@armadra/agent 0.0.0-stage → 0.2.1

package/dist/cli/subcommands/auth.js

@@ -0,0 +1,91 @@
+/**
+ * `ama auth set|list|remove <provider>`（设计 §3.5、§16.2 B5 验收）。[B5]
+ *
+ * - set：key 从 stdin 读取（TTY 下不回显），不经命令行参数，避免进 shell 历史；写 auth.json 0600。
+ * - list：只列供应商与 key 形态（字面量 / `!command` / `$ENV` 引用），从不输出 key。
+ * - `--auth-file <path>` 改变目标文件（缺省 `<configDir>/auth.json`）。
+ */
+import { resolve } from "node:path";
+import { PROVIDER_ID_PATTERN, defaultAuthFilePath, describeAuthFile, readAuthFile, removeAuthKey, setAuthKey, } from "../../config/auth-file.js";
+import { resolveConfigDir } from "../../config/paths.js";
+import { parseSubArgs, UsageError } from "../args.js";
+import { ExitCode } from "../exit-codes.js";
+export const AUTH_USAGE = `用法：ama auth set <provider> [--auth-file <文件>]   从 stdin 读取 key
+      ama auth list [--auth-file <文件>]
+      ama auth remove <provider> [--auth-file <文件>]
+`;
+const KIND_TEXT = { literal: "key", command: "!命令", "env-ref": "环境变量引用" };
+function providerArg(positionals, action) {
+    const provider = positionals[1];
+    if (provider === undefined)
+        throw new UsageError(`ama auth ${action} 需要 <provider>`);
+    if (positionals.length > 2)
+        throw new UsageError(`多余的参数：${positionals.slice(2).join(" ")}`);
+    if (!PROVIDER_ID_PATTERN.test(provider))
+        throw new UsageError(`供应商 id 不合法：${provider}`);
+    return provider;
+}
+/** 取第一行并去掉首尾空白；stdin 为空返回 ""。 */
+export function extractKey(raw) {
+    const line = raw.split(/\r?\n/).find((l) => l.trim() !== "") ?? "";
+    return line.trim();
+}
+export async function runAuth(argv, io) {
+    const { positionals, values, flags } = parseSubArgs(argv, ["auth-file"]);
+    const action = positionals[0];
+    if (flags.has("help") || action === undefined) {
+        io.stdout(AUTH_USAGE);
+        return flags.has("help") ? ExitCode.Ok : ExitCode.Usage;
+    }
+    const explicit = values.get("auth-file");
+    const path = explicit !== undefined
+        ? resolve(io.cwd, explicit)
+        : defaultAuthFilePath(resolveConfigDir({ env: io.env }));
+    switch (action) {
+        case "set": {
+            const provider = providerArg(positionals, "set");
+            if (io.stdinIsTTY)
+                io.stderr(`输入 ${provider} 的 API key（不回显），回车结束：`);
+            const key = extractKey(await io.readStdin());
+            if (io.stdinIsTTY)
+                io.stderr("\n");
+            if (key === "")
+                throw new UsageError("没有从 stdin 读到 key");
+            setAuthKey(path, provider, key);
+            io.stdout(`已保存 ${provider} 的 key → ${path}（0600）\n`);
+            return ExitCode.Ok;
+        }
+        case "list": {
+            if (positionals.length > 1)
+                throw new UsageError(`多余的参数：${positionals.slice(1).join(" ")}`);
+            const result = readAuthFile(path);
+            for (const warning of result.warnings)
+                io.stderr(`ama: 警告：${warning}\n`);
+            const entries = describeAuthFile(result.file);
+            if (entries.length === 0) {
+                io.stdout(`${path}：没有保存的 key\n`);
+                return ExitCode.Ok;
+            }
+            io.stdout(`${path}\n`);
+            for (const entry of entries) {
+                const extra = [
+                    entry.hasBaseUrl ? "baseUrl" : undefined,
+                    entry.envNames.length > 0 ? `env ${entry.envNames.join(",")}` : undefined,
+                ].filter((x) => x !== undefined);
+                io.stdout(`  ${entry.provider.padEnd(20)} ${KIND_TEXT[entry.kind]}${extra.length > 0 ? ` · ${extra.join(" · ")}` : ""}\n`);
+            }
+            return ExitCode.Ok;
+        }
+        case "remove": {
+            const provider = providerArg(positionals, "remove");
+            if (removeAuthKey(path, provider)) {
+                io.stdout(`已删除 ${provider} 的 key（${path}）\n`);
+                return ExitCode.Ok;
+            }
+            io.stderr(`ama: ${path} 中没有 ${provider}\n`);
+            return ExitCode.RuntimeError;
+        }
+        default:
+            throw new UsageError(`未知的 auth 子命令：${action}`);
+    }
+}

package/dist/cli/subcommands/config.d.ts

@@ -0,0 +1,44 @@
+/**
+ * `ama config show [--json] [--profile <文件>] [--auth-file <文件>]`（设计 §10.0）：打印生效配置，
+ * 每一项标出来自哪一层（default / user / profile / project），并给出将使用的模型与原因
+ * （`config.defaultModel` 或零配置选择）。只读；config 里的字面量 apiKey 只显示种类。[B6]
+ *
+ * [W3-B12] 「供应商」节：config 里出现的供应商与 baseUrl 来自环境变量（`OPENAI_BASE_URL` /
+ * `ANTHROPIC_BASE_URL`）的内置供应商，列出协议、生效 baseUrl 与来源、config 里每个模型的协议
+ * （模型级 `api` 生效后的值）。
+ */
+import type { AmaConfig } from "../../config/types.js";
+import type { Api, ProviderRegistryApi } from "../../ai/types.js";
+import type { CliIo, RuntimeDeps } from "../deps.js";
+export declare const CONFIG_USAGE = "\u7528\u6CD5\uFF1Aama config show [--json] [--profile <\u6587\u4EF6>] [--auth-file <\u6587\u4EF6>]\n";
+type Layer = {
+    name: "default" | "user" | "profile" | "project";
+    label: string;
+    value: unknown;
+};
+/** 叶子路径 → 值（数组与标量是叶子）。 */
+export declare function flatten(value: unknown, prefix?: string, out?: Map<string, unknown>): Map<string, unknown>;
+export interface ModelDescription {
+    ref: string | undefined;
+    reason: string;
+}
+/** 将使用的模型：`defaultModel` → 零配置（第一个有 key / 本地可达的供应商）→ 无。 */
+export declare function describeModel(config: AmaConfig, registry: ProviderRegistryApi | undefined): Promise<ModelDescription>;
+export interface ProviderDescription {
+    id: string;
+    api: Api;
+    baseUrl: string;
+    /** baseUrl 来自的环境变量。 */
+    baseUrlEnv?: string;
+    /** config 里列出的模型及其生效协议。 */
+    models: {
+        id: string;
+        api: Api;
+    }[];
+}
+/** config 里出现的供应商 + baseUrl 来自环境变量的内置供应商。 */
+export declare function describeProviders(config: AmaConfig, registry: ProviderRegistryApi | undefined): ProviderDescription[];
+/** 每个生效叶子的来源：累加型列表列出所有贡献层，其余取最后设置它的层。 */
+export declare function sourcesOf(effective: AmaConfig, layers: readonly Layer[]): Map<string, string>;
+export declare function runConfig(argv: readonly string[], io: CliIo, deps: Pick<RuntimeDeps, "providers"> | undefined): Promise<number>;
+export {};

package/dist/cli/subcommands/config.js

@@ -0,0 +1,201 @@
+/**
+ * `ama config show [--json] [--profile <文件>] [--auth-file <文件>]`（设计 §10.0）：打印生效配置，
+ * 每一项标出来自哪一层（default / user / profile / project），并给出将使用的模型与原因
+ * （`config.defaultModel` 或零配置选择）。只读；config 里的字面量 apiKey 只显示种类。[B6]
+ *
+ * [W3-B12] 「供应商」节：config 里出现的供应商与 baseUrl 来自环境变量（`OPENAI_BASE_URL` /
+ * `ANTHROPIC_BASE_URL`）的内置供应商，列出协议、生效 baseUrl 与来源、config 里每个模型的协议
+ * （模型级 `api` 生效后的值）。
+ */
+import { loadConfigFile } from "../../config/load.js";
+import { DEFAULT_CONFIG, PROFILE_DEFAULTS, mergeProjectAndCli } from "../../config/merge.js";
+import { CONFIG_FILE, projectFile } from "../../config/paths.js";
+import { baseUrlEnvOf } from "../../ai/providers/registry.js";
+import { classifyKeyValue } from "../../config/auth-file.js";
+import { effectiveCodemodeMode, resolvePreset } from "../../tools/presets.js";
+import { builtinTools } from "../../tools/registry.js";
+import { parseSubArgs, UsageError } from "../args.js";
+import { pickDefaultModel } from "../default-model.js";
+import { ExitCode } from "../exit-codes.js";
+import { buildRegistry, loadUserLevel } from "./context.js";
+export const CONFIG_USAGE = `用法：ama config show [--json] [--profile <文件>] [--auth-file <文件>]
+`;
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** 叶子路径 → 值（数组与标量是叶子）。 */
+export function flatten(value, prefix = "", out = new Map()) {
+    if (!isObject(value)) {
+        if (prefix !== "")
+            out.set(prefix, value);
+        return out;
+    }
+    for (const [key, child] of Object.entries(value)) {
+        if (key === "$schema" || (prefix === "" && key === "version"))
+            continue;
+        flatten(child, prefix === "" ? key : `${prefix}.${key}`, out);
+    }
+    return out;
+}
+const ACCUMULATING = new Set([
+    "permission.allow",
+    "permission.deny",
+    "tools.disabled",
+    "skills.dirs",
+]);
+function display(path, value) {
+    if (path.endsWith(".apiKey") && typeof value === "string") {
+        const kind = classifyKeyValue(value);
+        return kind === "literal" ? "<literal key>" : JSON.stringify(value);
+    }
+    return JSON.stringify(value);
+}
+/** 将使用的模型：`defaultModel` → 零配置（第一个有 key / 本地可达的供应商）→ 无。 */
+export async function describeModel(config, registry) {
+    if (config.defaultModel !== undefined)
+        return { ref: config.defaultModel, reason: "config.defaultModel" };
+    if (registry === undefined)
+        return { ref: undefined, reason: "注册表未装配" };
+    const picked = await pickDefaultModel(registry);
+    if (picked === undefined)
+        return { ref: undefined, reason: "没有可用模型：ama auth set <provider> 或设置对应环境变量" };
+    const ref = `${picked.provider.id}/${picked.model.id}`;
+    if (picked.via === "local")
+        return { ref, reason: `零配置：本地 ${picked.provider.id} 可达` };
+    const key = await registry.resolveApiKey(picked.provider.id);
+    const origin = key.origin !== undefined ? ` ${key.origin}` : "";
+    return { ref, reason: `零配置：${picked.provider.id} 有 key（${key.source}${origin}）` };
+}
+/** config 里出现的供应商 + baseUrl 来自环境变量的内置供应商。 */
+export function describeProviders(config, registry) {
+    if (registry === undefined)
+        return [];
+    const out = [];
+    for (const provider of registry.list()) {
+        const configured = config.providers?.[provider.id];
+        const env = baseUrlEnvOf(registry, provider.id);
+        if (configured === undefined && env === undefined)
+            continue;
+        const ids = new Set((configured?.models ?? []).map((m) => m.id));
+        out.push({
+            id: provider.id,
+            api: provider.api,
+            baseUrl: provider.baseUrl,
+            ...(env !== undefined ? { baseUrlEnv: env } : {}),
+            models: provider.models.filter((m) => ids.has(m.id)).map((m) => ({ id: m.id, api: m.api })),
+        });
+    }
+    return out;
+}
+function providerLines(providers) {
+    if (providers.length === 0)
+        return [];
+    const lines = ["", "供应商："];
+    for (const p of providers) {
+        const env = p.baseUrlEnv !== undefined ? `（baseUrl 来自环境变量 ${p.baseUrlEnv}）` : "";
+        lines.push(`  ${p.id}  ${p.api}  ${p.baseUrl}${env}`);
+        for (const m of p.models)
+            lines.push(`    ${p.id}/${m.id}  ${m.api}`);
+    }
+    return lines;
+}
+function layersOf(level, project, effective) {
+    const layers = [{ name: "default", label: "内置缺省", value: DEFAULT_CONFIG }];
+    const user = loadConfigFile("config", level.userConfigPath)?.value;
+    if (user !== undefined)
+        layers.push({ name: "user", label: level.userConfigPath, value: user });
+    if (level.profile !== undefined) {
+        layers.push({ name: "profile", label: level.profile.path, value: PROFILE_DEFAULTS });
+        if (level.profile.config !== undefined)
+            layers.push({
+                name: "profile",
+                label: level.profile.configFile ?? level.profile.path,
+                value: level.profile.config,
+            });
+    }
+    if (project !== undefined) {
+        // 只记被接受的项：生效值与项目级相同的路径才算项目级来源。
+        const flat = flatten(effective);
+        const accepted = {};
+        for (const [path, value] of flatten(project)) {
+            if (JSON.stringify(flat.get(path)) === JSON.stringify(value) || ACCUMULATING.has(path))
+                accepted[path] = value;
+        }
+        layers.push({ name: "project", label: ".ama/config.json", value: unflatten(accepted) });
+    }
+    return layers;
+}
+function unflatten(flat) {
+    const out = {};
+    for (const [path, value] of Object.entries(flat)) {
+        const keys = path.split(".");
+        let node = out;
+        for (const key of keys.slice(0, -1))
+            node = (node[key] ??= {});
+        node[keys.at(-1)] = value;
+    }
+    return out;
+}
+/** 每个生效叶子的来源：累加型列表列出所有贡献层，其余取最后设置它的层。 */
+export function sourcesOf(effective, layers) {
+    const flats = layers.map((l) => ({ name: l.name, flat: flatten(l.value) }));
+    const sources = new Map();
+    for (const path of flatten(effective).keys()) {
+        const setBy = flats.filter((l) => l.flat.has(path)).map((l) => l.name);
+        const names = ACCUMULATING.has(path)
+            ? [...new Set(setBy.filter((n) => n !== "default"))]
+            : setBy.slice(-1);
+        sources.set(path, names.length > 0 ? names.join("+") : "default");
+    }
+    return sources;
+}
+export async function runConfig(argv, io, deps) {
+    const { positionals, values, flags } = parseSubArgs(argv, ["profile", "auth-file"], ["json"]);
+    const action = positionals[0] ?? "show";
+    if (flags.has("help")) {
+        io.stdout(CONFIG_USAGE);
+        return ExitCode.Ok;
+    }
+    if (action !== "show")
+        throw new UsageError(`未知的 config 子命令：${action}`);
+    const level = loadUserLevel(io, {
+        profile: values.get("profile"),
+        authFile: values.get("auth-file"),
+    });
+    const project = loadConfigFile("config", projectFile(io.cwd, CONFIG_FILE))?.value;
+    const merged = mergeProjectAndCli(level.merged, project, undefined);
+    const config = merged.config;
+    const layers = layersOf(level, project, config);
+    const sources = sourcesOf(config, layers);
+    const registry = deps === undefined ? undefined : await buildRegistry(level, io, deps);
+    const model = await describeModel(config, registry);
+    const providers = describeProviders(config, registry);
+    const builtin = new Set(builtinTools().map((tool) => tool.name));
+    const preset = resolvePreset({ config, available: (name) => builtin.has(name) });
+    const warnings = [...level.warnings, ...merged.warnings];
+    if (flags.has("json")) {
+        const entries = [...flatten(config)].map(([path, value]) => ({
+            path,
+            value: path.endsWith(".apiKey") ? display(path, value) : value,
+            source: sources.get(path),
+        }));
+        io.stdout(`${JSON.stringify({ model, providers, tools: preset.builtin, codemode: effectiveCodemodeMode(config), entries, layers: layers.map((l) => ({ name: l.name, file: l.label })), warnings }, null, 2)}\n`);
+        return ExitCode.Ok;
+    }
+    const lines = ["生效配置（来源：default 内置 ← user ← profile ← project 只能收紧）"];
+    for (const layer of layers.slice(1))
+        lines.push(`  ${layer.name}：${layer.label}`);
+    lines.push("");
+    const rows = [...flatten(config)].map(([path, value]) => [`${path} = ${display(path, value)}`, sources.get(path) ?? "default"]);
+    const width = Math.min(60, Math.max(...rows.map(([text]) => text.length)));
+    for (const [text, source] of rows)
+        lines.push(`  ${text.padEnd(width)}  ${source}`);
+    lines.push(...providerLines(providers));
+    lines.push("");
+    lines.push(`模型：${model.ref ?? "（无）"}  ${model.reason}`);
+    lines.push(`工具：${preset.builtin.join(", ")}（预设 ${preset.preset}，codemode ${preset.codemode}）`);
+    for (const warning of [...warnings, ...preset.warnings])
+        lines.push(`警告：${warning}`);
+    io.stdout(`${lines.join("\n")}\n`);
+    return ExitCode.Ok;
+}

package/dist/cli/subcommands/context.d.ts

@@ -0,0 +1,21 @@
+/**
+ * 子命令共用：读用户级配置（+ 可选 profile）并构造供应商注册表。[B5]
+ */
+import type { ProviderRegistryApi } from "../../ai/types.js";
+import { type MergeResult } from "../../config/merge.js";
+import { type ProfileOptions } from "../../config/profile.js";
+import type { CliIo, RuntimeDeps } from "../deps.js";
+export interface UserLevel {
+    configDir: string;
+    dataDir: string;
+    profile?: ProfileOptions;
+    merged: MergeResult;
+    userConfigPath: string;
+    authFile: string;
+    warnings: string[];
+}
+export declare function loadUserLevel(io: CliIo, options?: {
+    profile?: string | undefined;
+    authFile?: string | undefined;
+}): UserLevel;
+export declare function buildRegistry(level: UserLevel, io: CliIo, deps: Pick<RuntimeDeps, "providers">): Promise<ProviderRegistryApi>;

package/dist/cli/subcommands/context.js

@@ -0,0 +1,41 @@
+/**
+ * 子命令共用：读用户级配置（+ 可选 profile）并构造供应商注册表。[B5]
+ */
+import { resolve } from "node:path";
+import { defaultAuthFilePath } from "../../config/auth-file.js";
+import { loadConfigFile } from "../../config/load.js";
+import { mergeBaseLayers } from "../../config/merge.js";
+import { CONFIG_FILE, resolveConfigDir, resolveDataDir, userFile } from "../../config/paths.js";
+import { loadProfile } from "../../config/profile.js";
+export function loadUserLevel(io, options = {}) {
+    const configDir = resolveConfigDir({ env: io.env });
+    const dataDir = resolveDataDir({ env: io.env });
+    const warnings = [];
+    const profile = options.profile === undefined ? undefined : loadProfile(options.profile, io.cwd);
+    if (profile !== undefined)
+        warnings.push(...profile.warnings);
+    const userConfigPath = userFile({ configDir }, CONFIG_FILE);
+    const user = loadConfigFile("config", userConfigPath);
+    if (user !== undefined)
+        warnings.push(...user.warnings);
+    const merged = mergeBaseLayers({
+        user: user?.value,
+        profile: profile?.config,
+        hasProfile: profile !== undefined,
+    });
+    const authFile = options.authFile !== undefined
+        ? resolve(io.cwd, options.authFile)
+        : (profile?.authFile ?? defaultAuthFilePath(configDir));
+    const result = { configDir, dataDir, merged, userConfigPath, authFile, warnings };
+    if (profile !== undefined)
+        result.profile = profile;
+    return result;
+}
+export async function buildRegistry(level, io, deps) {
+    return deps.providers.create({
+        config: level.merged.config,
+        cwd: io.cwd,
+        authFile: level.authFile,
+        authEnv: level.profile?.authEnv ?? true,
+    });
+}

package/dist/cli/subcommands/doctor.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `ama doctor`（设计 §1.2、§6.1、R4、R8）。[B5]
+ *
+ * 输出：目录、配置层级（每层文件存在 / 有效 / 警告）、信任状态与需信任的资源、AGENTS.md、
+ * key 来源（只给来源不给值）、将执行的 Hook 命令（含因未信任被跳过的项目级）、终端能力。
+ * 只读：不询问信任、不写任何文件；配置错误照常列出并以退出码 3 结束。
+ * [W3-B12] baseUrl 来自 `OPENAI_BASE_URL` / `ANTHROPIC_BASE_URL` 时在 key 行后标出变量与地址。
+ */
+import type { CliIo, RuntimeDeps } from "../deps.js";
+export declare const DOCTOR_USAGE = "\u7528\u6CD5\uFF1Aama doctor [--profile <\u6587\u4EF6>] [--auth-file <\u6587\u4EF6>] [--trust | --no-trust]\n";
+export declare function runDoctor(argv: readonly string[], io: CliIo, deps: RuntimeDeps | undefined): Promise<number>;

package/dist/cli/subcommands/doctor.js

@@ -0,0 +1,246 @@
+/**
+ * `ama doctor`（设计 §1.2、§6.1、R4、R8）。[B5]
+ *
+ * 输出：目录、配置层级（每层文件存在 / 有效 / 警告）、信任状态与需信任的资源、AGENTS.md、
+ * key 来源（只给来源不给值）、将执行的 Hook 命令（含因未信任被跳过的项目级）、终端能力。
+ * 只读：不询问信任、不写任何文件；配置错误照常列出并以退出码 3 结束。
+ * [W3-B12] baseUrl 来自 `OPENAI_BASE_URL` / `ANTHROPIC_BASE_URL` 时在 key 行后标出变量与地址。
+ */
+import { existsSync } from "node:fs";
+import { baseUrlEnvOf } from "../../ai/providers/registry.js";
+import { classifyKeyValue, isModeTooOpen, fileMode, readAuthFile } from "../../config/auth-file.js";
+import { findContextFiles } from "../../config/context-files.js";
+import { loadConfigFile, probeConfigFile } from "../../config/load.js";
+import { mergeProjectAndCli } from "../../config/merge.js";
+import { CONFIG_FILE, HOOKS_FILE, projectFile, userFile } from "../../config/paths.js";
+import { findTrustEntry, readTrustFile, trustGatedResources } from "../../config/trust.js";
+import { loadHookConfigs } from "../../hooks/config.js";
+import { AMA_VERSION } from "../../version.js";
+import { parseSubArgs } from "../args.js";
+import { ExitCode } from "../exit-codes.js";
+import { describeModel } from "./config.js";
+import { buildRegistry, loadUserLevel } from "./context.js";
+export const DOCTOR_USAGE = `用法：ama doctor [--profile <文件>] [--auth-file <文件>] [--trust | --no-trust]
+`;
+class Report {
+    lines = [];
+    problems = 0;
+    section(title) {
+        if (this.lines.length > 0)
+            this.lines.push("");
+        this.lines.push(title);
+    }
+    item(text) {
+        this.lines.push(`  ${text}`);
+    }
+    problem(text) {
+        this.problems++;
+        this.lines.push(`  ✗ ${text}`);
+    }
+    text() {
+        return `${this.lines.join("\n")}\n`;
+    }
+}
+function probeLine(report, label, kind, path) {
+    const probe = probeConfigFile(kind, path);
+    if (!probe.exists) {
+        report.item(`${label}：${path}（不存在）`);
+        return;
+    }
+    if (!probe.ok) {
+        report.problem(`${label}：${probe.messages.join("; ")}`);
+        return;
+    }
+    report.item(`${label}：${path}`);
+    for (const message of probe.messages)
+        report.item(`  警告：${message}`);
+}
+function trustSection(report, io, level, flag) {
+    report.section("信任");
+    let trusted = false;
+    let from;
+    if (flag !== undefined) {
+        trusted = flag;
+        from = "命令行";
+    }
+    else if (level.profile?.trustProject === true) {
+        trusted = true;
+        from = "profile.trustProject";
+    }
+    else {
+        try {
+            const entry = findTrustEntry(readTrustFile(level.configDir).entries, io.cwd);
+            trusted = entry?.trusted ?? false;
+            from = entry === undefined ? "缺省：无记录，交互模式会询问" : `trust.json ${entry.path}`;
+        }
+        catch (error) {
+            report.problem(error.message);
+            from = "trust.json 无效";
+        }
+    }
+    report.item(`${io.cwd}：${trusted ? "已信任" : "未信任"}（${from}）`);
+    const gated = trustGatedResources(io.cwd);
+    if (gated.length > 0) {
+        report.item(`需要信任的资源${trusted ? "" : "（当前不加载）"}：`);
+        for (const path of gated)
+            report.item(`  ${path}`);
+    }
+    return trusted;
+}
+async function keySection(report, io, level, deps) {
+    report.section("Key 来源（只显示来源，不显示值）");
+    try {
+        const auth = readAuthFile(level.authFile);
+        const mode = fileMode(level.authFile);
+        if (!auth.exists)
+            report.item(`auth.json：${level.authFile}（不存在）`);
+        else if (isModeTooOpen(mode))
+            report.problem(`auth.json 权限 ${mode?.toString(8)}，应为 600：${level.authFile}`);
+        else
+            report.item(`auth.json：${level.authFile}`);
+    }
+    catch (error) {
+        report.problem(error.message);
+    }
+    if (deps !== undefined) {
+        try {
+            const registry = await buildRegistry(level, io, deps);
+            for (const provider of registry.list()) {
+                const key = await registry.resolveApiKey(provider.id);
+                const text = key.apiKey !== undefined
+                    ? `${key.source}${key.origin !== undefined ? `（${key.origin}）` : ""}`
+                    : provider.requiresApiKey
+                        ? "无"
+                        : "无需";
+                report.item(`${provider.id.padEnd(20)} ${text}`);
+                const env = baseUrlEnvOf(registry, provider.id);
+                if (env !== undefined)
+                    report.item(`${"".padEnd(20)} baseUrl 来自环境变量 ${env}：${provider.baseUrl}（compat 按保守缺省）`);
+            }
+            const model = await describeModel(level.merged.config, registry);
+            report.item(`将使用的模型：${model.ref ?? "（无）"}（${model.reason}）`);
+            return;
+        }
+        catch (error) {
+            report.problem(`供应商注册表：${error.message}`);
+        }
+    }
+    // 未装配注册表：按文件与环境变量名列出能看到的来源。
+    try {
+        for (const [id, entry] of Object.entries(readAuthFile(level.authFile).file.providers)) {
+            report.item(`${id.padEnd(20)} auth-file（${classifyKeyValue(entry.apiKey)}）`);
+        }
+    }
+    catch {
+        // 上面已报告
+    }
+    for (const [id, provider] of Object.entries(level.merged.config.providers ?? {})) {
+        if (provider.apiKey !== undefined) {
+            report.item(`${id.padEnd(20)} config（${classifyKeyValue(provider.apiKey)}）`);
+        }
+    }
+    const envNames = Object.keys(io.env)
+        .filter((n) => /_API_KEY$/.test(n) || n.startsWith("AMA_API_KEY_"))
+        .filter((n) => (io.env[n] ?? "") !== "")
+        .sort();
+    report.item(`环境变量：${envNames.length > 0 ? envNames.join(", ") : "（无）"}`);
+}
+function hookSection(report, io, level, trusted) {
+    report.section("Hook");
+    try {
+        const hooks = loadHookConfigs({
+            configDir: level.configDir,
+            cwd: io.cwd,
+            profileHooksFile: level.profile?.hooksFile,
+            trusted,
+            defaultTimeoutMs: level.merged.config.hooks?.timeoutMs,
+        });
+        if (hooks.hooks.length === 0)
+            report.item("（无）");
+        for (const hook of hooks.hooks) {
+            const matcher = hook.matcher !== undefined ? ` [${hook.matcher}]` : "";
+            report.item(`${hook.source.padEnd(7)} ${hook.event}${matcher} → ${hook.command}（${hook.timeoutMs} ms）`);
+        }
+        if (hooks.skippedProject !== undefined) {
+            report.item(`未信任，跳过：${hooks.skippedProject}`);
+        }
+    }
+    catch (error) {
+        report.problem(error.message);
+    }
+}
+function terminalSection(report, io) {
+    report.section("终端");
+    const env = io.env;
+    report.item(`stdin TTY：${io.stdinIsTTY ? "是" : "否"} · stdout TTY：${io.stdoutIsTTY ? "是" : "否"}`);
+    report.item(`TERM=${env["TERM"] ?? "（未设置）"} · COLORTERM=${env["COLORTERM"] ?? "（未设置）"}`);
+    if (env["NO_COLOR"] !== undefined)
+        report.item("NO_COLOR 已设置：不输出颜色");
+    if (env["TMUX"] !== undefined)
+        report.item("在 tmux 中运行");
+    const columns = process.stdout.columns;
+    if (io.stdoutIsTTY && columns !== undefined)
+        report.item(`尺寸：${columns}×${process.stdout.rows}`);
+    const tui = io.stdinIsTTY && io.stdoutIsTTY && env["TERM"] !== "dumb";
+    report.item(`缺省界面：${tui ? "终端界面" : "行式（--no-tui 等价）"}`);
+}
+export async function runDoctor(argv, io, deps) {
+    const { values, flags } = parseSubArgs(argv, ["profile", "auth-file"], ["trust", "no-trust"]);
+    if (flags.has("help")) {
+        io.stdout(DOCTOR_USAGE);
+        return ExitCode.Ok;
+    }
+    const report = new Report();
+    report.section(`ama ${AMA_VERSION} · Node ${process.version} · ${process.platform}-${process.arch}`);
+    let level;
+    try {
+        level = loadUserLevel(io, {
+            profile: values.get("profile"),
+            authFile: values.get("auth-file"),
+        });
+    }
+    catch (error) {
+        report.problem(error.message);
+        io.stdout(report.text());
+        return ExitCode.Config;
+    }
+    report.section("目录");
+    report.item(`配置目录：${level.configDir}`);
+    report.item(`数据目录：${level.dataDir}${existsSync(level.dataDir) ? "" : "（尚未创建）"}`);
+    report.section("配置层级（缺省 ← 用户级 ← profile ← 项目级（只能收紧）← 命令行）");
+    report.item("缺省：内置");
+    probeLine(report, "用户级", "config", level.userConfigPath);
+    if (level.profile !== undefined) {
+        report.item(`profile：${level.profile.path}`);
+        if (level.profile.configFile !== undefined)
+            probeLine(report, "profile.config", "config", level.profile.configFile);
+    }
+    const projectPath = projectFile(io.cwd, CONFIG_FILE);
+    probeLine(report, "项目级", "config", projectPath);
+    try {
+        const project = loadConfigFile("config", projectPath);
+        const merged = mergeProjectAndCli(level.merged, project?.value, undefined);
+        for (const warning of merged.warnings)
+            report.item(`  收紧：${warning}`);
+        report.item(`有效权限模式：${merged.config.permission?.mode ?? "default"}`);
+    }
+    catch {
+        // probeLine 已报告
+    }
+    for (const warning of level.warnings)
+        report.item(`警告：${warning}`);
+    const flag = flags.has("trust") ? true : flags.has("no-trust") ? false : undefined;
+    const trusted = trustSection(report, io, level, flag);
+    report.section("上下文文件（AGENTS.md，外层在前）");
+    const context = findContextFiles({ cwd: io.cwd, configDir: level.configDir });
+    if (context.files.length === 0)
+        report.item("（无）");
+    for (const file of context.files)
+        report.item(`${file.scope === "user" ? "用户级" : "项目"}  ${file.path}`);
+    await keySection(report, io, level, deps);
+    hookSection(report, io, level, trusted);
+    report.item(`用户级 hooks.json：${userFile(level, HOOKS_FILE)}`);
+    terminalSection(report, io);
+    io.stdout(report.text());
+    return report.problems > 0 ? ExitCode.Config : ExitCode.Ok;
+}