@on-par/factory-cli 0.9.4 → 0.9.5-next.10

package/README.md

@@ -6,7 +6,7 @@ On PAR Dev's Software Factory is a local CLI that takes a GitHub issue through p
 
 Built in TypeScript. Routes work across Claude and Codex, with experimental local models through Ollama, and logs cost per task.
 
-![On PAR Dev's Software Factory running a Sound Buddy lane (sped up)](https://raw.githubusercontent.com/on-par/software-factory/main/docs/assets/factory-run.gif)
+![On PAR Dev's Software Factory running a lane on a real product repo (sped up)](https://raw.githubusercontent.com/on-par/software-factory/main/docs/assets/factory-run.gif)
 
 ## Install
 
@@ -16,7 +16,7 @@ factory --version
 factory doctor
 ```
 
-Also requires `git`, one supported coding agent CLI (see [docs/agents.md](https://github.com/on-par/software-factory/blob/main/docs/agents.md)), signed in, and the GitHub CLI signed in with `gh auth login`. The factory reads `GITHUB_TOKEN`, then `GH_TOKEN`, and falls back to `gh auth token`. `factory doctor` checks all of this and prints a fix for anything missing. It also checks your git identity and the sandbox runtime, and it runs outside a repo.
+Also requires `git`, one supported coding agent CLI (see [docs/agents.md](https://github.com/on-par/software-factory/blob/main/docs/agents.md)), signed in, and the GitHub CLI signed in with `gh auth login`. The factory reads `GITHUB_TOKEN`, then `GH_TOKEN`, and falls back to `gh auth token`. `factory doctor` checks all of this and prints a fix for anything missing. It also checks your git identity and the sandbox runtime, and it runs outside a repo. Global or repo-local `git config` for `user.name` and `user.email` both work. On Linux, install `firejail` first: without it, Codex runs with `--sandbox danger-full-access`.
 
 `factory init` creates a local-only `.factory/` (git-excluded) with a `default-code` constitution. See the main README quick start.
 
@@ -30,7 +30,7 @@ Agents run with their permission prompts off (Claude Code with `--permission-mod
 npm install -g @on-par/factory-cli@latest
 ```
 
-Automatic updates are planned: [#2354](https://github.com/on-par/software-factory/issues/2354), [#2355](https://github.com/on-par/software-factory/issues/2355).
+`factory self-update --check` reports whether a newer release is on npm. It works in 0.9.3 and later. Automatic updates are planned: [#2355](https://github.com/on-par/software-factory/issues/2355), [#1939](https://github.com/on-par/software-factory/issues/1939).
 
 ## Documentation
 

package/dist/cli/doctor.d.ts

@@ -1,4 +1,5 @@
 import type { DeclaredHarnessProbe } from '@on-par/factory-core';
+import type { ConfigLintInput } from '@on-par/factory-core/internal';
 export interface DoctorCheck {
     name: string;
     ok: boolean;
@@ -18,6 +19,14 @@ export interface DoctorExecOptions {
     /** Kill the command after this many ms; the probe then returns null. */
     timeoutMs?: number;
 }
+/** A declared, agentic command harness the repo's models.registry uses (#2691). */
+export interface ConfiguredCommandHarness {
+    harness: string;
+    /** The declared `command` template, verbatim. */
+    command: string;
+    /** First token of `command` to look up on PATH; null when it cannot be parsed safely. */
+    executable: string | null;
+}
 export interface DoctorEnvProbes {
     commandAvailable: (cmd: string) => boolean;
     envPresent: (key: string) => boolean;
@@ -34,14 +43,26 @@ export interface DoctorEnvProbes {
     codexSessionState?: () => 'ok' | 'refresh-pending' | 'unusable' | 'unknown';
     /** Whether a stored Claude Code login exists (#2556); reads local state only, never runs inference. */
     claudeLoggedIn?: () => boolean;
+    /** Stored Claude Code OAuth session state (#2721), read locally; never refreshes. */
+    claudeSessionState?: () => 'ok' | 'refresh-pending' | 'unusable' | 'unknown';
+    /** The agent's last recorded run-time local_auth failure when no login has happened since
+     *  (#2733); reads local state only, never refreshes. */
+    localAuthFailure?: (agent: 'claude' | 'codex') => {
+        agent: string;
+        at: string;
+    } | null;
     /** Whether a stored opencode auth login exists (#2556); reads local state only, never runs inference. */
     opencodeLoggedIn?: () => boolean;
+    /** Repo-configured command harnesses (#2691); absent or [] means none. */
+    commandHarnesses?: () => ConfiguredCommandHarness[];
 }
+/** Section for rows about repo-configured command harnesses (#2691). */
+export declare const COMMAND_HARNESS_SECTION = "Command harness";
 /** Repo wired-up rows, sectioned only inside a git repo (#2557). */
 export declare const REPO_SECTION = "Repo";
 export declare const NOT_IN_REPO_HINT = "cd into your repo, then run factory doctor again";
 /** Detail for every repo wired-up row when doctor runs outside a git repository (#2554). */
-export declare const NOT_IN_REPO_SKIP_DETAIL = "skipped \u2014 not inside a git repository; cd into your repo, then run factory doctor again";
+export declare const NOT_IN_REPO_SKIP_DETAIL = "skipped: not inside a git repository; cd into your repo, then run factory doctor again";
 export declare function hasSandboxRuntime(platform: NodeJS.Platform, commandAvailable: (cmd: string) => boolean): boolean;
 /** Reason the sandboxed claude auth probe is skipped before a sandbox policy is resolved,
  *  or null when cmdDoctor should resolve the policy as before (#2383). */
@@ -71,6 +92,8 @@ export declare const GIT_AUTH_FIX = "run `gh auth setup-git` so git uses your gh
 export declare function gitAuthCheck(repoRoot: string | null, tryExec: (cmd: string, opts?: DoctorExecOptions) => string | null): DoctorCheck;
 export interface HarnessSetup {
     section: string;
+    /** HARNESS_CATALOG id whose CLI probe decides whether this harness is installed (#2631). */
+    harnessId: string;
     cli: string;
     install: string;
     /** Exact shell command that signs the harness in (#2556); also the row's `next` command. */
@@ -82,11 +105,24 @@ export interface HarnessSetup {
 export declare const HARNESS_SETUP: readonly HarnessSetup[];
 /** One optional `<cli> installed` row per harness, with the CLI version when found and the install command when not (#2555). */
 export declare function harnessInstallChecks(commandAvailable: (cmd: string) => boolean, tryExec: (cmd: string) => string | null): DoctorCheck[];
-/** One `<cli> signed in` row per harness (#2556), judged only from local evidence: an env key,
+/** One `<cli> signed in` row per installed harness CLI (#2556, #2631), judged only from local evidence: an env key,
  *  stored credentials, or `codex login status`. Never runs inference and never prints a secret. */
 export declare function harnessSignInChecks(probes: DoctorEnvProbes): DoctorCheck[];
+/** The executable (first token) of a command template, or null when it cannot be parsed safely (#2691).
+ *  Guards `isCommandAvailable`, which interpolates into `command -v` unescaped. */
+export declare function commandExecutable(command: string): string | null;
+/** Declared, agentic command harnesses that at least one repo `models.registry` entry uses (#2691). */
+export declare function repoCommandHarnesses(harnesses: Readonly<Record<string, {
+    command: string;
+    agentic: boolean;
+}>> | undefined, registry: Readonly<Record<string, {
+    harness?: string;
+}>> | undefined): ConfiguredCommandHarness[];
+/** One optional `command harness <id>` row per configured command harness (#2691). */
+export declare function commandHarnessChecks(harnesses: readonly ConfiguredCommandHarness[], commandAvailable: (cmd: string) => boolean): DoctorCheck[];
 /** Coding agent prerequisites: at least one agent CLI is required; each CLI is then reported
- *  on its own optional line, with sign-in reported separately from installation (#1269, #2422, #2555, #2556). */
+ *  on its own optional line, with sign-in reported separately from installation (#1269, #2422, #2555, #2556).
+ *  A repo-configured command harness whose executable is on PATH also counts as a coding agent (#2691). */
 export declare function agentCliChecks(probes: DoctorEnvProbes): DoctorCheck[];
 export declare function runDoctorChecks(probes: DoctorEnvProbes): DoctorCheck[];
 /** Row icon (#2550): ❌ only for a failure (counted in "N failed"), ➖ for a skipped row, ⚠️ for an optional warning. */
@@ -210,4 +246,7 @@ export declare function declaredHarnessChecks(probes: DeclaredHarnessProbe[]): D
 export declare function modelsRegistryChecks(configPath: string, registry: Readonly<Record<string, {
     harness?: string;
 }>> | undefined, validHarnesses: readonly string[]): DoctorCheck[];
+/** `config` rows from the shared pre-PLAN lint (#2612): one failing row per finding, so doctor fails exactly when
+ *  the run preflight would escalate or park. A single ok row when clean. Read-only. */
+export declare function configLintChecks(input: ConfigLintInput, loadError?: string): DoctorCheck[];
 //# sourceMappingURL=doctor.d.ts.map

package/dist/cli/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAMjE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC,qGAAqG;IACrG,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,KAAK,MAAM,GAAG,IAAI,CAAC;IAClE,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,IAAI,GAAG,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5E,uGAAuG;IACvG,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,yGAAyG;IACzG,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC;CAClC;AAED,oEAAoE;AACpE,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC,eAAO,MAAM,gBAAgB,qDAAqD,CAAC;AAEnF,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,iGAA+D,CAAC;AAEpG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAEhH;AAED;0EAC0E;AAC1E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,MAAM,GAAG,IAAI,CAKhB;AAED;oFACoF;AACpF,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAQ1E;AAID;;qDAEqD;AACrD,eAAO,MAAM,kBAAkB,uFAAuF,CAAC;AACvH;;gDAEgD;AAChD,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK/D,CAAC;AACF,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,4FAA4F;AAC5F,eAAO,MAAM,YAAY,0FAA0F,CAAC;AAEpH;;mGAEmG;AACnG,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,KAAK,MAAM,GAAG,IAAI,GAChE,WAAW,CAyBb;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,yEAAyE;AACzE,eAAO,MAAM,aAAa,EAAE,SAAS,YAAY,EAsBhD,CAAC;AAEF,gIAAgI;AAChI,wBAAgB,oBAAoB,CAClC,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,EAC1C,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GACtC,WAAW,EAAE,CAsBf;AAkBD;mGACmG;AACnG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,EAAE,CAmE1E;AAED;iHACiH;AACjH,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,EAAE,CAiBrE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,EAAE,CAqLtE;AAED,uHAAuH;AACvH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAI1D;AAED,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CA4CjG;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAE3D;AAKD;0FAC0F;AAC1F,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6FAA6F;AAC7F,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC,CAAC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GAAG,oBAAoB,CAAC,GAC/C,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAAC,CAAC;AAMvE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,WAAW,CAgC3E;AAED;uFACuF;AACvF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAIhF;AAED,oFAAoF;AACpF,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAKD;;6EAE6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB,GAAG,WAAW,EAAE,CAoCpF;AAID;;6GAE6G;AAC7G,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAS7E;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IACzC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,WAAW,EAAE,CAwBjE;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CAWlE;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,GAAG,WAAW,CAuB9E;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,CAU7E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,CAU3E;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CASxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAStE;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAC7E,MAAM,CAMR;AAED;mGACmG;AACnG,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAUnF;AAED;;yCAEyC;AACzC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAU5E;AAED;8FAC8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,kBAAkB,EAAE,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAIzC,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,EAAE,CAyB9E;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,WAAW,EAAE,CAoBnF;AAID;oFACoF;AACpF,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EACpE,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,WAAW,EAAE,CA0Bf"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAYrE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC,qGAAqG;IACrG,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,KAAK,MAAM,GAAG,IAAI,CAAC;IAClE,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,IAAI,GAAG,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5E,uGAAuG;IACvG,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,qFAAqF;IACrF,kBAAkB,CAAC,EAAE,MAAM,IAAI,GAAG,iBAAiB,GAAG,UAAU,GAAG,SAAS,CAAC;IAC7E;4DACwD;IACxD,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,KAAK;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvF,yGAAyG;IACzG,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC;IACjC,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,wBAAwB,EAAE,CAAC;CACrD;AAED,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAEzD,oEAAoE;AACpE,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC,eAAO,MAAM,gBAAgB,qDAAqD,CAAC;AAEnF,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,2FAA8D,CAAC;AAEnG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAEhH;AAED;0EAC0E;AAC1E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,MAAM,GAAG,IAAI,CAKhB;AAED;oFACoF;AACpF,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAQ1E;AAID;;qDAEqD;AACrD,eAAO,MAAM,kBAAkB,uFAAuF,CAAC;AACvH;;gDAEgD;AAChD,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK/D,CAAC;AACF,kFAAkF;AAClF,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,4FAA4F;AAC5F,eAAO,MAAM,YAAY,0FAA0F,CAAC;AAEpH;;mGAEmG;AACnG,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,KAAK,MAAM,GAAG,IAAI,GAChE,WAAW,CAyBb;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,yEAAyE;AACzE,eAAO,MAAM,aAAa,EAAE,SAAS,YAAY,EAyBhD,CAAC;AAEF,gIAAgI;AAChI,wBAAgB,oBAAoB,CAClC,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,EAC1C,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GACtC,WAAW,EAAE,CAsBf;AA2BD;mGACmG;AACnG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,EAAE,CAiG1E;AAWD;mFACmF;AACnF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQhE;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EACtF,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,GACnE,wBAAwB,EAAE,CAK5B;AAED,sFAAsF;AACtF,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,SAAS,wBAAwB,EAAE,EAC9C,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GACzC,WAAW,EAAE,CAuBf;AAMD;;2GAE2G;AAC3G,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,EAAE,CA8BrE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,WAAW,EAAE,CAqLtE;AAED,uHAAuH;AACvH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAI1D;AAED,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CA4CjG;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAE3D;AAKD;0FAC0F;AAC1F,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6FAA6F;AAC7F,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC,CAAC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GAAG,oBAAoB,CAAC,GAC/C,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAAC,CAAC;AAMvE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,WAAW,CAgC3E;AAED;uFACuF;AACvF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAIhF;AAED,oFAAoF;AACpF,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAKD;;6EAE6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB,GAAG,WAAW,EAAE,CAoCpF;AAID;;6GAE6G;AAC7G,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAS7E;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IACzC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,WAAW,EAAE,CAwBjE;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CAWlE;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,GAAG,WAAW,CAuB9E;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,CAU7E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,CAU3E;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CASxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAStE;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAC7E,MAAM,CAMR;AAED;mGACmG;AACnG,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAUnF;AAED;;yCAEyC;AACzC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAU5E;AAED;8FAC8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,kBAAkB,EAAE,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAIzC,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,EAAE,CAyB9E;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,WAAW,EAAE,CAoBnF;AAID;oFACoF;AACpF,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EACpE,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,WAAW,EAAE,CA0Bf;AAED;uFACuF;AACvF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE,CA4D1F"}

package/dist/cli/doctor.js

@@ -1,13 +1,17 @@
 // packages/cli/src/cli/doctor.ts — `factory doctor` environment preflight
+import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { detectSandboxRuntime } from '@on-par/factory-core';
+import { findConfigSchemaErrors, isHarnessCliPresent, isTemplateToken, lintFactoryConfig, listBuiltInCheckers, } from '@on-par/factory-core/internal';
 import { MIN_NODE_MAJOR } from '../node-version.js';
 import { availableAgentClis, CLAUDE_CODE_URL, CODEX_CLI_URL, GITHUB_TOKENS_URL } from './first-run.js';
+/** Section for rows about repo-configured command harnesses (#2691). */
+export const COMMAND_HARNESS_SECTION = 'Command harness';
 /** Repo wired-up rows, sectioned only inside a git repo (#2557). */
 export const REPO_SECTION = 'Repo';
 export const NOT_IN_REPO_HINT = 'cd into your repo, then run factory doctor again';
 /** Detail for every repo wired-up row when doctor runs outside a git repository (#2554). */
-export const NOT_IN_REPO_SKIP_DETAIL = `skipped — not inside a git repository; ${NOT_IN_REPO_HINT}`;
+export const NOT_IN_REPO_SKIP_DETAIL = `skipped: not inside a git repository; ${NOT_IN_REPO_HINT}`;
 export function hasSandboxRuntime(platform, commandAvailable) {
     return detectSandboxRuntime(platform, commandAvailable) !== 'none';
 }
@@ -15,9 +19,9 @@ export function hasSandboxRuntime(platform, commandAvailable) {
  *  or null when cmdDoctor should resolve the policy as before (#2383). */
 export function sandboxAuthSkipDetail(opts) {
     if (!opts.runtimeAvailable)
-        return 'skipped — no sandbox runtime (sandbox-exec/firejail) on this host';
+        return 'skipped: no sandbox runtime (sandbox-exec/firejail) on this host';
     if (!opts.hostOk)
-        return 'skipped — host claude auth was not verified';
+        return 'skipped: host claude auth was not verified';
     if (!opts.inRepo)
         return NOT_IN_REPO_SKIP_DETAIL;
     return null;
@@ -70,7 +74,7 @@ export function gitAuthCheck(repoRoot, tryExec) {
     }
     const origin = tryExec('git remote get-url origin');
     if (!origin) {
-        return { name: GIT_AUTH_CHECK, ok: true, optional: true, detail: 'skipped — no origin remote configured' };
+        return { name: GIT_AUTH_CHECK, ok: true, optional: true, detail: 'skipped: no origin remote configured' };
     }
     // An empty string is exit 0 with no HEAD ref (an empty repo): still authenticated.
     const probe = tryExec(GIT_AUTH_PROBE_CMD, { env: { ...GIT_AUTH_PROBE_ENV }, timeoutMs: GIT_AUTH_PROBE_TIMEOUT_MS });
@@ -89,6 +93,7 @@ export function gitAuthCheck(repoRoot, tryExec) {
 export const HARNESS_SETUP = [
     {
         section: 'Claude Code',
+        harnessId: 'claude-cli',
         cli: 'claude',
         install: 'npm install -g @anthropic-ai/claude-code',
         login: 'claude /login',
@@ -96,6 +101,7 @@ export const HARNESS_SETUP = [
     },
     {
         section: 'Codex',
+        harnessId: 'codex-cli',
         cli: 'codex',
         install: 'npm install -g @openai/codex',
         login: 'codex login',
@@ -103,6 +109,7 @@ export const HARNESS_SETUP = [
     },
     {
         section: 'OpenCode',
+        harnessId: 'opencode',
         cli: 'opencode',
         install: 'npm install -g opencode-ai',
         login: 'opencode auth login',
@@ -148,17 +155,44 @@ function safe(fn) {
         return false;
     }
 }
-/** One `<cli> signed in` row per harness (#2556), judged only from local evidence: an env key,
+function safeState(fn) {
+    if (!fn)
+        return 'unknown';
+    try {
+        return fn();
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/** One `<cli> signed in` row per installed harness CLI (#2556, #2631), judged only from local evidence: an env key,
  *  stored credentials, or `codex login status`. Never runs inference and never prints a secret. */
 export function harnessSignInChecks(probes) {
     const { commandAvailable, envPresent, tryExec } = probes;
     const found = availableAgentClis(commandAvailable);
-    return HARNESS_SETUP.map(({ section, cli, login, envKeys }) => {
+    return HARNESS_SETUP.filter(({ harnessId }) => isHarnessCliPresent(harnessId, commandAvailable)).map(({ section, cli, login, envKeys }) => {
         const name = `${cli} signed in`;
-        if (!commandAvailable(cli)) {
-            return { name, section, ok: true, optional: true, detail: `skipped — ${cli} not installed` };
-        }
         const fix = `sign in to ${section}: ${login}`;
+        if (cli === 'claude' || cli === 'codex') {
+            let failure = null;
+            try {
+                failure = probes.localAuthFailure?.(cli) ?? null;
+            }
+            catch {
+                failure = null;
+            }
+            if (failure) {
+                return {
+                    name,
+                    section,
+                    ok: false,
+                    optional: found.length > 1,
+                    detail: `the most recent run failed sign-in (local_auth) at ${failure.at} and there has been no login since; re-run ${cli} login`,
+                    fix,
+                    next: login,
+                };
+            }
+        }
         if (cli === 'codex') {
             const key = envKeys.find((k) => envPresent(k));
             if (key)
@@ -199,6 +233,17 @@ export function harnessSignInChecks(probes) {
             const key = envKeys.find((k) => envPresent(k));
             if (key)
                 return { name, section, ok: true, detail: `signed in (${key} set)` };
+            if (cli === 'claude' && safeState(probes.claudeSessionState) === 'unusable') {
+                return {
+                    name,
+                    section,
+                    ok: false,
+                    optional: found.length > 1,
+                    detail: 'stored Claude Code login has expired and cannot be refreshed (no live access token and no refresh token); re-run claude login',
+                    fix: 'run `claude`, then /login, then re-run `factory doctor`',
+                    next: login,
+                };
+            }
             if (cli === 'claude' && safe(probes.claudeLoggedIn)) {
                 return { name, section, ok: true, detail: 'signed in (stored Claude Code login found)' };
             }
@@ -212,29 +257,98 @@ export function harnessSignInChecks(probes) {
             ok: false,
             // Required only when this is the sole agent: then nothing else can run.
             optional: found.length > 1,
-            detail: `unverified — no sign-in evidence (${SIGN_IN_EVIDENCE[cli]})`,
+            detail: `unverified: no sign-in evidence (${SIGN_IN_EVIDENCE[cli]})`,
             fix,
             next: login,
         };
     });
 }
+function safeList(fn) {
+    if (!fn)
+        return [];
+    try {
+        return fn();
+    }
+    catch {
+        return [];
+    }
+}
+/** The executable (first token) of a command template, or null when it cannot be parsed safely (#2691).
+ *  Guards `isCommandAvailable`, which interpolates into `command -v` unescaped. */
+export function commandExecutable(command) {
+    const tokens = command.trim().split(/\s+/);
+    while (tokens.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0]))
+        tokens.shift();
+    let token = tokens[0];
+    if (!token)
+        return null;
+    const quoted = /^(['"])(.*)\1$/.exec(token);
+    if (quoted)
+        token = quoted[2];
+    return /^[\w./@+~-]+$/.test(token) ? token : null;
+}
+/** Declared, agentic command harnesses that at least one repo `models.registry` entry uses (#2691). */
+export function repoCommandHarnesses(harnesses, registry) {
+    const used = new Set(Object.values(registry ?? {}).map((def) => def.harness));
+    return Object.entries(harnesses ?? {})
+        .filter(([id, decl]) => decl.agentic === true && used.has(id))
+        .map(([id, decl]) => ({ harness: id, command: decl.command, executable: commandExecutable(decl.command) }));
+}
+/** One optional `command harness <id>` row per configured command harness (#2691). */
+export function commandHarnessChecks(harnesses, commandAvailable) {
+    return harnesses.map((h) => {
+        const name = `command harness ${h.harness}`;
+        if (h.executable !== null && commandAvailable(h.executable)) {
+            return {
+                name,
+                section: COMMAND_HARNESS_SECTION,
+                optional: true,
+                ok: true,
+                detail: `${h.executable} found on PATH (command: ${h.command})`,
+            };
+        }
+        return {
+            name,
+            section: COMMAND_HARNESS_SECTION,
+            optional: true,
+            ok: false,
+            detail: `configured command \`${h.command}\`: ${h.executable === null ? 'cannot parse an executable from it' : `${h.executable} not found on PATH`}`,
+            fix: installFix(h),
+        };
+    });
+}
+function installFix(h) {
+    return `install ${h.executable ?? 'the agent CLI'} on PATH or fix "command" for harness ${h.harness} in the models config harnesses section`;
+}
 /** Coding agent prerequisites: at least one agent CLI is required; each CLI is then reported
- *  on its own optional line, with sign-in reported separately from installation (#1269, #2422, #2555, #2556). */
+ *  on its own optional line, with sign-in reported separately from installation (#1269, #2422, #2555, #2556).
+ *  A repo-configured command harness whose executable is on PATH also counts as a coding agent (#2691). */
 export function agentCliChecks(probes) {
     const { commandAvailable, tryExec } = probes;
     const found = availableAgentClis(commandAvailable);
+    const configured = safeList(probes.commandHarnesses);
+    const runnable = configured.filter((h) => h.executable !== null && commandAvailable(h.executable));
+    const agents = [...found, ...runnable.map((h) => `${h.harness} (command harness)`)];
+    const describe = (h) => `command harness ${h.harness} runs \`${h.command}\`, but ${h.executable ?? 'its executable'} is not on PATH`;
+    const missingRow = configured.length === 0
+        ? {
+            name: 'coding agent',
+            ok: false,
+            detail: 'no coding agent CLI on PATH (claude, codex or opencode)',
+            fix: `install Claude Code (${CLAUDE_CODE_URL}) or the Codex CLI (${CODEX_CLI_URL})`,
+            next: HARNESS_SETUP[0].install,
+        }
+        : {
+            name: 'coding agent',
+            ok: false,
+            detail: `no coding agent CLI on PATH (claude, codex or opencode); ${configured.map(describe).join('; ')}`,
+            fix: installFix(configured[0]),
+        };
     const checks = [
-        found.length > 0
-            ? { name: 'coding agent', ok: true, detail: `found ${found.join(', ')}` }
-            : {
-                name: 'coding agent',
-                ok: false,
-                detail: 'no coding agent CLI on PATH (claude, codex or opencode)',
-                fix: `install Claude Code (${CLAUDE_CODE_URL}) or the Codex CLI (${CODEX_CLI_URL})`,
-                next: HARNESS_SETUP[0].install,
-            },
+        agents.length > 0 ? { name: 'coding agent', ok: true, detail: `found ${agents.join(', ')}` } : missingRow,
     ];
     checks.push(...harnessInstallChecks(commandAvailable, tryExec));
+    checks.push(...commandHarnessChecks(configured, commandAvailable));
     checks.push(...harnessSignInChecks(probes));
     return checks;
 }
@@ -248,7 +362,7 @@ export function runDoctorChecks(probes) {
             name: 'git repository',
             ok: false,
             optional: true,
-            detail: 'not inside a git repository — repo checks skipped',
+            detail: 'not inside a git repository; repo checks skipped',
             fix: NOT_IN_REPO_HINT,
         });
     const repoSection = repoRoot === null ? {} : { section: REPO_SECTION };
@@ -353,14 +467,14 @@ export function runDoctorChecks(probes) {
             ok: true,
             optional: true,
             detail: sandboxRuntime === 'none'
-                ? 'codex CLI found — no sandbox runtime, so codex runs with danger-full-access'
+                ? 'codex CLI found; no sandbox runtime, so codex runs with danger-full-access'
                 : 'codex CLI found (sandboxed builds available)',
         }
         : {
             name: 'codex sandbox',
             ok: false,
             optional: true,
-            detail: 'codex CLI not found — codex build routes unavailable',
+            detail: 'codex CLI not found; codex build routes unavailable',
             fix: 'install the codex CLI, or rely on claude routes',
         });
     checks.push(sandboxRuntime !== 'none'
@@ -369,7 +483,7 @@ export function runDoctorChecks(probes) {
             name: 'sandbox runtime',
             ok: false,
             optional: true,
-            detail: 'no sandbox-exec (macOS) or firejail (Linux) on PATH — agents will run uncontained',
+            detail: 'no sandbox-exec (macOS) or firejail (Linux) on PATH; agents will run uncontained',
             fix: 'install firejail (Linux) or run on macOS; see README Safety',
         });
     if (repoRoot === null) {
@@ -441,7 +555,7 @@ export function formatDoctorChecks(checks, opts = {}) {
         }
         currentSection = check.section;
         const icon = doctorCheckIcon(check);
-        lines.push(`  ${icon} ${check.name} — ${check.detail}`);
+        lines.push(`  ${icon} ${check.name} - ${check.detail}`);
         if (!check.ok && check.fix) {
             lines.push(`       fix: ${check.fix}`);
         }
@@ -481,15 +595,15 @@ export function claudeKeychainCheck(probe) {
         return {
             name: 'claude keychain (macOS)',
             ok: false,
-            detail: `security find-generic-password -s '${service}'${profile} failed inside tmux (SecKeychainSearchCopyNext) — Claude OAuth refresh will fail with local_auth`,
-            fix: 'run the factory from a context with login-keychain access — a LaunchAgent in the gui domain (launchctl bootstrap gui/$(id -u) …) or a login Terminal, not a raw tmux pane — see docs/runbooks/macos-keychain-launchagent.md',
+            detail: `security find-generic-password -s '${service}'${profile} failed inside tmux (SecKeychainSearchCopyNext); Claude OAuth refresh will fail with local_auth`,
+            fix: 'run the factory from a context with login-keychain access, such as a LaunchAgent in the gui domain (launchctl bootstrap gui/$(id -u) …) or a login Terminal, not a raw tmux pane; see docs/runbooks/macos-keychain-launchagent.md',
         };
     }
     return {
         name: 'claude keychain (macOS)',
         ok: false,
         optional: true,
-        detail: `security find-generic-password -s '${service}'${profile} failed — either never logged in, or this launch context cannot read the login keychain`,
+        detail: `security find-generic-password -s '${service}'${profile} failed; either never logged in, or this launch context cannot read the login keychain`,
         fix: `run ${loginFix(probe)} and complete /login (or export ANTHROPIC_API_KEY); if already logged in, see docs/runbooks/macos-keychain-launchagent.md`,
     };
 }
@@ -499,7 +613,7 @@ export function keychainPreflightError(probe) {
     if (probe.status !== 'unreadable' || !probe.inTmux)
         return null;
     const service = probe.service ?? DEFAULT_KEYCHAIN_SERVICE;
-    return `Claude Code credentials are not readable from this tmux session (security find-generic-password -s '${service}' failed / SecKeychainSearchCopyNext). OAuth refresh will fail and every claimed issue would spuriously park as local_auth. Launch the factory from a context with login-keychain access — a LaunchAgent in the gui domain (launchctl bootstrap gui/$(id -u) …) or a login Terminal — or export ANTHROPIC_API_KEY. See docs/runbooks/macos-keychain-launchagent.md.`;
+    return `Claude Code credentials are not readable from this tmux session (security find-generic-password -s '${service}' failed / SecKeychainSearchCopyNext). OAuth refresh will fail and every claimed issue would spuriously park as local_auth. Launch the factory from a context with login-keychain access, such as a LaunchAgent in the gui domain (launchctl bootstrap gui/$(id -u) …) or a login Terminal, or export ANTHROPIC_API_KEY. See docs/runbooks/macos-keychain-launchagent.md.`;
 }
 const HOST_AUTH_CHECK = 'claude auth (host)';
 const SANDBOX_AUTH_CHECK = 'claude auth (sandboxed)';
@@ -528,7 +642,7 @@ export function sandboxClaudeAuthChecks(result) {
         sandboxed = {
             name: SANDBOX_AUTH_CHECK,
             ok: false,
-            detail: `${result.sandboxDetail} — host claude auth is healthy, so the sandbox is blocking Claude credential refresh`,
+            detail: `${result.sandboxDetail}; host claude auth is healthy, so the sandbox is blocking Claude credential refresh`,
             fix: 'check the sandbox write allowlist (~/.claude.json*, $CLAUDE_CONFIG_DIR when set, ~/Library/Keychains); as a stopgap run with FACTORY_SANDBOX=0',
         };
     }
@@ -537,7 +651,7 @@ export function sandboxClaudeAuthChecks(result) {
             name: SANDBOX_AUTH_CHECK,
             ok: false,
             optional: true,
-            detail: `${result.sandboxDetail} — host claude auth is not healthy either, so this is not attributable to the sandbox`,
+            detail: `${result.sandboxDetail}; host claude auth is not healthy either, so this is not attributable to the sandbox`,
             fix: 'fix host claude auth first, then re-run `factory doctor`',
         };
     }
@@ -568,7 +682,7 @@ export function leaseChecks(rows) {
                 name: `port lease :${row.port}`,
                 ok: true,
                 optional: true,
-                detail: `${row.worktreeId} — port ${row.port}, pid ${row.pid}, live`,
+                detail: `${row.worktreeId}: port ${row.port}, pid ${row.pid}, live`,
             };
         }
         const squatted = row.portSquatted ? '; port still in use by another process' : '';
@@ -576,7 +690,7 @@ export function leaseChecks(rows) {
             name: `port lease :${row.port}`,
             ok: false,
             optional: true,
-            detail: `${row.worktreeId} — port ${row.port}, pid ${row.pid}, stale (${row.reason})${squatted}`,
+            detail: `${row.worktreeId}: port ${row.port}, pid ${row.pid}, stale (${row.reason})${squatted}`,
             fix: 'run `factory doctor --reconcile` to reclaim stale leases',
         };
     });
@@ -615,7 +729,7 @@ export function eventLogCheck(integrity) {
         ok: false,
         optional: true,
         detail: `${integrity.unparseable} of ${integrity.total} lines unparseable (${pct}%)`,
-        fix: 'historical corruption from pre-lock parallel writes; appends are now serialized — metrics over this file carry this error bar',
+        fix: 'historical corruption from pre-lock parallel writes; appends are now serialized; metrics over this file carry this error bar',
     };
 }
 export function orphanContainerChecks(names) {
@@ -646,7 +760,7 @@ export function formatContainerReconcileReport(reaped) {
     return reaped
         .map((r) => r.removed
         ? `reconcile: removed container ${r.name}`
-        : `reconcile: failed to remove container ${r.name} — ${r.detail}`)
+        : `reconcile: failed to remove container ${r.name}: ${r.detail}`)
         .join('\n');
 }
 export function formatMicroVmReconcileReport(reaped) {
@@ -655,7 +769,7 @@ export function formatMicroVmReconcileReport(reaped) {
     return reaped
         .map((r) => r.removed
         ? `reconcile: removed sbx VM ${r.name} (sbx rm --force)`
-        : `reconcile: failed to remove sbx VM ${r.name} — ${r.detail}`)
+        : `reconcile: failed to remove sbx VM ${r.name}: ${r.detail}`)
         .join('\n');
 }
 export function formatReconcileReport(reaped) {
@@ -682,7 +796,7 @@ export function formatClaimReconcileReport(released) {
     return released
         .map((c) => c.released
         ? `reconcile: released issue #${c.issue} back to factory:queued (lease expired at ${c.expiresAt})`
-        : `reconcile: failed to release issue #${c.issue} (lease expired at ${c.expiresAt}) — ${c.detail ?? 'unknown error'}`)
+        : `reconcile: failed to release issue #${c.issue} (lease expired at ${c.expiresAt}): ${c.detail ?? 'unknown error'}`)
         .join('\n');
 }
 const GREEN_PR_CHECK = 'green PRs awaiting merge';
@@ -696,7 +810,7 @@ export function unmergedGreenPrChecks(result) {
                 name: GREEN_PR_CHECK,
                 ok: false,
                 optional: true,
-                detail: `scan failed — ${result.detail}`,
+                detail: `scan failed: ${result.detail}`,
                 fix: 'check `gh auth status` and network access, then re-run `factory doctor`',
             },
         ];
@@ -708,8 +822,8 @@ export function unmergedGreenPrChecks(result) {
         name: `green PR #${row.number}`,
         ok: false,
         optional: true,
-        detail: `${row.issue === null ? 'owning issue unknown' : `issue #${row.issue}`} — green and ready on ${row.branch}, open ${row.ageHours}h, not merged`,
-        fix: `review and merge #${row.number} (or close it) — the factory never auto-merges an orphaned PR`,
+        detail: `${row.issue === null ? 'owning issue unknown' : `issue #${row.issue}`}: green and ready on ${row.branch}, open ${row.ageHours}h, not merged`,
+        fix: `review and merge #${row.number} (or close it); the factory never auto-merges an orphaned PR`,
     }));
 }
 /** One doctor check per user-declared harness, from its `probe` result. */
@@ -722,7 +836,7 @@ export function declaredHarnessChecks(probes) {
             return {
                 name,
                 ok: false,
-                detail: `unavailable — probe \`${p.probe}\` failed: ${p.detail}`,
+                detail: `unavailable: probe \`${p.probe}\` failed: ${p.detail}`,
                 fix: 'install the agent CLI on PATH or fix the "probe" command in the models config harnesses section',
             };
         }
@@ -730,7 +844,7 @@ export function declaredHarnessChecks(probes) {
             name,
             ok: false,
             optional: true,
-            detail: 'unverified — no probe configured',
+            detail: 'unverified: no probe configured',
             fix: 'add a "probe" command (exit 0 = reachable) to the harness in the models config',
         };
     });
@@ -768,4 +882,69 @@ export function modelsRegistryChecks(configPath, registry, validHarnesses) {
     const n = entries.length;
     return [{ name: REGISTRY_CHECK, ok: true, detail: `${n} entr${n === 1 ? 'y' : 'ies'} valid (${configPath})` }];
 }
+/** `config` rows from the shared pre-PLAN lint (#2612): one failing row per finding, so doctor fails exactly when
+ *  the run preflight would escalate or park. A single ok row when clean. Read-only. */
+export function configLintChecks(input, loadError) {
+    const schemaRows = (input.configFile ? findConfigSchemaErrors(input.configFile) : []).map((f) => ({
+        name: 'config',
+        ok: false,
+        section: REPO_SECTION,
+        detail: `${f.file}${f.line ? `:${f.line}` : ''}: schema error at '${f.path}': ${f.message}`,
+        fix: f.fix,
+    }));
+    if (loadError !== undefined) {
+        return [
+            {
+                name: 'config',
+                ok: false,
+                section: REPO_SECTION,
+                detail: loadError,
+                fix: 'fix the constitution frontmatter YAML',
+            },
+            ...schemaRows,
+        ];
+    }
+    const { findings } = lintFactoryConfig(input);
+    if (findings.length > 0) {
+        const names = [...listBuiltInCheckers().map((c) => c.name), 'custom_*'].join(', ');
+        const lintRows = findings.map((f) => {
+            const where = `${f.file}${f.line ? `:${f.line}` : ''}`;
+            if (f.rule === 'unknown-checker') {
+                const kind = isTemplateToken(f.token) ? 'placeholder' : 'unknown';
+                return {
+                    name: 'config',
+                    ok: false,
+                    section: REPO_SECTION,
+                    detail: `${where}: ${kind} checker '${f.token}'`,
+                    fix: `replace '${f.token}' with a real checker name (${names}) or delete the line`,
+                };
+            }
+            return {
+                name: 'config',
+                ok: false,
+                section: REPO_SECTION,
+                detail: `${where}: unfilled template token '${f.token}'`,
+                fix: `replace '${f.token}' with a real value`,
+            };
+        });
+        return [...lintRows, ...schemaRows];
+    }
+    if (schemaRows.length > 0)
+        return schemaRows;
+    const scanned = [];
+    if (input.constitution?.repoInstance)
+        scanned.push(input.constitution.repoInstance.relPath);
+    if (input.configFile && existsSync(input.configFile.absPath))
+        scanned.push(input.configFile.relPath);
+    return [
+        {
+            name: 'config',
+            ok: true,
+            section: REPO_SECTION,
+            detail: scanned.length > 0
+                ? `no unfilled placeholders, unknown checkers or schema errors in ${scanned.join(', ')}`
+                : 'no constitution or config file to scan',
+        },
+    ];
+}
 //# sourceMappingURL=doctor.js.map