aiden-runtime 4.1.1 → 4.1.3

package/dist/cli/v4/doctorLiveness.js

@@ -18,11 +18,12 @@
  *   - `--providers` is opt-in. When the user types it we extend the
  *     report with one liveness row per probe, then render a summary
  *     line at the bottom.
- *   - Tool-catalog validation is deliberately OUT of scope. Liveness
- *     probes ship `tools: []` (see comment in checkProviderLiveness)
- *     so one bad tool schema doesn't false-red every provider that
- *     validates strictly. The eval-harness / registration-time schema
- *     validator (v4.1.1 main) is the right home for that concern.
+ *   - Tool-catalog validation is deliberately OUT of scope. The
+ *     probe ships ONE hardcoded no-op tool (`probe_noop`) so the
+ *     Codex backend accepts the request (it rejects empty `tools`),
+ *     while user-registered tool schemas stay un-validated here. The
+ *     eval-harness / registration-time schema validator (v4.1.1
+ *     main) is the right home for that concern.
  *
  * Trust artifact:
  *   - On failure we surface `err.message` VERBATIM (truncated to 200
@@ -31,6 +32,7 @@
  *     prints the actual OpenAI reason, not a generic "provider failed."
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.pickProbeModel = pickProbeModel;
 exports.enumerateConfiguredProviders = enumerateConfiguredProviders;
 exports.checkProviderLiveness = checkProviderLiveness;
 exports.runProviderLiveness = runProviderLiveness;
@@ -55,6 +57,28 @@ function truncate(s, max = ERROR_TRUNCATE_CHARS) {
         return s;
     return `${s.slice(0, max - 1)}…`;
 }
+/**
+ * Phase v4.1.2-slice5: pick a probe-safe model id from the registry.
+ *
+ * Some providers list model slugs that only work for enterprise / CLI
+ * accounts. ChatGPT Plus is the canonical case: the registry's
+ * `modelIds[0]` is `gpt-5.1-codex-max`, which is rejected by the
+ * subscription-account Codex backend with
+ * `"The 'gpt-5.1-codex-max' model is not supported when using Codex
+ * with a ChatGPT account."` — even though real REPL chat on the same
+ * account works because the user has selected a non-Codex slug
+ * (`gpt-5.5`).
+ *
+ * Heuristic: skip any slug containing `-codex` (covers `-codex-max`,
+ * `-codex-mini`, plain `-codex` suffix variants). Falls back to
+ * `modelIds[0]` if every slug is Codex-flavoured. No provider id
+ * special-casing — the heuristic is shape-based so future-similar
+ * providers benefit too.
+ */
+function pickProbeModel(entry) {
+    const safe = entry.modelIds.find((m) => !m.includes('-codex'));
+    return safe ?? entry.modelIds[0] ?? '';
+}
 /**
  * Wrap a promise with a hard timeout. Resolves to the inner result on
  * success, throws a clearly-labelled `Error` on timeout. Cleans up the
@@ -91,7 +115,7 @@ async function enumerateConfiguredProviders(opts) {
     const out = [];
     for (const entry of Object.values(registry_1.PROVIDER_REGISTRY)) {
         // Every provider needs at least one model to probe against.
-        const model = entry.modelIds[0];
+        const model = pickProbeModel(entry);
         if (!model) {
             out.push({
                 entry,
@@ -199,11 +223,42 @@ async function checkProviderLiveness(provider, model, adapter, opts) {
     const start = Date.now();
     // Liveness probes "is this provider reachable + authenticated?".
     // Tool-catalog validation is a separate concern (eval harness,
-    // v4.1.1 main). Sending tools: [] ensures one bad tool schema
-    // doesn't false-red every provider that validates strictly.
+    // v4.1.1 main).
+    //
+    // Phase v4.1.2-slice5: the probe used to send `messages: [user]`
+    // only, with `tools: []`. That body 400s against the Codex backend
+    // for two reasons:
+    //   1. No system message → empty `instructions` field in the wire
+    //      body. Codex rejects requests without `instructions` (same
+    //      root cause as the eval-runner fix in 6535d531).
+    //   2. Empty tools array → the codex adapter omits `tools`,
+    //      `tool_choice`, `parallel_tool_calls` from the wire body
+    //      entirely. The Codex backend treats this as malformed.
+    //
+    // Fix: add a minimal one-line system message (collapses into
+    // `instructions`) and one hand-crafted no-op tool. The probe tool
+    // is hardcoded with a conservative JSON Schema
+    // (`additionalProperties: false`) so strict validators accept it.
+    // The "one bad tool schema false-reds everyone" concern from the
+    // pre-slice5 comment applied to USER tools; this tool is internal.
     const input = {
-        messages: [{ role: 'user', content: 'ping' }],
-        tools: [],
+        messages: [
+            {
+                role: 'system',
+                content: 'You are an availability probe. Respond with a single word.',
+            },
+            { role: 'user', content: 'ping' },
+        ],
+        tools: [
+            {
+                name: 'probe_noop',
+                description: 'Probe placeholder. Do not call — the probe ignores any tool calls.',
+                inputSchema: {
+                    type: 'object',
+                    properties: {},
+                },
+            },
+        ],
         maxTokens: PROBE_MAX_TOKENS,
     };
     try {

package/dist/cli/v4/promotionPrompt.js

@@ -0,0 +1,332 @@
+"use strict";
+/**
+ * Copyright (c) 2026 Shiva Deore (Taracod).
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ *
+ * Aiden — local-first agent.
+ */
+/**
+ * cli/v4/promotionPrompt.ts — Phase v4.1.2-memory-D.
+ *
+ * REPL-side glue for the durable-facts promotion flow:
+ *   - `parsePromotionInput(raw, count)`  — pure: parse user reply into
+ *                                          a 0-indexed array of approved
+ *                                          candidate indices.
+ *   - `formatCandidateList(candidates)`  — pure: render the prompt body
+ *                                          the user sees.
+ *   - `promptForApproval(api, ...)`      — drives the prompt loop;
+ *                                          re-prompts ONCE on garbage,
+ *                                          then defaults to skip.
+ *   - `writeApprovedDurableFacts(...)`   — append approved candidates
+ *                                          to MEMORY.md `## Durable facts`
+ *                                          via MemoryGuard.replaceSection.
+ *
+ * Input grammar (per Phase D's Q3):
+ *   - "all"                  → every shown candidate
+ *   - "none" / "skip" / ""   → none
+ *   - "1,3"                  → 0-indexed 0 and 2
+ *   - "1-3"                  → 0-indexed 0, 1, 2 (inclusive range)
+ *   - "1, 3-5"               → mixed; whitespace tolerated
+ *   - Anything unparseable   → re-prompt once, then default skip
+ *
+ * The function intentionally keeps the parser pure so unit tests
+ * don't have to drive a prompt API. The prompt-loop function wires
+ * the parser to the existing `ChatPromptApi.readLine`.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePromotionInput = parsePromotionInput;
+exports.formatCandidateList = formatCandidateList;
+exports.promptForApproval = promptForApproval;
+exports.buildDurableFactsBody = buildDurableFactsBody;
+exports.readExistingDurableFactsBody = readExistingDurableFactsBody;
+exports.writeApprovedDurableFacts = writeApprovedDurableFacts;
+// ── Parser ────────────────────────────────────────────────────────────────
+/**
+ * Parse a user reply into the set of approved candidate indices
+ * (0-indexed). Returns `null` to signal "unparseable input — re-prompt
+ * once" so callers can distinguish "explicit skip" (empty array) from
+ * "garbage typed".
+ *
+ * Pure, deterministic; safe for unit tests.
+ */
+function parsePromotionInput(raw, count) {
+    const trimmed = raw.trim().toLowerCase();
+    if (trimmed === '' || trimmed === 'none' || trimmed === 'skip')
+        return [];
+    if (trimmed === 'all') {
+        return Array.from({ length: count }, (_, i) => i);
+    }
+    const out = new Set();
+    let sawAnyValid = false;
+    // Tolerate "1, 3-5 ,7"  with mixed whitespace.
+    for (const token of trimmed.split(',')) {
+        const piece = token.trim();
+        if (!piece)
+            continue;
+        const range = piece.match(/^(\d+)\s*-\s*(\d+)$/);
+        if (range) {
+            const start = Number.parseInt(range[1], 10);
+            const end = Number.parseInt(range[2], 10);
+            if (!Number.isFinite(start) || !Number.isFinite(end))
+                continue;
+            const [lo, hi] = start <= end ? [start, end] : [end, start];
+            for (let n = lo; n <= hi; n += 1) {
+                if (n >= 1 && n <= count) {
+                    out.add(n - 1);
+                    sawAnyValid = true;
+                }
+            }
+            continue;
+        }
+        const single = piece.match(/^\d+$/);
+        if (single) {
+            const n = Number.parseInt(piece, 10);
+            if (n >= 1 && n <= count) {
+                out.add(n - 1);
+                sawAnyValid = true;
+            }
+            continue;
+        }
+        // Non-numeric token alongside others — treat the WHOLE input as
+        // unparseable so the user gets one re-prompt instead of a silent
+        // partial selection.
+        return null;
+    }
+    if (!sawAnyValid)
+        return []; // numbers given but all out of range
+    return [...out].sort((a, b) => a - b);
+}
+// ── Renderer ──────────────────────────────────────────────────────────────
+/**
+ * Build the text the user sees. Pure — caller writes this to display.
+ */
+function formatCandidateList(candidates) {
+    const lines = [];
+    lines.push(`${candidates.length} thing${candidates.length === 1 ? '' : 's'} worth remembering this session. Promote which?`);
+    lines.push('');
+    for (let i = 0; i < candidates.length; i += 1) {
+        const c = candidates[i];
+        const sourceTag = c.source === 'explicit' ? '[user said]'
+            : c.source === 'decision' ? '[decision]'
+                : '[open item]';
+        lines.push(`  [${i + 1}] ${sourceTag} ${c.text}`);
+    }
+    lines.push('');
+    lines.push('Reply: numbers to approve (e.g. "1,3" or "1-3"), "all", or skip.');
+    return lines.join('\n');
+}
+/**
+ * Drive the approval prompt. Two paths:
+ *
+ *   1. Interactive checkbox (TTY): @inquirer/prompts.checkbox, space
+ *      to toggle, enter to confirm, esc/ctrl+c to skip. Default
+ *      selection is NONE — the user explicitly opts in. v4.1.3-essentials
+ *      promotion-ux replaces what used to be a text-input chore.
+ *
+ *   2. Text-input fallback (non-TTY / piped / CI): renders the
+ *      numbered list and reads a single line. Parser handles "1,3"
+ *      / "1-3" / "all" / "skip" / "". Re-prompts ONCE on garbage,
+ *      then defaults to skip. The original Phase v4.1.2-memory-D
+ *      behavior, preserved verbatim.
+ *
+ * Auto-routes via `process.stdout.isTTY`; tests override via opts.
+ *
+ * No mid-session state leakage — purely a session-end interaction.
+ */
+async function promptForApproval(api, display, candidates, opts = {}) {
+    if (candidates.length === 0)
+        return [];
+    const useInteractive = opts.forceInteractive === true
+        ? true
+        : opts.forceTextInput === true
+            ? false
+            : !!process.stdout.isTTY;
+    if (useInteractive) {
+        return promptForApprovalInteractive(display, candidates);
+    }
+    return promptForApprovalText(api, display, candidates);
+}
+/**
+ * v4.1.3-essentials promotion-ux: interactive multi-select checkbox.
+ * Uses @inquirer/prompts.checkbox (already a runtime dep — same
+ * library as the model picker, setup wizard, approval prompts).
+ *
+ * Choices render with the source-type tag inline so the user sees
+ * "[decision] X" / "[open item] Y" / "[user said] Z" — matches the
+ * tag set the text-input renderer uses.
+ *
+ * Exit paths:
+ *   - User confirms with at least one box checked → return selected
+ *   - User confirms with zero boxes checked       → dim note, return []
+ *   - User hits Esc / Ctrl+C (inquirer throws)    → dim note, return []
+ *
+ * All three "nothing selected" paths produce the same outcome — empty
+ * array — matching the user's Q5 default ("empty/skip/esc all
+ * equivalent").
+ *
+ * Lazy-require inquirer so test harnesses without a TTY don't crash
+ * importing the module. Same pattern setupWizard / callbacks /
+ * modelPicker already use.
+ */
+async function promptForApprovalInteractive(display, candidates) {
+    // Dynamic ES import (not CommonJS require) so vitest's vi.mock can
+    // intercept the call in tests. The runtime behavior is identical
+    // for our purpose — single one-shot lazy load on first call.
+    const inq = await Promise.resolve().then(() => __importStar(require('@inquirer/prompts')));
+    const heading = `${candidates.length} thing${candidates.length === 1 ? '' : 's'} ` +
+        `worth remembering this session.`;
+    display.write('\n' + heading + '\n');
+    try {
+        const selected = await inq.checkbox({
+            message: 'Promote which to durable memory? (space toggles · enter confirms)',
+            choices: candidates.map((c, i) => ({
+                name: `${typeTag(c)} ${c.text}`,
+                value: i,
+                checked: false,
+            })),
+            loop: false,
+            pageSize: Math.min(10, candidates.length),
+        });
+        if (selected.length === 0) {
+            display.dim('Nothing promoted to durable facts.');
+            return [];
+        }
+        return selected.map((i) => candidates[i]);
+    }
+    catch {
+        // Inquirer throws on Ctrl+C / Esc — treat as skip.
+        display.dim('Skipped: nothing promoted to durable facts.');
+        return [];
+    }
+}
+/**
+ * Source-type tag matching the text-input renderer's format. Kept as
+ * a helper so the interactive choice labels stay in sync with the
+ * text path if a new `Candidate.source` value lands.
+ */
+function typeTag(c) {
+    if (c.source === 'explicit')
+        return '[user said]';
+    if (c.source === 'decision')
+        return '[decision]';
+    return '[open item]';
+}
+/**
+ * Phase v4.1.2-memory-D text-input loop. Renders the candidate list,
+ * reads ONE line, parses, returns approved Candidate[]. On unparseable
+ * input re-prompts ONCE; second failure defaults to skip with a dim
+ * line explaining why nothing was promoted.
+ *
+ * Kept as the non-TTY fallback (pipes, CI, test harness) so the
+ * promotion-flow contract continues to work without an interactive
+ * shell. v4.1.3-essentials promotion-ux renamed this from
+ * `promptForApproval` so the public entry point can dispatch.
+ */
+async function promptForApprovalText(api, display, candidates) {
+    display.write('\n' + formatCandidateList(candidates) + '\n');
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const raw = await api.readLine('Promote > ');
+        const parsed = parsePromotionInput(raw, candidates.length);
+        if (parsed !== null) {
+            if (parsed.length === 0) {
+                display.dim('Nothing promoted to durable facts.');
+                return [];
+            }
+            return parsed.map((i) => candidates[i]);
+        }
+        if (attempt === 0) {
+            display.warn('Could not parse input. Use numbers ("1,3"), ranges ("1-3"), "all", or "skip".');
+        }
+    }
+    display.dim('Skipped: input still unparseable. Nothing promoted to durable facts.');
+    return [];
+}
+// ── Persistence ───────────────────────────────────────────────────────────
+const DURABLE_FACTS_HEADER = '## Durable facts';
+/**
+ * Render the section body for `## Durable facts` by combining existing
+ * entries with newly-approved candidates. Newest at the BOTTOM so
+ * read order reflects when each fact landed — matches how users scan
+ * MEMORY.md.
+ *
+ * Pure — caller passes existing body (extracted via the same regex
+ * pattern MemoryGuard uses in replaceSection).
+ */
+function buildDurableFactsBody(existingBody, approved) {
+    const existingLines = existingBody
+        .split('\n')
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0);
+    const newLines = approved.map((c) => `- ${c.text}`);
+    return [...existingLines, ...newLines].join('\n');
+}
+/**
+ * Read the current `## Durable facts` body from MEMORY.md (returns
+ * empty string when the section doesn't yet exist). Mirrors the
+ * regex pattern MemoryGuard.replaceSection uses.
+ */
+async function readExistingDurableFactsBody(memoryManager) {
+    const snap = await memoryManager.loadSnapshot();
+    const md = snap.memoryMd ?? '';
+    const headerEscaped = DURABLE_FACTS_HEADER.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const sectionRe = new RegExp(`${headerEscaped}[^\\n]*\\n([\\s\\S]*?)(?=\\n## |$)`);
+    const m = md.match(sectionRe);
+    return m ? (m[1] ?? '').trim() : '';
+}
+/**
+ * Persist the approved candidates. Reads existing body (so a second
+ * session-end appends rather than overwrites), folds in new lines,
+ * and writes via MemoryGuard.replaceSection — which handles
+ * verify-on-disk + section auto-creation.
+ *
+ * Returns the GuardedResult so the caller can dim-log success or
+ * warn on a failed verify.
+ */
+async function writeApprovedDurableFacts(memoryManager, memoryGuard, approved) {
+    if (approved.length === 0) {
+        return { ok: true, verified: true, entryCount: 0 };
+    }
+    const existingBody = await readExistingDurableFactsBody(memoryManager);
+    const newBody = buildDurableFactsBody(existingBody, approved);
+    const entryCount = newBody.split('\n').filter((l) => l.trim().length > 0).length;
+    const result = await memoryGuard.replaceSection('memory', DURABLE_FACTS_HEADER, newBody);
+    return {
+        ok: result.ok,
+        verified: result.verified,
+        reason: result.reason,
+        entryCount,
+    };
+}

package/dist/cli/v4/providerBootSelector.js

@@ -0,0 +1,144 @@
+"use strict";
+/**
+ * Copyright (c) 2026 Shiva Deore (Taracod).
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ *
+ * Aiden — local-first agent.
+ */
+/**
+ * cli/v4/providerBootSelector.ts — Phase v4.1.2-bug1.
+ *
+ * Boot-time provider/model picker. Replaces the hardcoded
+ * `groq + llama-3.3-70b-versatile` fallback that bit new users:
+ * users authenticated with ChatGPT Plus OAuth (the post-v4.1.1
+ * onboarding default) booted into Groq anyway, and llama-3.3-70b's
+ * tool emission triggers Groq's first-party 400
+ * ("Failed to call a function. Please adjust your prompt.").
+ *
+ * Resolution precedence (caller in `aidenCLI.ts` enforces order):
+ *   1. Both CLI flags `--provider` + `--model` set      → use as-is
+ *   2. One CLI flag set                                  → use it, resolve other
+ *   3. Persisted config (model-selection.json) complete  → use as-is
+ *   4. Persisted config partial                          → use it, resolve other
+ *   5. Neither → priority-list auto-pick                 → THIS MODULE
+ *   6. Nothing authed                                    → hardcoded fallback
+ *
+ * `resolveBootProvider()` covers cases 1–5; the caller composes the
+ * input shape and falls back when this returns `null` (case 6).
+ *
+ * Test surface: the enumerator is injected so unit tests mock it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BOOT_PRIORITY = void 0;
+exports.findProviderForModel = findProviderForModel;
+exports.resolveBootProvider = resolveBootProvider;
+const doctorLiveness_1 = require("./doctorLiveness");
+const registry_1 = require("../../providers/v4/registry");
+/**
+ * Provider id ordering for auto-pick. Higher in the list = preferred.
+ * OAuth subscription flows lead because they have no API-key
+ * onboarding friction and are the default v4.1.1 install path.
+ */
+exports.BOOT_PRIORITY = [
+    'chatgpt-plus', // OAuth — primary onboarding flow
+    'claude-pro', // OAuth — Anthropic equivalent
+    'anthropic', // API key — power-user tier
+    'openai', // API key — power-user tier
+    // Phase v4.1.2-deepseek: paid tier, strong tool-caller, ranked
+    // above groq for the same first-run-UX reason — groq's free-tier
+    // tool emission was the original bug1 (llama-3.3-70b 400s on
+    // tool calls).
+    'deepseek', // API key — paid, strong tool-caller (V4 Pro)
+    'groq', // free-tier API key — common but tool-emission flaky
+    'ollama', // local — only if daemon up
+];
+/**
+ * Walk every provider's `modelIds` and return the entry that lists
+ * `modelId`. Used by the `--model`-only path to validate the model
+ * is at least known to one provider before we accept it.
+ */
+function findProviderForModel(modelId) {
+    for (const entry of Object.values(registry_1.PROVIDER_REGISTRY)) {
+        if (entry.modelIds.includes(modelId))
+            return entry;
+    }
+    return null;
+}
+/**
+ * Resolve the boot provider + model. Returns `null` when no choice
+ * could be inferred AND nothing is authed (the caller falls back to
+ * the hardcoded `groq + llama-3.3-70b-versatile` default in that
+ * one case).
+ *
+ * Throws (`Error`) when input is internally inconsistent — e.g. the
+ * user passed `--model foo` for a model no provider declares. Caller
+ * surfaces the message via the standard error path.
+ */
+async function resolveBootProvider(input, enumerate) {
+    const { cliProviderId, cliModelId, cfgProviderId, cfgModelId } = input;
+    // Case 1: both CLI flags set.
+    if (cliProviderId && cliModelId) {
+        return { providerId: cliProviderId, modelId: cliModelId, source: 'cli-flag' };
+    }
+    // Case 2a: `--provider` only. Use that provider + its first
+    // non-codex model. The registry might not know this provider; we
+    // accept it as-is (the runtime resolver will throw a clearer error
+    // later if it's bogus).
+    if (cliProviderId && !cliModelId) {
+        const entry = registry_1.PROVIDER_REGISTRY[cliProviderId];
+        const modelId = entry ? (0, doctorLiveness_1.pickProbeModel)(entry) : '';
+        if (!modelId) {
+            throw new Error(`--provider '${cliProviderId}' set but no model could be inferred. ` +
+                `Pass --model explicitly.`);
+        }
+        return { providerId: cliProviderId, modelId, source: 'cli-flag-partial' };
+    }
+    // Case 2b: `--model` only. Verify the model is known to some
+    // provider; pick the matching provider.
+    if (!cliProviderId && cliModelId) {
+        const entry = findProviderForModel(cliModelId);
+        if (!entry) {
+            throw new Error(`--model '${cliModelId}' is not declared by any provider in the ` +
+                `registry. Run \`aiden model\` to see available models, or pass ` +
+                `--provider explicitly.`);
+        }
+        return { providerId: entry.id, modelId: cliModelId, source: 'cli-flag-partial' };
+    }
+    // Case 3: persisted config — both fields set.
+    if (cfgProviderId && cfgModelId) {
+        return { providerId: cfgProviderId, modelId: cfgModelId, source: 'persisted-config' };
+    }
+    // Case 4a: config has provider, no model — resolve via pickProbeModel.
+    if (cfgProviderId && !cfgModelId) {
+        const entry = registry_1.PROVIDER_REGISTRY[cfgProviderId];
+        const modelId = entry ? (0, doctorLiveness_1.pickProbeModel)(entry) : '';
+        if (modelId) {
+            return { providerId: cfgProviderId, modelId, source: 'config-partial' };
+        }
+        // Unknown provider in config — fall through to auto-pick rather
+        // than refusing to boot.
+    }
+    // Case 4b: config has model only — same shape as Case 2b but
+    // softer: fall through to auto-pick if the model isn't found in
+    // the registry (config can lag the codebase).
+    if (!cfgProviderId && cfgModelId) {
+        const entry = findProviderForModel(cfgModelId);
+        if (entry) {
+            return { providerId: entry.id, modelId: cfgModelId, source: 'config-partial' };
+        }
+    }
+    // Case 5: auto-pick from priority list.
+    const configured = await enumerate();
+    for (const id of exports.BOOT_PRIORITY) {
+        const hit = configured.find((c) => c.entry.id === id && c.configured);
+        if (hit) {
+            return {
+                providerId: id,
+                modelId: (0, doctorLiveness_1.pickProbeModel)(hit.entry),
+                source: 'auto-priority',
+            };
+        }
+    }
+    // Case 6: nothing authed — caller falls back to hardcoded default.
+    return null;
+}