@liustack/modlens 3.10.0 → 3.12.0

package/dist/main.js

@@ -13672,7 +13672,7 @@ function requireMockUtils() {
     }
     return normalizedQp;
   }
-  function safeUrl(path2) {
+  function safeUrl2(path2) {
     if (typeof path2 !== "string") {
       return path2;
     }
@@ -13710,10 +13710,10 @@ function requireMockUtils() {
   }
   function getMockDispatch(mockDispatches, key) {
     const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
-    const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
+    const resolvedPath = typeof basePath === "string" ? safeUrl2(basePath) : basePath;
     const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
     let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path2, ignoreTrailingSlash }) => {
-      return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path2)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path2), resolvedPath);
+      return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl2(path2)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl2(path2), resolvedPath);
     });
     if (matchedMockDispatches.length === 0) {
       throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -27236,15 +27236,6 @@ function parseIpv6Groups(groups) {
   }
   return parsed;
 }
-const MIME_BY_EXT = {
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".png": "image/png",
-  ".webp": "image/webp",
-  ".gif": "image/gif",
-  ".heic": "image/heic",
-  ".heif": "image/heif"
-};
 const MAX_REMOTE_IMAGE_BYTES = 25 * 1024 * 1024;
 const ALLOWED_MIME = /* @__PURE__ */ new Set([
   "image/png",
@@ -27270,8 +27261,27 @@ const SNIFFERS = [
   {
     mime: "image/webp",
     test: (b) => b.length >= 12 && b.toString("ascii", 0, 4) === "RIFF" && b.toString("ascii", 8, 12) === "WEBP"
+  },
+  // ISO BMFF: bytes 4-8 spell "ftyp" and the brand names the format. This
+  // closes the last extension-trust hole: heic/heif must now prove
+  // themselves from the header like every other type.
+  {
+    mime: "image/heic",
+    test: (b) => b.length >= 12 && b.toString("ascii", 4, 8) === "ftyp" && ["heic", "heix", "hevc", "hevx"].includes(b.toString("ascii", 8, 12))
+  },
+  {
+    mime: "image/heif",
+    test: (b) => b.length >= 12 && b.toString("ascii", 4, 8) === "ftyp" && ["mif1", "msf1", "heif"].includes(b.toString("ascii", 8, 12))
   }
 ];
+function safeUrl(url) {
+  try {
+    const u = new URL(url);
+    return `${u.origin}${u.pathname}`;
+  } catch {
+    return "<unparseable url>";
+  }
+}
 function sniffImageMime(buffer) {
   for (const { mime, test } of SNIFFERS) {
     if (test(buffer)) {
@@ -27280,22 +27290,13 @@ function sniffImageMime(buffer) {
   }
   return null;
 }
-function extMime(source) {
-  const ext = /^https?:\/\//i.test(source) ? path.extname(new URL(source).pathname).toLowerCase() : path.extname(source).toLowerCase();
-  return MIME_BY_EXT[ext] ?? null;
-}
-function resolveImageMime(buffer, source, contentType) {
+function resolveImageMime(buffer, source, _contentType) {
   const sniffed = sniffImageMime(buffer);
   if (sniffed) {
     return sniffed;
   }
-  const declared = contentType?.split(";")[0]?.trim().toLowerCase();
-  const candidate = extMime(source) ?? (declared?.startsWith("image/") ? declared : null);
-  if (candidate && ALLOWED_MIME.has(candidate)) {
-    return candidate;
-  }
   throw new Error(
-    `Unsupported or unrecognized image type for ${source}. Allowed: ${[...ALLOWED_MIME].join(", ")}.`
+    `Content of ${source} does not look like a supported image (its bytes match no known image header). Allowed types: ${[...ALLOWED_MIME].join(", ")}.`
   );
 }
 function readLocalImageBase64(filePath) {
@@ -27331,32 +27332,34 @@ async function fetchRemoteImageBase64(url, timeoutMs) {
         const location = response2.headers.get("location");
         if (!location) {
           throw new Error(
-            `Redirect response (${response2.status}) missing location header: ${current}`
+            `Redirect response (${response2.status}) missing location header: ${safeUrl(current.toString())}`
           );
         }
         await response2.body?.cancel();
         if (hop === MAX_REDIRECTS) {
-          throw new Error(`Too many redirects (max ${MAX_REDIRECTS}): ${url}`);
+          throw new Error(`Too many redirects (max ${MAX_REDIRECTS}): ${safeUrl(url)}`);
         }
         current = normalizeRemoteImageUrl(new URL(location, current).toString());
         continue;
       }
       if (!response2.ok) {
-        throw new Error(`Failed to download image (${response2.status}): ${current}`);
+        throw new Error(
+          `Failed to download image (${response2.status}): ${safeUrl(current.toString())}`
+        );
       }
       const declaredLength = Number(response2.headers.get("content-length"));
       if (Number.isFinite(declaredLength) && declaredLength > MAX_REMOTE_IMAGE_BYTES) {
         throw new Error(
-          `Remote image is ${declaredLength} bytes, over the ${MAX_REMOTE_IMAGE_BYTES}-byte limit: ${current}`
+          `Remote image is ${declaredLength} bytes, over the ${MAX_REMOTE_IMAGE_BYTES}-byte limit: ${safeUrl(current.toString())}`
         );
       }
       const finalUrl = current.toString();
       const buffer = await readCapped(response2, finalUrl);
       const contentType = response2.headers.get("content-type") ?? void 0;
-      const mimeType = resolveImageMime(buffer, finalUrl, contentType);
+      const mimeType = resolveImageMime(buffer, safeUrl(finalUrl), contentType);
       return { data: buffer.toString("base64"), mimeType };
     }
-    throw new Error(`Too many redirects (max ${MAX_REDIRECTS}): ${url}`);
+    throw new Error(`Too many redirects (max ${MAX_REDIRECTS}): ${safeUrl(url)}`);
   } finally {
     for (const dispatcher2 of dispatchers) {
       void dispatcher2.close();
@@ -27387,7 +27390,7 @@ async function readCapped(response2, url) {
     const buffer = Buffer.from(await response2.arrayBuffer());
     if (buffer.length > MAX_REMOTE_IMAGE_BYTES) {
       throw new Error(
-        `Remote image exceeds the ${MAX_REMOTE_IMAGE_BYTES}-byte limit: ${url}`
+        `Remote image exceeds the ${MAX_REMOTE_IMAGE_BYTES}-byte limit: ${safeUrl(url)}`
       );
     }
     return buffer;
@@ -27404,13 +27407,58 @@ async function readCapped(response2, url) {
     if (total > MAX_REMOTE_IMAGE_BYTES) {
       await reader.cancel();
       throw new Error(
-        `Remote image exceeds the ${MAX_REMOTE_IMAGE_BYTES}-byte limit: ${url}`
+        `Remote image exceeds the ${MAX_REMOTE_IMAGE_BYTES}-byte limit: ${safeUrl(url)}`
       );
     }
     chunks.push(Buffer.from(value));
   }
   return Buffer.concat(chunks);
 }
+function apiProxyDispatcher(explicitProxy, env) {
+  const proxy = explicitProxy?.trim();
+  if (proxy) {
+    return new undiciExports.ProxyAgent(proxy);
+  }
+  if (env.HTTPS_PROXY || env.https_proxy || env.HTTP_PROXY || env.http_proxy) {
+    return new undiciExports.EnvHttpProxyAgent();
+  }
+  return void 0;
+}
+const CONNECT_CODES = /* @__PURE__ */ new Set([
+  "UND_ERR_CONNECT_TIMEOUT",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ENOTFOUND",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "ETIMEDOUT"
+]);
+function connectFailureHint(error, url) {
+  const cause = error instanceof Error ? error.cause : void 0;
+  if (!cause?.code || !CONNECT_CODES.has(cause.code)) {
+    return null;
+  }
+  let host;
+  try {
+    host = new URL(url).host;
+  } catch {
+    return null;
+  }
+  return `Could not connect to ${host} (${cause.code}). The request never reached the network. If this machine reaches the internet through a proxy, set HTTPS_PROXY/HTTP_PROXY, or run: modlens config set proxy <url>`;
+}
+async function apiFetch(url, init, proxy, env = process.env) {
+  const dispatcher2 = apiProxyDispatcher(proxy, env);
+  try {
+    return await fetch(
+      url,
+      // `dispatcher` is a Node/undici extension to fetch's options.
+      dispatcher2 ? { ...init, dispatcher: dispatcher2 } : init
+    );
+  } catch (error) {
+    const hint = connectFailureHint(error, url);
+    throw hint ? new Error(hint, { cause: error }) : error;
+  }
+}
 const JSON_TEMPLATE_INSTRUCTION = `Respond with ONE JSON object only, no markdown fences, no commentary. Fill this exact structure with your findings from the image (do not repeat this template literally, replace every value):
 {"summary":"one paragraph describing the image","ocr":{"full_text":"all visible text","lines":[{"text":"one line","language":"en"}]},"layout":{"regions":[{"type":"title|subtitle|paragraph|list|table|chart|form|code|image|icon|other","reading_order":1,"text":"region text"}]},"semantics":{"scene":"what kind of scene","intent":"what the image is for","entities":[{"name":"entity","type":"kind","evidence":"where seen"}],"relations":[{"subject":"a","predicate":"relates to","object":"b"}]},"visual":{"dominant_colors":["color"],"style":"visual style","notes":["notable visual detail"]},"uncertainty":["anything unreadable or ambiguous"]}`;
 function buildVisionPrompt(options) {
@@ -27677,6 +27725,33 @@ function hasPath(value, dottedPath) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+const TOKEN_SHAPES = [
+  // Vendor-prefixed keys (OpenAI/Anthropic sk-, Stripe rk/pk, Slack xox*).
+  /\b(?:sk|rk|pk|xox[a-z])-[A-Za-z0-9_-]{12,}\b/g,
+  // Google API keys.
+  /\bAIza[A-Za-z0-9_-]{20,}\b/g,
+  // GitHub tokens.
+  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,
+  // JWTs (three base64url segments, the first spelling {"alg" or {"typ").
+  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}\b/g,
+  // Auth headers: "Bearer xyz" / "Authorization: xyz" (space form is real).
+  /\b(?:bearer|authorization)\b[=:\s]+"?[A-Za-z0-9._~+/-]{12,}"?/gi,
+  // Labeled keys need an explicit = or : separator; prose like
+  // "token limit_exceeded" is diagnostics, not a credential.
+  /\b(?:token|api[-_]?key)\b\s*[=:]\s*"?[A-Za-z0-9._~+/-]{12,}"?/gi
+];
+function redactSecrets(text, knownSecrets = []) {
+  let out = text;
+  for (const secret of knownSecrets) {
+    if (secret && secret.length >= 6) {
+      out = out.split(secret).join("[redacted]");
+    }
+  }
+  for (const shape of TOKEN_SHAPES) {
+    out = out.replace(shape, "[redacted]");
+  }
+  return out;
+}
 const ANTHROPIC_DEFAULT_MODEL = "claude-haiku-4-5-20251001";
 const DEFAULT_BASE_URL$1 = "https://api.anthropic.com";
 const TOOL_NAME = "report_vision_evidence";
@@ -27705,46 +27780,52 @@ async function executeAnthropicApi(options) {
 
 Report your findings by calling the ${TOOL_NAME} tool.`;
   const startedAt = Date.now();
-  const response2 = await fetch(`${baseUrl}/v1/messages`, {
-    method: "POST",
-    headers: {
-      "x-api-key": apiKey,
-      "anthropic-version": "2023-06-01",
-      "Content-Type": "application/json"
+  const response2 = await apiFetch(
+    `${baseUrl}/v1/messages`,
+    {
+      method: "POST",
+      headers: {
+        "x-api-key": apiKey,
+        "anthropic-version": "2023-06-01",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(
+        mergeExtraBody(
+          {
+            model,
+            max_tokens: 4096,
+            tools: [
+              {
+                name: TOOL_NAME,
+                description: "Report the structured visual evidence extracted from the image.",
+                input_schema: VISION_RESULT_SCHEMA
+              }
+            ],
+            tool_choice: { type: "tool", name: TOOL_NAME },
+            messages: [
+              {
+                role: "user",
+                content: [
+                  { type: "image", source: imageSource },
+                  { type: "text", text: prompt }
+                ]
+              }
+            ]
+          },
+          options.settings?.extraBody,
+          ["model", "messages", "tools", "tool_choice", "stream"],
+          "anthropic"
+        )
+      ),
+      signal: AbortSignal.timeout(options.timeoutMs)
     },
-    body: JSON.stringify(
-      mergeExtraBody(
-        {
-          model,
-          max_tokens: 4096,
-          tools: [
-            {
-              name: TOOL_NAME,
-              description: "Report the structured visual evidence extracted from the image.",
-              input_schema: VISION_RESULT_SCHEMA
-            }
-          ],
-          tool_choice: { type: "tool", name: TOOL_NAME },
-          messages: [
-            {
-              role: "user",
-              content: [
-                { type: "image", source: imageSource },
-                { type: "text", text: prompt }
-              ]
-            }
-          ]
-        },
-        options.settings?.extraBody,
-        ["model", "messages", "tools", "tool_choice", "stream"],
-        "anthropic"
-      )
-    ),
-    signal: AbortSignal.timeout(options.timeoutMs)
-  });
+    options.settings?.proxy
+  );
   if (!response2.ok) {
     const body2 = await response2.text();
-    throw new Error(`Anthropic API error ${response2.status}: ${truncate(body2)}`);
+    throw new Error(
+      `Anthropic API error ${response2.status}: ${truncate(redactSecrets(body2, [apiKey]))}`
+    );
   }
   const payload = await response2.json();
   const toolUse = payload.content?.find((block) => block.type === "tool_use");
@@ -28000,42 +28081,53 @@ async function executeGeminiApi(options) {
     extraPrompt: options.extraPrompt
   });
   const startedAt = Date.now();
-  const response2 = await fetch(`${baseUrl}/v1beta/models/${model}:generateContent`, {
-    method: "POST",
-    headers: {
-      "x-goog-api-key": apiKey,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(
-      mergeExtraBody(
-        {
-          contents: [
-            {
-              parts: [
-                { inline_data: { mime_type: image.mimeType, data: image.data } },
-                { text: prompt }
-              ]
+  const response2 = await apiFetch(
+    `${baseUrl}/v1beta/models/${model}:generateContent`,
+    {
+      method: "POST",
+      headers: {
+        "x-goog-api-key": apiKey,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(
+        mergeExtraBody(
+          {
+            contents: [
+              {
+                parts: [
+                  {
+                    inline_data: {
+                      mime_type: image.mimeType,
+                      data: image.data
+                    }
+                  },
+                  { text: prompt }
+                ]
+              }
+            ],
+            generationConfig: {
+              responseMimeType: "application/json",
+              responseJsonSchema: VISION_RESULT_SCHEMA
             }
+          },
+          options.settings?.extraBody,
+          [
+            "contents",
+            "generationConfig.responseMimeType",
+            "generationConfig.responseJsonSchema"
           ],
-          generationConfig: {
-            responseMimeType: "application/json",
-            responseJsonSchema: VISION_RESULT_SCHEMA
-          }
-        },
-        options.settings?.extraBody,
-        [
-          "contents",
-          "generationConfig.responseMimeType",
-          "generationConfig.responseJsonSchema"
-        ],
-        "gemini-api"
-      )
-    ),
-    signal: AbortSignal.timeout(options.timeoutMs)
-  });
+          "gemini-api"
+        )
+      ),
+      signal: AbortSignal.timeout(options.timeoutMs)
+    },
+    options.settings?.proxy
+  );
   if (!response2.ok) {
     const body2 = await response2.text();
-    throw new Error(`Gemini API error ${response2.status}: ${truncate(body2)}`);
+    throw new Error(
+      `Gemini API error ${response2.status}: ${truncate(redactSecrets(body2, [apiKey]))}`
+    );
   }
   const payload = await response2.json();
   const text = payload.candidates?.[0]?.content?.parts?.map((part) => part.text ?? "").join("");
@@ -28080,36 +28172,42 @@ async function executeOpenaiCompat(options) {
 
 ${JSON_TEMPLATE_INSTRUCTION}`;
   const startedAt = Date.now();
-  const response2 = await fetch(`${baseUrl}/chat/completions`, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${apiKey}`,
-      "Content-Type": "application/json"
+  const response2 = await apiFetch(
+    `${baseUrl}/chat/completions`,
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(
+        mergeExtraBody(
+          {
+            model,
+            messages: [
+              {
+                role: "user",
+                content: [
+                  { type: "image_url", image_url: { url: imageUrl } },
+                  { type: "text", text: prompt }
+                ]
+              }
+            ]
+          },
+          options.settings?.extraBody,
+          ["model", "messages", "stream"],
+          "openai"
+        )
+      ),
+      signal: AbortSignal.timeout(options.timeoutMs)
     },
-    body: JSON.stringify(
-      mergeExtraBody(
-        {
-          model,
-          messages: [
-            {
-              role: "user",
-              content: [
-                { type: "image_url", image_url: { url: imageUrl } },
-                { type: "text", text: prompt }
-              ]
-            }
-          ]
-        },
-        options.settings?.extraBody,
-        ["model", "messages", "stream"],
-        "openai"
-      )
-    ),
-    signal: AbortSignal.timeout(options.timeoutMs)
-  });
+    options.settings?.proxy
+  );
   if (!response2.ok) {
     const body2 = await response2.text();
-    throw new Error(`OpenAI-compatible API error ${response2.status}: ${truncate(body2)}`);
+    throw new Error(
+      `OpenAI-compatible API error ${response2.status}: ${truncate(redactSecrets(body2, [apiKey]))}`
+    );
   }
   const payload = await response2.json();
   const text = payload.choices?.[0]?.message?.content;
@@ -28174,7 +28272,7 @@ function providerAliases() {
 function listProviders() {
   return [...new Set(Object.values(PROVIDERS).map((provider) => provider.name))];
 }
-const STRING_FIELDS = ["apiKey", "baseUrl", "model"];
+const STRING_FIELDS = ["apiKey", "baseUrl", "model", "proxy"];
 const REUSE_HARNESSES = ["claude", "codex", "opencode", "pi", "grok"];
 const CONFIG_DIR = path.join(os.homedir(), ".modlens");
 const CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
@@ -28215,6 +28313,9 @@ function resolveProviderSettings(providerName, config2, env = process.env) {
   };
   const bindings = ENV_BINDINGS[providerName] ?? {};
   const settings = { ...fromFile };
+  if (!settings.proxy && config2.proxy?.trim()) {
+    settings.proxy = config2.proxy.trim();
+  }
   for (const [field, envName] of Object.entries(bindings)) {
     const value = env[envName]?.trim();
     if (value) {
@@ -28227,6 +28328,12 @@ function setConfigValue(dottedKey, value, configPath = CONFIG_PATH) {
   const config2 = loadConfigFile(configPath);
   if (dottedKey === "provider") {
     config2.provider = value;
+  } else if (dottedKey === "proxy") {
+    if (value.trim() === "") {
+      delete config2.proxy;
+    } else {
+      config2.proxy = value.trim();
+    }
   } else if (dottedKey.startsWith("reuse.")) {
     const harness = dottedKey.slice("reuse.".length);
     if (!REUSE_HARNESSES.includes(harness)) {
@@ -28271,7 +28378,7 @@ function setConfigValue(dottedKey, value, configPath = CONFIG_PATH) {
       }
     } else if (!STRING_FIELDS.includes(field)) {
       throw new Error(
-        `Unknown config field: ${field}. Use apiKey, baseUrl, model, or extraBody.`
+        `Unknown config field: ${field}. Use apiKey, baseUrl, model, proxy, or extraBody.`
       );
     } else {
       config2.providers ??= {};
@@ -28373,6 +28480,11 @@ function renderEffectiveConfig(config2, env = process.env) {
   if (config2.provider?.trim()) {
     effective.provider = config2.provider.trim();
   }
+  if (config2.proxy?.trim()) {
+    effective.proxy = `${config2.proxy.trim()} (file)`;
+  } else if (env.HTTPS_PROXY || env.https_proxy || env.HTTP_PROXY || env.http_proxy) {
+    effective.proxy = `${env.HTTPS_PROXY || env.https_proxy || env.HTTP_PROXY || env.http_proxy} (env)`;
+  }
   if (config2.guards) {
     const guards = {};
     if (config2.guards.denyModels !== void 0) {
@@ -28442,13 +28554,16 @@ const PROVIDER_DESCRIPTORS = [
 ];
 function findOnPath(bin, env) {
   const dirs = (env.PATH ?? "").split(path.delimiter).filter(Boolean);
+  const suffixes = process.platform === "win32" ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)] : [""];
   for (const dir of dirs) {
-    const full = path.join(dir, bin);
-    try {
-      if (fs.statSync(full).isFile()) {
-        return full;
+    for (const suffix of suffixes) {
+      const full = path.join(dir, bin + suffix);
+      try {
+        if (fs.statSync(full).isFile()) {
+          return full;
+        }
+      } catch {
       }
-    } catch {
     }
   }
   return null;
@@ -28609,7 +28724,10 @@ function probeCodex(env, home) {
         loggedIn,
         visionModels: [],
         source: "none",
-        error: error instanceof Error ? error.message : String(error)
+        error: redactSecrets(error instanceof Error ? error.message : String(error)).slice(
+          0,
+          200
+        )
       };
     }
   });
@@ -28682,7 +28800,10 @@ function probePi(env, home) {
         cliPath,
         visionModels: [],
         source: "none",
-        error: error instanceof Error ? error.message : String(error)
+        error: redactSecrets(error instanceof Error ? error.message : String(error)).slice(
+          0,
+          200
+        )
       };
     }
   });
@@ -28704,7 +28825,10 @@ function probeOpencode(env, runCli) {
         cliPath,
         visionModels: [],
         source: "none",
-        error: error instanceof Error ? error.message : String(error)
+        error: redactSecrets(error instanceof Error ? error.message : String(error)).slice(
+          0,
+          200
+        )
       };
     }
   });
@@ -29221,7 +29345,9 @@ async function analyzeImage(options) {
         provider: provider.name,
         ok: false,
         durationSeconds: (Date.now() - startedAt) / 1e3,
-        error: message.slice(0, 300)
+        // Providers redact their own errors, but attempts travel into
+        // output and model contexts, so the record gets the belt too.
+        error: redactSecrets(message).slice(0, 300)
       });
     }
   }
@@ -29444,7 +29570,9 @@ function runCommand(providerName, invocation, timeoutMs, describeFailure) {
         const explained = describeFailure?.({ stdout, stderr, code, startedAt: runStartedAt }) ?? null;
         reject(
           new Error(
-            explained ?? `${providerName} provider failed with code ${code}.${stderr ? ` stderr: ${stderr.trim()}` : ""}`
+            redactSecrets(
+              explained ?? `${providerName} provider failed with code ${code}.${stderr ? ` stderr: ${stderr.trim()}` : ""}`
+            )
           )
         );
         return;
@@ -29572,7 +29700,6 @@ function cwdMatches(recorded, wanted, bothDirections = false) {
   return bothDirections && resolvedWanted.startsWith(`${resolvedRecorded}${path.sep}`);
 }
 function transcriptBelongsTo(lines, cwd, bothDirections = false) {
-  let sawCwd = false;
   for (const line of lines) {
     if (!line.includes('"cwd"')) {
       continue;
@@ -29582,14 +29709,13 @@ function transcriptBelongsTo(lines, cwd, bothDirections = false) {
       if (typeof recorded !== "string") {
         continue;
       }
-      sawCwd = true;
       if (cwdMatches(recorded, cwd, bothDirections)) {
         return true;
       }
     } catch {
     }
   }
-  return !sawCwd;
+  return false;
 }
 function readLines(filePath) {
   try {
@@ -29718,16 +29844,19 @@ const claudeAdapter = jsonlAdapter({
 function opencodeDbPath() {
   return path.join(os.homedir(), ".local", "share", "opencode", "opencode.db");
 }
-function escapeLikePattern(value) {
-  return value.replace(/[\\%_]/g, (char) => `\\${char}`);
-}
-function opencodeDirectoryFilter(resolvedCwd) {
+function opencodeDirectoryFilter(resolvedCwd, caseInsensitive = process.platform === "win32") {
   const normalized = resolvedCwd.replace(/\\/g, "/");
-  const escaped = escapeLikePattern(normalized);
-  const dir = `REPLACE(session.directory, '\\', '/')`;
+  const cwd = caseInsensitive ? normalized.toLowerCase() : normalized;
+  const prefix = `${cwd.replace(/\/+$/, "")}/`;
+  const rawDir = `REPLACE(session.directory, '\\', '/')`;
+  const dir = caseInsensitive ? `LOWER(${rawDir})` : rawDir;
+  const dirPrefix = `RTRIM(${dir}, '/') || '/'`;
   return {
-    clause: `(${dir} = ? OR ${dir} LIKE ? || '/%' ESCAPE '\\' OR ? LIKE ${dir} || '/%' ESCAPE '\\')`,
-    params: [normalized, escaped, normalized]
+    // SQLite SUBSTR counts Unicode characters while JS .length counts
+    // UTF-16 units, so the length parameter is measured in code points
+    // ([...str].length) or an emoji in a path would shift the boundary.
+    clause: `(${dir} = ? OR SUBSTR(${dir}, 1, ?) = ? OR SUBSTR(?, 1, LENGTH(${dirPrefix})) = ${dirPrefix})`,
+    params: [cwd, [...prefix].length, prefix, cwd]
   };
 }
 function buildOpencodeQuery(resolvedCwd, sessionId) {
@@ -30175,8 +30304,13 @@ function inspectProvider(descriptor, config2, env) {
       name: descriptor.name,
       kind: "subprocess",
       ready: binaryPath !== null,
+      status: binaryPath !== null ? "installed" : "missing",
+      // "On PATH" proves installation, not a working login: doctor runs
+      // offline and spends nothing, so sign-in state stays unverified
+      // here and the first real read is the auth check.
+      authUnverified: binaryPath !== null,
       binaryPath,
-      detail: binaryPath ? `${descriptor.bin} found at ${binaryPath}` : `${descriptor.bin} not on PATH`,
+      detail: binaryPath ? `${descriptor.bin} found at ${binaryPath} (installed; sign-in not verified offline)` : `${descriptor.bin} not on PATH`,
       fix: binaryPath ? void 0 : descriptor.install
     };
   }
@@ -30194,6 +30328,7 @@ function inspectProvider(descriptor, config2, env) {
     name: descriptor.name,
     kind: "api",
     ready,
+    status: ready ? "ready" : "missing",
     settings: statuses,
     detail,
     fix: ready ? void 0 : descriptor.fix
@@ -30314,7 +30449,8 @@ function renderDoctorReport(report) {
   lines.push("");
   lines.push("Providers");
   for (const provider of report.providers) {
-    lines.push(`  ${mark(provider.ready)} ${provider.name}: ${provider.detail}`);
+    const providerMark = provider.ready && provider.authUnverified ? "[ok?]" : mark(provider.ready);
+    lines.push(`  ${providerMark} ${provider.name}: ${provider.detail}`);
     if (provider.fix) {
       lines.push(`       fix: ${provider.fix}`);
     }
@@ -30461,7 +30597,7 @@ function locateSource(cwd, adapters = ADAPTERS) {
     const blocked = blockers.length > 0 ? `
 Blocked: ${blockers.join(" | ")}` : "";
     throw new Error(
-      `No pasted images found in any session storage for this directory (looked in: ${dirs}). The user may not have pasted any, or the storage format changed; ask for a file path instead.${blocked}`
+      `No pasted images found in any session storage for this directory (looked in: ${dirs}). The user may not have pasted any, the storage format changed, or a legacy transcript records no cwd (ownership cannot be proven; an explicit --transcript path bypasses that check). Ask for a file path instead.${blocked}`
     );
   }
   return best.ref;
@@ -30528,7 +30664,7 @@ function recoverPastedImages(options = {}) {
   const all = source.extract();
   if (all.length === 0) {
     throw new Error(
-      `No pasted images found in ${source.location}. The user may not have pasted any, or the storage format changed; ask for a file path instead.`
+      `No pasted images found in ${source.location}. The user may not have pasted any, the storage format changed, or a legacy transcript records no cwd (ownership cannot be proven; an explicit --transcript path bypasses that check). Ask for a file path instead.`
     );
   }
   const outDir = prepareOutDir(options.outDir);
@@ -30560,16 +30696,19 @@ function recoverPastedImages(options = {}) {
   return result;
 }
 const program = new Command();
-program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.10.0");
+function parsePositiveInt(raw, flag) {
+  if (!/^\d+$/.test(raw.trim()) || Number.parseInt(raw, 10) <= 0) {
+    throw new Error(`Invalid ${flag}. Use a positive integer.`);
+  }
+  return Number.parseInt(raw, 10);
+}
+program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.12.0");
 program.command("analyze", { isDefault: true }).description("Analyze an image into structured JSON evidence (default command)").requiredOption("-i, --input <path|url>", "Input image path or https URL").option("-o, --output <path>", "Write result JSON to a file").option("-m, --model <name>", "Provider model name").option("-p, --provider <name>", `Vision provider (${listProviders().join(", ")})`).option("--prompt <text>", "Extra focus for this image").option("--timeout <ms>", "Provider timeout in milliseconds", "180000").option("--provider-bin <path>", "Provider binary path (default: agy)").option("--workdir <path>", "Working directory for the provider").option(
   "--extra-body <json>",
   `JSON merged into the API request body, e.g. '{"thinking":{"type":"disabled"}}'`
 ).action(async (options) => {
   try {
-    const timeoutMs = Number.parseInt(options.timeout, 10);
-    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
-      throw new Error("Invalid --timeout. Use a positive integer in milliseconds.");
-    }
+    const timeoutMs = parsePositiveInt(options.timeout, "--timeout (milliseconds)");
     const config2 = loadConfigFile();
     if (process.env.MODLENS_MODEL?.trim()) {
       const verdict = runGuard(config2.guards, {
@@ -30607,7 +30746,7 @@ program.command("analyze", { isDefault: true }).description("Analyze an image in
       `Error: ${error instanceof Error ? error.message : String(error)}
 `
     );
-    process.exit(1);
+    process.exitCode = 1;
   }
 });
 program.command("recover-paste").description(
@@ -30620,10 +30759,7 @@ program.command("recover-paste").description(
   "Force the storage scope: claude-code, pi, opencode, or none (default: auto-detect via process ancestry and env)"
 ).option("--cwd <path>", "Project directory the image was pasted in", process.cwd()).action(async (options) => {
   try {
-    const count = Number.parseInt(options.count, 10);
-    if (!Number.isFinite(count) || count <= 0) {
-      throw new Error("Invalid --count. Use a positive integer.");
-    }
+    const count = parsePositiveInt(options.count, "--count");
     const result = recoverPastedImages({
       count,
       outDir: options.outDir,
@@ -30639,7 +30775,7 @@ program.command("recover-paste").description(
       `Error: ${error instanceof Error ? error.message : String(error)}
 `
     );
-    process.exit(1);
+    process.exitCode = 1;
   }
 });
 program.command("guard").description(
@@ -30683,7 +30819,7 @@ program.command("doctor").description(
       `Error: ${error instanceof Error ? error.message : String(error)}
 `
     );
-    process.exit(1);
+    process.exitCode = 1;
   }
 });
 const config = program.command("config").description(`Manage ${CONFIG_PATH} (providers, keys, models)`);
@@ -30705,7 +30841,7 @@ config.command("init").description(`Create a starter config at ${CONFIG_PATH}`).
       `Error: ${error instanceof Error ? error.message : String(error)}
 `
     );
-    process.exit(1);
+    process.exitCode = 1;
   }
 });
 config.command("set <key> <value>").description("Set a value, e.g. modlens config set gemini-api.apiKey <key>").action((key, value) => {
@@ -30718,7 +30854,7 @@ config.command("set <key> <value>").description("Set a value, e.g. modlens confi
       `Error: ${error instanceof Error ? error.message : String(error)}
 `
     );
-    process.exit(1);
+    process.exitCode = 1;
   }
 });
 config.command("show").description("Print the effective config (file merged with env vars), API keys masked").action(() => {
@@ -30730,7 +30866,7 @@ config.command("show").description("Print the effective config (file merged with
       `Error: ${error instanceof Error ? error.message : String(error)}
 `
     );
-    process.exit(1);
+    process.exitCode = 1;
   }
 });
-program.parse();
+await program.parseAsync();