product-console-companion 0.5.2 → 0.6.1

package/README.md

@@ -3,8 +3,8 @@
 A local-first BYOS companion for the [Fynch Product Console](../README.md). Reads code from
 your own machine, so:
 
-- code never leaves your machine — only a small structured verdict (matches/differs + a short
-  explanation) is ever sent back;
+- code never goes to Fynch's servers — only a small structured verdict (matches/differs + a short
+  explanation) is sent back; the locally chosen AI provider receives the text needed to judge it;
 - there's no server-side truncation on what gets read (`server/drift.ts`'s
   `MAX_FILE_CHARS`/`MAX_TREE_PATHS` don't apply here at all);
 - AI spend bills against your own key/subscription, not the workspace's shared/BYOK credential.
@@ -13,7 +13,7 @@ Runs every AI task the hosted Console dispatches. That includes the repo-aware s
 checks as well as graph reasoning such as impact analysis, reviews, coupling maps, graph Q&A,
 edge descriptions, and exports. Graph-reasoning tasks receive all of their context from the
 Console and run connectionless with zero filesystem access. New server-side graph-reasoning task
-kinds use the same safe fallback without requiring another companion release. Two backends are
+kinds use the same safe fallback without requiring another companion release. Three backends are
 available, chosen per connection at `connect` time:
 
 - **`api-key`** (default) — no CLI dependency. Calls Anthropic directly with your own API key
@@ -26,6 +26,9 @@ available, chosen per connection at `connect` time:
   against a disposable, read-only git worktree (`sandbox.ts`) as defense-in-depth on top of
   `--restricted --tools "Read,Grep,Glob"`, which should already make a write/exec structurally
   impossible on its own.
+- **`codex`** — uses a ChatGPT subscription through the Codex CLI as a model-only backend. The
+  companion still selects and reads files itself; Codex is given only their text and cannot
+  explore the checkout.
 
 ## Setup
 
@@ -63,7 +66,8 @@ npx product-console-companion connect --url https://console.fynchconsulting.com
 
 This runs your workspace's PRD-only setup AI calls when there is no repo yet. `run` then polls
 for workspace-level tasks in addition to any per-repo connections configured on this machine.
-Pass `--backend cli` to use your Claude subscription for these repo-less tasks too. This mode
+Pass `--backend cli` to use your Claude subscription, or `--backend codex` to use a ChatGPT
+subscription, for these repo-less tasks too. This mode
 runs with zero filesystem access (stricter than the repo-scoped `cli` backend, because there is
 nothing to read). PDF-format PRDs cannot be delivered to the `cli` backend yet; use `api-key`,
 or re-upload the PRD as `.md`, `.txt`, or `.docx`.
@@ -79,6 +83,56 @@ into it first — `npm install -g @anthropic-ai/claude-code`, then run `claude`
 prompt. `connect` checks `claude --version` up front and fails fast if it's missing. Bills against
 your Claude subscription, not a separate API key.
 
+## ChatGPT subscription through Codex CLI
+
+**Requirements.** Install the Codex CLI with `npm install -g @openai/codex`, then log in once to
+the companion's own Codex home. This is separate from your normal Codex login:
+
+```powershell
+New-Item -ItemType Directory -Force "$HOME\.product-console-companion\codex-home" | Out-Null; $env:CODEX_HOME="$HOME\.product-console-companion\codex-home"; codex login; Remove-Item Env:CODEX_HOME
+```
+
+```bash
+mkdir -p "$HOME/.product-console-companion/codex-home" && CODEX_HOME="$HOME/.product-console-companion/codex-home" codex login
+```
+
+Use the PowerShell command on Windows and the shell command on macOS/Linux. Codex loads the global
+`AGENTS.md` from its home into every call, so the separate login ensures your own instructions do
+not shape Product Console assessments. The folder must exist before `codex login`, and the Windows
+line clears `CODEX_HOME` afterwards so the terminal goes back to your own Codex login.
+`connect --backend codex` checks this login before it saves
+anything, and `run` checks it again before it polls or claims work. A logged-out `codex exec` can
+retry a 401 ten times, so the companion never uses a failed task as a login check.
+
+**How it works.** Codex never runs commands and is never given a path to your files. The companion
+picks and reads the relevant files itself, exactly like the API-key backend, and gives Codex their
+text to judge. Codex runs in an empty temporary folder. Like the API-key backend, it sees only the
+files selected for it, up to eight per module; the Claude Code backend can explore further.
+
+**What stops it acting.** Every Codex feature that can be switched off is switched off, no Codex
+sandbox is used, and on the supported models every local tool routes through one mechanism that
+refuses when switched off. Codex still lists some tools it cannot use. If it ever tries one, the
+companion stops the call and throws the answer away. This was verified on Windows; the
+companion-side stop applies on every platform.
+
+Some prompt material cannot be removed by any tested setting: a skills list and a multi-agent
+role message remain. That role message's own instruction forbids starting sub-agents unless the
+user asks. Your environment variables are kept away from Codex: variables whose names look like
+credentials are removed before Codex starts, and Codex's command environment is restricted too.
+
+**No dollar budget enforcement.** Codex reports tokens, not cost, and exposes no budget flag or
+output-token cap. The 10-minute timeout is the only hard bound. The companion logs the returned
+token usage and explicitly marks the task's dollar budget as unenforced.
+
+One model is used for every task type because there is no evidence that ChatGPT-plan models map to
+the Claude tiers sent by the server. The default is `gpt-6-astra`. To override it, pass
+`--codex-model gpt-5.6-sol`, `--codex-model gpt-5.6-terra`, or `--codex-model gpt-5.6-luna` to
+`connect`. Other Codex models are refused because they were not verified to refuse tool use when
+their tools are switched off. The server's requested reasoning effort still passes through.
+
+PDF PRDs are not supported on this backend. Re-upload one as `.md`, `.txt`, or `.docx`, or use the
+API-key backend.
+
 Once it's running:
 
 ```bash

package/dist/api-key-caller.js

@@ -1,3 +1,16 @@
+/**
+ * The 3b backend (see the local-companion plan's Section 3) — no CLI dependency, calls the
+ * model directly with a locally-configured API key. Structurally mirrors server/drift.ts's
+ * verifyModuleAgainstCode almost exactly (same two-pass shape: pick candidate files, then judge
+ * against their contents) — the two things that actually change are which machine runs it and
+ * that file reads go through node:fs against the local checkout instead of the GitHub API, so
+ * nothing here truncates a file's contents the way MAX_FILE_CHARS does server-side.
+ *
+ * fileSelectSchema below is a deliberate duplicate of server/drift.ts's own (not imported —
+ * this package is meant to be independently publishable, see types.ts's own comment). Keep the
+ * two in sync by hand if either changes.
+ */
+import Anthropic from '@anthropic-ai/sdk';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { buildLocalDesignContext } from './design-context.js';
@@ -9,7 +22,40 @@ const MAX_CANDIDATE_FILES = 8;
  *  this backend is that what IS read is never truncated; this only guards against an
  *  accidentally-selected generated/binary/data file blowing up the prompt. */
 const MAX_FILE_BYTES = 512 * 1024;
-const fileSelectSchema = {
+/** Structured model-only call used by the investigation reader. The reader, not this call and
+ * not the model, owns every repository read and evidence id. */
+export async function runStructuredModelCall(client, request) {
+    const stream = client.messages.stream({
+        model: request.model,
+        max_tokens: request.maxTokens,
+        thinking: { type: 'adaptive' },
+        output_config: {
+            effort: request.effort,
+            format: { type: 'json_schema', schema: request.schema },
+        },
+        system: request.system,
+        messages: [{ role: 'user', content: request.prompt }],
+    });
+    let message;
+    try {
+        message = await stream.finalMessage();
+    }
+    catch (error) {
+        if (error instanceof Anthropic.RateLimitError) {
+            throw new Error('budget_exhausted: Anthropic API rate limit (HTTP 429).', { cause: error });
+        }
+        throw error;
+    }
+    if (message.stop_reason === 'refusal')
+        throw new Error('The model declined the structured investigation call.');
+    if (message.stop_reason === 'max_tokens')
+        throw new Error('budget_exhausted: the structured investigation call reached its output-token limit.');
+    const text = message.content.find((block) => block.type === 'text');
+    if (!text || text.type !== 'text')
+        throw new Error('The structured investigation call returned no text.');
+    return JSON.parse(text.text);
+}
+export const fileSelectSchema = {
     type: 'object',
     additionalProperties: false,
     required: ['paths'],
@@ -39,7 +85,7 @@ async function readLocalFile(repoPath, relPath) {
  * exact schema the task shipped with (task.payload.spec.schema), `filesRead` for the UI's
  * provenance note. Throws on anything that should surface as a task error (caller reports it
  * via POST .../error). */
-export async function runVerifyModuleTask(client, task, repoPath) {
+export async function runVerifyModuleTask(callModel, task, repoPath) {
     const payload = task.payload;
     const spec = payload.spec;
     const allFiles = await listRepoFiles(repoPath);
@@ -58,20 +104,18 @@ ${allFiles.join('\n')}
 First, list the file paths (verbatim from the tree above, up to ${MAX_CANDIDATE_FILES}) most
 likely to implement this module's behaviour. Prefer application source over tests, config, and
 generated files. Empty list if nothing plausibly implements it.`;
-    const selectStream = client.messages.stream({
+    const selectMsg = await callModel({
+        purpose: 'verify_module:file_select',
         model: spec.model,
-        max_tokens: 2000,
-        thinking: { type: 'adaptive' },
-        output_config: { effort: 'low', format: { type: 'json_schema', schema: fileSelectSchema } },
+        maxTokens: 2000,
+        effort: 'low',
         system: spec.system,
-        messages: [{ role: 'user', content: selectPrompt }],
+        stableText: '',
+        text: selectPrompt,
+        schema: fileSelectSchema,
     });
-    const selectMsg = await selectStream.finalMessage();
-    const selectText = selectMsg.content.find((b) => b.type === 'text');
-    if (!selectText || selectText.type !== 'text')
-        throw new Error('Could not pick files to check (no text in the file-select response).');
     const known = new Set(allFiles);
-    const chosen = JSON.parse(selectText.text).paths.filter((p) => known.has(p)).slice(0, MAX_CANDIDATE_FILES);
+    const chosen = JSON.parse(selectMsg.text).paths.filter((p) => known.has(p)).slice(0, MAX_CANDIDATE_FILES);
     if (chosen.length === 0) {
         return {
             filesRead: [],
@@ -91,30 +135,17 @@ generated files. Empty list if nothing plausibly implements it.`;
     // Pass 2: does the code satisfy the spec? spec.system/spec.volatileText/spec.schema are sent
     // by the server unchanged — this is the exact same prompt+schema the server-execution path
     // would use, just pointed at unbounded local file contents instead of truncated GitHub reads.
-    const content = [];
-    if (spec.stableText)
-        content.push({ type: 'text', text: spec.stableText, cache_control: { type: 'ephemeral' } });
-    content.push({
-        type: 'text',
-        text: `${spec.volatileText}\n\n# The actual code, as it currently stands locally\n\n${files.map((f) => `## ${f.path}\n\n\`\`\`\n${f.content}\n\`\`\``).join('\n\n')}`,
-    });
-    const verdictStream = client.messages.stream({
+    const verdictMsg = await callModel({
+        purpose: 'verify_module:judge',
         model: spec.model,
-        max_tokens: spec.maxTokens,
-        thinking: { type: 'adaptive' },
-        output_config: spec.schema
-            ? { effort: spec.effort, format: { type: 'json_schema', schema: spec.schema } }
-            : { effort: spec.effort },
+        maxTokens: spec.maxTokens,
+        effort: spec.effort,
         system: spec.system,
-        messages: [{ role: 'user', content }],
+        stableText: spec.stableText,
+        text: `${spec.volatileText}\n\n# The actual code, as it currently stands locally\n\n${files.map((f) => `## ${f.path}\n\n\`\`\`\n${f.content}\n\`\`\``).join('\n\n')}`,
+        schema: spec.schema,
     });
-    const verdictMsg = await verdictStream.finalMessage();
-    if (verdictMsg.stop_reason === 'refusal')
-        throw new Error('The model declined to check this module.');
-    const verdictText = verdictMsg.content.find((b) => b.type === 'text');
-    if (!verdictText || verdictText.type !== 'text')
-        throw new Error('No verdict returned.');
-    return { result: JSON.parse(verdictText.text), filesRead: files.map((f) => f.path) };
+    return { result: JSON.parse(verdictMsg.text), filesRead: files.map((f) => f.path) };
 }
 /* ------------------------------------------------------------------ generate_spec_batch */
 /** Matches verify_module's own MAX_CANDIDATE_FILES — tried lower (4) first on the theory that a
@@ -126,7 +157,7 @@ generated files. Empty list if nothing plausibly implements it.`;
  *  beats the server path's own FILES_PER_MODULE=2 (bootstrap.ts) either way; this raises the
  *  ceiling for the genuinely multi-file case rather than assuming it wouldn't come up. */
 const MAX_FILES_PER_MODULE_IN_BATCH = 8;
-const batchFileSelectSchema = {
+export const batchFileSelectSchema = {
     type: 'object',
     additionalProperties: false,
     required: ['selections'],
@@ -156,31 +187,23 @@ const batchFileSelectSchema = {
  *  the whole specs array in pass 2. `spec.volatileText` already carries the per-module id/lane/
  *  purpose breakdown and the "find files yourself" instruction (buildSpecBatchVolatile,
  *  server/bootstrap.ts) — this only adds the file tree and, in pass 2, what was actually read. */
-export async function runGenerateSpecBatchTask(client, task, repoPath) {
+export async function runGenerateSpecBatchTask(callModel, task, repoPath) {
     const payload = task.payload;
     const spec = payload.spec;
     const moduleIds = payload.moduleIds;
     if (payload.connectionless) {
         // The PRD is already in spec.stableText (stableTextForLocalDispatch); there is nothing local to read.
-        const content = [];
-        if (spec.stableText)
-            content.push({ type: 'text', text: spec.stableText, cache_control: { type: 'ephemeral' } });
-        content.push({ type: 'text', text: spec.volatileText });
-        const writeStream = client.messages.stream({
+        const writeMsg = await callModel({
+            purpose: 'generate_spec_batch:write',
             model: spec.model,
-            max_tokens: spec.maxTokens,
-            thinking: { type: 'adaptive' },
-            output_config: spec.schema ? { effort: spec.effort, format: { type: 'json_schema', schema: spec.schema } } : { effort: spec.effort },
+            maxTokens: spec.maxTokens,
+            effort: spec.effort,
             system: spec.system,
-            messages: [{ role: 'user', content }],
+            stableText: spec.stableText,
+            text: spec.volatileText,
+            schema: spec.schema,
         });
-        const writeMsg = await writeStream.finalMessage();
-        if (writeMsg.stop_reason === 'refusal')
-            throw new Error('The model declined to write specs for this batch.');
-        const writeText = writeMsg.content.find((b) => b.type === 'text');
-        if (!writeText || writeText.type !== 'text')
-            throw new Error('No specs returned.');
-        return { result: JSON.parse(writeText.text), filesRead: [] };
+        return { result: JSON.parse(writeMsg.text), filesRead: [] };
     }
     const allFiles = await listRepoFiles(repoPath);
     console.log(`  scanning ${allFiles.length} files in ${repoPath} for ${moduleIds.length} module(s)…`);
@@ -196,20 +219,18 @@ ${allFiles.join('\n')}
 For EACH module above (by id: ${moduleIds.join(', ')}), list up to ${MAX_FILES_PER_MODULE_IN_BATCH}
 file paths (verbatim from the tree above) most likely to implement it. One entry per module id,
 in the same order as given.`;
-    const selectStream = client.messages.stream({
+    const selectMsg = await callModel({
+        purpose: 'generate_spec_batch:file_select',
         model: spec.model,
-        max_tokens: 3000,
-        thinking: { type: 'adaptive' },
-        output_config: { effort: 'low', format: { type: 'json_schema', schema: batchFileSelectSchema } },
+        maxTokens: 3000,
+        effort: 'low',
         system: spec.system,
-        messages: [{ role: 'user', content: selectPrompt }],
+        stableText: '',
+        text: selectPrompt,
+        schema: batchFileSelectSchema,
     });
-    const selectMsg = await selectStream.finalMessage();
-    const selectText = selectMsg.content.find((b) => b.type === 'text');
-    if (!selectText || selectText.type !== 'text')
-        throw new Error('Could not pick files for this batch (no text in the file-select response).');
     const known = new Set(allFiles);
-    const selections = JSON.parse(selectText.text).selections;
+    const selections = JSON.parse(selectMsg.text).selections;
     const uniquePaths = [...new Set(selections.flatMap((s) => s.paths.filter((p) => known.has(p)).slice(0, MAX_FILES_PER_MODULE_IN_BATCH)))];
     const fileMap = new Map();
     await Promise.all(uniquePaths.map(async (p) => {
@@ -225,25 +246,17 @@ in the same order as given.`;
         return `## Files read for ${s.moduleId}\n\n${found.length ? found.map((p) => `### ${p}\n\`\`\`\n${fileMap.get(p)}\n\`\`\``).join('\n\n') : '(nothing readable found for this module)'}`;
     })
         .join('\n\n');
-    const content = [];
-    if (spec.stableText)
-        content.push({ type: 'text', text: spec.stableText, cache_control: { type: 'ephemeral' } });
-    content.push({ type: 'text', text: `${spec.volatileText}\n\n# Related files, as found in the local checkout\n\n${filesSection}` });
-    const writeStream = client.messages.stream({
+    const writeMsg = await callModel({
+        purpose: 'generate_spec_batch:write',
         model: spec.model,
-        max_tokens: spec.maxTokens,
-        thinking: { type: 'adaptive' },
-        output_config: spec.schema ? { effort: spec.effort, format: { type: 'json_schema', schema: spec.schema } } : { effort: spec.effort },
+        maxTokens: spec.maxTokens,
+        effort: spec.effort,
         system: spec.system,
-        messages: [{ role: 'user', content }],
+        stableText: spec.stableText,
+        text: `${spec.volatileText}\n\n# Related files, as found in the local checkout\n\n${filesSection}`,
+        schema: spec.schema,
     });
-    const writeMsg = await writeStream.finalMessage();
-    if (writeMsg.stop_reason === 'refusal')
-        throw new Error('The model declined to write specs for this batch.');
-    const writeText = writeMsg.content.find((b) => b.type === 'text');
-    if (!writeText || writeText.type !== 'text')
-        throw new Error('No specs returned.');
-    return { result: JSON.parse(writeText.text), filesRead: [...fileMap.keys()] };
+    return { result: JSON.parse(writeMsg.text), filesRead: [...fileMap.keys()] };
 }
 /* ---------------------------------------------------- propose_skeleton / propose_new_capabilities */
 /**
@@ -258,7 +271,7 @@ in the same order as given.`;
  * server/index.ts's completeAiJob payloads for /api/setup/skeleton and
  * /api/module-suggestions/scan — neither includes it), so there's nothing meaningful to report.
  */
-async function runShallowRepoTask(client, spec, repoPath, connectionless = false) {
+async function runShallowRepoTask(callModel, purpose, spec, repoPath, connectionless = false) {
     let repoSection = '';
     if (!connectionless) {
         const repoCtx = await buildLocalRepoContext(repoPath);
@@ -279,45 +292,35 @@ ${repoCtx.changelog ?? '(none found)'}
 ${repoCtx.packageJson ?? '(none found)'}
 `.trim();
     }
-    const content = [];
-    if (spec.stableDocumentBase64) {
-        content.push({ type: 'document', source: { type: 'base64', media_type: 'application/pdf', data: spec.stableDocumentBase64 } });
-    }
-    if (spec.stableText)
-        content.push({ type: 'text', text: spec.stableText, cache_control: { type: 'ephemeral' } });
-    content.push({ type: 'text', text: connectionless ? spec.volatileText : `${spec.volatileText}\n\n${repoSection}` });
-    const stream = client.messages.stream({
+    const message = await callModel({
+        purpose,
         model: spec.model,
-        max_tokens: spec.maxTokens,
-        thinking: { type: 'adaptive' },
-        output_config: spec.schema ? { effort: spec.effort, format: { type: 'json_schema', schema: spec.schema } } : { effort: spec.effort },
+        maxTokens: spec.maxTokens,
+        effort: spec.effort,
         system: spec.system,
-        messages: [{ role: 'user', content }],
+        stableText: spec.stableText,
+        text: connectionless ? spec.volatileText : `${spec.volatileText}\n\n${repoSection}`,
+        schema: spec.schema,
+        documentBase64: spec.stableDocumentBase64,
     });
-    const message = await stream.finalMessage();
-    if (message.stop_reason === 'refusal')
-        throw new Error('The model declined this request.');
-    const text = message.content.find((b) => b.type === 'text');
-    if (!text || text.type !== 'text')
-        throw new Error('No result returned.');
-    return { result: spec.schema ? JSON.parse(text.text) : text.text, filesRead: [] };
+    return { result: spec.schema ? JSON.parse(message.text) : message.text, filesRead: [] };
 }
 /** Forward-compatible fallback for server-created graph/spec reasoning tasks. The server sends
  *  the complete self-describing spec, so these calls never need or receive filesystem context. */
-export async function runGenericTask(client, task, repoPath) {
+export async function runGenericTask(callModel, task, repoPath) {
     const spec = task.payload?.spec;
     if (!spec || typeof spec !== 'object' || Array.isArray(spec)) {
         throw new Error(`Cannot run task kind "${task.kind}": payload.spec is missing or not an object.`);
     }
-    return runShallowRepoTask(client, spec, repoPath, true);
+    return runShallowRepoTask(callModel, 'generic', spec, repoPath, true);
 }
-export async function runProposeSkeletonTask(client, task, repoPath) {
+export async function runProposeSkeletonTask(callModel, task, repoPath) {
     const payload = task.payload;
-    return runShallowRepoTask(client, payload.spec, repoPath, payload.connectionless);
+    return runShallowRepoTask(callModel, 'propose_skeleton', payload.spec, repoPath, payload.connectionless);
 }
-export async function runProposeNewCapabilitiesTask(client, task, repoPath) {
+export async function runProposeNewCapabilitiesTask(callModel, task, repoPath) {
     const payload = task.payload;
-    return runShallowRepoTask(client, payload.spec, repoPath);
+    return runShallowRepoTask(callModel, 'propose_new_capabilities', payload.spec, repoPath);
 }
 /* --------------------------------------------------------------------- design_prompt */
 /**
@@ -329,33 +332,22 @@ export async function runProposeNewCapabilitiesTask(client, task, repoPath) {
  * generateDesignPrompt — the local-dispatch branch decides which wording to send based on the
  * same `direction` the server path already respects, before this ever reaches the companion).
  */
-export async function runDesignPromptTask(client, task, repoPath) {
+export async function runDesignPromptTask(callModel, task, repoPath) {
     const payload = task.payload;
     const spec = payload.spec;
     const designContext = await buildLocalDesignContext(repoPath);
     console.log(`  design signal: ${designContext ? 'found' : 'none found'}`);
-    const content = [];
-    if (spec.stableText)
-        content.push({ type: 'text', text: spec.stableText, cache_control: { type: 'ephemeral' } });
-    content.push({
-        type: 'text',
-        text: designContext ? `${spec.volatileText}\n\n# Design signal found in your local checkout\n\n${designContext}` : spec.volatileText,
-    });
-    const stream = client.messages.stream({
+    const message = await callModel({
+        purpose: 'design_prompt',
         model: spec.model,
-        max_tokens: spec.maxTokens,
-        thinking: { type: 'adaptive' },
-        output_config: spec.schema ? { effort: spec.effort, format: { type: 'json_schema', schema: spec.schema } } : { effort: spec.effort },
+        maxTokens: spec.maxTokens,
+        effort: spec.effort,
         system: spec.system,
-        messages: [{ role: 'user', content }],
+        stableText: spec.stableText,
+        text: designContext ? `${spec.volatileText}\n\n# Design signal found in your local checkout\n\n${designContext}` : spec.volatileText,
+        schema: spec.schema,
     });
-    const message = await stream.finalMessage();
-    if (message.stop_reason === 'refusal')
-        throw new Error('The model declined to write a design prompt.');
-    const text = message.content.find((b) => b.type === 'text');
-    if (!text || text.type !== 'text')
-        throw new Error('No design prompt returned.');
-    return { result: text.text, filesRead: [] }; // filesRead unused for this kind — see propose_skeleton/propose_new_capabilities's own comment
+    return { result: message.text, filesRead: [] }; // filesRead unused for this kind — see propose_skeleton/propose_new_capabilities's own comment
 }
 /* --------------------------------------------------------------------- analyse_shipment */
 /**
@@ -369,7 +361,7 @@ export async function runDesignPromptTask(client, task, repoPath) {
  * error via POST .../error, which surfaces to checkConnection as one caught, per-commit failure
  * (see server/poller.ts's own comment), not a crash that would wedge the rest of that check.
  */
-export async function runAnalyseShipmentTask(client, task, repoPath) {
+export async function runAnalyseShipmentTask(callModel, task, repoPath) {
     const payload = task.payload;
     const prep = await prepareShipmentAnalysis(repoPath, payload.sha);
     if (prep.outcome === 'sha_not_local') {
@@ -381,25 +373,17 @@ export async function runAnalyseShipmentTask(client, task, repoPath) {
     }
     console.log(`  read ${payload.sha.slice(0, 7)}'s diff locally (${prep.diffText.length} chars, ${prep.changedPaths.length} file(s) changed)`);
     const spec = appendDiffToVolatile(payload.spec, prep.diffText, prep.changedPaths);
-    const content = [];
-    if (spec.stableText)
-        content.push({ type: 'text', text: spec.stableText, cache_control: { type: 'ephemeral' } });
-    content.push({ type: 'text', text: spec.volatileText });
-    const stream = client.messages.stream({
+    const message = await callModel({
+        purpose: 'analyse_shipment',
         model: spec.model,
-        max_tokens: spec.maxTokens,
-        thinking: { type: 'adaptive' },
-        output_config: spec.schema ? { effort: spec.effort, format: { type: 'json_schema', schema: spec.schema } } : { effort: spec.effort },
+        maxTokens: spec.maxTokens,
+        effort: spec.effort,
         system: spec.system,
-        messages: [{ role: 'user', content }],
+        stableText: spec.stableText,
+        text: spec.volatileText,
+        schema: spec.schema,
     });
-    const message = await stream.finalMessage();
-    if (message.stop_reason === 'refusal')
-        throw new Error('The model declined to analyse this shipment.');
-    const text = message.content.find((b) => b.type === 'text');
-    if (!text || text.type !== 'text')
-        throw new Error('No drift analysis returned.');
     // filesRead unused for this kind, same as propose_skeleton/propose_new_capabilities above —
     // dispatchAndAwaitLocalTask's caller (poller.ts) only consumes the parsed result, not filesRead.
-    return { result: JSON.parse(text.text), filesRead: [] };
+    return { result: JSON.parse(message.text), filesRead: [] };
 }