@chengchenccc/oh-my-agent 0.2.0-rc.1 → 0.2.0-rc.2

package/dist/cli/gateway-commands.d.ts

@@ -1,9 +1,14 @@
 /** The gateway domain's verbs. `oma gateway <verb>` is the CLI surface for
  *  backend + web: fetch their artifact, run it, report on it. */
-export declare const GATEWAY_VERBS: readonly ["up", "down", "fetch", "status"];
+export declare const GATEWAY_VERBS: readonly ["up", "down", "fetch", "status", "doctor", "passwd"];
 export type GatewayCommand = (typeof GATEWAY_VERBS)[number];
-export declare const GATEWAY_USAGE = "oma gateway <command>\n\n  up        start backend + web; stays in the foreground (Ctrl-C stops it)\n  up -d     same, but detached: returns once it is healthy\n  down      stop a detached gateway\n  fetch     download, verify and unpack the gateway artifact for a version\n  status    which version is installed, is it running, is it answering\n\n  --version <v>   artifact version for up/fetch (default: oma's own)\n\nNote: 'gateway' is a reserved first word. To send it as a prompt, use\n'oma -p \"gateway ...\"'.";
+export declare const GATEWAY_USAGE = "oma gateway <command>\n\n  up        start backend + web; stays in the foreground (Ctrl-C stops it)\n  up -d     same, but detached: returns once it is healthy\n  down      stop a detached gateway\n  fetch     download, verify and unpack the gateway artifact for a version\n  status    which version is installed, is it running, is it answering\n  doctor    why nothing can run: artifact, tools, catalog, keys, ports, oma bin\n  passwd    replace the login password with a fresh random one\n\n  --version <v>   artifact version for up/fetch (default: oma's own)\n\nNote: 'gateway' is a reserved first word. To send it as a prompt, use\n'oma -p \"gateway ...\"'.";
 export declare function isGatewayCommand(value: string): value is GatewayCommand;
+/** What to tell the operator about logging in. The password is only echoed on
+ *  an interactive terminal: a detached run's stdout is redirected into a log
+ *  file, and a secret must not be filed away there. The pointer is always
+ *  printed, so a missed banner is never a dead end. */
+export declare function credentialLines(home: string, secrets: Record<string, string>, interactive: boolean): string[];
 export interface GatewayCommandOptions {
     home?: string;
     version?: string;
@@ -21,6 +26,13 @@ export declare function runGatewayStatus(opts?: GatewayCommandOptions): Promise<
 /** `oma gateway up`: fetch the version if it is missing, then run the whole gateway in
  *  the foreground (Ctrl-C stops it, children are signalled in reverse order). */
 export declare function runGatewayUp(opts?: GatewayCommandOptions): Promise<number>;
+/** `oma gateway passwd`: rotate the login password. Generated, never read from
+ *  argv — an argument would land in shell history and process listings.
+ *  Takes effect on the next start, because the web component reads it from its
+ *  environment. */
+export declare function runGatewayPasswd(opts?: GatewayCommandOptions): Promise<number>;
+/** `oma gateway doctor`: check the deployment and say how to fix what is wrong. */
+export declare function runGatewayDoctor(opts?: GatewayCommandOptions): Promise<number>;
 /** `oma gateway down`: stop whatever `up -d` started. */
 export declare function runGatewayDown(opts?: GatewayCommandOptions): Promise<number>;
 /** `oma gateway <verb>`: single entry point so the CLI owns one code path. */

package/dist/cli/gateway-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-commands.d.ts","sourceRoot":"","sources":["../../src/cli/gateway-commands.ts"],"names":[],"mappings":"AAqBA;iEACiE;AACjE,eAAO,MAAM,aAAa,4CAA6C,CAAC;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D,eAAO,MAAM,aAAa,ygBAWF,CAAC;AAEzB,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc,CAKvE;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAyBD;qEACqE;AACrE,wBAAsB,eAAe,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBvF;AAED;qEACqE;AACrE,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAuDxF;AAED;iFACiF;AACjF,wBAAsB,YAAY,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCpF;AAED,yDAAyD;AACzD,wBAAsB,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAUtF;AA0DD,8EAA8E;AAC9E,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,cAAc,EACpB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,MAAM,CAAC,CAKjB"}
+{"version":3,"file":"gateway-commands.d.ts","sourceRoot":"","sources":["../../src/cli/gateway-commands.ts"],"names":[],"mappings":"AAwBA;iEACiE;AACjE,eAAO,MAAM,aAAa,gEAAiE,CAAC;AAC5F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D,eAAO,MAAM,aAAa,0pBAaF,CAAC;AAEzB,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc,CAKvE;AAED;;;uDAGuD;AACvD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,WAAW,EAAE,OAAO,GACnB,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAyBD;qEACqE;AACrE,wBAAsB,eAAe,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBvF;AAED;qEACqE;AACrE,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAgExF;AAED;iFACiF;AACjF,wBAAsB,YAAY,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAoCpF;AAED;;;mBAGmB;AACnB,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CA0BxF;AA2BD,mFAAmF;AACnF,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBxF;AAED,yDAAyD;AACzD,wBAAsB,cAAc,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAUtF;AA+DD,8EAA8E;AAC9E,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,cAAc,EACpB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,MAAM,CAAC,CAOjB"}

package/dist/cli/gateway-commands.js

@@ -1,12 +1,14 @@
 import { existsSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
-import { currentVersion, fetchGatewayArtifact, gatewayPaths, installedVersions, omaHome, omaVersion, readSecrets, } from "../core/gateway/artifact.js";
+import { currentVersion, fetchGatewayArtifact, gatewayPaths, generatePassword, installedVersions, omaHome, omaVersion, readSecrets, } from "../core/gateway/artifact.js";
 import { isProcessAlive, readDaemon, startDetachedGateway, stopDetachedGateway, tailDaemonLog, } from "../core/gateway/daemon.js";
+import { diagnoseGateway } from "../core/gateway/doctor.js";
 import { readGatewayManifest } from "../core/gateway/manifest.js";
 import { runGateway } from "../core/gateway/supervisor.js";
 /** The gateway domain's verbs. `oma gateway <verb>` is the CLI surface for
  *  backend + web: fetch their artifact, run it, report on it. */
-export const GATEWAY_VERBS = ["up", "down", "fetch", "status"];
+export const GATEWAY_VERBS = ["up", "down", "fetch", "status", "doctor", "passwd"];
 export const GATEWAY_USAGE = `oma gateway <command>
 
   up        start backend + web; stays in the foreground (Ctrl-C stops it)
@@ -14,6 +16,8 @@ export const GATEWAY_USAGE = `oma gateway <command>
   down      stop a detached gateway
   fetch     download, verify and unpack the gateway artifact for a version
   status    which version is installed, is it running, is it answering
+  doctor    why nothing can run: artifact, tools, catalog, keys, ports, oma bin
+  passwd    replace the login password with a fresh random one
 
   --version <v>   artifact version for up/fetch (default: oma's own)
 
@@ -26,6 +30,18 @@ export function isGatewayCommand(value) {
     }
     return false;
 }
+/** What to tell the operator about logging in. The password is only echoed on
+ *  an interactive terminal: a detached run's stdout is redirected into a log
+ *  file, and a secret must not be filed away there. The pointer is always
+ *  printed, so a missed banner is never a dead end. */
+export function credentialLines(home, secrets, interactive) {
+    const lines = [];
+    const password = secrets.MOCK_PASSWORD;
+    if (password && interactive)
+        lines.push(`login: user-001 / ${password}`);
+    lines.push(`login password: oma gateway status   (or read ${gatewayPaths(home).secrets})`);
+    return lines;
+}
 /** A source checkout runs the gateway from the repo, so the release artifact it
  *  would download is unused. Only stay quiet there: an explicit CLI call still
  *  fetches. `npm_lifecycle_event` is set while a package's postinstall runs. */
@@ -81,6 +97,13 @@ export async function runGatewayStatus(opts = {}) {
     log(`gateway home: ${paths.home}`);
     log(`versions:   ${versions.length > 0 ? versions.join(", ") : "(none installed)"}`);
     log(`current:    ${current ?? "(none)"}`);
+    // Which catalog the gateway's children will read: product runs deliberately
+    // ignore ~/.oma/models.yml (the agent's own bash tool can write there), so a
+    // custom provider only counts when OMA_HOME points at its models.yml.
+    const catalogHome = process.env.OMA_HOME;
+    log(catalogHome
+        ? `catalog:    ${catalogHome}/models.yml via OMA_HOME`
+        : "catalog:    built-in providers only (OMA_HOME unset — a custom models.yml is not read)");
     if (versions.length === 0) {
         log(`install one: oma gateway fetch   (oma ${omaVersion()})`);
         return 1;
@@ -154,8 +177,9 @@ export async function runGatewayUp(opts = {}) {
                 log("");
                 log(`gateway ${handle.manifest.version} is up (${handle.manifest.components.length} processes)`);
                 log(`open http://127.0.0.1:${web?.port ?? 3001}/login`);
-                if (handle.secrets.MOCK_PASSWORD)
-                    log(`login: user-001 / ${handle.secrets.MOCK_PASSWORD}`);
+                for (const line of credentialLines(home, handle.secrets, process.stdout.isTTY === true)) {
+                    log(line);
+                }
                 log("Ctrl-C stops the gateway");
             },
         });
@@ -165,6 +189,73 @@ export async function runGatewayUp(opts = {}) {
         return 1;
     }
 }
+/** `oma gateway passwd`: rotate the login password. Generated, never read from
+ *  argv — an argument would land in shell history and process listings.
+ *  Takes effect on the next start, because the web component reads it from its
+ *  environment. */
+export async function runGatewayPasswd(opts = {}) {
+    const home = opts.home ?? omaHome();
+    const log = loggerFor(opts, "stdout");
+    const secretsPath = gatewayPaths(home).secrets;
+    if (!existsSync(secretsPath)) {
+        log(`no secrets at ${secretsPath} — run 'oma gateway up' once first`);
+        return 1;
+    }
+    const password = generatePassword();
+    const secrets = { ...readSecrets(home), MOCK_PASSWORD: password };
+    await writeFile(secretsPath, `${JSON.stringify(secrets, null, 2)}\n`, { mode: 0o600 });
+    log(`login password replaced: user-001 / ${password}`);
+    // A password set in the console is stored as a hash and wins over this file,
+    // so push the new one there too when the gateway is up — otherwise rotating
+    // here would silently not take effect.
+    const pushed = await pushPasswordToRunningGateway(secrets, password);
+    if (pushed) {
+        log("the running gateway took it too (console-set password updated)");
+    }
+    else {
+        log("restart to apply: oma gateway down && oma gateway up -d");
+        log("note: a password set in the web console wins over this file — change it there if you used that");
+    }
+    return 0;
+}
+/** Update the console-set password (a hash in the backend's settings) when the
+ *  gateway is reachable. Returns false when it is not: the file value then
+ *  applies after the next start. */
+async function pushPasswordToRunningGateway(secrets, password) {
+    const token = secrets.BACKEND_AUTH_TOKEN;
+    if (!token)
+        return false;
+    try {
+        const res = await fetch(`${process.env.BACKEND_URL ?? "http://127.0.0.1:3000"}/api/auth/password`, {
+            method: "PUT",
+            headers: { "content-type": "application/json", "x-auth-token": token },
+            body: JSON.stringify({ password }),
+            signal: AbortSignal.timeout(2000),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/** `oma gateway doctor`: check the deployment and say how to fix what is wrong. */
+export async function runGatewayDoctor(opts = {}) {
+    const home = opts.home ?? omaHome();
+    const log = loggerFor(opts, "stdout");
+    const checks = await diagnoseGateway({ home });
+    log(`oma gateway doctor (home: ${home})`);
+    for (const check of checks) {
+        log(`${check.ok ? "✓" : "✗"} ${check.id.padEnd(9)} ${check.detail}`);
+        if (check.fix)
+            log(`  ${check.ok ? "note" : "fix"}: ${check.fix}`);
+    }
+    const failed = checks.filter((check) => !check.ok);
+    log("");
+    log(failed.length === 0
+        ? "no problems found"
+        : `${failed.length} problem(s): ${failed.map((c) => c.id).join(", ")}`);
+    return failed.length === 0 ? 0 : 1;
+}
 /** `oma gateway down`: stop whatever `up -d` started. */
 export async function runGatewayDown(opts = {}) {
     const home = opts.home ?? omaHome();
@@ -206,12 +297,12 @@ async function startGatewayDetached(opts) {
             try {
                 const res = await fetch(healthUrl, { signal: AbortSignal.timeout(2000) });
                 if (res.ok) {
-                    const password = readSecrets(opts.home).MOCK_PASSWORD;
                     opts.log("");
                     opts.log(`gateway ${opts.version} is up in the background (pid ${daemon.pid})`);
                     opts.log(`open http://127.0.0.1:${web?.port ?? 3001}/login`);
-                    if (password)
-                        opts.log(`login: user-001 / ${password}`);
+                    for (const line of credentialLines(opts.home, readSecrets(opts.home), process.stdout.isTTY === true)) {
+                        opts.log(line);
+                    }
                     opts.log("stop it with: oma gateway down");
                     return 0;
                 }
@@ -238,5 +329,9 @@ export async function runGatewayCommand(verb, opts = {}) {
         return runGatewayDown(opts);
     if (verb === "fetch")
         return runGatewayFetch(opts);
+    if (verb === "doctor")
+        return runGatewayDoctor(opts);
+    if (verb === "passwd")
+        return runGatewayPasswd(opts);
     return runGatewayStatus(opts);
 }

package/dist/core/gateway/artifact.d.ts

@@ -29,7 +29,7 @@ export declare function releaseLocation(version: string, env?: NodeJS.ProcessEnv
 export declare function sha256File(path: string): Promise<string>;
 /** Parse the SHA256SUMS entry for one file (GNU coreutils format). */
 export declare function parseSums(sums: string, fileName: string): string;
-/** Read the launcher's secrets without generating anything (status paths). */
+export declare function generatePassword(): string;
 export declare function readSecrets(home: string): Record<string, string>;
 /** Read the launcher's secrets, generating any missing one. 0600: they
  *  authenticate the local single-user gateway. */
@@ -39,6 +39,8 @@ export interface FetchOptions {
     version?: string;
     env?: NodeJS.ProcessEnv;
     log?: (line: string) => void;
+    /** No-byte allowance before a download is declared dead (test seam). */
+    stallMs?: number;
 }
 export interface FetchResult {
     version: string;

package/dist/core/gateway/artifact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact.d.ts","sourceRoot":"","sources":["../../../src/core/gateway/artifact.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,eAAe,EAAuB,MAAM,eAAe,CAAC;AAE1E,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAM5D,wBAAgB,OAAO,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEpE;AAED;;sDAEsD;AACtD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAkB,GAAG,YAAY,CAUnE;AAED;qDACqD;AACrD,wBAAgB,UAAU,IAAI,MAAM,CAQnC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;oFACoF;AACpF,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,CAMjB;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI9D;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMhE;AA2CD,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBhE;AAED;kDACkD;AAClD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgBjC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;6EAC6E;AAC7E,wBAAsB,oBAAoB,CAAC,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAuDxF;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,EAAE,CAMpE;AAED,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,GAAG,SAAS,CAO3E"}
+{"version":3,"file":"artifact.d.ts","sourceRoot":"","sources":["../../../src/core/gateway/artifact.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,eAAe,EAAuB,MAAM,eAAe,CAAC;AAE1E,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAM5D,wBAAgB,OAAO,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEpE;AAED;;sDAEsD;AACtD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAkB,GAAG,YAAY,CAUnE;AAED;qDACqD;AACrD,wBAAgB,UAAU,IAAI,MAAM,CAQnC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;oFACoF;AACpF,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,CAMjB;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI9D;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMhE;AAiFD,wBAAgB,gBAAgB,IAAI,MAAM,CAYzC;AASD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBhE;AAED;kDACkD;AAClD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBjC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;6EAC6E;AAC7E,wBAAsB,oBAAoB,CAAC,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAuDxF;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,EAAE,CAMpE;AAED,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,GAAG,SAAS,CAO3E"}

package/dist/core/gateway/artifact.js

@@ -56,7 +56,24 @@ export function parseSums(sums, fileName) {
     }
     throw new GatewayArtifactError(`SHA256SUMS has no entry for ${fileName}`);
 }
-async function download(url, dest) {
+/** How long a download may go without delivering a byte before it is called
+ *  dead. A slow-but-moving transfer is fine; a wedged one must not hang an
+ *  install (a postinstall sat for 10 minutes before this existed). */
+const DEFAULT_STALL_MS = 60_000;
+async function withStallTimeout(work, ms, onStall) {
+    let timer;
+    const stall = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(onStall()), ms);
+    });
+    try {
+        return await Promise.race([work, stall]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+async function download(url, dest, stallMs) {
     let res;
     try {
         res = await fetch(url, { redirect: "follow" });
@@ -73,11 +90,17 @@ async function download(url, dest) {
     // also keeps a 60MB artifact out of memory.
     const writer = Bun.file(dest).writer();
     const reader = res.body.getReader();
-    for (;;) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        writer.write(value);
+    try {
+        for (;;) {
+            const { done, value } = await withStallTimeout(reader.read(), stallMs, () => new GatewayArtifactError(`download stalled for ${Math.round(stallMs / 1000)}s at ${url} — check the connection, then retry`));
+            if (done)
+                break;
+            writer.write(value);
+        }
+    }
+    catch (err) {
+        await reader.cancel().catch(() => { });
+        throw err;
     }
     await writer.end();
 }
@@ -99,6 +122,34 @@ async function unpack(tarball, dest) {
     }
 }
 /** Read the launcher's secrets without generating anything (status paths). */
+/** Human-typed login password. Entropy comes from length, not from requiring
+ *  character classes: 22 chars over a 56-symbol alphabet is ~128 bits. The
+ *  alphabet drops look-alikes (l, 1, I, O, 0) and shell-hostile punctuation,
+ *  because the person typing it may be reading it off a terminal on another
+ *  device. */
+const PASSWORD_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
+const PASSWORD_LENGTH = 22;
+export function generatePassword() {
+    // Rejection sampling keeps the alphabet uniform (256 % 56 is not zero).
+    const ceiling = Math.floor(256 / PASSWORD_ALPHABET.length) * PASSWORD_ALPHABET.length;
+    let password = "";
+    while (password.length < PASSWORD_LENGTH) {
+        for (const byte of crypto.getRandomValues(new Uint8Array(PASSWORD_LENGTH))) {
+            if (byte >= ceiling)
+                continue;
+            password += PASSWORD_ALPHABET.charAt(byte % PASSWORD_ALPHABET.length);
+            if (password.length === PASSWORD_LENGTH)
+                break;
+        }
+    }
+    return password;
+}
+/** Internal tokens (backend auth, session signing): never typed, so the cheap
+ *  hex encoding is fine. */
+function generateToken() {
+    const bytes = crypto.getRandomValues(new Uint8Array(24));
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
 export function readSecrets(home) {
     const path = gatewayPaths(home).secrets;
     if (!existsSync(path))
@@ -127,8 +178,9 @@ export async function ensureSecrets(home, names) {
     for (const name of names) {
         if (existing[name])
             continue;
-        const bytes = crypto.getRandomValues(new Uint8Array(24));
-        existing[name] = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+        // MOCK_PASSWORD is the one a human retypes at the login page; the rest are
+        // machine-to-machine tokens.
+        existing[name] = name === "MOCK_PASSWORD" ? generatePassword() : generateToken();
         generated = true;
     }
     if (generated) {
@@ -163,7 +215,7 @@ export async function fetchGatewayArtifact(opts = {}) {
         if (!sums.ok)
             throw new GatewayArtifactError(`${sumsUrl} -> HTTP ${sums.status}`);
         const expected = parseSums(await sums.text(), `oma-gateway-${version}.tar.zst`);
-        await download(tarballUrl, tarball);
+        await download(tarballUrl, tarball, opts.stallMs ?? DEFAULT_STALL_MS);
         const actual = await sha256File(tarball);
         if (actual !== expected) {
             throw new GatewayArtifactError(`checksum mismatch for ${version}: expected ${expected.slice(0, 12)}…, got ${actual.slice(0, 12)}…`);

package/dist/core/gateway/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../../src/core/gateway/daemon.ts"],"names":[],"mappings":"AAaA;mDACmD;AACnD,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAGrD;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CASlE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CASnD;AAED;;;gFAGgF;AAChF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAexD;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;6CAE6C;AAC7C,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CA6B7F;AAED;uBACuB;AACvB,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CA4B7F;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,MAAM,EAAE,CAKhE"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../../src/core/gateway/daemon.ts"],"names":[],"mappings":"AAaA;mDACmD;AACnD,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAGrD;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CASlE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CASnD;AAED;;;gFAGgF;AAChF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAexD;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;6CAE6C;AAC7C,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CA+B7F;AAED;uBACuB;AACvB,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CA4B7F;AAED,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,MAAM,EAAE,CAKhE"}

package/dist/core/gateway/daemon.js

@@ -68,7 +68,9 @@ export async function startDetachedGateway(opts) {
     const gateway = gatewayPaths(opts.home);
     await mkdir(gateway.root, { recursive: true });
     const paths = daemonPaths(opts.home);
-    const logFd = openSync(paths.log, "a");
+    // 0600: the log carries the supervisor's own output, and nothing that runs
+    // unattended should be world-readable.
+    const logFd = openSync(paths.log, "a", 0o600);
     let pid;
     try {
         const proc = Bun.spawn([...opts.command], {

package/dist/core/gateway/doctor.d.ts

@@ -0,0 +1,21 @@
+/** One diagnosis line: what was checked, what was found, and how to fix it. */
+export interface GatewayCheck {
+    id: string;
+    ok: boolean;
+    detail: string;
+    fix?: string;
+}
+export interface DoctorOptions {
+    home?: string;
+    /** Seam for tests: replaces the `oma --list-models` probe. */
+    probeModels?: () => Promise<{
+        providers: string[];
+    }>;
+    /** Seam for tests: replaces the release HEAD probe. Returns the HTTP status,
+     *  or undefined when the host could not be reached. */
+    probeRelease?: (url: string) => Promise<number | undefined>;
+}
+/** Diagnose why a gateway may not be able to run anything: artifact, tools,
+ *  catalog source, runnable providers, ports, and the per-run oma binary. */
+export declare function diagnoseGateway(opts?: DoctorOptions): Promise<GatewayCheck[]>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/core/gateway/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../../src/core/gateway/doctor.ts"],"names":[],"mappings":"AAeA,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACrD;2DACuD;IACvD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC7D;AAoED;6EAC6E;AAC7E,wBAAsB,eAAe,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA2UvF"}

package/dist/core/gateway/doctor.js

@@ -0,0 +1,405 @@
+import { existsSync, readFileSync, statfsSync, statSync } from "node:fs";
+import { rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { currentVersion, gatewayPaths, omaHome, omaVersion, readSecrets, releaseLocation, } from "./artifact.js";
+import { daemonPaths, isProcessAlive, readDaemon } from "./daemon.js";
+import { readGatewayManifest } from "./manifest.js";
+import { resolveOmaBin } from "./supervisor.js";
+/** Provider env names oma's builtin catalog knows (the product backend
+ *  forwards every *_API_KEY, but these work with no models.yml at all). */
+const BUILTIN_KEY_ENVS = [
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "OPENAI_API_KEY",
+    "DEEPSEEK_API_KEY",
+    "GROQ_API_KEY",
+    "OPENROUTER_API_KEY",
+];
+/** Hosts that are not reachable from another machine. */
+const LOOPBACK_HOSTS = ["127.0.0.1", "::1", "localhost"];
+async function probeRunnableProviders() {
+    const entry = resolveOmaBin();
+    const proc = Bun.spawn([entry, "--list-models"], {
+        // Exactly the switches the product backend uses for its children, so the
+        // answer matches what a Run would see.
+        env: { ...process.env, OMA_WORKSPACE_CATALOG: "0" },
+        stdin: "ignore",
+        stdout: "pipe",
+        stderr: "ignore",
+    });
+    const text = await new Response(proc.stdout).text();
+    const code = await proc.exited;
+    if (code !== 0)
+        return { providers: [] };
+    const parsed = JSON.parse(text);
+    if (typeof parsed !== "object" || parsed === null || !("models" in parsed)) {
+        return { providers: [] };
+    }
+    const models = parsed.models;
+    if (!Array.isArray(models))
+        return { providers: [] };
+    const seen = {};
+    for (const model of models) {
+        if (typeof model !== "object" || model === null || !("id" in model))
+            continue;
+        const id = model.id;
+        if (typeof id !== "string")
+            continue;
+        const provider = id.split("/")[0];
+        if (provider)
+            seen[provider] = true;
+    }
+    return { providers: Object.keys(seen).sort() };
+}
+/** `{status:"ok"}` from :3000/health is our backend; anything else on that port
+ *  is somebody else's process. */
+async function backendAnswers(url) {
+    try {
+        const res = await fetch(url, { signal: AbortSignal.timeout(1000) });
+        if (!res.ok)
+            return false;
+        const body = await res.json();
+        return typeof body === "object" && body !== null && "status" in body;
+    }
+    catch {
+        return false;
+    }
+}
+async function anyPortAnswers(url) {
+    try {
+        await fetch(url, { signal: AbortSignal.timeout(1000) });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Diagnose why a gateway may not be able to run anything: artifact, tools,
+ *  catalog source, runnable providers, ports, and the per-run oma binary. */
+export async function diagnoseGateway(opts = {}) {
+    const home = opts.home ?? omaHome();
+    const paths = gatewayPaths(home);
+    const checks = [];
+    // 1. artifact
+    const version = currentVersion(home) ?? omaVersion();
+    const dir = join(paths.versions, version);
+    const manifestPath = join(dir, "gateway.json");
+    let manifest;
+    if (existsSync(manifestPath)) {
+        manifest = readGatewayManifest(manifestPath);
+        checks.push({
+            id: "artifact",
+            ok: true,
+            detail: `${version} installed (${manifest.components.length} components) at ${dir}`,
+        });
+    }
+    else {
+        // A source checkout carries the repo's own version, which was never
+        // published: pointing at it would 404, so say what to do instead.
+        const fromSource = import.meta.filename.endsWith(".ts");
+        checks.push({
+            id: "artifact",
+            ok: false,
+            detail: `no gateway artifact for ${version} at ${dir}`,
+            fix: fromSource
+                ? "running from a checkout: fetch a released version (oma gateway fetch --version <released>), or run the stack from the repo"
+                : `oma gateway fetch --version ${version}`,
+        });
+    }
+    // 2. unpack tools (only needed by fetch)
+    const missingTools = ["tar", "zstd"].filter((tool) => !Bun.which(tool));
+    checks.push({
+        id: "tools",
+        ok: missingTools.length === 0,
+        detail: missingTools.length === 0
+            ? "tar and zstd are on PATH"
+            : `missing: ${missingTools.join(", ")}`,
+        fix: missingTools.length > 0 ? `install: ${missingTools.join(" ")}` : undefined,
+    });
+    // 3. catalog source — informational, but it is the usual reason a custom
+    //    provider is invisible: product children read ONLY $OMA_HOME/models.yml.
+    const catalogHome = process.env.OMA_HOME;
+    const customCatalog = catalogHome ? join(catalogHome, "models.yml") : undefined;
+    if (customCatalog) {
+        checks.push({
+            id: "catalog",
+            ok: true,
+            detail: existsSync(customCatalog)
+                ? `custom catalog: ${customCatalog}`
+                : `OMA_HOME is set but ${customCatalog} does not exist (builtin providers only)`,
+        });
+    }
+    else {
+        checks.push({
+            id: "catalog",
+            ok: true,
+            detail: "OMA_HOME is unset: no models.yml is read, so only builtin providers can be used",
+            fix: "to use a custom provider: put models.yml in a directory and start the gateway with OMA_HOME pointing at it",
+        });
+    }
+    // 4. provider credentials present in THIS environment (what a gateway
+    //    started from here would hand to the backend).
+    const present = BUILTIN_KEY_ENVS.filter((key) => (process.env[key] ?? "").length > 0);
+    checks.push({
+        id: "keys",
+        ok: present.length > 0,
+        detail: present.length > 0
+            ? `provider keys in this environment: ${present.join(", ")}`
+            : "no builtin provider key in this environment",
+        ...(present.length === 0
+            ? {
+                fix: "add one in the web UI (Settings -> Provider keys: stored server-side, no restart), or export it and restart the gateway",
+            }
+            : {}),
+    });
+    // 5. the decisive one: what can actually run, asked the way the backend asks.
+    let providers;
+    try {
+        providers = (await (opts.probeModels ?? probeRunnableProviders)()).providers;
+    }
+    catch (err) {
+        providers = [];
+        checks.push({
+            id: "models",
+            ok: false,
+            detail: `could not list models: ${err instanceof Error ? err.message : String(err)}`,
+            fix: "check that oma runs: oma --list-models",
+        });
+    }
+    if (providers.length > 0) {
+        checks.push({ id: "models", ok: true, detail: `runnable providers: ${providers.join(", ")}` });
+    }
+    else if (checks.every((c) => c.id !== "models")) {
+        checks.push({
+            id: "models",
+            ok: false,
+            detail: "no runnable model: an agent Run would fail here",
+            fix: "for a builtin provider add its key in the web UI (Settings -> Provider keys); for a custom provider put models.yml where OMA_HOME points and restart",
+        });
+    }
+    // 6. download channel — only matters when the artifact is missing.
+    if (!manifest) {
+        const { sums } = releaseLocation(version, process.env);
+        const probe = opts.probeRelease ??
+            (async (url) => {
+                try {
+                    const res = await fetch(url, { method: "HEAD", signal: AbortSignal.timeout(5000) });
+                    return res.status;
+                }
+                catch {
+                    return undefined;
+                }
+            });
+        const status = await probe(sums);
+        if (status === undefined) {
+            checks.push({
+                id: "download",
+                ok: false,
+                detail: `cannot reach the release host: ${sums}`,
+                fix: "check the network/proxy; a slow link shows up as a stalled download when fetching",
+            });
+        }
+        else {
+            // Any HTTP answer means the channel works; a 404 just means this version
+            // was never published (routine in a source checkout).
+            checks.push({
+                id: "download",
+                ok: true,
+                detail: status === 200
+                    ? `release reachable: ${sums}`
+                    : `release host reachable, but ${version} has no release (HTTP ${status})`,
+            });
+        }
+    }
+    // 7. secrets: present, parseable, and not readable by anyone else.
+    const secretsPath = paths.secrets;
+    if (!existsSync(secretsPath)) {
+        checks.push({
+            id: "secrets",
+            ok: true,
+            detail: `no secrets yet at ${secretsPath} (generated on first up)`,
+        });
+    }
+    else {
+        const mode = statSync(secretsPath).mode & 0o777;
+        let parsed;
+        let parseError;
+        try {
+            parsed = readSecrets(home);
+        }
+        catch (err) {
+            parseError = err instanceof Error ? err.message : String(err);
+        }
+        if (parseError) {
+            checks.push({
+                id: "secrets",
+                ok: false,
+                detail: `${secretsPath} is unreadable: ${parseError}`,
+                fix: `fix or delete ${secretsPath} (a new one is generated on the next up)`,
+            });
+        }
+        else {
+            const keys = Object.keys(parsed ?? {});
+            checks.push({
+                id: "secrets",
+                ok: mode === 0o600,
+                detail: `${secretsPath} holds ${keys.join(", ") || "nothing"} (mode ${mode.toString(8)})`,
+                fix: mode === 0o600 ? undefined : `chmod 600 ${secretsPath}`,
+            });
+        }
+    }
+    // 8. data directory: the backend writes its DB, workspaces and workflows here.
+    const dataDir = paths.data;
+    if (!existsSync(dataDir)) {
+        checks.push({
+            id: "data-dir",
+            ok: true,
+            detail: `${dataDir} does not exist yet (created on first up)`,
+        });
+    }
+    else {
+        let writable = true;
+        const probe = join(dataDir, ".doctor-probe");
+        try {
+            await writeFile(probe, "");
+            await rm(probe, { force: true });
+        }
+        catch {
+            writable = false;
+        }
+        let freeMb;
+        try {
+            const fs = statfsSync(dataDir);
+            freeMb = Math.round((Number(fs.bavail) * Number(fs.bsize)) / (1024 * 1024));
+        }
+        catch {
+            freeMb = -1;
+        }
+        const lowSpace = freeMb >= 0 && freeMb < 500;
+        checks.push({
+            id: "data-dir",
+            ok: writable && !lowSpace,
+            detail: writable
+                ? `${dataDir} (free ${freeMb >= 0 ? `${freeMb}MB` : "unknown"})`
+                : `${dataDir} is not writable`,
+            fix: writable && !lowSpace ? undefined : `free space or fix ownership: ${dataDir}`,
+        });
+    }
+    // 9. ports: is our stack answering, or is something else sitting on them?
+    const backendUp = await backendAnswers("http://127.0.0.1:3000/health");
+    const webAnswers = await anyPortAnswers("http://127.0.0.1:3001/login");
+    const daemon = readDaemon(home);
+    const detached = daemon && isProcessAlive(daemon.pid) ? `detached, pid ${daemon.pid}` : "not detached";
+    if (backendUp) {
+        checks.push({
+            id: "ports",
+            ok: true,
+            detail: `${detached}; our backend answers on 3000${webAnswers ? " and 3001 answers too" : ""}`,
+        });
+    }
+    else if (webAnswers) {
+        checks.push({
+            id: "ports",
+            ok: false,
+            detail: `something answers on 3001 but 3000 is not our backend (${detached})`,
+            fix: "stop whatever holds 3001, or start the gateway with different ports",
+        });
+    }
+    else {
+        checks.push({ id: "ports", ok: true, detail: `${detached}; ports quiet` });
+    }
+    // 10. the last start's log: migration failures are the classic first-boot
+    //     death and they only live here.
+    const logPath = daemonPaths(home).log;
+    if (existsSync(logPath)) {
+        const tail = readFileSync(logPath, "utf8").split("\n").slice(-200);
+        const failure = tail.find((line) => line.includes("_journal") ||
+            /\bmigrate\b/i.test(line) ||
+            line.includes("SQLITE_") ||
+            line.includes("no such table"));
+        checks.push({
+            id: "last-start",
+            ok: failure === undefined,
+            detail: failure === undefined
+                ? `${logPath}: no migration or SQLite errors in the last start`
+                : `${logPath} shows: ${failure.trim().slice(0, 120)}`,
+            fix: failure === undefined ? undefined : `read ${logPath} for the full start log`,
+        });
+    }
+    else {
+        checks.push({ id: "last-start", ok: true, detail: "no detached start log yet" });
+    }
+    // 11. exposure: the artifact decides what the components bind.
+    if (manifest) {
+        const hosts = [];
+        for (const component of manifest.components) {
+            const host = component.env.HOSTNAME ?? component.env.BACKEND_HOST;
+            hosts.push(host ?? "unset(0.0.0.0)");
+        }
+        const exposed = hosts.filter((host) => !LOOPBACK_HOSTS.includes(host));
+        const tokenIsDefault = (() => {
+            try {
+                const token = readSecrets(home).BACKEND_AUTH_TOKEN;
+                return token === undefined || token === "dev-token";
+            }
+            catch {
+                return true;
+            }
+        })();
+        if (exposed.length === 0) {
+            checks.push({ id: "exposure", ok: true, detail: "all components bind loopback" });
+        }
+        else {
+            checks.push({
+                id: "exposure",
+                ok: !tokenIsDefault,
+                detail: tokenIsDefault
+                    ? `components bind non-loopback (${exposed.join(", ")}) while the auth token is missing or the documented default`
+                    : `components bind non-loopback (${exposed.join(", ")})`,
+                fix: tokenIsDefault
+                    ? "set a random token before exposing this gateway, and see docs/architecture/security"
+                    : undefined,
+            });
+        }
+    }
+    // 12. which password wins: the console's hash or the launcher's secret.
+    if (backendUp) {
+        try {
+            const token = readSecrets(home).BACKEND_AUTH_TOKEN ?? "";
+            const res = await fetch("http://127.0.0.1:3000/api/auth/password", {
+                headers: { "x-auth-token": token },
+                signal: AbortSignal.timeout(2000),
+            });
+            const body = await res.json();
+            const configured = typeof body === "object" && body !== null && "configured" in body
+                ? body.configured === true
+                : undefined;
+            if (configured !== undefined) {
+                checks.push({
+                    id: "password",
+                    ok: true,
+                    detail: configured
+                        ? "a console-set password exists (it wins over the launcher's)"
+                        : "no console-set password: the launcher's secret is the one that logs in",
+                });
+            }
+        }
+        catch {
+            // The backend answered /health but not this route (older artifact).
+        }
+    }
+    // 13. the binary the backend spawns per Run
+    try {
+        const entry = resolveOmaBin();
+        checks.push({ id: "oma-bin", ok: true, detail: `runs will spawn ${entry}` });
+    }
+    catch (err) {
+        checks.push({
+            id: "oma-bin",
+            ok: false,
+            detail: err instanceof Error ? err.message : String(err),
+            fix: "install oma (npm/bun) or run 'bun run build' in the repo",
+        });
+    }
+    return checks;
+}

package/dist/protocol/transport.d.ts

@@ -365,6 +365,7 @@ export declare const executeCommandSchema: z.ZodObject<{
     }>;
 }, "strip", z.ZodTypeAny, {
     type: "execute";
+    id: string;
     input: {
         run: {
             model: {
@@ -399,9 +400,9 @@ export declare const executeCommandSchema: z.ZodObject<{
             args?: unknown;
         } | undefined;
     };
-    id: string;
 }, {
     type: "execute";
+    id: string;
     input: {
         run: {
             model: {
@@ -436,7 +437,6 @@ export declare const executeCommandSchema: z.ZodObject<{
             args?: unknown;
         } | undefined;
     };
-    id: string;
 }>;
 export type ExecuteCommand = z.infer<typeof executeCommandSchema>;
 export declare const steerCommandSchema: z.ZodObject<{
@@ -458,21 +458,21 @@ export declare const steerCommandSchema: z.ZodObject<{
     }>;
 }, "strip", z.ZodTypeAny, {
     type: "steer";
+    id: string;
     input: {
         message: Record<string, unknown>;
         inputId: string;
         productEntryId?: string | undefined;
     };
-    id: string;
     runId: string;
 }, {
     type: "steer";
+    id: string;
     input: {
         message: Record<string, unknown>;
         inputId: string;
         productEntryId?: string | undefined;
     };
-    id: string;
     runId: string;
 }>;
 export type SteerCommand = z.infer<typeof steerCommandSchema>;
@@ -498,14 +498,14 @@ export declare const resolveApprovalCommandSchema: z.ZodObject<{
     decision: z.ZodEnum<["allow", "deny"]>;
 }, "strip", z.ZodTypeAny, {
     type: "resolve_approval";
-    decision: "deny" | "allow";
     id: string;
+    decision: "deny" | "allow";
     callId: string;
     runId: string;
 }, {
     type: "resolve_approval";
-    decision: "deny" | "allow";
     id: string;
+    decision: "deny" | "allow";
     callId: string;
     runId: string;
 }>;
@@ -682,6 +682,7 @@ export declare const codingAgentCommandSchema: z.ZodDiscriminatedUnion<"type", [
     }>;
 }, "strip", z.ZodTypeAny, {
     type: "execute";
+    id: string;
     input: {
         run: {
             model: {
@@ -716,9 +717,9 @@ export declare const codingAgentCommandSchema: z.ZodDiscriminatedUnion<"type", [
             args?: unknown;
         } | undefined;
     };
-    id: string;
 }, {
     type: "execute";
+    id: string;
     input: {
         run: {
             model: {
@@ -753,7 +754,6 @@ export declare const codingAgentCommandSchema: z.ZodDiscriminatedUnion<"type", [
             args?: unknown;
         } | undefined;
     };
-    id: string;
 }>, z.ZodObject<{
     id: z.ZodString;
     type: z.ZodLiteral<"steer">;
@@ -773,21 +773,21 @@ export declare const codingAgentCommandSchema: z.ZodDiscriminatedUnion<"type", [
     }>;
 }, "strip", z.ZodTypeAny, {
     type: "steer";
+    id: string;
     input: {
         message: Record<string, unknown>;
         inputId: string;
         productEntryId?: string | undefined;
     };
-    id: string;
     runId: string;
 }, {
     type: "steer";
+    id: string;
     input: {
         message: Record<string, unknown>;
         inputId: string;
         productEntryId?: string | undefined;
     };
-    id: string;
     runId: string;
 }>, z.ZodObject<{
     id: z.ZodString;
@@ -809,14 +809,14 @@ export declare const codingAgentCommandSchema: z.ZodDiscriminatedUnion<"type", [
     decision: z.ZodEnum<["allow", "deny"]>;
 }, "strip", z.ZodTypeAny, {
     type: "resolve_approval";
-    decision: "deny" | "allow";
     id: string;
+    decision: "deny" | "allow";
     callId: string;
     runId: string;
 }, {
     type: "resolve_approval";
-    decision: "deny" | "allow";
     id: string;
+    decision: "deny" | "allow";
     callId: string;
     runId: string;
 }>]>;
@@ -1358,7 +1358,6 @@ export declare const modelCatalogResponseSchema: z.ZodObject<{
         };
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
-    backendKind: "omp" | "pi" | "oma" | "claude_code";
     models: {
         id: string;
         reasoning: boolean;
@@ -1374,8 +1373,8 @@ export declare const modelCatalogResponseSchema: z.ZodObject<{
             cacheWrite: number;
         };
     }[];
-}, {
     backendKind: "omp" | "pi" | "oma" | "claude_code";
+}, {
     models: {
         id: string;
         reasoning: boolean;
@@ -1391,6 +1390,7 @@ export declare const modelCatalogResponseSchema: z.ZodObject<{
             cacheWrite: number;
         };
     }[];
+    backendKind: "omp" | "pi" | "oma" | "claude_code";
 }>;
 export type ModelCatalogResponse = z.infer<typeof modelCatalogResponseSchema>;
 //# sourceMappingURL=transport.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chengchenccc/oh-my-agent",
-  "version": "0.2.0-rc.1",
+  "version": "0.2.0-rc.2",
   "private": false,
   "type": "module",
   "bin": {
@@ -21,23 +21,23 @@
     "lint": "biome check . && eslint ."
   },
   "dependencies": {
-    "@chengchenccc/adapter-mcp": "^0.2.0-rc.1",
-    "@chengchenccc/agent-contract": "^0.2.0-rc.1",
-    "@chengchenccc/ai": "^0.2.0-rc.1",
-    "@chengchenccc/config": "^0.2.0-rc.1",
-    "@chengchenccc/message": "^0.2.0-rc.1",
-    "@chengchenccc/sandbox": "^0.2.0-rc.1",
-    "@chengchenccc/source-fetch": "^0.2.0-rc.1",
-    "@chengchenccc/tui": "^0.2.0-rc.1",
+    "@chengchenccc/adapter-mcp": "^0.2.0-rc.2",
+    "@chengchenccc/agent-contract": "^0.2.0-rc.2",
+    "@chengchenccc/ai": "^0.2.0-rc.2",
+    "@chengchenccc/config": "^0.2.0-rc.2",
+    "@chengchenccc/message": "^0.2.0-rc.2",
+    "@chengchenccc/sandbox": "^0.2.0-rc.2",
+    "@chengchenccc/source-fetch": "^0.2.0-rc.2",
+    "@chengchenccc/tui": "^0.2.0-rc.2",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "puppeteer-core": "25.10.0",
     "zod": "^3.23.0"
   },
   "devDependencies": {
-    "@chengchenccc/test-helpers": "^0.2.0-rc.1",
+    "@chengchenccc/test-helpers": "^0.2.0-rc.2",
     "bun-types": "latest",
     "typescript": "^5.7.0",
-    "@chengchenccc/adapter-oma-agent": "^0.2.0-rc.1"
+    "@chengchenccc/adapter-oma-agent": "^0.2.0-rc.2"
   },
   "files": [
     "dist",