product-console-companion 0.7.1 → 0.7.3

package/dist/api-key-caller.js

@@ -16,6 +16,7 @@ import { join } from 'node:path';
 import { buildLocalDesignContext } from './design-context.js';
 import { buildLocalRepoContext, listRepoFiles } from './local-scan.js';
 import { appendDiffToVolatile, prepareShipmentAnalysis } from './shipment.js';
+import { replyText, streamWithFallback } from './text-model.js';
 const MAX_CANDIDATE_FILES = 8;
 /** A skip threshold, not a truncation — a file over this is left OUT of what's read entirely
  *  (with a note in the log), rather than read and cut off partway through. The whole point of
@@ -25,7 +26,7 @@ const MAX_FILE_BYTES = 512 * 1024;
 /** Structured model-only call used by the investigation reader. The reader, not this call and
  * not the model, owns every repository read and evidence id. */
 export async function runStructuredModelCall(client, request) {
-    const stream = client.messages.stream({
+    const stream = streamWithFallback(client, {
         model: request.model,
         max_tokens: request.maxTokens,
         thinking: { type: 'adaptive' },
@@ -46,14 +47,12 @@ export async function runStructuredModelCall(client, request) {
         }
         throw error;
     }
-    if (message.stop_reason === 'refusal')
-        throw new Error('The model declined the structured investigation call.');
     if (message.stop_reason === 'max_tokens')
         throw new Error('budget_exhausted: the structured investigation call reached its output-token limit.');
-    const text = message.content.find((block) => block.type === 'text');
-    if (!text || text.type !== 'text')
+    const text = replyText(message, 'The model declined the structured investigation call.');
+    if (!text)
         throw new Error('The structured investigation call returned no text.');
-    return JSON.parse(text.text);
+    return JSON.parse(text);
 }
 export const fileSelectSchema = {
     type: 'object',

package/dist/claude-binary.js

@@ -0,0 +1,121 @@
+import crossSpawn from 'cross-spawn';
+import { spawn as nodeSpawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve, sep } from 'node:path';
+const CMD_UNSAFE_ARGUMENT = /[\^<>|&%!]/;
+const FALLBACK_ARGUMENT_ERROR = "claude resolves to a .cmd shim and this argument can't pass through cmd.exe intact; install Claude Code so claude.exe is reachable, or update the companion";
+const defaultFs = { existsSync, readFileSync };
+let cachedCommand = null;
+function envValue(env, name) {
+    const key = Object.keys(env).find((candidate) => candidate.toLowerCase() === name.toLowerCase());
+    return key ? env[key] : undefined;
+}
+function windowsPathEntries(env) {
+    return (envValue(env, 'PATH') ?? '')
+        .split(';')
+        .map((entry) => entry.trim().replace(/^"|"$/g, ''))
+        .filter(Boolean);
+}
+function windowsExtensions(env) {
+    const pathExt = envValue(env, 'PATHEXT') || '.COM;.EXE;.BAT;.CMD';
+    return pathExt
+        .split(';')
+        .map((extension) => extension.trim().toLowerCase())
+        .filter(Boolean)
+        .map((extension) => extension.startsWith('.') ? extension : `.${extension}`);
+}
+function existingCandidate(directory, extension, fs) {
+    const lowerCaseCandidate = join(directory, `claude${extension.toLowerCase()}`);
+    if (fs.existsSync(lowerCaseCandidate))
+        return resolve(lowerCaseCandidate);
+    const originalCaseCandidate = join(directory, `claude${extension}`);
+    return fs.existsSync(originalCaseCandidate) ? resolve(originalCaseCandidate) : null;
+}
+function parsedShimExecutable(shimPath, fs) {
+    let contents;
+    try {
+        contents = fs.readFileSync(shimPath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const shimDirectory = dirname(shimPath);
+    for (const match of contents.matchAll(/"([^"\r\n]*claude\.exe)"/gi)) {
+        let target = match[1].replace(/%(?:~dp0|dp0)%?/gi, shimDirectory);
+        // Tests inject win32 while running on Linux CI; normalizing both separator forms keeps the
+        // resolver testable with a real temporary filesystem and is a no-op for native Windows paths.
+        target = target.replace(/[\\/]/g, sep);
+        if (!isAbsolute(target))
+            target = resolve(shimDirectory, target);
+        if (fs.existsSync(target))
+            return resolve(target);
+    }
+    return null;
+}
+function executableForShim(shimPath, fs) {
+    const parsed = parsedShimExecutable(shimPath, fs);
+    if (parsed)
+        return parsed;
+    const conventional = join(dirname(shimPath), 'node_modules', '@anthropic-ai', 'claude-code', 'bin', 'claude.exe');
+    return fs.existsSync(conventional) ? resolve(conventional) : null;
+}
+function resolveUncached(platform, env, fs) {
+    if (platform !== 'win32') {
+        return { command: { command: 'claude', viaShell: true }, fallbackReason: null };
+    }
+    const directories = windowsPathEntries(env);
+    const extensions = windowsExtensions(env);
+    for (const directory of directories) {
+        for (const extension of extensions) {
+            if (extension !== '.cmd' && extension !== '.exe')
+                continue;
+            const candidate = existingCandidate(directory, extension, fs);
+            if (!candidate)
+                continue;
+            if (extension === '.exe') {
+                return { command: { command: candidate, viaShell: false }, fallbackReason: null };
+            }
+            const executable = executableForShim(candidate, fs);
+            if (executable) {
+                return { command: { command: executable, viaShell: false }, fallbackReason: null };
+            }
+            return {
+                command: { command: 'claude', viaShell: true },
+                fallbackReason: `Found ${candidate}, but its claude.exe target was not reachable; falling back to the .cmd shim.`,
+            };
+        }
+    }
+    return {
+        command: { command: 'claude', viaShell: true },
+        fallbackReason: 'No claude.exe or claude.cmd was found on PATH; falling back to cross-spawn command lookup.',
+    };
+}
+/** Resolve once in production. Injected dependencies bypass the cache so Linux CI can exercise
+ * the Windows lookup rules without mutating process globals or depending on Windows filesystem
+ * semantics. */
+export function resolveClaudeCommand(options = {}) {
+    const injected = options.platform !== undefined || options.env !== undefined || options.fs !== undefined;
+    if (!injected && cachedCommand)
+        return cachedCommand;
+    const result = resolveUncached(options.platform ?? process.platform, options.env ?? process.env, options.fs ?? defaultFs);
+    if (!injected) {
+        cachedCommand = result.command;
+        if (result.fallbackReason)
+            console.warn(`[product-console-companion] ${result.fallbackReason}`);
+    }
+    return result.command;
+}
+export function assertClaudeArgumentsSafeForFallback(args, platform = process.platform) {
+    if (platform === 'win32' && args.some((argument) => CMD_UNSAFE_ARGUMENT.test(argument))) {
+        throw new Error(FALLBACK_ARGUMENT_ERROR);
+    }
+}
+/** Native executables go straight through CreateProcess via Node. cross-spawn remains only for
+ * the unresolved command-name path, where it supplies the existing .cmd compatibility behavior. */
+export function spawnClaude(args, options = {}, resolution = resolveClaudeCommand()) {
+    if (resolution.viaShell) {
+        assertClaudeArgumentsSafeForFallback(args);
+        return crossSpawn(resolution.command, args, options);
+    }
+    return nodeSpawn(resolution.command, args, options);
+}

package/dist/claude-cli-caller.js

@@ -10,15 +10,16 @@
  * --max-budget-usd's exceeded-budget behavior) was confirmed with real, budgeted `claude` calls
  * during development, not guessed from --help text alone — see the Phase 2 PR description.
  */
-import spawn from 'cross-spawn';
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createInterface } from 'node:readline';
 import { StringDecoder } from 'node:string_decoder';
 import { assertSingleLineArguments } from './cli-arguments.js';
+import { spawnClaude } from './claude-binary.js';
 import { gitErrorMessage } from './sandbox.js';
 import { appendDiffToVolatile, prepareShipmentAnalysis } from './shipment.js';
+import { ModelRefusalError } from './text-model.js';
 /** Independent of --max-budget-usd — a dollar cap doesn't prevent a network-stall hang. No
  *  automatic retry on top of this (see cli.ts): auto-retry would risk double-spending the
  *  customer's own subscription/API quota. */
@@ -85,6 +86,7 @@ async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
         assertSingleLineArguments('claude', args);
         const filesRead = new Set();
         let resultEnvelope = null;
+        let lastStopReason = null;
         let stderrTail = '';
         let timedOut = false;
         let stdinError = null;
@@ -98,7 +100,7 @@ async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
         let firstUnparseableLineFirst = '';
         let firstUnparseableLineLast = '';
         const typeCounts = new Map();
-        const child = spawn('claude', args, { cwd: sandboxPath });
+        const child = spawnClaude(args, { cwd: sandboxPath });
         // stdout/stderr are only null when stdio is explicitly configured away from 'pipe' — the
         // default here, so both are always real streams in practice; the ! just satisfies the type.
         const stdoutDecoder = new StringDecoder('utf8');
@@ -152,6 +154,9 @@ async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
                 resultEnvelope = event;
             }
             else if (eventType === 'assistant') {
+                const stopReason = event.message?.stop_reason;
+                if (typeof stopReason === 'string')
+                    lastStopReason = stopReason;
                 const blocks = event.message?.content ?? [];
                 for (const b of blocks) {
                     if (b.type === 'tool_use' && b.name === 'Read' && b.input?.file_path) {
@@ -211,6 +216,11 @@ async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
             const message = envelope.errors?.length ? envelope.errors.join('; ') : envelope.result;
             throw new Error(message || 'Unknown claude CLI error');
         }
+        // A refused turn can still end in a non-error result envelope; its result is empty or partial
+        // text, so it must fail here rather than be returned (or JSON-parsed) as an answer.
+        if (envelope.stop_reason === 'refusal' || lastStopReason === 'refusal') {
+            throw new ModelRefusalError('The model declined this request.');
+        }
         if (capturedStdinError) {
             throw promptWriteFailure(capturedStdinError);
         }

package/dist/cli.js

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import Anthropic from '@anthropic-ai/sdk';
-import spawn from 'cross-spawn';
 import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { addConnection, configPath, enableWorkspacePolling, loadConfig } from './config.js';
@@ -8,6 +7,7 @@ import { CompanionClient, CompanionHttpError, PairingHttpError, } from './http-c
 import { assertIsRepo, checkRepositoryReadiness, currentCommit, GIT_UNAVAILABLE_MESSAGE, REMOTE_TROUBLESHOOTING_HINT, repositoryIdentity, RepositoryIdentityError, repositoryTopLevel, } from './local-scan.js';
 import { runAnalyseShipmentTask, runDesignPromptTask, runGenerateSpecBatchTask, runGenericTask, runProposeNewCapabilitiesTask, runProposeSkeletonTask, runStructuredModelCall, runVerifyModuleTask } from './api-key-caller.js';
 import { runAnalyseShipmentTaskViaCli, runDesignPromptTaskViaCli, runGenerateSpecBatchTaskViaCli, runGenericTaskViaCli, runProposeNewCapabilitiesTaskViaCli, runProposeSkeletonTaskViaCli, runStructuredModelCallViaCli, runVerifyModuleTaskViaCli } from './claude-cli-caller.js';
+import { spawnClaude } from './claude-binary.js';
 import { checkCodexLogin, CODEX_CODE_MODE_MODELS, codexTextModel, defaultCodexHome, runStructuredModelCallViaCodex } from './codex-cli-caller.js';
 import { formatInvestigationReaderDiagnostic, INVESTIGATION_MODEL, runAndReportInvestigation } from './investigation-reader.js';
 import { anthropicTextModel } from './text-model.js';
@@ -80,7 +80,7 @@ function parseFlags(argv) {
 }
 async function checkClaudeCliAvailable() {
     return new Promise((resolvePromise) => {
-        const child = spawn('claude', ['--version']);
+        const child = spawnClaude(['--version']);
         let out = '';
         child.stdout?.on('data', (chunk) => (out += chunk.toString()));
         child.on('error', () => resolvePromise(null)); // e.g. ENOENT — not installed / not on PATH

package/dist/investigation-reader.js

@@ -15,7 +15,7 @@ export const MAX_EVIDENCE_FILE_BYTES = 512 * 1024;
  * ceiling leaves at least 3x headroom while bounding serialized prompt overhead.
  */
 export const MAX_ASSESSMENT_PROMPT_CHARACTERS = 384 * 1024;
-export const INVESTIGATION_MODEL = 'claude-sonnet-5';
+export const INVESTIGATION_MODEL = 'claude-sonnet-5-5';
 const execFileAsync = promisify(execFile);
 export class MissingPolicy4ExecutionError extends Error {
     name = 'MissingPolicy4ExecutionError';

package/dist/surface-mapper.js

@@ -7,7 +7,7 @@ import { DEFAULT_MAPPER_SETTINGS, enumerateTrackedFiles, expandImports, isSuppor
 import { repositoryMissingReason, spawnFailureCode } from './local-scan.js';
 import { createSandbox } from './sandbox.js';
 export const SURFACE_SEED_PROMPT_VERSION = 'map_module_seeds@1';
-export const SURFACE_SEED_MODEL = 'claude-sonnet-5';
+export const SURFACE_SEED_MODEL = 'claude-sonnet-5-5';
 const execFileAsync = promisify(execFile);
 const MODEL_ROLES = [
     'implementation',

package/dist/text-model.js

@@ -36,6 +36,34 @@ const PURPOSE_ERRORS = {
         empty: 'No result returned.',
     },
 };
+/** Server-side refusal fallback: on a policy decline the API re-runs the request on Anthropic's
+ * recommended substitute inside the same call. The scalar "default" form needs exactly this header
+ * (the array form is gated by -2026-06-01; pairing either header with the other form is a 400). */
+const FALLBACK_BETA = 'server-side-fallback-2026-07-01';
+/** SDK 0.111 types `fallbacks` as the array form only; the API also takes the scalar "default". */
+const DEFAULT_FALLBACKS = 'default';
+/** Every API-key call goes through here, so each one carries the refusal fallback. */
+export function streamWithFallback(client, params) {
+    return client.beta.messages.stream({ ...params, betas: [FALLBACK_BETA], fallbacks: DEFAULT_FALLBACKS });
+}
+/** stop_reason 'refusal' — after the fallback, the whole chain declined. Thrown before content is
+ * read, so a partial or empty reply is never parsed as a result. */
+export class ModelRefusalError extends Error {
+    category;
+    constructor(message, category = null) {
+        super(message);
+        this.name = 'ModelRefusalError';
+        this.category = category;
+    }
+}
+/** The reply text once a refusal is ruled out. A mid-output fallback continues the declined
+ * model's partial text in a later block, so every text block is joined; null when there is none. */
+export function replyText(message, refusal) {
+    if (message.stop_reason === 'refusal')
+        throw new ModelRefusalError(refusal, message.stop_details?.category ?? null);
+    const text = message.content.map((block) => (block.type === 'text' ? block.text : '')).join('');
+    return text || null;
+}
 function usageRecord(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return null;
@@ -68,7 +96,7 @@ export function anthropicTextModel(client) {
         const content = request.purpose.endsWith(':file_select') && blocks.length === 1 && blocks[0].type === 'text'
             ? blocks[0].text
             : blocks;
-        const stream = client.messages.stream({
+        const stream = streamWithFallback(client, {
             model: request.model,
             max_tokens: request.maxTokens,
             thinking: { type: 'adaptive' },
@@ -83,11 +111,11 @@ export function anthropicTextModel(client) {
             refusal: `The model declined the ${request.purpose} call.`,
             empty: `The ${request.purpose} call returned no text.`,
         };
-        if (message.stop_reason === 'refusal' && errors.refusal)
-            throw new Error(errors.refusal);
-        const text = message.content.find((block) => block.type === 'text');
-        if (!text || text.type !== 'text')
+        // A purpose with no refusal wording of its own still fails as a refusal, under its empty-reply
+        // wording — never by reading whatever partial text the declined attempt left behind.
+        const text = replyText(message, errors.refusal ?? errors.empty);
+        if (!text)
             throw new Error(errors.empty);
-        return { text: text.text, usage: usageRecord(message.usage) };
+        return { text, usage: usageRecord(message.usage) };
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "product-console-companion",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "Local-first BYOS companion for the Fynch Product Console — reads code and runs AI calls from your own machine instead of the hosted server.",
   "type": "module",
   "license": "MIT",