brindle 0.3.12__tar.gz → 0.3.13__tar.gz

{brindle-0.3.12 → brindle-0.3.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brindle
-Version: 0.3.12
+Version: 0.3.13
 Summary: Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges
 Project-URL: Homepage, https://pawdelta.com/brindle/
 Project-URL: Documentation, https://pawdelta.com/brindle/docs/recommended-use
@@ -94,7 +94,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.12`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.13`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start

{brindle-0.3.12 → brindle-0.3.13}/README.md

@@ -63,7 +63,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.12`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.13`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start

{brindle-0.3.12 → brindle-0.3.13}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brindle"
-version = "0.3.12"
+version = "0.3.13"
 description = "Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges"
 readme = "README.md"
 requires-python = ">=3.11"

{brindle-0.3.12 → brindle-0.3.13}/src/brindle/agents.py

@@ -817,14 +817,12 @@ def _launch(db: DB, agent: Agent, ws: Workspace, *, prompt: str | None,
         _launch_headless(db, agent, ws, prompt=prompt, resume=resume, watch_pane=watch_pane, m=m)
         return
     if provider.prompt_after_ready:
-        # Workers receive their instructions and real task in one delivery.
-        # A fresh interactive chat without a task still needs its profile.
-        if provider.name == "antigravity" and not resume and (prompt or agent.mode == "interactive"):
-            from brindle import antigravity
-            instructions = "\n\n".join(filter(None, (antigravity.TOOLS_NOTE, profile.prompt)))
-            prompt = "\n\n".join(filter(None, (antigravity.format_delivered_message(instructions), prompt)))
-        if prompt:
-            db.enqueue(agent.id, prompt, None)
+        # Typed in once it's ready, after a warm-up carrying its instructions:
+        # agy connects its MCP servers only once a conversation has started,
+        # so the task must arrive as a second turn (see brindle.antigravity).
+        for text in ((provider.warmup(profile) if not resume else None), prompt):
+            if text:
+                db.enqueue(agent.id, text, None)
         prompt = None
     # Recorded before launching: the agent's hooks may fire within milliseconds.
     status = "processing" if prompt else "starting"
@@ -2025,12 +2023,6 @@ def default_review_profile(cfg: RepoConfig, worker: Agent | None, db: DB | None
         return cfg.review_profile
     if cfg.reviewer and cfg.reviewer != "reviewer":
         return cfg.reviewer
-    if unusable("antigravity") is None:
-        try:
-            load_profile("reviewer-gemini", repo_root)
-            return "reviewer-gemini"
-        except Exception:
-            pass
     if db is None or not repo_root:
         return cfg.reviewer
     from brindle import learning
@@ -2079,6 +2071,15 @@ def _review_kill_switch(ws: Workspace) -> None:
         raise AgentError(f"No reviewer started: {why_not}")
 
 
+def _review_worktree_present(ws: Workspace) -> None:
+    """Raises ``AgentError`` when ``ws``'s worktree is gone from disk (removed
+    outside brindle, so its record outlived it): every git call on the branch
+    would fail there, and nothing is left to review."""
+    if not os.path.isdir(ws.path):
+        raise AgentError(f"No reviewer started: {ws.id}'s worktree {ws.path} no longer exists. "
+                         f"remove_workspace {ws.id} clears its record.")
+
+
 def _review_profile(db: DB, ws: Workspace, profile: str | None, cfg: RepoConfig) -> str:
     """The reviewer profile to use, checked to be one that can run: raises
     ``AgentError`` if it (explicit or picked) doesn't exist, or uses the codex
@@ -2144,6 +2145,7 @@ def start_review(db: DB, caller: Agent | None, ws: Workspace, profile: str | Non
     from brindle.config import load_repo_config
     from brindle.providers import brindle_invocation
 
+    _review_worktree_present(ws)
     cfg = cfg or load_repo_config(ws.repo_root)
     if not cfg.checks:
         return request_review(db, caller, ws, profile, focus, cfg)
@@ -2222,12 +2224,15 @@ def request_review(db: DB, caller: Agent | None, ws: Workspace, profile: str | N
     from brindle import gates
     from brindle.config import load_repo_config
 
+    _review_worktree_present(ws)
     _review_kill_switch(ws)
     cfg = cfg or load_repo_config(ws.repo_root)
     sha = gates.head(ws)
     for old in db.list_agents(ws.id):
         if old.mode != "review" or old.result is not None or not is_alive(old):
             continue
+        if old.unreported_noted:
+            continue   # it stopped without a verdict: not the reviewer of anything
         if old.review_sha == sha:
             if profile and old.profile != profile:
                 continue   # another profile's review of this commit (a second review): keep both
@@ -2467,13 +2472,49 @@ def permission_request_decision(db: DB, agent: Agent, payload: dict,
             if not reqs:
                 return None
             rules = [*permissions.all_rules(ws.repo_root), *profile_rules]
+            from dataclasses import replace
+
+            from brindle.native.permissions import Permissions, split_commands, uncovered_part
             from brindle.profiles import load_profile
 
             try:
-                rules += permissions.profile_bash_allows(load_profile(agent.profile, ws.repo_root))
+                profile = load_profile(agent.profile, ws.repo_root)
             except KeyError:
-                pass  # deleted profile: no extra allowances
+                profile = None  # deleted profile: no extra allowances
+            if profile is not None:
+                rules += permissions.profile_bash_allows(profile)
             decision = permissions.decide_all(reqs, checks=cfg.checks, rules=rules)
+            if decision.decision == "ask" and len(reqs) == 1:
+                # A deny on one part of a compound command (cd x && <denied>)
+                # wins before any part-by-part allow below.
+                decision = permissions.deny_in_parts(reqs[0], checks=cfg.checks, rules=rules) or decision
+            if decision.decision == "ask" and profile is not None:
+                perms = Permissions(profile.permission_mode, profile.allowed_tools)
+                command = reqs[0].command or ""
+                specs = [spec for name, spec in perms.rules
+                         if name == "Bash" and spec not in (None, "", "*")]
+                cwd = os.path.realpath(reqs[0].cwd or ws.path)
+                root = os.path.realpath(ws.path)
+                # Like pre_tool_decision: a compound command whose every part
+                # allowed_tools covers (a cd within the worktree counts).
+                if (len(reqs) == 1 and reqs[0].kind == "bash" and specs
+                        and (cwd == root or cwd.startswith(root + os.sep))
+                        and uncovered_part(specs, command, cd_root=ws.path) is None):
+                    decision = permissions.Decision(
+                        "allow", "every part of the command matches the profile's allowed_tools")
+                    # Deny each part as the allow just read it (quotes and a
+                    # harmless redirection gone), which deny_in_parts doesn't.
+                    for part in split_commands(command):
+                        denied = permissions.decide(replace(reqs[0], command=part), checks=cfg.checks, rules=rules)
+                        if denied.decision == "deny":
+                            decision = denied
+                            break
+                elif perms.mode == "dontAsk":
+                    # Nobody watches this pane: a prompt would stall the agent.
+                    decision = permissions.Decision(
+                        "deny", f"{decision.reason.removesuffix('; asking the user')}, and this profile "
+                        "never asks (permission_mode dontAsk). Don't retry it: do without it, or ask "
+                        "your supervisor with the send_message tool (brindle MCP server)")
             summary = reqs[0].summary() if len(reqs) == 1 else (
                 f"{reqs[0].tool}: " + ", ".join(r.path or "?" for r in reqs))[:200]
             _record_permission(db, agent, ws, summary, f"{decision.decision}: {decision.reason}")
@@ -2532,24 +2573,26 @@ def _stop_decision(db: DB, agent: Agent, payload: dict, via_inbox: bool = False)
     """What the Stop hook decides: a "block" with the reason to carry on, or
     None to let the agent stop. ``via_inbox``: the reason will be sent as an
     inbox message rather than block the stop, so ``stop_hook_active`` never
-    caps a repeat; the unread-mail reminder is then limited like a notice."""
+    caps a repeat; the unread-mail reminder is then limited to one per
+    NOTICE_TTL (DB.claim_stop_reminder)."""
     msg = db.pop_pending(agent.id)
     if msg:
         db.set_status(agent.id, "processing")
         return {"decision": "block", "reason": msg.body}
-    if agent.mode == "interactive" and db.unread_count(agent.id):
+    if (agent.mode == "interactive" and db.unread_count(agent.id)
+            and not payload.get("stop_hook_active")):
+        # Stopping with mail unread, even moments after its notice went out:
+        # that notice may have been lost, and nothing else will wake it.
         ap = db.get_autopilot(agent.id)
-        if (ap is not None and ap.enabled and not payload.get("stop_hook_active")
-                and (not via_inbox or db.claim_notice(agent.id))):
-            # An autopilot supervisor doesn't stop with mail it hasn't read.
+        pilot = ap is not None and ap.enabled
+        # An autopilot supervisor that would really be blocked doesn't stop
+        # with mail it hasn't read; stop_hook_active caps that.
+        claimed = db.unread(agent.id) if pilot and not via_inbox else db.claim_stop_reminder(agent.id)
+        if claimed:
             db.set_status(agent.id, "processing")
             return {"decision": "block", "reason": (
                 "[brindle autopilot] You have unread messages. Call read_messages "
-                "before you stop.")}
-        claimed = None if payload.get("stop_hook_active") else db.claim_notice(agent.id)
-        if claimed:  # the notice never went out (or was lost): hand it over now
-            db.set_status(agent.id, "processing")
-            return {"decision": "block", "reason": unread_notice(db, claimed)}
+                "before you stop." if pilot else unread_notice(db, claimed))}
     needs_report = agent.mode in REPORTING_MODES and agent.result is None
     if needs_report and not payload.get("stop_hook_active"):
         db.set_status(agent.id, "processing")
@@ -2607,6 +2650,11 @@ def handle_hook(db: DB, agent_id: str, event: str, payload: dict) -> dict | None
     if transcript and agent.provider == "claude" and transcript != agent.transcript_path:
         db.update_agent(agent_id, transcript_path=str(transcript))
 
+    if event in ("prompt-submit", "pre-tool", "tool-done") and agent.unreported_noted:
+        # It's working again, so a later stop without a result is a new one
+        # its supervisor should hear about (see tell_parent_unreported).
+        db.update_agent(agent_id, unreported_noted=None)
+
     if event == "session-start":
         from brindle import inbox
 
@@ -2711,6 +2759,13 @@ def handle_hook(db: DB, agent_id: str, event: str, payload: dict) -> dict | None
                 decision = pilot.on_stop(db, agent, payload)
                 if decision:
                     db.enqueue(agent_id, decision["reason"], None)
+            if (agent.mode in REPORTING_MODES and agent.result is None
+                    and not db.pending_count(agent_id)):
+                # No Stop hook can remind it to report, and no hook says when
+                # it resumes: every turn it ends without a result is a stop
+                # its supervisor hears about.
+                db.update_agent(agent_id, unreported_noted=None)
+                tell_parent_unreported(db, db.get_agent(agent_id) or agent)
             if db.pending_count(agent_id) and not agent.headless:
                 flush(db, agent_id)
     elif event == "stop-failure":
@@ -2738,17 +2793,32 @@ def handle_hook(db: DB, agent_id: str, event: str, payload: dict) -> dict | None
                 "oauth_org_not_allowed", "billing_error"
             ))
         )
-        if is_auth:
+        # Claude Code's line for a --model its backend doesn't serve: every
+        # turn fails the same way, so the agent can't go on (launch_health
+        # reads the same line on screen).
+        from brindle import launch_health
+
+        is_model = not is_rate_limit and not is_auth and bool(
+            re.search(launch_health.SELECTED_MODEL, err_fields))
+        if is_auth or is_model:
             db.set_status(agent_id, "failed")
             db.clear_permission_requests(agent_id)
             from brindle import providers, autopilot as pilot
-            providers.invalidate_signed_in(agent.provider)
-            err_desc = payload.get("error_details") or payload.get("error") or payload.get("error_type") or "401/403"
-            msg = (
-                f"[brindle] Agent {agent_id} encountered an authentication failure "
-                f"(invalid or expired credentials): {err_desc}. "
-                "Check API keys or login status."
-            )
+            if is_auth:
+                providers.invalidate_signed_in(agent.provider)
+                err_desc = payload.get("error_details") or payload.get("error") or payload.get("error_type") or "401/403"
+                msg = (
+                    f"[brindle] Agent {agent_id} encountered an authentication failure "
+                    f"(invalid or expired credentials): {err_desc}. "
+                    "Check API keys or login status."
+                )
+            else:
+                err_desc = "its model isn't available on this route"
+                msg = (
+                    f"[brindle] Agent {agent_id} failed: Claude Code says there's an issue with "
+                    "the selected model (it may not exist, or the account or route may lack access). "
+                    "Check the profile's model and the Claude route (`brindle doctor`), then retry."
+                )
             if agent.parent_id:
                 try:
                     send_message(db, agent.parent_id, msg, sender_id="brindle")
@@ -2759,7 +2829,8 @@ def handle_hook(db: DB, agent_id: str, event: str, payload: dict) -> dict | None
                         pass
             root_id = pilot.root_of(db, agent_id)
             if db.get_autopilot(root_id):
-                pilot.need_user(db, root_id, f"Credentials need attention for agent {agent_id}: {err_desc}")
+                what = "Credentials need" if is_auth else "The model needs"
+                pilot.need_user(db, root_id, f"{what} attention for agent {agent_id}: {err_desc}")
         else:
             db.set_status(agent_id, "idle")
             db.clear_permission_requests(agent_id)
@@ -2834,30 +2905,36 @@ def command_running(db: DB, agent: Agent) -> bool:
         return False
 
 
-def tell_parent_unreported(db: DB, agent: Agent) -> None:
+def tell_parent_unreported(db: DB, agent: Agent) -> bool:
     """A worker stopped again after being reminded to report, still without a
     result. It won't be reminded again on its own, and its supervisor has
     usually gone idle waiting for it with nothing left to wake it, so tell the
-    supervisor (queued if it's busy, delivered now if it's idle)."""
+    supervisor (queued if it's busy, delivered now if it's idle). Returns
+    whether the supervisor was told."""
     if agent.mode not in FORWARDING_MODES or not agent.parent_id:
-        return  # a synchronous handoff's caller is still waiting on it
+        return False  # a synchronous handoff's caller is still waiting on it
     if db.get_agent(agent.parent_id) is None:
-        return
+        return False
     ws = db.get_workspace(agent.workspace_id)
-    if agent.mode == "review" and ws is not None:
+    if agent.mode == "review" and ws is not None and os.path.isdir(ws.path):
         from brindle import gates
 
         if db.latest_review(ws.id, gates.head(ws)):
-            return  # its verdict for the current commit is already recorded
+            return False  # its verdict for the current commit is already recorded
     if agent.unreported_noted:
-        return  # the supervisor was told once; no repeats
+        return False  # the supervisor was told about this stop; cleared once it resumes
     if command_running(db, agent):
         # Its turn ended while a long or background command (a test run) is
         # still going: it isn't stopped, and the command finishing wakes it.
         # Not marked noted, so a real stop later still gets its one alert.
-        return
+        return False
     db.update_agent(agent.id, unreported_noted=1)
-    where = f" (branch `{ws.branch}`, workspace {ws.id})" if ws else ""
+    if agent.mode == "review" and ws is not None:
+        from brindle import pipeline
+
+        if pipeline.on_reviewer_unreported(db, get(db, agent.id), ws):
+            return True  # a fallback reviewer took over, or the supervisor was told
+    where =f" (branch `{ws.branch}`, workspace {ws.id})" if ws else ""
     tool = "submit_review" if agent.mode == "review" else "report_result"
     who = "Reviewer" if agent.mode == "review" else "Worker"
     body = (
@@ -2870,7 +2947,8 @@ def tell_parent_unreported(db: DB, agent: Agent) -> None:
     except (AgentError, tmux.TmuxError):
         # The parent isn't running (or can't take messages): the notice is
         # deliberately dropped here, since there's nothing left to tell.
-        pass
+        return False
+    return True
 
 
 PERMISSION_EVENTS = ("permission-request", "codex-permission-request")

{brindle-0.3.12 → brindle-0.3.13}/src/brindle/antigravity.py

@@ -23,9 +23,9 @@ brindle sends it after that is typed in as a new turn once it's idle.
 agy's hooks, mapped onto brindle's:
 - ``PreInvocation`` before each model call: working. ``invocationNum`` 0 means
   a new turn, typed by the user unless brindle just delivered a message.
-- ``Stop``: a queued message is typed in as a new turn; otherwise brindle's Stop
-  hook (the report reminder, autopilot), where ``{"decision": "continue",
-  "reason": ...}`` keeps it going.
+- ``Stop``: a queued message is typed in as a new turn, and so is what
+  brindle's Stop hook would block with (the report reminder, autopilot): a
+  ``{"decision": "continue"}`` turn would have no MCP tools to act on it.
 - ``PostToolUse``: a tool ran, so a permission prompt was answered.
 - ``PreToolUse`` (only with ``permission_policy: "on"``): brindle's permission
   policy (brindle.permissions) answers deny, or what agy would do anyway (allow
@@ -275,10 +275,12 @@ def handle_hook(db, agent_id: str, event: str, payload: dict) -> dict | None:
 
     if event == "agy-pre-invocation":
         db.set_status(agent_id, "processing")
-        if payload.get("invocationNum", 0) == 0:
-            # A new turn: the user's, unless brindle just typed a message in.
+        if payload.get("invocationNum", 0) == 0 and not db.delivered_since(agent_id, time.time() - DELIVERY_WINDOW):
+            # A new turn the user typed. One brindle typed in (the report
+            # reminder among them) keeps stop_blocked: the stop path resets
+            # it itself before delivering anything else.
             db.update_agent(agent_id, stop_blocked=0)
-            if agent.mode == "interactive" and not db.delivered_since(agent_id, time.time() - DELIVERY_WINDOW):
+            if agent.mode == "interactive":
                 autopilot.user_spoke(db, agent)
         return None
     if event == "agy-post-tool":
@@ -298,6 +300,12 @@ def handle_hook(db, agent_id: str, event: str, payload: dict) -> dict | None:
             error_type = "rate_limit" if limited else ("auth" if autherr else "error")
             agents.handle_hook(db, agent_id, "stop-failure",
                                {**base, "error_type": error_type, "error": error})
+            failed = db.get_agent(agent_id)
+            if failed is not None and failed.status != "failed":   # not a sign-in problem
+                db.update_agent(agent_id, stop_blocked=0)
+                if db.pending_count(agent_id):
+                    _flush_soon(agent_id)
+                _tell_parent_stopped_on_error(db, failed, error_type)
             return None
         if db.pending_count(agent_id):
             # A new turn, not a continuation: only then does agy give the
@@ -309,13 +317,41 @@ def handle_hook(db, agent_id: str, event: str, payload: dict) -> dict | None:
         out = agents.handle_hook(db, agent_id, "stop",
                                  {**base, "stop_hook_active": bool(agent.stop_blocked)})
         if out and out.get("decision") == "block":
+            # Typed in as a new turn too: a turn the Stop hook continues has
+            # no MCP tools, so the agent couldn't call report_result in it.
+            # stop_blocked stays set through that turn (see agy-pre-invocation),
+            # so the reminder is sent once.
             db.update_agent(agent_id, stop_blocked=1)
-            return {"decision": "continue", "reason": out["reason"]}
+            db.enqueue(agent_id, out["reason"], None)
+            db.set_status(agent_id, "idle")
+            _flush_soon(agent_id)
+            return None
         db.update_agent(agent_id, stop_blocked=0)
         return None
     return None
 
 
+def _tell_parent_stopped_on_error(db, agent, error_type: str) -> None:
+    """A worker's turn ended on a provider error (not sign-in, which
+    stop-failure reports itself): no Stop hook follows, so it gets no report
+    reminder and its supervisor would wait on it with nothing to wake it."""
+    from brindle import agents, tmux
+
+    if (agent.mode not in agents.FORWARDING_MODES or not agent.parent_id or agent.result is not None
+            or db.get_agent(agent.parent_id) is None):
+        return
+    queued = " Its queued messages are being typed in as a new turn." if db.pending_count(agent.id) else ""
+    tool = "submit_review" if agent.mode == "review" else "report_result"
+    # The error type only: provider output can carry URLs, keys or prompt text.
+    body = (f"{'Reviewer' if agent.mode == 'review' else 'Worker'} {agent.id}'s turn ended on a "
+            f"provider error ({error_type}) before it called {tool}.{queued} Check on it: "
+            "send_message to have it carry on, or remove_workspace if the work is abandoned.")
+    try:
+        agents.send_message(db, agent.parent_id, body)
+    except (agents.AgentError, tmux.TmuxError):
+        db.enqueue(agent.parent_id, body, None)
+
+
 def _flush_soon(agent_id: str, delay: float = 1.5) -> None:
     """Type the agent's next queued message once agy has finished stopping."""
     from brindle.providers import brindle_invocation
@@ -353,6 +389,10 @@ def pre_tool_decision(db, agent_id: str | None, payload: object, strict: bool =
         except KeyError:
             pass
     decision = permissions.decide(req, checks=cfg.checks, rules=rules)
+    if strict and decision.decision == "ask":
+        # A compound or quoted command whose every part is allowed, read as
+        # Claude Code's hook reads a profile's allowed_tools.
+        decision = permissions.allowlist_decision(req, rules, cfg.checks, cd_root=ws.path) or decision
     spaces = payload.get("workspacePaths")
     spaces = [s for s in spaces if isinstance(s, str) and s] if isinstance(spaces, list) else []
     if strict:
@@ -368,7 +408,13 @@ def pre_tool_decision(db, agent_id: str | None, payload: object, strict: bool =
             out = {"decision": "deny", "reason": f"brindle: {ambiguous}, so it can't be checked; "
                                                  "use one absolute path inside your worktree"}
         else:
-            out = output(decision, req, spaces, protected_roots=[ws.path, ws.repo_root])
+            # agy keeps what it tells the model about brindle's MCP server
+            # (its instructions and tools) and its built-in skills here:
+            # readable, never writable. Other servers' folders are not.
+            agy_home = Path.home() / ".gemini" / "antigravity-cli"
+            out = output(decision, req, spaces, protected_roots=[ws.path, ws.repo_root],
+                         readable=[str(agy_home / "mcp" / "brindle"), str(agy_home / "builtin")],
+                         has_supervisor=bool(agent.parent_id))
     else:
         out = output(decision, req, spaces)
     if req is not None and out["decision"] == "deny":

{brindle-0.3.12 → brindle-0.3.13}/src/brindle/autopilot.py

@@ -148,6 +148,9 @@ Acting on what you find:
   what you fixed and which findings weren't real. Don't ask first. Ask only
   before outward-facing or hard-to-reverse actions (posting, merging into a
   shared branch, deleting) and for decisions that are the user's to make.
+- Once you've laid out a plan, start it in the same turn. Don't end with
+  "shall I start?" or wait for a "yes" or "go": if a step needs a decision
+  only the user can make, ask that question and carry on with the rest.
 - Format your own verbose outputs or message transcripts in collapsible
   `<details><summary>Title</summary>...</details>` blocks so they are not
   sprawling in the chat UI."""

{brindle-0.3.12 → brindle-0.3.13}/src/brindle/company_login.py

@@ -472,7 +472,9 @@ def claude_model(model: str | None, repo_root: str | None = None) -> str | None:
     the profile's CLI flag, just as it does in the company login env.
     Launch and policy checks share this resolution without changing the
     saved profile. Claude Code's own managed settings pick their own route.
-    An unavailable setup leaves the profile alone, as company login does.
+    An unavailable setup leaves the profile alone, as company login does,
+    and so does a launch the route's env doesn't reach (``route_in_use``):
+    a route model id on the person's own Anthropic sign-in doesn't exist.
     """
     from brindle import providers
 
@@ -482,11 +484,26 @@ def claude_model(model: str | None, repo_root: str | None = None) -> str | None:
     if got is None or got is UNAVAILABLE:
         return model
     c = got[1].claude
-    if c is None or not c.model_ids or model in c.model_ids:
+    if c is None or not c.model_ids or model in c.model_ids or not route_in_use(got[0], got[1]):
         return model
     return c.default_model or c.model_ids[0]
 
 
+def route_in_use(org_id: str, setup) -> bool:
+    """Whether a Claude pane gets this org's route env: an enforced setup's
+    (``company_identity.enforced_route_env``), or the env company login
+    stored for this org (``stored_env``, what ``agents.agent_env`` applies)."""
+    if setup.enforce:
+        return True
+    if not stored_env():
+        return False
+    try:
+        got = config.user_settings().get(ENV_KEY)
+    except (OSError, ValueError):
+        return False
+    return isinstance(got, dict) and got.get("org") == org_id
+
+
 def org_setup(repo_root: str | None = None, store=None, client=None):
     """(org id, AgentSetup) for the signed-in org; personal policies supply
     only federated Claude setup. None when there is no applicable setup;

{brindle-0.3.12 → brindle-0.3.13}/src/brindle/cull.py

@@ -186,6 +186,7 @@ def sweep(db: DB, now: float | None = None) -> list[str]:
 
     # 3. Workers stuck on a prompt nobody is answering, or gone silent.
     done.extend(note_stuck(db, now, panes))
+    done.extend(note_idle_unreported(db, now, panes))
     done.extend(note_silent(db, now, panes))
     done.extend(note_model_refused(db, now, panes))
 
@@ -251,6 +252,49 @@ def note_stuck(db: DB, now: float, panes: dict[str, bool]) -> list[str]:
     return done
 
 
+# How long a worker may sit idle without having reported before its supervisor
+# is told (once per idle spell).
+IDLE_UNREPORTED_AFTER = 300.0
+
+
+def note_idle_unreported(db: DB, now: float, panes: dict[str, bool]) -> list[str]:
+    """Tell each supervisor, once per idle spell, about a worker that has sat
+    idle for IDLE_UNREPORTED_AFTER seconds without reporting, goal or not
+    (autopilot's Stop hook only checks on workers when a goal is set). It's
+    a reminder: the notice its stop sent may have gone unread, or been lost.
+
+    A worker whose provider has no hook for a turn starting (Codex) stays
+    'idle' from its first finished turn on, through any later turns, so it
+    also needs a pane that has printed nothing for that long, and the spell
+    starts at its last output."""
+    from brindle.providers import get_provider
+
+    done = []
+    owners = agents.pane_owners(db, panes)
+    for a in db.list_agents():
+        # Only these are ever told (a synchronous handoff's caller is waiting).
+        if (a.mode not in agents.FORWARDING_MODES or not a.parent_id or a.result is not None
+                or a.dismissed_at is not None or a.status != "idle"
+                or not agents.runs_process(a) or not agents.same_server(a, panes)
+                or not agents.is_alive(a, panes) or not agents.owns_pane(db, a, owners)):
+            continue
+        since = a.status_since or a.created_at
+        provider = get_provider(a.provider)
+        if not (provider.uses_hooks and provider.announces_turns):
+            last = tmux.window_activity(a.tmux_window, server=agents.server_of(a))
+            if last is None:
+                continue  # no telling whether a later turn is running
+            since = max(since, last)
+        if now - since < IDLE_UNREPORTED_AFTER or a.stuck_noted == since:
+            continue
+        db.update_agent(a.id, unreported_noted=None)
+        # Not told while a command it started is still running; tried again then.
+        if agents.tell_parent_unreported(db, db.get_agent(a.id) or a):
+            db.update_agent(a.id, stuck_noted=since)
+            done.append(f"told {a.parent_id} that worker {a.id} is idle without reporting")
+    return done
+
+
 # How long a worker no hook reports on (Codex) may show nothing new before its
 # supervisor is told. Such a CLI can sit on a startup error forever: signed in
 # without a plan that includes it, say (issue #42).
@@ -259,17 +303,23 @@ SILENT_AFTER = 600.0
 
 def note_silent(db: DB, now: float, panes: dict[str, bool]) -> list[str]:
     """Tell each supervisor, once per silence, about a worker whose status
-    no hook reports ('unknown') or that never got past 'starting', and whose
-    pane hasn't printed anything for SILENT_AFTER seconds without a result."""
+    no hook reports ('unknown'), that never got past 'starting', or that is
+    mid-turn ('processing': a running turn's spinner redraws the pane), and
+    whose pane hasn't printed anything for SILENT_AFTER seconds without a
+    result."""
     done = []
     owners = agents.pane_owners(db, panes)
     for a in db.list_agents():
         if (a.mode not in agents.REPORTING_MODES or not a.parent_id or a.result is not None
-                or a.dismissed_at is not None or a.status not in ("unknown", "starting")
+                or a.dismissed_at is not None
+                or a.status not in ("unknown", "starting", "processing")
                 or not agents.runs_process(a) or not agents.same_server(a, panes)
                 or not agents.is_alive(a, panes) or not agents.owns_pane(db, a, owners)):
             continue
-        last = tmux.window_activity(a.tmux_window, server=agents.server_of(a)) or a.created_at
+        activity = tmux.window_activity(a.tmux_window, server=agents.server_of(a))
+        if a.status == "processing" and (activity is None or a.headless):
+            continue  # no screen to go by, and its turn may well be running
+        last = activity or a.created_at
         if now - last < SILENT_AFTER or a.stuck_noted == last:
             continue
         ws = db.get_workspace(a.workspace_id)
@@ -280,9 +330,11 @@ def note_silent(db: DB, now: float, panes: dict[str, bool]) -> list[str]:
         tail = "\n".join([ln for ln in screen.rstrip().splitlines() if ln.strip()][-12:])
         where = f" on branch `{ws.branch}`" if ws else ""
         look = f"Look with `brindle attach {ws.name}`, or" if ws else "Look at its pane, or"
+        why = ("Its CLI may be hung mid-turn." if a.status == "processing" else
+               "Its CLI may be stuck at startup (for example signed in without a plan "
+               "that includes it).")
         body = (f"Worker {a.id} ({a.profile}, {a.provider}){where} has shown nothing new for "
-                f"{int((now - last) // 60)} min and hasn't reported. Its CLI may be stuck at "
-                f"startup (for example signed in without a plan that includes it). {look} "
+                f"{int((now - last) // 60)} min and hasn't reported. {why} {look} "
                 "cancel it and assign the task to another profile."
                 f"\n\nIts screen:\n{tail}")
         try: