kenaz 0.3.15 → 0.3.17

package/core/.claude/commands/Ansuz.md

@@ -14,6 +14,7 @@ ARGUMENTS 含 `[專案: X]` 或 `--project-path X` → PROJECT_PATH = X，下方
 ## 工作方式
 - **自己做**：約 30 行內的小修正 → 直接改，跑最近的測試，提交。
 - **開卡派工**（中型、可平行、高風險）：`kenaz_task_create` 開卡（requirements、acceptance criteria、scope paths）→ `node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent` → `promptText` 給 subagent、`agentParams` 照用（不換模型）；輸出是 `executor` 區塊時照 RULES.md 的 Dispatch 執行。subagent 在 worktree commit，你驗證後合併。
+- 用戶指定 model 就照做：單張卡加 `--dispatch-model <id>`（不改設定）；「之後都用」才 `kenaz subagent set <id> [--rigor r]`。沒指定就照設定，不自己換。
 - 開卡前確認 scope 與驗收條件對準真正的問題。
 
 ## 驗證（合併前，強度跟風險相稱）

package/core/.claude/hooks/__tests__/vendor-agent-guard.test.js

@@ -0,0 +1,44 @@
+// vendor-agent-guard.js: in another-vendor session, an Agent call that asks for a Claude model is denied.
+const test = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { decide } = require('../vendor-agent-guard');
+
+const DS = { ANTHROPIC_BASE_URL: 'https://api.deepseek.com/anthropic', KENAZ_PROVIDER: 'deepseek' };
+const call = (model, tool = 'Agent') => ({ tool_name: tool, tool_input: { description: 'x', prompt: 'y', ...(model ? { model } : {}) } });
+
+test('deepseek session: Agent/Task asking for a Claude model is denied with the dispatch.js route', () => {
+  for (const [m, t] of [['opus', 'Agent'], ['sonnet', 'Task'], ['claude-opus-5-5', 'Agent']]) {
+    const d = decide(call(m, t), DS);
+    assert.strictEqual(d.hookSpecificOutput.permissionDecision, 'deny', m);
+    assert.match(d.hookSpecificOutput.permissionDecisionReason, /dispatch\.js .*executor/);
+  }
+  // base URL alone (a session launched before KENAZ_PROVIDER existed) is enough
+  assert.ok(decide(call('opus'), { ANTHROPIC_BASE_URL: 'https://api.deepseek.com/anthropic' }));
+});
+
+test('controls: no model, a non-Claude model, a Claude session, or another tool are allowed', () => {
+  assert.strictEqual(decide(call(null), DS), null, 'no model = runs on the session vendor, as intended');
+  assert.strictEqual(decide(call('deepseek-v4-pro'), DS), null);
+  assert.strictEqual(decide(call('opus'), {}), null, 'normal Claude session');
+  assert.strictEqual(decide(call('opus'), { ANTHROPIC_BASE_URL: 'https://api.anthropic.com' }), null);
+  assert.strictEqual(decide({ tool_name: 'Bash', tool_input: { command: 'ls' } }, DS), null);
+});
+
+test('real hook path: the plugin dispatcher runs it in a user project and prints the deny JSON', () => {
+  const root = path.resolve(__dirname, '..', '..', '..');
+  // a user project (inside the core repo the plugin yields to the repo's own .claude/settings.json hooks)
+  const proj = require('fs').mkdtempSync(path.join(require('os').tmpdir(), 'vag-'));
+  require('fs').mkdirSync(path.join(proj, '.kenaz')); require('fs').writeFileSync(path.join(proj, '.kenaz', 'project.yaml'), 'name: p\n');
+  const r = spawnSync(process.execPath, [path.join(root, 'plugins', 'kenaz', 'hooks', 'kenaz-hook.js'), 'vendor-agent-guard'], {
+    input: JSON.stringify(call('opus')), encoding: 'utf8',
+    env: { ...process.env, ...DS, CLAUDE_PROJECT_DIR: proj, KENAZ_MODE: 'full' }, cwd: proj,
+  });
+  assert.match(r.stdout, /"permissionDecision":"deny"/, r.stdout + r.stderr);
+  const ok = spawnSync(process.execPath, [path.join(root, 'plugins', 'kenaz', 'hooks', 'kenaz-hook.js'), 'vendor-agent-guard'], {
+    input: JSON.stringify(call('opus')), encoding: 'utf8',
+    env: { ...process.env, ANTHROPIC_BASE_URL: '', KENAZ_PROVIDER: '', CLAUDE_PROJECT_DIR: proj, KENAZ_MODE: 'full' }, cwd: proj,
+  });
+  assert.strictEqual(ok.stdout.trim(), '', 'control: Claude session prints nothing');
+});

package/core/.claude/hooks/vendor-agent-guard.js

@@ -0,0 +1,40 @@
+'use strict';
+// PreToolUse(Agent|Task): in a session whose model requests go to another vendor (kenaz launch --provider
+// deepseek, or the env set by hand), an Agent-tool subagent runs on that vendor too, whatever `model` says.
+// Asking it for a Claude model is therefore always a silent substitution: deny it and point at the path that
+// does reach Claude (dispatch.js -> executor block -> claude -p on the user's own login). Agent calls without
+// a Claude model are allowed (they run on the session's vendor, as expected). Fails open on any error.
+// Field report 2026-10-12: a DeepSeek Ansuz asked the Agent tool for opus and the subagent ran deepseek-v4-pro.
+const path = require('path');
+
+const CLAUDE_MODEL = /^(opus|sonnet|haiku|fable)$|^claude-/i;
+
+function decide(input, env = process.env) {
+  if (!input || !['Agent', 'Task'].includes(input.tool_name)) return null;
+  const model = String((input.tool_input && input.tool_input.model) || '').trim();
+  if (!CLAUDE_MODEL.test(model)) return null;
+  let other = false;
+  try { other = require(path.join(__dirname, '..', '..', '.formation', 'bifrost', 'exec.js')).otherVendorSession(env); } catch (_) { return null; }
+  if (!other) return null;
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: `This session's model requests go to ${env.KENAZ_PROVIDER || 'another vendor'} (${env.ANTHROPIC_BASE_URL || 'KENAZ_PROVIDER'}), so an Agent-tool subagent would run there, not on Claude '${model}'. ` +
+        'For a Claude subagent run dispatch.js (card first): node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent [--dispatch-model ' + model + '] ' +
+        '-> it prints an `executor` block; run executor.command with Bash run_in_background (claude -p on the user\'s Claude login). ' +
+        'To use this session\'s model instead, call the Agent tool again without `model`.',
+    },
+  };
+}
+
+function main() {
+  try {
+    const raw = require('fs').readFileSync(0, 'utf8');
+    const out = decide(JSON.parse(raw || '{}'));
+    if (out) process.stdout.write(JSON.stringify(out));
+  } catch (_) { /* fail open */ }
+}
+
+if (require.main === module) main(); // hook wrappers require() it and call main() (same as memory-guard.js)
+module.exports = { decide, main };

package/core/.claude/settings.json

@@ -71,6 +71,15 @@
           }
         ],
         "matcher": "mcp__kenaz-dashboard__.*|Read|Edit|Write"
+      },
+      {
+        "matcher": "Agent|Task",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node -e \"const d=process.env.CLAUDE_PROJECT_DIR;process.chdir(d);require(d+'/.claude/hooks/vendor-agent-guard.js').main()\""
+          }
+        ]
       }
     ],
     "PostToolUse": [

package/core/.formation/bifrost/exec.js

@@ -4,9 +4,11 @@
  * Bifrost executors for `kenaz subagent` (TASK_2422): run a dispatched card with a non-Claude model.
  *   codex:<id>      `codex exec` in the card's worktree (id = an entry of openai/models.json; `codex:` = default)
  *   deepseek:<m>    `claude -p` in the worktree against DeepSeek's Anthropic-compatible endpoint
+ *   claude          (TASK_2430) `claude -p --model <alias>` on the user's own Claude login: used by dispatch.js inside a
+ *                   `kenaz launch` session, where the Agent tool can only reach the other vendor
  *
  * CLI (dispatch.js prints the exact command):
- *   node exec.js --adapter=codex|deepseek --model=<id> --worktree <dir> --prompt-file <f> --result-file <f>
+ *   node exec.js --adapter=codex|deepseek|claude --model=<id> --worktree <dir> --prompt-file <f> --result-file <f>
  * The prompt goes to the child on stdin (never argv). The DeepSeek key is only in the child's env and
  * is redacted from everything written. The worktree is never removed. Exit 0 = child ok AND new commits.
  */
@@ -63,6 +65,7 @@ function buildChild({ adapter, id, worktree, lastFile, key, gitDir }) {
     if (gitDir) args.push('--add-dir', gitDir);
     return { bin: 'codex', args, env: {}, unset: [] };
   }
+  if (adapter === 'claude') return { bin: 'claude', args: ['-p', '--model', id, '--allowedTools', ...CLAUDE_TOOLS], env: {}, unset: CLAUDE_UNSET };
   return { bin: 'claude', args: ['-p', '--allowedTools', ...CLAUDE_TOOLS], env: deepseekEnv(id, key), unset: DEEPSEEK_UNSET };
 }
 
@@ -89,7 +92,18 @@ async function deepseekModels(key, fetchFn = globalThis.fetch, timeoutMs = 3000)
     return Object.keys(out).length ? out : null;
   } catch { return null; }
 }
+/** True in a Claude Code session whose model requests go to another vendor (kenaz launch, or the env set by
+ *  hand): KENAZ_PROVIDER, or ANTHROPIC_BASE_URL not on anthropic.com. The Agent tool there reaches only that vendor. */
+function otherVendorSession(env = process.env) {
+  if (env.KENAZ_PROVIDER && env.KENAZ_PROVIDER !== 'anthropic') return true;
+  const u = String(env.ANTHROPIC_BASE_URL || '').replace(/^https?:\/\//i, '');
+  return !!u && !/(^|\.)anthropic\.com(\/|:|$)/i.test(u);
+}
 const DEEPSEEK_UNSET = ['ANTHROPIC_API_KEY']; // never send a real Anthropic key to another vendor
+// The claude adapter must reach Claude, not the vendor `kenaz launch` pointed this session at: drop every override
+// launch sets (the vendor key lives in ANTHROPIC_AUTH_TOKEN; DEEPSEEK_API_KEY is dropped too, the child does not need it).
+const CLAUDE_UNSET = ['ANTHROPIC_BASE_URL', 'ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_MODEL', 'ANTHROPIC_SMALL_FAST_MODEL', 'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL', 'ANTHROPIC_DEFAULT_OPUS_MODEL', 'CLAUDE_CODE_SUBAGENT_MODEL', 'CLAUDE_CODE_MAX_CONTEXT_TOKENS', 'KENAZ_PROVIDER', 'DEEPSEEK_API_KEY'];
 
 const git = (cwd, args) => spawnSync('git', args, { cwd, encoding: 'utf8', windowsHide: true });
 // Same exclusions as the dispatch prompt's commit command (session telemetry never rides along).
@@ -108,11 +122,13 @@ const winQuote = (a) => (/^[\w@%+=:,./\\-]+$/.test(a) ? a : '"' + a.replace(/"/g
 
 /** Run the executor; resolves to the result object (also written to resultFile). Never throws for child failures. */
 async function run({ adapter, model = '', worktree, promptFile, resultFile, env = process.env, home = os.homedir() }) {
-  if (!['codex', 'deepseek'].includes(adapter)) throw new Error(`unknown adapter '${adapter}'`);
+  if (!['codex', 'deepseek', 'claude'].includes(adapter)) throw new Error(`unknown adapter '${adapter}'`);
   const started = Date.now();
   const key = adapter === 'deepseek' ? deepseekKey(env, home) : null;
   if (adapter === 'deepseek' && !key) throw new Error('deepseek: no API key (set DEEPSEEK_API_KEY or deepseek_api_key in ~/.kenaz/credentials.yaml)');
-  const redact = (s) => (key ? String(s).split(key).join('***') : String(s));
+  // claude adapter: the vendor key is not given to the child, but redact it (and the launch token) from anything written anyway.
+  const secrets = adapter === 'claude' ? [deepseekKey(env, home), env.ANTHROPIC_AUTH_TOKEN].filter(Boolean) : key ? [key] : [];
+  const redact = (s) => secrets.reduce((acc, k) => acc.split(k).join('***'), String(s));
   const base = (git(worktree, ['rev-parse', 'HEAD']).stdout || '').trim();
   const lastFile = resultFile + '.last.txt';
   const gitDir = (git(worktree, ['rev-parse', '--path-format=absolute', '--git-common-dir']).stdout || '').trim();
@@ -148,7 +164,7 @@ async function main(argv) {
     if (m) a[m[1]] = m[2] !== undefined ? m[2] : argv[++i];
   }
   if (!a.adapter || !a.worktree || !a['prompt-file'] || !a['result-file']) {
-    console.error('usage: exec.js --adapter=codex|deepseek --model=<id> --worktree <dir> --prompt-file <f> --result-file <f>');
+    console.error('usage: exec.js --adapter=codex|deepseek|claude --model=<id> --worktree <dir> --prompt-file <f> --result-file <f>');
     return 2;
   }
   try {
@@ -159,4 +175,4 @@ async function main(argv) {
 }
 
 if (require.main === module) main(process.argv.slice(2)).then((c) => { process.exitCode = c; });
-module.exports = { parseExecutorModel, deepseekKey, deepseekEnv, deepseekModels, DEEPSEEK_UNSET, winQuote, buildChild, run, main, DEEPSEEK_MODELS };
+module.exports = { otherVendorSession, parseExecutorModel, deepseekKey, deepseekEnv, deepseekModels, DEEPSEEK_UNSET, winQuote, buildChild, run, main, DEEPSEEK_MODELS };

package/core/.formation/bifrost/provider-launch.js

@@ -42,7 +42,8 @@ function plan(argv, env = process.env, home = os.homedir(), live = null) {
   if (!valid.includes(id)) throw new Error(`unknown ${provider} model '${id}'; valid: ${valid.join(', ')}`);
   const key = p.key(env, home);
   if (!key) throw new Error(`${provider}: no API key (${p.keyHelp})`);
-  const childEnv = { ...env, ...p.env(id, key, live && live[id]), CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1' };
+  const childEnv = { ...env, ...p.env(id, key, live && live[id]), CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
+    KENAZ_PROVIDER: provider }; // tools (dispatch.js) tell the session runs on another vendor
   for (const k of p.unset) delete childEnv[k];
   return { bin: 'claude', args: rest, env: childEnv, provider, model: id, context: childEnv.CLAUDE_CODE_MAX_CONTEXT_TOKENS };
 }

package/core/.formation/bifrost/provider-launch.test.js

@@ -31,6 +31,7 @@ test('deepseek: every model slot points at DeepSeek, key only in the child env,
   assert.strictEqual(e.CLAUDE_CODE_MAX_CONTEXT_TOKENS, '1048576', 'V4 window from the built-in table when the live list is unavailable');
   assert.strictEqual(e.ANTHROPIC_API_KEY, undefined);
   assert.strictEqual(e.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC, '1');
+  assert.strictEqual(e.KENAZ_PROVIDER, 'deepseek', 'tools can tell the session runs on another vendor');
   assert.strictEqual(e.PATH, 'p', 'the rest of the env is kept');
   assert.ok(!JSON.stringify(c.args).includes(KEY) && !lines.join('\n').includes(KEY), 'key never in argv or output');
 });

package/core/.formation/tools/__tests__/subagent-executor.test.js

@@ -31,7 +31,7 @@ let stdin = ''; process.stdin.on('data', (d) => { stdin += d; });
 process.stdin.on('end', () => {
   const argv = process.argv.slice(2);
   fs.writeFileSync(path.join(process.env.STUB_OUT, name + '.json'), JSON.stringify({ argv, cwd: process.cwd(), stdin,
-    env: { ANTHROPIC_BASE_URL: process.env.ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN: process.env.ANTHROPIC_AUTH_TOKEN, ANTHROPIC_MODEL: process.env.ANTHROPIC_MODEL, ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY } }));
+    env: { ANTHROPIC_BASE_URL: process.env.ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN: process.env.ANTHROPIC_AUTH_TOKEN, ANTHROPIC_MODEL: process.env.ANTHROPIC_MODEL, ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY }, fullEnv: process.env }));
   if (process.env.STUB_WRITE_ONLY) fs.writeFileSync(path.join(process.cwd(), 'left.txt'), 'x'); // a sandboxed agent: edits, cannot commit
   if (process.env.STUB_COMMIT) {
     fs.writeFileSync(path.join(process.cwd(), 'out.txt'), 'x');
@@ -148,13 +148,74 @@ test('subagent set: unknown codex id and unknown prefix are refused with the val
 });
 
 // ---- dispatch.js: executor block vs the unchanged Claude control ----
+const REMOVED = ['ANTHROPIC_BASE_URL', 'ANTHROPIC_AUTH_TOKEN', 'ANTHROPIC_MODEL', 'ANTHROPIC_SMALL_FAST_MODEL', 'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL', 'ANTHROPIC_DEFAULT_OPUS_MODEL', 'CLAUDE_CODE_SUBAGENT_MODEL', 'CLAUDE_CODE_MAX_CONTEXT_TOKENS', 'KENAZ_PROVIDER'];
+test('claude executor (TASK_2430): --model alias, every launch override removed, vendor key nowhere', (t) => {
+  const launchEnv = Object.fromEntries(REMOVED.map((k) => [k, 'x-' + k])); launchEnv.ANTHROPIC_AUTH_TOKEN = KEY; launchEnv.STUB_ECHO_KEY = '1';
+  const x = runExec(t, { adapter: 'claude', model: 'opus', extraEnv: launchEnv });
+  assert.equal(x.r.status, 0, x.r.stdout + x.r.stderr);
+  assert.deepEqual(x.claude.argv, ['-p', '--model', 'opus', '--allowedTools', 'Bash', 'Edit', 'Write', 'Read', 'Glob', 'Grep']);
+  for (const k of [...REMOVED, 'DEEPSEEK_API_KEY']) assert.equal(x.claude.fullEnv[k], undefined, k + ' reached the claude child');
+  assert.match(x.claude.stdin, /^DO THE CARD\n\n## Executor note\n/);
+  assert.equal(JSON.stringify(x.claude.fullEnv).includes(KEY), false);
+  assert.equal(JSON.stringify(x.claude.argv).includes(KEY), false);
+  assert.equal((x.r.stdout + x.r.stderr).includes(KEY), false);
+  assert.equal(fs.readFileSync(x.resultPath, 'utf8').includes(KEY), false);
+  assert.equal(x.result.ok, true); assert.match(x.result.commits[0], /stub work/);
+});
+
+test('claude executor: edits left uncommitted are committed by exec.js; no commits = failure', (t) => {
+  const left = runExec(t, { adapter: 'claude', model: 'sonnet', extraEnv: { STUB_COMMIT: '', STUB_WRITE_ONLY: '1', GIT_AUTHOR_NAME: 't', GIT_AUTHOR_EMAIL: 't@t', GIT_COMMITTER_NAME: 't', GIT_COMMITTER_EMAIL: 't@t' } });
+  assert.equal(left.r.status, 0, left.r.stdout + left.r.stderr);
+  assert.ok(left.result.executorCommit);
+  const none = runExec(t, { adapter: 'claude', model: 'sonnet', extraEnv: { STUB_COMMIT: '' } });
+  assert.equal(none.r.status, 1); assert.equal(none.result.error, 'no commits');
+});
+
+test('dispatch under KENAZ_PROVIDER: Claude id -> executor adapter claude, no agentParams; without it agentParams as before', (t) => {
+  const sb = tmp(t, 'exec-dispatch-claude-');
+  for (const d of ['backlog', 'active', 'done', 'blocked', 'cancel']) fs.mkdirSync(path.join(sb, '.kenaz', 'tasks', d), { recursive: true });
+  fs.mkdirSync(path.join(sb, '.kenaz', 'locks'), { recursive: true });
+  fs.writeFileSync(path.join(sb, 'README.md'), 'x'); fs.writeFileSync(path.join(sb, '.gitignore'), '.formation/worktrees/\n.kenaz/\n');
+  git(sb, ['init', '-q']); git(sb, ['add', '-A']); git(sb, ['commit', '-q', '--no-verify', '-m', 'init']);
+  const base = { ...process.env }; delete base.CLAUDE_PROJECT_DIR; delete base.CODEX_SESSION_ID; delete base.CODEX_THREAD_ID; delete base.KENAZ_PROVIDER; delete base.ANTHROPIC_BASE_URL;
+  const sh = (script, args, env) => spawnSync(process.execPath, [script, ...args], { env, encoding: 'utf8', windowsHide: true, cwd: ROOT });
+  const mk = sh(TASKAPI, ['--project-path', sb, 'create', '--title', 't2430', '--description', 'd', '--scope-paths', 'zzz/a.js', '--requirements', 'r1',
+    '--acceptance-criteria', 'a1', '--acceptance-criteria', 'a2', '--acceptance-criteria', 'a3', '--technical-notes', 't1', '--technical-notes', 't2', '--force'], base);
+  const id = ((mk.stdout || '').match(/TASK_\d+/) || [])[0]; assert.ok(id, mk.stdout + mk.stderr);
+  const disp = (model, provider, extra = {}) => {
+    fs.writeFileSync(path.join(sb, '.kenaz', 'dashboard-models.json'), JSON.stringify({ dispatchModel: model }));
+    const env = { ...base, ...(provider ? { KENAZ_PROVIDER: provider } : {}), DEEPSEEK_API_KEY: KEY, ...extra };
+    const r = sh(DISPATCH, ['--skill=do', `--task=${id}`, '--dispatch-mode=subagent', '--project-path', sb, '--force'], env);
+    return { r, j: (() => { try { return JSON.parse(r.stdout); } catch { return null; } })() };
+  };
+  const ds = disp('claude-opus-5', 'deepseek');
+  assert.ok(ds.j, ds.r.stdout + ds.r.stderr);
+  assert.equal(ds.j.agentParams, undefined);
+  assert.equal(ds.j.executor.adapter, 'claude'); assert.equal(ds.j.executor.model, 'opus');
+  assert.equal(ds.j.executor.branchName, `task/${id.toLowerCase()}`);
+  assert.ok(fs.existsSync(ds.j.executor.worktreePath)); assert.ok(ds.j.executor.promptFile && ds.j.executor.resultFile && ds.j.executor.note);
+  assert.match(ds.j.executor.command, /exec\.js" --adapter=claude --model="opus" --worktree/);
+  assert.equal(ds.r.stdout.includes(KEY) || ds.r.stderr.includes(KEY), false);
+  const an = disp('claude-sonnet-5-5', 'anthropic'); // control: provider anthropic = no executor
+  assert.equal(an.j.executor, undefined); assert.equal(an.j.agentParams.model, 'sonnet');
+  const none = disp('claude-sonnet-5-5', null); // control: no KENAZ_PROVIDER = byte-for-byte as before
+  assert.equal(none.j.executor, undefined);
+  assert.deepEqual(Object.keys(none.j.agentParams), ['description', 'model']); assert.equal(none.j.agentParams.model, 'sonnet');
+  // a session launched before KENAZ_PROVIDER existed, or with the env set by hand, is recognised by its base URL
+  const byUrl = disp('claude-opus-5', null, { ANTHROPIC_BASE_URL: 'https://api.deepseek.com/anthropic' });
+  assert.equal(byUrl.j.executor.adapter, 'claude'); assert.equal(byUrl.j.agentParams, undefined);
+  const official = disp('claude-opus-5', null, { ANTHROPIC_BASE_URL: 'https://api.anthropic.com' }); // control
+  assert.equal(official.j.executor, undefined); assert.equal(official.j.agentParams.model, 'opus');
+});
+
 test('dispatch: executor block for codex:/deepseek:, byte-for-byte agentParams for a Claude id', (t) => {
   const sb = tmp(t, 'exec-dispatch-');
   for (const d of ['backlog', 'active', 'done', 'blocked', 'cancel']) fs.mkdirSync(path.join(sb, '.kenaz', 'tasks', d), { recursive: true });
   fs.mkdirSync(path.join(sb, '.kenaz', 'locks'), { recursive: true });
   fs.writeFileSync(path.join(sb, 'README.md'), 'x'); fs.writeFileSync(path.join(sb, '.gitignore'), '.formation/worktrees/\n.kenaz/\n');
   git(sb, ['init', '-q']); git(sb, ['add', '-A']); git(sb, ['commit', '-q', '--no-verify', '-m', 'init']);
-  const env = { ...process.env, DEEPSEEK_API_KEY: KEY }; delete env.CLAUDE_PROJECT_DIR; delete env.CODEX_SESSION_ID; delete env.CODEX_THREAD_ID;
+  const env = { ...process.env, DEEPSEEK_API_KEY: KEY }; delete env.ANTHROPIC_BASE_URL; delete env.KENAZ_PROVIDER; delete env.CLAUDE_PROJECT_DIR; delete env.CODEX_SESSION_ID; delete env.CODEX_THREAD_ID;
   const sh = (script, args) => spawnSync(process.execPath, [script, ...args], { env, encoding: 'utf8', windowsHide: true, cwd: ROOT });
   const mk = sh(TASKAPI, ['--project-path', sb, 'create', '--title', 't2422', '--description', 'd', '--scope-paths', 'zzz/a.js', '--requirements', 'r1',
     '--acceptance-criteria', 'a1', '--acceptance-criteria', 'a2', '--acceptance-criteria', 'a3', '--technical-notes', 't1', '--technical-notes', 't2', '--force']);

package/core/.formation/tools/dispatch.js

@@ -1063,6 +1063,14 @@ async function getSubagentDispatchParams(options) {
       return null;
     }
   }
+  // TASK_2430: in a `kenaz launch` session the Agent tool only reaches the other vendor, so a Claude model
+  // id runs as a `claude -p` executor on the user's own Claude login instead.
+  // A session started before KENAZ_PROVIDER existed, or with the env set by hand, is recognised by its base URL.
+  const otherVendor = require('../bifrost/exec').otherVendorSession(process.env);
+  if (!isCodex && !exec && otherVendor) {
+    const fam = translateModelForAgentTool(rawModel).model;
+    if (fam) exec = { adapter: 'claude', id: fam };
+  }
   // TASK_2315: Codex inherits the session model — nothing to translate or pass.
   const translated = isCodex || exec ? { model: null, lossless: true } : translateModelForAgentTool(rawModel);
   if (!isCodex && !exec && !translated.model) {

package/core/.specialist/Ansuz/RULES.md

@@ -70,9 +70,15 @@ the real defect BEFORE carding or dispatching.
   opus). dispatch.js moves the card to active.
 - The dispatch model is the project's setting: `kenaz subagent` (or /kenaz subagent) shows it per rigor, `kenaz subagent set <id> [--rigor r]`
   changes it (writes .kenaz/dashboard-models.json). Your own model is the user's session model (/model).
+- When the user names a model in conversation, act on it yourself (user decision 2026-10-12), never on your own
+  judgment (2026-09-22): for one card ("use opus for this", "let deepseek do the frontend") pass
+  `--dispatch-model <id>` to dispatch.js (claude-opus-5-5, opus, codex:<id>, deepseek:<model>) and leave the setting
+  alone; for "from now on / always" run `kenaz subagent set <id> [--rigor r]` (core repo:
+  `node .formation/tools/dispatch-model.js set <id> [--rigor r]`) and say what changed. No model named = the setting.
 - Executor model (`kenaz subagent set codex:<id>` or `deepseek:<model>`): dispatch.js prints an `executor` block instead of
   agentParams. Run `executor.command` with Bash run_in_background, wait for the completion notice, read `executor.resultFile`
   (ok, exitCode, lastMessage, commits; `no commits` = failure), then verify and merge `executor.branchName` as usual.
+  In a `kenaz launch` session (KENAZ_PROVIDER set), Claude subagents also come as an executor block (adapter `claude`, they use the user's Claude quota).
 - Worktree subagents must commit; cleanup deletes uncommitted edits. Remove Kenaz worktrees only
   via .formation/tools/worktree-reclaim.js (it unlinks node_modules junctions first).
 

package/core/KENAZ_CORE_VERSION

@@ -1 +1 @@
-0.3.15
+0.3.17

package/core/plugins/kenaz/commands/Ansuz.md

@@ -14,6 +14,7 @@ ARGUMENTS 含 `[專案: X]` 或 `--project-path X` → PROJECT_PATH = X，下方
 ## 工作方式
 - **自己做**：約 30 行內的小修正 → 直接改，跑最近的測試，提交。
 - **開卡派工**（中型、可平行、高風險）：`kenaz_task_create` 開卡（requirements、acceptance criteria、scope paths）→ `node "${CLAUDE_PLUGIN_ROOT}/hooks/core-resolve.js" .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent` → `promptText` 給 subagent、`agentParams` 照用（不換模型）；輸出是 `executor` 區塊時照 RULES.md 的 Dispatch 執行。subagent 在 worktree commit，你驗證後合併。
+- 用戶指定 model 就照做：單張卡加 `--dispatch-model <id>`（不改設定）；「之後都用」才 `kenaz subagent set <id> [--rigor r]`。沒指定就照設定，不自己換。
 - 開卡前確認 scope 與驗收條件對準真正的問題。
 
 ## 驗證（合併前，強度跟風險相稱）

package/core/plugins/kenaz/hooks/hooks.json

@@ -1,28 +1,152 @@
 {
   "hooks": {
-    "SessionStart": [{ "hooks": [
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" session-start" },
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" guidance" }
-    ] }],
-    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" prompt-runner" }] }],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" session-start"
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" guidance"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" prompt-runner"
+          }
+        ]
+      }
+    ],
     "PreToolUse": [
-      { "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] },
-      { "matcher": "Bash", "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" synapse-first" }] },
-      { "matcher": "mcp__kenaz-dashboard__.*|Read|Edit|Write", "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" memory-guard" }] }
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" synapse-first"
+          }
+        ]
+      },
+      {
+        "matcher": "mcp__kenaz-dashboard__.*|Read|Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" memory-guard"
+          }
+        ]
+      },
+      {
+        "matcher": "Agent|Task",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" vendor-agent-guard"
+          }
+        ]
+      }
     ],
     "PostToolUse": [
-      { "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] },
-      { "matcher": "TaskCreate|TaskUpdate", "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" task-bridge" }] }
-    ],
-    "PostToolUseFailure": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "Notification": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "SubagentStart": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "SubagentStop": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "SessionEnd": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "Stop": [{ "hooks": [
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" },
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" session-stop" },
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" autonomy-stop" }
-    ] }]
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      },
+      {
+        "matcher": "TaskCreate|TaskUpdate",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" task-bridge"
+          }
+        ]
+      }
+    ],
+    "PostToolUseFailure": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "Notification": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" session-stop"
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" autonomy-stop"
+          }
+        ]
+      }
+    ]
   }
 }

package/core/plugins/kenaz/hooks/kenaz-hook.js

@@ -31,6 +31,7 @@ const HOOKS = {
   'autonomy-stop':  { kind: 'script', file: 'autonomy-stop.js', call: 'main', minMode: 'full' },
   'synapse-first':  { kind: 'script', file: 'synapse-first-investigation.js', minMode: 'full' },
   'memory-guard':   { kind: 'script', file: 'memory-guard.js', call: 'main', minMode: 'full' },
+  'vendor-agent-guard': { kind: 'script', file: 'vendor-agent-guard.js', call: 'main', minMode: 'assist' },
   'task-bridge':    { kind: 'script', file: 'task-bridge.js', minMode: 'assist' },
 };
 

package/lib/cli.js

@@ -35,7 +35,9 @@ function installer() {
 
 /** A core module from the installed core, else this checkout; null when neither is there. */
 function coreModule(p, ...rel) {
-  for (const f of [path.join(p.core, ...rel), path.join(__dirname, '..', '..', '..', ...rel)]) {
+  // installed core, then the repo checkout (dev: live source), then the core bundled in this npm package (npx
+  // before `kenaz install`). Bundled before repo ran a stale prepack copy from a dev checkout (2026-10-12).
+  for (const f of [path.join(p.core, ...rel), path.join(__dirname, '..', '..', '..', ...rel), path.join(PKG_ROOT, 'core', ...rel)]) {
     if (fs.existsSync(f)) return require(f);
   }
   return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kenaz",
-  "version": "0.3.15",
+  "version": "0.3.17",
   "description": "Install Kenaz (plugin, hooks, kenaz-server) for Claude Code and Codex: npx kenaz install",
   "bin": {
     "kenaz": "bin/kenaz.js"
@@ -20,11 +20,11 @@
     "test": "node --test lib/cli.test.js"
   },
   "optionalDependencies": {
-    "@kenazai/server-darwin-arm64": "0.3.15",
-    "@kenazai/server-darwin-x64": "0.3.15",
-    "@kenazai/server-linux-arm64": "0.3.15",
-    "@kenazai/server-linux-x64": "0.3.15",
-    "@kenazai/server-win32-x64": "0.3.15"
+    "@kenazai/server-darwin-arm64": "0.3.17",
+    "@kenazai/server-darwin-x64": "0.3.17",
+    "@kenazai/server-linux-arm64": "0.3.17",
+    "@kenazai/server-linux-x64": "0.3.17",
+    "@kenazai/server-win32-x64": "0.3.17"
   },
   "license": "UNLICENSED",
   "repository": {