@doist/doistbot-cli 1.0.8 → 1.0.10

package/dist/actions/auth.js

@@ -1,5 +1,5 @@
 import chalk from 'chalk';
-import { deleteGeminiApiKey, deleteOpenRouterApiKey, getAuthStatus, loginOpenAICodex, logoutOpenAICodex, saveGeminiApiKey, saveOpenRouterApiKey, } from '../auth.js';
+import { createPiAuthRuntime, deleteGeminiApiKey, deleteOpenRouterApiKey, getAuthStatus, loginOpenAICodex, logoutOpenAICodex, saveGeminiApiKey, saveOpenRouterApiKey, } from '../auth.js';
 import { getEnvApiKeys } from '../env.js';
 import { FILE_STORE_PATH } from '../file-store.js';
 import { promptHiddenInput, promptMultiSelect } from '../input.js';
@@ -58,6 +58,7 @@ function formatSkipInstruction() {
 }
 export async function runAuthSetup(dependencies = {}) {
     const deps = {
+        createPiAuthRuntime,
         getAuthStatus,
         isInteractive: process.stdin.isTTY === true,
         loginOpenAICodex,
@@ -67,7 +68,8 @@ export async function runAuthSetup(dependencies = {}) {
         writeLine,
         ...dependencies,
     };
-    const status = await deps.getAuthStatus();
+    const runtime = await deps.createPiAuthRuntime();
+    const status = await deps.getAuthStatus({ runtime });
     deps.writeLine('1. OpenAI Codex');
     deps.writeLine();
     if (status.openai.configured && !status.openai.refreshFailed) {
@@ -80,7 +82,7 @@ export async function runAuthSetup(dependencies = {}) {
         if (status.openai.refreshFailed) {
             deps.writeLine('OpenAI session could not be refreshed (expired, revoked, or offline). Reconnecting.');
         }
-        await deps.loginOpenAICodex();
+        await deps.loginOpenAICodex(runtime);
         deps.writeLine();
         deps.writeLine('✓ OpenAI configured.');
     }
@@ -136,7 +138,7 @@ export async function runAuthSetup(dependencies = {}) {
         deps.writeLine('OpenRouter not configured. Skipping optional OpenRouter provider.');
         return;
     }
-    deps.writeLine(`Doistbot can use OpenRouter for DeepSeek, Z.ai, and other open models. Paste an OpenRouter API key, or ${formatSkipInstruction()}.`);
+    deps.writeLine(`Doistbot can use OpenRouter for DeepSeek, Grok, and other open models. Paste an OpenRouter API key, or ${formatSkipInstruction()}.`);
     const openRouterApiKey = (await deps.promptHiddenInput(API_KEY_PROMPT)).trim();
     if (!openRouterApiKey) {
         deps.writeLine();

package/dist/actions/review.js

@@ -6,6 +6,7 @@ const JSON_SCHEMA_VERSION = 1;
 const PROVIDER_DISPLAY_NAMES = {
     deepseek: 'DeepSeek',
     gemini: 'Gemini',
+    grok: 'Grok',
     zai: 'Z.ai',
     openai: 'OpenAI',
 };

package/dist/auth.js

@@ -1,10 +1,12 @@
 import { spawn } from 'child_process';
 import { homedir } from 'os';
 import path from 'path';
+import {} from '@earendil-works/pi-ai';
 import { getEnvApiKeys } from './env.js';
 import { createFileStore } from './file-store.js';
 import { promptInput } from './input.js';
 import { createCompositeStore, createKeyringStore, SecureStoreUnavailableError, } from './secure-store.js';
+import { writeLine } from './terminal.js';
 const GEMINI_ACCOUNT_NAME = 'gemini-api-key';
 const OPENROUTER_ACCOUNT_NAME = 'openrouter-api-key';
 export function createGeminiKeyStore() {
@@ -15,9 +17,20 @@ export function createOpenRouterKeyStore() {
 }
 export const OPENAI_CODEX_PROVIDER_ID = 'openai-codex';
 export const PI_AUTH_API_KEY = `pi-auth://${OPENAI_CODEX_PROVIDER_ID}`;
-export async function createPiAuthStorage() {
-    const { AuthStorage } = await import('@earendil-works/pi-coding-agent');
-    return AuthStorage.create(path.join(homedir(), '.pi', 'agent', 'auth.json'));
+const OPENAI_CODEX_BROWSER_LOGIN_METHOD = 'browser';
+export async function createPiAuthRuntime() {
+    // Pi's own CLI installs its npm Undici implementation before initializing
+    // ModelRuntime. SDK consumers must do the same on Node 26 so compressed OAuth
+    // responses are decoded before response.json() parses them.
+    const { install } = await import('undici');
+    install();
+    const { ModelRuntime } = await import('@earendil-works/pi-coding-agent');
+    return await ModelRuntime.create({
+        authPath: path.join(homedir(), '.pi', 'agent', 'auth.json'),
+        allowModelNetwork: false,
+        modelsPath: null,
+        refreshOnCreate: false,
+    });
 }
 export function getBrowserOpenCommand(platform, url) {
     if (platform === 'darwin') {
@@ -30,33 +43,38 @@ export function getBrowserOpenCommand(platform, url) {
 }
 /**
  * Check that the stored OAuth session is usable, not just present.
- * getApiKey returns the cached access token when unexpired; when expired it
- * attempts one cross-process-locked refresh, persists the result, and returns
- * undefined when the refresh fails (revoked session, no network) while
- * preserving the stored credentials. Unexpected storage errors propagate.
+ * The Pi model runtime returns the cached access token when unexpired; when
+ * expired it attempts one cross-process-locked refresh and persists the result.
+ * Refresh failures preserve the stored credentials. Unexpected storage errors
+ * propagate.
  */
-export async function getOpenAICodexAuthState(storage) {
-    const resolvedStorage = storage ?? (await createPiAuthStorage());
-    if (resolvedStorage.get(OPENAI_CODEX_PROVIDER_ID)?.type !== 'oauth') {
+export async function getOpenAICodexAuthState(runtime) {
+    const resolvedRuntime = runtime ?? (await createPiAuthRuntime());
+    const credentials = await resolvedRuntime.listCredentials();
+    if (!credentials.some(({ providerId, type }) => providerId === OPENAI_CODEX_PROVIDER_ID && type === 'oauth')) {
         return 'missing';
     }
-    const apiKey = await resolvedStorage.getApiKey(OPENAI_CODEX_PROVIDER_ID, {
-        includeFallback: false,
-    });
-    return apiKey ? 'ready' : 'refresh-failed';
-}
-export async function loginOpenAICodex(storage) {
-    const resolvedStorage = storage ?? (await createPiAuthStorage());
-    const { loginOpenAICodex: loginInBrowser } = await import('@earendil-works/pi-ai/oauth');
-    const credentials = await loginInBrowser(createOpenAICodexBrowserLoginOptions());
-    saveOpenAICodexCredentials(resolvedStorage, credentials);
+    try {
+        const auth = await resolvedRuntime.getAuth(OPENAI_CODEX_PROVIDER_ID);
+        return auth?.auth.apiKey ? 'ready' : 'refresh-failed';
+    }
+    catch (error) {
+        if (typeof error === 'object' &&
+            error !== null &&
+            'code' in error &&
+            error.code === 'oauth') {
+            return 'refresh-failed';
+        }
+        throw error;
+    }
 }
-export function saveOpenAICodexCredentials(storage, credentials) {
-    storage.set(OPENAI_CODEX_PROVIDER_ID, { type: 'oauth', ...credentials });
+export async function loginOpenAICodex(runtime) {
+    const resolvedRuntime = runtime ?? (await createPiAuthRuntime());
+    await resolvedRuntime.login(OPENAI_CODEX_PROVIDER_ID, 'oauth', createOpenAICodexBrowserLoginInteraction());
 }
-export async function logoutOpenAICodex(storage) {
-    const resolvedStorage = storage ?? (await createPiAuthStorage());
-    resolvedStorage.logout(OPENAI_CODEX_PROVIDER_ID);
+export async function logoutOpenAICodex(runtime) {
+    const resolvedRuntime = runtime ?? (await createPiAuthRuntime());
+    await resolvedRuntime.logout(OPENAI_CODEX_PROVIDER_ID);
 }
 export async function readStoredGeminiApiKey(store = createGeminiKeyStore()) {
     const result = await store.getSecret();
@@ -110,7 +128,7 @@ export async function deleteOpenRouterApiKey(store = createOpenRouterKeyStore())
 export async function deleteGeminiApiKey(store = createGeminiKeyStore()) {
     return await store.deleteSecret();
 }
-export async function getAuthStatus({ env = process.env, storage, geminiStore = createGeminiKeyStore(), openRouterStore = createOpenRouterKeyStore(), } = {}) {
+export async function getAuthStatus({ env = process.env, runtime, geminiStore = createGeminiKeyStore(), openRouterStore = createOpenRouterKeyStore(), } = {}) {
     const envApiKeys = getEnvApiKeys(env);
     const geminiStored = envApiKeys.gemini
         ? { value: undefined }
@@ -118,7 +136,7 @@ export async function getAuthStatus({ env = process.env, storage, geminiStore =
     const openRouterStored = envApiKeys.openrouter
         ? { value: undefined }
         : await readStoredOpenRouterApiKey(openRouterStore).catch(() => ({ value: undefined }));
-    const openAICodexAuthState = await getOpenAICodexAuthState(storage);
+    const openAICodexAuthState = await getOpenAICodexAuthState(runtime);
     return {
         openai: openAICodexAuthState === 'missing'
             ? { configured: false, source: undefined }
@@ -149,17 +167,31 @@ export async function getAuthStatus({ env = process.env, storage, geminiStore =
             },
     };
 }
-function createOpenAICodexBrowserLoginOptions() {
+function createOpenAICodexBrowserLoginInteraction() {
     return {
-        onAuth: (info) => {
-            openUrlInBrowser(info.url);
-            process.stdout.write('Open this URL in your browser:\n');
-            process.stdout.write(`${info.url}\n`);
-            if (info.instructions) {
-                process.stdout.write(`${info.instructions}\n`);
+        notify: (event) => {
+            if (event.type === 'auth_url') {
+                openUrlInBrowser(event.url);
+                writeLine('Open this URL in your browser:');
+                writeLine(event.url);
+                if (event.instructions) {
+                    writeLine(event.instructions);
+                }
+            }
+            else if (event.type === 'info' || event.type === 'progress') {
+                writeLine(event.message);
+            }
+        },
+        prompt: async (prompt) => {
+            if (prompt.type === 'select') {
+                const browserOption = prompt.options.find(({ id }) => id === OPENAI_CODEX_BROWSER_LOGIN_METHOD);
+                if (!browserOption) {
+                    throw new Error('OpenAI Codex did not provide a browser login option');
+                }
+                return browserOption.id;
             }
+            return await promptInput(`${prompt.message} `, prompt.signal);
         },
-        onPrompt: async (prompt) => await promptInput(`${prompt.message} `),
     };
 }
 function openUrlInBrowser(url) {

package/dist/config.js

@@ -3,13 +3,15 @@ import { getEnvApiKeys } from './env.js';
 const REQUIRED_CLI_AUTH_PROVIDERS = [{ provider: 'openai', label: 'OpenAI' }];
 const ALL_REVIEW_FOCUSES = [
     'general',
+    'security',
+    'reuse',
     'quality',
     'efficiency',
     'tests',
     'standards',
 ];
-const OPENROUTER_REVIEW_MODELS = ['deepseek', 'zai'];
-const CLI_GEMINI_REVIEW_MODEL = 'gemini-3.5-flash';
+const OPENROUTER_REVIEW_MODELS = ['deepseek', 'grok'];
+const CLI_GEMINI_REVIEW_MODEL = 'gemini-3.7-flash';
 function createCliGeminiCredential(apiKey) {
     return {
         apiKey,
@@ -47,6 +49,7 @@ export async function getApiKeys(env = process.env, auth = {
     }
     if (openRouterApiKey) {
         apiKeys.deepseek = { apiKey: openRouterApiKey, piProviderId: 'openrouter' };
+        apiKeys.grok = { apiKey: openRouterApiKey, piProviderId: 'openrouter' };
         apiKeys.zai = { apiKey: openRouterApiKey, piProviderId: 'openrouter' };
     }
     if (openAICodexAuthState === 'ready') {
@@ -74,7 +77,7 @@ export function formatMissingRequiredCliAuthProviders(missingProviders) {
 }
 export function getCliReviewRouting(apiKeys) {
     const hasGemini = Boolean(apiKeys.gemini);
-    const hasOpenRouter = Boolean(apiKeys.deepseek && apiKeys.zai);
+    const hasOpenRouter = Boolean(apiKeys.deepseek && apiKeys.grok);
     if (hasGemini && hasOpenRouter) {
         return {
             reviewModelsEnabled: ['openai', ...OPENROUTER_REVIEW_MODELS],

package/dist/input.js

@@ -1,15 +1,15 @@
-import { createInterface } from 'node:readline';
-export function promptInput(prompt) {
-    return new Promise((resolve) => {
-        const rl = createInterface({
-            input: process.stdin,
-            output: process.stdout,
-        });
-        rl.question(prompt, (answer) => {
-            rl.close();
-            resolve(answer);
-        });
+import { createInterface } from 'node:readline/promises';
+export async function promptInput(prompt, signal) {
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stdout,
     });
+    try {
+        return await rl.question(prompt, { signal });
+    }
+    finally {
+        rl.close();
+    }
 }
 export function promptHiddenInput(prompt) {
     if (!process.stdin.isTTY) {

package/dist/terminal.js

@@ -116,6 +116,7 @@ export async function withSpinner(message, task, terminalConfig = getDefaultTerm
 const PROVIDER_DISPLAY_NAMES = {
     deepseek: 'DeepSeek',
     gemini: 'Gemini',
+    grok: 'Grok',
     zai: 'Z.ai',
     openai: 'OpenAI',
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@doist/doistbot-cli",
-    "version": "1.0.8",
+    "version": "1.0.10",
     "description": "Local self-review CLI for Doistbot",
     "type": "module",
     "main": "dist/index.js",
@@ -42,14 +42,15 @@
     "dependencies": {
         "@inquirer/checkbox": "5.2.1",
         "@inquirer/password": "5.1.1",
-        "@earendil-works/pi-ai": "0.80.6",
-        "@earendil-works/pi-coding-agent": "0.80.6",
+        "@earendil-works/pi-ai": "0.84.2",
+        "@earendil-works/pi-coding-agent": "0.84.2",
         "@napi-rs/keyring": "1.3.0",
         "ajv": "8.20.0",
         "chalk": "4.1.2",
         "commander": "14.0.3",
-        "js-yaml": "4.2.0",
+        "js-yaml": "4.3.1",
         "octokit": "5.0.5",
+        "undici": "8.10.0",
         "yocto-spinner": "1.2.0"
     },
     "devDependencies": {

package/sandbox/_node_modules/doistbot-repo-config/dist/index.d.ts

@@ -1,7 +1,7 @@
 import type { Logger } from 'doistbot-logging';
 import type { Octokit } from 'octokit';
 export declare const CONFIG_FILE_PATH = ".github/doistbot.yml";
-export declare const DEFAULT_REVIEW_MODELS: readonly ["openai", "deepseek", "zai"];
+export declare const DEFAULT_REVIEW_MODELS: readonly ["openai", "deepseek", "grok"];
 export type DefaultReviewModel = (typeof DEFAULT_REVIEW_MODELS)[number];
 export type RepoConfig = {
     review?: {

package/sandbox/_node_modules/doistbot-repo-config/dist/index.js

@@ -2,7 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import { load as yamlLoad } from 'js-yaml';
 export const CONFIG_FILE_PATH = '.github/doistbot.yml';
-export const DEFAULT_REVIEW_MODELS = ['openai', 'deepseek', 'zai'];
+export const DEFAULT_REVIEW_MODELS = ['openai', 'deepseek', 'grok'];
 function parseRepoConfigContent(content) {
     return yamlLoad(content);
 }

package/sandbox/dist/core/datadog-metrics.js

@@ -11,6 +11,8 @@ function toTaskMetricBaseModel(model) {
         case 'gemini':
         case 'google':
             return 'google';
+        case 'grok':
+            return 'grok';
         case 'zai':
             return 'zai';
         case 'openai':

package/sandbox/dist/core/pi.js

@@ -6,25 +6,29 @@ import { fileURLToPath } from 'url';
 export const PI_PROVIDER_BY_DOISTBOT_PROVIDER = {
     deepseek: 'openrouter',
     gemini: 'google',
+    grok: 'openrouter',
     zai: 'openrouter',
     openai: 'openai',
 };
 export const DEFAULT_PI_MODELS = {
     deepseek: 'deepseek-v4-pro',
     gemini: 'gemini-3.1-pro-preview',
+    grok: 'grok-4.6',
     zai: 'glm5.2',
     openai: 'gpt-5.6-terra',
 };
 export const DEFAULT_OPENROUTER_MODELS = {
-    deepseek: 'deepseek/deepseek-v4-pro',
+    deepseek: 'deepseek/deepseek-v4-pro-0813',
     gemini: 'google/gemini-3.1-pro-preview',
+    grok: 'x-ai/grok-4.6',
     zai: 'z-ai/glm-5.2',
 };
 // Gemini flash fallback model.
-export const DEFAULT_GEMINI_FLASH_MODEL = 'gemini-3.5-flash';
+export const DEFAULT_GEMINI_FLASH_MODEL = 'gemini-3.7-flash';
 export const MAX_PI_THINKING_BY_PROVIDER = {
     deepseek: 'high',
     gemini: 'high',
+    grok: 'high',
     zai: 'high',
     openai: 'xhigh',
 };
@@ -334,8 +338,14 @@ export function createPiInvoker({ provider, apiKey, piProviderId, cwd, extraEnv,
                 ...openRouterSessionExtension.args,
                 ...imageArgs,
             ];
-            const childEnv = {
+            const inheritedEnv = {
                 ...process.env,
+            };
+            // Repository-scoped credentials must be passed explicitly through
+            // extraEnv by an authorized task invocation.
+            delete inheritedEnv.GH_PACKAGES_TOKEN;
+            const childEnv = {
+                ...inheritedEnv,
                 HOME: process.env.HOME,
                 PATH: process.env.PATH,
                 GIT_TERMINAL_PROMPT: '0',

package/sandbox/dist/core/shared.js

@@ -40,16 +40,16 @@ export function optionalPositiveInt(value) {
 /**
  * Parses the base environment variables common to all sandbox tasks.
  */
-export function parseBaseContext() {
+export function parseBaseContext(env = process.env) {
     return {
-        owner: requiredEnv('REPO_OWNER'),
-        repo: requiredEnv('REPO_NAME'),
-        prNumber: requiredPositiveInt('PR_NUMBER'),
-        installationId: requiredPositiveInt('INSTALLATION_ID'),
-        appId: requiredEnv('APP_ID'),
-        privateKey: requiredEnv('PRIVATE_KEY'),
-        githubToken: process.env.GITHUB_TOKEN?.trim() || undefined,
-        deliveryId: process.env.DELIVERY_ID,
+        owner: requiredEnv('REPO_OWNER', env),
+        repo: requiredEnv('REPO_NAME', env),
+        prNumber: requiredPositiveInt('PR_NUMBER', env),
+        installationId: requiredPositiveInt('INSTALLATION_ID', env),
+        appId: requiredEnv('APP_ID', env),
+        privateKey: requiredEnv('PRIVATE_KEY', env),
+        githubToken: env.GITHUB_TOKEN?.trim() || undefined,
+        deliveryId: env.DELIVERY_ID?.trim() || undefined,
     };
 }
 export function resolveWriteOctokit({ githubToken, fallbackOctokit, }) {

package/sandbox/dist/core/span-test-helpers.js

@@ -0,0 +1,13 @@
+import { vi } from 'vitest';
+/**
+ * Shared assertion helper for the model/phase span tests, which all spy on
+ * `logger.info` and assert on the same `phase.*` envelope shape emitted by the
+ * LoggerSpanProcessor.
+ *
+ * Returns the `phase.end` envelopes for the given span name, in call order.
+ */
+export function phaseEnds(infoSpy, name) {
+    return infoSpy.mock.calls
+        .map((call) => call[1])
+        .filter((meta) => meta?.event === 'phase.end' && meta?.name === name);
+}

package/sandbox/dist/core/tracing.js

@@ -72,7 +72,7 @@ export function recordEvent(name, meta) {
 /**
  * Maps a doistbot provider key to the OTel `gen_ai.provider.name` value
  * (docs/sandbox-instrumentation.md). Only `gemini` has a standard name
- * (`gcp.gemini`); the OpenRouter-routed keys (`zai`, `deepseek`) have none, so
+ * (`gcp.gemini`); the OpenRouter-routed keys (`grok`, `zai`, `deepseek`) have none, so
  * they pass through. Single source so every span site stays consistent.
  */
 export function genAiProviderName(provider) {

package/sandbox/dist/main.js

@@ -32,6 +32,9 @@ switch (taskType) {
     case 'review':
         await import('./tasks/review/review.js');
         break;
+    case 'review-slice-plan':
+        await import('./tasks/review-slice-plan/review-slice-plan.js');
+        break;
     default:
         process.stderr.write(`Unknown TASK_TYPE: ${taskType}\n`);
         process.exit(1);

package/sandbox/dist/providers/index.js

@@ -11,6 +11,7 @@ export * from './types.js';
 const providers = {
     deepseek: new OpenRouterPiProvider('deepseek'),
     gemini: new GeminiProvider(),
+    grok: new OpenRouterPiProvider('grok'),
     zai: new OpenRouterPiProvider('zai'),
     openai: new OpenAIProvider(),
 };

package/sandbox/dist/tasks/issue-summarize/model.js

@@ -4,11 +4,11 @@ import { buildPiImageContent, createPiInvoker, DEFAULT_OPENROUTER_MODELS } from
 import { withPhase } from '../../core/tracing.js';
 const ISSUE_SUMMARIZE_TIMEOUT_MS = 5 * 60 * 1000;
 const ISSUE_SUMMARIZE_MULTIMODAL_MODEL = 'google/gemini-2.5-pro';
-const SUMMARIZE_TEXT_PROVIDER = 'zai';
-// Single source of truth: inherit the repo-wide ZAI default so a default-model
+const SUMMARIZE_TEXT_PROVIDER = 'grok';
+// Single source of truth: inherit the repo-wide Grok default so a default-model
 // bump in core/pi.ts moves summarize too, and the executed model matches the
 // recorded gen_ai.request.model.
-const SUMMARIZE_TEXT_MODEL = DEFAULT_OPENROUTER_MODELS.zai;
+const SUMMARIZE_TEXT_MODEL = DEFAULT_OPENROUTER_MODELS.grok;
 const SUMMARIZE_MULTIMODAL_PROVIDER = 'gcp.gemini';
 // One model span per actual model.invoke. The final summary uses
 // `issue-summarize.model`; each chunk summary uses `issue-summarize.chunk`.
@@ -16,7 +16,7 @@ const SUMMARIZE_MODEL_PHASE = 'issue-summarize.model';
 const SUMMARIZE_CHUNK_PHASE = 'issue-summarize.chunk';
 export function createIssueSummarizeModel(apiKey) {
     return createPiInvoker({
-        provider: 'zai',
+        provider: 'grok',
         apiKey,
         piProviderId: 'openrouter',
         cwd: process.cwd(),

package/sandbox/dist/tasks/issue-triage/autofix-capabilities.js

@@ -0,0 +1,22 @@
+const REPOSITORY_CAPABILITIES = {
+    'doist/todoist-web': ['github-packages-read'],
+};
+export function resolveAutofixCapabilities(repository) {
+    return REPOSITORY_CAPABILITIES[repository.toLowerCase()] ?? [];
+}
+export function resolveAutofixCapabilityEnv(repository, env = process.env) {
+    const capabilityEnv = {};
+    for (const capability of resolveAutofixCapabilities(repository)) {
+        if (capability === 'github-packages-read') {
+            const token = env.GH_PACKAGES_TOKEN?.trim();
+            if (!token) {
+                return {
+                    ok: false,
+                    reason: `Missing GH_PACKAGES_TOKEN for required autofix capability "${capability}" on ${repository}.`,
+                };
+            }
+            capabilityEnv.GH_PACKAGES_TOKEN = token;
+        }
+    }
+    return { ok: true, env: capabilityEnv };
+}

package/sandbox/dist/tasks/issue-triage/fix-attempt.js

@@ -1,6 +1,7 @@
 import { execFileSync } from 'child_process';
 import { logger } from '../../core/logging.js';
 import { fillPromptTemplate, loadPromptTemplateFile, resolvePromptFile, } from '../../core/prompt-template.js';
+import { resolveAutofixCapabilityEnv } from './autofix-capabilities.js';
 import { validateDiff } from './diff-validator.js';
 import { CODEX_CANNOT_FIX_REASON, FIX_LOOP_FAILED_REASON_PREFIX } from './fix-failure-reasons.js';
 import { CX_HERO_MANUAL_HANDLE, resolveHeroGroup } from './hero-group-map.js';
@@ -325,6 +326,10 @@ export async function runFixCore(input) {
             reason: buildFixAssessmentSkipReason(fixAssessment),
         };
     }
+    const capabilityEnvResult = resolveAutofixCapabilityEnv(targetRepo.repository.fullName);
+    if (!capabilityEnvResult.ok) {
+        return capabilityEnvResult;
+    }
     // Reset repo to clean state before fix attempt (triage Codex may have modified files).
     // Use `git reset --hard` to clear both the working tree and the index, since
     // captureGitDiff stages files with `git add -A`.
@@ -387,6 +392,7 @@ export async function runFixCore(input) {
         timeoutMs,
         extraEnv: {
             GH_TOKEN: input.ghToken,
+            ...capabilityEnvResult.env,
         },
     });
     if (!codexResult.ok) {