemini: "google/gemini-3.1-pro-preview",
 	"gemini-flash": "google/gemini-3-flash-preview",
@@ -13762,6 +13784,7 @@ function validateConfigObjectWithPluginsBase(raw, opts) {
 			workspaceDir: resolveAgentWorkspaceDir(config, resolveDefaultAgentId(config)) ?? void 0
 		});
 		for (const diag of registry.diagnostics) {
+			if (diag.level === "info") continue; // JOHNNESS_PATCH_DEFAULTS_61
 			let path = diag.pluginId ? `plugins.entries.${diag.pluginId}` : "plugins";
 			if (!diag.pluginId && diag.message.includes("plugin path not found")) path = "plugins.load.paths";
 			const message = `${diag.pluginId ? `plugin ${diag.pluginId}` : "plugin"}: ${diag.message}`;

package/dist/codex-oauth-device.js

@@ -1,4 +1,5 @@
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 // Native OpenAI device flow, verified against Codex 0.154.0 device_code_auth.rs.
 // OpenAI uses deviceauth + an authorization-code/PKCE exchange, NOT RFC 8628.
 import path from 'node:path';
@@ -23,6 +24,23 @@ export function redactLoginEmail(email) {
   const [local, domain] = email.split('@');
   return `${local.slice(0, 1)}***@${domain.slice(0, 1)}***`;
 }
+export const DEVICE_LOGIN_SECURITY_FIX = "Go to chatgpt.com > Settings > Security, turn on 'Device code authorization for Codex'";
+export function formatDeviceLoginInstructions(login, { email, chat = false } = {}) {
+  const account = typeof email === 'string' && email.includes('@') ? redactLoginEmail(email) : 'the same account as before';
+  const code = chat ? `\`${login.userCode}\`` : login.userCode;
+  const retry = chat ? 'send /login again' : 'run johnness models auth login --device again';
+  const minutes = Math.max(1, Math.ceil((login.expiresAt - Date.now()) / 60000));
+  return `Let's sign you back into ChatGPT.
+1. Open ${login.verificationUri} on your phone or computer.
+2. Sign in with your ChatGPT account (${account}) if asked.
+3. On the same page, enter this code${chat ? ' (tap the code to copy it)' : ''}:
+${code}
+4. Tap Approve.
+Code is good for ${minutes} minute${minutes === 1 ? '' : 's'}. If you see 'Device code authorization is disabled', ${DEVICE_LOGIN_SECURITY_FIX.charAt(0).toLowerCase() + DEVICE_LOGIN_SECURITY_FIX.slice(1)}, then ${retry} for a fresh code.`;
+}
+function hasDeviceLoginSecurityFix(error) {
+  return ['device_login_unavailable', 'device_code_authorization_disabled'].includes(error?.reason);
+}
 export async function startDeviceLogin({ provider = PROVIDER, fetch: fetchImpl = globalThis.fetch, now = Date.now, sleep: pause = sleep, signal } = {}) {
   if (provider !== PROVIDER) fail('unsupported_provider');
   async function request(url, body, form = false, remaining = 30000) {
@@ -36,7 +54,12 @@ export async function startDeviceLogin({ provider = PROVIDER, fetch: fetchImpl =
   }
   const started = now();
   const { response, data } = await request(`${ISSUER}/api/accounts/deviceauth/usercode`, { client_id: CLIENT_ID });
-  if (!response.ok) fail(response.status === 404 ? 'device_login_unavailable' : 'request_failed', response.status);
+  if (!response.ok) {
+    // Only classify the initial request, never reinterpret polling's bare 403/404.
+    const messages = [data?.message, data?.error_description, data?.error?.message, data?.error];
+    if (response.status === 403 && messages.some(message => typeof message === 'string' && /device code authorization is disabled|security settings do not allow device code authorization for codex/i.test(message))) fail('device_code_authorization_disabled', response.status);
+    fail(response.status === 404 ? 'device_login_unavailable' : 'request_failed', response.status);
+  }
   const userCode = data.user_code ?? data.usercode;
   if (typeof data.device_auth_id !== 'string' || !data.device_auth_id || typeof userCode !== 'string' || !/^[A-Za-z0-9-]{4,32}$/.test(userCode)) fail('invalid_response');
   const expiresAt = started + TTL;
@@ -166,11 +189,16 @@ export async function getOrStartDeviceLogin(params = {}) {
 }
 export async function runDeviceLoginCli(opts, runtime, params = {}) {
   if (opts.provider && opts.provider !== PROVIDER) fail('unsupported_provider');
-  const login = await getOrStartDeviceLogin(params);
-  runtime.log(`Open ${login.verificationUri} and enter code ${login.userCode} (expires in ${Math.max(1, Math.ceil((login.expiresAt - Date.now()) / 60000))} min)`);
-  const result = await login.complete();
-  runtime.log(`Signed in as ${redactLoginEmail(result.credential.email)}`);
-  return result;
+  try {
+    const login = await getOrStartDeviceLogin(params);
+    runtime.log(formatDeviceLoginInstructions(login, { email: selectDeviceLoginProfile(params).previous?.email }));
+    const result = await login.complete();
+    runtime.log(`Signed in as ${redactLoginEmail(result.credential.email)}`);
+    return result;
+  } catch (error) {
+    if (hasDeviceLoginSecurityFix(error)) runtime.log(`${DEVICE_LOGIN_SECURITY_FIX}, then run johnness models auth login --device again for a fresh code.`);
+    throw error;
+  }
 }
 export async function handleDeviceLoginCommand(params, allowTextCommands, { routeReply, callGateway, log = console.info, ...options } = {}) {
   if (!allowTextCommands || !/^\/(login|relogin)(?:\s|$)/i.test(params.command.commandBodyNormalized)) return null;
@@ -185,7 +213,7 @@ export async function handleDeviceLoginCommand(params, allowTextCommands, { rout
     if (!login.notifiedRoutes.has(routeKey)) {
       login.notifiedRoutes.add(routeKey);
       // Never keep the command lane occupied for the 15-minute authorization window.
-      void login.complete().then(() => 'Signed in. I\'m back.', error => error.reason === 'expired' ? 'That code expired. Send /login again.' : error.reason === 'denied' ? 'Login was denied. Send /login to try again.' : 'Login failed. Send /login to try again.').then(async text => {
+      void login.complete().then(() => 'Signed in. I\'m back.', error => error.reason === 'expired' ? "That code expired (they last 15 minutes). Send /login and I'll give you a fresh one." : error.reason === 'denied' ? 'That sign-in was declined. Send /login to try again.' : 'Login failed. Send /login to try again.').then(async text => {
         const result = ["webchat", "internal"].includes(route.channel) && callGateway
           ? await callGateway({ method: "chat.inject", params: { sessionKey: route.sessionKey, message: text } })
           : await routeReply({ ...route, payload: { text } });
@@ -194,6 +222,8 @@ export async function handleDeviceLoginCommand(params, allowTextCommands, { rout
       }).catch(() => log('[codex-device-login] completion delivery failed; send /login again.'));
     }
     log('[codex-device-login] /login recognized; code issued (code and identity redacted)');
-    return reply(`Open ${login.verificationUri} and enter code ${login.userCode}. Good for ${Math.max(1, Math.ceil((login.expiresAt - Date.now()) / 60000))} minutes.`);
-  } catch { return reply('Could not start ChatGPT login. Send /login to try again.'); }
+    return reply(formatDeviceLoginInstructions(login, { email: selectDeviceLoginProfile({ ...options, agentDir: params.agentDir }).previous?.email, chat: true }));
+  } catch (error) {
+    return reply(hasDeviceLoginSecurityFix(error) ? `${DEVICE_LOGIN_SECURITY_FIX}, then send /login again for a fresh code.` : 'Could not start ChatGPT login. Send /login to try again.');
+  }
 }

package/dist/codex-oauth-nudge.js

@@ -1,8 +1,9 @@
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import fs from 'node:fs';
 import path from 'node:path';
 import { transactAuthStore, sameCredential } from './auth-store-transactions.js';
-export const LOGIN_NUDGE_TEXT = 'My ChatGPT login expired. Send /login to fix it.';
+export const LOGIN_NUDGE_TEXT = "My ChatGPT login expired. Send /login and I'll walk you through signing back in (takes about a minute).";
 const DEAD = new Set(['refresh_token_reused', 'invalid_grant', 'refresh_token_expired', 'refresh_token_invalidated', 'expired_no_refresh']);
 export function resolveLoginOwnerRoute(cfg = {}) {
   const owners = cfg.commands?.ownerAllowFrom ?? [];
@@ -48,7 +49,7 @@ export async function notifyDeadCodexChain(params = {}) {
       }
     }
     const route = resolveLoginOwnerRoute(cfg);
-    if (!route) { log('[codex-device-login] My ChatGPT login expired. Send /login to fix it. (No owner route resolved.)'); return true; }
+    if (!route) { log(`[codex-device-login] ${LOGIN_NUDGE_TEXT} (No owner route resolved.)`); return true; }
     if (params.send) await params.send({ ...route, text: LOGIN_NUDGE_TEXT, cfg });
     else {
       const { deliverOutboundPayloads } = await import('./deliver-runtime-JZdz0coW.js');

package/dist/codex-oauth-owner.js

@@ -1,4 +1,5 @@
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { notifyDeadCodexChain } from './codex-oauth-nudge.js';
 // JOHNNESS_PATCH_CODEX_OAUTH_OWNERSHIP_58
 import fs from 'node:fs';

package/dist/commands-registry-C78-tPS3.js

@@ -1,4 +1,5 @@
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { l as escapeRegExp } from "./utils-DC4zYvW0.js";
 import { i as listThinkingLevels } from "./thinking-BYwvlJ3S.js";
 import { Gi as DEFAULT_PROVIDER, Wi as DEFAULT_MODEL, h as resolveConfiguredModelRef } from "./model-selection-L7RMwsG-.js";

package/dist/commands-registry-D0Jkz-Sn.js

@@ -1,4 +1,5 @@
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { D as isPlainObject, u as escapeRegExp } from "./logger-Bj0Xl6pn.js";
 import { Fr as DEFAULT_MODEL, Ir as DEFAULT_PROVIDER, l as resolveConfiguredModelRef, nn as getActivePluginRegistry } from "./model-selection-BGlGpPgM.js";
 import { f as listChannelDocks, r as listThinkingLevels } from "./thinking-CAzdgmNV.js";

package/dist/commands-registry-DJWLO-6B.js

@@ -1,4 +1,5 @@
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { D as isPlainObject, u as escapeRegExp } from "./logger-BW8uLq6f.js";
 import { Mr as DEFAULT_PROVIDER, jr as DEFAULT_MODEL, tn as getActivePluginRegistry, u as resolveConfiguredModelRef } from "./model-selection-BU6wl1le.js";
 import { f as listChannelDocks, r as listThinkingLevels } from "./thinking-B5B36ffe.js";

package/dist/commands-registry-l51VuG0m.js

@@ -1,4 +1,5 @@
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { Bi as DEFAULT_PROVIDER, Or as resolveConfiguredModelRef, zi as DEFAULT_MODEL } from "./auth-profiles-5CHn7vq1.js";
 import { c as escapeRegExp } from "./utils-C5WN6czr.js";
 import { u as getActivePluginRegistry } from "./registry-DoLLbW4m.js";

package/dist/compact-B247y5Qt.js

@@ -1,4 +1,5 @@
 // JOHNNESS_PATCH_DEVICE_LOGIN_60
+// JOHNNESS_PATCH_DEVICE_LOGIN_60B
 import { handleDeviceLoginCommand } from "./codex-oauth-device.js";
 import { E as normalizeLogLevel, a as logVerbose, c as shouldLogVerbose, k as resolvePreferredJohnnessTmpDir, m as getChildLogger, p as theme, t as danger, u as warn } from "./globals-Bv4ZcVWM.js";
 import { g as resolveStateDir, r as STATE_DIR, u as resolveGatewayPort, y as resolveRequiredHomeDir } from "./paths-BfR2LXbA.js";
@@ -92631,7 +92632,10 @@ function isTrackedByProvenance(params) {
 function warnWhenAllowlistIsOpen(params) {
 	if (!params.pluginsEnabled) return;
 	if (params.allow.length > 0) return;
-	const nonBundled = params.discoverablePlugins.filter((entry) => entry.origin !== "bundled");
+	// JOHNNESS_PATCH_DEFAULTS_61: plugins the config already implies (memory slot, enabled
+	// entries, install records) are trusted by construction and never warned about.
+	const implied = params.impliedIds ?? new Set();
+	const nonBundled = params.discoverablePlugins.filter((entry) => entry.origin !== "bundled" && !implied.has(entry.id));
 	if (nonBundled.length === 0) return;
 	const preview = nonBundled.slice(0, 6).map((entry) => `${entry.id} (${entry.source})`).join(", ");
 	const extra = nonBundled.length > 6 ? ` (+${nonBundled.length - 6} more)` : "";
@@ -92729,6 +92733,11 @@ function loadJohnnessPlugins(options = {}) {
 		logger,
 		pluginsEnabled: normalized.enabled,
 		allow: normalized.allow,
+		impliedIds: new Set([
+			...typeof normalized.slots.memory === "string" ? [normalized.slots.memory] : [],
+			...Object.entries(normalized.entries).filter(([, entry]) => entry?.enabled === true).map(([id]) => id),
+			...Object.keys(cfg.plugins?.installs ?? {})
+		]), // JOHNNESS_PATCH_DEFAULTS_61
 		discoverablePlugins: manifestRegistry.plugins.map((plugin) => ({
 			id: plugin.id,
 			source: plugin.source,

package/dist/config-koj5M_EO.js

@@ -1573,6 +1573,9 @@ function normalizeGoogleModelId(id) {
 }
 createSubsystemLogger("model-selection");
 const ANTHROPIC_MODEL_ALIASES = {
+	"opus-5": "claude-opus-5", // JOHNNESS_PATCH_DEFAULTS_61
+	"sonnet-5": "claude-sonnet-5",
+	"fable-5.1": "claude-fable-5-1",
 	"opus-4.6": "claude-opus-4-6",
 	"opus-4.5": "claude-opus-4-5",
 	"sonnet-4.6": "claude-sonnet-4-6",
@@ -1788,9 +1791,18 @@ let defaultWarnState = { warned: false };
 const DEFAULT_MODEL_ALIASES = {
 	muse: "meta/muse-spark-1.3", // JOHNNESS_PATCH_MUSE_SPARK
 	"muse-spark": "meta/muse-spark-1.3",
-	opus: "anthropic/claude-opus-4-6",
-	sonnet: "anthropic/claude-sonnet-4-6",
-	gpt: "openai/gpt-5.4",
+	// JOHNNESS_PATCH_DEFAULTS_61: current model aliases ship with the harness; user config
+	// aliases (agents.defaults.models[*].alias) still take precedence.
+	opus: "anthropic/claude-opus-5",
+	sonnet: "anthropic/claude-sonnet-5",
+	opus46: "anthropic/claude-opus-4-6",
+	sonnet46: "anthropic/claude-sonnet-4-6",
+	fable: "anthropic/claude-fable-5-1",
+	astra: "openai-codex/gpt-6-astra",
+	sol: "openai-codex/gpt-5.6-sol",
+	luna: "openai-codex/gpt-5.6-luna",
+	terra: "openai-codex/gpt-5.6-terra",
+	gpt: "openai-codex/gpt-5.5",
 	"gpt-mini": "openai/gpt-5-mini",
 	gemini: "google/gemini-3.1-pro-preview",
 	"gemini-flash": "google/gemini-3-flash-preview",
@@ -4407,7 +4419,9 @@ function isBundledChannelEnabledByChannelConfig(cfg, pluginId) {
 	if (!channelId) return false;
 	const entry = cfg.channels?.[channelId];
 	if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
-	return entry.enabled === true;
+	// JOHNNESS_PATCH_DEFAULTS_61: a configured channel block implies the bundled channel
+	// plugin. Only an explicit enabled:false opts out; no plugins.allow needed.
+	return entry.enabled !== false;
 }
 function resolveEffectiveEnableState(params) {
 	const base = resolveEnableState(params.id, params.origin, params.config);
@@ -5091,6 +5105,18 @@ function safeStatMtimeMs(filePath) {
 		return null;
 	}
 }
+// JOHNNESS_PATCH_DEFAULTS_61: loose semver compare for bundled-vs-installed plugin dedupe.
+function compareJohnnessPluginVersions(a, b) {
+	const parse = (value) => String(value ?? "").trim().replace(/^v/i, "").split(/[-+]/)[0].split(".").map((part) => Number.parseInt(part, 10)).map((part) => Number.isFinite(part) ? part : 0);
+	const left = parse(a);
+	const right = parse(b);
+	const len = Math.max(left.length, right.length, 1);
+	for (let i = 0; i < len; i += 1) {
+		const diff = (left[i] ?? 0) - (right[i] ?? 0);
+		if (diff !== 0) return diff > 0 ? 1 : -1;
+	}
+	return 0;
+}
 function normalizeManifestLabel(raw) {
 	const trimmed = raw?.trim();
 	return trimmed ? trimmed : void 0;
@@ -5187,6 +5213,39 @@ function loadPluginManifestRegistry(params) {
 				}
 				continue;
 			}
+			// JOHNNESS_PATCH_DEFAULTS_61: the same plugin id bundled with the harness and installed
+			// under the state dir is the normal shape (mr-memory). The installed copy stays
+			// authoritative (family 59) with no warning; when the bundled copy is newer by
+			// package version, one info line suggests updating. Two non-bundled copies
+			// still warn as before.
+			const existingBundled = existing.candidate.origin === "bundled";
+			const candidateBundled = candidate.origin === "bundled";
+			if (existingBundled !== candidateBundled) {
+				const existingRecord = records[existing.recordIndex];
+				const candidateVersion = normalizeManifestLabel(manifest.version) ?? candidate.packageVersion;
+				const bundledVersion = existingBundled ? existingRecord?.version : candidateVersion;
+				const installedVersion = existingBundled ? candidateVersion : existingRecord?.version;
+				if (existingBundled) {
+					records[existing.recordIndex] = buildRecord({
+						manifest,
+						candidate,
+						manifestPath: manifestRes.manifestPath,
+						schemaCacheKey,
+						configSchema
+					});
+					seenIds.set(manifest.id, {
+						candidate,
+						recordIndex: existing.recordIndex
+					});
+				}
+				if (compareJohnnessPluginVersions(bundledVersion, installedVersion) > 0) diagnostics.push({
+					level: "info",
+					pluginId: manifest.id,
+					source: candidate.source,
+					message: `installed copy ${installedVersion ?? "?"} is older than the bundled ${bundledVersion ?? "?"}; run "johnness plugins update ${manifest.id}" to upgrade`
+				});
+				continue;
+			}
 			diagnostics.push({
 				level: "warn",
 				pluginId: manifest.id,
@@ -9576,6 +9635,7 @@ function validateConfigObjectWithPluginsBase(raw, opts) {
 			workspaceDir: resolveAgentWorkspaceDir(config, resolveDefaultAgentId(config)) ?? void 0
 		});
 		for (const diag of registry.diagnostics) {
+			if (diag.level === "info") continue; // JOHNNESS_PATCH_DEFAULTS_61
 			let path = diag.pluginId ? `plugins.entries.${diag.pluginId}` : "plugins";
 			if (!diag.pluginId && diag.message.includes("plugin path not found")) path = "plugins.load.paths";
 			const message = `${diag.pluginId ? `plugin ${diag.pluginId}` : "plugin"}: ${diag.message}`;

package/dist/daemon-cli.js

@@ -4724,6 +4724,9 @@ function normalizeGoogleModelId(id) {
 }
 createSubsystemLogger("model-selection");
 const ANTHROPIC_MODEL_ALIASES = {
+	"opus-5": "claude-opus-5", // JOHNNESS_PATCH_DEFAULTS_61
+	"sonnet-5": "claude-sonnet-5",
+	"fable-5.1": "claude-fable-5-1",
 	"opus-4.6": "claude-opus-4-6",
 	"opus-4.5": "claude-opus-4-5",
 	"sonnet-4.6": "claude-sonnet-4-6",
@@ -4939,9 +4942,18 @@ let defaultWarnState = { warned: false };
 const DEFAULT_MODEL_ALIASES = {
 	muse: "meta/muse-spark-1.3", // JOHNNESS_PATCH_MUSE_SPARK
 	"muse-spark": "meta/muse-spark-1.3",
-	opus: "anthropic/claude-opus-4-6",
-	sonnet: "anthropic/claude-sonnet-4-6",
-	gpt: "openai/gpt-5.4",
+	// JOHNNESS_PATCH_DEFAULTS_61: current model aliases ship with the harness; user config
+	// aliases (agents.defaults.models[*].alias) still take precedence.
+	opus: "anthropic/claude-opus-5",
+	sonnet: "anthropic/claude-sonnet-5",
+	opus46: "anthropic/claude-opus-4-6",
+	sonnet46: "anthropic/claude-sonnet-4-6",
+	fable: "anthropic/claude-fable-5-1",
+	astra: "openai-codex/gpt-6-astra",
+	sol: "openai-codex/gpt-5.6-sol",
+	luna: "openai-codex/gpt-5.6-luna",
+	terra: "openai-codex/gpt-5.6-terra",
+	gpt: "openai-codex/gpt-5.5",
 	"gpt-mini": "openai/gpt-5-mini",
 	gemini: "google/gemini-3.1-pro-preview",
 	"gemini-flash": "google/gemini-3-flash-preview",
@@ -7371,7 +7383,9 @@ function isBundledChannelEnabledByChannelConfig(cfg, pluginId) {
 	if (!channelId) return false;
 	const entry = cfg.channels?.[channelId];
 	if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
-	return entry.enabled === true;
+	// JOHNNESS_PATCH_DEFAULTS_61: a configured channel block implies the bundled channel
+	// plugin. Only an explicit enabled:false opts out; no plugins.allow needed.
+	return entry.enabled !== false;
 }
 function resolveEffectiveEnableState(params) {
 	const base = resolveEnableState(params.id, params.origin, params.config);
@@ -8055,6 +8069,18 @@ function safeStatMtimeMs(filePath) {
 		return null;
 	}
 }
+// JOHNNESS_PATCH_DEFAULTS_61: loose semver compare for bundled-vs-installed plugin dedupe.
+function compareJohnnessPluginVersions(a, b) {
+	const parse = (value) => String(value ?? "").trim().replace(/^v/i, "").split(/[-+]/)[0].split(".").map((part) => Number.parseInt(part, 10)).map((part) => Number.isFinite(part) ? part : 0);
+	const left = parse(a);
+	const right = parse(b);
+	const len = Math.max(left.length, right.length, 1);
+	for (let i = 0; i < len; i += 1) {
+		const diff = (left[i] ?? 0) - (right[i] ?? 0);
+		if (diff !== 0) return diff > 0 ? 1 : -1;
+	}
+	return 0;
+}
 function normalizeManifestLabel(raw) {
 	const trimmed = raw?.trim();
 	return trimmed ? trimmed : void 0;
@@ -8151,6 +8177,39 @@ function loadPluginManifestRegistry(params) {
 				}
 				continue;
 			}
+			// JOHNNESS_PATCH_DEFAULTS_61: the same plugin id bundled with the harness and installed
+			// under the state dir is the normal shape (mr-memory). The installed copy stays
+			// authoritative (family 59) with no warning; when the bundled copy is newer by
+			// package version, one info line suggests updating. Two non-bundled copies
+			// still warn as before.
+			const existingBundled = existing.candidate.origin === "bundled";
+			const candidateBundled = candidate.origin === "bundled";
+			if (existingBundled !== candidateBundled) {
+				const existingRecord = records[existing.recordIndex];
+				const candidateVersion = normalizeManifestLabel(manifest.version) ?? candidate.packageVersion;
+				const bundledVersion = existingBundled ? existingRecord?.version : candidateVersion;
+				const installedVersion = existingBundled ? candidateVersion : existingRecord?.version;
+				if (existingBundled) {
+					records[existing.recordIndex] = buildRecord({
+						manifest,
+						candidate,
+						manifestPath: manifestRes.manifestPath,
+						schemaCacheKey,
+						configSchema
+					});
+					seenIds.set(manifest.id, {
+						candidate,
+						recordIndex: existing.recordIndex
+					});
+				}
+				if (compareJohnnessPluginVersions(bundledVersion, installedVersion) > 0) diagnostics.push({
+					level: "info",
+					pluginId: manifest.id,
+					source: candidate.source,
+					message: `installed copy ${installedVersion ?? "?"} is older than the bundled ${bundledVersion ?? "?"}; run "johnness plugins update ${manifest.id}" to upgrade`
+				});
+				continue;
+			}
 			diagnostics.push({
 				level: "warn",
 				pluginId: manifest.id,
@@ -12481,6 +12540,7 @@ function validateConfigObjectWithPluginsBase(raw, opts) {
 			workspaceDir: resolveAgentWorkspaceDir(config, resolveDefaultAgentId(config)) ?? void 0
 		});
 		for (const diag of registry.diagnostics) {
+			if (diag.level === "info") continue; // JOHNNESS_PATCH_DEFAULTS_61
 			let path = diag.pluginId ? `plugins.entries.${diag.pluginId}` : "plugins";
 			if (!diag.pluginId && diag.message.includes("plugin path not found")) path = "plugins.load.paths";
 			const message = `${diag.pluginId ? `plugin ${diag.pluginId}` : "plugin"}: ${diag.message}`;

package/dist/manifest-registry-BMEqbkWA.js

@@ -134,7 +134,9 @@ function isBundledChannelEnabledByChannelConfig(cfg, pluginId) {
 	if (!channelId) return false;
 	const entry = cfg.channels?.[channelId];
 	if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
-	return entry.enabled === true;
+	// JOHNNESS_PATCH_DEFAULTS_61: a configured channel block implies the bundled channel
+	// plugin. Only an explicit enabled:false opts out; no plugins.allow needed.
+	return entry.enabled !== false;
 }
 function resolveEffectiveEnableState(params) {
 	const base = resolveEnableState(params.id, params.origin, params.config);
@@ -820,6 +822,18 @@ function safeStatMtimeMs(filePath) {
 		return null;
 	}
 }
+// JOHNNESS_PATCH_DEFAULTS_61: loose semver compare for bundled-vs-installed plugin dedupe.
+function compareJohnnessPluginVersions(a, b) {
+	const parse = (value) => String(value ?? "").trim().replace(/^v/i, "").split(/[-+]/)[0].split(".").map((part) => Number.parseInt(part, 10)).map((part) => Number.isFinite(part) ? part : 0);
+	const left = parse(a);
+	const right = parse(b);
+	const len = Math.max(left.length, right.length, 1);
+	for (let i = 0; i < len; i += 1) {
+		const diff = (left[i] ?? 0) - (right[i] ?? 0);
+		if (diff !== 0) return diff > 0 ? 1 : -1;
+	}
+	return 0;
+}
 function normalizeManifestLabel(raw) {
 	const trimmed = raw?.trim();
 	return trimmed ? trimmed : void 0;
@@ -916,6 +930,39 @@ function loadPluginManifestRegistry(params) {
 				}
 				continue;
 			}
+			// JOHNNESS_PATCH_DEFAULTS_61: the same plugin id bundled with the harness and installed
+			// under the state dir is the normal shape (mr-memory). The installed copy stays
+			// authoritative (family 59) with no warning; when the bundled copy is newer by
+			// package version, one info line suggests updating. Two non-bundled copies
+			// still warn as before.
+			const existingBundled = existing.candidate.origin === "bundled";
+			const candidateBundled = candidate.origin === "bundled";
+			if (existingBundled !== candidateBundled) {
+				const existingRecord = records[existing.recordIndex];
+				const candidateVersion = normalizeManifestLabel(manifest.version) ?? candidate.packageVersion;
+				const bundledVersion = existingBundled ? existingRecord?.version : candidateVersion;
+				const installedVersion = existingBundled ? candidateVersion : existingRecord?.version;
+				if (existingBundled) {
+					records[existing.recordIndex] = buildRecord({
+						manifest,
+						candidate,
+						manifestPath: manifestRes.manifestPath,
+						schemaCacheKey,
+						configSchema
+					});
+					seenIds.set(manifest.id, {
+						candidate,
+						recordIndex: existing.recordIndex
+					});
+				}
+				if (compareJohnnessPluginVersions(bundledVersion, installedVersion) > 0) diagnostics.push({
+					level: "info",
+					pluginId: manifest.id,
+					source: candidate.source,
+					message: `installed copy ${installedVersion ?? "?"} is older than the bundled ${bundledVersion ?? "?"}; run "johnness plugins update ${manifest.id}" to upgrade`
+				});
+				continue;
+			}
 			diagnostics.push({
 				level: "warn",
 				pluginId: manifest.id,

package/dist/manifest-registry-Ba187z7Z.js

@@ -134,7 +134,9 @@ function isBundledChannelEnabledByChannelConfig(cfg, pluginId) {
 	if (!channelId) return false;
 	const entry = cfg.channels?.[channelId];
 	if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
-	return entry.enabled === true;
+	// JOHNNESS_PATCH_DEFAULTS_61: a configured channel block implies the bundled channel
+	// plugin. Only an explicit enabled:false opts out; no plugins.allow needed.
+	return entry.enabled !== false;
 }
 function resolveEffectiveEnableState(params) {
 	const base = resolveEnableState(params.id, params.origin, params.config);
@@ -820,6 +822,18 @@ function safeStatMtimeMs(filePath) {
 		return null;
 	}
 }
+// JOHNNESS_PATCH_DEFAULTS_61: loose semver compare for bundled-vs-installed plugin dedupe.
+function compareJohnnessPluginVersions(a, b) {
+	const parse = (value) => String(value ?? "").trim().replace(/^v/i, "").split(/[-+]/)[0].split(".").map((part) => Number.parseInt(part, 10)).map((part) => Number.isFinite(part) ? part : 0);
+	const left = parse(a);
+	const right = parse(b);
+	const len = Math.max(left.length, right.length, 1);
+	for (let i = 0; i < len; i += 1) {
+		const diff = (left[i] ?? 0) - (right[i] ?? 0);
+		if (diff !== 0) return diff > 0 ? 1 : -1;
+	}
+	return 0;
+}
 function normalizeManifestLabel(raw) {
 	const trimmed = raw?.trim();
 	return trimmed ? trimmed : void 0;
@@ -916,6 +930,39 @@ function loadPluginManifestRegistry(params) {
 				}
 				continue;
 			}
+			// JOHNNESS_PATCH_DEFAULTS_61: the same plugin id bundled with the harness and installed
+			// under the state dir is the normal shape (mr-memory). The installed copy stays
+			// authoritative (family 59) with no warning; when the bundled copy is newer by
+			// package version, one info line suggests updating. Two non-bundled copies
+			// still warn as before.
+			const existingBundled = existing.candidate.origin === "bundled";
+			const candidateBundled = candidate.origin === "bundled";
+			if (existingBundled !== candidateBundled) {
+				const existingRecord = records[existing.recordIndex];
+				const candidateVersion = normalizeManifestLabel(manifest.version) ?? candidate.packageVersion;
+				const bundledVersion = existingBundled ? existingRecord?.version : candidateVersion;
+				const installedVersion = existingBundled ? candidateVersion : existingRecord?.version;
+				if (existingBundled) {
+					records[existing.recordIndex] = buildRecord({
+						manifest,
+						candidate,
+						manifestPath: manifestRes.manifestPath,
+						schemaCacheKey,
+						configSchema
+					});
+					seenIds.set(manifest.id, {
+						candidate,
+						recordIndex: existing.recordIndex
+					});
+				}
+				if (compareJohnnessPluginVersions(bundledVersion, installedVersion) > 0) diagnostics.push({
+					level: "info",
+					pluginId: manifest.id,
+					source: candidate.source,
+					message: `installed copy ${installedVersion ?? "?"} is older than the bundled ${bundledVersion ?? "?"}; run "johnness plugins update ${manifest.id}" to upgrade`
+				});
+				continue;
+			}
 			diagnostics.push({
 				level: "warn",
 				pluginId: manifest.id,