tickmarkr 1.90.3 → 1.90.5

package/dist/adapters/catalog-remote.js

@@ -89,12 +89,20 @@ function providerModels(modelsDev, preferred) {
         : [];
     // Price is provider-specific. A provider-qualified query must never borrow an identically named
     // model from another provider, where subscription and metered costs can differ materially.
-    const selected = preferred ? preferredEntries : entries;
+    // D-OBS-11 follow-up: that rule presumes the hinted provider EXISTS in the catalog. A hint that
+    // matches nothing (kimi's "moonshot" vs the catalog's "moonshotai"/"kimi-for-coding"; cursor has
+    // no provider at all) used to ZERO the search space and blanket-uncover the whole adapter.
+    // Fail open to the full scan instead — advisory evidence with a visible models.dev id beats none.
+    const selected = preferred && preferredEntries.length > 0 ? preferredEntries : entries;
     return selected
         .map(([, provider]) => record(record(provider)?.models))
         .filter((models) => models !== undefined);
 }
 function findModelsDevModel(catalog, provider, modelId) {
+    // CLI namespaces prefix their catalog ids (kimi-code/k3 vs catalog key k3; omp's openai/gpt-4):
+    // after exact key/id misses, retry with the bare segment after the last "/". Deterministic
+    // provider order; first hit wins — acceptable for advisory evidence, never routing.
+    const bare = modelId.includes("/") ? modelId.slice(modelId.lastIndexOf("/") + 1) : undefined;
     for (const models of providerModels(catalog.modelsDev, provider)) {
         const direct = record(models[modelId]);
         if (direct)
@@ -103,6 +111,13 @@ function findModelsDevModel(catalog, provider, modelId) {
         if (byId)
             return byId;
     }
+    if (bare) {
+        for (const models of providerModels(catalog.modelsDev, provider)) {
+            const direct = record(models[bare]);
+            if (direct)
+                return direct;
+        }
+    }
     return undefined;
 }
 function artificialAnalysisRows(value) {

package/dist/adapters/model-lints.js

@@ -11,8 +11,9 @@ export const MODEL_STALE_DAYS = 30;
 const DAY_MS = 86400000;
 // cursor-agent 2026.07.08 reports 193 mostly-parameterized ids (e.g. gpt-5.3-codex-high-fast); filter the `auto`
 // pseudo-model + effort/speed variant suffixes from the unconfigured-lint aggregation ONLY — doctor.json keeps the
-// raw list (verified 2026-07-10). Data stays raw; lints stay signal.
-const LINT_VARIANT_RE = /^auto$|-(fast|minimal|low|medium|high|xhigh)$/;
+// raw list (verified 2026-07-10). Data stays raw; lints stay signal. -max/-none/-thinking joined the suffix set
+// 2026-08-12 (D-OBS-11: cursor's residual lint list was still mostly effort variants of configured bases).
+const LINT_VARIANT_RE = /^auto$|-(fast|minimal|none|low|medium|high|xhigh|max|thinking)$/;
 const LINT_CAP = 5;
 const TTY_LINT_CAP = 3;
 const DEFAULT_STATE_DIR = ".tickmarkr";

package/dist/cli/commands/doctor.d.ts

@@ -40,4 +40,19 @@ export declare function packageManagerFinding(cwd: string, probe?: (pm: string)
     verdict: "pass" | "fail";
     detail: string;
 } | undefined;
+/**
+ * Q142s: tickmarkr guarded every binary except its own. Exhibit (operator machine,
+ * 2026-08-12): an orphaned npm-prefix root at ~/.local held tickmarkr AND tkr at
+ * 1.85.0 beside the live 1.90.3 — two seats disagreed about the tool's version and
+ * were BOTH right about their own PATH order (a consultant reported "no verify
+ * command" — verify shipped in 1.90.0 — while the overseer saw it present). Checks
+ * EVERY bin name the package declares: the first sweep of that machine missed `tkr`.
+ */
+export declare function selfShadowFinding(ownVersion: string, cwd?: string, resolve?: (bin: string, cwd: string) => {
+    resolved?: string;
+    all: string[];
+}, versionOf?: (path: string) => string | undefined): {
+    verdict: "pass" | "fail";
+    detail: string;
+} | undefined;
 export declare function doctor(_argv: string[], cwd?: string, adapters?: WorkerAdapter[], opts?: DoctorOpts): Promise<string>;

package/dist/cli/commands/doctor.js

@@ -3,7 +3,8 @@ import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { detectPackageManager } from "../../gates/baseline.js";
-import { allAdapters, binaryShadowWarnings, detectCandidateClis, flagDriftWarnings, modelAliasExclusions, modelAliasLine, probeAll, probeModels, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
+import { version } from "./version.js";
+import { allAdapters, binaryShadowWarnings, detectCandidateClis, flagDriftWarnings, modelAliasExclusions, modelAliasLine, probeAll, probeModels, resolveShellBinary, servableExclusions, servabilityLine, writeDoctor } from "../../adapters/registry.js";
 import { CLAUDE_ALIAS_IDENTITY_STAMPS, claudeCode, resolveClaudeAliasIdentity } from "../../adapters/claude-code.js";
 import { BANNER, dim, fail, kvRow, legend, ok, rule, statusRow, title } from "../../brand.js";
 import { tickmarkrDir, stateDirName } from "../../graph/graph.js";
@@ -170,6 +171,40 @@ export function packageManagerFinding(cwd, probe = (pm) => spawnSync(pm, ["--ver
         detail: `repo uses ${pm} but the binary does not resolve in this environment — every auto-detected gate command will die before running any suite (fix: corepack enable, or install ${pm} on the daemon's PATH)`,
     };
 }
+/**
+ * Q142s: tickmarkr guarded every binary except its own. Exhibit (operator machine,
+ * 2026-08-12): an orphaned npm-prefix root at ~/.local held tickmarkr AND tkr at
+ * 1.85.0 beside the live 1.90.3 — two seats disagreed about the tool's version and
+ * were BOTH right about their own PATH order (a consultant reported "no verify
+ * command" — verify shipped in 1.90.0 — while the overseer saw it present). Checks
+ * EVERY bin name the package declares: the first sweep of that machine missed `tkr`.
+ */
+export function selfShadowFinding(ownVersion, cwd = process.cwd(), resolve = resolveShellBinary, versionOf = (p) => {
+    const r = spawnSync(p, ["version"], { encoding: "utf8", timeout: 5_000, shell: false });
+    return r.status === 0 ? r.stdout.trim().split("\n")[0] : undefined;
+}) {
+    const hits = new Map(); // path -> version
+    for (const bin of ["tickmarkr", "tkr"]) {
+        for (const p of resolve(bin, cwd).all) {
+            if (!hits.has(p))
+                hits.set(p, versionOf(p) ?? "?");
+        }
+    }
+    if (hits.size === 0)
+        return undefined; // no install on PATH (repo checkout) — nothing to shadow
+    const stale = [...hits].filter(([, v]) => v !== ownVersion);
+    if (stale.length === 0) {
+        return { verdict: "pass", detail: `single install root at ${ownVersion} (${[...hits.keys()].join(", ")})` };
+    }
+    const listing = stale.map(([p, v]) => `${p} → ${v}`).join(", ");
+    // One mismatched hit and it's the one running? Impossible — it would report ownVersion.
+    // Mismatch therefore means a SECOND root: a shell or daemon with a different PATH
+    // order runs a different tickmarkr than this one, silently.
+    return {
+        verdict: "fail",
+        detail: `stale tickmarkr/tkr binaries on PATH: ${listing} (running ${ownVersion}) — a seat with different PATH order silently runs the old binary; remove the stale install root`,
+    };
+}
 export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(), opts = {}) {
     if (_argv.length === 1 && _argv[0] === "--refresh-catalog") {
         const refreshed = await refreshCatalogCommand({ repoRoot: cwd, now: opts.catalogNow });
@@ -265,6 +300,10 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     const pmRow = packageManagerFinding(cwd);
     if (pmRow)
         rows.push(alignedStatusRow(pmRow.verdict, "package-manager", pmRow.detail));
+    // Q142s: tickmarkr's own binary gets the shadow check every adapter binary already had.
+    const shadowRow = selfShadowFinding(await version(), cwd);
+    if (shadowRow)
+        rows.push(alignedStatusRow(shadowRow.verdict, "tickmarkr-binary", shadowRow.detail));
     // v1.22 T5: workspace-trust pre-flight — per installed adapter: trusted | seeded | action-required | n/a.
     // action-required names the exact one-time command (or dialog) the operator must run once.
     rows.push(legend("workspace trust:"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.90.3",
+  "version": "1.90.5",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",