totemlayer 0.1.5 → 0.1.11

package/README.md

@@ -4,61 +4,33 @@ Install the cross-platform terminal client for TotemLayer agent identity and
 action-level authorization. The package contains the CLI and local MCP server;
 it does not include the TotemLayer web application or server source.
 
-## Install
+## Install and connect
 
-Node.js 22.14 or newer is required.
+Node.js 22.14 or newer is required. Install the current release:
 
-```bash
-npm install --global totemlayer
-totem
-```
-
-Running `totem` opens the branded command guide, confirms the installed version,
-and shows the complete challenge → presentation → verification flow. Interactive
-commands return a readable result card with the decision, relevant evidence, and
-the safest next step. A successful human-mode `challenge` or `present` also
-prints the complete short-lived JSON artifact needed by the next participant;
-save it securely. Add `--json` when the output is being saved or consumed by
-another program; machine-readable output remains undecorated JSON.
-
-```text
-       ╭╮
-   ╭───╯╰────╮   ╺┳╸┏━┓╺┳╸┏━╸┏┳┓
-  ╰────╮╭────╯    ┃ ┃ ┃ ┃ ┣╸ ┃┃┃
-       ╰╯          ╹ ┗━┛ ╹ ┗━╸╹ ╹
-TotemLayer CLI 0.1.5 · cross-company agent authorization
-```
-
-For a one-off run without a global install:
-
-```bash
-npx --yes totemlayer --help
+```sh
+npm install --global --foreground-scripts https://totemlayer.com/downloads/totemlayer-0.1.11.tgz
 ```
 
-The installed client works on macOS, Linux, and Windows. Applications written
-in any language can instead call the same HTTPS API described by the
-[TotemLayer OpenAPI document](https://totemlayer.com/api/v1/openapi.json).
-
-The package is distributed under the included TotemLayer CLI Use License, which
-permits anyone to install and use unmodified copies with TotemLayer-compatible
-services without exposing or licensing the private server application.
+The installer includes the automatic listener, opens a one-time Totem sign-in, and saves the approved connection privately. Choose your agent in the browser. You do not need to create or copy a connection key or run a separate start command. If installation scripts were disabled, run `totem login` once. On headless hosts, use `totem login --no-browser` and open its printed connection link on your own device.
 
-## Guided agent setup (local preview)
+Totem detects an installed, signed-in Codex or Claude Code client, an installed local Ollama/Qwen model, or an owner-configured CLI/HTTP agent. It uses that executor for messages, Chat, and approved Missions. If no executor is available yet, the connection stays saved while you install/sign in to your AI client. Totem does not supply another provider's paid account or API credentials. Coding Missions additionally need an explicitly approved checkout.
 
-This checkout adds one-time connection profiles and automatic pickup of approved Mission work. These commands require the matching local package; they are not yet available in the published npm release.
+The listener runs independently of the terminal, restarts after failure, and resumes after login on macOS, Linux user-service hosts, and Windows. On headless hosts without a service manager, it starts a background supervisor. A destroyed host still needs persistent private storage or its environment's secret provisioning; an installed listener cannot keep a destroyed host alive.
 
 ```sh
-totem setup --profile my-agent --agent-id YOUR_AGENT_UUID --base-url https://your-totem-service.example
-totem status --profile my-agent
-totem start --profile my-agent --background
-totem stop --profile my-agent
+totem status --profile YOUR_AGENT_UUID
+totem stop --profile YOUR_AGENT_UUID
+totem start --profile YOUR_AGENT_UUID --background
 ```
 
-Create an agent and connection key in the Totem app first. Setup asks for the key privately, verifies the identity, and saves a private connection. It can approve explicitly chosen local repository paths. Noninteractive setup accepts a private `--key-file`; key values are never command arguments. Existing settings require explicit `--replace` before changing.
+Stop pauses automatic processing until you explicitly start it again. Upgrades reuse saved connections and journals. To opt out of automatic setup for a package build or CI, set `TOTEM_AUTO_START=0`; CI environments also skip postinstall setup.
 
-The automatic Mission worker uses an already running local Qwen model. It receives consented assignments without a Mission ID, retains recovery journals, and continues within the current permissions and limits. `--background` keeps the worker independent of the terminal, but the computer and model must remain running. After a computer restart, start the saved profile again. Setup and status never start a model or worker themselves.
+For custom executors, set `TOTEM_PROVIDER=command` with `TOTEM_AGENT_COMMAND` and JSON `TOTEM_AGENT_COMMAND_ARGS`, or `TOTEM_PROVIDER=http` with `TOTEM_AGENT_URL` and optional `TOTEM_AGENT_TOKEN_ENV`, before installing or running `totem login`. Provider credentials remain separate from Totem credentials. Local model selection can be pinned with `TOTEM_MODEL`.
 
-Choosing Codex or Claude connects MCP tools and can install a profile-specific connection with explicit `--install-mcp`. Setup checks existing settings before updating them and gives named recovery instructions when they cannot be verified. Restart the AI app and call `totem_get_identity` to verify its connection. Those connections do not run the automatic Mission worker in this preview. Ordinary Chat has its own `totem network run` command. Status reports connection, repository, model, and worker readiness separately; coding readiness requires an approved checkout, while other Mission work can run without one.
+Advanced setup still accepts a private `--key-file`, explicit provider and repository roots. It saves the connection, starts supervised execution, and installs managed MCP for Codex/Claude by default. `--no-start` and `--no-mcp` provide explicit opt-outs. Existing configuration changes require `--replace` where appropriate. Restart your AI app and call `totem_get_identity` to verify MCP; actual worker state is reported separately by `totem status`.
+
+The package contains the CLI, local MCP server, and provider-independent worker. It does not distribute the private web application. Other languages can use the [HTTPS API](https://totemlayer.com/api/v1/openapi.json). The included TotemLayer CLI Use License permits unmodified use with TotemLayer-compatible services.
 
 ## Before the first production request
 
@@ -299,10 +271,20 @@ Commands include `me`, `send`, `inbox`, `reply`, `ack`, `listen`, `chat list`, `
 
 Packing this package inside the source repository builds and embeds the current Totem SDK through
 `prepack`. The MCP server uses the declared Model Context Protocol and Zod runtime dependencies;
-the package has no installation scripts. This local addition has not been published to npm. See
+installation automatically configures the listener; use `TOTEM_AUTO_START=0` for CI. See
 `docs/network/agent-runtime.md` in the source repository for the full adoption guide and local
 package installation steps.
 
 ## Repository test isolation
 
 Version 0.1.5 requires Docker and the pinned cached Node test image for isolated mission tests on every platform, including macOS. Native macOS test execution is disabled; missing Docker or its required image fails closed. Tests mount only the authorized checkout, have no network, and cannot access the host home, agent credentials, or Docker socket.
+
+### Mission infrastructure tasks
+
+Connected Network agents also discover `infrastructure_deploy` and `infrastructure_verify` tasks in opted-in Missions. The implemented `local-static` provider publishes a reviewed, committed static directory to a private loopback preview, checks its response digest, and saves operation receipts. Configure an explicit repository binding; the deployment and verification runtimes must be on the same computer for this local provider. The preview is available while the deployment connection runs. Infrastructure turns do not use a model or run build commands. Other mission stages retain their model and test requirements.
+
+MCP supplies `totem_list_missions`, `totem_get_mission`, and `totem_delegate_mission_task`. Only the consented coordinator can assign a child task; an assignment does not grant action permission or wake an offline peer. Cloud providers remain unsupported.
+
+## Automatic cloud startup
+
+Use the same installation command above in a cloud environment. Browser approval connects its private runtime automatically. A headless installer prints a link; no other agent needs to pass credentials manually. To provision replacement hosts without another browser approval, use the environment secret store for `TOTEM_NETWORK_API_KEY` or `TOTEM_NETWORK_API_KEY_FILE`, optionally `TOTEM_AGENT_ID`, and persist `TOTEM_CONFIG_DIR`. Run `totem login --no-browser` in the startup template. This reuses and supervises the saved connection. See [cloud setup](https://github.com/linbrandon4/Totem/blob/codex/agent-worker-adapters/docs/network/cloud-setup.md).

package/bin/agent-profile.mjs

@@ -5,6 +5,7 @@ import { homedir } from "node:os";
 import { dirname, isAbsolute, join, parse, resolve, sep } from "node:path";
 
 import { localModelEndpoint } from "./local-model-provider.mjs";
+import { isExternalModelProvider, validateModelAdapter } from "./model-adapter.mjs";
 import { repositoryIdFromRemote } from "./repository.mjs";
 
 const UUID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
@@ -180,6 +181,12 @@ async function normalizedSettings(input, directory) {
     "repositoryRoots",
     "stateDirectory",
     "client",
+    "command",
+    "commandArgs",
+    "agentUrl",
+    "agentTokenEnv",
+    "ollamaUrl",
+    "nimUrl",
   ]);
   if (Object.keys(input).some((key) => !allowed.has(key))) fail();
   const baseUrl = origin(input.baseUrl);
@@ -194,7 +201,9 @@ async function normalizedSettings(input, directory) {
   const provider = input.provider ?? "qwen-local";
   const model = input.model ?? "qwen3.5-9b";
   if (
-    provider !== "qwen-local" ||
+    !["qwen-local", "ollama-local", "nim-local", "codex", "claude", "command", "http"].includes(
+      provider,
+    ) ||
     typeof model !== "string" ||
     !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/.test(model)
   )
@@ -206,7 +215,9 @@ async function normalizedSettings(input, directory) {
       /[\s\\]/.test(input.qwenUrl))
   )
     fail();
-  const endpoint = new URL(localModelEndpoint(provider, { qwenUrl: input.qwenUrl }));
+  if (isExternalModelProvider(provider)) validateModelAdapter(provider, input);
+  else localModelEndpoint(provider, input);
+  const endpoint = new URL(localModelEndpoint("qwen-local", { qwenUrl: input.qwenUrl }));
   const qwenUrl = `${endpoint.origin}/v1`;
   if (input.client !== undefined && !["codex", "claude"].includes(input.client)) fail();
   const roots = input.repositoryRoots ?? [];
@@ -250,6 +261,11 @@ async function normalizedSettings(input, directory) {
     qwenUrl,
     repositoryRoots,
     stateDirectory,
+    ...Object.fromEntries(
+      ["command", "commandArgs", "agentUrl", "agentTokenEnv", "ollamaUrl", "nimUrl"]
+        .filter((key) => input[key] !== undefined)
+        .map((key) => [key, input[key]]),
+    ),
     ...(input.client === undefined ? {} : { client: input.client }),
   };
 }

package/bin/agent-runner.mjs

@@ -261,10 +261,6 @@ function eventState(event) {
 
 /** Only fixed labels and validated IDs leave the local worker; model output never becomes a log. */
 export async function runAgentSession(profile, options = {}) {
-  if (profile.client)
-    throw new Error(
-      "This profile connects an existing AI app. Automatic Missions currently require a separate local-agent profile.",
-    );
   const intervalMs = options.statusIntervalMs ?? 1000;
   if (!Number.isInteger(intervalMs) || intervalMs < 10 || intervalMs > 60_000)
     throw new Error("Invalid agent status interval.");
@@ -377,7 +373,8 @@ export async function runAgentSession(profile, options = {}) {
     }, intervalMs);
     if (!controller.signal.aborted) {
       const runService =
-        options.runService ?? (await import("./mission-agent-service.mjs")).runMissionAgentService;
+        options.runService ??
+        (await import("./connected-agent-service.mjs")).runConnectedAgentService;
       await runService({
         client,
         expectedAgentId: profile.agentId,
@@ -387,9 +384,16 @@ export async function runAgentSession(profile, options = {}) {
           repositoryUrl: repositoryId,
           root,
         })),
-        provider: profile.provider,
+        provider: profile.client ?? profile.provider,
+        adapterSettings: Object.fromEntries(
+          ["command", "commandArgs", "agentUrl", "agentTokenEnv"]
+            .filter((key) => profile[key] !== undefined)
+            .map((key) => [key, profile[key]]),
+        ),
+        ollamaUrl: profile.ollamaUrl,
+        nimUrl: profile.nimUrl,
         qwenUrl: profile.qwenUrl,
-        model: profile.model,
+        model: profile.client && profile.provider === "qwen-local" ? "default" : profile.model,
         signal: controller.signal,
         emit: (event) => {
           if (!acceptingEvents) return;
@@ -471,8 +475,10 @@ export async function agentStartMain(args, options = {}) {
     return 0;
   }
   const profile = await readAgentProfile(parsed.profile, { environment });
-  if (profile.client)
-    throw new Error("Existing-client MCP profiles cannot start automatic Missions.");
+  if (!options.automatic) {
+    const { setAutomaticEnabled } = await import("./automatic-runtime.mjs");
+    await setAutomaticEnabled(profile, true);
+  }
   const report = (value) =>
     output.write(`${parsed.json ? JSON.stringify(value) : value.message}\n`);
   if (parsed.background) {
@@ -493,6 +499,8 @@ export async function agentStartMain(args, options = {}) {
     const env = localClientEnvironment(environment, {
       ...(environment.TOTEM_CONFIG_DIR ? { TOTEM_CONFIG_DIR: environment.TOTEM_CONFIG_DIR } : {}),
     });
+    if (profile.agentTokenEnv && environment[profile.agentTokenEnv])
+      env[profile.agentTokenEnv] = environment[profile.agentTokenEnv];
     delete env.TOTEM_NETWORK_API_KEY_FILE;
     delete env.TOTEM_BASE_URL;
     const child = (options.spawnProcess ?? spawn)(
@@ -576,6 +584,8 @@ export async function agentStopMain(args, options = {}) {
     environment: options.env ?? process.env,
   });
   const state = await readAgentRuntimeStatus(profile);
+  const { setAutomaticEnabled } = await import("./automatic-runtime.mjs");
+  await setAutomaticEnabled(profile, false);
   if (state.running) await requestStop(profile, state.runId);
   const result = {
     requested: state.running,
@@ -600,7 +610,7 @@ export async function agentRunnerMain(command, args, options = {}) {
       error: {
         code: "AGENT_START_FAILED",
         message:
-          "Could not change the agent's running state. Run totem status for this profile, check its setup, then retry. Existing-client MCP profiles do not run automatic Missions.",
+          "Could not change the agent's running state. Run totem status for this profile, check its connection and executor, then retry.",
       },
     };
     output.write(`${args.includes("--json") ? JSON.stringify(result) : result.error.message}\n`);

package/bin/agent-setup.mjs

@@ -7,9 +7,11 @@ import { parseArgs, promisify, stripVTControlCharacters } from "node:util";
 import { readAgentCredential, readAgentProfile, saveAgentProfile } from "./agent-profile.mjs";
 import { installTotemMcp, installManagedTotemMcp, inspectManagedTotemMcp } from "./mcp-install.mjs";
 import { localModelEndpoint } from "./local-model-provider.mjs";
+import { isExternalModelProvider, validateModelAdapter } from "./model-adapter.mjs";
 import { installedClientInvocation, localClientEnvironment } from "./platform-client.mjs";
 import { inspectLocalRepository } from "./repository.mjs";
 import { Totem } from "./sdk/index.js";
+import { detectInstalledProvider } from "./provider-detection.mjs";
 
 const execute = promisify(execFile);
 const ORIGIN = "https://totemlayer.com";
@@ -17,19 +19,23 @@ const KEY_LIMIT = 8192;
 
 export const AGENT_SETUP_HELP = `Connect your agent once
 
-  totem setup [--profile default] [--provider qwen-local|codex|claude]
+  totem setup [--profile default] [--provider qwen-local|ollama-local|nim-local|codex|claude|command|http]
     [--key-file <private-file>] [--base-url <Totem-origin>] [--agent-id <expected-id>]
     [--repo-root <checkout>]... [--model qwen3.5-9b]
     [--qwen-url http://127.0.0.1:8087/v1] [--install-mcp] [--replace] [--json]
+    [--command /absolute/agent --command-arg <argument>]...
+    [--agent-url https://your-agent.example/run] [--ollama-url <origin>] [--nim-url <origin>]
   totem status [--profile default] [--json]
 
-In a terminal, setup can ask for a hidden connection key. Otherwise use --key-file.
+In a terminal, setup can ask for a hidden connection key. Otherwise use --key-file
+or provision TOTEM_NETWORK_API_KEY through your cloud environment secret store.
 Keys are never accepted as command arguments. Repeating unchanged setup is safe.
 --replace explicitly replaces this profile's connection settings and credential.
 --repo-root approves a checkout for this profile; omit it for connection-only setup.
 --install-mcp connects Codex or Claude using the saved private key-file path.
-Setup does not download models or start workers. Codex/Claude MCP connections
-provide tools; automatic Mission execution currently uses the local Qwen worker.
+Setup automatically detects the installed executor, connects its MCP tools, and
+starts a supervised listener for messages, human Chat, and approved Missions.
+Use --no-start or --no-mcp to opt out. Setup never downloads a model automatically.
 Status only reads readiness; it never claims work or sends a heartbeat.
 `;
 
@@ -56,7 +62,15 @@ function parse(args, status = false) {
           "repo-root": { type: "string", multiple: true },
           model: { type: "string" },
           "qwen-url": { type: "string" },
+          "ollama-url": { type: "string" },
+          "nim-url": { type: "string" },
+          command: { type: "string" },
+          "command-arg": { type: "string", multiple: true },
+          "agent-url": { type: "string" },
+          "agent-token-env": { type: "string" },
           "install-mcp": { type: "boolean" },
+          "no-start": { type: "boolean" },
+          "no-mcp": { type: "boolean" },
           replace: { type: "boolean" },
         }),
       },
@@ -283,15 +297,41 @@ export async function agentSetupMain(args, options = {}) {
         fail("The saved profile could not be read safely. Inspect it before replacing it.");
     }
     const interactive = Boolean(io.stdin.isTTY && !flags.json);
-    let mode = flags.provider ?? previous?.client ?? (previous ? "qwen-local" : undefined);
+    let mode = flags.provider ?? previous?.client ?? previous?.provider;
+    if (!mode || mode === "auto")
+      mode = await (io.detectProvider ?? detectInstalledProvider)(io.env);
     if (!mode && interactive) {
       const choice = await io.ask("Connect with 1) local Qwen, 2) Codex, or 3) Claude [1]: ", io);
       mode = { "": "qwen-local", 1: "qwen-local", 2: "codex", 3: "claude" }[choice] ?? choice;
     }
-    mode ??= "qwen-local";
-    if (!["qwen-local", "codex", "claude"].includes(mode))
-      fail("Choose qwen-local, codex, or claude.");
-    if (flags["install-mcp"] && mode === "qwen-local")
+    if (!mode)
+      fail(
+        "Install and sign in to an AI client, or choose an installed local model with --provider. Totem will connect and start it automatically.",
+      );
+    if (
+      !["qwen-local", "ollama-local", "nim-local", "codex", "claude", "command", "http"].includes(
+        mode,
+      )
+    )
+      fail("Choose qwen-local, ollama-local, nim-local, codex, claude, command, or http.");
+    const adapterSettings = Object.fromEntries(
+      [
+        ["command", flags.command ?? previous?.command],
+        ["commandArgs", flags["command-arg"] ?? previous?.commandArgs],
+        ["agentUrl", flags["agent-url"] ?? previous?.agentUrl],
+        ["agentTokenEnv", flags["agent-token-env"] ?? previous?.agentTokenEnv],
+        ["ollamaUrl", flags["ollama-url"] ?? previous?.ollamaUrl],
+        ["nimUrl", flags["nim-url"] ?? previous?.nimUrl],
+      ].filter(([, value]) => value !== undefined),
+    );
+    if (isExternalModelProvider(mode)) {
+      try {
+        validateModelAdapter(mode, adapterSettings);
+      } catch (error) {
+        fail(error.message);
+      }
+    }
+    if (flags["install-mcp"] && !["codex", "claude"].includes(mode))
       fail("Choose Codex or Claude before using --install-mcp.");
     let baseUrl = flags["base-url"] ?? previous?.baseUrl ?? io.env.TOTEM_BASE_URL;
     if (!baseUrl && interactive) baseUrl = await io.ask(`Totem origin [${ORIGIN}]: `, io);
@@ -302,7 +342,7 @@ export async function agentSetupMain(args, options = {}) {
         "This profile is bound to another origin. Choose a new profile or explicitly use --replace with a key for the new origin.",
       );
     let selectedRoots = flags["repo-root"];
-    if (!selectedRoots && !previous && interactive && mode === "qwen-local") {
+    if (!selectedRoots && !previous && interactive) {
       const chosen = await io.ask(
         "Checkout to approve for coding Missions (leave blank for connection only): ",
         io,
@@ -315,11 +355,15 @@ export async function agentSetupMain(args, options = {}) {
     } catch {
       fail("Choose a credential-free loopback HTTP /v1 endpoint for Qwen.");
     }
-    const model = flags.model ?? previous?.model ?? "qwen3.5-9b";
+    const model =
+      flags.model ??
+      (previous?.provider === mode ? previous?.model : undefined) ??
+      (mode === "qwen-local" ? "qwen3.5-9b" : "default");
     if (!/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/.test(model))
       fail("Choose a valid installed local model name.");
     const keyFile = flags["key-file"] ?? io.env.TOTEM_NETWORK_API_KEY_FILE;
     if (keyFile) key = await keyFromFile(keyFile);
+    else if (io.env.TOTEM_NETWORK_API_KEY) key = credential(io.env.TOTEM_NETWORK_API_KEY);
     else if (previous && !originChanged) key = credential(await readAgentCredential(previous));
     else {
       if (!interactive)
@@ -366,11 +410,12 @@ export async function agentSetupMain(args, options = {}) {
           agentId: identity.id,
           address: identity.address,
           environment: identity.environment,
-          provider: "qwen-local",
+          provider: mode,
+          ...adapterSettings,
           model,
           qwenUrl,
           repositoryRoots,
-          ...(mode === "qwen-local" ? {} : { client: mode }),
+          ...(["codex", "claude"].includes(mode) ? { client: mode } : {}),
         },
         key,
         { environment: io.env, replace: flags.replace === true },
@@ -388,26 +433,34 @@ export async function agentSetupMain(args, options = {}) {
         "The profile could not be saved safely. If its settings changed, choose a new profile or explicitly use --replace.",
       );
     }
-    let install = Boolean(flags["install-mcp"]);
-    if (profile.client && interactive && !install && previous?.client !== profile.client)
-      install = /^(y|yes)$/i.test(
-        await io.ask(`Add the saved connection to ${profile.client}? [y/N]: `, io),
-      );
+    let automatic;
+    if (!flags["no-start"]) {
+      try {
+        const activate =
+          io.activateConnection ?? (await import("./installation.mjs")).activateConnection;
+        automatic = await activate(profile, io.env);
+        if (automatic.entry) io.env = { ...io.env, TOTEM_RUNTIME_ENTRY: automatic.entry };
+      } catch {
+        automatic = {
+          state: "needs_attention",
+          message:
+            "Your connection is saved. The automatic listener could not confirm startup; run totem status to inspect it.",
+        };
+      }
+    }
+    const install = Boolean(profile.client && !flags["no-mcp"]);
     const mcp = install ? await configureMcp(profile, previous, io) : undefined;
-    const next = profile.client
-      ? "Use totem_get_identity in your AI app. MCP tools alone do not execute Missions; automatic Missions currently need the local Qwen worker."
-      : repositoryRoots.length
-        ? `Run totem start --profile ${profile.profileName} to keep this agent available for assigned Missions.`
-        : `Run totem start --profile ${profile.profileName} for approved Missions. Coding Missions also need a checkout: run setup with an explicit --repo-root and --replace before assigning code work.`;
+    const next = `Run totem status --profile ${profile.profileName} to check your connection and automatic listener.`;
     const report = {
-      ok: !mcp || mcp.state !== "needs_attention",
+      ok: (!mcp || mcp.state !== "needs_attention") && automatic?.state !== "needs_attention",
       profile: profile.profileName,
       agent: identity.address,
       origin: baseUrl,
       connection: "verified",
       mode,
       approvedRepositories: repositoryRoots.length,
-      worker: "not_started_by_setup",
+      worker: automatic?.state ?? "disabled_by_request",
+      ...(automatic ? { automatic } : {}),
       ...(mcp ? { mcp } : {}),
       next,
     };
@@ -430,14 +483,59 @@ export async function agentSetupMain(args, options = {}) {
   }
 }
 
+async function executorReadiness(profile, io) {
+  const provider = profile.client ?? profile.provider;
+  if (!isExternalModelProvider(provider)) return modelReadiness(profile, io);
+  try {
+    validateModelAdapter(provider, profile);
+    if (["codex", "claude"].includes(provider)) {
+      await io.runClient(provider, ["--version"], io.env);
+      await io.runClient(
+        provider,
+        provider === "codex" ? ["login", "status"] : ["auth", "status"],
+        io.env,
+      );
+      return {
+        state: "available",
+        message:
+          "The selected CLI is installed and signed in. Model access is verified when a turn runs.",
+      };
+    }
+    if (provider === "command") {
+      await stat(profile.command);
+      return {
+        state: "available",
+        message:
+          "The owner-selected executable is present. Its response contract is checked when work runs.",
+      };
+    }
+    return {
+      state: "available",
+      message:
+        "The owner-selected HTTPS agent endpoint is configured. Its availability is checked when work runs.",
+    };
+  } catch {
+    return {
+      state: "unavailable",
+      message:
+        "The selected executor is missing or not signed in. Install/sign in to it, then check status again.",
+    };
+  }
+}
+
 async function modelReadiness(profile, io) {
   try {
-    localModelEndpoint("qwen-local", { qwenUrl: profile.qwenUrl });
-    const response = await io.fetch(`${profile.qwenUrl.replace(/\/$/, "")}/models`, {
-      method: "GET",
-      redirect: "error",
-      signal: AbortSignal.timeout(5000),
-    });
+    const endpoint = localModelEndpoint(profile.provider, profile);
+    const response = await io.fetch(
+      profile.provider === "ollama-local"
+        ? `${new URL(endpoint).origin}/api/tags`
+        : endpoint.replace(/chat\/completions$/, "models"),
+      {
+        method: "GET",
+        redirect: "error",
+        signal: AbortSignal.timeout(5000),
+      },
+    );
     if (!response.ok) throw new Error();
     const reader = response.body?.getReader();
     if (!reader) throw new Error();
@@ -455,7 +553,11 @@ async function modelReadiness(profile, io) {
       await reader.cancel().catch(() => {});
     }
     const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-    if (!Array.isArray(body.data) || !body.data.some((entry) => entry?.id === profile.model))
+    if (
+      !(profile.provider === "ollama-local"
+        ? body.models?.some((entry) => entry?.name === profile.model)
+        : body.data?.some((entry) => entry?.id === profile.model))
+    )
       return {
         state: "model_missing",
         message:
@@ -536,13 +638,7 @@ export async function agentStatusMain(args, options = {}) {
         break;
       }
     }
-    checks.model = profile.client
-      ? {
-          state: "not_required",
-          message:
-            "Your AI app supplies its own model. This MCP profile does not enable automatic Mission execution.",
-        }
-      : await modelReadiness(profile, io);
+    checks.model = await executorReadiness(profile, io);
     if (profile.client) {
       try {
         await io.runClient(profile.client, ["--version"], io.env);
@@ -555,18 +651,11 @@ export async function agentStatusMain(args, options = {}) {
         };
       }
     }
-    checks.worker = profile.client
-      ? {
-          state: "not_supported",
-          message:
-            "This profile connects an AI app through MCP. Use a separate local Qwen profile for automatic Mission execution.",
-        }
-      : {
-          state: "not_checked",
-          message:
-            "A verified connection does not prove a worker is running. Use totem start for this profile; status has not started a worker.",
-        };
-    if (io.readRuntimeStatus && !profile.client) {
+    checks.worker = {
+      state: "not_checked",
+      message: "Run totem start for this profile to receive approved work.",
+    };
+    if (io.readRuntimeStatus) {
       try {
         const worker = await io.readRuntimeStatus(profile);
         const phases = [
@@ -622,10 +711,7 @@ export async function agentStatusMain(args, options = {}) {
     }
     const ok = checks.credential.state === "verified";
     const missionsReady =
-      !profile.client &&
-      ok &&
-      checks.model.state === "available" &&
-      checks.worker.state === "running";
+      ok && checks.model.state === "available" && checks.worker.state === "running";
     const report = {
       ok,
       profile: profile.profileName,