tickmarkr 1.70.0 → 1.72.0

package/dist/adapters/codex.js

@@ -80,6 +80,15 @@ export function readCodexModelsCache(path) {
 // P87-08: "Unable to create …/.git/worktrees/…/index.lock"). Expanded by the pane shell at the
 // worktree cwd; in a plain repo it resolves to ./.git (already writable, harmless).
 const GITDIR_WRITABLE = `-c "sandbox_workspace_write.writable_roots=[\\"$(git rev-parse --path-format=absolute --git-common-dir)\\"]"`;
+// OBS-125: codex 0.144.x gates enabled hooks behind PER-PROJECT-PATH hook trust — a NEW gate distinct
+// from the directory trust seedCodexTrust seeds. Every worker runs in a fresh ephemeral worktree, an
+// untrusted project, so codex re-prompts "Hooks need review" and the interactive worker stalls forever
+// (run-20260722/23 incidents). This flag runs the operator's OWN already-trusted hooks — including the
+// ~/.codex/hooks.json herdr-agent-state hook herdr relies on for agent detection, so the hooks can't
+// just be disabled — WITHOUT requiring persisted per-path trust for this invocation. It KEEPS the
+// -s/--sandbox workspace-write sandbox (deliberately NOT --dangerously-bypass-approvals-and-sandbox,
+// which would drop the sandbox). Listed by `codex --help` and `codex exec --help` (verified 2026-07-23).
+const CODEX_HOOK_TRUST = "--dangerously-bypass-hook-trust";
 // v1.22 T5 / OBS-16: codex keys trust on absolute path under [projects."<root>"] trust_level="trusted"
 // in ~/.codex/config.toml (CODEX_HOME relocates the dir). Worktrees inherit parent-project trust when
 // the REPO ROOT is trusted — seed the root once, cover every future worktree. Idempotent: a second
@@ -171,14 +180,15 @@ export const codex = {
     channels: (cfg) => channelsFromConfig("codex", cfg),
     // v1.65 T3: every flag the command builders below hardcode (incl. codexMcpSuppressionFlags' -c/
     // --disable and GITDIR_WRITABLE's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
-    hardcodedFlags: { binary: "codex", flags: ["--sandbox", "--model", "-a", "-s", "-c", "--disable"] },
+    hardcodedFlags: { binary: "codex", flags: ["--sandbox", "--model", "-a", "-s", "-c", "--disable", "--dangerously-bypass-hook-trust"] },
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)
     // MCP suppression built per dispatch (config can change between runs) — see codexMcpSuppressionFlags.
-    headlessCommand: (promptFile, model) => `codex exec --sandbox workspace-write ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
+    // CODEX_HOOK_TRUST (OBS-125) clears the per-worktree "Hooks need review" gate while keeping the sandbox.
+    headlessCommand: (promptFile, model) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
     // TUI uses expanded -a never -s workspace-write (exec-only flags do not apply)
     // (--help 2026-07-09: valid approval policies are untrusted|on-request|never; the previously
     // used `on-failure` is invalid and made codex exit 2 pre-inference)
-    interactiveCommand: (promptFile, model) => `codex -a never -s workspace-write ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
+    interactiveCommand: (promptFile, model) => `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${GITDIR_WRITABLE} --model ${shq(model)} "$(cat ${shq(promptFile)})"`,
     invoke(task, _cwd, a, ctx) {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },

package/dist/adapters/kimi.js

@@ -1,9 +1,10 @@
-import { spawnSync } from "node:child_process";
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
+import { runInteractiveSeed } from "../run/interactive-seed.js";
+import { sh } from "../run/git.js";
 import { channelsFromConfig, MODEL_ID_RE, shq, TokenUsageSchema } from "./types.js";
 // KIMI-03 → v1.58 T5: the "no harness-readable counter" block (research F-6, 2026-07-17) is
 // LIFTED for collectUsage — kimi 0.27.0 writes a wire journal per agent at
@@ -117,40 +118,18 @@ export function confirmKimiSeedBanner(banner, assignedModel) {
     }
     return { ok: true, sessionId: kimiBannerSessionId(banner) };
 }
-// Shared launch-then-seed surface (T6) + banner confirm helpers (T7). One definition so the
-// adapter property and runKimiInteractiveSeed cannot drift.
+// Shared launch-then-seed surface (T6) + banner confirm (T7/T2). One definition so the adapter
+// property and the daemon's generic runInteractiveSeed path cannot drift.
 const KIMI_SEED = {
     launch: (model) => `kimi -y -m ${shq(kimiAlias(model))}`,
     readinessMatch: "Send /help for help information.",
     seedLine: (promptFile) => `Read ${promptFile} and do exactly what it says.`,
+    confirmBanner: confirmKimiSeedBanner,
 };
-// v1.69 T7: kimi-local launch-then-seed that confirms the banner model and captures the session id
-// from the SAME pane text already present for the readiness match. No extra probe, no extra
-// dispatch — one read of the launch banner, then seed or fail closed.
+// v1.69 T7 / v1.71 T2: thin wrapper over the daemon's generic dispatch path for kimi-only tests.
 export async function runKimiInteractiveSeed(opts) {
-    await opts.driver.run(opts.slot, KIMI_SEED.launch(opts.assignment.model));
-    const ready = await opts.driver.waitOutput(opts.slot, KIMI_SEED.readinessMatch, opts.taskTimeoutMinutes * 60_000);
-    // Banner text already on the pane for the readiness match — the only text model/session use.
-    const banner = await opts.driver.read(opts.slot, 1000);
-    if (!ready) {
-        return { output: banner, seedFailed: true, seedError: `readiness pattern not seen: ${KIMI_SEED.readinessMatch}` };
-    }
-    const confirm = confirmKimiSeedBanner(banner, opts.assignment.model);
-    if (!confirm.ok) {
-        return { output: banner, seedFailed: true, seedError: confirm.error };
-    }
-    const seedText = KIMI_SEED.seedLine(opts.promptFile);
-    await opts.driver.run(opts.slot, seedText);
-    let output = "";
-    for (let attempt = 0; attempt < 5; attempt++) {
-        await new Promise((r) => setTimeout(r, 200));
-        output = await opts.driver.read(opts.slot, 1000);
-        const bottom = output.trimEnd().split("\n").pop() ?? "";
-        if (!bottom.includes(seedText)) {
-            return { output, seedFailed: false, sessionId: confirm.sessionId };
-        }
-    }
-    return { output, seedFailed: true, seedError: "seed line never left the input box", sessionId: confirm.sessionId };
+    const r = await runInteractiveSeed({ ...opts, adapter: kimi });
+    return { output: r.output, seedFailed: r.seedFailed, seedError: r.seedError, sessionId: r.sessionId };
 }
 export const kimi = {
     id: "kimi",
@@ -183,10 +162,8 @@ export const kimi = {
     // null → the daemon's print fallback (types.ts:101) keeps kimi workers visible without a TUI.
     interactiveCommand: () => null,
     // v1.69 T6/T7: launch the real TUI, wait for the cold-start readiness marker, then submit the
-    // prompt as one user turn. Banner model/session confirmation for seed mode lives in
-    // runKimiInteractiveSeed / confirmKimiSeedBanner (same pane text as the readiness match — no
-    // extra probe). Live-probed 2026-07-22 (kimi 0.28.1): `kimi -y` opens the TUI with yolo active
-    // and prints the model/session lines plus "Send /help for help information." before the input box.
+    // prompt as one user turn. Banner model/session confirmation runs on the daemon's generic
+    // runInteractiveSeed path via confirmBanner on KIMI_SEED (not a separate dispatch helper).
     interactiveSeed: KIMI_SEED,
     // v1.53 T3 resume — live-probed 2026-07-18: `-p` + `-S <id>` compose cleanly (no OBS-67-class
     // flag rejection) and the resumed session carries prior conversation state. `-S <id>` is the
@@ -298,7 +275,7 @@ export const kimi = {
         }
     },
     listModels: async () => {
-        const r = spawnSync("kimi", ["provider", "list", "--json"], { encoding: "utf8", timeout: 15000 });
-        return r.error || r.status !== 0 ? [] : parseKimiModels(r.stdout || "");
+        const r = await sh("kimi provider list --json", process.cwd(), 15000);
+        return r.code !== 0 ? [] : parseKimiModels(r.stdout || "");
     },
 };

package/dist/adapters/registry.d.ts

@@ -3,6 +3,28 @@ import { type RoutingProfile } from "../route/profile.js";
 import { type AuthHealth, type BillingChannel, type WorkerAdapter } from "./types.js";
 export declare const CANDIDATE_CLI_CATALOG: readonly ["kimi", "gemini", "qwen", "aider", "goose", "amp", "droid", "auggie", "crush"];
 export declare const REGISTERED_ADAPTER_BINARIES: readonly ["claude", "codex", "cursor-agent", "opencode", "pi", "grok"];
+export declare function resolveShellBinary(bin: string, cwd?: string): {
+    resolved?: string;
+    all: string[];
+};
+export declare function probeVersionShell(bin: string, cwd?: string): AuthHealth & {
+    binaryPaths?: string[];
+};
+export declare function binaryShadowWarnings(adapters: WorkerAdapter[], health: Record<string, AuthHealth>, cwd?: string, resolve?: (bin: string, cwd: string) => {
+    resolved?: string;
+    all: string[];
+}): string[];
+export declare function invalidConfiguredModels(cfg: TickmarkrConfig, adapterId: string, h: AuthHealth | undefined): string[];
+export declare function modelAliasExclusions(cfg: TickmarkrConfig, adapters: WorkerAdapter[], health: Record<string, AuthHealth>): {
+    key: string;
+    adapter: string;
+    model: string;
+}[];
+export declare function modelAliasLine(excluded: {
+    key: string;
+    adapter: string;
+    model: string;
+}[]): string;
 export type CandidateCliDetection = {
     binary: string;
     version: string | undefined;
@@ -19,7 +41,9 @@ export declare function allAdapters(opts?: {
     fakeScriptPath?: string;
 }): WorkerAdapter[];
 export declare function getAdapter(id: string, adapters: WorkerAdapter[]): WorkerAdapter;
-export declare function probeAll(adapters: WorkerAdapter[]): Promise<Record<string, AuthHealth>>;
+export declare function probeAll(adapters: WorkerAdapter[], opts?: {
+    cwd?: string;
+}): Promise<Record<string, AuthHealth>>;
 export type ProbeModelStatus = "ok" | "timeout" | "failed";
 export type ProbeModelProgress = (adapter: string, model: string, status: ProbeModelStatus, durationMs: number) => void;
 export interface AutoPreferDoc {

package/dist/adapters/registry.js

@@ -18,11 +18,89 @@ import { grok } from "./grok.js";
 import { kimi } from "./kimi.js";
 import { opencode } from "./opencode.js";
 import { pi } from "./pi.js";
-import { channelKey, modelAuthed, QUOTA_RE } from "./types.js";
+import { sealHerdrEnv } from "../drivers/subprocess.js";
+import { channelKey, modelAuthed, QUOTA_RE, shq } from "./types.js";
 // Agent-CLI binary names with no tickmarkr adapter — doctor sweeps these advisory-only (v1.48 T1).
 export const CANDIDATE_CLI_CATALOG = ["kimi", "gemini", "qwen", "aider", "goose", "amp", "droid", "auggie", "crush"];
 // Binaries probed by registered adapters — kept beside the catalog so a test can forbid overlap.
 export const REGISTERED_ADAPTER_BINARIES = ["claude", "codex", "cursor-agent", "opencode", "pi", "grok"];
+// OBS-117: worker panes run commands through `bash -lc` (SubprocessDriver + sh()), not bare spawnSync(bin).
+// Doctor must resolve adapter binaries the same way so a shadow install on PATH cannot disagree with dispatch.
+function shellSpawnSync(cmd, cwd, timeoutMs = 10000) {
+    const r = spawnSync("bash", ["-lc", cmd], {
+        encoding: "utf8",
+        cwd,
+        timeout: timeoutMs,
+        env: sealHerdrEnv(process.env),
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    return { code: r.status ?? 1, stdout: (r.stdout || "").trim(), stderr: (r.stderr || "").trim() };
+}
+export function resolveShellBinary(bin, cwd = process.cwd()) {
+    const r = shellSpawnSync(`type -a ${shq(bin)} 2>/dev/null | sed -n 's/^.* is \\(.*\\)$/\\1/p'`, cwd);
+    const all = r.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+    return { resolved: all[0], all };
+}
+export function probeVersionShell(bin, cwd = process.cwd()) {
+    const { resolved, all } = resolveShellBinary(bin, cwd);
+    if (!resolved)
+        return { installed: false, authed: false, models: [] };
+    const r = shellSpawnSync(`${shq(resolved)} --version`, cwd);
+    if (r.code !== 0)
+        return { installed: false, authed: false, models: [], binaryPaths: all };
+    return {
+        installed: true,
+        authed: true,
+        version: (r.stdout || r.stderr).trim().split("\n")[0],
+        models: [],
+        note: "auth assumed; verified at dispatch (failover on auth/quota errors)",
+        binaryPaths: all,
+    };
+}
+export function binaryShadowWarnings(adapters, health, cwd = process.cwd(), resolve) {
+    const resolveFn = resolve ?? resolveShellBinary;
+    const out = [];
+    for (const a of adapters) {
+        const bin = a.hardcodedFlags?.binary;
+        if (!bin || !health[a.id]?.installed)
+            continue;
+        const { resolved, all } = resolveFn(bin, cwd);
+        if (all.length <= 1)
+            continue;
+        out.push(`binary shadow: ${a.id} resolves to ${resolved ?? bin} but ${all.length} installs on PATH — ${all.join(", ")}`);
+    }
+    return out;
+}
+function modelListValidated(h) {
+    return !!h?.modelsDetectedAt && Array.isArray(h.models);
+}
+export function invalidConfiguredModels(cfg, adapterId, h) {
+    if (!modelListValidated(h))
+        return [];
+    const listed = new Set(h.models);
+    const configured = Object.keys(cfg.tiers[adapterId]?.models ?? {});
+    // Fail open until the CLI list intersects at least one configured model — proves the list is authoritative
+    // for this adapter's tier namespace (MODEL-04: unrelated detected ids must not invalidate routing).
+    if (!configured.some((m) => listed.has(m)))
+        return [];
+    return configured.filter((m) => !listed.has(m));
+}
+export function modelAliasExclusions(cfg, adapters, health) {
+    const out = [];
+    for (const a of adapters) {
+        const h = health[a.id];
+        if (!h?.installed || !h?.authed)
+            continue;
+        for (const model of invalidConfiguredModels(cfg, a.id, h)) {
+            out.push({ key: channelKey({ adapter: a.id, model }), adapter: a.id, model });
+        }
+    }
+    return out;
+}
+export function modelAliasLine(excluded) {
+    const parts = excluded.map(({ key, adapter }) => `${key} (not in ${adapter}'s reported model list)`);
+    return `model alias: ${excluded.length} channel(s) invalid — ${parts.join(", ")}`;
+}
 function candidateOnPath(bin, pathEnv) {
     const r = spawnSync("which", [bin], { encoding: "utf8", env: { ...process.env, PATH: pathEnv } });
     return r.status === 0 && r.stdout.trim().length > 0;
@@ -105,9 +183,20 @@ export function getAdapter(id, adapters) {
         throw new Error(`unknown adapter ${id} (have: ${adapters.map((a) => a.id).join(", ")})`);
     return a;
 }
-export async function probeAll(adapters) {
+export async function probeAll(adapters, opts = {}) {
+    const cwd = opts.cwd ?? process.cwd();
     const out = {};
-    await Promise.all(adapters.map(async (a) => { out[a.id] = await a.probe(); }));
+    await Promise.all(adapters.map(async (a) => {
+        let h = await a.probe();
+        const bin = a.hardcodedFlags?.binary;
+        if (bin) {
+            const shell = probeVersionShell(bin, cwd);
+            h = { ...h, installed: shell.installed, version: shell.version ?? h.version };
+            if (!shell.installed)
+                h = { ...h, installed: false, authed: false };
+        }
+        out[a.id] = h;
+    }));
     return out;
 }
 const MODEL_PROBE_PROMPT = "Reply with exactly OK and nothing else.";
@@ -317,10 +406,12 @@ export function discoverChannels(cfg, adapters, health) {
         .flatMap((a) => {
         const h = health[a.id];
         const s = h?.servable;
+        const invalid = new Set(invalidConfiguredModels(cfg, a.id, h));
         // T2 (2026-07-13): only a model doctor marked authed (modelAuth[model].authed===true) advertises a
         // channel — routing an unknown or 403 into dispatch is fail-closed. Operators with pre-v1.21 doctor.json
         // can opt into the prior unknown-is-routable behavior with routing.allowUnverifiedModels.
-        return a.channels(cfg).filter((c) => modelAuthed(h, c.model, cfg.routing.allowUnverifiedModels) && (!s || s.includes(c.model)));
+        // OBS-117: configured aliases absent from the adapter CLI's own model list are not dispatchable.
+        return a.channels(cfg).filter((c) => !invalid.has(c.model) && modelAuthed(h, c.model, cfg.routing.allowUnverifiedModels) && (!s || s.includes(c.model)));
     });
     if (!cfg.routing.allow && !cfg.routing.deny)
         return base;

package/dist/adapters/types.d.ts

@@ -48,10 +48,18 @@ export interface WorkerResult {
     deviations: string[];
     raw: string;
 }
+export type SeedBannerConfirmResult = {
+    ok: true;
+    sessionId?: string;
+} | {
+    ok: false;
+    error: string;
+};
 export interface InteractiveSeed {
     launch(model: string): string;
     readinessMatch: string;
     seedLine(promptFile: string): string;
+    confirmBanner?(banner: string, assignedModel: string): SeedBannerConfirmResult;
 }
 export interface ContextUsage {
     tokens: number;

package/dist/cli/commands/doctor.js

@@ -1,12 +1,12 @@
 import { writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { allAdapters, detectCandidateClis, flagDriftWarnings, probeAll, probeModels, readAutoPrefer, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
+import { allAdapters, binaryShadowWarnings, detectCandidateClis, flagDriftWarnings, modelAliasExclusions, modelAliasLine, probeAll, probeModels, readAutoPrefer, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
 import { BANNER, dim, fail, kvRow, legend, ok, rule, statusRow, title } from "../../brand.js";
 import { tickmarkrDir, stateDirName } from "../../graph/graph.js";
 import { declaredModelWindow, hasWindowsConfig, modelLints, suggestOverlay, ttyVisual } from "../../adapters/model-lints.js";
 import { DEFAULT_CONFIG, loadConfig, overlayPreferShapes } from "../../config/config.js";
 import { HerdrDriver } from "../../drivers/herdr.js";
-import { disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../../route/preference.js";
+import { denyPreferCollisionLine, denyPreferCollisions, disallowedBy, excludedChannels, exclusionLine, preferRanks } from "../../route/preference.js";
 const visual = () => process.stdout.isTTY === true && process.env.NO_COLOR === undefined;
 const alignedStatusRow = (verdict, key, value) => `  ${statusRow(verdict, kvRow(key, value).slice(2))}`;
 const attentionRow = (text) => `  ${statusRow("warn", text)}`;
@@ -19,7 +19,7 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     // otherwise prints nothing until the end — silence here reads as a hang (v1.33.1)
     console.error("probing installed agent CLIs — one short LLM call per configured model, may take a minute...");
     const probeProgressTTY = process.stderr.isTTY === true;
-    const health = await probeAll(adapters);
+    const health = await probeAll(adapters, { cwd });
     // MODEL-02: detect models where the adapter exposes a list surface, BEFORE writing doctor.json (write once, below).
     // Fail OPEN — the inverse of gates' fail-closed: detection is advisory, so a broken list surface NEVER fails doctor.
     for (const a of adapters) {
@@ -81,6 +81,11 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     const excluded = excludedChannels(cfg, adapters, health);
     if (excluded.length)
         rows.push(attentionRow(exclusionLine(excluded)));
+    rows.push(...denyPreferCollisions(cfg).map((c) => attentionRow(denyPreferCollisionLine(c))));
+    const aliasExcluded = modelAliasExclusions(cfg, adapters, health);
+    if (aliasExcluded.length)
+        rows.push(attentionRow(modelAliasLine(aliasExcluded)));
+    rows.push(...binaryShadowWarnings(adapters, health, cwd).map(attentionRow));
     // HYG-07(a): doctor just probed fresh (probeAll above), so servability attribution is current by construction.
     const servable = servableExclusions(cfg, adapters, health);
     if (servable.length)

package/dist/cli/commands/fleet.d.ts

@@ -12,6 +12,8 @@ export type FleetOutput = {
 export type FleetIO = {
     input?: FleetInput;
     output?: FleetOutput;
+    debug?: boolean;
+    reloadGuard?: (bytes: string) => string | null;
 };
 export declare function fleet(argv: string[], cwd?: string, adapters?: WorkerAdapter[], io?: FleetIO): Promise<string | {
     out: string;