ultra-builder-pro-cli 0.13.0 → 0.14.0

package/skills/codex-collab/SKILL.md

@@ -5,8 +5,8 @@ description: Ask Codex CLI for an independent read-only analysis of a bounded ar
 
 # Consult Codex read-only
 
-Treat Codex as an untrusted advisor. The current host owns scope, evidence, edits,
-verification, and the final answer.
+Treat Codex as an untrusted advisor. Keep the current host responsible for scope,
+evidence, edits, verification, and the final answer.
 
 ## Preconditions
 
@@ -23,7 +23,6 @@ Create a session directory under `.ultra/collab/`, then run in a read-only sandb
 SESSION_PATH=".ultra/collab/$(date +%Y%m%d-%H%M%S)-codex"
 mkdir -p "${SESSION_PATH}"
 codex exec -s read-only \
-  -a never \
   --ephemeral \
   --ignore-user-config \
   --ignore-rules \

package/skills/ultra-plan/SKILL.md

@@ -65,13 +65,23 @@ id when applicable.
 
 ## PRD mode
 
-1. Call `task.parse_prd` with `dry_run: true` and the active `change_id` when
-   applicable.
-2. Show the proposed slices, topology, conflict surface, and cost estimate.
-3. Require explicit approval; rejection performs no state write.
-4. On approval, repeat with `dry_run: false` and the same change ownership, export
+1. Read the approved PRD with the current host model and derive the proposed task
+   objects using the `task.parse_prd` input schema. Do not invoke a second model or
+   require a provider API key inside Ultra MCP.
+2. Call `task.parse_prd` with those `tasks`, `dry_run: true`, and the active
+   `change_id` when applicable. The MCP validates the graph but does not supply
+   product judgment.
+3. Show the proposed slices, topology, conflict surface, and cost estimate.
+4. Require explicit approval; rejection performs no state write.
+5. On approval, repeat with `dry_run: false`, the identical task objects, and the
+   same change ownership; export
    the plan, and verify that the dry-run and persisted task identities agree.
 
+When one approved task is still too broad, derive its complete child graph with the
+current host model and call `task.expand` with the parent `id` and validated
+`children`. The MCP assigns parent, tag, and change ownership atomically. Never ask
+the MCP runtime to generate child content.
+
 ## Completion gate
 
 Planning is complete only when the DAG is valid, each task reaches a public seam, each

package/skills/ultra-verify/SKILL.md

@@ -1,12 +1,13 @@
 ---
 name: ultra-verify
-description: Run independent two-model verification with the current host as primary and a read-only external advisor, then verify and synthesize both evidence sets. Use only when the user explicitly requests cross-model verification.
+description: Run independent two-model verification with the current host as primary and one installed read-only advisor, then verify and synthesize both evidence sets. Use only when the user explicitly requests cross-model verification.
 ---
 
 # Run independent cross-model verification
 
-Claude Code writes the first analysis, verifies consequential claims, and owns the
-final answer. Codex is an untrusted read-only advisor.
+Keep the current host responsible for scope, evidence, edits, verification, and the
+final answer. Use one installed collaboration companion that invokes a different CLI;
+never recurse into the current host or treat advisor output as authority.
 
 ## Modes
 
@@ -17,36 +18,26 @@ final answer. Codex is an untrusted read-only advisor.
 
 ## Workflow
 
-1. Confirm the advisor CLI and authentication. Define the exact workspace, question,
-   evidence standard, and response shape. Exclude secrets and unrelated files.
-2. Create `.ultra/collab/<session-id>/` and write the primary host's evidence-backed
-   analysis to `claude-analysis.md` before reading advisor output.
-3. Launch Codex with the raw bounded question and evidence in a read-only sandbox. Do
-   not include the primary conclusion when independence matters:
-
-   ```bash
-   codex exec -s read-only \
-     -a never \
-     --ephemeral \
-     --ignore-user-config \
-     --ignore-rules \
-     -o "${SESSION_PATH}/codex-output.md" \
-     "<bounded prompt>" \
-     2> "${SESSION_PATH}/codex-error.log"
-   ```
-4. Run `scripts/verify_wait.py` resolved relative to this skill directory. Use a
-   yielded or asynchronous shell session and poll at bounded intervals; do not hold a
-   blocking tool call longer than one minute.
+1. Define the workspace, question, evidence standard, and response shape. Confirm the
+   selected advisor CLI and authentication. Exclude secrets and unrelated files.
+2. Create `.ultra/collab/<session-id>/` and write the current host's independent,
+   evidence-backed analysis to `host-analysis.md` before reading advisor output.
+3. Follow the installed collaboration companion's read-only invocation contract. Give
+   the advisor the same bounded question and evidence, without the primary conclusion
+   when independence matters. Store its result as `advisor-output.md` and diagnostics
+   as `advisor-error.log`.
+4. Run `scripts/verify_wait.py <session-path> --advisor advisor --output
+   advisor-output.md` from this skill directory. Use a yielded shell session and poll
+   in bounded intervals; do not hold one blocking tool call longer than one minute.
 5. Read advisor output only after the waiter reports a complete, non-empty file.
-6. Verify both analyses against the current checkout, tests, runtime, or primary
-   documentation. Explain scope, version, evidence, and assumption differences before
-   judging disagreement.
-7. Write session metadata and a synthesis artifact, then return one host-owned
-   conclusion.
+6. Verify consequential claims against the current checkout, tests, runtime, or
+   primary documentation. Explain scope, version, evidence, and assumption differences
+   before resolving disagreement.
+7. Write `metadata.json` and `synthesis.md`, then return one host-owned conclusion.
 
 Read `references/cross-verify-modes.md` for mode-specific evidence and
 `references/confidence-system.md` when confidence language is useful. Model agreement
 never overrides failing tests or authoritative runtime evidence.
 
-Advisor failure degrades to the primary analysis with a single-source warning. It does
-not block the user's underlying task.
+Advisor failure degrades to the primary analysis with a single-source warning. It
+never blocks the user's underlying task.

package/skills/ultra-verify/scripts/verify_wait.py

@@ -1,19 +1,16 @@
 #!/usr/bin/env python3
-"""File-based completion waiter for the Ultra Verify advisor.
-
-Poll the session directory until the expected output is non-empty and stable, or until timeout.
-The JSON result carries the operational status; timeout is not a process error.
-"""
+"""Wait for one named advisor output file to become non-empty and stable."""
 
+import argparse
 import json
+import re
 import sys
 import time
 from pathlib import Path
 
 POLL_INTERVAL = 3
 DEFAULT_TIMEOUT = 1200
-ADVISOR = "codex"
-OUTPUT_FILE = "codex-output.md"
+SAFE_ADVISOR = re.compile(r"^[a-zA-Z0-9_-]+$")
 
 
 def _file_size(path: Path) -> int:
@@ -23,71 +20,74 @@ def _file_size(path: Path) -> int:
         return -1
 
 
-def _check_output(session_path: Path) -> dict:
-    output = session_path / OUTPUT_FILE
+def _safe_output(value: str) -> Path:
+    result = Path(value)
+    if result.is_absolute() or len(result.parts) != 1 or result.name in {"", ".", ".."}:
+        raise argparse.ArgumentTypeError("--output must be one file name inside the session directory")
+    return result
+
+
+def _arguments():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("session_path", type=Path)
+    parser.add_argument("--advisor", default="advisor")
+    parser.add_argument("--output", type=_safe_output, default=Path("advisor-output.md"))
+    parser.add_argument("--timeout", type=int, default=DEFAULT_TIMEOUT)
+    args = parser.parse_args()
+    if not SAFE_ADVISOR.fullmatch(args.advisor):
+        parser.error("--advisor must use letters, numbers, underscore, or hyphen")
+    if args.timeout < 0:
+        parser.error("--timeout must be non-negative")
+    if not args.session_path.is_dir():
+        parser.error(f"session directory not found: {args.session_path}")
+    return args
+
+
+def _status(session_path: Path, advisor: str, output_name: Path) -> dict:
+    output = session_path / output_name
     if _file_size(output) > 0:
-        return {"name": ADVISOR, "status": "complete", "file": str(output)}
-    return {"name": ADVISOR, "status": "pending", "file": None}
+        return {"name": advisor, "status": "complete", "file": str(output)}
+    return {"name": advisor, "status": "pending", "file": None}
 
 
-def _timeout_status(session_path: Path) -> dict:
-    output = session_path / OUTPUT_FILE
-    error = session_path / f"{ADVISOR}-error.log"
+def _timeout_status(session_path: Path, advisor: str, output_name: Path) -> dict:
+    output = session_path / output_name
+    error = session_path / f"{advisor}-error.log"
     output_size = _file_size(output)
     if output_size > 0:
-        return {"name": ADVISOR, "status": "complete", "file": str(output)}
+        return {"name": advisor, "status": "complete", "file": str(output)}
     if _file_size(error) > 0:
-        return {"name": ADVISOR, "status": "failed", "file": str(error)}
+        return {"name": advisor, "status": "failed", "file": str(error)}
     if output_size == 0:
-        return {"name": ADVISOR, "status": "empty", "file": str(output)}
-    return {"name": ADVISOR, "status": "pending", "file": None}
+        return {"name": advisor, "status": "empty", "file": str(output)}
+    return {"name": advisor, "status": "pending", "file": None}
 
 
 def main() -> None:
-    if len(sys.argv) < 2:
-        print(__doc__, file=sys.stderr)
-        sys.exit(2)
-
-    session_path = Path(sys.argv[1])
-    timeout = DEFAULT_TIMEOUT
-    if "--timeout" in sys.argv:
-        idx = sys.argv.index("--timeout")
-        if idx + 1 >= len(sys.argv):
-            print("Error: --timeout requires an integer", file=sys.stderr)
-            sys.exit(2)
-        try:
-            timeout = int(sys.argv[idx + 1])
-        except ValueError:
-            print(f"Error: --timeout must be integer: {sys.argv[idx + 1]}", file=sys.stderr)
-            sys.exit(2)
-        if timeout < 0:
-            print("Error: --timeout must be non-negative", file=sys.stderr)
-            sys.exit(2)
-
-    if not session_path.is_dir():
-        print(f"Error: session directory not found: {session_path}", file=sys.stderr)
-        sys.exit(2)
-
-    deadline = time.monotonic() + timeout
-    previous_size = _file_size(session_path / OUTPUT_FILE)
+    args = _arguments()
+    output = args.session_path / args.output
+    deadline = time.monotonic() + args.timeout
+    previous_size = _file_size(output)
     while time.monotonic() < deadline:
-        current_size = _file_size(session_path / OUTPUT_FILE)
-        advisor = _check_output(session_path)
-        stable = advisor["status"] == "complete" and current_size == previous_size
-        if stable:
-            elapsed = int(timeout - (deadline - time.monotonic()))
-            print(json.dumps({"status": "complete", ADVISOR: advisor, "elapsed_seconds": elapsed}))
+        current_size = _file_size(output)
+        advisor = _status(args.session_path, args.advisor, args.output)
+        if advisor["status"] == "complete" and current_size == previous_size:
+            elapsed = int(args.timeout - (deadline - time.monotonic()))
+            print(json.dumps({
+                "status": "complete", "advisor": advisor, "elapsed_seconds": elapsed,
+            }))
             return
-
         state = "stabilizing" if advisor["status"] == "complete" else "waiting"
         remaining = max(0, int(deadline - time.monotonic()))
-        sys.stderr.write(f"\r  [0/1] {ADVISOR}:{state} ({remaining}s remaining)  ")
+        sys.stderr.write(f"\r  [0/1] {args.advisor}:{state} ({remaining}s remaining)  ")
         sys.stderr.flush()
         previous_size = current_size
         time.sleep(POLL_INTERVAL)
 
-    advisor = _timeout_status(session_path)
-    print(json.dumps({"status": "timeout", ADVISOR: advisor, "elapsed_seconds": timeout}))
+    advisor = _timeout_status(args.session_path, args.advisor, args.output)
+    print(json.dumps({
+        "status": "timeout", "advisor": advisor, "elapsed_seconds": args.timeout,
+    }))
 
 
 if __name__ == "__main__":

package/spec/mcp-tools.yaml

@@ -321,17 +321,30 @@ tools:
 
   - name: task.expand
     family: task
-    description: Expand a parent task into N child sub-tasks (Phase 8A).
+    description: Validate and atomically persist child tasks derived by the current host from one parent task.
     phase: '8a'
     writer_role: mcp
     input_schema:
       type: object
-      required: [id]
+      required: [id, children]
       additionalProperties: false
       properties:
-        id:        { type: string }
-        sub_count: { type: integer, minimum: 1, maximum: 16 }
-        strategy:  { type: string, enum: [llm], default: llm }
+        id: { type: string }
+        children:
+          type: array
+          minItems: 1
+          items:
+            type: object
+            required: [id, title, type, priority]
+            additionalProperties: false
+            properties:
+              id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
+              title: { type: string, minLength: 3, maxLength: 200 }
+              type: { type: string, enum: [architecture, feature, bugfix] }
+              priority: { type: string, enum: [P0, P1, P2, P3] }
+              complexity: { type: integer, minimum: 1, maximum: 10 }
+              deps: { type: array, items: { type: string } }
+              files_modified: { type: array, items: { type: string } }
     output_schema:
       type: object
       required: [parent_id, children]
@@ -345,21 +358,36 @@ tools:
       - { code: CHANGE_NOT_FOUND, description: 'the parent task change does not exist' }
       - { code: CHANGE_NOT_MUTABLE, description: 'the parent task change no longer accepts children' }
       - { code: BASELINE_NOT_READY, description: 'child creation requires a ready baseline or the parent task to belong to an already-authorized active change' }
+      - { code: INVALID_OUTPUT, description: 'the host-derived child task graph is invalid' }
     cli_subcommand: task expand
     emits_events: [task_expanded]
     trace_to: '§7.3, D34'
 
   - name: task.parse_prd
     family: task
-    description: Parse a PRD document into a task graph (Phase 8A). When dry_run=true the tasks are returned without writing to state.db (supports ultra-plan human gate workflow).
+    description: Validate a host-derived PRD task graph and optionally persist it after the Ultra planning approval gate.
     phase: '8a'
     writer_role: mcp
     input_schema:
       type: object
+      required: [tasks]
       additionalProperties: false
       properties:
-        prd_path: { type: string }
-        prd_text: { type: string }
+        tasks:
+          type: array
+          minItems: 1
+          items:
+            type: object
+            required: [id, title, type, priority]
+            additionalProperties: false
+            properties:
+              id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
+              title: { type: string, minLength: 3, maxLength: 200 }
+              type: { type: string, enum: [architecture, feature, bugfix] }
+              priority: { type: string, enum: [P0, P1, P2, P3] }
+              complexity: { type: integer, minimum: 1, maximum: 10 }
+              deps: { type: array, items: { type: string } }
+              files_modified: { type: array, items: { type: string } }
         tag:      { type: string }
         change_id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$', description: 'continuous change unit that will own every persisted parsed task' }
         dry_run:  { type: boolean, default: false, description: 'when true, do not persist to state.db — used by ultra-plan gate to preview before approve' }
@@ -371,8 +399,8 @@ tools:
         tasks: { type: array, items: { type: object } }
         topo:  { type: array, items: { type: array, items: { type: string } } }
     errors:
-      - { code: NO_INPUT, description: 'one of prd_path or prd_text required' }
-      - { code: PARSE_FAILED, description: 'PRD could not be parsed into tasks' }
+      - { code: PARSE_FAILED, description: 'the host-derived PRD task graph is invalid' }
+      - { code: CYCLE_DETECTED, description: 'the proposed task graph contains a dependency cycle' }
       - { code: CHANGE_NOT_FOUND, description: 'assigned change does not exist' }
       - { code: CHANGE_NOT_MUTABLE, description: 'assigned change no longer accepts tasks' }
       - { code: BASELINE_NOT_READY, description: 'persisting parsed tasks requires a ready baseline or an already-authorized active change' }

package/mcp-server/lib/llm-client.cjs

@@ -1,157 +0,0 @@
-'use strict';
-
-// Phase 8A.1 — Unified LLM client over @anthropic-ai/sdk and openai.
-//
-// Provider is inferred from model prefix (claude/opus/sonnet/haiku → Anthropic,
-// gpt/o1/o3 → OpenAI). API keys come from env. The single surface the rest of
-// the code depends on is `client.completeJson({ system, user, maxTokens })`,
-// which returns `{ json, raw, usage, model, provider }` — the model's reply
-// already parsed as JSON (caller handles schema validation on `.json`).
-
-const Anthropic = require('@anthropic-ai/sdk');
-const OpenAI = require('openai');
-
-const PROVIDER_RULES = Object.freeze([
-  { pattern: /^(claude|opus|sonnet|haiku)/i, provider: 'anthropic' },
-  { pattern: /^(gpt|o1|o3)/i,                provider: 'openai'    },
-]);
-
-const DEFAULT_MODEL = 'claude-sonnet-4-6';
-const DEFAULT_MAX_TOKENS = 4096;
-
-class LlmClientError extends Error {
-  constructor(code, message, cause) {
-    super(message);
-    this.name = 'LlmClientError';
-    this.code = code;
-    if (cause) this.cause = cause;
-  }
-}
-
-function inferProvider(model) {
-  if (!model || typeof model !== 'string') return null;
-  for (const rule of PROVIDER_RULES) {
-    if (rule.pattern.test(model)) return rule.provider;
-  }
-  return null;
-}
-
-function resolveProviderKey(provider, apiKey) {
-  if (apiKey) return apiKey;
-  return provider === 'anthropic' ? process.env.ANTHROPIC_API_KEY : process.env.OPENAI_API_KEY;
-}
-
-function createLlmClient({ model, apiKey } = {}) {
-  const resolvedModel = model || process.env.UBP_PLANNER_MODEL || DEFAULT_MODEL;
-  const provider = inferProvider(resolvedModel);
-  if (!provider) {
-    throw new LlmClientError(
-      'LLM_UNSUPPORTED_MODEL',
-      `cannot infer provider from model "${resolvedModel}"`,
-    );
-  }
-  const key = resolveProviderKey(provider, apiKey);
-  if (!key) {
-    const envName = provider === 'anthropic' ? 'ANTHROPIC_API_KEY' : 'OPENAI_API_KEY';
-    throw new LlmClientError('NO_LLM_CREDENTIALS', `${envName} not set`);
-  }
-  return provider === 'anthropic'
-    ? buildAnthropicAdapter({ model: resolvedModel, apiKey: key })
-    : buildOpenAiAdapter({ model: resolvedModel, apiKey: key });
-}
-
-function buildAnthropicAdapter({ model, apiKey }) {
-  const sdk = new Anthropic({ apiKey });
-  return {
-    provider: 'anthropic',
-    model,
-    async completeJson({ system, user, maxTokens = DEFAULT_MAX_TOKENS }) {
-      let message;
-      try {
-        message = await sdk.messages.create({
-          model,
-          max_tokens: maxTokens,
-          system,
-          messages: [{ role: 'user', content: user }],
-        });
-      } catch (err) {
-        throw new LlmClientError('LLM_API_ERROR', `Anthropic API error: ${err.message}`, err);
-      }
-      const text = extractAnthropicText(message.content);
-      const usage = {
-        input_tokens: message.usage?.input_tokens ?? 0,
-        output_tokens: message.usage?.output_tokens ?? 0,
-      };
-      return parseCompletionJson({ raw: text, usage, model, provider: 'anthropic' });
-    },
-  };
-}
-
-function buildOpenAiAdapter({ model, apiKey }) {
-  const sdk = new OpenAI({ apiKey });
-  return {
-    provider: 'openai',
-    model,
-    async completeJson({ system, user, maxTokens = DEFAULT_MAX_TOKENS }) {
-      let completion;
-      try {
-        completion = await sdk.chat.completions.create({
-          model,
-          max_tokens: maxTokens,
-          response_format: { type: 'json_object' },
-          messages: [
-            { role: 'system', content: system },
-            { role: 'user',   content: user   },
-          ],
-        });
-      } catch (err) {
-        throw new LlmClientError('LLM_API_ERROR', `OpenAI API error: ${err.message}`, err);
-      }
-      const text = completion.choices?.[0]?.message?.content ?? '';
-      const usage = {
-        input_tokens:  completion.usage?.prompt_tokens     ?? 0,
-        output_tokens: completion.usage?.completion_tokens ?? 0,
-      };
-      return parseCompletionJson({ raw: text, usage, model, provider: 'openai' });
-    },
-  };
-}
-
-function extractAnthropicText(content) {
-  if (!Array.isArray(content)) return '';
-  return content.filter((b) => b && b.type === 'text').map((b) => b.text || '').join('');
-}
-
-function parseCompletionJson({ raw, usage, model, provider }) {
-  const trimmed = stripCodeFence(raw).trim();
-  if (!trimmed) {
-    throw new LlmClientError('LLM_INVALID_JSON', 'LLM returned empty content');
-  }
-  let json;
-  try {
-    json = JSON.parse(trimmed);
-  } catch (err) {
-    throw new LlmClientError(
-      'LLM_INVALID_JSON',
-      `failed to parse LLM response as JSON: ${err.message}`,
-      err,
-    );
-  }
-  return { json, raw, usage, model, provider };
-}
-
-function stripCodeFence(s) {
-  if (!s || typeof s !== 'string') return '';
-  const fenced = s.match(/^```(?:json)?\s*\n?([\s\S]*?)\n?```\s*$/);
-  return fenced ? fenced[1] : s;
-}
-
-module.exports = {
-  createLlmClient,
-  inferProvider,
-  LlmClientError,
-  parseCompletionJson,
-  stripCodeFence,
-  DEFAULT_MODEL,
-  DEFAULT_MAX_TOKENS,
-};

package/mcp-server/lib/llm-client.test.cjs

@@ -1,156 +0,0 @@
-'use strict';
-
-const test = require('node:test');
-const assert = require('node:assert/strict');
-
-const {
-  createLlmClient,
-  inferProvider,
-  LlmClientError,
-  parseCompletionJson,
-  stripCodeFence,
-  DEFAULT_MODEL,
-} = require('./llm-client.cjs');
-
-test('inferProvider: claude family → anthropic', () => {
-  assert.equal(inferProvider('claude-sonnet-4-6'), 'anthropic');
-  assert.equal(inferProvider('claude-opus-4-7'), 'anthropic');
-  assert.equal(inferProvider('sonnet-legacy'), 'anthropic');
-  assert.equal(inferProvider('opus-anything'), 'anthropic');
-  assert.equal(inferProvider('haiku-4-5'), 'anthropic');
-});
-
-test('inferProvider: GPT / o1 / o3 → openai', () => {
-  assert.equal(inferProvider('gpt-4o'), 'openai');
-  assert.equal(inferProvider('gpt-5.4'), 'openai');
-  assert.equal(inferProvider('o1-preview'), 'openai');
-  assert.equal(inferProvider('o3-mini'), 'openai');
-});
-
-test('inferProvider: unknown prefix → null', () => {
-  assert.equal(inferProvider('llama-3'), null);
-  assert.equal(inferProvider(''), null);
-  assert.equal(inferProvider(null), null);
-  assert.equal(inferProvider(undefined), null);
-});
-
-test('stripCodeFence: removes ```json ... ``` fence', () => {
-  const input = '```json\n{"a":1}\n```';
-  assert.equal(stripCodeFence(input).trim(), '{"a":1}');
-});
-
-test('stripCodeFence: removes plain ``` ... ``` fence', () => {
-  const input = '```\n{"a":1}\n```';
-  assert.equal(stripCodeFence(input).trim(), '{"a":1}');
-});
-
-test('stripCodeFence: leaves unfenced content alone', () => {
-  assert.equal(stripCodeFence('{"a":1}'), '{"a":1}');
-  assert.equal(stripCodeFence('   '), '   ');
-});
-
-test('stripCodeFence: empty / nullish → empty string', () => {
-  assert.equal(stripCodeFence(''), '');
-  assert.equal(stripCodeFence(null), '');
-  assert.equal(stripCodeFence(undefined), '');
-});
-
-test('parseCompletionJson: valid JSON → parsed object', () => {
-  const r = parseCompletionJson({
-    raw: '{"ok":true,"n":2}',
-    usage: { input_tokens: 10, output_tokens: 5 },
-    model: 'claude-sonnet-4-6',
-    provider: 'anthropic',
-  });
-  assert.deepEqual(r.json, { ok: true, n: 2 });
-  assert.equal(r.usage.input_tokens, 10);
-  assert.equal(r.model, 'claude-sonnet-4-6');
-  assert.equal(r.provider, 'anthropic');
-});
-
-test('parseCompletionJson: fenced JSON → parsed object', () => {
-  const r = parseCompletionJson({
-    raw: '```json\n{"x":42}\n```',
-    usage: {},
-    model: 'gpt-5',
-    provider: 'openai',
-  });
-  assert.deepEqual(r.json, { x: 42 });
-});
-
-test('parseCompletionJson: empty content → LLM_INVALID_JSON', () => {
-  assert.throws(
-    () => parseCompletionJson({ raw: '', usage: {}, model: 'x', provider: 'anthropic' }),
-    (err) => err instanceof LlmClientError && err.code === 'LLM_INVALID_JSON',
-  );
-});
-
-test('parseCompletionJson: malformed JSON → LLM_INVALID_JSON', () => {
-  assert.throws(
-    () => parseCompletionJson({ raw: '{not json', usage: {}, model: 'x', provider: 'anthropic' }),
-    (err) => err instanceof LlmClientError && err.code === 'LLM_INVALID_JSON',
-  );
-});
-
-test('createLlmClient: unknown model → LLM_UNSUPPORTED_MODEL', () => {
-  assert.throws(
-    () => createLlmClient({ model: 'llama-3', apiKey: 'sk-test' }),
-    (err) => err instanceof LlmClientError && err.code === 'LLM_UNSUPPORTED_MODEL',
-  );
-});
-
-test('createLlmClient: missing key → NO_LLM_CREDENTIALS', () => {
-  const savedA = process.env.ANTHROPIC_API_KEY;
-  const savedO = process.env.OPENAI_API_KEY;
-  delete process.env.ANTHROPIC_API_KEY;
-  delete process.env.OPENAI_API_KEY;
-  try {
-    assert.throws(
-      () => createLlmClient({ model: 'claude-sonnet-4-6' }),
-      (err) => err instanceof LlmClientError && err.code === 'NO_LLM_CREDENTIALS',
-    );
-    assert.throws(
-      () => createLlmClient({ model: 'gpt-5' }),
-      (err) => err instanceof LlmClientError && err.code === 'NO_LLM_CREDENTIALS',
-    );
-  } finally {
-    if (savedA !== undefined) process.env.ANTHROPIC_API_KEY = savedA;
-    if (savedO !== undefined) process.env.OPENAI_API_KEY = savedO;
-  }
-});
-
-test('createLlmClient: explicit apiKey bypasses env check + returns adapter shape', () => {
-  const anthropicClient = createLlmClient({ model: 'claude-sonnet-4-6', apiKey: 'sk-test' });
-  assert.equal(anthropicClient.provider, 'anthropic');
-  assert.equal(anthropicClient.model, 'claude-sonnet-4-6');
-  assert.equal(typeof anthropicClient.completeJson, 'function');
-
-  const openaiClient = createLlmClient({ model: 'gpt-5', apiKey: 'sk-test' });
-  assert.equal(openaiClient.provider, 'openai');
-  assert.equal(openaiClient.model, 'gpt-5');
-  assert.equal(typeof openaiClient.completeJson, 'function');
-});
-
-test('createLlmClient: defaults model from env UBP_PLANNER_MODEL', () => {
-  const saved = process.env.UBP_PLANNER_MODEL;
-  process.env.UBP_PLANNER_MODEL = 'gpt-5.4';
-  try {
-    const c = createLlmClient({ apiKey: 'sk-test' });
-    assert.equal(c.model, 'gpt-5.4');
-    assert.equal(c.provider, 'openai');
-  } finally {
-    if (saved === undefined) delete process.env.UBP_PLANNER_MODEL;
-    else process.env.UBP_PLANNER_MODEL = saved;
-  }
-});
-
-test('createLlmClient: falls back to DEFAULT_MODEL when nothing supplied', () => {
-  const savedEnv = process.env.UBP_PLANNER_MODEL;
-  delete process.env.UBP_PLANNER_MODEL;
-  try {
-    const c = createLlmClient({ apiKey: 'sk-test' });
-    assert.equal(c.model, DEFAULT_MODEL);
-  } finally {
-    if (savedEnv !== undefined) process.env.UBP_PLANNER_MODEL = savedEnv;
-  }
-});