@mono-agent/agent-app 0.6.2 → 0.9.0

package/dist/doctor.js

@@ -1,9 +1,15 @@
+import { execFile as execFileCallback } from "node:child_process";
 import { constants } from "node:fs";
-import { access, mkdir, readFile, stat } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { access, lstat, mkdir, readdir, readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isIP } from "node:net";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { getBuiltinModels as getPiBuiltinModels, getBuiltinProviders as getPiBuiltinProviders, } from "@earendil-works/pi-ai/providers/all";
 import { listRecordedRuns } from "@mono-agent/observability";
 import { serializeTraceSpans } from "@mono-agent/observability/otel";
-import { describeMonoRuntimeSupport, modelReferenceKey, parseMonoRuntimeModelReference } from "@mono-agent/runtime-adapter";
+import { classifyContinuationMcpServerTransport, isStdioMcpServerSpec, loadToolPolicyFromJsonFile, } from "@mono-agent/agent-harness";
+import { defaultExecutionModeForModel, describeMonoRuntimeSupport, isValidMcpServerName, modelReferenceKey, networkPolicyAllowsUrl, parseMonoRuntimeModelReference, resolveModelEffortLevels, } from "@mono-agent/runtime-adapter";
 import { buildMonoAgentConfigView, findJsonSecretConfigWarnings, findRemovedConfigWarnings, readMonoAgentConfigJson, redactMonoAgentConfig, resolveSupermemoryContainer, } from "@mono-agent/config";
 import { describeSandboxEffectiveState, resolveSandboxEffectiveState, sandboxEffectiveStateWarning, } from "@mono-agent/runtime-adapter";
 import { describeSensitiveDataExportWarning, isAppCoreConfigError, loadAppCoreConfig, phoenixAppBaseUrl, resolveAppArtifactDir, resolveAppObservabilityExporters, } from "./app-config.js";
@@ -12,8 +18,19 @@ import { canonicalToolName, isAllowAllTools, isKnownToolName, isMcpToolName, sug
 import { collectChannelConfigViews } from "./channel-config-view.js";
 import { resolveChannelDrivers } from "./channels.js";
 import { findUnknownAppConfigWarnings } from "./config-reference.js";
+import { loadContinuationSettings } from "./continuation-config.js";
+import { CONTINUATION_RECORD_STORE_SCHEMA_VERSION, CONTINUATION_STORE_SCHEMA_VERSION, } from "./continuation-store.js";
+import { CONTINUATION_STATES } from "./continuations.js";
+import { formatInteractionBridgeUrl, loadInteractionSettings } from "./interaction-bridge.js";
+import { FIRST_RUN_MEMORY_INITIALIZING_MARKER } from "./first-run-managed-memory.js";
+import { DEFAULT_MEMORY_EMBEDDING_ENDPOINTS, probeMemoryEmbeddingSelection, } from "./memory-embedding-service.js";
 import { buildRunsHealthDisplay, RUNS_HEALTH_MAX_RUNS } from "./runs-health.js";
-import { piAuthWorkingDirectory, piLoginCommandLine } from "./provider-setup.js";
+import { piAuthRecoveryCommand } from "./provider-setup.js";
+import { inspectPiAuthStore } from "./pi-auth-store-inspection.js";
+import { checkManagedProjectSkills, managedProjectSkillsExist } from "./project-skills.js";
+import { configuredRuntimeFallbackModels, configuredRuntimeModels } from "./runtime-routes.js";
+import { loadSupermemoryPlugin } from "./supermemory-plugin.js";
+const execFile = promisify(execFileCallback);
 /**
  * Loads every config section the app would use at start and reports it
  * per-section, so an engineer can see exactly what would run, wait, or fail —
@@ -36,6 +53,7 @@ export async function validateMonoAgentFolder(options) {
         sections.push({ id: "core", label: "Core config", status: "error", details: [error.message] });
     }
     if (coreConfig !== undefined) {
+        const staticTriggerCredentialRefs = await collectStaticTriggerCredentialRefs(drivers, options);
         const jsonResult = await readMonoAgentConfigJson(options.configPath);
         // Channel secrets (bot tokens, API keys) live outside the core view, so the
         // placement check spans both: core sections + every channel's config view.
@@ -55,10 +73,11 @@ export async function validateMonoAgentFolder(options) {
             sections.push({ id: "secret-placement", label: "Config warnings", status: "waiting", details: configWarnings });
         }
         sections.push(runtimeSection(coreConfig));
-        sections.push(await credentialsSection(coreConfig, options.env));
-        sections.push(await contextSection(coreConfig));
-        sections.push(await memorySection(coreConfig, liveness, allowFilesystemWrites));
+        sections.push(await credentialsSection(coreConfig, options.env, options.cwd, liveness, options.verifiedCredentialModelRefs, options.sdkAuthStatusExecFile, staticTriggerCredentialRefs));
+        sections.push(await contextSection(coreConfig, options.cwd));
+        sections.push(await memorySection(coreConfig, options.cwd, options.env, liveness, allowFilesystemWrites, options.preferAppPluginInstall === true));
         sections.push(await toolsSection(coreConfig, options));
+        sections.push(await continuationSection(coreConfig, options));
         sections.push(await sandboxSection(coreConfig, options.sandboxEngine));
     }
     sections.push(await exporterSection(options, liveness));
@@ -66,6 +85,9 @@ export async function validateMonoAgentFolder(options) {
     for (const driver of drivers) {
         sections.push(await channelSection(driver, options));
     }
+    if (coreConfig !== undefined) {
+        await applyRequestModelOverrideCompatibilityChecks(sections, coreConfig, drivers, options);
+    }
     // Cross-check the built `channel:*` statuses against the tool policy and annotate
     // the tools section (send-tool-allowed-but-channel-disabled, or channel-enabled-
     // but-no-send-tool). Only meaningful once coreConfig — and thus the tools section
@@ -78,6 +100,236 @@ export async function validateMonoAgentFolder(options) {
         ok: sections.every((section) => section.status !== "error"),
     };
 }
+/** Enabled, statically configured webhook/cron entries that can actually execute. */
+function staticTriggerConfigEntries(driverId, loaded) {
+    if (!isUnknownRecord(loaded))
+        return [];
+    if (driverId === "webhook" && loaded.enabled === false)
+        return [];
+    const entries = driverId === "webhook" ? loaded.endpoints : loaded.jobs;
+    if (!Array.isArray(entries))
+        return [];
+    return entries.flatMap((entry, index) => {
+        if (!isUnknownRecord(entry) || entry.enabled === false)
+            return [];
+        return [{
+                entryPath: `${driverId}.${driverId === "webhook" ? "endpoints" : "jobs"}[${index}]`,
+                entry,
+            }];
+    });
+}
+/**
+ * Collect static trigger model overrides for credential readiness. Dynamic
+ * webhook request-body overrides are intentionally unavailable at validate time.
+ */
+async function collectStaticTriggerCredentialRefs(drivers, input) {
+    const refs = [];
+    const seen = new Set();
+    for (const driver of drivers) {
+        if (driver.id !== "webhook" && driver.id !== "cron")
+            continue;
+        let loaded;
+        try {
+            loaded = await driver.loadConfig(input);
+        }
+        catch {
+            // The channel section owns malformed/unreadable config diagnostics.
+            continue;
+        }
+        for (const { entryPath, entry } of staticTriggerConfigEntries(driver.id, loaded)) {
+            if (typeof entry.model !== "string")
+                continue;
+            try {
+                const ref = parseMonoRuntimeModelReference(entry.model);
+                const key = `${entryPath}\u0000${modelReferenceKey(ref)}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                refs.push({ label: entryPath, ref });
+            }
+            catch {
+                // The channel section owns invalid model-reference syntax.
+            }
+        }
+    }
+    return refs;
+}
+async function applyRequestModelOverrideCompatibilityChecks(sections, config, drivers, input) {
+    const baseIsDirectCodex = config.runtime.model.sdk === "codex";
+    const routeSafety = config.runtime.routeSafety ?? "uniform";
+    const directBoundaryConflicts = [];
+    const sandboxBypasses = [];
+    const toolPolicyBypasses = [];
+    const effortBypasses = [];
+    const turnCapBypasses = [];
+    const mcpBypasses = [];
+    const skillBypasses = [];
+    const piModelResolutionFailures = [];
+    const monoSandboxActive = config.sandbox !== undefined && config.sandbox.mode !== "off";
+    const restrictiveToolPolicy = !hasExactAllowAllToolPolicy(config.tools);
+    let configuredMcpServerNames = [];
+    if (config.tools.mcpConfigPath !== undefined) {
+        try {
+            configuredMcpServerNames = Object.keys((await loadToolPolicyFromJsonFile(config.tools.mcpConfigPath)).mcpServers ?? {});
+        }
+        catch {
+            // The tools section owns missing/malformed MCP-file diagnostics.
+        }
+    }
+    let adapterToolNames = [];
+    try {
+        const settings = await resolveAdapterSendToolsSettings(input, {
+            allowedTools: config.tools.allowedTools,
+            disallowedTools: config.tools.disallowedTools,
+        });
+        if (settings !== undefined)
+            adapterToolNames = adapterSendToolNames(settings);
+    }
+    catch {
+        // Channel/tools sections own adapter config diagnostics.
+    }
+    const effectiveMcpSources = effectiveMcpRuntimeSources(config, configuredMcpServerNames, adapterToolNames);
+    for (const driver of drivers) {
+        if (driver.id !== "webhook" && driver.id !== "cron")
+            continue;
+        let loaded;
+        try {
+            loaded = await driver.loadConfig(input);
+        }
+        catch {
+            // The channel section already reports malformed/unreadable config.
+            continue;
+        }
+        for (const { entryPath, entry } of staticTriggerConfigEntries(driver.id, loaded)) {
+            const hasModelOverride = typeof entry.model === "string";
+            const hasEffortOverride = typeof entry.effort === "string";
+            if (!hasModelOverride && !hasEffortOverride)
+                continue;
+            try {
+                const model = hasModelOverride
+                    ? parseMonoRuntimeModelReference(entry.model)
+                    : config.runtime.model;
+                const location = hasModelOverride
+                    ? `${entryPath}.model=${entry.model}`
+                    : `${entryPath}.effort=${entry.effort}`;
+                if (hasModelOverride) {
+                    const resolutionIssue = piModelResolutionIssue(config, model);
+                    if (resolutionIssue !== undefined) {
+                        piModelResolutionFailures.push(`${location}: ${resolutionIssue}.`);
+                    }
+                }
+                if (routeSafety === "uniform" && hasModelOverride && (model.sdk === "codex") !== baseIsDirectCodex) {
+                    directBoundaryConflicts.push(location);
+                }
+                if (routeSafety === "uniform" && hasModelOverride && monoSandboxActive && (model.sdk === "claude" || model.sdk === "opencode" || model.sdk === "codex")) {
+                    sandboxBypasses.push(location);
+                }
+                if (hasModelOverride && restrictiveToolPolicy && model.sdk === "opencode") {
+                    toolPolicyBypasses.push(location);
+                }
+                const effectiveEffort = hasEffortOverride ? entry.effort : config.runtime.effort;
+                const legacyFallbacks = (config.runtime.fallbacks?.length ?? 0) > 0
+                    ? []
+                    : config.runtime.fallbackModels ?? [];
+                const directOpenCodeModels = [model, ...legacyFallbacks]
+                    .filter((candidate) => candidate.sdk === "opencode");
+                if (directOpenCodeModels.length > 0 && effectiveEffort !== undefined) {
+                    effortBypasses.push(`${location} (effective effort=${effectiveEffort}) (direct OpenCode route=${directOpenCodeModels.map(referenceOf).join(", ")})`);
+                }
+                if (directOpenCodeModels.length > 0 && Number(config.runtime.maxTurns) > 0) {
+                    turnCapBypasses.push(`${location} (runtime.maxTurns=${config.runtime.maxTurns}; direct OpenCode route=${directOpenCodeModels.map(referenceOf).join(", ")})`);
+                }
+                if (directOpenCodeModels.length > 0 && effectiveMcpSources.length > 0) {
+                    mcpBypasses.push(`${location} (direct OpenCode route=${directOpenCodeModels.map(referenceOf).join(", ")}; MCP sources=${effectiveMcpSources.join("; ")})`);
+                }
+                if (directOpenCodeModels.length > 0
+                    && config.context.skillDisclosure === "index"
+                    && config.context.skillsRoot !== undefined) {
+                    skillBypasses.push(location);
+                }
+            }
+            catch {
+                // Adapter configIssues owns syntax diagnostics.
+            }
+        }
+    }
+    if (directBoundaryConflicts.length === 0
+        && sandboxBypasses.length === 0
+        && toolPolicyBypasses.length === 0
+        && effortBypasses.length === 0
+        && turnCapBypasses.length === 0
+        && mcpBypasses.length === 0
+        && skillBypasses.length === 0
+        && piModelResolutionFailures.length === 0)
+        return;
+    const index = sections.findIndex((section) => section.id === "runtime");
+    if (index < 0)
+        return;
+    const runtime = sections[index];
+    sections[index] = {
+        ...runtime,
+        status: "error",
+        details: [
+            ...runtime.details,
+            ...(directBoundaryConflicts.length === 0
+                ? []
+                : [
+                    "Uniform route safety cannot cross the direct-Codex runtime boundary because tool and sandbox contracts would change mid-agent. Choose per-route-native to opt into explicit route-local contracts.",
+                    ...directBoundaryConflicts,
+                ]),
+            ...(sandboxBypasses.length === 0
+                ? []
+                : [
+                    "Claude or direct OpenCode model overrides cannot run under uniform route safety while mono-agent SRT is active; direct Codex is also provider-owned. Choose per-route-native only after reviewing the explicit route-local contracts.",
+                    ...sandboxBypasses,
+                ]),
+            ...(toolPolicyBypasses.length === 0
+                ? []
+                : [
+                    "Per-trigger direct OpenCode model overrides require exact allow-all because OpenCode's provider-owned tool loop does not consume mono-agent allowedTools/disallowedTools.",
+                    ...toolPolicyBypasses,
+                ]),
+            ...(effortBypasses.length === 0
+                ? []
+                : [
+                    "Per-trigger direct OpenCode routes cannot receive runtime effort because the OpenCode SDK does not expose effort control.",
+                    ...effortBypasses,
+                ]),
+            ...(turnCapBypasses.length === 0
+                ? []
+                : [
+                    "Per-trigger direct OpenCode routes cannot enforce runtime.maxTurns; omit it, set it to 0, or use a runtime with a hard turn cap.",
+                    ...turnCapBypasses,
+                ]),
+            ...(mcpBypasses.length === 0
+                ? []
+                : [
+                    "Per-trigger direct OpenCode routes cannot receive configured or auto-provisioned MCP runtime options.",
+                    ...mcpBypasses,
+                ]),
+            ...(skillBypasses.length === 0
+                ? []
+                : [
+                    "Per-trigger direct OpenCode routes cannot use index skill disclosure because the bridge disables external/runtime skills; use full disclosure or a Pi runtime.",
+                    ...skillBypasses,
+                ]),
+            ...(piModelResolutionFailures.length === 0
+                ? []
+                : [
+                    "Per-trigger Pi model overrides must resolve through providers.local or Pi's exact built-in catalog before execution.",
+                    ...piModelResolutionFailures,
+                ]),
+        ],
+    };
+}
+function isUnknownRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactAllowAllToolPolicy(tools) {
+    return tools.allowedTools.length === 1
+        && tools.allowedTools[0] === "*"
+        && tools.disallowedTools.length === 0;
+}
 /** Adapter send tools each channel owns; an allowed entry needs BOTH the tool AND the enabled channel. */
 const CHANNEL_OWNED_SEND_TOOLS = {
     slack: ["SlackSendMessage"],
@@ -141,55 +393,136 @@ function applyToolChannelCrossChecks(sections, allowedTools, disallowedTools) {
 function runtimeSection(config) {
     const details = [];
     let status = "ok";
-    const primary = describeMonoRuntimeSupport(config.runtime.model, config.runtime.executionMode);
-    if (primary.compatible) {
-        details.push(`Primary model ${referenceOf(config.runtime.model)} runs on ${primary.backend?.label ?? "unknown backend"} (${config.runtime.executionMode}).`);
+    const routes = configuredRuntimeRouteChecks(config);
+    const routeSafety = config.runtime.routeSafety ?? "uniform";
+    details.push(`Route safety: ${routeSafety}.`);
+    if (routes.length > 1) {
+        details.push(routeSafety === "per-route-native"
+            ? "Mixed runtime families are allowed; every attempt uses its explicit route-native safety contract."
+            : "Fallback routes use the uniform compatibility contract; validation fails closed when any route cannot represent a required capability.");
+    }
+    const directOpenCodeModels = routes.filter((route) => route.model.sdk === "opencode");
+    if (Number(config.runtime.maxTurns) > 0 && directOpenCodeModels.length > 0) {
+        status = "error";
+        details.push(`Direct OpenCode model${directOpenCodeModels.length === 1 ? "" : "s"} ${directOpenCodeModels.map((route) => referenceOf(route.model)).join(", ")} cannot enforce runtime.maxTurns=${config.runtime.maxTurns}; omit it, set it to 0, or use a runtime with a hard turn cap.`);
     }
-    else {
+    if (directOpenCodeModels.length > 0
+        && config.context.skillDisclosure === "index"
+        && config.context.skillsRoot !== undefined) {
         status = "error";
-        details.push(`Primary model ${referenceOf(config.runtime.model)}: ${primary.incompatibilityReason ?? "unsupported"}.`);
+        details.push(`Direct OpenCode model${directOpenCodeModels.length === 1 ? "" : "s"} ${directOpenCodeModels.map((route) => referenceOf(route.model)).join(", ")} cannot use context.skillDisclosure=index because runtime skills are disabled; use full disclosure or a Pi runtime.`);
     }
-    for (const fallback of config.runtime.fallbackModels ?? []) {
-        const support = describeMonoRuntimeSupport(fallback);
-        if (support.compatible) {
-            details.push(`Fallback model ${referenceOf(fallback)} runs on ${support.backend?.label ?? "unknown backend"}.`);
+    for (const route of routes) {
+        try {
+            const support = describeMonoRuntimeSupport(route.model, route.executionMode);
+            const resolutionIssue = piModelResolutionIssue(config, route.model);
+            const effortIssue = runtimeRouteEffortIssue(config, route);
+            if (support.compatible && resolutionIssue === undefined) {
+                details.push(`${route.label} ${referenceOf(route.model)} runs on ${support.backend?.label ?? "unknown backend"} ` +
+                    `(effort: ${route.effort ?? "provider default"}).`);
+            }
+            else {
+                status = "error";
+                details.push(`${route.label} ${referenceOf(route.model)}: ${resolutionIssue ?? support.incompatibilityReason ?? "unsupported"}.`);
+            }
+            if (effortIssue !== undefined) {
+                status = "error";
+                details.push(`${route.label} ${referenceOf(route.model)}: ${effortIssue}`);
+            }
         }
-        else {
+        catch (error) {
             status = "error";
-            details.push(`Fallback model ${referenceOf(fallback)}: ${support.incompatibilityReason ?? "unsupported"}.`);
+            details.push(`${route.label} ${referenceOf(route.model)}: ${error instanceof Error ? error.message : String(error)}.`);
         }
     }
     return { id: "runtime", label: "Runtime", status, details };
 }
-const PI_API_KEY_ENV_BY_PROVIDER = {
-    "opencode-go": "OPENCODE_API_KEY",
-};
-/** Parses the Pi OAuth auth store (provider -> credentials) at `path`, best-effort. */
-async function readPiAuthProviders(path) {
-    try {
-        const parsed = JSON.parse(await readFile(path, "utf8"));
-        if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
-            return parsed;
-        }
+function configuredRuntimeRouteChecks(config) {
+    const primary = {
+        label: "Primary model",
+        model: config.runtime.model,
+        ...(config.runtime.effort === undefined ? {} : { effort: config.runtime.effort }),
+        executionMode: config.runtime.executionMode,
+    };
+    if ((config.runtime.fallbacks?.length ?? 0) > 0) {
+        return [
+            primary,
+            ...(config.runtime.fallbacks ?? []).map((fallback) => ({
+                label: "Fallback model",
+                model: fallback.model,
+                ...(fallback.effort === undefined ? {} : { effort: fallback.effort }),
+            })),
+        ];
     }
-    catch {
-        // Missing/invalid auth file is reported per-provider below, not thrown here.
+    return [
+        primary,
+        ...(config.runtime.fallbackModels ?? []).map((model) => ({
+            label: "Fallback model",
+            model,
+            ...(config.runtime.effort === undefined ? {} : { effort: config.runtime.effort }),
+        })),
+    ];
+}
+function runtimeRouteEffortIssue(config, route) {
+    if (route.effort === undefined)
+        return undefined;
+    if (route.model.sdk === "opencode") {
+        return `Direct OpenCode model ${referenceOf(route.model)} cannot receive runtime.effort=${route.effort}; the OpenCode SDK exposes no reasoning-effort input. Omit the route effort.`;
+    }
+    const metadata = resolveModelEffortLevels(route.model, config.providers?.local);
+    if (metadata.effortLevels !== undefined && !metadata.effortLevels.includes(route.effort)) {
+        return `effort=${route.effort} is unsupported by known model metadata; choose ${metadata.effortLevels.join(", ")}, or omit it for provider default.`;
+    }
+    if (metadata.reasoning === false && route.effort !== "none") {
+        return `effort=${route.effort} is unsupported because known model metadata marks this route as non-reasoning; use none or provider default.`;
+    }
+    if (route.model.sdk === "claude"
+        && (route.executionMode ?? defaultExecutionModeForModel(route.model)) === "sdk"
+        && !["low", "medium", "high", "xhigh", "max"].includes(route.effort)) {
+        return `effort=${route.effort} is unsupported by the Claude Agent SDK; choose low, medium, high, xhigh, max, or provider default.`;
     }
     return undefined;
 }
-/** Provider ids configured via the sibling `models.json` (custom/local providers need no OAuth). */
-async function readPiCustomProviders(authPath) {
-    try {
-        const parsed = JSON.parse(await readFile(join(dirname(authPath), "models.json"), "utf8"));
-        const providers = parsed?.providers;
-        if (providers !== null && typeof providers === "object" && !Array.isArray(providers)) {
-            return new Set(Object.keys(providers));
+/**
+ * Mirrors the Pi runtime's actual model-resolution boundary. Mono-agent only
+ * registers a custom Pi provider from `providers.local`; it deliberately does
+ * not import Pi CLI's ambient sibling `models.json`. Without a matching local
+ * provider, `resolvePiRuntimeModel` performs an exact built-in catalog lookup.
+ */
+function piModelResolutionIssue(config, model) {
+    if (model.sdk !== "pi" || model.provider === undefined) {
+        return undefined;
+    }
+    const localProvider = config.providers?.local?.find((provider) => provider.id === model.provider);
+    if (localProvider !== undefined) {
+        if (localProvider.enabled === false) {
+            return `provider \`${model.provider}\` is disabled in providers.local`;
         }
+        const localModel = localProvider.models?.find((candidate) => candidate.name === model.model || candidate.alias === model.model);
+        if (localModel?.enabled === false) {
+            return `model \`${model.model}\` is disabled in providers.local for provider \`${model.provider}\``;
+        }
+        return undefined;
     }
-    catch {
-        // No models.json is fine; such providers simply won't be marked custom.
+    if (isPiBuiltinProvider(model.provider)
+        && getPiBuiltinModels(model.provider).some((candidate) => candidate.id === model.model)) {
+        return undefined;
     }
-    return new Set();
+    return (`pi model not found: ${model.provider}:${model.model}; no matching providers.local entry exists and Pi's built-in catalog has no exact model. ` +
+        "The sibling Pi CLI models.json is not a mono-agent runtime source; add providers.local for a self-hosted provider or choose a built-in Pi model");
+}
+function isPiBuiltinProvider(provider) {
+    return getPiBuiltinProviders().includes(provider);
+}
+const PI_API_KEY_ENV_BY_PROVIDER = {
+    "opencode-go": "OPENCODE_API_KEY",
+};
+/** Inspects Pi credentials without following aliases or reading unbounded input. */
+async function readPiAuthProviders(path) {
+    const inspection = await inspectPiAuthStore(path);
+    if (inspection.status !== "ok")
+        return inspection;
+    return { status: "ok", providers: inspection.auth };
 }
 /**
  * What each SDK-authenticated backend truthfully reads for credentials. Only the
@@ -215,14 +548,165 @@ const SDK_AUTH_SCHEMES = {
         loginCommand: "claude /login",
         loginDetail: "a `claude /login` subscription session or a Bedrock/Vertex configuration (CLAUDE_CODE_USE_BEDROCK/VERTEX)",
         failureHint: 'the first turn fails with an opaque "Claude Code process exited with code 1" that names nothing',
+        statusCommand: "claude auth status --json",
+        statusArgs: ["auth", "status", "--json"],
     },
     codex: {
         envKeys: ["OPENAI_API_KEY"],
         loginCommand: "codex login",
         loginDetail: "a `codex login` ChatGPT session (`~/.codex/auth.json`, outside the environment)",
         failureHint: "the first turn fails to authenticate",
+        statusCommand: "codex login status",
+        statusArgs: ["login", "status"],
     },
 };
+const SDK_AUTH_STATUS_TIMEOUT_MS = 5_000;
+const SDK_AUTH_STATUS_MAX_BUFFER_BYTES = 64 * 1024;
+function isSdkAuthName(value) {
+    return value === "claude" || value === "codex";
+}
+const defaultSdkAuthStatusExecFile = async (file, args, options) => {
+    const { stdout } = await execFile(file, [...args], options);
+    return { stdout };
+};
+/**
+ * Performs the SDK's local, read-only login-status command. A zero Codex exit
+ * confirms its external login; Claude additionally requires strict JSON with
+ * `loggedIn: true`. Missing binaries, timeouts, non-zero exits, and malformed
+ * output all fail closed without leaking command output into validation.
+ */
+async function checkSdkExternalLoginStatus(sdk, env, cwd, run) {
+    const scheme = SDK_AUTH_SCHEMES[sdk];
+    try {
+        const { stdout } = await run(sdk, scheme.statusArgs, {
+            cwd,
+            env,
+            timeout: SDK_AUTH_STATUS_TIMEOUT_MS,
+            maxBuffer: SDK_AUTH_STATUS_MAX_BUFFER_BYTES,
+            encoding: "utf8",
+        });
+        if (sdk === "codex") {
+            return true;
+        }
+        const parsed = JSON.parse(stdout);
+        return parsed !== null
+            && typeof parsed === "object"
+            && !Array.isArray(parsed)
+            && parsed.loggedIn === true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Read provider IDs directly from auth.json without launching mutation-capable OpenCode middleware. */
+async function inspectOpenCodeCredentialProviders(env) {
+    if (env.OPENCODE_AUTH_CONTENT !== undefined) {
+        return { status: "inline_auth_unsupported" };
+    }
+    const dataHome = typeof env.XDG_DATA_HOME === "string" && env.XDG_DATA_HOME.length > 0
+        ? env.XDG_DATA_HOME
+        : join(typeof env.HOME === "string" && env.HOME.length > 0 ? env.HOME : homedir(), ".local", "share");
+    const opencodeData = join(dataHome, "opencode");
+    const marker = await regularCurrentUserFile(join(opencodeData, "opencode.db"));
+    if (!marker)
+        return { status: "migration_required" };
+    const authPath = join(opencodeData, "auth.json");
+    if (!(await regularCurrentUserFile(authPath)))
+        return { status: "auth_missing" };
+    try {
+        const parsed = JSON.parse(await readFile(authPath, "utf8"));
+        if (!isUnknownRecord(parsed))
+            return { status: "auth_invalid" };
+        const providers = new Set();
+        for (const [provider, credential] of Object.entries(parsed)) {
+            if (provider.length === 0 || provider.trim() !== provider || !isOpenCodeCredentialEntry(credential)) {
+                return { status: "auth_invalid" };
+            }
+            providers.add(provider);
+        }
+        return { status: "ok", providers };
+    }
+    catch {
+        return { status: "auth_invalid" };
+    }
+}
+async function regularCurrentUserFile(path) {
+    try {
+        const info = await lstat(path);
+        return info.isFile() && (typeof process.getuid !== "function" || info.uid === process.getuid());
+    }
+    catch {
+        return false;
+    }
+}
+function isOpenCodeCredentialEntry(value) {
+    if (!isUnknownRecord(value))
+        return false;
+    if (value.type === "oauth") {
+        return typeof value.refresh === "string"
+            && typeof value.access === "string"
+            && (value.refresh.trim().length > 0 || value.access.trim().length > 0)
+            && typeof value.expires === "number"
+            && Number.isSafeInteger(value.expires)
+            && value.expires >= 0
+            && (value.accountId === undefined || typeof value.accountId === "string")
+            && (value.enterpriseUrl === undefined || typeof value.enterpriseUrl === "string");
+    }
+    if (value.type === "api") {
+        return typeof value.key === "string"
+            && value.key.trim().length > 0
+            && (value.metadata === undefined
+                || (isUnknownRecord(value.metadata) && Object.values(value.metadata).every((entry) => typeof entry === "string")));
+    }
+    if (value.type === "wellknown") {
+        return typeof value.key === "string" && value.key.trim().length > 0
+            && typeof value.token === "string" && value.token.trim().length > 0;
+    }
+    return false;
+}
+async function checkOpenCodeVersion(env, cwd, run) {
+    const versionEnv = {};
+    for (const key of [
+        "PATH",
+        "LANG",
+        "LC_ALL",
+        "LC_CTYPE",
+        "SHELL",
+        "TMPDIR",
+        "TMP",
+        "TEMP",
+        "SystemRoot",
+        "WINDIR",
+        "ComSpec",
+        "PATHEXT",
+    ]) {
+        const value = env[key];
+        if (typeof value === "string" && value.length > 0)
+            versionEnv[key] = value;
+    }
+    try {
+        const { stdout } = await run("opencode", ["--version"], {
+            cwd,
+            env: versionEnv,
+            timeout: SDK_AUTH_STATUS_TIMEOUT_MS,
+            maxBuffer: SDK_AUTH_STATUS_MAX_BUFFER_BYTES,
+            encoding: "utf8",
+        });
+        const match = /^v?(\d+)\.(\d+)\.(\d+)(?:\+[0-9A-Za-z.-]+)?$/u.exec(stdout.trim());
+        if (match === null)
+            return false;
+        const major = Number(match[1]);
+        const minor = Number(match[2]);
+        const patch = Number(match[3]);
+        return Number.isSafeInteger(major)
+            && Number.isSafeInteger(minor)
+            && Number.isSafeInteger(patch)
+            && (major > 1 || (major === 1 && minor >= 15));
+    }
+    catch {
+        return false;
+    }
+}
 /** First env key whose value is present and non-blank, or undefined when none are set. */
 function firstPresentEnvKey(env, keys) {
     for (const key of keys) {
@@ -241,26 +725,35 @@ function firstPresentEnvKey(env, keys) {
  * and the E1 fresh-instance case where `claude:*` with no `ANTHROPIC_API_KEY` "validates"
  * clean but the first turn dies with an opaque "process exited with code 1").
  *
- * The check is intentionally STATIC and read-only — a validator must not mutate the auth
- * store or hit the network.
+ * The check is read-only. Static validation never launches a process; live validation may
+ * run bounded, local SDK login-status commands, which inspect durable external login state
+ * without making a model turn or mutating the auth store.
  *
- * - Pi providers: inspect the auth store (`piAuthPath`), the sibling `models.json`, AND the
- *   config's own `providers.local` custom providers. A custom/local provider needs no OAuth;
- *   an OAuth provider absent from the store, or whose access token has expired, is flagged
- *   `waiting` with a re-auth hint.
- * - SDK-authenticated providers (`claude:*` / `codex:*`): inspect only the RESOLVED ENV
- *   (process env + loaded `.env`) for the backend's accepted keys. When none is present we
- *   flag `waiting` — but the warning explicitly acknowledges the interactive login path
- *   (`claude /login` / `codex login`), which lives outside the environment and CANNOT be
- *   verified statically, so a logged-in user is not falsely told they are broken.
+ * - Pi providers: inspect the auth store (`piAuthPath`) and the config's own
+ *   `providers.local` custom providers. A custom/local provider follows its declared
+ *   `apiKey` / `apiKeyEnv` contract instead of Pi OAuth; an OAuth provider absent from
+ *   the store, or whose access token has expired, is flagged `waiting` with a re-auth hint.
+ * - SDK-authenticated providers (`claude:*` / `codex:*`): inspect the RESOLVED ENV (process
+ *   env + loaded `.env`) for the backend's accepted keys. During live validation only, a
+ *   missing env credential falls back to `claude auth status --json` / `codex login status`.
+ *   The commands use the same resolved environment (including PATH and HOME), are bounded,
+ *   cached once per SDK, and never make a model turn. Static validation remains process-free.
+ * - Direct OpenCode (`opencode:<provider>:<model>`): inspect exact provider IDs in the
+ *   standard auth.json and require the native DB migration marker. Static validation launches
+ *   no process. Live validation runs only a bounded `opencode --version` preflight; it never
+ *   runs the mutation-capable auth middleware or makes a model turn.
  *
  * `waiting` (never `error`) keeps the verdict non-fatal, mirroring the Ollama/Phoenix
  * probes — the goal is visibility, not blocking start.
  */
-async function credentialsSection(config, env) {
+async function credentialsSection(config, env, cwd, liveness, verifiedCredentialModelRefs = [], sdkAuthStatusExecFile = defaultSdkAuthStatusExecFile, staticTriggerRefs = []) {
     const refs = [
         { label: "Primary", ref: config.runtime.model },
-        ...(config.runtime.fallbackModels ?? []).map((ref) => ({ label: "Fallback", ref })),
+        ...configuredRuntimeRouteChecks(config).slice(1).map((route) => ({
+            label: "Fallback",
+            ref: route.model,
+        })),
+        ...staticTriggerRefs,
     ];
     if (config.memory?.llm !== undefined && config.memory.llm.provider !== "ollama") {
         try {
@@ -270,9 +763,10 @@ async function credentialsSection(config, env) {
             // A malformed memory model reference is surfaced by the memory/runtime shape checks.
         }
     }
-    const piRefs = refs.filter((r) => r.ref.sdk === "pi" && typeof r.ref.provider === "string");
-    const sdkRefs = refs.filter((r) => r.ref.sdk in SDK_AUTH_SCHEMES);
-    if (piRefs.length === 0 && sdkRefs.length === 0) {
+    const authenticatedRefs = refs.filter((r) => (r.ref.sdk === "pi" && typeof r.ref.provider === "string")
+        || (r.ref.sdk === "opencode" && typeof r.ref.provider === "string")
+        || isSdkAuthName(r.ref.sdk));
+    if (authenticatedRefs.length === 0) {
         return {
             id: "credentials",
             label: "Provider credentials",
@@ -282,12 +776,49 @@ async function credentialsSection(config, env) {
     }
     const details = [];
     let status = "ok";
+    const verified = new Set(verifiedCredentialModelRefs);
+    for (const { label, ref } of authenticatedRefs) {
+        const refStr = referenceOf(ref);
+        if (verified.has(refStr)) {
+            details.push(`${label} ${refStr}: credentials verified by a successful live model check.`);
+        }
+    }
+    const unverifiedRefs = authenticatedRefs.filter(({ ref }) => !verified.has(referenceOf(ref)));
+    const piRefs = unverifiedRefs.filter((r) => r.ref.sdk === "pi" && typeof r.ref.provider === "string");
+    const openCodeRefs = unverifiedRefs.filter((r) => r.ref.sdk === "opencode" && typeof r.ref.provider === "string");
+    const sdkRefs = unverifiedRefs.filter((r) => isSdkAuthName(r.ref.sdk));
     if (piRefs.length > 0) {
-        const piStatus = await appendPiCredentialDetails(config, piRefs, details);
+        const piStatus = await appendPiCredentialDetails(config, piRefs, details, env);
         if (piStatus === "waiting") {
             status = "waiting";
         }
     }
+    const openCodeInspection = openCodeRefs.length > 0
+        ? inspectOpenCodeCredentialProviders(env)
+        : undefined;
+    const openCodeVersion = liveness && openCodeRefs.length > 0
+        ? checkOpenCodeVersion(env, cwd, sdkAuthStatusExecFile)
+        : undefined;
+    const sdkAuthStatuses = new Map();
+    const externalLoginStatus = (sdk) => {
+        const cached = sdkAuthStatuses.get(sdk);
+        if (cached !== undefined) {
+            return cached;
+        }
+        const pending = checkSdkExternalLoginStatus(sdk, env, cwd, sdkAuthStatusExecFile);
+        sdkAuthStatuses.set(sdk, pending);
+        return pending;
+    };
+    // Start each unique local status check before awaiting details so two SDKs
+    // cost one bounded timeout window rather than running serially.
+    if (liveness) {
+        for (const { ref } of sdkRefs) {
+            const scheme = SDK_AUTH_SCHEMES[ref.sdk];
+            if (scheme !== undefined && firstPresentEnvKey(env, scheme.envKeys) === undefined) {
+                void externalLoginStatus(ref.sdk);
+            }
+        }
+    }
     for (const { label, ref } of sdkRefs) {
         const refStr = referenceOf(ref);
         const scheme = SDK_AUTH_SCHEMES[ref.sdk];
@@ -296,32 +827,69 @@ async function credentialsSection(config, env) {
         }
         const present = firstPresentEnvKey(env, scheme.envKeys);
         if (present !== undefined) {
-            details.push(`${label} ${refStr}: SDK credential present in the resolved env (${present}).`);
+            details.push(`${label} ${refStr}: SDK credential present in the resolved env (${present}); credential detected, live model verification is still pending.`);
+            continue;
+        }
+        if (liveness && await externalLoginStatus(ref.sdk)) {
+            details.push(`${label} ${refStr}: external sign-in detected by read-only \`${scheme.statusCommand}\`; ` +
+                "credentials are not verified until a live model turn succeeds.");
             continue;
         }
         status = "waiting";
         details.push(`[WARN] ${label} ${refStr}: no SDK credential in the resolved env (checked ${scheme.envKeys.join(", ")}). ` +
-            `If you authenticated via ${scheme.loginDetail} this is fine and can't be verified here; ` +
+            (liveness
+                ? `External login was not verified by \`${scheme.statusCommand}\`; `
+                : `If you authenticated via ${scheme.loginDetail} this is fine and can't be verified during static validation; `) +
             `otherwise ${scheme.failureHint} — set ${scheme.envKeys[0]} or run \`${scheme.loginCommand}\`.`);
     }
+    if (openCodeRefs.length > 0) {
+        const inspection = openCodeInspection === undefined ? undefined : await openCodeInspection;
+        const supportedVersion = openCodeVersion === undefined ? false : await openCodeVersion;
+        for (const { label, ref } of openCodeRefs) {
+            const refStr = referenceOf(ref);
+            const provider = ref.provider;
+            const credentialPresent = inspection?.status === "ok" && inspection.providers.has(provider);
+            if (credentialPresent && liveness && supportedVersion) {
+                details.push(`${label} ${refStr}: provider \`${provider}\` credential present in the standard OpenCode auth store; stable OpenCode CLI >=1.15.0 detected without a model turn. Credential detected; live model verification is still pending.`);
+            }
+            else {
+                status = "waiting";
+                const warning = inspection?.status === "migration_required"
+                    ? "the native OpenCode database migration marker is missing or invalid; run `opencode db migrate --pure` once"
+                    : inspection?.status === "inline_auth_unsupported"
+                        ? "OPENCODE_AUTH_CONTENT is unsupported for direct runs; persist credentials with `opencode auth login` and unset it"
+                        : inspection?.status === "auth_invalid"
+                            ? "the standard OpenCode auth.json is malformed or contains an unsupported credential entry"
+                            : credentialPresent && !liveness
+                                ? "credentials and migration marker are present, but the required stable OpenCode CLI >=1.15.0 is unverified during static validation"
+                                : credentialPresent && !supportedVersion
+                                    ? "credentials are present, but stable OpenCode CLI >=1.15.0 could not be verified"
+                                    : inspection?.status === "ok"
+                                        ? `no exact credential entry exists for provider \`${provider}\`; run \`opencode auth login\` for that provider`
+                                        : "the standard OpenCode auth.json is missing; run `opencode auth login`";
+                const safetyNote = liveness
+                    ? "No model turn or mutation-capable OpenCode command was run."
+                    : "No OpenCode process was launched.";
+                details.push(`[WARN] ${label} ${refStr}: ${warning}. ${safetyNote}`);
+            }
+        }
+    }
     return { id: "credentials", label: "Provider credentials", status, details };
 }
 /**
  * Appends one detail line per Pi provider reference and returns "waiting" if any
- * was flagged (missing/expired), else "ok". Recognizes providers configured via
- * the auth store's `models.json` AND the config's `providers.local` custom set.
+ * was flagged (missing/expired), else "ok". Recognizes custom providers only
+ * through the config's `providers.local` set, matching the runtime boundary.
  */
-async function appendPiCredentialDetails(config, piRefs, details) {
+async function appendPiCredentialDetails(config, piRefs, details, env) {
     const authPath = config.providers?.piAuthPath;
-    const authProviders = authPath === undefined ? undefined : await readPiAuthProviders(authPath);
-    const modelsJsonProviders = authPath === undefined ? new Set() : await readPiCustomProviders(authPath);
-    // A `pi:<id>:...` model whose `<id>` matches an ENABLED `providers.local` entry
-    // is a keyless local/custom provider — no OAuth, no auth-store entry. A DISABLED
-    // entry is tracked separately: the runtime throws `provider disabled: <id>` on the
-    // first turn (pi-models.js), so validate must name that instead of reporting a
-    // clean OK or the misleading "no Pi credentials" advice.
-    const enabledLocalProviders = new Set((config.providers?.local ?? []).filter((provider) => provider.enabled !== false).map((provider) => provider.id));
-    const disabledLocalProviders = new Set((config.providers?.local ?? []).filter((provider) => provider.enabled === false).map((provider) => provider.id));
+    const authInspection = authPath === undefined ? undefined : await readPiAuthProviders(authPath);
+    const authProviders = authInspection?.status === "ok" ? authInspection.providers : undefined;
+    // A matching `providers.local` entry owns the runtime route, even when its ID
+    // collides with a Pi built-in provider. Report the local entry's declared auth
+    // contract instead of consulting the unrelated Pi auth store. A disabled entry
+    // remains authoritative because the runtime rejects it before credential use.
+    const localProviders = new Map((config.providers?.local ?? []).map((provider) => [provider.id, provider]));
     const now = Date.now();
     let status = "ok";
     if (authPath !== undefined) {
@@ -330,45 +898,99 @@ async function appendPiCredentialDetails(config, piRefs, details) {
     for (const { label, ref } of piRefs) {
         const provider = ref.provider;
         const refStr = referenceOf(ref);
-        const loginCommand = piLoginCommandLine(provider);
-        const loginCwd = piAuthWorkingDirectory(authPath);
-        if (enabledLocalProviders.has(provider)) {
-            details.push(`${label} ${refStr}: provider \`${provider}\` configured via config providers.local (keyless local provider).`);
+        const loginCommand = piAuthRecoveryCommand(provider, authPath);
+        const localProvider = localProviders.get(provider);
+        if (localProvider !== undefined) {
+            if (localProvider.enabled === false) {
+                status = "waiting";
+                details.push(`[WARN] ${label} ${refStr}: provider \`${provider}\` is configured in providers.local but disabled (\`enabled: false\`); the runtime will throw \`provider disabled: ${provider}\` on the first turn. Set \`enabled: true\` on that providers.local entry.`);
+            }
+            else if (localProvider.apiKey !== undefined) {
+                details.push(`${label} ${refStr}: provider \`${provider}\` configured via config providers.local (API key configured); credential detected, live model verification is still pending.`);
+            }
+            else if (localProvider.apiKeyEnv !== undefined) {
+                if (hasNonEmptyCredentialValue(env[localProvider.apiKeyEnv])) {
+                    details.push(`${label} ${refStr}: provider \`${provider}\` configured via config providers.local with ${localProvider.apiKeyEnv} present in the resolved environment; credential detected, live model verification is still pending.`);
+                }
+                else {
+                    status = "waiting";
+                    details.push(`[WARN] ${label} ${refStr}: provider \`${provider}\` declares apiKeyEnv \`${localProvider.apiKeyEnv}\`, but the resolved environment has no non-empty value and no inline apiKey fallback. Set ${localProvider.apiKeyEnv} before starting.`);
+                }
+            }
+            else {
+                details.push(`${label} ${refStr}: provider \`${provider}\` configured via config providers.local (keyless local provider; no API key declared).`);
+            }
             continue;
         }
-        if (disabledLocalProviders.has(provider)) {
-            status = "waiting";
-            details.push(`[WARN] ${label} ${refStr}: provider \`${provider}\` is configured in providers.local but disabled (\`enabled: false\`); the runtime will throw \`provider disabled: ${provider}\` on the first turn. Set \`enabled: true\` on that providers.local entry.`);
+        const apiKeyEnv = PI_API_KEY_ENV_BY_PROVIDER[provider];
+        if (apiKeyEnv !== undefined && hasNonEmptyCredentialValue(env[apiKeyEnv])) {
+            details.push(`${label} ${refStr}: Pi API-key credential for \`${provider}\` present in the resolved environment (${apiKeyEnv}); credential detected, live model verification is still pending.`);
             continue;
         }
-        if (modelsJsonProviders.has(provider)) {
-            details.push(`${label} ${refStr}: provider \`${provider}\` configured via pi models.json.`);
+        if (authInspection?.status === "unsafe") {
+            status = "waiting";
+            details.push(`[WARN] ${label} ${refStr}: Pi auth store was not trusted because ${describePiAuthStoreUnsafeReason(authInspection.reason)}. ` +
+                `Move the unsafe entry aside if needed, then run \`${loginCommand}\` to create or atomically harden a current-user 0600 store. ` +
+                "A current-user, non-writable legacy store can be replaced during this explicit repair, but is intentionally never trusted for credential detection. " +
+                "No credential values or file contents were displayed.");
             continue;
         }
         const entry = authProviders?.[provider];
         if (entry === undefined) {
             status = "waiting";
-            const apiKeyEnv = PI_API_KEY_ENV_BY_PROVIDER[provider];
             details.push(apiKeyEnv === undefined
-                ? `[WARN] ${label} ${refStr}: no Pi credentials found for provider \`${provider}\` (absent from the auth store and models.json). Authenticate it with \`${loginCommand}\` from ${loginCwd}, or set providers.piAuthPath.`
-                : `[WARN] ${label} ${refStr}: no Pi API key credentials found for provider \`${provider}\` (absent from the auth store and models.json). Save an API key entry in providers.piAuthPath, or set ${apiKeyEnv}.`);
+                ? `[WARN] ${label} ${refStr}: no Pi credentials found for provider \`${provider}\` in the auth store. Authenticate it with \`${loginCommand}\`, or set providers.piAuthPath.`
+                : `[WARN] ${label} ${refStr}: no Pi API key credentials found for provider \`${provider}\` in the auth store or resolved environment. Run \`${loginCommand}\`, or set ${apiKeyEnv}.`);
+            continue;
+        }
+        const isOAuth = entry.type === "oauth";
+        const isApiKey = entry.type === "api_key";
+        if (isApiKey && !hasNonEmptyCredentialValue(entry.key)) {
+            status = "waiting";
+            details.push(`[WARN] ${label} ${refStr}: stored API-key credential for \`${provider}\` has no usable key. Run \`${loginCommand}\`; no secret value was displayed.`);
+            continue;
+        }
+        if (isOAuth && !hasNonEmptyCredentialValue(entry.access) && !hasNonEmptyCredentialValue(entry.refresh)) {
+            status = "waiting";
+            details.push(`[WARN] ${label} ${refStr}: stored OAuth credential for \`${provider}\` has no usable access or refresh token. Re-authenticate with \`${loginCommand}\`; no secret value was displayed.`);
+            continue;
+        }
+        if (!isOAuth && !isApiKey) {
+            status = "waiting";
+            details.push(`[WARN] ${label} ${refStr}: stored credential for \`${provider}\` has an unsupported or missing type. Re-authenticate with \`${loginCommand}\`; no secret value was displayed.`);
             continue;
         }
-        const isOAuth = entry.type === "oauth" || typeof entry.expires === "number";
         const expired = typeof entry.expires === "number" && entry.expires < now;
         const whenNote = typeof entry.expires === "number" ? ` ${new Date(entry.expires).toISOString()}` : "";
         if (isOAuth && expired) {
             status = "waiting";
-            details.push(`[WARN] ${label} ${refStr}: OAuth token for \`${provider}\` expired${whenNote} — the runtime auto-refreshes, but if runs fail with "No API key for provider: ${provider}" the refresh is dead; re-authenticate with \`${loginCommand}\` from ${loginCwd}.`);
+            details.push(`[WARN] ${label} ${refStr}: OAuth token for \`${provider}\` expired${whenNote} — the runtime may auto-refresh, but this credential is not ready until a request succeeds; if runs fail with "No API key for provider: ${provider}" re-authenticate with \`${loginCommand}\`.`);
             continue;
         }
         details.push(isOAuth
-            ? `${label} ${refStr}: OAuth credentials for \`${provider}\` present (token valid${whenNote}).`
-            : `${label} ${refStr}: API key credentials for \`${provider}\` present.`);
+            ? `${label} ${refStr}: OAuth credentials for \`${provider}\` present (token valid${whenNote}); credential detected, live model verification is still pending.`
+            : `${label} ${refStr}: API key credentials for \`${provider}\` present; credential detected, live model verification is still pending.`);
     }
     return status;
 }
-async function contextSection(config) {
+function describePiAuthStoreUnsafeReason(reason) {
+    switch (reason) {
+        case "owner-check-unavailable": return "the current file owner could not be verified";
+        case "symbolic-link": return "the configured entry is a symbolic link";
+        case "not-regular-file": return "the configured entry is not a regular file";
+        case "multiple-hard-links": return "the file has multiple hard links";
+        case "oversized": return "the file exceeds the 1 MiB inspection limit";
+        case "foreign-owner": return "the file is not owned by the current user";
+        case "not-owner-only": return "its permissions are not owner-only";
+        case "changed-during-read": return "its identity or metadata changed during inspection";
+        case "malformed-json": return "it is not a valid JSON object";
+        case "unreadable": return "it could not be opened and inspected safely";
+    }
+}
+function hasNonEmptyCredentialValue(value) {
+    return typeof value === "string" && value.trim().length > 0 && value.length <= 65_536 && !value.includes("\0");
+}
+async function contextSection(config, cwd) {
     const details = [];
     let status = "ok";
     if (await pathExists(config.context.identityPath)) {
@@ -405,10 +1027,23 @@ async function contextSection(config) {
         status = "error";
         details.push("Skills are selected but context.skillsRoot is not set.");
     }
+    if (await managedProjectSkillsExist(cwd)) {
+        const managed = await checkManagedProjectSkills(cwd);
+        const drift = managed.statuses.filter((entry) => entry.status !== "ready");
+        if (drift.length === 0) {
+            details.push(`Managed project skills: current (${managed.manifestVersion ?? "unknown version"}).`);
+        }
+        else {
+            if (status === "ok")
+                status = "waiting";
+            details.push(`Managed project skill drift: ${drift.map((entry) => `${entry.name}=${entry.status}`).join(", ")}. ` +
+                "Run `mono-agent install-skill --project --check`; use --update only after reconciling modified copies.");
+        }
+    }
     return { id: "context", label: "Context & skills", status, details };
 }
 const DEFAULT_CONSOLIDATION_CRON = "0 */2 * * *";
-async function memorySection(config, liveness, allowFilesystemWrites) {
+async function memorySection(config, cwd, env, liveness, allowFilesystemWrites, preferAppPluginInstall) {
     if (config.memory === undefined) {
         return { id: "memory", label: "Memory", status: "disabled", details: ["No memory configured."] };
     }
@@ -425,6 +1060,32 @@ async function memorySection(config, liveness, allowFilesystemWrites) {
                 details: ["[ERROR] backend 'supermemory' requires a memory.supermemory block."],
             };
         }
+        try {
+            const plugin = await loadSupermemoryPlugin({ cwd, preferAppInstall: preferAppPluginInstall });
+            const validation = plugin.validateSupermemoryConfig({
+                baseUrl: sm.baseUrl,
+                container: resolveSupermemoryContainer(config),
+                ...(sm.apiKey === undefined ? {} : { apiKey: sm.apiKey }),
+                ...(sm.timeoutMs === undefined ? {} : { timeoutMs: sm.timeoutMs }),
+                ...(config.memory.maxBytes === undefined ? {} : { maxBytes: config.memory.maxBytes }),
+            });
+            if (!validation.valid) {
+                return {
+                    id: "memory",
+                    label: "Memory",
+                    status: "error",
+                    details: validation.errors.map((detail) => `[ERROR] ${detail}`),
+                };
+            }
+        }
+        catch (error) {
+            return {
+                id: "memory",
+                label: "Memory",
+                status: "error",
+                details: [`[ERROR] ${error instanceof Error ? error.message : String(error)}`],
+            };
+        }
         return {
             id: "memory",
             label: "Memory",
@@ -442,39 +1103,191 @@ async function memorySection(config, liveness, allowFilesystemWrites) {
     const details = [
         `Mode: ${config.memory.mode}, path: ${config.memory.path}, writeMode: ${config.memory.writeMode}.`,
     ];
+    let status = "ok";
     if (config.memory.llm !== undefined) {
         details.push(`Chat LLM: ${memoryLlmLabel(config.memory.llm)}.`);
+        if (config.memory.llm.provider === "agent-host") {
+            try {
+                const model = parseMonoRuntimeModelReference(config.memory.llm.model);
+                const resolutionIssue = piModelResolutionIssue(config, model);
+                if (resolutionIssue !== undefined) {
+                    status = "error";
+                    details.push(`Agent-host memory LLM ${referenceOf(model)}: ${resolutionIssue}.`);
+                }
+            }
+            catch (error) {
+                status = "error";
+                details.push(`Agent-host memory LLM ${config.memory.llm.model}: ${error instanceof Error ? error.message : String(error)}.`);
+            }
+        }
     }
     if (config.memory.mode === "bujo") {
         // Report consolidation scheduler cadence.
         const consolidationEnabled = config.memory.consolidation?.enabled !== false;
         const consolidationCron = config.memory.consolidation?.cron ?? DEFAULT_CONSOLIDATION_CRON;
-        const hasLlm = config.memory.llm !== undefined;
-        if (hasLlm) {
-            if (consolidationEnabled) {
-                details.push(`Consolidation: ${consolidationCron} (auto).`);
-            }
-            else {
-                details.push("Consolidation: disabled.");
-            }
+        if (consolidationEnabled) {
+            details.push(`Consolidation: ${consolidationCron} (auto).`);
         }
         else {
-            details.push("Consolidation: not scheduled (no chat model — bujo runtime tier downgrades to journal).");
+            details.push("Consolidation: disabled.");
         }
     }
+    const managedIdentity = await managedMemoryIdentityStatus(config.memory);
+    if (managedIdentity !== undefined) {
+        return {
+            id: "memory",
+            label: "Memory",
+            status: status === "error" ? "error" : managedIdentity.status,
+            details: [...details, ...managedIdentity.details],
+        };
+    }
+    const nativeAvailability = await builtInMemoryNativeStatus(config.memory);
+    if (nativeAvailability !== undefined) {
+        return {
+            id: "memory",
+            label: "Memory",
+            status: "error",
+            details: [...details, nativeAvailability],
+        };
+    }
     if (config.memory.mode === "journal" || config.memory.mode === "bujo") {
-        const warns = await memoryLivenessWarnings(config.memory, liveness, allowFilesystemWrites);
+        const warns = await memoryLivenessWarnings(config.memory, env, liveness, allowFilesystemWrites);
         if (warns.length > 0) {
-            return { id: "memory", label: "Memory", status: "waiting", details: [...details, ...warns] };
+            return {
+                id: "memory",
+                label: "Memory",
+                status: status === "error" ? "error" : "waiting",
+                details: [...details, ...warns],
+            };
         }
     }
     if (config.memory.mode === "lite") {
         const liteWarns = await liteRootWritableWarning(config.memory.path, allowFilesystemWrites);
         if (liteWarns.length > 0) {
-            return { id: "memory", label: "Memory", status: "waiting", details: [...details, ...liteWarns] };
+            return {
+                id: "memory",
+                label: "Memory",
+                status: status === "error" ? "error" : "waiting",
+                details: [...details, ...liteWarns],
+            };
         }
     }
-    return { id: "memory", label: "Memory", status: "ok", details };
+    return { id: "memory", label: "Memory", status, details };
+}
+async function managedMemoryIdentityStatus(memory) {
+    if (await pathExists(join(memory.path, FIRST_RUN_MEMORY_INITIALIZING_MARKER))) {
+        return {
+            status: "error",
+            details: [
+                "[ERROR] First-run managed memory initialization is incomplete.",
+                "Re-run `mono-agent init` in a clean target or remove only the failed first-run root after inspecting it.",
+            ],
+        };
+    }
+    const manifestPath = join(memory.path, ".index", "manifest.json");
+    if (!(await pathExists(manifestPath))) {
+        // Lite has no semantic index authority. Journal/BuJo readiness is strict:
+        // a missing manifest is fatal even for a wholly new/unmanaged root, and the
+        // provider must not be probed until rebuild establishes that authority.
+        if (memory.mode === "lite")
+            return undefined;
+        return {
+            status: "error",
+            details: [
+                "[ERROR] Managed memory generation metadata is missing for Journal/BuJo memory.",
+                "Stop the agent with `mono-agent stop`, run `mono-agent memory rebuild`, then re-run `mono-agent validate` before restarting.",
+            ],
+        };
+    }
+    let manifest;
+    try {
+        const { readManagedIndexManifest } = await import("@mono-agent/memory/bujo");
+        manifest = readManagedIndexManifest(memory.path);
+    }
+    catch {
+        return {
+            status: "error",
+            details: ["[ERROR] Managed memory generation metadata is invalid or unavailable."],
+        };
+    }
+    if (manifest === undefined) {
+        return {
+            status: "error",
+            details: ["[ERROR] Managed memory generation metadata disappeared during validation."],
+        };
+    }
+    const configuredModel = memory.embeddings === undefined
+        ? undefined
+        : `${memory.embeddings.provider}:${memory.embeddings.model}`;
+    const configuredDimension = memory.embeddings === undefined ? undefined : memory.embeddings.dim ?? 768;
+    const active = manifest.active;
+    if (active.tier === memory.mode
+        && active.embeddingModel === configuredModel
+        && active.dimension === configuredDimension) {
+        return undefined;
+    }
+    const identity = (tier, model, dimension) => `tier=${tier}, model=${model ?? "none"}, dim=${dimension ?? "none"}`;
+    return {
+        status: "error",
+        details: [
+            `[ERROR] Active managed generation does not match the configured memory identity: active ${identity(active.tier, active.embeddingModel, active.dimension)}; configured ${identity(memory.mode, configuredModel, configuredDimension)}.`,
+            "Stop the agent with `mono-agent stop`, run `mono-agent memory rebuild`, then re-run `mono-agent validate` before restarting.",
+        ],
+    };
+}
+async function builtInMemoryNativeStatus(memory) {
+    let database;
+    let managedGeneration = false;
+    try {
+        const { openMemoryDb } = await import("@mono-agent/memory/store");
+        const manifestPath = join(memory.path, ".index", "manifest.json");
+        if (await pathExists(manifestPath)) {
+            managedGeneration = true;
+            const { resolveActiveMemoryDbPath } = await import("@mono-agent/memory/bujo");
+            database = openMemoryDb({ path: resolveActiveMemoryDbPath(memory.path), readOnly: true });
+        }
+        else {
+            // Lite roots may not exist yet and validation must remain read-only. An
+            // in-memory open exercises the exact native ABI + extension load without
+            // scanning durable memory or creating the configured root.
+            database = openMemoryDb({ path: ":memory:" });
+        }
+        // A single schema-row lookup proves the opened handle can actually read
+        // SQLite state (constructor-only opens can accept a truncated file). This
+        // remains constant-work and avoids the corpus/queue scans of strict audit.
+        database.indexMetadata();
+        database.close();
+        database = undefined;
+        return undefined;
+    }
+    catch (error) {
+        if (isBuiltInMemoryNativeFailure(error)) {
+            return "[ERROR] Built-in memory native module is unavailable for this Node runtime. Rebuild dependencies with the launch runtime, then re-run `mono-agent validate`.";
+        }
+        if (managedGeneration) {
+            return "[ERROR] Built-in memory active generation is unavailable. Stop the agent with `mono-agent stop`, run `mono-agent memory rebuild`, then re-run `mono-agent validate` before restarting.";
+        }
+        return "[ERROR] Built-in memory database smoke check failed. Rebuild dependencies with the launch runtime; if the runtime is compatible, stop the agent and run `mono-agent memory rebuild`, then re-run `mono-agent validate`.";
+    }
+    finally {
+        try {
+            database?.close();
+        }
+        catch { /* best-effort smoke cleanup */ }
+    }
+}
+function isBuiltInMemoryNativeFailure(error) {
+    try {
+        const message = error instanceof Error ? error.message : "";
+        const code = typeof error === "object" && error !== null && "code" in error
+            ? String(error.code ?? "")
+            : "";
+        return /(?:err_(?:dlopen|module_not_found)|module_not_found|better[-_ ]?sqlite|sqlite[-_ ]?vec|node_module_version|native module|dlopen|\.node\b)/iu
+            .test(`${code} ${message}`);
+    }
+    catch {
+        return false;
+    }
 }
 async function liteRootWritableWarning(memoryPath, allowFilesystemWrites) {
     return await memoryRootWritableWarnings("lite", memoryPath, allowFilesystemWrites);
@@ -496,20 +1309,34 @@ async function fetchOllamaModels(endpoint) {
         clearTimeout(timer);
     }
 }
-async function memoryLivenessWarnings(memory, liveness, allowFilesystemWrites) {
+async function memoryLivenessWarnings(memory, env, liveness, allowFilesystemWrites) {
     const warns = [];
     const mode = memory.mode;
-    const embeddingsUsesOllama = (memory.embeddings?.provider ?? "ollama") === "ollama";
     const llmUsesOllama = memory.llm?.provider === "ollama";
     const ollamaModelsByEndpoint = new Map();
     // 1. Memory root writable (every embedded tier) — local I/O, always checked.
     const rootWarns = await memoryRootWritableWarnings(mode, memory.path, allowFilesystemWrites);
     warns.push(...rootWarns);
+    const embeddings = memory.embeddings;
+    let embeddingApiKey = embeddings?.apiKey;
+    if (embeddings?.apiKeyEnv !== undefined) {
+        embeddingApiKey = env[embeddings.apiKeyEnv]?.trim();
+        if (embeddingApiKey === undefined || embeddingApiKey.length === 0) {
+            warns.push(`[WARN] Embeddings apiKeyEnv ${embeddings.apiKeyEnv} is declared, but the resolved environment has no ` +
+                `non-empty value. Set ${embeddings.apiKeyEnv} before starting managed memory; no keyless probe was attempted.`);
+            embeddingApiKey = undefined;
+        }
+    }
     // Network-dependent probes below only ever produce `waiting`, so the start
     // preflight skips them (liveness=false) without changing the pass/fail verdict.
     if (!liveness) {
         return warns;
     }
+    if (embeddings !== undefined
+        && (embeddings.provider === "ollama" || embeddings.provider === "lmstudio")
+        && (embeddings.apiKeyEnv === undefined || embeddingApiKey !== undefined)) {
+        warns.push(...await localEmbeddingLivenessWarnings(embeddings, embeddingApiKey));
+    }
     async function modelsForOllamaEndpoint(endpoint) {
         const normalizedEndpoint = endpoint.replace(/\/$/u, "");
         if (ollamaModelsByEndpoint.has(normalizedEndpoint)) {
@@ -526,18 +1353,9 @@ async function memoryLivenessWarnings(memory, liveness, allowFilesystemWrites) {
             return undefined;
         }
     }
-    // 2. Ollama liveness — only probe components that actually use Ollama. OpenAI embeddings and
-    // agent-host chat LLMs have no local model list to validate here.
-    if (embeddingsUsesOllama) {
-        const endpoint = memory.embeddings?.endpoint ?? "http://localhost:11434";
-        const ollamaModels = await modelsForOllamaEndpoint(endpoint);
-        if (ollamaModels !== undefined) {
-            const embeddingsModel = memory.embeddings?.model ?? "nomic-embed-text:v1.5";
-            if (!ollamaModels.includes(embeddingsModel)) {
-                warns.push(`[WARN] Embeddings model ${embeddingsModel} not pulled — run \`ollama pull ${embeddingsModel}\`.`);
-            }
-        }
-    }
+    // 2. Chat-LLM Ollama liveness remains independent from the selected
+    // embeddings service. OpenAI embeddings and agent-host chat LLMs have no
+    // local typed model catalog to validate here.
     if (llmUsesOllama && memory.llm !== undefined) {
         const endpoint = memory.llm.endpoint ?? "http://localhost:11434";
         const ollamaModels = await modelsForOllamaEndpoint(endpoint);
@@ -550,6 +1368,52 @@ async function memoryLivenessWarnings(memory, liveness, allowFilesystemWrites) {
     }
     return warns;
 }
+async function localEmbeddingLivenessWarnings(embeddings, apiKey) {
+    if (embeddings.provider !== "ollama" && embeddings.provider !== "lmstudio")
+        return [];
+    const provider = embeddings.provider;
+    const label = provider === "ollama" ? "Ollama" : "LM Studio";
+    const endpoint = (embeddings.endpoint ?? DEFAULT_MEMORY_EMBEDDING_ENDPOINTS[provider]).replace(/\/+$/u, "");
+    // Runtime readiness is authoritative on the exact configured model. Typed
+    // catalogs help the wizard offer choices, but an unavailable/incomplete
+    // catalog must not make its explicit manual fallback permanently unready.
+    try {
+        await probeMemoryEmbeddingSelection({
+            provider,
+            endpoint,
+            model: embeddings.model,
+            expectedDimension: embeddings.dim ?? 768,
+            timeoutMs: BUJO_PROBE_TIMEOUT_MS,
+            ...(apiKey === undefined ? {} : { apiKey }),
+        });
+        return [];
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        if (/HTTP 401/u.test(reason)) {
+            return [
+                `[WARN] ${label} authentication failed at ${endpoint} (HTTP 401). ` +
+                    "Set the configured embeddings apiKeyEnv to a valid bearer token and retry.",
+            ];
+        }
+        if (/could not connect|timed out/iu.test(reason)) {
+            return [
+                `[WARN] ${label} not reachable at ${endpoint}; embeddings will fail at runtime (${reason}). ` +
+                    `Start ${label} or fix the endpoint.`,
+            ];
+        }
+        if (provider === "ollama" && /HTTP 404/u.test(reason)) {
+            return [
+                `[WARN] Ollama embedding model ${embeddings.model} could not be proved at ${endpoint} (${reason}); ` +
+                    `run \`ollama pull ${embeddings.model}\` and verify its embedding capability.`,
+            ];
+        }
+        return [
+            `[WARN] ${label} embedding readiness failed for ${embeddings.model} at ${endpoint} (${reason}). ` +
+                "Verify the selected model, authentication, and configured dimension.",
+        ];
+    }
+}
 async function memoryRootWritableWarnings(mode, memoryPath, allowFilesystemWrites) {
     if (allowFilesystemWrites) {
         try {
@@ -652,18 +1516,102 @@ async function toolsSection(config, input) {
         // Under allow-all the disallow list is already folded into the "except" clause above.
         details.push(`Disallowed tools: ${config.tools.disallowedTools.join(", ")}.`);
     }
+    const directCodexModels = configuredRuntimeModels(config.runtime)
+        .filter((model) => model.sdk === "codex")
+        .map(referenceOf);
+    const directOpenCodeModels = configuredRuntimeModels(config.runtime)
+        .filter((model) => model.sdk === "opencode")
+        .map(referenceOf);
+    const claudeCliModels = [
+        { model: config.runtime.model, executionMode: config.runtime.executionMode },
+        ...configuredRuntimeFallbackModels(config.runtime).map((model) => ({
+            model,
+            executionMode: defaultExecutionModeForModel(model),
+        })),
+    ]
+        .filter(({ model, executionMode }) => model.sdk === "claude" && executionMode === "cli")
+        .map(({ model }) => referenceOf(model));
+    const exactAllowAll = hasExactAllowAllToolPolicy(config.tools);
+    const dedicatedNoToolsProbe = input.codexNoToolsProbe === true
+        && allowedTools.length === 0
+        && config.tools.disallowedTools.length === 0;
+    if (directCodexModels.length > 0
+        && !dedicatedNoToolsProbe
+        && !exactAllowAll) {
+        status = "error";
+        details.push(`Direct Codex model${directCodexModels.length === 1 ? "" : "s"} ${directCodexModels.join(", ")} cannot enforce ` +
+            "tools.allowedTools/tools.disallowedTools. Use exact allow-all (allowedTools: [\"*\"] with no disallowedTools), " +
+            "or select a runtime that supports restrictive tool policies.");
+    }
+    if (directOpenCodeModels.length > 0 && !exactAllowAll) {
+        status = "error";
+        details.push(`Direct OpenCode model${directOpenCodeModels.length === 1 ? "" : "s"} ${directOpenCodeModels.join(", ")} cannot enforce ` +
+            "tools.allowedTools/tools.disallowedTools. Use exact allow-all (allowedTools: [\"*\"] with no disallowedTools), " +
+            "or use a Pi runtime (including pi:opencode-go:*).");
+    }
+    if (claudeCliModels.length > 0 && allowedTools.length === 0) {
+        status = "error";
+        details.push(`Claude CLI model${claudeCliModels.length === 1 ? "" : "s"} ${claudeCliModels.join(", ")} cannot enforce an empty ` +
+            "tools.allowedTools list because omitting --tools enables Claude Code's default tool set. Use Claude SDK for a chat-only agent, or configure a non-empty enforceable tool list.");
+    }
+    let configuredMcpServerNames = [];
+    let configuredMcpServers = {};
     if (config.tools.mcpConfigPath !== undefined) {
         if (await pathExists(config.tools.mcpConfigPath)) {
             details.push(`MCP config: ${config.tools.mcpConfigPath}`);
+            try {
+                const policy = await loadToolPolicyFromJsonFile(config.tools.mcpConfigPath);
+                configuredMcpServers = policy.mcpServers ?? {};
+                configuredMcpServerNames = Object.keys(configuredMcpServers);
+            }
+            catch {
+                status = "error";
+                details.push(`MCP config is malformed or unreadable: ${config.tools.mcpConfigPath}`);
+            }
         }
         else {
             status = "error";
             details.push(`MCP config file is missing: ${config.tools.mcpConfigPath}`);
         }
     }
+    for (const serverName of config.tools.mcpRequestContextServers ?? []) {
+        if (!isValidMcpServerName(serverName)) {
+            status = "error";
+            details.push(`tools.mcpRequestContextServers entry "${serverName}" is not a runtime-valid MCP server name (letters, digits, underscores, and hyphens only).`);
+            continue;
+        }
+        const spec = configuredMcpServers[serverName];
+        if (spec === undefined) {
+            status = "error";
+            details.push(`tools.mcpRequestContextServers names unknown MCP server "${serverName}"; declare it in tools.mcpConfigPath.`);
+            continue;
+        }
+        if (!isStdioMcpServerSpec(spec)) {
+            status = "error";
+            details.push(`tools.mcpRequestContextServers entry "${serverName}" must reference a stdio MCP server (command/type:stdio), not HTTP/SSE.`);
+        }
+    }
+    for (const serverName of config.tools.continuationServers ?? []) {
+        if (!isValidMcpServerName(serverName)) {
+            status = "error";
+            details.push(`tools.continuationServers entry "${serverName}" is not a runtime-valid MCP server name (letters, digits, underscores, and hyphens only).`);
+            continue;
+        }
+        const spec = configuredMcpServers[serverName];
+        if (spec === undefined) {
+            status = "error";
+            details.push(`tools.continuationServers names unknown MCP server "${serverName}"; declare it in tools.mcpConfigPath.`);
+            continue;
+        }
+        if (classifyContinuationMcpServerTransport(spec) === "unsupported") {
+            status = "error";
+            details.push(`tools.continuationServers entry "${serverName}" must reference a stdio or loopback HTTP MCP server; remote HTTP and SSE are not supported.`);
+        }
+    }
     const adapterSendTools = await resolveAdapterSendToolsSettings(input, {
         allowedTools: config.tools.allowedTools,
         disallowedTools: config.tools.disallowedTools,
+        suppressInteractionTools: directOpenCodeModels.length > 0,
     });
     if (adapterSendTools === undefined) {
         details.push("No adapter-derived send tools enabled.");
@@ -671,9 +1619,518 @@ async function toolsSection(config, input) {
     else {
         details.push(`Adapter send tools: ${adapterSendToolNames(adapterSendTools).join(", ")}.`);
     }
+    const blockedAdapterEndpoints = await adapterSendToolNetworkPolicyWarnings(config, input, adapterSendTools, directOpenCodeModels.length > 0);
+    if (blockedAdapterEndpoints.length > 0) {
+        if (status !== "error") {
+            status = "waiting";
+        }
+        details.push(...blockedAdapterEndpoints);
+    }
+    const effectiveMcpSources = effectiveMcpRuntimeSources(config, configuredMcpServerNames, adapterSendTools === undefined ? [] : adapterSendToolNames(adapterSendTools));
+    if (directOpenCodeModels.length > 0 && effectiveMcpSources.length > 0) {
+        status = "error";
+        details.push(`Direct OpenCode model${directOpenCodeModels.length === 1 ? "" : "s"} ${directOpenCodeModels.join(", ")} cannot safely consume ` +
+            `MCP runtime options from ${effectiveMcpSources.join("; ")}. Disable those MCP sources or use a Pi runtime (including pi:opencode-go:*).`);
+    }
     return { id: "tools", label: "Tools & MCP", status, details };
 }
+async function continuationSection(config, input) {
+    let settings;
+    try {
+        settings = await loadContinuationSettings({
+            cwd: input.cwd,
+            configPath: input.configPath,
+            env: input.env,
+        });
+    }
+    catch (error) {
+        return {
+            id: "continuations",
+            label: "Durable continuations",
+            status: "error",
+            details: [`Continuation configuration is invalid: ${continuationReason(error)}`],
+        };
+    }
+    const continuationServers = config.tools.continuationServers ?? [];
+    if (!settings.configured && continuationServers.length === 0) {
+        return {
+            id: "continuations",
+            label: "Durable continuations",
+            status: "disabled",
+            details: ["No continuation-capable MCP servers or detached continuation routes are configured."],
+        };
+    }
+    if (!settings.enabled) {
+        return {
+            id: "continuations",
+            label: "Durable continuations",
+            status: "error",
+            details: ["Continuation service is disabled while continuation functionality is configured."],
+        };
+    }
+    const details = [
+        `Loopback service: http://${formatContinuationHost(settings.host)}:${String(settings.port)}.`,
+        `Owner-only state: ${settings.stateDir}.`,
+        continuationServers.length === 0
+            ? "Run-scoped continuation MCP servers: none."
+            : `Run-scoped continuation MCP servers: ${continuationServers.join(", ")}.`,
+    ];
+    const routeNames = Object.entries(settings.namedRoutes).map(([name, route]) => `${name} (${route.mode})`);
+    details.push(routeNames.length === 0 ? "Named detached routes: none." : `Named detached routes: ${routeNames.join(", ")}.`);
+    const detachedNames = Object.keys(settings.detachedServices);
+    details.push(detachedNames.length === 0 ? "Detached services: none." : `Detached services: ${detachedNames.join(", ")}.`);
+    const state = await inspectContinuationState(settings.stateDir);
+    details.push(...state.details);
+    return {
+        id: "continuations",
+        label: "Durable continuations",
+        status: state.status,
+        details,
+    };
+}
+async function inspectContinuationState(stateDir) {
+    const details = [];
+    let directory;
+    try {
+        directory = await lstat(stateDir);
+    }
+    catch (error) {
+        if (continuationFsCode(error) === "ENOENT") {
+            return {
+                status: "ok",
+                details: ["State has not been initialized; the app will create it with owner-only permissions on first start."],
+            };
+        }
+        return { status: "error", details: [`Continuation state cannot be inspected: ${continuationReason(error)}`] };
+    }
+    if (!directory.isDirectory() || directory.isSymbolicLink()) {
+        return { status: "error", details: ["Continuation state path must be a real directory, not a file or symlink."] };
+    }
+    const directorySecurityError = continuationOwnershipError(directory, "state directory", 0o700);
+    if (directorySecurityError !== undefined) {
+        return { status: "error", details: [directorySecurityError] };
+    }
+    const secretError = await inspectContinuationSecret(join(stateDir, "continuation-secret"));
+    if (secretError !== undefined) {
+        return { status: "error", details: [secretError] };
+    }
+    const manifestPath = join(stateDir, "continuation-store-v2.json");
+    let manifestInfo;
+    try {
+        manifestInfo = await lstat(manifestPath);
+    }
+    catch (error) {
+        if (continuationFsCode(error) !== "ENOENT") {
+            return { status: "error", details: [`Continuation store manifest cannot be inspected: ${continuationReason(error)}`] };
+        }
+    }
+    if (manifestInfo !== undefined) {
+        if (!manifestInfo.isFile() || manifestInfo.isSymbolicLink()) {
+            return { status: "error", details: ["Continuation store manifest must be a regular file, not a symlink."] };
+        }
+        const manifestSecurityError = continuationOwnershipError(manifestInfo, "store manifest", 0o600);
+        if (manifestSecurityError !== undefined)
+            return { status: "error", details: [manifestSecurityError] };
+        let manifest;
+        try {
+            manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+        }
+        catch (error) {
+            return { status: "error", details: [`Continuation store manifest contains invalid JSON: ${continuationReason(error)}`] };
+        }
+        if (!isContinuationStoreManifest(manifest)) {
+            return { status: "error", details: ["Continuation store manifest has an unsupported or malformed schema."] };
+        }
+        const recordsDirectoryError = await inspectContinuationRecordsDirectory(join(stateDir, "records-v2"));
+        if (recordsDirectoryError !== undefined)
+            return { status: "error", details: [recordsDirectoryError] };
+        const transaction = await inspectContinuationTransaction(join(stateDir, "continuation-transaction-v2.json"));
+        if (!transaction.valid)
+            return { status: "error", details: [transaction.detail] };
+        const owner = await inspectContinuationOwnerDatabase(join(stateDir, "continuations-owner.sqlite"));
+        if (!owner.valid)
+            return { status: "error", details: [owner.detail] };
+        details.push(`Store v2: ${String(manifest.stats.records)} retained; ${String(manifest.stats.active)} active; ${String(manifest.stats.unresolvedDelivery)} delivery unknown; ${String(manifest.stats.deadLettered)} dead-lettered; ${String(manifest.stats.historyDegraded)} history-degraded deliveries; ${String(manifest.stats.terminalTombstones)} terminal tombstones; ${String(manifest.stats.capturedText)} captured answers.`, `Retention: at most ${String(manifest.stats.limits.terminalMaxRecords)} terminal tombstones and ${String(manifest.stats.limits.capturedTextMaxRecords)} captured answers.`, transaction.detail, owner.detail);
+        return {
+            status: transaction.pending
+                || manifest.stats.unresolvedDelivery > 0
+                || manifest.stats.deadLettered > 0
+                || manifest.stats.historyDegraded > 0
+                ? "waiting"
+                : "ok",
+            details,
+        };
+    }
+    const storePath = join(stateDir, "continuations-v1.json");
+    let storeInfo;
+    try {
+        storeInfo = await lstat(storePath);
+    }
+    catch (error) {
+        if (continuationFsCode(error) === "ENOENT") {
+            details.push("No continuation ledger has been written yet.");
+            const owner = await inspectContinuationOwnerDatabase(join(stateDir, "continuations-owner.sqlite"));
+            details.push(owner.detail);
+            return { status: owner.valid ? "ok" : "error", details };
+        }
+        return { status: "error", details: [`Continuation ledger cannot be inspected: ${continuationReason(error)}`] };
+    }
+    if (!storeInfo.isFile() || storeInfo.isSymbolicLink()) {
+        return { status: "error", details: ["Continuation ledger must be a regular file, not a symlink."] };
+    }
+    const storeSecurityError = continuationOwnershipError(storeInfo, "ledger", 0o600);
+    if (storeSecurityError !== undefined) {
+        return { status: "error", details: [storeSecurityError] };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(storePath, "utf8"));
+    }
+    catch (error) {
+        return { status: "error", details: [`Continuation ledger contains invalid JSON: ${continuationReason(error)}`] };
+    }
+    if (!isContinuationLedger(parsed)) {
+        return { status: "error", details: ["Continuation ledger has an unsupported or malformed schema."] };
+    }
+    const counts = Object.fromEntries(CONTINUATION_STATES.map((state) => [state, 0]));
+    for (const record of Object.values(parsed.records)) {
+        if (!isDoctorObject(record) || typeof record.state !== "string" || !CONTINUATION_STATES.includes(record.state)) {
+            return { status: "error", details: ["Continuation ledger contains a record with an invalid lifecycle state."] };
+        }
+        counts[record.state] += 1;
+    }
+    const total = Object.values(counts).reduce((sum, count) => sum + count, 0);
+    const pending = counts.claimed + counts.result_received + counts.synthesizing + counts.ready_to_deliver + counts.delivery_retry;
+    details.push(`Legacy ledger awaiting v2 migration: ${String(total)} total; ${String(pending)} pending; ${String(counts.delivery_unknown)} delivery unknown; ${String(counts.dead_lettered)} dead-lettered.`);
+    const owner = await inspectContinuationOwnerDatabase(join(stateDir, "continuations-owner.sqlite"));
+    details.push(owner.detail);
+    return {
+        status: !owner.valid
+            ? "error"
+            : counts.delivery_unknown > 0 || counts.dead_lettered > 0
+                ? "waiting"
+                : "ok",
+        details,
+    };
+}
+async function inspectContinuationSecret(path) {
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (error) {
+        return continuationFsCode(error) === "ENOENT"
+            ? undefined
+            : `Continuation secret cannot be inspected: ${continuationReason(error)}`;
+    }
+    if (!info.isFile() || info.isSymbolicLink())
+        return "Continuation secret must be a regular file, not a symlink.";
+    const securityError = continuationOwnershipError(info, "secret", 0o600);
+    if (securityError !== undefined)
+        return securityError;
+    try {
+        const secret = Buffer.from((await readFile(path, "utf8")).trim(), "base64url");
+        if (secret.length !== 32)
+            return "Continuation secret contents are invalid.";
+    }
+    catch (error) {
+        return `Continuation secret cannot be read: ${continuationReason(error)}`;
+    }
+    return undefined;
+}
+async function inspectContinuationOwnerDatabase(path) {
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (error) {
+        return continuationFsCode(error) === "ENOENT"
+            ? { valid: true, detail: "The OS-backed continuation ownership database has not been initialized yet." }
+            : { valid: false, detail: `Continuation ownership database cannot be inspected: ${continuationReason(error)}` };
+    }
+    if (!info.isFile() || info.isSymbolicLink()) {
+        return { valid: false, detail: "Continuation ownership database is not a regular file." };
+    }
+    const securityError = continuationOwnershipError(info, "ownership database", 0o600);
+    if (securityError !== undefined)
+        return { valid: false, detail: securityError };
+    return { valid: true, detail: "OS-backed exclusive ownership is released automatically on clean stop or process death." };
+}
+async function inspectContinuationRecordsDirectory(path) {
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (error) {
+        return continuationFsCode(error) === "ENOENT"
+            ? "Continuation record directory is missing."
+            : `Continuation record directory cannot be inspected: ${continuationReason(error)}`;
+    }
+    if (!info.isDirectory() || info.isSymbolicLink()) {
+        return "Continuation record directory must be a real directory, not a file or symlink.";
+    }
+    const directorySecurityError = continuationOwnershipError(info, "record directory", 0o700);
+    if (directorySecurityError !== undefined)
+        return directorySecurityError;
+    try {
+        for (const entry of await readdir(path, { withFileTypes: true })) {
+            if (!entry.name.endsWith(".json") && !(entry.name.startsWith(".") && entry.name.endsWith(".tmp"))) {
+                return `Continuation record directory contains an unexpected entry: ${entry.name}.`;
+            }
+            const recordInfo = await lstat(join(path, entry.name));
+            if (!recordInfo.isFile() || recordInfo.isSymbolicLink()) {
+                return `Continuation record entry is not a regular file: ${entry.name}.`;
+            }
+            const securityError = continuationOwnershipError(recordInfo, "record", 0o600);
+            if (securityError !== undefined)
+                return securityError;
+        }
+    }
+    catch (error) {
+        return `Continuation record directory cannot be inspected: ${continuationReason(error)}`;
+    }
+    return undefined;
+}
+async function inspectContinuationTransaction(path) {
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (error) {
+        return continuationFsCode(error) === "ENOENT"
+            ? { valid: true, pending: false, detail: "No interrupted durable transaction is awaiting recovery." }
+            : { valid: false, pending: false, detail: `Continuation transaction cannot be inspected: ${continuationReason(error)}` };
+    }
+    if (!info.isFile() || info.isSymbolicLink()) {
+        return { valid: false, pending: true, detail: "Continuation transaction must be a regular file, not a symlink." };
+    }
+    const securityError = continuationOwnershipError(info, "transaction", 0o600);
+    if (securityError !== undefined)
+        return { valid: false, pending: true, detail: securityError };
+    return {
+        valid: true,
+        pending: true,
+        detail: "An interrupted durable transaction is present and will be completed idempotently by the state owner.",
+    };
+}
+function continuationOwnershipError(info, label, expectedMode) {
+    if (typeof process.getuid === "function" && Number(info.uid) !== process.getuid()) {
+        return `Continuation ${label} is not owned by the current user.`;
+    }
+    if (process.platform !== "win32" && (Number(info.mode) & 0o777) !== expectedMode) {
+        return `Continuation ${label} permissions must be ${expectedMode.toString(8)}.`;
+    }
+    return undefined;
+}
+function isContinuationLedger(value) {
+    return isDoctorObject(value)
+        && value.schemaVersion === CONTINUATION_STORE_SCHEMA_VERSION
+        && isDoctorObject(value.records);
+}
+function isContinuationStoreManifest(value) {
+    if (!isDoctorObject(value)
+        || value.schemaVersion !== CONTINUATION_RECORD_STORE_SCHEMA_VERSION
+        || typeof value.generation !== "string"
+        || !isDoctorObject(value.stats)
+        || value.stats.format !== "per-record-v2"
+        || !isDoctorObject(value.stats.limits))
+        return false;
+    return [
+        value.stats.records,
+        value.stats.active,
+        value.stats.unresolvedDelivery,
+        value.stats.deadLettered,
+        value.stats.historyDegraded,
+        value.stats.terminalTombstones,
+        value.stats.compacted,
+        value.stats.capturedText,
+        value.stats.limits.terminalMaxRecords,
+        value.stats.limits.terminalMaxAgeMs,
+        value.stats.limits.capturedTextMaxRecords,
+        value.stats.limits.capturedTextMaxAgeMs,
+    ].every((entry) => Number.isSafeInteger(entry) && Number(entry) >= 0);
+}
+function isDoctorObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function continuationFsCode(error) {
+    return isDoctorObject(error) && typeof error.code === "string" ? error.code : undefined;
+}
+function continuationReason(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function formatContinuationHost(host) {
+    return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+/**
+ * Adapter-send tools run in a stdio MCP child governed by the native SRT
+ * policy. Channel readiness alone therefore is not enough: the child also
+ * needs the remote adapter API (or the app-owned interaction bridge) admitted
+ * by sandbox.network.
+ */
+async function adapterSendToolNetworkPolicyWarnings(config, input, settings, suppressInteractionTools) {
+    if (config.sandbox === undefined || config.sandbox.mode !== "native") {
+        return [];
+    }
+    const toolNames = settings === undefined ? [] : adapterSendToolNames(settings);
+    const requirements = [];
+    if (settings?.slack !== undefined) {
+        requirements.push({
+            label: "Slack adapter-send API",
+            tools: ["SlackSendMessage"],
+            url: "https://slack.com/api",
+        });
+    }
+    if (settings?.telegram !== undefined) {
+        requirements.push({
+            label: "Telegram adapter-send API",
+            tools: toolNames.filter((name) => name.startsWith("Telegram")),
+            url: settings.telegram.apiRoot ?? "https://api.telegram.org",
+        });
+    }
+    const askUserAllowed = !suppressInteractionTools && isAdapterSendToolAllowed("AskUser", {
+        allowedTools: config.tools.allowedTools,
+        disallowedTools: config.tools.disallowedTools,
+    });
+    const bridgeTools = [
+        ...(askUserAllowed ? ["AskUser"] : []),
+        ...(toolNames.includes("TelegramAskButtons") ? ["TelegramAskButtons"] : []),
+    ];
+    if (bridgeTools.length > 0) {
+        const configuredBridgeUrl = input.env.MONO_AGENT_INTERACTION_BRIDGE_URL?.trim();
+        const interaction = await loadInteractionSettings(input);
+        const bridgeUrl = configuredBridgeUrl === undefined || configuredBridgeUrl.length === 0
+            ? formatInteractionBridgeUrl(interaction.host, interaction.port)
+            : configuredBridgeUrl;
+        requirements.push({ label: "AskUser interaction bridge", tools: bridgeTools, url: bridgeUrl });
+    }
+    return requirements.flatMap((requirement) => {
+        if (adapterSendChildNetworkAllowsUrl(config, requirement.url)) {
+            return [];
+        }
+        const host = endpointHost(requirement.url);
+        const allowlistHost = host === "::1" ? "localhost" : host;
+        return [
+            `Native sandbox network policy blocks ${requirement.label} host "${host}", required by ${requirement.tools.join(", ")}. ` +
+                `Set sandbox.network.mode to "allowlist" and add "${allowlistHost}" to sandbox.network.allowlist, ` +
+                `or disable ${requirement.tools.join(", ")}.`,
+        ];
+    });
+}
+function adapterSendChildNetworkAllowsUrl(config, url) {
+    if (networkPolicyAllowsUrl(config.sandbox, url))
+        return true;
+    if (config.sandbox?.mode !== "native" || config.sandbox.network.mode !== "allowlist")
+        return false;
+    const host = endpointHost(url);
+    return isLoopbackEndpointHost(host) && config.sandbox.network.allowlist.some(isLoopbackEndpointHost);
+}
+function isLoopbackEndpointHost(host) {
+    return host === "localhost" || host === "::1" || (isIP(host) === 4 && host.split(".")[0] === "127");
+}
+function endpointHost(url) {
+    try {
+        const host = new URL(url).hostname.toLowerCase();
+        return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+    }
+    catch {
+        return url;
+    }
+}
+function effectiveMcpRuntimeSources(config, configuredMcpServerNames, adapterToolNames) {
+    const sources = [];
+    if (configuredMcpServerNames.length > 0) {
+        sources.push(`tools.mcpConfigPath (${configuredMcpServerNames.join(", ")})`);
+    }
+    if (config.memory?.recallTool?.enabled === true) {
+        sources.push("memory.recallTool");
+    }
+    if (config.memory?.backend === "supermemory"
+        && config.memory.supermemory?.exposeMcpServer === true
+        && config.memory.supermemory.apiKey !== undefined) {
+        sources.push("memory.supermemory.exposeMcpServer");
+    }
+    if (adapterToolNames.length > 0) {
+        sources.push(`adapter send tools (${adapterToolNames.join(", ")})`);
+    }
+    return sources;
+}
 async function sandboxSection(config, engine) {
+    const runtimeModels = configuredRuntimeModels(config.runtime);
+    const directCodexRefs = runtimeModels
+        .filter((model) => model.sdk === "codex")
+        .map((model) => model.reference ?? `codex:${model.model}`);
+    const claudeRefs = runtimeModels
+        .filter((model) => model.sdk === "claude")
+        .map((model) => model.reference ?? `claude:${model.model}`);
+    const directOpenCodeRefs = runtimeModels
+        .filter((model) => model.sdk === "opencode")
+        .map((model) => model.reference ?? `opencode:${model.provider ?? "unknown"}:${model.model}`);
+    const routeSafety = config.runtime.routeSafety ?? "uniform";
+    if (routeSafety === "per-route-native") {
+        const monoSandboxActive = config.sandbox !== undefined && config.sandbox.mode !== "off";
+        const piRoutes = runtimeModels.filter((model) => model.sdk === "pi");
+        const details = runtimeModels.map((model, index) => routeNativeSafetyDetail(model, index, config));
+        let status = !monoSandboxActive && piRoutes.length > 0 ? "disabled" : "ok";
+        if (monoSandboxActive && piRoutes.length > 0) {
+            const state = await resolveSandboxEffectiveState({
+                policy: config.sandbox,
+                ...(engine === undefined ? {} : { engine }),
+            });
+            const warning = sandboxEffectiveStateWarning(state);
+            details.push(`Pi route SRT policy: mode ${config.sandbox.mode}, network ${config.sandbox.network.mode}, fallback ${config.sandbox.fallback}.`, describeSandboxEffectiveState(state), ...(warning === undefined ? [] : [warning]));
+            if (warning !== undefined || state.effective === "blocked")
+                status = "waiting";
+        }
+        else if (piRoutes.length > 0) {
+            details.push("Pi route SRT policy: disabled; Bash and stdio MCP subprocesses run unsandboxed.");
+        }
+        else if (monoSandboxActive) {
+            details.push("The configured mono-agent SRT policy has no Pi route to enforce it; provider-owned route contracts below apply instead.");
+            status = "waiting";
+        }
+        if (monoSandboxActive && runtimeModels.some((model) => model.sdk !== "pi")) {
+            details.push("[WARN] Per-route-native explicitly does not project mono-agent readableRoots, writableRoots, denyWrite, or network rules onto non-Pi routes; review each route contract before start.");
+            status = "waiting";
+        }
+        if (runtimeModels.some((model) => model.sdk === "codex") && config.runtime.permissionMode === "bypassPermissions") {
+            status = "waiting";
+        }
+        return { id: "sandbox", label: "Sandbox", status, details };
+    }
+    const incompatibleDetails = [];
+    if (config.sandbox !== undefined && config.sandbox.mode !== "off" && directCodexRefs.length > 0) {
+        const codexPosture = directCodexSandboxPosture(config.runtime.permissionMode);
+        incompatibleDetails.push(`Native mono-agent sandbox policy cannot govern direct Codex runtime${directCodexRefs.length === 1 ? "" : "s"}: ${directCodexRefs.join(", ")}.`, `${codexPosture.detail} Remove the mono-agent sandbox block or use Pi when exact srt roots, denyWrite, or network policy are required.`);
+    }
+    if (config.sandbox !== undefined && config.sandbox.mode !== "off" && claudeRefs.length > 0) {
+        incompatibleDetails.push(`Native mono-agent sandbox policy cannot govern Claude runtime${claudeRefs.length === 1 ? "" : "s"}: ${claudeRefs.join(", ")}.`, "Claude's provider-owned tool loop does not consume mono-agent sandboxPolicy. Set sandbox.mode to off, remove the sandbox block, or use a Pi runtime when mono-agent srt enforcement is required.");
+    }
+    if (config.sandbox !== undefined && config.sandbox.mode !== "off" && directOpenCodeRefs.length > 0) {
+        incompatibleDetails.push(`Native mono-agent sandbox policy cannot govern direct OpenCode runtime${directOpenCodeRefs.length === 1 ? "" : "s"}: ${directOpenCodeRefs.join(", ")}.`, "Direct OpenCode's provider-owned tool loop does not consume mono-agent sandboxPolicy. Set sandbox.mode to off, remove the sandbox block, or use a pi:opencode-go:* runtime when mono-agent srt enforcement is required.");
+    }
+    if (incompatibleDetails.length > 0) {
+        return {
+            id: "sandbox",
+            label: "Sandbox",
+            status: "error",
+            details: incompatibleDetails,
+        };
+    }
+    if (directCodexRefs.length > 0 && (config.sandbox === undefined || config.sandbox.mode === "off")) {
+        const posture = directCodexSandboxPosture(config.runtime.permissionMode);
+        return {
+            id: "sandbox",
+            label: "Sandbox",
+            status: posture.status,
+            details: [
+                posture.detail,
+                config.sandbox === undefined
+                    ? "No mono-agent native srt policy is configured."
+                    : "The mono-agent native srt policy is explicitly off; the Codex-native posture still applies.",
+            ],
+        };
+    }
     if (config.sandbox === undefined) {
         return { id: "sandbox", label: "Sandbox", status: "disabled", details: ["No sandbox policy configured."] };
     }
@@ -701,6 +2158,44 @@ async function sandboxSection(config, engine) {
         details,
     };
 }
+function routeNativeSafetyDetail(model, index, config) {
+    const label = index === 0 ? "Primary" : `Fallback ${index}`;
+    const ref = referenceOf(model);
+    if (model.sdk === "pi") {
+        if (config.sandbox === undefined || config.sandbox.mode === "off") {
+            return `${label} ${ref}: Pi-owned tools use mono-agent tool policy; SRT is disabled, so Bash and stdio MCP subprocesses run unsandboxed.`;
+        }
+        if (config.sandbox.fallback === "unsafe-host-process") {
+            return `${label} ${ref}: Pi-owned tools use the configured mono-agent SRT policy; its explicit unsafe-host-process fallback can run subprocesses unsandboxed when SRT is unavailable.`;
+        }
+        return `${label} ${ref}: Pi-owned tools use the configured mono-agent SRT policy and fail closed when it is unavailable.`;
+    }
+    if (model.sdk === "claude") {
+        return `${label} ${ref}: Claude provider-owned permissions apply; mono-agent SRT filesystem/network rules are not projected.`;
+    }
+    if (model.sdk === "codex") {
+        return `${label} ${ref}: ${directCodexSandboxPosture(config.runtime.permissionMode).detail}`;
+    }
+    return `${label} ${ref}: OpenCode provider-owned execution with exact allow-all tool policy applies; mono-agent SRT rules are not projected.`;
+}
+function directCodexSandboxPosture(permissionMode) {
+    if (permissionMode === "bypassPermissions") {
+        return {
+            status: "waiting",
+            detail: "[WARN] Direct Codex bypassPermissions uses native danger-full-access with no filesystem or network sandbox; unattended approval prompts are still disabled.",
+        };
+    }
+    if (permissionMode === "plan") {
+        return {
+            status: "ok",
+            detail: "Direct Codex plan mode uses its native read-only sandbox with network disabled; unattended escalation requests are denied.",
+        };
+    }
+    return {
+        status: "ok",
+        detail: "Direct Codex default/acceptEdits mode uses its native workspace-write sandbox with network disabled; unattended escalation requests are denied.",
+    };
+}
 async function runsSection(input, config) {
     const artifactDir = await resolveAppArtifactDir(input);
     const { totalRuns, runs, warnings } = await listRecordedRuns({ artifactDir, maxRuns: RUNS_HEALTH_MAX_RUNS, scope: "agent" });