@doist/doistbot-cli 1.0.7 → 1.0.9

package/dist/actions/auth.js

@@ -1,5 +1,5 @@
 import chalk from 'chalk';
-import { deleteGeminiApiKey, deleteOpenRouterApiKey, getAuthStatus, loginOpenAICodex, logoutOpenAICodex, saveGeminiApiKey, saveOpenRouterApiKey, } from '../auth.js';
+import { createPiAuthRuntime, deleteGeminiApiKey, deleteOpenRouterApiKey, getAuthStatus, loginOpenAICodex, logoutOpenAICodex, saveGeminiApiKey, saveOpenRouterApiKey, } from '../auth.js';
 import { getEnvApiKeys } from '../env.js';
 import { FILE_STORE_PATH } from '../file-store.js';
 import { promptHiddenInput, promptMultiSelect } from '../input.js';
@@ -58,6 +58,7 @@ function formatSkipInstruction() {
 }
 export async function runAuthSetup(dependencies = {}) {
     const deps = {
+        createPiAuthRuntime,
         getAuthStatus,
         isInteractive: process.stdin.isTTY === true,
         loginOpenAICodex,
@@ -67,17 +68,21 @@ export async function runAuthSetup(dependencies = {}) {
         writeLine,
         ...dependencies,
     };
-    const status = await deps.getAuthStatus();
+    const runtime = await deps.createPiAuthRuntime();
+    const status = await deps.getAuthStatus({ runtime });
     deps.writeLine('1. OpenAI Codex');
     deps.writeLine();
-    if (status.openai.configured) {
+    if (status.openai.configured && !status.openai.refreshFailed) {
         deps.writeLine('✓ OpenAI already configured (pi-auth).');
     }
     else {
         if (!deps.isInteractive) {
             throw new Error('Cannot configure OpenAI Codex auth in non-interactive mode.');
         }
-        await deps.loginOpenAICodex();
+        if (status.openai.refreshFailed) {
+            deps.writeLine('OpenAI session could not be refreshed (expired, revoked, or offline). Reconnecting.');
+        }
+        await deps.loginOpenAICodex(runtime);
         deps.writeLine();
         deps.writeLine('✓ OpenAI configured.');
     }
@@ -149,10 +154,19 @@ export async function runAuthSetup(dependencies = {}) {
 }
 export async function runAuthStatus() {
     const status = await getAuthStatus();
-    writeLine(`OpenAI: ${status.openai.configured ? `configured (${status.openai.source ?? 'unknown'})` : 'not configured'}`);
+    writeLine(`OpenAI: ${formatOpenAIStatus(status.openai)}`);
     writeLine(`Gemini ${formatOptionalLabel()}: ${status.gemini.configured ? `configured (${status.gemini.source ?? 'unknown'})` : 'not configured'}`);
     writeLine(`OpenRouter ${formatOptionalLabel()}: ${status.openrouter.configured ? `configured (${status.openrouter.source ?? 'unknown'})` : 'not configured'}`);
 }
+function formatOpenAIStatus(status) {
+    if (!status.configured) {
+        return 'not configured';
+    }
+    const base = `configured (${status.source ?? 'unknown'})`;
+    return status.refreshFailed
+        ? `${base} — session could not be refreshed; check your connection or run \`doistbot auth login\``
+        : base;
+}
 export async function runAuthLogout(target, dependencies = {}) {
     const deps = {
         deleteGeminiApiKey,

package/dist/actions/doctor.js

@@ -4,7 +4,9 @@ import { checkGit, checkPiDependency, checkRepository, checkSandboxBuild } from
 import { renderDiagnosticCheck } from '../terminal.js';
 export function getConfiguredProviders({ status, }) {
     return [
-        status.openai.configured ? `OpenAI (${status.openai.source ?? 'configured'})` : undefined,
+        status.openai.configured && !status.openai.refreshFailed
+            ? `OpenAI (${status.openai.source ?? 'configured'})`
+            : undefined,
         status.gemini.configured
             ? `Gemini optional (${status.gemini.source ?? 'configured'})`
             : undefined,

package/dist/actions/review.js

@@ -21,10 +21,14 @@ function getReadableProviderFailure(failure) {
     if (failure.model === 'openai' &&
         (normalized.includes('no api key found for openai') ||
             normalized.includes('no api key found for openai-codex') ||
+            normalized.includes('no api key for provider') ||
             normalized.includes('use /login') ||
             normalized.includes('invalid api key') ||
-            normalized.includes('incorrect api key'))) {
-        return 'OpenAI Codex is not authenticated. Run `doistbot auth` to reconnect OpenAI.';
+            normalized.includes('incorrect api key') ||
+            normalized.includes('refresh_token_invalidated') ||
+            normalized.includes('unauthorized') ||
+            /\b401\b/.test(normalized))) {
+        return 'OpenAI Codex is not authenticated. Run `doistbot auth login` to reconnect OpenAI.';
     }
     if (failure.model === 'gemini' &&
         (normalized.includes('429') ||
@@ -40,7 +44,8 @@ function getReadableProviderFailure(failure) {
             normalized.includes('invalid_argument') ||
             normalized.includes('invalid api key') ||
             normalized.includes('no api key found for google') ||
-            normalized.includes('no api key found for gemini'))) {
+            normalized.includes('no api key found for gemini') ||
+            normalized.includes('no api key for provider'))) {
         return 'Gemini API key is invalid or missing. Run `doistbot auth` and paste a valid Gemini key.';
     }
     const firstLine = error
@@ -205,7 +210,7 @@ function getMissingAuthProviderFailures(missingProviders) {
     if (missingProviders.includes('OpenAI')) {
         failures.push({
             model: 'openai',
-            message: 'OpenAI not configured; run `doistbot auth`',
+            message: 'OpenAI authentication unavailable; run `doistbot auth login`',
         });
     }
     return failures;

package/dist/auth.js

@@ -1,10 +1,12 @@
 import { spawn } from 'child_process';
 import { homedir } from 'os';
 import path from 'path';
+import {} from '@earendil-works/pi-ai';
 import { getEnvApiKeys } from './env.js';
 import { createFileStore } from './file-store.js';
 import { promptInput } from './input.js';
 import { createCompositeStore, createKeyringStore, SecureStoreUnavailableError, } from './secure-store.js';
+import { writeLine } from './terminal.js';
 const GEMINI_ACCOUNT_NAME = 'gemini-api-key';
 const OPENROUTER_ACCOUNT_NAME = 'openrouter-api-key';
 export function createGeminiKeyStore() {
@@ -15,9 +17,20 @@ export function createOpenRouterKeyStore() {
 }
 export const OPENAI_CODEX_PROVIDER_ID = 'openai-codex';
 export const PI_AUTH_API_KEY = `pi-auth://${OPENAI_CODEX_PROVIDER_ID}`;
-export async function createPiAuthStorage() {
-    const { AuthStorage } = await import('@earendil-works/pi-coding-agent');
-    return AuthStorage.create(path.join(homedir(), '.pi', 'agent', 'auth.json'));
+const OPENAI_CODEX_BROWSER_LOGIN_METHOD = 'browser';
+export async function createPiAuthRuntime() {
+    // Pi's own CLI installs its npm Undici implementation before initializing
+    // ModelRuntime. SDK consumers must do the same on Node 26 so compressed OAuth
+    // responses are decoded before response.json() parses them.
+    const { install } = await import('undici');
+    install();
+    const { ModelRuntime } = await import('@earendil-works/pi-coding-agent');
+    return await ModelRuntime.create({
+        authPath: path.join(homedir(), '.pi', 'agent', 'auth.json'),
+        allowModelNetwork: false,
+        modelsPath: null,
+        refreshOnCreate: false,
+    });
 }
 export function getBrowserOpenCommand(platform, url) {
     if (platform === 'darwin') {
@@ -28,22 +41,40 @@ export function getBrowserOpenCommand(platform, url) {
     }
     return { command: 'xdg-open', args: [url] };
 }
-export async function hasOpenAICodexAuth(storage) {
-    const resolvedStorage = storage ?? (await createPiAuthStorage());
-    return resolvedStorage.get(OPENAI_CODEX_PROVIDER_ID)?.type === 'oauth';
-}
-export async function loginOpenAICodex(storage) {
-    const resolvedStorage = storage ?? (await createPiAuthStorage());
-    const { loginOpenAICodex: loginInBrowser } = await import('@earendil-works/pi-ai/oauth');
-    const credentials = await loginInBrowser(createOpenAICodexBrowserLoginOptions());
-    saveOpenAICodexCredentials(resolvedStorage, credentials);
+/**
+ * Check that the stored OAuth session is usable, not just present.
+ * The Pi model runtime returns the cached access token when unexpired; when
+ * expired it attempts one cross-process-locked refresh and persists the result.
+ * Refresh failures preserve the stored credentials. Unexpected storage errors
+ * propagate.
+ */
+export async function getOpenAICodexAuthState(runtime) {
+    const resolvedRuntime = runtime ?? (await createPiAuthRuntime());
+    const credentials = await resolvedRuntime.listCredentials();
+    if (!credentials.some(({ providerId, type }) => providerId === OPENAI_CODEX_PROVIDER_ID && type === 'oauth')) {
+        return 'missing';
+    }
+    try {
+        const auth = await resolvedRuntime.getAuth(OPENAI_CODEX_PROVIDER_ID);
+        return auth?.auth.apiKey ? 'ready' : 'refresh-failed';
+    }
+    catch (error) {
+        if (typeof error === 'object' &&
+            error !== null &&
+            'code' in error &&
+            error.code === 'oauth') {
+            return 'refresh-failed';
+        }
+        throw error;
+    }
 }
-export function saveOpenAICodexCredentials(storage, credentials) {
-    storage.set(OPENAI_CODEX_PROVIDER_ID, { type: 'oauth', ...credentials });
+export async function loginOpenAICodex(runtime) {
+    const resolvedRuntime = runtime ?? (await createPiAuthRuntime());
+    await resolvedRuntime.login(OPENAI_CODEX_PROVIDER_ID, 'oauth', createOpenAICodexBrowserLoginInteraction());
 }
-export async function logoutOpenAICodex(storage) {
-    const resolvedStorage = storage ?? (await createPiAuthStorage());
-    resolvedStorage.logout(OPENAI_CODEX_PROVIDER_ID);
+export async function logoutOpenAICodex(runtime) {
+    const resolvedRuntime = runtime ?? (await createPiAuthRuntime());
+    await resolvedRuntime.logout(OPENAI_CODEX_PROVIDER_ID);
 }
 export async function readStoredGeminiApiKey(store = createGeminiKeyStore()) {
     const result = await store.getSecret();
@@ -97,7 +128,7 @@ export async function deleteOpenRouterApiKey(store = createOpenRouterKeyStore())
 export async function deleteGeminiApiKey(store = createGeminiKeyStore()) {
     return await store.deleteSecret();
 }
-export async function getAuthStatus({ env = process.env, storage, geminiStore = createGeminiKeyStore(), openRouterStore = createOpenRouterKeyStore(), } = {}) {
+export async function getAuthStatus({ env = process.env, runtime, geminiStore = createGeminiKeyStore(), openRouterStore = createOpenRouterKeyStore(), } = {}) {
     const envApiKeys = getEnvApiKeys(env);
     const geminiStored = envApiKeys.gemini
         ? { value: undefined }
@@ -105,11 +136,15 @@ export async function getAuthStatus({ env = process.env, storage, geminiStore =
     const openRouterStored = envApiKeys.openrouter
         ? { value: undefined }
         : await readStoredOpenRouterApiKey(openRouterStore).catch(() => ({ value: undefined }));
-    const openAICodexAuthConfigured = await hasOpenAICodexAuth(storage);
+    const openAICodexAuthState = await getOpenAICodexAuthState(runtime);
     return {
-        openai: openAICodexAuthConfigured
-            ? { configured: true, source: 'pi-auth' }
-            : { configured: false, source: undefined },
+        openai: openAICodexAuthState === 'missing'
+            ? { configured: false, source: undefined }
+            : {
+                configured: true,
+                source: 'pi-auth',
+                refreshFailed: openAICodexAuthState === 'refresh-failed',
+            },
         gemini: envApiKeys.gemini
             ? { configured: true, source: 'env' }
             : {
@@ -132,17 +167,31 @@ export async function getAuthStatus({ env = process.env, storage, geminiStore =
             },
     };
 }
-function createOpenAICodexBrowserLoginOptions() {
+function createOpenAICodexBrowserLoginInteraction() {
     return {
-        onAuth: (info) => {
-            openUrlInBrowser(info.url);
-            process.stdout.write('Open this URL in your browser:\n');
-            process.stdout.write(`${info.url}\n`);
-            if (info.instructions) {
-                process.stdout.write(`${info.instructions}\n`);
+        notify: (event) => {
+            if (event.type === 'auth_url') {
+                openUrlInBrowser(event.url);
+                writeLine('Open this URL in your browser:');
+                writeLine(event.url);
+                if (event.instructions) {
+                    writeLine(event.instructions);
+                }
+            }
+            else if (event.type === 'info' || event.type === 'progress') {
+                writeLine(event.message);
+            }
+        },
+        prompt: async (prompt) => {
+            if (prompt.type === 'select') {
+                const browserOption = prompt.options.find(({ id }) => id === OPENAI_CODEX_BROWSER_LOGIN_METHOD);
+                if (!browserOption) {
+                    throw new Error('OpenAI Codex did not provide a browser login option');
+                }
+                return browserOption.id;
             }
+            return await promptInput(`${prompt.message} `, prompt.signal);
         },
-        onPrompt: async (prompt) => await promptInput(`${prompt.message} `),
     };
 }
 function openUrlInBrowser(url) {

package/dist/config.js

@@ -1,15 +1,17 @@
-import { getStoredGeminiApiKey, getStoredOpenRouterApiKey, hasOpenAICodexAuth, PI_AUTH_API_KEY, } from './auth.js';
+import { getOpenAICodexAuthState, getStoredGeminiApiKey, getStoredOpenRouterApiKey, PI_AUTH_API_KEY, } from './auth.js';
 import { getEnvApiKeys } from './env.js';
 const REQUIRED_CLI_AUTH_PROVIDERS = [{ provider: 'openai', label: 'OpenAI' }];
 const ALL_REVIEW_FOCUSES = [
     'general',
+    'security',
+    'reuse',
     'quality',
     'efficiency',
     'tests',
     'standards',
 ];
 const OPENROUTER_REVIEW_MODELS = ['deepseek', 'zai'];
-const CLI_GEMINI_REVIEW_MODEL = 'gemini-3.5-flash';
+const CLI_GEMINI_REVIEW_MODEL = 'gemini-3.7-flash';
 function createCliGeminiCredential(apiKey) {
     return {
         apiKey,
@@ -29,7 +31,7 @@ function createCliGeminiSummaryModel(credential) {
 export async function getApiKeys(env = process.env, auth = {
     getStoredGeminiApiKey,
     getStoredOpenRouterApiKey,
-    hasOpenAICodexAuth,
+    getOpenAICodexAuthState,
 }) {
     const envApiKeys = getEnvApiKeys(env);
     const storedGeminiApiKey = envApiKeys.gemini
@@ -38,7 +40,7 @@ export async function getApiKeys(env = process.env, auth = {
     const storedOpenRouterApiKey = envApiKeys.openrouter
         ? undefined
         : await auth.getStoredOpenRouterApiKey().catch(() => undefined);
-    const openAICodexAuthConfigured = await auth.hasOpenAICodexAuth();
+    const openAICodexAuthState = await auth.getOpenAICodexAuthState();
     const openRouterApiKey = envApiKeys.openrouter || storedOpenRouterApiKey;
     const apiKeys = {};
     const geminiApiKey = envApiKeys.gemini || storedGeminiApiKey;
@@ -49,13 +51,16 @@ export async function getApiKeys(env = process.env, auth = {
         apiKeys.deepseek = { apiKey: openRouterApiKey, piProviderId: 'openrouter' };
         apiKeys.zai = { apiKey: openRouterApiKey, piProviderId: 'openrouter' };
     }
-    if (openAICodexAuthConfigured) {
+    if (openAICodexAuthState === 'ready') {
         apiKeys.openai = PI_AUTH_API_KEY;
     }
     return apiKeys;
 }
 export function getMissingRequiredCliAuthProviders(status) {
-    return REQUIRED_CLI_AUTH_PROVIDERS.filter(({ provider }) => !status[provider].configured).map(({ label }) => label);
+    return REQUIRED_CLI_AUTH_PROVIDERS.filter(({ provider }) => {
+        const providerStatus = status[provider];
+        return !providerStatus.configured || providerStatus.refreshFailed === true;
+    }).map(({ label }) => label);
 }
 export function getMissingRequiredCliReviewAuthProviders(apiKeys) {
     return REQUIRED_CLI_AUTH_PROVIDERS.filter(({ provider }) => {
@@ -67,7 +72,7 @@ export function getMissingRequiredCliReviewAuthProviders(apiKeys) {
     }).map(({ label }) => label);
 }
 export function formatMissingRequiredCliAuthProviders(missingProviders) {
-    return `${missingProviders.join(' and ')} not configured; run \`doistbot auth\``;
+    return `${missingProviders.join(' and ')} authentication unavailable (not configured, or the session could not be refreshed); run \`doistbot auth login\``;
 }
 export function getCliReviewRouting(apiKeys) {
     const hasGemini = Boolean(apiKeys.gemini);

package/dist/input.js

@@ -1,15 +1,15 @@
-import { createInterface } from 'node:readline';
-export function promptInput(prompt) {
-    return new Promise((resolve) => {
-        const rl = createInterface({
-            input: process.stdin,
-            output: process.stdout,
-        });
-        rl.question(prompt, (answer) => {
-            rl.close();
-            resolve(answer);
-        });
+import { createInterface } from 'node:readline/promises';
+export async function promptInput(prompt, signal) {
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stdout,
     });
+    try {
+        return await rl.question(prompt, { signal });
+    }
+    finally {
+        rl.close();
+    }
 }
 export function promptHiddenInput(prompt) {
     if (!process.stdin.isTTY) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@doist/doistbot-cli",
-    "version": "1.0.7",
+    "version": "1.0.9",
     "description": "Local self-review CLI for Doistbot",
     "type": "module",
     "main": "dist/index.js",
@@ -42,14 +42,15 @@
     "dependencies": {
         "@inquirer/checkbox": "5.2.1",
         "@inquirer/password": "5.1.1",
-        "@earendil-works/pi-ai": "0.79.6",
-        "@earendil-works/pi-coding-agent": "0.79.6",
+        "@earendil-works/pi-ai": "0.84.2",
+        "@earendil-works/pi-coding-agent": "0.84.2",
         "@napi-rs/keyring": "1.3.0",
         "ajv": "8.20.0",
         "chalk": "4.1.2",
         "commander": "14.0.3",
-        "js-yaml": "4.2.0",
+        "js-yaml": "4.3.1",
         "octokit": "5.0.5",
+        "undici": "8.9.0",
         "yocto-spinner": "1.2.0"
     },
     "devDependencies": {

package/sandbox/dist/core/pi.js

@@ -13,15 +13,15 @@ export const DEFAULT_PI_MODELS = {
     deepseek: 'deepseek-v4-pro',
     gemini: 'gemini-3.1-pro-preview',
     zai: 'glm5.2',
-    openai: 'gpt-5.4',
+    openai: 'gpt-5.6-terra',
 };
 export const DEFAULT_OPENROUTER_MODELS = {
-    deepseek: 'deepseek/deepseek-v4-pro',
+    deepseek: 'deepseek/deepseek-v4-pro-0813',
     gemini: 'google/gemini-3.1-pro-preview',
     zai: 'z-ai/glm-5.2',
 };
 // Gemini flash fallback model.
-export const DEFAULT_GEMINI_FLASH_MODEL = 'gemini-3.5-flash';
+export const DEFAULT_GEMINI_FLASH_MODEL = 'gemini-3.7-flash';
 export const MAX_PI_THINKING_BY_PROVIDER = {
     deepseek: 'high',
     gemini: 'high',
@@ -334,8 +334,14 @@ export function createPiInvoker({ provider, apiKey, piProviderId, cwd, extraEnv,
                 ...openRouterSessionExtension.args,
                 ...imageArgs,
             ];
-            const childEnv = {
+            const inheritedEnv = {
                 ...process.env,
+            };
+            // Repository-scoped credentials must be passed explicitly through
+            // extraEnv by an authorized task invocation.
+            delete inheritedEnv.GH_PACKAGES_TOKEN;
+            const childEnv = {
+                ...inheritedEnv,
                 HOME: process.env.HOME,
                 PATH: process.env.PATH,
                 GIT_TERMINAL_PROMPT: '0',

package/sandbox/dist/core/shared.js

@@ -40,16 +40,16 @@ export function optionalPositiveInt(value) {
 /**
  * Parses the base environment variables common to all sandbox tasks.
  */
-export function parseBaseContext() {
+export function parseBaseContext(env = process.env) {
     return {
-        owner: requiredEnv('REPO_OWNER'),
-        repo: requiredEnv('REPO_NAME'),
-        prNumber: requiredPositiveInt('PR_NUMBER'),
-        installationId: requiredPositiveInt('INSTALLATION_ID'),
-        appId: requiredEnv('APP_ID'),
-        privateKey: requiredEnv('PRIVATE_KEY'),
-        githubToken: process.env.GITHUB_TOKEN?.trim() || undefined,
-        deliveryId: process.env.DELIVERY_ID,
+        owner: requiredEnv('REPO_OWNER', env),
+        repo: requiredEnv('REPO_NAME', env),
+        prNumber: requiredPositiveInt('PR_NUMBER', env),
+        installationId: requiredPositiveInt('INSTALLATION_ID', env),
+        appId: requiredEnv('APP_ID', env),
+        privateKey: requiredEnv('PRIVATE_KEY', env),
+        githubToken: env.GITHUB_TOKEN?.trim() || undefined,
+        deliveryId: env.DELIVERY_ID?.trim() || undefined,
     };
 }
 export function resolveWriteOctokit({ githubToken, fallbackOctokit, }) {

package/sandbox/dist/core/span-test-helpers.js

@@ -0,0 +1,13 @@
+import { vi } from 'vitest';
+/**
+ * Shared assertion helper for the model/phase span tests, which all spy on
+ * `logger.info` and assert on the same `phase.*` envelope shape emitted by the
+ * LoggerSpanProcessor.
+ *
+ * Returns the `phase.end` envelopes for the given span name, in call order.
+ */
+export function phaseEnds(infoSpy, name) {
+    return infoSpy.mock.calls
+        .map((call) => call[1])
+        .filter((meta) => meta?.event === 'phase.end' && meta?.name === name);
+}

package/sandbox/dist/main.js

@@ -32,6 +32,9 @@ switch (taskType) {
     case 'review':
         await import('./tasks/review/review.js');
         break;
+    case 'review-slice-plan':
+        await import('./tasks/review-slice-plan/review-slice-plan.js');
+        break;
     default:
         process.stderr.write(`Unknown TASK_TYPE: ${taskType}\n`);
         process.exit(1);

package/sandbox/dist/tasks/chat/chat.js

@@ -11,8 +11,9 @@ import { withPhase } from '../../core/tracing.js';
 import { buildPrompt } from './prompt.js';
 const CHAT_PROMPT_FILE = 'chat-prompt.md';
 const CHAT_TIMEOUT_MS = 5 * 60 * 1000;
-const CHAT_PROVIDER = 'zai';
-const CHAT_MODEL = 'z-ai/glm-5.2';
+const CHAT_PROVIDER = 'openai';
+const CHAT_MODEL = 'gpt-5.6-luna';
+const CHAT_THINKING_LEVEL = 'high';
 function parseContext() {
     const base = parseBaseContext();
     const reactionIdRaw = process.env.REACTION_ID;
@@ -125,12 +126,12 @@ async function gatherIssueCommentContext(octokit, owner, repo, prNumber, comment
     };
 }
 export async function invokeChatModel(prompt) {
-    const apiKey = process.env.OPENROUTER_API_KEY?.trim();
+    const apiKey = process.env.OPENAI_KEY?.trim();
     if (!apiKey) {
         // Config error: no model call attempted, so no model span. The reason is
         // returned so the caller's root span reports the real cause.
         logger.warn('Chat model API key missing');
-        return { ok: false, reason: 'OPENROUTER_API_KEY missing' };
+        return { ok: false, reason: 'OPENAI_KEY missing' };
     }
     return withPhase('chat.model', {
         'gen_ai.operation.name': 'chat',
@@ -140,11 +141,11 @@ export async function invokeChatModel(prompt) {
         const result = await invokePiPrompt({
             provider: CHAT_PROVIDER,
             apiKey,
-            piProviderId: 'openrouter',
             prompt,
             cwd: WORKSPACE_DIR,
             timeoutMs: CHAT_TIMEOUT_MS,
             capabilityPreset: 'workspace-inspection',
+            thinkingLevel: CHAT_THINKING_LEVEL,
             // Keep the executed model in sync with the recorded span attr.
             modelName: CHAT_MODEL,
         });
@@ -371,7 +372,7 @@ async function main() {
             await recordTaskMetrics({
                 type: 'chat',
                 repository: `${ctx.owner}/${ctx.repo}`,
-                model: 'zai',
+                model: 'openai',
                 outcome: metricOutcome,
                 durationMs: performance.now() - startedAt,
             });

package/sandbox/dist/tasks/issue-triage/autofix-capabilities.js

@@ -0,0 +1,22 @@
+const REPOSITORY_CAPABILITIES = {
+    'doist/todoist-web': ['github-packages-read'],
+};
+export function resolveAutofixCapabilities(repository) {
+    return REPOSITORY_CAPABILITIES[repository.toLowerCase()] ?? [];
+}
+export function resolveAutofixCapabilityEnv(repository, env = process.env) {
+    const capabilityEnv = {};
+    for (const capability of resolveAutofixCapabilities(repository)) {
+        if (capability === 'github-packages-read') {
+            const token = env.GH_PACKAGES_TOKEN?.trim();
+            if (!token) {
+                return {
+                    ok: false,
+                    reason: `Missing GH_PACKAGES_TOKEN for required autofix capability "${capability}" on ${repository}.`,
+                };
+            }
+            capabilityEnv.GH_PACKAGES_TOKEN = token;
+        }
+    }
+    return { ok: true, env: capabilityEnv };
+}

package/sandbox/dist/tasks/issue-triage/fix-attempt.js

@@ -1,6 +1,7 @@
 import { execFileSync } from 'child_process';
 import { logger } from '../../core/logging.js';
 import { fillPromptTemplate, loadPromptTemplateFile, resolvePromptFile, } from '../../core/prompt-template.js';
+import { resolveAutofixCapabilityEnv } from './autofix-capabilities.js';
 import { validateDiff } from './diff-validator.js';
 import { CODEX_CANNOT_FIX_REASON, FIX_LOOP_FAILED_REASON_PREFIX } from './fix-failure-reasons.js';
 import { CX_HERO_MANUAL_HANDLE, resolveHeroGroup } from './hero-group-map.js';
@@ -325,6 +326,10 @@ export async function runFixCore(input) {
             reason: buildFixAssessmentSkipReason(fixAssessment),
         };
     }
+    const capabilityEnvResult = resolveAutofixCapabilityEnv(targetRepo.repository.fullName);
+    if (!capabilityEnvResult.ok) {
+        return capabilityEnvResult;
+    }
     // Reset repo to clean state before fix attempt (triage Codex may have modified files).
     // Use `git reset --hard` to clear both the working tree and the index, since
     // captureGitDiff stages files with `git add -A`.
@@ -383,9 +388,11 @@ export async function runFixCore(input) {
         prompt,
         apiKey: ctx.openaiApiKey,
         cwd: targetRepo.localPath,
+        thinkingLevel: 'xhigh',
         timeoutMs,
         extraEnv: {
             GH_TOKEN: input.ghToken,
+            ...capabilityEnvResult.env,
         },
     });
     if (!codexResult.ok) {