brindle 0.3.17__tar.gz → 0.3.18__tar.gz

{brindle-0.3.17 → brindle-0.3.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brindle
-Version: 0.3.17
+Version: 0.3.18
 Summary: Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges
 Project-URL: Homepage, https://pawdelta.com/brindle/
 Project-URL: Documentation, https://pawdelta.com/brindle/docs/recommended-use
@@ -94,7 +94,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.17`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.18`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -415,7 +415,7 @@ knowing them helps when you tell the supervisor how to work.
 | `complete_subagent` | supervisor | record the result of a `subagent`-profile task |
 | `set_goal` / `get_progress` / `check_milestone` | supervisor | autopilot's goal, its progress, and running the checks |
 | `record_audit_decision` | supervisor | record acceptance of an audit finding with rationale so subsequent audits respect it |
-| `need_user` | supervisor | stop autopilot and ask you a question |
+| `need_user` | supervisor | ask you a question (a decision, a denied action, a stalled external job such as a CI run no runner picks up); only the steps that depend on it wait, the rest keeps going; `answered=true` once you've replied |
 | `transfer_to_repo` | supervisor | move a scratch session's work into a repository |
 | `handover` | supervisor | hand the session to a new supervisor on another branch or worktree, with a note |
 
@@ -641,6 +641,8 @@ wins. When every candidate is out, the repo's `default_agent` runs. The reply sa
 what was picked and why, e.g. `weight medium -> developer (Codex at 93%, skipped developer-codex)`.
 An `agent_profile` you pass, or a milestone's `profile`, always wins over weight.
 
+The supervisor runs on your Claude Code model. If your organisation's Claude Code managed settings pin the model (e.g. to Sonnet), that applies to the brindle supervisor too. Supervising goes best on Opus (or Fable where available), so if your org allows it, switch in the supervisor's own session with `/model`. Worker profiles set their own model and aren't affected.
+
 Provisioning and routing also check explicit models against supported read-only
 catalogs, with the managed model, stored keys and the worker's filtered pane
 environment. A model absent from a complete authoritative catalog is rejected
@@ -1419,7 +1421,7 @@ change files under a directory without prompts.
 
 ### Which provider can do what
 
-| Provider | Supervisor (`brindle --provider …`) | Worker / reviewer |
+| Provider | Supervisor (`brindle --supervisor …`) | Worker / reviewer |
 |---|---|---|
 | `claude` (Claude Code) | yes (the default) | yes |
 | `codex` | yes | yes |
@@ -1481,7 +1483,7 @@ When running long, unattended autopilot sessions with API keys:
   - **Codex (unsupported runtime auth detection)**: Codex CLI turn completion (`agent-turn-complete`) does not classify auth errors at runtime. If an OpenAI API key expires or is rejected, Codex workers will not automatically transition to `failed` or trigger an autopilot credential pause. When running Codex workers unattended, monitor their progress via `brindle watch` or check tmux panes; if an auth failure occurs, manually restart or rotate keys.
 - **Supervisor credential refresh and key rotation**:
   - **Recovering failed/blocked workers**: When an agent fails on an expired key or autopilot pauses with a credential error, export the fresh key (or update `brindle keys set`), then run `brindle continue`. This unpauses the session and relaunches paused/failed agents with the new credentials. The replacement credentials are automatically synced to the session credential store, dynamically refreshed by the supervisor's launcher on all subsequent worker delegations (`assign`/`handoff`).
-  - **Proactive rotation in live sessions**: Exporting a new key while an active session is healthy does not restart running workers or the supervisor (running `brindle continue` on an active healthy session simply reattaches to tmux without restarting workers). To proactively rotate credentials for the entire session and all running workers: run `brindle stop` -> update credentials in your environment or via `brindle keys set` -> run `brindle continue`.
+  - **Proactive rotation in live sessions**: For Claude keys rotated outside brindle, set Claude Code's `apiKeyHelper` in `~/.claude/settings.json` or the project's `.claude/settings.json`. Claude Code re-runs the helper every 5 minutes (configurable with `CLAUDE_CODE_API_KEY_HELPER_TTL_MS`) and after a 401, so running workers pick up the new key. Don't also export `ANTHROPIC_API_KEY` or set a Claude key with `brindle keys set`, since an environment key takes precedence over the helper. Codex and Antigravity keys still need workers stopped, then `brindle keys set`, then `brindle continue`. Exporting a new key while an active session is healthy does not restart running workers or the supervisor (running `brindle continue` on an active healthy session simply reattaches to tmux without restarting workers). To proactively rotate credentials for the entire session and all running workers: run `brindle stop` -> update credentials in your environment or via `brindle keys set` -> run `brindle continue`.
   - **Precedence**: Newly stored keys (`brindle keys set`) or session credentials updated during recovery take effect dynamically for all new panes, overriding stale launcher environments. For profile-level overrides, an explicit profile key (`env.NAME`) takes precedence over default provider credentials.
 - **Antigravity permissions prerequisite**: Antigravity (`agy`) does not support approving shell commands solely via external hooks. With `GEMINI_API_KEY`, unattended agy workers will still stall on approval prompts unless permissions are pre-populated in `settings.json` (see Permissions) or run with `agy_approvals: "brindle"` under `permission_policy: "on"` (`--dangerously-skip-permissions`).
 
@@ -1966,7 +1968,8 @@ you to sign in. `agy` takes no other key or token from the environment; its
 Google Cloud, Workforce Identity and Application Default Credentials sign-ins are
 chosen on its sign-in screen.
 
-Then run the whole session on it with `brindle --provider antigravity`, or mix models:
+Then run the supervisor on it with `brindle --supervisor antigravity`.
+Workers keep their own profiles' providers. To mix models,
 give a profile `provider: antigravity` (for example a `gemini-reviewer` for a second
 model's review) and the supervisor can hand it tasks.
 

{brindle-0.3.17 → brindle-0.3.18}/README.md

@@ -63,7 +63,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.17`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.18`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -384,7 +384,7 @@ knowing them helps when you tell the supervisor how to work.
 | `complete_subagent` | supervisor | record the result of a `subagent`-profile task |
 | `set_goal` / `get_progress` / `check_milestone` | supervisor | autopilot's goal, its progress, and running the checks |
 | `record_audit_decision` | supervisor | record acceptance of an audit finding with rationale so subsequent audits respect it |
-| `need_user` | supervisor | stop autopilot and ask you a question |
+| `need_user` | supervisor | ask you a question (a decision, a denied action, a stalled external job such as a CI run no runner picks up); only the steps that depend on it wait, the rest keeps going; `answered=true` once you've replied |
 | `transfer_to_repo` | supervisor | move a scratch session's work into a repository |
 | `handover` | supervisor | hand the session to a new supervisor on another branch or worktree, with a note |
 
@@ -610,6 +610,8 @@ wins. When every candidate is out, the repo's `default_agent` runs. The reply sa
 what was picked and why, e.g. `weight medium -> developer (Codex at 93%, skipped developer-codex)`.
 An `agent_profile` you pass, or a milestone's `profile`, always wins over weight.
 
+The supervisor runs on your Claude Code model. If your organisation's Claude Code managed settings pin the model (e.g. to Sonnet), that applies to the brindle supervisor too. Supervising goes best on Opus (or Fable where available), so if your org allows it, switch in the supervisor's own session with `/model`. Worker profiles set their own model and aren't affected.
+
 Provisioning and routing also check explicit models against supported read-only
 catalogs, with the managed model, stored keys and the worker's filtered pane
 environment. A model absent from a complete authoritative catalog is rejected
@@ -1388,7 +1390,7 @@ change files under a directory without prompts.
 
 ### Which provider can do what
 
-| Provider | Supervisor (`brindle --provider …`) | Worker / reviewer |
+| Provider | Supervisor (`brindle --supervisor …`) | Worker / reviewer |
 |---|---|---|
 | `claude` (Claude Code) | yes (the default) | yes |
 | `codex` | yes | yes |
@@ -1450,7 +1452,7 @@ When running long, unattended autopilot sessions with API keys:
   - **Codex (unsupported runtime auth detection)**: Codex CLI turn completion (`agent-turn-complete`) does not classify auth errors at runtime. If an OpenAI API key expires or is rejected, Codex workers will not automatically transition to `failed` or trigger an autopilot credential pause. When running Codex workers unattended, monitor their progress via `brindle watch` or check tmux panes; if an auth failure occurs, manually restart or rotate keys.
 - **Supervisor credential refresh and key rotation**:
   - **Recovering failed/blocked workers**: When an agent fails on an expired key or autopilot pauses with a credential error, export the fresh key (or update `brindle keys set`), then run `brindle continue`. This unpauses the session and relaunches paused/failed agents with the new credentials. The replacement credentials are automatically synced to the session credential store, dynamically refreshed by the supervisor's launcher on all subsequent worker delegations (`assign`/`handoff`).
-  - **Proactive rotation in live sessions**: Exporting a new key while an active session is healthy does not restart running workers or the supervisor (running `brindle continue` on an active healthy session simply reattaches to tmux without restarting workers). To proactively rotate credentials for the entire session and all running workers: run `brindle stop` -> update credentials in your environment or via `brindle keys set` -> run `brindle continue`.
+  - **Proactive rotation in live sessions**: For Claude keys rotated outside brindle, set Claude Code's `apiKeyHelper` in `~/.claude/settings.json` or the project's `.claude/settings.json`. Claude Code re-runs the helper every 5 minutes (configurable with `CLAUDE_CODE_API_KEY_HELPER_TTL_MS`) and after a 401, so running workers pick up the new key. Don't also export `ANTHROPIC_API_KEY` or set a Claude key with `brindle keys set`, since an environment key takes precedence over the helper. Codex and Antigravity keys still need workers stopped, then `brindle keys set`, then `brindle continue`. Exporting a new key while an active session is healthy does not restart running workers or the supervisor (running `brindle continue` on an active healthy session simply reattaches to tmux without restarting workers). To proactively rotate credentials for the entire session and all running workers: run `brindle stop` -> update credentials in your environment or via `brindle keys set` -> run `brindle continue`.
   - **Precedence**: Newly stored keys (`brindle keys set`) or session credentials updated during recovery take effect dynamically for all new panes, overriding stale launcher environments. For profile-level overrides, an explicit profile key (`env.NAME`) takes precedence over default provider credentials.
 - **Antigravity permissions prerequisite**: Antigravity (`agy`) does not support approving shell commands solely via external hooks. With `GEMINI_API_KEY`, unattended agy workers will still stall on approval prompts unless permissions are pre-populated in `settings.json` (see Permissions) or run with `agy_approvals: "brindle"` under `permission_policy: "on"` (`--dangerously-skip-permissions`).
 
@@ -1935,7 +1937,8 @@ you to sign in. `agy` takes no other key or token from the environment; its
 Google Cloud, Workforce Identity and Application Default Credentials sign-ins are
 chosen on its sign-in screen.
 
-Then run the whole session on it with `brindle --provider antigravity`, or mix models:
+Then run the supervisor on it with `brindle --supervisor antigravity`.
+Workers keep their own profiles' providers. To mix models,
 give a profile `provider: antigravity` (for example a `gemini-reviewer` for a second
 model's review) and the supervisor can hand it tasks.
 

{brindle-0.3.17 → brindle-0.3.18}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brindle"
-version = "0.3.17"
+version = "0.3.18"
 description = "Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges"
 readme = "README.md"
 requires-python = ">=3.11"

{brindle-0.3.17 → brindle-0.3.18}/src/brindle/agents.py

@@ -300,9 +300,11 @@ def decorate_worker_prompt(task: str, agent_id: str, ws: Workspace, done_when: s
         prompt += PLAN_FIRST_NOTE
     prompt += WORKER_FOOTER.format(agent_id=agent_id, branch=ws.branch,
                                    guidance=worker_guidance(ws))
-    if done_when and provider.name == "claude" and not headless:
-        # /goal is an interactive command; headless workers get the finish
-        # line above and the Stop hook's reminder to report.
+    if (done_when and provider.name == "claude" and not headless
+            and not provider.hooks_disabled(ws.path)):
+        # /goal is an interactive command that Claude Code refuses when hooks
+        # are disabled (#133), and headless workers get the finish line above
+        # and the Stop hook's reminder to report either way.
         prompt = pilot.worker_goal(prompt, done_when, ws.branch) or prompt
     return prompt
 
@@ -2812,6 +2814,11 @@ def handle_hook(db: DB, agent_id: str, event: str, payload: dict) -> dict | None
         db.set_status(agent_id, "processing", only_if="waiting")
         db.set_status(agent_id, "processing", only_if="idle")  # see "pre-tool"
         note_permission_outcome(db, agent, payload)
+        from brindle import launch_health
+        try:
+            launch_health.check_mcp(db, agent)
+        except Exception:  # noqa: BLE001
+            log.exception("brindle: couldn't check the brindle MCP server's start")
     elif event == "stop":
         from brindle import inbox, tasks
 
@@ -3114,6 +3121,47 @@ def reopen_reviewer(db: DB, agent: Agent, ws: Workspace,
     return True
 
 
+def review_moot(db: DB, agent: Agent) -> bool:
+    """A reviewer whose branch already merged at its current commit: there is
+    nothing left for it to review or report. A reviewer of commits made after
+    the merge is not moot."""
+    if agent.mode != "review":
+        return False
+    ws = db.get_workspace(agent.workspace_id)
+    if ws is None:
+        return False
+    from brindle import pipeline
+
+    return (pipeline._settled(db, ws) or "").startswith(pipeline.ALREADY_MERGED)
+
+
+def liveness(db: DB, a: Agent, ws: Workspace | None, panes: dict[str, bool] | None = None) -> str:
+    """What brindle can see of an agent for free, as one line for its
+    supervisor: whether it's running, when it last did anything, and what
+    its branch holds, so deciding what to do about it takes no digging.
+    Never raises: a fact it can't read is left out."""
+    parts = []
+    try:
+        parts.append("running" if is_alive(a, panes) else "not running")
+        path = transcript_file(a)
+        last = (os.stat(path).st_mtime if path else
+                tmux.window_activity(a.tmux_window, server=server_of(a)) if a.tmux_window else None)
+        if last:
+            parts[-1] += f", last active {int((time.time() - last) // 60)} min ago"
+        if ws is not None and os.path.isdir(ws.path):
+            base = git.base_ref(ws.path, ws.base_branch or git.default_branch(ws.repo_root))
+            ahead = git.ahead_behind(ws.path, base)[1]
+            stat = git.out(["diff", "--stat", git.merge_base(ws.path, base)], ws.path).splitlines()
+            files = ", ".join(ln.split("|")[0].strip() for ln in stat[:-1][:5])
+            more = f" and {len(stat) - 6} more" if len(stat) > 6 else ""
+            parts.append(f"{ahead} commit(s) ahead of {base}"
+                         + (f" ({files}{more}: {stat[-1].strip()})" if stat else ""))
+            parts.append(f"{len(git.dirty_files(ws.path))} uncommitted file(s)")
+    except Exception:  # noqa: BLE001
+        pass
+    return "; ".join(parts)
+
+
 def tell_parent_unreported(db: DB, agent: Agent) -> bool:
     """A worker stopped again after being reminded to report, still without a
     result. It won't be reminded again on its own, and its supervisor has
@@ -3126,6 +3174,9 @@ def tell_parent_unreported(db: DB, agent: Agent) -> bool:
         _note_reviewer_end(db, agent)
         return False
     ws = db.get_workspace(agent.workspace_id)
+    if review_moot(db, agent):
+        close_later(agent.id)
+        return False
     if agent.mode == "review" and ws is not None and os.path.isdir(ws.path):
         from brindle import gates
 
@@ -3154,9 +3205,10 @@ def tell_parent_unreported(db: DB, agent: Agent) -> bool:
             if agent.pipeline == "fixing" and agent.result is not None
             else f"stopped without calling {tool}")
     body = (
-        f"{who} {agent.id}{where} {what}, and won't be reminded "
-        f"again on its own. Check on it: workspace_diff to see what it did, send_message to "
-        f"ask it to finish or report, or remove_workspace if the work is abandoned."
+        f"{who} {agent.id}{where} {what}, and won't be reminded again on its own. "
+        f"What brindle sees: {liveness(db, agent, ws)}. Decide from that: send_message to "
+        f"ask it to finish or report, workspace_diff for the full change, or remove_workspace "
+        f"if the work is abandoned."
     )
     try:
         send_message(db, agent.parent_id, body)

{brindle-0.3.17 → brindle-0.3.18}/src/brindle/autopilot.py

@@ -107,8 +107,11 @@ to be asked each step.
   approves. Treat any gaps it finds as unfinished work, and tighten (with
   `set_goal`) the check that let each gap through.
 - Keep going until every milestone passes. If you stop early, brindle will ask
-  you to continue. Stop only when you are blocked on something only the user
-  can decide: call `need_user` with the question, then ask it.
+  you to continue. A denied action, a stalled external job (a CI run no runner
+  picks up) or a question only the user can answer blocks only the steps that
+  depend on it: call `need_user` with the question, ask it, keep working the
+  rest, and report the blocked item with it. Stop only when nothing else is
+  left; once the user answers, call `need_user(answered=true)`.
 - When a milestone passes, tell the user in one line.
 - If a message says autopilot is off, stop driving: wait for the user's
   instructions.
@@ -632,7 +635,7 @@ def set_enabled(db: DB, root_id: str, on: bool) -> None:
     fields: dict[str, object] = {"enabled": int(on), "nudges": 0}
     ap = db.get_autopilot(root_id)
     if on and ap and ap.state in ("blocked", "stalled"):
-        fields.update(state="running", note=None)
+        fields.update(state="running", note=None, question=None)
     db.update_autopilot(root_id, **fields)
 
 
@@ -1043,16 +1046,40 @@ def resolve_profile(db: DB, caller_id: str, repo_root: str, requested: str | Non
     return choose_profile(db, caller_id, repo_root, requested, task, files)[0]
 
 
-def need_user(db: DB, root_id: str, question: str) -> None:
-    db.update_autopilot(root_id, state="blocked", note=question.strip()[:500], nudges=0)
+def need_user(db: DB, root_id: str, question: str, ask: bool = False) -> None:
+    """Block autopilot on ``question``. brindle's own blocks (credentials,
+    budget) stop the whole session until the user replies; a supervisor's
+    question (``ask``) holds only the work that depends on it, until the
+    supervisor says it's answered."""
+    note = question.strip()[:500]
+    fields: dict[str, object] = {"state": "blocked", "note": note, "nudges": 0,
+                                 "question": note if ask else None}
+    if ask:
+        ap = db.get_autopilot(root_id)
+        fields["nudged_at"] = ap.progress if ap else None
+    db.update_autopilot(root_id, **fields)
+
+
+def held(ap: Autopilot) -> bool:
+    """Autopilot waits on the supervisor's open question, and nothing has
+    blocked it since (that would have replaced the note)."""
+    return ap.state == "blocked" and bool(ap.question) and ap.question == ap.note
+
+
+def answered(db: DB, root_id: str) -> None:
+    db.update_autopilot(root_id, state="running", note=None, question=None, nudges=0)
 
 
 def user_spoke(db: DB, agent: Agent) -> None:
     """The user typed into the supervisor's chat: whatever blocked autopilot
-    is theirs to have answered, so it may drive again."""
+    is theirs to have answered, so it may drive again. An open question stays
+    open (the message may be about something else), but the supervisor gets
+    one more reminder of it."""
     ap = db.get_autopilot(agent.id)
-    if ap and ap.state in ("blocked", "stalled"):
-        db.update_autopilot(agent.id, state="running", note=None, nudges=0)
+    if ap and held(ap):
+        db.update_autopilot(agent.id, nudges=0, nudged_at=None)
+    elif ap and ap.state in ("blocked", "stalled"):
+        db.update_autopilot(agent.id, state="running", note=None, question=None, nudges=0)
     elif ap:
         db.update_autopilot(agent.id, nudges=0)
 
@@ -1476,7 +1503,7 @@ def record_audit(db: DB, root_id: str, approved: bool, summary: str) -> str:
 
 # -- progress -----------------------------------------------------------------
 
-MARK = {"passed": "✓", "failed": "✗", "pending": "○"}
+MARK = {"passed": "✓", "failed": "✗", "pending": "○", "working": "◐", "waiting": "◌"}
 
 
 def counts(db: DB, root_id: str) -> tuple[int, int]:
@@ -1484,6 +1511,27 @@ def counts(db: DB, root_id: str) -> tuple[int, int]:
     return sum(m.status == "passed" for m in ms), len(ms)
 
 
+def work_state(db: DB, root_id: str) -> str | None:
+    """Display-only: "working" or "waiting" while the session has work in
+    flight, else None. A failed milestone's last check is stale then, so it
+    shouldn't read as a plain failure. Never stored on the milestone.
+
+    shortcut: work isn't tied to a milestone, so any in-flight work marks every
+    failed milestone; upgrade if tasks get a milestone link."""
+    from brindle import login_pause
+
+    ap = db.get_autopilot(root_id)
+    if (ap is not None and ap.state == "usage_paused") or login_pause.paused(db, root_id):
+        return "waiting"
+    live = active_workers(db, root_id)
+    if any(a.status != "waiting" for a in live):
+        return "working"
+    if live or any(root_of(db, t.caller_id) == root_id
+                   for t in db.list_tasks(state="pending") if t.caller_id):
+        return "waiting"
+    return None
+
+
 def progress(db: DB, root_id: str) -> str:
     ap = db.get_autopilot(root_id)
     if ap is None:
@@ -1494,12 +1542,16 @@ def progress(db: DB, root_id: str) -> str:
                 "user's request (ask what we're building only if there is no request).")
     done, total = counts(db, root_id)
     lines = [f"{head}. Goal: {ap.goal}", f"{done} of {total} milestones verified."]
-    for m in db.milestones(root_id):
+    ms = db.milestones(root_id)
+    w = work_state(db, root_id) if any(m.status == "failed" for m in ms) else None
+    for m in ms:
         where = f"@{m.repo}: " if m.repo else ""
         how = f"check: `{where}{m.check_cmd}`" if m.check_cmd else "NO CHECK: propose one with set_goal"
         when = f", last checked {time.strftime('%H:%M', time.localtime(m.checked_at))}" if m.checked_at else ""
         who = f", profile: {m.profile}" if m.profile else ""
-        lines.append(f"  {MARK.get(m.status, '·')} {m.position}. {m.title} ({how}{who}{when})")
+        shown = w if m.status == "failed" and w else m.status
+        stale = ", last check failed" if shown != m.status else ""
+        lines.append(f"  {MARK.get(shown, '·')} {m.position}. {m.title} ({how}{who}{when}{stale})")
     if ap.state in ("blocked", "stalled") and ap.note:
         lines.append(f"{ap.state.capitalize()}: {ap.note}")
     elif ap.state == "auditing":
@@ -1526,7 +1578,8 @@ def active_workers(db: DB, root_id: str, *, reviewers: bool = True) -> list[Agen
     return [a for a in agents.tree(db, root_id)[1:]
             if a.mode in agents.REPORTING_MODES and (reviewers or a.mode != "review")
             and (a.result is None or a.status in BUSY or a.pipeline)
-            and a.status not in ("paused", "done") and agents.is_alive(a)]
+            and a.status not in ("paused", "done") and agents.is_alive(a)
+            and not agents.review_moot(db, a)]
 
 
 def split_workers(db: DB, root_id: str, *, screen: bool = False) -> tuple[list[Agent], list[Agent]]:
@@ -1743,6 +1796,9 @@ def on_stop(db: DB, agent: Agent, payload: dict) -> dict | None:
                 return None
         else:
             return None
+    elif held(ap):
+        if ap.nudged_at == ap.progress:
+            return None  # reminded of the open question since the last step or user message
     elif ap.state != "running":
         return None
 
@@ -1763,6 +1819,10 @@ def on_stop(db: DB, agent: Agent, payload: dict) -> dict | None:
     if any(agents.runs_process(a) for a in working
             if getattr(a, "plan_state", None) != "proposed"):
         return None  # their results arrive as messages and wake it up
+    if held(ap):
+        # One reminder per step: never counts toward stalling.
+        db.update_autopilot(agent.id, nudges=0, nudged_at=ap.progress)
+        return {"decision": "block", "reason": nudge(db, ap, cfg, working, stalled)}
     nudges = ap.nudges if ap.nudged_at == ap.progress else 0
     if nudges >= MAX_NUDGES:
         db.update_autopilot(agent.id, state="stalled", nudges=0,
@@ -1789,18 +1849,23 @@ def nudge(db: DB, ap: Autopilot, cfg: RepoConfig,
                     "approved=false to ask for changes; the worker is waiting on you.\n\n")
     stuck = ""
     if stalled:
-        names = ", ".join(a.id for a in stalled)
+        seen = "\n".join(f"- {a.id}: {agents.liveness(db, a, db.get_workspace(a.workspace_id))}"
+                         for a in stalled)
         stuck = (
-            f"{names} went idle without ever calling report_result and won't be reminded "
-            "again on their own. Check on them: workspace_diff to see what they did, "
-            "send_message asking them to report or finish, or remove_workspace if the work "
-            "is abandoned.\n\n"
+            "These went idle without ever calling report_result and won't be reminded "
+            f"again on their own. What brindle sees of each:\n{seen}\nDecide from that: "
+            "send_message asking them to report or finish, workspace_diff for the full change, "
+            "or remove_workspace if the work is abandoned.\n\n"
         )
     ms = db.milestones(ap.root_id)
     if ms and all(m.status == "passed" for m in ms):
         pending += ("Every milestone's check passes, but the completion audit hasn't approved "
                     "the current commit. Close any gaps it found, commit, and call "
                     "check_milestone: that starts a fresh audit.\n\n")
+    if held(ap):
+        pending += (f"Waiting on the user for: {ap.question}. Work only on what doesn't depend "
+                    "on it; if nothing is left, stop. When they've answered, call "
+                    "need_user(answered=true).\n\n")
     return (
         "[brindle autopilot] The goal isn't reached yet, and no workers are running.\n"
         f"{progress(db, ap.root_id)}\n\n{pending}{stuck}"

{brindle-0.3.17 → brindle-0.3.18}/src/brindle/cli.py

@@ -9,7 +9,7 @@ import subprocess
 import sys
 import time
 from pathlib import Path
-from typing import Optional
+from typing import Annotated, Optional
 
 import typer
 
@@ -187,14 +187,18 @@ def new(
     pr: Optional[int] = typer.Option(None, "--pr", help="Check out this GitHub PR's head branch (via `gh`), based on the PR's base branch. Don't also pass BRANCH or --base; the head branch is always fetched."),
     no_agent: bool = typer.Option(False, "--no-agent", help="Only create the worktree; start no supervisor."),
     prompt: Optional[str] = typer.Option(None, "--prompt", "-p", help="First message for the supervisor."),
-    provider: Optional[str] = typer.Option(None, help="Run the supervisor on this CLI instead of Claude Code (codex, antigravity)."),
+    provider: Optional[str] = typer.Option(
+        None, "--supervisor", "-s", help="Run the supervisor on this CLI instead of Claude Code (codex, antigravity). Workers keep their own profiles' providers.",
+    ),
     no_fetch: bool = typer.Option(False, "--no-fetch", help="Don't fetch the base branch first."),
     no_setup: bool = typer.Option(False, "--no-setup", help="Skip setup commands."),
     attach: bool = typer.Option(False, "--attach", help="Attach to the tmux session afterward."),
+    provider_alias: Annotated[Optional[str], typer.Option("--provider", hidden=True)] = None,
 ) -> None:
     """Create a worktree on a new branch and start a supervisor in it."""
     from brindle.providers import NOT_SUPERVISOR, SUPERVISOR_PROVIDERS
 
+    provider = provider or provider_alias
     if provider and provider in NOT_SUPERVISOR:
         _fail(f"the {provider} provider can't run the supervisor; use one of: "
               f"{', '.join(SUPERVISOR_PROVIDERS)}")
@@ -246,12 +250,15 @@ def new(
 @app.command()
 def start(
     prompt: Optional[str] = typer.Option(None, "--prompt", "-p"),
-    provider: Optional[str] = typer.Option(None),
+    provider: Optional[str] = typer.Option(
+        None, "--supervisor", "-s", help="Run the supervisor on this CLI instead of Claude Code (codex, antigravity). Workers keep their own profiles' providers.",
+    ),
     attach: bool = typer.Option(True, "--attach/--no-attach"),
     watch: bool = typer.Option(True, "--watch/--no-watch", help="Show the brindle watch dashboard in a pane under the agent."),
     autopilot: Optional[bool] = typer.Option(None, "--autopilot/--no-autopilot", help="The supervisor drives toward a goal until it's verified (default: on, or `autopilot` in .brindle/config.json)."),
     branch: Optional[str] = typer.Option(None, "--branch", "-b", help="Run in the worktree for this branch, creating the branch and worktree if needed."),
     worktree: Optional[str] = typer.Option(None, "--worktree", "-w", help="Run in the worktree at this path (created with --branch if it doesn't exist)."),
+    provider_alias: Annotated[Optional[str], typer.Option("--provider", hidden=True)] = None,
 ) -> None:
     """Start a fresh supervisor chat here, with the dashboard alongside. A launch only ever starts a supervisor; it starts the other agents itself.
 
@@ -263,6 +270,7 @@ def start(
     from brindle.config import load_repo_config
     from brindle import scratch
 
+    provider = provider or provider_alias
     db = DB()
     if branch or worktree:
         ws = _run(workspaces.checkout_for, db, os.getcwd(), branch=branch, worktree=worktree)
@@ -290,6 +298,14 @@ def start(
                     typer.secho(f"✓ Switched to '{default_b}'.", fg="green")
             except Exception:
                 pass
+        elif curr_b and git.upstream_gone(ws.path, curr_b):
+            typer.secho(f"! Branch '{curr_b}' was deleted on origin but has unmerged changes.", fg="yellow")
+        try:
+            if curr_b and git.current_branch(ws.path) == git.default_branch(ws.repo_root):
+                if warning := git.fast_forward(ws.path, git.current_branch(ws.path)):
+                    typer.secho(f"! {warning}", fg="yellow")
+        except git.GitError:
+            pass
 
     from brindle.providers import NOT_SUPERVISOR, SUPERVISOR_PROVIDERS
 
@@ -741,10 +757,14 @@ def default(
     ctx: typer.Context,
     cont: bool = typer.Option(False, "--continue", "-c", help="Pick up the most recent paused session instead of starting fresh."),
     autopilot: Optional[bool] = typer.Option(None, "--autopilot/--no-autopilot", help="Start with autopilot on or off (default: on, or `autopilot` in .brindle/config.json)."),
-    provider: Optional[str] = typer.Option(None, "--provider", help="Run the supervisor on this CLI instead of Claude Code (codex, antigravity)."),
+    provider: Optional[str] = typer.Option(
+        None, "--supervisor", "-s", help="Run the supervisor on this CLI instead of Claude Code (codex, antigravity). Workers keep their own profiles' providers.",
+    ),
     show_version: bool = typer.Option(False, "--version", help="Print brindle's version and exit."),
+    provider_alias: Annotated[Optional[str], typer.Option("--provider", hidden=True)] = None,
 ) -> None:
     """Bare `brindle`: a fresh supervisor chat here (a scratch session outside git)."""
+    provider = provider or provider_alias
     if show_version:
         from brindle import __version__
 
@@ -768,14 +788,18 @@ def default(
 @app.command()
 def supervisor(
     prompt: Optional[str] = typer.Option(None, "--prompt", "-p"),
-    provider: Optional[str] = typer.Option(None),
+    provider: Optional[str] = typer.Option(
+        None, "--supervisor", "-s", help="Run the supervisor on this CLI instead of Claude Code (codex, antigravity). Workers keep their own profiles' providers.",
+    ),
     attach: bool = typer.Option(True, "--attach/--no-attach"),
     watch: bool = typer.Option(True, "--watch/--no-watch", help="Show the brindle watch dashboard in a pane under the agent."),
     autopilot: Optional[bool] = typer.Option(None, "--autopilot/--no-autopilot", help="The supervisor drives toward a goal until it's verified (default: on, or `autopilot` in .brindle/config.json)."),
     branch: Optional[str] = typer.Option(None, "--branch", "-b", help="Run in the worktree for this branch, creating the branch and worktree if needed."),
     worktree: Optional[str] = typer.Option(None, "--worktree", "-w", help="Run in the worktree at this path (created with --branch if it doesn't exist)."),
+    provider_alias: Annotated[Optional[str], typer.Option("--provider", hidden=True)] = None,
 ) -> None:
     """Start an explicit supervisor session to coordinate coding agents."""
+    provider = provider or provider_alias
     start(prompt=prompt, provider=provider, attach=attach, watch=watch,
           autopilot=autopilot, branch=branch, worktree=worktree)
 

{brindle-0.3.17 → brindle-0.3.18}/src/brindle/company_identity.py

@@ -278,10 +278,13 @@ class Identity:
     billed: str | None = None       # who pays for this agent's use, when known
 
 
-def _unknown(provider: str, tool: str, why: str = "") -> Identity:
+def _unknown(provider: str, tool: str, why: str = "", exe: str = "") -> Identity:
     install = company_login.INSTALL.get(tool)
     if why:
         return Identity(provider, f"{tool}: {why}", determined=False)
+    if company_login.which(exe or tool):
+        return Identity(provider, f"{tool} is installed but its sign-in check couldn't run, "
+                        "so the identity can't be checked", determined=False)
     return Identity(provider, f"{tool} isn't installed, so the identity can't be checked"
                     + (f" (install: {install})" if install else ""), determined=False)
 
@@ -306,9 +309,12 @@ def claude_identity(org_id: str, claude, cache: bool = True) -> Identity:
 
 
 def _claude_login(claude, route, cache) -> Identity:
-    got = _probe(["claude", "auth", "status"], cache)
+    from brindle import providers
+
+    exe = providers.claude_binary()
+    got = _probe([exe, "auth", "status"], cache)
     if got is None:
-        return _unknown("claude", "claude")
+        return _unknown("claude", "claude", exe=exe)
     status = _json(got[1])
     if status is None:
         return Identity("claude", "claude: status unreadable", determined=False)

{brindle-0.3.17 → brindle-0.3.18}/src/brindle/company_login.py

@@ -484,7 +484,19 @@ def claude_model(model: str | None, repo_root: str | None = None) -> str | None:
     if got is None or got is UNAVAILABLE:
         return model
     c = got[1].claude
-    if c is None or not c.model_ids or model in c.model_ids or not route_in_use(got[0], got[1]):
+    if c is None or not route_in_use(got[0], got[1]):
+        return model
+    return route_model(c, model)
+
+
+def route_model(c, model: str | None) -> str | None:
+    """The model a Claude pane runs on route ``c`` (a ``ClaudeSetup``) for a
+    profile's ``model``: the profile's own when the route serves it, or when
+    it is an alias (opus, sonnet, haiku) the route pins in ``models`` (the
+    pane's ANTHROPIC_DEFAULT_*_MODEL maps it); else the route's default."""
+    if not c.model_ids or model in c.model_ids:
+        return model
+    if model in ("opus", "sonnet", "haiku") and c.models is not None and getattr(c.models, model):
         return model
     return c.default_model or c.model_ids[0]