@nathapp/nax 0.82.0 → 0.82.1

package/README.md

@@ -145,7 +145,7 @@ For full flag details, see the [CLI Reference](docs/guides/cli-reference.md).
 
 `execution.commandInterceptor` rewrites the `Git` tool's argv through `rtk` so `log` and `diff` output reaches the model compressed. It is confined to the Git site: user-authored `quality.commands` and `acceptance.command` are never wrapped. It fails open — if the `rtk` binary is missing the call runs as plain git.
 
-**Both features are native-agent only.** An ACP agent (`claude`, `codex`, `opencode`, `gemini`) brings its own tools, so nax's `Git` tool is never invoked and no MCP tool is advertised. A project on `"protocol": "acp"` can hold a complete, valid config for both and get zero effect, with no error. Set `agent.protocol: "hybrid"` and `agent.default: "native"` first.
+**Both features are native-agent only.** An ACP agent (`claude`, `codex`, `opencode`, `gemini`) brings its own tools, so nax's `Git` tool is never invoked and no MCP tool is advertised. A project on `"protocol": "acp"` can hold a complete, valid config for both and get zero effect, with no error. The built-in defaults (`agent.protocol: "hybrid"`, `agent.default: "native"`) enable both; a config that switches to an acpx agent does not.
 
 See [MCP & Command Interception](docs/guides/mcp-and-interception.md) for setup, verification and troubleshooting, and the [Configuration Guide](docs/guides/configuration.md) for the full schema.
 
@@ -209,11 +209,12 @@ See [Plugins Guide](docs/guides/agents.md#plugins).
 
 ## Agents
 
-nax communicates with all coding agents via [ACP](https://github.com/openclaw/acpx) (Agent Client Protocol) — a JSON-RPC protocol that provides persistent sessions, exact token/cost reporting, and multi-turn session continuity.
+The default agent is `native`: nax drives the model in-process over `@nathapp/nax-ai` (no CLI binary), using the built-in `models.native` Anthropic tier map, so it needs Anthropic credentials (`nax auth` or the provider's environment variable) unless you override the map. Every other agent is reached via [ACP](https://github.com/openclaw/acpx) (Agent Client Protocol) — a JSON-RPC protocol that provides persistent sessions, exact token/cost reporting, and multi-turn session continuity.
 
 | Agent | Binary | Notes |
 |:------|:-------|:------|
-| Claude Code | `claude` | Default. Set `agent.default: "claude"` |
+| Native (nax-ai) | — (in-process) | Default. `agent.default: "native"` |
+| Claude Code | `claude` | Set `agent.default: "claude"` |
 | OpenCode | `opencode` | Set `agent.default: "opencode"` |
 | Codex | `codex` | Set `agent.default: "codex"` |
 | Gemini CLI | `gemini` | Set `agent.default: "gemini"` |

package/dist/nax.js

@@ -2668,7 +2668,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@nathapp/nax",
-    version: "0.82.0",
+    version: "0.82.1",
     description: "AI Coding Agent Orchestrator \u2014 loops until done",
     type: "module",
     bin: {
@@ -4047,6 +4047,26 @@ var init_types2 = __esm(() => {
   };
 });
 
+// src/config/agent-defaults.ts
+function isBuiltInModelMap(agent, entry) {
+  if (!Object.hasOwn(DEFAULT_MODEL_MAPS, agent) || typeof entry !== "object" || entry === null)
+    return false;
+  const builtIn = DEFAULT_MODEL_MAPS[agent];
+  const tiers = Object.entries(entry);
+  return tiers.length === Object.keys(builtIn).length && tiers.every(([tier, value]) => Object.hasOwn(builtIn, tier) && builtIn[tier] === value);
+}
+var DEFAULT_AGENT_PROTOCOL = "hybrid", DEFAULT_AGENT_NAME = "native", NATIVE_AGENT_NAME = "native", DEFAULT_MODEL_MAPS;
+var init_agent_defaults = __esm(() => {
+  DEFAULT_MODEL_MAPS = {
+    claude: { fast: "haiku", balanced: "sonnet", powerful: "opus" },
+    native: {
+      fast: "anthropic/claude-haiku-4-5",
+      balanced: "anthropic/claude-sonnet-5",
+      powerful: "anthropic/claude-opus-5-5"
+    }
+  };
+});
+
 // node_modules/zod/v4/core/core.js
 function $constructor(name, initializer, params) {
   function init(inst, def) {
@@ -17936,7 +17956,7 @@ var init_schemas_sandbox = __esm(() => {
   SANDBOX_GLOB_CHARS = /[*?[\]{}]/;
   literalPath = exports_external.string().refine((p) => !SANDBOX_GLOB_CHARS.test(p), "sandbox paths must be literal: no * ? [ ] { } (spec F1)");
   SandboxConfigSchema = exports_external.object({
-    enabled: exports_external.boolean().default(false),
+    enabled: exports_external.boolean().default(true),
     backend: exports_external.enum(["srt"]).default("srt"),
     filesystem: exports_external.object({
       allowWrite: exports_external.array(literalPath).default([]),
@@ -18184,7 +18204,7 @@ async function runArgv(options) {
     stdoutController.abort();
     stderrController.abort();
   };
-  const timerId = setTimeout(() => {
+  const timerId = _argvExecDeps.setTimeout(() => {
     timedOut = true;
     killGroup();
     stopReaders();
@@ -18201,7 +18221,7 @@ async function runArgv(options) {
   const graceMs = _argvExecDeps.drainGraceMs;
   let graceTimerId;
   const gracePromise = new Promise((resolve3) => {
-    graceTimerId = setTimeout(() => resolve3("expired"), graceMs);
+    graceTimerId = _argvExecDeps.setTimeout(() => resolve3("expired"), graceMs);
   });
   const stdoutSettled = await Promise.race([
     stdoutPromise,
@@ -18212,7 +18232,7 @@ async function runArgv(options) {
     gracePromise.then(() => "expired")
   ]);
   if (graceTimerId !== undefined)
-    clearTimeout(graceTimerId);
+    _argvExecDeps.clearTimeout(graceTimerId);
   const stdoutClosed = stdoutSettled !== "expired";
   const stderrClosed = stderrSettled !== "expired";
   if (!stdoutClosed || !stderrClosed) {
@@ -18225,7 +18245,7 @@ async function runArgv(options) {
   }
   const stdoutFinal = stdoutClosed ? stdoutSettled : await stdoutPromise;
   const stderrFinal = stderrClosed ? stderrSettled : await stderrPromise;
-  clearTimeout(timerId);
+  _argvExecDeps.clearTimeout(timerId);
   signal?.removeEventListener("abort", onAbort);
   return {
     exitCode,
@@ -18242,7 +18262,9 @@ var init_argv_exec = __esm(() => {
   _argvExecDeps = {
     spawn,
     killProcessGroup,
-    drainGraceMs: DRAIN_GRACE_MS
+    drainGraceMs: DRAIN_GRACE_MS,
+    setTimeout: (fn, ms) => setTimeout(fn, ms),
+    clearTimeout: (id) => clearTimeout(id)
   };
 });
 
@@ -19638,7 +19660,8 @@ ${launched.stderr}`;
           isError: launched.timedOut || launched.exitCode !== 0 || launched.aborted === true,
           audit: {
             executed: launched.executed,
-            ...launched.sandbox !== undefined ? { sandbox: launched.sandbox } : {}
+            ...launched.sandbox !== undefined ? { sandbox: launched.sandbox } : {},
+            ...!launched.timedOut && launched.aborted !== true ? { exitCode: launched.exitCode } : {}
           },
           resultBytesPreTruncation: Buffer.byteLength(body, "utf8")
         };
@@ -23563,15 +23586,36 @@ var init_types3 = __esm(() => {
 });
 
 // src/command-safety/rule-scorer.ts
-function scoreRules(command) {
+import { posix } from "path";
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function usableRoot(root) {
+  if (root === undefined || !root.startsWith("/"))
+    return;
+  const normalized = posix.normalize(root).replace(/\/+$/, "");
+  return normalized.split("/").filter(Boolean).length >= MIN_ROOT_SEGMENTS ? normalized : undefined;
+}
+function maskProjectRoot(command, root) {
+  const usable = usableRoot(root);
+  if (usable === undefined)
+    return command;
+  const underRoot = new RegExp(`(?<=^|[${PATH_END}=:])${escapeRegExp(usable)}((?:/[^${PATH_END}]*)?)(?=$|[${PATH_END}])`, "g");
+  return command.replace(underRoot, (match, rest, offset) => {
+    CLEAN_TAIL.lastIndex = offset + match.length;
+    return /\.\.|\\|,/.test(rest) || !CLEAN_TAIL.test(command) ? match : `.${rest}`;
+  });
+}
+function scoreRules(command, context = {}) {
   try {
-    const hits = Object.fromEntries(QUESTION_IDS.map((id) => [id, RULES[id].some((re) => re.test(command))]));
+    const masked = maskProjectRoot(command, context.root);
+    const hits = Object.fromEntries(QUESTION_IDS.map((id) => [id, RULES[id].some((re) => re.test(id === "outside_project" ? masked : command))]));
     return { version: RULE_SET_VERSION, hits };
   } catch (err) {
     return { version: RULE_SET_VERSION, hits: NO_HITS, error: errorMessage(err) };
   }
 }
-var RULE_SET_VERSION = 1, RULES, NO_HITS;
+var RULE_SET_VERSION = 2, RULES, NO_HITS, PATH_END, CLEAN_TAIL, MIN_ROOT_SEGMENTS = 2;
 var init_rule_scorer = __esm(() => {
   init_types3();
   RULES = {
@@ -23617,6 +23661,8 @@ var init_rule_scorer = __esm(() => {
     privilege: [/(?:^|[\s;&|(])(?:sudo|doas)\s/, /\b(?:chmod|chown|chgrp)\b/]
   };
   NO_HITS = Object.freeze(Object.fromEntries(QUESTION_IDS.map((id) => [id, false])));
+  PATH_END = String.raw`\s'"\`;&|<>()`;
+  CLEAN_TAIL = /['")]*(?=$|[\s;&|<>])/y;
 });
 
 // src/command-safety/shadow.ts
@@ -23664,6 +23710,7 @@ function createCommandShadow(opts) {
     const { obs } = entry;
     const r = model.result;
     const cwd = entry.run?.cwd ?? obs.cwd;
+    const rules = cwd !== obs.cwd ? scoreRules(obs.command, { root: cwd }) : entry.rules;
     return {
       at: _commandShadowDeps.now(),
       runId: opts.runId,
@@ -23676,7 +23723,7 @@ function createCommandShadow(opts) {
       ...cwd !== undefined ? { cwd } : {},
       mechanical: obs.mechanical,
       outcome,
-      rules: entry.rules,
+      rules,
       ...callIdentifiers(obs),
       model: {
         status: model.cached && r.status === "answered" ? "cached" : r.status,
@@ -23694,7 +23741,7 @@ function createCommandShadow(opts) {
       try {
         if (entries.has(key))
           return;
-        const entry = { obs, rules: scoreRules(obs.command), written: false };
+        const entry = { obs, rules: scoreRules(obs.command, { root: obs.cwd }), written: false };
         entries.set(key, entry);
         const { promise: promise2, cached: cached2 } = classifyCached(obs.command);
         track(inFlight2, promise2.then((result) => {
@@ -24524,6 +24571,7 @@ function createCodingToolRuntime(opts) {
       ...audit?.target !== undefined ? { target: audit.target } : {},
       ...audit?.approval !== undefined ? { approval: audit.approval } : {},
       ...audit?.sandbox !== undefined ? { sandbox: audit.sandbox } : {},
+      ...audit?.exitCode !== undefined ? { exitCode: audit.exitCode } : {},
       ...provider !== undefined ? { provider } : {},
       ...resultBytesPreTruncation !== undefined ? { resultBytesPreTruncation } : {},
       ...opts.callId !== undefined ? { callId: opts.callId } : {},
@@ -26802,6 +26850,7 @@ var init_schemas_execution = __esm(() => {
 var PlanConfigSchema, AcceptanceFixConfigSchema, AcceptanceConfigSchema, LlmRoutingConfigSchema, AgentRoutingProfileSchema, AgentRoutingConfigSchema, RoutingConfigSchema, OptimizerConfigSchema, PluginConfigEntrySchema, HooksConfigSchema, InteractionConfigSchema, StorySizeGateConfigSchema, PromptAuditConfigSchema, UsageAuditConfigSchema, FallbackTargetSchema, AgentFallbackConfigSchema, DEFAULT_AGENT_IDLE_WATCHDOG_CONFIG, AgentIdleWatchdogConfigSchema, DEFAULT_AGENT_SPIN_BREAKER_CONFIG, AgentSpinBreakerConfigSchema, AgentAcpConfigSchema, AgentNativeTransportRetryConfigSchema, AgentNativeConfigSchema, AgentTimeoutRetryConfigSchema, DEFAULT_AGENT_TIMEOUT_RETRY_CONFIG, AgentConfigSchema, PrecheckConfigSchema, PromptsConfigSchema, ProjectProfileSchema, VALID_AGENT_TYPES, GenerateConfigSchema, CuratorThresholdsSchema, CuratorRetentionConfigSchema, CuratorConfigSchema;
 var init_schemas_infra = __esm(() => {
   init_zod();
+  init_agent_defaults();
   init_schemas_model();
   PlanConfigSchema = exports_external.object({
     model: ConfiguredModelSchema,
@@ -27021,8 +27070,8 @@ var init_schemas_infra = __esm(() => {
     budgetMultiplier: 0.5
   };
   AgentConfigSchema = exports_external.object({
-    protocol: exports_external.enum(["acp", "native", "hybrid"]).default("acp"),
-    default: exports_external.string().trim().min(1, "agent.default must be non-empty").default("claude"),
+    protocol: exports_external.enum(["acp", "native", "hybrid"]).default(DEFAULT_AGENT_PROTOCOL),
+    default: exports_external.string().trim().min(1, "agent.default must be non-empty").default(DEFAULT_AGENT_NAME),
     maxInteractionTurns: exports_external.number().int().min(1).max(100).default(20),
     promptAudit: PromptAuditConfigSchema.default({ enabled: false }),
     usageAudit: UsageAuditConfigSchema.default({ enabled: false }),
@@ -27101,19 +27150,29 @@ var init_schemas_infra = __esm(() => {
 function asModelDef(entry) {
   return typeof entry === "object" && entry !== null ? entry : null;
 }
+function declaredModelAgents(models) {
+  return Object.entries(models ?? {}).filter(([agent, entry]) => !isBuiltInModelMap(agent, entry)).map(([agent]) => agent);
+}
 function validateProtocolGate(data, ctx) {
-  const protocol = data.agent?.protocol ?? DEFAULT_PROTOCOL;
-  const modelAgents = Object.keys(data.models ?? {});
-  if (protocol === DEFAULT_PROTOCOL && modelAgents.includes(NATIVE)) {
+  const protocol = data.agent?.protocol ?? DEFAULT_AGENT_PROTOCOL;
+  const modelAgents = declaredModelAgents(data.models);
+  if (protocol === "acp" && (data.agent?.default ?? DEFAULT_AGENT_NAME) === NATIVE_AGENT_NAME) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["agent", "default"],
+      message: 'agent.protocol "acp" cannot reach agent.default "native", which is also the built-in default when agent.default is unset. Set agent.default to an acpx agent such as "claude", or use agent.protocol "hybrid".'
+    });
+  }
+  if (protocol === "acp" && modelAgents.includes(NATIVE_AGENT_NAME)) {
     ctx.addIssue({
       code: "custom",
-      path: ["models", NATIVE],
+      path: ["models", NATIVE_AGENT_NAME],
       message: 'models.native requires agent.protocol "hybrid" or "native" (it is "acp"). Set agent.protocol, or remove the native entry.'
     });
   }
-  if (protocol === NATIVE) {
+  if (protocol === NATIVE_AGENT_NAME) {
     for (const agent of modelAgents) {
-      if (agent === NATIVE)
+      if (agent === NATIVE_AGENT_NAME)
         continue;
       ctx.addIssue({
         code: "custom",
@@ -27121,7 +27180,7 @@ function validateProtocolGate(data, ctx) {
         message: `agent.protocol "native" permits only models.native; "${agent}" is an acpx agent. Use "hybrid" to run both.`
       });
     }
-    if ((data.agent?.default ?? DEFAULT_AGENT) !== NATIVE) {
+    if ((data.agent?.default ?? DEFAULT_AGENT_NAME) !== NATIVE_AGENT_NAME) {
       ctx.addIssue({
         code: "custom",
         path: ["agent", "default"],
@@ -27133,7 +27192,7 @@ function validateProtocolGate(data, ctx) {
   validateFallbackLadderAgents(data, ctx);
 }
 function validateNativeModelIds(data, ctx) {
-  for (const [tier, entry] of Object.entries(data.models?.[NATIVE] ?? {})) {
+  for (const [tier, entry] of Object.entries(data.models?.[NATIVE_AGENT_NAME] ?? {})) {
     if (entry === undefined)
       continue;
     const def = asModelDef(entry);
@@ -27145,8 +27204,8 @@ function validateNativeModelIds(data, ctx) {
     const sibling = def && typeof def.provider === "string" ? def.provider.trim() : "";
     ctx.addIssue({
       code: "custom",
-      path: ["models", NATIVE, tier, ...def ? ["model"] : []],
-      message: sibling.length > 0 ? `models.${NATIVE}.${tier}.model "${modelId}" must be written "provider/model". The sibling "provider" field is not used on the native path \u2014 put it in the model id: "${sibling}/${modelId}".` : `models.${NATIVE}.${tier} "${modelId}" must be written "provider/model" (e.g. "openai/gpt-5.4-mini"). There is no default provider.`
+      path: ["models", NATIVE_AGENT_NAME, tier, ...def ? ["model"] : []],
+      message: sibling.length > 0 ? `models.${NATIVE_AGENT_NAME}.${tier}.model "${modelId}" must be written "provider/model". The sibling "provider" field is not used on the native path \u2014 put it in the model id: "${sibling}/${modelId}".` : `models.${NATIVE_AGENT_NAME}.${tier} "${modelId}" must be written "provider/model" (e.g. "openai/gpt-5.4-mini"). There is no default provider.`
     });
   }
 }
@@ -27161,12 +27220,12 @@ function rungAgent(value) {
   return;
 }
 function validateFallbackLadderAgents(data, ctx) {
-  const protocol = data.agent?.protocol ?? DEFAULT_PROTOCOL;
+  const protocol = data.agent?.protocol ?? DEFAULT_AGENT_PROTOCOL;
   if (protocol === "hybrid")
     return;
   const map2 = data.agent?.fallback?.map ?? {};
   const reject = (agent, path) => {
-    const permitted = protocol === NATIVE ? `only "${NATIVE}"` : `no native agent`;
+    const permitted = protocol === NATIVE_AGENT_NAME ? `only "${NATIVE_AGENT_NAME}"` : `no native agent`;
     ctx.addIssue({
       code: "custom",
       path,
@@ -27174,7 +27233,7 @@ function validateFallbackLadderAgents(data, ctx) {
     });
   };
   for (const [from, rungs] of Object.entries(map2)) {
-    const offending = (agent) => protocol === NATIVE ? agent !== NATIVE : agent === NATIVE;
+    const offending = (agent) => protocol === NATIVE_AGENT_NAME ? agent !== NATIVE_AGENT_NAME : agent === NATIVE_AGENT_NAME;
     if (offending(from))
       reject(from, ["agent", "fallback", "map", from]);
     (rungs ?? []).forEach((rung, index) => {
@@ -27184,9 +27243,9 @@ function validateFallbackLadderAgents(data, ctx) {
     });
   }
 }
-var NATIVE = "native", DEFAULT_PROTOCOL = "acp", DEFAULT_AGENT = "claude";
 var init_schemas_protocol_gate = __esm(() => {
   init_model_spec();
+  init_agent_defaults();
 });
 
 // src/config/schemas-reporters.ts
@@ -27350,6 +27409,7 @@ var init_schemas_review = __esm(() => {
 var NaxConfigSchema;
 var init_schemas3 = __esm(() => {
   init_zod();
+  init_agent_defaults();
   init_bash_approval();
   init_schema_types();
   init_schemas_context();
@@ -27379,13 +27439,7 @@ var init_schemas3 = __esm(() => {
       message: "outputDir must be absolute or start with ~/"
     }),
     version: exports_external.number().default(1),
-    models: ModelMapSchema.default({
-      claude: {
-        fast: "haiku",
-        balanced: "sonnet",
-        powerful: "opus"
-      }
-    }),
+    models: ModelMapSchema.default(structuredClone(DEFAULT_MODEL_MAPS)),
     autoMode: AutoModeConfigSchema.default({
       enabled: true,
       complexityRouting: {
@@ -27596,8 +27650,8 @@ var init_schemas3 = __esm(() => {
       }
     }),
     agent: AgentConfigSchema.optional().default({
-      protocol: "acp",
-      default: "claude",
+      protocol: DEFAULT_AGENT_PROTOCOL,
+      default: DEFAULT_AGENT_NAME,
       maxInteractionTurns: 20,
       promptAudit: { enabled: false },
       usageAudit: { enabled: false },
@@ -27699,7 +27753,7 @@ var init_schemas3 = __esm(() => {
     for (const [pi, profile] of profiles.entries()) {
       const { agent: pAgent, model: pModel } = profile.target;
       const targetTier = MODEL_SHORTHAND_TIERS[pModel.toLowerCase()] ?? pModel;
-      const namesTier = resolveTierMembership(data.models ?? {}, pAgent, targetTier, data.agent?.default ?? "claude").isTier;
+      const namesTier = resolveTierMembership(data.models ?? {}, pAgent, targetTier, data.agent?.default ?? DEFAULT_AGENT_NAME).isTier;
       const hasMatchingRung = tierOrder.some((r) => r.tier === targetTier && r.agent === pAgent);
       if (namesTier && !hasMatchingRung) {
         ctx.addIssue({
@@ -28312,6 +28366,57 @@ function trackedSpawnDeadlines(config2) {
   };
 }
 
+// src/config/unreferenced-agent-models.ts
+function isPin(value) {
+  return typeof value.agent === "string" && (("model" in value) || ("tier" in value));
+}
+function pinAgents(value, found) {
+  if (Array.isArray(value)) {
+    for (const item of value)
+      pinAgents(item, found);
+    return;
+  }
+  if (typeof value !== "object" || value === null)
+    return;
+  const record3 = value;
+  if (isPin(record3))
+    found.add(record3.agent);
+  for (const child of Object.values(record3))
+    pinAgents(child, found);
+}
+function fallbackAgents(config2) {
+  const fallback = config2.agent?.fallback;
+  if (fallback?.enabled !== true)
+    return [];
+  return Object.values(fallback.map ?? {}).flatMap((rungs) => (rungs ?? []).map((rung) => typeof rung === "string" ? rung : rung.agent));
+}
+function findUnreferencedAgentModels(config2, storyAgents = []) {
+  const reached = new Set([
+    config2.agent?.default ?? DEFAULT_AGENT_NAME,
+    ...fallbackAgents(config2),
+    ...storyAgents
+  ]);
+  for (const [key, value] of Object.entries(config2)) {
+    if (!SKIPPED_ROOT_KEYS.has(key))
+      pinAgents(value, reached);
+  }
+  return Object.entries(config2.models ?? {}).filter(([agent, map2]) => agent !== NATIVE_AGENT_NAME && !isBuiltInModelMap(agent, map2) && !reached.has(agent)).map(([agent]) => agent);
+}
+function describeUnreferencedAgentModels(agents, config2) {
+  const maps = agents.map((agent) => `models.${agent}`).join(", ");
+  const head = `${maps} is declared but nothing dispatches to it: no agent.default, enabled fallback rung, pin, escalation rung, ` + `complexity route, routing profile or PRD story names ${agents.join(", ")}.`;
+  if (config2.agent?.protocol === "native") {
+    return `${head} Under agent.protocol "native" acpx agents cannot run; remove the map or use protocol "hybrid".`;
+  }
+  const defaultAgent = config2.agent?.default ?? DEFAULT_AGENT_NAME;
+  return `${head} Unassigned work runs on agent.default "${defaultAgent}". ` + `Set agent.default "${agents[0]}" to run it, or reference it from a pin or fallback rung.`;
+}
+var SKIPPED_ROOT_KEYS;
+var init_unreferenced_agent_models = __esm(() => {
+  init_agent_defaults();
+  SKIPPED_ROOT_KEYS = new Set(["models", "agent"]);
+});
+
 // src/config/validate.ts
 function validateConfig(config2) {
   const errors3 = [];
@@ -28322,7 +28427,7 @@ function validateConfig(config2) {
   if (!config2.models) {
     errors3.push("models mapping is required");
   } else {
-    const defaultAgent = config2.agent?.default ?? "claude";
+    const defaultAgent = config2.agent?.default ?? DEFAULT_AGENT_NAME;
     const agentModels = config2.models[defaultAgent];
     if (!agentModels) {
       errors3.push(`models.${defaultAgent} is required (default agent has no model map)`);
@@ -28370,13 +28475,13 @@ function validateConfig(config2) {
   }
   if (config2.models && config2.agent?.fallback?.map) {
     const modelKeys = Object.keys(config2.models);
-    const fallbackAgents = new Set;
+    const fallbackAgents2 = new Set;
     for (const [primary, candidates] of Object.entries(config2.agent.fallback.map)) {
-      fallbackAgents.add(primary);
+      fallbackAgents2.add(primary);
       for (const c of candidates)
-        fallbackAgents.add(typeof c === "string" ? c : c.agent);
+        fallbackAgents2.add(typeof c === "string" ? c : c.agent);
     }
-    for (const agent of fallbackAgents) {
+    for (const agent of fallbackAgents2) {
       if (!modelKeys.includes(agent)) {
         errors3.push(`agent.fallback.map: agent "${agent}" is not a key in models (available: ${modelKeys.join(", ")})`);
       } else {
@@ -28395,7 +28500,7 @@ function validateConfig(config2) {
         errors3.push(`autoMode.escalation.tierOrder: tier "${tc.tier}" agent "${tc.agent}" is not a key in models (available: ${modelKeys.join(", ")})`);
       }
       if (tc.agent === undefined) {
-        const owner = config2.agent?.default ?? "claude";
+        const owner = config2.agent?.default ?? DEFAULT_AGENT_NAME;
         const ownerMap = config2.models[owner];
         if (ownerMap && ownerMap[tc.tier] === undefined) {
           errors3.push(`autoMode.escalation.tierOrder: tier "${tc.tier}" does not resolve under agent "${owner}" (the default agent)`);
@@ -28403,7 +28508,7 @@ function validateConfig(config2) {
       }
     }
   }
-  const defaultAgentKey = config2.agent?.default ?? "claude";
+  const defaultAgentKey = config2.agent?.default ?? DEFAULT_AGENT_NAME;
   const complexities = ["simple", "medium", "complex", "expert"];
   for (const complexity of complexities) {
     const entry = config2.autoMode.complexityRouting[complexity];
@@ -28430,6 +28535,9 @@ function validateConfig(config2) {
     errors: errors3
   };
 }
+var init_validate = __esm(() => {
+  init_agent_defaults();
+});
 
 // src/config/index.ts
 var exports_config = {};
@@ -28448,6 +28556,8 @@ __export(exports_config, {
   ContextV2ConfigSchema: () => ContextV2ConfigSchema,
   CuratorRetentionConfigSchema: () => CuratorRetentionConfigSchema,
   DEFAULT_AGENT_IDLE_WATCHDOG_CONFIG: () => DEFAULT_AGENT_IDLE_WATCHDOG_CONFIG,
+  DEFAULT_AGENT_NAME: () => DEFAULT_AGENT_NAME,
+  DEFAULT_AGENT_PROTOCOL: () => DEFAULT_AGENT_PROTOCOL,
   DEFAULT_AGENT_SPIN_BREAKER_CONFIG: () => DEFAULT_AGENT_SPIN_BREAKER_CONFIG,
   DEFAULT_AGENT_TIMEOUT_RETRY_CONFIG: () => DEFAULT_AGENT_TIMEOUT_RETRY_CONFIG,
   DEFAULT_CONFIG: () => DEFAULT_CONFIG,
@@ -28460,6 +28570,7 @@ __export(exports_config, {
   MODEL_SHORTHAND_TIERS: () => MODEL_SHORTHAND_TIERS,
   McpConfigSchema: () => McpConfigSchema,
   ModelTierSchema: () => ModelTierSchema,
+  NATIVE_AGENT_NAME: () => NATIVE_AGENT_NAME,
   NaxConfigSchema: () => NaxConfigSchema,
   PROJECT_FEATURES_DIR: () => PROJECT_FEATURES_DIR,
   PROJECT_NAX_DIR: () => PROJECT_NAX_DIR,
@@ -28489,17 +28600,20 @@ __export(exports_config, {
   createConfigLoader: () => createConfigLoader,
   decomposeConfigSelector: () => decomposeConfigSelector,
   deepMergeConfig: () => deepMergeConfig,
+  describeUnreferencedAgentModels: () => describeUnreferencedAgentModels,
   executionGatesConfigSelector: () => executionGatesConfigSelector,
   featureDir: () => featureDir,
   featuresDir: () => featuresDir,
   findInertBashStages: () => findInertBashStages,
   findProjectDir: () => findProjectDir,
+  findUnreferencedAgentModels: () => findUnreferencedAgentModels,
   finishConfigSelector: () => finishConfigSelector,
   getAcQualityRules: () => getAcQualityRules,
   getProjectKey: () => getProjectKey,
   globalConfigDir: () => globalConfigDir,
   globalConfigPath: () => globalConfigPath,
   interactionConfigSelector: () => interactionConfigSelector,
+  isBuiltInModelMap: () => isBuiltInModelMap,
   isSingleSessionTestOwningStrategy: () => isSingleSessionTestOwningStrategy,
   isThreeSessionStrategy: () => isThreeSessionStrategy,
   isUnrecognizedLiteralModel: () => isUnrecognizedLiteralModel,
@@ -28549,6 +28663,7 @@ __export(exports_config, {
   verifyConfigSelector: () => verifyConfigSelector
 });
 var init_config = __esm(() => {
+  init_agent_defaults();
   init_bash_approval();
   init_inert_bash_stages();
   init_loader();
@@ -28570,6 +28685,8 @@ var init_config = __esm(() => {
   init_schemas_sandbox();
   init_selectors();
   init_test_strategy();
+  init_unreferenced_agent_models();
+  init_validate();
 });
 
 // src/agents/native/credentials.ts
@@ -28744,6 +28861,32 @@ async function ambientShadows(providerIds) {
   }));
   return checked.filter((id) => id !== undefined);
 }
+async function providersWithoutCredentials(providerIds) {
+  const unique = [...new Set(providerIds)];
+  let stored;
+  try {
+    stored = new Set((await listStoredProviders()).map((entry) => entry.providerId));
+  } catch {
+    return [];
+  }
+  const sweep = Promise.all(unique.filter((providerId) => !stored.has(providerId)).map(async (providerId) => {
+    try {
+      return await _authDeps.ambientAuthAvailable(providerId) ? undefined : providerId;
+    } catch {
+      return;
+    }
+  })).then((missing) => missing.filter((id) => id !== undefined));
+  let timer;
+  const expiry = new Promise((resolve15) => {
+    timer = setTimeout(() => resolve15([]), AMBIENT_PROBE_TIMEOUT_MS);
+  });
+  try {
+    return await Promise.race([sweep, expiry]);
+  } finally {
+    if (timer !== undefined)
+      clearTimeout(timer);
+  }
+}
 async function anyAmbientCredential() {
   let timer;
   const sweep = (async () => {
@@ -28764,13 +28907,13 @@ async function anyAmbientCredential() {
     });
   })();
   const expiry = new Promise((resolve15) => {
-    timer = setTimeout(() => resolve15(true), AMBIENT_PROBE_TIMEOUT_MS);
+    timer = _authDeps.setTimeout(() => resolve15(true), AMBIENT_PROBE_TIMEOUT_MS);
   });
   try {
     return await Promise.race([sweep, expiry]);
   } finally {
     if (timer !== undefined)
-      clearTimeout(timer);
+      _authDeps.clearTimeout(timer);
   }
 }
 var AuthCancelledError, _authDeps, DEFAULT_PI_AUTH_PATH, AMBIENT_PROBE_TIMEOUT_MS = 2000;
@@ -28788,7 +28931,9 @@ var init_auth = __esm(() => {
   _authDeps = {
     login,
     ambientAuthAvailable,
-    providerIds: async () => (await defaultProviders2()).map((provider) => provider.id)
+    providerIds: async () => (await defaultProviders2()).map((provider) => provider.id),
+    setTimeout: (fn, ms) => setTimeout(fn, ms),
+    clearTimeout: (id) => clearTimeout(id)
   };
   DEFAULT_PI_AUTH_PATH = join20(homedir3(), ".pi", "agent", "auth.json");
 });
@@ -28874,11 +29019,12 @@ function resolveContextWindow(override, realWindow) {
   }
   return override;
 }
-var NATIVE_AGENT = "native", THINKING_LEVELS;
+var THINKING_LEVELS;
 var init_models = __esm(() => {
   init_errors();
   init_logger2();
   init_model_spec();
+  init_config();
   THINKING_LEVELS = {
     off: true,
     minimal: true,
@@ -28892,7 +29038,7 @@ var init_models = __esm(() => {
 
 // src/agents/native/client.ts
 import { createClient, defaultProtocols, defaultProviders as defaultProviders3 } from "@nathapp/nax-ai";
-async function buildNativeClient(catalogOverrides = []) {
+async function buildNativeClient(catalogOverrides = [], options = {}) {
   return createClient({
     providers: await defaultProviders3(),
     protocols: ({ providerOverrides }) => _clientDeps.defaultProtocols({
@@ -28900,7 +29046,8 @@ async function buildNativeClient(catalogOverrides = []) {
       clientApp: NAX_CLIENT_APP,
       providerOverrides
     }),
-    ...catalogOverrides.length > 0 ? { providerOverrides: toProviderOverrides(catalogOverrides) } : {}
+    ...catalogOverrides.length > 0 ? { providerOverrides: toProviderOverrides(catalogOverrides) } : {},
+    ...options.transportRetries !== undefined ? { transportRetries: options.transportRetries } : {}
   });
 }
 function canonicalise(value) {
@@ -29358,7 +29505,7 @@ async function openNativeSession(name, opts) {
   });
   return {
     id: name,
-    agentName: NATIVE_AGENT,
+    agentName: NATIVE_AGENT_NAME,
     protocolIds: { recordId: nativeSessionId(name), sessionId: nativeSessionId(name) },
     ...opts.modelDef !== undefined ? { modelDef: opts.modelDef } : {},
     ...opts.modelTier !== undefined ? { modelTier: opts.modelTier } : {}
@@ -31030,7 +31177,7 @@ ${previousSummary}`;
 
 class NativeAgentAdapter {
   catalogOverrides;
-  name = NATIVE_AGENT;
+  name = NATIVE_AGENT_NAME;
   displayName = "Native (nax-ai)";
   binary = "";
   capabilities;
@@ -31064,7 +31211,7 @@ class NativeAgentAdapter {
     const client = await getNativeClient(this.catalogOverrides);
     const resolved = await client.model(provider, model);
     const controller = new AbortController;
-    const timer = options.timeoutMs !== undefined ? setTimeout(() => controller.abort(), options.timeoutMs) : undefined;
+    const timer = options.timeoutMs !== undefined ? _adapterDeps.setTimeout(() => controller.abort(), options.timeoutMs) : undefined;
     try {
       const sessionId = nativeSessionId(this.oneShotKey);
       const result = await client.complete(resolved, {
@@ -31098,7 +31245,7 @@ class NativeAgentAdapter {
       throw err;
     } finally {
       if (timer !== undefined)
-        clearTimeout(timer);
+        _adapterDeps.clearTimeout(timer);
     }
   }
   openSession(name, opts) {
@@ -31142,7 +31289,7 @@ class NativeAgentAdapter {
     });
     const deadlineController = new AbortController;
     const deadlineMs = deadline.remainingMs();
-    const deadlineTimer = deadlineMs !== undefined ? setTimeout(() => deadlineController.abort(), deadlineMs) : undefined;
+    const deadlineTimer = deadlineMs !== undefined ? _adapterDeps.setTimeout(() => deadlineController.abort(), deadlineMs) : undefined;
     const turnSignals = [turnController.signal, deadlineController.signal];
     if (opts.signal !== undefined)
       turnSignals.unshift(opts.signal);
@@ -31165,7 +31312,7 @@ class NativeAgentAdapter {
         summarize: async (span, previousSummary) => {
           const remainingMs = deadline.remainingMs();
           const controller = new AbortController;
-          const timer = remainingMs !== undefined ? setTimeout(() => controller.abort(), remainingMs) : undefined;
+          const timer = remainingMs !== undefined ? _adapterDeps.setTimeout(() => controller.abort(), remainingMs) : undefined;
           const signal = AbortSignal.any(opts.signal !== undefined ? [opts.signal, controller.signal, turnController.signal, deadlineController.signal] : [controller.signal, turnController.signal, deadlineController.signal]);
           try {
             const res = await client.complete(resolved, {
@@ -31178,13 +31325,13 @@ class NativeAgentAdapter {
             return { text: res.text, usage: summaryUsage, costUsd, rates: resolvedRates };
           } finally {
             if (timer !== undefined)
-              clearTimeout(timer);
+              _adapterDeps.clearTimeout(timer);
           }
         },
         complete: async (messages, tools, requestOptions) => {
           const remainingMs = deadline.remainingMs();
           const controller = new AbortController;
-          const timer = remainingMs !== undefined ? setTimeout(() => controller.abort(), remainingMs) : undefined;
+          const timer = remainingMs !== undefined ? _adapterDeps.setTimeout(() => controller.abort(), remainingMs) : undefined;
           const signal = AbortSignal.any(opts.signal !== undefined ? [opts.signal, controller.signal, turnController.signal, deadlineController.signal] : [controller.signal, turnController.signal, deadlineController.signal]);
           const requestThinking = requestOptions?.thinking === false ? undefined : thinking;
           try {
@@ -31209,7 +31356,7 @@ class NativeAgentAdapter {
             };
           } finally {
             if (timer !== undefined)
-              clearTimeout(timer);
+              _adapterDeps.clearTimeout(timer);
           }
         }
       });
@@ -31229,7 +31376,7 @@ class NativeAgentAdapter {
       throw err;
     } finally {
       if (deadlineTimer !== undefined)
-        clearTimeout(deadlineTimer);
+        _adapterDeps.clearTimeout(deadlineTimer);
     }
     hooks?.onStreamActivity?.({
       ...eventBase,
@@ -31244,7 +31391,7 @@ class NativeAgentAdapter {
     return closeNativeSession(handle);
   }
   async closePhysicalSession(handle, _workdir, _options) {
-    return closeNativeSession({ id: handle, agentName: NATIVE_AGENT });
+    return closeNativeSession({ id: handle, agentName: NATIVE_AGENT_NAME });
   }
 }
 var CONSERVATIVE_CONTEXT_TOKENS = 128000, FALLBACK_TURN_TIMEOUT_SECONDS = 3600, DEFAULT_TIERS, _adapterDeps;
@@ -31262,7 +31409,12 @@ var init_adapter = __esm(() => {
   init_turn_types();
   init_session_affinity();
   DEFAULT_TIERS = ["fast", "balanced", "powerful"];
-  _adapterDeps = { listStoredProviders, anyAmbientCredential };
+  _adapterDeps = {
+    listStoredProviders,
+    anyAmbientCredential,
+    setTimeout: (fn, ms) => setTimeout(fn, ms),
+    clearTimeout: (id) => clearTimeout(id)
+  };
 });
 
 // src/agents/native/model-resolver.ts
@@ -31807,7 +31959,7 @@ async function assertPrdCommitted(prdPath, projectRoot) {
     });
   }
 }
-var init_validate = __esm(() => {
+var init_validate2 = __esm(() => {
   init_errors();
   init_git();
 });
@@ -31906,7 +32058,7 @@ function validateInjectedStory(raw, existingIds) {
 var STORY_ID_PREFIX = "US";
 var init_inject = __esm(() => {
   init_errors();
-  init_validate();
+  init_validate2();
 });
 
 // src/prd/modifies-extract.ts
@@ -33002,7 +33154,7 @@ var init_schema_story = __esm(() => {
   init_test_strategy();
   init_errors();
   init_out_of_scope();
-  init_validate();
+  init_validate2();
   VALID_COMPLEXITY = ["simple", "medium", "complex", "expert"];
   WORKDIR_SOURCES = ["stated", "derived", "defaulted"];
   STORY_ID_NO_SEPARATOR = /^([A-Za-z]+)(\d+)$/;
@@ -33357,7 +33509,7 @@ var init_prd = __esm(() => {
   init_out_of_scope_extract();
   init_spec_drift();
   init_spec_lint();
-  init_validate();
+  init_validate2();
   init_workdir_canonical();
   init_schema2();
   PRD_MAX_FILE_SIZE = 5 * 1024 * 1024;
@@ -53052,8 +53204,8 @@ var init_version = __esm(() => {
   NAX_AI_VERSION = CATALOG_VERSION;
   NAX_COMMIT = (() => {
     try {
-      if (/^[0-9a-f]{6,10}$/.test("a83e5791"))
-        return "a83e5791";
+      if (/^[0-9a-f]{6,10}$/.test("3e4ec026"))
+        return "3e4ec026";
     } catch {}
     try {
       const result = Bun.spawnSync(["git", "rev-parse", "--short", "HEAD"], {
@@ -65849,7 +66001,7 @@ var init_coding_tool_support = __esm(() => {
 
 // src/agents/tool-preamble.ts
 function promptWithToolPreamble(agentName, options) {
-  const base = agentName === NATIVE_AGENT ? options.prompt : buildContextToolPreamble(options);
+  const base = agentName === NATIVE_AGENT_NAME ? options.prompt : buildContextToolPreamble(options);
   const scope = buildAgentScopeSection(options.codingToolRoot, options.codingToolWorkdirLabel);
   return scope === undefined ? base : `${scope}
 
@@ -65857,7 +66009,7 @@ ${base}`;
 }
 function applyDiffAccessForAgentProtocol(agentName, prompt, advertisedTools) {
   return applyProtocolRegions(prompt, {
-    protocol: agentName === NATIVE_AGENT ? "native" : "acp",
+    protocol: agentName === NATIVE_AGENT_NAME ? "native" : "acp",
     advertisedTools: new Set(advertisedTools)
   });
 }
@@ -76918,7 +77070,7 @@ function buildSessionTurnEvent(input) {
     ...result.pricingSource !== undefined ? { pricingSource: result.pricingSource } : {},
     ...result.rates !== undefined ? { rates: result.rates } : {},
     roundTrips: result.internalRoundTrips ?? 1,
-    roundTripUnit: input.agentName === NATIVE_AGENT ? "model-call" : "agent-run",
+    roundTripUnit: input.agentName === NATIVE_AGENT_NAME ? "model-call" : "agent-run",
     protocolIds: {
       sessionId: handle.protocolIds?.sessionId ?? null,
       recordId: handle.protocolIds?.recordId ?? null,
@@ -77475,7 +77627,7 @@ var init_manager_run_fallback = __esm(() => {
 
 // src/agents/registry.ts
 function adapterFor(name) {
-  return name === NATIVE_AGENT ? new NativeAgentAdapter : new AcpAgentAdapter(name);
+  return name === NATIVE_AGENT_NAME ? new NativeAgentAdapter : new AcpAgentAdapter(name);
 }
 function buildAdapterList() {
   return [...Array.from(_registryTestAdapters.values()), ...KNOWN_AGENT_NAMES.map(adapterFor)];
@@ -77491,12 +77643,12 @@ async function getInstalledAgents() {
 function createAgentRegistry(config2) {
   const logger = getLogger();
   const adapterCache = new Map;
-  const protocol = config2.agent?.protocol ?? "acp";
+  const protocol = config2.agent?.protocol ?? DEFAULT_AGENT_PROTOCOL;
   logger?.info("agents", `Agent protocol: ${protocol}`, { protocol, hasConfig: !!config2.agent });
   function cachedAdapter(name) {
     let adapter = adapterCache.get(name);
     if (adapter === undefined) {
-      adapter = name === NATIVE_AGENT ? new NativeAgentAdapter(undefined, config2.agent?.native?.catalogOverrides ?? []) : new AcpAgentAdapter(name);
+      adapter = name === NATIVE_AGENT_NAME ? new NativeAgentAdapter(undefined, config2.agent?.native?.catalogOverrides ?? []) : new AcpAgentAdapter(name);
       adapterCache.set(name, adapter);
       logger?.debug("agents", `Created ${adapter.constructor.name} for ${name}`, { name });
     }
@@ -77530,10 +77682,11 @@ function createAgentRegistry(config2) {
 }
 var KNOWN_AGENT_NAMES, _registryTestAdapters;
 var init_registry4 = __esm(() => {
+  init_config();
   init_logger2();
   init_adapter2();
   init_native();
-  KNOWN_AGENT_NAMES = ["claude", "codex", "opencode", "gemini", "aider", "pi", NATIVE_AGENT];
+  KNOWN_AGENT_NAMES = ["claude", "codex", "opencode", "gemini", "aider", "pi", NATIVE_AGENT_NAME];
   _registryTestAdapters = new Map;
 });
 
@@ -77602,7 +77755,7 @@ class AgentManager {
     const fromAgent = this._config.agent?.default;
     if (typeof fromAgent === "string" && fromAgent.length > 0)
       return fromAgent;
-    return "claude";
+    return DEFAULT_AGENT_NAME;
   }
   isUnavailable(agent, tier, model) {
     return this._cooldowns.isCooling(agent, tier, this._fallbackIdentity.modelId(agent, tier, model));
@@ -77992,6 +78145,7 @@ class AgentManager {
 }
 var MAX_EMITTER_LISTENERS = 100, _agentManagerDeps;
 var init_manager2 = __esm(() => {
+  init_config();
   init_permissions2();
   init_errors();
   init_logger2();
@@ -78036,7 +78190,7 @@ function toAssignment(p, models, defaultAgent) {
   if (!membership.isTier) {
     return { agent: p.target.agent, agentProfileId: p.id, profileModelPin: p.target.model };
   }
-  if (membership.viaDefaultAgentFallback && p.target.agent === NATIVE_AGENT2 !== (defaultAgent === NATIVE_AGENT2)) {
+  if (membership.viaDefaultAgentFallback && p.target.agent === NATIVE_AGENT !== (defaultAgent === NATIVE_AGENT)) {
     getSafeLogger()?.warn("routing", "Profile tier resolves only via the default agent across a protocol boundary", {
       profileId: p.id,
       agent: p.target.agent,
@@ -78046,7 +78200,7 @@ function toAssignment(p, models, defaultAgent) {
   }
   return { agent: p.target.agent, agentProfileId: p.id, profileModelTier: targetModel };
 }
-var NATIVE_AGENT2 = "native";
+var NATIVE_AGENT = "native";
 var init_agent_profile_resolver = __esm(() => {
   init_config();
   init_logger2();
@@ -78146,7 +78300,11 @@ function resolveDefaultAgent(config2) {
     return fromAgent;
   return FALLBACK_DEFAULT_AGENT;
 }
-var FALLBACK_DEFAULT_AGENT = "claude";
+var FALLBACK_DEFAULT_AGENT;
+var init_utils = __esm(() => {
+  init_config();
+  FALLBACK_DEFAULT_AGENT = DEFAULT_AGENT_NAME;
+});
 
 // src/agents/index.ts
 var init_agents = __esm(() => {
@@ -78161,20 +78319,24 @@ var init_agents = __esm(() => {
   init_shared();
   init_version_detection();
   init_types2();
+  init_utils();
 });
 
 // src/cli/agents.ts
 async function agentsListCommand(config2, _workdir) {
-  const adapters = Array.from(ACP_ADAPTER_NAMES).map((name) => new AcpAgentAdapter(name));
-  const agentVersions = await Promise.all(adapters.map(async (agent) => ({
+  const acpReachable = (config2.agent?.protocol ?? DEFAULT_AGENT_PROTOCOL) !== "native";
+  const adapters = acpReachable ? Array.from(ACP_ADAPTER_NAMES).map((name) => new AcpAgentAdapter(name)) : [];
+  const defaultAgent = resolveDefaultAgent(config2);
+  const acpVersions = await Promise.all(adapters.map(async (agent) => ({
     name: agent.name,
     displayName: agent.displayName,
     binary: agent.binary,
     version: await _cliAgentsDeps.getAgentVersion(agent.binary),
     installed: await agent.isInstalled(),
     capabilities: agent.capabilities,
-    isDefault: resolveDefaultAgent(config2) === agent.name
+    isDefault: defaultAgent === agent.name
   })));
+  const agentVersions = [...nativeListing(config2, defaultAgent), ...acpVersions];
   const rows = agentVersions.map((info) => {
     const status = info.installed ? "installed" : "unavailable";
     const versionStr = info.version || "-";
@@ -78208,6 +78370,22 @@ Available Agents:
   }
   console.log();
 }
+function nativeListing(config2, defaultAgent) {
+  if ((config2.agent?.protocol ?? DEFAULT_AGENT_PROTOCOL) === "acp")
+    return [];
+  const adapter = new NativeAgentAdapter(Object.keys(config2.models[NATIVE_AGENT_NAME] ?? {}));
+  return [
+    {
+      name: adapter.name,
+      displayName: adapter.displayName,
+      binary: "in-process",
+      version: "",
+      installed: true,
+      capabilities: adapter.capabilities,
+      isDefault: defaultAgent === adapter.name
+    }
+  ];
+}
 function pad(str, width) {
   return str.padEnd(width);
 }
@@ -78215,7 +78393,9 @@ var _cliAgentsDeps;
 var init_agents2 = __esm(() => {
   init_agents();
   init_acp();
+  init_native();
   init_version_detection();
+  init_config();
   _cliAgentsDeps = { getAgentVersion };
 });
 
@@ -84723,6 +84903,14 @@ async function checkClaudeCLI() {
 }
 async function checkAgentCLI(config2) {
   const agent = resolveDefaultAgent(config2);
+  if (agent === NATIVE_AGENT_NAME) {
+    return {
+      name: "agent-cli-available",
+      tier: "blocker",
+      passed: true,
+      message: "native agent runs in-process; no CLI binary required"
+    };
+  }
   try {
     const proc = _checkCliDeps.spawn([agent, "--version"], {
       stdout: "pipe",
@@ -84748,6 +84936,7 @@ async function checkAgentCLI(config2) {
 var _checkCliDeps;
 var init_checks_cli = __esm(() => {
   init_agents();
+  init_native();
   init_bun_deps();
   _checkCliDeps = {
     spawn
@@ -99298,8 +99487,26 @@ function warnInertBashStages(config2, logger) {
     logger?.warn("permissions", `bashApproval "${resolved}" on stage "${stage}" grants no Bash (no Bash(...) allow rule) -- the agent is not offered Bash, so nothing can escalate. Add one rule: "allow": ["Bash(ls *, cat *, git status*)"]`, { storyId: "_setup", stage, bashApproval: resolved });
   }
 }
+function warnUnreferencedAgentModels(prd, config2, logger) {
+  const storyAgents = prd.userStories.flatMap((story) => story.routing?.agent ? [story.routing.agent] : []);
+  const agents = findUnreferencedAgentModels(config2, storyAgents);
+  if (agents.length === 0)
+    return;
+  logger?.warn("config", describeUnreferencedAgentModels(agents, config2), { storyId: "_setup", agents });
+}
+async function assertDefaultNativeCredentials(config2) {
+  const { describeMissingNativeCredentials, findMissingNativeCredentials } = await Promise.resolve().then(() => (init_precheck2(), exports_precheck));
+  const missing = await findMissingNativeCredentials(config2);
+  if (missing.length === 0)
+    return;
+  throw new NaxError(describeMissingNativeCredentials(missing), "NATIVE_CREDENTIALS_MISSING", {
+    stage: "setup",
+    providers: missing.map(({ provider: provider2 }) => provider2)
+  });
+}
 var init_run_setup_warnings = __esm(() => {
   init_config();
+  init_errors();
 });
 
 // src/execution/lifecycle/gitignore-reconcile.ts
@@ -100116,6 +100323,7 @@ async function initializeAfterLock(options) {
     const prd = initResult.prd;
     statusWriter.setPrd(prd);
     warnProfileMismatch(prd, config2, logger);
+    warnUnreferencedAgentModels(prd, config2, logger);
     let counts = initResult.storyCounts;
     if (counts.paused > 0 && interactionChain !== null) {
       const { promptForPausedStories: promptForPausedStories2 } = await Promise.resolve().then(() => (init_paused_story_prompts(), exports_paused_story_prompts));
@@ -102466,6 +102674,9 @@ async function setupRun(options) {
   if (options.agentManager) {
     await options.agentManager.validateCredentials();
   }
+  if (!options.dryRun) {
+    await assertDefaultNativeCredentials(options.config);
+  }
   const {
     prdPath,
     workdir,
@@ -109108,7 +109319,7 @@ function collectConfiguredModelPins(config2) {
     }
   }
   const pins = [];
-  const defaultAgent = cfg.agent?.default ?? "claude";
+  const defaultAgent = cfg.agent?.default ?? DEFAULT_AGENT_NAME;
   if (cfg.review?.semantic !== undefined) {
     const pin = pinFromConfiguredModel("review.semantic.model", cfg.review.semantic.model, defaultAgent, tierEntries);
     if (pin !== undefined)
@@ -109197,7 +109408,7 @@ var init_checks_model_resolution_walk = __esm(() => {
 
 // src/precheck/checks-model-resolution.ts
 function isNativeAgent(agent) {
-  return agent === "native";
+  return agent === NATIVE_AGENT_NAME;
 }
 async function checkModelResolution(config2) {
   const { pins, tierEntries, catalogOverrides } = collectConfiguredModelPins(config2);
@@ -109306,6 +109517,52 @@ var init_checks_model_resolution = __esm(() => {
   };
 });
 
+// src/precheck/checks-native-credentials.ts
+function providerOf(id) {
+  const slash = id.indexOf("/");
+  return slash > 0 ? id.slice(0, slash) : undefined;
+}
+function providerTiers(config2) {
+  const overridden = new Set((config2.agent?.native?.catalogOverrides ?? []).map((override) => override.provider));
+  const byProvider = new Map;
+  for (const [tier, entry] of Object.entries(config2.models?.[NATIVE_AGENT_NAME] ?? {})) {
+    if (entry === undefined)
+      continue;
+    const provider2 = providerOf(typeof entry === "string" ? entry : entry.model);
+    if (provider2 === undefined || overridden.has(provider2))
+      continue;
+    byProvider.set(provider2, [...byProvider.get(provider2) ?? [], tier]);
+  }
+  return byProvider;
+}
+async function findMissingNativeCredentials(config2) {
+  if (resolveDefaultAgent(config2) !== NATIVE_AGENT_NAME)
+    return [];
+  const byProvider = providerTiers(config2);
+  if (byProvider.size === 0)
+    return [];
+  const missing = await _nativeCredentialDeps.providersWithoutCredentials([...byProvider.keys()]);
+  return missing.map((provider2) => ({ provider: provider2, tiers: byProvider.get(provider2) ?? [] }));
+}
+function describeMissingNativeCredentials(missing) {
+  const uses = missing.map(({ provider: provider2, tiers }) => `${provider2} (${tiers.map((tier) => `models.native.${tier}`).join(", ")})`).join("; ");
+  const logins = missing.map(({ provider: provider2 }) => `nax auth login ${provider2}`).join(" / ");
+  return `The default native agent needs a credential for ${uses}, but none is stored or in the environment. ` + `Run ${logins}, set the provider's API key environment variable, point models.native at a provider you have ` + `credentials for, or set agent.default "claude" to use an acpx agent.`;
+}
+async function checkNativeCredentials(config2) {
+  const missing = await findMissingNativeCredentials(config2);
+  if (missing.length === 0) {
+    return { name: CHECK_NAME, tier: "blocker", passed: true, message: "native default agent credentials found" };
+  }
+  return { name: CHECK_NAME, tier: "blocker", passed: false, message: describeMissingNativeCredentials(missing) };
+}
+var CHECK_NAME = "native-credentials", _nativeCredentialDeps;
+var init_checks_native_credentials = __esm(() => {
+  init_agents();
+  init_native();
+  _nativeCredentialDeps = { providersWithoutCredentials };
+});
+
 // src/precheck/checks-warnings.ts
 import { existsSync as existsSync37 } from "fs";
 import { isAbsolute as isAbsolute22 } from "path";
@@ -109614,6 +109871,7 @@ var init_checks4 = __esm(() => {
   init_checks_agents();
   init_checks_blockers();
   init_checks_model_resolution();
+  init_checks_native_credentials();
   init_checks_warnings();
 });
 
@@ -109742,6 +110000,7 @@ __export(exports_precheck, {
   EXIT_CODES: () => EXIT_CODES,
   _checkDiskSpaceDeps: () => _checkDiskSpaceDeps,
   _modelResolutionDeps: () => _modelResolutionDeps,
+  _nativeCredentialDeps: () => _nativeCredentialDeps,
   _precheckDeps: () => _precheckDeps,
   checkAgentCLI: () => checkAgentCLI,
   checkBuildCommandInReviewChecks: () => checkBuildCommandInReviewChecks,
@@ -109758,6 +110017,7 @@ __export(exports_precheck, {
   checkLintCommand: () => checkLintCommand,
   checkModelResolution: () => checkModelResolution,
   checkMultiAgentHealth: () => checkMultiAgentHealth,
+  checkNativeCredentials: () => checkNativeCredentials,
   checkOptionalCommands: () => checkOptionalCommands,
   checkPRDValid: () => checkPRDValid,
   checkPendingStories: () => checkPendingStories,
@@ -109766,6 +110026,8 @@ __export(exports_precheck, {
   checkTestCommand: () => checkTestCommand,
   checkTypecheckCommand: () => checkTypecheckCommand,
   checkWorkingTreeClean: () => checkWorkingTreeClean,
+  describeMissingNativeCredentials: () => describeMissingNativeCredentials,
+  findMissingNativeCredentials: () => findMissingNativeCredentials,
   parseDiskSpaceOutput: () => parseDiskSpaceOutput,
   runEnvironmentPrecheck: () => runEnvironmentPrecheck,
   runPrecheck: () => runPrecheck2
@@ -109781,6 +110043,7 @@ function getLateEnvironmentBlockers(config2, workdir) {
   return [
     () => checkAgentCLI(config2),
     () => checkModelResolution(config2),
+    () => checkNativeCredentials(config2),
     () => checkDependenciesInstalled(workdir),
     () => checkTestCommand(config2),
     () => checkLintCommand(config2),
@@ -110170,7 +110433,7 @@ ${repairHint}` : codebaseContext;
     agentRouting: config2.routing?.agents,
     profileName: config2.profile,
     models: config2.models,
-    defaultAgent: config2.agent?.default ?? "claude",
+    defaultAgent: config2.agent?.default ?? DEFAULT_AGENT_NAME,
     outputPath: prdPath,
     repoRoot: workdir,
     scope: new Set(subStoriesWithParent.map((s) => s.id)),
@@ -110494,7 +110757,7 @@ async function persistPrd(ctx, prd) {
     agentRouting: ctx.config.routing?.agents,
     profileName: ctx.profileName,
     models: ctx.config.models,
-    defaultAgent: ctx.config.agent?.default ?? "claude",
+    defaultAgent: ctx.config.agent?.default ?? DEFAULT_AGENT_NAME,
     outputPath: ctx.outputPath,
     repoRoot: ctx.workdir,
     writeFile: ctx.deps.writeFile
@@ -110502,6 +110765,7 @@ async function persistPrd(ctx, prd) {
 }
 var _persistPrdDeps;
 var init_persist_prd = __esm(() => {
+  init_config();
   init_generator2();
   init_logger2();
   init_operations();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nathapp/nax",
-  "version": "0.82.0",
+  "version": "0.82.1",
   "description": "AI Coding Agent Orchestrator — loops until done",
   "type": "module",
   "bin": {