v3.8.0

• Reuse: per-harness grants for the logins already on your machine. A signed-in Codex, an OpenCode vision model, or credentials held by pi can now serve as vision engines, each behind one explicit yes recorded as reuse.<claude|codex|opencode|pi> (true grants, false means never ask again, absent means never asked; claude absent counts as granted since claude-cli predates the model, and reuse.claude false now removes it from the chain). pi credentials with an exactly-supported api shape (openai-completions, anthropic-messages) and a printable API key run through the existing inline providers with every guard intact; OAuth logins and other shapes (Responses, Vertex) drive pi itself (pi -p with the @file attachment), and codex (codex exec -i) and opencode (opencode run -f) join as agent routes. Reused engines get no priority: one chain, two regions, speed-class placement only, and every reused answer adds a meta.warnings line naming whose quota it spent. Keys are fetched at call time, live only in memory, and no subprocess output ever travels into an error message.
• The failover chain leads inline everywhere. The local chain becomes gemini-api, openai, anthropic, then antigravity-cli, then claude-cli: a configured key answers in 5-10 seconds while an agent loop takes 15-45, so with both set up the old agent-first order made every read slower than it had to be. A config set provider preference still moves any provider to the front for local images; for remote URLs inline-first stays a security boundary even against a preferred agent, since only the inline download path runs the private-address guards, the magic-byte check, and the size cap.
• Onboarding is one consent conversation, symmetric across harnesses. INSTALL.md's engine step now reads doctor's Reuse section and asks one question per never-asked harness, the harness you are installing into included, so a Codex-only or Pi-only machine gets the same zero-config offer a Claude Code machine always had. The same flow lives in the skill as references/onboard.md for machines where the skill arrived without a config. Refusals are recorded and never re-asked; config show renders the tri-state so the flow can tell.
• doctor tells the whole truth. The Auto section becomes Reuse (per-harness decision plus what discovery found), the failover chains display includes reused routes labeled (reused) so a machine living entirely on granted logins no longer reads as having no engine, and a fully failed chain distinguishes never-asked reusable vision from a grant that stopped working. A stock codex install without a config.toml counts as vision-capable, and a cache timestamp that fails to parse now expires instead of living forever.
• SKILL.md went progressive. 59 lines instead of 164: the trigger contract, the launcher, and the loop stay; machine state is read from doctor and config show at run time, and the heavy flows load on demand from references (find-image.md for the per-harness paste-path branches, onboard.md for first-run setup, configure.md for every key). cli.md and output-schema.md moved to docs/: they are manuals for humans, not run-time knowledge.
• The whole reuse surface passed an independent code acceptance review (run through a reused Codex, fittingly): nine findings fixed, from credential redaction and exact api-shape mapping to preference preservation and the remote security boundary, each with a regression test. 279 tests.