@liustack/modlens 3.7.0 → 3.8.0

package/dist/main.js

@@ -3,7 +3,7 @@ import { Command } from "commander";
 import * as fs from "fs";
 import * as path from "path";
 import * as childProcess from "child_process";
-import { spawn, execFileSync } from "child_process";
+import { execFileSync, spawn } from "child_process";
 import * as os from "os";
 import { fileURLToPath } from "url";
 import require$$0$1 from "node:assert";
@@ -33,6 +33,82 @@ import * as dns$1 from "dns/promises";
 import { isIP } from "net";
 import { createRequire } from "module";
 import * as crypto from "crypto";
+function denyPatterns(guards) {
+  return stringPatterns(guards?.denyModels);
+}
+function allowPatterns(guards) {
+  return stringPatterns(guards?.allowModels);
+}
+function stringPatterns(raw) {
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  return raw.filter((pattern) => typeof pattern === "string");
+}
+function globMatch(pattern, value) {
+  const regex = pattern.split(/([*?])/).map((part) => {
+    if (part === "*") {
+      return ".*";
+    }
+    if (part === "?") {
+      return ".";
+    }
+    return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }).join("");
+  return new RegExp(`^${regex}$`, "i").test(value);
+}
+function evaluateGuard(guards, detection) {
+  const deny = denyPatterns(guards);
+  const allow = allowPatterns(guards);
+  if (!detection.model) {
+    if (guards?.denyWhenUnknown === true) {
+      return {
+        ...detection,
+        guard: "deny",
+        reason: "model unknown and denyWhenUnknown is set"
+      };
+    }
+    return {
+      ...detection,
+      guard: "allow",
+      reason: deny.length === 0 && allow.length === 0 ? "no deny rules configured" : "model unknown, failing open"
+    };
+  }
+  if (deny.length === 0 && allow.length === 0) {
+    return { ...detection, guard: "allow", reason: "no deny rules configured" };
+  }
+  const candidates = [detection.model];
+  if (detection.provider) {
+    candidates.push(`${detection.provider}/${detection.model}`);
+  }
+  const firstMatch = (patterns) => patterns.find((pattern) => candidates.some((candidate) => globMatch(pattern, candidate)));
+  const denied = firstMatch(deny);
+  if (denied) {
+    return {
+      ...detection,
+      guard: "deny",
+      matched: denied,
+      reason: "model has native vision per guards.denyModels"
+    };
+  }
+  if (allow.length > 0) {
+    const allowed = firstMatch(allow);
+    if (allowed) {
+      return {
+        ...detection,
+        guard: "allow",
+        matched: allowed,
+        reason: "model is on guards.allowModels"
+      };
+    }
+    return {
+      ...detection,
+      guard: "deny",
+      reason: "not on guards.allowModels: only listed models run the engine"
+    };
+  }
+  return { ...detection, guard: "allow", reason: "not on the deny list" };
+}
 var undici = { exports: {} };
 var symbols;
 var hasRequiredSymbols;
@@ -27335,6 +27411,8 @@ async function readCapped(response2, url) {
   }
   return Buffer.concat(chunks);
 }
+const JSON_TEMPLATE_INSTRUCTION = `Respond with ONE JSON object only, no markdown fences, no commentary. Fill this exact structure with your findings from the image (do not repeat this template literally, replace every value):
+{"summary":"one paragraph describing the image","ocr":{"full_text":"all visible text","lines":[{"text":"one line","language":"en"}]},"layout":{"regions":[{"type":"title|subtitle|paragraph|list|table|chart|form|code|image|icon|other","reading_order":1,"text":"region text"}]},"semantics":{"scene":"what kind of scene","intent":"what the image is for","entities":[{"name":"entity","type":"kind","evidence":"where seen"}],"relations":[{"subject":"a","predicate":"relates to","object":"b"}]},"visual":{"dominant_colors":["color"],"style":"visual style","notes":["notable visual detail"]},"uncertainty":["anything unreadable or ambiguous"]}`;
 function buildVisionPrompt(options) {
   const readInstruction = options.imageKind === "inline" ? "Analyze the image attached to this message." : options.imageKind === "remote" ? `Fetch the image at this URL and analyze it: ${options.imageSource}` : `Read the image file at this path and analyze it: ${options.imageSource}`;
   const basePrompt = `${readInstruction}
@@ -28000,8 +28078,7 @@ async function executeOpenaiCompat(options) {
     extraPrompt: options.extraPrompt
   })}
 
-Respond with ONE JSON object only, no markdown fences, no commentary. Fill this exact structure with your findings from the image (do not repeat this template literally, replace every value):
-{"summary":"one paragraph describing the image","ocr":{"full_text":"all visible text","lines":[{"text":"one line","language":"en"}]},"layout":{"regions":[{"type":"title|subtitle|paragraph|list|table|chart|form|code|image|icon|other","reading_order":1,"text":"region text"}]},"semantics":{"scene":"what kind of scene","intent":"what the image is for","entities":[{"name":"entity","type":"kind","evidence":"where seen"}],"relations":[{"subject":"a","predicate":"relates to","object":"b"}]},"visual":{"dominant_colors":["color"],"style":"visual style","notes":["notable visual detail"]},"uncertainty":["anything unreadable or ambiguous"]}`;
+${JSON_TEMPLATE_INSTRUCTION}`;
   const startedAt = Date.now();
   const response2 = await fetch(`${baseUrl}/chat/completions`, {
     method: "POST",
@@ -28098,6 +28175,7 @@ function listProviders() {
   return [...new Set(Object.values(PROVIDERS).map((provider) => provider.name))];
 }
 const STRING_FIELDS = ["apiKey", "baseUrl", "model"];
+const REUSE_HARNESSES = ["claude", "codex", "opencode", "pi"];
 const CONFIG_DIR = path.join(os.homedir(), ".modlens");
 const CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 const ENV_BINDINGS = {
@@ -28149,19 +28227,33 @@ function setConfigValue(dottedKey, value, configPath = CONFIG_PATH) {
   const config2 = loadConfigFile(configPath);
   if (dottedKey === "provider") {
     config2.provider = value;
-  } else if (dottedKey === "auto") {
+  } else if (dottedKey.startsWith("reuse.")) {
+    const harness = dottedKey.slice("reuse.".length);
+    if (!REUSE_HARNESSES.includes(harness)) {
+      throw new Error(
+        `Unknown reuse harness: ${harness}. Use ${REUSE_HARNESSES.join(", ")}.`
+      );
+    }
+    const key = harness;
     const normalized = value.trim().toLowerCase();
-    if (normalized !== "true" && normalized !== "false") {
-      throw new Error("auto must be true or false.");
+    if (normalized === "") {
+      delete config2.reuse?.[key];
+      if (config2.reuse && Object.keys(config2.reuse).length === 0) {
+        delete config2.reuse;
+      }
+    } else if (normalized !== "true" && normalized !== "false") {
+      throw new Error(`reuse.${harness} must be true or false (empty clears).`);
+    } else {
+      config2.reuse ??= {};
+      config2.reuse[key] = normalized === "true";
     }
-    config2.auto = normalized === "true";
   } else if (dottedKey.startsWith("guards.")) {
     setGuardsValue(config2, dottedKey.slice("guards.".length), value);
   } else {
     const dot = dottedKey.indexOf(".");
     if (dot <= 0 || dot === dottedKey.length - 1) {
       throw new Error(
-        `Invalid config key: ${dottedKey}. Use "provider", "auto", "guards.<denyModels|allowModels|denyWhenUnknown>", or "<provider>.<apiKey|baseUrl|model|extraBody>".`
+        `Invalid config key: ${dottedKey}. Use "provider", "reuse.<claude|codex|opencode|pi>", "guards.<denyModels|allowModels|denyWhenUnknown>", or "<provider>.<apiKey|baseUrl|model|extraBody>".`
       );
     }
     const providerName = dottedKey.slice(0, dot);
@@ -28286,6 +28378,9 @@ function renderEffectiveConfig(config2, env = process.env) {
     if (config2.guards.denyModels !== void 0) {
       guards.denyModels = `${JSON.stringify(config2.guards.denyModels)} (file)`;
     }
+    if (config2.guards.allowModels !== void 0) {
+      guards.allowModels = `${JSON.stringify(config2.guards.allowModels)} (file)`;
+    }
     if (config2.guards.denyWhenUnknown !== void 0) {
       guards.denyWhenUnknown = `${config2.guards.denyWhenUnknown} (file)`;
     }
@@ -28293,6 +28388,14 @@ function renderEffectiveConfig(config2, env = process.env) {
       effective.guards = guards;
     }
   }
+  if (config2.reuse && Object.keys(config2.reuse).length > 0) {
+    effective.reuse = Object.fromEntries(
+      Object.entries(config2.reuse).map(([harness, granted]) => [
+        harness,
+        `${granted} (file)`
+      ])
+    );
+  }
   return JSON.stringify(effective, null, 2);
 }
 function maskKey(key) {
@@ -28362,15 +28465,18 @@ function providerAvailable(name, config2, env = process.env) {
   return (descriptor.required ?? []).every((req) => Boolean(settings[req.field]?.trim()));
 }
 const LOCAL_FAILOVER_ORDER = [
-  "antigravity-cli",
   "gemini-api",
   "openai",
   "anthropic",
+  "antigravity-cli",
   "claude-cli"
 ];
 const REMOTE_FAILOVER_ORDER = ["gemini-api", "openai", "anthropic", "antigravity-cli"];
 function providerChain(kind, config2, env = process.env) {
-  const names = [...kind === "remote" ? REMOTE_FAILOVER_ORDER : LOCAL_FAILOVER_ORDER];
+  let names = [...kind === "remote" ? REMOTE_FAILOVER_ORDER : LOCAL_FAILOVER_ORDER];
+  if (config2.reuse?.claude === false) {
+    names = names.filter((name) => name !== "claude-cli");
+  }
   const preferred = config2.provider?.trim();
   if (preferred) {
     let canonical = null;
@@ -28390,454 +28496,121 @@ function providerChain(kind, config2, env = process.env) {
   }
   return names.filter((name) => providerAvailable(name, config2, env)).map((name) => resolveProvider(name));
 }
-const DEFAULT_TIMEOUT_MS = 18e4;
-const KILL_GRACE_MS = 3e4;
-const DRAIN_GRACE_MS = 500;
-const SIGKILL_GRACE_MS = 2e3;
-async function analyzeImage(options) {
-  const resolvedInput = resolveInput(options.input);
-  if (resolvedInput.kind === "local") {
-    validateInputFile(resolvedInput.source);
-  }
-  const config2 = options.config ?? loadConfigFile();
-  const chain = options.provider ? [resolveProvider(options.provider)] : options.providerBin ? [resolveProvider("antigravity-cli")] : providerChain(resolvedInput.kind, config2);
-  if (chain.length === 0) {
-    throw new Error(
-      "No vision provider is set up on this machine. Install Antigravity CLI (curl -fsSL https://antigravity.google/cli/install.sh | bash, then run agy once to sign in), or configure a key: modlens config set gemini-api.apiKey <key>. Run modlens doctor for the full picture."
-    );
-  }
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const attempts = [];
-  const warnings = [];
-  let lastError;
-  for (const provider of chain) {
-    const startedAt = Date.now();
-    const model = (attempts.length === 0 ? options.model : void 0) || resolveProviderSettings(provider.name, config2).model || provider.defaultModel;
+const VISION_MODEL_PATTERNS = [
+  "claude-*",
+  "gpt-4o*",
+  "gpt-4.1*",
+  "gpt-5*",
+  "o3*",
+  "o4*",
+  "gemini-*",
+  "glm-*v*",
+  "qwen*-vl*",
+  "qwen3.5-plus*",
+  "qwen3.6-plus*",
+  "kimi-k2.5*",
+  "kimi-k2.6*",
+  "kimi-k2.7*",
+  "kimi-k3*",
+  "moonshot-v1-*vision*",
+  "minimax-vl*",
+  "minimax-m3*",
+  "deepseek-vl*",
+  "deepseek-ocr*",
+  "janus*",
+  "pixtral*",
+  "llama-4*",
+  "llama-3.2-*vision*",
+  "grok-4*",
+  "grok-2-vision*",
+  "internvl*"
+];
+function isVisionModel(modelId) {
+  const bare = modelId.includes("/") ? modelId.slice(modelId.lastIndexOf("/") + 1) : modelId;
+  return VISION_MODEL_PATTERNS.some((pattern) => globMatch(pattern, bare));
+}
+const DEFAULT_TTL_MS = 6 * 60 * 60 * 1e3;
+const CLI_TIMEOUT_MS = 1e4;
+function defaultRunCli(bin, args, timeoutMs) {
+  return execFileSync(bin, args, { encoding: "utf-8", timeout: timeoutMs, stdio: "pipe" });
+}
+function timed(run) {
+  const start = Date.now();
+  const probe = run();
+  return { ...probe, elapsedMs: Date.now() - start };
+}
+function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, "utf-8"));
+}
+function probeClaude(env) {
+  return timed(() => {
+    const cliPath = findOnPath("claude", env);
+    if (!cliPath) {
+      return {
+        harness: "claude-code",
+        cliFound: false,
+        visionModels: [],
+        source: "none"
+      };
+    }
+    return {
+      harness: "claude-code",
+      cliFound: true,
+      cliPath,
+      visionModels: ["anthropic/* (all current models)"],
+      source: "builtin-table"
+    };
+  });
+}
+function probeCodex(env, home) {
+  return timed(() => {
+    const cliPath = findOnPath("codex", env);
+    const base = { harness: "codex", cliFound: cliPath !== null };
+    if (!cliPath) {
+      return { ...base, visionModels: [], source: "none" };
+    }
+    const codexHome = path.join(home, ".codex");
+    const loggedIn = fs.existsSync(path.join(codexHome, "auth.json"));
+    if (!fs.existsSync(path.join(codexHome, "config.toml"))) {
+      return {
+        ...base,
+        cliPath,
+        loggedIn,
+        visionModels: ["default"],
+        source: "builtin-table"
+      };
+    }
     try {
-      const parsed = await runProvider(
-        provider,
-        model,
-        options,
-        resolvedInput,
-        timeoutMs,
-        config2,
-        warnings
-      );
-      attempts.push({
-        provider: provider.name,
-        ok: true,
-        durationSeconds: (Date.now() - startedAt) / 1e3
-      });
-      if (attempts.length > 1) {
-        const failed = attempts.slice(0, -1);
-        warnings.push(
-          `Failed over to ${provider.name} after: ${failed.map((attempt) => `${attempt.provider} (${attempt.error})`).join("; ")}.`
-        );
-        if (options.model) {
-          warnings.push(
-            `The explicit model applied to ${failed[0].provider} only; ${provider.name} ran its own default.`
-          );
-        }
+      const toml = fs.readFileSync(path.join(codexHome, "config.toml"), "utf-8");
+      const catalogPath = toml.match(/^model_catalog_json\s*=\s*"([^"]+)"/m)?.[1];
+      const thirdParty = /^model_provider\s*=/m.test(toml);
+      if (!catalogPath) {
+        return thirdParty ? { ...base, cliPath, loggedIn, visionModels: [], source: "none" } : {
+          ...base,
+          cliPath,
+          loggedIn,
+          visionModels: ["default"],
+          source: "builtin-table"
+        };
       }
+      const catalog = readJson(catalogPath);
+      const vision = (catalog.models ?? []).filter((m) => m.slug && (m.input_modalities ?? []).includes("image")).map((m) => m.slug);
       return {
-        image: resolvedInput.source,
-        provider: provider.name,
-        result: parsed.result,
-        meta: {
-          generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          model,
-          conversationId: parsed.meta.conversationId,
-          durationSeconds: parsed.meta.durationSeconds,
-          usage: parsed.meta.usage,
-          attempts,
-          warnings
-        }
+        ...base,
+        cliPath,
+        loggedIn,
+        visionModels: vision,
+        source: "metadata"
       };
     } catch (error) {
-      lastError = error;
-      const message = error instanceof Error ? error.message : String(error);
-      attempts.push({
-        provider: provider.name,
-        ok: false,
-        durationSeconds: (Date.now() - startedAt) / 1e3,
-        error: message.slice(0, 300)
-      });
-    }
-  }
-  if (chain.length === 1) {
-    throw lastError;
-  }
-  throw new Error(
-    `Every configured vision provider failed for this image. ${attempts.map((attempt) => `${attempt.provider}: ${attempt.error}`).join(" | ")}`
-  );
-}
-async function runProvider(provider, model, options, resolvedInput, timeoutMs, config2, warnings) {
-  const configured = resolveProviderSettings(provider.name, config2);
-  const settings = options.extraBody ? { ...configured, extraBody: options.extraBody } : configured;
-  if (settings.extraBody && !provider.execute) {
-    warnings.push(
-      `${provider.name} is a CLI provider and takes no request body, so extraBody was ignored for this run.`
-    );
-  }
-  const providerOptions = {
-    imageSource: resolvedInput.source,
-    imageKind: resolvedInput.kind,
-    model,
-    extraPrompt: options.prompt,
-    providerBin: options.providerBin,
-    workdir: options.workdir,
-    timeoutMs,
-    settings
-  };
-  let parsed;
-  if (provider.execute) {
-    parsed = await provider.execute(providerOptions);
-  } else if (provider.buildInvocation && provider.parseOutput) {
-    const buildInvocation = provider.buildInvocation;
-    const parseOutput = provider.parseOutput;
-    const isolation = !options.workdir && provider.isolateWorkdir ? resolvedInput.kind === "local" ? isolateImage(resolvedInput.source) : emptyWorkdir() : null;
-    try {
-      const invocation = buildInvocation({
-        ...providerOptions,
-        imageSource: isolation?.imageSource ?? providerOptions.imageSource,
-        workdir: isolation?.workdir ?? providerOptions.workdir
-      });
-      const backstop = provider.hasInternalTimeout ? timeoutMs + KILL_GRACE_MS : timeoutMs;
-      const commandResult = await runCommand(
-        provider.name,
-        invocation,
-        backstop,
-        provider.describeFailure
-      );
-      parsed = parseOutput(commandResult.stdout);
-    } finally {
-      isolation?.cleanup();
-    }
-  } else {
-    throw new Error(
-      `Provider ${provider.name} implements neither execute nor buildInvocation.`
-    );
-  }
-  const missing = missingSchemaFields(parsed.result);
-  if (missing.length > 0) {
-    throw new Error(
-      `${provider.name} returned a result that does not match the vision schema (missing: ${missing.join(", ")}).`
-    );
-  }
-  return parsed;
-}
-function resolveInput(input) {
-  const trimmed = input.trim();
-  if (!trimmed) {
-    throw new Error("Input path is required.");
-  }
-  if (isRemoteSource(trimmed)) {
-    return { source: trimmed, kind: "remote" };
-  }
-  if (/^file:\/\//i.test(trimmed)) {
-    return { source: path.resolve(fileURLToPath(trimmed)), kind: "local" };
-  }
-  return { source: path.resolve(trimmed), kind: "local" };
-}
-function isRemoteSource(value) {
-  return /^https?:\/\//i.test(value.trim());
-}
-function validateInputFile(filePath) {
-  if (!fs.existsSync(filePath)) {
-    throw new Error(`Input image not found: ${filePath}`);
-  }
-  const stat = fs.statSync(filePath);
-  if (!stat.isFile()) {
-    throw new Error(`Input is not a file: ${filePath}`);
-  }
-}
-function isolateImage(source) {
-  const workdir = fs.mkdtempSync(path.join(os.tmpdir(), "modlens-work-"));
-  const imageSource = path.join(workdir, path.basename(source));
-  fs.copyFileSync(source, imageSource);
-  fs.chmodSync(imageSource, 384);
-  return {
-    imageSource,
-    workdir,
-    cleanup: () => fs.rmSync(workdir, { recursive: true, force: true })
-  };
-}
-function emptyWorkdir() {
-  const workdir = fs.mkdtempSync(path.join(os.tmpdir(), "modlens-work-"));
-  return {
-    workdir,
-    cleanup: () => fs.rmSync(workdir, { recursive: true, force: true })
-  };
-}
-function runCommand(providerName, invocation, timeoutMs, describeFailure) {
-  const runStartedAt = Date.now();
-  return new Promise((resolve, reject) => {
-    const child = spawn(invocation.command, invocation.args, {
-      cwd: invocation.cwd,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    const outDecoder = new TextDecoder("utf-8");
-    const errDecoder = new TextDecoder("utf-8");
-    let stdout = "";
-    let stderr = "";
-    let timedOut = false;
-    let settled = false;
-    let drainTimer;
-    const timer = setTimeout(() => {
-      timedOut = true;
-      child.kill("SIGTERM");
-      settle(null);
-      setTimeout(() => {
-        if (!exited) {
-          child.kill("SIGKILL");
-        }
-      }, SIGKILL_GRACE_MS).unref();
-    }, timeoutMs);
-    const settle = (code) => {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      clearTimeout(timer);
-      clearTimeout(drainTimer);
-      stdout += outDecoder.decode();
-      stderr += errDecoder.decode();
-      child.stdout?.destroy();
-      child.stderr?.destroy();
-      child.unref();
-      if (timedOut) {
-        reject(new Error(`${providerName} provider timed out after ${timeoutMs} ms.`));
-        return;
-      }
-      if (code !== 0) {
-        const explained = describeFailure?.({ stdout, stderr, code, startedAt: runStartedAt }) ?? null;
-        reject(
-          new Error(
-            explained ?? `${providerName} provider failed with code ${code}.${stderr ? ` stderr: ${stderr.trim()}` : ""}`
-          )
-        );
-        return;
-      }
-      resolve({ stdout, stderr });
-    };
-    let exitCode = null;
-    let exited = false;
-    const restartDrain = () => {
-      if (!exited || settled) {
-        return;
-      }
-      clearTimeout(drainTimer);
-      drainTimer = setTimeout(() => settle(exitCode), DRAIN_GRACE_MS);
-    };
-    child.stdout.on("data", (chunk) => {
-      stdout += outDecoder.decode(chunk, { stream: true });
-      restartDrain();
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += errDecoder.decode(chunk, { stream: true });
-      restartDrain();
-    });
-    child.on("error", (error) => {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      clearTimeout(timer);
-      clearTimeout(drainTimer);
-      if (error.code === "ENOENT") {
-        const missingCwd = !fs.existsSync(invocation.cwd);
-        reject(
-          new Error(
-            missingCwd ? `Working directory does not exist: ${invocation.cwd}` : `Provider CLI not found: ${invocation.command}. Install it and sign in first.`
-          )
-        );
-        return;
-      }
-      reject(error);
-    });
-    child.on("exit", (code) => {
-      exitCode = code;
-      exited = true;
-      restartDrain();
-    });
-    child.on("close", (code) => settle(code));
-  });
-}
-function denyPatterns(guards) {
-  return stringPatterns(guards?.denyModels);
-}
-function allowPatterns(guards) {
-  return stringPatterns(guards?.allowModels);
-}
-function stringPatterns(raw) {
-  if (!Array.isArray(raw)) {
-    return [];
-  }
-  return raw.filter((pattern) => typeof pattern === "string");
-}
-function globMatch(pattern, value) {
-  const regex = pattern.split(/([*?])/).map((part) => {
-    if (part === "*") {
-      return ".*";
-    }
-    if (part === "?") {
-      return ".";
-    }
-    return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  }).join("");
-  return new RegExp(`^${regex}$`, "i").test(value);
-}
-function evaluateGuard(guards, detection) {
-  const deny = denyPatterns(guards);
-  const allow = allowPatterns(guards);
-  if (!detection.model) {
-    if (guards?.denyWhenUnknown === true) {
-      return {
-        ...detection,
-        guard: "deny",
-        reason: "model unknown and denyWhenUnknown is set"
-      };
-    }
-    return {
-      ...detection,
-      guard: "allow",
-      reason: deny.length === 0 && allow.length === 0 ? "no deny rules configured" : "model unknown, failing open"
-    };
-  }
-  if (deny.length === 0 && allow.length === 0) {
-    return { ...detection, guard: "allow", reason: "no deny rules configured" };
-  }
-  const candidates = [detection.model];
-  if (detection.provider) {
-    candidates.push(`${detection.provider}/${detection.model}`);
-  }
-  const firstMatch = (patterns) => patterns.find((pattern) => candidates.some((candidate) => globMatch(pattern, candidate)));
-  const denied = firstMatch(deny);
-  if (denied) {
-    return {
-      ...detection,
-      guard: "deny",
-      matched: denied,
-      reason: "model has native vision per guards.denyModels"
-    };
-  }
-  if (allow.length > 0) {
-    const allowed = firstMatch(allow);
-    if (allowed) {
-      return {
-        ...detection,
-        guard: "allow",
-        matched: allowed,
-        reason: "model is on guards.allowModels"
-      };
-    }
-    return {
-      ...detection,
-      guard: "deny",
-      reason: "not on guards.allowModels: only listed models run the engine"
-    };
-  }
-  return { ...detection, guard: "allow", reason: "not on the deny list" };
-}
-const VISION_MODEL_PATTERNS = [
-  "claude-*",
-  "gpt-4o*",
-  "gpt-4.1*",
-  "gpt-5*",
-  "o3*",
-  "o4*",
-  "gemini-*",
-  "glm-*v*",
-  "qwen*-vl*",
-  "qwen3.5-plus*",
-  "qwen3.6-plus*",
-  "kimi-k2.5*",
-  "kimi-k2.6*",
-  "kimi-k2.7*",
-  "kimi-k3*",
-  "moonshot-v1-*vision*",
-  "minimax-vl*",
-  "minimax-m3*",
-  "deepseek-vl*",
-  "deepseek-ocr*",
-  "janus*",
-  "pixtral*",
-  "llama-4*",
-  "llama-3.2-*vision*",
-  "grok-4*",
-  "grok-2-vision*",
-  "internvl*"
-];
-function isVisionModel(modelId) {
-  const bare = modelId.includes("/") ? modelId.slice(modelId.lastIndexOf("/") + 1) : modelId;
-  return VISION_MODEL_PATTERNS.some((pattern) => globMatch(pattern, bare));
-}
-const DEFAULT_TTL_MS = 6 * 60 * 60 * 1e3;
-const CLI_TIMEOUT_MS = 1e4;
-function defaultRunCli(bin, args, timeoutMs) {
-  return execFileSync(bin, args, { encoding: "utf-8", timeout: timeoutMs, stdio: "pipe" });
-}
-function timed(run) {
-  const start = Date.now();
-  const probe = run();
-  return { ...probe, elapsedMs: Date.now() - start };
-}
-function readJson(filePath) {
-  return JSON.parse(fs.readFileSync(filePath, "utf-8"));
-}
-function probeClaude(env) {
-  return timed(() => {
-    const cliPath = findOnPath("claude", env);
-    if (!cliPath) {
-      return {
-        harness: "claude-code",
-        cliFound: false,
-        visionModels: [],
-        source: "none"
-      };
-    }
-    return {
-      harness: "claude-code",
-      cliFound: true,
-      cliPath,
-      visionModels: ["anthropic/* (all current models)"],
-      source: "builtin-table"
-    };
-  });
-}
-function probeCodex(env, home) {
-  return timed(() => {
-    const cliPath = findOnPath("codex", env);
-    const base = { harness: "codex", cliFound: cliPath !== null };
-    if (!cliPath) {
-      return { ...base, visionModels: [], source: "none" };
-    }
-    const codexHome = path.join(home, ".codex");
-    const loggedIn = fs.existsSync(path.join(codexHome, "auth.json"));
-    try {
-      const toml = fs.readFileSync(path.join(codexHome, "config.toml"), "utf-8");
-      const catalogPath = toml.match(/^model_catalog_json\s*=\s*"([^"]+)"/m)?.[1];
-      if (!catalogPath) {
-        return { ...base, cliPath, loggedIn, visionModels: [], source: "none" };
-      }
-      const catalog = readJson(catalogPath);
-      const vision = (catalog.models ?? []).filter((m) => m.slug && (m.input_modalities ?? []).includes("image")).map((m) => m.slug);
-      return {
-        ...base,
-        cliPath,
-        loggedIn,
-        visionModels: vision,
-        source: "metadata"
-      };
-    } catch (error) {
-      return {
-        ...base,
-        cliPath,
-        loggedIn,
-        visionModels: [],
-        source: "none",
-        error: error instanceof Error ? error.message : String(error)
-      };
+      return {
+        ...base,
+        cliPath,
+        loggedIn,
+        visionModels: [],
+        source: "none",
+        error: error instanceof Error ? error.message : String(error)
+      };
     }
   });
 }
@@ -28887,61 +28660,737 @@ function probeOpencode(env, runCli) {
       return { ...base, visionModels: [], source: "none" };
     }
     try {
-      const listing = runCli(cliPath, ["models"], CLI_TIMEOUT_MS);
-      const vision = listing.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && isVisionModel(line));
-      return { ...base, cliPath, visionModels: vision, source: "builtin-table" };
-    } catch (error) {
-      return {
-        ...base,
-        cliPath,
-        visionModels: [],
-        source: "none",
-        error: error instanceof Error ? error.message : String(error)
-      };
+      const listing = runCli(cliPath, ["models"], CLI_TIMEOUT_MS);
+      const vision = listing.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && isVisionModel(line));
+      return { ...base, cliPath, visionModels: vision, source: "builtin-table" };
+    } catch (error) {
+      return {
+        ...base,
+        cliPath,
+        visionModels: [],
+        source: "none",
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  });
+}
+function readCache(cachePath, ttlMs) {
+  try {
+    const cached = readJson(cachePath);
+    if (!cached.cachedAt || !Array.isArray(cached.probes)) {
+      return null;
+    }
+    const cachedAtMs = Date.parse(cached.cachedAt);
+    if (!Number.isFinite(cachedAtMs) || Date.now() - cachedAtMs > ttlMs) {
+      return null;
+    }
+    return cached;
+  } catch {
+    return null;
+  }
+}
+function discoverAuto(options = {}) {
+  const env = options.env ?? process.env;
+  const home = options.home ?? os.homedir();
+  const cachePath = options.cachePath ?? path.join(home, ".modlens", "auto-cache.json");
+  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+  if (!options.fresh) {
+    const cached = readCache(cachePath, ttlMs);
+    if (cached) {
+      return { probes: cached.probes, cachedAt: cached.cachedAt, fromCache: true };
+    }
+  }
+  const runCli = options.runCli ?? defaultRunCli;
+  const probes = [
+    probeClaude(env),
+    probeCodex(env, home),
+    probeOpencode(env, runCli),
+    probePi(env, home)
+  ];
+  const cachedAt = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
+    fs.writeFileSync(cachePath, JSON.stringify({ cachedAt, probes }, null, 2), {
+      mode: 384
+    });
+  } catch {
+  }
+  return { probes, cachedAt, fromCache: false };
+}
+const KEY_FETCH_TIMEOUT_MS = 1e4;
+function codexCliRoute(visionModel) {
+  return {
+    name: "codex-cli",
+    defaultModel: visionModel,
+    isolateWorkdir: true,
+    reuseNote: "this read reused the local Codex CLI login and spent that account's quota.",
+    buildInvocation: (options) => {
+      if (options.imageKind === "remote") {
+        throw new Error(
+          "codex-cli route reads local files only. Remote URLs stay on the inline providers."
+        );
+      }
+      const prompt = `${buildVisionPrompt({
+        imageSource: options.imageSource,
+        imageKind: "inline",
+        extraPrompt: options.extraPrompt
+      })}
+
+${JSON_TEMPLATE_INSTRUCTION}`;
+      const model = options.model || visionModel;
+      const args = [
+        "exec",
+        "--skip-git-repo-check",
+        "--ephemeral",
+        "-s",
+        "read-only",
+        "--json",
+        "-i",
+        options.imageSource
+      ];
+      if (model && model !== "default") {
+        args.push("-m", model);
+      }
+      args.push("--", prompt);
+      return {
+        command: options.providerBin || "codex",
+        args,
+        cwd: path.resolve(options.workdir || path.dirname(options.imageSource))
+      };
+    },
+    parseOutput: (stdout) => {
+      let threadId = null;
+      let usage = null;
+      let lastMessage = null;
+      for (const line of stdout.split("\n")) {
+        const event = tryParseJson(line.trim());
+        if (!event) {
+          continue;
+        }
+        if (event.type === "thread.started" && event.thread_id) {
+          threadId = event.thread_id;
+        }
+        if (event.type === "turn.completed" && event.usage !== void 0) {
+          usage = event.usage;
+        }
+        if (event.type === "item.completed" && event.item?.type === "agent_message" && typeof event.item.text === "string") {
+          lastMessage = event.item.text;
+        }
+      }
+      if (!lastMessage) {
+        throw new Error(
+          "codex exec produced no agent message. Check the Codex login (run: codex)."
+        );
+      }
+      const result = extractJson(lastMessage);
+      if (result === null) {
+        throw new Error(`codex returned a non-JSON answer: ${truncate(lastMessage)}`);
+      }
+      return {
+        result,
+        meta: { conversationId: threadId, durationSeconds: null, usage }
+      };
+    }
+  };
+}
+function opencodeCliRoute(modelId) {
+  return {
+    name: "opencode-cli",
+    defaultModel: modelId,
+    isolateWorkdir: true,
+    reuseNote: `this read reused OpenCode's ${modelId} and spent that account's quota.`,
+    buildInvocation: (options) => {
+      if (options.imageKind === "remote") {
+        throw new Error(
+          "opencode-cli route reads local files only. Remote URLs stay on the inline providers."
+        );
+      }
+      const prompt = `${buildVisionPrompt({
+        imageSource: options.imageSource,
+        imageKind: "inline",
+        extraPrompt: options.extraPrompt
+      })}
+
+${JSON_TEMPLATE_INSTRUCTION}`;
+      return {
+        command: options.providerBin || "opencode",
+        args: [
+          "run",
+          prompt,
+          "-m",
+          options.model || modelId,
+          "--format",
+          "json",
+          "-f",
+          options.imageSource
+        ],
+        cwd: path.resolve(options.workdir || path.dirname(options.imageSource))
+      };
+    },
+    parseOutput: (stdout) => {
+      let sessionId = null;
+      let usage = null;
+      const texts = [];
+      for (const line of stdout.split("\n")) {
+        const event = tryParseJson(line.trim());
+        if (!event) {
+          continue;
+        }
+        sessionId ??= event.sessionID ?? null;
+        if (event.type === "text" && typeof event.part?.text === "string") {
+          texts.push(event.part.text);
+        }
+        if (event.type === "step_finish" && event.part?.tokens !== void 0) {
+          usage = event.part.tokens;
+        }
+      }
+      const answer = texts.join("").trim();
+      if (!answer) {
+        throw new Error("opencode run produced no text answer.");
+      }
+      const result = extractJson(answer);
+      if (result === null) {
+        throw new Error(`opencode returned a non-JSON answer: ${truncate(answer)}`);
+      }
+      return {
+        result,
+        meta: { conversationId: sessionId, durationSeconds: null, usage }
+      };
+    }
+  };
+}
+const PI_API_TARGETS = {
+  "openai-completions": "openai",
+  "anthropic-messages": "anthropic"
+};
+const DEFAULT_TARGETS = {
+  openai: openaiCompatProvider,
+  anthropic: anthropicApiProvider,
+  "gemini-api": geminiApiProvider
+};
+function piCliRoute(providerName, modelId) {
+  return {
+    name: "pi-cli",
+    defaultModel: modelId,
+    isolateWorkdir: true,
+    reuseNote: `this read reused pi's ${providerName}/${modelId} and spent that account's quota.`,
+    buildInvocation: (options) => {
+      if (options.imageKind === "remote") {
+        throw new Error(
+          "pi-cli route reads local files only. Remote URLs stay on the inline providers."
+        );
+      }
+      const prompt = `${buildVisionPrompt({
+        imageSource: options.imageSource,
+        imageKind: "inline",
+        extraPrompt: options.extraPrompt
+      })}
+
+${JSON_TEMPLATE_INSTRUCTION}`;
+      return {
+        command: options.providerBin || "pi",
+        args: [
+          "-p",
+          "--no-session",
+          "--no-tools",
+          "--mode",
+          "json",
+          "--provider",
+          providerName,
+          "--model",
+          options.model || modelId,
+          `@${options.imageSource}`,
+          prompt
+        ],
+        cwd: path.resolve(options.workdir || path.dirname(options.imageSource))
+      };
+    },
+    parseOutput: (stdout) => {
+      let final = null;
+      for (const line of stdout.split("\n")) {
+        const event = tryParseJson(line.trim());
+        if (event?.type === "message_end" && event.message) {
+          final = event.message;
+        }
+      }
+      const answer = (final?.content ?? []).filter((part) => part.type === "text" && typeof part.text === "string").map((part) => part.text).join("").trim();
+      if (!answer) {
+        throw new Error("pi produced no text answer. Check pi and its credentials.");
+      }
+      const result = extractJson(answer);
+      if (result === null) {
+        throw new Error(`pi returned a non-JSON answer: ${truncate(answer)}`);
+      }
+      return {
+        result,
+        meta: {
+          conversationId: final?.responseId ?? null,
+          durationSeconds: null,
+          usage: final?.usage ?? null
+        }
+      };
+    }
+  };
+}
+function piRoutes(home, env, targets = DEFAULT_TARGETS) {
+  const empty = { inline: [], agents: [] };
+  const piPath = findOnPath("pi", env);
+  if (!piPath) {
+    return empty;
+  }
+  const agentDir = path.join(home, ".pi", "agent");
+  let auth;
+  let store;
+  try {
+    auth = JSON.parse(fs.readFileSync(path.join(agentDir, "auth.json"), "utf-8"));
+    store = JSON.parse(fs.readFileSync(path.join(agentDir, "models-store.json"), "utf-8"));
+  } catch {
+    return empty;
+  }
+  const routes = [];
+  const agents = [];
+  const usedTargets = /* @__PURE__ */ new Set();
+  for (const entry of Object.values(store)) {
+    for (const model of entry?.models ?? []) {
+      if (!model.id || !model.provider || !model.baseUrl || !(model.input ?? []).includes("image") || !(model.provider in auth)) {
+        continue;
+      }
+      const credential = auth[model.provider];
+      const targetName = PI_API_TARGETS[model.api ?? ""];
+      const target = targetName ? targets[targetName] : void 0;
+      const targetExecute = target?.execute;
+      if (!target || !targetExecute || credential?.type !== "api_key") {
+        if (agents.length < 2) {
+          agents.push(piCliRoute(model.provider, model.id));
+        }
+        continue;
+      }
+      if (usedTargets.has(target.name)) {
+        continue;
+      }
+      usedTargets.add(target.name);
+      const { id, provider, baseUrl } = model;
+      routes.push({
+        name: `pi:${target.name}`,
+        defaultModel: id,
+        reuseNote: `this read reused pi's ${provider} credentials for ${id} and spent that account's quota.`,
+        execute: async (options) => {
+          const apiKey = fetchPiKey(
+            piPath,
+            id,
+            provider,
+            Math.min(KEY_FETCH_TIMEOUT_MS, options.timeoutMs || KEY_FETCH_TIMEOUT_MS)
+          );
+          return targetExecute({
+            ...options,
+            settings: {
+              ...options.settings ?? {},
+              apiKey,
+              baseUrl,
+              model: options.model || id
+            }
+          });
+        }
+      });
+    }
+  }
+  return { inline: routes.slice(0, 2), agents };
+}
+function fetchPiKey(piPath, modelId, provider, timeoutMs) {
+  try {
+    const key = execFileSync(
+      piPath,
+      ["auth", "print-api-key", "--model", modelId, "--provider", provider],
+      { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], timeout: timeoutMs }
+    ).trim();
+    if (!key) {
+      throw new Error("empty");
+    }
+    return key;
+  } catch {
+    throw new Error(
+      `pi could not print an API key for ${provider}/${modelId}. Run \`pi auth\` to check that credential.`
+    );
+  }
+}
+function reuseProviders(kind, config2, options = {}) {
+  const env = options.env ?? process.env;
+  const home = options.home ?? os.homedir();
+  const grants = config2.reuse ?? {};
+  const inline = [];
+  const agents = [];
+  let piAgents = [];
+  if (grants.pi === true) {
+    try {
+      const pi = piRoutes(home, env, options.targets);
+      inline.push(...pi.inline);
+      piAgents = pi.agents;
+    } catch {
+    }
+  }
+  if (kind === "local" && (grants.codex === true || grants.opencode === true)) {
+    try {
+      const discovery = options.discovery ?? discoverAuto({ env, home });
+      const codex = discovery.probes.find((probe) => probe.harness === "codex");
+      if (grants.codex === true && codex?.cliFound && codex.loggedIn !== false && codex.visionModels[0]) {
+        agents.push(codexCliRoute(codex.visionModels[0]));
+      }
+      const opencode = discovery.probes.find((probe) => probe.harness === "opencode");
+      if (grants.opencode === true && opencode?.cliFound && opencode.visionModels[0]) {
+        agents.push(opencodeCliRoute(opencode.visionModels[0]));
+      }
+    } catch {
+    }
+  }
+  if (kind === "local") {
+    agents.push(...piAgents);
+  }
+  return { inline, agents };
+}
+const DEFAULT_TIMEOUT_MS = 18e4;
+const KILL_GRACE_MS = 3e4;
+const DRAIN_GRACE_MS = 500;
+const SIGKILL_GRACE_MS = 2e3;
+async function analyzeImage(options) {
+  const resolvedInput = resolveInput(options.input);
+  if (resolvedInput.kind === "local") {
+    validateInputFile(resolvedInput.source);
+  }
+  const config2 = options.config ?? loadConfigFile();
+  const chain = options.provider ? [resolveProvider(options.provider)] : options.providerBin ? [resolveProvider("antigravity-cli")] : composeChain(resolvedInput.kind, config2, options.autoOptions);
+  if (chain.length === 0) {
+    throw new Error(
+      "No vision provider is set up on this machine. Install Antigravity CLI (curl -fsSL https://antigravity.google/cli/install.sh | bash, then run agy once to sign in), or configure a key: modlens config set gemini-api.apiKey <key>. Run modlens doctor for the full picture." + reuseHint(config2, options.autoOptions)
+    );
+  }
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const attempts = [];
+  const warnings = [];
+  let lastError;
+  for (const provider of chain) {
+    const startedAt = Date.now();
+    const model = (attempts.length === 0 ? options.model : void 0) || resolveProviderSettings(provider.name, config2).model || provider.defaultModel;
+    try {
+      const parsed = await runProvider(
+        provider,
+        model,
+        options,
+        resolvedInput,
+        timeoutMs,
+        config2,
+        warnings
+      );
+      attempts.push({
+        provider: provider.name,
+        ok: true,
+        durationSeconds: (Date.now() - startedAt) / 1e3
+      });
+      if (provider.reuseNote) {
+        warnings.push(provider.reuseNote);
+      }
+      if (attempts.length > 1) {
+        const failed = attempts.slice(0, -1);
+        warnings.push(
+          `Failed over to ${provider.name} after: ${failed.map((attempt) => `${attempt.provider} (${attempt.error})`).join("; ")}.`
+        );
+        if (options.model) {
+          warnings.push(
+            `The explicit model applied to ${failed[0].provider} only; ${provider.name} ran its own default.`
+          );
+        }
+      }
+      return {
+        image: resolvedInput.source,
+        provider: provider.name,
+        result: parsed.result,
+        meta: {
+          generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          model,
+          conversationId: parsed.meta.conversationId,
+          durationSeconds: parsed.meta.durationSeconds,
+          usage: parsed.meta.usage,
+          attempts,
+          warnings
+        }
+      };
+    } catch (error) {
+      lastError = error;
+      const message = error instanceof Error ? error.message : String(error);
+      attempts.push({
+        provider: provider.name,
+        ok: false,
+        durationSeconds: (Date.now() - startedAt) / 1e3,
+        error: message.slice(0, 300)
+      });
+    }
+  }
+  if (chain.length === 1) {
+    if (!options.provider && !options.providerBin && lastError instanceof Error) {
+      const hint = reuseHint(config2, options.autoOptions);
+      if (hint) {
+        lastError.message += hint;
+      }
+    }
+    throw lastError;
+  }
+  throw new Error(
+    `Every configured vision provider failed for this image. ${attempts.map((attempt) => `${attempt.provider}: ${attempt.error}`).join(" | ")}${reuseHint(config2, options.autoOptions)}`
+  );
+}
+const INLINE_REGION = /* @__PURE__ */ new Set(["gemini-api", "openai", "anthropic"]);
+function composeChain(kind, config2, autoOptions) {
+  const chain = [...providerChain(kind, config2, autoOptions?.env ?? process.env)];
+  const borrowed = reuseProviders(kind, config2, autoOptions);
+  let preferredName = null;
+  if (config2.provider?.trim()) {
+    try {
+      preferredName = resolveProvider(config2.provider.trim()).name;
+    } catch {
+      preferredName = null;
     }
-  });
+  }
+  if (borrowed.inline.length > 0) {
+    const lastInline = chain.map((p) => INLINE_REGION.has(p.name)).lastIndexOf(true);
+    const insertAt = lastInline >= 0 ? lastInline + 1 : kind === "local" && preferredName === chain[0]?.name ? 1 : 0;
+    chain.splice(insertAt, 0, ...borrowed.inline);
+  }
+  if (borrowed.agents.length > 0) {
+    const last = chain[chain.length - 1];
+    const beforeClaude = last?.name === "claude-cli" && preferredName !== "claude-cli";
+    chain.splice(beforeClaude ? chain.length - 1 : chain.length, 0, ...borrowed.agents);
+  }
+  return chain;
 }
-function readCache(cachePath, ttlMs) {
+const REUSE_KEY_BY_HARNESS = {
+  codex: "codex",
+  opencode: "opencode",
+  pi: "pi"
+};
+function reuseHint(config2, autoOptions) {
   try {
-    const cached = readJson(cachePath);
-    if (!cached.cachedAt || !Array.isArray(cached.probes)) {
-      return null;
+    const grants = config2.reuse ?? {};
+    const discovery = autoOptions?.discovery ?? discoverAuto({ env: autoOptions?.env, home: autoOptions?.home });
+    const unasked = [];
+    const dead = [];
+    for (const probe of discovery.probes) {
+      const key = REUSE_KEY_BY_HARNESS[probe.harness];
+      if (key === void 0) {
+        continue;
+      }
+      const usable = probe.cliFound && probe.visionModels.length > 0 && probe.loggedIn !== false;
+      if (grants[key] === void 0 && usable) {
+        unasked.push(probe.harness);
+      } else if (grants[key] === true && !usable) {
+        dead.push(probe.harness);
+      }
     }
-    if (Date.now() - Date.parse(cached.cachedAt) > ttlMs) {
-      return null;
+    const parts = [];
+    if (unasked.length > 0) {
+      parts.push(
+        ` Hint: this machine has vision reachable through ${unasked.join(", ")}, which modlens is not yet allowed to reuse. Ask the user, then: modlens config set reuse.<harness> true.`
+      );
     }
-    return cached;
+    if (dead.length > 0) {
+      parts.push(
+        ` Note: reuse is granted for ${dead.join(", ")} but it is currently unusable (signed out, uninstalled, or no vision model); check that CLI's login.`
+      );
+    }
+    return parts.join("");
   } catch {
-    return null;
+    return "";
   }
 }
-function discoverAuto(options = {}) {
-  const env = options.env ?? process.env;
-  const home = options.home ?? os.homedir();
-  const cachePath = options.cachePath ?? path.join(home, ".modlens", "auto-cache.json");
-  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
-  if (!options.fresh) {
-    const cached = readCache(cachePath, ttlMs);
-    if (cached) {
-      return { probes: cached.probes, cachedAt: cached.cachedAt, fromCache: true };
+async function runProvider(provider, model, options, resolvedInput, timeoutMs, config2, warnings) {
+  const configured = resolveProviderSettings(provider.name, config2);
+  const settings = options.extraBody ? { ...configured, extraBody: options.extraBody } : configured;
+  if (settings.extraBody && !provider.execute) {
+    warnings.push(
+      `${provider.name} is a CLI provider and takes no request body, so extraBody was ignored for this run.`
+    );
+  }
+  const providerOptions = {
+    imageSource: resolvedInput.source,
+    imageKind: resolvedInput.kind,
+    model,
+    extraPrompt: options.prompt,
+    providerBin: options.providerBin,
+    workdir: options.workdir,
+    timeoutMs,
+    settings
+  };
+  let parsed;
+  if (provider.execute) {
+    parsed = await provider.execute(providerOptions);
+  } else if (provider.buildInvocation && provider.parseOutput) {
+    const buildInvocation = provider.buildInvocation;
+    const parseOutput = provider.parseOutput;
+    const isolation = !options.workdir && provider.isolateWorkdir ? resolvedInput.kind === "local" ? isolateImage(resolvedInput.source) : emptyWorkdir() : null;
+    try {
+      const invocation = buildInvocation({
+        ...providerOptions,
+        imageSource: isolation?.imageSource ?? providerOptions.imageSource,
+        workdir: isolation?.workdir ?? providerOptions.workdir
+      });
+      const backstop = provider.hasInternalTimeout ? timeoutMs + KILL_GRACE_MS : timeoutMs;
+      const commandResult = await runCommand(
+        provider.name,
+        invocation,
+        backstop,
+        provider.describeFailure
+      );
+      parsed = parseOutput(commandResult.stdout);
+    } finally {
+      isolation?.cleanup();
     }
+  } else {
+    throw new Error(
+      `Provider ${provider.name} implements neither execute nor buildInvocation.`
+    );
   }
-  const runCli = options.runCli ?? defaultRunCli;
-  const probes = [
-    probeClaude(env),
-    probeCodex(env, home),
-    probeOpencode(env, runCli),
-    probePi(env, home)
-  ];
-  const cachedAt = (/* @__PURE__ */ new Date()).toISOString();
-  try {
-    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
-    fs.writeFileSync(cachePath, JSON.stringify({ cachedAt, probes }, null, 2), {
-      mode: 384
-    });
-  } catch {
+  const missing = missingSchemaFields(parsed.result);
+  if (missing.length > 0) {
+    throw new Error(
+      `${provider.name} returned a result that does not match the vision schema (missing: ${missing.join(", ")}).`
+    );
   }
-  return { probes, cachedAt, fromCache: false };
+  return parsed;
+}
+function resolveInput(input) {
+  const trimmed = input.trim();
+  if (!trimmed) {
+    throw new Error("Input path is required.");
+  }
+  if (isRemoteSource(trimmed)) {
+    return { source: trimmed, kind: "remote" };
+  }
+  if (/^file:\/\//i.test(trimmed)) {
+    return { source: path.resolve(fileURLToPath(trimmed)), kind: "local" };
+  }
+  return { source: path.resolve(trimmed), kind: "local" };
+}
+function isRemoteSource(value) {
+  return /^https?:\/\//i.test(value.trim());
+}
+function validateInputFile(filePath) {
+  if (!fs.existsSync(filePath)) {
+    throw new Error(`Input image not found: ${filePath}`);
+  }
+  const stat = fs.statSync(filePath);
+  if (!stat.isFile()) {
+    throw new Error(`Input is not a file: ${filePath}`);
+  }
+}
+function isolateImage(source) {
+  const workdir = fs.mkdtempSync(path.join(os.tmpdir(), "modlens-work-"));
+  const imageSource = path.join(workdir, path.basename(source));
+  fs.copyFileSync(source, imageSource);
+  fs.chmodSync(imageSource, 384);
+  return {
+    imageSource,
+    workdir,
+    cleanup: () => fs.rmSync(workdir, { recursive: true, force: true })
+  };
+}
+function emptyWorkdir() {
+  const workdir = fs.mkdtempSync(path.join(os.tmpdir(), "modlens-work-"));
+  return {
+    workdir,
+    cleanup: () => fs.rmSync(workdir, { recursive: true, force: true })
+  };
+}
+function runCommand(providerName, invocation, timeoutMs, describeFailure) {
+  const runStartedAt = Date.now();
+  return new Promise((resolve, reject) => {
+    const child = spawn(invocation.command, invocation.args, {
+      cwd: invocation.cwd,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const outDecoder = new TextDecoder("utf-8");
+    const errDecoder = new TextDecoder("utf-8");
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let settled = false;
+    let drainTimer;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+      settle(null);
+      setTimeout(() => {
+        if (!exited) {
+          child.kill("SIGKILL");
+        }
+      }, SIGKILL_GRACE_MS).unref();
+    }, timeoutMs);
+    const settle = (code) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(timer);
+      clearTimeout(drainTimer);
+      stdout += outDecoder.decode();
+      stderr += errDecoder.decode();
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+      child.unref();
+      if (timedOut) {
+        reject(new Error(`${providerName} provider timed out after ${timeoutMs} ms.`));
+        return;
+      }
+      if (code !== 0) {
+        const explained = describeFailure?.({ stdout, stderr, code, startedAt: runStartedAt }) ?? null;
+        reject(
+          new Error(
+            explained ?? `${providerName} provider failed with code ${code}.${stderr ? ` stderr: ${stderr.trim()}` : ""}`
+          )
+        );
+        return;
+      }
+      resolve({ stdout, stderr });
+    };
+    let exitCode = null;
+    let exited = false;
+    const restartDrain = () => {
+      if (!exited || settled) {
+        return;
+      }
+      clearTimeout(drainTimer);
+      drainTimer = setTimeout(() => settle(exitCode), DRAIN_GRACE_MS);
+    };
+    child.stdout.on("data", (chunk) => {
+      stdout += outDecoder.decode(chunk, { stream: true });
+      restartDrain();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += errDecoder.decode(chunk, { stream: true });
+      restartDrain();
+    });
+    child.on("error", (error) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(timer);
+      clearTimeout(drainTimer);
+      if (error.code === "ENOENT") {
+        const missingCwd = !fs.existsSync(invocation.cwd);
+        reject(
+          new Error(
+            missingCwd ? `Working directory does not exist: ${invocation.cwd}` : `Provider CLI not found: ${invocation.command}. Install it and sign in first.`
+          )
+        );
+        return;
+      }
+      reject(error);
+    });
+    child.on("exit", (code) => {
+      exitCode = code;
+      exited = true;
+      restartDrain();
+    });
+    child.on("close", (code) => settle(code));
+  });
 }
 const HARNESS_BY_BASENAME = {
   claude: "claude-code",
@@ -29587,6 +30036,9 @@ function versionParts(version) {
   }
   return [Number(match[1]), Number(match[2])];
 }
+function chainEntryName(provider) {
+  return provider.reuseNote ? `${provider.name} (reused)` : provider.name;
+}
 function meetsMinimum(version, minimum) {
   const [major, minor] = versionParts(version);
   const [minMajor, minMinor] = versionParts(minimum);
@@ -29699,6 +30151,8 @@ function buildDoctorReport(input) {
     harness: harnessDetection.harness
   });
   const guardVerdict = evaluateGuard(input.config.guards, guardDetection);
+  const reuseDiscovery = discoverAuto({ env, fresh: true, ...input.auto });
+  const reuseOptions = { env, ...input.auto, discovery: reuseDiscovery };
   return {
     node: {
       version: process.version,
@@ -29708,9 +30162,12 @@ function buildDoctorReport(input) {
     nodeSqlite: checkNodeSqlite(),
     providers: PROVIDER_DESCRIPTORS.map((d) => inspectProvider(d, input.config, env)),
     selection: resolveSelection(input.config, input.providerFlag),
+    // The chains a run would actually use, reused routes included and
+    // labeled, so a machine living entirely on granted logins does not
+    // read as "no engine" right next to a granted Reuse section.
     chains: {
-      local: providerChain("local", input.config, env).map((p) => p.name),
-      remote: providerChain("remote", input.config, env).map((p) => p.name)
+      local: composeChain("local", input.config, reuseOptions).map(chainEntryName),
+      remote: composeChain("remote", input.config, reuseOptions).map(chainEntryName)
     },
     harness: { detected: harnessDetection.harness, source: harnessDetection.source },
     guard: {
@@ -29724,11 +30181,18 @@ function buildDoctorReport(input) {
       reason: guardVerdict.reason
     },
     config: inspectConfigFile(configPath),
-    // doctor is the "what would auto find" view, so it always probes fresh
-    // (and rewrites the cache); regular runs will read the cache instead.
-    auto: {
-      enabled: input.config.auto === true,
-      probes: discoverAuto({ env, fresh: true, ...input.auto }).probes
+    reuse: {
+      decisions: Object.fromEntries(
+        REUSE_HARNESSES.map((harness) => {
+          const decision = input.config.reuse?.[harness];
+          const fallback = harness === "claude" ? "granted" : "not asked";
+          return [
+            harness,
+            decision === true ? "granted" : decision === false ? "refused" : fallback
+          ];
+        })
+      ),
+      probes: reuseDiscovery.probes
     }
   };
 }
@@ -29778,11 +30242,11 @@ function renderDoctorReport(report) {
     `  verdict: ${report.guard.verdict}${report.guard.matched ? ` (matched "${report.guard.matched}")` : ""}, ${report.guard.reason}`
   );
   lines.push("");
-  lines.push("Auto (borrowable local harness vision; off by default)");
+  lines.push('Reuse (may modlens reuse other local logins? config "reuse.<harness>")');
   lines.push(
-    `  enabled: ${report.auto.enabled}${report.auto.enabled ? "" : " (turn on: modlens config set auto true)"}`
+    `  decisions: ${Object.entries(report.reuse.decisions).map(([harness, decision]) => `${harness} ${decision}`).join(", ")}`
   );
-  for (const probe of report.auto.probes) {
+  for (const probe of report.reuse.probes) {
     if (!probe.cliFound) {
       lines.push(`  ${probe.harness}: cli not found`);
       continue;
@@ -29994,7 +30458,7 @@ function recoverPastedImages(options = {}) {
   return result;
 }
 const program = new Command();
-program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.7.0");
+program.name("modlens").description("Plug-in vision for text-only LLMs: image in, structured JSON evidence out").version("3.8.0");
 program.command("analyze", { isDefault: true }).description("Analyze an image into structured JSON evidence (default command)").requiredOption("-i, --input <path|url>", "Input image path or https URL").option("-o, --output <path>", "Write result JSON to a file").option("-m, --model <name>", "Provider model name").option("-p, --provider <name>", `Vision provider (${listProviders().join(", ")})`).option("--prompt <text>", "Extra focus for this image").option("--timeout <ms>", "Provider timeout in milliseconds", "180000").option("--provider-bin <path>", "Provider binary path (default: agy)").option("--workdir <path>", "Working directory for the provider").option(
   "--extra-body <json>",
   `JSON merged into the API request body, e.g. '{"thinking":{"type":"disabled"}}'`