nomarmy 0.1.0-alpha.19 → 0.1.0-alpha.20

package/bin/nomarmy.mjs

@@ -38,9 +38,10 @@ import { readSetting, writeSetting, writeEnvLine, userCommonPath, userProfilePat
 import { MIN_PODMAN_VM_MB } from "../lib/doctor.mjs";
 import { liveLeases } from "../lib/slots.mjs";
 import { ensureProviderConfig } from "../lib/openclaw-config.mjs";
-import { recordProbeSuccess } from "../lib/health.mjs";
+import { recordProbeSuccess, parseOpenclawAuthProfiles } from "../lib/health.mjs";
 import { pruneJobRuntime } from "../lib/prune.mjs";
 import { SUBSCRIPTION_VENDORS, parseOpenclawVersion, versionAtLeast, parseCatalogModels, parseCliLoginStatus, probeOutcome, parseMuseAuthDescriptor, extractMintedKey } from "../lib/subscription-setup.mjs";
+import { PINNED_OPENCLAW_VERSION, repairOpenclaw, verifyOpenclaw, configuredSubscriptionVendors } from "../lib/openclaw-install.mjs";
 import { ensureOpenClawOnPath } from "../lib/openclaw-path.mjs";
 import { THINKING_LEVELS } from "../lib/thinking.mjs";
 import { fileURLToPath } from "node:url";
@@ -224,7 +225,7 @@ Usage: nomarmy <command> [options]
                   how many api and subscription jobs run at once, across
                   every session (default 4); with n, sets it in limits.yml.
                   Warns when the Podman VM is too small for that many.
-  jobs [--watch|--events [--until-done]|--prune|--wait <jobId>|--stop <jobId> [--reason <text>]] [--interval N] [--older-than DAYS]
+  jobs [--watch|--events [--until-done] [--run <run-id>] [--repo <path>]|--prune|--wait <jobId> [<jobId> ...]|--stop <jobId> [--reason <text>]] [--interval N] [--older-than DAYS]
                   what's running across every session (agent, model, phase,
                   last tool call, files changed, heartbeat) and what just
                   finished; --watch redraws every N seconds (default 3);
@@ -232,14 +233,17 @@ Usage: nomarmy <command> [options]
                   finish (--json for JSON lines). It's a stream: read it
                   with a monitor that wakes on each line. A background
                   command is only reported when it exits, so there use
-                  --events --until-done, which exits once every job it saw
-                  running has finished (or --wait for one job). The plain
+                  --events --until-done --run <run-id> for a whole run,
+                  or --wait <id> <id> ... for specific jobs. Unscoped
+                  --until-done watches every job on this machine. The plain
                   stream ends on its own after 30 minutes with nothing
                   running (--idle-minutes N); --prune removes the bulky runtime data
                   from finished jobs older than DAYS (default 2), keeping
                   their records, reports and any retained worktree;
-                  --wait <jobId> [--timeout <seconds>] blocks for one job
-                  to finish (default timeout 1800; --json is supported);
+                  --wait <jobId> [<jobId> ...] [--timeout <seconds>]
+                  blocks until all finish; comma-separated ids also work
+                  (default timeout 1800; --json is supported);
+                  --events --repo <path> limits events to one repository;
                   --stop <jobId> stops a running job's worker (no report
                   recovery, no verification), keeping its worktree for
                   continue_from
@@ -353,7 +357,7 @@ function cmdScan() {
   const notes = evidence.notes?.items ?? [];
   if (notes.length) {
     console.log("\nNotes:");
-    for (const n of notes) console.log(`  ${n.message ?? n}`);
+    for (const n of notes) console.log(`  ${typeof n === "string" ? n : n.message ?? JSON.stringify(n)}`);
   }
   console.log("\nThis is deterministic evidence only - nothing here was executed.");
   console.log("Describe the environment in .nomarmy.yml, then run 'nomarmy validate'.");
@@ -376,12 +380,12 @@ function scanCheck(evidence) {
     process.exit(1);
   }
   console.log(`Comparing ${path.basename(loaded.path)} against repository evidence\n`);
-  if (drift.summary) console.log(`${drift.summary}\n`);
+  if (drift.summary) console.log(`Drift: ${drift.summary.missingFromConfig} missing from config, ${drift.summary.missingFromRepo} missing from repo (${drift.summary.total} total)\n`);
   for (const section of ["services", "ports", "environment", "commandKinds"]) {
     const d = drift[section];
     if (!d) continue;
-    for (const m of d.missingFromConfig ?? []) console.log(`  repo has, config omits:  ${section}: ${m}`);
-    for (const m of d.missingFromRepo ?? []) console.log(`  config has, repo lacks:  ${section}: ${m}`);
+    for (const m of d.missingFromConfig ?? []) console.log(`  repo has, config omits:  ${section}: ${typeof m === "object" ? JSON.stringify(m) : m}`);
+    for (const m of d.missingFromRepo ?? []) console.log(`  config has, repo lacks:  ${section}: ${typeof m === "object" ? JSON.stringify(m) : m}`);
   }
   process.exit(drift.ok ? 0 : 1);
 }
@@ -1178,23 +1182,24 @@ async function ensureVendorAuth(rl, vendorKey) {
   let status = readLoginStatus(vendorKey);
   if (!status.loggedIn) {
     console.log(c.yellow(`You're not logged in to ${vendor.cli.bin} yet -- this opens its own login (a browser or a device code).`));
-    if (!(await confirm(rl, "Log in now?"))) return { ok: false };
-    runInteractive(vendor.cli.bin, vendor.cli.loginArgs);
+    if (!(await confirm(rl, "Log in now?"))) { console.log(c.red(`✗ Sign-in canceled. Retry with \`nomarmy agents add subscription ${vendorKey}\`.`)); return { ok: false }; }
+    const loginOk = runInteractive(vendor.cli.bin, vendor.cli.loginArgs);
+    if (!loginOk) { console.log(c.red(`✗ ${vendor.cli.bin} sign-in failed or was canceled. Retry with \`nomarmy agents add subscription ${vendorKey}\`.`)); return { ok: false }; }
     status = readLoginStatus(vendorKey);
-    if (!status.loggedIn) { console.log(c.red(`✗ Still not logged in to ${vendor.cli.bin}.`)); return { ok: false }; }
+    if (!status.loggedIn) { console.log(c.red(`✗ Still not logged in to ${vendor.cli.bin}. Retry with \`nomarmy agents add subscription ${vendorKey}\`.`)); return { ok: false }; }
   }
   console.log(c.green(`✓ Logged in to ${vendor.cli.bin}${status.email ? ` as ${status.email}` : ""}${status.subscriptionType ? ` (${status.subscriptionType})` : ""}.`));
 
   if (vendor.plugin) {
     step("OpenClaw plugin");
     const version = parseOpenclawVersion(runQuiet(openclawCmd(), ["--version"]).out);
-    if (!versionAtLeast(version, vendor.plugin.minOpenclaw)) {
-      console.log(c.yellow(`OpenClaw ${version ? version.join(".") : "(unknown version)"} is older than the ${vendor.plugin.minOpenclaw} this vendor's plugin needs.`));
-      if (!(await confirm(rl, "Update OpenClaw now (npm update -g openclaw)?"))) return { ok: false };
-      if (!runInteractive("npm", ["update", "-g", "openclaw"])) {
-        console.log(c.red("✗ Update failed. If npm reports EACCES, your global npm directory has root-owned files from an old sudo install: `sudo chown -R $(whoami) ~/.npm ~/.npm-global` fixes it."));
-        return { ok: false };
-      }
+    if (!versionAtLeast(version, PINNED_OPENCLAW_VERSION)) {
+      const repaired = await repairOpenclaw({
+        command: openclawCmd(),
+        vendors: configuredSubscriptionVendors(loadAgentsOrExit().agents, [vendorKey]),
+        isTTY: Boolean(input.isTTY), ask: (prompt) => rl.question(prompt),
+      });
+      if (!repaired.ok) return { ok: false };
     }
     if (!runQuiet(openclawCmd(), ["plugins", "inspect", vendor.plugin.id]).ok) {
       console.log(c.dim(`Installing ${vendor.plugin.spec}...`));
@@ -1204,6 +1209,12 @@ async function ensureVendorAuth(rl, vendorKey) {
       }
       runQuiet(openclawCmd(), ["plugins", "registry", "--refresh"]);
     }
+    const checks = verifyOpenclaw({ command: openclawCmd(), vendors: configuredSubscriptionVendors(loadAgentsOrExit().agents, [vendorKey]) });
+    const failed = checks.filter((check) => !check.ok);
+    if (failed.length) {
+      for (const check of failed) console.log(c.red(`✗ ${check.message} Fix: ${check.fix}`));
+      return { ok: false };
+    }
     console.log(c.green(`✓ OpenClaw's ${vendor.plugin.id} plugin is ready.`));
   }
   if (vendor.credential.kind === "minted-key") {
@@ -1225,11 +1236,24 @@ async function ensureVendorAuth(rl, vendorKey) {
   return { ok: true, email: status.email };
 }
 
+function hasUsableOpenclawAuthProfile(provider) {
+  // Same OpenClaw command and JSON shape used by health's login-expiry check.
+  const result = runQuiet(openclawCmd(), ["models", "auth", "list", "--json"]);
+  if (!result.ok) return false;
+  const profiles = parseOpenclawAuthProfiles(result.stdout);
+  return profiles?.some((profile) => {
+    if (profile.provider !== provider) return false;
+    if (profile.expiresAt == null) return true;
+    const expires = Date.parse(profile.expiresAt);
+    return Number.isFinite(expires) && expires > Date.now();
+  }) ?? false;
+}
+
 function catalogModelsFor(provider) {
   return parseCatalogModels(runQuiet(openclawCmd(), ["models", "list", "--refresh"]).out, provider);
 }
 
-/** One real, one-token completion through OpenClaw -- the only proof a credential actually works. */
+/** One real, one-token completion through OpenClaw to test a model. */
 // Why the last probeWorker() call failed, in the vendor's words when it said.
 let lastProbeFailure = null;
 function probeWorker(provider, model) {
@@ -1279,8 +1303,8 @@ function reapProbeSandbox(stateDir) {
 /**
  * OpenClaw's own provider login, for the vendors whose plugin wants one on
  * top of the vendor CLI's login (Claude doesn't: OpenClaw reuses the CLI
- * session directly). Only ever run when a probe or catalog lookup has
- * already shown it's needed -- never preemptively.
+ * session directly). Run when the catalog or auth-profile check shows
+ * linking is needed, never preemptively.
  */
 function openclawProviderLogin(vendor) {
   const provider = vendor.credential.loginProvider ?? vendor.provider;
@@ -1295,8 +1319,9 @@ function openclawProviderLogin(vendor) {
 // One list in ~/.config/nomarmy/agents.yml (lib/agents.mjs): the local
 // model, api keys, and individual subscriptions. `add` walks through what
 // each kind needs -- a key registered with OpenClaw, or the vendor's own
-// login -- and proves it with a real test call before saving. Changes apply
-// to the next job; the MCP server re-reads the file when it changes.
+// login -- and tests the selected model before saving, with an explicit
+// opt-in to save after a failed model call. Changes apply to the next job;
+// the MCP server re-reads the file when it changes.
 
 function loadAgentsOrExit() {
   try { return loadAgents(globalConfigDir()); }
@@ -1514,6 +1539,14 @@ async function addApiAgent(rl, agents) {
   console.log(c.dim(`Use it with \`nomarmy army assign <role> ${name}\` or agent: "${name}" on a job.`));
 }
 
+const OWNER_EMAIL_RE = /^[^@\s]+@[^@\s]+$/;
+function validOwnerEmail(email) { return typeof email === "string" && OWNER_EMAIL_RE.test(email); }
+function gitUserEmail() {
+  const result = spawnSync("git", ["config", "user.email"], { cwd: repoDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+  const email = result.status === 0 ? result.stdout.trim() : "";
+  return validOwnerEmail(email) ? email : "";
+}
+
 const SUBSCRIPTION_AGENT_DEFAULT_NAMES = { claude: "claude", codex: "codex", meta: "muse" };
 
 async function addSubscriptionAgent(rl, agents) {
@@ -1537,7 +1570,7 @@ async function addSubscriptionAgent(rl, agents) {
   }
 
   const auth = await ensureVendorAuth(rl, vendorKey);
-  if (!auth.ok) { console.log(c.dim("\nStopped; nothing was written.")); return; }
+  if (!auth.ok) { console.log(c.dim("\nStopped; nothing was written.")); process.exitCode = 1; return; }
 
   console.log(`\n${c.bold("→")} Models`);
   const needsOpenclawLogin = vendor.credential.kind === "openclaw-login";
@@ -1545,8 +1578,19 @@ async function addSubscriptionAgent(rl, agents) {
   let models = catalogModelsFor(vendor.provider);
   if (!models.length && needsOpenclawLogin) {
     linkedOpenclaw = openclawProviderLogin(vendor);
+    if (!linkedOpenclaw) { console.log(c.red(`✗ Sign-in failed or was canceled. Retry with \`nomarmy agents add subscription ${vendorKey}\`.`)); process.exitCode = 1; return; }
     models = catalogModelsFor(vendor.provider);
   }
+  // Catalog entries can be cached, and a particular model can refuse a
+  // working login. Check OpenClaw's auth profile before asking for details.
+  if (needsOpenclawLogin && !hasUsableOpenclawAuthProfile(vendor.provider)) {
+    if (linkedOpenclaw || !openclawProviderLogin(vendor) || !hasUsableOpenclawAuthProfile(vendor.provider)) {
+      console.log(c.red(`✗ Sign-in has no usable auth profile. Retry with \`nomarmy agents add subscription ${vendorKey}\`.`));
+      process.exitCode = 1;
+      return;
+    }
+    linkedOpenclaw = true;
+  }
   // The agent is the account; the model is only a default. Roles pick
   // their own model (or "auto" for the General to choose per job).
   if (models.length) models.forEach((m, i) => console.log(`  ${c.cyan(`${i + 1}.`)} ${m}`));
@@ -1554,27 +1598,29 @@ async function addSubscriptionAgent(rl, agents) {
   const pick = (await rl.question(c.bold(`Default model, optional${models.length ? " (a number or an id)" : ""}; blank = pick per role: `))).trim();
   const model = /^\d+$/.test(pick) && models.length ? models[Number(pick) - 1] : pick || null;
   if (pick && !model) throw new Error(`Not a valid choice: "${pick}".`);
-  // The test call needs some model; it proves the login, not the choice.
+  // The test call needs some model; it checks the model, not the login.
   const probeModel = model ?? models[0] ?? vendor.defaultModel;
 
-  const knownOwners = [...new Set(Object.values(agents).filter((a) => a.kind === "subscription").map((a) => a.owner))];
-  const ownerDefault = auth.email ?? (knownOwners.length === 1 ? knownOwners[0] : "");
-  const owner = (await rl.question(c.bold(`Whose subscription is this${ownerDefault ? ` [${ownerDefault}]` : ""}: `))).trim() || ownerDefault;
-  if (!owner) throw new Error("An owner is required -- every job on this agent must name them in on_behalf_of.");
+  const ownerDefault = validOwnerEmail(auth.email) ? auth.email : gitUserEmail();
+  const owner = await askUntilValid(rl, `Whose subscription is this${ownerDefault ? ` [${ownerDefault}]` : ""}: `, {
+    allowEmpty: Boolean(ownerDefault), fallback: ownerDefault, pattern: OWNER_EMAIL_RE,
+    invalidMessage: "enter an email address (one @, no spaces).",
+  });
 
   const name = await askAgentName(rl, agents, SUBSCRIPTION_AGENT_DEFAULT_NAMES[vendorKey] ?? vendorKey);
   if (!name) { console.log(c.dim("Stopped; nothing was written.")); return; }
 
   console.log(`\n${c.bold("→")} Test call`);
-  let works = probeModel ? probeWorker(vendor.provider, probeModel) : false;
-  if (!works && needsOpenclawLogin && !linkedOpenclaw && probeModel) {
-    openclawProviderLogin(vendor);
-    works = probeWorker(vendor.provider, probeModel);
-  }
+  const works = probeModel ? probeWorker(vendor.provider, probeModel) : false;
   if (works) console.log(c.green(`✓ ${vendor.provider}/${probeModel} answered a real test prompt.`));
   else {
-    console.log(c.red(probeModel ? `✗ A real test prompt to ${vendor.provider}/${probeModel} didn't come back.` : "✗ No model to make a test call with."));
-    if (!(await confirm(rl, "Save the agent anyway?", { defaultYes: false }))) { console.log(c.dim("Stopped; nothing was written.")); return; }
+    console.log(c.yellow(probeModel ? `⚠ The login works, but ${vendor.provider}/${probeModel} didn't answer a real test prompt.` : "⚠ The login works, but no model is available for a test call."));
+    console.log(c.dim(`You can retry later with \`nomarmy agents update ${name} --probe\`.`));
+    if (!(await confirm(rl, "Save the agent anyway?", { defaultYes: false }))) {
+      console.log(c.dim("Stopped; nothing was written."));
+      process.exitCode = 1;
+      return;
+    }
   }
   const written = saveAgents({ ...agents, [name]: { kind: "subscription", provider: vendor.provider, owner, ...(model ? { model } : {}) } });
   savedAgentMessage(name, written);
@@ -1587,6 +1633,7 @@ async function cmdAgentsAddJson() {
   const kind = value("kind") ?? (AGENT_KINDS.includes(argv[2]) ? argv[2] : null);
   if (!name || !kind) throw new Error(`--json requires --name <agent> and --kind <${AGENT_KINDS.join("|")}>, plus that kind's fields (see \`nomarmy help\`).`);
   if (RESERVED_AGENT_NAMES.includes(name)) throw new Error(`"${name}" is a reserved name.`);
+  if (kind === "subscription" && value("owner") !== null && !validOwnerEmail(value("owner"))) throw new Error("--owner must be an email address (one @, no spaces).");
   const agent = { kind };
   const num = (flagName) => (value(flagName) !== null ? Number(value(flagName)) : undefined);
   if (kind === "local") {
@@ -1612,6 +1659,43 @@ async function cmdAgentsAddJson() {
   return out({ written: agentsConfigPath(globalConfigDir()), name, agent: saved, ...(kind === "api" ? { registered, mcpUpdated } : {}) });
 }
 
+// A probe-only update checks credentials without changing agents.yml.
+function probeConfiguredAgent(name, agent) {
+  const provider = agentProviderId(agent);
+  let model = agent.model;
+  let source = "";
+  if (!model && provider) {
+    const role = agentAssignments()[name]?.roles.find((r) => r.model && r.model !== "auto");
+    if (role) { model = role.model; source = `${role.role}'s model`; }
+    if (!model) {
+      const vendor = Object.values(SUBSCRIPTION_VENDORS).find((v) => v.provider === provider);
+      if (vendor?.defaultModel) { model = vendor.defaultModel; source = "vendor default"; }
+    }
+    if (!model) {
+      model = catalogModelsFor(provider)[0];
+      if (model) source = "first catalog model";
+    }
+  }
+  if (!provider || !model) {
+    console.log(c.red(`✗ ${name}  ${provider ?? agent.kind}/${model ?? "no model"}  no model available; set one with \`nomarmy agents update ${name} --model <m>\``));
+    process.exitCode = 1;
+    return;
+  }
+  const selected = `${provider}/${model}${source ? ` (${source})` : ""}`;
+  const start = performance.now();
+  const ok = probeWorker(provider, model);
+  const elapsed = ((performance.now() - start) / 1000).toFixed(1);
+  console.log(ok ? c.green(`✓ ${name}  ${selected}  answered in ${elapsed}s`)
+    : c.red(`✗ ${name}  ${selected}  failed: ${lastProbeFailure ?? "no answer"}`));
+  if (!ok) process.exitCode = 1;
+}
+
+function cmdAgentsProbeAll() {
+  const agents = fileAgentsOrExit();
+  if (!Object.keys(agents).length) { console.log("No configured agents to probe."); return; }
+  for (const [name, agent] of Object.entries(agents)) probeConfiguredAgent(name, agent);
+}
+
 // --- update ---
 
 // Kind, provider and owner are fixed: changing any of them is a different
@@ -1620,7 +1704,8 @@ async function cmdAgentsAddJson() {
 // test call `add` makes (interactive always; --json only with --probe,
 // since it spends a real request on the subscription).
 async function cmdAgentsUpdate() {
-  const name = argv[2];
+  const name = argv[2]?.startsWith("--") ? null : argv[2];
+  if (!name && flag("probe")) return cmdAgentsProbeAll();
   if (!name) throw new Error("Usage: nomarmy agents update <name> [--model <m>|--no-model] [--slot coder|gpt] [--auth-env <NAME>] [--base-url <url>] [--max-concurrent <n>] [--context-window <tokens>] [--thinking [low|medium|high]|--no-thinking] [--probe]");
   const agents = fileAgentsOrExit();
   const current = Object.prototype.hasOwnProperty.call(agents, name) ? agents[name] : name === "local" ? { ...BUILTIN_LOCAL_AGENT } : undefined;
@@ -1646,7 +1731,7 @@ async function cmdAgentsUpdate() {
       throw new Error("Kind, provider and owner can't be changed -- that's a different agent. Use `nomarmy agents add`.");
     }
     probe = flag("probe") && current.kind === "subscription";
-    if (!Object.keys(changes).length) throw new Error("Nothing to update -- pass at least one field flag (see `nomarmy agents update` usage).");
+    if (!Object.keys(changes).length && !probe) throw new Error("Nothing to update -- pass at least one field flag (see `nomarmy agents update` usage).");
   } else {
     if (!process.stdin.isTTY) throw new Error("nomarmy agents update needs an interactive terminal, or the flags to change (e.g. --max-concurrent 3).");
     const rl = createInterface({ input, output });
@@ -1693,6 +1778,7 @@ async function cmdAgentsUpdate() {
     if (!Object.keys(changes).length) { console.log(c.dim("\nNothing changed.")); return; }
   }
 
+  if (probe && !Object.keys(changes).length) { probeConfiguredAgent(name, current); return; }
   if (probe && changes.model && !probeWorker(current.provider, changes.model)) {
     out({ error: `a real test prompt to ${current.provider}/${changes.model} didn't come back -- nothing was written` });
     process.exit(1);
@@ -2319,9 +2405,15 @@ function armyLayerFlag(fallback = "global") {
   return chosen[0] ?? fallback;
 }
 
-function loadArmyForCli() {
+function loadArmyForCli({ globalOnly = false } = {}) {
   const agents = loadAgentsOrExit().agents;
-  const loaded = loadArmy({ projectDir: repoDir });
+  const loaded = globalOnly
+    ? (() => {
+        const filePath = armyLayerPath("global", { projectDir: repoDir });
+        const army = readArmyFile(filePath, { armyOnly: true });
+        return { ...mergeArmy([{ layer: "global", army }]), layers: [{ layer: "global", path: filePath, exists: fs.existsSync(filePath), hasArmy: Boolean(army) }] };
+      })()
+    : loadArmy({ projectDir: repoDir });
   const usageSnapshots = readUsageSnapshots(process.env.NOMARMY_AGENT_STATE || path.join(os.homedir(), ".local", "share", "nomarmy-local-agents"));
   return { loaded, agents, summary: describeArmy(loaded, { agents, describeAgent: describeAgentLabel, usageSnapshots, agentProviderId }) };
 }
@@ -2349,11 +2441,23 @@ function usageLine(usage, indent) {
   return usage.level === "over" ? c.red(`${text} (at the limit)`) : usage.level === "high" ? c.yellow(text) : c.dim(text);
 }
 
+function repositoryHere(dir) {
+  let current = path.resolve(dir);
+  while (true) {
+    if (fs.existsSync(path.join(current, ".git"))) return true;
+    const parent = path.dirname(current);
+    if (parent === current) return false;
+    current = parent;
+  }
+}
+
 async function cmdArmyShow() {
-  const { summary } = loadArmyForCli();
+  const inRepository = repositoryHere(repoDir);
+  const { summary } = loadArmyForCli({ globalOnly: !inRepository });
   if (json) return out(summary);
   const g = summary.general;
-  console.log(c.bold("🪖 nomArmy") + c.dim(`  (${repoDir})`));
+  console.log(c.bold("🪖 nomArmy") + (inRepository ? c.dim(`  (${repoDir})`) : ""));
+  if (!inRepository) console.log(c.dim("no repository here: showing global settings"));
   console.log(`\n${c.bold("General")}  ${g.agent ? agentCell(g.agent, g.agentRunsOn) : ""}${g.setBy ? c.dim(`  [${g.setBy}]`) : ""}`);
   console.log(c.dim(`  ${g.who}`));
   for (const line of g.responsibilities) console.log(c.dim(`  - ${line}`));
@@ -2383,7 +2487,7 @@ async function cmdArmyShow() {
     }
   }
   console.log(`\n${c.bold("Layers")}  ${c.dim("(later ones win)")}`);
-  for (const layer of summary.layers) {
+  for (const layer of summary.layers.filter((entry) => inRepository || entry.layer === "global")) {
     const state = layer.hasArmy ? c.green("● army section") : layer.exists ? c.dim("○ file exists, no army section") : c.dim("○ no file");
     console.log(`  ${layer.layer.padEnd(8)} ${state.padEnd(40)} ${c.dim(layer.path)}`);
   }
@@ -2433,14 +2537,31 @@ async function cmdArmyInit() {
   }
 }
 
+function armyPositionals() {
+  const result = [];
+  const args = argv.slice(2);
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (["--repo", "--agent", "--model"].includes(arg)) {
+      if (!args[i + 1] || args[i + 1].startsWith("--")) throw new Error(`${arg} requires a value`);
+      i++;
+    } else if (["--global", "--project", "--local", "--json", "--no-check"].includes(arg)) {
+      continue;
+    } else if (arg.startsWith("--")) {
+      throw new Error(`Unknown army option ${arg}`);
+    } else result.push(arg);
+  }
+  return result;
+}
+
 async function cmdArmyAssign() {
-  // Positionals only: argv also holds flags, and `--json` must never be read as a model.
-  const positional = argv.slice(2);
-  const firstFlag = positional.findIndex((a) => a.startsWith("--"));
-  const [roleName, agentName, model] = firstFlag === -1 ? positional : positional.slice(0, firstFlag);
-  if (!roleName || !agentName) throw new Error("Usage: nomarmy army assign <role> <agent|none> [model|auto] [--global|--project|--local]");
+  const positional = armyPositionals();
+  const [roleName, agentName, model] = positional;
+  if (!roleName || !agentName || positional.length > 3) throw new Error("Usage: nomarmy army assign <role> <agent|none> [model|auto] [--global|--project|--local]");
   const layer = armyLayerFlag("global");
   const filePath = armyLayerPath(layer, { projectDir: repoDir });
+  const defined = Object.prototype.hasOwnProperty.call(loadArmy({ projectDir: repoDir }).army.roles, roleName);
+  if (!defined) throw new Error(`Role "${roleName}" is not defined in any army roster. Run nomarmy army init first.`);
   const target = parseTargetSpec(agentName, model);
   const check = flag("no-check") ? { status: "skipped" } : checkRoleModel(agentName, model);
   if (check.status === "failed") {
@@ -2496,8 +2617,9 @@ function checkRoleModel(agentName, model) {
 // Which agent the General is. Global or local only: it describes the
 // person's own coordinator session, which a committed project file can't know.
 async function cmdArmyGeneral() {
-  const agentName = argv[2];
-  if (!agentName) throw new Error("Usage: nomarmy army general <agent> [--global|--local]");
+  const positional = armyPositionals();
+  const [agentName] = positional;
+  if (!agentName || positional.length !== 1) throw new Error("Usage: nomarmy army general <agent> [--global|--local]");
   const layer = armyLayerFlag("global");
   if (layer === "project") throw new Error("The General is your own coordinator session, so it's set in --global or --local, never in a committed project file.");
   const agents = loadAgentsOrExit().agents;
@@ -2583,7 +2705,7 @@ function pidIsAlive(pid) {
   try { process.kill(pid, 0); return true; } catch (error) { return error.code === "EPERM"; }
 }
 
-function collectJobs({ recent = 8 } = {}) {
+function collectJobs({ recent = 8, runId = null, projectDir = null } = {}) {
   const root = jobsRootDir();
   let names = [];
   try { names = fs.readdirSync(root); } catch { return { running: [], recent: [] }; }
@@ -2591,6 +2713,10 @@ function collectJobs({ recent = 8 } = {}) {
     const dir = path.join(root, name);
     const status = readJsonSafe(path.join(dir, "status.json")) ?? {};
     const meta = readJsonSafe(path.join(dir, "metadata.json"));
+    const lease = readJsonSafe(path.join(agentStateRoot(), "leases", `${name}.json`));
+    const jobRunId = meta?.labels?.runId ?? lease?.runId ?? null;
+    const jobProjectDir = meta?.projectDir ?? lease?.repo ?? null;
+    if ((runId && jobRunId !== runId) || (projectDir && (!jobProjectDir || path.resolve(jobProjectDir) !== projectDir))) return null;
     const started = Date.parse(status.startedAt ?? meta?.startedAt ?? "") || fs.statSync(dir).mtimeMs;
     const running = status.state === "running" && pidIsAlive(status.serverPid);
     return {
@@ -2603,7 +2729,7 @@ function collectJobs({ recent = 8 } = {}) {
       heartbeatAgeSeconds: status.heartbeatAt ? Math.round((Date.now() - Date.parse(status.heartbeatAt)) / 1000) : null,
       started, dir,
     };
-  }).sort((a, b) => b.started - a.started);
+  }).filter(Boolean).sort((a, b) => b.started - a.started);
   return { running: jobs.filter((j) => j.running), recent: jobs.filter((j) => !j.running).slice(0, recent) };
 }
 
@@ -2636,6 +2762,13 @@ async function streamJobEvents() {
   // background command (reported only on exit) was never told jobs had
   // finished, and eight of these streams were left running for days.
   const untilDone = flag("until-done");
+  const runId = value("run");
+  const projectDir = flag("repo") ? repoDir : null;
+  if (!runId && !projectDir) {
+    const detail = "watching every job on this machine; use --wait <ids> or --run <id> to scope the watch";
+    if (json) console.log(JSON.stringify({ at: new Date().toISOString(), event: "scope", detail }));
+    else console.log(detail);
+  }
   const idleLimitMs = Math.max(1, Number(value("idle-minutes", "30")) || 30) * 60000;
   let idleSinceMs = Date.now(), sawRunning = false;
   const seen = new Map();
@@ -2646,7 +2779,7 @@ async function streamJobEvents() {
   process.on("SIGINT", () => process.exit(0));
   let first = true;
   for (;;) {
-    const { running, recent } = collectJobs({ recent: 20 });
+    const { running, recent } = collectJobs({ recent: 20, runId, projectDir });
     const now = new Map([...running, ...recent].map((j) => [j.jobId, j]));
     for (const j of running) {
       const prev = seen.get(j.jobId);
@@ -2657,10 +2790,13 @@ async function streamJobEvents() {
       const j = now.get(id);
       if (prev.running && j && !j.running) emit("finished", j, `${j.phase} after ${fmtSeconds(j.elapsedSeconds)}`);
     }
+    // A finished record can briefly lack its run label after its lease is removed.
+    // Keep the running snapshot until the stamped record becomes visible.
+    const pending = (runId || projectDir) ? [...seen].filter(([id, j]) => j.running && !now.has(id)) : [];
     seen.clear();
-    for (const [id, j] of now) seen.set(id, j);
+    for (const [id, j] of [...now, ...pending]) seen.set(id, j);
     first = false;
-    if (running.length) { sawRunning = true; idleSinceMs = Date.now(); }
+    if (running.length || pending.length) { sawRunning = true; idleSinceMs = Date.now(); }
     else if (untilDone && sawRunning) {
       if (json) console.log(JSON.stringify({ at: new Date().toISOString(), event: "done", detail: "every job seen running has finished" }));
       else console.log(`${new Date().toLocaleTimeString()}  done      every job seen running has finished`);
@@ -2677,65 +2813,60 @@ async function streamJobEvents() {
 
 const commitSha = (commit) => (typeof commit === "string" ? commit : typeof commit?.sha === "string" ? commit.sha : null);
 
-/** Wait for one job in the shared, cross-session state directory. */
+/** Wait for selected jobs in the shared, cross-session state directory. */
 async function waitForJobCli() {
-  const requested = value("wait");
-  const jobId = requested ? path.basename(requested) : null;
+  const waitIndex = argv.indexOf("--wait");
+  const requested = [];
+  for (let i = waitIndex + 1; i < argv.length && !argv[i].startsWith("--"); i++) requested.push(...argv[i].split(","));
+  const jobIds = [...new Set(requested)];
   const timeoutSeconds = Number(value("timeout", "1800"));
-  if (!jobId || jobId !== requested) {
-    if (json) out({ error: "--wait needs a job id" });
-    else console.error("nomarmy jobs: --wait needs a job id");
+  const errorOut = (message) => {
+    if (json) out({ error: message });
+    else console.error(`nomarmy jobs: ${message}`);
     process.exitCode = 2;
-    return;
-  }
-  if (!Number.isFinite(timeoutSeconds) || timeoutSeconds < 0) {
-    if (json) out({ error: "--timeout must be a non-negative number of seconds" });
-    else console.error("nomarmy jobs: --timeout must be a non-negative number of seconds");
-    process.exitCode = 2;
-    return;
-  }
-  const jobDir = path.join(jobsRootDir(), jobId);
-  const lease = path.join(agentStateRoot(), "leases", `${jobId}.json`);
-  if (!fs.existsSync(jobDir) && !fs.existsSync(lease)) {
-    if (json) out({ error: `unknown job id: ${jobId}` });
-    else console.error(`nomarmy jobs: unknown job id: ${jobId}`);
-    process.exitCode = 2;
-    return;
+  };
+  if (!jobIds.length) return errorOut("--wait needs a job id");
+  if (jobIds.some((id) => !id || path.basename(id) !== id || id === "." || id === "..")) return errorOut("--wait needs valid job ids");
+  if (!Number.isFinite(timeoutSeconds) || timeoutSeconds < 0) return errorOut("--timeout must be a non-negative number of seconds");
+  for (const jobId of jobIds) {
+    if (!fs.existsSync(path.join(jobsRootDir(), jobId)) && !fs.existsSync(path.join(agentStateRoot(), "leases", `${jobId}.json`))) {
+      return errorOut(`unknown job id: ${jobId}`);
+    }
   }
   const deadline = Date.now() + timeoutSeconds * 1000;
-  for (;;) {
-    const status = readJsonSafe(path.join(jobDir, "status.json")) ?? {};
-    const meta = readJsonSafe(path.join(jobDir, "metadata.json")) ?? {};
-    if (status.state === "finished" || meta.outcome) {
-      const issues = Array.isArray(meta.issues) ? meta.issues : Array.isArray(status.issues) ? status.issues : [];
-      const result = {
-        jobId,
-        outcome: meta.outcome ?? status.outcome ?? null,
-        coordinatorStatus: meta.coordinatorStatus ?? status.coordinatorStatus ?? null,
-        branch: meta.branch ?? status.branch ?? null,
-        // A job that made no commit has commit: { created: false, sha: null }; only a sha is a commit.
-        commit: commitSha(meta.commit) ?? commitSha(status.commit),
-        issues,
-      };
-      if (json) out(result);
-      else {
-        const firstIssue = issues[0];
-        const issueText = firstIssue == null ? null : typeof firstIssue === "string" ? firstIssue : firstIssue.message ?? JSON.stringify(firstIssue);
-        console.log([result.jobId, result.outcome ?? "unknown", result.coordinatorStatus ?? "unknown",
-          result.branch ? `branch=${result.branch}` : null, result.commit ? `commit=${result.commit}` : null,
-          issueText ? `issue=${issueText}` : null].filter(Boolean).join(" "));
+  const results = await Promise.all(jobIds.map(async (jobId) => {
+    const jobDir = path.join(jobsRootDir(), jobId);
+    for (;;) {
+      const status = readJsonSafe(path.join(jobDir, "status.json")) ?? {};
+      const meta = readJsonSafe(path.join(jobDir, "metadata.json")) ?? {};
+      if (status.state === "finished" || meta.outcome) {
+        const issues = Array.isArray(meta.issues) ? meta.issues : Array.isArray(status.issues) ? status.issues : [];
+        const result = {
+          jobId,
+          outcome: meta.outcome ?? status.outcome ?? null,
+          coordinatorStatus: meta.coordinatorStatus ?? status.coordinatorStatus ?? null,
+          branch: meta.branch ?? status.branch ?? null,
+          commit: commitSha(meta.commit) ?? commitSha(status.commit),
+          issues,
+        };
+        if (json) out(result);
+        else {
+          const firstIssue = issues[0];
+          const issueText = firstIssue == null ? null : typeof firstIssue === "string" ? firstIssue : firstIssue.message ?? JSON.stringify(firstIssue);
+          console.log([result.jobId, result.outcome ?? "unknown", result.coordinatorStatus ?? "unknown",
+            result.branch ? `branch=${result.branch}` : null, result.commit ? `commit=${result.commit}` : null,
+            issueText ? `issue=${issueText}` : null].filter(Boolean).join(" "));
+        }
+        return result.coordinatorStatus === "complete" ? 0 : 1;
       }
-      process.exitCode = result.coordinatorStatus === "complete" ? 0 : 1;
-      return;
-    }
-    if (Date.now() >= deadline) {
-      if (json) out({ error: `timed out waiting for job ${jobId}` });
-      else console.error(`nomarmy jobs: timed out waiting for job ${jobId}`);
-      process.exitCode = 2;
-      return;
+      if (Date.now() >= deadline) {
+        errorOut(`timed out waiting for job ${jobId}`);
+        return 2;
+      }
+      await new Promise((resolve) => setTimeout(resolve, Math.min(2000, Math.max(1, deadline - Date.now()))));
     }
-    await new Promise((resolve) => setTimeout(resolve, Math.min(2000, Math.max(1, deadline - Date.now()))));
-  }
+  }));
+  process.exitCode = Math.max(...results);
 }
 
 /**
@@ -3019,7 +3150,23 @@ async function cmdDoctor() {
   }
   // Import lazily to avoid circular dependencies
   const { runDoctor } = await import("../lib/doctor.mjs");
-  await runDoctor({ json, exit: true, env: installEnv() });
+  const vendors = configuredSubscriptionVendors(loadAgentsOrExit().agents);
+  let checks;
+  if (flag("fix")) {
+    const repaired = await repairOpenclaw({
+      command: openclawCmd(), vendors, yes: flag("yes"), isTTY: Boolean(input.isTTY),
+      print: json ? console.error : console.log,
+      ask: async (prompt) => {
+        const rl = createInterface({ input, output: json ? process.stderr : output });
+        try { return await rl.question(prompt); } finally { rl.close(); }
+      },
+    });
+    checks = repaired.checks;
+    if (!repaired.ok && !checks.some((check) => !check.ok)) checks.push({ id: "openclaw-repair", ok: false, message: "OpenClaw repair was declined or failed.", fix: "nomarmy doctor --fix --yes" });
+  } else {
+    checks = verifyOpenclaw({ command: openclawCmd(), vendors });
+  }
+  await runDoctor({ json, exit: true, env: installEnv(), additionalChecks: checks });
 }
 commands.doctor = cmdDoctor;
 if (windowsFrontEnd() && windowsPlan(argv) === "FORWARD") {

package/install.sh

@@ -101,27 +101,13 @@ fi
 # on a fresh macOS install nothing has initialized that VM yet at this point.
 if nomarmy_is_cloud; then need aws || { echo 'ERROR: the AWS CLI is required for cloud profiles.'; exit 1; }; fi
 "$ROOT/scripts/install-llama-cpp.sh" "$NOMARMY_PROFILE"
-# A pinned npm release, which npm checks against the registry's integrity
-# hash, rather than piping a remote installer script into bash.
-OPENCLAW_VERSION="${NOMARMY_OPENCLAW_VERSION:-2026.9.6}"
-if ! command -v openclaw >/dev/null 2>&1; then
-  if ! node -e 'const [a, b] = process.versions.node.split(".").map(Number); process.exit((a === 24 && b >= 16) || (a === 26 && b >= 1) || a > 26 ? 0 : 1)'; then
-    echo "ERROR: OpenClaw $OPENCLAW_VERSION needs Node 24.16+ or 26.1+; this is Node $(node -v)."
-    echo '       Upgrade Node and re-run this installer, or install OpenClaw yourself first:'
-    echo '         https://openclaw.ai (then re-run this installer)'
-    exit 1
-  fi
-  echo "==> Installing OpenClaw $OPENCLAW_VERSION from npm"
-  if [[ -w "$(npm prefix -g)" ]]; then
-    npm install -g "openclaw@$OPENCLAW_VERSION" --no-audit --no-fund
-  else
-    # No writable global prefix: install for this user, as OpenClaw's own installer does.
-    npm install -g --prefix "$HOME/.npm-global" "openclaw@$OPENCLAW_VERSION" --no-audit --no-fund
-    # nomArmy finds it there on its own (lib/openclaw-path.mjs); your shell won't until PATH has it.
-    echo "NOTE: OpenClaw is in ~/.npm-global/bin. nomArmy finds it there; to run openclaw yourself, add it to PATH:"
-    echo '      echo '"'"'export PATH="$HOME/.npm-global/bin:$PATH"'"'"' >> ~/.profile'
-  fi
-  export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
+# One shared installation policy; no dist-tag or environment override.
+# Only this process's PATH is changed, never a shell rc file.
+export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
+if [[ -w "$(npm prefix -g)" ]]; then
+  node "$ROOT/scripts/install-openclaw.mjs"
+else
+  node "$ROOT/scripts/install-openclaw.mjs" --prefix "$HOME/.npm-global"
 fi
 need openclaw
 if nomarmy_has_local_model; then openclaw plugins install @openclaw/llama-cpp-provider || true; fi

package/lib/admission.mjs

@@ -13,7 +13,7 @@ import { readClaudeSessionTranscript } from "./claude-transcript.mjs";
 import { notify } from "./notify.mjs";
 import { readCodexRateLimits, recordUsageSnapshot, readUsageSnapshots, usageStatus } from "./usage-limits.mjs";
 import { projectDirProblem } from "./server-context.mjs";
-import { recentModelRefusal, refusedModelIn, recordModelRefusal, recordProbeSuccess, modelProven, modelRefusals } from "./health.mjs";
+import { recentModelRefusal, refusedModelIn, recordModelRefusal, recordProbeSuccess, modelProven, modelRefusals, claimModelRefusalRetry } from "./health.mjs";
 import { writeLease, removeLease, liveLeases, liveSlots, acquireSlot } from "./slots.mjs";
 import { loadRun, runTotals, runAdmissionProblems, recordRunJob, detectUsageLimit } from "./runs.mjs";
 import { agentProviderId, hostToolsImplementProblem } from "./agents.mjs";
@@ -287,16 +287,30 @@ export function createJobRuntime(deps) {
       try { problem = hostToolsImplementProblem(j.agentName, agentsConfig().agents[j.agentName]); } catch { return; }
       if (problem) problems.push(`${jobs.length > 1 ? `job ${i + 1}: ` : ""}${problem}`);
     });
-    // A model its vendor refused on a job today, with nothing working on it
-    // since, isn't sent another job (lib/health.mjs recentModelRefusal).
+    // Re-test stale refusals once per day before making an admission decision.
+    const now = deps.now?.() ?? Date.now();
+    const refusedJobs = new Map();
     jobs.forEach((j, i) => {
       if (j.mode === "verify" || !j.agentName || !j.model) return;
       let provider = null;
       try { provider = agentProviderId(agentsConfig().agents[j.agentName]); } catch { return; }
       if (!provider) return;
-      const refusal = recentModelRefusal(stateRoot, `${provider}/${j.model}`);
-      if (refusal) problems.push(`${jobs.length > 1 ? `job ${i + 1}: ` : ""}model_not_found: ${provider}/${j.model} was refused on an earlier job today and hasn't worked since, so this job wasn't sent. Use another model (the job's \`model\`, or \`nomarmy army assign\`); \`nomarmy army assign <role> ${j.agentName} ${j.model}\` re-tests it, and a passing test clears this.`);
+      const key = `${provider}/${j.model}`;
+      if (!recentModelRefusal(stateRoot, key, { now })) return;
+      if (!refusedJobs.has(key)) refusedJobs.set(key, { provider, model: j.model, jobs: [] });
+      refusedJobs.get(key).jobs.push(i);
     });
+    await Promise.all([...refusedJobs.entries()].map(async ([key, entry]) => {
+      const hadRefusal = Boolean(modelRefusals(stateRoot)[key]);
+      if (hadRefusal && deps.probeModel && claimModelRefusalRetry(stateRoot, key, { now })) {
+        try {
+          const result = await deps.probeModel({ provider: entry.provider, model: entry.model, stateRoot });
+          if (result.ok) { recordProbeSuccess(stateRoot, key, { now }); return; }
+          if (result.refused) recordModelRefusal(stateRoot, key, result.reason, { now });
+        } catch { /* A failed probe is inconclusive; keep the original refusal. */ }
+      }
+      for (const i of entry.jobs) problems.push(`${jobs.length > 1 ? `job ${i + 1}: ` : ""}model_not_found: ${key} was refused on an earlier job and hasn't worked since, so this job wasn't sent. Use another model or re-test with nomarmy army assign.`);
+    }));
     // A model that has never worked for its agent gets one test call first
     // (lib/model-probe.mjs): a refusal then costs seconds, not a whole job.
     // The server wires the probe; without one (tests), nothing is probed.

package/lib/connect.mjs

@@ -24,6 +24,7 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { mcpBridgeLaunch } from "./wsl.mjs";
 import { toPosix } from "./path-utils.mjs";
 import { execFileSync } from "node:child_process";
@@ -432,6 +433,48 @@ export function portableServerLaunch({ nomarmyRoot, installDir = defaultInstallD
   return { serverPath, env: { ...derivePoolAuthEnvPlaceholders(configDir), ...deriveWorkerModelEnv(nomarmyRoot), ...env } };
 }
 
+/** The on-disk server scripts registered by connect for this repository. */
+export async function registeredMcpCopies({ projectDir = null, installDir = defaultInstallDir(), nomarmyRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."), run }) {
+  const copies = [];
+  const add = (target, scope, command, args = []) => {
+    let serverPath = null;
+    if (command === "node" && typeof args[0] === "string") serverPath = path.resolve(args[0]);
+    else if (command === PORTABLE_SERVER.command && args[0] === PORTABLE_SERVER.args[0]) {
+      serverPath = portableServerLaunch({ nomarmyRoot, installDir }).serverPath;
+    }
+    if (serverPath && path.basename(serverPath) === "server.mjs" && path.basename(path.dirname(serverPath)) === "mcp") copies.push({ target, scope, serverPath });
+  };
+  const output = async (cmd, args, cwd) => {
+    try {
+      const result = await run(cmd, args, { cwd, timeoutMs: 5000 });
+      return result?.ok ? result.stdout : null;
+    } catch { return null; }
+  };
+  const claude = (value) => {
+    if (!value || !value.includes(`${SERVER_NAME}:`)) return;
+    const scope = /^\s*Scope:\s*(User|Local|Project)\b/im.exec(value)?.[1]?.toLowerCase();
+    const command = /^\s*Command:\s*(\S+)\s*$/im.exec(value)?.[1];
+    const args = /^\s*Args:\s*(.*?)\s*$/im.exec(value)?.[1];
+    if (scope && command) add("claude", scope, command, args ? [args] : []);
+  };
+  claude(await output("claude", ["mcp", "get", SERVER_NAME], projectDir || undefined));
+  if (projectDir) claude(await output("claude", ["mcp", "get", SERVER_NAME], os.homedir()));
+  const codex = await output("codex", ["mcp", "get", SERVER_NAME, "--json"]);
+  if (codex) {
+    try {
+      const transport = JSON.parse(codex).transport;
+      if (transport) add("codex", "user", transport.command, transport.args);
+    } catch { /* no registration */ }
+  }
+  for (const [scope, configPath] of [["user", defaultCursorConfigPath()], ...(projectDir ? [["local", path.join(projectDir, ".cursor", "mcp.json")]] : [])]) {
+    try {
+      const entry = readCursorConfig(configPath).mcpServers?.[SERVER_NAME];
+      if (entry) add("cursor", scope === "local" && entry.command === PORTABLE_SERVER.command ? "project" : scope, entry.command, entry.args);
+    } catch { /* unreadable registration */ }
+  }
+  return [...new Map(copies.map((copy) => [`${copy.target}:${copy.scope}:${copy.serverPath}`, copy])).values()];
+}
+
 /** Whether Claude Code also has nomArmy registered for every project. */
 export function claudeUserScoped(run = defaultRun) {
   try {

package/lib/coordinator-instructions.mjs

@@ -16,7 +16,7 @@ Before dispatching:
 - To run tests without changing anything, use mode: verify; it costs no model usage.
 - Mark an implement job stakes: high when a mistake would be costly (security, access control, personal or tenant data, data loss, money, irreversible changes), however small it is. It then needs a verification profile, keeps the revert check, and needs an independent review before you accept it: a scout on another vendor with reviews: <job id>.
 - Brief outcomes, not edits: a task, explicit acceptance criteria, and the tests that prove it. Put facts you've already resolved in evidence.
-- Prefer local_worker_start for anything longer than a few minutes. Right after, if you can run a background command, run \`nomarmy jobs --wait <job_id>\` in the background so you're told the moment it finishes and can tell the operator (for several jobs, \`nomarmy jobs --events --until-done\`, which exits when they've all finished); otherwise poll local_worker_status with wait_seconds. To read a finished job, use local_worker_status with report: true (the report, a scout's cited findings, the outcome, issues and commit); full: true is the whole record and rarely needed. Review scouts (reviews set, or a review-phase role) default to 20 minutes, other jobs to 10; pass timeout_seconds for more. Never run the plain \`nomarmy jobs --events\` stream as a background command: it only reports when it exits, so you'd never hear; it's for a monitor that reads each line. For a whole feature, use /feature (run_start keeps a run's jobs, spend and hours bounded).
+- Prefer local_worker_start for anything longer than a few minutes. Right after, if you can run a background command, run \`nomarmy jobs --wait <job_id>\` in the background so you're told the moment it finishes and can tell the operator (for several jobs, \`nomarmy jobs --wait <id> <id> ...\`; for a whole run, \`nomarmy jobs --events --until-done --run <run-id>\`); otherwise poll local_worker_status with wait_seconds. To read a finished job, use local_worker_status with report: true (the report, a scout's cited findings, the outcome, issues and commit); full: true is the whole record and rarely needed. Review scouts (reviews set, or a review-phase role) default to 20 minutes, other jobs to 10; pass timeout_seconds for more. Never use unscoped \`--until-done\` when other sessions may have jobs. Never run the plain \`nomarmy jobs --events\` stream as a background command: it only reports when it exits, so you'd never hear; it's for a monitor that reads each line. For a whole feature, use /feature (run_start keeps a run's jobs, spend and hours bounded).
 
 Trust boundary:
 - A worker's four-line report is a claim; nomArmy's verified git record and independent verification are the evidence. A job isn't complete if its report is missing or malformed, its STATUS is partial or blocked, STATUS done lacks VERIFICATION pass, or its changes aren't committed by nomArmy.

package/lib/doctor.mjs

@@ -553,7 +553,7 @@ export function evaluateChecks(facts) {
 export async function runDoctor(opts = {}) {
   const { json = false, exit = false, env = process.env } = opts;
   const facts = opts.facts ?? await collectFacts(env);
-  const checks = evaluateChecks(facts);
+  const checks = [...evaluateChecks(facts), ...(opts.additionalChecks ?? [])];
   const allOk = checks.every((c) => c.ok);
   const result = { ok: allOk, checks };
 

package/lib/health.mjs

@@ -27,18 +27,28 @@ import { providerConfigured, readOpenclawConfig } from "./openclaw-config.mjs";
 import { readUsageSnapshots, usageStatus } from "./usage-limits.mjs";
 import { freshnessIssues, readInstallVersions } from "./install-freshness.mjs";
 
+import { PINNED_OPENCLAW_VERSION } from "./openclaw-install.mjs";
+
 const DAY = 86400000;
 
 /** Run a command asynchronously, bounded; resolves { ok, stdout }. Never rejects. */
-export function runBounded(cmd, args, { timeoutMs = 20000 } = {}) {
+export function runBounded(cmd, args, { timeoutMs = 20000, cwd } = {}) {
   return new Promise((resolve) => {
-    execFile(cmd, args, { encoding: "utf8", timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024 }, (error, stdout) => resolve({ ok: !error, stdout: stdout ?? "" }));
+    execFile(cmd, args, { encoding: "utf8", timeout: timeoutMs, cwd, maxBuffer: 16 * 1024 * 1024 }, (error, stdout) => resolve({ ok: !error, stdout: stdout ?? "" }));
   });
 }
 
 const versionOf = (text) => /(\d+)\.(\d+)\.(\d+)/.exec(String(text ?? ""))?.slice(1, 4).map(Number) ?? null;
 const older = (a, b) => { for (let i = 0; i < 3; i++) { if (a[i] !== b[i]) return a[i] < b[i]; } return false; };
 
+/** Read OpenClaw's auth-list JSON, tolerating text before the JSON envelope. */
+export function parseOpenclawAuthProfiles(stdout) {
+  try {
+    const profiles = JSON.parse(stdout.slice(stdout.indexOf("{"))).profiles;
+    return Array.isArray(profiles) ? profiles : null;
+  } catch { return null; }
+}
+
 /** OAuth profiles near or past expiry, from `openclaw models auth list --json`. */
 export function loginExpiryIssues(authJson, { now = Date.now(), warnDays = 7 } = {}) {
   const issues = [];
@@ -61,7 +71,7 @@ export function versionIssues({ installed, latest, plugins = [] }) {
   if (have && want && older(have, want)) {
     issues.push({ id: `openclaw-update:${want.join(".")}`, severity: "info", title: `OpenClaw ${want.join(".")} is out (you have ${have.join(".")})`,
       detail: "Its bundled model catalog lags new models; an old one made a working model look unavailable and budgeted new ones at the 32k fallback.",
-      fix: "npm update -g openclaw && openclaw doctor --fix  (when no nomArmy jobs are running)", short: "openclaw update" });
+      fix: older(have, versionOf(PINNED_OPENCLAW_VERSION)) ? "nomarmy doctor --fix  (installs the tested OpenClaw release, when no nomArmy jobs are running)" : "No automatic upgrade: nomArmy keeps the tested release or a newer installed version", short: "openclaw update" });
   }
   for (const p of plugins) {
     const pv = versionOf(p.version);
@@ -162,7 +172,8 @@ export function recordProbeSuccess(stateRoot, model, { now = Date.now() } = {})
 // Models a vendor refused on a job, kept until a job or test call on them
 // works. A plan's model limit doesn't expire overnight (gpt-6-luna was
 // refused again days after the first time), so this isn't a 24-hour memory.
-// <stateRoot>/model-refusals.json: { "<provider>/<model>": { at, reason } }.
+// <stateRoot>/model-refusals.json: { "<provider>/<model>": { at, reason, retriedAt? } }.
+export const REFUSAL_RETRY_MS = 24 * 60 * 60 * 1000;
 const REFUSALS_FILE = "model-refusals.json";
 export function modelRefusals(stateRoot) {
   try { const data = JSON.parse(fs.readFileSync(path.join(stateRoot, REFUSALS_FILE), "utf8")); return data && typeof data === "object" && !Array.isArray(data) ? data : {}; } catch { return {}; }
@@ -173,6 +184,16 @@ function writeRefusals(stateRoot, data) {
 export function recordModelRefusal(stateRoot, model, reason = null, { now = Date.now() } = {}) {
   writeRefusals(stateRoot, { ...modelRefusals(stateRoot), [model]: { at: new Date(now).toISOString(), reason } });
 }
+/** Claim a stale refusal before a retry so overlapping calls do not re-test it. */
+export function claimModelRefusalRetry(stateRoot, model, { now = Date.now() } = {}) {
+  const data = modelRefusals(stateRoot);
+  const entry = data[model];
+  if (!entry || now - Date.parse(entry.at) < REFUSAL_RETRY_MS ||
+      (entry.retriedAt && now - Date.parse(entry.retriedAt) < REFUSAL_RETRY_MS)) return false;
+  data[model] = { ...entry, retriedAt: new Date(now).toISOString() };
+  writeRefusals(stateRoot, data);
+  return true;
+}
 export function clearModelRefusal(stateRoot, model) {
   const data = modelRefusals(stateRoot);
   if (!(model in data)) return;
@@ -245,7 +266,8 @@ export async function runHealthChecks({ now = Date.now(), mode = "local", opencl
     install ? run("npm", ["view", "nomarmy", "dist-tags.alpha"], { timeoutMs: 15000 }) : null,
   ]);
   if (install) issues.push(...freshnessIssues({ ...install, latestVersion: nomarmyLatest?.ok ? nomarmyLatest.stdout : null }));
-  if (auth.ok) { try { issues.push(...loginExpiryIssues(JSON.parse(auth.stdout.slice(auth.stdout.indexOf("{"))), { now })); } catch { /* unparseable: skip */ } }
+  const authProfiles = auth.ok ? parseOpenclawAuthProfiles(auth.stdout) : null;
+  if (authProfiles) issues.push(...loginExpiryIssues({ profiles: authProfiles }, { now }));
   const pluginVersion = /Version:\s*(\S+)/.exec(plugins.stdout ?? "")?.[1];
   if (version.ok) issues.push(...versionIssues({ installed: version.stdout, latest: latest.ok ? latest.stdout : null, plugins: pluginVersion ? [{ id: "codex", version: pluginVersion }] : [] }));
   if (agentsError) issues.push({ id: `config:agents:${agentsError}`, severity: "error", title: "agents.yml can't be loaded", detail: agentsError, fix: "nomarmy agents list (shows the problem)", short: "agents.yml broken" });
@@ -295,6 +317,18 @@ export function recordHealth(file, result, { now = Date.now() } = {}) {
   return toNotify;
 }
 
+/** Read versions and harnesses only from MCP registrations that launch nomArmy. */
+export async function readRegisteredInstall({ projectDir, run = runBounded, installDir } = {}) {
+  const { registeredMcpCopies } = await import("./connect.mjs");
+  const { loadHarnesses } = await import("./harnesses.mjs");
+  const registered = await registeredMcpCopies({ projectDir, run, installDir });
+  if (!registered.length) return null;
+  return { registrations: registered.map(({ target, scope, serverPath }) => {
+    const copyDir = path.dirname(path.dirname(serverPath));
+    return { target, scope, ...readInstallVersions(copyDir), copyHarnesses: Object.keys(loadHarnesses(path.join(copyDir, "harnesses")).harnesses).length };
+  }) };
+}
+
 /**
  * Everything a check run needs, gathered the same way for the server's
  * periodic run and `nomarmy health`, then run and recorded to the shared
@@ -327,10 +361,7 @@ export async function checkAndRecordHealth({ projectDir, stateRoot, configDir, n
   let autoPruned = null;
   if (ageMs !== null) { try { autoPruned = { ...pruneJobRuntime({ stateRoot, olderThanMs: ageMs, now }), olderThanHours: ageMs / 3600000 }; } catch { /* best-effort */ } }
   const mode = executionMode(env).mode;
-  const { defaultInstallDir } = await import("./connect.mjs");
-  const installDir = defaultInstallDir();
-  const { loadHarnesses } = await import("./harnesses.mjs");
-  const install = { ...readInstallVersions(installDir), copyHarnesses: Object.keys(loadHarnesses(path.join(installDir, "harnesses")).harnesses).length };
+  const install = await readRegisteredInstall({ projectDir });
   const result = await runHealthChecks({ now, mode, armySummary, agentsError, jobsRoot: path.join(stateRoot, "jobs"), pidAlive,
     agents, openclawConfig: readOpenclawConfig(), vendors: SUBSCRIPTION_VENDORS, modelsInUse, autoPruned, usageSnapshots: readUsageSnapshots(stateRoot), install });
   try {

package/lib/install-freshness.mjs

@@ -76,12 +76,15 @@ export function compareVersions(a, b) {
 const valid = (v) => typeof v === "string" && /^v?\d+\.\d+\.\d+/.test(v.trim());
 
 /** Health issues for a stale CLI, a stale installed copy, or a copy missing its harnesses. */
-export function freshnessIssues({ copyVersion = null, sourceVersion = null, latestVersion = null, copyHarnesses = null }) {
+export function freshnessIssues({ copyVersion = null, sourceVersion = null, latestVersion = null, copyHarnesses = null, registrations = null, target = "claude", scope = "user" }) {
+  if (registrations) return registrations.flatMap((copy, index) => freshnessIssues({ ...copy, latestVersion: index === 0 ? latestVersion : null }));
+  const reconnect = `nomarmy connect ${target}${scope === "user" ? "" : ` --scope ${scope}`}`;
+  const fix = registrations === null && target === "claude" && scope === "user" ? "nomarmy connect claude (and codex, cursor), then restart those sessions" : `${reconnect}, then restart that session`;
   const issues = [];
   if (valid(copyVersion) && copyHarnesses === 0) {
     issues.push({ id: `nomarmy-harnesses:${copyVersion}`, severity: "error", title: "The nomArmy your coordinators run has no harnesses",
       detail: "Jobs match no harness, so they run in the plain base image: no dependencies, fake services, browser tests or artifacts.",
-      fix: "nomarmy connect claude (and codex, cursor), then restart those sessions", short: "no harnesses" });
+      fix, short: "no harnesses" });
   }
   if (valid(latestVersion) && valid(sourceVersion) && compareVersions(sourceVersion, latestVersion) < 0) {
     const latest = latestVersion.trim();
@@ -92,7 +95,7 @@ export function freshnessIssues({ copyVersion = null, sourceVersion = null, late
   if (valid(sourceVersion) && valid(copyVersion) && compareVersions(copyVersion, sourceVersion) < 0) {
     issues.push({ id: `nomarmy-copy:${sourceVersion}`, severity: "warn", title: `Your coordinators run nomArmy ${copyVersion}, but ${sourceVersion} is installed`,
       detail: "Claude Code, Codex and Cursor run a copy of nomArmy that only `nomarmy connect` refreshes.",
-      fix: "nomarmy connect claude (and codex, cursor), then restart those sessions", short: "nomarmy reconnect" });
+      fix, short: "nomarmy reconnect" });
   }
   return issues;
 }

package/lib/openclaw-install.mjs

@@ -0,0 +1,122 @@
+// One tested release for every nomArmy-managed OpenClaw installation.
+// Never follow npm's dist-tag or downgrade a newer installation.
+import { spawnSync } from "node:child_process";
+import { SUBSCRIPTION_VENDORS, parseOpenclawVersion, versionAtLeast } from "./subscription-setup.mjs";
+
+export const PINNED_OPENCLAW_VERSION = "2026.9.6";
+export const OPENCLAW_INSTALL_ARGS = Object.freeze(["install", "-g", `openclaw@${PINNED_OPENCLAW_VERSION}`]);
+
+export function runOpenclawCommand(command, args, { timeoutMs = command === "npm" ? 600000 : 60000 } = {}) {
+  const r = spawnSync(command, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: timeoutMs });
+  const timedOut = r.error?.code === "ETIMEDOUT";
+  return { ok: !timedOut && r.status === 0, stdout: r.stdout ?? "",
+    stderr: timedOut ? `Command timed out after ${timeoutMs} ms.` : r.stderr ?? "", timedOut };
+}
+
+export function openclawInstallPlan(installed, { prefix = null } = {}) {
+  const have = parseOpenclawVersion(installed);
+  if (versionAtLeast(have, PINNED_OPENCLAW_VERSION)) return [];
+  return [{
+    description: `${have ? "Upgrade" : "Install"} OpenClaw to ${PINNED_OPENCLAW_VERSION}`,
+    command: "npm",
+    args: [...OPENCLAW_INSTALL_ARGS, ...(prefix ? ["--prefix", prefix] : [])],
+  }];
+}
+
+export function configuredSubscriptionVendors(agents = {}, extra = []) {
+  return [...new Set([...extra, ...Object.values(agents)
+    .filter((a) => a?.kind === "subscription")
+    .map((a) => Object.keys(SUBSCRIPTION_VENDORS).find((key) => SUBSCRIPTION_VENDORS[key].provider === a.provider))])].filter(Boolean);
+}
+
+/** Read-only postflight using structured status and plugin compatibility data. */
+function parseCommandJson(stdout) {
+  const start = (stdout ?? "").indexOf("{");
+  if (start < 0) throw new Error("No JSON object in command output");
+  return JSON.parse(stdout.slice(start));
+}
+
+export function verifyOpenclaw({ run = runOpenclawCommand, command = "openclaw", vendors = [] } = {}) {
+  const checks = [];
+  const version = run(command, ["--version"]);
+  const have = version.ok ? parseOpenclawVersion(version.stdout) : null;
+  checks.push({
+    id: "openclaw", ok: versionAtLeast(have, PINNED_OPENCLAW_VERSION),
+    message: have ? `OpenClaw ${have.join(".")}${have.join(".") !== PINNED_OPENCLAW_VERSION && versionAtLeast(have, PINNED_OPENCLAW_VERSION) ? " is newer than the tested release; left unchanged" : ""}.` : version.timedOut ? "OpenClaw version check timed out." : "OpenClaw version could not be verified.",
+    fix: `npm ${OPENCLAW_INSTALL_ARGS.join(" ")}`,
+  });
+  if (!have) return checks;
+  for (const key of [...new Set(vendors)]) {
+    const vendor = SUBSCRIPTION_VENDORS[key];
+    if (!vendor) throw new Error(`Unknown subscription vendor: ${key}`);
+    if (!vendor.plugin) continue;
+    const { id, spec } = vendor.plugin;
+    const inspected = run(command, ["plugins", "inspect", id, "--json"]);
+    let plugin;
+    try { plugin = parseCommandJson(inspected.stdout).plugin; } catch { /* Unverified output fails below. */ }
+    const pluginVersion = plugin?.builtWithOpenClawVersion === undefined ? plugin?.version : plugin.builtWithOpenClawVersion;
+    const installedVersion = have.join(".");
+    const ok = inspected.ok && plugin?.enabled === true && pluginVersion !== undefined && versionAtLeast(have, pluginVersion);
+    checks.push({
+      id: `openclaw-plugin:${id}`, ok,
+      message: ok ? `OpenClaw plugin ${id} ${pluginVersion} is ready (built for ${pluginVersion}; OpenClaw is ${installedVersion}).` : `OpenClaw plugin ${id} ${inspected.timedOut ? "check timed out." : plugin?.enabled === true && pluginVersion === undefined ? "version could not be verified." : `is missing, disabled, unreadable, or built for a newer OpenClaw than ${installedVersion}.`}`,
+      fix: `openclaw plugins install ${spec}`,
+    });
+  }
+  const status = run(command, ["update", "status", "--json"]);
+  let warnings;
+  try {
+    if (!status.ok) throw new Error("Status command failed");
+    const data = parseCommandJson(status.stdout);
+    warnings = data.migrationWarnings === undefined ? [] : data.migrationWarnings;
+    if (!Array.isArray(warnings) || warnings.some((warning) => typeof warning !== "string")) throw new Error("Invalid migration warnings");
+  } catch {
+    checks.push({ id: "openclaw-migrations", ok: false, message: status.timedOut ? "OpenClaw migration check timed out." : "OpenClaw migrations could not be verified. Run openclaw update status --json by hand.", fix: "openclaw update status --json" });
+    return checks;
+  }
+  checks.push({
+    id: "openclaw-migrations", ok: warnings.length === 0,
+    message: warnings.length ? warnings.join("\n") : "No pending OpenClaw migrations.",
+    fix: "openclaw update repair",
+  });
+  return checks;
+}
+
+/** Print the complete mutation plan before a single default-no consent gate. */
+export async function repairOpenclaw({
+  run = runOpenclawCommand, command = "openclaw", vendors = [], prefix = null,
+  yes = false, isTTY = false, ask = async () => "", print = console.log,
+} = {}) {
+  const version = run(command, ["--version"]);
+  const actions = openclawInstallPlan(version.ok ? version.stdout : null, { prefix });
+  print("Planned changes:");
+  for (const action of actions) print(`  ${action.description}: ${action.command} ${action.args.join(" ")}`);
+  if (!actions.length) print("  None. The installed OpenClaw is not older than the tested release.");
+  print("Postflight checks (read-only):");
+  print(`  ${command} --version`);
+  for (const key of [...new Set(vendors)]) {
+    const vendor = SUBSCRIPTION_VENDORS[key];
+    if (!vendor) throw new Error(`Unknown subscription vendor: ${key}`);
+    if (vendor.plugin) print(`  ${command} plugins inspect ${vendor.plugin.id} --json`);
+  }
+  print(`  ${command} update status --json`);
+  print("  Migration repairs are not run automatically. If needed, run openclaw update repair --yes separately.");
+  const changed = [];
+  if (actions.length && !yes && (!isTTY || !/^(y|yes)$/i.test((await ask("Apply these changes? [y/N] ")).trim()))) {
+    print(isTTY ? "No changes made." : "No changes made. Non-interactive repair requires --yes.");
+    return { ok: false, actions, changed, checks: [] };
+  }
+  for (const action of actions) {
+    const result = run(action.command, action.args);
+    if (!result.ok) {
+      print(`Failed: ${action.description}. Fix: ${action.command} ${action.args.join(" ")}`);
+      print(`Completed changes: ${changed.length ? changed.join("; ") : "none"}. The failed install may have partially modified OpenClaw.`);
+      return { ok: false, actions, changed, checks: [] };
+    }
+    changed.push(action.description);
+  }
+  print(`Changed: ${changed.length ? changed.join("; ") : "nothing"}.`);
+  const checks = verifyOpenclaw({ run, command, vendors });
+  for (const check of checks) print(`${check.ok ? "OK" : "FAIL"}: ${check.message}${check.ok ? "" : ` Fix: ${check.fix}`}`);
+  return { ok: checks.every((check) => check.ok), actions, changed, checks };
+}

package/lib/refusal-retry.mjs

@@ -0,0 +1,16 @@
+import { claimModelRefusalRetry, modelRefusals, recordModelRefusal, recordProbeSuccess } from "./health.mjs";
+
+/** Start eligible one-token probes without waiting for them in the caller. */
+export function retryRefusedModelsInBackground(stateRoot, { probeModel, now = Date.now() } = {}) {
+  if (!probeModel) return;
+  for (const key of Object.keys(modelRefusals(stateRoot))) {
+    if (!claimModelRefusalRetry(stateRoot, key, { now })) continue;
+    const slash = key.indexOf("/");
+    if (slash < 1 || slash === key.length - 1) continue;
+    const provider = key.slice(0, slash), model = key.slice(slash + 1);
+    Promise.resolve().then(() => probeModel({ provider, model, stateRoot })).then((result) => {
+      if (result?.ok) recordProbeSuccess(stateRoot, key, { now });
+      else if (result?.refused) recordModelRefusal(stateRoot, key, result.reason, { now });
+    }).catch(() => { /* An inconclusive probe keeps the refusal and retry timestamp. */ });
+  }
+}

package/mcp/server.mjs

@@ -34,6 +34,7 @@ import { agentDispatchFields, resolveAgentModel, agentProviderId, describeAgent
 import { OUTCOMES, COORDINATOR_STATUS_BY_OUTCOME } from "../lib/outcomes.mjs";
 import { readUsageSnapshots, usageStatus } from "../lib/usage-limits.mjs";
 import { modelRefusals } from "../lib/health.mjs";
+import { retryRefusedModelsInBackground } from "../lib/refusal-retry.mjs";
 import { podmanProblem, podmanVmStartedAt } from "../lib/podman-health.mjs";
 import { restartNotice } from "../lib/install-freshness.mjs";
 import { requestJobStop } from "../lib/openclaw-run.mjs";
@@ -583,6 +584,7 @@ server.tool("army", "Who you, the General, are and who you call for what in this
     const catalog = await modelCatalogReady();
     // A model its vendor refused on a job is listed apart, so a role on
     // "auto" isn't sent to it (the catalog lists what a plan may refuse).
+    retryRefusedModelsInBackground(stateRoot, { probeModel });
     const refusals = modelRefusals(stateRoot);
     summary.agents = Object.fromEntries(Object.entries(agents).map(([name, agent]) => {
       const provider = agentProviderId(agent);

package/package.json

@@ -3,7 +3,7 @@
   "description": "Every byte verified: a harness for AI coding workers whose claims are never trusted. Your coding assistant stays in charge while workers implement and test in sandboxes, and nomArmy checks every change before it is committed.",
   "author": "Rayson Technologies",
   "license": "Apache-2.0",
-  "version": "0.1.0-alpha.19",
+  "version": "0.1.0-alpha.20",
   "private": false,
   "type": "module",
   "engines": {

package/playbooks/feature.md

@@ -25,9 +25,11 @@ When you hit a choice you'd normally ask the operator about, don't stop: pick th
 
 Stop and ask only for something irreversible or outside this repository: merging or pushing, deploying, anything needing cloud or production credentials, deleting data, or changing another repository.
 
+A gate's result is not yours to reinterpret. When a check the plan or the operator set (an exact expected output, a count, a checksum, a contract) doesn't match, that's a failure, even when the difference looks cosmetic: whitespace from BSD versus GNU `wc`, line endings, ordering, a trailing newline. Don't judge it "equivalent" and pass it. Either fix the check so it compares what was meant (normalize both sides, and write that change into the run log as a decision), or send the mismatch back as a failed job. A gate the General can wave through is no gate.
+
 ## Watching jobs
 
-Prefer `local_worker_start`. Right after starting a job, if your coordinator can run a background command, run `nomarmy jobs --wait <job_id>` in the background so you're told the moment it finishes and can tell the operator. Otherwise poll `local_worker_status` with the longest `wait_seconds` it allows. For several jobs at once, `nomarmy jobs --events --until-done` exits when every one has finished. The plain `nomarmy jobs --events` stream never exits on its own while jobs run, so don't run it as a background command (you'd only hear when it exits); use it only with a monitor that wakes on each line. `run_status` lists the run's running jobs as well as finished ones. The operator gets a desktop notification whenever a job finishes and whenever the run crosses a limit, so you don't need to relay each one.
+Prefer `local_worker_start`. Right after starting a job, if your coordinator can run a background command, run `nomarmy jobs --wait <job_id>` in the background so you're told the moment it finishes and can tell the operator. Otherwise poll `local_worker_status` with the longest `wait_seconds` it allows. For several jobs at once, `nomarmy jobs --wait <id> <id> ...` exits when every one has finished. For a whole run, use `nomarmy jobs --events --until-done --run <run-id>`. Never use unscoped `--until-done` when other sessions may have jobs. The plain `nomarmy jobs --events` stream never exits on its own while jobs run, so don't run it as a background command (you'd only hear when it exits); use it only with a monitor that wakes on each line. `run_status` lists the run's running jobs as well as finished ones. The operator gets a desktop notification whenever a job finishes and whenever the run crosses a limit, so you don't need to relay each one.
 
 ## Limits
 

package/scripts/install-openclaw.mjs

@@ -0,0 +1,23 @@
+// install.sh has already installed nomArmy's dependencies. Nothing is ready
+// until the configured vendors and read-only OpenClaw diagnostics pass.
+import { loadAgents } from "../lib/agents.mjs";
+import { globalConfigDir } from "../lib/army.mjs";
+import { ensureOpenClawOnPath } from "../lib/openclaw-path.mjs";
+import { configuredSubscriptionVendors, openclawInstallPlan, repairOpenclaw, runOpenclawCommand, PINNED_OPENCLAW_VERSION } from "../lib/openclaw-install.mjs";
+
+ensureOpenClawOnPath();
+const command = process.env.NOMARMY_OPENCLAW_CMD || "openclaw";
+const version = runOpenclawCommand(command, ["--version"]);
+const [major, minor] = process.versions.node.split(".").map(Number);
+if (openclawInstallPlan(version.ok ? version.stdout : null).length &&
+    !((major === 24 && minor >= 16) || (major === 26 && minor >= 1) || major > 26)) {
+  console.error(`OpenClaw ${PINNED_OPENCLAW_VERSION} needs Node 24.16+ or 26.1+. Upgrade Node first.`);
+  process.exitCode = 1;
+} else {
+  const prefixIndex = process.argv.indexOf("--prefix");
+  const result = await repairOpenclaw({
+    command, yes: true, prefix: prefixIndex < 0 ? null : process.argv[prefixIndex + 1],
+    vendors: configuredSubscriptionVendors(loadAgents(globalConfigDir()).agents),
+  });
+  process.exitCode = result.ok ? 0 : 1;
+}