ultra-builder-pro-cli 0.13.0 → 0.14.0

package/mcp-server/lib/task-expander.test.cjs

@@ -1,10 +1,5 @@
 'use strict';
 
-// Integration tests for task-expander — real SQLite (Testcontainers-style
-// in-process) so parent_id column + status transition + task_expanded event
-// are exercised end-to-end. The only Test Double is the LLM client, which
-// we inject with deterministic child fixtures.
-
 const test = require('node:test');
 const assert = require('node:assert/strict');
 const fs = require('node:fs');
@@ -32,23 +27,6 @@ function cleanup({ dir, db }) {
   fs.rmSync(dir, { recursive: true, force: true });
 }
 
-function fakeLlm(childrenJson, { shouldFail = false, usage = {} } = {}) {
-  return {
-    provider: 'anthropic',
-    model: 'claude-sonnet-4-6',
-    async completeJson() {
-      if (shouldFail) throw new Error('upstream LLM 500');
-      return {
-        json: { children: childrenJson },
-        raw: JSON.stringify({ children: childrenJson }),
-        usage,
-        model: 'claude-sonnet-4-6',
-        provider: 'anthropic',
-      };
-    },
-  };
-}
-
 function seedParent(db, overrides = {}) {
   return ops.createTask(db, {
     id: 'parent-1',
@@ -62,203 +40,110 @@ function seedParent(db, overrides = {}) {
 }
 
 const HAPPY_CHILDREN = [
-  { id: 'child-1', title: 'Design auth schema',       type: 'architecture', priority: 'P1', complexity: 4, deps: [],          files_modified: ['src/auth/schema.ts'] },
-  { id: 'child-2', title: 'Implement login endpoint', type: 'feature',      priority: 'P1', complexity: 5, deps: ['child-1'], files_modified: ['src/auth/login.ts']  },
-  { id: 'child-3', title: 'Add signup endpoint',      type: 'feature',      priority: 'P2', complexity: 3, deps: ['child-1'], files_modified: ['src/auth/signup.ts'] },
+  { id: 'child-1', title: 'Design auth schema', type: 'architecture', priority: 'P1', complexity: 4, deps: [], files_modified: ['src/auth/schema.ts'] },
+  { id: 'child-2', title: 'Implement login endpoint', type: 'feature', priority: 'P1', complexity: 5, deps: ['child-1'], files_modified: ['src/auth/login.ts'] },
+  { id: 'child-3', title: 'Add signup endpoint', type: 'feature', priority: 'P2', complexity: 3, deps: ['child-1'], files_modified: ['src/auth/signup.ts'] },
 ];
 
-test('expandTask happy path: creates children, flips parent status, emits task_expanded', async () => {
+test('expandTask atomically persists host-derived children without a provider client', () => {
   const ctx = tmpDb();
   try {
     seedParent(ctx.db);
-    const result = await expandTask(ctx.db, {
-      id: 'parent-1',
-      strategy: 'llm',
-      llmClient: fakeLlm(HAPPY_CHILDREN),
-    });
+    const result = expandTask(ctx.db, { id: 'parent-1', children: HAPPY_CHILDREN });
     assert.equal(result.parent_id, 'parent-1');
     assert.equal(result.children.length, 3);
-
-    const parentAfter = ops.readTask(ctx.db, 'parent-1');
-    assert.equal(parentAfter.status, 'expanded');
-
+    assert.equal(ops.readTask(ctx.db, 'parent-1').status, 'expanded');
     for (const child of HAPPY_CHILDREN) {
       const row = ops.readTask(ctx.db, child.id);
-      assert.ok(row, `child ${child.id} missing`);
       assert.equal(row.parent_id, 'parent-1');
       assert.equal(row.status, 'pending');
     }
-
-    const events = ops.subscribeEventsSince(ctx.db, { since_id: 0, limit: 100 });
-    const expandedEvents = events.events.filter((e) => e.type === 'task_expanded');
-    assert.equal(expandedEvents.length, 1);
-    assert.equal(expandedEvents[0].task_id, 'parent-1');
-    const createdEvents = events.events.filter((e) => e.type === 'task_created');
-    assert.ok(createdEvents.length >= 4, 'parent + 3 children task_created events');
-  } finally {
-    cleanup(ctx);
-  }
+    const events = ops.subscribeEventsSince(ctx.db, { since_id: 0, limit: 100 }).events;
+    assert.equal(events.filter((event) => event.type === 'task_expanded').length, 1);
+  } finally { cleanup(ctx); }
 });
 
-test('expandTask: missing parent → TASK_NOT_FOUND', async () => {
+test('expandTask rejects missing and already expanded parents', () => {
   const ctx = tmpDb();
   try {
-    await assert.rejects(
-      expandTask(ctx.db, {
-        id: 'does-not-exist',
-        llmClient: fakeLlm(HAPPY_CHILDREN),
-      }),
+    assert.throws(
+      () => expandTask(ctx.db, { id: 'missing', children: HAPPY_CHILDREN }),
       (err) => err instanceof TaskExpandError && err.code === 'TASK_NOT_FOUND',
     );
-  } finally {
-    cleanup(ctx);
-  }
-});
-
-test('expandTask: already-expanded parent → ALREADY_EXPANDED', async () => {
-  const ctx = tmpDb();
-  try {
     seedParent(ctx.db);
-    // First expansion succeeds
-    await expandTask(ctx.db, {
-      id: 'parent-1',
-      llmClient: fakeLlm(HAPPY_CHILDREN),
-    });
-    // Second attempt must refuse
-    await assert.rejects(
-      expandTask(ctx.db, {
-        id: 'parent-1',
-        llmClient: fakeLlm(HAPPY_CHILDREN.map((c, i) => ({ ...c, id: `other-${i}` }))),
-      }),
+    expandTask(ctx.db, { id: 'parent-1', children: HAPPY_CHILDREN });
+    assert.throws(
+      () => expandTask(ctx.db, { id: 'parent-1', children: [{ ...HAPPY_CHILDREN[0], id: 'other' }] }),
       (err) => err instanceof TaskExpandError && err.code === 'ALREADY_EXPANDED',
     );
-  } finally {
-    cleanup(ctx);
-  }
-});
-
-test('expandTask: strategy="manual" → NOT_IMPLEMENTED', async () => {
-  const ctx = tmpDb();
-  try {
-    seedParent(ctx.db);
-    await assert.rejects(
-      expandTask(ctx.db, {
-        id: 'parent-1',
-        strategy: 'manual',
-        llmClient: fakeLlm(HAPPY_CHILDREN),
-      }),
-      (err) => err instanceof TaskExpandError && err.code === 'NOT_IMPLEMENTED',
-    );
-  } finally {
-    cleanup(ctx);
-  }
-});
-
-test('expandTask: missing llmClient → NO_LLM_CLIENT', async () => {
-  const ctx = tmpDb();
-  try {
-    seedParent(ctx.db);
-    await assert.rejects(
-      expandTask(ctx.db, { id: 'parent-1' }),
-      (err) => err instanceof TaskExpandError && err.code === 'NO_LLM_CLIENT',
-    );
-  } finally {
-    cleanup(ctx);
-  }
+  } finally { cleanup(ctx); }
 });
 
-test('expandTask: LLM throws → LLM_CALL_FAILED', async () => {
+test('expandTask requires valid host-derived children and leaves the parent untouched on failure', () => {
   const ctx = tmpDb();
   try {
     seedParent(ctx.db);
-    await assert.rejects(
-      expandTask(ctx.db, {
-        id: 'parent-1',
-        llmClient: fakeLlm([], { shouldFail: true }),
-      }),
-      (err) => err instanceof TaskExpandError && err.code === 'LLM_CALL_FAILED',
-    );
-    // parent status must be unchanged
-    assert.equal(ops.readTask(ctx.db, 'parent-1').status, 'pending');
-  } finally {
-    cleanup(ctx);
-  }
-});
-
-test('expandTask: invalid child shape → INVALID_OUTPUT, parent untouched', async () => {
-  const ctx = tmpDb();
-  try {
-    seedParent(ctx.db);
-    const bad = [{ id: 'child-1', title: 'x', type: 'feature', priority: 'P1' }]; // title too short
-    await assert.rejects(
-      expandTask(ctx.db, { id: 'parent-1', llmClient: fakeLlm(bad) }),
-      (err) => err instanceof TaskExpandError && err.code === 'INVALID_OUTPUT',
-    );
-    assert.equal(ops.readTask(ctx.db, 'parent-1').status, 'pending');
-  } finally {
-    cleanup(ctx);
-  }
+    for (const children of [undefined, [], [{
+      id: 'child-1', title: 'x', type: 'feature', priority: 'P1',
+    }]]) {
+      assert.throws(
+        () => expandTask(ctx.db, { id: 'parent-1', children }),
+        (err) => err instanceof TaskExpandError && err.code === 'INVALID_OUTPUT',
+      );
+      assert.equal(ops.readTask(ctx.db, 'parent-1').status, 'pending');
+    }
+  } finally { cleanup(ctx); }
 });
 
-test('expandTask: duplicate child id → INVALID_OUTPUT', async () => {
+test('expandTask rejects duplicate child ids', () => {
   const ctx = tmpDb();
   try {
     seedParent(ctx.db);
-    const dup = [
-      { id: 'same', title: 'First child',  type: 'feature', priority: 'P2' },
-      { id: 'same', title: 'Second child', type: 'feature', priority: 'P2' },
-    ];
-    await assert.rejects(
-      expandTask(ctx.db, { id: 'parent-1', llmClient: fakeLlm(dup) }),
+    assert.throws(
+      () => expandTask(ctx.db, { id: 'parent-1', children: [
+        { id: 'same', title: 'First child', type: 'feature', priority: 'P2' },
+        { id: 'same', title: 'Second child', type: 'feature', priority: 'P2' },
+      ] }),
       (err) => err instanceof TaskExpandError && err.code === 'INVALID_OUTPUT',
     );
-  } finally {
-    cleanup(ctx);
-  }
+  } finally { cleanup(ctx); }
 });
 
-test('expandTask: tx rollback — child id collides with existing task → parent status unchanged, no children inserted', async () => {
+test('expandTask rolls back every child when one id collides', () => {
   const ctx = tmpDb();
   try {
     seedParent(ctx.db);
-    // Pre-create a task with the same id one of the children will try
     ops.createTask(ctx.db, {
-      id: 'child-1',
-      title: 'Pre-existing task',
-      type: 'bugfix',
-      priority: 'P3',
+      id: 'child-1', title: 'Pre-existing task', type: 'bugfix', priority: 'P3',
     });
-    await assert.rejects(
-      expandTask(ctx.db, { id: 'parent-1', llmClient: fakeLlm(HAPPY_CHILDREN) }),
-      /* any error is acceptable — the point is no partial state */
-    );
+    assert.throws(() => expandTask(ctx.db, { id: 'parent-1', children: HAPPY_CHILDREN }));
     assert.equal(ops.readTask(ctx.db, 'parent-1').status, 'pending');
-    // child-2 / child-3 must NOT have been inserted
     assert.equal(ops.readTask(ctx.db, 'child-2'), null);
     assert.equal(ops.readTask(ctx.db, 'child-3'), null);
-  } finally {
-    cleanup(ctx);
-  }
+  } finally { cleanup(ctx); }
 });
 
-test('expandTask: children inherit parent tag', async () => {
+test('expandTask children inherit parent tag and change ownership', () => {
   const ctx = tmpDb();
   try {
-    seedParent(ctx.db, { tag: 'feat-auth' });
-    await expandTask(ctx.db, {
-      id: 'parent-1',
-      llmClient: fakeLlm(HAPPY_CHILDREN),
+    const { change } = changes.createChange(ctx.db, {
+      id: 'expand-change', title: 'Expand one task', kind: 'quick',
+      intent: 'Keep child ownership inside the active change.',
+      docs_impact: { status: 'none', rationale: 'test fixture' },
+    }, { rootDir: ctx.dir });
+    seedParent(ctx.db, { tag: 'feat-auth', change_id: change.id });
+    const result = expandTask(ctx.db, {
+      id: 'parent-1', children: HAPPY_CHILDREN, rootDir: ctx.dir,
     });
-    for (const child of HAPPY_CHILDREN) {
+    for (const child of result.children) {
       const row = ops.readTask(ctx.db, child.id);
       assert.equal(row.tag, 'feat-auth');
+      assert.equal(row.change_id, change.id);
     }
-  } finally {
-    cleanup(ctx);
-  }
+  } finally { cleanup(ctx); }
 });
 
-test('expandTask blocks new children when baseline authority is missing, draft, or migrated', async () => {
+test('expandTask enforces baseline authority before writing children', () => {
   for (const baseline of ['missing', 'draft', 'migrated']) {
     const ctx = tmpDb();
     try {
@@ -271,9 +156,9 @@ test('expandTask blocks new children when baseline authority is missing, draft,
           "UPDATE baselines SET mode = 'migrated', status = 'adopting' WHERE id = 'test-baseline'",
         ).run();
       }
-      await assert.rejects(
-        expandTask(ctx.db, {
-          id: 'parent-1', llmClient: fakeLlm(HAPPY_CHILDREN), rootDir: ctx.dir,
+      assert.throws(
+        () => expandTask(ctx.db, {
+          id: 'parent-1', children: HAPPY_CHILDREN, rootDir: ctx.dir,
         }),
         (error) => error.code === 'BASELINE_NOT_READY',
       );
@@ -282,43 +167,3 @@ test('expandTask blocks new children when baseline authority is missing, draft,
     } finally { cleanup(ctx); }
   }
 });
-
-test('expandTask preserves active ordinary and approved incident change ownership while adoption is incomplete', async () => {
-  for (const kind of ['quick', 'incident']) {
-    const ctx = tmpDb();
-    try {
-      if (kind === 'incident') {
-        ctx.db.prepare(
-          "UPDATE baselines SET mode = 'brownfield', status = 'adopting' WHERE id = 'test-baseline'",
-        ).run();
-      }
-      const changeId = `expand-${kind}`;
-      changes.createChange(ctx.db, {
-        id: changeId,
-        title: kind === 'incident' ? 'Recover production expansion' : 'Continue planned expansion',
-        kind,
-        intent: 'Keep every expanded child inside the already-authorized continuous change.',
-        ...(kind === 'incident' ? {
-          baseline_bypass: {
-            approved_by: 'incident-commander',
-            reason: 'Production recovery requires a bounded task expansion before adoption converges.',
-          },
-        } : {}),
-      }, { rootDir: ctx.dir });
-      seedParent(ctx.db, { change_id: changeId });
-      if (kind === 'quick') {
-        ctx.db.prepare(
-          "UPDATE baselines SET mode = 'brownfield', status = 'adopting' WHERE id = 'test-baseline'",
-        ).run();
-      }
-
-      const result = await expandTask(ctx.db, {
-        id: 'parent-1', llmClient: fakeLlm(HAPPY_CHILDREN), rootDir: ctx.dir,
-      });
-      assert.equal(result.children.length, HAPPY_CHILDREN.length);
-      for (const child of HAPPY_CHILDREN) {
-        assert.equal(ops.readTask(ctx.db, child.id).change_id, changeId);
-      }
-    } finally { cleanup(ctx); }
-  }
-});

package/mcp-server/server.cjs

@@ -23,7 +23,6 @@ const ops = require('./lib/state-ops.cjs');
 const projector = require('./lib/projector.cjs');
 const telemetry = require('./lib/telemetry.cjs');
 const topo = require('./lib/topo.cjs');
-const llm = require('./lib/llm-client.cjs');
 const parser = require('./lib/prd-parser.cjs');
 const expander = require('./lib/task-expander.cjs');
 const planStore = require('./lib/plan-store.cjs');
@@ -32,6 +31,10 @@ const baselines = require('./lib/baseline-workflow.cjs');
 const changes = require('./lib/change-workflow.cjs');
 const runtimeState = require('./lib/runtime-state.cjs');
 const doctor = require('./lib/doctor.cjs');
+const {
+  readProjectBreadcrumb,
+  renderProjectBreadcrumb,
+} = require('./lib/project-breadcrumb.cjs');
 
 const REPO_ROOT = process.env.UBP_RUNTIME_ROOT
   ? path.resolve(process.env.UBP_RUNTIME_ROOT)
@@ -127,22 +130,6 @@ function mintSessionId() {
   return `sess-${randomUUID().slice(0, 8)}`;
 }
 
-function resolvePrdText(input, ctx) {
-  if (input.prd_text && String(input.prd_text).trim()) return String(input.prd_text);
-  if (input.prd_path) {
-    const abs = path.isAbsolute(input.prd_path)
-      ? input.prd_path
-      : path.join(ctx.rootDir || process.cwd(), input.prd_path);
-    return fs.readFileSync(abs, 'utf8');
-  }
-  return null;
-}
-
-function buildLlmClient(ctx) {
-  if (ctx && ctx.llmClient) return ctx.llmClient;
-  return llm.createLlmClient({});
-}
-
 async function dispatchTool(name, input, db, ctx = {}) {
   switch (name) {
     case 'task.create': {
@@ -283,23 +270,27 @@ async function dispatchTool(name, input, db, ctx = {}) {
       return { waves: result.waves };
     }
     case 'task.parse_prd': {
-      const prdText = resolvePrdText(input, ctx);
-      if (!prdText || !prdText.trim()) {
-        const err = new Error('one of prd_path or prd_text required');
-        err.code = 'NO_INPUT';
-        throw err;
-      }
       const dryRun = input.dry_run === true;
       const rootDir = ctx.rootDir || process.cwd();
       const creationAuthority = { change_id: input.change_id };
       if (!dryRun) changes.assertTaskCreationAllowed(db, creationAuthority, { rootDir });
-      const client = buildLlmClient(ctx);
-      const parsed = await parser.parsePrd(prdText, { llmClient: client, tag: input.tag });
+      const parsed = parser.parsePrd(input.tasks, {
+        tag: input.tag,
+        changeId: input.change_id,
+      });
       const shaped = parsed.tasks.map((t) => ({
         id: t.id, title: t.title, type: t.type, priority: t.priority,
         complexity: t.complexity, deps: t.deps, files_modified: t.files_modified,
-        tag: t.tag, change_id: input.change_id,
+        tag: t.tag, change_id: t.change_id,
       }));
+      const graph = shaped.map((t) => ({ id: t.id, deps: t.deps || [] }));
+      const topoResult = topo.computeWaves(graph);
+      if (topoResult.cycles.length > 0) {
+        const err = new Error(`parsed task graph has ${topoResult.cycles.length} cycle(s)`);
+        err.code = 'CYCLE_DETECTED';
+        err.details = { cycles: topoResult.cycles };
+        throw err;
+      }
       if (!dryRun) {
         try {
           ops.tx(db, () => {
@@ -314,13 +305,9 @@ async function dispatchTool(name, input, db, ctx = {}) {
           throw wrap;
         }
       }
-      const graph = shaped.map((t) => ({ id: t.id, deps: t.deps || [] }));
-      const topoResult = topo.computeWaves(graph);
       return { tasks: shaped, topo: topoResult.waves };
     }
     case 'task.expand': {
-      // Cheap guards before paying for LLM client construction (which would
-      // throw NO_LLM_CREDENTIALS when env keys are missing).
       const parent = ops.readTask(db, input.id);
       if (!parent) {
         const err = new Error(`no task ${input.id}`);
@@ -334,12 +321,9 @@ async function dispatchTool(name, input, db, ctx = {}) {
       }
       const rootDir = ctx.rootDir || process.cwd();
       changes.assertTaskCreationAllowed(db, { change_id: parent.change_id }, { rootDir });
-      const client = buildLlmClient(ctx);
-      const result = await expander.expandTask(db, {
+      const result = expander.expandTask(db, {
         id: input.id,
-        sub_count: input.sub_count,
-        strategy: input.strategy,
-        llmClient: client,
+        children: input.children,
         rootDir,
       });
       return { parent_id: result.parent_id, children: result.children };
@@ -659,4 +643,6 @@ module.exports = {
   REGISTERED_TOOLS,
   STATELESS_TOOLS,
   MUTATING_TOOLS,
+  readProjectBreadcrumb,
+  renderProjectBreadcrumb,
 };

package/mcp-server/tests/server-contract.test.cjs

@@ -91,27 +91,15 @@ function expectError(result) {
   return JSON.parse(result.content[0].text).error;
 }
 
-function fakePrdClient(taskId) {
-  const client = {
-    calls: 0,
-    provider: 'anthropic',
-    model: 'test-model',
-    async completeJson() {
-      client.calls += 1;
-      const json = {
-        tasks: [{
-          id: taskId,
-          title: `Implement ${taskId}`,
-          type: 'feature',
-          priority: 'P1',
-          deps: [],
-          files_modified: [`src/${taskId}.js`],
-        }],
-      };
-      return { json, raw: JSON.stringify(json), usage: {}, model: client.model, provider: client.provider };
-    },
-  };
-  return client;
+function prdTasks(taskId) {
+  return [{
+    id: taskId,
+    title: `Implement ${taskId}`,
+    type: 'feature',
+    priority: 'P1',
+    deps: [],
+    files_modified: [`src/${taskId}.js`],
+  }];
 }
 
 test('listTools returns workflow tools and exposes no Ultra memory API', async () => {
@@ -550,12 +538,10 @@ test('task.parse_prd keeps dry runs read-only and blocks persistence before base
   try {
     const { db } = initStateDb(dryProject.dbPath);
     try {
-      const client = fakePrdClient('dry-run-task');
       const result = await dispatchTool('task.parse_prd', {
-        prd_text: 'Build a dry-run task.', dry_run: true,
-      }, db, { rootDir: dryProject.dir, llmClient: client });
+        tasks: prdTasks('dry-run-task'), dry_run: true,
+      }, db, { rootDir: dryProject.dir });
       assert.equal(result.tasks[0].id, 'dry-run-task');
-      assert.equal(client.calls, 1);
       assert.equal(ops.listTasks(db, {}).length, 0);
     } finally { closeStateDb(db); }
   } finally { fs.rmSync(dryProject.dir, { recursive: true, force: true }); }
@@ -570,14 +556,12 @@ test('task.parse_prd keeps dry runs read-only and blocks persistence before base
       if (baseline) seedBaseline(proj, baseline);
       const { db } = initStateDb(proj.dbPath);
       try {
-        const client = fakePrdClient(`blocked-prd-${baseline?.mode || 'missing'}`);
         await assert.rejects(
           dispatchTool('task.parse_prd', {
-            prd_text: 'Persist a task before adoption.', dry_run: false,
-          }, db, { rootDir: proj.dir, llmClient: client }),
+            tasks: prdTasks(`blocked-prd-${baseline?.mode || 'missing'}`), dry_run: false,
+          }, db, { rootDir: proj.dir }),
           (error) => error.code === 'BASELINE_NOT_READY',
         );
-        assert.equal(client.calls, 0, 'baseline gate must run before the LLM call');
         assert.equal(ops.listTasks(db, {}).length, 0);
       } finally { closeStateDb(db); }
     } finally { fs.rmSync(proj.dir, { recursive: true, force: true }); }
@@ -591,8 +575,8 @@ test('task.parse_prd persists only under ready or already-authorized change owne
     const { db } = initStateDb(readyProject.dbPath);
     try {
       await dispatchTool('task.parse_prd', {
-        prd_text: 'Build a ready task.', dry_run: false,
-      }, db, { rootDir: readyProject.dir, llmClient: fakePrdClient('ready-prd-task') });
+        tasks: prdTasks('ready-prd-task'), dry_run: false,
+      }, db, { rootDir: readyProject.dir });
       assert.equal(ops.readTask(db, 'ready-prd-task').change_id, null);
     } finally { closeStateDb(db); }
   } finally { fs.rmSync(readyProject.dir, { recursive: true, force: true }); }
@@ -628,8 +612,8 @@ test('task.parse_prd persists only under ready or already-authorized change owne
         }
         const taskId = `parsed-${kind}-task`;
         await dispatchTool('task.parse_prd', {
-          prd_text: 'Build a change-owned task.', dry_run: false, change_id: changeId,
-        }, db, { rootDir: proj.dir, llmClient: fakePrdClient(taskId) });
+          tasks: prdTasks(taskId), dry_run: false, change_id: changeId,
+        }, db, { rootDir: proj.dir });
         assert.equal(ops.readTask(db, taskId).change_id, changeId);
       } finally { closeStateDb(db); }
     } finally { fs.rmSync(proj.dir, { recursive: true, force: true }); }
@@ -1313,42 +1297,48 @@ test('task.dependency_topo: happy path groups tasks into correct waves', async (
   }
 });
 
-test('task.parse_prd: neither prd_path nor prd_text → NO_INPUT', async () => {
+test('task.parse_prd: missing host-derived tasks → validation error', async () => {
   const proj = tmpProject();
   try {
     await withClient(proj, async (client) => {
       const resp = await client.callTool({ name: 'task.parse_prd', arguments: {} });
       const err = expectError(resp);
-      assert.equal(err.code, 'NO_INPUT');
+      assert.equal(err.code, 'VALIDATION_ERROR');
     });
   } finally {
     fs.rmSync(proj.dir, { recursive: true, force: true });
   }
 });
 
-test('task.parse_prd: missing LLM credentials → NO_LLM_CREDENTIALS', async () => {
+test('task.parse_prd works without provider credentials', async () => {
   const proj = tmpProject();
   try {
     await withClientNoLlmKey(proj, async (client) => {
       const resp = await client.callTool({
         name: 'task.parse_prd',
-        arguments: { prd_text: 'Build a login feature with email and password.', dry_run: true },
+        arguments: { tasks: prdTasks('no-key-prd'), dry_run: true },
       });
-      const err = expectError(resp);
-      assert.equal(err.code, 'NO_LLM_CREDENTIALS');
+      const data = readToolPayload(resp);
+      assert.equal(data.tasks[0].id, 'no-key-prd');
     });
   } finally {
     fs.rmSync(proj.dir, { recursive: true, force: true });
   }
 });
 
-test('task.expand: unknown parent → TASK_NOT_FOUND (no LLM call needed)', async () => {
+test('task.expand: unknown parent → TASK_NOT_FOUND without a provider key', async () => {
   const proj = tmpProject();
   try {
     await withClientNoLlmKey(proj, async (client) => {
       const resp = await client.callTool({
         name: 'task.expand',
-        arguments: { id: 'nonexistent-parent' },
+        arguments: {
+          id: 'nonexistent-parent',
+          children: [{
+            id: 'unused-child', title: 'Unused child task',
+            type: 'feature', priority: 'P1',
+          }],
+        },
       });
       const err = expectError(resp);
       assert.equal(err.code, 'TASK_NOT_FOUND');
@@ -1358,7 +1348,7 @@ test('task.expand: unknown parent → TASK_NOT_FOUND (no LLM call needed)', asyn
   }
 });
 
-test('task.expand: missing LLM credentials on valid parent → NO_LLM_CREDENTIALS', async () => {
+test('task.expand persists host-derived children without provider credentials', async () => {
   const proj = tmpProject();
   try {
     seedReadyBaseline(proj);
@@ -1369,10 +1359,16 @@ test('task.expand: missing LLM credentials on valid parent → NO_LLM_CREDENTIAL
       });
       const resp = await client.callTool({
         name: 'task.expand',
-        arguments: { id: 'parent-1' },
+        arguments: {
+          id: 'parent-1',
+          children: [{
+            id: 'child-no-key', title: 'Implement child without provider key',
+            type: 'feature', priority: 'P1', complexity: 4, deps: [], files_modified: [],
+          }],
+        },
       });
-      const err = expectError(resp);
-      assert.equal(err.code, 'NO_LLM_CREDENTIALS');
+      const data = readToolPayload(resp);
+      assert.equal(data.children[0].id, 'child-no-key');
     });
   } finally {
     fs.rmSync(proj.dir, { recursive: true, force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra-builder-pro-cli",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Multi-runtime installer for the Ultra Builder Pro agent engineering system — deploys commands, agents, skills, hooks, and MCP server to Claude Code, OpenCode, Codex CLI, and Kimi Code.",
   "bin": {
     "ultra-builder-pro-cli": "bin/install.js",
@@ -98,13 +98,11 @@
     "install:all": "node bin/install.js --all --local"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.111.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@vercel/ncc": "0.38.4",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "better-sqlite3": "^11.5.0",
-    "js-yaml": "^4.1.0",
-    "openai": "^6.34.0"
+    "js-yaml": "^4.1.0"
   }
 }

package/skills/cc-collab/SKILL.md

@@ -5,8 +5,8 @@ description: Ask Claude Code for an independent read-only analysis of a bounded
 
 # Consult Claude Code read-only
 
-Treat Claude Code as an untrusted advisor. The current host owns scope, evidence,
-decisions, edits, and final verification.
+Treat Claude Code as an untrusted advisor. Keep the current host responsible for
+scope, evidence, decisions, edits, and final verification.
 
 ## Preconditions