@liustack/modlens 3.4.0 → 3.5.0

package/dist/main.js

@@ -7,7 +7,7 @@ import { spawn } from "child_process";
 import * as os from "os";
 import require$$0$1 from "node:assert";
 import require$$1 from "node:net";
-import require$$2$1 from "node:http";
+import require$$2 from "node:http";
 import require$$0$2 from "node:stream";
 import require$$5 from "node:querystring";
 import require$$0 from "node:events";
@@ -18,44 +18,20 @@ import require$$0$4 from "node:buffer";
 import require$$0$5 from "node:zlib";
 import require$$5$1 from "node:perf_hooks";
 import require$$8 from "node:util/types";
-import require$$2$2 from "node:worker_threads";
-import require$$2$3 from "node:crypto";
+import require$$2$1 from "node:worker_threads";
+import require$$2$2 from "node:crypto";
 import require$$11 from "node:stream/web";
 import require$$0$6 from "node:url";
 import require$$1$1 from "node:async_hooks";
 import require$$1$2 from "node:console";
 import require$$0$7 from "node:fs/promises";
 import require$$1$3 from "node:path";
-import require$$2$4 from "node:timers";
+import require$$2$3 from "node:timers";
 import require$$1$4 from "node:dns";
 import * as dns$1 from "dns/promises";
 import { isIP } from "net";
 import { createRequire } from "module";
 import * as crypto from "crypto";
-function getAugmentedNamespace(n) {
-  if (Object.prototype.hasOwnProperty.call(n, "__esModule")) return n;
-  var f = n.default;
-  if (typeof f == "function") {
-    var a = function a2() {
-      if (this instanceof a2) {
-        return Reflect.construct(f, arguments, this.constructor);
-      }
-      return f.apply(this, arguments);
-    };
-    a.prototype = f.prototype;
-  } else a = {};
-  Object.defineProperty(a, "__esModule", { value: true });
-  Object.keys(n).forEach(function(k) {
-    var d = Object.getOwnPropertyDescriptor(n, k);
-    Object.defineProperty(a, k, d.get ? d : {
-      enumerable: true,
-      get: function() {
-        return n[k];
-      }
-    });
-  });
-  return a;
-}
 var undici = { exports: {} };
 var symbols;
 var hasRequiredSymbols;
@@ -1061,7 +1037,7 @@ function requireUtil$5() {
   hasRequiredUtil$5 = 1;
   const assert = require$$0$1;
   const { kDestroyed, kBodyUsed, kListeners, kBody } = requireSymbols();
-  const { IncomingMessage } = require$$2$1;
+  const { IncomingMessage } = require$$2;
   const stream = require$$0$2;
   const net = require$$1;
   const { stringify } = require$$5;
@@ -4309,7 +4285,7 @@ function requireWebidl() {
   hasRequiredWebidl = 1;
   const assert = require$$0$1;
   const { types, inspect } = require$$3;
-  const { markAsUncloneable } = require$$2$2;
+  const { markAsUncloneable } = require$$2$1;
   const UNDEFINED = 1;
   const BOOLEAN = 2;
   const STRING = 3;
@@ -5670,20 +5646,14 @@ function requireUtil$4() {
   return util$4;
 }
 var runtimeFeatures = {};
-const __viteBrowserExternal = {};
-const __viteBrowserExternal$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  default: __viteBrowserExternal
-}, Symbol.toStringTag, { value: "Module" }));
-const require$$2 = /* @__PURE__ */ getAugmentedNamespace(__viteBrowserExternal$1);
 var hasRequiredRuntimeFeatures;
 function requireRuntimeFeatures() {
   if (hasRequiredRuntimeFeatures) return runtimeFeatures;
   hasRequiredRuntimeFeatures = 1;
   const lazyLoaders = {
     __proto__: null,
-    "node:crypto": () => require$$2$3,
-    "node:sqlite": () => require$$2
+    "node:crypto": () => require$$2$2,
+    "node:sqlite": () => require("node:sqlite")
   };
   function detectRuntimeFeatureByNodeModule(moduleName) {
     try {
@@ -5760,7 +5730,7 @@ function requireFormdata() {
   const { webidl } = requireWebidl();
   const nodeUtil = require$$3;
   const { runtimeFeatures: runtimeFeatures2 } = requireRuntimeFeatures();
-  const random = runtimeFeatures2.has("crypto") ? require$$2$3.randomInt : (max) => Math.floor(Math.random() * max);
+  const random = runtimeFeatures2.has("crypto") ? require$$2$2.randomInt : (max) => Math.floor(Math.random() * max);
   class FormData {
     #state = [];
     #boundary = null;
@@ -9112,7 +9082,7 @@ function requireClient() {
   hasRequiredClient = 1;
   const assert = require$$0$1;
   const net = require$$1;
-  const http = require$$2$1;
+  const http = require$$2;
   const util2 = requireUtil$5();
   const { ClientStats } = requireStats();
   const { channels } = requireDiagnostics();
@@ -13531,7 +13501,7 @@ function requireMockUtils() {
     kTotalDispatchCount
   } = requireMockSymbols();
   const { serializePathWithQuery, parseHeaders } = requireUtil$5();
-  const { STATUS_CODES } = require$$2$1;
+  const { STATUS_CODES } = require$$2;
   const {
     types: {
       isPromise
@@ -14806,7 +14776,7 @@ function requireSnapshotUtils() {
       match: new Set(matchHeaders.map((header) => caseSensitive ? header : header.toLowerCase()))
     };
   }
-  const crypto2 = runtimeFeatures2.has("crypto") ? require$$2$3 : null;
+  const crypto2 = runtimeFeatures2.has("crypto") ? require$$2$2 : null;
   const hashId = crypto2?.hash ? (value) => crypto2.hash("sha256", value, "base64url") : (value) => Buffer.from(value).toString("base64url");
   function isUndiciHeaders(headers2) {
     return Array.isArray(headers2) && (headers2.length & 1) === 0;
@@ -14884,7 +14854,7 @@ function requireSnapshotRecorder() {
   hasRequiredSnapshotRecorder = 1;
   const { writeFile, readFile, mkdir } = require$$0$7;
   const { dirname, resolve } = require$$1$3;
-  const { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = require$$2$4;
+  const { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = require$$2$3;
   const { InvalidArgumentError, UndiciError } = requireErrors();
   const { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = requireSnapshotUtils();
   function normalizeUrlForMatching(url, matchQuery, normalizeQuery) {
@@ -19535,7 +19505,7 @@ function requireSqliteCacheStore() {
         }
       }
       if (!DatabaseSync) {
-        DatabaseSync = require$$2.DatabaseSync;
+        DatabaseSync = require("node:sqlite").DatabaseSync;
       }
       this.#db = new DatabaseSync(opts?.location ?? ":memory:");
       this.#db.exec(`
@@ -21500,7 +21470,7 @@ function requireSubresourceIntegrity() {
   const validSRIHashAlgorithmTokenSet = /* @__PURE__ */ new Map([["sha256", 0], ["sha384", 1], ["sha512", 2]]);
   let crypto2;
   if (runtimeFeatures2.has("crypto")) {
-    crypto2 = require$$2$3;
+    crypto2 = require$$2$2;
     const cryptoHashes = crypto2.getHashes();
     if (cryptoHashes.length === 0) {
       validSRIHashAlgorithmTokenSet.clear();
@@ -21694,7 +21664,7 @@ function requireFetch() {
   const { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = requireDataUrl();
   const { getGlobalDispatcher } = requireGlobal();
   const { webidl } = requireWebidl();
-  const { STATUS_CODES } = require$$2$1;
+  const { STATUS_CODES } = require$$2;
   const { bytesMatch } = requireSubresourceIntegrity();
   const { isomorphicEncode } = requireInfra();
   const GET_OR_HEAD = ["GET", "HEAD"];
@@ -24454,7 +24424,7 @@ function requireFrame() {
   const BUFFER_SIZE = 8 * 1024;
   let buffer = null;
   let bufIdx = BUFFER_SIZE;
-  const randomFillSync = runtimeFeatures2.has("crypto") ? require$$2$3.randomFillSync : null;
+  const randomFillSync = runtimeFeatures2.has("crypto") ? require$$2$2.randomFillSync : null;
   function generateMask() {
     if (bufIdx === BUFFER_SIZE) {
       bufIdx = 0;
@@ -24559,7 +24529,7 @@ function requireConnection() {
   const { WebsocketFrameSend } = requireFrame();
   const assert = require$$0$1;
   const { runtimeFeatures: runtimeFeatures2 } = requireRuntimeFeatures();
-  const crypto2 = runtimeFeatures2.has("crypto") ? require$$2$3 : null;
+  const crypto2 = runtimeFeatures2.has("crypto") ? require$$2$2 : null;
   let warningEmitted = false;
   function establishWebSocketConnection(url, protocols, client2, handler, options) {
     const requestURL = url;
@@ -27537,13 +27507,56 @@ function schemaViolations(schema, value, path2) {
   }
   return [];
 }
-function parseExtraBody(raw, origin) {
-  let parsed;
+function tryParseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+function parseJsonOrExplain(raw, origin) {
   try {
-    parsed = JSON.parse(raw);
+    return JSON.parse(raw);
   } catch (error) {
     throw new Error(`${origin} is not valid JSON: ${error.message}`);
   }
+}
+function parseJsonLoose(text) {
+  const trimmed = text.trim();
+  const direct = tryParseJson(trimmed);
+  if (direct !== null) {
+    return direct;
+  }
+  return parseBraceSlice(trimmed);
+}
+function extractJson(text) {
+  const trimmed = text.trim();
+  const direct = tryParseJson(trimmed);
+  if (direct !== null) {
+    return direct;
+  }
+  const fenced = /```(?:json)?\s*([\s\S]*?)```/i.exec(trimmed);
+  if (fenced) {
+    const parsed = tryParseJson(fenced[1].trim());
+    if (parsed !== null) {
+      return parsed;
+    }
+  }
+  return parseBraceSlice(trimmed);
+}
+function parseBraceSlice(trimmed) {
+  const first = trimmed.indexOf("{");
+  const last = trimmed.lastIndexOf("}");
+  if (first >= 0 && last > first) {
+    return tryParseJson(trimmed.slice(first, last + 1));
+  }
+  return null;
+}
+function truncate(text, max = 300) {
+  return text.length > max ? `${text.slice(0, max)}...` : text;
+}
+function parseExtraBody(raw, origin) {
+  const parsed = parseJsonOrExplain(raw, origin);
   if (!isPlainObject(parsed)) {
     throw new Error(
       `${origin} must be a JSON object, for example {"thinking":{"type":"disabled"}}`
@@ -27585,47 +27598,6 @@ function hasPath(value, dottedPath) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function tryParseJson(text) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return null;
-  }
-}
-function parseJsonLoose(text) {
-  const trimmed = text.trim();
-  const direct = tryParseJson(trimmed);
-  if (direct !== null) {
-    return direct;
-  }
-  return parseBraceSlice(trimmed);
-}
-function extractJson(text) {
-  const trimmed = text.trim();
-  const direct = tryParseJson(trimmed);
-  if (direct !== null) {
-    return direct;
-  }
-  const fenced = /```(?:json)?\s*([\s\S]*?)```/i.exec(trimmed);
-  if (fenced) {
-    const parsed = tryParseJson(fenced[1].trim());
-    if (parsed !== null) {
-      return parsed;
-    }
-  }
-  return parseBraceSlice(trimmed);
-}
-function parseBraceSlice(trimmed) {
-  const first = trimmed.indexOf("{");
-  const last = trimmed.lastIndexOf("}");
-  if (first >= 0 && last > first) {
-    return tryParseJson(trimmed.slice(first, last + 1));
-  }
-  return null;
-}
-function truncate(text, max = 300) {
-  return text.length > max ? `${text.slice(0, max)}...` : text;
-}
 const ANTHROPIC_DEFAULT_MODEL = "claude-haiku-4-5-20251001";
 const DEFAULT_BASE_URL$1 = "https://api.anthropic.com";
 const TOOL_NAME = "report_vision_evidence";
@@ -28176,11 +28148,13 @@ function setConfigValue(dottedKey, value, configPath = CONFIG_PATH) {
   const config2 = loadConfigFile(configPath);
   if (dottedKey === "provider") {
     config2.provider = value;
+  } else if (dottedKey.startsWith("guards.")) {
+    setGuardsValue(config2, dottedKey.slice("guards.".length), value);
   } else {
     const dot = dottedKey.indexOf(".");
     if (dot <= 0 || dot === dottedKey.length - 1) {
       throw new Error(
-        `Invalid config key: ${dottedKey}. Use "provider" or "<provider>.<apiKey|baseUrl|model|extraBody>".`
+        `Invalid config key: ${dottedKey}. Use "provider", "guards.<denyModels|denyWhenUnknown>", or "<provider>.<apiKey|baseUrl|model|extraBody>".`
       );
     }
     const providerName = dottedKey.slice(0, dot);
@@ -28214,6 +28188,38 @@ function setConfigValue(dottedKey, value, configPath = CONFIG_PATH) {
   } catch {
   }
 }
+function setGuardsValue(config2, field, value) {
+  if (field === "denyModels") {
+    if (value.trim() === "") {
+      delete config2.guards?.denyModels;
+    } else {
+      config2.guards ??= {};
+      config2.guards.denyModels = parseModelList(value);
+    }
+  } else if (field === "denyWhenUnknown") {
+    const normalized = value.trim().toLowerCase();
+    if (normalized !== "true" && normalized !== "false") {
+      throw new Error("guards.denyWhenUnknown must be true or false.");
+    }
+    config2.guards ??= {};
+    config2.guards.denyWhenUnknown = normalized === "true";
+  } else {
+    throw new Error(`Unknown guards field: ${field}. Use denyModels or denyWhenUnknown.`);
+  }
+  if (config2.guards && Object.keys(config2.guards).length === 0) {
+    delete config2.guards;
+  }
+}
+function parseModelList(value) {
+  if (value.trim().startsWith("[")) {
+    const parsed = parseJsonOrExplain(value, "guards.denyModels");
+    if (!Array.isArray(parsed) || parsed.some((item) => typeof item !== "string")) {
+      throw new Error("guards.denyModels must be a JSON array of glob strings.");
+    }
+    return parsed;
+  }
+  return value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+}
 const CONFIG_TEMPLATE = {
   // Empty means the built-in default provider.
   provider: "",
@@ -28266,6 +28272,18 @@ function renderEffectiveConfig(config2, env = process.env) {
   if (config2.provider?.trim()) {
     effective.provider = config2.provider.trim();
   }
+  if (config2.guards) {
+    const guards = {};
+    if (config2.guards.denyModels !== void 0) {
+      guards.denyModels = `${JSON.stringify(config2.guards.denyModels)} (file)`;
+    }
+    if (config2.guards.denyWhenUnknown !== void 0) {
+      guards.denyWhenUnknown = `${config2.guards.denyWhenUnknown} (file)`;
+    }
+    if (Object.keys(guards).length > 0) {
+      effective.guards = guards;
+    }
+  }
   return JSON.stringify(effective, null, 2);
 }
 function maskKey(key) {
@@ -28706,270 +28724,101 @@ function detectHarnessDetailed() {
 function detectHarness() {
   return detectHarnessDetailed().harness;
 }
-const MIN_NODE = "22.13";
-function versionParts(version) {
-  const match = /(\d+)\.(\d+)/.exec(version.replace(/^v/, ""));
-  if (!match) {
-    return [0, 0];
+function cwdMatches(recorded, wanted, bothDirections = false) {
+  const resolvedRecorded = path.resolve(recorded);
+  const resolvedWanted = path.resolve(wanted);
+  if (resolvedRecorded === resolvedWanted || resolvedRecorded.startsWith(`${resolvedWanted}${path.sep}`)) {
+    return true;
   }
-  return [Number(match[1]), Number(match[2])];
+  return bothDirections && resolvedWanted.startsWith(`${resolvedRecorded}${path.sep}`);
 }
-function meetsMinimum(version, minimum) {
-  const [major, minor] = versionParts(version);
-  const [minMajor, minMinor] = versionParts(minimum);
-  return major > minMajor || major === minMajor && minor >= minMinor;
+function transcriptBelongsTo(lines, cwd, bothDirections = false) {
+  let sawCwd = false;
+  for (const line of lines) {
+    if (!line.includes('"cwd"')) {
+      continue;
+    }
+    try {
+      const recorded = JSON.parse(line).cwd;
+      if (typeof recorded !== "string") {
+        continue;
+      }
+      sawCwd = true;
+      if (cwdMatches(recorded, cwd, bothDirections)) {
+        return true;
+      }
+    } catch {
+    }
+  }
+  return !sawCwd;
 }
-function checkNodeSqlite() {
-  const realEmit = process.emitWarning;
-  process.emitWarning = () => {
-  };
+function readLines(filePath) {
   try {
-    const mod = createRequire(import.meta.url)("node:sqlite");
-    if (mod?.DatabaseSync) {
-      return {
-        available: true,
-        detail: "node:sqlite is available (OpenCode paste recovery)"
-      };
-    }
-    return { available: false, detail: "node:sqlite loaded but DatabaseSync is missing" };
+    return fs.readFileSync(filePath, "utf-8").split("\n");
   } catch {
-    return {
-      available: false,
-      detail: "node:sqlite unavailable. Upgrade Node to 22.13+ for OpenCode paste recovery"
-    };
-  } finally {
-    process.emitWarning = realEmit;
+    return null;
   }
 }
-function inspectProvider(descriptor, config2, env) {
-  if (descriptor.kind === "subprocess") {
-    const binaryPath = findOnPath(descriptor.bin, env);
-    return {
-      name: descriptor.name,
-      kind: "subprocess",
-      ready: binaryPath !== null,
-      binaryPath,
-      detail: binaryPath ? `${descriptor.bin} found at ${binaryPath}` : `${descriptor.bin} not on PATH`,
-      fix: binaryPath ? void 0 : descriptor.install
-    };
+function forEachJsonLine(filePath, visit) {
+  const lines = readLines(filePath);
+  if (!lines) {
+    return;
   }
-  const settings = resolveProviderSettings(descriptor.name, config2, env);
-  const statuses = (descriptor.required ?? []).map((req) => {
-    const envValue = req.env ? env[req.env]?.trim() : void 0;
-    const value = settings[req.field]?.trim();
-    const source = envValue ? "env" : value ? "file" : "missing";
-    return { field: req.field, present: Boolean(value), source, env: req.env };
-  });
-  const missing = statuses.filter((s) => !s.present).map((s) => s.field);
-  const ready = missing.length === 0;
-  const detail = ready ? statuses.map((s) => `${s.field}: ${s.source}`).join(", ") : `missing: ${missing.join(", ")}`;
+  forEachParsedLine(lines, visit);
+}
+function forEachParsedLine(lines, visit) {
+  for (const line of lines) {
+    if (!line.includes('"image"')) {
+      continue;
+    }
+    try {
+      visit(JSON.parse(line));
+    } catch {
+    }
+  }
+}
+function jsonlSource(harness, filePath, extractLine) {
   return {
-    name: descriptor.name,
-    kind: "api",
-    ready,
-    settings: statuses,
-    detail,
-    fix: ready ? void 0 : descriptor.fix
+    harness,
+    location: filePath,
+    extract: () => {
+      const images = [];
+      forEachJsonLine(filePath, (line) => {
+        images.push(...extractLine(line));
+      });
+      return images;
+    }
   };
 }
-function resolveSelection(config2, providerFlag) {
-  const raw = providerFlag?.trim() || config2.provider?.trim() || "antigravity-cli";
-  const source = providerFlag?.trim() ? "flag" : config2.provider?.trim() ? "config" : "default";
-  let canonical;
+function newestJsonlTimestamp(lines, extractLine) {
+  let latest = null;
+  forEachParsedLine(lines, (line) => {
+    if (extractLine(line).length === 0) {
+      return;
+    }
+    const ts = line.timestamp;
+    const ms = typeof ts === "string" ? Date.parse(ts) : NaN;
+    if (Number.isFinite(ms) && (latest === null || ms > latest)) {
+      latest = ms;
+    }
+  });
+  return latest;
+}
+function listJsonl(dir) {
   try {
-    canonical = resolveProvider(raw).name;
+    return fs.readdirSync(dir).filter((name) => name.endsWith(".jsonl")).map((name) => path.join(dir, name));
   } catch {
-    canonical = null;
+    return [];
   }
-  const reason = source === "flag" ? `-p ${raw} on the command line` : source === "config" ? "provider set in the config file" : "built-in default (no -p flag and no provider in the config file)";
-  return { provider: raw, canonical, source, reason };
 }
-function inspectConfigFile(configPath) {
-  try {
-    const stat = fs.statSync(configPath);
-    const mode = stat.mode & 511;
-    const enforcesPosixPerms = typeof process.getuid === "function";
-    const permissionsOk = !enforcesPosixPerms || (mode & 63) === 0;
-    return {
-      path: configPath,
-      exists: true,
-      mode: mode.toString(8).padStart(3, "0"),
-      permissionsOk,
-      note: permissionsOk ? void 0 : "group/world can read this file. Run: chmod 600 to lock it down"
-    };
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return {
-        path: configPath,
-        exists: false,
-        mode: null,
-        permissionsOk: true,
-        note: "no config file (using env vars and built-in defaults)"
-      };
-    }
-    return {
-      path: configPath,
-      exists: true,
-      mode: null,
-      permissionsOk: false,
-      note: `cannot stat: ${error.message}`
-    };
-  }
-}
-function buildDoctorReport(input) {
-  const env = input.env ?? process.env;
-  const configPath = input.configPath ?? CONFIG_PATH;
-  return {
-    node: {
-      version: process.version,
-      minimum: MIN_NODE,
-      meetsMinimum: meetsMinimum(process.version, MIN_NODE)
-    },
-    nodeSqlite: checkNodeSqlite(),
-    providers: PROVIDER_DESCRIPTORS.map((d) => inspectProvider(d, input.config, env)),
-    selection: resolveSelection(input.config, input.providerFlag),
-    chains: {
-      local: providerChain("local", input.config, env).map((p) => p.name),
-      remote: providerChain("remote", input.config, env).map((p) => p.name)
-    },
-    harness: (() => {
-      const detection = detectHarnessDetailed();
-      return { detected: detection.harness, source: detection.source };
-    })(),
-    config: inspectConfigFile(configPath)
-  };
-}
-function mark(ok) {
-  return ok ? "[ok]" : "[!!]";
-}
-function renderDoctorReport(report) {
-  const lines = [];
-  lines.push("modlens doctor");
-  lines.push("(local diagnostics only: no network calls, no provider quota spent)");
-  lines.push("");
-  lines.push("Node");
-  lines.push(
-    `  ${mark(report.node.meetsMinimum)} ${report.node.version} (minimum ${report.node.minimum})`
-  );
-  lines.push(`  ${mark(report.nodeSqlite.available)} ${report.nodeSqlite.detail}`);
-  lines.push("");
-  lines.push("Providers");
-  for (const provider of report.providers) {
-    lines.push(`  ${mark(provider.ready)} ${provider.name}: ${provider.detail}`);
-    if (provider.fix) {
-      lines.push(`       fix: ${provider.fix}`);
-    }
-  }
-  lines.push("");
-  lines.push("Selected provider");
-  const canonicalNote = report.selection.canonical && report.selection.canonical !== report.selection.provider ? ` (canonical: ${report.selection.canonical})` : report.selection.canonical === null ? " (unknown provider name)" : "";
-  lines.push(`  ${report.selection.provider}${canonicalNote}`);
-  lines.push(`  reason: ${report.selection.reason}`);
-  lines.push("");
-  lines.push("Failover chains (what a run tries, in order)");
-  const chainLine = (chain) => chain.length > 0 ? chain.join(" -> ") : "(none available)";
-  lines.push(`  local:  ${chainLine(report.chains.local)}`);
-  lines.push(`  remote: ${chainLine(report.chains.remote)}`);
-  lines.push("");
-  lines.push("Harness");
-  lines.push(
-    report.harness.detected ? `  ${report.harness.detected} (via ${report.harness.source})` : `  none detected (${report.harness.source})`
-  );
-  lines.push("");
-  lines.push("Config file");
-  lines.push(`  path: ${report.config.path}`);
-  if (report.config.exists) {
-    lines.push(
-      `  ${mark(report.config.permissionsOk)} exists, mode ${report.config.mode ?? "?"}`
-    );
-  } else {
-    lines.push("  not present");
-  }
-  if (report.config.note) {
-    lines.push(`  note: ${report.config.note}`);
-  }
-  return lines.join("\n");
-}
-function transcriptBelongsTo(lines, cwd) {
-  const wanted = path.resolve(cwd);
-  let sawCwd = false;
-  for (const line of lines) {
-    if (!line.includes('"cwd"')) {
-      continue;
-    }
-    try {
-      const recorded = JSON.parse(line).cwd;
-      if (typeof recorded !== "string") {
-        continue;
-      }
-      sawCwd = true;
-      const resolved = path.resolve(recorded);
-      if (resolved === wanted || resolved.startsWith(`${wanted}${path.sep}`)) {
-        return true;
-      }
-    } catch {
-    }
-  }
-  return !sawCwd;
-}
-function readLines(filePath) {
-  try {
-    return fs.readFileSync(filePath, "utf-8").split("\n");
-  } catch {
-    return null;
-  }
-}
-function forEachJsonLine(filePath, visit) {
-  const lines = readLines(filePath);
-  if (!lines) {
-    return;
-  }
-  forEachParsedLine(lines, visit);
-}
-function forEachParsedLine(lines, visit) {
-  for (const line of lines) {
-    if (!line.includes('"image"')) {
-      continue;
-    }
+function listJsonlByMtimeDesc(dir) {
+  return listJsonl(dir).map((file) => {
     try {
-      visit(JSON.parse(line));
+      return { file, mtime: fs.statSync(file).mtimeMs };
     } catch {
+      return null;
     }
-  }
-}
-function jsonlSource(harness, filePath, extractLine) {
-  return {
-    harness,
-    location: filePath,
-    extract: () => {
-      const images = [];
-      forEachJsonLine(filePath, (line) => {
-        images.push(...extractLine(line));
-      });
-      return images;
-    }
-  };
-}
-function newestJsonlTimestamp(lines, extractLine) {
-  let latest = null;
-  forEachParsedLine(lines, (line) => {
-    if (extractLine(line).length === 0) {
-      return;
-    }
-    const ts = line.timestamp;
-    const ms = typeof ts === "string" ? Date.parse(ts) : NaN;
-    if (Number.isFinite(ms) && (latest === null || ms > latest)) {
-      latest = ms;
-    }
-  });
-  return latest;
-}
-function listJsonl(dir) {
-  try {
-    return fs.readdirSync(dir).filter((name) => name.endsWith(".jsonl")).map((name) => path.join(dir, name));
-  } catch {
-    return [];
-  }
+  }).filter((entry) => entry !== null).sort((a, b) => b.mtime - a.mtime).map((entry) => entry.file);
 }
 function jsonlAdapter(options) {
   const { name, dirFor, matchesSession, extractLine } = options;
@@ -29033,13 +28882,19 @@ function opencodeDbPath() {
 function escapeLikePattern(value) {
   return value.replace(/[\\%_]/g, (char) => `\\${char}`);
 }
-function buildOpencodeQuery(resolvedCwd, sessionId) {
+function opencodeDirectoryFilter(resolvedCwd) {
   const normalized = resolvedCwd.replace(/\\/g, "/");
   const escaped = escapeLikePattern(normalized);
   const dir = `REPLACE(session.directory, '\\', '/')`;
-  const directoryFilter = `(${dir} = ? OR ${dir} LIKE ? || '/%' ESCAPE '\\' OR ? LIKE ${dir} || '/%' ESCAPE '\\')`;
-  const sessionFilter = sessionId ? `AND ${directoryFilter} AND (session.id = ? OR session.slug = ?)` : `AND ${directoryFilter}`;
-  const params = sessionId ? [normalized, escaped, normalized, sessionId, sessionId] : [normalized, escaped, normalized];
+  return {
+    clause: `(${dir} = ? OR ${dir} LIKE ? || '/%' ESCAPE '\\' OR ? LIKE ${dir} || '/%' ESCAPE '\\')`,
+    params: [normalized, escaped, normalized]
+  };
+}
+function buildOpencodeQuery(resolvedCwd, sessionId) {
+  const directory = opencodeDirectoryFilter(resolvedCwd);
+  const sessionFilter = sessionId ? `AND ${directory.clause} AND (session.id = ? OR session.slug = ?)` : `AND ${directory.clause}`;
+  const params = sessionId ? [...directory.params, sessionId, sessionId] : directory.params;
   const sql = `SELECT part.data AS data, part.time_created AS time_created, part.session_id AS session_id
                  FROM part
                  JOIN message ON message.id = part.message_id
@@ -29050,12 +28905,17 @@ function buildOpencodeQuery(resolvedCwd, sessionId) {
                  ORDER BY part.time_created ASC`;
   return { sql, params };
 }
-function opencodeQuery(dbPath, cwd, sessionId) {
-  let DatabaseSync;
+function loadNodeSqlite() {
   try {
     const nodeRequire = createRequire(import.meta.url);
-    ({ DatabaseSync } = nodeRequire("node:sqlite"));
+    return nodeRequire("node:sqlite").DatabaseSync;
   } catch {
+    return null;
+  }
+}
+function opencodeQuery(dbPath, cwd, sessionId) {
+  const DatabaseSync = loadNodeSqlite();
+  if (!DatabaseSync) {
     throw new Error(
       "Reading opencode storage needs the node:sqlite module (unflagged on Node 22.13+). Upgrade Node, or pass --transcript/--session for a JSONL-based harness."
     );
@@ -29156,6 +29016,541 @@ const piAdapter = jsonlAdapter({
   matchesSession: (fileName, sessionId) => fileName.endsWith(`_${sessionId}.jsonl`),
   extractLine: piExtractLine
 });
+const WINDOW_BYTES = 512 * 1024;
+function readWindowedLines(file, maxBytes = WINDOW_BYTES) {
+  let fd;
+  try {
+    fd = fs.openSync(file, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const size = fs.fstatSync(fd).size;
+    if (size <= 2 * maxBytes) {
+      const whole = Buffer.alloc(size);
+      fs.readSync(fd, whole, 0, size, 0);
+      return whole.toString("utf-8").split("\n");
+    }
+    const head = Buffer.alloc(maxBytes);
+    fs.readSync(fd, head, 0, maxBytes, 0);
+    const tail = Buffer.alloc(maxBytes);
+    fs.readSync(fd, tail, 0, maxBytes, size - maxBytes);
+    const headLines = head.toString("utf-8").split("\n");
+    headLines.pop();
+    const tailLines = tail.toString("utf-8").split("\n");
+    tailLines.shift();
+    return [...headLines, ...tailLines];
+  } catch {
+    return null;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+function lastAssistantModelFromLines(lines) {
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!line.includes('"model"')) {
+      continue;
+    }
+    try {
+      const message = JSON.parse(line).message;
+      if (message?.role === "assistant" && typeof message.model === "string") {
+        const found = { model: message.model };
+        if (typeof message.provider === "string") {
+          found.provider = message.provider;
+        }
+        return found;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function lastCodexModelFromLines(lines) {
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!line.includes('"turn_context"')) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(line);
+      if (parsed.type === "turn_context" && typeof parsed.payload?.model === "string") {
+        return parsed.payload.model;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function codexTranscriptBelongsTo(lines, cwd) {
+  for (const line of lines) {
+    if (!line.includes('"cwd"')) {
+      continue;
+    }
+    try {
+      const recorded = JSON.parse(line).payload?.cwd;
+      if (typeof recorded === "string" && cwdMatches(recorded, cwd, true)) {
+        return true;
+      }
+    } catch {
+    }
+  }
+  return false;
+}
+function* cwdAncestors(cwd) {
+  let current = path.resolve(cwd);
+  for (; ; ) {
+    yield current;
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return;
+    }
+    current = parent;
+  }
+}
+function newestAssistantModelInDir(dir, cwd) {
+  for (const file of listJsonlByMtimeDesc(dir)) {
+    const lines = readWindowedLines(file);
+    if (!lines || !transcriptBelongsTo(lines, cwd, true)) {
+      continue;
+    }
+    const found = lastAssistantModelFromLines(lines);
+    if (found) {
+      return found;
+    }
+  }
+  return null;
+}
+function existingSlugDirs(root, cwd, slugFor) {
+  const dirs = [];
+  for (const ancestor of cwdAncestors(cwd)) {
+    const dir = path.join(root, slugFor(ancestor));
+    if (fs.existsSync(dir)) {
+      dirs.push(dir);
+    }
+  }
+  return dirs;
+}
+function sniffClaudeModel(cwd, env, projectsDir = path.join(os.homedir(), ".claude", "projects")) {
+  const dirs = existingSlugDirs(projectsDir, cwd, claudeProjectSlug);
+  const sessionId = env.CLAUDE_CODE_SESSION_ID?.trim();
+  if (sessionId) {
+    for (const dir of dirs) {
+      const lines = readWindowedLines(path.join(dir, `${sessionId}.jsonl`));
+      const pinned = lines ? lastAssistantModelFromLines(lines) : null;
+      if (pinned) {
+        return pinned;
+      }
+    }
+  }
+  for (const dir of dirs) {
+    const found = newestAssistantModelInDir(dir, cwd);
+    if (found) {
+      return found;
+    }
+  }
+  return null;
+}
+function sniffPiModel(cwd, sessionsRoot = path.join(os.homedir(), ".pi", "agent", "sessions")) {
+  for (const dir of existingSlugDirs(sessionsRoot, cwd, piSessionSlug)) {
+    const found = newestAssistantModelInDir(dir, cwd);
+    if (found) {
+      return found;
+    }
+  }
+  return null;
+}
+const CODEX_SCAN_LIMIT = 20;
+const CODEX_STAT_LIMIT = 200;
+function sniffCodexModel(cwd, env, sessionsRoot = path.join(os.homedir(), ".codex", "sessions")) {
+  let names;
+  try {
+    names = fs.readdirSync(sessionsRoot, { recursive: true }).filter((name) => name.endsWith(".jsonl")).sort().reverse();
+  } catch {
+    return null;
+  }
+  const threadId = env.CODEX_THREAD_ID?.trim();
+  if (threadId) {
+    const pinned = names.find((name) => path.basename(name).endsWith(`-${threadId}.jsonl`));
+    if (pinned) {
+      const lines = readWindowedLines(path.join(sessionsRoot, pinned));
+      const model = lines ? lastCodexModelFromLines(lines) : null;
+      if (model) {
+        return model;
+      }
+    }
+  }
+  const byMtimeDesc = names.slice(0, CODEX_STAT_LIMIT).map((name) => {
+    const file = path.join(sessionsRoot, name);
+    try {
+      return { file, mtime: fs.statSync(file).mtimeMs };
+    } catch {
+      return null;
+    }
+  }).filter((entry) => entry !== null).sort((a, b) => b.mtime - a.mtime);
+  for (const entry of byMtimeDesc.slice(0, CODEX_SCAN_LIMIT)) {
+    const lines = readWindowedLines(entry.file);
+    if (!lines || !codexTranscriptBelongsTo(lines, cwd)) {
+      continue;
+    }
+    const model = lastCodexModelFromLines(lines);
+    if (model) {
+      return model;
+    }
+  }
+  return null;
+}
+function opencodeModelForCwd(cwd, dbPath = opencodeDbPath()) {
+  if (!fs.existsSync(dbPath)) {
+    return null;
+  }
+  const DatabaseSync = loadNodeSqlite();
+  if (!DatabaseSync) {
+    return null;
+  }
+  const directory = opencodeDirectoryFilter(path.resolve(cwd));
+  const sql = `SELECT message.data AS data
+                 FROM message
+                 JOIN session ON session.id = message.session_id
+                 WHERE json_extract(message.data, '$.role') = 'assistant'
+                   AND ${directory.clause}
+                 ORDER BY message.time_created DESC
+                 LIMIT 1`;
+  const db = new DatabaseSync(dbPath, { readOnly: true });
+  try {
+    const rows = db.prepare(sql).all(...directory.params);
+    if (rows.length === 0) {
+      return null;
+    }
+    const data = JSON.parse(rows[0].data);
+    if (typeof data.modelID !== "string") {
+      return null;
+    }
+    const found = { model: data.modelID };
+    if (typeof data.providerID === "string") {
+      found.provider = data.providerID;
+    }
+    return found;
+  } catch {
+    return null;
+  } finally {
+    db.close();
+  }
+}
+function sniffModel(harness, cwd, env, roots = {}) {
+  try {
+    switch (harness) {
+      case "claude-code":
+        return sniffClaudeModel(cwd, env, roots.claudeProjectsDir);
+      case "pi":
+        return sniffPiModel(cwd, roots.piSessionsRoot);
+      case "codex": {
+        const model = sniffCodexModel(cwd, env, roots.codexSessionsRoot);
+        return model ? { model } : null;
+      }
+      case "opencode":
+        return opencodeModelForCwd(cwd, roots.opencodeDb);
+      default:
+        return null;
+    }
+  } catch {
+    return null;
+  }
+}
+function denyPatterns(guards) {
+  const raw = guards?.denyModels;
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  return raw.filter((pattern) => typeof pattern === "string");
+}
+function globMatch(pattern, value) {
+  const regex = pattern.split(/([*?])/).map((part) => {
+    if (part === "*") {
+      return ".*";
+    }
+    if (part === "?") {
+      return ".";
+    }
+    return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }).join("");
+  return new RegExp(`^${regex}$`, "i").test(value);
+}
+function evaluateGuard(guards, detection) {
+  const patterns = denyPatterns(guards);
+  if (!detection.model) {
+    if (guards?.denyWhenUnknown === true) {
+      return {
+        ...detection,
+        guard: "deny",
+        reason: "model unknown and denyWhenUnknown is set"
+      };
+    }
+    return {
+      ...detection,
+      guard: "allow",
+      reason: patterns.length === 0 ? "no deny rules configured" : "model unknown, failing open"
+    };
+  }
+  if (patterns.length === 0) {
+    return { ...detection, guard: "allow", reason: "no deny rules configured" };
+  }
+  const candidates = [detection.model];
+  if (detection.provider) {
+    candidates.push(`${detection.provider}/${detection.model}`);
+  }
+  for (const pattern of patterns) {
+    if (candidates.some((candidate) => globMatch(pattern, candidate))) {
+      return {
+        ...detection,
+        guard: "deny",
+        matched: pattern,
+        reason: "model has native vision per guards.denyModels"
+      };
+    }
+  }
+  return { ...detection, guard: "allow", reason: "not on the deny list" };
+}
+function detectActiveModel(options) {
+  const env = options.env ?? process.env;
+  const envModel = env.MODLENS_MODEL?.trim();
+  if (envModel) {
+    return envModel.toLowerCase() === "none" ? { model: null, source: "env" } : { model: envModel, source: "env" };
+  }
+  const forced = env.MODLENS_HARNESS;
+  const harness = forced === "none" ? null : forced || (options.harness !== void 0 ? options.harness : detectHarnessDetailed().harness);
+  const sniffed = harness ? sniffModel(harness, options.cwd, env, options.roots) : null;
+  if (sniffed) {
+    const detection = {
+      model: sniffed.model,
+      source: "storage",
+      harness
+    };
+    if (sniffed.provider) {
+      detection.provider = sniffed.provider;
+    }
+    if (options.selfReported && options.selfReported.toLowerCase() !== sniffed.model.toLowerCase()) {
+      detection.selfReported = options.selfReported;
+    }
+    return detection;
+  }
+  if (options.selfReported) {
+    return { model: options.selfReported, source: "self-report", harness };
+  }
+  return { model: null, source: "none", harness };
+}
+function runGuard(guards, options) {
+  if (denyPatterns(guards).length === 0 && guards?.denyWhenUnknown !== true) {
+    return { model: null, source: "none", guard: "allow", reason: "no deny rules configured" };
+  }
+  return evaluateGuard(guards, detectActiveModel(options));
+}
+const MIN_NODE = "22.13";
+function versionParts(version) {
+  const match = /(\d+)\.(\d+)/.exec(version.replace(/^v/, ""));
+  if (!match) {
+    return [0, 0];
+  }
+  return [Number(match[1]), Number(match[2])];
+}
+function meetsMinimum(version, minimum) {
+  const [major, minor] = versionParts(version);
+  const [minMajor, minMinor] = versionParts(minimum);
+  return major > minMajor || major === minMajor && minor >= minMinor;
+}
+function checkNodeSqlite() {
+  const realEmit = process.emitWarning;
+  process.emitWarning = () => {
+  };
+  try {
+    const mod = createRequire(import.meta.url)("node:sqlite");
+    if (mod?.DatabaseSync) {
+      return {
+        available: true,
+        detail: "node:sqlite is available (OpenCode paste recovery)"
+      };
+    }
+    return { available: false, detail: "node:sqlite loaded but DatabaseSync is missing" };
+  } catch {
+    return {
+      available: false,
+      detail: "node:sqlite unavailable. Upgrade Node to 22.13+ for OpenCode paste recovery"
+    };
+  } finally {
+    process.emitWarning = realEmit;
+  }
+}
+function inspectProvider(descriptor, config2, env) {
+  if (descriptor.kind === "subprocess") {
+    const binaryPath = findOnPath(descriptor.bin, env);
+    return {
+      name: descriptor.name,
+      kind: "subprocess",
+      ready: binaryPath !== null,
+      binaryPath,
+      detail: binaryPath ? `${descriptor.bin} found at ${binaryPath}` : `${descriptor.bin} not on PATH`,
+      fix: binaryPath ? void 0 : descriptor.install
+    };
+  }
+  const settings = resolveProviderSettings(descriptor.name, config2, env);
+  const statuses = (descriptor.required ?? []).map((req) => {
+    const envValue = req.env ? env[req.env]?.trim() : void 0;
+    const value = settings[req.field]?.trim();
+    const source = envValue ? "env" : value ? "file" : "missing";
+    return { field: req.field, present: Boolean(value), source, env: req.env };
+  });
+  const missing = statuses.filter((s) => !s.present).map((s) => s.field);
+  const ready = missing.length === 0;
+  const detail = ready ? statuses.map((s) => `${s.field}: ${s.source}`).join(", ") : `missing: ${missing.join(", ")}`;
+  return {
+    name: descriptor.name,
+    kind: "api",
+    ready,
+    settings: statuses,
+    detail,
+    fix: ready ? void 0 : descriptor.fix
+  };
+}
+function resolveSelection(config2, providerFlag) {
+  const raw = providerFlag?.trim() || config2.provider?.trim() || "antigravity-cli";
+  const source = providerFlag?.trim() ? "flag" : config2.provider?.trim() ? "config" : "default";
+  let canonical;
+  try {
+    canonical = resolveProvider(raw).name;
+  } catch {
+    canonical = null;
+  }
+  const reason = source === "flag" ? `-p ${raw} on the command line` : source === "config" ? "provider set in the config file" : "built-in default (no -p flag and no provider in the config file)";
+  return { provider: raw, canonical, source, reason };
+}
+function inspectConfigFile(configPath) {
+  try {
+    const stat = fs.statSync(configPath);
+    const mode = stat.mode & 511;
+    const enforcesPosixPerms = typeof process.getuid === "function";
+    const permissionsOk = !enforcesPosixPerms || (mode & 63) === 0;
+    return {
+      path: configPath,
+      exists: true,
+      mode: mode.toString(8).padStart(3, "0"),
+      permissionsOk,
+      note: permissionsOk ? void 0 : "group/world can read this file. Run: chmod 600 to lock it down"
+    };
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return {
+        path: configPath,
+        exists: false,
+        mode: null,
+        permissionsOk: true,
+        note: "no config file (using env vars and built-in defaults)"
+      };
+    }
+    return {
+      path: configPath,
+      exists: true,
+      mode: null,
+      permissionsOk: false,
+      note: `cannot stat: ${error.message}`
+    };
+  }
+}
+function buildDoctorReport(input) {
+  const env = input.env ?? process.env;
+  const configPath = input.configPath ?? CONFIG_PATH;
+  const harnessDetection = detectHarnessDetailed();
+  const guardDetection = detectActiveModel({
+    cwd: process.cwd(),
+    env,
+    harness: harnessDetection.harness
+  });
+  const guardVerdict = evaluateGuard(input.config.guards, guardDetection);
+  return {
+    node: {
+      version: process.version,
+      minimum: MIN_NODE,
+      meetsMinimum: meetsMinimum(process.version, MIN_NODE)
+    },
+    nodeSqlite: checkNodeSqlite(),
+    providers: PROVIDER_DESCRIPTORS.map((d) => inspectProvider(d, input.config, env)),
+    selection: resolveSelection(input.config, input.providerFlag),
+    chains: {
+      local: providerChain("local", input.config, env).map((p) => p.name),
+      remote: providerChain("remote", input.config, env).map((p) => p.name)
+    },
+    harness: { detected: harnessDetection.harness, source: harnessDetection.source },
+    guard: {
+      rules: denyPatterns(input.config.guards).length,
+      denyWhenUnknown: input.config.guards?.denyWhenUnknown ?? false,
+      model: guardVerdict.model,
+      source: guardVerdict.source,
+      verdict: guardVerdict.guard,
+      matched: guardVerdict.matched,
+      reason: guardVerdict.reason
+    },
+    config: inspectConfigFile(configPath)
+  };
+}
+function mark(ok) {
+  return ok ? "[ok]" : "[!!]";
+}
+function renderDoctorReport(report) {
+  const lines = [];
+  lines.push("modlens doctor");
+  lines.push("(local diagnostics only: no network calls, no provider quota spent)");
+  lines.push("");
+  lines.push("Node");
+  lines.push(
+    `  ${mark(report.node.meetsMinimum)} ${report.node.version} (minimum ${report.node.minimum})`
+  );
+  lines.push(`  ${mark(report.nodeSqlite.available)} ${report.nodeSqlite.detail}`);
+  lines.push("");
+  lines.push("Providers");
+  for (const provider of report.providers) {
+    lines.push(`  ${mark(provider.ready)} ${provider.name}: ${provider.detail}`);
+    if (provider.fix) {
+      lines.push(`       fix: ${provider.fix}`);
+    }
+  }
+  lines.push("");
+  lines.push("Selected provider");
+  const canonicalNote = report.selection.canonical && report.selection.canonical !== report.selection.provider ? ` (canonical: ${report.selection.canonical})` : report.selection.canonical === null ? " (unknown provider name)" : "";
+  lines.push(`  ${report.selection.provider}${canonicalNote}`);
+  lines.push(`  reason: ${report.selection.reason}`);
+  lines.push("");
+  lines.push("Failover chains (what a run tries, in order)");
+  const chainLine = (chain) => chain.length > 0 ? chain.join(" -> ") : "(none available)";
+  lines.push(`  local:  ${chainLine(report.chains.local)}`);
+  lines.push(`  remote: ${chainLine(report.chains.remote)}`);
+  lines.push("");
+  lines.push("Harness");
+  lines.push(
+    report.harness.detected ? `  ${report.harness.detected} (via ${report.harness.source})` : `  none detected (${report.harness.source})`
+  );
+  lines.push("");
+  lines.push("Guard (should the vision engine run for the active model?)");
+  lines.push(
+    `  rules: ${report.guard.rules} deny pattern(s), denyWhenUnknown: ${report.guard.denyWhenUnknown}`
+  );
+  lines.push(`  active model: ${report.guard.model ?? "unknown"} (via ${report.guard.source})`);
+  lines.push(
+    `  verdict: ${report.guard.verdict}${report.guard.matched ? ` (matched "${report.guard.matched}")` : ""}, ${report.guard.reason}`
+  );
+  lines.push("");
+  lines.push("Config file");
+  lines.push(`  path: ${report.config.path}`);
+  if (report.config.exists) {
+    lines.push(
+      `  ${mark(report.config.permissionsOk)} exists, mode ${report.config.mode ?? "?"}`
+    );
+  } else {
+    lines.push("  not present");
+  }
+  if (report.config.note) {
+    lines.push(`  note: ${report.config.note}`);
+  }
+  return lines.join("\n");
+}
 function extensionFromMediaType(mediaType) {
   const subtype = mediaType.split("/")[1]?.split("+")[0]?.replace(/[^a-z0-9]/gi, "");
   return subtype ? subtype.toLowerCase() : "bin";
@@ -29334,7 +29729,7 @@ function recoverPastedImages(options = {}) {
   return result;
 }
 const program = new Command();
-program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.4.0");
+program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.5.0");
 program.command("analyze", { isDefault: true }).description("Analyze an image into structured JSON evidence (default command)").requiredOption("-i, --input <path|url>", "Input image path or https URL").option("-o, --output <path>", "Write result JSON to a file").option("-m, --model <name>", "Provider model name").option("-p, --provider <name>", `Vision provider (${listProviders().join(", ")})`).option("--prompt <text>", "Extra focus for this image").option("--timeout <ms>", "Provider timeout in milliseconds", "180000").option("--provider-bin <path>", "Provider binary path (default: agy)").option("--workdir <path>", "Working directory for the provider").option(
   "--extra-body <json>",
   `JSON merged into the API request body, e.g. '{"thinking":{"type":"disabled"}}'`
@@ -29344,6 +29739,18 @@ program.command("analyze", { isDefault: true }).description("Analyze an image in
     if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
       throw new Error("Invalid --timeout. Use a positive integer in milliseconds.");
     }
+    const config2 = loadConfigFile();
+    if (process.env.MODLENS_MODEL?.trim()) {
+      const verdict = runGuard(config2.guards, {
+        cwd: process.cwd(),
+        env: process.env
+      });
+      if (verdict.guard === "deny" && verdict.matched) {
+        throw new Error(
+          `Invocation guard denied this read: active model "${verdict.model}" matches guards.denyModels pattern "${verdict.matched}". A model with native vision should read the image itself. To override, unset MODLENS_MODEL or edit guards in ${CONFIG_PATH}.`
+        );
+      }
+    }
     const result = await analyzeImage({
       input: options.input,
       provider: options.provider,
@@ -29352,7 +29759,8 @@ program.command("analyze", { isDefault: true }).description("Analyze an image in
       timeoutMs,
       providerBin: options.providerBin,
       workdir: options.workdir,
-      extraBody: options.extraBody ? parseExtraBody(options.extraBody, "--extra-body") : void 0
+      extraBody: options.extraBody ? parseExtraBody(options.extraBody, "--extra-body") : void 0,
+      config: config2
     });
     const output = JSON.stringify(result, null, 2);
     if (options.output) {
@@ -29402,6 +29810,29 @@ program.command("recover-paste").description(
     process.exit(1);
   }
 });
+program.command("guard").description(
+  "Check whether the vision engine should run for the active model (exit 0 allow, 1 deny, 2 error)"
+).option(
+  "--model <name>",
+  "The calling agent's own model name; weakest signal, used when env and session storage say nothing"
+).option("--cwd <path>", "Project directory of the session", process.cwd()).action((options) => {
+  try {
+    const verdict = runGuard(loadConfigFile().guards, {
+      cwd: options.cwd,
+      env: process.env,
+      selfReported: options.model
+    });
+    process.stdout.write(`${JSON.stringify(verdict, null, 2)}
+`);
+    process.exitCode = verdict.guard === "deny" ? 1 : 0;
+  } catch (error) {
+    process.stderr.write(
+      `Error: ${error instanceof Error ? error.message : String(error)}
+`
+    );
+    process.exitCode = 2;
+  }
+});
 program.command("doctor").description(
   "Diagnose local config and routing (Node, providers, selection, harness) without spending quota or hitting the network"
 ).option("--json", "Emit the report as JSON").option("-p, --provider <name>", "Show which provider this -p value would select").action((options) => {