@liustack/modlens 3.3.0 → 3.5.0

package/dist/main.js

@@ -20,15 +20,14 @@ import require$$5$1 from "node:perf_hooks";
 import require$$8 from "node:util/types";
 import require$$2$1 from "node:worker_threads";
 import require$$2$2 from "node:crypto";
-import require$$1$1 from "node:sqlite";
 import require$$11 from "node:stream/web";
 import require$$0$6 from "node:url";
-import require$$1$2 from "node:async_hooks";
-import require$$1$3 from "node:console";
+import require$$1$1 from "node:async_hooks";
+import require$$1$2 from "node:console";
 import require$$0$7 from "node:fs/promises";
-import require$$1$4 from "node:path";
+import require$$1$3 from "node:path";
 import require$$2$3 from "node:timers";
-import require$$1$5 from "node:dns";
+import require$$1$4 from "node:dns";
 import * as dns$1 from "dns/promises";
 import { isIP } from "net";
 import { createRequire } from "module";
@@ -5654,7 +5653,7 @@ function requireRuntimeFeatures() {
   const lazyLoaders = {
     __proto__: null,
     "node:crypto": () => require$$2$2,
-    "node:sqlite": () => require$$1$1
+    "node:sqlite": () => require("node:sqlite")
   };
   function detectRuntimeFeatureByNodeModule(moduleName) {
     try {
@@ -12557,7 +12556,7 @@ function requireApiRequest() {
   if (hasRequiredApiRequest) return apiRequest.exports;
   hasRequiredApiRequest = 1;
   const assert = require$$0$1;
-  const { AsyncResource } = require$$1$2;
+  const { AsyncResource } = require$$1$1;
   const { Readable } = requireReadable();
   const { InvalidArgumentError, RequestAbortedError } = requireErrors();
   const util2 = requireUtil$5();
@@ -12810,7 +12809,7 @@ function requireApiStream() {
   if (hasRequiredApiStream) return apiStream;
   hasRequiredApiStream = 1;
   const assert = require$$0$1;
-  const { AsyncResource } = require$$1$2;
+  const { AsyncResource } = require$$1$1;
   const { InvalidArgumentError, InvalidReturnValueError } = requireErrors();
   const util2 = requireUtil$5();
   const { addSignal, removeSignal } = requireAbortSignal();
@@ -13025,7 +13024,7 @@ function requireApiPipeline() {
     PassThrough
   } = require$$0$2;
   const assert = require$$0$1;
-  const { AsyncResource } = require$$1$2;
+  const { AsyncResource } = require$$1$1;
   const {
     InvalidArgumentError,
     InvalidReturnValueError,
@@ -13227,7 +13226,7 @@ function requireApiUpgrade() {
   if (hasRequiredApiUpgrade) return apiUpgrade;
   hasRequiredApiUpgrade = 1;
   const { InvalidArgumentError, SocketError } = requireErrors();
-  const { AsyncResource } = require$$1$2;
+  const { AsyncResource } = require$$1$1;
   const assert = require$$0$1;
   const util2 = requireUtil$5();
   const { kHTTP2Stream } = requireSymbols();
@@ -13327,7 +13326,7 @@ function requireApiConnect() {
   if (hasRequiredApiConnect) return apiConnect;
   hasRequiredApiConnect = 1;
   const assert = require$$0$1;
-  const { AsyncResource } = require$$1$2;
+  const { AsyncResource } = require$$1$1;
   const { InvalidArgumentError, SocketError } = requireErrors();
   const util2 = requireUtil$5();
   const { addSignal, removeSignal } = requireAbortSignal();
@@ -14543,7 +14542,7 @@ function requirePendingInterceptorsFormatter() {
   if (hasRequiredPendingInterceptorsFormatter) return pendingInterceptorsFormatter;
   hasRequiredPendingInterceptorsFormatter = 1;
   const { Transform } = require$$0$2;
-  const { Console } = require$$1$3;
+  const { Console } = require$$1$2;
   const PERSISTENT = process.versions.icu ? "✅" : "Y ";
   const NOT_PERSISTENT = process.versions.icu ? "❌" : "N ";
   pendingInterceptorsFormatter = class PendingInterceptorsFormatter {
@@ -14854,7 +14853,7 @@ function requireSnapshotRecorder() {
   if (hasRequiredSnapshotRecorder) return snapshotRecorder;
   hasRequiredSnapshotRecorder = 1;
   const { writeFile, readFile, mkdir } = require$$0$7;
-  const { dirname, resolve } = require$$1$4;
+  const { dirname, resolve } = require$$1$3;
   const { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = require$$2$3;
   const { InvalidArgumentError, UndiciError } = requireErrors();
   const { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = requireSnapshotUtils();
@@ -16040,7 +16039,7 @@ function requireDns() {
   if (hasRequiredDns) return dns;
   hasRequiredDns = 1;
   const { isIP: isIP2 } = require$$1;
-  const { lookup } = require$$1$5;
+  const { lookup } = require$$1$4;
   const DecoratorHandler = requireDecoratorHandler();
   const { InvalidArgumentError, InformationalError } = requireErrors();
   const maxInt = Math.pow(2, 31) - 1;
@@ -19506,7 +19505,7 @@ function requireSqliteCacheStore() {
         }
       }
       if (!DatabaseSync) {
-        DatabaseSync = require$$1$1.DatabaseSync;
+        DatabaseSync = require("node:sqlite").DatabaseSync;
       }
       this.#db = new DatabaseSync(opts?.location ?? ":memory:");
       this.#db.exec(`
@@ -27515,6 +27514,13 @@ function tryParseJson(text) {
     return null;
   }
 }
+function parseJsonOrExplain(raw, origin) {
+  try {
+    return JSON.parse(raw);
+  } catch (error) {
+    throw new Error(`${origin} is not valid JSON: ${error.message}`);
+  }
+}
 function parseJsonLoose(text) {
   const trimmed = text.trim();
   const direct = tryParseJson(trimmed);
@@ -27549,6 +27555,49 @@ function parseBraceSlice(trimmed) {
 function truncate(text, max = 300) {
   return text.length > max ? `${text.slice(0, max)}...` : text;
 }
+function parseExtraBody(raw, origin) {
+  const parsed = parseJsonOrExplain(raw, origin);
+  if (!isPlainObject(parsed)) {
+    throw new Error(
+      `${origin} must be a JSON object, for example {"thinking":{"type":"disabled"}}`
+    );
+  }
+  return parsed;
+}
+function mergeExtraBody(body2, extra, reserved, providerName) {
+  if (!extra || Object.keys(extra).length === 0) {
+    return body2;
+  }
+  for (const path2 of reserved) {
+    if (hasPath(extra, path2)) {
+      throw new Error(
+        `extraBody cannot override "${path2}" for the ${providerName} provider: it carries the image, the prompt, or the schema this tool depends on. Remove that field from ${providerName}.extraBody (or --extra-body).`
+      );
+    }
+  }
+  return deepMerge(body2, extra);
+}
+function deepMerge(base, overlay) {
+  const merged = { ...base };
+  for (const [key, value] of Object.entries(overlay)) {
+    const current = merged[key];
+    merged[key] = isPlainObject(current) && isPlainObject(value) ? deepMerge(current, value) : value;
+  }
+  return merged;
+}
+function hasPath(value, dottedPath) {
+  let cursor = value;
+  for (const segment of dottedPath.split(".")) {
+    if (!isPlainObject(cursor) || !Object.hasOwn(cursor, segment)) {
+      return false;
+    }
+    cursor = cursor[segment];
+  }
+  return true;
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 const ANTHROPIC_DEFAULT_MODEL = "claude-haiku-4-5-20251001";
 const DEFAULT_BASE_URL$1 = "https://api.anthropic.com";
 const TOOL_NAME = "report_vision_evidence";
@@ -27584,27 +27633,34 @@ Report your findings by calling the ${TOOL_NAME} tool.`;
       "anthropic-version": "2023-06-01",
       "Content-Type": "application/json"
     },
-    body: JSON.stringify({
-      model,
-      max_tokens: 4096,
-      tools: [
-        {
-          name: TOOL_NAME,
-          description: "Report the structured visual evidence extracted from the image.",
-          input_schema: VISION_RESULT_SCHEMA
-        }
-      ],
-      tool_choice: { type: "tool", name: TOOL_NAME },
-      messages: [
+    body: JSON.stringify(
+      mergeExtraBody(
         {
-          role: "user",
-          content: [
-            { type: "image", source: imageSource },
-            { type: "text", text: prompt }
+          model,
+          max_tokens: 4096,
+          tools: [
+            {
+              name: TOOL_NAME,
+              description: "Report the structured visual evidence extracted from the image.",
+              input_schema: VISION_RESULT_SCHEMA
+            }
+          ],
+          tool_choice: { type: "tool", name: TOOL_NAME },
+          messages: [
+            {
+              role: "user",
+              content: [
+                { type: "image", source: imageSource },
+                { type: "text", text: prompt }
+              ]
+            }
           ]
-        }
-      ]
-    }),
+        },
+        options.settings?.extraBody,
+        ["model", "messages", "tools", "tool_choice", "stream"],
+        "anthropic"
+      )
+    ),
     signal: AbortSignal.timeout(options.timeoutMs)
   });
   if (!response2.ok) {
@@ -27871,20 +27927,31 @@ async function executeGeminiApi(options) {
       "x-goog-api-key": apiKey,
       "Content-Type": "application/json"
     },
-    body: JSON.stringify({
-      contents: [
+    body: JSON.stringify(
+      mergeExtraBody(
         {
-          parts: [
-            { inline_data: { mime_type: image.mimeType, data: image.data } },
-            { text: prompt }
-          ]
-        }
-      ],
-      generationConfig: {
-        responseMimeType: "application/json",
-        responseJsonSchema: VISION_RESULT_SCHEMA
-      }
-    }),
+          contents: [
+            {
+              parts: [
+                { inline_data: { mime_type: image.mimeType, data: image.data } },
+                { text: prompt }
+              ]
+            }
+          ],
+          generationConfig: {
+            responseMimeType: "application/json",
+            responseJsonSchema: VISION_RESULT_SCHEMA
+          }
+        },
+        options.settings?.extraBody,
+        [
+          "contents",
+          "generationConfig.responseMimeType",
+          "generationConfig.responseJsonSchema"
+        ],
+        "gemini-api"
+      )
+    ),
     signal: AbortSignal.timeout(options.timeoutMs)
   });
   if (!response2.ok) {
@@ -27941,18 +28008,25 @@ Respond with ONE JSON object only, no markdown fences, no commentary. Fill this
       Authorization: `Bearer ${apiKey}`,
       "Content-Type": "application/json"
     },
-    body: JSON.stringify({
-      model,
-      messages: [
+    body: JSON.stringify(
+      mergeExtraBody(
         {
-          role: "user",
-          content: [
-            { type: "image_url", image_url: { url: imageUrl } },
-            { type: "text", text: prompt }
+          model,
+          messages: [
+            {
+              role: "user",
+              content: [
+                { type: "image_url", image_url: { url: imageUrl } },
+                { type: "text", text: prompt }
+              ]
+            }
           ]
-        }
-      ]
-    }),
+        },
+        options.settings?.extraBody,
+        ["model", "messages", "stream"],
+        "openai"
+      )
+    ),
     signal: AbortSignal.timeout(options.timeoutMs)
   });
   if (!response2.ok) {
@@ -28022,6 +28096,7 @@ function providerAliases() {
 function listProviders() {
   return [...new Set(Object.values(PROVIDERS).map((provider) => provider.name))];
 }
+const STRING_FIELDS = ["apiKey", "baseUrl", "model"];
 const CONFIG_DIR = path.join(os.homedir(), ".modlens");
 const CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 const ENV_BINDINGS = {
@@ -28073,21 +28148,37 @@ function setConfigValue(dottedKey, value, configPath = CONFIG_PATH) {
   const config2 = loadConfigFile(configPath);
   if (dottedKey === "provider") {
     config2.provider = value;
+  } else if (dottedKey.startsWith("guards.")) {
+    setGuardsValue(config2, dottedKey.slice("guards.".length), value);
   } else {
     const dot = dottedKey.indexOf(".");
     if (dot <= 0 || dot === dottedKey.length - 1) {
       throw new Error(
-        `Invalid config key: ${dottedKey}. Use "provider" or "<provider>.<apiKey|baseUrl|model>".`
+        `Invalid config key: ${dottedKey}. Use "provider", "guards.<denyModels|denyWhenUnknown>", or "<provider>.<apiKey|baseUrl|model|extraBody>".`
       );
     }
     const providerName = dottedKey.slice(0, dot);
     const field = dottedKey.slice(dot + 1);
-    if (!["apiKey", "baseUrl", "model"].includes(field)) {
-      throw new Error(`Unknown config field: ${field}. Use apiKey, baseUrl, or model.`);
+    if (field === "extraBody") {
+      config2.providers ??= {};
+      config2.providers[providerName] ??= {};
+      if (value.trim() === "") {
+        delete config2.providers[providerName].extraBody;
+      } else {
+        config2.providers[providerName].extraBody = parseExtraBody(
+          value,
+          `${providerName}.extraBody`
+        );
+      }
+    } else if (!STRING_FIELDS.includes(field)) {
+      throw new Error(
+        `Unknown config field: ${field}. Use apiKey, baseUrl, model, or extraBody.`
+      );
+    } else {
+      config2.providers ??= {};
+      config2.providers[providerName] ??= {};
+      config2.providers[providerName][field] = value;
     }
-    config2.providers ??= {};
-    config2.providers[providerName] ??= {};
-    config2.providers[providerName][field] = value;
   }
   fs.mkdirSync(path.dirname(configPath), { recursive: true });
   fs.writeFileSync(configPath, `${JSON.stringify(config2, null, 2)}
@@ -28097,6 +28188,38 @@ function setConfigValue(dottedKey, value, configPath = CONFIG_PATH) {
   } catch {
   }
 }
+function setGuardsValue(config2, field, value) {
+  if (field === "denyModels") {
+    if (value.trim() === "") {
+      delete config2.guards?.denyModels;
+    } else {
+      config2.guards ??= {};
+      config2.guards.denyModels = parseModelList(value);
+    }
+  } else if (field === "denyWhenUnknown") {
+    const normalized = value.trim().toLowerCase();
+    if (normalized !== "true" && normalized !== "false") {
+      throw new Error("guards.denyWhenUnknown must be true or false.");
+    }
+    config2.guards ??= {};
+    config2.guards.denyWhenUnknown = normalized === "true";
+  } else {
+    throw new Error(`Unknown guards field: ${field}. Use denyModels or denyWhenUnknown.`);
+  }
+  if (config2.guards && Object.keys(config2.guards).length === 0) {
+    delete config2.guards;
+  }
+}
+function parseModelList(value) {
+  if (value.trim().startsWith("[")) {
+    const parsed = parseJsonOrExplain(value, "guards.denyModels");
+    if (!Array.isArray(parsed) || parsed.some((item) => typeof item !== "string")) {
+      throw new Error("guards.denyModels must be a JSON array of glob strings.");
+    }
+    return parsed;
+  }
+  return value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+}
 const CONFIG_TEMPLATE = {
   // Empty means the built-in default provider.
   provider: "",
@@ -28126,7 +28249,7 @@ function renderEffectiveConfig(config2, env = process.env) {
     const fileSettings = config2.providers?.[name] ?? {};
     const bindings = ENV_BINDINGS[name] ?? {};
     const fields = {};
-    for (const field of ["apiKey", "baseUrl", "model"]) {
+    for (const field of STRING_FIELDS) {
       const envName = bindings[field];
       const envValue = envName ? env[envName]?.trim() : void 0;
       const value = envValue ?? fileSettings[field];
@@ -28136,6 +28259,9 @@ function renderEffectiveConfig(config2, env = process.env) {
         fields[field] = `${shown} (${source})`;
       }
     }
+    if (fileSettings.extraBody !== void 0) {
+      fields.extraBody = `${JSON.stringify(fileSettings.extraBody)} (file)`;
+    }
     if (Object.keys(fields).length > 0) {
       providers[name] = fields;
     }
@@ -28146,6 +28272,18 @@ function renderEffectiveConfig(config2, env = process.env) {
   if (config2.provider?.trim()) {
     effective.provider = config2.provider.trim();
   }
+  if (config2.guards) {
+    const guards = {};
+    if (config2.guards.denyModels !== void 0) {
+      guards.denyModels = `${JSON.stringify(config2.guards.denyModels)} (file)`;
+    }
+    if (config2.guards.denyWhenUnknown !== void 0) {
+      guards.denyWhenUnknown = `${config2.guards.denyWhenUnknown} (file)`;
+    }
+    if (Object.keys(guards).length > 0) {
+      effective.guards = guards;
+    }
+  }
   return JSON.stringify(effective, null, 2);
 }
 function maskKey(key) {
@@ -28273,7 +28411,8 @@ async function analyzeImage(options) {
         options,
         resolvedInput,
         timeoutMs,
-        config2
+        config2,
+        warnings
       );
       attempts.push({
         provider: provider.name,
@@ -28323,8 +28462,14 @@ async function analyzeImage(options) {
     `Every configured vision provider failed for this image. ${attempts.map((attempt) => `${attempt.provider}: ${attempt.error}`).join(" | ")}`
   );
 }
-async function runProvider(provider, model, options, resolvedInput, timeoutMs, config2) {
-  const settings = resolveProviderSettings(provider.name, config2);
+async function runProvider(provider, model, options, resolvedInput, timeoutMs, config2, warnings) {
+  const configured = resolveProviderSettings(provider.name, config2);
+  const settings = options.extraBody ? { ...configured, extraBody: options.extraBody } : configured;
+  if (settings.extraBody && !provider.execute) {
+    warnings.push(
+      `${provider.name} is a CLI provider and takes no request body, so extraBody was ignored for this run.`
+    );
+  }
   const providerOptions = {
     imageSource: resolvedInput.source,
     imageKind: resolvedInput.kind,
@@ -28579,192 +28724,15 @@ function detectHarnessDetailed() {
 function detectHarness() {
   return detectHarnessDetailed().harness;
 }
-const MIN_NODE = "22.13";
-function versionParts(version) {
-  const match = /(\d+)\.(\d+)/.exec(version.replace(/^v/, ""));
-  if (!match) {
-    return [0, 0];
-  }
-  return [Number(match[1]), Number(match[2])];
-}
-function meetsMinimum(version, minimum) {
-  const [major, minor] = versionParts(version);
-  const [minMajor, minMinor] = versionParts(minimum);
-  return major > minMajor || major === minMajor && minor >= minMinor;
-}
-function checkNodeSqlite() {
-  const realEmit = process.emitWarning;
-  process.emitWarning = () => {
-  };
-  try {
-    const mod = createRequire(import.meta.url)("node:sqlite");
-    if (mod?.DatabaseSync) {
-      return {
-        available: true,
-        detail: "node:sqlite is available (OpenCode paste recovery)"
-      };
-    }
-    return { available: false, detail: "node:sqlite loaded but DatabaseSync is missing" };
-  } catch {
-    return {
-      available: false,
-      detail: "node:sqlite unavailable. Upgrade Node to 22.13+ for OpenCode paste recovery"
-    };
-  } finally {
-    process.emitWarning = realEmit;
-  }
-}
-function inspectProvider(descriptor, config2, env) {
-  if (descriptor.kind === "subprocess") {
-    const binaryPath = findOnPath(descriptor.bin, env);
-    return {
-      name: descriptor.name,
-      kind: "subprocess",
-      ready: binaryPath !== null,
-      binaryPath,
-      detail: binaryPath ? `${descriptor.bin} found at ${binaryPath}` : `${descriptor.bin} not on PATH`,
-      fix: binaryPath ? void 0 : descriptor.install
-    };
-  }
-  const settings = resolveProviderSettings(descriptor.name, config2, env);
-  const statuses = (descriptor.required ?? []).map((req) => {
-    const envValue = req.env ? env[req.env]?.trim() : void 0;
-    const value = settings[req.field]?.trim();
-    const source = envValue ? "env" : value ? "file" : "missing";
-    return { field: req.field, present: Boolean(value), source, env: req.env };
-  });
-  const missing = statuses.filter((s) => !s.present).map((s) => s.field);
-  const ready = missing.length === 0;
-  const detail = ready ? statuses.map((s) => `${s.field}: ${s.source}`).join(", ") : `missing: ${missing.join(", ")}`;
-  return {
-    name: descriptor.name,
-    kind: "api",
-    ready,
-    settings: statuses,
-    detail,
-    fix: ready ? void 0 : descriptor.fix
-  };
-}
-function resolveSelection(config2, providerFlag) {
-  const raw = providerFlag?.trim() || config2.provider?.trim() || "antigravity-cli";
-  const source = providerFlag?.trim() ? "flag" : config2.provider?.trim() ? "config" : "default";
-  let canonical;
-  try {
-    canonical = resolveProvider(raw).name;
-  } catch {
-    canonical = null;
-  }
-  const reason = source === "flag" ? `-p ${raw} on the command line` : source === "config" ? "provider set in the config file" : "built-in default (no -p flag and no provider in the config file)";
-  return { provider: raw, canonical, source, reason };
-}
-function inspectConfigFile(configPath) {
-  try {
-    const stat = fs.statSync(configPath);
-    const mode = stat.mode & 511;
-    const enforcesPosixPerms = typeof process.getuid === "function";
-    const permissionsOk = !enforcesPosixPerms || (mode & 63) === 0;
-    return {
-      path: configPath,
-      exists: true,
-      mode: mode.toString(8).padStart(3, "0"),
-      permissionsOk,
-      note: permissionsOk ? void 0 : "group/world can read this file. Run: chmod 600 to lock it down"
-    };
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return {
-        path: configPath,
-        exists: false,
-        mode: null,
-        permissionsOk: true,
-        note: "no config file (using env vars and built-in defaults)"
-      };
-    }
-    return {
-      path: configPath,
-      exists: true,
-      mode: null,
-      permissionsOk: false,
-      note: `cannot stat: ${error.message}`
-    };
-  }
-}
-function buildDoctorReport(input) {
-  const env = input.env ?? process.env;
-  const configPath = input.configPath ?? CONFIG_PATH;
-  return {
-    node: {
-      version: process.version,
-      minimum: MIN_NODE,
-      meetsMinimum: meetsMinimum(process.version, MIN_NODE)
-    },
-    nodeSqlite: checkNodeSqlite(),
-    providers: PROVIDER_DESCRIPTORS.map((d) => inspectProvider(d, input.config, env)),
-    selection: resolveSelection(input.config, input.providerFlag),
-    chains: {
-      local: providerChain("local", input.config, env).map((p) => p.name),
-      remote: providerChain("remote", input.config, env).map((p) => p.name)
-    },
-    harness: (() => {
-      const detection = detectHarnessDetailed();
-      return { detected: detection.harness, source: detection.source };
-    })(),
-    config: inspectConfigFile(configPath)
-  };
-}
-function mark(ok) {
-  return ok ? "[ok]" : "[!!]";
-}
-function renderDoctorReport(report) {
-  const lines = [];
-  lines.push("modlens doctor");
-  lines.push("(local diagnostics only: no network calls, no provider quota spent)");
-  lines.push("");
-  lines.push("Node");
-  lines.push(
-    `  ${mark(report.node.meetsMinimum)} ${report.node.version} (minimum ${report.node.minimum})`
-  );
-  lines.push(`  ${mark(report.nodeSqlite.available)} ${report.nodeSqlite.detail}`);
-  lines.push("");
-  lines.push("Providers");
-  for (const provider of report.providers) {
-    lines.push(`  ${mark(provider.ready)} ${provider.name}: ${provider.detail}`);
-    if (provider.fix) {
-      lines.push(`       fix: ${provider.fix}`);
-    }
-  }
-  lines.push("");
-  lines.push("Selected provider");
-  const canonicalNote = report.selection.canonical && report.selection.canonical !== report.selection.provider ? ` (canonical: ${report.selection.canonical})` : report.selection.canonical === null ? " (unknown provider name)" : "";
-  lines.push(`  ${report.selection.provider}${canonicalNote}`);
-  lines.push(`  reason: ${report.selection.reason}`);
-  lines.push("");
-  lines.push("Failover chains (what a run tries, in order)");
-  const chainLine = (chain) => chain.length > 0 ? chain.join(" -> ") : "(none available)";
-  lines.push(`  local:  ${chainLine(report.chains.local)}`);
-  lines.push(`  remote: ${chainLine(report.chains.remote)}`);
-  lines.push("");
-  lines.push("Harness");
-  lines.push(
-    report.harness.detected ? `  ${report.harness.detected} (via ${report.harness.source})` : `  none detected (${report.harness.source})`
-  );
-  lines.push("");
-  lines.push("Config file");
-  lines.push(`  path: ${report.config.path}`);
-  if (report.config.exists) {
-    lines.push(
-      `  ${mark(report.config.permissionsOk)} exists, mode ${report.config.mode ?? "?"}`
-    );
-  } else {
-    lines.push("  not present");
-  }
-  if (report.config.note) {
-    lines.push(`  note: ${report.config.note}`);
+function cwdMatches(recorded, wanted, bothDirections = false) {
+  const resolvedRecorded = path.resolve(recorded);
+  const resolvedWanted = path.resolve(wanted);
+  if (resolvedRecorded === resolvedWanted || resolvedRecorded.startsWith(`${resolvedWanted}${path.sep}`)) {
+    return true;
   }
-  return lines.join("\n");
+  return bothDirections && resolvedWanted.startsWith(`${resolvedRecorded}${path.sep}`);
 }
-function transcriptBelongsTo(lines, cwd) {
-  const wanted = path.resolve(cwd);
+function transcriptBelongsTo(lines, cwd, bothDirections = false) {
   let sawCwd = false;
   for (const line of lines) {
     if (!line.includes('"cwd"')) {
@@ -28776,8 +28744,7 @@ function transcriptBelongsTo(lines, cwd) {
         continue;
       }
       sawCwd = true;
-      const resolved = path.resolve(recorded);
-      if (resolved === wanted || resolved.startsWith(`${wanted}${path.sep}`)) {
+      if (cwdMatches(recorded, cwd, bothDirections)) {
         return true;
       }
     } catch {
@@ -28844,8 +28811,17 @@ function listJsonl(dir) {
     return [];
   }
 }
-function jsonlAdapter(options) {
-  const { name, dirFor, matchesSession, extractLine } = options;
+function listJsonlByMtimeDesc(dir) {
+  return listJsonl(dir).map((file) => {
+    try {
+      return { file, mtime: fs.statSync(file).mtimeMs };
+    } catch {
+      return null;
+    }
+  }).filter((entry) => entry !== null).sort((a, b) => b.mtime - a.mtime).map((entry) => entry.file);
+}
+function jsonlAdapter(options) {
+  const { name, dirFor, matchesSession, extractLine } = options;
   return {
     name,
     describe: (cwd) => dirFor(cwd),
@@ -28906,13 +28882,19 @@ function opencodeDbPath() {
 function escapeLikePattern(value) {
   return value.replace(/[\\%_]/g, (char) => `\\${char}`);
 }
-function buildOpencodeQuery(resolvedCwd, sessionId) {
+function opencodeDirectoryFilter(resolvedCwd) {
   const normalized = resolvedCwd.replace(/\\/g, "/");
   const escaped = escapeLikePattern(normalized);
   const dir = `REPLACE(session.directory, '\\', '/')`;
-  const directoryFilter = `(${dir} = ? OR ${dir} LIKE ? || '/%' ESCAPE '\\' OR ? LIKE ${dir} || '/%' ESCAPE '\\')`;
-  const sessionFilter = sessionId ? `AND ${directoryFilter} AND (session.id = ? OR session.slug = ?)` : `AND ${directoryFilter}`;
-  const params = sessionId ? [normalized, escaped, normalized, sessionId, sessionId] : [normalized, escaped, normalized];
+  return {
+    clause: `(${dir} = ? OR ${dir} LIKE ? || '/%' ESCAPE '\\' OR ? LIKE ${dir} || '/%' ESCAPE '\\')`,
+    params: [normalized, escaped, normalized]
+  };
+}
+function buildOpencodeQuery(resolvedCwd, sessionId) {
+  const directory = opencodeDirectoryFilter(resolvedCwd);
+  const sessionFilter = sessionId ? `AND ${directory.clause} AND (session.id = ? OR session.slug = ?)` : `AND ${directory.clause}`;
+  const params = sessionId ? [...directory.params, sessionId, sessionId] : directory.params;
   const sql = `SELECT part.data AS data, part.time_created AS time_created, part.session_id AS session_id
                  FROM part
                  JOIN message ON message.id = part.message_id
@@ -28923,12 +28905,17 @@ function buildOpencodeQuery(resolvedCwd, sessionId) {
                  ORDER BY part.time_created ASC`;
   return { sql, params };
 }
-function opencodeQuery(dbPath, cwd, sessionId) {
-  let DatabaseSync;
+function loadNodeSqlite() {
   try {
     const nodeRequire = createRequire(import.meta.url);
-    ({ DatabaseSync } = nodeRequire("node:sqlite"));
+    return nodeRequire("node:sqlite").DatabaseSync;
   } catch {
+    return null;
+  }
+}
+function opencodeQuery(dbPath, cwd, sessionId) {
+  const DatabaseSync = loadNodeSqlite();
+  if (!DatabaseSync) {
     throw new Error(
       "Reading opencode storage needs the node:sqlite module (unflagged on Node 22.13+). Upgrade Node, or pass --transcript/--session for a JSONL-based harness."
     );
@@ -29029,6 +29016,541 @@ const piAdapter = jsonlAdapter({
   matchesSession: (fileName, sessionId) => fileName.endsWith(`_${sessionId}.jsonl`),
   extractLine: piExtractLine
 });
+const WINDOW_BYTES = 512 * 1024;
+function readWindowedLines(file, maxBytes = WINDOW_BYTES) {
+  let fd;
+  try {
+    fd = fs.openSync(file, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const size = fs.fstatSync(fd).size;
+    if (size <= 2 * maxBytes) {
+      const whole = Buffer.alloc(size);
+      fs.readSync(fd, whole, 0, size, 0);
+      return whole.toString("utf-8").split("\n");
+    }
+    const head = Buffer.alloc(maxBytes);
+    fs.readSync(fd, head, 0, maxBytes, 0);
+    const tail = Buffer.alloc(maxBytes);
+    fs.readSync(fd, tail, 0, maxBytes, size - maxBytes);
+    const headLines = head.toString("utf-8").split("\n");
+    headLines.pop();
+    const tailLines = tail.toString("utf-8").split("\n");
+    tailLines.shift();
+    return [...headLines, ...tailLines];
+  } catch {
+    return null;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+function lastAssistantModelFromLines(lines) {
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!line.includes('"model"')) {
+      continue;
+    }
+    try {
+      const message = JSON.parse(line).message;
+      if (message?.role === "assistant" && typeof message.model === "string") {
+        const found = { model: message.model };
+        if (typeof message.provider === "string") {
+          found.provider = message.provider;
+        }
+        return found;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function lastCodexModelFromLines(lines) {
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!line.includes('"turn_context"')) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(line);
+      if (parsed.type === "turn_context" && typeof parsed.payload?.model === "string") {
+        return parsed.payload.model;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function codexTranscriptBelongsTo(lines, cwd) {
+  for (const line of lines) {
+    if (!line.includes('"cwd"')) {
+      continue;
+    }
+    try {
+      const recorded = JSON.parse(line).payload?.cwd;
+      if (typeof recorded === "string" && cwdMatches(recorded, cwd, true)) {
+        return true;
+      }
+    } catch {
+    }
+  }
+  return false;
+}
+function* cwdAncestors(cwd) {
+  let current = path.resolve(cwd);
+  for (; ; ) {
+    yield current;
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return;
+    }
+    current = parent;
+  }
+}
+function newestAssistantModelInDir(dir, cwd) {
+  for (const file of listJsonlByMtimeDesc(dir)) {
+    const lines = readWindowedLines(file);
+    if (!lines || !transcriptBelongsTo(lines, cwd, true)) {
+      continue;
+    }
+    const found = lastAssistantModelFromLines(lines);
+    if (found) {
+      return found;
+    }
+  }
+  return null;
+}
+function existingSlugDirs(root, cwd, slugFor) {
+  const dirs = [];
+  for (const ancestor of cwdAncestors(cwd)) {
+    const dir = path.join(root, slugFor(ancestor));
+    if (fs.existsSync(dir)) {
+      dirs.push(dir);
+    }
+  }
+  return dirs;
+}
+function sniffClaudeModel(cwd, env, projectsDir = path.join(os.homedir(), ".claude", "projects")) {
+  const dirs = existingSlugDirs(projectsDir, cwd, claudeProjectSlug);
+  const sessionId = env.CLAUDE_CODE_SESSION_ID?.trim();
+  if (sessionId) {
+    for (const dir of dirs) {
+      const lines = readWindowedLines(path.join(dir, `${sessionId}.jsonl`));
+      const pinned = lines ? lastAssistantModelFromLines(lines) : null;
+      if (pinned) {
+        return pinned;
+      }
+    }
+  }
+  for (const dir of dirs) {
+    const found = newestAssistantModelInDir(dir, cwd);
+    if (found) {
+      return found;
+    }
+  }
+  return null;
+}
+function sniffPiModel(cwd, sessionsRoot = path.join(os.homedir(), ".pi", "agent", "sessions")) {
+  for (const dir of existingSlugDirs(sessionsRoot, cwd, piSessionSlug)) {
+    const found = newestAssistantModelInDir(dir, cwd);
+    if (found) {
+      return found;
+    }
+  }
+  return null;
+}
+const CODEX_SCAN_LIMIT = 20;
+const CODEX_STAT_LIMIT = 200;
+function sniffCodexModel(cwd, env, sessionsRoot = path.join(os.homedir(), ".codex", "sessions")) {
+  let names;
+  try {
+    names = fs.readdirSync(sessionsRoot, { recursive: true }).filter((name) => name.endsWith(".jsonl")).sort().reverse();
+  } catch {
+    return null;
+  }
+  const threadId = env.CODEX_THREAD_ID?.trim();
+  if (threadId) {
+    const pinned = names.find((name) => path.basename(name).endsWith(`-${threadId}.jsonl`));
+    if (pinned) {
+      const lines = readWindowedLines(path.join(sessionsRoot, pinned));
+      const model = lines ? lastCodexModelFromLines(lines) : null;
+      if (model) {
+        return model;
+      }
+    }
+  }
+  const byMtimeDesc = names.slice(0, CODEX_STAT_LIMIT).map((name) => {
+    const file = path.join(sessionsRoot, name);
+    try {
+      return { file, mtime: fs.statSync(file).mtimeMs };
+    } catch {
+      return null;
+    }
+  }).filter((entry) => entry !== null).sort((a, b) => b.mtime - a.mtime);
+  for (const entry of byMtimeDesc.slice(0, CODEX_SCAN_LIMIT)) {
+    const lines = readWindowedLines(entry.file);
+    if (!lines || !codexTranscriptBelongsTo(lines, cwd)) {
+      continue;
+    }
+    const model = lastCodexModelFromLines(lines);
+    if (model) {
+      return model;
+    }
+  }
+  return null;
+}
+function opencodeModelForCwd(cwd, dbPath = opencodeDbPath()) {
+  if (!fs.existsSync(dbPath)) {
+    return null;
+  }
+  const DatabaseSync = loadNodeSqlite();
+  if (!DatabaseSync) {
+    return null;
+  }
+  const directory = opencodeDirectoryFilter(path.resolve(cwd));
+  const sql = `SELECT message.data AS data
+                 FROM message
+                 JOIN session ON session.id = message.session_id
+                 WHERE json_extract(message.data, '$.role') = 'assistant'
+                   AND ${directory.clause}
+                 ORDER BY message.time_created DESC
+                 LIMIT 1`;
+  const db = new DatabaseSync(dbPath, { readOnly: true });
+  try {
+    const rows = db.prepare(sql).all(...directory.params);
+    if (rows.length === 0) {
+      return null;
+    }
+    const data = JSON.parse(rows[0].data);
+    if (typeof data.modelID !== "string") {
+      return null;
+    }
+    const found = { model: data.modelID };
+    if (typeof data.providerID === "string") {
+      found.provider = data.providerID;
+    }
+    return found;
+  } catch {
+    return null;
+  } finally {
+    db.close();
+  }
+}
+function sniffModel(harness, cwd, env, roots = {}) {
+  try {
+    switch (harness) {
+      case "claude-code":
+        return sniffClaudeModel(cwd, env, roots.claudeProjectsDir);
+      case "pi":
+        return sniffPiModel(cwd, roots.piSessionsRoot);
+      case "codex": {
+        const model = sniffCodexModel(cwd, env, roots.codexSessionsRoot);
+        return model ? { model } : null;
+      }
+      case "opencode":
+        return opencodeModelForCwd(cwd, roots.opencodeDb);
+      default:
+        return null;
+    }
+  } catch {
+    return null;
+  }
+}
+function denyPatterns(guards) {
+  const raw = guards?.denyModels;
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  return raw.filter((pattern) => typeof pattern === "string");
+}
+function globMatch(pattern, value) {
+  const regex = pattern.split(/([*?])/).map((part) => {
+    if (part === "*") {
+      return ".*";
+    }
+    if (part === "?") {
+      return ".";
+    }
+    return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }).join("");
+  return new RegExp(`^${regex}$`, "i").test(value);
+}
+function evaluateGuard(guards, detection) {
+  const patterns = denyPatterns(guards);
+  if (!detection.model) {
+    if (guards?.denyWhenUnknown === true) {
+      return {
+        ...detection,
+        guard: "deny",
+        reason: "model unknown and denyWhenUnknown is set"
+      };
+    }
+    return {
+      ...detection,
+      guard: "allow",
+      reason: patterns.length === 0 ? "no deny rules configured" : "model unknown, failing open"
+    };
+  }
+  if (patterns.length === 0) {
+    return { ...detection, guard: "allow", reason: "no deny rules configured" };
+  }
+  const candidates = [detection.model];
+  if (detection.provider) {
+    candidates.push(`${detection.provider}/${detection.model}`);
+  }
+  for (const pattern of patterns) {
+    if (candidates.some((candidate) => globMatch(pattern, candidate))) {
+      return {
+        ...detection,
+        guard: "deny",
+        matched: pattern,
+        reason: "model has native vision per guards.denyModels"
+      };
+    }
+  }
+  return { ...detection, guard: "allow", reason: "not on the deny list" };
+}
+function detectActiveModel(options) {
+  const env = options.env ?? process.env;
+  const envModel = env.MODLENS_MODEL?.trim();
+  if (envModel) {
+    return envModel.toLowerCase() === "none" ? { model: null, source: "env" } : { model: envModel, source: "env" };
+  }
+  const forced = env.MODLENS_HARNESS;
+  const harness = forced === "none" ? null : forced || (options.harness !== void 0 ? options.harness : detectHarnessDetailed().harness);
+  const sniffed = harness ? sniffModel(harness, options.cwd, env, options.roots) : null;
+  if (sniffed) {
+    const detection = {
+      model: sniffed.model,
+      source: "storage",
+      harness
+    };
+    if (sniffed.provider) {
+      detection.provider = sniffed.provider;
+    }
+    if (options.selfReported && options.selfReported.toLowerCase() !== sniffed.model.toLowerCase()) {
+      detection.selfReported = options.selfReported;
+    }
+    return detection;
+  }
+  if (options.selfReported) {
+    return { model: options.selfReported, source: "self-report", harness };
+  }
+  return { model: null, source: "none", harness };
+}
+function runGuard(guards, options) {
+  if (denyPatterns(guards).length === 0 && guards?.denyWhenUnknown !== true) {
+    return { model: null, source: "none", guard: "allow", reason: "no deny rules configured" };
+  }
+  return evaluateGuard(guards, detectActiveModel(options));
+}
+const MIN_NODE = "22.13";
+function versionParts(version) {
+  const match = /(\d+)\.(\d+)/.exec(version.replace(/^v/, ""));
+  if (!match) {
+    return [0, 0];
+  }
+  return [Number(match[1]), Number(match[2])];
+}
+function meetsMinimum(version, minimum) {
+  const [major, minor] = versionParts(version);
+  const [minMajor, minMinor] = versionParts(minimum);
+  return major > minMajor || major === minMajor && minor >= minMinor;
+}
+function checkNodeSqlite() {
+  const realEmit = process.emitWarning;
+  process.emitWarning = () => {
+  };
+  try {
+    const mod = createRequire(import.meta.url)("node:sqlite");
+    if (mod?.DatabaseSync) {
+      return {
+        available: true,
+        detail: "node:sqlite is available (OpenCode paste recovery)"
+      };
+    }
+    return { available: false, detail: "node:sqlite loaded but DatabaseSync is missing" };
+  } catch {
+    return {
+      available: false,
+      detail: "node:sqlite unavailable. Upgrade Node to 22.13+ for OpenCode paste recovery"
+    };
+  } finally {
+    process.emitWarning = realEmit;
+  }
+}
+function inspectProvider(descriptor, config2, env) {
+  if (descriptor.kind === "subprocess") {
+    const binaryPath = findOnPath(descriptor.bin, env);
+    return {
+      name: descriptor.name,
+      kind: "subprocess",
+      ready: binaryPath !== null,
+      binaryPath,
+      detail: binaryPath ? `${descriptor.bin} found at ${binaryPath}` : `${descriptor.bin} not on PATH`,
+      fix: binaryPath ? void 0 : descriptor.install
+    };
+  }
+  const settings = resolveProviderSettings(descriptor.name, config2, env);
+  const statuses = (descriptor.required ?? []).map((req) => {
+    const envValue = req.env ? env[req.env]?.trim() : void 0;
+    const value = settings[req.field]?.trim();
+    const source = envValue ? "env" : value ? "file" : "missing";
+    return { field: req.field, present: Boolean(value), source, env: req.env };
+  });
+  const missing = statuses.filter((s) => !s.present).map((s) => s.field);
+  const ready = missing.length === 0;
+  const detail = ready ? statuses.map((s) => `${s.field}: ${s.source}`).join(", ") : `missing: ${missing.join(", ")}`;
+  return {
+    name: descriptor.name,
+    kind: "api",
+    ready,
+    settings: statuses,
+    detail,
+    fix: ready ? void 0 : descriptor.fix
+  };
+}
+function resolveSelection(config2, providerFlag) {
+  const raw = providerFlag?.trim() || config2.provider?.trim() || "antigravity-cli";
+  const source = providerFlag?.trim() ? "flag" : config2.provider?.trim() ? "config" : "default";
+  let canonical;
+  try {
+    canonical = resolveProvider(raw).name;
+  } catch {
+    canonical = null;
+  }
+  const reason = source === "flag" ? `-p ${raw} on the command line` : source === "config" ? "provider set in the config file" : "built-in default (no -p flag and no provider in the config file)";
+  return { provider: raw, canonical, source, reason };
+}
+function inspectConfigFile(configPath) {
+  try {
+    const stat = fs.statSync(configPath);
+    const mode = stat.mode & 511;
+    const enforcesPosixPerms = typeof process.getuid === "function";
+    const permissionsOk = !enforcesPosixPerms || (mode & 63) === 0;
+    return {
+      path: configPath,
+      exists: true,
+      mode: mode.toString(8).padStart(3, "0"),
+      permissionsOk,
+      note: permissionsOk ? void 0 : "group/world can read this file. Run: chmod 600 to lock it down"
+    };
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return {
+        path: configPath,
+        exists: false,
+        mode: null,
+        permissionsOk: true,
+        note: "no config file (using env vars and built-in defaults)"
+      };
+    }
+    return {
+      path: configPath,
+      exists: true,
+      mode: null,
+      permissionsOk: false,
+      note: `cannot stat: ${error.message}`
+    };
+  }
+}
+function buildDoctorReport(input) {
+  const env = input.env ?? process.env;
+  const configPath = input.configPath ?? CONFIG_PATH;
+  const harnessDetection = detectHarnessDetailed();
+  const guardDetection = detectActiveModel({
+    cwd: process.cwd(),
+    env,
+    harness: harnessDetection.harness
+  });
+  const guardVerdict = evaluateGuard(input.config.guards, guardDetection);
+  return {
+    node: {
+      version: process.version,
+      minimum: MIN_NODE,
+      meetsMinimum: meetsMinimum(process.version, MIN_NODE)
+    },
+    nodeSqlite: checkNodeSqlite(),
+    providers: PROVIDER_DESCRIPTORS.map((d) => inspectProvider(d, input.config, env)),
+    selection: resolveSelection(input.config, input.providerFlag),
+    chains: {
+      local: providerChain("local", input.config, env).map((p) => p.name),
+      remote: providerChain("remote", input.config, env).map((p) => p.name)
+    },
+    harness: { detected: harnessDetection.harness, source: harnessDetection.source },
+    guard: {
+      rules: denyPatterns(input.config.guards).length,
+      denyWhenUnknown: input.config.guards?.denyWhenUnknown ?? false,
+      model: guardVerdict.model,
+      source: guardVerdict.source,
+      verdict: guardVerdict.guard,
+      matched: guardVerdict.matched,
+      reason: guardVerdict.reason
+    },
+    config: inspectConfigFile(configPath)
+  };
+}
+function mark(ok) {
+  return ok ? "[ok]" : "[!!]";
+}
+function renderDoctorReport(report) {
+  const lines = [];
+  lines.push("modlens doctor");
+  lines.push("(local diagnostics only: no network calls, no provider quota spent)");
+  lines.push("");
+  lines.push("Node");
+  lines.push(
+    `  ${mark(report.node.meetsMinimum)} ${report.node.version} (minimum ${report.node.minimum})`
+  );
+  lines.push(`  ${mark(report.nodeSqlite.available)} ${report.nodeSqlite.detail}`);
+  lines.push("");
+  lines.push("Providers");
+  for (const provider of report.providers) {
+    lines.push(`  ${mark(provider.ready)} ${provider.name}: ${provider.detail}`);
+    if (provider.fix) {
+      lines.push(`       fix: ${provider.fix}`);
+    }
+  }
+  lines.push("");
+  lines.push("Selected provider");
+  const canonicalNote = report.selection.canonical && report.selection.canonical !== report.selection.provider ? ` (canonical: ${report.selection.canonical})` : report.selection.canonical === null ? " (unknown provider name)" : "";
+  lines.push(`  ${report.selection.provider}${canonicalNote}`);
+  lines.push(`  reason: ${report.selection.reason}`);
+  lines.push("");
+  lines.push("Failover chains (what a run tries, in order)");
+  const chainLine = (chain) => chain.length > 0 ? chain.join(" -> ") : "(none available)";
+  lines.push(`  local:  ${chainLine(report.chains.local)}`);
+  lines.push(`  remote: ${chainLine(report.chains.remote)}`);
+  lines.push("");
+  lines.push("Harness");
+  lines.push(
+    report.harness.detected ? `  ${report.harness.detected} (via ${report.harness.source})` : `  none detected (${report.harness.source})`
+  );
+  lines.push("");
+  lines.push("Guard (should the vision engine run for the active model?)");
+  lines.push(
+    `  rules: ${report.guard.rules} deny pattern(s), denyWhenUnknown: ${report.guard.denyWhenUnknown}`
+  );
+  lines.push(`  active model: ${report.guard.model ?? "unknown"} (via ${report.guard.source})`);
+  lines.push(
+    `  verdict: ${report.guard.verdict}${report.guard.matched ? ` (matched "${report.guard.matched}")` : ""}, ${report.guard.reason}`
+  );
+  lines.push("");
+  lines.push("Config file");
+  lines.push(`  path: ${report.config.path}`);
+  if (report.config.exists) {
+    lines.push(
+      `  ${mark(report.config.permissionsOk)} exists, mode ${report.config.mode ?? "?"}`
+    );
+  } else {
+    lines.push("  not present");
+  }
+  if (report.config.note) {
+    lines.push(`  note: ${report.config.note}`);
+  }
+  return lines.join("\n");
+}
 function extensionFromMediaType(mediaType) {
   const subtype = mediaType.split("/")[1]?.split("+")[0]?.replace(/[^a-z0-9]/gi, "");
   return subtype ? subtype.toLowerCase() : "bin";
@@ -29207,13 +29729,28 @@ function recoverPastedImages(options = {}) {
   return result;
 }
 const program = new Command();
-program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.3.0");
-program.command("analyze", { isDefault: true }).description("Analyze an image into structured JSON evidence (default command)").requiredOption("-i, --input <path|url>", "Input image path or https URL").option("-o, --output <path>", "Write result JSON to a file").option("-m, --model <name>", "Provider model name").option("-p, --provider <name>", `Vision provider (${listProviders().join(", ")})`).option("--prompt <text>", "Extra focus for this image").option("--timeout <ms>", "Provider timeout in milliseconds", "180000").option("--provider-bin <path>", "Provider binary path (default: agy)").option("--workdir <path>", "Working directory for the provider").action(async (options) => {
+program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.5.0");
+program.command("analyze", { isDefault: true }).description("Analyze an image into structured JSON evidence (default command)").requiredOption("-i, --input <path|url>", "Input image path or https URL").option("-o, --output <path>", "Write result JSON to a file").option("-m, --model <name>", "Provider model name").option("-p, --provider <name>", `Vision provider (${listProviders().join(", ")})`).option("--prompt <text>", "Extra focus for this image").option("--timeout <ms>", "Provider timeout in milliseconds", "180000").option("--provider-bin <path>", "Provider binary path (default: agy)").option("--workdir <path>", "Working directory for the provider").option(
+  "--extra-body <json>",
+  `JSON merged into the API request body, e.g. '{"thinking":{"type":"disabled"}}'`
+).action(async (options) => {
   try {
     const timeoutMs = Number.parseInt(options.timeout, 10);
     if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
       throw new Error("Invalid --timeout. Use a positive integer in milliseconds.");
     }
+    const config2 = loadConfigFile();
+    if (process.env.MODLENS_MODEL?.trim()) {
+      const verdict = runGuard(config2.guards, {
+        cwd: process.cwd(),
+        env: process.env
+      });
+      if (verdict.guard === "deny" && verdict.matched) {
+        throw new Error(
+          `Invocation guard denied this read: active model "${verdict.model}" matches guards.denyModels pattern "${verdict.matched}". A model with native vision should read the image itself. To override, unset MODLENS_MODEL or edit guards in ${CONFIG_PATH}.`
+        );
+      }
+    }
     const result = await analyzeImage({
       input: options.input,
       provider: options.provider,
@@ -29221,7 +29758,9 @@ program.command("analyze", { isDefault: true }).description("Analyze an image in
       prompt: options.prompt,
       timeoutMs,
       providerBin: options.providerBin,
-      workdir: options.workdir
+      workdir: options.workdir,
+      extraBody: options.extraBody ? parseExtraBody(options.extraBody, "--extra-body") : void 0,
+      config: config2
     });
     const output = JSON.stringify(result, null, 2);
     if (options.output) {
@@ -29271,6 +29810,29 @@ program.command("recover-paste").description(
     process.exit(1);
   }
 });
+program.command("guard").description(
+  "Check whether the vision engine should run for the active model (exit 0 allow, 1 deny, 2 error)"
+).option(
+  "--model <name>",
+  "The calling agent's own model name; weakest signal, used when env and session storage say nothing"
+).option("--cwd <path>", "Project directory of the session", process.cwd()).action((options) => {
+  try {
+    const verdict = runGuard(loadConfigFile().guards, {
+      cwd: options.cwd,
+      env: process.env,
+      selfReported: options.model
+    });
+    process.stdout.write(`${JSON.stringify(verdict, null, 2)}
+`);
+    process.exitCode = verdict.guard === "deny" ? 1 : 0;
+  } catch (error) {
+    process.stderr.write(
+      `Error: ${error instanceof Error ? error.message : String(error)}
+`
+    );
+    process.exitCode = 2;
+  }
+});
 program.command("doctor").description(
   "Diagnose local config and routing (Node, providers, selection, harness) without spending quota or hitting the network"
 ).option("--json", "Emit the report as JSON").option("-p, --provider <name>", "Show which provider this -p value would select").action((options) => {
@@ -29302,6 +29864,7 @@ config.command("init").description(`Create a starter config at ${CONFIG_PATH}`).
         "Everything is optional. Two things you can set:",
         "  modlens config set provider <name>                      which provider analyzes images",
         "  modlens config set <provider>.<apiKey|baseUrl|model> <value>   provider credentials",
+        `  modlens config set <provider>.extraBody '{"thinking":{"type":"disabled"}}'   vendor request fields`,
         ""
       ].join("\n")
     );