@gobing-ai/ts-ai-runner 0.3.21 → 0.4.1

package/dist/agents/auth-shims.d.ts

@@ -0,0 +1,47 @@
+import { type FileSystem } from '@gobing-ai/ts-runtime';
+import type { AiRunner } from '../ai-runner';
+import { type AgentName, getAgentShim } from './shims';
+/**
+ * Authentication state for a coding agent — **tri-state by design**.
+ *
+ * `unknown` is first-class: several agents have no reliable auth probe
+ * (no auth verb, no checkable credential file). Collapsing `unknown` to
+ * `unauthenticated` is exactly the false-negative that used to make
+ * `antigravity-cli` (no auth verb) and inconclusive probes report
+ * `usable: false` despite being runnable.
+ *
+ * Auth detection is **off the execution critical path**: {@link isAuthenticated}
+ * never feeds run-readiness — it is operator information only. A genuinely
+ * unauthenticated agent fails at runtime with its own error (auth is the
+ * agent's concern).
+ */
+export type AuthState = 'authenticated' | 'unauthenticated' | 'unknown';
+/** Context injected into {@link isAuthenticated}. */
+export interface AuthContext {
+    /** Runner used to execute auth probes. */
+    runner: AiRunner;
+    /** Environment map for env/file auth checks. Defaults to the process env. */
+    env?: Record<string, string | undefined>;
+    /** Filesystem for auth-file checks. Required — inject a fake in tests. */
+    fileSystem: FileSystem;
+    /** Auth probe timeout in milliseconds. */
+    timeout?: number;
+}
+/**
+ * Resolve a coding agent's authentication state.
+ *
+ * **Never throws.** Any probe failure, inconclusive output, or missing probe
+ * resolves to `unknown` rather than `unauthenticated` — see {@link AuthState}.
+ *
+ * Auth sources, in priority order per agent:
+ * - **gemini** — credential-like content in `~/.gemini/settings.json`.
+ * - **codex** — `codex login status` CLI output, falling back to an
+ *   `~/.codex/auth{.json,}` credential file.
+ * - **pi / omp** — a non-empty `GOOGLE_API_KEY` or `ANTHROPIC_API_KEY` in env
+ *   (an empty export is not a usable credential), else the CLI auth probe.
+ * - **others** — the shim's auth command; matched against {@link AUTH_PATTERNS}.
+ * - **no probe** (e.g. `antigravity-cli`) ⇒ `unknown`.
+ */
+export declare function isAuthenticated(agent: AgentName, ctx: AuthContext): Promise<AuthState>;
+export { getAgentShim };
+//# sourceMappingURL=auth-shims.d.ts.map

package/dist/agents/auth-shims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-shims.d.ts","sourceRoot":"","sources":["../../src/agents/auth-shims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAA2B,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAmC,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,KAAK,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAExE,qDAAqD;AACrD,MAAM,WAAW,WAAW;IACxB,0CAA0C;IAC1C,MAAM,EAAE,QAAQ,CAAC;IACjB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,0EAA0E;IAC1E,UAAU,EAAE,UAAU,CAAC;IACvB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AA6CD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAgB5F;AA8CD,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/agents/auth-shims.js

@@ -0,0 +1,120 @@
+import { getProcessEnv, joinPath } from '@gobing-ai/ts-runtime';
+import { getAgentShim } from './shims.js';
+const DEFAULT_AUTH_TIMEOUT_MS = 5_000;
+/**
+ * Per-agent auth-probe output patterns. A positive match ⇒ authenticated;
+ * a negative match ⇒ unauthenticated; neither (or no probe) ⇒ unknown.
+ */
+const AUTH_PATTERNS = {
+    claude: {
+        positive: /authenticated|logged[\s_-]*in|"loggedIn"\s*:\s*true/i,
+        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|logged[\s_-]*out|unauthenticated|"loggedIn"\s*:\s*false/i,
+    },
+    codex: {
+        positive: /logged[\s_-]*in|authenticated/i,
+        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|logged[\s_-]*out|unauthenticated/i,
+    },
+    opencode: {
+        positive: /configured|available/i,
+        negative: /not[\s_-]*configured|no[\s_-]+providers?[\s_-]+available|unavailable/i,
+    },
+    openclaw: {
+        positive: /(^|[^a-z])ok([^a-z]|$)|healthy/i,
+        negative: /not[\s_-]*healthy|unhealthy|not[\s_-]*ok/i,
+    },
+    pi: {
+        positive: /\S/,
+        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|unauthenticated|no[\s_-]+providers?/i,
+    },
+    omp: {
+        positive: /\S/,
+        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|unauthenticated|no[\s_-]+providers?/i,
+    },
+    hermes: {
+        positive: /(^|[^a-z])ok([^a-z]|$)|healthy|configured|ready/i,
+        negative: /not[\s_-]*(configured|healthy|ok)|unhealthy|missing[\s_-]+dependenc|error|failed/i,
+    },
+};
+/** True when a value is a defined, non-blank string. */
+function isNonEmpty(value) {
+    return value !== undefined && value.trim().length > 0;
+}
+/**
+ * Resolve a coding agent's authentication state.
+ *
+ * **Never throws.** Any probe failure, inconclusive output, or missing probe
+ * resolves to `unknown` rather than `unauthenticated` — see {@link AuthState}.
+ *
+ * Auth sources, in priority order per agent:
+ * - **gemini** — credential-like content in `~/.gemini/settings.json`.
+ * - **codex** — `codex login status` CLI output, falling back to an
+ *   `~/.codex/auth{.json,}` credential file.
+ * - **pi / omp** — a non-empty `GOOGLE_API_KEY` or `ANTHROPIC_API_KEY` in env
+ *   (an empty export is not a usable credential), else the CLI auth probe.
+ * - **others** — the shim's auth command; matched against {@link AUTH_PATTERNS}.
+ * - **no probe** (e.g. `antigravity-cli`) ⇒ `unknown`.
+ */
+export async function isAuthenticated(agent, ctx) {
+    const env = ctx.env ?? getProcessEnv();
+    const fs = ctx.fileSystem;
+    const timeout = ctx.timeout ?? DEFAULT_AUTH_TIMEOUT_MS;
+    const home = env.HOME || env.USERPROFILE || '';
+    if (agent === 'gemini')
+        return geminiSettingsContainCredentials(fs, home);
+    if (agent === 'codex')
+        return checkCodexAuth(ctx.runner, fs, home, timeout);
+    // pi and omp read provider keys from the environment; require a non-empty
+    // value rather than mere presence (an empty export is not a usable credential).
+    if ((agent === 'pi' || agent === 'omp') && (isNonEmpty(env.GOOGLE_API_KEY) || isNonEmpty(env.ANTHROPIC_API_KEY))) {
+        return 'authenticated';
+    }
+    return probeAuthOutput(ctx.runner, agent, timeout);
+}
+async function checkCodexAuth(runner, fs, home, timeout) {
+    const probeStatus = await probeAuthOutput(runner, 'codex', timeout);
+    if (probeStatus !== 'unknown')
+        return probeStatus;
+    const hasFile = (await hasNonEmptyFile(fs, joinPath(home, '.codex', 'auth.json'))) ||
+        (await hasNonEmptyFile(fs, joinPath(home, '.codex', 'auth')));
+    return hasFile ? 'authenticated' : 'unknown';
+}
+async function geminiSettingsContainCredentials(fs, home) {
+    try {
+        const content = await fs.readFile(joinPath(home, '.gemini', 'settings.json'));
+        return /auth|token|key/i.test(content) ? 'authenticated' : 'unauthenticated';
+    }
+    catch {
+        // Missing or unreadable settings — auth state genuinely unknown.
+        return 'unknown';
+    }
+}
+async function probeAuthOutput(runner, agent, timeout) {
+    const options = { timeout };
+    const command = runner.runAuthCommand(agent, options);
+    const patterns = AUTH_PATTERNS[agent];
+    if (command === null || patterns === undefined)
+        return 'unknown';
+    try {
+        const result = await command;
+        if (result.exitCode !== 0)
+            return 'unauthenticated';
+        const output = `${result.stdout}\n${result.stderr}`;
+        if (patterns.negative.test(output))
+            return 'unauthenticated';
+        if (patterns.positive.test(output))
+            return 'authenticated';
+        return 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/** True when the path exists and has a non-zero size. */
+async function hasNonEmptyFile(fs, path) {
+    const stat = await fs.stat(path);
+    if (stat === null)
+        return false;
+    return stat.isFile() && stat.size > 0;
+}
+// Re-exported so callers that only need the auth facet don't import getAgentShim directly.
+export { getAgentShim };

package/dist/ai-runner.d.ts

@@ -21,6 +21,8 @@ export interface AgentRunOptions {
     cwd?: string;
     /** Timeout in milliseconds. */
     timeout?: number;
+    /** AbortSignal forwarded to ProcessExecutor — aborts the agent subprocess when fired. */
+    signal?: AbortSignal;
 }
 /** Constructor options for AiRunner. */
 export interface AiRunnerOptions {

package/dist/ai-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-runner.d.ts","sourceRoot":"","sources":["../src/ai-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAa,KAAK,MAAM,EAAc,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAGH,KAAK,eAAe,EAEpB,KAAK,UAAU,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,SAAS,EAAgB,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACpG,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAInE,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC3B,uEAAuE;IACvE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC5B,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC5B,4DAA4D;IAC5D,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,aAAa,CAAC,EAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAChD,gEAAgE;IAChE,MAAM,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/B,kFAAkF;IAClF,MAAM,CAAC,EAAE,UAAU,CAAC;CACvB;AAED,uEAAuE;AACvE,qBAAa,QAAQ;IACjB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAE/C,OAAO,GAAE,eAAoB;IAuBzC,iCAAiC;IACjC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAIxF,oCAAoC;IACpC,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI3F,mCAAmC;IACnC,gBAAgB,CACZ,KAAK,EAAE,SAAS,EAChB,aAAa,EAAE,aAAa,EAC5B,OAAO,GAAE,eAAoB,GAC9B,OAAO,CAAC,cAAc,CAAC;IAI1B,6EAA6E;IAC7E,eAAe,CACX,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,aAAa,EAC5B,OAAO,GAAE,eAAoB,GAC9B,OAAO,CAAC,cAAc,CAAC;IAI1B,0DAA0D;IAC1D,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,GAAE,eAAoB,GAAG,WAAW;IAM9G,4EAA4E;IAC5E,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI;YAKjF,MAAM;CA0CvB;AAWD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/B,WAAW,CAEb"}
+{"version":3,"file":"ai-runner.d.ts","sourceRoot":"","sources":["../src/ai-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAa,KAAK,MAAM,EAAc,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAGH,KAAK,eAAe,EAEpB,KAAK,UAAU,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,SAAS,EAAgB,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACpG,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAInE,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC3B,uEAAuE;IACvE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC5B,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,MAAM,CAAC,EAAE,WAAW,CAAC;CACxB;AAED,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC5B,4DAA4D;IAC5D,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,aAAa,CAAC,EAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAChD,gEAAgE;IAChE,MAAM,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/B,kFAAkF;IAClF,MAAM,CAAC,EAAE,UAAU,CAAC;CACvB;AAED,uEAAuE;AACvE,qBAAa,QAAQ;IACjB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAE/C,OAAO,GAAE,eAAoB;IAuBzC,iCAAiC;IACjC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAIxF,oCAAoC;IACpC,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI3F,mCAAmC;IACnC,gBAAgB,CACZ,KAAK,EAAE,SAAS,EAChB,aAAa,EAAE,aAAa,EAC5B,OAAO,GAAE,eAAoB,GAC9B,OAAO,CAAC,cAAc,CAAC;IAI1B,6EAA6E;IAC7E,eAAe,CACX,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,aAAa,EAC5B,OAAO,GAAE,eAAoB,GAC9B,OAAO,CAAC,cAAc,CAAC;IAI1B,0DAA0D;IAC1D,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,GAAE,eAAoB,GAAG,WAAW;IAM9G,4EAA4E;IAC5E,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI;YAKjF,MAAM;CA2CvB;AAWD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC7B,KAAK,EAAE,SAAS,EAChB,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/B,WAAW,CAEb"}

package/dist/ai-runner.js

@@ -71,6 +71,7 @@ export class AiRunner {
             forceBuffered,
             cwd: options.cwd ?? this.defaultCwd,
             timeout: options.timeout ?? this.defaultTimeout,
+            ...(options.signal !== undefined ? { signal: options.signal } : {}),
         });
         if (result.exitCode !== 0) {
             this.logger.error('invoke exited non-zero', {

package/dist/doctor-runner.d.ts

@@ -1,6 +1,7 @@
 import { type Logger } from '@gobing-ai/ts-infra';
 import { type FileSystem } from '@gobing-ai/ts-runtime';
 import { AgentDetector } from './agent-detector';
+import { type AuthState } from './agents/auth-shims';
 import { type AgentName } from './agents/shims';
 import { AiRunner } from './ai-runner';
 /** Health-check result for one coding agent. */
@@ -11,9 +12,18 @@ export interface DoctorResult {
     installed: boolean;
     /** Human-readable version when installed. */
     version: string | null;
-    /** Whether the agent appears authenticated. */
-    authenticated: boolean;
-    /** Whether the agent is ready for direct use. */
+    /**
+     * Authentication state — **tri-state** (`authenticated | unauthenticated |
+     * unknown`). Informational only; never feeds {@link usable} or any
+     * run-readiness gate. A genuinely unauthenticated agent fails at runtime
+     * with its own error.
+     */
+    authenticated: AuthState;
+    /**
+     * Whether the agent is **runnable** — liveness only
+     * (`installed && version !== null`). Auth is NOT consulted: a logged-out
+     * agent is still `usable` (it will fail at runtime with its own auth error).
+     */
     usable: boolean;
     /** Capability tier: 1 = direct CLI, 2 = gateway/TUI constrained. */
     tier: 1 | 2;
@@ -41,7 +51,7 @@ export interface DoctorRunnerOptions {
     /** Filesystem for auth-file checks. Defaults to `createNodeFileSystem()`; inject to test without disk. */
     fileSystem?: FileSystem;
 }
-/** Runs installation and auth health checks for supported coding agents. */
+/** Runs installation, liveness, and auth health checks for supported coding agents. */
 export declare class DoctorRunner {
     private readonly detector;
     private readonly runner;
@@ -55,11 +65,5 @@ export declare class DoctorRunner {
     /** Run a health check on one agent. */
     runOne(agent: string): Promise<DoctorResult>;
     private buildResult;
-    private checkAuth;
-    private checkCodexAuth;
-    private geminiSettingsContainCredentials;
-    private probeAuthOutput;
-    /** True when the path exists and has a non-zero size. */
-    private hasNonEmptyFile;
 }
 //# sourceMappingURL=doctor-runner.d.ts.map

package/dist/doctor-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-runner.d.ts","sourceRoot":"","sources":["../src/doctor-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAwB,KAAK,UAAU,EAA2B,MAAM,uBAAuB,CAAC;AACvG,OAAO,EAAE,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,KAAK,SAAS,EAAiD,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAuB,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5D,gDAAgD;AAChD,MAAM,WAAW,YAAY;IACzB,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,+CAA+C;IAC/C,aAAa,EAAE,OAAO,CAAC;IACvB,iDAAiD;IACjD,MAAM,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACZ,wDAAwD;IACxD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wEAAwE;IACxE,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,oCAAoC;IACpC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,4CAA4C;AAC5C,MAAM,WAAW,mBAAmB;IAChC,uBAAuB;IACvB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,qBAAqB;IACrB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0GAA0G;IAC1G,UAAU,CAAC,EAAE,UAAU,CAAC;CAC3B;AAwCD,4EAA4E;AAC5E,qBAAa,YAAY;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqC;IACzD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,OAAO,GAAE,mBAAwB;IAS7C,kDAAkD;IAC5C,MAAM,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAkBvC,uCAAuC;IACjC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAIpC,WAAW;YAmBX,SAAS;YAcT,cAAc;YASd,gCAAgC;YAQhC,eAAe;IAY7B,yDAAyD;YAC3C,eAAe;CAKhC"}
+{"version":3,"file":"doctor-runner.d.ts","sourceRoot":"","sources":["../src/doctor-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAwB,KAAK,UAAU,EAAiB,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,KAAK,SAAS,EAAmB,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,KAAK,SAAS,EAAiD,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,gDAAgD;AAChD,MAAM,WAAW,YAAY;IACzB,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;OAKG;IACH,aAAa,EAAE,SAAS,CAAC;IACzB;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACZ,wDAAwD;IACxD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gEAAgE;IAChE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wEAAwE;IACxE,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,oCAAoC;IACpC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,4CAA4C;AAC5C,MAAM,WAAW,mBAAmB;IAChC,uBAAuB;IACvB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,qBAAqB;IACrB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0GAA0G;IAC1G,UAAU,CAAC,EAAE,UAAU,CAAC;CAC3B;AAID,uFAAuF;AACvF,qBAAa,YAAY;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqC;IACzD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,OAAO,GAAE,mBAAwB;IAS7C,kDAAkD;IAC5C,MAAM,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAkBvC,uCAAuC;IACjC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAIpC,WAAW;CA4B5B"}

package/dist/doctor-runner.js

@@ -1,44 +1,11 @@
 import { getLogger } from '@gobing-ai/ts-infra';
-import { createNodeFileSystem, getProcessEnv, joinPath } from '@gobing-ai/ts-runtime';
+import { createNodeFileSystem, getProcessEnv } from '@gobing-ai/ts-runtime';
 import { AgentDetector } from './agent-detector.js';
+import { isAuthenticated } from './agents/auth-shims.js';
 import { DISPLAY_ORDER, resolveAgentName, TIER2_AGENTS } from './agents/shims.js';
 import { AiRunner } from './ai-runner.js';
 const DEFAULT_TIMEOUT_MS = 5_000;
-const AUTH_PATTERNS = {
-    claude: {
-        positive: /authenticated|logged[\s_-]*in|"loggedIn"\s*:\s*true/i,
-        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|logged[\s_-]*out|unauthenticated|"loggedIn"\s*:\s*false/i,
-    },
-    codex: {
-        positive: /logged[\s_-]*in|authenticated/i,
-        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|logged[\s_-]*out|unauthenticated/i,
-    },
-    opencode: {
-        positive: /configured|available/i,
-        negative: /not[\s_-]*configured|no[\s_-]+providers?[\s_-]+available|unavailable/i,
-    },
-    openclaw: {
-        positive: /(^|[^a-z])ok([^a-z]|$)|healthy/i,
-        negative: /not[\s_-]*healthy|unhealthy|not[\s_-]*ok/i,
-    },
-    pi: {
-        positive: /\S/,
-        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|unauthenticated|no[\s_-]+providers?/i,
-    },
-    omp: {
-        positive: /\S/,
-        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|unauthenticated|no[\s_-]+providers?/i,
-    },
-    hermes: {
-        positive: /(^|[^a-z])ok([^a-z]|$)|healthy|configured|ready/i,
-        negative: /not[\s_-]*(configured|healthy|ok)|unhealthy|missing[\s_-]+dependenc|error|failed/i,
-    },
-};
-/** True when a value is a defined, non-blank string. */
-function isNonEmpty(value) {
-    return value !== undefined && value.trim().length > 0;
-}
-/** Runs installation and auth health checks for supported coding agents. */
+/** Runs installation, liveness, and auth health checks for supported coding agents. */
 export class DoctorRunner {
     detector;
     runner;
@@ -74,13 +41,22 @@ export class DoctorRunner {
         const canonical = resolveAgentName(detected.name) ?? null;
         const tier = canonical !== null && TIER2_AGENTS.has(canonical) ? 2 : 1;
         this.logger.debug('checking agent', { agent: detected.name, installed: detected.installed, tier });
-        const authenticated = detected.installed && canonical !== null ? await this.checkAuth(canonical) : false;
+        const authenticated = detected.installed && canonical !== null
+            ? await isAuthenticated(canonical, {
+                runner: this.runner,
+                env: this.env,
+                fileSystem: this.fs,
+                timeout: this.timeout,
+            })
+            : 'unauthenticated';
         return {
             agent: detected.name,
             installed: detected.installed,
             version: detected.version,
             authenticated,
-            usable: detected.installed && detected.version !== null && authenticated,
+            // Liveness only: auth never gates runnability. A logged-out agent
+            // is usable (it fails at runtime with its own error).
+            usable: detected.installed && detected.version !== null,
             tier,
             channels: detected.channels,
             deprecated: detected.deprecated,
@@ -88,54 +64,4 @@ export class DoctorRunner {
             error: detected.error,
         };
     }
-    async checkAuth(agent) {
-        const home = this.env.HOME || this.env.USERPROFILE || '';
-        if (agent === 'gemini')
-            return this.geminiSettingsContainCredentials(home);
-        if (agent === 'codex')
-            return this.checkCodexAuth(home);
-        // pi and omp read provider keys from the environment; require a non-empty
-        // value rather than mere presence (an empty export is not a usable credential).
-        if ((agent === 'pi' || agent === 'omp') &&
-            (isNonEmpty(this.env.GOOGLE_API_KEY) || isNonEmpty(this.env.ANTHROPIC_API_KEY)))
-            return true;
-        return (await this.probeAuthOutput(agent)) === true;
-    }
-    async checkCodexAuth(home) {
-        const probeStatus = await this.probeAuthOutput('codex');
-        if (probeStatus !== null)
-            return probeStatus;
-        return ((await this.hasNonEmptyFile(joinPath(home, '.codex', 'auth.json'))) ||
-            (await this.hasNonEmptyFile(joinPath(home, '.codex', 'auth'))));
-    }
-    async geminiSettingsContainCredentials(home) {
-        try {
-            return /auth|token|key/i.test(await this.fs.readFile(joinPath(home, '.gemini', 'settings.json')));
-        }
-        catch {
-            return false;
-        }
-    }
-    async probeAuthOutput(agent) {
-        const command = this.runner.runAuthCommand(agent, { timeout: this.timeout });
-        const patterns = AUTH_PATTERNS[agent];
-        if (command === null || patterns === undefined)
-            return null;
-        const result = await command;
-        if (result.exitCode !== 0)
-            return false;
-        const output = `${result.stdout}\n${result.stderr}`;
-        if (patterns.negative.test(output))
-            return false;
-        if (patterns.positive.test(output))
-            return true;
-        return null;
-    }
-    /** True when the path exists and has a non-zero size. */
-    async hasNonEmptyFile(path) {
-        const stat = await this.fs.stat(path);
-        if (stat === null)
-            return false;
-        return stat.isFile() && stat.size > 0;
-    }
 }

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from './agent-detector';
 export * from './agent-spec';
+export * from './agents/auth-shims';
 export * from './agents/shims';
 export * from './ai-runner';
 export * from './doctor-runner';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
 export * from './agent-detector.js';
 export * from './agent-spec.js';
+export * from './agents/auth-shims.js';
 export * from './agents/shims.js';
 export * from './ai-runner.js';
 export * from './doctor-runner.js';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/ts-ai-runner",
-    "version": "0.3.21",
+    "version": "0.4.1",
     "description": "@gobing-ai/ts-ai-runner — Coding-agent shims, detection, doctor checks, and prompt execution.",
     "keywords": [
         "typescript",
@@ -47,9 +47,9 @@
         "release": "echo 'Manual publish is disabled. Releases go through GitHub Actions via Trusted Publishing — push a tag: git tag @gobing-ai/ts-ai-runner-v<version> && git push --tags' && exit 1"
     },
     "dependencies": {
-        "@gobing-ai/ts-db": "^0.3.21",
-        "@gobing-ai/ts-infra": "^0.3.21",
-        "@gobing-ai/ts-runtime": "^0.3.21"
+        "@gobing-ai/ts-db": "^0.4.1",
+        "@gobing-ai/ts-infra": "^0.4.1",
+        "@gobing-ai/ts-runtime": "^0.4.1"
     },
     "devDependencies": {
         "@types/bun": "1.3.14"

package/src/agents/auth-shims.ts

@@ -0,0 +1,153 @@
+import { type FileSystem, getProcessEnv, joinPath } from '@gobing-ai/ts-runtime';
+import type { AgentRunOptions, AgentRunResult, AiRunner } from '../ai-runner';
+import { type AgentName, getAgentShim } from './shims';
+
+/**
+ * Authentication state for a coding agent — **tri-state by design**.
+ *
+ * `unknown` is first-class: several agents have no reliable auth probe
+ * (no auth verb, no checkable credential file). Collapsing `unknown` to
+ * `unauthenticated` is exactly the false-negative that used to make
+ * `antigravity-cli` (no auth verb) and inconclusive probes report
+ * `usable: false` despite being runnable.
+ *
+ * Auth detection is **off the execution critical path**: {@link isAuthenticated}
+ * never feeds run-readiness — it is operator information only. A genuinely
+ * unauthenticated agent fails at runtime with its own error (auth is the
+ * agent's concern).
+ */
+export type AuthState = 'authenticated' | 'unauthenticated' | 'unknown';
+
+/** Context injected into {@link isAuthenticated}. */
+export interface AuthContext {
+    /** Runner used to execute auth probes. */
+    runner: AiRunner;
+    /** Environment map for env/file auth checks. Defaults to the process env. */
+    env?: Record<string, string | undefined>;
+    /** Filesystem for auth-file checks. Required — inject a fake in tests. */
+    fileSystem: FileSystem;
+    /** Auth probe timeout in milliseconds. */
+    timeout?: number;
+}
+
+const DEFAULT_AUTH_TIMEOUT_MS = 5_000;
+
+/**
+ * Per-agent auth-probe output patterns. A positive match ⇒ authenticated;
+ * a negative match ⇒ unauthenticated; neither (or no probe) ⇒ unknown.
+ */
+const AUTH_PATTERNS: Partial<Record<AgentName, { positive: RegExp; negative: RegExp }>> = {
+    claude: {
+        positive: /authenticated|logged[\s_-]*in|"loggedIn"\s*:\s*true/i,
+        negative:
+            /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|logged[\s_-]*out|unauthenticated|"loggedIn"\s*:\s*false/i,
+    },
+    codex: {
+        positive: /logged[\s_-]*in|authenticated/i,
+        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|logged[\s_-]*out|unauthenticated/i,
+    },
+    opencode: {
+        positive: /configured|available/i,
+        negative: /not[\s_-]*configured|no[\s_-]+providers?[\s_-]+available|unavailable/i,
+    },
+    openclaw: {
+        positive: /(^|[^a-z])ok([^a-z]|$)|healthy/i,
+        negative: /not[\s_-]*healthy|unhealthy|not[\s_-]*ok/i,
+    },
+    pi: {
+        positive: /\S/,
+        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|unauthenticated|no[\s_-]+providers?/i,
+    },
+    omp: {
+        positive: /\S/,
+        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|unauthenticated|no[\s_-]+providers?/i,
+    },
+    hermes: {
+        positive: /(^|[^a-z])ok([^a-z]|$)|healthy|configured|ready/i,
+        negative: /not[\s_-]*(configured|healthy|ok)|unhealthy|missing[\s_-]+dependenc|error|failed/i,
+    },
+};
+
+/** True when a value is a defined, non-blank string. */
+function isNonEmpty(value: string | undefined): boolean {
+    return value !== undefined && value.trim().length > 0;
+}
+
+/**
+ * Resolve a coding agent's authentication state.
+ *
+ * **Never throws.** Any probe failure, inconclusive output, or missing probe
+ * resolves to `unknown` rather than `unauthenticated` — see {@link AuthState}.
+ *
+ * Auth sources, in priority order per agent:
+ * - **gemini** — credential-like content in `~/.gemini/settings.json`.
+ * - **codex** — `codex login status` CLI output, falling back to an
+ *   `~/.codex/auth{.json,}` credential file.
+ * - **pi / omp** — a non-empty `GOOGLE_API_KEY` or `ANTHROPIC_API_KEY` in env
+ *   (an empty export is not a usable credential), else the CLI auth probe.
+ * - **others** — the shim's auth command; matched against {@link AUTH_PATTERNS}.
+ * - **no probe** (e.g. `antigravity-cli`) ⇒ `unknown`.
+ */
+export async function isAuthenticated(agent: AgentName, ctx: AuthContext): Promise<AuthState> {
+    const env = ctx.env ?? getProcessEnv();
+    const fs = ctx.fileSystem;
+    const timeout = ctx.timeout ?? DEFAULT_AUTH_TIMEOUT_MS;
+    const home = env.HOME || env.USERPROFILE || '';
+
+    if (agent === 'gemini') return geminiSettingsContainCredentials(fs, home);
+    if (agent === 'codex') return checkCodexAuth(ctx.runner, fs, home, timeout);
+
+    // pi and omp read provider keys from the environment; require a non-empty
+    // value rather than mere presence (an empty export is not a usable credential).
+    if ((agent === 'pi' || agent === 'omp') && (isNonEmpty(env.GOOGLE_API_KEY) || isNonEmpty(env.ANTHROPIC_API_KEY))) {
+        return 'authenticated';
+    }
+
+    return probeAuthOutput(ctx.runner, agent, timeout);
+}
+
+async function checkCodexAuth(runner: AiRunner, fs: FileSystem, home: string, timeout: number): Promise<AuthState> {
+    const probeStatus = await probeAuthOutput(runner, 'codex', timeout);
+    if (probeStatus !== 'unknown') return probeStatus;
+    const hasFile =
+        (await hasNonEmptyFile(fs, joinPath(home, '.codex', 'auth.json'))) ||
+        (await hasNonEmptyFile(fs, joinPath(home, '.codex', 'auth')));
+    return hasFile ? 'authenticated' : 'unknown';
+}
+
+async function geminiSettingsContainCredentials(fs: FileSystem, home: string): Promise<AuthState> {
+    try {
+        const content = await fs.readFile(joinPath(home, '.gemini', 'settings.json'));
+        return /auth|token|key/i.test(content) ? 'authenticated' : 'unauthenticated';
+    } catch {
+        // Missing or unreadable settings — auth state genuinely unknown.
+        return 'unknown';
+    }
+}
+
+async function probeAuthOutput(runner: AiRunner, agent: AgentName, timeout: number): Promise<AuthState> {
+    const options: AgentRunOptions = { timeout };
+    const command: Promise<AgentRunResult> | null = runner.runAuthCommand(agent, options);
+    const patterns = AUTH_PATTERNS[agent];
+    if (command === null || patterns === undefined) return 'unknown';
+    try {
+        const result = await command;
+        if (result.exitCode !== 0) return 'unauthenticated';
+        const output = `${result.stdout}\n${result.stderr}`;
+        if (patterns.negative.test(output)) return 'unauthenticated';
+        if (patterns.positive.test(output)) return 'authenticated';
+        return 'unknown';
+    } catch {
+        return 'unknown';
+    }
+}
+
+/** True when the path exists and has a non-zero size. */
+async function hasNonEmptyFile(fs: FileSystem, path: string): Promise<boolean> {
+    const stat = await fs.stat(path);
+    if (stat === null) return false;
+    return stat.isFile() && stat.size > 0;
+}
+
+// Re-exported so callers that only need the auth facet don't import getAgentShim directly.
+export { getAgentShim };

package/src/ai-runner.ts

@@ -31,6 +31,8 @@ export interface AgentRunOptions {
     cwd?: string;
     /** Timeout in milliseconds. */
     timeout?: number;
+    /** AbortSignal forwarded to ProcessExecutor — aborts the agent subprocess when fired. */
+    signal?: AbortSignal;
 }
 
 /** Constructor options for AiRunner. */
@@ -142,6 +144,7 @@ export class AiRunner {
             forceBuffered,
             cwd: options.cwd ?? this.defaultCwd,
             timeout: options.timeout ?? this.defaultTimeout,
+            ...(options.signal !== undefined ? { signal: options.signal } : {}),
         });
         if (result.exitCode !== 0) {
             this.logger.error('invoke exited non-zero', {

package/src/doctor-runner.ts

@@ -1,8 +1,9 @@
 import { getLogger, type Logger } from '@gobing-ai/ts-infra';
-import { createNodeFileSystem, type FileSystem, getProcessEnv, joinPath } from '@gobing-ai/ts-runtime';
+import { createNodeFileSystem, type FileSystem, getProcessEnv } from '@gobing-ai/ts-runtime';
 import { AgentDetector, type DetectedAgent } from './agent-detector';
+import { type AuthState, isAuthenticated } from './agents/auth-shims';
 import { type AgentName, DISPLAY_ORDER, resolveAgentName, TIER2_AGENTS } from './agents/shims';
-import { type AgentRunResult, AiRunner } from './ai-runner';
+import { AiRunner } from './ai-runner';
 
 /** Health-check result for one coding agent. */
 export interface DoctorResult {
@@ -12,9 +13,18 @@ export interface DoctorResult {
     installed: boolean;
     /** Human-readable version when installed. */
     version: string | null;
-    /** Whether the agent appears authenticated. */
-    authenticated: boolean;
-    /** Whether the agent is ready for direct use. */
+    /**
+     * Authentication state — **tri-state** (`authenticated | unauthenticated |
+     * unknown`). Informational only; never feeds {@link usable} or any
+     * run-readiness gate. A genuinely unauthenticated agent fails at runtime
+     * with its own error.
+     */
+    authenticated: AuthState;
+    /**
+     * Whether the agent is **runnable** — liveness only
+     * (`installed && version !== null`). Auth is NOT consulted: a logged-out
+     * agent is still `usable` (it will fail at runtime with its own auth error).
+     */
     usable: boolean;
     /** Capability tier: 1 = direct CLI, 2 = gateway/TUI constrained. */
     tier: 1 | 2;
@@ -45,44 +55,8 @@ export interface DoctorRunnerOptions {
 }
 
 const DEFAULT_TIMEOUT_MS = 5_000;
-const AUTH_PATTERNS: Partial<Record<AgentName, { positive: RegExp; negative: RegExp }>> = {
-    claude: {
-        positive: /authenticated|logged[\s_-]*in|"loggedIn"\s*:\s*true/i,
-        negative:
-            /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|logged[\s_-]*out|unauthenticated|"loggedIn"\s*:\s*false/i,
-    },
-    codex: {
-        positive: /logged[\s_-]*in|authenticated/i,
-        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|logged[\s_-]*out|unauthenticated/i,
-    },
-    opencode: {
-        positive: /configured|available/i,
-        negative: /not[\s_-]*configured|no[\s_-]+providers?[\s_-]+available|unavailable/i,
-    },
-    openclaw: {
-        positive: /(^|[^a-z])ok([^a-z]|$)|healthy/i,
-        negative: /not[\s_-]*healthy|unhealthy|not[\s_-]*ok/i,
-    },
-    pi: {
-        positive: /\S/,
-        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|unauthenticated|no[\s_-]+providers?/i,
-    },
-    omp: {
-        positive: /\S/,
-        negative: /not[\s_-]*authenticated|not[\s_-]*logged[\s_-]*in|unauthenticated|no[\s_-]+providers?/i,
-    },
-    hermes: {
-        positive: /(^|[^a-z])ok([^a-z]|$)|healthy|configured|ready/i,
-        negative: /not[\s_-]*(configured|healthy|ok)|unhealthy|missing[\s_-]+dependenc|error|failed/i,
-    },
-};
 
-/** True when a value is a defined, non-blank string. */
-function isNonEmpty(value: string | undefined): boolean {
-    return value !== undefined && value.trim().length > 0;
-}
-
-/** Runs installation and auth health checks for supported coding agents. */
+/** Runs installation, liveness, and auth health checks for supported coding agents. */
 export class DoctorRunner {
     private readonly detector: AgentDetector;
     private readonly runner: AiRunner;
@@ -128,13 +102,23 @@ export class DoctorRunner {
         const canonical = resolveAgentName(detected.name) ?? null;
         const tier = canonical !== null && TIER2_AGENTS.has(canonical) ? 2 : 1;
         this.logger.debug('checking agent', { agent: detected.name, installed: detected.installed, tier });
-        const authenticated = detected.installed && canonical !== null ? await this.checkAuth(canonical) : false;
+        const authenticated: AuthState =
+            detected.installed && canonical !== null
+                ? await isAuthenticated(canonical, {
+                      runner: this.runner,
+                      env: this.env,
+                      fileSystem: this.fs,
+                      timeout: this.timeout,
+                  })
+                : 'unauthenticated';
         return {
             agent: detected.name,
             installed: detected.installed,
             version: detected.version,
             authenticated,
-            usable: detected.installed && detected.version !== null && authenticated,
+            // Liveness only: auth never gates runnability. A logged-out agent
+            // is usable (it fails at runtime with its own error).
+            usable: detected.installed && detected.version !== null,
             tier,
             channels: detected.channels,
             deprecated: detected.deprecated,
@@ -142,54 +126,4 @@ export class DoctorRunner {
             error: detected.error,
         };
     }
-
-    private async checkAuth(agent: AgentName): Promise<boolean> {
-        const home = this.env.HOME || this.env.USERPROFILE || '';
-        if (agent === 'gemini') return this.geminiSettingsContainCredentials(home);
-        if (agent === 'codex') return this.checkCodexAuth(home);
-        // pi and omp read provider keys from the environment; require a non-empty
-        // value rather than mere presence (an empty export is not a usable credential).
-        if (
-            (agent === 'pi' || agent === 'omp') &&
-            (isNonEmpty(this.env.GOOGLE_API_KEY) || isNonEmpty(this.env.ANTHROPIC_API_KEY))
-        )
-            return true;
-        return (await this.probeAuthOutput(agent)) === true;
-    }
-
-    private async checkCodexAuth(home: string): Promise<boolean> {
-        const probeStatus = await this.probeAuthOutput('codex');
-        if (probeStatus !== null) return probeStatus;
-        return (
-            (await this.hasNonEmptyFile(joinPath(home, '.codex', 'auth.json'))) ||
-            (await this.hasNonEmptyFile(joinPath(home, '.codex', 'auth')))
-        );
-    }
-
-    private async geminiSettingsContainCredentials(home: string): Promise<boolean> {
-        try {
-            return /auth|token|key/i.test(await this.fs.readFile(joinPath(home, '.gemini', 'settings.json')));
-        } catch {
-            return false;
-        }
-    }
-
-    private async probeAuthOutput(agent: AgentName): Promise<boolean | null> {
-        const command = this.runner.runAuthCommand(agent, { timeout: this.timeout });
-        const patterns = AUTH_PATTERNS[agent];
-        if (command === null || patterns === undefined) return null;
-        const result: AgentRunResult = await command;
-        if (result.exitCode !== 0) return false;
-        const output = `${result.stdout}\n${result.stderr}`;
-        if (patterns.negative.test(output)) return false;
-        if (patterns.positive.test(output)) return true;
-        return null;
-    }
-
-    /** True when the path exists and has a non-zero size. */
-    private async hasNonEmptyFile(path: string): Promise<boolean> {
-        const stat = await this.fs.stat(path);
-        if (stat === null) return false;
-        return stat.isFile() && stat.size > 0;
-    }
 }

package/src/index.ts

@@ -1,5 +1,6 @@
 export * from './agent-detector';
 export * from './agent-spec';
+export * from './agents/auth-shims';
 export * from './agents/shims';
 export * from './ai-runner';
 export * from './doctor-runner';