@on-par/factory-cli 0.9.3 → 0.9.4

package/README.md

@@ -16,7 +16,7 @@ factory --version
 factory doctor
 ```
 
-Also requires `git`, Claude Code (`claude`) installed and signed in, and the GitHub CLI signed in with `gh auth login`. The factory reads `GITHUB_TOKEN`, then `GH_TOKEN`, and falls back to `gh auth token`. `factory doctor` checks all of this and prints a fix for anything missing. It also checks your git identity and the sandbox runtime, and it runs outside a repo.
+Also requires `git`, one supported coding agent CLI (see [docs/agents.md](https://github.com/on-par/software-factory/blob/main/docs/agents.md)), signed in, and the GitHub CLI signed in with `gh auth login`. The factory reads `GITHUB_TOKEN`, then `GH_TOKEN`, and falls back to `gh auth token`. `factory doctor` checks all of this and prints a fix for anything missing. It also checks your git identity and the sandbox runtime, and it runs outside a repo.
 
 `factory init` creates a local-only `.factory/` (git-excluded) with a `default-code` constitution. See the main README quick start.
 

package/dist/cli/doctor.d.ts

@@ -7,12 +7,22 @@ export interface DoctorCheck {
     fix?: string;
     /** Optional checks never fail the doctor exit code. */
     optional?: boolean;
+    /** Setup section the row renders under (#2555); unsectioned rows render first. */
+    section?: string;
+    /** Exactly one shell command to run next (#2557); rendered as the last line of a non-ok row. */
+    next?: string;
+}
+export interface DoctorExecOptions {
+    /** Extra env vars merged over process.env for this command. */
+    env?: Record<string, string>;
+    /** Kill the command after this many ms; the probe then returns null. */
+    timeoutMs?: number;
 }
 export interface DoctorEnvProbes {
     commandAvailable: (cmd: string) => boolean;
     envPresent: (key: string) => boolean;
-    /** Run a command, return trimmed stdout, or null if it fails. */
-    tryExec: (cmd: string) => string | null;
+    /** Run a command, return trimmed stdout, or null if it fails. `opts` adds env vars and a timeout. */
+    tryExec: (cmd: string, opts?: DoctorExecOptions) => string | null;
     pathExists: (p: string) => boolean;
     /** Host platform; defaults to process.platform. */
     platform?: NodeJS.Platform;
@@ -20,8 +30,18 @@ export interface DoctorEnvProbes {
         fresh: boolean;
         detail: string;
     };
+    /** Stored Codex ChatGPT session state (#2509), read locally; never refreshes. */
+    codexSessionState?: () => 'ok' | 'refresh-pending' | 'unusable' | 'unknown';
+    /** Whether a stored Claude Code login exists (#2556); reads local state only, never runs inference. */
+    claudeLoggedIn?: () => boolean;
+    /** Whether a stored opencode auth login exists (#2556); reads local state only, never runs inference. */
+    opencodeLoggedIn?: () => boolean;
 }
+/** Repo wired-up rows, sectioned only inside a git repo (#2557). */
+export declare const REPO_SECTION = "Repo";
 export declare const NOT_IN_REPO_HINT = "cd into your repo, then run factory doctor again";
+/** Detail for every repo wired-up row when doctor runs outside a git repository (#2554). */
+export declare const NOT_IN_REPO_SKIP_DETAIL = "skipped \u2014 not inside a git repository; cd into your repo, then run factory doctor again";
 export declare function hasSandboxRuntime(platform: NodeJS.Platform, commandAvailable: (cmd: string) => boolean): boolean;
 /** Reason the sandboxed claude auth probe is skipped before a sandbox policy is resolved,
  *  or null when cmdDoctor should resolve the policy as before (#2383). */
@@ -30,8 +50,51 @@ export declare function sandboxAuthSkipDetail(opts: {
     hostOk: boolean;
     inRepo: boolean;
 }): string | null;
+/** Sign-in method reported by `codex login status`, or null when it shows no login. Never returns
+ *  any part of a credential: only a fixed label is derived from the status text. */
+export declare function codexAuthMethod(statusOutput: string | null): string | null;
+/** Non-interactive read-only probe of origin. `credential.interactive=never` turns off Git
+ *  Credential Manager UI and an empty `core.askPass` turns off configured askpass programs;
+ *  stored credentials from any helper still work. */
+export declare const GIT_AUTH_PROBE_CMD = "git -c credential.interactive=never -c core.askPass= ls-remote --quiet origin HEAD";
+/** GIT_TERMINAL_PROMPT=0 makes git fail instead of asking on the terminal; empty GIT_ASKPASS
+ *  and SSH_ASKPASS turn off askpass programs and ssh's GUI askpass; GCM_INTERACTIVE=never
+ *  turns off Git Credential Manager prompts. */
+export declare const GIT_AUTH_PROBE_ENV: Readonly<Record<string, string>>;
+/** Bounds the probe, e.g. an ssh key passphrase prompt that waits on /dev/tty. */
+export declare const GIT_AUTH_PROBE_TIMEOUT_MS = 15000;
+/** Remedy shown only when the git-auth probe fails: wires git's credential helper to gh. */
+export declare const GIT_AUTH_FIX = "run `gh auth setup-git` so git uses your gh credentials, then re-run `factory doctor`";
+/** Git-auth check (#2482, #2483): skipped, never failing, outside a git repository or without
+ *  an origin remote. Otherwise runs a non-interactive `git ls-remote` against origin and fails
+ *  when it cannot authenticate. The detail never echoes the origin URL, which may hold a token. */
+export declare function gitAuthCheck(repoRoot: string | null, tryExec: (cmd: string, opts?: DoctorExecOptions) => string | null): DoctorCheck;
+export interface HarnessSetup {
+    section: string;
+    cli: string;
+    install: string;
+    /** Exact shell command that signs the harness in (#2556); also the row's `next` command. */
+    login: string;
+    /** Env vars that count as sign-in evidence (#2556). */
+    envKeys: readonly string[];
+}
+/** One doctor section per built-in harness (#2555), in display order. */
+export declare const HARNESS_SETUP: readonly HarnessSetup[];
+/** One optional `<cli> installed` row per harness, with the CLI version when found and the install command when not (#2555). */
+export declare function harnessInstallChecks(commandAvailable: (cmd: string) => boolean, tryExec: (cmd: string) => string | null): DoctorCheck[];
+/** One `<cli> signed in` row per harness (#2556), judged only from local evidence: an env key,
+ *  stored credentials, or `codex login status`. Never runs inference and never prints a secret. */
+export declare function harnessSignInChecks(probes: DoctorEnvProbes): DoctorCheck[];
+/** Coding agent prerequisites: at least one agent CLI is required; each CLI is then reported
+ *  on its own optional line, with sign-in reported separately from installation (#1269, #2422, #2555, #2556). */
+export declare function agentCliChecks(probes: DoctorEnvProbes): DoctorCheck[];
 export declare function runDoctorChecks(probes: DoctorEnvProbes): DoctorCheck[];
-export declare function formatDoctorChecks(checks: DoctorCheck[]): string;
+/** Row icon (#2550): ❌ only for a failure (counted in "N failed"), ➖ for a skipped row, ⚠️ for an optional warning. */
+export declare function doctorCheckIcon(check: DoctorCheck): string;
+/** Outside a repo the models hint is skipped because `factory models --doctor` needs a repo (#2472). */
+export declare function formatDoctorChecks(checks: DoctorCheck[], opts?: {
+    inRepo?: boolean;
+}): string;
 export declare function doctorFailed(checks: DoctorCheck[]): boolean;
 /** Which Claude profile a keychain probe checked: the keychain service name and, for a
  *  non-default profile, the CLAUDE_CONFIG_DIR it belongs to. Absent = default profile. */
@@ -65,6 +128,10 @@ export interface ClaudeAuthProbeResult {
  *  differential — host ok, sandboxed failed — is a hard doctor failure; that is the one
  *  combination that proves the sandbox, not the credentials, is at fault. */
 export declare function sandboxClaudeAuthChecks(result: ClaudeAuthProbeResult): DoctorCheck[];
+/** #2496: doctor fails on agent sign-in only when no installed agent is signed in. A logged-out
+ *  agent is a warning while another one is signed in, and a hard failure when none is. Skipped
+ *  probes (optional passes, e.g. a `<cli> signed in` row for a CLI not on PATH) never count as signed in. */
+export declare function reconcileAgentAuthChecks(checks: DoctorCheck[]): DoctorCheck[];
 export interface LeaseHealthRow {
     worktreeId: string;
     branch: string;
@@ -138,4 +205,9 @@ export type GreenPrScanResult = {
 export declare function unmergedGreenPrChecks(result: GreenPrScanResult): DoctorCheck[];
 /** One doctor check per user-declared harness, from its `probe` result. */
 export declare function declaredHarnessChecks(probes: DeclaredHarnessProbe[]): DoctorCheck[];
+/** One failed check per models.registry entry whose harness is missing or unknown;
+ *  a single ok row when every entry is valid; nothing when there is no registry. */
+export declare function modelsRegistryChecks(configPath: string, registry: Readonly<Record<string, {
+    harness?: string;
+}>> | undefined, validHarnesses: readonly string[]): DoctorCheck[];
 //# sourceMappingURL=doctor.d.ts.map

package/dist/cli/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAMjE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC,iEAAiE;IACjE,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAED,eAAO,MAAM,gBAAgB,qDAAqD,CAAC;AAEnF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAEhH;AAED;0EAC0E;AAC1E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,MAAM,GAAG,IAAI,CAKhB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,EAAE,CA+KtE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CA0BhE;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAE3D;AAKD;0FAC0F;AAC1F,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6FAA6F;AAC7F,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC,CAAC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GAAG,oBAAoB,CAAC,GAC/C,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAAC,CAAC;AAMvE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,WAAW,CAgC3E;AAED;uFACuF;AACvF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAIhF;AAED,oFAAoF;AACpF,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAKD;;6EAE6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB,GAAG,WAAW,EAAE,CAoCpF;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IACzC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,WAAW,EAAE,CAwBjE;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CAWlE;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,GAAG,WAAW,CAuB9E;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,CAU7E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,CAU3E;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CASxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAStE;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAC7E,MAAM,CAMR;AAED;mGACmG;AACnG,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAUnF;AAED;;yCAEyC;AACzC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAU5E;AAED;8FAC8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,kBAAkB,EAAE,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAIzC,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,EAAE,CAyB9E;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,WAAW,EAAE,CAoBnF"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAMjE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC,qGAAqG;IACrG,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,KAAK,MAAM,GAAG,IAAI,CAAC;IAClE,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,IAAI,GAAG,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5E,uGAAuG;IACvG,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,yGAAyG;IACzG,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC;CAClC;AAED,oEAAoE;AACpE,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC,eAAO,MAAM,gBAAgB,qDAAqD,CAAC;AAEnF,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,iGAA+D,CAAC;AAEpG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAEhH;AAED;0EAC0E;AAC1E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,MAAM,GAAG,IAAI,CAKhB;AAED;oFACoF;AACpF,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAQ1E;AAID;;qDAEqD;AACrD,eAAO,MAAM,kBAAkB,uFAAuF,CAAC;AACvH;;gDAEgD;AAChD,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK/D,CAAC;AACF,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,4FAA4F;AAC5F,eAAO,MAAM,YAAY,0FAA0F,CAAC;AAEpH;;mGAEmG;AACnG,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,KAAK,MAAM,GAAG,IAAI,GAChE,WAAW,CAyBb;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,yEAAyE;AACzE,eAAO,MAAM,aAAa,EAAE,SAAS,YAAY,EAsBhD,CAAC;AAEF,gIAAgI;AAChI,wBAAgB,oBAAoB,CAClC,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,EAC1C,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GACtC,WAAW,EAAE,CAsBf;AAkBD;mGACmG;AACnG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,EAAE,CAmE1E;AAED;iHACiH;AACjH,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,EAAE,CAiBrE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,EAAE,CAqLtE;AAED,uHAAuH;AACvH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAI1D;AAED,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CA4CjG;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAE3D;AAKD;0FAC0F;AAC1F,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6FAA6F;AAC7F,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC,CAAC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GAAG,oBAAoB,CAAC,GAC/C,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAAC,CAAC;AAMvE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,WAAW,CAgC3E;AAED;uFACuF;AACvF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAIhF;AAED,oFAAoF;AACpF,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAKD;;6EAE6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB,GAAG,WAAW,EAAE,CAoCpF;AAID;;6GAE6G;AAC7G,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAS7E;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IACzC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,WAAW,EAAE,CAwBjE;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CAWlE;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,GAAG,WAAW,CAuB9E;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,CAU7E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,CAU3E;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CASxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAStE;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAC7E,MAAM,CAMR;AAED;mGACmG;AACnG,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAUnF;AAED;;yCAEyC;AACzC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAU5E;AAED;8FAC8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,kBAAkB,EAAE,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAIzC,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,EAAE,CAyB9E;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,WAAW,EAAE,CAoBnF;AAID;oFACoF;AACpF,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EACpE,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,WAAW,EAAE,CA0Bf"}

package/dist/cli/doctor.js

@@ -2,8 +2,12 @@
 import { resolve } from 'node:path';
 import { detectSandboxRuntime } from '@on-par/factory-core';
 import { MIN_NODE_MAJOR } from '../node-version.js';
-import { CLAUDE_CODE_URL, GITHUB_TOKENS_URL } from './first-run.js';
+import { availableAgentClis, CLAUDE_CODE_URL, CODEX_CLI_URL, GITHUB_TOKENS_URL } from './first-run.js';
+/** Repo wired-up rows, sectioned only inside a git repo (#2557). */
+export const REPO_SECTION = 'Repo';
 export const NOT_IN_REPO_HINT = 'cd into your repo, then run factory doctor again';
+/** Detail for every repo wired-up row when doctor runs outside a git repository (#2554). */
+export const NOT_IN_REPO_SKIP_DETAIL = `skipped — not inside a git repository; ${NOT_IN_REPO_HINT}`;
 export function hasSandboxRuntime(platform, commandAvailable) {
     return detectSandboxRuntime(platform, commandAvailable) !== 'none';
 }
@@ -15,9 +19,225 @@ export function sandboxAuthSkipDetail(opts) {
     if (!opts.hostOk)
         return 'skipped — host claude auth was not verified';
     if (!opts.inRepo)
-        return `skipped — not inside a git repository; ${NOT_IN_REPO_HINT}`;
+        return NOT_IN_REPO_SKIP_DETAIL;
     return null;
 }
+/** Sign-in method reported by `codex login status`, or null when it shows no login. Never returns
+ *  any part of a credential: only a fixed label is derived from the status text. */
+export function codexAuthMethod(statusOutput) {
+    if (statusOutput === null)
+        return null;
+    const text = statusOutput.toLowerCase();
+    if (!text.includes('logged in') || text.includes('not logged in'))
+        return null;
+    if (text.includes('chatgpt'))
+        return 'ChatGPT';
+    if (text.includes('api key'))
+        return 'API key';
+    if (text.includes('access token'))
+        return 'access token';
+    return 'unknown method';
+}
+const GIT_AUTH_CHECK = 'git auth';
+/** Non-interactive read-only probe of origin. `credential.interactive=never` turns off Git
+ *  Credential Manager UI and an empty `core.askPass` turns off configured askpass programs;
+ *  stored credentials from any helper still work. */
+export const GIT_AUTH_PROBE_CMD = 'git -c credential.interactive=never -c core.askPass= ls-remote --quiet origin HEAD';
+/** GIT_TERMINAL_PROMPT=0 makes git fail instead of asking on the terminal; empty GIT_ASKPASS
+ *  and SSH_ASKPASS turn off askpass programs and ssh's GUI askpass; GCM_INTERACTIVE=never
+ *  turns off Git Credential Manager prompts. */
+export const GIT_AUTH_PROBE_ENV = {
+    GIT_TERMINAL_PROMPT: '0',
+    GIT_ASKPASS: '',
+    SSH_ASKPASS: '',
+    GCM_INTERACTIVE: 'never',
+};
+/** Bounds the probe, e.g. an ssh key passphrase prompt that waits on /dev/tty. */
+export const GIT_AUTH_PROBE_TIMEOUT_MS = 15_000;
+/** Remedy shown only when the git-auth probe fails: wires git's credential helper to gh. */
+export const GIT_AUTH_FIX = 'run `gh auth setup-git` so git uses your gh credentials, then re-run `factory doctor`';
+/** Git-auth check (#2482, #2483): skipped, never failing, outside a git repository or without
+ *  an origin remote. Otherwise runs a non-interactive `git ls-remote` against origin and fails
+ *  when it cannot authenticate. The detail never echoes the origin URL, which may hold a token. */
+export function gitAuthCheck(repoRoot, tryExec) {
+    if (repoRoot === null) {
+        return {
+            name: GIT_AUTH_CHECK,
+            ok: true,
+            optional: true,
+            detail: NOT_IN_REPO_SKIP_DETAIL,
+        };
+    }
+    const origin = tryExec('git remote get-url origin');
+    if (!origin) {
+        return { name: GIT_AUTH_CHECK, ok: true, optional: true, detail: 'skipped — no origin remote configured' };
+    }
+    // An empty string is exit 0 with no HEAD ref (an empty repo): still authenticated.
+    const probe = tryExec(GIT_AUTH_PROBE_CMD, { env: { ...GIT_AUTH_PROBE_ENV }, timeoutMs: GIT_AUTH_PROBE_TIMEOUT_MS });
+    if (probe === null) {
+        return {
+            name: GIT_AUTH_CHECK,
+            ok: false,
+            detail: 'git could not authenticate to origin non-interactively (prompting disabled)',
+            fix: GIT_AUTH_FIX,
+            next: 'gh auth setup-git',
+        };
+    }
+    return { name: GIT_AUTH_CHECK, ok: true, detail: 'git can authenticate to origin non-interactively' };
+}
+/** One doctor section per built-in harness (#2555), in display order. */
+export const HARNESS_SETUP = [
+    {
+        section: 'Claude Code',
+        cli: 'claude',
+        install: 'npm install -g @anthropic-ai/claude-code',
+        login: 'claude /login',
+        envKeys: ['ANTHROPIC_API_KEY', 'CLAUDE_CODE_OAUTH_TOKEN'],
+    },
+    {
+        section: 'Codex',
+        cli: 'codex',
+        install: 'npm install -g @openai/codex',
+        login: 'codex login',
+        envKeys: ['CODEX_API_KEY'],
+    },
+    {
+        section: 'OpenCode',
+        cli: 'opencode',
+        install: 'npm install -g opencode-ai',
+        login: 'opencode auth login',
+        envKeys: ['OPENCODE_API_KEY'],
+    },
+];
+/** One optional `<cli> installed` row per harness, with the CLI version when found and the install command when not (#2555). */
+export function harnessInstallChecks(commandAvailable, tryExec) {
+    return HARNESS_SETUP.map(({ section, cli, install }) => {
+        const name = `${cli} installed`;
+        if (!commandAvailable(cli)) {
+            return {
+                name,
+                section,
+                ok: false,
+                optional: true,
+                detail: `${cli} not found on PATH, ${cli} routes unavailable`,
+                fix: `install ${section}: ${install}`,
+            };
+        }
+        const version = tryExec(`${cli} --version`)?.trim().split('\n')[0]?.trim();
+        return {
+            name,
+            section,
+            ok: true,
+            optional: true,
+            detail: version ? `found on PATH (${version})` : 'found on PATH (version unknown)',
+        };
+    });
+}
+const SIGN_IN_EVIDENCE = {
+    claude: 'no ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN or stored login',
+    codex: 'no CODEX_API_KEY or codex login; API billing: codex login --with-api-key; headless: codex login --device-auth',
+    opencode: 'no OPENCODE_API_KEY or stored auth login',
+};
+function safe(fn) {
+    if (!fn)
+        return false;
+    try {
+        return fn();
+    }
+    catch {
+        return false;
+    }
+}
+/** One `<cli> signed in` row per harness (#2556), judged only from local evidence: an env key,
+ *  stored credentials, or `codex login status`. Never runs inference and never prints a secret. */
+export function harnessSignInChecks(probes) {
+    const { commandAvailable, envPresent, tryExec } = probes;
+    const found = availableAgentClis(commandAvailable);
+    return HARNESS_SETUP.map(({ section, cli, login, envKeys }) => {
+        const name = `${cli} signed in`;
+        if (!commandAvailable(cli)) {
+            return { name, section, ok: true, optional: true, detail: `skipped — ${cli} not installed` };
+        }
+        const fix = `sign in to ${section}: ${login}`;
+        if (cli === 'codex') {
+            const key = envKeys.find((k) => envPresent(k));
+            if (key)
+                return { name, section, ok: true, detail: `signed in (${key} set)` };
+            const method = codexAuthMethod(tryExec('codex login status 2>&1'));
+            const session = method === 'ChatGPT' ? (probes.codexSessionState?.() ?? 'unknown') : 'unknown';
+            if (session === 'unusable') {
+                return {
+                    name,
+                    section,
+                    ok: false,
+                    optional: found.length > 1,
+                    detail: 'ChatGPT session in auth.json is unusable (unreadable, or no valid access token and no refresh token)',
+                    fix,
+                    next: login,
+                };
+            }
+            if (session === 'refresh-pending') {
+                return {
+                    name,
+                    section,
+                    ok: true,
+                    detail: 'logged in with ChatGPT; access token expired, codex refreshes it on the next run (run `codex login` if that run fails with 401)',
+                };
+            }
+            if (method) {
+                return {
+                    name,
+                    section,
+                    ok: true,
+                    detail: method === 'ChatGPT'
+                        ? 'logged in with ChatGPT; runs draw on your ChatGPT plan limits (manage usage in ChatGPT settings)'
+                        : `logged in with ${method}`,
+                };
+            }
+        }
+        else {
+            const key = envKeys.find((k) => envPresent(k));
+            if (key)
+                return { name, section, ok: true, detail: `signed in (${key} set)` };
+            if (cli === 'claude' && safe(probes.claudeLoggedIn)) {
+                return { name, section, ok: true, detail: 'signed in (stored Claude Code login found)' };
+            }
+            if (cli === 'opencode' && safe(probes.opencodeLoggedIn)) {
+                return { name, section, ok: true, detail: 'signed in (stored opencode auth login found)' };
+            }
+        }
+        return {
+            name,
+            section,
+            ok: false,
+            // Required only when this is the sole agent: then nothing else can run.
+            optional: found.length > 1,
+            detail: `unverified — no sign-in evidence (${SIGN_IN_EVIDENCE[cli]})`,
+            fix,
+            next: login,
+        };
+    });
+}
+/** Coding agent prerequisites: at least one agent CLI is required; each CLI is then reported
+ *  on its own optional line, with sign-in reported separately from installation (#1269, #2422, #2555, #2556). */
+export function agentCliChecks(probes) {
+    const { commandAvailable, tryExec } = probes;
+    const found = availableAgentClis(commandAvailable);
+    const checks = [
+        found.length > 0
+            ? { name: 'coding agent', ok: true, detail: `found ${found.join(', ')}` }
+            : {
+                name: 'coding agent',
+                ok: false,
+                detail: 'no coding agent CLI on PATH (claude, codex or opencode)',
+                fix: `install Claude Code (${CLAUDE_CODE_URL}) or the Codex CLI (${CODEX_CLI_URL})`,
+                next: HARNESS_SETUP[0].install,
+            },
+    ];
+    checks.push(...harnessInstallChecks(commandAvailable, tryExec));
+    checks.push(...harnessSignInChecks(probes));
+    return checks;
+}
 export function runDoctorChecks(probes) {
     const { commandAvailable, envPresent, tryExec, pathExists, distFreshness } = probes;
     const checks = [];
@@ -31,34 +251,37 @@ export function runDoctorChecks(probes) {
             detail: 'not inside a git repository — repo checks skipped',
             fix: NOT_IN_REPO_HINT,
         });
-    const userName = tryExec('git config user.name');
-    const userEmail = tryExec('git config user.email');
-    if (userName && userEmail) {
-        checks.push({ name: 'git identity', ok: true, detail: `${userName} <${userEmail}>` });
+    const repoSection = repoRoot === null ? {} : { section: REPO_SECTION };
+    if (repoRoot === null) {
+        checks.push({ name: 'git identity', ok: false, optional: true, detail: NOT_IN_REPO_SKIP_DETAIL });
     }
     else {
-        const missing = [!userName && 'user.name', !userEmail && 'user.email'].filter(Boolean).join(' and ');
-        checks.push({
-            name: 'git identity',
-            ok: false,
-            detail: `${missing} not set`,
-            fix: 'git config --global user.name "Your Name" && git config --global user.email you@example.com',
-        });
+        const userName = tryExec('git config user.name');
+        const userEmail = tryExec('git config user.email');
+        if (userName && userEmail) {
+            checks.push({ name: 'git identity', ok: true, detail: `${userName} <${userEmail}>`, ...repoSection });
+        }
+        else {
+            const missing = [!userName && 'user.name', !userEmail && 'user.email'].filter(Boolean).join(' and ');
+            checks.push({
+                name: 'git identity',
+                ok: false,
+                detail: `${missing} not set`,
+                next: !userName
+                    ? 'git config --global user.name "Your Name"'
+                    : 'git config --global user.email you@example.com',
+                ...repoSection,
+            });
+        }
     }
-    checks.push(commandAvailable('claude')
-        ? { name: 'claude CLI', ok: true, detail: 'found on PATH' }
-        : {
-            name: 'claude CLI',
-            ok: false,
-            detail: 'not found on PATH',
-            fix: `install Claude Code first: ${CLAUDE_CODE_URL}`,
-        });
+    checks.push(...agentCliChecks(probes));
     if (!commandAvailable('gh')) {
         checks.push({
             name: 'gh auth',
             ok: false,
             detail: 'gh CLI not found on PATH',
-            fix: 'install GitHub CLI and run `gh auth login`',
+            fix: 'install GitHub CLI: https://cli.github.com',
+            next: 'gh auth login',
         });
     }
     else if (tryExec('gh auth status') === null) {
@@ -66,12 +289,13 @@ export function runDoctorChecks(probes) {
             name: 'gh auth',
             ok: false,
             detail: 'gh is not authenticated',
-            fix: 'install GitHub CLI and run `gh auth login`',
+            next: 'gh auth login',
         });
     }
     else {
         checks.push({ name: 'gh auth', ok: true, detail: 'authenticated' });
     }
+    checks.push({ ...gitAuthCheck(repoRoot, tryExec), ...repoSection });
     if (envPresent('GITHUB_TOKEN')) {
         checks.push({ name: 'GitHub token', ok: true, detail: 'GITHUB_TOKEN set' });
     }
@@ -89,6 +313,7 @@ export function runDoctorChecks(probes) {
                 ok: false,
                 detail: 'no GITHUB_TOKEN, GH_TOKEN, or gh auth token',
                 fix: `create a token at ${GITHUB_TOKENS_URL} and export it`,
+                next: 'gh auth login',
             });
         }
     }
@@ -105,11 +330,11 @@ export function runDoctorChecks(probes) {
             name: 'git worktree clean',
             ok: false,
             optional: true,
-            detail: `skipped — not a git repository; ${NOT_IN_REPO_HINT}`,
+            detail: NOT_IN_REPO_SKIP_DETAIL,
         });
     }
     else if (tryExec('git status --porcelain') === '') {
-        checks.push({ name: 'git worktree clean', ok: true, detail: 'clean' });
+        checks.push({ name: 'git worktree clean', ok: true, detail: 'clean', ...repoSection });
     }
     else {
         checks.push({
@@ -118,6 +343,7 @@ export function runDoctorChecks(probes) {
             optional: true,
             detail: 'uncommitted changes present',
             fix: 'commit or stash changes before running the factory',
+            ...repoSection,
         });
     }
     const sandboxRuntime = detectSandboxRuntime(probes.platform ?? process.platform, commandAvailable);
@@ -151,19 +377,19 @@ export function runDoctorChecks(probes) {
             name: '.factory initialized',
             ok: false,
             optional: true,
-            detail: `skipped — not a git repository; ${NOT_IN_REPO_HINT}`,
+            detail: NOT_IN_REPO_SKIP_DETAIL,
         });
     }
     else if (pathExists(resolve(repoRoot, '.factory'))) {
-        checks.push({ name: '.factory initialized', ok: true, optional: true, detail: '.factory/ present' });
+        checks.push({ name: '.factory initialized', ok: true, detail: '.factory/ present', ...repoSection });
     }
     else {
         checks.push({
             name: '.factory initialized',
             ok: false,
-            optional: true,
             detail: '.factory/ missing',
-            fix: 'run `factory init`',
+            next: 'factory init',
+            ...repoSection,
         });
     }
     if (distFreshness) {
@@ -175,16 +401,32 @@ export function runDoctorChecks(probes) {
                 ok: false,
                 detail,
                 fix: "run 'npm run build' at the monorepo root",
+                next: 'npm run build',
             });
     }
     return checks;
 }
-export function formatDoctorChecks(checks) {
+/** Row icon (#2550): ❌ only for a failure (counted in "N failed"), ➖ for a skipped row, ⚠️ for an optional warning. */
+export function doctorCheckIcon(check) {
+    if (!check.ok && !check.optional)
+        return '❌';
+    if (/^skipped\b/.test(check.detail))
+        return '➖';
+    return check.ok ? '✅' : '⚠️';
+}
+/** Outside a repo the models hint is skipped because `factory models --doctor` needs a repo (#2472). */
+export function formatDoctorChecks(checks, opts = {}) {
     const lines = ['== factory doctor =='];
     let passed = 0;
     let failed = 0;
     let warnings = 0;
-    for (const check of checks) {
+    const sections = [...new Set(checks.flatMap((c) => (c.section === undefined ? [] : [c.section])))];
+    const ordered = [
+        ...checks.filter((c) => c.section === undefined),
+        ...sections.flatMap((s) => checks.filter((c) => c.section === s)),
+    ];
+    let currentSection;
+    for (const check of ordered) {
         if (check.ok) {
             passed++;
         }
@@ -194,15 +436,24 @@ export function formatDoctorChecks(checks) {
         else {
             failed++;
         }
-        const icon = check.ok ? '✅' : '❌';
+        if (check.section !== undefined && check.section !== currentSection) {
+            lines.push(`-- ${check.section} --`);
+        }
+        currentSection = check.section;
+        const icon = doctorCheckIcon(check);
         lines.push(`  ${icon} ${check.name} — ${check.detail}`);
         if (!check.ok && check.fix) {
             lines.push(`       fix: ${check.fix}`);
         }
+        if (!check.ok && check.next) {
+            lines.push(`       next: ${check.next}`);
+        }
     }
     lines.push(`${passed} passed, ${failed} failed, ${warnings} warnings`);
     lines.push('');
-    lines.push('Model reachability: factory models --doctor');
+    lines.push(opts.inRepo === false
+        ? `Model reachability: ${NOT_IN_REPO_SKIP_DETAIL}`
+        : 'Model reachability: factory models --doctor');
     return lines.join('\n');
 }
 export function doctorFailed(checks) {
@@ -292,6 +543,21 @@ export function sandboxClaudeAuthChecks(result) {
     }
     return [host, sandboxed];
 }
+const AGENT_AUTH_CHECKS = new Set([...HARNESS_SETUP.map(({ cli }) => `${cli} signed in`), HOST_AUTH_CHECK]);
+/** #2496: doctor fails on agent sign-in only when no installed agent is signed in. A logged-out
+ *  agent is a warning while another one is signed in, and a hard failure when none is. Skipped
+ *  probes (optional passes, e.g. a `<cli> signed in` row for a CLI not on PATH) never count as signed in. */
+export function reconcileAgentAuthChecks(checks) {
+    const auth = checks.filter((c) => AGENT_AUTH_CHECKS.has(c.name));
+    const anySignedIn = auth.some((c) => c.ok && c.optional !== true);
+    return checks.map((c) => {
+        if (!AGENT_AUTH_CHECKS.has(c.name) || c.ok)
+            return c;
+        return anySignedIn
+            ? { ...c, optional: true, detail: `${c.detail} (another agent is signed in, so runs can still proceed)` }
+            : { ...c, optional: false };
+    });
+}
 export function leaseChecks(rows) {
     if (rows.length === 0) {
         return [{ name: 'port leases', ok: true, optional: true, detail: 'no active leases' }];
@@ -469,4 +735,37 @@ export function declaredHarnessChecks(probes) {
         };
     });
 }
+const REGISTRY_CHECK = 'models.registry';
+/** One failed check per models.registry entry whose harness is missing or unknown;
+ *  a single ok row when every entry is valid; nothing when there is no registry. */
+export function modelsRegistryChecks(configPath, registry, validHarnesses) {
+    const entries = Object.entries(registry ?? {});
+    if (entries.length === 0)
+        return [];
+    const failed = [];
+    for (const [id, def] of entries) {
+        const field = `models.registry.${id}.harness`;
+        const name = `${REGISTRY_CHECK} ${id}`;
+        if (def.harness === undefined || def.harness.trim() === '') {
+            failed.push({
+                name,
+                ok: false,
+                detail: `${configPath}: ${field} is missing`,
+                fix: `set "harness" to one of: ${validHarnesses.join(', ')}`,
+            });
+        }
+        else if (!validHarnesses.includes(def.harness)) {
+            failed.push({
+                name,
+                ok: false,
+                detail: `${configPath}: ${field} '${def.harness}' is not a known harness (valid harnesses: ${validHarnesses.join(', ')})`,
+                fix: 'use a built-in harness id or declare it under "harnesses" in the models config',
+            });
+        }
+    }
+    if (failed.length > 0)
+        return failed;
+    const n = entries.length;
+    return [{ name: REGISTRY_CHECK, ok: true, detail: `${n} entr${n === 1 ? 'y' : 'ies'} valid (${configPath})` }];
+}
 //# sourceMappingURL=doctor.js.map