kenaz 0.3.16 → 0.3.18

package/core/.claude/commands/Ansuz.md

@@ -14,6 +14,7 @@ ARGUMENTS 含 `[專案: X]` 或 `--project-path X` → PROJECT_PATH = X，下方
 ## 工作方式
 - **自己做**：約 30 行內的小修正 → 直接改，跑最近的測試，提交。
 - **開卡派工**（中型、可平行、高風險）：`kenaz_task_create` 開卡（requirements、acceptance criteria、scope paths）→ `node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent` → `promptText` 給 subagent、`agentParams` 照用（不換模型）；輸出是 `executor` 區塊時照 RULES.md 的 Dispatch 執行。subagent 在 worktree commit，你驗證後合併。
+- 用戶指定 model 就照做：單張卡加 `--dispatch-model <id>`（不改設定）；「之後都用」才 `kenaz subagent set <id> [--rigor r]`。沒指定就照設定，不自己換。
 - 開卡前確認 scope 與驗收條件對準真正的問題。
 
 ## 驗證（合併前，強度跟風險相稱）

package/core/.claude/hooks/__tests__/vendor-agent-guard.test.js

@@ -0,0 +1,44 @@
+// vendor-agent-guard.js: in another-vendor session, an Agent call that asks for a Claude model is denied.
+const test = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { decide } = require('../vendor-agent-guard');
+
+const DS = { ANTHROPIC_BASE_URL: 'https://api.deepseek.com/anthropic', KENAZ_PROVIDER: 'deepseek' };
+const call = (model, tool = 'Agent') => ({ tool_name: tool, tool_input: { description: 'x', prompt: 'y', ...(model ? { model } : {}) } });
+
+test('deepseek session: Agent/Task asking for a Claude model is denied with the dispatch.js route', () => {
+  for (const [m, t] of [['opus', 'Agent'], ['sonnet', 'Task'], ['claude-opus-5-5', 'Agent']]) {
+    const d = decide(call(m, t), DS);
+    assert.strictEqual(d.hookSpecificOutput.permissionDecision, 'deny', m);
+    assert.match(d.hookSpecificOutput.permissionDecisionReason, /dispatch\.js .*executor/);
+  }
+  // base URL alone (a session launched before KENAZ_PROVIDER existed) is enough
+  assert.ok(decide(call('opus'), { ANTHROPIC_BASE_URL: 'https://api.deepseek.com/anthropic' }));
+});
+
+test('controls: no model, a non-Claude model, a Claude session, or another tool are allowed', () => {
+  assert.strictEqual(decide(call(null), DS), null, 'no model = runs on the session vendor, as intended');
+  assert.strictEqual(decide(call('deepseek-v4-pro'), DS), null);
+  assert.strictEqual(decide(call('opus'), {}), null, 'normal Claude session');
+  assert.strictEqual(decide(call('opus'), { ANTHROPIC_BASE_URL: 'https://api.anthropic.com' }), null);
+  assert.strictEqual(decide({ tool_name: 'Bash', tool_input: { command: 'ls' } }, DS), null);
+});
+
+test('real hook path: the plugin dispatcher runs it in a user project and prints the deny JSON', () => {
+  const root = path.resolve(__dirname, '..', '..', '..');
+  // a user project (inside the core repo the plugin yields to the repo's own .claude/settings.json hooks)
+  const proj = require('fs').mkdtempSync(path.join(require('os').tmpdir(), 'vag-'));
+  require('fs').mkdirSync(path.join(proj, '.kenaz')); require('fs').writeFileSync(path.join(proj, '.kenaz', 'project.yaml'), 'name: p\n');
+  const r = spawnSync(process.execPath, [path.join(root, 'plugins', 'kenaz', 'hooks', 'kenaz-hook.js'), 'vendor-agent-guard'], {
+    input: JSON.stringify(call('opus')), encoding: 'utf8',
+    env: { ...process.env, ...DS, CLAUDE_PROJECT_DIR: proj, KENAZ_MODE: 'full' }, cwd: proj,
+  });
+  assert.match(r.stdout, /"permissionDecision":"deny"/, r.stdout + r.stderr);
+  const ok = spawnSync(process.execPath, [path.join(root, 'plugins', 'kenaz', 'hooks', 'kenaz-hook.js'), 'vendor-agent-guard'], {
+    input: JSON.stringify(call('opus')), encoding: 'utf8',
+    env: { ...process.env, ANTHROPIC_BASE_URL: '', KENAZ_PROVIDER: '', CLAUDE_PROJECT_DIR: proj, KENAZ_MODE: 'full' }, cwd: proj,
+  });
+  assert.strictEqual(ok.stdout.trim(), '', 'control: Claude session prints nothing');
+});

package/core/.claude/hooks/synapse-first-investigation.js

@@ -201,9 +201,24 @@ function isDeduped(normalized) {
   }
 }
 
+// Every Bash call appends a line; uncapped it reached 11.7 MB (2026-10-12). Past MAX_LOG_BYTES keep the newest
+// KEEP_LOG_BYTES (cut at a line boundary), so the readers still see recent history.
+const MAX_LOG_BYTES = 2 * 1024 * 1024;
+const KEEP_LOG_BYTES = 1024 * 1024;
+function capLog(file) {
+  let size = 0;
+  try { size = fs.statSync(file).size; } catch { return; }
+  if (size <= MAX_LOG_BYTES) return;
+  const buf = fs.readFileSync(file);
+  const tail = buf.subarray(buf.length - KEEP_LOG_BYTES);
+  const nl = tail.indexOf(10);
+  fs.writeFileSync(file, nl >= 0 ? tail.subarray(nl + 1) : tail);
+}
+
 function appendTelemetry(record) {
   try {
     fs.mkdirSync(path.dirname(NUDGES_PATH), { recursive: true });
+    capLog(NUDGES_PATH);
     fs.appendFileSync(NUDGES_PATH, JSON.stringify(record) + '\n', 'utf8');
   } catch {
     // best-effort

package/core/.claude/hooks/vendor-agent-guard.js

@@ -0,0 +1,40 @@
+'use strict';
+// PreToolUse(Agent|Task): in a session whose model requests go to another vendor (kenaz launch --provider
+// deepseek, or the env set by hand), an Agent-tool subagent runs on that vendor too, whatever `model` says.
+// Asking it for a Claude model is therefore always a silent substitution: deny it and point at the path that
+// does reach Claude (dispatch.js -> executor block -> claude -p on the user's own login). Agent calls without
+// a Claude model are allowed (they run on the session's vendor, as expected). Fails open on any error.
+// Field report 2026-10-12: a DeepSeek Ansuz asked the Agent tool for opus and the subagent ran deepseek-v4-pro.
+const path = require('path');
+
+const CLAUDE_MODEL = /^(opus|sonnet|haiku|fable)$|^claude-/i;
+
+function decide(input, env = process.env) {
+  if (!input || !['Agent', 'Task'].includes(input.tool_name)) return null;
+  const model = String((input.tool_input && input.tool_input.model) || '').trim();
+  if (!CLAUDE_MODEL.test(model)) return null;
+  let other = false;
+  try { other = require(path.join(__dirname, '..', '..', '.formation', 'bifrost', 'exec.js')).otherVendorSession(env); } catch (_) { return null; }
+  if (!other) return null;
+  return {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: `This session's model requests go to ${env.KENAZ_PROVIDER || 'another vendor'} (${env.ANTHROPIC_BASE_URL || 'KENAZ_PROVIDER'}), so an Agent-tool subagent would run there, not on Claude '${model}'. ` +
+        'For a Claude subagent run dispatch.js (card first): node .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent [--dispatch-model ' + model + '] ' +
+        '-> it prints an `executor` block; run executor.command with Bash run_in_background (claude -p on the user\'s Claude login). ' +
+        'To use this session\'s model instead, call the Agent tool again without `model`.',
+    },
+  };
+}
+
+function main() {
+  try {
+    const raw = require('fs').readFileSync(0, 'utf8');
+    const out = decide(JSON.parse(raw || '{}'));
+    if (out) process.stdout.write(JSON.stringify(out));
+  } catch (_) { /* fail open */ }
+}
+
+if (require.main === module) main(); // hook wrappers require() it and call main() (same as memory-guard.js)
+module.exports = { decide, main };

package/core/.claude/settings.json

@@ -71,6 +71,15 @@
           }
         ],
         "matcher": "mcp__kenaz-dashboard__.*|Read|Edit|Write"
+      },
+      {
+        "matcher": "Agent|Task",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node -e \"const d=process.env.CLAUDE_PROJECT_DIR;process.chdir(d);require(d+'/.claude/hooks/vendor-agent-guard.js').main()\""
+          }
+        ]
       }
     ],
     "PostToolUse": [

package/core/.formation/bifrost/exec.js

@@ -19,7 +19,7 @@ const { spawn, spawnSync } = require('child_process');
 
 // First = default. From GET https://api.deepseek.com/models on 2026-10-11 (V4 ids, 1M context); the V3 ids still
 // answer but are no longer listed. `kenaz launch` re-reads the context window from that endpoint at start.
-const DEEPSEEK_MODELS = ['deepseek-v4-pro', 'deepseek-flash', 'deepseek-chat', 'deepseek-reasoner'];
+const DEEPSEEK_MODELS = ['deepseek-flash', 'deepseek-v4-pro', 'deepseek-chat', 'deepseek-reasoner']; // flash = default (user decision 2026-10-12)
 const DEEPSEEK_BASE_URL = 'https://api.deepseek.com/anthropic';
 const DEEPSEEK_CONTEXT_TOKENS = { 'deepseek-v4-pro': 1048576, 'deepseek-flash': 1048576, 'deepseek-chat': 128000, 'deepseek-reasoner': 128000 };
 const DEEPSEEK_FAST = 'deepseek-flash'; // Claude Code's small/fast slot (titles, summaries): the cheap model
@@ -38,12 +38,37 @@ function parseExecutorModel(raw) {
     return { adapter, id };
   }
   if (adapter === 'deepseek') {
-    if (!DEEPSEEK_MODELS.includes(id)) throw new Error(`unknown deepseek model '${id}'; valid: ${DEEPSEEK_MODELS.map((i) => 'deepseek:' + i).join(', ')}`);
-    return { adapter, id };
+    // Any id the vendor may add later is accepted (no release needed); `deepseek:` alone = the user's saved default.
+    const model = id || providerDefault('deepseek') || DEEPSEEK_MODELS[0];
+    if (!MODEL_ID.test(model)) throw new Error(`invalid deepseek model id '${id}' (letters, digits, . _ - only); known: ${DEEPSEEK_MODELS.map((i) => 'deepseek:' + i).join(', ')}`);
+    return { adapter, id: model };
   }
   throw new Error(`unknown executor prefix '${m[1]}:'; valid prefixes: codex:<id>, deepseek:<model>`);
 }
 
+const MODEL_ID = /^[A-Za-z0-9][\w.-]{0,63}$/;
+const configFile = (home) => path.join(home, '.kenaz', 'config.json');
+
+/** The user's own default model for a provider: KENAZ_<PROVIDER>_MODEL, else ~/.kenaz/config.json
+ *  providers.<provider>.model (written by `kenaz launch --provider p --model m --save-default`); null when unset. */
+function providerDefault(provider, env = process.env, home = os.homedir()) {
+  const e = env['KENAZ_' + provider.toUpperCase() + '_MODEL'];
+  if (e && e.trim()) return e.trim();
+  try { const m = JSON.parse(fs.readFileSync(configFile(home), 'utf8')).providers[provider].model; return typeof m === 'string' && m.trim() ? m.trim() : null; } catch { return null; }
+}
+
+/** Save the default (other keys in config.json are kept; atomic write). */
+function saveProviderDefault(provider, model, home = os.homedir()) {
+  let cfg = {};
+  try { cfg = JSON.parse(fs.readFileSync(configFile(home), 'utf8')) || {}; } catch { /* new file */ }
+  cfg.providers = { ...(cfg.providers || {}), [provider]: { ...((cfg.providers || {})[provider] || {}), model } };
+  fs.mkdirSync(path.dirname(configFile(home)), { recursive: true });
+  const tmp = configFile(home) + '.tmp';
+  fs.writeFileSync(tmp, JSON.stringify(cfg, null, 2) + '\n');
+  fs.renameSync(tmp, configFile(home));
+  return configFile(home);
+}
+
 /** DEEPSEEK_API_KEY, else deepseek_api_key in ~/.kenaz/credentials.yaml; null when neither. */
 function deepseekKey(env = process.env, home = os.homedir()) {
   if (env.DEEPSEEK_API_KEY && env.DEEPSEEK_API_KEY.trim()) return env.DEEPSEEK_API_KEY.trim();
@@ -92,6 +117,13 @@ async function deepseekModels(key, fetchFn = globalThis.fetch, timeoutMs = 3000)
     return Object.keys(out).length ? out : null;
   } catch { return null; }
 }
+/** True in a Claude Code session whose model requests go to another vendor (kenaz launch, or the env set by
+ *  hand): KENAZ_PROVIDER, or ANTHROPIC_BASE_URL not on anthropic.com. The Agent tool there reaches only that vendor. */
+function otherVendorSession(env = process.env) {
+  if (env.KENAZ_PROVIDER && env.KENAZ_PROVIDER !== 'anthropic') return true;
+  const u = String(env.ANTHROPIC_BASE_URL || '').replace(/^https?:\/\//i, '');
+  return !!u && !/(^|\.)anthropic\.com(\/|:|$)/i.test(u);
+}
 const DEEPSEEK_UNSET = ['ANTHROPIC_API_KEY']; // never send a real Anthropic key to another vendor
 // The claude adapter must reach Claude, not the vendor `kenaz launch` pointed this session at: drop every override
 // launch sets (the vendor key lives in ANTHROPIC_AUTH_TOKEN; DEEPSEEK_API_KEY is dropped too, the child does not need it).
@@ -168,4 +200,4 @@ async function main(argv) {
 }
 
 if (require.main === module) main(process.argv.slice(2)).then((c) => { process.exitCode = c; });
-module.exports = { parseExecutorModel, deepseekKey, deepseekEnv, deepseekModels, DEEPSEEK_UNSET, winQuote, buildChild, run, main, DEEPSEEK_MODELS };
+module.exports = { otherVendorSession, providerDefault, saveProviderDefault, MODEL_ID, parseExecutorModel, deepseekKey, deepseekEnv, deepseekModels, DEEPSEEK_UNSET, winQuote, buildChild, run, main, DEEPSEEK_MODELS };

package/core/.formation/bifrost/provider-launch.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 /**
- * `kenaz launch --provider deepseek [--model deepseek-v4-pro|deepseek-flash|...] [claude args...]`
+ * `kenaz launch --provider deepseek [--model deepseek-flash (default)|deepseek-v4-pro|...] [claude args...]`
  * Starts Claude Code with every model request sent to another vendor's Anthropic-compatible endpoint, so
  * Ansuz (/kenaz:Ansuz), its subagents and background requests run on that vendor and use no Claude quota.
  * The key is read from the env or ~/.kenaz/credentials.yaml and set only in the claude child's env: never in
@@ -9,7 +9,7 @@
  */
 const os = require('os');
 const { spawn } = require('child_process');
-const { deepseekKey, deepseekEnv, deepseekModels, DEEPSEEK_UNSET, DEEPSEEK_MODELS, winQuote } = require('./exec');
+const { deepseekKey, deepseekEnv, deepseekModels, DEEPSEEK_UNSET, DEEPSEEK_MODELS, winQuote, providerDefault, saveProviderDefault, MODEL_ID } = require('./exec');
 
 const PROVIDERS = {
   deepseek: {
@@ -17,29 +17,31 @@ const PROVIDERS = {
     keyHelp: 'set DEEPSEEK_API_KEY, or add `deepseek_api_key: <key>` to ~/.kenaz/credentials.yaml',
   },
 };
-const USAGE = 'usage: kenaz launch --provider <' + Object.keys(PROVIDERS).join('|') + '> [--model <id>] [claude args...]';
+const USAGE = 'usage: kenaz launch --provider <' + Object.keys(PROVIDERS).join('|') + '> [--model <id> [--save-default]] [claude args...]';
 
 function parse(argv) {
-  const rest = []; let provider = null; let model = null;
+  const rest = []; let provider = null; let model = null; let save = false;
   for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === '--save-default') { save = true; continue; }
     const m = /^--(provider|model)(?:=(.*))?$/.exec(argv[i]);
     if (!m) { rest.push(argv[i]); continue; }
     const v = m[2] !== undefined ? m[2] : argv[++i];
     if (m[1] === 'provider') provider = v; else model = v;
   }
-  return { rest, provider, model };
+  return { rest, provider, model, save };
 }
 
-/** Child process plan: { bin, args, env }. live = {id: context_window} from the vendor's model list (or null):
- *  a listed id is valid even if it is newer than the built-in list, and its window drives auto-compact.
- *  Throws with a user-facing message. */
+/** Child process plan: { bin, args, env }. Model = --model, else the user's own default (KENAZ_<P>_MODEL or
+ *  ~/.kenaz/config.json, see providerDefault), else the built-in default. live = {id: context_window} from the
+ *  vendor's model list (or null): when known it is the only validation (new vendor models work without a Kenaz
+ *  release); when unreachable any well-formed id is accepted. Throws with a user-facing message. */
 function plan(argv, env = process.env, home = os.homedir(), live = null) {
   const { rest, provider, model } = parse(argv);
   const p = PROVIDERS[provider];
   if (!p) throw new Error((provider ? `unknown provider '${provider}'. ` : '') + USAGE);
-  const id = model || p.models[0];
-  const valid = [...new Set([...p.models, ...Object.keys(live || {})])];
-  if (!valid.includes(id)) throw new Error(`unknown ${provider} model '${id}'; valid: ${valid.join(', ')}`);
+  const id = model || providerDefault(provider, env, home) || p.models[0];
+  if (!MODEL_ID.test(id)) throw new Error(`invalid ${provider} model id '${id}'`);
+  if (live && !(id in live)) throw new Error(`unknown ${provider} model '${id}'; the vendor currently lists: ${Object.keys(live).join(', ')}`);
   const key = p.key(env, home);
   if (!key) throw new Error(`${provider}: no API key (${p.keyHelp})`);
   const childEnv = { ...env, ...p.env(id, key, live && live[id]), CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
@@ -56,6 +58,11 @@ async function main(argv, out = console.log, deps = {}) {
   const live = key ? await (deps.live || p.live)(key) : null;
   let pl;
   try { pl = plan(argv, env, home, live); } catch (e) { out(e.message); return 2; }
+  const { model: asked, save } = parse(argv);
+  if (save) {
+    if (!asked) { out('--save-default needs --model <id>'); return 2; }
+    out(`kenaz launch: ${pl.provider} default model saved: ${pl.model} (${saveProviderDefault(pl.provider, pl.model, home)})`);
+  }
   out(`kenaz launch: Claude Code on ${pl.provider} (${pl.model}, context ${pl.context} tokens); no Claude quota is used in this session`);
   const win = (deps.platform || process.platform) === 'win32'; // claude is a .cmd shim on npm installs
   const child = (deps.spawn || spawn)(win ? [pl.bin, ...pl.args].map(winQuote).join(' ') : pl.bin, win ? [] : pl.args,

package/core/.formation/bifrost/provider-launch.test.js

@@ -25,7 +25,7 @@ test('deepseek: every model slot points at DeepSeek, key only in the child env,
   assert.strictEqual(e.ANTHROPIC_BASE_URL, 'https://api.deepseek.com/anthropic');
   assert.strictEqual(e.ANTHROPIC_AUTH_TOKEN, KEY);
   for (const k of ['ANTHROPIC_MODEL', 'ANTHROPIC_DEFAULT_SONNET_MODEL', 'ANTHROPIC_DEFAULT_OPUS_MODEL', 'CLAUDE_CODE_SUBAGENT_MODEL']) {
-    assert.strictEqual(e[k], 'deepseek-v4-pro', k);
+    assert.strictEqual(e[k], 'deepseek-flash', k);
   }
   assert.strictEqual(e.ANTHROPIC_SMALL_FAST_MODEL, 'deepseek-flash'); assert.strictEqual(e.ANTHROPIC_DEFAULT_HAIKU_MODEL, 'deepseek-flash');
   assert.strictEqual(e.CLAUDE_CODE_MAX_CONTEXT_TOKENS, '1048576', 'V4 window from the built-in table when the live list is unavailable');
@@ -54,7 +54,7 @@ test('control: no key, unknown provider or model -> exit 2 and claude is never s
     [['--provider', 'deepseek'], {}, /no API key/],
     [['--provider', 'nope'], { DEEPSEEK_API_KEY: KEY }, /unknown provider 'nope'/],
     [[], { DEEPSEEK_API_KEY: KEY }, /usage: kenaz launch --provider <deepseek>/],
-    [['--provider', 'deepseek', '--model', 'gpt-x'], { DEEPSEEK_API_KEY: KEY }, /valid: deepseek-v4-pro, deepseek-flash, deepseek-chat, deepseek-reasoner/],
+    [['--provider', 'deepseek', '--model', 'bad id'], { DEEPSEEK_API_KEY: KEY }, /invalid deepseek model id/],
   ]) {
     const calls = [], lines = [];
     const rc = await main(argv, (l) => lines.push(l), { spawn: fakeSpawn(calls), live: async () => null, env, home: home(), platform: 'linux' });
@@ -74,3 +74,27 @@ test('live model list: a newer listed id is accepted and its context window driv
   assert.strictEqual(calls[0].opts.env.CLAUDE_CODE_MAX_CONTEXT_TOKENS, '2097152');
   assert.match(lines[0], /context 2097152 tokens/);
 });
+
+test('model not in the vendor list is refused only when the list is known; unknown list = accepted (no release needed)', async () => {
+  const calls = [], lines = [];
+  const rc = await main(['--provider', 'deepseek', '--model', 'gpt-x'], (l) => lines.push(l), { spawn: fakeSpawn(calls), live: async () => ({ 'deepseek-flash': 1048576 }), env: { DEEPSEEK_API_KEY: KEY }, home: home(), platform: 'linux' });
+  assert.strictEqual(rc, 2); assert.strictEqual(calls.length, 0); assert.match(lines.join(String.fromCharCode(10)), /the vendor currently lists: deepseek-flash/);
+  const calls2 = [];
+  assert.strictEqual(await main(['--provider', 'deepseek', '--model', 'deepseek-v9'], () => {}, { spawn: fakeSpawn(calls2), live: async () => null, env: { DEEPSEEK_API_KEY: KEY }, home: home(), platform: 'linux' }), 0);
+  assert.strictEqual(calls2[0].opts.env.ANTHROPIC_MODEL, 'deepseek-v9');
+});
+
+test('the user picks the default: --save-default writes ~/.kenaz/config.json (other keys kept), env overrides it, --model overrides both', async () => {
+  const h = home(); fs.mkdirSync(path.join(h, '.kenaz'));
+  fs.writeFileSync(path.join(h, '.kenaz', 'config.json'), JSON.stringify({ setupCompleted: true }));
+  const run = async (argv, env = {}) => { const calls = [], lines = []; const rc = await main(argv, (l) => lines.push(l), { spawn: fakeSpawn(calls), live: async () => null, env: { DEEPSEEK_API_KEY: KEY, ...env }, home: h, platform: 'linux' }); return { rc, model: calls[0] && calls[0].opts.env.ANTHROPIC_MODEL, lines }; };
+  assert.strictEqual((await run(['--provider', 'deepseek'])).model, 'deepseek-flash', 'built-in default');
+  const saved = await run(['--provider', 'deepseek', '--model', 'deepseek-v4-pro', '--save-default']);
+  assert.strictEqual(saved.model, 'deepseek-v4-pro'); assert.match(saved.lines.join(String.fromCharCode(10)), /default model saved: deepseek-v4-pro/);
+  const cfg = JSON.parse(fs.readFileSync(path.join(h, '.kenaz', 'config.json'), 'utf8'));
+  assert.strictEqual(cfg.setupCompleted, true); assert.strictEqual(cfg.providers.deepseek.model, 'deepseek-v4-pro');
+  assert.strictEqual((await run(['--provider', 'deepseek'])).model, 'deepseek-v4-pro', 'saved default used');
+  assert.strictEqual((await run(['--provider', 'deepseek'], { KENAZ_DEEPSEEK_MODEL: 'deepseek-chat' })).model, 'deepseek-chat', 'env overrides saved');
+  assert.strictEqual((await run(['--provider', 'deepseek', '--model', 'deepseek-flash'])).model, 'deepseek-flash', '--model overrides');
+  assert.strictEqual((await run(['--provider', 'deepseek', '--save-default'])).rc, 2, '--save-default without --model');
+});

package/core/.formation/tools/__tests__/dispatch-cwd-project.test.js

@@ -0,0 +1,42 @@
+// dispatch.js without --project-path, run from a user's project through the plugin (cwd = that project, ROOT = core):
+// the card and the worktree belong to the cwd project, not the core (repro 2026-10-12: '任務不存在' and a worktree
+// created inside the core repo, leaving Ansuz waiting on a subagent that had no card).
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..', '..', '..');
+const DISPATCH = path.join(ROOT, '.formation', 'tools', 'dispatch.js');
+const git = (cwd, args) => spawnSync('git', ['-c', 'user.name=t', '-c', 'user.email=t@t', ...args], { cwd, encoding: 'utf8' });
+
+function project() {
+  const p = fs.mkdtempSync(path.join(os.tmpdir(), 'dcp-'));
+  git(p, ['init', '-q']); fs.writeFileSync(path.join(p, 'README.md'), 'x'); git(p, ['add', '-A']); git(p, ['commit', '-q', '-m', 'init']);
+  for (const d of ['backlog', 'active', 'done', 'blocked', 'cancel']) fs.mkdirSync(path.join(p, '.kenaz', 'tasks', d), { recursive: true });
+  fs.writeFileSync(path.join(p, '.kenaz', 'project.yaml'), 'name: dcp\n');
+  fs.writeFileSync(path.join(p, '.kenaz', 'tasks', 'backlog', 'TASK_7201_x.yaml'),
+    'id: TASK_7201\ntitle: "Unique card title 7201"\nstatus: backlog\npriority: low\nrigor: low\nrequirements: ["r"]\nacceptance_criteria: ["a"]\nscope_paths: [x.txt]\n');
+  return p;
+}
+
+const env = () => { const e = { ...process.env }; for (const k of ['CLAUDE_PROJECT_DIR', 'KENAZ_PROVIDER', 'ANTHROPIC_BASE_URL', 'CODEX_SESSION_ID', 'CODEX_THREAD_ID']) delete e[k]; return e; };
+
+test('from a user project without --project-path: the card is found and isolation targets that project', () => {
+  const p = project();
+  const r = spawnSync(process.execPath, [DISPATCH, '--skill=do', '--task=TASK_7201', '--dispatch-mode=subagent', '--dry-run'], { cwd: p, env: env(), encoding: 'utf8' });
+  assert.strictEqual(r.status, 0, r.stderr);
+  assert.doesNotMatch(r.stderr, /任務不存在/);
+  const j = JSON.parse(r.stdout);
+  assert.match(j.promptText, /Unique card title 7201/);
+  assert.match(r.stderr, new RegExp('cross-project detected .*' + path.basename(p)));
+});
+
+test('control: in the core repo itself nothing changes (same-project Agent worktree)', () => {
+  const r = spawnSync(process.execPath, [DISPATCH, '--skill=do', '--task=TASK_2376', '--dispatch-mode=subagent', '--dry-run'], { cwd: ROOT, env: env(), encoding: 'utf8' });
+  assert.strictEqual(r.status, 0, r.stderr);
+  const j = JSON.parse(r.stdout);
+  assert.strictEqual(j.isolation.mode, 'agent_tool_worktree');
+});

package/core/.formation/tools/__tests__/subagent-executor.test.js

@@ -139,8 +139,9 @@ test('subagent set: unknown codex id and unknown prefix are refused with the val
   const p = tmp(t, 'dm-');
   const a = dmRun(['set', 'codex:nope'], p);
   assert.equal(a.code, 1); assert.match(a.out, /unknown codex model 'nope'.*codex:gpt-5\.6-sol/);
-  const b = dmRun(['set', 'deepseek:gpt'], p);
-  assert.equal(b.code, 1); assert.match(b.out, /deepseek:deepseek-chat, deepseek:deepseek-reasoner/);
+  // any well-formed deepseek id is accepted (a new vendor model needs no Kenaz release); a malformed one is refused
+  const b = dmRun(['set', 'deepseek:bad id'], p);
+  assert.equal(b.code, 1); assert.match(b.out, /invalid deepseek model id/);
   const c = dmRun(['set', 'gemini:pro'], p);
   assert.equal(c.code, 1); assert.match(c.out, /unknown executor prefix 'gemini:'.*codex:<id>, deepseek:<model>/);
   assert.equal(fs.existsSync(path.join(p, '.kenaz', 'dashboard-models.json')), false);
@@ -178,14 +179,14 @@ test('dispatch under KENAZ_PROVIDER: Claude id -> executor adapter claude, no ag
   fs.mkdirSync(path.join(sb, '.kenaz', 'locks'), { recursive: true });
   fs.writeFileSync(path.join(sb, 'README.md'), 'x'); fs.writeFileSync(path.join(sb, '.gitignore'), '.formation/worktrees/\n.kenaz/\n');
   git(sb, ['init', '-q']); git(sb, ['add', '-A']); git(sb, ['commit', '-q', '--no-verify', '-m', 'init']);
-  const base = { ...process.env }; delete base.CLAUDE_PROJECT_DIR; delete base.CODEX_SESSION_ID; delete base.CODEX_THREAD_ID; delete base.KENAZ_PROVIDER;
+  const base = { ...process.env }; delete base.CLAUDE_PROJECT_DIR; delete base.CODEX_SESSION_ID; delete base.CODEX_THREAD_ID; delete base.KENAZ_PROVIDER; delete base.ANTHROPIC_BASE_URL;
   const sh = (script, args, env) => spawnSync(process.execPath, [script, ...args], { env, encoding: 'utf8', windowsHide: true, cwd: ROOT });
   const mk = sh(TASKAPI, ['--project-path', sb, 'create', '--title', 't2430', '--description', 'd', '--scope-paths', 'zzz/a.js', '--requirements', 'r1',
     '--acceptance-criteria', 'a1', '--acceptance-criteria', 'a2', '--acceptance-criteria', 'a3', '--technical-notes', 't1', '--technical-notes', 't2', '--force'], base);
   const id = ((mk.stdout || '').match(/TASK_\d+/) || [])[0]; assert.ok(id, mk.stdout + mk.stderr);
-  const disp = (model, provider) => {
+  const disp = (model, provider, extra = {}) => {
     fs.writeFileSync(path.join(sb, '.kenaz', 'dashboard-models.json'), JSON.stringify({ dispatchModel: model }));
-    const env = { ...base, ...(provider ? { KENAZ_PROVIDER: provider } : {}), DEEPSEEK_API_KEY: KEY };
+    const env = { ...base, ...(provider ? { KENAZ_PROVIDER: provider } : {}), DEEPSEEK_API_KEY: KEY, ...extra };
     const r = sh(DISPATCH, ['--skill=do', `--task=${id}`, '--dispatch-mode=subagent', '--project-path', sb, '--force'], env);
     return { r, j: (() => { try { return JSON.parse(r.stdout); } catch { return null; } })() };
   };
@@ -202,6 +203,11 @@ test('dispatch under KENAZ_PROVIDER: Claude id -> executor adapter claude, no ag
   const none = disp('claude-sonnet-5-5', null); // control: no KENAZ_PROVIDER = byte-for-byte as before
   assert.equal(none.j.executor, undefined);
   assert.deepEqual(Object.keys(none.j.agentParams), ['description', 'model']); assert.equal(none.j.agentParams.model, 'sonnet');
+  // a session launched before KENAZ_PROVIDER existed, or with the env set by hand, is recognised by its base URL
+  const byUrl = disp('claude-opus-5', null, { ANTHROPIC_BASE_URL: 'https://api.deepseek.com/anthropic' });
+  assert.equal(byUrl.j.executor.adapter, 'claude'); assert.equal(byUrl.j.agentParams, undefined);
+  const official = disp('claude-opus-5', null, { ANTHROPIC_BASE_URL: 'https://api.anthropic.com' }); // control
+  assert.equal(official.j.executor, undefined); assert.equal(official.j.agentParams.model, 'opus');
 });
 
 test('dispatch: executor block for codex:/deepseek:, byte-for-byte agentParams for a Claude id', (t) => {
@@ -210,7 +216,7 @@ test('dispatch: executor block for codex:/deepseek:, byte-for-byte agentParams f
   fs.mkdirSync(path.join(sb, '.kenaz', 'locks'), { recursive: true });
   fs.writeFileSync(path.join(sb, 'README.md'), 'x'); fs.writeFileSync(path.join(sb, '.gitignore'), '.formation/worktrees/\n.kenaz/\n');
   git(sb, ['init', '-q']); git(sb, ['add', '-A']); git(sb, ['commit', '-q', '--no-verify', '-m', 'init']);
-  const env = { ...process.env, DEEPSEEK_API_KEY: KEY }; delete env.CLAUDE_PROJECT_DIR; delete env.CODEX_SESSION_ID; delete env.CODEX_THREAD_ID;
+  const env = { ...process.env, DEEPSEEK_API_KEY: KEY }; delete env.ANTHROPIC_BASE_URL; delete env.KENAZ_PROVIDER; delete env.CLAUDE_PROJECT_DIR; delete env.CODEX_SESSION_ID; delete env.CODEX_THREAD_ID;
   const sh = (script, args) => spawnSync(process.execPath, [script, ...args], { env, encoding: 'utf8', windowsHide: true, cwd: ROOT });
   const mk = sh(TASKAPI, ['--project-path', sb, 'create', '--title', 't2422', '--description', 'd', '--scope-paths', 'zzz/a.js', '--requirements', 'r1',
     '--acceptance-criteria', 'a1', '--acceptance-criteria', 'a2', '--acceptance-criteria', 'a3', '--technical-notes', 't1', '--technical-notes', 't2', '--force']);

package/core/.formation/tools/dispatch.js

@@ -487,6 +487,15 @@ function samePath(a, b) {
  * @param {boolean|null} [opts.useWorktreeOverride] - dispatch-time toggle (CLI --use-worktree)
  * @returns {{ isCrossProject: boolean, mode: string, useWorktree: boolean, source: string, verifyOffline: string|null }}
  */
+/** The Kenaz project around the cwd (CLAUDE_PROJECT_DIR first), or null when it is the core itself / none. */
+function cwdProject(start = process.env.CLAUDE_PROJECT_DIR || process.cwd()) {
+  let root = null;
+  try { root = require('../../.claude/hooks/_project-guard').findProjectRoot(start); } catch { return null; }
+  if (!root) return null;
+  const norm = (p) => path.resolve(p).replace(/\\/g, '/').toLowerCase();
+  return norm(root) === norm(ROOT) ? null : root;
+}
+
 function resolveDispatchIsolation({ projectPath = null, useWorktreeOverride = null } = {}) {
   // TASK_1710 semantics: samePath, not raw string compare (separator/case).
   const isCrossProject = !!(projectPath && !samePath(projectPath, ROOT));
@@ -829,7 +838,11 @@ Sub-agent dispatch (Ansuz billing-aware path):
   const formation = getArg('--formation') || 'unit';
   const skill = getArg('--skill');
   const task = getArg('--task');
-  const projectPath = getArg('--project-path');
+  // No --project-path: the Kenaz project around the cwd, when that is not the core itself. Plugin users run
+  // dispatch.js from their own project through core-resolve, so ROOT is the core: before this, the card was looked
+  // up in the core ("任務不存在") and the worktree was created in the core repo, leaving Ansuz waiting on a
+  // subagent with no card in the wrong repo (repro 2026-10-12).
+  const projectPath = getArg('--project-path') || cwdProject();
   const dryRun = args.includes('--dry-run');
   const dispatchModeCli = getArg('--dispatch-mode');
   // TASK_1998 R3: subagent-path model override — wins over dashboard
@@ -1065,7 +1078,9 @@ async function getSubagentDispatchParams(options) {
   }
   // TASK_2430: in a `kenaz launch` session the Agent tool only reaches the other vendor, so a Claude model
   // id runs as a `claude -p` executor on the user's own Claude login instead.
-  if (!isCodex && !exec && process.env.KENAZ_PROVIDER && process.env.KENAZ_PROVIDER !== 'anthropic') {
+  // A session started before KENAZ_PROVIDER existed, or with the env set by hand, is recognised by its base URL.
+  const otherVendor = require('../bifrost/exec').otherVendorSession(process.env);
+  if (!isCodex && !exec && otherVendor) {
     const fam = translateModelForAgentTool(rawModel).model;
     if (fam) exec = { adapter: 'claude', id: fam };
   }

package/core/.specialist/Ansuz/RULES.md

@@ -70,6 +70,11 @@ the real defect BEFORE carding or dispatching.
   opus). dispatch.js moves the card to active.
 - The dispatch model is the project's setting: `kenaz subagent` (or /kenaz subagent) shows it per rigor, `kenaz subagent set <id> [--rigor r]`
   changes it (writes .kenaz/dashboard-models.json). Your own model is the user's session model (/model).
+- When the user names a model in conversation, act on it yourself (user decision 2026-10-12), never on your own
+  judgment (2026-09-22): for one card ("use opus for this", "let deepseek do the frontend") pass
+  `--dispatch-model <id>` to dispatch.js (claude-opus-5-5, opus, codex:<id>, deepseek:<model>) and leave the setting
+  alone; for "from now on / always" run `kenaz subagent set <id> [--rigor r]` (core repo:
+  `node .formation/tools/dispatch-model.js set <id> [--rigor r]`) and say what changed. No model named = the setting.
 - Executor model (`kenaz subagent set codex:<id>` or `deepseek:<model>`): dispatch.js prints an `executor` block instead of
   agentParams. Run `executor.command` with Bash run_in_background, wait for the completion notice, read `executor.resultFile`
   (ok, exitCode, lastMessage, commits; `no commits` = failure), then verify and merge `executor.branchName` as usual.

package/core/KENAZ_CORE_VERSION

@@ -1 +1 @@
-0.3.16
+0.3.18

package/core/dev/scripts/run-rust-tests.js

@@ -115,6 +115,24 @@ function renderCompilerErrors(stdoutText, maxErrors = 20) {
   return out;
 }
 
+// The shared verify cache only grows (incremental builds are never pruned): it reached 551 GB by 2026-10-12.
+// Every KENAZ_VERIFY_CLEAN_DAYS (default 7) days run `cargo clean` on it first. A stamp file, not a size walk:
+// walking hundreds of GB takes minutes. cargo clean takes cargo's own lock, so a running build is waited for.
+const CLEAN_STAMP = '.kenaz-last-clean';
+function periodicClean(targetDir, env, { now = Date.now(), run = spawnSync, log = (m) => process.stderr.write(m) } = {}) {
+  const days = Number(env.KENAZ_VERIFY_CLEAN_DAYS || 7);
+  const stamp = path.join(targetDir, CLEAN_STAMP);
+  let last = 0;
+  try { last = fs.statSync(stamp).mtimeMs; } catch (_) { /* never stamped */ }
+  const touch = () => { try { fs.mkdirSync(targetDir, { recursive: true }); fs.writeFileSync(stamp, new Date(now).toISOString() + '\n'); } catch (_) { /* best effort */ } };
+  if (!last) { touch(); return 'stamped'; } // first run after this change: start the clock, do not wipe
+  if (!(days > 0) || now - last < days * 86400000) return 'fresh';
+  log(`[run-rust-tests] verify cache last cleaned ${Math.round((now - last) / 86400000)} days ago: cargo clean (one full rebuild follows)\n`);
+  const r = run('cargo', ['clean'], { cwd: crateDir, env, encoding: 'utf8', shell: false });
+  touch();
+  return r && r.status === 0 ? 'cleaned' : 'clean-failed';
+}
+
 function main() {
   const exeArgs = buildExeArgs(process.argv.slice(2));
 
@@ -131,6 +149,8 @@ function main() {
     );
   }
 
+  if (env.CARGO_TARGET_DIR === verifyTargetDir()) periodicClean(env.CARGO_TARGET_DIR, env);
+
   // 1. Build the lib test binary without running it.
   const build = spawnSync(
     'cargo',
@@ -204,4 +224,4 @@ if (require.main === module) {
   main();
 }
 
-module.exports = { parseArgs, buildExeArgs, renderCompilerErrors };
+module.exports = { parseArgs, buildExeArgs, renderCompilerErrors, periodicClean, CLEAN_STAMP };

package/core/dev/scripts/run-rust-tests.test.js

@@ -152,3 +152,20 @@ test('renderCompilerErrors: cap applied -> first N kept + omitted-count note', (
     'error[E0001]: synthetic error 1\n... 2 more errors omitted\n'
   );
 });
+
+test('periodicClean: first run only stamps; fresh = nothing; older than N days = cargo clean then restamp', () => {
+  const fs = require('node:fs'), os = require('node:os'), path = require('node:path');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rrt-clean-'));
+  const calls = [];
+  const run = (cmd, args) => { calls.push([cmd, ...args].join(' ')); return { status: 0 }; };
+  const t0 = Date.parse('2026-10-01T00:00:00Z');
+  assert.equal(mod.periodicClean(dir, {}, { now: t0, run, log: () => {} }), 'stamped');
+  assert.deepEqual(calls, [], 'never wipes on the first run');
+  const stamp = path.join(dir, mod.CLEAN_STAMP);
+  fs.utimesSync(stamp, t0 / 1000, t0 / 1000);
+  assert.equal(mod.periodicClean(dir, {}, { now: t0 + 6 * 86400000, run, log: () => {} }), 'fresh');
+  assert.deepEqual(calls, []);
+  assert.equal(mod.periodicClean(dir, {}, { now: t0 + 8 * 86400000, run, log: () => {} }), 'cleaned');
+  assert.deepEqual(calls, ['cargo clean']);
+  assert.equal(mod.periodicClean(dir, { KENAZ_VERIFY_CLEAN_DAYS: '30' }, { now: t0 + 10 * 86400000, run, log: () => {} }), 'fresh', 'restamped, and the window is configurable');
+});

package/core/plugins/kenaz/commands/Ansuz.md

@@ -14,6 +14,7 @@ ARGUMENTS 含 `[專案: X]` 或 `--project-path X` → PROJECT_PATH = X，下方
 ## 工作方式
 - **自己做**：約 30 行內的小修正 → 直接改，跑最近的測試，提交。
 - **開卡派工**（中型、可平行、高風險）：`kenaz_task_create` 開卡（requirements、acceptance criteria、scope paths）→ `node "${CLAUDE_PLUGIN_ROOT}/hooks/core-resolve.js" .formation/tools/dispatch.js --skill=do --task=TASK_XXX --dispatch-mode=subagent` → `promptText` 給 subagent、`agentParams` 照用（不換模型）；輸出是 `executor` 區塊時照 RULES.md 的 Dispatch 執行。subagent 在 worktree commit，你驗證後合併。
+- 用戶指定 model 就照做：單張卡加 `--dispatch-model <id>`（不改設定）；「之後都用」才 `kenaz subagent set <id> [--rigor r]`。沒指定就照設定，不自己換。
 - 開卡前確認 scope 與驗收條件對準真正的問題。
 
 ## 驗證（合併前，強度跟風險相稱）

package/core/plugins/kenaz/hooks/hooks.json

@@ -1,28 +1,152 @@
 {
   "hooks": {
-    "SessionStart": [{ "hooks": [
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" session-start" },
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" guidance" }
-    ] }],
-    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" prompt-runner" }] }],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" session-start"
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" guidance"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" prompt-runner"
+          }
+        ]
+      }
+    ],
     "PreToolUse": [
-      { "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] },
-      { "matcher": "Bash", "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" synapse-first" }] },
-      { "matcher": "mcp__kenaz-dashboard__.*|Read|Edit|Write", "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" memory-guard" }] }
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" synapse-first"
+          }
+        ]
+      },
+      {
+        "matcher": "mcp__kenaz-dashboard__.*|Read|Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" memory-guard"
+          }
+        ]
+      },
+      {
+        "matcher": "Agent|Task",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" vendor-agent-guard"
+          }
+        ]
+      }
     ],
     "PostToolUse": [
-      { "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] },
-      { "matcher": "TaskCreate|TaskUpdate", "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" task-bridge" }] }
-    ],
-    "PostToolUseFailure": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "Notification": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "SubagentStart": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "SubagentStop": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "SessionEnd": [{ "hooks": [{ "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" }] }],
-    "Stop": [{ "hooks": [
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post" },
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" session-stop" },
-      { "type": "command", "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" autonomy-stop" }
-    ] }]
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      },
+      {
+        "matcher": "TaskCreate|TaskUpdate",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" task-bridge"
+          }
+        ]
+      }
+    ],
+    "PostToolUseFailure": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "Notification": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" flow-post"
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" session-stop"
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/kenaz-hook.js\" autonomy-stop"
+          }
+        ]
+      }
+    ]
   }
 }

package/core/plugins/kenaz/hooks/kenaz-hook.js

@@ -31,6 +31,7 @@ const HOOKS = {
   'autonomy-stop':  { kind: 'script', file: 'autonomy-stop.js', call: 'main', minMode: 'full' },
   'synapse-first':  { kind: 'script', file: 'synapse-first-investigation.js', minMode: 'full' },
   'memory-guard':   { kind: 'script', file: 'memory-guard.js', call: 'main', minMode: 'full' },
+  'vendor-agent-guard': { kind: 'script', file: 'vendor-agent-guard.js', call: 'main', minMode: 'assist' },
   'task-bridge':    { kind: 'script', file: 'task-bridge.js', minMode: 'assist' },
 };
 

package/core/plugins/kenaz/scripts/ygg.js

@@ -76,6 +76,10 @@ function buildStatus(cfg, relay, peer) {
     waiting_mail: peer && typeof peer.waiting_count === 'number' ? peer.waiting_count : null,
     undeliverable_mail: peer && typeof peer.undeliverable_count === 'number' ? peer.undeliverable_count : null,
     // TASK_2380: real delivery mode per live session (push | pull-on-prompt | none), never a bare 'enabled'.
+    // TASK_2436: when the poller last reached the relay, and the relay's same-name warning.
+    last_poll_at: peer && peer.last_poll_at ? peer.last_poll_at : null,
+    last_poll_ok: peer && typeof peer.last_poll_ok === 'boolean' ? peer.last_poll_ok : null,
+    same_name_warning: peer && peer.same_name_warning ? peer.same_name_warning : '',
     delivery_mode: peer && peer.delivery_mode ? peer.delivery_mode : 'unknown',
     delivery_note: peer && peer.delivery_note ? peer.delivery_note : '',
     sessions: peer && Array.isArray(peer.sessions) ? peer.sessions : [],
@@ -95,6 +99,7 @@ function renderStatus(s) {
     'Pending mail:     ' + (s.pending_mail == null ? 'unknown' : s.pending_mail),
     'Waiting for a session: ' + (s.waiting_mail == null ? 'unknown' : s.waiting_mail) + ' (stored on this node, readable)',
     'Undeliverable:    ' + (s.undeliverable_mail == null ? 'unknown' : s.undeliverable_mail),
+    'Last poll:        ' + (s.last_poll_at ? s.last_poll_at + (s.last_poll_ok === false ? ' (FAILED)' : ' (ok)') : 'none yet'),
     'Delivery:         ' + s.delivery_mode + (s.sessions.length ? '' : ' (no live sessions)'),
   ];
   for (const x of s.sessions) L.push('  - ' + x.agent + ' ' + String(x.session_id).slice(0, 8) + ': ' + x.delivery_mode);
@@ -102,6 +107,7 @@ function renderStatus(s) {
     L.push('', 'New team key (shown once, save it): ' + s.created.key + (s.created.team_name ? '  [' + s.created.team_name + ']' : ''));
     L.push('share with teammates: kenaz ygg join ' + s.created.key);
   }
+  if (s.same_name_warning) L.push('WARNING:          ' + s.same_name_warning);
   if (s.room_warning) L.push('WARNING:          ' + s.room_warning);
   if (s.delivery_note) L.push('Note:             ' + s.delivery_note);
   return L.join('\n');

package/lib/cli.js

@@ -35,8 +35,9 @@ function installer() {
 
 /** A core module from the installed core, else this checkout; null when neither is there. */
 function coreModule(p, ...rel) {
-  // installed core, then the core bundled in this npm package (npx before `kenaz install`), then the repo checkout
-  for (const f of [path.join(p.core, ...rel), path.join(PKG_ROOT, 'core', ...rel), path.join(__dirname, '..', '..', '..', ...rel)]) {
+  // installed core, then the repo checkout (dev: live source), then the core bundled in this npm package (npx
+  // before `kenaz install`). Bundled before repo ran a stale prepack copy from a dev checkout (2026-10-12).
+  for (const f of [path.join(p.core, ...rel), path.join(__dirname, '..', '..', '..', ...rel), path.join(PKG_ROOT, 'core', ...rel)]) {
     if (fs.existsSync(f)) return require(f);
   }
   return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kenaz",
-  "version": "0.3.16",
+  "version": "0.3.18",
   "description": "Install Kenaz (plugin, hooks, kenaz-server) for Claude Code and Codex: npx kenaz install",
   "bin": {
     "kenaz": "bin/kenaz.js"
@@ -20,11 +20,11 @@
     "test": "node --test lib/cli.test.js"
   },
   "optionalDependencies": {
-    "@kenazai/server-darwin-arm64": "0.3.16",
-    "@kenazai/server-darwin-x64": "0.3.16",
-    "@kenazai/server-linux-arm64": "0.3.16",
-    "@kenazai/server-linux-x64": "0.3.16",
-    "@kenazai/server-win32-x64": "0.3.16"
+    "@kenazai/server-darwin-arm64": "0.3.18",
+    "@kenazai/server-darwin-x64": "0.3.18",
+    "@kenazai/server-linux-arm64": "0.3.18",
+    "@kenazai/server-linux-x64": "0.3.18",
+    "@kenazai/server-win32-x64": "0.3.18"
   },
   "license": "UNLICENSED",
   "repository": {