@on-par/factory-cli 0.9.3 → 0.9.4

package/dist/cli/index.js

@@ -8,8 +8,8 @@ import { arch, hostname as osHostname, release, platform, userInfo } from 'node:
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { promisify, styleText } from 'node:util';
 import { BRANCH_PREFIX_MATCH_OPTION_DESCRIPTION, BRANCH_PREFIX_OPTION_DESCRIPTION, INVALID_BRANCH_PREFIX_MESSAGE, resolveBranchPrefixOption, } from './branch-prefix.js';
-import { acquirePortLease, aggregateCosts, appendKpiHistoryLine, applyRepoConfig, buildPhase, checkPhase, clearProxyState, closedWorkSkipReason, computeHealthKpis, ConstitutionLoader, createDefaultWorkSourceRegistry, createFileApprovalGate, createLogger, createLaneProxy, defaultFindPortListeners, describeEffectiveConfig, detectPostMergeDefects, diagnoseModels, probeDeclaredHarnesses, drainSteering, estimateTrailingSpend, fetchDefectSources, fetchHumanEventSources, fetchSubscriptionUsage, formatKpiLines, formatUsageReport, getConstitutionsDir, getFactoryPaths, GITHUB_ISSUE_SOURCE, hasUnresolvedPark, InvalidArtifactsDirError, InvalidWorkRequestInputError, InvalidWorkspaceError, inspectPortLeases, isCommandAvailable, isProxyRunning, kpiBranchPrefixes, kpisToHistoryRecord, laneBaseUrl, laneEnv, LaneFileGuard, laneHostLabel, listQueuedSteering, loadFactoryConfigForRepo, loadModelsConfig, loadRepoConfig, loadRoutesConfig, LOCAL_BRIEF_SOURCE, localOnlyWorkspace, joinClassifierOutcomes, mergeClassifierOutcomes, parseClassifierOutcomes, summarizeClassifierOutcomes, formatClassifierReport, mergedPrRefs, ModelRegistry, ModelRouter, parkReasonFor, parseKpiHistory, parseQueue, partitionLocalQueueByActivity, phaseSnapshotFile, planPhase, provisionLaneContainer, ProviderBreaker, readEvents, readPortLeases, readQueue, readUsage, reapOrphanProcesses, reapStalePortLeases, reconstructKpiEvents, recordLeasePgid, releasePortLease, renderKpiReport, renderKpiTrend, resolveAutoFailover, resolveCodexDisabled, resolveDefectWindowDays, resolveBuildPublish, resolveSizeGateMode, parseSizeGateMode, parseMaxSlices, resolveSizeGateMaxSlices, SIZE_GATE_MODES, resolveDesignRegressionBlock, resolveReadinessUpdateIssueBody, resolveEffectiveModelPins, resolveEfficiencyPolicy, resolveLaneBreakerThreshold, resolveEnvironmentPorts, resolveEnvironmentProxy, resolveArtifactsDir, resolveIngestConfig, resolveLocalOnlyPolicy, resolveMergePolicy, resolvePlanApproval, resolveProcessGroupGraceMs, resolveSandboxPolicy, resolveSkipCI, resolveTimeouts, resolveUsageCap, resolveWatchdogPolicy, ReworkHistory, rewriteQueueForDecomposition, runAutoIngest, runIssue, shipPhase, summarizeEvent, formatCostTotal, touchLastEvent, touchRunActivity, validateQueue, watchUsage, worktreeWorkspace, writeBenchmarkArtifacts, writeLocalRunReport, writePhaseSnapshot, writeProxyState, } from '@on-par/factory-core';
-import { acquirePidFile, createPlanReuseStore, checkBaseHealth, currentSlice, egressSummaryMessage, findSlicePlanComment, upsertSlicePlanComment, withSliceState, DEFAULT_GARDEN_MAX_CLUSTERS, DEFAULT_GARDEN_SINCE, capGardenClusters, clusterGarden, dedupGardenClusters, filterGardenOnlyNew, filterGardenWindow, markGardenTrackingUnknown, parseGardenDuration, readHarvestEvents, renderGardenJson, renderGardenReport, formatWorktreeLocation, laneWorktreePath, resolveWorktreeRoot, migrateRepoConfigToYaml, REPO_CONFIG_YAML_HEADER, branchFor, claudeConfigDirOverride, claudeKeychainService, cleanupWorktree, createDaemonLogSink, factoryBranchIssue, factoryBranchPrefixes, getIssueTitle, LEGACY_BRANCH_PREFIX, createDockerEngine, createFactorydServer, createRunRuntime, createShipExecutor, createGithubQueue, createLocalSmallDryRun, createOctokitFilingClient, createOctokitGreenPrClient, createOctokitQueueClient, daemonRuntimePaths, DEFAULT_FACTORYD_PORT, defaultRegistryPath, ensureDir, FACTORY_RUNTIME_CONFIG_KEYS, findUnmergedGreenPrs, formatGcReport, gitFetch, isAutoMergeBlocked, listMicroVms, listOrphanContainers, logCost, logEvent, microVmName, planQueueMigration, readCosts, readGithubQueueSnapshot, reapLaneWorktree, reapOrphanContainers, reapOrphanMicroVm, releaseRuntimeFiles, releaseStaleClaims, resolveBranchPrefix, resolveEffectiveConfig, worktreeSandboxFor, resolveExperimental, resolveFilingPolicy, resolveLocalOnly, resolvePrClassifierPolicy, resolveReviewFloorRules, RunLockHeldError, runOvernightQueue, findOpenPR, parseRemoteSlug, setupWorktree, shellEscape, listBuiltInCheckers, shouldProxyEgress, slugify, startEgressProxy, sweepWorktrees, watchChecks, watchChecksWithInfraRerun, withAdmissionGuard, withFileLock, withGitLock, withRunLock, wrapCommandInSandbox, writePortFile, } from '@on-par/factory-core/internal';
+import { acquirePortLease, aggregateCosts, appendKpiHistoryLine, applyRepoConfig, buildPhase, checkPhase, clearProxyState, closedWorkSkipReason, computeHealthKpis, ConstitutionLoader, createDefaultWorkSourceRegistry, createFileApprovalGate, createLogger, createLaneProxy, defaultFindPortListeners, describeEffectiveConfig, detectPostMergeDefects, diagnoseModels, probeDeclaredHarnesses, drainSteering, estimateTrailingSpend, fetchDefectSources, fetchHumanEventSources, fetchSubscriptionUsage, formatKpiLines, formatUsageReport, getConstitutionsDir, getFactoryPaths, GITHUB_ISSUE_SOURCE, hasUnresolvedPark, InvalidArtifactsDirError, InvalidWorkRequestInputError, InvalidWorkspaceError, inspectPortLeases, isCommandAvailable, isProxyRunning, kpiBranchPrefixes, KNOWN_HARNESS_IDS, kpisToHistoryRecord, laneBaseUrl, laneEnv, LaneFileGuard, laneHostLabel, listQueuedSteering, loadFactoryConfigForRepo, loadModelsConfig, loadRepoConfig, loadRoutesConfig, LOCAL_BRIEF_SOURCE, localOnlyWorkspace, joinClassifierOutcomes, mergeClassifierOutcomes, parseClassifierOutcomes, summarizeClassifierOutcomes, formatClassifierReport, mergedPrRefs, ModelRegistry, ModelRouter, parkReasonFor, parseKpiHistory, parseQueue, partitionLocalQueueByActivity, phaseSnapshotFile, planPhase, provisionLaneContainer, ProviderBreaker, readEvents, readPortLeases, readQueue, readUsage, reapOrphanProcesses, reapStalePortLeases, reconstructKpiEvents, recordLeasePgid, releasePortLease, renderKpiReport, renderKpiTrend, resolveAutoFailover, resolveCodexDisabled, resolveDefectWindowDays, resolveBuildPublish, resolveSizeGateMode, parseSizeGateMode, parseMaxSlices, resolveSizeGateMaxSlices, SIZE_GATE_MODES, resolveDesignRegressionBlock, resolveReadinessUpdateIssueBody, resolveEffectiveModelPins, resolveEfficiencyPolicy, resolveLaneBreakerThreshold, resolveEnvironmentPorts, resolveEnvironmentProxy, resolveArtifactsDir, resolveIngestConfig, resolveLocalOnlyPolicy, resolveMergePolicy, resolvePlanApproval, resolveProcessGroupGraceMs, resolveSandboxPolicy, resolveSkipCI, resolveTimeouts, resolveUsageCap, resolveWatchdogPolicy, ReworkHistory, rewriteQueueForDecomposition, runAutoIngest, runIssue, shipPhase, summarizeEvent, formatCostTotal, touchLastEvent, touchRunActivity, validateQueue, watchUsage, worktreeWorkspace, writeBenchmarkArtifacts, writeLocalRunReport, writePhaseSnapshot, writeProxyState, } from '@on-par/factory-core';
+import { acquirePidFile, createPlanReuseStore, checkBaseHealth, currentSlice, egressSummaryMessage, findSlicePlanComment, upsertSlicePlanComment, withSliceState, DEFAULT_GARDEN_MAX_CLUSTERS, DEFAULT_GARDEN_SINCE, capGardenClusters, clusterGarden, dedupGardenClusters, filterGardenOnlyNew, filterGardenWindow, markGardenTrackingUnknown, parseGardenDuration, readHarvestEvents, renderGardenJson, renderGardenReport, formatWorktreeLocation, laneWorktreePath, resolveWorktreeRoot, migrateRepoConfigToYaml, REPO_CONFIG_YAML_HEADER, branchFor, claudeConfigDirOverride, claudeKeychainService, cleanupWorktree, createDaemonLogSink, factoryBranchIssue, factoryBranchPrefixes, getIssueTitle, LEGACY_BRANCH_PREFIX, createDockerEngine, createFactorydServer, createRunRuntime, createShipExecutor, createGithubQueue, createLocalSmallDryRun, createOctokitFilingClient, createOctokitGreenPrClient, createOctokitQueueClient, daemonRuntimePaths, DEFAULT_FACTORYD_PORT, defaultRegistryPath, ensureDir, FACTORY_RUNTIME_CONFIG_KEYS, findUnmergedGreenPrs, formatGcReport, gitFetch, isAutoMergeBlocked, listMicroVms, listOrphanContainers, logCost, logEvent, microVmName, planQueueMigration, readCosts, readGithubQueueSnapshot, reapLaneWorktree, reapOrphanContainers, reapOrphanMicroVm, releaseRuntimeFiles, releaseStaleClaims, resolveBranchPrefix, resolveEffectiveConfig, worktreeSandboxFor, resolveExperimental, resolveFilingPolicy, resolveLocalOnly, resolvePrClassifierPolicy, resolveReviewFloorRules, RunLockHeldError, runOvernightQueue, findOpenPR, parseRemoteSlug, setupWorktree, shellEscape, listBuiltInCheckers, shouldProxyEgress, slugify, startEgressProxy, sweepWorktrees, watchChecks, watchChecksWithInfraRerun, withAdmissionGuard, withFileLock, withGitLock, withRunLock, wrapCommandInSandbox, writePortFile, buildTriagePrompt, normalizeTriageQueue, parseTriageCandidates, codexChatgptSessionState, hasClaudeLoginEvidence, hasOpencodeLoginEvidence, } from '@on-par/factory-core/internal';
 import { runTui } from '@on-par/factory-tui';
 import { Command } from 'commander';
 import { admissionStateReaderFor, runQueueReconcile } from './admission.js';
@@ -29,8 +29,8 @@ import { buildUsageJson } from './usage-json.js';
 import { parseResetIssues, runReset } from './reset.js';
 import { cmdDaemonLogs, cmdDaemonStart, cmdDaemonStatus, cmdDaemonStop, createAutoUpdateDeps, DaemonCtlError, detectInstall, loadDaemonFileConfig, recoverStaleDrain, resolveFactorydConfig, runAutoUpdateLoop, } from './daemon.js';
 import { checkForUpdate, cmdSelfUpdateCheck } from './self-update.js';
-import { analyzeEventLog, claudeKeychainCheck, doctorFailed, eventLogCheck, formatClaimReconcileReport, formatContainerReconcileReport, formatDoctorChecks, formatMicroVmReconcileReport, formatReconcileReport, formatWorktreeReconcileReport, declaredHarnessChecks, hasSandboxRuntime, leaseChecks, keychainPreflightError, orphanContainerChecks, orphanMicroVmChecks, runDoctorChecks, sandboxAuthSkipDetail, sandboxClaudeAuthChecks, unmergedGreenPrChecks, } from './doctor.js';
-import { DOCS_URL, formatOverview, missingClaudeCliMessage, missingTokenMessage, notInitializedMessage, } from './first-run.js';
+import { analyzeEventLog, claudeKeychainCheck, doctorFailed, eventLogCheck, formatClaimReconcileReport, formatContainerReconcileReport, formatDoctorChecks, formatMicroVmReconcileReport, formatReconcileReport, formatWorktreeReconcileReport, declaredHarnessChecks, hasSandboxRuntime, leaseChecks, keychainPreflightError, orphanContainerChecks, modelsRegistryChecks, orphanMicroVmChecks, runDoctorChecks, sandboxAuthSkipDetail, reconcileAgentAuthChecks, sandboxClaudeAuthChecks, unmergedGreenPrChecks, } from './doctor.js';
+import { DOCS_URL, formatOverview, availableAgentClis, missingAgentCliMessage, missingTokenMessage, notInitializedMessage, } from './first-run.js';
 import { cmdHostedSmoke } from './hosted.js';
 import { cmdHostedQueue } from './hosted-queue.js';
 import { cmdHostedRunner } from './hosted-runner.js';
@@ -179,7 +179,9 @@ function resolvePhaseOps(overrides, base = phaseOps) {
         shipPhase: overrides.shipPhase ?? base.shipPhase,
     };
 }
-export const PREREQUISITES_TEXT = `Prerequisites:
+export const PREREQUISITES_TEXT = `First step: run \`factory doctor\` to check your setup and see what to fix.
+
+Prerequisites:
   - Claude Code CLI installed and authenticated (Claude subscription): https://claude.com/claude-code
   - GitHub CLI authenticated: gh auth login
   - GITHUB_TOKEN or GH_TOKEN set (falls back to \`gh auth token\`)
@@ -339,13 +341,13 @@ async function cmdInit(opts = {}) {
     // Doctor-style validation (policy=auto, N models reachable) — informational, never fails init.
     const modelsConfig = applyRepoConfig(configLoaders.loadModelsConfig(), configLoaders.loadRepoConfig(repoRoot));
     const registry = new coreOps.ModelRegistry(modelsConfig);
-    const diagnoses = coreOps.diagnoseModels(registry, modelDoctorProbes(), resolveExperimental(), resolveLocalOnly());
+    const diagnoses = coreOps.diagnoseModels(registry, modelDoctorProbes({ requireOllamaOnPath: true }), resolveExperimental(), resolveLocalOnly());
     console.log(formatInitReachability(diagnoses));
     if (!hasReachableWorker(diagnoses)) {
         console.log(styleText('yellow', 'No worker model reachable yet — see `factory doctor` and `factory models --doctor`.'));
     }
     console.log(styleText('green', `Initialized ${paths.root}`));
-    console.log(`Next: factory constitution --product <name>, then factory triage`);
+    console.log('Next: factory doctor, then factory triage (optional: factory constitution --product <name> to swap the default constitution)');
 }
 /** Rewrite a checkout's legacy `.factory/` inputs and runtime files to the v2
  * layout. Every write is idempotent so it is safe to run this more than once. */
@@ -723,12 +725,16 @@ export async function cmdConstitution(opts, deps = {}) {
 export function modelStatusIcon(d) {
     return d.reachable ? styleText('green', '✅') : d.unverified ? styleText('yellow', '⚠️') : styleText('red', '❌');
 }
-export function formatDoctorReport(diagnoses) {
+/** Single owner of the `[repo-defined]` marker for models declared in `.factory/config.json` models.registry, shared by `factory models` and `models --doctor` (#2443). */
+export function repoDefinedTag(model, repoDefined) {
+    return repoDefined.has(model) ? styleText('cyan', ' [repo-defined]') : '';
+}
+export function formatDoctorReport(diagnoses, repoDefined = new Set()) {
     const lines = [styleText('bold', '\n== Model Doctor ==')];
     for (const d of diagnoses) {
         const icon = modelStatusIcon(d);
         const tiers = d.tiers.join('/');
-        lines.push(`  ${icon} ${d.model} provider=${d.provider} tier=${tiers} — ${d.reason}`);
+        lines.push(`  ${icon} ${d.model} provider=${d.provider} tier=${tiers} — ${d.reason}${repoDefinedTag(d.model, repoDefined)}`);
     }
     lines.push(`  ${formatReachabilityCount(diagnoses)}`);
     return lines.join('\n');
@@ -736,7 +742,9 @@ export function formatDoctorReport(diagnoses) {
 export function hasReachableWorker(diagnoses) {
     return diagnoses.some((d) => d.reachable && (d.tiers.includes('worker') || d.tiers.includes('worker_fallback')));
 }
-function ollamaModelSet() {
+function ollamaModelSet(requireOnPath = false) {
+    if (requireOnPath && !coreOps.isCommandAvailable('ollama'))
+        return undefined;
     try {
         const out = shellOps.execSync('ollama list', { timeout: 10_000 });
         return new Set(out
@@ -750,9 +758,10 @@ function ollamaModelSet() {
     }
 }
 /** Probes shared by every doctor-style reachability check (init, models --doctor, overnight
- *  preflight), so their counts agree. */
-export function modelDoctorProbes() {
-    const ollamaModels = ollamaModelSet();
+ *  preflight), so their counts agree. init passes `requireOllamaOnPath` so a missing binary never
+ *  reaches the shell (#2507). */
+export function modelDoctorProbes(opts = {}) {
+    const ollamaModels = ollamaModelSet(opts.requireOllamaOnPath === true);
     return {
         commandAvailable: coreOps.isCommandAvailable,
         ollamaModelPresent: ollamaModels ? (model) => ollamaModels.has(model) : undefined,
@@ -760,13 +769,15 @@ export function modelDoctorProbes() {
 }
 async function cmdModels(opts = {}) {
     const repoRoot = await getRepoRoot();
-    const modelsConfig = applyRepoConfig(configLoaders.loadModelsConfig(), configLoaders.loadRepoConfig(repoRoot));
+    const repoConfig = configLoaders.loadRepoConfig(repoRoot);
+    const modelsConfig = applyRepoConfig(configLoaders.loadModelsConfig(), repoConfig);
+    const repoDefined = new Set(Object.keys(repoConfig?.models?.registry ?? {}));
     const registry = new coreOps.ModelRegistry(modelsConfig);
     const allowExperimental = resolveExperimental();
     const localOnly = resolveLocalOnly();
     const diagnoses = coreOps.diagnoseModels(registry, modelDoctorProbes(), allowExperimental, localOnly);
     if (opts.doctor) {
-        console.log(formatDoctorReport(diagnoses));
+        console.log(formatDoctorReport(diagnoses, repoDefined));
         if (!hasReachableWorker(diagnoses)) {
             throw new CliExitError('factory: no worker model is reachable — fix the reasons above before running a queue', 1);
         }
@@ -781,7 +792,7 @@ async function cmdModels(opts = {}) {
         const d = byModel.get(m);
         const avail = d ? modelStatusIcon(d) : styleText('red', '❌');
         const tag = registry.isExperimental(m) ? styleText('yellow', ' [experimental]') : '';
-        console.log(`  ${avail} ${m} tier=${tiers} ${cost}${tag}`);
+        console.log(`  ${avail} ${m} tier=${tiers} ${cost}${tag}${repoDefinedTag(m, repoDefined)}`);
     }
     console.log(styleText('bold', '\n== Tiers =='));
     for (const tier of ['boss', 'worker', 'checker', 'triage']) {
@@ -1560,6 +1571,7 @@ export async function shipIssue(issueNum, opts, ctx, deps = {}) {
             : { ...resolveEffectiveConfig(repoConfig), branchPrefix: opts.branchPrefix },
     };
     const router = new core.ModelRouter(policy.models, policy.routes, false, undefined, policy.effective.allowExperimental, policy.effective.localOnly);
+    router.skipMissingHarnessClis(core.isCommandAvailable);
     let issueSpend = 0;
     let laneSandboxRuntime = 'none';
     const laneWorkspaceBackend = factoryConfig.workspace?.backend === 'disposable-docker' ? 'disposable-docker' : 'worktree';
@@ -2014,8 +2026,8 @@ export async function sweepBetweenLaneIssues(issue, lane, repoRoot, ghRepo, path
     }
 }
 async function cmdShip(issueNum, opts) {
-    if (!coreOps.isCommandAvailable('claude')) {
-        throw new CliExitError(`factory: ${missingClaudeCliMessage()}`, 2);
+    if (availableAgentClis(coreOps.isCommandAvailable).length === 0) {
+        throw new CliExitError(`factory: ${missingAgentCliMessage()}`, 2);
     }
     const repoRoot = await getRepoRoot();
     const paths = getFactoryPaths(repoRoot);
@@ -2050,13 +2062,16 @@ async function cmdShip(issueNum, opts) {
         catch (err) {
             if (err instanceof IssueSkippedError)
                 return;
+            // #2492: a pull request number is a usage error, not a failed ship.
+            if (err instanceof InvalidWorkRequestInputError)
+                throw new CliExitError(`factory: ${err.message}`, 2);
             throw new CliExitError(`Ship failed for issue #${issueNum}: ${err.message}`, 1);
         }
     });
 }
 async function cmdRunIssue(issueNum, opts) {
-    if (!coreOps.isCommandAvailable('claude')) {
-        throw new CliExitError(`factory: ${missingClaudeCliMessage()}`, 2);
+    if (availableAgentClis(coreOps.isCommandAvailable).length === 0) {
+        throw new CliExitError(`factory: ${missingAgentCliMessage()}`, 2);
     }
     const repoRoot = await getRepoRoot();
     const paths = getFactoryPaths(repoRoot);
@@ -2173,8 +2188,8 @@ async function runDecomposedChildren(parent, children, opts, env) {
     }
 }
 async function cmdRunBrief(briefPath, opts) {
-    if (!coreOps.isCommandAvailable('claude')) {
-        throw new CliExitError(`factory: ${missingClaudeCliMessage()}`, 2);
+    if (availableAgentClis(coreOps.isCommandAvailable).length === 0) {
+        throw new CliExitError(`factory: ${missingAgentCliMessage()}`, 2);
     }
     const repoRoot = await getRepoRoot();
     const paths = getFactoryPaths(repoRoot);
@@ -2290,8 +2305,8 @@ async function cmdLocalSmallOvernight(opts) {
         const ghRepo = await getGitHubRepo();
         process.env.FACTORY_LOCAL_ONLY = '1';
         const preflight = async () => {
-            if (!coreOps.isCommandAvailable('claude'))
-                return { ok: false, reason: missingClaudeCliMessage() };
+            if (availableAgentClis(coreOps.isCommandAvailable).length === 0)
+                return { ok: false, reason: missingAgentCliMessage() };
             const registry = new coreOps.ModelRegistry(applyRepoConfig(configLoaders.loadModelsConfig(), configLoaders.loadRepoConfig(repoRoot)));
             const diagnoses = coreOps.diagnoseModels(registry, modelDoctorProbes(), resolveExperimental(), true);
             if (!hasReachableWorker(diagnoses)) {
@@ -2635,28 +2650,33 @@ async function cmdTriage(opts) {
     const routesConfig = configLoaders.loadRoutesConfig();
     const effective = resolveEffectiveConfig(repoConfig);
     const router = new coreOps.ModelRouter(modelsConfig, routesConfig, false, undefined, effective.allowExperimental, effective.localOnly);
-    // Triage always runs `claude -p`, so only claude-cli models with a flag are runnable.
-    const registry = router.registryRef;
-    const resolved = router.resolveAll('triage');
-    const candidates = resolved.length > 0 ? resolved : ['claude-sonnet-5'];
-    const model = candidates.find((m) => registry.getHarnessId(m) === 'claude-cli' && registry.getClaudeFlag(m));
-    const flag = model ? registry.getClaudeFlag(model) : undefined;
-    const constitutionNote = product ? `Active constitution: ${product}.` : '';
-    const prompt = `Triage the open GitHub issues of ${ghRepo} for an autonomous software factory.
-${constitutionNote}
-Run: gh issue list --repo ${ghRepo} --state open --limit 100 --json number,title,labels,body
-Read every body. Exclude epics/PRDs/meta, external-account/credential/outreach issues,
-and anything too vague. Group by lane (same-file issues together). Order by dependency then value.
-Write ONLY the queue to ${paths.queueProposed} in format '<lane> <issue#>', with '#' comments
-explaining exclusions.`;
+    router.skipMissingHarnessClis(coreOps.isCommandAvailable);
+    router.setCostSink((entry) => logCost(paths.costs, { ...entry, issue: '-' }));
     let plannerError;
-    logEvent(paths.events, 'triage', '-', `Triaging ${ghRepo} with ${flag ?? 'claude default model'}`);
-    await shellOps
-        .exec(`claude -p ${shellEscape(prompt)} ${flag ? `--model ${flag}` : ''} --allowedTools "Bash(gh issue:*)" "Bash(gh repo:*)" Read Glob Grep Write`)
-        .catch((err) => {
+    let model;
+    try {
+        const { stdout: listed } = await shellOps.exec(`gh issue list --repo ${shellEscape(ghRepo)} --state open --limit 100 --json number,title,labels,body`);
+        const prompt = buildTriagePrompt({ repo: ghRepo, product, candidates: parseTriageCandidates(listed || '[]') });
+        logEvent(paths.events, 'triage', '-', `Triaging ${ghRepo} via the triage route`);
+        const result = await router.run('triage', prompt, {
+            worktree: repoRoot,
+            timeoutSeconds: 600,
+            ...(opts.model ? { modelOverride: opts.model } : {}),
+            onLog: (msg) => logEvent(paths.events, 'triage', '-', msg),
+        });
+        model = result.model;
+        const queue = normalizeTriageQueue(result.output);
+        if (queue) {
+            const header = `# Triage queue (model ${model}${product ? `, constitution ${product}` : ''})\n`;
+            writeFileSync(paths.queueProposed, header + queue);
+        }
+    }
+    catch (err) {
         plannerError = err;
         logEvent(paths.events, 'warn', '-', `triage planner failed: ${errorDetail(err)}`);
-    });
+    }
+    if (model)
+        logEvent(paths.events, 'triage', '-', `Triaged ${ghRepo} with ${model}`);
     const proposed = existsSync(paths.queueProposed) ? readFileSync(paths.queueProposed, 'utf-8') : '';
     const message = triageProposalMessage(proposed, paths.queueProposed, paths.queue);
     if (message) {
@@ -4366,9 +4386,15 @@ async function cmdDoctor(opts = {}) {
     const checks = runDoctorChecks({
         commandAvailable: coreOps.isCommandAvailable,
         envPresent: (key) => !!process.env[key],
-        tryExec: (cmd) => {
+        tryExec: (cmd, opts) => {
             try {
-                return shellOps.execSync(cmd, { timeout: 10_000, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+                return shellOps
+                    .execSync(cmd, {
+                    timeout: opts?.timeoutMs ?? 10_000,
+                    stdio: ['ignore', 'pipe', 'ignore'],
+                    ...(opts?.env ? { env: { ...process.env, ...opts.env } } : {}),
+                })
+                    .trim();
             }
             catch {
                 return null;
@@ -4376,6 +4402,14 @@ async function cmdDoctor(opts = {}) {
         },
         pathExists: existsSync,
         distFreshness: distFreshnessProbe(import.meta.url),
+        codexSessionState: () => codexChatgptSessionState(),
+        claudeLoggedIn: () => hasClaudeLoginEvidence({
+            exec: (file, args) => {
+                shellOps.execSync([file, ...args].map(shellEscape).join(' '), { timeout: 10_000, stdio: 'ignore' });
+            },
+            fileExists: existsSync,
+        }),
+        opencodeLoggedIn: () => hasOpencodeLoginEvidence(),
     });
     let repoRoot;
     try {
@@ -4389,53 +4423,57 @@ async function cmdDoctor(opts = {}) {
     catch {
         repoRoot = null;
     }
-    const CLAUDE_AUTH_PROBE = 'claude -p "reply with exactly: ok"';
-    const probeExec = (cmd) => {
-        try {
-            return shellOps.execSync(cmd, { timeout: 120_000, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-        }
-        catch {
-            return null;
-        }
-    };
-    let host = 'skipped';
-    let hostDetail = 'skipped — claude CLI not on PATH';
-    if (coreOps.isCommandAvailable('claude')) {
-        host = probeExec(CLAUDE_AUTH_PROBE) === null ? 'failed' : 'ok';
-        hostDetail = host === 'ok' ? 'claude -p succeeded on the host' : 'claude -p failed on the host';
-    }
-    let sandboxed = 'skipped';
-    let sandboxDetail = 'skipped — host claude auth was not verified';
-    const runtimeAvailable = hasSandboxRuntime(process.platform, (cmd) => isCommandAvailableViaShell(shellOps, cmd));
-    const skip = sandboxAuthSkipDetail({ runtimeAvailable, hostOk: host === 'ok', inRepo: repoRoot !== null });
-    if (skip !== null) {
-        sandboxDetail = skip;
-    }
-    else if (repoRoot !== null) {
-        const policy = resolveSandboxPolicy(configLoaders.loadFactoryConfigForRepo(getFactoryPaths(repoRoot).config).sandbox, {
-            worktree: repoRoot,
-            repoRoot,
-            isAvailable: (cmd) => isCommandAvailableViaShell(shellOps, cmd),
-        });
-        if (!policy) {
-            sandboxDetail = 'skipped — sandbox disabled by config or FACTORY_SANDBOX';
-        }
-        else if (policy.runtime === 'none') {
-            sandboxDetail = 'skipped — no sandbox runtime (sandbox-exec/firejail) on this host';
-        }
-        else if (policy.runtime === 'docker-sandbox') {
-            sandboxDetail = 'skipped — docker-sandbox containment is the microVM, not command wrapping (#653)';
-        }
-        else {
-            sandboxed = probeExec(wrapCommandInSandbox(CLAUDE_AUTH_PROBE, policy)) === null ? 'failed' : 'ok';
-            sandboxDetail =
-                sandboxed === 'ok'
-                    ? `claude -p succeeded under ${policy.runtime}`
-                    : `claude -p failed under ${policy.runtime} (local_auth)`;
+    // Only with --probe-inference: these send a real prompt (uses quota). Plain doctor makes no inference call.
+    if (opts.probeInference) {
+        const CLAUDE_AUTH_PROBE = 'claude -p "reply with exactly: ok"';
+        const probeExec = (cmd) => {
+            try {
+                return shellOps.execSync(cmd, { timeout: 120_000, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+            }
+            catch {
+                return null;
+            }
+        };
+        let host = 'skipped';
+        let hostDetail = 'skipped — claude CLI not on PATH';
+        if (coreOps.isCommandAvailable('claude')) {
+            host = probeExec(CLAUDE_AUTH_PROBE) === null ? 'failed' : 'ok';
+            hostDetail = host === 'ok' ? 'claude -p succeeded on the host' : 'claude -p failed on the host';
+        }
+        let sandboxed = 'skipped';
+        let sandboxDetail = 'skipped — host claude auth was not verified';
+        const runtimeAvailable = hasSandboxRuntime(process.platform, (cmd) => isCommandAvailableViaShell(shellOps, cmd));
+        const skip = sandboxAuthSkipDetail({ runtimeAvailable, hostOk: host === 'ok', inRepo: repoRoot !== null });
+        if (skip !== null) {
+            sandboxDetail = skip;
+        }
+        else if (repoRoot !== null) {
+            const policy = resolveSandboxPolicy(configLoaders.loadFactoryConfigForRepo(getFactoryPaths(repoRoot).config).sandbox, {
+                worktree: repoRoot,
+                repoRoot,
+                isAvailable: (cmd) => isCommandAvailableViaShell(shellOps, cmd),
+            });
+            if (!policy) {
+                sandboxDetail = 'skipped — sandbox disabled by config or FACTORY_SANDBOX';
+            }
+            else if (policy.runtime === 'none') {
+                sandboxDetail = 'skipped — no sandbox runtime (sandbox-exec/firejail) on this host';
+            }
+            else if (policy.runtime === 'docker-sandbox') {
+                sandboxDetail = 'skipped — docker-sandbox containment is the microVM, not command wrapping (#653)';
+            }
+            else {
+                sandboxed = probeExec(wrapCommandInSandbox(CLAUDE_AUTH_PROBE, policy)) === null ? 'failed' : 'ok';
+                sandboxDetail =
+                    sandboxed === 'ok'
+                        ? `claude -p succeeded under ${policy.runtime}`
+                        : `claude -p failed under ${policy.runtime} (local_auth)`;
+            }
         }
+        checks.push(...sandboxClaudeAuthChecks({ host, sandboxed, hostDetail, sandboxDetail }));
     }
     checks.push(claudeKeychainCheck(probeClaudeKeychain()));
-    checks.push(...sandboxClaudeAuthChecks({ host, sandboxed, hostDetail, sandboxDetail }));
+    checks.splice(0, checks.length, ...reconcileAgentAuthChecks(checks));
     if (repoRoot !== null) {
         const paths = getFactoryPaths(repoRoot);
         const factoryConfig = configLoaders.loadFactoryConfigForRepo(paths.config);
@@ -4455,6 +4493,16 @@ async function cmdDoctor(opts = {}) {
         checks.push(stopSentinelCheck(readStopFileStatus(paths)));
         const eventsContent = existsSync(paths.events) ? readFileSync(paths.events, 'utf-8') : null;
         checks.push(eventLogCheck(eventsContent === null ? null : analyzeEventLog(eventsContent)));
+        try {
+            const declared = Object.keys(configLoaders.loadModelsConfig().harnesses ?? {});
+            checks.push(...modelsRegistryChecks(paths.config, configLoaders.loadRepoConfig(repoRoot)?.models?.registry, [
+                ...KNOWN_HARNESS_IDS,
+                ...declared,
+            ]));
+        }
+        catch {
+            // malformed config is reported by the load paths / `factory models --doctor`; doctor keeps going
+        }
         let harnessProbes = [];
         try {
             const registry = new coreOps.ModelRegistry(applyRepoConfig(configLoaders.loadModelsConfig(), configLoaders.loadRepoConfig(repoRoot)));
@@ -4524,7 +4572,7 @@ async function cmdDoctor(opts = {}) {
             }
         }
     }
-    console.log(formatDoctorChecks(checks));
+    console.log(formatDoctorChecks(checks, { inRepo: repoRoot !== null }));
     if (doctorFailed(checks))
         process.exit(1);
 }
@@ -4648,8 +4696,9 @@ export async function main(argv = process.argv, deps = {}) {
         .action(cmdModels);
     program
         .command('doctor')
-        .description('Check your environment (git, claude, gh auth, GitHub token, npm, sandbox, .factory/)')
+        .description('Check your environment (git, agent install and sign-in, gh auth, GitHub token, npm, sandbox, .factory/)')
         .option('--reconcile', 'Reap stale port leases, dead-run worktrees, stale issue claims, orphan sf-job-*/factory.managed containers, and orphan factory-* sbx VMs')
+        .option('--probe-inference', 'Also send one real prompt with claude -p on the host and in the sandbox to verify Claude auth (uses quota)')
         .action((opts) => cmdDoctor(opts));
     program
         .command('cost')
@@ -4746,6 +4795,7 @@ export async function main(argv = process.argv, deps = {}) {
         .command('triage')
         .description('Have a model propose a queue from open issues into .factory/queue.proposed')
         .option('--product <name>', 'Product constitution to scope triage')
+        .option('--model <id>', 'Model to triage with (any registered model, Claude or Codex)')
         .action(cmdTriage);
     triage
         .command('accept')