cli-router 0.3.0__tar.gz → 0.3.1__tar.gz

cli_router-0.3.1/.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - mothership

cli_router-0.3.1/.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      python-development:
+        dependency-type: development
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

cli_router-0.3.1/.github/workflows/agent-drift-watchdog.yml

@@ -0,0 +1,255 @@
+name: Agent drift watchdog
+
+# Scheduled loop: inspect live model catalogs on the self-hosted runner. A
+# single-runner removal opens an advisory issue; only a maintainer-confirmed
+# manual run may invoke the local patch agent and open a review-required PR.
+#
+# SECURITY: this runs on a self-hosted runner that holds your subscription
+# credentials. It is triggered ONLY by the schedule or a maintainer clicking
+# "Run workflow" — never by pull_request, and never by fork code. Do not add
+# untrusted triggers to this file.
+
+on:
+  schedule:
+    - cron: "0 14 * * 1" # Mondays 14:00 UTC
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Detect and report drift only; do not patch or open a PR"
+        type: boolean
+        default: true
+      confirm_removals:
+        description: "Confirm this runner's missing models should be patched"
+        type: boolean
+        default: false
+
+permissions: {}
+
+concurrency:
+  group: agent-drift-watchdog
+  cancel-in-progress: false
+
+jobs:
+  preflight:
+    runs-on: [self-hosted, mothership]
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      issues: write
+    outputs:
+      proceed: ${{ steps.gate.outputs.proceed }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - id: gate
+        name: Circuit breaker + kill switch
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          DAILY_CAP: ${{ vars.AGENT_DAILY_CAP || '10' }}
+        run: python3 scripts/agent/preflight.py
+
+  drift:
+    needs: preflight
+    if: needs.preflight.outputs.proceed == 'true'
+    runs-on: [self-hosted, mothership]
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      issues: write
+    outputs:
+      patch_ready: ${{ steps.package.outputs.patch_ready }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install cli-router in an isolated environment
+        run: |
+          python3 -m venv "$RUNNER_TEMP/cli-router-venv"
+          "$RUNNER_TEMP/cli-router-venv/bin/python" -m pip install -e .
+          echo "$RUNNER_TEMP/cli-router-venv/bin" >> "$GITHUB_PATH"
+
+      - name: Detect drift
+        id: detect
+        env:
+          CONFIRM_REMOVALS: ${{ inputs.confirm_removals || 'false' }}
+        run: |
+          confirm_arg=""
+          if [ "$CONFIRM_REMOVALS" = "true" ]; then
+            confirm_arg="--confirm-removals"
+          fi
+          python3 scripts/agent/detect_drift.py --timeout 15 $confirm_arg | tee drift.json
+          drift=$(python3 -c "import json; print(str(json.load(open('drift.json'))['drift']).lower())")
+          candidate=$(python3 -c "import json; print(str(json.load(open('drift.json'))['candidate_drift']).lower())")
+          echo "drift=$drift" >> "$GITHUB_OUTPUT"
+          echo "candidate=$candidate" >> "$GITHUB_OUTPUT"
+
+      - name: No candidate drift
+        if: steps.detect.outputs.candidate != 'true'
+        run: echo "No retired shipped models. Nothing to do."
+
+      - name: Report candidate drift for maintainer confirmation
+        if: steps.detect.outputs.candidate == 'true' && steps.detect.outputs.drift != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh label create agent-drift --color 1d76db --description "Model-list drift candidate" --force
+          existing=$(gh issue list --label agent-drift --state open --json number --jq '.[0].number')
+          body="$(cat drift.json)"
+          if [ -n "$existing" ]; then
+            gh issue comment "$existing" --body "Fresh single-runner observation; confirmation is still required:
+
+          \`\`\`json
+          $body
+          \`\`\`"
+          else
+            gh issue create --label agent-created --label agent-drift \
+              --title "Provider model-list drift requires confirmation" \
+              --body "One runner observed a shipped fallback model missing. This can vary by account or CLI version, so no patch was applied.
+
+          Re-run this workflow manually with \`confirm_removals=true\` after verification.
+
+          \`\`\`json
+          $body
+          \`\`\`"
+          fi
+
+      - name: Dry run — report only
+        if: steps.detect.outputs.candidate == 'true' && inputs.dry_run == true
+        run: |
+          echo "Drift found; dry_run=true, not patching:"
+          cat drift.json
+
+      # --- The following steps run only when there is real drift and it's not a dry run ---
+
+      - name: Build agent prompt
+        if: steps.detect.outputs.drift == 'true' && inputs.dry_run != true
+        run: python3 scripts/agent/build_prompt.py drift.json | tee patch_prompt.txt
+
+      - name: Create isolated patch branch
+        if: steps.detect.outputs.drift == 'true' && inputs.dry_run != true
+        run: |
+          git switch -c "agent/drift-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          git config --local credential.helper ""
+
+      - name: Reject persistent runner GitHub authentication
+        if: steps.detect.outputs.drift == 'true' && inputs.dry_run != true
+        run: |
+          if env -u GH_TOKEN -u GITHUB_TOKEN -u GH_CONFIG_DIR gh auth status >/dev/null 2>&1; then
+            echo "Persistent gh authentication is available to the runner user; refusing to launch the patch agent." >&2
+            exit 1
+          fi
+
+      - name: Apply fix with local agent
+        if: steps.detect.outputs.drift == 'true' && inputs.dry_run != true
+        env:
+          GH_CONFIG_DIR: ${{ runner.temp }}/cli-router-empty-gh
+        run: |
+          mkdir -p "$GH_CONFIG_DIR"
+          env -u GH_TOKEN -u GITHUB_TOKEN -u ACTIONS_RUNTIME_TOKEN \
+            -u ACTIONS_ID_TOKEN_REQUEST_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_URL \
+            bash scripts/agent/apply_drift_fix.sh patch_prompt.txt
+
+      - name: Validate agent patch scope
+        if: steps.detect.outputs.drift == 'true' && inputs.dry_run != true
+        run: python3 scripts/agent/validate_patch.py
+
+      - id: package
+        name: Package the validated patch
+        if: steps.detect.outputs.drift == 'true' && inputs.dry_run != true
+        run: |
+          set -euo pipefail
+          git diff --binary HEAD -- CHANGELOG.md cli_router/models.py tests/test_models.py > "$RUNNER_TEMP/drift.patch"
+          test -s "$RUNNER_TEMP/drift.patch"
+          echo "patch_ready=true" >> "$GITHUB_OUTPUT"
+
+      - name: Upload the validated patch
+        if: steps.package.outputs.patch_ready == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: validated-drift-patch
+          path: ${{ runner.temp }}/drift.patch
+          if-no-files-found: error
+          retention-days: 1
+
+  verify_patch:
+    needs: drift
+    if: needs.drift.outputs.patch_ready == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.12"
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: validated-drift-patch
+          path: ${{ runner.temp }}
+
+      - name: Apply and validate the isolated patch
+        run: |
+          git apply "$RUNNER_TEMP/drift.patch"
+          python3 scripts/agent/validate_patch.py
+
+      - name: Verify in an ephemeral read-only job
+        run: |
+          python -m pip install -e .
+          python -m pytest -q
+
+  publish:
+    needs: [drift, verify_patch]
+    if: needs.drift.outputs.patch_ready == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: validated-drift-patch
+          path: ${{ runner.temp }}
+
+      - name: Apply the verified patch
+        run: |
+          git apply "$RUNNER_TEMP/drift.patch"
+          python3 scripts/agent/validate_patch.py
+
+      - name: Open review-required PR
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh auth setup-git
+          git config user.name "cli-router-agent[bot]"
+          git config user.email "cli-router-agent@users.noreply.github.com"
+          branch="agent/drift-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          git switch -c "$branch"
+          git add -- cli_router/models.py tests/test_models.py CHANGELOG.md
+          git -c core.hooksPath=/dev/null commit -m "Fix provider model-list drift (automated)"
+          git push -u origin "$branch"
+
+          # Ensure labels exist (ignore errors if already created).
+          gh label create agent-created --color 5319e7 --description "Opened by an agent loop" 2>/dev/null || true
+          gh label create agent-drift   --color 1d76db --description "Model-list drift fix"     2>/dev/null || true
+
+          url=$(gh pr create \
+            --title "Fix provider model-list drift" \
+            --body "Automated by the drift watchdog. \`cli-router doctor\` found a retired shipped model; this updates \`DEFAULT_MODELS\`, the test, and the changelog. The full test suite passed on the runner.
+          The self-hosted runner supplied only a validated three-file patch; publication ran in this isolated GitHub-hosted job." \
+            --label agent-created --label agent-drift)
+          echo "Opened $url"

{cli_router-0.3.0 → cli_router-0.3.1}/.github/workflows/publish.yml

@@ -3,7 +3,6 @@ name: Publish to PyPI
 on:
   release:
     types: [published]
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -14,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install test dependencies
@@ -26,14 +25,16 @@ jobs:
         run: python -m pip install -e .
       - name: Run tests
         run: python -m pytest tests -q
+      - name: Validate release identity
+        run: python scripts/check_release.py
 
   build:
     name: Build distributions
     runs-on: ubuntu-latest
     needs: test
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
       - name: Install build tools
@@ -43,7 +44,7 @@ jobs:
       - name: Check distributions
         run: python -m twine check dist/*
       - name: Upload distributions
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dist
           path: dist/
@@ -60,9 +61,9 @@ jobs:
 
     steps:
       - name: Download distributions
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist/
       - name: Publish package
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1

cli_router-0.3.1/.github/workflows/test.yml

@@ -0,0 +1,58 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install test dependencies
+        run: python -m pip install --upgrade pip pytest
+      - name: Install package
+        run: python -m pip install -e .
+      - name: Test
+        run: python -m pytest tests -q
+
+  quality:
+    name: Quality and package
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.12"
+      - name: Install package and development tools
+        run: python -m pip install --upgrade pip -e ".[dev]"
+      - name: Lint
+        run: ruff check cli_router scripts tests
+      - name: Type check
+        run: mypy cli_router scripts
+      - name: Lint GitHub Actions workflows
+        run: |
+          curl --fail --silent --show-error --location \
+            --output /tmp/actionlint.tar.gz \
+            https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
+          echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  /tmp/actionlint.tar.gz" \
+            | sha256sum --check --strict
+          tar -xzf /tmp/actionlint.tar.gz -C /tmp actionlint
+          /tmp/actionlint -color
+      - name: Test with coverage
+        run: coverage run -m pytest tests -q && coverage report
+      - name: Build package
+        run: python -m build
+      - name: Check distributions
+        run: python -m twine check dist/*

{cli_router-0.3.0 → cli_router-0.3.1}/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 0.3.1 - 2026-07-19
+
+- Made workflow outcomes fail closed: `run` and `implement` now reject empty resolved stage lists, and `stop_on_failure: false` preserves the first failed stage as the overall result even when later stages succeed.
+- Terminate the full subprocess process group on command timeout so provider helper processes do not survive an exit `124`.
+- Restored home-config-only TUI persistence; project-local and explicit configuration files are no longer silently rewritten.
+- Updated generated Hermes commands to the current non-interactive `hermes --oneshot` interface and corrected Grok `--single` argument ordering.
+- Hardened Doctor repair backends to run tool-free/read-only from an isolated temporary directory without GitHub repository tokens; providers without a safe tool-free mode are excluded.
+- Changed model drift removals to require explicit maintainer confirmation, isolated the patch agent from GitHub credentials, added a strict patch-file allowlist, and removed auto-merge from the watchdog.
+- Added release identity validation, Python 3.14 CI, Ruff, mypy, actionlint, branch-aware coverage, package checks, script tests, and Dependabot configuration.
+
 ## 0.3.0 - 2026-07-13
 
 - Added a `doctor` feature (`cli-router doctor`, `--repair`) to catch agent-CLI drift over time. `doctor` reports each provider's discovery health (CLI present? live model list parses?). With `--repair`, when a provider's CLI is installed and responding but its model list no longer parses, Doctor uses a working agent as an LLM parser — it runs the sick provider's own list command itself, hands only the raw text to the agent, and expects back a JSON array of model ids (LLM-as-parser, never LLM-as-operator). Recovered lists are written to `~/.cli-router/model-cache.yaml` (`cli_router.modelcache.ModelCache`), which layers between live discovery and the static `DEFAULT_MODELS` fallback, so the fix survives across runs without editing source. Model discovery and the TUI model pickers now consult that cache.

{cli_router-0.3.0 → cli_router-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cli-router
-Version: 0.3.0
+Version: 0.3.1
 Summary: A simple Python CLI router for AI planning and coding agents.
 Project-URL: Homepage, https://github.com/coolrazor007/cli-router
 Project-URL: Repository, https://github.com/coolrazor007/cli-router
@@ -18,11 +18,19 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development
 Classifier: Topic :: Utilities
 Requires-Python: >=3.10
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: rich>=13.0
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: coverage[toml]>=7.6; extra == 'dev'
+Requires-Dist: mypy>=1.11; extra == 'dev'
+Requires-Dist: pytest>=8.3; extra == 'dev'
+Requires-Dist: ruff>=0.9; extra == 'dev'
+Requires-Dist: twine>=6.0; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # CLI-Router
@@ -300,8 +308,11 @@ Set `defaults.log_dir` to store these files somewhere else, and `defaults.log_le
 ## Development
 
 ```bash
-python -m pip install -e .
+python -m pip install -e ".[dev]"
 python -m pytest
+ruff check cli_router scripts tests
+mypy cli_router scripts
+coverage run -m pytest tests -q && coverage report
 ```
 
 Build and check a release locally:

{cli_router-0.3.0 → cli_router-0.3.1}/README.md

@@ -273,8 +273,11 @@ Set `defaults.log_dir` to store these files somewhere else, and `defaults.log_le
 ## Development
 
 ```bash
-python -m pip install -e .
+python -m pip install -e ".[dev]"
 python -m pytest
+ruff check cli_router scripts tests
+mypy cli_router scripts
+coverage run -m pytest tests -q && coverage report
 ```
 
 Build and check a release locally:

{cli_router-0.3.0 → cli_router-0.3.1}/cli_router/__init__.py

@@ -1,3 +1,3 @@
 """CLI-Router package."""
 
-__version__ = "0.2.0"
+__version__ = "0.3.1"

{cli_router-0.3.0 → cli_router-0.3.1}/cli_router/cli.py

@@ -21,7 +21,7 @@ def main(argv: Sequence[str] | None = None) -> int:
     try:
         args = parser.parse_args(argv)
     except SystemExit as exc:
-        return int(exc.code)
+        return exc.code if isinstance(exc.code, int) else 1
 
     try:
         config = load_config(args.config)

{cli_router-0.3.0 → cli_router-0.3.1}/cli_router/doctor.py

@@ -27,11 +27,14 @@ reuse it with a different task.
 from __future__ import annotations
 
 import json
+import os
 import re
 import subprocess
+import tempfile
 from collections.abc import Callable, Iterable
 from dataclasses import dataclass, field
 
+from .modelcache import ModelCache
 from .models import (
     DEFAULT_MODELS,
     MODEL_LIST_COMMANDS,
@@ -42,13 +45,13 @@ from .models import (
     _provider_command,
     probe_models,
 )
-from .modelcache import ModelCache
 
 # Discovery during diagnosis is a deliberate setup/repair action, so it can wait
 # longer than the snappy interactive picker for a slow CLI to cold-start.
 DISCOVERY_TIMEOUT_SECONDS = 10.0
 # The doctor agent may need to read a long, messy CLI dump and think about it.
 DOCTOR_TIMEOUT_SECONDS = 120.0
+SAFE_DOCTOR_PROVIDERS = frozenset({"codex", "claude", "grok"})
 
 WhichFn = Callable[[str], str | None]
 # (backend) -> recovered model ids; raises DoctorError when the backend fails.
@@ -76,8 +79,48 @@ class Backend:
         return f"{self.provider}:{self.model or 'default'}"
 
     def command(self, prompt: str) -> list[str]:
-        argv = _provider_command(self.provider, self.model)
-        return [prompt if part == "{prompt}" else part for part in argv]
+        if self.provider == "codex":
+            return [
+                "codex",
+                "exec",
+                "--sandbox",
+                "read-only",
+                "--ephemeral",
+                "--skip-git-repo-check",
+                "--ignore-rules",
+                *(["-m", self.model] if self.model else []),
+                prompt,
+            ]
+        if self.provider == "claude":
+            return [
+                "claude",
+                "-p",
+                *(["--model", self.model] if self.model else []),
+                "--tools",
+                "",
+                "--permission-mode",
+                "plan",
+                "--no-session-persistence",
+                "--safe-mode",
+                prompt,
+            ]
+        if self.provider == "grok":
+            return [
+                "grok",
+                *(["-m", self.model] if self.model else []),
+                "--tools",
+                "",
+                "--permission-mode",
+                "plan",
+                "--no-memory",
+                "--no-subagents",
+                "--disable-web-search",
+                "--max-turns",
+                "1",
+                "--single",
+                prompt,
+            ]
+        raise DoctorError(f"{self.provider} has no tool-free doctor mode")
 
 
 @dataclass(frozen=True)
@@ -202,12 +245,18 @@ def candidate_backends(
     which = which or _default_which
     backends: list[Backend] = []
     for provider in sorted(providers):
+        if provider not in SAFE_DOCTOR_PROVIDERS:
+            continue
         if which(_executable(provider)) is None:
             continue
         models = list(cache.get(provider)) if cache is not None else []
         models += list(DEFAULT_MODELS.get(provider, []))
         seen: set[str] = set()
-        ordered = [m for m in models if not (m in seen or seen.add(m))]
+        ordered: list[str] = []
+        for model in models:
+            if model not in seen:
+                seen.add(model)
+                ordered.append(model)
         for model in ordered or [""]:
             backends.append(Backend(provider, model))
     return backends
@@ -243,7 +292,9 @@ def repair(
     selector = _BackendSelector(chain)
     reports: list[RepairResult] = []
     for h in drifting:
-        task: BackendTask = lambda backend, health=h: _extract_models_for(backend, health, runner)
+        def task(backend: Backend, health: ProviderHealth = h) -> list[str]:
+            return _extract_models_for(backend, health, runner)
+
         try:
             backend, models = selector.run(task, cancelled)
         except (DoctorCancelled, KeyboardInterrupt):
@@ -345,15 +396,27 @@ def run_agent(
     so the selector can fail over to the next candidate.
     """
     argv = backend.command(prompt)
+    env = os.environ.copy()
+    for name in (
+        "GH_TOKEN",
+        "GITHUB_TOKEN",
+        "ACTIONS_RUNTIME_TOKEN",
+        "ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+        "ACTIONS_ID_TOKEN_REQUEST_URL",
+    ):
+        env.pop(name, None)
     try:
-        completed = runner(
-            argv,
-            capture_output=True,
-            text=True,
-            check=False,
-            stdin=subprocess.DEVNULL,
-            timeout=timeout,
-        )
+        with tempfile.TemporaryDirectory(prefix="cli-router-doctor-") as working_dir:
+            completed = runner(
+                argv,
+                capture_output=True,
+                text=True,
+                check=False,
+                stdin=subprocess.DEVNULL,
+                timeout=timeout,
+                cwd=working_dir,
+                env=env,
+            )
     except (OSError, subprocess.TimeoutExpired) as exc:
         raise DoctorError(f"{backend.label} did not run: {exc}") from exc
     if completed.returncode != 0:

{cli_router-0.3.0 → cli_router-0.3.1}/cli_router/failures.py

@@ -4,7 +4,6 @@ from __future__ import annotations
 
 from .runner import ToolRunResult
 
-
 USAGE_LIMIT_PATTERNS = (
     "usage limit",
     "session limit",

{cli_router-0.3.0 → cli_router-0.3.1}/cli_router/logs.py

@@ -32,14 +32,16 @@ def configure_logging(config: RouterConfig) -> logging.Logger:
     logger.setLevel(_log_level(config))
     logger.propagate = False
 
-    for handler in list(logger.handlers):
-        if not getattr(handler, "_cli_router_log_handler", False):
+    for existing_handler in list(logger.handlers):
+        if not getattr(existing_handler, "_cli_router_log_handler", False):
             continue
-        if getattr(handler, "_cli_router_log_path", None) == str(log_path) and not isinstance(handler, logging.NullHandler):
-            handler.setLevel(logger.level)
+        if getattr(existing_handler, "_cli_router_log_path", None) == str(log_path) and not isinstance(
+            existing_handler, logging.NullHandler
+        ):
+            existing_handler.setLevel(logger.level)
             return logger
-        logger.removeHandler(handler)
-        handler.close()
+        logger.removeHandler(existing_handler)
+        existing_handler.close()
 
     try:
         log_dir.mkdir(parents=True, exist_ok=True)

{cli_router-0.3.0 → cli_router-0.3.1}/cli_router/models.py

@@ -77,9 +77,9 @@ def _provider_command(provider: str, model: str = "", effort: str = "") -> list[
     if provider == "claude":
         return ["claude", "-p", *_model_flag("--model", model), *_effort_args(provider, effort), "{prompt}"]
     if provider == "hermes":
-        return ["hermes", "run", "{prompt}"]
+        return ["hermes", "--oneshot", "{prompt}"]
     if provider == "grok":
-        return ["grok", "--single", *_model_flag("-m", model), *_effort_args(provider, effort), "{prompt}"]
+        return ["grok", *_model_flag("-m", model), *_effort_args(provider, effort), "--single", "{prompt}"]
     return [provider, "{prompt}"]