@liustack/modlens 3.6.0 → 3.8.0

package/dist/main.js

@@ -3,7 +3,7 @@ import { Command } from "commander";
 import * as fs from "fs";
 import * as path from "path";
 import * as childProcess from "child_process";
-import { spawn } from "child_process";
+import { execFileSync, spawn } from "child_process";
 import * as os from "os";
 import { fileURLToPath } from "url";
 import require$$0$1 from "node:assert";
@@ -33,6 +33,82 @@ import * as dns$1 from "dns/promises";
 import { isIP } from "net";
 import { createRequire } from "module";
 import * as crypto from "crypto";
+function denyPatterns(guards) {
+  return stringPatterns(guards?.denyModels);
+}
+function allowPatterns(guards) {
+  return stringPatterns(guards?.allowModels);
+}
+function stringPatterns(raw) {
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  return raw.filter((pattern) => typeof pattern === "string");
+}
+function globMatch(pattern, value) {
+  const regex = pattern.split(/([*?])/).map((part) => {
+    if (part === "*") {
+      return ".*";
+    }
+    if (part === "?") {
+      return ".";
+    }
+    return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }).join("");
+  return new RegExp(`^${regex}$`, "i").test(value);
+}
+function evaluateGuard(guards, detection) {
+  const deny = denyPatterns(guards);
+  const allow = allowPatterns(guards);
+  if (!detection.model) {
+    if (guards?.denyWhenUnknown === true) {
+      return {
+        ...detection,
+        guard: "deny",
+        reason: "model unknown and denyWhenUnknown is set"
+      };
+    }
+    return {
+      ...detection,
+      guard: "allow",
+      reason: deny.length === 0 && allow.length === 0 ? "no deny rules configured" : "model unknown, failing open"
+    };
+  }
+  if (deny.length === 0 && allow.length === 0) {
+    return { ...detection, guard: "allow", reason: "no deny rules configured" };
+  }
+  const candidates = [detection.model];
+  if (detection.provider) {
+    candidates.push(`${detection.provider}/${detection.model}`);
+  }
+  const firstMatch = (patterns) => patterns.find((pattern) => candidates.some((candidate) => globMatch(pattern, candidate)));
+  const denied = firstMatch(deny);
+  if (denied) {
+    return {
+      ...detection,
+      guard: "deny",
+      matched: denied,
+      reason: "model has native vision per guards.denyModels"
+    };
+  }
+  if (allow.length > 0) {
+    const allowed = firstMatch(allow);
+    if (allowed) {
+      return {
+        ...detection,
+        guard: "allow",
+        matched: allowed,
+        reason: "model is on guards.allowModels"
+      };
+    }
+    return {
+      ...detection,
+      guard: "deny",
+      reason: "not on guards.allowModels: only listed models run the engine"
+    };
+  }
+  return { ...detection, guard: "allow", reason: "not on the deny list" };
+}
 var undici = { exports: {} };
 var symbols;
 var hasRequiredSymbols;
@@ -27335,6 +27411,8 @@ async function readCapped(response2, url) {
   }
   return Buffer.concat(chunks);
 }
+const JSON_TEMPLATE_INSTRUCTION = `Respond with ONE JSON object only, no markdown fences, no commentary. Fill this exact structure with your findings from the image (do not repeat this template literally, replace every value):
+{"summary":"one paragraph describing the image","ocr":{"full_text":"all visible text","lines":[{"text":"one line","language":"en"}]},"layout":{"regions":[{"type":"title|subtitle|paragraph|list|table|chart|form|code|image|icon|other","reading_order":1,"text":"region text"}]},"semantics":{"scene":"what kind of scene","intent":"what the image is for","entities":[{"name":"entity","type":"kind","evidence":"where seen"}],"relations":[{"subject":"a","predicate":"relates to","object":"b"}]},"visual":{"dominant_colors":["color"],"style":"visual style","notes":["notable visual detail"]},"uncertainty":["anything unreadable or ambiguous"]}`;
 function buildVisionPrompt(options) {
   const readInstruction = options.imageKind === "inline" ? "Analyze the image attached to this message." : options.imageKind === "remote" ? `Fetch the image at this URL and analyze it: ${options.imageSource}` : `Read the image file at this path and analyze it: ${options.imageSource}`;
   const basePrompt = `${readInstruction}
@@ -28000,8 +28078,7 @@ async function executeOpenaiCompat(options) {
     extraPrompt: options.extraPrompt
   })}
 
-Respond with ONE JSON object only, no markdown fences, no commentary. Fill this exact structure with your findings from the image (do not repeat this template literally, replace every value):
-{"summary":"one paragraph describing the image","ocr":{"full_text":"all visible text","lines":[{"text":"one line","language":"en"}]},"layout":{"regions":[{"type":"title|subtitle|paragraph|list|table|chart|form|code|image|icon|other","reading_order":1,"text":"region text"}]},"semantics":{"scene":"what kind of scene","intent":"what the image is for","entities":[{"name":"entity","type":"kind","evidence":"where seen"}],"relations":[{"subject":"a","predicate":"relates to","object":"b"}]},"visual":{"dominant_colors":["color"],"style":"visual style","notes":["notable visual detail"]},"uncertainty":["anything unreadable or ambiguous"]}`;
+${JSON_TEMPLATE_INSTRUCTION}`;
   const startedAt = Date.now();
   const response2 = await fetch(`${baseUrl}/chat/completions`, {
     method: "POST",
@@ -28098,6 +28175,7 @@ function listProviders() {
   return [...new Set(Object.values(PROVIDERS).map((provider) => provider.name))];
 }
 const STRING_FIELDS = ["apiKey", "baseUrl", "model"];
+const REUSE_HARNESSES = ["claude", "codex", "opencode", "pi"];
 const CONFIG_DIR = path.join(os.homedir(), ".modlens");
 const CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 const ENV_BINDINGS = {
@@ -28149,13 +28227,33 @@ function setConfigValue(dottedKey, value, configPath = CONFIG_PATH) {
   const config2 = loadConfigFile(configPath);
   if (dottedKey === "provider") {
     config2.provider = value;
+  } else if (dottedKey.startsWith("reuse.")) {
+    const harness = dottedKey.slice("reuse.".length);
+    if (!REUSE_HARNESSES.includes(harness)) {
+      throw new Error(
+        `Unknown reuse harness: ${harness}. Use ${REUSE_HARNESSES.join(", ")}.`
+      );
+    }
+    const key = harness;
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "") {
+      delete config2.reuse?.[key];
+      if (config2.reuse && Object.keys(config2.reuse).length === 0) {
+        delete config2.reuse;
+      }
+    } else if (normalized !== "true" && normalized !== "false") {
+      throw new Error(`reuse.${harness} must be true or false (empty clears).`);
+    } else {
+      config2.reuse ??= {};
+      config2.reuse[key] = normalized === "true";
+    }
   } else if (dottedKey.startsWith("guards.")) {
     setGuardsValue(config2, dottedKey.slice("guards.".length), value);
   } else {
     const dot = dottedKey.indexOf(".");
     if (dot <= 0 || dot === dottedKey.length - 1) {
       throw new Error(
-        `Invalid config key: ${dottedKey}. Use "provider", "guards.<denyModels|allowModels|denyWhenUnknown>", or "<provider>.<apiKey|baseUrl|model|extraBody>".`
+        `Invalid config key: ${dottedKey}. Use "provider", "reuse.<claude|codex|opencode|pi>", "guards.<denyModels|allowModels|denyWhenUnknown>", or "<provider>.<apiKey|baseUrl|model|extraBody>".`
       );
     }
     const providerName = dottedKey.slice(0, dot);
@@ -28280,6 +28378,9 @@ function renderEffectiveConfig(config2, env = process.env) {
     if (config2.guards.denyModels !== void 0) {
       guards.denyModels = `${JSON.stringify(config2.guards.denyModels)} (file)`;
     }
+    if (config2.guards.allowModels !== void 0) {
+      guards.allowModels = `${JSON.stringify(config2.guards.allowModels)} (file)`;
+    }
     if (config2.guards.denyWhenUnknown !== void 0) {
       guards.denyWhenUnknown = `${config2.guards.denyWhenUnknown} (file)`;
     }
@@ -28287,6 +28388,14 @@ function renderEffectiveConfig(config2, env = process.env) {
       effective.guards = guards;
     }
   }
+  if (config2.reuse && Object.keys(config2.reuse).length > 0) {
+    effective.reuse = Object.fromEntries(
+      Object.entries(config2.reuse).map(([harness, granted]) => [
+        harness,
+        `${granted} (file)`
+      ])
+    );
+  }
   return JSON.stringify(effective, null, 2);
 }
 function maskKey(key) {
@@ -28356,15 +28465,18 @@ function providerAvailable(name, config2, env = process.env) {
   return (descriptor.required ?? []).every((req) => Boolean(settings[req.field]?.trim()));
 }
 const LOCAL_FAILOVER_ORDER = [
-  "antigravity-cli",
   "gemini-api",
   "openai",
   "anthropic",
+  "antigravity-cli",
   "claude-cli"
 ];
 const REMOTE_FAILOVER_ORDER = ["gemini-api", "openai", "anthropic", "antigravity-cli"];
 function providerChain(kind, config2, env = process.env) {
-  const names = [...kind === "remote" ? REMOTE_FAILOVER_ORDER : LOCAL_FAILOVER_ORDER];
+  let names = [...kind === "remote" ? REMOTE_FAILOVER_ORDER : LOCAL_FAILOVER_ORDER];
+  if (config2.reuse?.claude === false) {
+    names = names.filter((name) => name !== "claude-cli");
+  }
   const preferred = config2.provider?.trim();
   if (preferred) {
     let canonical = null;
@@ -28384,6 +28496,557 @@ function providerChain(kind, config2, env = process.env) {
   }
   return names.filter((name) => providerAvailable(name, config2, env)).map((name) => resolveProvider(name));
 }
+const VISION_MODEL_PATTERNS = [
+  "claude-*",
+  "gpt-4o*",
+  "gpt-4.1*",
+  "gpt-5*",
+  "o3*",
+  "o4*",
+  "gemini-*",
+  "glm-*v*",
+  "qwen*-vl*",
+  "qwen3.5-plus*",
+  "qwen3.6-plus*",
+  "kimi-k2.5*",
+  "kimi-k2.6*",
+  "kimi-k2.7*",
+  "kimi-k3*",
+  "moonshot-v1-*vision*",
+  "minimax-vl*",
+  "minimax-m3*",
+  "deepseek-vl*",
+  "deepseek-ocr*",
+  "janus*",
+  "pixtral*",
+  "llama-4*",
+  "llama-3.2-*vision*",
+  "grok-4*",
+  "grok-2-vision*",
+  "internvl*"
+];
+function isVisionModel(modelId) {
+  const bare = modelId.includes("/") ? modelId.slice(modelId.lastIndexOf("/") + 1) : modelId;
+  return VISION_MODEL_PATTERNS.some((pattern) => globMatch(pattern, bare));
+}
+const DEFAULT_TTL_MS = 6 * 60 * 60 * 1e3;
+const CLI_TIMEOUT_MS = 1e4;
+function defaultRunCli(bin, args, timeoutMs) {
+  return execFileSync(bin, args, { encoding: "utf-8", timeout: timeoutMs, stdio: "pipe" });
+}
+function timed(run) {
+  const start = Date.now();
+  const probe = run();
+  return { ...probe, elapsedMs: Date.now() - start };
+}
+function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, "utf-8"));
+}
+function probeClaude(env) {
+  return timed(() => {
+    const cliPath = findOnPath("claude", env);
+    if (!cliPath) {
+      return {
+        harness: "claude-code",
+        cliFound: false,
+        visionModels: [],
+        source: "none"
+      };
+    }
+    return {
+      harness: "claude-code",
+      cliFound: true,
+      cliPath,
+      visionModels: ["anthropic/* (all current models)"],
+      source: "builtin-table"
+    };
+  });
+}
+function probeCodex(env, home) {
+  return timed(() => {
+    const cliPath = findOnPath("codex", env);
+    const base = { harness: "codex", cliFound: cliPath !== null };
+    if (!cliPath) {
+      return { ...base, visionModels: [], source: "none" };
+    }
+    const codexHome = path.join(home, ".codex");
+    const loggedIn = fs.existsSync(path.join(codexHome, "auth.json"));
+    if (!fs.existsSync(path.join(codexHome, "config.toml"))) {
+      return {
+        ...base,
+        cliPath,
+        loggedIn,
+        visionModels: ["default"],
+        source: "builtin-table"
+      };
+    }
+    try {
+      const toml = fs.readFileSync(path.join(codexHome, "config.toml"), "utf-8");
+      const catalogPath = toml.match(/^model_catalog_json\s*=\s*"([^"]+)"/m)?.[1];
+      const thirdParty = /^model_provider\s*=/m.test(toml);
+      if (!catalogPath) {
+        return thirdParty ? { ...base, cliPath, loggedIn, visionModels: [], source: "none" } : {
+          ...base,
+          cliPath,
+          loggedIn,
+          visionModels: ["default"],
+          source: "builtin-table"
+        };
+      }
+      const catalog = readJson(catalogPath);
+      const vision = (catalog.models ?? []).filter((m) => m.slug && (m.input_modalities ?? []).includes("image")).map((m) => m.slug);
+      return {
+        ...base,
+        cliPath,
+        loggedIn,
+        visionModels: vision,
+        source: "metadata"
+      };
+    } catch (error) {
+      return {
+        ...base,
+        cliPath,
+        loggedIn,
+        visionModels: [],
+        source: "none",
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  });
+}
+function probePi(env, home) {
+  return timed(() => {
+    const cliPath = findOnPath("pi", env);
+    const base = { harness: "pi", cliFound: cliPath !== null };
+    if (!cliPath) {
+      return { ...base, visionModels: [], source: "none" };
+    }
+    const agentDir = path.join(home, ".pi", "agent");
+    try {
+      const auth = readJson(path.join(agentDir, "auth.json"));
+      const providersWithCreds = new Set(Object.keys(auth));
+      const store = readJson(path.join(agentDir, "models-store.json"));
+      const vision = [];
+      for (const entry of Object.values(store)) {
+        for (const model of entry?.models ?? []) {
+          if (model.id && (model.input ?? []).includes("image") && model.provider && providersWithCreds.has(model.provider)) {
+            vision.push(model.id);
+          }
+        }
+      }
+      return {
+        ...base,
+        cliPath,
+        loggedIn: providersWithCreds.size > 0,
+        visionModels: vision,
+        source: "metadata"
+      };
+    } catch (error) {
+      return {
+        ...base,
+        cliPath,
+        visionModels: [],
+        source: "none",
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  });
+}
+function probeOpencode(env, runCli) {
+  return timed(() => {
+    const cliPath = findOnPath("opencode", env);
+    const base = { harness: "opencode", cliFound: cliPath !== null };
+    if (!cliPath) {
+      return { ...base, visionModels: [], source: "none" };
+    }
+    try {
+      const listing = runCli(cliPath, ["models"], CLI_TIMEOUT_MS);
+      const vision = listing.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && isVisionModel(line));
+      return { ...base, cliPath, visionModels: vision, source: "builtin-table" };
+    } catch (error) {
+      return {
+        ...base,
+        cliPath,
+        visionModels: [],
+        source: "none",
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  });
+}
+function readCache(cachePath, ttlMs) {
+  try {
+    const cached = readJson(cachePath);
+    if (!cached.cachedAt || !Array.isArray(cached.probes)) {
+      return null;
+    }
+    const cachedAtMs = Date.parse(cached.cachedAt);
+    if (!Number.isFinite(cachedAtMs) || Date.now() - cachedAtMs > ttlMs) {
+      return null;
+    }
+    return cached;
+  } catch {
+    return null;
+  }
+}
+function discoverAuto(options = {}) {
+  const env = options.env ?? process.env;
+  const home = options.home ?? os.homedir();
+  const cachePath = options.cachePath ?? path.join(home, ".modlens", "auto-cache.json");
+  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+  if (!options.fresh) {
+    const cached = readCache(cachePath, ttlMs);
+    if (cached) {
+      return { probes: cached.probes, cachedAt: cached.cachedAt, fromCache: true };
+    }
+  }
+  const runCli = options.runCli ?? defaultRunCli;
+  const probes = [
+    probeClaude(env),
+    probeCodex(env, home),
+    probeOpencode(env, runCli),
+    probePi(env, home)
+  ];
+  const cachedAt = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
+    fs.writeFileSync(cachePath, JSON.stringify({ cachedAt, probes }, null, 2), {
+      mode: 384
+    });
+  } catch {
+  }
+  return { probes, cachedAt, fromCache: false };
+}
+const KEY_FETCH_TIMEOUT_MS = 1e4;
+function codexCliRoute(visionModel) {
+  return {
+    name: "codex-cli",
+    defaultModel: visionModel,
+    isolateWorkdir: true,
+    reuseNote: "this read reused the local Codex CLI login and spent that account's quota.",
+    buildInvocation: (options) => {
+      if (options.imageKind === "remote") {
+        throw new Error(
+          "codex-cli route reads local files only. Remote URLs stay on the inline providers."
+        );
+      }
+      const prompt = `${buildVisionPrompt({
+        imageSource: options.imageSource,
+        imageKind: "inline",
+        extraPrompt: options.extraPrompt
+      })}
+
+${JSON_TEMPLATE_INSTRUCTION}`;
+      const model = options.model || visionModel;
+      const args = [
+        "exec",
+        "--skip-git-repo-check",
+        "--ephemeral",
+        "-s",
+        "read-only",
+        "--json",
+        "-i",
+        options.imageSource
+      ];
+      if (model && model !== "default") {
+        args.push("-m", model);
+      }
+      args.push("--", prompt);
+      return {
+        command: options.providerBin || "codex",
+        args,
+        cwd: path.resolve(options.workdir || path.dirname(options.imageSource))
+      };
+    },
+    parseOutput: (stdout) => {
+      let threadId = null;
+      let usage = null;
+      let lastMessage = null;
+      for (const line of stdout.split("\n")) {
+        const event = tryParseJson(line.trim());
+        if (!event) {
+          continue;
+        }
+        if (event.type === "thread.started" && event.thread_id) {
+          threadId = event.thread_id;
+        }
+        if (event.type === "turn.completed" && event.usage !== void 0) {
+          usage = event.usage;
+        }
+        if (event.type === "item.completed" && event.item?.type === "agent_message" && typeof event.item.text === "string") {
+          lastMessage = event.item.text;
+        }
+      }
+      if (!lastMessage) {
+        throw new Error(
+          "codex exec produced no agent message. Check the Codex login (run: codex)."
+        );
+      }
+      const result = extractJson(lastMessage);
+      if (result === null) {
+        throw new Error(`codex returned a non-JSON answer: ${truncate(lastMessage)}`);
+      }
+      return {
+        result,
+        meta: { conversationId: threadId, durationSeconds: null, usage }
+      };
+    }
+  };
+}
+function opencodeCliRoute(modelId) {
+  return {
+    name: "opencode-cli",
+    defaultModel: modelId,
+    isolateWorkdir: true,
+    reuseNote: `this read reused OpenCode's ${modelId} and spent that account's quota.`,
+    buildInvocation: (options) => {
+      if (options.imageKind === "remote") {
+        throw new Error(
+          "opencode-cli route reads local files only. Remote URLs stay on the inline providers."
+        );
+      }
+      const prompt = `${buildVisionPrompt({
+        imageSource: options.imageSource,
+        imageKind: "inline",
+        extraPrompt: options.extraPrompt
+      })}
+
+${JSON_TEMPLATE_INSTRUCTION}`;
+      return {
+        command: options.providerBin || "opencode",
+        args: [
+          "run",
+          prompt,
+          "-m",
+          options.model || modelId,
+          "--format",
+          "json",
+          "-f",
+          options.imageSource
+        ],
+        cwd: path.resolve(options.workdir || path.dirname(options.imageSource))
+      };
+    },
+    parseOutput: (stdout) => {
+      let sessionId = null;
+      let usage = null;
+      const texts = [];
+      for (const line of stdout.split("\n")) {
+        const event = tryParseJson(line.trim());
+        if (!event) {
+          continue;
+        }
+        sessionId ??= event.sessionID ?? null;
+        if (event.type === "text" && typeof event.part?.text === "string") {
+          texts.push(event.part.text);
+        }
+        if (event.type === "step_finish" && event.part?.tokens !== void 0) {
+          usage = event.part.tokens;
+        }
+      }
+      const answer = texts.join("").trim();
+      if (!answer) {
+        throw new Error("opencode run produced no text answer.");
+      }
+      const result = extractJson(answer);
+      if (result === null) {
+        throw new Error(`opencode returned a non-JSON answer: ${truncate(answer)}`);
+      }
+      return {
+        result,
+        meta: { conversationId: sessionId, durationSeconds: null, usage }
+      };
+    }
+  };
+}
+const PI_API_TARGETS = {
+  "openai-completions": "openai",
+  "anthropic-messages": "anthropic"
+};
+const DEFAULT_TARGETS = {
+  openai: openaiCompatProvider,
+  anthropic: anthropicApiProvider,
+  "gemini-api": geminiApiProvider
+};
+function piCliRoute(providerName, modelId) {
+  return {
+    name: "pi-cli",
+    defaultModel: modelId,
+    isolateWorkdir: true,
+    reuseNote: `this read reused pi's ${providerName}/${modelId} and spent that account's quota.`,
+    buildInvocation: (options) => {
+      if (options.imageKind === "remote") {
+        throw new Error(
+          "pi-cli route reads local files only. Remote URLs stay on the inline providers."
+        );
+      }
+      const prompt = `${buildVisionPrompt({
+        imageSource: options.imageSource,
+        imageKind: "inline",
+        extraPrompt: options.extraPrompt
+      })}
+
+${JSON_TEMPLATE_INSTRUCTION}`;
+      return {
+        command: options.providerBin || "pi",
+        args: [
+          "-p",
+          "--no-session",
+          "--no-tools",
+          "--mode",
+          "json",
+          "--provider",
+          providerName,
+          "--model",
+          options.model || modelId,
+          `@${options.imageSource}`,
+          prompt
+        ],
+        cwd: path.resolve(options.workdir || path.dirname(options.imageSource))
+      };
+    },
+    parseOutput: (stdout) => {
+      let final = null;
+      for (const line of stdout.split("\n")) {
+        const event = tryParseJson(line.trim());
+        if (event?.type === "message_end" && event.message) {
+          final = event.message;
+        }
+      }
+      const answer = (final?.content ?? []).filter((part) => part.type === "text" && typeof part.text === "string").map((part) => part.text).join("").trim();
+      if (!answer) {
+        throw new Error("pi produced no text answer. Check pi and its credentials.");
+      }
+      const result = extractJson(answer);
+      if (result === null) {
+        throw new Error(`pi returned a non-JSON answer: ${truncate(answer)}`);
+      }
+      return {
+        result,
+        meta: {
+          conversationId: final?.responseId ?? null,
+          durationSeconds: null,
+          usage: final?.usage ?? null
+        }
+      };
+    }
+  };
+}
+function piRoutes(home, env, targets = DEFAULT_TARGETS) {
+  const empty = { inline: [], agents: [] };
+  const piPath = findOnPath("pi", env);
+  if (!piPath) {
+    return empty;
+  }
+  const agentDir = path.join(home, ".pi", "agent");
+  let auth;
+  let store;
+  try {
+    auth = JSON.parse(fs.readFileSync(path.join(agentDir, "auth.json"), "utf-8"));
+    store = JSON.parse(fs.readFileSync(path.join(agentDir, "models-store.json"), "utf-8"));
+  } catch {
+    return empty;
+  }
+  const routes = [];
+  const agents = [];
+  const usedTargets = /* @__PURE__ */ new Set();
+  for (const entry of Object.values(store)) {
+    for (const model of entry?.models ?? []) {
+      if (!model.id || !model.provider || !model.baseUrl || !(model.input ?? []).includes("image") || !(model.provider in auth)) {
+        continue;
+      }
+      const credential = auth[model.provider];
+      const targetName = PI_API_TARGETS[model.api ?? ""];
+      const target = targetName ? targets[targetName] : void 0;
+      const targetExecute = target?.execute;
+      if (!target || !targetExecute || credential?.type !== "api_key") {
+        if (agents.length < 2) {
+          agents.push(piCliRoute(model.provider, model.id));
+        }
+        continue;
+      }
+      if (usedTargets.has(target.name)) {
+        continue;
+      }
+      usedTargets.add(target.name);
+      const { id, provider, baseUrl } = model;
+      routes.push({
+        name: `pi:${target.name}`,
+        defaultModel: id,
+        reuseNote: `this read reused pi's ${provider} credentials for ${id} and spent that account's quota.`,
+        execute: async (options) => {
+          const apiKey = fetchPiKey(
+            piPath,
+            id,
+            provider,
+            Math.min(KEY_FETCH_TIMEOUT_MS, options.timeoutMs || KEY_FETCH_TIMEOUT_MS)
+          );
+          return targetExecute({
+            ...options,
+            settings: {
+              ...options.settings ?? {},
+              apiKey,
+              baseUrl,
+              model: options.model || id
+            }
+          });
+        }
+      });
+    }
+  }
+  return { inline: routes.slice(0, 2), agents };
+}
+function fetchPiKey(piPath, modelId, provider, timeoutMs) {
+  try {
+    const key = execFileSync(
+      piPath,
+      ["auth", "print-api-key", "--model", modelId, "--provider", provider],
+      { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], timeout: timeoutMs }
+    ).trim();
+    if (!key) {
+      throw new Error("empty");
+    }
+    return key;
+  } catch {
+    throw new Error(
+      `pi could not print an API key for ${provider}/${modelId}. Run \`pi auth\` to check that credential.`
+    );
+  }
+}
+function reuseProviders(kind, config2, options = {}) {
+  const env = options.env ?? process.env;
+  const home = options.home ?? os.homedir();
+  const grants = config2.reuse ?? {};
+  const inline = [];
+  const agents = [];
+  let piAgents = [];
+  if (grants.pi === true) {
+    try {
+      const pi = piRoutes(home, env, options.targets);
+      inline.push(...pi.inline);
+      piAgents = pi.agents;
+    } catch {
+    }
+  }
+  if (kind === "local" && (grants.codex === true || grants.opencode === true)) {
+    try {
+      const discovery = options.discovery ?? discoverAuto({ env, home });
+      const codex = discovery.probes.find((probe) => probe.harness === "codex");
+      if (grants.codex === true && codex?.cliFound && codex.loggedIn !== false && codex.visionModels[0]) {
+        agents.push(codexCliRoute(codex.visionModels[0]));
+      }
+      const opencode = discovery.probes.find((probe) => probe.harness === "opencode");
+      if (grants.opencode === true && opencode?.cliFound && opencode.visionModels[0]) {
+        agents.push(opencodeCliRoute(opencode.visionModels[0]));
+      }
+    } catch {
+    }
+  }
+  if (kind === "local") {
+    agents.push(...piAgents);
+  }
+  return { inline, agents };
+}
 const DEFAULT_TIMEOUT_MS = 18e4;
 const KILL_GRACE_MS = 3e4;
 const DRAIN_GRACE_MS = 500;
@@ -28394,10 +29057,10 @@ async function analyzeImage(options) {
     validateInputFile(resolvedInput.source);
   }
   const config2 = options.config ?? loadConfigFile();
-  const chain = options.provider ? [resolveProvider(options.provider)] : options.providerBin ? [resolveProvider("antigravity-cli")] : providerChain(resolvedInput.kind, config2);
+  const chain = options.provider ? [resolveProvider(options.provider)] : options.providerBin ? [resolveProvider("antigravity-cli")] : composeChain(resolvedInput.kind, config2, options.autoOptions);
   if (chain.length === 0) {
     throw new Error(
-      "No vision provider is set up on this machine. Install Antigravity CLI (curl -fsSL https://antigravity.google/cli/install.sh | bash, then run agy once to sign in), or configure a key: modlens config set gemini-api.apiKey <key>. Run modlens doctor for the full picture."
+      "No vision provider is set up on this machine. Install Antigravity CLI (curl -fsSL https://antigravity.google/cli/install.sh | bash, then run agy once to sign in), or configure a key: modlens config set gemini-api.apiKey <key>. Run modlens doctor for the full picture." + reuseHint(config2, options.autoOptions)
     );
   }
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
@@ -28422,6 +29085,9 @@ async function analyzeImage(options) {
         ok: true,
         durationSeconds: (Date.now() - startedAt) / 1e3
       });
+      if (provider.reuseNote) {
+        warnings.push(provider.reuseNote);
+      }
       if (attempts.length > 1) {
         const failed = attempts.slice(0, -1);
         warnings.push(
@@ -28459,12 +29125,81 @@ async function analyzeImage(options) {
     }
   }
   if (chain.length === 1) {
+    if (!options.provider && !options.providerBin && lastError instanceof Error) {
+      const hint = reuseHint(config2, options.autoOptions);
+      if (hint) {
+        lastError.message += hint;
+      }
+    }
     throw lastError;
   }
   throw new Error(
-    `Every configured vision provider failed for this image. ${attempts.map((attempt) => `${attempt.provider}: ${attempt.error}`).join(" | ")}`
+    `Every configured vision provider failed for this image. ${attempts.map((attempt) => `${attempt.provider}: ${attempt.error}`).join(" | ")}${reuseHint(config2, options.autoOptions)}`
   );
 }
+const INLINE_REGION = /* @__PURE__ */ new Set(["gemini-api", "openai", "anthropic"]);
+function composeChain(kind, config2, autoOptions) {
+  const chain = [...providerChain(kind, config2, autoOptions?.env ?? process.env)];
+  const borrowed = reuseProviders(kind, config2, autoOptions);
+  let preferredName = null;
+  if (config2.provider?.trim()) {
+    try {
+      preferredName = resolveProvider(config2.provider.trim()).name;
+    } catch {
+      preferredName = null;
+    }
+  }
+  if (borrowed.inline.length > 0) {
+    const lastInline = chain.map((p) => INLINE_REGION.has(p.name)).lastIndexOf(true);
+    const insertAt = lastInline >= 0 ? lastInline + 1 : kind === "local" && preferredName === chain[0]?.name ? 1 : 0;
+    chain.splice(insertAt, 0, ...borrowed.inline);
+  }
+  if (borrowed.agents.length > 0) {
+    const last = chain[chain.length - 1];
+    const beforeClaude = last?.name === "claude-cli" && preferredName !== "claude-cli";
+    chain.splice(beforeClaude ? chain.length - 1 : chain.length, 0, ...borrowed.agents);
+  }
+  return chain;
+}
+const REUSE_KEY_BY_HARNESS = {
+  codex: "codex",
+  opencode: "opencode",
+  pi: "pi"
+};
+function reuseHint(config2, autoOptions) {
+  try {
+    const grants = config2.reuse ?? {};
+    const discovery = autoOptions?.discovery ?? discoverAuto({ env: autoOptions?.env, home: autoOptions?.home });
+    const unasked = [];
+    const dead = [];
+    for (const probe of discovery.probes) {
+      const key = REUSE_KEY_BY_HARNESS[probe.harness];
+      if (key === void 0) {
+        continue;
+      }
+      const usable = probe.cliFound && probe.visionModels.length > 0 && probe.loggedIn !== false;
+      if (grants[key] === void 0 && usable) {
+        unasked.push(probe.harness);
+      } else if (grants[key] === true && !usable) {
+        dead.push(probe.harness);
+      }
+    }
+    const parts = [];
+    if (unasked.length > 0) {
+      parts.push(
+        ` Hint: this machine has vision reachable through ${unasked.join(", ")}, which modlens is not yet allowed to reuse. Ask the user, then: modlens config set reuse.<harness> true.`
+      );
+    }
+    if (dead.length > 0) {
+      parts.push(
+        ` Note: reuse is granted for ${dead.join(", ")} but it is currently unusable (signed out, uninstalled, or no vision model); check that CLI's login.`
+      );
+    }
+    return parts.join("");
+  } catch {
+    return "";
+  }
+}
 async function runProvider(provider, model, options, resolvedInput, timeoutMs, config2, warnings) {
   const configured = resolveProviderSettings(provider.name, config2);
   const settings = options.extraBody ? { ...configured, extraBody: options.extraBody } : configured;
@@ -29259,82 +29994,6 @@ function sniffModel(harness, cwd, env, roots = {}) {
     return null;
   }
 }
-function denyPatterns(guards) {
-  return stringPatterns(guards?.denyModels);
-}
-function allowPatterns(guards) {
-  return stringPatterns(guards?.allowModels);
-}
-function stringPatterns(raw) {
-  if (!Array.isArray(raw)) {
-    return [];
-  }
-  return raw.filter((pattern) => typeof pattern === "string");
-}
-function globMatch(pattern, value) {
-  const regex = pattern.split(/([*?])/).map((part) => {
-    if (part === "*") {
-      return ".*";
-    }
-    if (part === "?") {
-      return ".";
-    }
-    return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  }).join("");
-  return new RegExp(`^${regex}$`, "i").test(value);
-}
-function evaluateGuard(guards, detection) {
-  const deny = denyPatterns(guards);
-  const allow = allowPatterns(guards);
-  if (!detection.model) {
-    if (guards?.denyWhenUnknown === true) {
-      return {
-        ...detection,
-        guard: "deny",
-        reason: "model unknown and denyWhenUnknown is set"
-      };
-    }
-    return {
-      ...detection,
-      guard: "allow",
-      reason: deny.length === 0 && allow.length === 0 ? "no deny rules configured" : "model unknown, failing open"
-    };
-  }
-  if (deny.length === 0 && allow.length === 0) {
-    return { ...detection, guard: "allow", reason: "no deny rules configured" };
-  }
-  const candidates = [detection.model];
-  if (detection.provider) {
-    candidates.push(`${detection.provider}/${detection.model}`);
-  }
-  const firstMatch = (patterns) => patterns.find((pattern) => candidates.some((candidate) => globMatch(pattern, candidate)));
-  const denied = firstMatch(deny);
-  if (denied) {
-    return {
-      ...detection,
-      guard: "deny",
-      matched: denied,
-      reason: "model has native vision per guards.denyModels"
-    };
-  }
-  if (allow.length > 0) {
-    const allowed = firstMatch(allow);
-    if (allowed) {
-      return {
-        ...detection,
-        guard: "allow",
-        matched: allowed,
-        reason: "model is on guards.allowModels"
-      };
-    }
-    return {
-      ...detection,
-      guard: "deny",
-      reason: "not on guards.allowModels: only listed models run the engine"
-    };
-  }
-  return { ...detection, guard: "allow", reason: "not on the deny list" };
-}
 function detectActiveModel(options) {
   const env = options.env ?? process.env;
   const envModel = env.MODLENS_MODEL?.trim();
@@ -29377,6 +30036,9 @@ function versionParts(version) {
   }
   return [Number(match[1]), Number(match[2])];
 }
+function chainEntryName(provider) {
+  return provider.reuseNote ? `${provider.name} (reused)` : provider.name;
+}
 function meetsMinimum(version, minimum) {
   const [major, minor] = versionParts(version);
   const [minMajor, minMinor] = versionParts(minimum);
@@ -29489,6 +30151,8 @@ function buildDoctorReport(input) {
     harness: harnessDetection.harness
   });
   const guardVerdict = evaluateGuard(input.config.guards, guardDetection);
+  const reuseDiscovery = discoverAuto({ env, fresh: true, ...input.auto });
+  const reuseOptions = { env, ...input.auto, discovery: reuseDiscovery };
   return {
     node: {
       version: process.version,
@@ -29498,9 +30162,12 @@ function buildDoctorReport(input) {
     nodeSqlite: checkNodeSqlite(),
     providers: PROVIDER_DESCRIPTORS.map((d) => inspectProvider(d, input.config, env)),
     selection: resolveSelection(input.config, input.providerFlag),
+    // The chains a run would actually use, reused routes included and
+    // labeled, so a machine living entirely on granted logins does not
+    // read as "no engine" right next to a granted Reuse section.
     chains: {
-      local: providerChain("local", input.config, env).map((p) => p.name),
-      remote: providerChain("remote", input.config, env).map((p) => p.name)
+      local: composeChain("local", input.config, reuseOptions).map(chainEntryName),
+      remote: composeChain("remote", input.config, reuseOptions).map(chainEntryName)
     },
     harness: { detected: harnessDetection.harness, source: harnessDetection.source },
     guard: {
@@ -29513,7 +30180,20 @@ function buildDoctorReport(input) {
       matched: guardVerdict.matched,
       reason: guardVerdict.reason
     },
-    config: inspectConfigFile(configPath)
+    config: inspectConfigFile(configPath),
+    reuse: {
+      decisions: Object.fromEntries(
+        REUSE_HARNESSES.map((harness) => {
+          const decision = input.config.reuse?.[harness];
+          const fallback = harness === "claude" ? "granted" : "not asked";
+          return [
+            harness,
+            decision === true ? "granted" : decision === false ? "refused" : fallback
+          ];
+        })
+      ),
+      probes: reuseDiscovery.probes
+    }
   };
 }
 function mark(ok) {
@@ -29562,6 +30242,30 @@ function renderDoctorReport(report) {
     `  verdict: ${report.guard.verdict}${report.guard.matched ? ` (matched "${report.guard.matched}")` : ""}, ${report.guard.reason}`
   );
   lines.push("");
+  lines.push('Reuse (may modlens reuse other local logins? config "reuse.<harness>")');
+  lines.push(
+    `  decisions: ${Object.entries(report.reuse.decisions).map(([harness, decision]) => `${harness} ${decision}`).join(", ")}`
+  );
+  for (const probe of report.reuse.probes) {
+    if (!probe.cliFound) {
+      lines.push(`  ${probe.harness}: cli not found`);
+      continue;
+    }
+    const parts = [];
+    const shown = probe.visionModels.slice(0, 3).join(", ");
+    parts.push(
+      probe.visionModels.length === 0 ? "no vision models" : `${probe.visionModels.length} vision model(s): ${shown}${probe.visionModels.length > 3 ? ", ..." : ""}`
+    );
+    if (probe.loggedIn !== void 0) {
+      parts.push(probe.loggedIn ? "logged in" : "no credentials found");
+    }
+    parts.push(`via ${probe.source}, ${probe.elapsedMs}ms`);
+    if (probe.error) {
+      parts.push(`error: ${probe.error}`);
+    }
+    lines.push(`  ${probe.harness}: ${parts.join(", ")}`);
+  }
+  lines.push("");
   lines.push("Config file");
   lines.push(`  path: ${report.config.path}`);
   if (report.config.exists) {
@@ -29754,7 +30458,7 @@ function recoverPastedImages(options = {}) {
   return result;
 }
 const program = new Command();
-program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.6.0");
+program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.8.0");
 program.command("analyze", { isDefault: true }).description("Analyze an image into structured JSON evidence (default command)").requiredOption("-i, --input <path|url>", "Input image path or https URL").option("-o, --output <path>", "Write result JSON to a file").option("-m, --model <name>", "Provider model name").option("-p, --provider <name>", `Vision provider (${listProviders().join(", ")})`).option("--prompt <text>", "Extra focus for this image").option("--timeout <ms>", "Provider timeout in milliseconds", "180000").option("--provider-bin <path>", "Provider binary path (default: agy)").option("--workdir <path>", "Working directory for the provider").option(
   "--extra-body <json>",
   `JSON merged into the API request body, e.g. '{"thinking":{"type":"disabled"}}'`