muonroi-cli 1.8.4 → 1.9.0

package/dist/src/council/llm.js

@@ -1,20 +1,31 @@
 import * as fs from "node:fs";
-import { generateText, stepCountIs } from "ai";
+import { generateText, stepCountIs, streamText } from "ai";
 import { getDefaultEEClient } from "../ee/intercept.js";
 import { emitMatches } from "../ee/render.js";
+import { getMcpKey } from "../mcp/mcp-keychain.js";
 import { buildMcpToolSet } from "../mcp/runtime.js";
-import { getProviderCapabilities } from "../providers/capabilities.js";
+import { getModelInfo } from "../models/registry.js";
+import { getProviderCapabilities, resolveTemperature } from "../providers/capabilities.js";
 import { loadKeyForProvider, ProviderKeyMissingError } from "../providers/keychain.js";
-import { createProviderFactoryAsync, detectProviderForModel, resolveModelRuntime } from "../providers/runtime.js";
+import { createProviderFactoryAsync, detectProviderForModel, resolveModelRuntime, shouldDropParam, } from "../providers/runtime.js";
+import { wireDebug } from "../providers/wire-debug.js";
+import { statusBarStore } from "../state/status-bar-store.js";
+import { recordUsageEvent } from "../storage/index.js";
 import { createBuiltinTools as createTools } from "../tools/registry.js";
 import { appendCostLog } from "../usage/cost-log.js";
 import { projectCostUSD } from "../usage/estimator.js";
 import { withDeadlineRace, withTimeoutSignal } from "../utils/llm-deadline.js";
+import { logger } from "../utils/logger.js";
 import { loadMcpServers } from "../utils/settings.js";
 import { withVisibleRetry } from "../utils/visible-retry.js";
 import { buildResearchSystemPrompt } from "./prompts.js";
+import { stripThinkBlocks } from "./strip-think.js";
 /**
- * Resolve a provider factory for a council sub-call, OAuth-aware.
+ * Register a provider factory for a council sub-call, OAuth-aware.
+ *
+ * A council roster routes stances to providers the session itself never built,
+ * so their factory must exist in the registry before `resolveModelRuntime` can
+ * derive it from the model id.
  *
  * The council reachability gate (`isProviderReachable` in leader.ts) counts
  * OAuth-authenticated providers as usable (via `getConfiguredProviders`), so a
@@ -27,7 +38,7 @@ import { buildResearchSystemPrompt } from "./prompts.js";
  * refreshes the stored OAuth bearer token. Only the expected missing-key case
  * is swallowed; unexpected errors propagate.
  */
-async function resolveCouncilFactory(providerId) {
+async function ensureCouncilFactory(providerId) {
     let apiKey;
     try {
         apiKey = await loadKeyForProvider(providerId);
@@ -37,8 +48,7 @@ async function resolveCouncilFactory(providerId) {
             throw err;
         // OAuth-only provider — createProviderFactoryAsync injects the bearer token.
     }
-    const { factory } = await createProviderFactoryAsync(providerId, apiKey ? { apiKey } : {});
-    return factory;
+    await createProviderFactoryAsync(providerId, apiKey ? { apiKey } : {});
 }
 function getDebugLogPath() {
     const p = process.env.MUONROI_COUNCIL_DEBUG_LOG;
@@ -186,6 +196,62 @@ function logCouncilCost(args) {
     }).catch(() => undefined);
     return usage;
 }
+/**
+ * Record a council LLM call into the `usage_events` table with source="council".
+ *
+ * This is the SINGLE source of truth for council usage accounting: it fires from
+ * inside every council generate/debate/research call so ALL council entry points
+ * (the /council slash path, auto-council, and every /ideal phase — clarifier,
+ * research, generate, sprint) land in usage_events. Before this existed, only
+ * the loop-driver's `runDebate` call site externally wrapped usage recording, so
+ * `runCouncilV2` (/council + auto-council) and the non-debate /ideal phases never
+ * recorded — their token cost was invisible to session totals, the StatusBar,
+ * `usage forensics`, and the cost caps (root cause of session f24c28b6dcb3:
+ * council ran but produced 0 source="council" usage_events).
+ *
+ * Best-effort: a null sessionId (no chat session FK) or a DB failure must never
+ * break the council run, but per the No-Silent-Catch rule we log the failure.
+ */
+export function recordCouncilUsage(sessionId, modelId, usage) {
+    if (!sessionId)
+        return;
+    try {
+        recordUsageEvent(sessionId, "council", modelId, {
+            inputTokens: usage.inputTokens,
+            outputTokens: usage.outputTokens,
+            cacheReadTokens: usage.cachedInputTokens,
+        });
+        // Mirror council billing into the live StatusBar so cache-hit% / tokens /
+        // cost reflect the WHOLE session (council calls have ~0 cache; excluding
+        // them overstated the message-only cache ratio — session f24c28b6dcb3).
+        // ONLY the five cumulative billing counters — NEVER ctx_tokens/ctx_pct/
+        // model/provider, which describe the current MAIN-conversation call and
+        // would be clobbered by a small council sub-call.
+        const totalInput = usage.inputTokens;
+        const output = usage.outputTokens;
+        const cacheRead = usage.cachedInputTokens;
+        const info = getModelInfo(modelId);
+        const priceIn = info?.inputPrice ?? 0;
+        const priceCached = info?.cachedInputPrice ?? priceIn * 0.1;
+        const priceOut = info?.outputPrice ?? 0;
+        const nonCachedInput = Math.max(0, totalInput - cacheRead);
+        const turnCostMicros = nonCachedInput * priceIn + cacheRead * priceCached + output * priceOut;
+        const prev = statusBarStore.getState();
+        statusBarStore.setState({
+            in_tokens: prev.in_tokens + totalInput,
+            out_tokens: prev.out_tokens + output,
+            cache_read_tokens: (prev.cache_read_tokens ?? 0) + cacheRead,
+            session_usd: prev.session_usd + turnCostMicros / 1_000_000,
+        });
+    }
+    catch (err) {
+        logger.error("storage", "recordUsageEvent(council) failed — token cost not accounted", {
+            sessionId,
+            modelId,
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
 function getMockLlm() {
     // biome-ignore lint/suspicious/noExplicitAny: intentionally untyped global access
     return globalThis.__muonroiMockLlm ?? null;
@@ -209,6 +275,154 @@ const COUNCIL_LLM_TIMEOUT_MS = (() => {
 // withTimeoutSignal + withDeadlineRace moved to ../utils/llm-deadline.js so all
 // pre-flight LLM call sites (council, debate-planner, scope-ceiling) share one
 // implementation. Imported at the top of this file.
+/**
+ * Run a single-shot LLM call over the STREAMING transport and collect the full
+ * result, returning a `generateText`-shaped object ({ text, usage, finishReason,
+ * reasoningText }).
+ *
+ * Why stream a one-shot generate? The OpenAI codex/oauth endpoint
+ * (chatgpt.com/backend-api/codex/responses, used by gpt-5.*-codex subscription
+ * auth) HARD-REJECTS non-streaming requests with 400 `{"detail":"Stream must be
+ * set to true"}`. `generateText` issues a non-stream POST, so every council
+ * sub-task that ran through it (leader round evaluation, clarify, spec
+ * synthesis, running summary) failed on a codex session — surfacing to the user
+ * as the opaque "Decision: evaluation unavailable" round card (diagnosed from
+ * session 8191ecaee149: gpt-5.4-mini → codex/responses → "Stream must be set to
+ * true"). The panel debate never hit this because it streams. Streaming is the
+ * universal transport (every provider + the whole TUI already use it), so
+ * collecting a streamed result fixes codex without special-casing it.
+ *
+ * A provider `error` part is re-thrown so the caller's retry / cross-provider
+ * fallback treats it as a failure exactly as a thrown `generateText` did.
+ *
+ * Also used by `debate()` (the panel pair turns) with the tiny verification
+ * toolset: pass `tools`/`stopWhen`/`prepareStep` and the collected `toolCalls`
+ * (toolName + input + matched result) come back in the same shape the old
+ * `generateText` result exposed. A debater on the codex/oauth endpoint hit the
+ * exact same non-stream 400 as the eval path — streaming fixes it uniformly.
+ */
+/**
+ * Spread for the `maxOutputTokens` param, omitted when the resolved runtime
+ * rejects it. The ChatGPT Codex OAuth endpoint (chatgpt.com/backend-api/codex/
+ * responses) 400s with `{"detail":"Unsupported parameter: max_output_tokens"}`
+ * on EVERY council sub-call (clarify / debate / research) — every council
+ * generate on a Codex-OAuth session was failing wholesale. Mirrors the
+ * orchestrator + classify paths, which already gate this param via
+ * `shouldDropParam`.
+ */
+function maxOutSpread(runtime, n) {
+    return shouldDropParam(runtime, "maxOutputTokens") ? {} : { maxOutputTokens: n };
+}
+/**
+ * Push-based stream liveness — module-level because the only readers
+ * (`tracedAsync` wrappers in debate.ts) sit OUTSIDE the `CouncilLLM` interface
+ * and cannot reach the in-flight `collectStreamText` any other way.
+ *
+ * Why it exists. `tracedAsync`'s 1s tick only materializes when the CONSUMER
+ * pulls `.next()`; a round that awaits its pairs via `Promise.all` stops
+ * pumping the tick generator, so `elapsedMs` FREEZES and a slow-but-alive run
+ * is indistinguishable from a hung one (observed: tick frozen at 33142ms for
+ * 8+ minutes while status was still "tick"). Token deltas are PUSHED here as
+ * they arrive, so liveness survives any back-pressure on the generator.
+ */
+let councilStreamedCharsTotal = 0;
+let councilLastDeltaAt = 0;
+/** Record `chars` of streamed output (text OR reasoning) against the live window. */
+export function noteCouncilStreamDelta(chars) {
+    if (chars <= 0)
+        return;
+    councilStreamedCharsTotal += chars;
+    councilLastDeltaAt = Date.now();
+}
+/**
+ * Open a liveness window and return a reader for it.
+ *
+ * `streamedChars` counts only what streamed SINCE the window opened, and
+ * `lastDeltaAgeMs` is measured from the window's own start until the first
+ * delta lands — so a cold stall reads as an age growing from 0, never as a
+ * bogus epoch-sized number. Reasoning-delta counts toward both: a reasoning
+ * model emits reasoning tokens for minutes before any text, and that is
+ * exactly the window an operator must not mistake for a hang.
+ */
+export function councilStreamLivenessReader() {
+    const baseChars = councilStreamedCharsTotal;
+    const windowStart = Date.now();
+    return () => ({
+        streamedChars: councilStreamedCharsTotal - baseChars,
+        lastDeltaAgeMs: Date.now() - (councilLastDeltaAt > windowStart ? councilLastDeltaAt : windowStart),
+    });
+}
+async function collectStreamText(args) {
+    const hasTools = !!args.tools && Object.keys(args.tools).length > 0;
+    const result = streamText({
+        model: args.model,
+        system: args.system,
+        prompt: args.prompt,
+        ...(args.maxOutputTokens === undefined ? {} : { maxOutputTokens: args.maxOutputTokens }),
+        maxRetries: 0,
+        ...(args.temperature === undefined ? {} : { temperature: args.temperature }),
+        ...(args.providerOptions ? { providerOptions: args.providerOptions } : {}),
+        ...(hasTools ? { tools: args.tools, stopWhen: args.stopWhen, prepareStep: args.prepareStep } : {}),
+        abortSignal: args.abortSignal,
+    });
+    let text = "";
+    let reasoningText = "";
+    let usage;
+    let finishReason;
+    const toolCalls = [];
+    const byId = new Map();
+    for await (const part of result.fullStream) {
+        switch (part.type) {
+            case "text-delta": {
+                const d = part.text ?? "";
+                text += d;
+                args.onDelta?.(d.length);
+                break;
+            }
+            case "reasoning-delta": {
+                // Reasoning deltas count as liveness: a reasoning model streams these
+                // for minutes before its first text-delta, and that silent-on-text
+                // window is precisely what gets misread as a hang.
+                const d = part.text ?? "";
+                reasoningText += d;
+                args.onDelta?.(d.length);
+                break;
+            }
+            case "tool-call": {
+                const p = part;
+                const tc = { toolName: p.toolName, input: p.input };
+                byId.set(p.toolCallId, tc);
+                toolCalls.push(tc);
+                break;
+            }
+            case "tool-result": {
+                const p = part;
+                const tc = byId.get(p.toolCallId);
+                if (tc)
+                    tc.result = p.output;
+                break;
+            }
+            case "finish":
+                usage = part.totalUsage ?? part.usage;
+                finishReason = part.finishReason;
+                break;
+            case "error": {
+                const raw = part.error;
+                throw raw instanceof Error ? raw : new Error(String(raw));
+            }
+            default:
+                break;
+        }
+    }
+    return { text, usage, finishReason, reasoningText: reasoningText || undefined, toolCalls };
+}
+/**
+ * Test-only handle on the private stream collector, so `onDelta` (the liveness
+ * signal that tells a slow reasoning call from a hung one) is directly
+ * assertable without standing up a full council run. Not for production use.
+ * @internal
+ */
+export const __testCollectStreamText = collectStreamText;
 export function createCouncilLLM(bash, mode, sessionId, stats) {
     return {
         async generate(modelId, system, prompt, maxTokens = 4096, onUsage, signal) {
@@ -216,11 +430,11 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
             if (mock) {
                 stats.calls++;
                 const result = await mock.complete({ prompt });
-                return result.text;
+                return stripThinkBlocks(result.text);
             }
             const providerId = detectProviderForModel(modelId);
-            const factory = await resolveCouncilFactory(providerId);
-            const runtime = resolveModelRuntime(factory, modelId);
+            await ensureCouncilFactory(providerId);
+            const runtime = resolveModelRuntime(modelId);
             const t0 = Date.now();
             // Combine the user-abort signal (when threaded from runCouncil) with the
             // per-call wall-clock deadline. Without the parent signal, an Esc/Ctrl-C
@@ -228,19 +442,25 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
             // eval) was a no-op — the call ran to completion or hit the 5-min timeout.
             const { signal: timedSignal, cleanup: cleanupTimeout } = withTimeoutSignal(signal, COUNCIL_LLM_TIMEOUT_MS);
             try {
-                const result = await withDeadlineRace(() => withVisibleRetry(() => generateText({
+                const result = await withDeadlineRace(() => withVisibleRetry(() => 
+                // Stream + collect (NOT generateText). The codex/oauth endpoint
+                // 400s on non-stream requests ("Stream must be set to true"),
+                // which nulled every council eval/clarify/synthesis on a codex
+                // session → the opaque "evaluation unavailable" card. See
+                // collectStreamText's doc for the full diagnosis.
+                collectStreamText({
                     model: runtime.model,
                     system,
                     prompt,
-                    maxOutputTokens: maxTokens,
-                    temperature: 0.7,
-                    // Visible retry (src/utils/visible-retry.ts) replaces SDK's silent
-                    // exponential backoff (2,4,8,16,32s). When SiliconFlow rate-limits
-                    // with 429, user now sees "[retry] rate-limited (429) — waiting Xs
-                    // before attempt N/6" instead of a 62s blank window that looks hung.
-                    maxRetries: 0,
-                    ...(runtime.providerOptions ? { providerOptions: runtime.providerOptions } : {}),
+                    ...maxOutSpread(runtime, maxTokens),
+                    // Never hardcode temperature: some upstreams (Moonshot/Kimi via
+                    // opencode-go) reject any value but their pinned one, which
+                    // failed every clarify/spec call on a Kimi session. resolveTemperature
+                    // omits the field or clamps to the model's fixed value.
+                    temperature: resolveTemperature(providerId, runtime.modelInfo, 0.7),
+                    providerOptions: runtime.providerOptions,
                     abortSignal: timedSignal,
+                    onDelta: noteCouncilStreamDelta,
                 }), { label: "council.generate" }), COUNCIL_LLM_TIMEOUT_MS + 5_000, "council.generate", signal);
                 cleanupTimeout();
                 stats.calls++;
@@ -255,6 +475,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     durationMs: durMs,
                 });
                 onUsage?.(callUsage);
+                recordCouncilUsage(sessionId, modelId, callUsage);
                 writeDebugRecord({
                     ts: new Date().toISOString(),
                     kind: "generate",
@@ -273,10 +494,16 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     finishReason: result.finishReason,
                     usage: result.usage,
                 });
-                return result.text;
+                return stripThinkBlocks(result.text);
             }
             catch (err) {
                 cleanupTimeout();
+                // Capture the provider-side detail (status code + response body +
+                // request param shape) that `err.message` alone drops — a generic
+                // "Bad Request" on the council path was previously undiagnosable
+                // because collectStreamText re-throws only the message. PII-safe,
+                // no-op unless MUONROI_DEBUG_LLM_WIRE=1. (No-Silent-Catch.)
+                wireDebug.logError(providerId, err);
                 writeDebugRecord({
                     ts: new Date().toISOString(),
                     kind: "generate",
@@ -300,11 +527,11 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
             if (mock) {
                 stats.calls++;
                 const result = await mock.complete({ prompt });
-                return { text: result.text, toolCalls: [] };
+                return { text: stripThinkBlocks(result.text), toolCalls: [] };
             }
             const providerId = detectProviderForModel(modelId);
-            const factory = await resolveCouncilFactory(providerId);
-            const runtime = resolveModelRuntime(factory, modelId);
+            await ensureCouncilFactory(providerId);
+            const runtime = resolveModelRuntime(modelId);
             // Verification tools — re-introduced after the no-tools fix (session
             // a7a5690d2049). The original failure was stepCountIs(4) + full toolset
             // letting reasoning models exhaust steps on exploratory tool chains and
@@ -335,13 +562,16 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                             }
                         }
                     }
-                    catch {
-                        /* MCP optional — debate continues with builtins only */
+                    catch (err) {
+                        // MCP is optional here — debate continues with builtins only — but a
+                        // silent swallow hid which server failed and why. (No-Silent-Catch.)
+                        console.error(`[council/llm] debate MCP tool discovery failed, continuing with builtins only: ${err instanceof Error ? err.message : String(err)}`, { modelId, provider: providerId });
                     }
                     verificationTools = wrapToolsWithEeCheck(filtered, sessionId ?? "council-debate");
                 }
-                catch {
-                    /* fail-open: no tools */
+                catch (err) {
+                    // fail-open: the debate turn still runs, just without verification tools.
+                    console.error(`[council/llm] debate verification toolset build failed, running without tools: ${err instanceof Error ? err.message : String(err)}`, { modelId, provider: providerId });
                 }
             }
             // sanitizeHistory is identity for every provider (kept as a hook for
@@ -351,10 +581,30 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
             const t0 = Date.now();
             const { signal: timedSignal, cleanup: cleanupTimeout } = withTimeoutSignal(signal, COUNCIL_LLM_TIMEOUT_MS);
             try {
-                const result = await withDeadlineRace(() => withVisibleRetry(() => generateText({
+                const result = await withDeadlineRace(() => withVisibleRetry(() => 
+                // Stream + collect (NOT generateText). A debater on the codex/oauth
+                // endpoint hits the same non-stream 400 ("Stream must be set to
+                // true") that nulled the eval path; streaming is uniform across
+                // providers. Tools (when the tier + circuit breaker allow) ride
+                // through with stepCountIs(2) + the same sanitizeHistory prepareStep.
+                collectStreamText({
                     model: runtime.model,
                     system,
                     prompt,
+                    // Reasoning models (deepseek-v4-*, anthropic thinking) consume part
+                    // of this budget on reasoning_tokens before producing user-visible
+                    // text. E2E showed 2048 caused finishReason=length on 3KB debate
+                    // prompts. 6144 leaves ~4000 tokens for text after typical reasoning
+                    // overhead and avoids cuts mid-thought.
+                    ...maxOutSpread(runtime, 6144),
+                    // See generate(): capability-aware temperature (omit / clamp).
+                    temperature: resolveTemperature(providerId, runtime.modelInfo, 0.7),
+                    providerOptions: runtime.providerOptions,
+                    abortSignal: timedSignal,
+                    // Push liveness for the round wrapper: a debate turn on a
+                    // reasoning model runs near the 5-min ceiling, and the tick
+                    // generator is not being pumped while Promise.all awaits.
+                    onDelta: noteCouncilStreamDelta,
                     ...(verificationTools && Object.keys(verificationTools).length > 0
                         ? {
                             tools: verificationTools,
@@ -367,20 +617,6 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                             },
                         }
                         : {}),
-                    // Reasoning models (deepseek-v4-*, anthropic thinking) consume part
-                    // of this budget on reasoning_tokens before producing user-visible
-                    // text. E2E showed 2048 caused finishReason=length on 3KB debate
-                    // prompts. 6144 leaves ~4000 tokens for text after typical reasoning
-                    // overhead and avoids cuts mid-thought.
-                    maxOutputTokens: 6144,
-                    temperature: 0.7,
-                    // Visible retry (src/utils/visible-retry.ts) replaces SDK's silent
-                    // exponential backoff (2,4,8,16,32s). When SiliconFlow rate-limits
-                    // with 429, user now sees "[retry] rate-limited (429) — waiting Xs
-                    // before attempt N/6" instead of a 62s blank window that looks hung.
-                    maxRetries: 0,
-                    ...(runtime.providerOptions ? { providerOptions: runtime.providerOptions } : {}),
-                    abortSignal: timedSignal,
                 }), { label: "council.debate" }), COUNCIL_LLM_TIMEOUT_MS + 5_000, "council.debate", signal);
                 cleanupTimeout();
                 stats.calls++;
@@ -402,6 +638,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     stepCount: toolCalls.length,
                 });
                 onUsage?.(debateUsage);
+                recordCouncilUsage(sessionId, modelId, debateUsage);
                 writeDebugRecord({
                     ts: new Date().toISOString(),
                     kind: "debate",
@@ -423,7 +660,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     usage: result.usage,
                 });
                 return {
-                    text: result.text,
+                    text: stripThinkBlocks(result.text),
                     toolCalls: toolCalls,
                 };
             }
@@ -456,11 +693,11 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
             if (mock) {
                 stats.calls++;
                 const result = await mock.complete({ prompt: topic });
-                return result.text;
+                return stripThinkBlocks(result.text);
             }
             const providerId = detectProviderForModel(modelId);
-            const factory = await resolveCouncilFactory(providerId);
-            const runtime = resolveModelRuntime(factory, modelId);
+            await ensureCouncilFactory(providerId);
+            const runtime = resolveModelRuntime(modelId);
             const builtinTools = createTools(bash, mode);
             // CQ-03: Lazy MCP bundle per research call — fail-open so builtins remain available
             let mcpBundle = null;
@@ -476,12 +713,21 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
             const hasUrl = /https?:\/\/\S+/.test(topic);
             const internetFirst = options?.internetFirst === true;
             const systemPrompt = buildResearchSystemPrompt(hasUrl, internetFirst);
-            // Warn early if internet-first mode is requested but no internet/browser tools are loaded.
-            const internetToolAvailable = Object.keys(allTools).some((n) => /tavily|web[_-]?fetch|web[_-]?search|playwright|chrome|context7|firecrawl|exa/i.test(n));
+            // Warn early if internet-first mode is requested but no *working* web
+            // research capability exists. The builtin `web_search`/`fetch_url` tools
+            // are ALWAYS registered, so the old tool-NAME check was always true — even
+            // when `web_search` will just return `ERROR no_tavily_key`, so the warning
+            // never fired and internet-first research failed silently. Gate on real
+            // capability: a Tavily key, or an MCP search/browser tool actually loaded
+            // (builtins alone don't count — open-ended search needs the key).
+            const hasTavilyKey = ((await getMcpKey("tavily")) || process.env.TAVILY_API_KEY || "").trim().length >= 10;
+            const mcpSearchTool = Object.keys(mcpBundle?.tools ?? {}).some((n) => /tavily|web[_-]?search|web[_-]?fetch|playwright|chrome|context7|firecrawl|exa|browser/i.test(n));
+            const internetToolAvailable = hasTavilyKey || mcpSearchTool;
             const internetGapWarning = internetFirst && !internetToolAvailable
-                ? `\n\n## Research Gap\n- Internet-first mode requested but no browser/search tool ` +
-                    `(tavily, web-fetch, playwright, chrome-devtools, context7) is available. ` +
-                    `Findings will be limited to what the model already knows.`
+                ? `\n\n## Research Gap\n- Internet-first mode requested but no working web-search capability ` +
+                    `(a Tavily API key or an MCP search/browser tool) is available. ` +
+                    `\`fetch_url\` still works for explicit URLs, but open-ended search is unavailable — ` +
+                    `findings will be limited to what the model already knows.`
                 : "";
             const userPrompt = conversationContext
                 ? `## Context\n${conversationContext}\n\n---\n\n## Research Topic\n${topic}\n\nInvestigate and report findings.`
@@ -507,8 +753,12 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                         const stripped = researchCaps.sanitizeHistory(messages);
                         return stripped === messages ? {} : { messages: stripped };
                     },
-                    maxOutputTokens: 4096,
-                    temperature: 0.3,
+                    ...maxOutSpread(runtime, 4096),
+                    // See generate(): capability-aware temperature (omit / clamp).
+                    ...(() => {
+                        const t = resolveTemperature(providerId, runtime.modelInfo, 0.3);
+                        return t === undefined ? {} : { temperature: t };
+                    })(),
                     // Visible retry (src/utils/visible-retry.ts) replaces SDK's silent
                     // exponential backoff (2,4,8,16,32s). When SiliconFlow rate-limits
                     // with 429, user now sees "[retry] rate-limited (429) — waiting Xs
@@ -530,6 +780,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     stepCount: (result.toolCalls ?? []).length,
                 });
                 onUsage?.(researchUsage);
+                recordCouncilUsage(sessionId, modelId, researchUsage);
                 writeDebugRecord({
                     ts: new Date().toISOString(),
                     kind: "research",
@@ -558,7 +809,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                 // CQ-04: When URL present, verify at least one browser tool was invoked
                 if (hasUrl) {
                     // Use result.toolCalls (flat array across all steps) — more reliably typed than steps[].toolCalls
-                    const browserUsed = researchToolCalls.some((tc) => tc.toolName.includes("playwright") || tc.toolName.includes("chrome"));
+                    const browserUsed = researchToolCalls.some((tc) => tc.toolName.includes("playwright") || tc.toolName.includes("chrome") || tc.toolName === "fetch_url");
                     if (!browserUsed) {
                         stats.calls++;
                         return (result.text +
@@ -568,7 +819,7 @@ export function createCouncilLLM(bash, mode, sessionId, stats) {
                     }
                 }
                 stats.calls++;
-                return result.text + internetGapWarning;
+                return stripThinkBlocks(result.text) + internetGapWarning;
             }
             catch (err) {
                 cleanupTimeout();
@@ -691,6 +942,33 @@ export async function* tracedGenerate(llm, args) {
     };
     return resultText;
 }
+/**
+ * Run {@link tracedGenerate} across a list of models, returning the first
+ * non-empty completion. A model that throws (e.g. a flaky proxy returning
+ * "Upstream request failed") or yields only whitespace advances to the next
+ * candidate; fallback attempts are labelled so the timeline shows the retry.
+ * Returns null when every candidate fails — the caller decides the degraded
+ * fallback (e.g. a single-criterion spec). Dedupes the model list in order.
+ */
+export async function* tracedGenerateWithFallback(llm, args) {
+    const seen = new Set();
+    const models = args.models.filter((m) => m && !seen.has(m) && (seen.add(m), true));
+    for (let i = 0; i < models.length; i++) {
+        try {
+            const raw = yield* tracedGenerate(llm, {
+                ...args,
+                modelId: models[i],
+                label: i > 0 ? `${args.label} (fallback: ${models[i]})` : args.label,
+            });
+            if (raw?.trim())
+                return raw;
+        }
+        catch {
+            /* try the next candidate */
+        }
+    }
+    return null;
+}
 /**
  * Generic version of {@link tracedGenerate} for arbitrary async work
  * (e.g. `llm.research`, `Promise.all` over multiple model calls).
@@ -701,6 +979,19 @@ export async function* tracedAsync(fn, args) {
         : `status-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
     const start = Date.now();
     const tickInterval = args.tickIntervalMs ?? 1000;
+    /** Never let a liveness read break the heartbeat it is meant to enrich. */
+    const livenessFields = () => {
+        if (!args.liveness)
+            return {};
+        try {
+            const l = args.liveness();
+            return { streamedChars: l.streamedChars, lastDeltaAgeMs: l.lastDeltaAgeMs };
+        }
+        catch (err) {
+            console.error(`[council/llm] tracedAsync liveness read failed: ${err instanceof Error ? err.message : String(err)}`, { phase: args.phase, label: args.label });
+            return {};
+        }
+    };
     yield {
         type: "council_status",
         councilStatus: {
@@ -746,6 +1037,7 @@ export async function* tracedAsync(fn, args) {
                 detail: args.detail,
                 role: args.role,
                 elapsedMs: Date.now() - start,
+                ...livenessFields(),
             },
         };
     }
@@ -777,6 +1069,7 @@ export async function* tracedAsync(fn, args) {
             detail: args.detail,
             role: args.role,
             elapsedMs: Date.now() - start,
+            ...livenessFields(),
         },
     };
     return result;

package/dist/src/council/panel-select.d.ts

@@ -0,0 +1,30 @@
+/**
+ * src/council/panel-select.ts
+ *
+ * U3 — task-aware debate panel selection. Instead of a fixed capability roster
+ * (resolveParticipants picks by tier, blind to the prompt), the leader reads the
+ * task and CHOOSES which reachable models should debate it. Fail-open: any parse
+ * / provider failure returns null and the caller keeps the default roster. The
+ * internal implement/verify/research routing slots are assigned here purely for
+ * downstream compatibility — they are never surfaced to the user (the UI shows
+ * the task-adaptive persona / model, per U1.1).
+ */
+import type { StreamChunk } from "../types/index.js";
+import type { ModelRole } from "../utils/settings.js";
+import type { CouncilCandidate } from "./leader.js";
+import type { CouncilLLM } from "./types.js";
+/**
+ * Ask the leader to select a task-appropriate debate panel from `pool`.
+ * Returns a roster (models mapped onto internal routing roles) or null when the
+ * leader is unavailable / returns an unusable selection — the caller then keeps
+ * its default roster.
+ */
+export declare function selectTaskAwarePanel(opts: {
+    topic: string;
+    pool: CouncilCandidate[];
+    leaderModelId: string;
+    llm: CouncilLLM;
+}): AsyncGenerator<StreamChunk, Array<{
+    role: ModelRole;
+    model: string;
+}> | null, unknown>;