tickmarkr 2.8.4 → 2.8.5

package/dist/adapters/claude-code.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, declareInputBox, MODEL_ID_RE, promptFitsArgv, shq, TokenUsageSchema } from "./types.js";
 // SPEND-01/SPEND-11: claude writes a per-session JSONL to ~/.claude/projects/<slug>/ where slug is the
@@ -188,7 +189,7 @@ export function probeClaudeAliasIdentity(cwd, alias) {
             "--strict-mcp-config",
             "--mcp-config", '{"mcpServers":{}}',
             "--output-format", "text",
-        ], { cwd, encoding: "utf8", timeout: 60000, stdio: ["ignore", "pipe", "pipe"] });
+        ], { cwd, encoding: "utf8", timeout: 60000, stdio: ["ignore", "pipe", "pipe"], env: withoutHostSession() });
         if (r.error || r.status !== 0)
             return undefined;
         const identity = (r.stdout || "").trim();
@@ -202,7 +203,7 @@ export function resolveClaudeAliasIdentity(cwd, alias, probe = probeClaudeAliasI
     return readClaudeAliasIdentity(cwd, alias) ?? probe(cwd, alias);
 }
 export function probeVersion(bin) {
-    const r = spawnSync(bin, ["--version"], { encoding: "utf8", timeout: 10000 });
+    const r = spawnSync(bin, ["--version"], { encoding: "utf8", timeout: 10000, env: withoutHostSession() });
     if (r.error || r.status !== 0)
         return { installed: false, authed: false, models: [] };
     return {

package/dist/adapters/codex-commit-check.js

@@ -5,6 +5,7 @@ import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { promisify } from "node:util";
 import { assertGitTrust, GitTrustRefusal, protectedGitEnv } from "../run/git-trust.js";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { CODEX_GIT_GRANT, codex } from "./codex.js";
 import { shq } from "./types.js";
 const exec = promisify(execFile);
@@ -40,7 +41,7 @@ export const codexSandboxArgs = (p, grant = CODEX_GIT_GRANT) => [
     `codex sandbox -c 'sandbox_mode="workspace-write"' ${grant} -- sh -c ${shq(SCRIPT)} sh ${[p.control, p.token, p.hostileHook, p.hostileRoot].map(shq).join(" ")}`,
 ];
 /** A sandbox executing `grant`; production is CODEX_GIT_GRANT. Tests pass a mutant grant to prove discrimination. */
-export const codexSandboxFor = (grant) => async (p) => (await exec("sh", codexSandboxArgs(p, grant), { cwd: p.worktree, timeout: 20_000, signal: p.signal })).stdout;
+export const codexSandboxFor = (grant) => async (p) => (await exec("sh", codexSandboxArgs(p, grant), { cwd: p.worktree, timeout: 20_000, signal: p.signal, env: withoutHostSession() })).stdout;
 export const codexSandbox = codexSandboxFor(CODEX_GIT_GRANT);
 const holds = (path, token) => {
     try {

package/dist/adapters/cursor-agent.js

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, MODEL_ID_RE, shq } from "./types.js";
@@ -58,7 +59,7 @@ export const cursorAgent = {
     // network (1.35s wall vs 0.34s CPU, RESEARCH A1); 15s timeout + fail-open covers offline.
     // Live-verified 2026-07-10, cursor-agent 2026.07.08.
     listModels: async () => {
-        const r = spawnSync("cursor-agent", ["--list-models"], { encoding: "utf8", timeout: 15000 });
+        const r = spawnSync("cursor-agent", ["--list-models"], { encoding: "utf8", timeout: 15000, env: withoutHostSession() });
         return r.error || r.status !== 0 ? [] : parseCursorModels(r.stdout || "");
     },
 };

package/dist/adapters/grok.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, MODEL_ID_RE, shq } from "./types.js";
@@ -130,7 +131,7 @@ export const grok = {
     // Advisory/doctor-only — never in the dispatch or auth path (types.ts:56-60).
     // Live-verified 2026-07-11 format, grok 0.2.93, 40-RESEARCH F-1.
     listModels: async () => {
-        const r = spawnSync("grok", ["models"], { encoding: "utf8", timeout: 15000 });
+        const r = spawnSync("grok", ["models"], { encoding: "utf8", timeout: 15000, env: withoutHostSession() });
         return r.error || r.status !== 0 ? [] : parseGrokModels(r.stdout || "");
     },
 };

package/dist/adapters/kimi.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { runInteractiveSeed } from "../run/interactive-seed.js";
@@ -191,7 +192,7 @@ const kimiTuiLaunch = (model) => {
     let neverAsk = false;
     try {
         const help = spawnSync("kimi", ["--help"], {
-            encoding: "utf8", timeout: KIMI_HELP_TIMEOUT_MS, stdio: ["ignore", "pipe", "ignore"],
+            encoding: "utf8", timeout: KIMI_HELP_TIMEOUT_MS, stdio: ["ignore", "pipe", "ignore"], env: withoutHostSession(),
         });
         neverAsk = !help.error && help.status === 0 && kimiHasNeverAskOption(help.stdout);
     }
@@ -287,8 +288,12 @@ const KIMI_SEED = {
 // cursor glyph; prose never does. Enter accepts the highlighted "Trust this folder" option, and the
 // two captures above are the reason the cursor+label pair is the fingerprint rather than either
 // prompt's heading: the same gate ships two different headings.
+// Queue row 198: kimi 2.2.0 renders that gate as one modal whose selected option is "Trust and continue"
+// (KIMI_TRUST_PANE in types.ts), so the 0.29.0 pair above no longer appears and the seat waited out its
+// readiness budget on an unanswered modal. The declaration follows the installed kimi, which updates
+// itself; a kimi older than 2.2.0 renders the 0.29.0 option, which this declaration no longer answers.
 export const KIMI_TRUST_DIALOG = {
-    fingerprint: "❯ Trust this folder",
+    fingerprint: "❯ Trust and continue",
     key: "Enter",
 };
 // v1.69 T7 / v1.71 T2: thin wrapper over the daemon's generic dispatch path for kimi-only tests.
@@ -317,13 +322,10 @@ export const kimi = {
     // v1.65 T3: every flag the command builders below hardcode (-S is resumeCommand's) — verified in
     // `kimi --help` 2026-07-22.
     hardcodedFlags: { binary: "kimi", flags: ["-p", "--model", "--output-format", "-S"] },
-    // KNOWN GAP, stated rather than implied: this declaration is consumed by the daemon's trust loop,
-    // which is entered only AFTER runInteractiveSeed returns — and that seed waits for
-    // `readinessMatch` for the whole task timeout, which is exactly the window this prompt blocks in
-    // (run …215). So on a kimi startup pane the declaration is correct and still unreached: the seed
-    // reports `readiness pattern not seen` with zero keypresses. Answering it during the readiness
-    // wait is a change to src/run/interactive-seed.ts — WHEN and HOW OFTEN a declaration is answered
-    // is T19's half of this contract, and src/run may not appear in this task's diff.
+    // The seed's readiness wait answers this declaration once per slot before the banner appears
+    // (src/run/interactive-seed.ts awaitReadiness); the daemon's post-seed trust loop is the second
+    // consumer. Queue row 198: a declaration whose fingerprint the installed kimi no longer renders is
+    // never answered, and the seat waits out its readiness budget on the modal (row 199).
     trustDialog: KIMI_TRUST_DIALOG,
     // KIMI-02 headless. -p prompt mode + explicit model, NO permission flag: kimi 0.26.0 rejects
     // -p combined with -y/--auto at argument parse time ("Cannot combine --prompt with --yolo",

package/dist/adapters/opencode.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, MODEL_ID_RE, OPENCODE_BUSY_FRAME_MARKERS, shq, TokenUsageSchema } from "./types.js";
@@ -52,7 +53,7 @@ export const opencode = {
     // opencode reads its own cache offline; --refresh adds an avoidable network dependency (RESEARCH
     // anti-pattern). Live-verified 2026-07-10, opencode 1.17.15.
     listModels: async () => {
-        const r = spawnSync("opencode", ["models"], { encoding: "utf8", timeout: 15000 });
+        const r = spawnSync("opencode", ["models"], { encoding: "utf8", timeout: 15000, env: withoutHostSession() });
         return r.error || r.status !== 0 ? [] : parseOpencodeModels(r.stdout || "");
     },
     // SPEND-09: opencode 1.x writes per-message token deltas to SQLite opencode.db (NOT the dead 0.7.x

package/dist/adapters/pi.js

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, MODEL_ID_RE, shq, TokenUsageSchema } from "./types.js";
@@ -142,7 +143,7 @@ export const pi = {
         // The store is local and independently useful: preserve its advisory even when the network/auth
         // capability call below fails. A failed model listing must not erase evidence of a substitution.
         const drift = servedModelNote();
-        const r = spawnSync("pi", ["--list-models"], { encoding: "utf8", timeout: 15000 });
+        const r = spawnSync("pi", ["--list-models"], { encoding: "utf8", timeout: 15000, env: withoutHostSession() });
         if (r.error || r.status !== 0) {
             return drift ? { ...h, note: `${h.note ? `${h.note}; ` : ""}${drift}` } : h;
         }
@@ -183,7 +184,7 @@ export const pi = {
     // v1.5 MODEL-01: fail OPEN to [] (detection is advisory — unlike gates' fail-closed posture).
     // spawnSync mirrors probeVersion; 15s timeout. Live-verified 2026-07-10, pi 0.80.3.
     listModels: async () => {
-        const r = spawnSync("pi", ["--list-models"], { encoding: "utf8", timeout: 15000 });
+        const r = spawnSync("pi", ["--list-models"], { encoding: "utf8", timeout: 15000, env: withoutHostSession() });
         return r.error || r.status !== 0 ? [] : parsePiModels(r.stdout || "");
     },
     collectUsage(cwd, sinceMs) {

package/dist/adapters/qwen.js

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, shq, } from "./types.js";
 export const QWEN_VERSION_IDENTITY = /^\d+\.\d+\.\d+/;
@@ -149,7 +150,7 @@ export function parseQwenResult(raw, nonce) {
     return { ...parseWorkerResult(decoded.assistantText, nonce), raw };
 }
 function probeQwen() {
-    const result = spawnSync("qwen", ["--version"], { encoding: "utf8", timeout: 10_000 });
+    const result = spawnSync("qwen", ["--version"], { encoding: "utf8", timeout: 10_000, env: withoutHostSession() });
     if (result.error || result.status !== 0)
         return { installed: false, authed: false, models: [] };
     const version = (result.stdout || result.stderr).trim().split("\n")[0] ?? "";

package/dist/adapters/registry.js

@@ -10,6 +10,7 @@ import { sh } from "../run/git.js";
 import { FakeAdapter } from "./fake.js";
 import { parseWorkerResult } from "./prompt.js";
 import { sealHerdrEnv } from "../drivers/subprocess.js";
+import { withoutHostSession } from "../drivers/host-env.js";
 import { catalogEntries, isNativeCliDrive, projectCliEntries, SHIPPED_CLI_CATALOG, } from "./catalog.js";
 import { channelKey, channelsFromConfig, modelAuthed, MODEL_ID_RE, MODEL_PROBE_ERRORS, QUOTA_PHRASE_RE, shq, STATUS_LABEL, } from "./types.js";
 // Compatibility projection for callers/tests that only need shipped advisory names. The literal
@@ -180,7 +181,7 @@ export function formatCandidateCliRow({ binary, path }) {
 // so no drift verdict piles onto the existing auth report.
 export function probeHelpText(bin) {
     try {
-        const r = spawnSync(bin, ["--help"], { encoding: "utf8", timeout: 10000 });
+        const r = spawnSync(bin, ["--help"], { encoding: "utf8", timeout: 10000, env: withoutHostSession() });
         if (r.error || r.status !== 0)
             return undefined;
         return `${r.stdout || ""}\n${r.stderr || ""}`;

package/dist/adapters/types.d.ts

@@ -118,6 +118,7 @@ export declare const CLAUDE_TRUST_PANE: string;
 export declare const CODEX_TRUST_PANE: string;
 export declare const CURSOR_TRUST_PANE = "Workspace Trust Required\nTrust this folder?";
 export declare const KIMI_TRUST_PANE: string;
+export declare const KIMI_TRUST_PANE_029: string;
 export declare const KIMI_MCP_TRUST_PANE: string;
 export declare const RECORDED_TRUST_PANES: readonly string[];
 export declare const APPROVED_TRUST_FINGERPRINTS: readonly string[];

package/dist/adapters/types.js

@@ -59,11 +59,25 @@ export const CODEX_TRUST_PANE = [
 ].join("\n");
 // v1.22 T5 / OBS-19, cursor-agent's per-worktree dialog.
 export const CURSOR_TRUST_PANE = "Workspace Trust Required\nTrust this folder?";
+// Queue row 198, kimi 2.2.0's folder-trust modal on a fresh task worktree (run 1394 T3, read off the
+// Orca screen before its one Enter). The worktree path is shortened as above; every other row is as
+// rendered. 2.2.0 renamed the selected option, so the 0.29.0 fingerprint below never matched it and the
+// seat sat on this modal for 21 minutes.
+export const KIMI_TRUST_PANE = [
+    "Trust this folder?",
+    "↑↓ navigate · Enter select · Esc exit",
+    "/Users/…/.tickmarkr/worktrees.noindex/tickmarkr-run-20261017-122301-…1394--T3",
+    "No project integrations or instructions to activate.",
+    "Trust is remembered for this folder, including future project config changes.",
+    "Tool approvals follow your permission settings.",
+    " ❯ Trust and continue",
+    "   Exit",
+].join("\n");
 // OBS-358, live pane wW:p2TB of run-20260805-121252 — the dialog that cost 30 minutes — quoted from
 // the record holding all five lines, .overseer/REPAIR-v186/GATE-T28-1.md (OBSERVATIONS.md abridges
 // it to the first three). "← highlighted" is the observer's annotation of the selected row, kept
-// exactly as recorded rather than tidied away.
-export const KIMI_TRUST_PANE = [
+// exactly as recorded rather than tidied away. kimi 0.29.0; superseded by the 2.2.0 capture above.
+export const KIMI_TRUST_PANE_029 = [
     "Trust this folder?",
     "  /Users/…/.tickmarkr/worktrees.noindex/tickmarkr-run-20260805-121252--T29",
     "❯ Trust this folder     ← highlighted",
@@ -77,7 +91,7 @@ export const KIMI_MCP_TRUST_PANE = [
     " ❯ Trust this folder      /      Don't trust",
 ].join("\n");
 export const RECORDED_TRUST_PANES = [
-    CLAUDE_TRUST_PANE, CODEX_TRUST_PANE, CURSOR_TRUST_PANE, KIMI_TRUST_PANE, KIMI_MCP_TRUST_PANE,
+    CLAUDE_TRUST_PANE, CODEX_TRUST_PANE, CURSOR_TRUST_PANE, KIMI_TRUST_PANE, KIMI_TRUST_PANE_029, KIMI_MCP_TRUST_PANE,
 ];
 // v1.89 T1 / OBS-414 round 4 — EXACT, not "leading bytes of a recorded line". Round 3 accepted any
 // prefix of a captured line, and every prefix of a trust prompt is also a substring of unrelated
@@ -96,6 +110,7 @@ export const APPROVED_TRUST_FINGERPRINTS = [
     "Do you trust the contents of this directory?", // codex 0.144.6, OBS-137
     "Workspace Trust Required", // cursor-agent, OBS-19
     "❯ Trust this folder", // kimi 0.29.0, OBS-358 + OBS-406 — the cursor glyph is load-bearing
+    "❯ Trust and continue", // kimi 2.2.0, queue row 198 — the same gate with its option renamed
 ];
 const isApprovedFingerprint = (fingerprint) => APPROVED_TRUST_FINGERPRINTS.includes(fingerprint)
     && RECORDED_TRUST_PANES.some((pane) => pane.includes(fingerprint));

package/dist/cli/commands/doctor.d.ts

@@ -52,6 +52,23 @@ type OrcaCapability = {
  * stderr (Electron timestamps), so the row is byte-stable across runs.
  */
 export declare function probeOrcaCapability(cwd: string, opts?: Pick<DoctorOpts, "orcaStatusProbe" | "orcaHooksStatusProbe" | "resolveOrcaBinary" | "orcaEnv">): Promise<OrcaCapability>;
+/** D-2102 add.39: the seams for a Node without stripTypeScriptTypes, and for a child that does not answer in time. */
+export type ParseSeam = {
+    strip?: "absent";
+    timeoutMs?: number;
+};
+/**
+ * D-2102 add.37 and add.39: the config's text with its TypeScript types erased (offsets unchanged), once a real
+ * parser accepts it — or why not. The source reaches PARSE_CHILD on stdin through process.execPath with no shell
+ * and no temp file. A spawn error, a timeout, a non-zero exit, a missing or malformed answer, or erased text of
+ * another length reads "doctor could not check <file>'s syntax"; a TypeScript config on a Node without
+ * stripTypeScriptTypes (below 22.13) reads unverifiable; nothing here throws.
+ */
+export declare function realParse(source: string, configPath: string, seam?: ParseSeam): {
+    text: string;
+} | {
+    why: string;
+};
 export declare function runnerIgnoreFinding(cwd: string): {
     verdict: "pass" | "warn";
     detail: string;
@@ -61,16 +78,43 @@ export declare function runnerIgnoreFinding(cwd: string): {
  * repos a hand-edit (SentioQ run 2 paid a whole run first); --fix applies the ignore
  * where a safe textual edit exists and refuses loudly otherwise.
  *
- * Safety contract: only three write shapes, each verified by re-running
- * runnerIgnoreFinding afterward — a write that does not turn the row green is
- * REVERTED and reported as manual. Never touches package.json (jest block → manual).
- * ponytail: text-level edits, same ceilings as the finding; the verify-then-revert
- * loop is what makes them safe to ship.
+ * Safety contract (queue row 197; D-2102 add.8 and add.30): the canonical entries the config's own literal
+ * ignore list lacks go into that array as complete string-literal elements (never a coverage array or a
+ * scalar), beside the state dir's canonical entry, else first; a jest element that is exactly an unanchored
+ * entry for either directory (the SentioQ run-2 shape) is replaced by its canonical twin; a jest config with
+ * no testPathIgnorePatterns gets the property, preserving jest's default /node_modules/ ignore, as before
+ * this change (a JSON config with its key quoted), and a vitest config without test.exclude gets one that
+ * keeps Vitest 3.2.7's default excludes ahead of the two entries — inside a new test object where it has
+ * none (D-2102 add.31). A config doctor could not read or any other element is manual with the file
+ * byte-unchanged. The write is verified by
+ * re-running the same rule on the written file (and JSON.parse for a .json config); a write that does not
+ * turn the row green is REVERTED byte-for-byte and reported as manual. Never touches package.json.
  */
 export declare function applyRunnerIgnore(cwd: string): {
     action: "none" | "wrote" | "manual";
     detail: string;
 };
+type EnvLike = NodeJS.ProcessEnv | Record<string, string | undefined>;
+/**
+ * Queue row 196 (D-2102 add.1): the host decides where seats run. herdr or Orca markers (classifyHost)
+ * name that driver; with neither, seats run headless on the subprocess driver with no daemon board.
+ * Only the exact claude-desktop entry point names Claude Desktop — a cli entry point is a terminal seat
+ * and no Claude variable alone is a host. Panes configured where no pane host exists cannot be honored.
+ */
+export declare function hostRows(env: EnvLike, llm: "pane" | "headless"): {
+    verdict: "pass" | "warn";
+    key: string;
+    detail: string;
+}[];
+/**
+ * Queue row 196 (D-2102 add.1): gates inherit the launching locale. The effective value is LC_ALL, else
+ * LC_CTYPE, else LANG (an empty value counts as unset). Unset, C or POSIX is the C-locale fallback;
+ * C.UTF-8 is a UTF-8 locale and passes. Advisory only — doctor never sets or writes a locale.
+ */
+export declare function localeFinding(env: EnvLike): {
+    verdict: "pass" | "warn";
+    detail: string;
+};
 /**
  * Q140s(b) / operator directive (D-OBS-10): the repo's package manager must resolve in
  * THIS process's environment — the same class of environment the daemon spawns gates