omnilane 0.14.0 → 0.20.0

package/scripts/lib/common.sh

@@ -64,6 +64,94 @@ write_current_pid_file() {
   mv "$tmp" "$path"
 }
 
+process_start_time() { # pid -> stable ps(1) start timestamp
+  local pid="$1" value
+  [[ "$pid" =~ ^[1-9][0-9]{0,9}$ ]] || return 1
+  value="$(LC_ALL=C ps -o lstart= -p "$pid" 2>/dev/null)" || return 1
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+  [[ -n "$value" ]] || return 1
+  printf '%s\n' "$value"
+}
+
+process_parent_pid() {
+  local pid="$1" value
+  [[ "$pid" =~ ^[1-9][0-9]{0,9}$ ]] || return 1
+  value="$(LC_ALL=C ps -o ppid= -p "$pid" 2>/dev/null)" || return 1
+  value="${value//[[:space:]]/}"
+  [[ "$value" =~ ^[1-9][0-9]{0,9}$ ]] || return 1
+  printf '%s\n' "$value"
+}
+
+read_session_entry() { # path -> SESSION_ENTRY_{PID,START,ID}
+  local path="$1" fields rest
+  SESSION_ENTRY_PID=""
+  SESSION_ENTRY_START=""
+  SESSION_ENTRY_ID=""
+  [[ -f "$path" && ! -L "$path" ]] || return 1
+  fields="$(perl -MJSON::PP -e '
+    use strict;
+    use warnings;
+    my ($path) = @ARGV;
+    my $size = -s $path;
+    die "invalid size\n" unless defined($size) && $size <= 4096;
+    open my $fh, "<", $path or die $!;
+    local $/;
+    my $entry = decode_json(<$fh>);
+    close $fh or die $!;
+    die "invalid entry\n" unless ref($entry) eq "HASH";
+    my ($pid, $start, $id) = @{$entry}{qw(pid start_time session_id)};
+    die "invalid pid\n" if ref($pid) || !defined($pid) || $pid !~ /\A[1-9][0-9]{0,9}\z/;
+    die "invalid start\n" if ref($start) || !defined($start) ||
+      $start !~ /\A[ -~]{1,128}\z/;
+    die "invalid session\n" if ref($id) || !defined($id) ||
+      $id !~ /\A[A-Za-z0-9._:-]{1,256}\z/;
+    print "$pid\t$start\t$id";
+  ' "$path" 2>/dev/null)" || return 1
+  SESSION_ENTRY_PID="${fields%%$'\t'*}"
+  rest="${fields#*$'\t'}"
+  [[ "$rest" != "$fields" ]] || return 1
+  SESSION_ENTRY_START="${rest%%$'\t'*}"
+  SESSION_ENTRY_ID="${rest#*$'\t'}"
+  [[ "$SESSION_ENTRY_ID" != "$rest" ]] || return 1
+}
+
+prune_stale_session_entries() {
+  local sessions="$OMNILANE_HOME/sessions" entry live_start
+  [[ -d "$sessions" && ! -L "$sessions" ]] || return 0
+  for entry in "$sessions"/*.json; do
+    [[ -f "$entry" && ! -L "$entry" ]] || continue
+    read_session_entry "$entry" || continue
+    if ! live_start="$(process_start_time "$SESSION_ENTRY_PID")" ||
+       [[ "$live_start" != "$SESSION_ENTRY_START" ]]; then
+      rm "$entry" 2>/dev/null || true
+    fi
+  done
+}
+
+find_foreman_session() { # dispatch pid -> nearest live Claude foreman session
+  local pid="$1" sessions="$OMNILANE_HOME/sessions"
+  local parent start entry hops=0
+  [[ "$pid" =~ ^[1-9][0-9]{0,9}$ ]] || return 1
+  [[ -d "$sessions" && ! -L "$sessions" ]] || return 1
+  prune_stale_session_entries
+
+  while [[ "$hops" -lt 128 ]]; do
+    parent="$(process_parent_pid "$pid")" || return 1
+    [[ "$parent" =~ ^[1-9][0-9]{0,9}$ && "$parent" != "$pid" ]] || return 1
+    start="$(process_start_time "$parent")" || return 1
+    entry="$sessions/$parent.json"
+    if read_session_entry "$entry" &&
+       [[ "$SESSION_ENTRY_PID" == "$parent" && "$SESSION_ENTRY_START" == "$start" ]]; then
+      printf '%s\n' "$SESSION_ENTRY_ID"
+      return 0
+    fi
+    pid="$parent"
+    hops=$((hops + 1))
+  done
+  return 1
+}
+
 # ---- Vendor registry (single source of truth) ---------------------------
 # Two vendor kinds. CLI-agent vendors run a local binary (see vendor_bin).
 # Direct-API vendors are OpenAI-compatible /chat/completions endpoints driven
@@ -181,6 +269,25 @@ read_lock_owner() {
   LOCK_OWNER_VALUE="$value"
 }
 
+prepare_private_store() { # path, diagnostic label
+  local store_root="$1" store_label="$2"
+  mkdir -p "$OMNILANE_HOME" || return 1
+  if [[ -L "$store_root" || ( -e "$store_root" && ! -d "$store_root" ) ]]; then
+    echo "omnilane: unsafe $store_label path (want real directory): $store_root" >&2
+    return 1
+  fi
+  [[ -d "$store_root" ]] || mkdir -m 700 "$store_root" || return 1
+  [[ -d "$store_root" && ! -L "$store_root" ]] || {
+    echo "omnilane: $store_label changed while preparing it" >&2
+    return 1
+  }
+  chmod 700 "$store_root" || return 1
+}
+
+prepare_inbox_store() {
+  prepare_private_store "$OMNILANE_HOME/inbox" "inbox store"
+}
+
 prepare_lock_store() {
   local lock_root="$OMNILANE_HOME/locks"
   mkdir -p "$OMNILANE_HOME"

package/scripts/lib/i18n.sh

@@ -28,6 +28,14 @@ msg() { # key -> localized string ({} = placeholder, see msgf)
       case "$L" in zh-TW) echo "已偵測到——請自行執行:";; zh-CN) echo "已检测到——请自行执行:";; ja) echo "検出——次を手動で実行:";; ko) echo "감지됨——직접 실행하세요:";; *) echo "found — run this yourself:";; esac ;;
     plugin_hint)
       case "$L" in zh-TW) echo "(選配:把本 repo 裝成 Claude Code 外掛,可用 /route 指令)";; zh-CN) echo "(可选:把本仓库装成 Claude Code 插件,获得 /route 命令)";; ja) echo "(任意:このリポジトリを Claude Code プラグインとして追加すると /route コマンドが使えます)";; ko) echo "(선택: 이 저장소를 Claude Code 플러그인으로 추가하면 /route 명령 사용 가능)";; *) echo "(optional: add this repo as a Claude Code plugin for /route commands)";; esac ;;
+    completion_notice_active)
+      case "$L" in zh-TW) echo "Claude Code 完成通知：已啟用（omnilane@omnilane 外掛已啟用）。";; zh-CN) echo "Claude Code 完成通知：已启用（omnilane@omnilane 插件已启用）。";; ja) echo "Claude Code 完了通知: 有効です（omnilane@omnilane プラグインが有効）。";; ko) echo "Claude Code 완료 알림: 활성 상태입니다(omnilane@omnilane 플러그인 활성화됨).";; *) echo "Claude Code completion notice: active (omnilane@omnilane is enabled).";; esac ;;
+    completion_notice_unknown)
+      case "$L" in zh-TW) echo "Claude Code 完成通知：狀態未知（查不到外掛狀態）。";; zh-CN) echo "Claude Code 完成通知：状态未知（无法查询插件状态）。";; ja) echo "Claude Code 完了通知: 状態不明（プラグイン状態を確認できません）。";; ko) echo "Claude Code 완료 알림: 상태를 알 수 없습니다(플러그인 상태 조회 실패).";; *) echo "Claude Code completion notice: unknown (plugin state could not be queried).";; esac ;;
+    completion_notice_inactive)
+      case "$L" in zh-TW) echo "Claude Code 完成通知：未啟用。這項功能需要安裝外掛；只有 skill symlink 不會送達通知。";; zh-CN) echo "Claude Code 完成通知：未启用。此功能需要安装插件；只有 skill symlink 不会送达通知。";; ja) echo "Claude Code 完了通知: 無効です。この機能にはプラグインのインストールが必要で、skill symlink だけでは通知されません。";; ko) echo "Claude Code 완료 알림: 비활성 상태입니다. 이 기능은 플러그인 설치가 필요하며 skill symlink만으로는 알림이 전달되지 않습니다.";; *) echo "Claude Code completion notice: inactive. This feature requires the plugin install; the skill symlink alone does not deliver notices.";; esac ;;
+    completion_notice_install)
+      case "$L" in zh-TW) echo "請執行：";; zh-CN) echo "请执行：";; ja) echo "次を実行してください:";; ko) echo "다음을 실행하세요:";; *) echo "Run:";; esac ;;
     linked)
       case "$L" in zh-TW) echo "已連結";; zh-CN) echo "已链接";; ja) echo "リンクしました";; ko) echo "링크됨";; *) echo "linked";; esac ;;
     removed)

package/scripts/lib/job-worker.sh

@@ -1,8 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
-# Internal worker boundary for one dispatch. The optional whole-job supervisor
+
+# Internal worker boundary for one dispatch. An optional whole-job supervisor
 # wraps this process so lock wait, retries, and vote rounds share one budget.
 
+# Runtime-relative shared library.
+# shellcheck disable=SC1091
 source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
 
 [[ $# -eq 7 ]] || { echo "omnilane: internal job worker received invalid arguments" >&2; exit 2; }
@@ -13,11 +16,177 @@ PROMPT_FILE="$6"; OUTPUT_FILE="$7"
 RUNNER="$OMNILANE_REPO/scripts/runners/run-$VENDOR.sh"
 [[ -x "$RUNNER" ]] || { echo "omnilane: no runner for vendor '$VENDOR'" >&2; exit 2; }
 
-# Two concurrent codex exec in one target dir corrupt its job index — serialize.
+# Two concurrent codex execs in one target dir corrupt its job index — serialize.
 [[ "$VENDOR" == "codex" ]] && acquire_cwd_lock codex "$WORKDIR"
 
+# The backslash case pattern is intentional.
+# shellcheck disable=SC1003
+json_escape() {
+  local s="$1" out="" ch escaped code i
+  for ((i = 0; i < ${#s}; i++)); do
+    ch="${s:i:1}"
+    case "$ch" in
+      '"') out="$out\\\"" ;;
+      '\\') out="$out\\\\" ;;
+      $'\b') out="$out\\b" ;;
+      $'\f') out="$out\\f" ;;
+      $'\n') out="$out\\n" ;;
+      $'\r') out="$out\\r" ;;
+      $'\t') out="$out\\t" ;;
+      *)
+        LC_CTYPE=C printf -v code '%d' "'$ch"
+        if [[ "$code" -ge 0 && "$code" -lt 32 ]]; then
+          printf -v escaped '\\u%04x' "$code"
+          out="$out$escaped"
+        else
+          out="$out$ch"
+        fi
+        ;;
+    esac
+  done
+  printf '%s' "$out"
+}
+
+emit_mode_notice() {
+  local notice="$1" notice_file="${OUTPUT_FILE%/*}/mode-notice.txt"
+  printf '%s\n' "$notice" >&2
+  if [[ -L "$notice_file" || ( -e "$notice_file" && ! -f "$notice_file" ) ]]; then
+    echo "omnilane: unsafe mode notice path" >&2
+    return 1
+  fi
+  (umask 077; printf '%s\n' "$notice" > "$notice_file")
+}
+
+run_single_shot() {
+  local notice="$1" rc
+  set +e
+  (
+    unset OMNILANE_INBOX
+    "$RUNNER" "$MODE" "$WORKDIR" "$MODEL" "$EFFORT" "$PROMPT_FILE" "$OUTPUT_FILE"
+  )
+  rc=$?
+  set -e
+  emit_mode_notice "$notice"
+  return "$rc"
+}
+
+if [[ "$VENDOR" != "claude" ]]; then
+  set +e
+  run_single_shot "omnilane: vendor '$VENDOR' is not live-capable; ran in single-shot mode"
+  rc=$?
+  set -e
+  exit "$rc"
+fi
+
+JOB_DIR="${OUTPUT_FILE%/*}"
+JOB_ID="${JOB_DIR##*/}"
+INBOX_FIFO="$JOB_DIR/inbox.fifo"
+HOLDER_PID_FILE="$JOB_DIR/inbox.holder.pid"
+READY_FILE="$JOB_DIR/inbox.ready"
+EVENTS_FILE="${OUTPUT_FILE}.events.jsonl"
+EVENTS_ALIAS="$JOB_DIR/events.jsonl"
+close_requested=0
+inbox_holder_open=0
+runner_pid=""
+
+# Invoked by the EXIT trap below.
+# shellcheck disable=SC2329
+cleanup_live_mailbox() {
+  if [[ "$inbox_holder_open" -eq 1 ]]; then
+    exec 3>&-
+    inbox_holder_open=0
+  fi
+  rm "$READY_FILE" "$HOLDER_PID_FILE" "$INBOX_FIFO" 2>/dev/null || true
+}
+
+prepare_live_mailbox() {
+  local path old_umask rc=0
+  for path in "$INBOX_FIFO" "$HOLDER_PID_FILE" "$READY_FILE" "$EVENTS_FILE" "$EVENTS_ALIAS"; do
+    [[ ! -e "$path" && ! -L "$path" ]] || return 1
+  done
+  old_umask="$(umask)"
+  umask 077
+  mkfifo "$INBOX_FIFO" || rc=$?
+  if [[ "$rc" -eq 0 ]]; then
+    : > "$EVENTS_FILE" || rc=$?
+  fi
+  if [[ "$rc" -eq 0 ]]; then
+    ln "$EVENTS_FILE" "$EVENTS_ALIAS" || rc=$?
+  fi
+  if [[ "$rc" -eq 0 ]]; then
+    chmod 600 "$INBOX_FIFO" "$EVENTS_FILE" "$EVENTS_ALIAS" || rc=$?
+  fi
+  umask "$old_umask"
+  if [[ "$rc" -ne 0 ]]; then
+    rm "$EVENTS_ALIAS" "$EVENTS_FILE" "$INBOX_FIFO" 2>/dev/null || true
+  fi
+  return "$rc"
+}
+
+last_result_status() {
+  local last_result
+  last_result="$(grep -E '"type"[[:space:]]*:[[:space:]]*"result"' "$EVENTS_FILE" 2>/dev/null | tail -n 1 || true)"
+  [[ -n "$last_result" ]] || return 1
+  [[ ! "$last_result" =~ "is_error"[[:space:]]*:[[:space:]]*true ]]
+}
+
+if ! prepare_live_mailbox; then
+  set +e
+  run_single_shot "omnilane: Claude live mailbox unavailable because FIFO setup failed; ran in single-shot mode"
+  rc=$?
+  set -e
+  exit "$rc"
+fi
+
+trap 'close_requested=1' USR1
+trap cleanup_live_mailbox EXIT
+truncate_payload "$PROMPT_FILE" 102400
+INITIAL_TEXT="$(cat "$PROMPT_FILE")"
+if [[ "${FOREMAN_SESSION+x}" == "x" ]]; then
+  FOREMAN_SESSION_VALUE="$FOREMAN_SESSION"
+else
+  FOREMAN_SESSION_VALUE="${foreman_session-}"
+fi
+
+write_current_pid_file "$HOLDER_PID_FILE"
+export OMNILANE_INBOX="$INBOX_FIFO"
+"$RUNNER" "$MODE" "$WORKDIR" "$MODEL" "$EFFORT" "$PROMPT_FILE" "$OUTPUT_FILE" &
+runner_pid=$!
+
+# Open only after the reader starts. The runner was launched first, so it cannot
+# inherit this write descriptor. FD 3 is the named holder for the conversation.
+exec 3> "$INBOX_FIFO"
+inbox_holder_open=1
+if [[ "$close_requested" -eq 0 ]]; then
+  printf '{"type":"user","omnilane_job_id":"%s","foreman_session":"%s","message":{"role":"user","content":[{"type":"text","text":"%s"}]}}\n' \
+    "$(json_escape "$JOB_ID")" "$(json_escape "$FOREMAN_SESSION_VALUE")" \
+    "$(json_escape "$INITIAL_TEXT")" >&3
+fi
+(umask 077; : > "$READY_FILE")
+
 set +e
-"$RUNNER" "$MODE" "$WORKDIR" "$MODEL" "$EFFORT" "$PROMPT_FILE" "$OUTPUT_FILE"
-rc=$?
+wait "$runner_pid"
+runner_rc=$?
 set -e
+
+if [[ "$close_requested" -eq 1 ]]; then
+  exec 3>&-
+  inbox_holder_open=0
+  set +e
+  kill -TERM "$runner_pid" 2>/dev/null || true
+  wait "$runner_pid" 2>/dev/null
+  set -e
+  if last_result_status; then
+    rc=0
+  else
+    rc=1
+    emit_mode_notice "omnilane: Claude live mailbox closed without a successful result event"
+  fi
+else
+  exec 3>&-
+  inbox_holder_open=0
+  rc="$runner_rc"
+fi
+
+trap - USR1
 exit "$rc"

package/scripts/runners/run-claude.sh

@@ -3,6 +3,8 @@ set -euo pipefail
 # omnilane runner: Claude Code CLI
 # Usage: run-claude.sh MODE WORKDIR MODEL EFFORT PROMPT_FILE OUTPUT_FILE
 
+# Runtime-relative shared library.
+# shellcheck disable=SC1091
 source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
 
 MODE="$1"; WORKDIR="$2"; MODEL="$3"; EFFORT="$4"; PROMPT_FILE="$5"; OUTPUT_FILE="$6"
@@ -12,6 +14,110 @@ RUN_TIMEOUT="${OMNILANE_TIMEOUT:-600}"
 
 truncate_payload "$PROMPT_FILE" 102400
 
+LIVE_INBOX="${OMNILANE_INBOX:-}"
+if [[ -n "$LIVE_INBOX" && -p "$LIVE_INBOX" ]]; then
+  EVENTS_FILE="${OUTPUT_FILE}.events.jsonl"
+  STDERR_FILE="${OUTPUT_FILE}.stderr.log"
+  LIVE_CHILD_PID=""
+
+  if [[ -L "$EVENTS_FILE" || ( -e "$EVENTS_FILE" && ! -f "$EVENTS_FILE" ) ]]; then
+    echo "omnilane: unsafe Claude live event path" >&2
+    exit 125
+  fi
+  (umask 077; : > "$EVENTS_FILE"; : > "$STDERR_FILE")
+
+  LIVE_ARGS=(--disable-slash-commands --model "$MODEL")
+  [[ -n "$EFFORT" && "$EFFORT" != "-" ]] && LIVE_ARGS+=(--effort "$EFFORT")
+  if [[ "$MODE" == "advise" ]]; then
+    LIVE_ARGS+=(--tools Read Glob Grep)
+  else
+    LIVE_ARGS+=(--permission-mode acceptEdits)
+  fi
+  LIVE_ARGS+=(-p --verbose --input-format stream-json --output-format stream-json)
+
+  finalize_live_output() {
+    local tmp="${OUTPUT_FILE}.tmp"
+    if ! command -v python3 >/dev/null 2>&1; then
+      echo "omnilane: cannot extract Claude live result: python3 not found" >> "$STDERR_FILE"
+      return 1
+    fi
+    if ! python3 - "$EVENTS_FILE" "$tmp" <<'PY'
+import json
+import pathlib
+import sys
+
+events_path = pathlib.Path(sys.argv[1])
+output_path = pathlib.Path(sys.argv[2])
+last_result = None
+
+with events_path.open(encoding="utf-8") as events:
+    for raw_line in events:
+        try:
+            event = json.loads(raw_line)
+        except json.JSONDecodeError:
+            continue
+        if event.get("type") == "result" and isinstance(event.get("result"), str):
+            last_result = event["result"]
+
+if last_result is None:
+    raise SystemExit(1)
+
+output_path.write_text(last_result.rstrip("\n") + "\n", encoding="utf-8")
+PY
+    then
+      echo "omnilane: Claude live stream ended without a readable result event" >> "$STDERR_FILE"
+      return 1
+    fi
+    mv "$tmp" "$OUTPUT_FILE"
+  }
+
+  # Invoked by signal traps below.
+  # shellcheck disable=SC2329
+  stop_live_child() {
+    local signal_rc="$1" waited=0
+    trap - TERM HUP INT
+    set +e
+    if [[ -n "$LIVE_CHILD_PID" ]] && kill -0 "$LIVE_CHILD_PID" 2>/dev/null; then
+      kill -TERM "-$LIVE_CHILD_PID" 2>/dev/null || kill -TERM "$LIVE_CHILD_PID" 2>/dev/null || true
+      while kill -0 "$LIVE_CHILD_PID" 2>/dev/null && [[ "$waited" -lt 50 ]]; do
+        sleep 0.1
+        waited=$((waited + 1))
+      done
+      if kill -0 "$LIVE_CHILD_PID" 2>/dev/null; then
+        kill -KILL "-$LIVE_CHILD_PID" 2>/dev/null || kill -KILL "$LIVE_CHILD_PID" 2>/dev/null || true
+      fi
+      wait "$LIVE_CHILD_PID" 2>/dev/null
+    fi
+    finalize_live_output || true
+    [[ -s "$STDERR_FILE" ]] || rm "$STDERR_FILE" 2>/dev/null || true
+    exit "$signal_rc"
+  }
+
+  set -m
+  (
+    cd "$WORKDIR" || exit 127
+    run_with_timeout "$RUN_TIMEOUT" env \
+      OMNILANE_DEPTH=1 \
+      "$CLAUDE_BIN" "${LIVE_ARGS[@]}" < "$LIVE_INBOX" > "$EVENTS_FILE" 2> "$STDERR_FILE"
+  ) &
+  LIVE_CHILD_PID=$!
+  set +m
+  trap 'stop_live_child 143' TERM
+  trap 'stop_live_child 129' HUP
+  trap 'stop_live_child 130' INT
+
+  set +e
+  wait "$LIVE_CHILD_PID"
+  RC=$?
+  set -e
+  trap - TERM HUP INT
+  if ! finalize_live_output && [[ "$RC" -eq 0 ]]; then
+    RC=1
+  fi
+  [[ -s "$STDERR_FILE" ]] || rm "$STDERR_FILE" 2>/dev/null || true
+  exit "$RC"
+fi
+
 ARGS=(--disable-slash-commands --model "$MODEL" --output-format text)
 [[ -n "$EFFORT" && "$EFFORT" != "-" ]] && ARGS+=(--effort "$EFFORT")
 if [[ "$MODE" == "advise" ]]; then

package/scripts/runners/run-codex.sh

@@ -16,7 +16,9 @@ RUN_TIMEOUT="${OMNILANE_TIMEOUT:-600}"
 
 # --skip-git-repo-check: the operator chose WORKDIR explicitly; codex would
 # otherwise refuse any directory that is not a trusted git repo.
-ARGS=(exec -m "$MODEL" -o "${OUTPUT_FILE}.tmp" --skip-git-repo-check)
+# --json: without it codex writes nothing until it exits, so a watchdog kill
+# leaves an empty progress log that looks identical to a run that never started.
+ARGS=(exec --json -m "$MODEL" -o "${OUTPUT_FILE}.tmp" --skip-git-repo-check)
 [[ -n "$EFFORT" && "$EFFORT" != "-" ]] && ARGS+=(-c "model_reasoning_effort=\"$EFFORT\"")
 if [[ "$MODE" == "advise" ]]; then
   ARGS+=(--ephemeral -s read-only)
@@ -41,10 +43,25 @@ set +e
 RC=$?
 set -e
 
-# Watchdog kill with an empty progress log = codex produced nothing at all;
-# the usual cause is a quota-window 429 retry loop, which codex retries silently.
-if [[ ("$RC" -eq 142 || "$RC" -eq 124) && ! -s "${OUTPUT_FILE}.progress.log" ]]; then
-  echo "omnilane: codex timed out after ${RUN_TIMEOUT}s with no output — likely a usage-limit retry loop; check your codex quota window and retry" >> "${OUTPUT_FILE}.stderr.log"
+if [[ "$RC" -eq 142 || "$RC" -eq 124 ]]; then
+  {
+    echo "omnilane: codex timed out after ${RUN_TIMEOUT}s. This does NOT identify the cause."
+    echo "omnilane: an empty progress log is NOT evidence of a stall — check, in order:"
+    echo "  1. the streamed events in ${OUTPUT_FILE}.progress.log — the last event says how far the run got"
+    echo "  2. the rollout file below — if it stops at task_started, the request never left the CLI"
+    echo "  3. your provider proxy's log for the run window: rate-limit responses, and whether a"
+    echo "     request was ever sent upstream at all"
+    # The rollout holds the full turn history a killed run never got to report;
+    # thread_id is the only handle onto it once the process is gone.
+    thread_id="$(head -1 "${OUTPUT_FILE}.progress.log" 2>/dev/null |
+      sed -n 's/.*"thread_id":"\([^"]*\)".*/\1/p')"
+    if [[ -n "$thread_id" ]]; then
+      rollout="$(find "${CODEX_HOME:-$HOME/.codex}/sessions" -name "rollout-*-${thread_id}.jsonl" 2>/dev/null | head -1)"
+      echo "omnilane: rollout: ${rollout:-not found (thread ${thread_id})}"
+    else
+      echo "omnilane: rollout: unknown — no thread_id in the progress log, so codex died before its first event"
+    fi
+  } >> "${OUTPUT_FILE}.stderr.log"
 fi
 
 if [[ -f "${OUTPUT_FILE}.tmp" ]]; then

package/skills/omnilane/SKILL.md

@@ -0,0 +1,172 @@
+---
+name: omnilane
+description: 'Universal model-routing table + cross-vendor dispatch for ANY harness (Claude Code, Codex, Grok Build, Antigravity). Use when delegating subtasks, choosing a model for work, planning multi-part tasks, or when asked about model routing, delegate, dispatch, which model, tier selection, escalate, 派工, 模型路由. One routing table; the main loop self-executes its own lane and shells out to every other vendor via dispatch.sh.'
+---
+
+# omnilane — one routing table, every harness
+
+You (the main loop) may be Claude, GPT, Grok, or Gemini. The procedure is identical:
+
+1. **Identify your main model.** You know which model you are running as.
+2. **Split the work into subtasks and classify each into a lane** (table below).
+3. **If the lane's model is you, self-execute.** Otherwise dispatch:
+   `<repo>/scripts/dispatch.sh [--vendor V] [--mode work] [--workdir DIR] <lane> "<task>"`
+   Add `--background` for long tasks; poll with `scripts/jobs.sh status|result <id>`.
+   Before changing lane order from anecdotal outcomes, run
+   `scripts/jobs.sh recommend [--last N] [--lane L] [--min-samples N]` and report
+   its evidence threshold. The command is read-only and never changes routing.
+   Preview old completed-job cleanup with `scripts/jobs.sh prune --keep <N>`;
+   deletion requires the explicit `--apply` flag and never targets running jobs.
+   A deep task whose CLI call may outrun the 600s per-call watchdog can raise its
+   cap with `--timeout <seconds>` (e.g. `--timeout 1200` for hard-judgment /
+   long-context). It bounds each CLI call, not the whole dispatch.
+   For one aggregate fuse across lock wait, retries, voters, and rounds, add
+   `--job-timeout <seconds>`. It is disabled by default; deep full-repository
+   audits typically need 7200–14400 seconds, and expiry returns 124. The one
+   automatic exception is non-Git Codex `work`: without an explicit, lane, or
+   global job timeout, its resolved per-call timeout becomes the whole-job fuse,
+   capped at the supervisor's 999999999-second maximum. If the bundled Perl
+   supervisor is unavailable, it warns and continues through the existing
+   per-call watchdog path.
+
+Run `scripts/dispatch.sh --list` to see the effective table (local overrides win).
+When routing is unexpectedly unavailable, run `bin/omnilane doctor` before
+changing configuration; it reports state and dependencies without repairing them.
+Doctor remains offline unless the operator explicitly adds `--probe V`; that
+bounded probe returns metadata only. Use `bin/omnilane benchmark` for a fixed
+no-call route plan, and add `--run` only when actual advise-mode comparison calls
+were explicitly requested. Neither command changes routing.
+Lanes are fallback chains — dispatch uses the first vendor CLI actually installed,
+so the same table works with any subset of subscriptions.
+
+## Lanes (defaults; see routing.yaml for the live values)
+
+Each lane's **backup** is the next candidate in its `routing.yaml` chain —
+what dispatch picks when the first-choice vendor CLI is not installed.
+
+| Lane | First choice | Backup | When |
+|---|---|---|---|
+| hardest-coding | GPT-5.6 Sol (xhigh) | Claude Opus 5 (xhigh) | Hardest implementation, deep root-cause debug, correctness-critical edits |
+| bulk-mechanical | GPT-5.6 Terra (max) | Claude Sonnet 5 (high) | Refactors, migrations, tests, review sweeps — mechanical endurance |
+| triage | GPT-5.6 Luna (medium) | Gemini 3.6 Flash (Low) | High-volume scans, first-pass filtering |
+| hard-judgment | Claude Opus 5 (xhigh) | GPT-5.6 Sol (max) | Architecture arbitration, deep reasoning, second opinions |
+| taste-final | Claude Opus 5 (high) | GPT-5.6 Sol (max) | User-facing prose, prompt/doc polish, Chinese phrasing, style arbitration |
+| consult | Explicit named vendor/model | — (no fallback) | Direct natural-language consultation; always keep `--vendor` |
+| ui-draft | GPT-5.6 Sol (xhigh) | Claude Opus 5 (high) | UI drafts only WITH a design system / reference images; open-ended visual taste goes to taste-final |
+| long-context | Gemini 3.1 Pro (High) | GPT-5.6 Sol (high) | 1M-token synthesis; Pro is agentic-capable, while fast repeated loops prefer Flash on speed/cost |
+| fast-agentic | GPT-5.6 Luna (max) | Gemini 3.6 Flash (High) | Fast multi-step agentic loops, multimodal checks |
+| live-search | Grok 4.5 | — (off) | Realtime X/web search and social context |
+| coding-overflow | Grok 4.5 | Kimi K3 → Qwen3 Coder Plus → OpenCode | Codex-quota relief valve for mid-tier coding; verify factual claims |
+| arbitrate | off (opt-in vote panel) | — | Disabled by default. Enable with `arbitrate: vote codex,claude,grok -` in routing.local.yaml or via the configurator (any 1-4 voters). One quota hit PER VOTER PER ROUND; you chair: read the opinions and own the decision. Effort field 2 = debate round (voters rebut each other) |
+
+Claude Fable 5 (`claude-fable-5`) is absent from the defaults on purpose: the
+top Claude tier is usually the main loop itself, not a dispatched worker, and
+it prices at twice Opus 5. This is a cost / guardrail / main-loop policy choice,
+not a capability verdict — Artificial Analysis calls Opus 5 (61) and Fable 5 (60)
+"effectively tied" on the Intelligence Index, but Opus 5 leads AA-Briefcase by
+146 Elo at 20% lower cost per task. Fable 5 keeps the lead on factual breadth
+(AA-Omniscience), so name it explicitly for recall-heavy consults. To route to
+it anyway, select it in the configurator or override a lane in
+`~/.omnilane/routing.local.yaml` (e.g. `taste-final: claude claude-fable-5 high`).
+
+## Natural-language consultation
+
+Users may speak normally; they do not need lane names.
+
+1. Capability-only question (`which model`, `what can Claude do`, `哪個模型`,
+   `誰適合`) → classify the need, then answer with the first available model
+   shown for that lane by `dispatch.sh --list`; do not dispatch unless execution
+   is also requested.
+2. Generic vendor name (`Claude`, `Codex`, `Grok`, `Gemini`, `OpenCode`) → run
+   `dispatch.sh --vendor <vendor> consult "<task>"`.
+3. Canonical model alias → pass its vendor, model, and effort from the table
+   below. Never silently substitute another model family.
+4. No named target → classify into an existing lane and dispatch normally.
+5. Unknown or ambiguous nickname → ask for clarification; do not guess or run.
+
+| Alias | Vendor | Model | Effort |
+|---|---|---|---|
+| Opus | claude | claude-opus-5 | high |
+| Fable | claude | claude-fable-5 | high |
+| Sonnet | claude | claude-sonnet-5 | high |
+| Haiku | claude | claude-haiku-4-5 | - |
+| Sol | codex | gpt-5.6-sol | max |
+| Terra | codex | gpt-5.6-terra | max |
+| Luna | codex | gpt-5.6-luna | medium |
+| Grok 4.5 | grok | grok-4.5 | - |
+| Gemini Pro | gemini | Gemini 3.1 Pro (High) | - |
+| Gemini Flash | gemini | Gemini 3.6 Flash (High) | - |
+| Kimi | kimi | kimi-k3 | - |
+| Qwen | qwen | qwen3-coder-plus | - |
+| OpenCode | opencode | provider/model form, or `-` for its own default | - |
+| OpenRouter | openrouter | explicit OpenRouter slug (e.g. anthropic/claude-sonnet-5) | - |
+
+OpenCode is the multi-provider aggregator CLI (75+ providers): work-capable,
+last resort in coding-overflow. OpenRouter is direct-API — no CLI needed, only
+`OPENROUTER_API_KEY` — and is **advise/consult only** (it cannot edit files);
+its model slug is mandatory. "Ask <any hosted model> via OpenRouter" →
+`dispatch.sh --vendor openrouter --model <slug> consult "<task>"`.
+
+Examples:
+
+- Ask Opus to challenge this architecture →
+  `dispatch.sh --vendor claude --model claude-opus-5 --effort high consult "challenge this architecture"`
+- 請 Grok 查最新公開資訊 →
+  `dispatch.sh --vendor grok consult "查最新公開資訊"`
+- 哪個模型適合檢查大型 repo？ → answer only; do not dispatch.
+
+Consultation defaults to `advise`. Use `--mode work --workdir <dir>` only for
+an explicit edit request. Missing explicit targets fail clearly; never remove
+`--vendor` to obtain a fallback.
+
+## Live UI is observation only
+
+The optional Live UI is a read-only observer, not a prompt or dispatch path.
+It displays existing jobs' `task.txt` and public `out.txt`, but never raw logs;
+its history search and state filters can export only the currently visible public
+metadata as local JSON; tokens and task/result bodies are excluded from export.
+it cannot interpret natural language, choose routes, dispatch, retry, cancel,
+delete jobs, or edit configuration. Natural-language interpretation and
+dispatch stay in this skill and the CLI. Manage the local board with
+`omnilane ui start|status|url|stop`, and stop it when monitoring is finished.
+
+## Rules
+
+- **Dispatch in `advise` mode by default** (read-only worker). Use `--mode work`
+  only when the worker must edit files, and give it an explicit `--workdir`.
+- **`--mode sysops`** is `work` minus the vendor sandbox, for service
+  operations the sandbox denies (launchctl, system daemons). Codex runs with
+  `-s danger-full-access`; other vendors treat it as `work`. Explicit
+  per-dispatch opt-in only — never a lane default, and the task text must
+  name the exact service commands the worker is authorized to run.
+  Codex `work`/`sysops` still needs a git-repo `--workdir` (non-git
+  directories trip the whole-job fuse).
+- **Every dispatched task states acceptance criteria and the exact verification
+  command.** Do not accept "done" without evidence.
+- **No nested dispatch**: workers must not fan out again (enforced via
+  `OMNILANE_DEPTH`). Escalate back to the main loop instead.
+- **Same-directory codex dispatches are serialized automatically** (lock);
+  do not try to parallelize them yourself.
+- Escalate without asking: two failed attempts on a lane → move one lane up
+  (triage → bulk-mechanical → hardest-coding).
+- Vendor quota exhausted (429 / "stream disconnected" / usage-limit message):
+  send mid-tier coding through coding-overflow instead; never silently downgrade
+  hardest-coding — wait or escalate to the user.
+
+## Per-model notes (apply the row matching YOUR main model)
+
+- **Claude (Fable/Opus main)**: top judgment and taste are yours — self-execute;
+  push mechanical coding volume out to the codex lanes.
+- **Claude Sonnet main**: coordination/tools/mid-tier coding only; never
+  self-assign top judgment or hardest implementation.
+- **GPT Sol main**: hardest coding + hard judgment are yours (use max for
+  judgment turns, xhigh for coding); cross to taste-final for style calls.
+- **GPT Terra main**: bulk work is yours at max; escalate the genuinely hardest
+  pieces to Sol instead of grinding.
+- **Grok 4.5 main**: mid-tier coding + live-search are yours; verify every API
+  signature and cited fact before shipping (measured high hallucination rate).
+- **Gemini Flash main**: fast agentic/multimodal loops are yours; never
+  self-assign top judgment.
+- **Gemini 3.1 Pro main**: 1M-context synthesis and context-heavy agentic work
+  are yours. Prefer Gemini Flash for fast repeated tool loops on speed/cost;
+  route hardest coding and judgment to the stronger codex lanes.