@mono-agent/agent-app 0.20.11 → 0.21.0

package/dist/doctor.js

@@ -1,7 +1,7 @@
+import { inspectWebControl } from "./web-request-coordinator.js";
 import { execFile as execFileCallback } from "node:child_process";
 import { constants } from "node:fs";
 import { access, lstat, mkdir, readdir, readFile, realpath, stat } from "node:fs/promises";
-import { homedir } from "node:os";
 import { isIP } from "node:net";
 import { basename, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
@@ -12,10 +12,12 @@ import { promisify } from "node:util";
 import { getBuiltinModels as getPiBuiltinModels, getBuiltinProviders as getPiBuiltinProviders, } from "@earendil-works/pi-ai/providers/all";
 import { validateCronExpression } from "@mono-agent/cron-adapter";
 import { classifyContinuationMcpServerTransport, isStdioMcpServerSpec, loadToolPolicyFromJsonFile, } from "@mono-agent/agent-harness";
-import { defaultExecutionModeForModel, describeMonoRuntimeSupport, inspectCodexSubscriptionSearch, isValidMcpServerName, modelReferenceKey, networkPolicyAllowsUrl, parseMonoRuntimeModelReference, resolveModelEffortLevels, } from "@mono-agent/runtime-adapter";
-import { buildMonoAgentConfigView, findJsonSecretConfigWarnings, findRemovedConfigWarnings, readMonoAgentConfigJson, redactMonoAgentConfig, resolveSupermemoryContainer, } from "@mono-agent/config";
-import { describeSandboxEffectiveState, resolveSandboxEffectiveState, sandboxEffectiveStateWarning, } from "@mono-agent/runtime-adapter";
+import { describeMonoRuntimeSupport, inspectCodexSubscriptionSearch, isValidMcpServerName, modelReferenceKey, networkPolicyAllowsUrl, parseMonoRuntimeModelReference, } from "@mono-agent/runtime-adapter";
+import { buildMonoAgentConfigView, EFFORT_LEVELS, findJsonSecretConfigWarnings, findRemovedConfigWarnings, readMonoAgentConfigJson, redactMonoAgentConfig, resolveSupermemoryContainer, } from "@mono-agent/config";
+import { describeSandboxEffectiveState, MODEL_REFERENCE_ECHO_MAX_BYTES, MODEL_REFERENCE_REASON_MAX_BYTES, resolveSandboxEffectiveState, RuntimeAdapterError, sandboxEffectiveStateWarning, sanitizeModelReferenceText, } from "@mono-agent/runtime-adapter";
 import { isAppCoreConfigError, loadAppCoreConfig, } from "./app-config.js";
+import { isRememberToolAllowed, isRememberToolPolicyName } from "./memory-remember.js";
+import { isMemoryJournalToolAllowed, isMemoryJournalToolPolicyName } from "./memory-journal.js";
 import { adapterSendToolNames, isAdapterSendToolAllowed, resolveAdapterSendToolsSettings } from "./adapter-send-tools.js";
 import { canonicalToolName, isAllowAllTools, isKnownToolName, isMcpToolName, suggestToolName } from "./modules/known-tools.js";
 import { collectChannelConfigViews } from "./channel-config-view.js";
@@ -37,19 +39,26 @@ import { formatInteractionBridgeUrl, loadInteractionSettings } from "./interacti
 import { FIRST_RUN_MEMORY_INITIALIZING_MARKER } from "./first-run-managed-memory.js";
 import { DEFAULT_MEMORY_EMBEDDING_ENDPOINTS, probeMemoryEmbeddingSelection, } from "./memory-embedding-service.js";
 import { piAuthRecoveryCommand } from "./provider-setup.js";
+import { collectUsedProviderReferences } from "./provider-auth-status.js";
 import { inspectPiAuthStore } from "./pi-auth-store-inspection.js";
-import { checkManagedProjectSkills, managedProjectSkillsExist } from "./project-skills.js";
-import { configuredRuntimeFallbackModels, configuredRuntimeModels } from "./runtime-routes.js";
+import { activeProjectSkillSelections, checkManagedProjectSkills, isRetiredProjectSkillName, managedProjectSkillsExist, } from "./project-skills.js";
 import { runtimeProvenanceDetail } from "./runtime-provenance.js";
+import { resolveAdvertisedModelEffort } from "./model-effort-capabilities.js";
 import { loadSupermemoryPlugin } from "./supermemory-plugin.js";
 import { DEFAULT_LAUNCHD_LOG_POLICY, inspectLaunchdLogs, LAUNCHD_LOG_MONITOR_INTERVAL_SECONDS, launchdLogPathsForConfig, } from "./launchd-logs.js";
 import { readLaunchdLogMonitorStatus } from "./launchd-log-monitor-status.js";
 import { exporterSection, runsSection } from "./doctor-observability.js";
 import { sessionToolHistorySection } from "./doctor-session-history.js";
-import { runtimeRouteContainsUnsupportedHistoryTool } from "./app-controller-utils.js";
 const execFile = promisify(execFileCallback);
 const CONTINUATION_V2_ROLLBACK_GUARD = "UPGRADED-TO-RECORDS-V3";
 const CONTINUATION_V2_ROLLBACK_GUARD_CONTENT = "This state directory uses continuation records v3. Older runtimes must not open records-v2.\n";
+const DOCTOR_STATUS_TIMEOUT_MS = 5_000;
+const DOCTOR_STATUS_MAX_BUFFER_BYTES = 64 * 1024;
+const OLLAMA_WEB_SEARCH_PROBE_MAX_BYTES = 2 * 1024 * 1024;
+const defaultDoctorStatusExecFile = async (file, args, options) => {
+    const { stdout } = await execFile(file, [...args], options);
+    return { stdout };
+};
 /**
  * Loads every config section the app would use at start and reports it
  * per-section, so an engineer can see exactly what would run, wait, or fail —
@@ -73,7 +82,7 @@ export async function validateMonoAgentFolder(options) {
     }
     sections.push(await runtimeProvenanceSection(options.verifiedRuntimeProvenanceDetail));
     if (coreConfig !== undefined) {
-        const staticTriggerCredentialRefs = await collectStaticTriggerCredentialRefs(drivers, options);
+        const staticTriggerCredentialRefs = await collectStaticTriggerCredentialRefs(coreConfig, drivers, options);
         const jsonResult = await readMonoAgentConfigJson(options.configPath);
         // Channel secrets (bot tokens, API keys) live outside the core view, so the
         // placement check spans both: core sections + every channel's config view.
@@ -92,13 +101,13 @@ export async function validateMonoAgentFolder(options) {
             sections.push({ id: "secret-placement", label: "Config warnings", status: "waiting", details: configWarnings });
         }
         sections.push(runtimeSection(coreConfig));
-        sections.push(await credentialsSection(coreConfig, options.env, options.cwd, liveness, options.verifiedCredentialModelRefs, options.sdkAuthStatusExecFile, staticTriggerCredentialRefs));
+        sections.push(await credentialsSection(coreConfig, options.env, options.verifiedCredentialModelRefs, staticTriggerCredentialRefs));
         sections.push(await contextSection(coreConfig, options.cwd));
         sections.push(await memorySection(coreConfig, options.cwd, options.env, liveness, allowFilesystemWrites, options.preferAppPluginInstall === true));
         sections.push(await toolsSection(coreConfig, options));
         sections.push(await sessionToolHistorySection({
             historyRoot: join(coreConfig.artifacts.dir, "..", "history"),
-            requestScopedToolSupported: !runtimeRouteContainsUnsupportedHistoryTool(coreConfig),
+            requestScopedToolSupported: true,
         }));
         sections.push(await webToolsSection(coreConfig, options, liveness));
         sections.push(await continuationSection(coreConfig, options));
@@ -233,73 +242,13 @@ function staticTriggerConfigEntries(driverId, loaded) {
  * Collect static trigger model overrides for credential readiness. Dynamic
  * webhook request-body overrides are intentionally unavailable at validate time.
  */
-async function collectStaticTriggerCredentialRefs(drivers, input) {
-    const refs = [];
-    const seen = new Set();
-    for (const driver of drivers) {
-        if (driver.id !== "webhook" && driver.id !== "cron")
-            continue;
-        let loaded;
-        try {
-            loaded = await driver.loadConfig(input);
-        }
-        catch {
-            // The channel section owns malformed/unreadable config diagnostics.
-            continue;
-        }
-        for (const { entryPath, entry } of staticTriggerConfigEntries(driver.id, loaded)) {
-            if (typeof entry.model !== "string")
-                continue;
-            try {
-                const ref = parseMonoRuntimeModelReference(entry.model);
-                const key = `${entryPath}\u0000${modelReferenceKey(ref)}`;
-                if (seen.has(key))
-                    continue;
-                seen.add(key);
-                refs.push({ label: entryPath, ref });
-            }
-            catch {
-                // The channel section owns invalid model-reference syntax.
-            }
-        }
-    }
-    return refs;
+async function collectStaticTriggerCredentialRefs(config, drivers, input) {
+    return (await collectUsedProviderReferences(config, drivers, input))
+        .filter(({ usage }) => usage.kind === "cron" || usage.kind === "webhook")
+        .map(({ usage, ref }) => ({ label: usage.label, ref }));
 }
 async function applyRequestModelOverrideCompatibilityChecks(sections, config, drivers, input) {
-    const baseIsDirectCodex = config.runtime.model.sdk === "codex";
-    const routeSafety = config.runtime.routeSafety ?? "uniform";
-    const directBoundaryConflicts = [];
-    const sandboxBypasses = [];
-    const toolPolicyBypasses = [];
-    const effortBypasses = [];
-    const turnCapBypasses = [];
-    const mcpBypasses = [];
-    const skillBypasses = [];
     const piModelResolutionFailures = [];
-    const monoSandboxActive = config.sandbox !== undefined && config.sandbox.mode !== "off";
-    const restrictiveToolPolicy = !hasAllowAllOnlyToolPolicy(config.tools);
-    let configuredMcpServerNames = [];
-    if (config.tools.mcpConfigPath !== undefined) {
-        try {
-            configuredMcpServerNames = Object.keys((await loadToolPolicyFromJsonFile(config.tools.mcpConfigPath)).mcpServers ?? {});
-        }
-        catch {
-            // The tools section owns missing/malformed MCP-file diagnostics.
-        }
-    }
-    let adapterToolNames = [];
-    try {
-        const settings = await resolveAdapterSendToolsSettings(input, {
-            allowedTools: config.tools.allowedTools,
-            disallowedTools: config.tools.disallowedTools,
-        });
-        if (settings !== undefined)
-            adapterToolNames = adapterSendToolNames(settings);
-    }
-    catch {
-        // Channel/tools sections own adapter config diagnostics.
-    }
-    const effectiveMcpSources = effectiveMcpRuntimeSources(config, configuredMcpServerNames, adapterToolNames);
     for (const driver of drivers) {
         if (driver.id !== "webhook" && driver.id !== "cron")
             continue;
@@ -313,50 +262,19 @@ async function applyRequestModelOverrideCompatibilityChecks(sections, config, dr
         }
         for (const { entryPath, entry } of staticTriggerConfigEntries(driver.id, loaded)) {
             const hasModelOverride = typeof entry.model === "string";
-            const hasEffortOverride = typeof entry.effort === "string";
-            if (!hasModelOverride && !hasEffortOverride)
+            if (!hasModelOverride)
                 continue;
             try {
-                const model = hasModelOverride
-                    ? parseMonoRuntimeModelReference(entry.model)
-                    : config.runtime.model;
-                const location = hasModelOverride
-                    ? `${entryPath}.model=${entry.model}`
-                    : `${entryPath}.effort=${entry.effort}`;
-                if (hasModelOverride) {
-                    const resolutionIssue = piModelResolutionIssue(config, model);
-                    if (resolutionIssue !== undefined) {
-                        piModelResolutionFailures.push(`${location}: ${resolutionIssue}.`);
-                    }
-                }
-                if (routeSafety === "uniform" && hasModelOverride && (model.sdk === "codex") !== baseIsDirectCodex) {
-                    directBoundaryConflicts.push(location);
-                }
-                if (routeSafety === "uniform" && hasModelOverride && monoSandboxActive && (model.sdk === "claude" || model.sdk === "opencode" || model.sdk === "codex")) {
-                    sandboxBypasses.push(location);
-                }
-                if (hasModelOverride && restrictiveToolPolicy && model.sdk === "opencode") {
-                    toolPolicyBypasses.push(location);
-                }
-                const effectiveEffort = hasEffortOverride ? entry.effort : config.runtime.effort;
-                const legacyFallbacks = (config.runtime.fallbacks?.length ?? 0) > 0
-                    ? []
-                    : config.runtime.fallbackModels ?? [];
-                const directOpenCodeModels = [model, ...legacyFallbacks]
-                    .filter((candidate) => candidate.sdk === "opencode");
-                if (directOpenCodeModels.length > 0 && effectiveEffort !== undefined) {
-                    effortBypasses.push(`${location} (effective effort=${effectiveEffort}) (direct OpenCode route=${directOpenCodeModels.map(referenceOf).join(", ")})`);
-                }
-                if (directOpenCodeModels.length > 0 && Number(config.runtime.maxTurns) > 0) {
-                    turnCapBypasses.push(`${location} (runtime.maxTurns=${config.runtime.maxTurns}; direct OpenCode route=${directOpenCodeModels.map(referenceOf).join(", ")})`);
-                }
-                if (directOpenCodeModels.length > 0 && effectiveMcpSources.length > 0) {
-                    mcpBypasses.push(`${location} (direct OpenCode route=${directOpenCodeModels.map(referenceOf).join(", ")}; MCP sources=${effectiveMcpSources.join("; ")})`);
-                }
-                if (directOpenCodeModels.length > 0
-                    && config.context.skillDisclosure === "index"
-                    && config.context.skillsRoot !== undefined) {
-                    skillBypasses.push(location);
+                const model = parseMonoRuntimeModelReference(entry.model);
+                const resolutionIssue = piModelResolutionIssue(config, model);
+                if (resolutionIssue !== undefined) {
+                    // The parser accepted this value, but acceptance is no longer a length
+                    // guarantee: the byte ceiling was removed because no constant could
+                    // hold for every provider, so a legitimately long id parses. This is a
+                    // diagnostic, not the protocol string, so it is bounded here rather
+                    // than at the grammar.
+                    const echoed = sanitizeModelReferenceText(entry.model, MODEL_REFERENCE_ECHO_MAX_BYTES);
+                    piModelResolutionFailures.push(`${entryPath}.model=${echoed}: ${resolutionIssue}.`);
                 }
             }
             catch {
@@ -364,14 +282,7 @@ async function applyRequestModelOverrideCompatibilityChecks(sections, config, dr
             }
         }
     }
-    if (directBoundaryConflicts.length === 0
-        && sandboxBypasses.length === 0
-        && toolPolicyBypasses.length === 0
-        && effortBypasses.length === 0
-        && turnCapBypasses.length === 0
-        && mcpBypasses.length === 0
-        && skillBypasses.length === 0
-        && piModelResolutionFailures.length === 0)
+    if (piModelResolutionFailures.length === 0)
         return;
     const index = sections.findIndex((section) => section.id === "runtime");
     if (index < 0)
@@ -382,63 +293,14 @@ async function applyRequestModelOverrideCompatibilityChecks(sections, config, dr
         status: "error",
         details: [
             ...runtime.details,
-            ...(directBoundaryConflicts.length === 0
-                ? []
-                : [
-                    "Uniform route safety cannot cross the direct-Codex runtime boundary because tool and sandbox contracts would change mid-agent. Choose per-route-native to opt into explicit route-local contracts.",
-                    ...directBoundaryConflicts,
-                ]),
-            ...(sandboxBypasses.length === 0
-                ? []
-                : [
-                    "Claude or direct OpenCode model overrides cannot run under uniform route safety while mono-agent SRT is active; direct Codex is also provider-owned. Choose per-route-native only after reviewing the explicit route-local contracts.",
-                    ...sandboxBypasses,
-                ]),
-            ...(toolPolicyBypasses.length === 0
-                ? []
-                : [
-                    "Per-trigger direct OpenCode model overrides require an effective allow-all policy because OpenCode's provider-owned tool loop does not consume mono-agent allowedTools/disallowedTools.",
-                    ...toolPolicyBypasses,
-                ]),
-            ...(effortBypasses.length === 0
-                ? []
-                : [
-                    "Per-trigger direct OpenCode routes cannot receive runtime effort because the OpenCode SDK does not expose effort control.",
-                    ...effortBypasses,
-                ]),
-            ...(turnCapBypasses.length === 0
-                ? []
-                : [
-                    "Per-trigger direct OpenCode routes cannot enforce runtime.maxTurns; omit it, set it to 0, or use a runtime with a hard turn cap.",
-                    ...turnCapBypasses,
-                ]),
-            ...(mcpBypasses.length === 0
-                ? []
-                : [
-                    "Per-trigger direct OpenCode routes cannot receive configured or auto-provisioned MCP runtime options.",
-                    ...mcpBypasses,
-                ]),
-            ...(skillBypasses.length === 0
-                ? []
-                : [
-                    "Per-trigger direct OpenCode routes cannot use index skill disclosure because the bridge disables external/runtime skills; use full disclosure or a Pi runtime.",
-                    ...skillBypasses,
-                ]),
-            ...(piModelResolutionFailures.length === 0
-                ? []
-                : [
-                    "Per-trigger Pi model overrides must resolve through providers.local or Pi's exact built-in catalog before execution.",
-                    ...piModelResolutionFailures,
-                ]),
+            "Per-trigger Pi model overrides must resolve through providers.local or Pi's exact built-in catalog before execution.",
+            ...piModelResolutionFailures,
         ],
     };
 }
 function isUnknownRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function hasAllowAllOnlyToolPolicy(tools) {
-    return isAllowAllTools(tools.allowedTools) && tools.disallowedTools.length === 0;
-}
 /** Adapter send tools each channel owns; an allowed entry needs BOTH the tool AND the enabled channel. */
 const CHANNEL_OWNED_SEND_TOOLS = {
     slack: ["SlackSendMessage"],
@@ -511,45 +373,28 @@ function runtimeSection(config) {
     const details = [];
     let status = "ok";
     const routes = configuredRuntimeRouteChecks(config);
-    const routeSafety = config.runtime.routeSafety ?? "uniform";
-    details.push(`Route safety: ${routeSafety}.`);
-    if (routes.length > 1) {
-        details.push(routeSafety === "per-route-native"
-            ? "Mixed runtime families are allowed; every attempt uses its explicit route-native safety contract."
-            : "Fallback routes use the uniform compatibility contract; validation fails closed when any route cannot represent a required capability.");
-    }
-    const directOpenCodeModels = routes.filter((route) => route.model.sdk === "opencode");
-    if (Number(config.runtime.maxTurns) > 0 && directOpenCodeModels.length > 0) {
-        status = "error";
-        details.push(`Direct OpenCode model${directOpenCodeModels.length === 1 ? "" : "s"} ${directOpenCodeModels.map((route) => referenceOf(route.model)).join(", ")} cannot enforce runtime.maxTurns=${config.runtime.maxTurns}; omit it, set it to 0, or use a runtime with a hard turn cap.`);
-    }
-    if (directOpenCodeModels.length > 0
-        && config.context.skillDisclosure === "index"
-        && config.context.skillsRoot !== undefined) {
-        status = "error";
-        details.push(`Direct OpenCode model${directOpenCodeModels.length === 1 ? "" : "s"} ${directOpenCodeModels.map((route) => referenceOf(route.model)).join(", ")} cannot use context.skillDisclosure=index because runtime skills are disabled; use full disclosure or a Pi runtime.`);
-    }
     for (const route of routes) {
         try {
-            const support = describeMonoRuntimeSupport(route.model, route.executionMode);
+            const support = describeMonoRuntimeSupport(route.model);
             const resolutionIssue = piModelResolutionIssue(config, route.model);
-            const effortIssue = runtimeRouteEffortIssue(config, route);
-            if (support.compatible && resolutionIssue === undefined) {
-                details.push(`${route.label} ${referenceOf(route.model)} runs on ${support.backend?.label ?? "unknown backend"} ` +
+            const effortWarning = runtimeRouteEffortWarning(config, route);
+            if (resolutionIssue === undefined) {
+                details.push(`${route.label} ${displayReferenceOf(route.model)} runs on ${support.backend.label} ` +
                     `(effort: ${route.effort ?? "provider default"}).`);
             }
             else {
                 status = "error";
-                details.push(`${route.label} ${referenceOf(route.model)}: ${resolutionIssue ?? support.incompatibilityReason ?? "unsupported"}.`);
+                details.push(`${route.label} ${displayReferenceOf(route.model)}: ${resolutionIssue}.`);
             }
-            if (effortIssue !== undefined) {
-                status = "error";
-                details.push(`${route.label} ${referenceOf(route.model)}: ${effortIssue}`);
+            if (effortWarning !== undefined) {
+                if (status !== "error")
+                    status = "waiting";
+                details.push(effortWarning);
             }
         }
         catch (error) {
             status = "error";
-            details.push(`${route.label} ${referenceOf(route.model)}: ${error instanceof Error ? error.message : String(error)}.`);
+            details.push(`${route.label} ${displayReferenceOf(route.model)}: ${displayReason(error)}.`);
         }
     }
     return { id: "runtime", label: "Runtime", status, details };
@@ -557,48 +402,52 @@ function runtimeSection(config) {
 function configuredRuntimeRouteChecks(config) {
     const primary = {
         label: "Primary model",
+        configPath: "runtime.effort",
         model: config.runtime.model,
         ...(config.runtime.effort === undefined ? {} : { effort: config.runtime.effort }),
-        executionMode: config.runtime.executionMode,
     };
-    if ((config.runtime.fallbacks?.length ?? 0) > 0) {
-        return [
-            primary,
-            ...(config.runtime.fallbacks ?? []).map((fallback) => ({
-                label: "Fallback model",
-                model: fallback.model,
-                ...(fallback.effort === undefined ? {} : { effort: fallback.effort }),
-            })),
-        ];
-    }
     return [
         primary,
-        ...(config.runtime.fallbackModels ?? []).map((model) => ({
+        ...(config.runtime.fallbacks ?? []).map((fallback, index) => ({
             label: "Fallback model",
-            model,
-            ...(config.runtime.effort === undefined ? {} : { effort: config.runtime.effort }),
+            configPath: `runtime.fallbacks[${index}].effort`,
+            model: fallback.model,
+            ...(fallback.effort === undefined ? {} : { effort: fallback.effort }),
         })),
     ];
 }
-function runtimeRouteEffortIssue(config, route) {
+function runtimeRouteEffortWarning(config, route) {
     if (route.effort === undefined)
         return undefined;
-    if (route.model.sdk === "opencode") {
-        return `Direct OpenCode model ${referenceOf(route.model)} cannot receive runtime.effort=${route.effort}; the OpenCode SDK exposes no reasoning-effort input. Omit the route effort.`;
-    }
-    const metadata = resolveModelEffortLevels(route.model, config.providers?.local);
-    if (metadata.effortLevels !== undefined && !metadata.effortLevels.includes(route.effort)) {
-        return `effort=${route.effort} is unsupported by known model metadata; choose ${metadata.effortLevels.join(", ")}, or omit it for provider default.`;
-    }
-    if (metadata.reasoning === false && route.effort !== "none") {
-        return `effort=${route.effort} is unsupported because known model metadata marks this route as non-reasoning; use none or provider default.`;
-    }
-    if (route.model.sdk === "claude"
-        && (route.executionMode ?? defaultExecutionModeForModel(route.model)) === "sdk"
-        && !["low", "medium", "high", "xhigh", "max"].includes(route.effort)) {
-        return `effort=${route.effort} is unsupported by the Claude Agent SDK; choose low, medium, high, xhigh, max, or provider default.`;
-    }
-    return undefined;
+    // Always go through the shared resolver. Deriving the ladder from
+    // `thinkingLevelMap`'s KEYS treated an override table as the complete
+    // supported set: claude-fable-5 maps only {off, xhigh, max}, which yielded
+    // [none, xhigh, max] and made a perfectly valid `effort: medium` warn and
+    // recommend xhigh. The resolver reports [minimal, low, medium, high, xhigh,
+    // max] for that model, and it is the same one the catalog and pickers use --
+    // doctor disagreeing with what the selector offers is its own bug.
+    const resolved = resolveAdvertisedModelEffort(route.model, {
+        ...(config.providers?.local === undefined ? {} : { localProviders: config.providers.local }),
+    });
+    // A NON-REASONING route has no advertised ladder at all, so the level-list
+    // check below returns clean and `effort: high` was reported ready. Keep this
+    // ahead of that check: a local model can declare `reasoning_mode: "none"`
+    // WITH `reasoning_levels`, and "this route does not reason" is the accurate
+    // diagnosis there, not "pick another level".
+    if (resolved.reasoning === false && route.effort !== "none") {
+        return `[WARN] ${route.configPath}=${route.effort} is unsupported because known model metadata marks ${displayReferenceOf(route.model)} as non-reasoning; use none, or omit it for the provider default. The runtime remains permissive and will forward the configured value.`;
+    }
+    const advertised = resolved.effortLevels
+        ?.filter((level) => EFFORT_LEVELS.includes(level));
+    if (advertised === undefined || advertised.length === 0 || advertised.includes(route.effort))
+        return undefined;
+    const configuredIndex = EFFORT_LEVELS.indexOf(route.effort);
+    const nearest = advertised.reduce((best, candidate) => {
+        const candidateIndex = EFFORT_LEVELS.indexOf(candidate);
+        const bestIndex = EFFORT_LEVELS.indexOf(best);
+        return Math.abs(candidateIndex - configuredIndex) < Math.abs(bestIndex - configuredIndex) ? candidate : best;
+    });
+    return `[WARN] ${route.configPath}=${route.effort} is outside ${displayReferenceOf(route.model)}'s advertised effort levels (${advertised.join(", ")}); nearest advertised level: ${nearest}. The runtime remains permissive and will forward the configured value.`;
 }
 /**
  * Mirrors the Pi runtime's actual model-resolution boundary. Mono-agent only
@@ -607,17 +456,14 @@ function runtimeRouteEffortIssue(config, route) {
  * provider, `resolvePiRuntimeModel` performs an exact built-in catalog lookup.
  */
 function piModelResolutionIssue(config, model) {
-    if (model.sdk !== "pi" || model.provider === undefined) {
-        return undefined;
-    }
     const localProvider = config.providers?.local?.find((provider) => provider.id === model.provider);
     if (localProvider !== undefined) {
         if (localProvider.enabled === false) {
-            return `provider \`${model.provider}\` is disabled in providers.local`;
+            return `provider \`${displayText(model.provider)}\` is disabled in providers.local`;
         }
         const localModel = localProvider.models?.find((candidate) => candidate.name === model.model || candidate.alias === model.model);
         if (localModel?.enabled === false) {
-            return `model \`${model.model}\` is disabled in providers.local for provider \`${model.provider}\``;
+            return `model \`${displayText(model.model)}\` is disabled in providers.local for provider \`${displayText(model.provider)}\``;
         }
         return undefined;
     }
@@ -625,7 +471,14 @@ function piModelResolutionIssue(config, model) {
         && getPiBuiltinModels(model.provider).some((candidate) => candidate.id === model.model)) {
         return undefined;
     }
-    return (`pi model not found: ${model.provider}:${model.model}; no matching providers.local entry exists and Pi's built-in catalog has no exact model. ` +
+    // This is doctor's own validate-time diagnostic, not the runtime failure
+    // string. The one that must stay byte-identical for `NON_RETRYABLE_PROVIDER_RE`
+    // is built in agent-runtime's `ai/providers/pi-models.js`; nothing matches
+    // against this text. So the reference is bounded here, which matters now that
+    // the parser imposes no length ceiling and a legitimately long id reaches this
+    // line whole.
+    const reference = displayText(`${model.provider}:${model.model}`);
+    return (`pi model not found: ${reference}; no matching providers.local entry exists and Pi's built-in catalog has no exact model. ` +
         "The sibling Pi CLI models.json is not a mono-agent runtime source; add providers.local for a self-hosted provider or choose a built-in Pi model");
 }
 function isPiBuiltinProvider(provider) {
@@ -641,229 +494,21 @@ async function readPiAuthProviders(path) {
         return inspection;
     return { status: "ok", providers: inspection.auth };
 }
-/**
- * What each SDK-authenticated backend truthfully reads for credentials. Only the
- * env vars are statically checkable; the login paths are recorded so the warning
- * can stay honest (a logged-in user is fine and we must not claim otherwise).
- *
- * - claude (`claude:*`, sdk + cli): the Claude Code process authenticates from
- *   `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, or `CLAUDE_CODE_OAUTH_TOKEN` in
- *   the env, OR from a `claude /login` subscription session stored outside the
- *   environment (macOS Keychain / `~/.claude`), OR from a Bedrock/Vertex
- *   configuration (`CLAUDE_CODE_USE_BEDROCK`/`CLAUDE_CODE_USE_VERTEX` + cloud
- *   credentials) — none of which the env-key check can see, hence the hedge in
- *   the warning. Its own error string is verbatim: "Claude Code authentication
- *   failed. Run `claude /login` or configure ANTHROPIC_API_KEY,
- *   ANTHROPIC_AUTH_TOKEN, or CLAUDE_CODE_OAUTH_TOKEN."
- * - codex (`codex:*`, cli): the Codex app-server authenticates from
- *   `OPENAI_API_KEY` in the env, OR from a `codex login` ChatGPT session stored
- *   in `~/.codex/auth.json` — also outside the environment.
- */
-const SDK_AUTH_SCHEMES = {
-    claude: {
-        envKeys: ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN"],
-        loginCommand: "claude /login",
-        loginDetail: "a `claude /login` subscription session or a Bedrock/Vertex configuration (CLAUDE_CODE_USE_BEDROCK/VERTEX)",
-        failureHint: 'the first turn fails with an opaque "Claude Code process exited with code 1" that names nothing',
-        statusCommand: "claude auth status --json",
-        statusArgs: ["auth", "status", "--json"],
-    },
-    codex: {
-        envKeys: ["OPENAI_API_KEY"],
-        loginCommand: "codex login",
-        loginDetail: "a `codex login` ChatGPT session (`~/.codex/auth.json`, outside the environment)",
-        failureHint: "the first turn fails to authenticate",
-        statusCommand: "codex login status",
-        statusArgs: ["login", "status"],
-    },
-};
-const SDK_AUTH_STATUS_TIMEOUT_MS = 5_000;
-const SDK_AUTH_STATUS_MAX_BUFFER_BYTES = 64 * 1024;
-function isSdkAuthName(value) {
-    return value === "claude" || value === "codex";
-}
-const defaultSdkAuthStatusExecFile = async (file, args, options) => {
-    const { stdout } = await execFile(file, [...args], options);
-    return { stdout };
-};
-/**
- * Performs the SDK's local, read-only login-status command. A zero Codex exit
- * confirms its external login; Claude additionally requires strict JSON with
- * `loggedIn: true`. Missing binaries, timeouts, non-zero exits, and malformed
- * output all fail closed without leaking command output into validation.
- */
-async function checkSdkExternalLoginStatus(sdk, env, cwd, run) {
-    const scheme = SDK_AUTH_SCHEMES[sdk];
-    try {
-        const { stdout } = await run(sdk, scheme.statusArgs, {
-            cwd,
-            env,
-            timeout: SDK_AUTH_STATUS_TIMEOUT_MS,
-            maxBuffer: SDK_AUTH_STATUS_MAX_BUFFER_BYTES,
-            encoding: "utf8",
-        });
-        if (sdk === "codex") {
-            return true;
-        }
-        const parsed = JSON.parse(stdout);
-        return parsed !== null
-            && typeof parsed === "object"
-            && !Array.isArray(parsed)
-            && parsed.loggedIn === true;
-    }
-    catch {
-        return false;
-    }
-}
-/** Read provider IDs directly from auth.json without launching mutation-capable OpenCode middleware. */
-async function inspectOpenCodeCredentialProviders(env) {
-    if (env.OPENCODE_AUTH_CONTENT !== undefined) {
-        return { status: "inline_auth_unsupported" };
-    }
-    const dataHome = typeof env.XDG_DATA_HOME === "string" && env.XDG_DATA_HOME.length > 0
-        ? env.XDG_DATA_HOME
-        : join(typeof env.HOME === "string" && env.HOME.length > 0 ? env.HOME : homedir(), ".local", "share");
-    const opencodeData = join(dataHome, "opencode");
-    const marker = await regularCurrentUserFile(join(opencodeData, "opencode.db"));
-    if (!marker)
-        return { status: "migration_required" };
-    const authPath = join(opencodeData, "auth.json");
-    if (!(await regularCurrentUserFile(authPath)))
-        return { status: "auth_missing" };
-    try {
-        const parsed = JSON.parse(await readFile(authPath, "utf8"));
-        if (!isUnknownRecord(parsed))
-            return { status: "auth_invalid" };
-        const providers = new Set();
-        for (const [provider, credential] of Object.entries(parsed)) {
-            if (provider.length === 0 || provider.trim() !== provider || !isOpenCodeCredentialEntry(credential)) {
-                return { status: "auth_invalid" };
-            }
-            providers.add(provider);
-        }
-        return { status: "ok", providers };
-    }
-    catch {
-        return { status: "auth_invalid" };
-    }
-}
-async function regularCurrentUserFile(path) {
-    try {
-        const info = await lstat(path);
-        return info.isFile() && (typeof process.getuid !== "function" || info.uid === process.getuid());
-    }
-    catch {
-        return false;
-    }
-}
-function isOpenCodeCredentialEntry(value) {
-    if (!isUnknownRecord(value))
-        return false;
-    if (value.type === "oauth") {
-        return typeof value.refresh === "string"
-            && typeof value.access === "string"
-            && (value.refresh.trim().length > 0 || value.access.trim().length > 0)
-            && typeof value.expires === "number"
-            && Number.isSafeInteger(value.expires)
-            && value.expires >= 0
-            && (value.accountId === undefined || typeof value.accountId === "string")
-            && (value.enterpriseUrl === undefined || typeof value.enterpriseUrl === "string");
-    }
-    if (value.type === "api") {
-        return typeof value.key === "string"
-            && value.key.trim().length > 0
-            && (value.metadata === undefined
-                || (isUnknownRecord(value.metadata) && Object.values(value.metadata).every((entry) => typeof entry === "string")));
-    }
-    if (value.type === "wellknown") {
-        return typeof value.key === "string" && value.key.trim().length > 0
-            && typeof value.token === "string" && value.token.trim().length > 0;
-    }
-    return false;
-}
-async function checkOpenCodeVersion(env, cwd, run) {
-    const versionEnv = {};
-    for (const key of [
-        "PATH",
-        "LANG",
-        "LC_ALL",
-        "LC_CTYPE",
-        "SHELL",
-        "TMPDIR",
-        "TMP",
-        "TEMP",
-        "SystemRoot",
-        "WINDIR",
-        "ComSpec",
-        "PATHEXT",
-    ]) {
-        const value = env[key];
-        if (typeof value === "string" && value.length > 0)
-            versionEnv[key] = value;
-    }
-    try {
-        const { stdout } = await run("opencode", ["--version"], {
-            cwd,
-            env: versionEnv,
-            timeout: SDK_AUTH_STATUS_TIMEOUT_MS,
-            maxBuffer: SDK_AUTH_STATUS_MAX_BUFFER_BYTES,
-            encoding: "utf8",
-        });
-        const match = /^v?(\d+)\.(\d+)\.(\d+)(?:\+[0-9A-Za-z.-]+)?$/u.exec(stdout.trim());
-        if (match === null)
-            return false;
-        const major = Number(match[1]);
-        const minor = Number(match[2]);
-        const patch = Number(match[3]);
-        return Number.isSafeInteger(major)
-            && Number.isSafeInteger(minor)
-            && Number.isSafeInteger(patch)
-            && (major > 1 || (major === 1 && minor >= 15));
-    }
-    catch {
-        return false;
-    }
-}
-/** First env key whose value is present and non-blank, or undefined when none are set. */
-function firstPresentEnvKey(env, keys) {
-    for (const key of keys) {
-        const value = env[key];
-        if (typeof value === "string" && value.trim().length > 0) {
-            return key;
-        }
-    }
-    return undefined;
-}
 /**
  * Checks that every referenced model (primary, fallbacks, and the agent-host memory LLM)
  * has discoverable credentials, so a keyless or expired-OAuth provider is caught at
  * `validate` time instead of degrading crons/memory silently at runtime (the failure mode
- * that broke memory capture for ~10 days: the auth store's OAuth token had quietly expired,
- * and the E1 fresh-instance case where `claude:*` with no `ANTHROPIC_API_KEY` "validates"
- * clean but the first turn dies with an opaque "process exited with code 1").
+ * that broke memory capture for ~10 days when an auth-store OAuth token quietly expired.
  *
- * The check is read-only. Static validation never launches a process; live validation may
- * run bounded, local SDK login-status commands, which inspect durable external login state
- * without making a model turn or mutating the auth store.
- *
- * - Pi providers: inspect the auth store (`piAuthPath`) and the config's own
+ * The read-only check inspects the auth store (`piAuthPath`) and the config's own
  *   `providers.local` custom providers. A custom/local provider follows its declared
  *   `apiKey` / `apiKeyEnv` contract instead of Pi OAuth; an OAuth provider absent from
  *   the store, or whose access token has expired, is flagged `waiting` with a re-auth hint.
- * - SDK-authenticated providers (`claude:*` / `codex:*`): inspect the RESOLVED ENV (process
- *   env + loaded `.env`) for the backend's accepted keys. During live validation only, a
- *   missing env credential falls back to `claude auth status --json` / `codex login status`.
- *   The commands use the same resolved environment (including PATH and HOME), are bounded,
- *   cached once per SDK, and never make a model turn. Static validation remains process-free.
- * - Direct OpenCode (`opencode:<provider>:<model>`): inspect exact provider IDs in the
- *   standard auth.json and require the native DB migration marker. Static validation launches
- *   no process. Live validation runs only a bounded `opencode --version` preflight; it never
- *   runs the mutation-capable auth middleware or makes a model turn.
  *
  * `waiting` (never `error`) keeps the verdict non-fatal, mirroring the Ollama/Phoenix
  * probes — the goal is visibility, not blocking start.
  */
-async function credentialsSection(config, env, cwd, liveness, verifiedCredentialModelRefs = [], sdkAuthStatusExecFile = defaultSdkAuthStatusExecFile, staticTriggerRefs = []) {
+async function credentialsSection(config, env, verifiedCredentialModelRefs = [], staticTriggerRefs = []) {
     const refs = [
         { label: "Primary", ref: config.runtime.model },
         ...configuredRuntimeRouteChecks(config).slice(1).map((route) => ({
@@ -872,7 +517,7 @@ async function credentialsSection(config, env, cwd, liveness, verifiedCredential
         })),
         ...staticTriggerRefs,
     ];
-    if (config.memory?.llm !== undefined && config.memory.llm.provider !== "ollama") {
+    if (config.memory?.llm?.provider === "agent-host") {
         try {
             refs.push({ label: "Memory LLM", ref: parseMonoRuntimeModelReference(config.memory.llm.model) });
         }
@@ -880,9 +525,7 @@ async function credentialsSection(config, env, cwd, liveness, verifiedCredential
             // A malformed memory model reference is surfaced by the memory/runtime shape checks.
         }
     }
-    const authenticatedRefs = refs.filter((r) => (r.ref.sdk === "pi" && typeof r.ref.provider === "string")
-        || (r.ref.sdk === "opencode" && typeof r.ref.provider === "string")
-        || isSdkAuthName(r.ref.sdk));
+    const authenticatedRefs = refs;
     if (authenticatedRefs.length === 0) {
         return {
             id: "credentials",
@@ -895,102 +538,19 @@ async function credentialsSection(config, env, cwd, liveness, verifiedCredential
     let status = "ok";
     const verified = new Set(verifiedCredentialModelRefs);
     for (const { label, ref } of authenticatedRefs) {
-        const refStr = referenceOf(ref);
-        if (verified.has(refStr)) {
-            details.push(`${label} ${refStr}: credentials verified by a successful live model check.`);
+        // The set holds whole canonical references, so the LOOKUP key stays whole;
+        // only the printed form is bounded.
+        if (verified.has(referenceOf(ref))) {
+            details.push(`${label} ${displayReferenceOf(ref)}: credentials verified by a successful live model check.`);
         }
     }
     const unverifiedRefs = authenticatedRefs.filter(({ ref }) => !verified.has(referenceOf(ref)));
-    const piRefs = unverifiedRefs.filter((r) => r.ref.sdk === "pi" && typeof r.ref.provider === "string");
-    const openCodeRefs = unverifiedRefs.filter((r) => r.ref.sdk === "opencode" && typeof r.ref.provider === "string");
-    const sdkRefs = unverifiedRefs.filter((r) => isSdkAuthName(r.ref.sdk));
-    if (piRefs.length > 0) {
-        const piStatus = await appendPiCredentialDetails(config, piRefs, details, env);
+    if (unverifiedRefs.length > 0) {
+        const piStatus = await appendPiCredentialDetails(config, unverifiedRefs, details, env);
         if (piStatus === "waiting") {
             status = "waiting";
         }
     }
-    const openCodeInspection = openCodeRefs.length > 0
-        ? inspectOpenCodeCredentialProviders(env)
-        : undefined;
-    const openCodeVersion = liveness && openCodeRefs.length > 0
-        ? checkOpenCodeVersion(env, cwd, sdkAuthStatusExecFile)
-        : undefined;
-    const sdkAuthStatuses = new Map();
-    const externalLoginStatus = (sdk) => {
-        const cached = sdkAuthStatuses.get(sdk);
-        if (cached !== undefined) {
-            return cached;
-        }
-        const pending = checkSdkExternalLoginStatus(sdk, env, cwd, sdkAuthStatusExecFile);
-        sdkAuthStatuses.set(sdk, pending);
-        return pending;
-    };
-    // Start each unique local status check before awaiting details so two SDKs
-    // cost one bounded timeout window rather than running serially.
-    if (liveness) {
-        for (const { ref } of sdkRefs) {
-            const scheme = SDK_AUTH_SCHEMES[ref.sdk];
-            if (scheme !== undefined && firstPresentEnvKey(env, scheme.envKeys) === undefined) {
-                void externalLoginStatus(ref.sdk);
-            }
-        }
-    }
-    for (const { label, ref } of sdkRefs) {
-        const refStr = referenceOf(ref);
-        const scheme = SDK_AUTH_SCHEMES[ref.sdk];
-        if (scheme === undefined) {
-            continue;
-        }
-        const present = firstPresentEnvKey(env, scheme.envKeys);
-        if (present !== undefined) {
-            details.push(`${label} ${refStr}: SDK credential present in the resolved env (${present}); credential detected, live model verification is still pending.`);
-            continue;
-        }
-        if (liveness && await externalLoginStatus(ref.sdk)) {
-            details.push(`${label} ${refStr}: external sign-in detected by read-only \`${scheme.statusCommand}\`; ` +
-                "credentials are not verified until a live model turn succeeds.");
-            continue;
-        }
-        status = "waiting";
-        details.push(`[WARN] ${label} ${refStr}: no SDK credential in the resolved env (checked ${scheme.envKeys.join(", ")}). ` +
-            (liveness
-                ? `External login was not verified by \`${scheme.statusCommand}\`; `
-                : `If you authenticated via ${scheme.loginDetail} this is fine and can't be verified during static validation; `) +
-            `otherwise ${scheme.failureHint} — set ${scheme.envKeys[0]} or run \`${scheme.loginCommand}\`.`);
-    }
-    if (openCodeRefs.length > 0) {
-        const inspection = openCodeInspection === undefined ? undefined : await openCodeInspection;
-        const supportedVersion = openCodeVersion === undefined ? false : await openCodeVersion;
-        for (const { label, ref } of openCodeRefs) {
-            const refStr = referenceOf(ref);
-            const provider = ref.provider;
-            const credentialPresent = inspection?.status === "ok" && inspection.providers.has(provider);
-            if (credentialPresent && liveness && supportedVersion) {
-                details.push(`${label} ${refStr}: provider \`${provider}\` credential present in the standard OpenCode auth store; stable OpenCode CLI >=1.15.0 detected without a model turn. Credential detected; live model verification is still pending.`);
-            }
-            else {
-                status = "waiting";
-                const warning = inspection?.status === "migration_required"
-                    ? "the native OpenCode database migration marker is missing or invalid; run `opencode db migrate --pure` once"
-                    : inspection?.status === "inline_auth_unsupported"
-                        ? "OPENCODE_AUTH_CONTENT is unsupported for direct runs; persist credentials with `opencode auth login` and unset it"
-                        : inspection?.status === "auth_invalid"
-                            ? "the standard OpenCode auth.json is malformed or contains an unsupported credential entry"
-                            : credentialPresent && !liveness
-                                ? "credentials and migration marker are present, but the required stable OpenCode CLI >=1.15.0 is unverified during static validation"
-                                : credentialPresent && !supportedVersion
-                                    ? "credentials are present, but stable OpenCode CLI >=1.15.0 could not be verified"
-                                    : inspection?.status === "ok"
-                                        ? `no exact credential entry exists for provider \`${provider}\`; run \`opencode auth login\` for that provider`
-                                        : "the standard OpenCode auth.json is missing; run `opencode auth login`";
-                const safetyNote = liveness
-                    ? "No model turn or mutation-capable OpenCode command was run."
-                    : "No OpenCode process was launched.";
-                details.push(`[WARN] ${label} ${refStr}: ${warning}. ${safetyNote}`);
-            }
-        }
-    }
     return { id: "credentials", label: "Provider credentials", status, details };
 }
 /**
@@ -1014,34 +574,38 @@ async function appendPiCredentialDetails(config, piRefs, details, env) {
     }
     for (const { label, ref } of piRefs) {
         const provider = ref.provider;
-        const refStr = referenceOf(ref);
-        const loginCommand = piAuthRecoveryCommand(provider, authPath);
+        // Display-only from here down: `provider` is still the lookup key into the
+        // auth store and providers.local, `providerLabel` and `refStr` are what the
+        // detail lines quote back at the operator.
+        const providerLabel = displayText(provider);
+        const refStr = displayReferenceOf(ref);
+        const loginCommand = piAuthRecoveryCommand(providerLabel, authPath);
         const localProvider = localProviders.get(provider);
         if (localProvider !== undefined) {
             if (localProvider.enabled === false) {
                 status = "waiting";
-                details.push(`[WARN] ${label} ${refStr}: provider \`${provider}\` is configured in providers.local but disabled (\`enabled: false\`); the runtime will throw \`provider disabled: ${provider}\` on the first turn. Set \`enabled: true\` on that providers.local entry.`);
+                details.push(`[WARN] ${label} ${refStr}: provider \`${providerLabel}\` is configured in providers.local but disabled (\`enabled: false\`); the runtime will throw \`provider disabled: ${providerLabel}\` on the first turn. Set \`enabled: true\` on that providers.local entry.`);
             }
             else if (localProvider.apiKey !== undefined) {
-                details.push(`${label} ${refStr}: provider \`${provider}\` configured via config providers.local (API key configured); credential detected, live model verification is still pending.`);
+                details.push(`${label} ${refStr}: provider \`${providerLabel}\` configured via config providers.local (API key configured); credential detected, live model verification is still pending.`);
             }
             else if (localProvider.apiKeyEnv !== undefined) {
                 if (hasNonEmptyCredentialValue(env[localProvider.apiKeyEnv])) {
-                    details.push(`${label} ${refStr}: provider \`${provider}\` configured via config providers.local with ${localProvider.apiKeyEnv} present in the resolved environment; credential detected, live model verification is still pending.`);
+                    details.push(`${label} ${refStr}: provider \`${providerLabel}\` configured via config providers.local with ${localProvider.apiKeyEnv} present in the resolved environment; credential detected, live model verification is still pending.`);
                 }
                 else {
                     status = "waiting";
-                    details.push(`[WARN] ${label} ${refStr}: provider \`${provider}\` declares apiKeyEnv \`${localProvider.apiKeyEnv}\`, but the resolved environment has no non-empty value and no inline apiKey fallback. Set ${localProvider.apiKeyEnv} before starting.`);
+                    details.push(`[WARN] ${label} ${refStr}: provider \`${providerLabel}\` declares apiKeyEnv \`${localProvider.apiKeyEnv}\`, but the resolved environment has no non-empty value and no inline apiKey fallback. Set ${localProvider.apiKeyEnv} before starting.`);
                 }
             }
             else {
-                details.push(`${label} ${refStr}: provider \`${provider}\` configured via config providers.local (keyless local provider; no API key declared).`);
+                details.push(`${label} ${refStr}: provider \`${providerLabel}\` configured via config providers.local (keyless local provider; no API key declared).`);
             }
             continue;
         }
         const apiKeyEnv = PI_API_KEY_ENV_BY_PROVIDER[provider];
         if (apiKeyEnv !== undefined && hasNonEmptyCredentialValue(env[apiKeyEnv])) {
-            details.push(`${label} ${refStr}: Pi API-key credential for \`${provider}\` present in the resolved environment (${apiKeyEnv}); credential detected, live model verification is still pending.`);
+            details.push(`${label} ${refStr}: Pi API-key credential for \`${providerLabel}\` present in the resolved environment (${apiKeyEnv}); credential detected, live model verification is still pending.`);
             continue;
         }
         if (authInspection?.status === "unsafe") {
@@ -1056,37 +620,37 @@ async function appendPiCredentialDetails(config, piRefs, details, env) {
         if (entry === undefined) {
             status = "waiting";
             details.push(apiKeyEnv === undefined
-                ? `[WARN] ${label} ${refStr}: no Pi credentials found for provider \`${provider}\` in the auth store. Authenticate it with \`${loginCommand}\`, or set providers.piAuthPath.`
-                : `[WARN] ${label} ${refStr}: no Pi API key credentials found for provider \`${provider}\` in the auth store or resolved environment. Run \`${loginCommand}\`, or set ${apiKeyEnv}.`);
+                ? `[WARN] ${label} ${refStr}: no Pi credentials found for provider \`${providerLabel}\` in the auth store. Authenticate it with \`${loginCommand}\`, or set providers.piAuthPath.`
+                : `[WARN] ${label} ${refStr}: no Pi API key credentials found for provider \`${providerLabel}\` in the auth store or resolved environment. Run \`${loginCommand}\`, or set ${apiKeyEnv}.`);
             continue;
         }
         const isOAuth = entry.type === "oauth";
         const isApiKey = entry.type === "api_key";
         if (isApiKey && !hasNonEmptyCredentialValue(entry.key)) {
             status = "waiting";
-            details.push(`[WARN] ${label} ${refStr}: stored API-key credential for \`${provider}\` has no usable key. Run \`${loginCommand}\`; no secret value was displayed.`);
+            details.push(`[WARN] ${label} ${refStr}: stored API-key credential for \`${providerLabel}\` has no usable key. Run \`${loginCommand}\`; no secret value was displayed.`);
             continue;
         }
         if (isOAuth && !hasNonEmptyCredentialValue(entry.access) && !hasNonEmptyCredentialValue(entry.refresh)) {
             status = "waiting";
-            details.push(`[WARN] ${label} ${refStr}: stored OAuth credential for \`${provider}\` has no usable access or refresh token. Re-authenticate with \`${loginCommand}\`; no secret value was displayed.`);
+            details.push(`[WARN] ${label} ${refStr}: stored OAuth credential for \`${providerLabel}\` has no usable access or refresh token. Re-authenticate with \`${loginCommand}\`; no secret value was displayed.`);
             continue;
         }
         if (!isOAuth && !isApiKey) {
             status = "waiting";
-            details.push(`[WARN] ${label} ${refStr}: stored credential for \`${provider}\` has an unsupported or missing type. Re-authenticate with \`${loginCommand}\`; no secret value was displayed.`);
+            details.push(`[WARN] ${label} ${refStr}: stored credential for \`${providerLabel}\` has an unsupported or missing type. Re-authenticate with \`${loginCommand}\`; no secret value was displayed.`);
             continue;
         }
         const expired = typeof entry.expires === "number" && entry.expires < now;
         const whenNote = typeof entry.expires === "number" ? ` ${new Date(entry.expires).toISOString()}` : "";
         if (isOAuth && expired) {
             status = "waiting";
-            details.push(`[WARN] ${label} ${refStr}: OAuth token for \`${provider}\` expired${whenNote} — the runtime may auto-refresh, but this credential is not ready until a request succeeds; if runs fail with "No API key for provider: ${provider}" re-authenticate with \`${loginCommand}\`.`);
+            details.push(`[WARN] ${label} ${refStr}: OAuth token for \`${providerLabel}\` expired${whenNote} — the runtime may auto-refresh, but this credential is not ready until a request succeeds; if runs fail with "No API key for provider: ${providerLabel}" re-authenticate with \`${loginCommand}\`.`);
             continue;
         }
         details.push(isOAuth
-            ? `${label} ${refStr}: OAuth credentials for \`${provider}\` present (token valid${whenNote}); credential detected, live model verification is still pending.`
-            : `${label} ${refStr}: API key credentials for \`${provider}\` present; credential detected, live model verification is still pending.`);
+            ? `${label} ${refStr}: OAuth credentials for \`${providerLabel}\` present (token valid${whenNote}); credential detected, live model verification is still pending.`
+            : `${label} ${refStr}: API key credentials for \`${providerLabel}\` present; credential detected, live model verification is still pending.`);
     }
     return status;
 }
@@ -1110,6 +674,8 @@ function hasNonEmptyCredentialValue(value) {
 async function contextSection(config, cwd) {
     const details = [];
     let status = "ok";
+    const activeSelectedSkills = activeProjectSkillSelections(config.context.selectedSkills);
+    const retiredSelectedSkills = config.context.selectedSkills.filter(isRetiredProjectSkillName);
     if (await pathExists(config.context.identityPath)) {
         details.push(`Identity: ${config.context.identityPath}`);
     }
@@ -1121,10 +687,19 @@ async function contextSection(config, cwd) {
         status = "error";
         details.push(`Soul file is missing: ${config.context.soulPath}`);
     }
-    if (config.context.skillsRoot !== undefined) {
+    for (const skill of retiredSelectedSkills) {
+        if (status === "ok")
+            status = "waiting";
+        details.push(`Skill \`${skill}\` is retired and ignored. Remove it from context.selectedSkills or ` +
+            "MONO_AGENT_SELECTED_SKILLS, then run `mono-agent install-skill --project --check`." +
+            (config.context.skillDisclosure === "index"
+                ? " Skill disclosure runs as `full` until the retired selector is removed."
+                : ""));
+    }
+    if (activeSelectedSkills.length > 0 && config.context.skillsRoot !== undefined) {
         if (await pathExists(config.context.skillsRoot)) {
             details.push(`Skills root: ${config.context.skillsRoot}`);
-            for (const skill of config.context.selectedSkills) {
+            for (const skill of activeSelectedSkills) {
                 const skillPath = join(config.context.skillsRoot, skill, "SKILL.md");
                 if (await pathExists(skillPath)) {
                     details.push(`Skill \`${skill}\`: ${skillPath}`);
@@ -1140,7 +715,7 @@ async function contextSection(config, cwd) {
             details.push(`Skills root is missing: ${config.context.skillsRoot}`);
         }
     }
-    else if (config.context.selectedSkills.length > 0) {
+    else if (activeSelectedSkills.length > 0) {
         status = "error";
         details.push("Skills are selected but context.skillsRoot is not set.");
     }
@@ -1175,7 +750,15 @@ function memoryConsolidationCronIssue(expression) {
 }
 async function memorySection(config, cwd, env, liveness, allowFilesystemWrites, preferAppPluginInstall) {
     if (config.memory === undefined) {
-        return { id: "memory", label: "Memory", status: "disabled", details: ["No memory configured."] };
+        return {
+            id: "memory",
+            label: "Memory",
+            status: "disabled",
+            details: [
+                "No memory configured.",
+                "Chronological journal: disabled because no local memory backend is configured.",
+            ],
+        };
     }
     // External backend (e.g. supermemory): mode/embeddings/llm are bujo-only and
     // ignored, so validate the plugin-owned shape before any soft liveness probe.
@@ -1221,6 +804,9 @@ async function memorySection(config, cwd, env, liveness, allowFilesystemWrites,
             sm.apiKey === undefined
                 ? "Auth: no API key configured (keyless — works only if the instance allows it)."
                 : "Auth: API key configured.",
+            config.memory.recallTool?.enabled === false
+                ? "Explicit memory read tools are disabled by memory.recallTool.enabled. Chronological journal browsing is also unsupported by Supermemory."
+                : "Chronological journal: unsupported by Supermemory; MemoryJournal is not offered.",
         ];
         if (!liveness) {
             details.push("Supermemory liveness probe skipped; ingestion is async.");
@@ -1238,6 +824,9 @@ async function memorySection(config, cwd, env, liveness, allowFilesystemWrites,
     }
     const details = [
         `Mode: ${config.memory.mode}, path: ${config.memory.path}, writeMode: ${config.memory.writeMode}.`,
+        config.memory.recallTool?.enabled === false
+            ? `Explicit memory read tools are disabled by memory.recallTool.enabled; the local ${config.memory.mode} tier supports chronology but MemoryJournal is not offered.`
+            : `Chronological journal: supported by the local ${config.memory.mode} tier when tool policy allows MemoryJournal.`,
     ];
     let status = "ok";
     if (config.memory.llm !== undefined) {
@@ -1248,12 +837,12 @@ async function memorySection(config, cwd, env, liveness, allowFilesystemWrites,
                 const resolutionIssue = piModelResolutionIssue(config, model);
                 if (resolutionIssue !== undefined) {
                     status = "error";
-                    details.push(`Agent-host memory LLM ${referenceOf(model)}: ${resolutionIssue}.`);
+                    details.push(`Agent-host memory LLM ${displayReferenceOf(model)}: ${resolutionIssue}.`);
                 }
             }
             catch (error) {
                 status = "error";
-                details.push(`Agent-host memory LLM ${config.memory.llm.model}: ${error instanceof Error ? error.message : String(error)}.`);
+                details.push(`Agent-host memory LLM ${displayText(config.memory.llm.model)}: ${displayReason(error)}.`);
             }
         }
     }
@@ -1573,12 +1162,12 @@ async function localEmbeddingLivenessWarnings(embeddings, apiKey) {
         }
         if (provider === "ollama" && /HTTP 404/u.test(reason)) {
             return [
-                `[WARN] Ollama embedding model ${embeddings.model} could not be proved at ${endpoint} (${reason}); ` +
-                    `run \`ollama pull ${embeddings.model}\` and verify its embedding capability.`,
+                `[WARN] Ollama embedding model ${displayText(embeddings.model)} could not be proved at ${endpoint} (${reason}); ` +
+                    `run \`ollama pull ${displayText(embeddings.model)}\` and verify its embedding capability.`,
             ];
         }
         return [
-            `[WARN] ${label} embedding readiness failed for ${embeddings.model} at ${endpoint} (${reason}). ` +
+            `[WARN] ${label} embedding readiness failed for ${displayText(embeddings.model)} at ${endpoint} (${reason}). ` +
                 "Verify the selected model, authentication, and configured dimension.",
         ];
     }
@@ -1620,8 +1209,8 @@ function memoryLlmLabel(llm) {
         return "none";
     }
     return llm.provider === "ollama"
-        ? `ollama:${llm.model}`
-        : `agent-host:${llm.model}${llm.executionMode === undefined ? "" : ` (${llm.executionMode})`}`;
+        ? `ollama:${displayText(llm.model)}`
+        : `agent-host:${displayText(llm.model)}`;
 }
 async function toolsSection(config, input) {
     const details = [];
@@ -1650,6 +1239,53 @@ async function toolsSection(config, input) {
         details.push(`Allowed tools: ${allowedTools.join(", ")}.`);
         let mcpNoteAdded = false;
         for (const name of allowedTools) {
+            if (isMemoryJournalToolPolicyName(name)) {
+                // This app-owned MCP surface must be checked before the generic MCP
+                // branch, using the same deny-wins spellings as runtime composition.
+                if (!isMemoryJournalToolAllowed(config.tools)) {
+                    status = "waiting";
+                    details.push(`${name} is listed but tool policy still resolves to denied (deny wins, including the mcp__mono-agent-memory-journal__* spelling) - the tool will not be offered.`);
+                }
+                else if (config.memory === undefined) {
+                    status = "waiting";
+                    details.push(`${name} is in allowedTools but no memory block is configured - chronological journal browsing will not work.`);
+                }
+                else if (config.memory.recallTool?.enabled === false) {
+                    status = "waiting";
+                    details.push(`${name} is in allowedTools but memory.recallTool.enabled is off - explicit memory read tools will not work.`);
+                }
+                else if ((config.memory.backend ?? "bujo") === "supermemory") {
+                    status = "waiting";
+                    details.push(`${name} is in allowedTools but the Supermemory backend exposes no chronological journal surface - the tool will not be offered.`);
+                }
+                continue;
+            }
+            if (isRememberToolPolicyName(name)) {
+                // Reconcile with the runtime's own resolution, which honours the
+                // `mcp__mono-agent-memory-write__*` spellings and deny-wins. This check
+                // must precede the generic MCP branch below.
+                if (!isRememberToolAllowed(config.tools)) {
+                    status = "waiting";
+                    details.push(`${name} is listed but tool policy still resolves to denied (deny wins, including the mcp__mono-agent-memory-write__* spellings) - the tool will not be offered.`);
+                    continue;
+                }
+                // Unlike MemoryRecall, Remember IS allowlist-gated, so listing it is
+                // correct and required under a restrictive policy. It still needs a
+                // configured memory block with the write surface left enabled.
+                if (config.memory === undefined) {
+                    status = "waiting";
+                    details.push(`${name} is in allowedTools but no memory block is configured - durable writes will not work. Configure memory (or remove this entry).`);
+                }
+                else if (config.memory.rememberTool?.enabled === false) {
+                    status = "waiting";
+                    details.push(`${name} is in allowedTools but memory.rememberTool.enabled is off - durable writes will not work. Enable memory.rememberTool (or remove this entry).`);
+                }
+                else if (config.memory.backend === "supermemory") {
+                    status = "waiting";
+                    details.push(`${name} is in allowedTools but the supermemory backend exposes no durable write surface - the tool will not be offered.`);
+                }
+                continue;
+            }
             if (isMcpToolName(name)) {
                 // MCP tool names are owned by their servers; we cannot verify them offline.
                 if (!mcpNoteAdded) {
@@ -1685,45 +1321,6 @@ async function toolsSection(config, input) {
         // Under allow-all the disallow list is already folded into the "except" clause above.
         details.push(`Disallowed tools: ${config.tools.disallowedTools.join(", ")}.`);
     }
-    const runtimeModels = configuredRuntimeModels(config.runtime);
-    const directCodexModels = runtimeModels
-        .filter((model) => model.sdk === "codex")
-        .map(referenceOf);
-    const directOpenCodeModels = runtimeModels
-        .filter((model) => model.sdk === "opencode")
-        .map(referenceOf);
-    const claudeCliModels = [
-        { model: config.runtime.model, executionMode: config.runtime.executionMode },
-        ...configuredRuntimeFallbackModels(config.runtime).map((model) => ({
-            model,
-            executionMode: defaultExecutionModeForModel(model),
-        })),
-    ]
-        .filter(({ model, executionMode }) => model.sdk === "claude" && executionMode === "cli")
-        .map(({ model }) => referenceOf(model));
-    const allowAllOnly = hasAllowAllOnlyToolPolicy(config.tools);
-    const dedicatedNoToolsProbe = input.codexNoToolsProbe === true
-        && allowedTools.length === 0
-        && config.tools.disallowedTools.length === 0;
-    if (directCodexModels.length > 0
-        && !dedicatedNoToolsProbe
-        && !allowAllOnly) {
-        status = "error";
-        details.push(`Direct Codex model${directCodexModels.length === 1 ? "" : "s"} ${directCodexModels.join(", ")} cannot enforce ` +
-            "tools.allowedTools/tools.disallowedTools. Use allow-all-only (allowedTools omitted or containing \"*\", with no disallowedTools), " +
-            "or select a runtime that supports restrictive tool policies.");
-    }
-    if (directOpenCodeModels.length > 0 && !allowAllOnly) {
-        status = "error";
-        details.push(`Direct OpenCode model${directOpenCodeModels.length === 1 ? "" : "s"} ${directOpenCodeModels.join(", ")} cannot enforce ` +
-            "tools.allowedTools/tools.disallowedTools. Use allow-all-only (allowedTools omitted or containing \"*\", with no disallowedTools), " +
-            "or use a Pi runtime (including pi:opencode-go:*).");
-    }
-    if (claudeCliModels.length > 0 && allowedTools.length === 0) {
-        status = "error";
-        details.push(`Claude CLI model${claudeCliModels.length === 1 ? "" : "s"} ${claudeCliModels.join(", ")} cannot enforce an empty ` +
-            "tools.allowedTools list because omitting --tools enables Claude Code's default tool set. Use Claude SDK for a chat-only agent, or configure a non-empty enforceable tool list.");
-    }
     let configuredMcpServerNames = [];
     let configuredMcpServers = {};
     if (config.tools.mcpConfigPath !== undefined) {
@@ -1781,7 +1378,6 @@ async function toolsSection(config, input) {
     const adapterSendTools = await resolveAdapterSendToolsSettings(input, {
         allowedTools: config.tools.allowedTools,
         disallowedTools: config.tools.disallowedTools,
-        suppressInteractionTools: directOpenCodeModels.length > 0,
     });
     if (adapterSendTools === undefined) {
         details.push("No adapter-derived send tools enabled.");
@@ -1789,19 +1385,13 @@ async function toolsSection(config, input) {
     else {
         details.push(`Adapter send tools: ${adapterSendToolNames(adapterSendTools).join(", ")}.`);
     }
-    const blockedAdapterEndpoints = await adapterSendToolNetworkPolicyWarnings(config, input, adapterSendTools, directOpenCodeModels.length > 0);
+    const blockedAdapterEndpoints = await adapterSendToolNetworkPolicyWarnings(config, input, adapterSendTools);
     if (blockedAdapterEndpoints.length > 0) {
         if (status !== "error") {
             status = "waiting";
         }
         details.push(...blockedAdapterEndpoints);
     }
-    const effectiveMcpSources = effectiveMcpRuntimeSources(config, configuredMcpServerNames, adapterSendTools === undefined ? [] : adapterSendToolNames(adapterSendTools));
-    if (directOpenCodeModels.length > 0 && effectiveMcpSources.length > 0) {
-        status = "error";
-        details.push(`Direct OpenCode model${directOpenCodeModels.length === 1 ? "" : "s"} ${directOpenCodeModels.join(", ")} cannot safely consume ` +
-            `MCP runtime options from ${effectiveMcpSources.join("; ")}. Disable those MCP sources or use a Pi runtime (including pi:opencode-go:*).`);
-    }
     // Subagents: the Agent tool is registered only when BOTH the capability is
     // enabled and the tool is allowed, so surface either half being missing.
     const subagents = config.subagents;
@@ -1824,14 +1414,6 @@ async function toolsSection(config, input) {
         }
         else {
             details.push("Subagents inherit the parent's skill index and the ReadSkill tool.");
-            // The parent's own chain is capability-checked elsewhere; a profile that
-            // pins its own model is not, so a direct-OpenCode profile would silently
-            // run without the index it was told it had.
-            for (const definition of subagents.definitions ?? []) {
-                if (definition.model?.sdk === "opencode") {
-                    details.push(`Subagent "${definition.name}" is pinned to a direct OpenCode model, which cannot use ReadSkill; it runs without the skill index.`);
-                }
-            }
         }
         for (const tool of subagents.inline?.allowedTools ?? []) {
             if (!isKnownToolName(tool) && !isMcpToolName(tool)) {
@@ -1881,31 +1463,61 @@ async function toolsSection(config, input) {
     return { id: "tools", label: "Tools & MCP", status, details };
 }
 const MIN_AGENT_BROWSER_VERSION = [0, 33, 1];
+function formatSearchBackendChain(backends) {
+    if (backends.length <= 1)
+        return backends[0] ?? "none";
+    return `${backends.slice(0, -1).join(", ")}, then ${backends.at(-1)}`;
+}
 async function webToolsSection(config, input, liveness) {
     const web = config.tools.web;
     const search = web?.search ?? {
         backend: "auto",
+        maxRequestsPerRun: 4,
         codex: { model: "gpt-5.6-luna" },
     };
     const fetchConfig = web?.fetch ?? { render: "never", browserCommand: "agent-browser" };
-    const details = [`WebSearch backend: ${search.backend}.`];
+    const details = [
+        `WebSearch backend: ${search.backend}.`,
+        `WebSearch request budget: ${search.maxRequestsPerRun ?? 4} per logical run.`,
+        `Web coordination: ${web?.coordination ?? "process"}.`,
+    ];
     let status = "ok";
-    if (search.endpoint === undefined) {
+    if (web?.coordination === "host") {
+        try {
+            const shared = await inspectWebControl();
+            details.push(shared.exists ? "Host web control state is valid." : "Host web control state will be initialized on first request.");
+        }
+        catch {
+            status = "waiting";
+            details.push("Host web control state is unavailable; web requests will fail closed. Inspect with mono-agent web-control status.");
+        }
+    }
+    const searxngEndpoint = search.searxng?.endpoint ?? search.endpoint;
+    const autoEligibleBackends = [
+        ...(search.ollama === undefined ? [] : ["configured Ollama"]),
+        ...(searxngEndpoint === undefined ? [] : ["configured SearXNG"]),
+        "Codex",
+        "keyless",
+    ];
+    const autoAfterOllama = formatSearchBackendChain(autoEligibleBackends.slice(1));
+    if (searxngEndpoint === undefined) {
         details.push(search.backend === "keyless"
             ? "SearXNG is not configured; keyless search is enabled."
             : search.backend === "codex"
                 ? "SearXNG is not configured; strict Codex subscription search is enabled."
                 : search.backend === "searxng"
                     ? "SearXNG is not configured."
-                    : "SearXNG is not configured; auto mode starts with Codex subscription search, then keyless search.");
+                    : search.ollama === undefined
+                        ? "SearXNG is not configured; auto mode starts with Codex subscription search, then keyless search."
+                        : "SearXNG is not configured; auto mode uses configured Ollama, then Codex subscription search, then keyless search.");
     }
     else {
-        details.push(`SearXNG endpoint: ${search.endpoint}.`);
+        details.push(`SearXNG endpoint: ${searxngEndpoint}.`);
         if (!liveness) {
             details.push("SearXNG liveness was not probed.");
         }
         else {
-            const probe = await probeSearxngEndpoint(search.endpoint);
+            const probe = await probeSearxngEndpoint(searxngEndpoint);
             if (probe.ok) {
                 details.push("SearXNG JSON search probe succeeded.");
             }
@@ -1913,14 +1525,42 @@ async function webToolsSection(config, input, liveness) {
                 status = "waiting";
                 details.push(`[WARN] SearXNG JSON search probe failed (${probe.reason}). ` +
                     (search.backend === "auto"
-                        ? "Start the local companion or fix tools.web.search.endpoint; auto mode can still fall back to Codex subscription search, then keyless search."
-                        : "Start the local companion or fix tools.web.search.endpoint; strict SearXNG mode has no fallback."));
+                        ? "Start the local companion or fix tools.web.search.searxng.endpoint; auto mode can still fall back to Codex subscription search, then keyless search."
+                        : "Start the local companion or fix tools.web.search.searxng.endpoint; strict SearXNG mode has no fallback."));
             }
         }
     }
+    if (search.backend === "ollama" || (search.backend === "auto" && search.ollama !== undefined)) {
+        const ollama = search.ollama;
+        if (ollama === undefined) {
+            status = "waiting";
+            details.push("[WARN] Ollama Web Search is selected but its resolved configuration is missing.");
+        }
+        else if (!liveness) {
+            details.push(`Ollama Web Search origin: ${ollama.baseUrl}. ${search.backend === "ollama" ? "Strict Ollama mode has no fallback." : `Auto mode advances to ${autoAfterOllama} when Ollama is unavailable.`}`);
+            details.push("Ollama Web Search liveness was not probed.");
+        }
+        else {
+            details.push(`Ollama Web Search origin: ${ollama.baseUrl}. ${search.backend === "ollama" ? "Strict Ollama mode has no fallback." : `Auto mode advances to ${autoAfterOllama} when Ollama is unavailable.`}`);
+            const probe = await probeOllamaWebSearch(ollama);
+            if (probe.ok)
+                details.push("Ollama Web Search JSON probe succeeded.");
+            else {
+                status = "waiting";
+                details.push(`[WARN] Ollama Web Search probe failed (${probe.reason}). ${search.backend === "ollama" ? "Strict Ollama mode has no fallback." : `Auto mode can still advance to ${autoAfterOllama}.`}`);
+            }
+        }
+    }
+    else if (search.ollama !== undefined) {
+        details.push(`Ollama Web Search is configured but inactive because backend ${search.backend} is strict.`);
+    }
     if (search.backend === "auto") {
         const codexModel = search.codex?.model ?? "gpt-5.6-luna";
-        details.push(`Codex subscription fallback model: ${codexModel}; readiness is checked lazily when auto mode reaches that fallback.`);
+        const beforeCodex = autoEligibleBackends.slice(0, autoEligibleBackends.indexOf("Codex"));
+        const codexPosition = beforeCodex.length === 0
+            ? "as the first eligible backend"
+            : `after ${formatSearchBackendChain(beforeCodex)}`;
+        details.push(`Codex subscription fallback model: ${codexModel}; readiness is checked lazily when auto mode reaches it ${codexPosition}.`);
     }
     else if (search.backend === "codex") {
         const codexModel = search.codex?.model ?? "gpt-5.6-luna";
@@ -1960,6 +1600,95 @@ async function webToolsSection(config, input, liveness) {
     }
     return { id: "web-tools", label: "Web search & fetch", status, details };
 }
+async function probeOllamaWebSearch(config) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => { ctrl.abort(); }, LIVENESS_PROBE_TIMEOUT_MS);
+    const official = config.baseUrl === "https://ollama.com";
+    const paths = official ? ["/api/web_search"] : ["/api/experimental/web_search", "/api/web_search"];
+    try {
+        for (let index = 0; index < paths.length; index += 1) {
+            const response = await fetch(`${config.baseUrl}${paths[index]}`, {
+                method: "POST",
+                headers: {
+                    Accept: "application/json",
+                    "Content-Type": "application/json",
+                    ...(official ? { Authorization: `Bearer ${config.apiKey}` } : {}),
+                },
+                body: JSON.stringify({ query: "mono-agent doctor", max_results: 1 }),
+                redirect: "error",
+                signal: ctrl.signal,
+            });
+            if (!official && index === 0 && [404, 405].includes(response.status)) {
+                await response.body?.cancel();
+                continue;
+            }
+            if ([401, 403].includes(response.status)) {
+                await response.body?.cancel();
+                return { ok: false, reason: official
+                        ? `hosted authentication failed; check ${config.apiKeyEnv}`
+                        : "the local proxy requires sign-in; run ollama signin or repair its proxy authentication" };
+            }
+            if (!response.ok) {
+                await response.body?.cancel();
+                return { ok: false, reason: `HTTP ${response.status}` };
+            }
+            const declared = Number(response.headers.get("content-length"));
+            if (Number.isFinite(declared) && declared > OLLAMA_WEB_SEARCH_PROBE_MAX_BYTES) {
+                await response.body?.cancel();
+                return { ok: false, reason: `response exceeded ${OLLAMA_WEB_SEARCH_PROBE_MAX_BYTES} bytes` };
+            }
+            const bytes = await readBoundedProbeResponse(response, OLLAMA_WEB_SEARCH_PROBE_MAX_BYTES);
+            let body;
+            try {
+                body = JSON.parse(new TextDecoder().decode(bytes));
+            }
+            catch {
+                return { ok: false, reason: "response was not valid JSON" };
+            }
+            if (!body || typeof body !== "object" || !Array.isArray(body.results)) {
+                return { ok: false, reason: "response did not contain a results array" };
+            }
+            return { ok: true, reason: "" };
+        }
+        return { ok: false, reason: "this Ollama version supports neither local Web Search endpoint" };
+    }
+    catch (error) {
+        return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function readBoundedProbeResponse(response, maxBytes) {
+    const reader = response.body?.getReader();
+    if (reader === undefined)
+        throw new Error("response body could not be read safely");
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const next = await reader.read();
+            if (next.done)
+                break;
+            total += next.value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                throw new Error(`response exceeded ${maxBytes} bytes`);
+            }
+            chunks.push(next.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const joined = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        joined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return joined;
+}
 async function probeSearxngEndpoint(endpoint) {
     const ctrl = new AbortController();
     const timer = setTimeout(() => { ctrl.abort(); }, LIVENESS_PROBE_TIMEOUT_MS);
@@ -2001,14 +1730,14 @@ async function probeSearxngEndpoint(endpoint) {
     }
 }
 async function readAgentBrowserVersion(command, input) {
-    const run = input.sdkAuthStatusExecFile ?? defaultSdkAuthStatusExecFile;
+    const run = input.statusExecFile ?? defaultDoctorStatusExecFile;
     try {
         const { stdout } = await run(command, ["--version"], {
             cwd: input.cwd,
             env: Object.fromEntries(["PATH", "LANG", "LC_ALL", "LC_CTYPE", "SHELL", "TMPDIR", "TMP", "TEMP"]
                 .flatMap((key) => typeof input.env[key] === "string" ? [[key, input.env[key]]] : [])),
-            timeout: SDK_AUTH_STATUS_TIMEOUT_MS,
-            maxBuffer: SDK_AUTH_STATUS_MAX_BUFFER_BYTES,
+            timeout: DOCTOR_STATUS_TIMEOUT_MS,
+            maxBuffer: DOCTOR_STATUS_MAX_BUFFER_BYTES,
             encoding: "utf8",
         });
         const match = /(?:^|\s)v?(\d+)\.(\d+)\.(\d+)(?:\s|$)/u.exec(stdout.trim());
@@ -2166,7 +1895,7 @@ async function processJobsSection(config, input) {
         `Owner-only local state: ${settings.stateDir}.`,
         `Concurrency: ${String(settings.maxConcurrent)} global, ${String(settings.maxActivePerConversation)} per conversation, ${String(settings.maxQueued)} queued.`,
         `Caps: runtime=${String(settings.maxRuntimeMs)}ms, queue-age=${String(settings.maxQueueAgeMs)}ms, output=${String(settings.maxOutputBytes)} bytes, chain-depth=${String(settings.maxChainDepth)}.`,
-        `Runtime availability: Pi-native Exec/Bash only; configured primary is ${config.runtime.model.sdk}.`,
+        `Runtime availability: Pi-native Exec/Bash only; configured primary provider is ${displayText(config.runtime.model.provider)}.`,
     ];
     const inspection = await inspectProcessJobState(input.cwd, settings.stateDir);
     return {
@@ -3205,7 +2934,7 @@ function formatContinuationHost(host) {
  * needs the remote adapter API (or the app-owned interaction bridge) admitted
  * by sandbox.network.
  */
-async function adapterSendToolNetworkPolicyWarnings(config, input, settings, suppressInteractionTools) {
+async function adapterSendToolNetworkPolicyWarnings(config, input, settings) {
     if (config.sandbox === undefined || config.sandbox.mode !== "native") {
         return [];
     }
@@ -3225,7 +2954,7 @@ async function adapterSendToolNetworkPolicyWarnings(config, input, settings, sup
             url: settings.telegram.apiRoot ?? "https://api.telegram.org",
         });
     }
-    const askUserAllowed = !suppressInteractionTools && isAdapterSendToolAllowed("AskUser", {
+    const askUserAllowed = isAdapterSendToolAllowed("AskUser", {
         allowedTools: config.tools.allowedTools,
         disallowedTools: config.tools.disallowedTools,
     });
@@ -3273,100 +3002,7 @@ function endpointHost(url) {
         return url;
     }
 }
-function effectiveMcpRuntimeSources(config, configuredMcpServerNames, adapterToolNames) {
-    const sources = [];
-    if (configuredMcpServerNames.length > 0) {
-        sources.push(`tools.mcpConfigPath (${configuredMcpServerNames.join(", ")})`);
-    }
-    if (config.memory?.recallTool?.enabled === true) {
-        sources.push("memory.recallTool");
-    }
-    if (config.memory?.backend === "supermemory"
-        && config.memory.supermemory?.exposeMcpServer === true
-        && config.memory.supermemory.apiKey !== undefined) {
-        sources.push("memory.supermemory.exposeMcpServer");
-    }
-    if (adapterToolNames.length > 0) {
-        sources.push(`adapter send tools (${adapterToolNames.join(", ")})`);
-    }
-    return sources;
-}
 async function sandboxSection(config, engine) {
-    const runtimeModels = configuredRuntimeModels(config.runtime);
-    const directCodexRefs = runtimeModels
-        .filter((model) => model.sdk === "codex")
-        .map((model) => model.reference ?? `codex:${model.model}`);
-    const claudeRefs = runtimeModels
-        .filter((model) => model.sdk === "claude")
-        .map((model) => model.reference ?? `claude:${model.model}`);
-    const directOpenCodeRefs = runtimeModels
-        .filter((model) => model.sdk === "opencode")
-        .map((model) => model.reference ?? `opencode:${model.provider ?? "unknown"}:${model.model}`);
-    const routeSafety = config.runtime.routeSafety ?? "uniform";
-    if (routeSafety === "per-route-native") {
-        const monoSandboxActive = config.sandbox !== undefined && config.sandbox.mode !== "off";
-        const piRoutes = runtimeModels.filter((model) => model.sdk === "pi");
-        const details = runtimeModels.map((model, index) => routeNativeSafetyDetail(model, index, config));
-        let status = !monoSandboxActive && piRoutes.length > 0 ? "disabled" : "ok";
-        if (monoSandboxActive && piRoutes.length > 0) {
-            const state = await resolveSandboxEffectiveState({
-                policy: config.sandbox,
-                ...(engine === undefined ? {} : { engine }),
-            });
-            const warning = sandboxEffectiveStateWarning(state);
-            details.push(`Pi route SRT policy: mode ${config.sandbox.mode}, network ${config.sandbox.network.mode}, fallback ${config.sandbox.fallback}.`, describeSandboxEffectiveState(state), ...(warning === undefined ? [] : [warning]));
-            if (warning !== undefined || state.effective === "blocked")
-                status = "waiting";
-        }
-        else if (piRoutes.length > 0) {
-            details.push("Pi route SRT policy: disabled; Bash and stdio MCP subprocesses run unsandboxed.");
-        }
-        else if (monoSandboxActive) {
-            details.push("The configured mono-agent SRT policy has no Pi route to enforce it; provider-owned route contracts below apply instead.");
-            status = "waiting";
-        }
-        if (monoSandboxActive && runtimeModels.some((model) => model.sdk !== "pi")) {
-            details.push("[WARN] Per-route-native explicitly does not project mono-agent readableRoots, writableRoots, denyWrite, or network rules onto non-Pi routes; review each route contract before start.");
-            status = "waiting";
-        }
-        if (runtimeModels.some((model) => model.sdk === "codex") && config.runtime.permissionMode === "bypassPermissions") {
-            status = "waiting";
-        }
-        return { id: "sandbox", label: "Sandbox", status, details };
-    }
-    const incompatibleDetails = [];
-    if (config.sandbox !== undefined && config.sandbox.mode !== "off" && directCodexRefs.length > 0) {
-        const codexPosture = directCodexSandboxPosture(config.runtime.permissionMode);
-        incompatibleDetails.push(`Native mono-agent sandbox policy cannot govern direct Codex runtime${directCodexRefs.length === 1 ? "" : "s"}: ${directCodexRefs.join(", ")}.`, `${codexPosture.detail} Remove the mono-agent sandbox block or use Pi when exact srt roots, denyWrite, or network policy are required.`);
-    }
-    if (config.sandbox !== undefined && config.sandbox.mode !== "off" && claudeRefs.length > 0) {
-        incompatibleDetails.push(`Native mono-agent sandbox policy cannot govern Claude runtime${claudeRefs.length === 1 ? "" : "s"}: ${claudeRefs.join(", ")}.`, "Claude's provider-owned tool loop does not consume mono-agent sandboxPolicy. Set sandbox.mode to off, remove the sandbox block, or use a Pi runtime when mono-agent srt enforcement is required.");
-    }
-    if (config.sandbox !== undefined && config.sandbox.mode !== "off" && directOpenCodeRefs.length > 0) {
-        incompatibleDetails.push(`Native mono-agent sandbox policy cannot govern direct OpenCode runtime${directOpenCodeRefs.length === 1 ? "" : "s"}: ${directOpenCodeRefs.join(", ")}.`, "Direct OpenCode's provider-owned tool loop does not consume mono-agent sandboxPolicy. Set sandbox.mode to off, remove the sandbox block, or use a pi:opencode-go:* runtime when mono-agent srt enforcement is required.");
-    }
-    if (incompatibleDetails.length > 0) {
-        return {
-            id: "sandbox",
-            label: "Sandbox",
-            status: "error",
-            details: incompatibleDetails,
-        };
-    }
-    if (directCodexRefs.length > 0 && (config.sandbox === undefined || config.sandbox.mode === "off")) {
-        const posture = directCodexSandboxPosture(config.runtime.permissionMode);
-        return {
-            id: "sandbox",
-            label: "Sandbox",
-            status: posture.status,
-            details: [
-                posture.detail,
-                config.sandbox === undefined
-                    ? "No mono-agent native srt policy is configured."
-                    : "The mono-agent native srt policy is explicitly off; the Codex-native posture still applies.",
-            ],
-        };
-    }
     if (config.sandbox === undefined) {
         return { id: "sandbox", label: "Sandbox", status: "disabled", details: ["No sandbox policy configured."] };
     }
@@ -3394,44 +3030,6 @@ async function sandboxSection(config, engine) {
         details,
     };
 }
-function routeNativeSafetyDetail(model, index, config) {
-    const label = index === 0 ? "Primary" : `Fallback ${index}`;
-    const ref = referenceOf(model);
-    if (model.sdk === "pi") {
-        if (config.sandbox === undefined || config.sandbox.mode === "off") {
-            return `${label} ${ref}: Pi-owned tools use mono-agent tool policy; SRT is disabled, so Bash and stdio MCP subprocesses run unsandboxed.`;
-        }
-        if (config.sandbox.fallback === "unsafe-host-process") {
-            return `${label} ${ref}: Pi-owned tools use the configured mono-agent SRT policy; its explicit unsafe-host-process fallback can run subprocesses unsandboxed when SRT is unavailable.`;
-        }
-        return `${label} ${ref}: Pi-owned tools use the configured mono-agent SRT policy and fail closed when it is unavailable.`;
-    }
-    if (model.sdk === "claude") {
-        return `${label} ${ref}: Claude provider-owned permissions apply; mono-agent SRT filesystem/network rules are not projected.`;
-    }
-    if (model.sdk === "codex") {
-        return `${label} ${ref}: ${directCodexSandboxPosture(config.runtime.permissionMode).detail}`;
-    }
-    return `${label} ${ref}: OpenCode provider-owned execution with an effective allow-all tool policy applies; mono-agent SRT rules are not projected.`;
-}
-function directCodexSandboxPosture(permissionMode) {
-    if (permissionMode === "bypassPermissions") {
-        return {
-            status: "waiting",
-            detail: "[WARN] Direct Codex bypassPermissions uses native danger-full-access with no filesystem or network sandbox; unattended approval prompts are still disabled.",
-        };
-    }
-    if (permissionMode === "plan") {
-        return {
-            status: "ok",
-            detail: "Direct Codex plan mode uses its native read-only sandbox with network disabled; unattended escalation requests are denied.",
-        };
-    }
-    return {
-        status: "ok",
-        detail: "Direct Codex default/acceptEdits mode uses its native workspace-write sandbox with network disabled; unattended escalation requests are denied.",
-    };
-}
 async function channelSection(driver, input) {
     const id = `channel:${driver.id}`;
     try {
@@ -3464,6 +3062,44 @@ async function channelSection(driver, input) {
 function referenceOf(model) {
     return modelReferenceKey(model);
 }
+/**
+ * Bounded, single-line rendering of operator-supplied text for a diagnostic.
+ *
+ * `referenceOf` is the canonical KEY -- it is compared against
+ * `verifiedCredentialModelRefs`, which carries whole references -- so it must
+ * stay unbounded. What gets PRINTED must not be. The parser deliberately has no
+ * length ceiling any more (a reference cannot be truncated into validity, so a
+ * ceiling there could only refuse a model that runs), which means acceptance
+ * stopped being a length guarantee: a 500,000-byte reference parses today and
+ * every one of these lines is echoed by `mono-agent validate`, the daemon log
+ * and launchd's captured stdout. Escaping comes with the clamp, so a reference
+ * carrying a newline also cannot forge a detail line that reads as doctor's own.
+ */
+function displayText(value) {
+    return sanitizeModelReferenceText(value, MODEL_REFERENCE_ECHO_MAX_BYTES);
+}
+/** Bounded display form of a model reference. Never use it as a map or set key. */
+function displayReferenceOf(model) {
+    return displayText(referenceOf(model));
+}
+/**
+ * Bounded display form of a thrown reason. A reason gets the larger budget because it is one
+ * fixed repair sentence plus at most one echo of the value.
+ *
+ * Unwrap one layer first, as `modelReferenceReason` in @mono-agent/config and `reasonOf` in
+ * trigger-overrides already do: the adapter's `message` wraps a 32-byte generic prefix around
+ * a reason ALREADY at the full reason budget, so clamping the wrapped form spends the budget
+ * on the prefix and pays for it out of the tail -- which is where the kernel parser puts the
+ * concrete repair whenever it quotes the operator's value first.
+ */
+function displayReason(error) {
+    const reason = error instanceof RuntimeAdapterError && typeof error.details.reason === "string"
+        ? error.details.reason
+        : error instanceof Error
+            ? error.message
+            : String(error);
+    return sanitizeModelReferenceText(reason, MODEL_REFERENCE_REASON_MAX_BYTES);
+}
 async function pathExists(path) {
     try {
         await stat(path);