muonroi-cli 1.8.4 → 1.8.5

package/dist/src/council/llm.js

@@ -1,18 +1,24 @@
 import * as fs from "node:fs";
-import { generateText, stepCountIs } from "ai";
+import { generateText, stepCountIs, streamText } from "ai";
 import { getDefaultEEClient } from "../ee/intercept.js";
 import { emitMatches } from "../ee/render.js";
+import { getMcpKey } from "../mcp/mcp-keychain.js";
 import { buildMcpToolSet } from "../mcp/runtime.js";
-import { getProviderCapabilities } from "../providers/capabilities.js";
+import { getModelInfo } from "../models/registry.js";
+import { getProviderCapabilities, resolveTemperature } from "../providers/capabilities.js";
 import { loadKeyForProvider, ProviderKeyMissingError } from "../providers/keychain.js";
 import { createProviderFactoryAsync, detectProviderForModel, resolveModelRuntime } from "../providers/runtime.js";
+import { statusBarStore } from "../state/status-bar-store.js";
+import { recordUsageEvent } from "../storage/index.js";
 import { createBuiltinTools as createTools } from "../tools/registry.js";
 import { appendCostLog } from "../usage/cost-log.js";
 import { projectCostUSD } from "../usage/estimator.js";
 import { withDeadlineRace, withTimeoutSignal } from "../utils/llm-deadline.js";
+import { logger } from "../utils/logger.js";
 import { loadMcpServers } from "../utils/settings.js";
 import { withVisibleRetry } from "../utils/visible-retry.js";
 import { buildResearchSystemPrompt } from "./prompts.js";
+import { stripThinkBlocks } from "./strip-think.js";
 /**
  * Resolve a provider factory for a council sub-call, OAuth-aware.
  *
@@ -186,6 +192,62 @@ function logCouncilCost(args) {
     }).catch(() => undefined);
     return usage;
 }
+/**
+ * Record a council LLM call into the `usage_events` table with source="council".
+ *
+ * This is the SINGLE source of truth for council usage accounting: it fires from
+ * inside every council generate/debate/research call so ALL council entry points
+ * (the /council slash path, auto-council, and every /ideal phase — clarifier,
+ * research, generate, sprint) land in usage_events. Before this existed, only
+ * the loop-driver's `runDebate` call site externally wrapped usage recording, so
+ * `runCouncilV2` (/council + auto-council) and the non-debate /ideal phases never
+ * recorded — their token cost was invisible to session totals, the StatusBar,
+ * `usage forensics`, and the cost caps (root cause of session f24c28b6dcb3:
+ * council ran but produced 0 source="council" usage_events).
+ *
+ * Best-effort: a null sessionId (no chat session FK) or a DB failure must never
+ * break the council run, but per the No-Silent-Catch rule we log the failure.
+ */
+export function recordCouncilUsage(sessionId, modelId, usage) {
+    if (!sessionId)
+        return;
+    try {
+        recordUsageEvent(sessionId, "council", modelId, {
+            inputTokens: usage.inputTokens,
+            outputTokens: usage.outputTokens,
+            cacheReadTokens: usage.cachedInputTokens,
+        });
+        // Mirror council billing into the live StatusBar so cache-hit% / tokens /
+        // cost reflect the WHOLE session (council calls have ~0 cache; excluding
+        // them overstated the message-only cache ratio — session f24c28b6dcb3).
+        // ONLY the five cumulative billing counters — NEVER ctx_tokens/ctx_pct/
+        // model/provider, which describe the current MAIN-conversation call and
+        // would be clobbered by a small council sub-call.
+        const totalInput = usage.inputTokens;
+        const output = usage.outputTokens;
+        const cacheRead = usage.cachedInputTokens;
+        const info = getModelInfo(modelId);
+        const priceIn = info?.inputPrice ?? 0;
+        const priceCached = info?.cachedInputPrice ?? priceIn * 0.1;
+        const priceOut = info?.outputPrice ?? 0;
+        const nonCachedInput = Math.max(0, totalInput - cacheRead);
+        const turnCostMicros = nonCachedInput * priceIn + cacheRead * priceCached + output * priceOut;
+        const prev = statusBarStore.getState();
+        statusBarStore.setState({
+            in_tokens: prev.in_tokens + totalInput,
+            out_tokens: prev.out_tokens + output,
+            cache_read_tokens: (prev.cache_read_tokens ?? 0) + cacheRead,
+            session_usd: prev.session_usd + turnCostMicros / 1_000_000,
+        });
+    }
+    catch (err) {
+        logger.error("storage", "recordUsageEvent(council) failed — token cost not accounted", {
+            sessionId,
+            modelId,
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
 function getMockLlm() {
     // biome-ignore lint/suspicious/noExplicitAny: intentionally untyped global access
     return globalThis.__muonroiMockLlm ?? null;
@@ -209,6 +271,87 @@ const COUNCIL_LLM_TIMEOUT_MS = (() => {
 // withTimeoutSignal + withDeadlineRace moved to ../utils/llm-deadline.js so all
 // pre-flight LLM call sites (council, debate-planner, scope-ceiling) share one
 // implementation. Imported at the top of this file.
+/**
+ * Run a single-shot LLM call over the STREAMING transport and collect the full
+ * result, returning a `generateText`-shaped object ({ text, usage, finishReason,
+ * reasoningText }).
+ *
+ * Why stream a one-shot generate? The OpenAI codex/oauth endpoint
+ * (chatgpt.com/backend-api/codex/responses, used by gpt-5.*-codex subscription
+ * auth) HARD-REJECTS non-streaming requests with 400 `{"detail":"Stream must be
+ * set to true"}`. `generateText` issues a non-stream POST, so every council
+ * sub-task that ran through it (leader round evaluation, clarify, spec
+ * synthesis, running summary) failed on a codex session — surfacing to the user
+ * as the opaque "Decision: evaluation unavailable" round card (diagnosed from
+ * session 8191ecaee149: gpt-5.4-mini → codex/responses → "Stream must be set to
+ * true"). The panel debate never hit this because it streams. Streaming is the
+ * universal transport (every provider + the whole TUI already use it), so
+ * collecting a streamed result fixes codex without special-casing it.
+ *
+ * A provider `error` part is re-thrown so the caller's retry / cross-provider
+ * fallback treats it as a failure exactly as a thrown `generateText` did.
+ *
+ * Also used by `debate()` (the panel pair turns) with the tiny verification
+ * toolset: pass `tools`/`stopWhen`/`prepareStep` and the collected `toolCalls`
+ * (toolName + input + matched result) come back in the same shape the old
+ * `generateText` result exposed. A debater on the codex/oauth endpoint hit the
+ * exact same non-stream 400 as the eval path — streaming fixes it uniformly.
+ */
+async function collectStreamText(args) {
+    const hasTools = !!args.tools && Object.keys(args.tools).length > 0;
+    const result = streamText({
+        model: args.model,
+        system: args.system,
+        prompt: args.prompt,
+        maxOutputTokens: args.maxOutputTokens,
+        maxRetries: 0,
+        ...(args.temperature === undefined ? {} : { temperature: args.temperature }),
+        ...(args.providerOptions ? { providerOptions: args.providerOptions } : {}),
+        ...(hasTools ? { tools: args.tools, stopWhen: args.stopWhen, prepareStep: args.prepareStep } : {}),
+        abortSignal: args.abortSignal,
+    });
+    let text = "";
+    let reasoningText = "";
+    let usage;
+    let finishReason;
+    const toolCalls = [];
+    const byId = new Map();
+    for await (const part of result.fullStream) {
+        switch (part.type) {
+            case "text-delta":
+                text += part.text ?? "";
+                break;
+            case "reasoning-delta":
+                reasoningText += part.text ?? "";
+                break;
+            case "tool-call": {
+                const p = part;
+                const tc = { toolName: p.toolName, input: p.input };
+                byId.set(p.toolCallId, tc);
+                toolCalls.push(tc);
+                break;
+            }
+            case "tool-result": {
+                const p = part;
+                const tc = byId.get(p.toolCallId);
+                if (tc)
+                    tc.result = p.output;
+                break;
+            }
+            case "finish":
+                usage = part.totalUsage ?? part.usage;
+                finishReason = part.finishReason;
+                break;
+            case "error": {
+                const raw = part.error;
+                throw raw instanceof Error ? raw : new Error(String(raw));
+            }
+            default:
+                break;
+        }
+    }
+    return { text, usage, finishReason, reasoningText: reasoningText || undefined, toolCalls };
+}
 export function createCouncilLLM(bash, mode, sessionId, stats) {
     return {
         async generate(modelId, system, prompt, maxTokens = 4096, onUsage, signal) {
@@ -216,7 +359,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
             if (mock) {
                 stats.calls++;
                 const result = await mock.complete({ prompt });
-                return result.text;
+                return stripThinkBlocks(result.text);
             }
             const providerId = detectProviderForModel(modelId);
             const factory = await resolveCouncilFactory(providerId);
@@ -228,18 +371,23 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
             // eval) was a no-op — the call ran to completion or hit the 5-min timeout.
             const { signal: timedSignal, cleanup: cleanupTimeout } = withTimeoutSignal(signal, COUNCIL_LLM_TIMEOUT_MS);
             try {
-                const result = await withDeadlineRace(() => withVisibleRetry(() => generateText({
+                const result = await withDeadlineRace(() => withVisibleRetry(() => 
+                // Stream + collect (NOT generateText). The codex/oauth endpoint
+                // 400s on non-stream requests ("Stream must be set to true"),
+                // which nulled every council eval/clarify/synthesis on a codex
+                // session → the opaque "evaluation unavailable" card. See
+                // collectStreamText's doc for the full diagnosis.
+                collectStreamText({
                     model: runtime.model,
                     system,
                     prompt,
                     maxOutputTokens: maxTokens,
-                    temperature: 0.7,
-                    // Visible retry (src/utils/visible-retry.ts) replaces SDK's silent
-                    // exponential backoff (2,4,8,16,32s). When SiliconFlow rate-limits
-                    // with 429, user now sees "[retry] rate-limited (429) — waiting Xs
-                    // before attempt N/6" instead of a 62s blank window that looks hung.
-                    maxRetries: 0,
-                    ...(runtime.providerOptions ? { providerOptions: runtime.providerOptions } : {}),
+                    // Never hardcode temperature: some upstreams (Moonshot/Kimi via
+                    // opencode-go) reject any value but their pinned one, which
+                    // failed every clarify/spec call on a Kimi session. resolveTemperature
+                    // omits the field or clamps to the model's fixed value.
+                    temperature: resolveTemperature(providerId, runtime.modelInfo, 0.7),
+                    providerOptions: runtime.providerOptions,
                     abortSignal: timedSignal,
                 }), { label: "council.generate" }), COUNCIL_LLM_TIMEOUT_MS + 5_000, "council.generate", signal);
                 cleanupTimeout();
@@ -255,6 +403,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     durationMs: durMs,
                 });
                 onUsage?.(callUsage);
+                recordCouncilUsage(sessionId, modelId, callUsage);
                 writeDebugRecord({
                     ts: new Date().toISOString(),
                     kind: "generate",
@@ -273,7 +422,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     finishReason: result.finishReason,
                     usage: result.usage,
                 });
-                return result.text;
+                return stripThinkBlocks(result.text);
             }
             catch (err) {
                 cleanupTimeout();
@@ -300,7 +449,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
             if (mock) {
                 stats.calls++;
                 const result = await mock.complete({ prompt });
-                return { text: result.text, toolCalls: [] };
+                return { text: stripThinkBlocks(result.text), toolCalls: [] };
             }
             const providerId = detectProviderForModel(modelId);
             const factory = await resolveCouncilFactory(providerId);
@@ -351,10 +500,26 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
             const t0 = Date.now();
             const { signal: timedSignal, cleanup: cleanupTimeout } = withTimeoutSignal(signal, COUNCIL_LLM_TIMEOUT_MS);
             try {
-                const result = await withDeadlineRace(() => withVisibleRetry(() => generateText({
+                const result = await withDeadlineRace(() => withVisibleRetry(() => 
+                // Stream + collect (NOT generateText). A debater on the codex/oauth
+                // endpoint hits the same non-stream 400 ("Stream must be set to
+                // true") that nulled the eval path; streaming is uniform across
+                // providers. Tools (when the tier + circuit breaker allow) ride
+                // through with stepCountIs(2) + the same sanitizeHistory prepareStep.
+                collectStreamText({
                     model: runtime.model,
                     system,
                     prompt,
+                    // Reasoning models (deepseek-v4-*, anthropic thinking) consume part
+                    // of this budget on reasoning_tokens before producing user-visible
+                    // text. E2E showed 2048 caused finishReason=length on 3KB debate
+                    // prompts. 6144 leaves ~4000 tokens for text after typical reasoning
+                    // overhead and avoids cuts mid-thought.
+                    maxOutputTokens: 6144,
+                    // See generate(): capability-aware temperature (omit / clamp).
+                    temperature: resolveTemperature(providerId, runtime.modelInfo, 0.7),
+                    providerOptions: runtime.providerOptions,
+                    abortSignal: timedSignal,
                     ...(verificationTools && Object.keys(verificationTools).length > 0
                         ? {
                             tools: verificationTools,
@@ -367,20 +532,6 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                             },
                         }
                         : {}),
-                    // Reasoning models (deepseek-v4-*, anthropic thinking) consume part
-                    // of this budget on reasoning_tokens before producing user-visible
-                    // text. E2E showed 2048 caused finishReason=length on 3KB debate
-                    // prompts. 6144 leaves ~4000 tokens for text after typical reasoning
-                    // overhead and avoids cuts mid-thought.
-                    maxOutputTokens: 6144,
-                    temperature: 0.7,
-                    // Visible retry (src/utils/visible-retry.ts) replaces SDK's silent
-                    // exponential backoff (2,4,8,16,32s). When SiliconFlow rate-limits
-                    // with 429, user now sees "[retry] rate-limited (429) — waiting Xs
-                    // before attempt N/6" instead of a 62s blank window that looks hung.
-                    maxRetries: 0,
-                    ...(runtime.providerOptions ? { providerOptions: runtime.providerOptions } : {}),
-                    abortSignal: timedSignal,
                 }), { label: "council.debate" }), COUNCIL_LLM_TIMEOUT_MS + 5_000, "council.debate", signal);
                 cleanupTimeout();
                 stats.calls++;
@@ -402,6 +553,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     stepCount: toolCalls.length,
                 });
                 onUsage?.(debateUsage);
+                recordCouncilUsage(sessionId, modelId, debateUsage);
                 writeDebugRecord({
                     ts: new Date().toISOString(),
                     kind: "debate",
@@ -423,7 +575,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     usage: result.usage,
                 });
                 return {
-                    text: result.text,
+                    text: stripThinkBlocks(result.text),
                     toolCalls: toolCalls,
                 };
             }
@@ -456,7 +608,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
             if (mock) {
                 stats.calls++;
                 const result = await mock.complete({ prompt: topic });
-                return result.text;
+                return stripThinkBlocks(result.text);
             }
             const providerId = detectProviderForModel(modelId);
             const factory = await resolveCouncilFactory(providerId);
@@ -476,12 +628,21 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
             const hasUrl = /https?:\/\/\S+/.test(topic);
             const internetFirst = options?.internetFirst === true;
             const systemPrompt = buildResearchSystemPrompt(hasUrl, internetFirst);
-            // Warn early if internet-first mode is requested but no internet/browser tools are loaded.
-            const internetToolAvailable = Object.keys(allTools).some((n) => /tavily|web[_-]?fetch|web[_-]?search|playwright|chrome|context7|firecrawl|exa/i.test(n));
+            // Warn early if internet-first mode is requested but no *working* web
+            // research capability exists. The builtin `web_search`/`fetch_url` tools
+            // are ALWAYS registered, so the old tool-NAME check was always true — even
+            // when `web_search` will just return `ERROR no_tavily_key`, so the warning
+            // never fired and internet-first research failed silently. Gate on real
+            // capability: a Tavily key, or an MCP search/browser tool actually loaded
+            // (builtins alone don't count — open-ended search needs the key).
+            const hasTavilyKey = ((await getMcpKey("tavily")) || process.env.TAVILY_API_KEY || "").trim().length >= 10;
+            const mcpSearchTool = Object.keys(mcpBundle?.tools ?? {}).some((n) => /tavily|web[_-]?search|web[_-]?fetch|playwright|chrome|context7|firecrawl|exa|browser/i.test(n));
+            const internetToolAvailable = hasTavilyKey || mcpSearchTool;
             const internetGapWarning = internetFirst && !internetToolAvailable
-                ? `\n\n## Research Gap\n- Internet-first mode requested but no browser/search tool ` +
-                    `(tavily, web-fetch, playwright, chrome-devtools, context7) is available. ` +
-                    `Findings will be limited to what the model already knows.`
+                ? `\n\n## Research Gap\n- Internet-first mode requested but no working web-search capability ` +
+                    `(a Tavily API key or an MCP search/browser tool) is available. ` +
+                    `\`fetch_url\` still works for explicit URLs, but open-ended search is unavailable — ` +
+                    `findings will be limited to what the model already knows.`
                 : "";
             const userPrompt = conversationContext
                 ? `## Context\n${conversationContext}\n\n---\n\n## Research Topic\n${topic}\n\nInvestigate and report findings.`
@@ -508,7 +669,11 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                         return stripped === messages ? {} : { messages: stripped };
                     },
                     maxOutputTokens: 4096,
-                    temperature: 0.3,
+                    // See generate(): capability-aware temperature (omit / clamp).
+                    ...(() => {
+                        const t = resolveTemperature(providerId, runtime.modelInfo, 0.3);
+                        return t === undefined ? {} : { temperature: t };
+                    })(),
                     // Visible retry (src/utils/visible-retry.ts) replaces SDK's silent
                     // exponential backoff (2,4,8,16,32s). When SiliconFlow rate-limits
                     // with 429, user now sees "[retry] rate-limited (429) — waiting Xs
@@ -530,6 +695,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     stepCount: (result.toolCalls ?? []).length,
                 });
                 onUsage?.(researchUsage);
+                recordCouncilUsage(sessionId, modelId, researchUsage);
                 writeDebugRecord({
                     ts: new Date().toISOString(),
                     kind: "research",
@@ -558,7 +724,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                 // CQ-04: When URL present, verify at least one browser tool was invoked
                 if (hasUrl) {
                     // Use result.toolCalls (flat array across all steps) — more reliably typed than steps[].toolCalls
-                    const browserUsed = researchToolCalls.some((tc) => tc.toolName.includes("playwright") || tc.toolName.includes("chrome"));
+                    const browserUsed = researchToolCalls.some((tc) => tc.toolName.includes("playwright") || tc.toolName.includes("chrome") || tc.toolName === "fetch_url");
                     if (!browserUsed) {
                         stats.calls++;
                         return (result.text +
@@ -568,7 +734,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     }
                 }
                 stats.calls++;
-                return result.text + internetGapWarning;
+                return stripThinkBlocks(result.text) + internetGapWarning;
             }
             catch (err) {
                 cleanupTimeout();
@@ -691,6 +857,33 @@ export async function* tracedGenerate(llm, args) {
     };
     return resultText;
 }
+/**
+ * Run {@link tracedGenerate} across a list of models, returning the first
+ * non-empty completion. A model that throws (e.g. a flaky proxy returning
+ * "Upstream request failed") or yields only whitespace advances to the next
+ * candidate; fallback attempts are labelled so the timeline shows the retry.
+ * Returns null when every candidate fails — the caller decides the degraded
+ * fallback (e.g. a single-criterion spec). Dedupes the model list in order.
+ */
+export async function* tracedGenerateWithFallback(llm, args) {
+    const seen = new Set();
+    const models = args.models.filter((m) => m && !seen.has(m) && (seen.add(m), true));
+    for (let i = 0; i < models.length; i++) {
+        try {
+            const raw = yield* tracedGenerate(llm, {
+                ...args,
+                modelId: models[i],
+                label: i > 0 ? `${args.label} (fallback: ${models[i]})` : args.label,
+            });
+            if (raw?.trim())
+                return raw;
+        }
+        catch {
+            /* try the next candidate */
+        }
+    }
+    return null;
+}
 /**
  * Generic version of {@link tracedGenerate} for arbitrary async work
  * (e.g. `llm.research`, `Promise.all` over multiple model calls).

package/dist/src/council/panel-select.d.ts

@@ -0,0 +1,30 @@
+/**
+ * src/council/panel-select.ts
+ *
+ * U3 — task-aware debate panel selection. Instead of a fixed capability roster
+ * (resolveParticipants picks by tier, blind to the prompt), the leader reads the
+ * task and CHOOSES which reachable models should debate it. Fail-open: any parse
+ * / provider failure returns null and the caller keeps the default roster. The
+ * internal implement/verify/research routing slots are assigned here purely for
+ * downstream compatibility — they are never surfaced to the user (the UI shows
+ * the task-adaptive persona / model, per U1.1).
+ */
+import type { StreamChunk } from "../types/index.js";
+import type { ModelRole } from "../utils/settings.js";
+import type { CouncilCandidate } from "./leader.js";
+import type { CouncilLLM } from "./types.js";
+/**
+ * Ask the leader to select a task-appropriate debate panel from `pool`.
+ * Returns a roster (models mapped onto internal routing roles) or null when the
+ * leader is unavailable / returns an unusable selection — the caller then keeps
+ * its default roster.
+ */
+export declare function selectTaskAwarePanel(opts: {
+    topic: string;
+    pool: CouncilCandidate[];
+    leaderModelId: string;
+    llm: CouncilLLM;
+}): AsyncGenerator<StreamChunk, Array<{
+    role: ModelRole;
+    model: string;
+}> | null, unknown>;

package/dist/src/council/panel-select.js

@@ -0,0 +1,72 @@
+/**
+ * src/council/panel-select.ts
+ *
+ * U3 — task-aware debate panel selection. Instead of a fixed capability roster
+ * (resolveParticipants picks by tier, blind to the prompt), the leader reads the
+ * task and CHOOSES which reachable models should debate it. Fail-open: any parse
+ * / provider failure returns null and the caller keeps the default roster. The
+ * internal implement/verify/research routing slots are assigned here purely for
+ * downstream compatibility — they are never surfaced to the user (the UI shows
+ * the task-adaptive persona / model, per U1.1).
+ */
+import { tracedGenerate } from "./llm.js";
+const ALL_ROLES = ["implement", "verify", "research"];
+const SELECT_SYSTEM = "You are the council leader assembling a debate panel for a specific task. From the AVAILABLE MODELS, " +
+    "pick the 2-4 that will produce the most rigorous, diverse debate for THIS task — prefer provider and " +
+    "tier diversity, and match model strengths to what the task actually needs (e.g. a decision/analysis task " +
+    "wants strong reasoners; a build task wants a coding-capable model plus a critical reviewer). " +
+    'Return ONLY JSON: {"members":[{"model":"<exact id from the list>","why":"<short reason>"}]}. ' +
+    "Use exact model ids from the list; never invent an id.";
+/**
+ * Ask the leader to select a task-appropriate debate panel from `pool`.
+ * Returns a roster (models mapped onto internal routing roles) or null when the
+ * leader is unavailable / returns an unusable selection — the caller then keeps
+ * its default roster.
+ */
+export async function* selectTaskAwarePanel(opts) {
+    const { topic, pool, leaderModelId, llm } = opts;
+    if (pool.length < 2)
+        return null;
+    const poolList = pool
+        .map((c) => `- ${c.model}${c.tier ? ` [${c.tier}]` : ""}${c.provider ? ` (${c.provider})` : ""}: ${c.description.slice(0, 120)}`)
+        .join("\n");
+    const prompt = `## Task\n${topic}\n\n## Available models\n${poolList}\n\nSelect the 2-4 models best suited to debate this task.`;
+    let raw;
+    try {
+        raw = yield* tracedGenerate(llm, {
+            phase: "panel_select",
+            label: "Leader selecting debate panel",
+            modelId: leaderModelId,
+            system: SELECT_SYSTEM,
+            prompt,
+            maxTokens: 512,
+        });
+    }
+    catch {
+        return null;
+    }
+    const match = raw.match(/\{[\s\S]*\}/);
+    if (!match)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(match[0]);
+    }
+    catch {
+        return null;
+    }
+    const valid = new Set(pool.map((c) => c.model));
+    const picked = [];
+    for (const m of parsed.members ?? []) {
+        const id = typeof m?.model === "string" ? m.model.trim() : "";
+        if (id && valid.has(id) && !picked.includes(id))
+            picked.push(id);
+        if (picked.length >= 4)
+            break;
+    }
+    if (picked.length < 2)
+        return null;
+    // Roles are internal cost-tier routing slots (hidden from UI); assign cyclically.
+    return picked.map((model, i) => ({ role: ALL_ROLES[i % ALL_ROLES.length], model }));
+}
+//# sourceMappingURL=panel-select.js.map

package/dist/src/council/planner.js

@@ -1,3 +1,4 @@
+import { getCouncilLanguage } from "../utils/settings.js";
 import { tracedGenerate } from "./llm.js";
 import { phaseDone, phaseError, phaseStart } from "./phase-events.js";
 import { buildSynthesisPrompt } from "./prompts.js";
@@ -33,6 +34,9 @@ planEmphasis) {
             outputStyle: outputStyle ?? undefined,
             refineContext,
             planEmphasis,
+            // Feature B — synthesis output language follows the resolved council
+            // debate language (auto → detect from the brief; pinned → that locale).
+            language: getCouncilLanguage(),
         };
         const first = buildSynthesisPrompt(baseArgs);
         synthesisText = yield* tracedGenerate(llm, {
@@ -233,10 +237,29 @@ function parseOutcome(synthesisText, debatePlan) {
                         sections[s.key] = parsed[s.key];
                 }
             }
+            // Model-first post-debate options. Keep only entries whose action is in
+            // the wired vocabulary; drop malformed items so a hallucinated action id
+            // can't reach the handler switch. Empty → index.ts uses its fallback set.
+            const VALID_ACTIONS = new Set(["ask_followup", "generate_plan", "implement", "save_exit", "continue_session"]);
+            const nextActions = Array.isArray(parsed.nextActions)
+                ? parsed.nextActions
+                    .filter((a) => !!a &&
+                    typeof a === "object" &&
+                    typeof a.action === "string" &&
+                    VALID_ACTIONS.has(a.action) &&
+                    typeof a.label === "string" &&
+                    a.label.trim().length > 0)
+                    .map((a) => ({
+                    action: a.action,
+                    label: a.label.trim(),
+                    reason: typeof a.reason === "string" ? a.reason.trim() : undefined,
+                }))
+                : undefined;
             return {
                 type,
                 summary,
                 sections: Object.keys(sections).length > 0 ? sections : undefined,
+                nextActions: nextActions && nextActions.length > 0 ? nextActions : undefined,
                 // Legacy fields — synthesizer may still emit them when shape calls for them.
                 agreed: Array.isArray(parsed.agreed) ? parsed.agreed : undefined,
                 tradeoffs: Array.isArray(parsed.tradeoffs) ? parsed.tradeoffs : undefined,

package/dist/src/council/preflight.d.ts

@@ -3,6 +3,13 @@ import type { ClarifiedSpec, PreflightResponder } from "./types.js";
 export interface RunPreflightOptions {
     repoEmpty?: boolean;
     researchOverridable?: boolean;
+    /**
+     * ROI: when the clarifier judged the spec ready (high confidence, no gaps),
+     * the approve card is a rubber-stamp. Show the Discussion Brief for
+     * transparency but auto-approve without blocking on a gate. Default false —
+     * an unready/low-confidence spec still surfaces the approve card.
+     */
+    autoApprove?: boolean;
 }
 export declare function runPreflight(spec: ClarifiedSpec, participants: Array<{
     role: string;

package/dist/src/council/preflight.js

@@ -31,13 +31,25 @@ export async function* runPreflight(spec, participants, researchNeeded, respondT
                 },
                 { heading: "Scope", body: spec.scope || "Not specified" },
                 {
-                    heading: "Participants",
-                    body: participants.map((p) => `- ${p.role} → ${p.model}`).join("\n"),
+                    heading: "Panel",
+                    body: participants.map((p) => `- ${p.model}`).join("\n"),
                 },
                 { heading: "Research phase", body: `${researchMode}${researchNote}` },
             ],
         },
     };
+    // ROI: skip the approve gate when the spec is already judged ready — show the
+    // brief above for transparency but don't block on a rubber-stamp.
+    if (options?.autoApprove === true) {
+        yield phaseDone({
+            phaseId: "phase:preflight",
+            kind: "preflight",
+            label: "Pre-flight review",
+            startedAt,
+            detail: "auto-approved (spec ready)",
+        });
+        return true;
+    }
     yield {
         type: "council_preflight",
         content: "Review the discussion brief above. Approve to start debate, or reject to revise.",