reis-mobile 0.8.0 → 0.9.0

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "AI agents for mobile engineering",
-    "version": "0.8.0"
+    "version": "0.9.0"
   },
   "plugins": [
     {
       "name": "reis-mobile",
       "source": "./",
       "description": "AI agents, skills and workflows for Flutter, Android, iOS and React Native development.",
-      "version": "0.8.0",
+      "version": "0.9.0",
       "author": {
         "name": "Warleson Reis"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "reis-mobile",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "AI agents, skills and workflows for Flutter, Android, iOS and React Native development. Use /reis-mobile:doctor, /reis-mobile:review and /reis-mobile:test.",
   "author": {
     "name": "Warleson Reis"

package/CHANGELOG.md

@@ -4,6 +4,29 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). The pr
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-10-13
+
+### Added
+
+- `core/providers/`: the multi-provider layer. Six external providers — the `codex` and `gemini` CLIs plus the OpenAI, Gemini, OpenRouter and Ollama HTTP APIs — described as data (endpoint, credential variables, request shape, model catalog), so adding one touches no command. Status, model and allowlist resolution make no network call: a CLI is found by scanning `PATH`, an HTTP provider by its credential variable.
+- `reis-mobile providers [--all] [--json]` lists every provider with the evidence behind its status (`ready`, `local`, `missing`, `disabled`, `blocked`), its endpoint and the resolved model. `reis-mobile providers --models` asks each provider which models it serves, so no model id is ever shipped as a default.
+- `reis-mobile consult [--providers a,b] [--model <id>] [--file <path>] [--timeout <ms>] <question>` asks the selected providers the same question in parallel. The core performs the call, so no API key passes through the conversation; the question is redacted on the way out and every answer on the way in. Each requested provider is reported with its own typed status — `ok`, `unavailable`, `no-model`, `timeout`, `error` — and the exit code is 1 only when nobody answered.
+- `/reis-mobile:consult [options] <question>`, also reachable as `/reis-mobile consult ...`: routes the question through the stack's specialist, requires its own position first, builds a self-contained briefing in `.reis-mobile/consults/`, consults the providers and then reconciles every outside claim against the code as confirmed with `file:line`, unverifiable or wrong.
+- `providers:` in `.reis-mobile/config.yaml`: the allowlist of external providers a repository accepts, committed with the repository. An absent key allows all, an empty list allows none, and a blocked provider says so instead of failing.
+- `providers.<id>.model` and `providers.<id>.enabled` in `~/.config/reis-mobile/config.json`, with precedence `--model`, then the provider's model variable (`OPENAI_MODEL`, `GEMINI_MODEL`, `OPENROUTER_MODEL`, `OLLAMA_MODEL`), then the config file.
+- `reis-mobile doctor` lists the configured providers under Integrations, with a single informational row when none is configured. It still makes no network call.
+
+### Changed
+
+- `/reis-mobile:debate --external` selects providers through the core instead of probing with `command -v`, accepts `--providers a,b`, and no longer needs `Bash(codex:*)` or `Bash(gemini:*)`: every provider call goes through the CLI. Behavior without a ready provider is unchanged — the debate carries on with the agents alone.
+- CLI providers are asked for an opinion, not for work: `codex exec` now runs with `--sandbox read-only` and `gemini` with `--approval-mode plan`, both in a temporary working directory that is removed afterwards. The debate's previous invocation granted write access and the user's repository as a workspace, neither of which a second opinion needs.
+- `/reis-mobile:review` points at `/reis-mobile:consult` when a finding should be cross-checked outside the session, and still never sends project context itself.
+
+### Fixed
+
+- `/reis-mobile:debate --external` could not reach Codex at all on current CLI versions: `codex exec --full-auto` is rejected with `unexpected argument '--full-auto' found`, and the call ran outside a Git repository without `--skip-git-repo-check`. The provider catalog now carries the invocation verified against `codex exec --help`.
+- A failing CLI provider reported its opening banner (`YOLO mode is enabled...`) instead of the cause. The reported line is now the first one that names a failure, falling back to the last line of stderr.
+
 ## [0.8.0] - 2026-09-23
 
 ### Added

package/README.md

@@ -44,21 +44,28 @@ A mobile app is not a generic project. A code review that does not know about `B
 ## What's new
 
 <!-- reis-mobile:latest-release:start -->
-### v0.8.0
+### v0.9.0
 
 #### Added
 
-- `mobile-performance` topic skill: measurement before optimization, budgets for startup, rendering, memory, battery and app size, and regression detection in CI, with a reference per stack (Flutter DevTools and `integration_test` summaries, Android Macrobenchmark, Baseline Profiles and vitals, iOS Instruments, MetricKit and `XCTMetric` baselines, React Native Hermes profiling and list tuning, KMP shared-versus-host isolation) plus a cross-stack guide to background execution and battery.
-- `mobile-offline-sync` topic skill: local store as the source of truth, a durable outbox with client-generated idempotency keys, ordering and operation collapsing, retry with backoff, conflict strategies per entity, reconnection triggers, offline UX and nine failure cases to test, with a reference per stack (drift and workmanager, Room and WorkManager, Core Data/SwiftData and `BGTaskScheduler`, SQLite with NetInfo and OTA-aware drains, SQLDelight and Ktor in `commonMain`).
-- `mobile-observability` topic skill: the signals that explain a production failure, mandatory segmentation by version and cohort, error context and grouping, correlation ids shared with the backend, rate-based alerting per version, sampling and cost, and what must never be collected, with a reference per stack (Flutter's three capture layers and Dart symbol upload, Android vitals and `ApplicationExitInfo`, MetricKit and Organizer, React Native source maps and OTA update ids, KMP `Telemetry` boundary and Kotlin/Native crash hooks).
-- `offline` and `observability` intents in the router. `offline` goes to the stack's architect and falls back to `mobile-staff-engineer`; `observability` goes to `mobile-release-engineer`.
-- `mobile-security/references/auth.md`: OAuth 2.0 and OIDC for native apps following RFC 8252 — authorization code with PKCE (`S256`), no client secret, system browser instead of a WebView, redirect URI choices, token rotation with reuse detection, and biometrics gating a key rather than a boolean.
-- `mobile-release/references/billing.md`: in-app purchase and subscription lifecycle — server-side entitlement, store server notifications, the states between active and expired, acknowledgement deadlines and automatic refunds, restore and account mapping, and the per-stack client libraries.
-- `mobile-accessibility/references/localization.md`: strings, CLDR plurals, locale-aware formatting, right-to-left layout and icon mirroring, translation growth, per-app language settings and pseudolocalization.
+- `core/providers/`: the multi-provider layer. Six external providers — the `codex` and `gemini` CLIs plus the OpenAI, Gemini, OpenRouter and Ollama HTTP APIs — described as data (endpoint, credential variables, request shape, model catalog), so adding one touches no command. Status, model and allowlist resolution make no network call: a CLI is found by scanning `PATH`, an HTTP provider by its credential variable.
+- `reis-mobile providers [--all] [--json]` lists every provider with the evidence behind its status (`ready`, `local`, `missing`, `disabled`, `blocked`), its endpoint and the resolved model. `reis-mobile providers --models` asks each provider which models it serves, so no model id is ever shipped as a default.
+- `reis-mobile consult [--providers a,b] [--model <id>] [--file <path>] [--timeout <ms>] <question>` asks the selected providers the same question in parallel. The core performs the call, so no API key passes through the conversation; the question is redacted on the way out and every answer on the way in. Each requested provider is reported with its own typed status — `ok`, `unavailable`, `no-model`, `timeout`, `error` — and the exit code is 1 only when nobody answered.
+- `/reis-mobile:consult [options] <question>`, also reachable as `/reis-mobile consult ...`: routes the question through the stack's specialist, requires its own position first, builds a self-contained briefing in `.reis-mobile/consults/`, consults the providers and then reconciles every outside claim against the code as confirmed with `file:line`, unverifiable or wrong.
+- `providers:` in `.reis-mobile/config.yaml`: the allowlist of external providers a repository accepts, committed with the repository. An absent key allows all, an empty list allows none, and a blocked provider says so instead of failing.
+- `providers.<id>.model` and `providers.<id>.enabled` in `~/.config/reis-mobile/config.json`, with precedence `--model`, then the provider's model variable (`OPENAI_MODEL`, `GEMINI_MODEL`, `OPENROUTER_MODEL`, `OLLAMA_MODEL`), then the config file.
+- `reis-mobile doctor` lists the configured providers under Integrations, with a single informational row when none is configured. It still makes no network call.
 
 #### Changed
 
-- The five `*-architect` agents also serve the `offline` intent, and `mobile-release-engineer` also serves `observability`; `mobile-staff-engineer` covers both when no stack is detected.
+- `/reis-mobile:debate --external` selects providers through the core instead of probing with `command -v`, accepts `--providers a,b`, and no longer needs `Bash(codex:*)` or `Bash(gemini:*)`: every provider call goes through the CLI. Behavior without a ready provider is unchanged — the debate carries on with the agents alone.
+- CLI providers are asked for an opinion, not for work: `codex exec` now runs with `--sandbox read-only` and `gemini` with `--approval-mode plan`, both in a temporary working directory that is removed afterwards. The debate's previous invocation granted write access and the user's repository as a workspace, neither of which a second opinion needs.
+- `/reis-mobile:review` points at `/reis-mobile:consult` when a finding should be cross-checked outside the session, and still never sends project context itself.
+
+#### Fixed
+
+- `/reis-mobile:debate --external` could not reach Codex at all on current CLI versions: `codex exec --full-auto` is rejected with `unexpected argument '--full-auto' found`, and the call ran outside a Git repository without `--skip-git-repo-check`. The provider catalog now carries the invocation verified against `codex exec --help`.
+- A failing CLI provider reported its opening banner (`YOLO mode is enabled...`) instead of the cause. The reported line is now the first one that names a failure, falling back to the last line of stderr.
 
 <!-- reis-mobile:latest-release:end -->
 
@@ -247,7 +254,8 @@ After editing agents, skills or commands, restart Claude Code or Codex.
 /reis-mobile:test audit Espresso checkout tests  # Reviews assertions and synchronization without editing
 /reis-mobile:release audit both stores for the production variant # Evidence-backed readiness, read-only
 /reis-mobile:debate Riverpod or BLoC in this app? # Debate between the specialists, with a decision by lead-mobile
-/reis-mobile:debate --rounds 3 --external ...     # More rounds; --external adds Codex and Gemini, if installed
+/reis-mobile:debate --rounds 3 --external ...     # More rounds; --external adds every configured external provider
+/reis-mobile:consult should we move this to a native module? # Second opinion from OpenAI, Gemini, OpenRouter, Ollama or the CLIs
 ```
 
 ### Debug
@@ -299,7 +307,50 @@ Participants vary along two axes at once. The **role** gives each one a differen
 
 It is expensive: several agents over two rounds. Use it for architecture decisions with a real trade-off — *migrate to Riverpod*, *offline-first with Firestore or a local cache*, *native plugin or an off-the-shelf package* — and not for questions with a single answer, where `/reis-mobile <request>` solves it for less.
 
-With `--external`, the command checks whether the `codex` and `gemini` CLIs exist and carries on without them if they are missing. External providers do not know the project and do not have the plugin skills: they come in as an outside opinion, checked against the code before the synthesis.
+With `--external`, the command asks the core which providers are ready — the `codex` and `gemini` CLIs, OpenAI, Gemini, OpenRouter, Ollama — and carries on without them if none is. `--providers a,b` picks them explicitly. External providers do not know the project and do not have the plugin skills: they come in as an outside opinion, checked against the code before the synthesis.
+
+### External providers
+
+`/reis-mobile:consult <question>` is the debate's external axis on its own: it routes the question, forms its own position, builds a self-contained briefing with the relevant code excerpts, sends it to the configured providers and then reconciles every outside claim against your code — confirmed with `file:line`, unverifiable, or wrong with the evidence. Rounds and agents cost nothing here, so it fits a question a single outside opinion settles.
+
+The core makes the call, never the model, so **no API key passes through the conversation**. The question is masked by [`redact.mjs`](core/security/redact.mjs) on the way out and every answer on the way in.
+
+| Provider | Needs | Model from |
+|---|---|---|
+| `codex` | the `codex` CLI on `PATH` | its own configuration |
+| `gemini-cli` | the `gemini` CLI on `PATH` | its own configuration |
+| `openai` | `OPENAI_API_KEY` | `OPENAI_MODEL` |
+| `gemini` | `GEMINI_API_KEY` or `GOOGLE_API_KEY` | `GEMINI_MODEL` |
+| `openrouter` | `OPENROUTER_API_KEY` | `OPENROUTER_MODEL` |
+| `ollama` | a server at `OLLAMA_HOST` (default `http://127.0.0.1:11434`) | `OLLAMA_MODEL` |
+
+```bash
+reis-mobile providers --all                      # What each provider needs, with no network call
+reis-mobile providers --models --providers openai # Ask the provider which models it serves
+reis-mobile consult --providers openai,ollama -- "is a native module justified here?"
+reis-mobile consult --file briefing.md --timeout 300000
+```
+
+reis-mobile ships **no default model id**: a hardcoded one is wrong the day the provider retires it. Set `OPENAI_MODEL` and friends, pass `--model`, or write it once in `~/.config/reis-mobile/config.json`:
+
+```json
+{
+  "providers": {
+    "openai": { "model": "<a model from reis-mobile providers --models>" },
+    "openrouter": { "enabled": false }
+  }
+}
+```
+
+A team decides which providers may receive repository context, committed with the repository:
+
+```yaml
+# .reis-mobile/config.yaml
+providers:
+  - ollama      # only this one; an empty list allows none, no key allows all
+```
+
+`reis-mobile providers` and `/reis-mobile:doctor` make no network call: a provider is `ready` because its executable is on `PATH` or its credential is in the environment, never because it answered. `ollama` shows as `local` until a request proves the server is up.
 
 Not sure what the router will pick? Ask the CLI:
 
@@ -326,6 +377,7 @@ The router never invents a specialist: if no agent serves the intent, it warns y
 | I want to... | Use | Status |
 |----------|-----|--------|
 | Know if my environment is ready to build | `/reis-mobile:doctor` | ✅ |
+| Cross-check a decision with a model outside this session | `/reis-mobile:consult` | ✅ |
 | Review a PR or my changes | `/reis-mobile:review` | ✅ |
 | Audit an entire Flutter project | `/reis-mobile:review` with no pending changes | ✅ |
 | Find out a project's stack | `reis-mobile detect` | ✅ |
@@ -454,13 +506,13 @@ About 85 guides come from [flutter/skills](https://github.com/flutter/skills), [
 
 ## Trust, security and limits
 
-**Read-only CLI context.** `doctor`, `detect`, `route`, `review`, `test` and `release` do not modify your project. `/reis-mobile:release` inspects existing release evidence and remains read-only unless execution is explicitly requested. The `/reis-mobile:test` slash command can write or fix tests and execute runners when requested. `/reis-mobile:project` writes only the optional project profile. The `/reis-mobile:review` and `/reis-mobile:debate` commands instruct the model not to edit app code; the debate writes its rounds to `.reis-mobile/debates/`.
+**Read-only CLI context.** `doctor`, `detect`, `route`, `review`, `test`, `release`, `providers` and `consult` do not modify your project. `/reis-mobile:release` inspects existing release evidence and remains read-only unless execution is explicitly requested. The `/reis-mobile:test` slash command can write or fix tests and execute runners when requested. `/reis-mobile:project` writes only the optional project profile. The `/reis-mobile:review` and `/reis-mobile:debate` commands instruct the model not to edit app code; the debate writes its rounds to `.reis-mobile/debates/` and a consult its briefing to `.reis-mobile/consults/`.
 
 **Secrets masked.** The diff goes through [`core/security/redact.mjs`](core/security/redact.mjs) before reaching the model. Lock files and generated code (`*.g.dart`, `*.freezed.dart`, `*.pbxproj`) stay out of the diff. Redaction is a protection layer, not a guarantee. See [SECURITY.md](SECURITY.md).
 
-**No telemetry.** `detect`, `doctor`, `route`, `review`, `debug` and `test` make no network calls. The update hook and `update-check` request the public npm package metadata; they send no project files or identifiers. Installation downloads the package and registers the plugin. The Google Play policy guide in `mobile-android` runs Python scripts that download your app's public Google Play listing when the model uses it. The AI analysis uses the model of the session you are working in, such as Claude Code or Codex.
+**No telemetry.** `detect`, `doctor`, `route`, `review`, `debug`, `test` and `providers` make no network calls (`providers --models` and `consult` do, by request). The update hook and `update-check` request the public npm package metadata; they send no project files or identifiers. Installation downloads the package and registers the plugin. The Google Play policy guide in `mobile-android` runs Python scripts that download your app's public Google Play listing when the model uses it. The AI analysis uses the model of the session you are working in, such as Claude Code or Codex.
 
-**Exception: `/reis-mobile:debate --external`.** This flag, and only this flag, sends the debate context — including excerpts of the files mentioned in the question — to the `codex` and `gemini` CLIs, which are third-party and have their own data policies. Without the flag, the debate context stays in your session. The `review` diff is masked by `redact.mjs`, but the context you cite in a debate question does not go through that layer: check what you are sending before using `--external`.
+**Exception: external providers.** Two workflows, and only these two, send project context to a third party: `/reis-mobile:debate --external` and `/reis-mobile:consult`. Both state which providers receive it, and both are opt-in — no other command calls a provider. What leaves is the briefing, including the code excerpts you include; each provider has its own data policy. The question and every answer pass through `redact.mjs`, which is a protection layer and not a guarantee: read the briefing before sending it. API keys are read from the environment by the CLI and never enter the conversation, and `providers:` in `.reis-mobile/config.yaml` lets a team restrict which providers a repository allows. CLI providers (`codex`, `gemini-cli`) are asked for an opinion, not for work: they run in read-only mode (`codex exec --sandbox read-only`, `gemini --approval-mode plan`) inside a temporary directory, never in your repository.
 
 **Context cost.** Claude Code loads the descriptions of 21 agents and 17 skills; the full content of each skill is loaded only when it is used. The exact description cost depends on the host and plugin version.
 
@@ -491,8 +543,8 @@ About 85 guides come from [flutter/skills](https://github.com/flutter/skills), [
 | v0.7.1 | Update notices, single-source version and release automation | ✅ |
 | v0.7.3 | `/reis-mobile:release` with per-target evidence, required gates and deterministic readiness verdicts (previously planned for v0.8.0) | ✅ |
 | v0.8.0 | `mobile-performance`, `mobile-offline-sync` and `mobile-observability` topic skills with a reference per stack, plus background execution, OAuth/PKCE, billing lifecycle and localization references | ✅ |
-| v0.9.0 | MCP server | ⏳ |
-| v0.10.0 | Multi-provider (OpenAI, Gemini, OpenRouter, Ollama) beyond the debate's `--external` | ⏳ |
+| v0.9.0 | Multi-provider layer (OpenAI, Gemini, OpenRouter, Ollama and the Codex/Gemini CLIs), `reis-mobile providers`, `reis-mobile consult` and `/reis-mobile:consult` — previously planned for v0.10.0 | ✅ |
+| v0.10.0 | MCP server | ⏳ |
 | v1.0.0 | First stable version: Flutter, Android, iOS and React Native | ⏳ |
 
 ---
@@ -502,6 +554,9 @@ About 85 guides come from [flutter/skills](https://github.com/flutter/skills), [
 **Do I need Flutter, Xcode or the Android SDK installed?**
 Not for the review, which only reads code. `/reis-mobile:doctor` shows what is missing in case you want to build.
 
+**Do I need an API key?**
+No. Everything except `/reis-mobile:consult` and `/reis-mobile:debate --external` runs on the model of your session. Those two use whatever you have configured — a `codex` or `gemini` CLI already on your machine counts, and `ollama` keeps the question on localhost. `reis-mobile providers --all` shows what each one still needs.
+
 **My app lives inside a monorepo.**
 Commit a `.reis-mobile/config.yaml` at the repository root pointing at the app:
 
@@ -546,6 +601,7 @@ Questions: [Discussions](https://github.com/wrsilva/reis-mobile/discussions). Wh
 - [Architecture](ARCHITECTURE.md): modules, detection, routing and the agent and skill contract
 - [AGENTS.md](AGENTS.md): rules for whoever (or whichever AI) contributes to the repository
 - [Contributing](CONTRIBUTING.md)
+- [Releasing](docs/releasing.md): how a version is cut, what is generated and what to do when the pipeline fails
 - [Code of Conduct](CODE_OF_CONDUCT.md)
 - [Support](SUPPORT.md)
 - [Security](SECURITY.md)

package/bin/reis-mobile.mjs

@@ -10,6 +10,8 @@ import { detectStack } from '../core/detection/stack-detector.mjs';
 import { runDoctor } from '../core/diagnostics/doctor.mjs';
 import { runInit } from '../core/install/init.mjs';
 import { PLUGIN_ROOT } from '../core/paths.mjs';
+import { DEFAULT_TIMEOUT_MS, consult, listProviderModels } from '../core/providers/consult.mjs';
+import { parseProviderList, providerAllowlist, resolveProviders, selectProviders } from '../core/providers/providers.mjs';
 import { loadRegistry, validateRegistry } from '../core/registry/registry.mjs';
 import { releaseContext } from '../core/release/context.mjs';
 import { INTENT_IDS } from '../core/router/intents.mjs';
@@ -30,6 +32,8 @@ Commands:
   debug [problem...]         Route a build or runtime failure and report the toolchain it runs on
   test [request...]          Prepare test routing, git context and toolchain checks (does not run tests)
   release [request...]       Prepare release evidence context (does not build or publish)
+  providers                  List the external model providers and what each one needs
+  consult [question...]      Ask the configured external providers the same question
   agents | skills | stacks   List registered components
   validate                   Validate the plugin's agents, skills and stacks
   update-check               Check npm for a newer reis-mobile release
@@ -44,6 +48,11 @@ Options:
   --scope <scope>   init: Claude Code scope, user (default), project or local
   --uninstall       init: remove the plugin and its marketplace from Claude Code and Codex, and the saved language
   --force           update-check: ignore the cached registry result
+  --providers <ids> providers/consult: comma-separated provider ids (default: every usable one)
+  --model <id>      consult: model for the selected HTTP providers, overriding the configuration
+  --models          providers: ask each provider which models it serves (network request)
+  --file <path>     consult: read the question from a file instead of the arguments
+  --timeout <ms>    consult: give up on a provider after this long (default 120000)
   --lang <en|pt>    Override the saved language for this run
   --json            Machine-readable output
   -v, --version     Print the version
@@ -59,6 +68,11 @@ const OPTIONS = {
   scope: { type: 'string' },
   uninstall: { type: 'boolean' },
   force: { type: 'boolean' },
+  providers: { type: 'string' },
+  model: { type: 'string' },
+  models: { type: 'boolean' },
+  file: { type: 'string' },
+  timeout: { type: 'string' },
   lang: { type: 'string' },
   json: { type: 'boolean' },
   version: { type: 'boolean', short: 'v' },
@@ -75,6 +89,8 @@ const COMMANDS = {
   debug: commandDebug,
   test: commandTest,
   release: commandRelease,
+  providers: commandProviders,
+  consult: commandConsult,
   agents: (options) => commandList('agents', options),
   skills: (options) => commandList('skills', options),
   stacks: (options) => commandList('stacks', options),
@@ -109,7 +125,7 @@ async function main(argv) {
   return (await command({ ...options, dir: project.projectDir, project, prompt: rest.join(' ') })) ?? 0;
 }
 
-const PROJECT_COMMANDS = new Set(['detect', 'doctor', 'route', 'review', 'debug', 'test', 'release']);
+const PROJECT_COMMANDS = new Set(['detect', 'doctor', 'route', 'review', 'debug', 'test', 'release', 'providers', 'consult']);
 
 async function commandUpdateCheck({ force, json }) {
   const result = await checkForUpdate({ force });
@@ -300,6 +316,112 @@ async function commandRelease({ dir, project, prompt, json, lang }) {
   return 0;
 }
 
+/**
+ * External providers and what each one still needs. No network call: an executable on PATH
+ * or a credential in the environment is what decides `ready`, so `providers` and `doctor`
+ * stay offline. `--models` is the one exception, and asks the provider itself rather than
+ * shipping a model id that goes stale.
+ */
+async function commandProviders({ project, all, json, models, providers: requested, model, timeout }) {
+  const allow = providerAllowlist(project.config);
+  const resolution = await resolveProviders({ allow, model });
+  const requestedIds = parseProviderList(requested);
+  for (const warning of resolution.warnings) console.error(`! ${warning}`);
+
+  if (models) {
+    const selected = selectProviders(resolution.providers, requestedIds, { requireModel: false });
+    const catalogs = await listProviderModels({ providers: selected, timeoutMs: parseTimeout(timeout, 30_000) });
+    if (json) return print({ models: catalogs, configPath: resolution.configPath });
+    for (const catalog of catalogs) {
+      const summary = catalog.status === 'ok' ? `${catalog.models.length} model(s)` : `${catalog.status} · ${catalog.error}`;
+      console.log(`${catalog.provider.padEnd(14)}${summary}`);
+      for (const id of catalog.models) console.log(`  · ${id}`);
+    }
+    return catalogs.some((catalog) => catalog.status === 'ok') ? 0 : 1;
+  }
+
+  if (json) return print({ providers: resolution.providers, configPath: resolution.configPath, projectConfig: project.config?.path ?? null });
+
+  printProject(project);
+  const shown = all ? resolution.providers : resolution.providers.filter((provider) => provider.selectable);
+  for (const provider of shown) {
+    const model = provider.model ? `model ${provider.model} (${provider.modelSource})` : provider.kind === 'cli' ? 'own model' : 'no model';
+    console.log(`${provider.id.padEnd(14)}${PROVIDER_SYMBOLS[provider.status]} ${provider.status.padEnd(9)}${model.padEnd(34)}${provider.detail}`);
+  }
+  const usable = resolution.providers.filter((provider) => provider.runnable);
+  console.log(
+    usable.length
+      ? `\n${usable.length} provider(s) ready: reis-mobile consult --providers ${usable.map((provider) => provider.id).join(',')} -- "<question>"`
+      : '\nNo provider is ready. Install the Codex or Gemini CLI, or set an API key and a model (reis-mobile providers --all).',
+  );
+  console.log(`Config      ${resolution.configPath}`);
+  return 0;
+}
+
+const PROVIDER_SYMBOLS = { ready: '✓', local: '-', missing: '-', disabled: '-', blocked: '✗' };
+
+/**
+ * Asks the selected providers the same question. The core performs the call so no API key
+ * reaches the conversation, and both the question and every answer go through the redaction
+ * layer on the way through.
+ */
+async function commandConsult({ dir, project, json, providers: requested, model, timeout, file, prompt, lang }) {
+  const question = file ? await readFile(file, 'utf8') : prompt || (await readStdin());
+  if (!question.trim()) {
+    console.error('consult needs a question. Pass it as an argument, with --file <path>, or on stdin.');
+    return 1;
+  }
+
+  const allow = providerAllowlist(project.config);
+  const resolution = await resolveProviders({ allow, model });
+  for (const warning of resolution.warnings) console.error(`! ${warning}`);
+  const selected = selectProviders(resolution.providers, parseProviderList(requested));
+  if (!selected.length) {
+    console.error('No external provider is ready. Run `reis-mobile providers --all` to see what each one needs.');
+    return 1;
+  }
+
+  const detection = await detectStack(dir);
+  const language = await resolveLanguage({ flag: lang });
+  const answers = await consult({ prompt: question, providers: selected, timeoutMs: parseTimeout(timeout, DEFAULT_TIMEOUT_MS) });
+  const answered = answers.results.filter((result) => result.status === 'ok');
+
+  if (json) {
+    print({ stack: detection.stack, language, projectConfig: project.config?.path ?? null, ...answers });
+    return answered.length ? 0 : 1;
+  }
+
+  printProject(project);
+  console.log(`Stack       ${detection.stack}`);
+  printLanguage(language);
+  console.log(`Question    ${answers.prompt.chars} chars${answers.prompt.redacted ? ' (secrets masked)' : ''}`);
+  for (const result of answers.results) {
+    const heading = `${result.provider}${result.model ? ` · ${result.model}` : ''} · ${result.status} · ${(result.durationMs / 1000).toFixed(1)}s`;
+    console.log(`\n--- ${heading} ---`);
+    console.log(result.status === 'ok' ? result.text : `! ${result.error}`);
+  }
+  console.log(
+    answered.length
+      ? '\nExternal answers are an outside opinion: they do not know this project. Verify every claim in the code.'
+      : '\nNo provider answered.',
+  );
+  return answered.length ? 0 : 1;
+}
+
+function parseTimeout(value, fallback) {
+  if (value === undefined) return fallback;
+  const timeout = Number(value);
+  if (!Number.isFinite(timeout) || timeout <= 0) throw new Error(`--timeout must be a positive number of milliseconds, got ${JSON.stringify(value)}`);
+  return timeout;
+}
+
+async function readStdin() {
+  if (process.stdin.isTTY) return '';
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString('utf8');
+}
+
 async function commandList(kind, { json }) {
   const registry = await loadRegistry();
   const items = registry[kind];

package/commands/consult.md

@@ -0,0 +1,95 @@
+---
+description: Second opinion from external providers — builds a stack-aware briefing, sends it through the provider layer and reconciles every outside claim against the code
+argument-hint: "[--providers a,b] [--model <id>] [--files a,b] <question>"
+allowed-tools: ["Bash(node:*)", "Read", "Grep", "Glob", "Write"]
+---
+
+# reis-mobile consult
+
+Arguments received: `$ARGUMENTS`
+
+Use this command when a mobile decision or finding deserves a model that does not share this session's blind spots: a migration you are unsure about, a diagnosis you cannot confirm, a trade-off where you suspect you are anchored. For a question the code answers on its own, answer it directly and say why a consult was not worth it.
+
+**This sends project context to a third party.** Everything in the briefing leaves the session, including the excerpts of the files you include. Name the providers that will receive it before sending, and never include a credential, a store key or a `.env` value.
+
+## 1. Parse the arguments
+
+| Flag | Default | Effect |
+|---|---|---|
+| `--providers a,b` | every ready provider | Explicit provider ids, from step 2. |
+| `--model <id>` | per-provider configuration | Model for the selected HTTP providers. |
+| `--files a,b` | files named in the question | Extra files to include in the briefing. |
+| `--timeout <ms>` | 120000 | How long to wait for each provider. |
+
+Whatever remains is the question, as free text. Without a question, explain the usage and stop.
+
+## 2. Check who can answer
+
+```bash
+node "${CLAUDE_PLUGIN_ROOT}/bin/reis-mobile.mjs" providers --dir "$PWD" --all
+```
+
+`ready` providers can be used now. `missing` ones state the executable or the credential they need, `local` needs a server running, `disabled` is off in the user config and `blocked` is not in the `providers:` allowlist of `.reis-mobile/config.yaml` — a team decision, which you do not work around. With no ready provider, show what each one needs and stop.
+
+## 3. Route the question and gather the evidence
+
+```bash
+node "${CLAUDE_PLUGIN_ROOT}/bin/reis-mobile.mjs" route --dir "$PWD" -- "<question>"
+```
+
+Use the `Language` line for everything the user reads (`en` English, `pt` Brazilian Portuguese; `-` means the language of the request). Read the selected agent and skills as `/reis-mobile:review` does, then resolve the paths in the question and in `--files` and read them. External providers receive content, never paths: they cannot open your repository.
+
+**Form your own position first.** Write it down before sending anything. A consult that starts without one turns into agreement with whatever comes back.
+
+## 4. Write the briefing
+
+```bash
+mkdir -p ".reis-mobile/consults/<NNN-question-slug>"
+```
+
+`NNN` is sequential within `.reis-mobile/consults/`. Write `briefing.md` in that folder with the Write tool, self-contained:
+
+```text
+QUESTION: <question>
+STACK: <detected stack, variant and platforms>
+LANGUAGE: <language — answer in it>
+CODE: <the relevant excerpts, with file:line for each>
+CONSTRAINTS: <versions, SDK targets, deadlines or rules that limit the answer>
+
+You do not have access to this repository: everything you need is above.
+Answer in at most 500 words: your recommendation, the evidence in the excerpts that
+supports it, what it costs, and what would change your mind. Say explicitly when the
+excerpts are not enough to decide.
+```
+
+## 5. Consult
+
+```bash
+node "${CLAUDE_PLUGIN_ROOT}/bin/reis-mobile.mjs" consult --dir "$PWD" \
+  --file ".reis-mobile/consults/<id>/briefing.md" \
+  [--providers <ids>] [--model <id>] [--timeout <ms>]
+```
+
+The CLI performs the call, so no API key passes through this conversation; the question is masked by the redaction layer on the way out and every answer on the way in. Each block is headed by the provider, its model, its status and its duration. A `no-model`, `timeout`, `unavailable` or `error` status is information to report, not a failure to retry blindly — retry once at most, and only for `timeout`.
+
+## 6. Reconcile against the code
+
+External answers do not know this project and have no reis-mobile skills. For every claim that matters:
+
+- confirm it in the code and cite `file:line`;
+- mark as **unverifiable** what the excerpts cannot settle;
+- mark as **wrong** what the code contradicts, with the evidence.
+
+A claim that only repeats the briefing back adds nothing. Do not adopt a recommendation because several providers agree: they may share a training bias that your code does not.
+
+## 7. Report
+
+In this order:
+
+1. **Decision** — your recommendation, with the reason, in one paragraph.
+2. **Where the providers agreed with you** and where they did not, naming each one.
+3. **Confirmed claims** with `file:line`, then **unverifiable** and **wrong** ones.
+4. **Action plan**, if the decision implies work.
+5. The briefing path and the providers that received it.
+
+Do not apply any code change: a consult ends in a recommendation. Implementing it is a new request.

package/commands/debate.md

@@ -1,7 +1,7 @@
 ---
 description: Structured debate between the mobile specialists — each agent defends its perspective, rebuts the others, and lead-mobile decides
-argument-hint: "[--rounds N] [--agents a,b,c] [--external] <question>"
-allowed-tools: ["Bash(node:*)", "Bash(command:*)", "Bash(mkdir:*)", "Bash(codex:*)", "Bash(gemini:*)", "Agent", "Read", "Write", "Grep", "Glob"]
+argument-hint: "[--rounds N] [--agents a,b,c] [--external] [--providers a,b] <question>"
+allowed-tools: ["Bash(node:*)", "Bash(mkdir:*)", "Agent", "Read", "Write", "Grep", "Glob"]
 ---
 
 # reis-mobile debate
@@ -16,7 +16,8 @@ Use this command for architecture decisions with real trade-offs, not for routin
 |---|---|---|
 | `--rounds N` | 2 | Number of rounds, from 1 to 3. Above 3, warn and use 3. |
 | `--agents a,b,c` | automatic | Explicit participants, using the names from the table in step 3. |
-| `--external` | off | Adds Codex and Gemini to the debate, when installed. |
+| `--external` | off | Adds every ready external provider to the debate. |
+| `--providers a,b` | every ready one | Explicit provider ids; implies `--external`. |
 
 Whatever remains is the question, as free text. Without a question, explain the usage and stop.
 
@@ -98,23 +99,26 @@ Ground every claim in file:line. Do not write what you have not verified.
 Write your position to: .reis-mobile/debates/<id>/rounds/r1_<agent>.md
 ```
 
-### 5.1 External providers (only with `--external`)
+### 5.1 External providers (only with `--external` or `--providers`)
 
-Check before calling, and carry on without them if they are missing — their absence is informative, not an error:
+Ask the core which providers can answer, instead of probing for executables yourself:
 
 ```bash
-command -v codex >/dev/null 2>&1 && echo codex
-command -v gemini >/dev/null 2>&1 && echo gemini
+node "${CLAUDE_PLUGIN_ROOT}/bin/reis-mobile.mjs" providers --dir "$PWD" --all
 ```
 
-If present, call them in parallel with the agents, writing to `r1_codex.md` and `r1_gemini.md`:
+`ready` providers can be used now; `missing`, `local`, `disabled` and `blocked` state what each one needs, and `blocked` means the repository's `providers:` allowlist excludes it — a team decision you do not work around. With no ready provider, carry on with the agents alone: their absence is informative, not an error. State at the opening who joined and who was missing.
+
+Write the same briefing you gave the agents to `rounds/r<N>_briefing.md` with the Write tool — a file, so nothing depends on shell quoting — and send it:
 
 ```bash
-codex exec --full-auto "<briefing>"
-printf '%s' "<briefing>" | gemini -p "" -o text --approval-mode yolo
+node "${CLAUDE_PLUGIN_ROOT}/bin/reis-mobile.mjs" consult --dir "$PWD" \
+  --file ".reis-mobile/debates/<id>/rounds/r<N>_briefing.md" [--providers <ids>]
 ```
 
-They do not have the plugin skills and do not know the project: give the entire context in the briefing and treat the output as an outside opinion, to be checked against the code before it enters the synthesis. State at the opening who joined and who was missing.
+The CLI performs the call, so no API key passes through this conversation, and the briefing is masked by the redaction layer before it leaves the process. Write each answer to `rounds/r<N>_<provider>.md` with the Write tool, keeping the provider id and the status from the output header. Treat a `timeout`, `error` or `no-model` status as a participant that did not answer this round.
+
+They do not have the plugin skills and do not know the project: the briefing carries the entire context, and the output is an outside opinion to be checked against the code before it enters the synthesis. In round 2 they receive the others' positions exactly as the agents do.
 
 ## 6. Round 2 — rebuttal
 

package/commands/reis-mobile.md

@@ -1,6 +1,6 @@
 ---
-description: reis-mobile entry point — lists the commands or forwards to doctor, project, review, debug, test, release, debate or the right agent from a free-form request
-argument-hint: "[doctor | project | review | debug | test | release | debate | free-form request]"
+description: reis-mobile entry point — lists the commands or forwards to doctor, project, review, debug, test, release, debate, consult or the right agent from a free-form request
+argument-hint: "[doctor | project | review | debug | test | release | debate | consult | free-form request]"
 allowed-tools: ["Bash(node:*)", "Bash(git:*)", "Read", "Grep", "Glob", "Edit", "Write"]
 ---
 
@@ -26,6 +26,7 @@ Reply only with this list. The only thing to run is `node "${CLAUDE_PLUGIN_ROOT}
 /reis-mobile:test [request]          Runs, writes, audits or fixes tests using the project's test setup
 /reis-mobile:release [request]       Audits store readiness with evidence and a go/no-go verdict
 /reis-mobile:debate <question>       Debate between the specialists, with a decision by lead-mobile
+/reis-mobile:consult <question>      Second opinion from the configured external providers, checked against the code
 /reis-mobile <free-form request>     Forwards the request to the agent and skills for the detected stack
 ```
 
@@ -52,6 +53,10 @@ Read `${CLAUDE_PLUGIN_ROOT}/commands/debug.md` and follow all of it, treating th
 
 Read `${CLAUDE_PLUGIN_ROOT}/commands/debate.md` and follow all of it, treating the rest of the arguments (without the word `debate`) as `$ARGUMENTS`.
 
+## `consult [options] <question>`
+
+Read `${CLAUDE_PLUGIN_ROOT}/commands/consult.md` and follow all of it, treating the rest of the arguments (without the word `consult`) as `$ARGUMENTS`. This entry point has the same behavior as `/reis-mobile:consult`.
+
 ## `test [request]`
 
 Read `${CLAUDE_PLUGIN_ROOT}/commands/test.md` and follow all of it, treating the rest of the arguments (without the word `test`) as `$ARGUMENTS`. This entry point has the same behavior as `/reis-mobile:test`.

package/commands/review.md

@@ -51,3 +51,5 @@ Confirm every finding in the code before reporting it. Do not modify files: this
 Answer in the format defined by the agent (Summary, Critical, Bugs, Architecture, Security, Performance, Maintainability, Suggested changes), translating the headings when the language is not English. On the first line of the Summary, state the stack, the agent and the skills used, so the routing is visible.
 
 If the router emitted warnings (lines starting with `!`), mention them in the Summary.
+
+When the user wants a finding cross-checked by a model outside this session, point them at `/reis-mobile:consult <question>`: it builds the briefing, sends it to the configured providers and reconciles every outside claim against the code. A review never sends project context to a third party on its own.

package/core/config/project.mjs

@@ -5,7 +5,7 @@ import { parseYamlSubset } from '../registry/frontmatter.mjs';
 
 export const PROJECT_CONFIG = join('.reis-mobile', 'config.yaml');
 
-const KNOWN_KEYS = new Set(['app']);
+const KNOWN_KEYS = new Set(['app', 'providers']);
 
 /**
  * Finds the nearest `.reis-mobile/config.yaml`, starting at `dir` and walking up, so a

package/core/diagnostics/doctor.mjs

@@ -4,8 +4,10 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { promisify } from 'node:util';
 
+import { findProjectConfig } from '../config/project.mjs';
 import { createProbe } from '../detection/project-probe.mjs';
 import { detectStack } from '../detection/stack-detector.mjs';
+import { providerAllowlist, resolveProviders } from '../providers/providers.mjs';
 
 const run = promisify(execFile);
 const TOOL_TIMEOUT_MS = 30_000;
@@ -47,8 +49,9 @@ export async function runDoctor({ projectDir = process.cwd(), all = false, platf
   const tools = TOOLS.filter((tool) => all || tool.relevant(context));
   const toolChecks = await Promise.all(tools.map((tool) => checkTool(tool, platform)));
   const projectChecks = await checkProject(probe, detection, files);
+  const providerChecks = await checkProviders(detection.projectDir, all);
 
-  const checks = [...toolChecks, ...projectChecks];
+  const checks = [...toolChecks, ...projectChecks, ...providerChecks];
   const warnings = checks.filter((check) => check.status === 'warning').length;
 
   return {
@@ -85,6 +88,25 @@ async function checkTool(tool, platform) {
   }
 }
 
+/**
+ * External model providers, resolved from PATH and the environment only: `doctor` makes no
+ * network call, so a reachable provider is never confirmed here, just a configured one.
+ */
+async function checkProviders(projectDir, all) {
+  const { providers } = await resolveProviders({ allow: providerAllowlist(findProjectConfig(projectDir)) });
+  const shown = all ? providers : providers.filter((provider) => provider.status === 'ready');
+  if (!shown.length) {
+    return [{ id: 'providers', label: 'Providers', section: 'integrations', status: 'info', detail: 'none configured (reis-mobile providers --all)' }];
+  }
+  return shown.map((provider) => ({
+    id: `provider-${provider.id}`,
+    label: provider.label,
+    section: 'integrations',
+    status: provider.status === 'ready' ? 'ok' : 'info',
+    detail: `${provider.status} · ${provider.model ? `model ${provider.model}` : provider.kind === 'cli' ? 'own model' : 'no model'}`,
+  }));
+}
+
 async function checkAndroidSdk() {
   const candidates = [
     process.env.ANDROID_HOME,

package/core/providers/catalog.mjs

@@ -0,0 +1,168 @@
+// External model providers reis-mobile can ask for a second opinion.
+//
+// A provider is data, not code paths spread across commands: the catalog says how to reach
+// it, which credential proves it is usable and where its model catalog lives. Nothing here
+// carries a default model id — a provider is the only authority on its own catalog, and a
+// hardcoded id becomes wrong the day it is retired. `providers --models` asks instead.
+
+const JSON_HEADERS = { 'content-type': 'application/json' };
+
+/** OpenAI, OpenRouter and any other `/chat/completions` endpoint share this shape. */
+function openAiCompatible({ id, label, docs, keys, modelEnv, baseEnv, defaultBase, headers = {} }) {
+  const base = (env) => trimTrailingSlash(env[baseEnv] || defaultBase);
+  const auth = (env) => ({ authorization: `Bearer ${credential(env, keys)}`, ...headers });
+  return {
+    id,
+    label,
+    kind: 'http',
+    docs,
+    keys,
+    modelEnv,
+    needsModel: true,
+    base,
+    chat: ({ prompt, model, env }) => ({
+      url: `${base(env)}/chat/completions`,
+      init: {
+        method: 'POST',
+        headers: { ...JSON_HEADERS, ...auth(env) },
+        body: JSON.stringify({ model, messages: [{ role: 'user', content: prompt }] }),
+      },
+    }),
+    readChat: (body) => body?.choices?.[0]?.message?.content ?? '',
+    catalog: ({ env }) => ({ url: `${base(env)}/models`, init: { headers: auth(env) } }),
+    readCatalog: (body) => (body?.data ?? []).map((item) => item?.id).filter(Boolean),
+  };
+}
+
+export const PROVIDERS = [
+  {
+    id: 'codex',
+    label: 'Codex CLI',
+    kind: 'cli',
+    docs: 'https://developers.openai.com/codex/cli',
+    command: 'codex',
+    // `--sandbox read-only` because a second opinion never needs to write, and
+    // `--skip-git-repo-check` because the call runs in a temporary directory, not a repository.
+    // Verified against `codex exec --help` (codex-cli 0.155.1); the prompt is an argument.
+    argv: ({ prompt }) => ['exec', '--sandbox', 'read-only', '--skip-git-repo-check', prompt],
+    stdin: () => undefined,
+    version: ['--version'],
+  },
+  {
+    id: 'gemini-cli',
+    label: 'Gemini CLI',
+    kind: 'cli',
+    docs: 'https://github.com/google-gemini/gemini-cli',
+    command: 'gemini',
+    // `-p ""` plus the briefing on stdin, as `--prompt` is appended to stdin input, and
+    // `--approval-mode plan`, the read-only mode (`gemini --help`, gemini-cli 0.34.0).
+    argv: () => ['-p', '', '-o', 'text', '--approval-mode', 'plan'],
+    stdin: ({ prompt }) => prompt,
+    version: ['--version'],
+  },
+  openAiCompatible({
+    id: 'openai',
+    label: 'OpenAI',
+    docs: 'https://platform.openai.com/docs/api-reference',
+    keys: ['OPENAI_API_KEY'],
+    modelEnv: 'OPENAI_MODEL',
+    baseEnv: 'OPENAI_BASE_URL',
+    defaultBase: 'https://api.openai.com/v1',
+  }),
+  openAiCompatible({
+    id: 'openrouter',
+    label: 'OpenRouter',
+    docs: 'https://openrouter.ai/docs',
+    keys: ['OPENROUTER_API_KEY'],
+    modelEnv: 'OPENROUTER_MODEL',
+    baseEnv: 'OPENROUTER_BASE_URL',
+    defaultBase: 'https://openrouter.ai/api/v1',
+    headers: { 'x-title': 'reis-mobile' },
+  }),
+  {
+    id: 'gemini',
+    label: 'Gemini API',
+    kind: 'http',
+    docs: 'https://ai.google.dev/gemini-api/docs',
+    keys: ['GEMINI_API_KEY', 'GOOGLE_API_KEY'],
+    modelEnv: 'GEMINI_MODEL',
+    needsModel: true,
+    base: geminiBase,
+    chat: ({ prompt, model, env }) => ({
+      url: `${geminiBase(env)}/models/${encodeURIComponent(model)}:generateContent`,
+      init: {
+        method: 'POST',
+        headers: { ...JSON_HEADERS, 'x-goog-api-key': credential(env, ['GEMINI_API_KEY', 'GOOGLE_API_KEY']) },
+        body: JSON.stringify({ contents: [{ role: 'user', parts: [{ text: prompt }] }] }),
+      },
+    }),
+    readChat: (body) =>
+      (body?.candidates?.[0]?.content?.parts ?? [])
+        .map((part) => part?.text)
+        .filter(Boolean)
+        .join(''),
+    catalog: ({ env }) => ({
+      url: `${geminiBase(env)}/models`,
+      init: { headers: { 'x-goog-api-key': credential(env, ['GEMINI_API_KEY', 'GOOGLE_API_KEY']) } },
+    }),
+    readCatalog: (body) => (body?.models ?? []).map((item) => String(item?.name ?? '').replace(/^models\//, '')).filter(Boolean),
+  },
+  {
+    id: 'ollama',
+    label: 'Ollama',
+    kind: 'http',
+    docs: 'https://github.com/ollama/ollama/blob/main/docs/api.md',
+    // No credential: a local server is either running or it is not, and only a request tells.
+    keys: [],
+    local: true,
+    modelEnv: 'OLLAMA_MODEL',
+    needsModel: true,
+    base: ollamaBase,
+    chat: ({ prompt, model, env }) => ({
+      url: `${ollamaBase(env)}/api/chat`,
+      init: {
+        method: 'POST',
+        headers: JSON_HEADERS,
+        body: JSON.stringify({ model, messages: [{ role: 'user', content: prompt }], stream: false }),
+      },
+    }),
+    readChat: (body) => body?.message?.content ?? '',
+    catalog: ({ env }) => ({ url: `${ollamaBase(env)}/api/tags`, init: {} }),
+    readCatalog: (body) => (body?.models ?? []).map((item) => item?.name).filter(Boolean),
+  },
+];
+
+export const PROVIDER_IDS = PROVIDERS.map((provider) => provider.id);
+
+export function findProvider(id) {
+  return PROVIDERS.find((provider) => provider.id === id) ?? null;
+}
+
+export function unknownProviderMessage(id) {
+  return `Unknown provider "${id}". Use one of: ${PROVIDER_IDS.join(', ')}`;
+}
+
+/** The endpoint a provider is reached at, so `providers` can show where a call would go. */
+export function providerEndpoint(provider, env = process.env) {
+  return provider.kind === 'cli' ? provider.command : provider.base(env);
+}
+
+function geminiBase(env) {
+  return trimTrailingSlash(env.GEMINI_BASE_URL || 'https://generativelanguage.googleapis.com/v1beta');
+}
+
+/** `OLLAMA_HOST` is commonly set without a scheme (`127.0.0.1:11434`). */
+function ollamaBase(env) {
+  const host = (env.OLLAMA_HOST || '').trim();
+  if (!host) return 'http://127.0.0.1:11434';
+  return trimTrailingSlash(/^https?:\/\//.test(host) ? host : `http://${host}`);
+}
+
+function credential(env, keys) {
+  for (const key of keys) if (env[key]) return env[key];
+  return '';
+}
+
+function trimTrailingSlash(value) {
+  return String(value).replace(/\/+$/, '');
+}

package/core/providers/consult.mjs

@@ -0,0 +1,220 @@
+import { spawn } from 'node:child_process';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { redactSecrets } from '../security/redact.mjs';
+import { findProvider } from './catalog.mjs';
+
+export const DEFAULT_TIMEOUT_MS = 120_000;
+const MAX_OUTPUT_BYTES = 2_000_000;
+const ERROR_BODY_CHARS = 300;
+
+/**
+ * Asks each provider the same question, in parallel, and returns one result per requested
+ * provider.
+ *
+ * The core makes the call instead of handing the model a command to run: a credential must
+ * never reach a transcript or a tool log. The prompt is redacted on the way out — a
+ * third-party provider is exactly the boundary `redactSecrets` exists for — and every answer
+ * is redacted on the way in, because a provider can echo back what it was given.
+ *
+ * Statuses: `ok`, `unavailable` (the provider cannot be reached at all), `no-model`,
+ * `timeout`, `error`.
+ */
+export async function consult({
+  prompt,
+  providers,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  env = process.env,
+  fetchImpl = globalThis.fetch,
+  runCommand = spawnCommand,
+} = {}) {
+  const text = redactSecrets(String(prompt ?? ''));
+  if (!text.trim()) throw new Error('consult needs a prompt. Pass it as an argument, with --file, or on stdin.');
+
+  const results = await Promise.all(
+    providers.map((resolved) => askOne({ resolved, prompt: text, timeoutMs, env, fetchImpl, runCommand })),
+  );
+  return {
+    prompt: { chars: text.length, redacted: text !== String(prompt ?? '') },
+    timeoutMs,
+    results,
+  };
+}
+
+async function askOne({ resolved, prompt, timeoutMs, env, fetchImpl, runCommand }) {
+  const base = {
+    provider: resolved.id,
+    label: resolved.label,
+    kind: resolved.kind,
+    model: resolved.model,
+    status: 'error',
+    text: '',
+    error: null,
+    durationMs: 0,
+  };
+  if (!resolved.selectable) return { ...base, status: 'unavailable', error: resolved.detail };
+  if (resolved.needsModel && !resolved.model) {
+    const provider = findProvider(resolved.id);
+    return {
+      ...base,
+      status: 'no-model',
+      error: `no model configured. Set ${provider.modelEnv}, or providers.${resolved.id}.model in the config file, or pass --model. Run \`reis-mobile providers --models --providers ${resolved.id}\` to see what it serves.`,
+    };
+  }
+
+  const started = Date.now();
+  const outcome = await (resolved.kind === 'cli'
+    ? askCli({ resolved, prompt, timeoutMs, env, runCommand })
+    : askHttp({ resolved, prompt, timeoutMs, env, fetchImpl }));
+  return { ...base, ...outcome, durationMs: Date.now() - started };
+}
+
+async function askHttp({ resolved, prompt, timeoutMs, env, fetchImpl }) {
+  const provider = findProvider(resolved.id);
+  const { url, init } = provider.chat({ prompt, model: resolved.model, env });
+  const response = await withTimeout(timeoutMs, (signal) => fetchImpl(url, { ...init, signal }));
+  if (response.timedOut) return { status: 'timeout', error: `no answer in ${timeoutMs} ms` };
+  if (response.failed) return { status: 'error', error: safe(response.error) };
+
+  if (!response.value.ok) {
+    const body = await readBody(response.value);
+    return { status: 'error', error: safe(`HTTP ${response.value.status}${body ? `: ${body.slice(0, ERROR_BODY_CHARS)}` : ''}`) };
+  }
+  let payload;
+  try {
+    payload = await response.value.json();
+  } catch {
+    return { status: 'error', error: 'the answer was not JSON' };
+  }
+  const text = safe(provider.readChat(payload));
+  return text.trim() ? { status: 'ok', text } : { status: 'error', error: 'the provider returned no text' };
+}
+
+/**
+ * CLI providers run in a throwaway directory. `codex exec --full-auto` and `gemini
+ * --approval-mode yolo` may write files, and the briefing already carries every file they
+ * need to read, so there is no reason to give them the user's repository as a workspace.
+ */
+async function askCli({ resolved, prompt, timeoutMs, env, runCommand }) {
+  const provider = findProvider(resolved.id);
+  const workdir = await mkdtemp(join(tmpdir(), 'reis-mobile-consult-'));
+  try {
+    const result = await runCommand({
+      command: provider.command,
+      args: provider.argv({ prompt }),
+      stdin: provider.stdin({ prompt }),
+      cwd: workdir,
+      timeoutMs,
+      env,
+    });
+    if (result.status === 'timeout') return { status: 'timeout', error: `no answer in ${timeoutMs} ms` };
+    if (result.status === 'error') return { status: 'error', error: safe(result.error) };
+    const text = safe(result.stdout).trim();
+    return text ? { status: 'ok', text } : { status: 'error', error: 'the provider returned no text' };
+  } finally {
+    await rm(workdir, { recursive: true, force: true });
+  }
+}
+
+/** What each selected provider says it serves, so reis-mobile never invents a model id. */
+export async function listProviderModels({ providers, env = process.env, fetchImpl = globalThis.fetch, timeoutMs = 30_000 } = {}) {
+  return Promise.all(
+    providers.map(async (resolved) => {
+      const base = { provider: resolved.id, label: resolved.label, kind: resolved.kind, models: [], status: 'error', error: null };
+      if (resolved.kind === 'cli') return { ...base, status: 'unsupported', error: 'a CLI provider uses the model it is configured with' };
+      if (!resolved.selectable) return { ...base, status: 'unavailable', error: resolved.detail };
+
+      const provider = findProvider(resolved.id);
+      const { url, init } = provider.catalog({ env });
+      const response = await withTimeout(timeoutMs, (signal) => fetchImpl(url, { ...init, signal }));
+      if (response.timedOut) return { ...base, status: 'timeout', error: `no answer in ${timeoutMs} ms` };
+      if (response.failed) return { ...base, status: 'error', error: safe(response.error) };
+      if (!response.value.ok) return { ...base, status: 'error', error: safe(`HTTP ${response.value.status}`) };
+      try {
+        return { ...base, status: 'ok', models: provider.readCatalog(await response.value.json()) };
+      } catch {
+        return { ...base, status: 'error', error: 'the answer was not JSON' };
+      }
+    }),
+  );
+}
+
+async function withTimeout(timeoutMs, call) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return { value: await call(controller.signal) };
+  } catch (error) {
+    return controller.signal.aborted ? { timedOut: true } : { failed: true, error: error.message };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function readBody(response) {
+  try {
+    return (await response.text()).trim().replace(/\s+/g, ' ');
+  } catch {
+    return '';
+  }
+}
+
+/** Collects stdout instead of using execFile, which cannot write to stdin. */
+export function spawnCommand({ command, args, stdin, cwd, timeoutMs, env }) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn(command, args, { cwd, env, stdio: ['pipe', 'pipe', 'pipe'] });
+    } catch (error) {
+      resolve({ status: 'error', error: error.message });
+      return;
+    }
+    let stdout = '';
+    let stderr = '';
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill('SIGKILL');
+    }, timeoutMs);
+
+    child.stdout.on('data', (chunk) => {
+      if (stdout.length < MAX_OUTPUT_BYTES) stdout += chunk;
+    });
+    child.stderr.on('data', (chunk) => {
+      if (stderr.length < MAX_OUTPUT_BYTES) stderr += chunk;
+    });
+    child.stdin.on('error', () => {
+      // The provider closed stdin before reading the prompt; the exit code reports it.
+    });
+    child.on('error', (error) => {
+      clearTimeout(timer);
+      resolve({ status: 'error', error: error.code === 'ENOENT' ? `${command} not found in PATH` : error.message });
+    });
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      if (timedOut) resolve({ status: 'timeout' });
+      else if (code === 0) resolve({ status: 'ok', stdout });
+      else resolve({ status: 'error', error: failureLine(stderr) || `${command} exited with code ${code}` });
+    });
+    child.stdin.end(stdin ?? '');
+  });
+}
+
+/** Nothing leaves this module without passing the redaction layer. */
+function safe(value) {
+  return redactSecrets(String(value ?? ''));
+}
+
+/**
+ * The line of stderr that explains the failure. Agentic CLIs open with banners and notices,
+ * so the first line is usually noise and the cause is further down.
+ */
+function failureLine(text) {
+  const lines = String(text ?? '')
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean);
+  return lines.find((line) => /\b(error|failed|failure|unauthorized|forbidden|quota|unexpected|not found|invalid|denied)\b/i.test(line)) ?? lines.at(-1) ?? '';
+}

package/core/providers/providers.mjs

@@ -0,0 +1,156 @@
+import { accessSync, constants } from 'node:fs';
+import { join } from 'node:path';
+
+import { configPath, readConfig } from '../config/language.mjs';
+import { PROVIDERS, PROVIDER_IDS, findProvider, providerEndpoint, unknownProviderMessage } from './catalog.mjs';
+
+export { PROVIDERS, PROVIDER_IDS, findProvider, unknownProviderMessage } from './catalog.mjs';
+
+/**
+ * Status of a provider, decided without a single network call so `doctor` and `providers`
+ * stay offline:
+ *
+ * - `ready`     the executable is on PATH, or the credential is set
+ * - `local`     keyless local server: selectable, proven only by an actual request
+ * - `missing`   no executable and no credential
+ * - `disabled`  turned off in the user config
+ * - `blocked`   not in the `providers:` allowlist of .reis-mobile/config.yaml
+ */
+const SELECTABLE = new Set(['ready', 'local']);
+
+/**
+ * Finds an executable by scanning PATH instead of shelling out to `which`: one less
+ * subprocess, and a platform the tests can inject.
+ */
+export function findExecutable(command, { env = process.env, platform = process.platform } = {}) {
+  const separator = platform === 'win32' ? ';' : ':';
+  const extensions = platform === 'win32' ? (env.PATHEXT || '.COM;.EXE;.BAT;.CMD').split(';') : [''];
+  for (const directory of String(env.PATH || '').split(separator).filter(Boolean)) {
+    for (const extension of extensions) {
+      const candidate = join(directory, `${command}${extension}`);
+      try {
+        accessSync(candidate, platform === 'win32' ? constants.F_OK : constants.X_OK);
+        return candidate;
+      } catch {
+        // Not here; keep scanning.
+      }
+    }
+  }
+  return null;
+}
+
+/** The allowlist a team commits in `.reis-mobile/config.yaml`, or null when absent. */
+export function providerAllowlist(projectConfig) {
+  const value = projectConfig?.data?.providers;
+  if (value === undefined) return null;
+  const list = (Array.isArray(value) ? value : [value]).map((item) => String(item).trim()).filter(Boolean);
+  const unknown = list.filter((id) => !PROVIDER_IDS.includes(id));
+  if (unknown.length) {
+    return { ids: list.filter((id) => PROVIDER_IDS.includes(id)), warnings: unknown.map((id) => `${projectConfig.path}: ${unknownProviderMessage(id)}`) };
+  }
+  return { ids: list, warnings: [] };
+}
+
+/**
+ * Every provider with its status, resolved model and the evidence that decided both.
+ * `model` precedence: the `--model` flag, then the provider's model variable, then
+ * `providers.<id>.model` in the user config. CLI providers resolve no model: the spelling
+ * of their model flag is not verified here, so they keep the one they are configured with.
+ */
+export async function resolveProviders({
+  env = process.env,
+  platform = process.platform,
+  model: flagModel,
+  allow = null,
+  config,
+  path = configPath({ env }),
+} = {}) {
+  const settings = config ?? (await readConfig(path));
+  const providerSettings = settings.providers ?? {};
+  const warnings = [...(allow?.warnings ?? [])];
+
+  const providers = PROVIDERS.map((provider) => {
+    const setting = providerSettings[provider.id] ?? {};
+    const resolved = {
+      id: provider.id,
+      label: provider.label,
+      kind: provider.kind,
+      endpoint: providerEndpoint(provider, env),
+      docs: provider.docs,
+      needsModel: provider.needsModel === true,
+      model: null,
+      modelSource: null,
+      status: 'missing',
+      detail: '',
+    };
+
+    if (provider.kind === 'cli') {
+      const executable = findExecutable(provider.command, { env, platform });
+      resolved.status = executable ? 'ready' : 'missing';
+      resolved.detail = executable ?? `${provider.command} not found in PATH`;
+      resolved.model = null;
+      resolved.modelSource = 'provider';
+      if (setting.model || (flagModel && executable)) {
+        warnings.push(`${provider.id}: reis-mobile does not set the model of a CLI provider; it uses its own configuration`);
+      }
+    } else {
+      const key = provider.keys.find((candidate) => env[candidate]);
+      if (provider.local) {
+        resolved.status = 'local';
+        resolved.detail = `requires a server at ${resolved.endpoint}`;
+      } else {
+        resolved.status = key ? 'ready' : 'missing';
+        resolved.detail = key ? `${key} set` : `set ${provider.keys.join(' or ')}`;
+      }
+      const [value, source] = flagModel
+        ? [flagModel, '--model']
+        : env[provider.modelEnv]
+          ? [env[provider.modelEnv], provider.modelEnv]
+          : setting.model
+            ? [setting.model, `providers.${provider.id}.model`]
+            : [null, null];
+      resolved.model = value;
+      resolved.modelSource = source;
+    }
+
+    if (setting.enabled === false) {
+      resolved.status = 'disabled';
+      resolved.detail = `providers.${provider.id}.enabled is false`;
+    } else if (allow && !allow.ids.includes(provider.id)) {
+      resolved.status = 'blocked';
+      resolved.detail = 'not listed in the project providers allowlist';
+    }
+
+    resolved.selectable = SELECTABLE.has(resolved.status);
+    // A provider that needs a model and has none is selectable but not runnable: asking for
+    // it explicitly reports `no-model`, while the default selection leaves it out.
+    resolved.runnable = resolved.selectable && (!resolved.needsModel || Boolean(resolved.model));
+    if (resolved.selectable && !resolved.runnable) resolved.detail = `${resolved.detail} · no model configured`;
+    return resolved;
+  });
+
+  return { providers, warnings, configPath: path };
+}
+
+/**
+ * The providers a run should talk to. Requested ids that are not usable are kept in the
+ * result with their status instead of being dropped: a missing provider is information the
+ * caller has to report, not an error to swallow.
+ */
+export function selectProviders(providers, requested, { requireModel = true } = {}) {
+  if (!requested || requested.length === 0) {
+    return providers.filter((provider) => (requireModel ? provider.runnable : provider.selectable));
+  }
+  const unknown = requested.filter((id) => !PROVIDER_IDS.includes(id));
+  if (unknown.length) throw new Error(unknownProviderMessage(unknown[0]));
+  return requested.map((id) => providers.find((provider) => provider.id === id));
+}
+
+/** `--providers codex,openai` */
+export function parseProviderList(value) {
+  if (value === undefined || value === null) return null;
+  return String(value)
+    .split(',')
+    .map((item) => item.trim())
+    .filter(Boolean);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reis-mobile",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "AI agents and skills for Flutter, Android, iOS, React Native and Kotlin Multiplatform — a Claude Code and Codex plugin for reviews, debugging, tests, architecture, security and Firebase.",
   "type": "module",
   "license": "MIT",