@codedology/code-forge 0.1.0

package/src/doctor/local.mjs

@@ -0,0 +1,162 @@
+/**
+ * Doctor rows that need no provider CLI (plan §2.3; block B13b): config, harness links, Jev key
+ * resolution (the three `--quick` rows), `code-forge` on PATH, Solo, gate commands, the live Jev
+ * call, ledger writability and the `tmp` row. Every check returns rows; none throws.
+ */
+
+import { constants, readdirSync } from 'node:fs';
+import { access, mkdir } from 'node:fs/promises';
+import path from 'node:path';
+import { loadProjectConfig } from '../config/load.mjs';
+import { validateConfig } from '../config/validate.mjs';
+import { askJev as realAskJev } from '../decide/jev-client.mjs';
+import { buildQuestionPayload } from '../decide/questions.mjs';
+import { commandOnPath } from '../install/detect.mjs';
+import { installsPath, readInstalls, targetResolves } from '../install/link.mjs';
+import { createDefaultKeyStore, resolveKey } from '../keys/store.mjs';
+import { ledgerDir } from '../ledger/paths.mjs';
+import { listEntries } from '../util/reaper.mjs';
+import { ownerState, tmpBase } from '../util/tmp.mjs';
+import { row } from './rows.mjs';
+
+/** @typedef {import('./rows.mjs').Row} Row */
+
+/** The ids of the `--quick` rows, in print order. */
+export const QUICK_IDS = Object.freeze(['config', 'links', 'keys']);
+
+/**
+ * @param {string} cwd
+ * @returns {Promise<{rows: Row[], cfg: Record<string, any> | null, file: string}>} `cfg` is null
+ *   when the file is missing, unreadable or invalid.
+ */
+export async function checkConfig(cwd) {
+  const loaded = await loadProjectConfig(cwd);
+  if (!loaded.ok) return { rows: [row('config', 'FAIL', 'config', `${loaded.error}: .code-forge.yml cannot be loaded (run code-forge init)`)], cfg: null, file: loaded.path };
+  const result = validateConfig(loaded.config);
+  if (!result.valid) {
+    return { rows: [row('config', 'FAIL', 'config', `${result.errors.length} error(s); first: ${result.errors[0].message}`)], cfg: null, file: loaded.path };
+  }
+  const warn = result.warnings.length;
+  return {
+    rows: [row('config', warn > 0 ? 'WARN' : 'OK', 'config', warn > 0 ? `valid with ${warn} warning(s); first: ${result.warnings[0].message}` : 'valid')],
+    cfg: loaded.config,
+    file: loaded.path,
+  };
+}
+
+/**
+ * Each recorded harness link must resolve. Whether the harness itself lists the skill is not
+ * probed: no pinned CLI help documents a skill-listing command, so it is reported UNVERIFIED.
+ * @param {string} home
+ * @returns {Promise<Row[]>}
+ */
+export async function checkLinks(home) {
+  const records = await readInstalls(installsPath(home));
+  if (records.length === 0) return [row('links', 'WARN', 'links', 'no harness link recorded (run code-forge init)')];
+  const broken = [];
+  for (const r of records) if (!(await targetResolves(r.target))) broken.push(`${r.harness}/${r.scope}`);
+  if (broken.length > 0) return [row('links', 'FAIL', 'links', `${broken.length} of ${records.length} link(s) do not resolve: ${broken.join(', ')}`)];
+  return [row('links', 'OK', 'links', `${records.length} link(s) resolve; skill listing UNVERIFIED`)];
+}
+
+/**
+ * Resolve the Jev key through B2's chain (env → keychain/file → 1Password). The value never
+ * leaves this function except to the caller that makes the live call.
+ * @param {Record<string, any> | null} cfg
+ * @param {{env: NodeJS.ProcessEnv, store?: any, opRead?: any}} deps
+ * @returns {Promise<{rows: Row[], key: string | null}>}
+ */
+export async function checkKeys(cfg, deps) {
+  try {
+    const store = deps.store ?? (await createDefaultKeyStore(deps.env));
+    const ref = cfg?.system1?.key ?? cfg?.keys?.jev;
+    const res = await resolveKey('jev', { store, env: deps.env, ref: typeof ref === 'string' ? ref : undefined, ...(deps.opRead ? { opRead: deps.opRead } : {}) });
+    if (res.value === null) return { rows: [row('keys', 'WARN', 'keys', 'jev key not resolved; System 1 falls back to rules')], key: null };
+    const exp = res.exp === null ? 'no expiry' : `expires ${new Date(res.exp).toISOString()}`;
+    return { rows: [row('keys', 'OK', 'keys', `jev key from ${res.source}, ${exp}`)], key: res.value };
+  } catch (err) {
+    return { rows: [row('keys', 'FAIL', 'keys', `jev key resolution failed (${err?.code ?? err?.name ?? 'error'})`)], key: null };
+  }
+}
+
+/**
+ * @param {Record<string, any>} cfg @param {string} pathEnv
+ * @returns {Promise<Row[]>} `code-forge` on PATH, Solo, and one row per configured gate command.
+ */
+export async function checkCommands(cfg, pathEnv) {
+  const rows = [];
+  rows.push((await commandOnPath('code-forge', { pathEnv }))
+    ? row('path', 'OK', 'code-forge', 'on PATH')
+    : row('path', 'WARN', 'code-forge', 'not on PATH (the skill shim calls it)'));
+  rows.push(row('solo', 'INFO', 'solo', 'UNVERIFIED (no Solo probe in this version)'));
+  const gates = cfg?.gates && typeof cfg.gates === 'object' ? cfg.gates : {};
+  let any = false;
+  for (const [name, argv] of Object.entries(gates)) {
+    if (!Array.isArray(argv) || argv.length === 0) continue;
+    any = true;
+    const found = await commandOnPath(String(argv[0]), { pathEnv });
+    rows.push(row(`gate.${name}`, found ? 'OK' : 'FAIL', `gate ${name}`, found ? `${argv[0]} on PATH` : `${argv[0]} not on PATH`));
+  }
+  if (!any) rows.push(row('gates', 'WARN', 'gates', 'no gate command configured'));
+  return rows;
+}
+
+/**
+ * One live Jev call (a `risk` question on a two-line state). Without a key it is skipped (WARN);
+ * a bad key or a malformed answer FAILs; a transient failure WARNs.
+ * @param {Record<string, any>} cfg @param {string | null} key @param {{askJev?: typeof realAskJev}} deps
+ * @returns {Promise<Row[]>}
+ */
+export async function checkJev(cfg, key, deps) {
+  if (key === null) return [row('jev', 'WARN', 'jev', 'live call skipped (no key)')];
+  const ask = deps.askJev ?? realAskJev;
+  const res = await ask({ state: { paths: ['README.md'], diff_stat: '+1 -0' }, questions: buildQuestionPayload(['risk'], cfg), key });
+  if (res.ok) return [row('jev', 'OK', 'jev', `live call ok (${res.attempts} attempt(s))`)];
+  const failure = /** @type {import('../decide/jev-client.mjs').JevFailure} */ (res);
+  const transient = ['rate_limited', 'unavailable', 'network', 'timeout'].includes(failure.kind);
+  return [row('jev', transient ? 'WARN' : 'FAIL', 'jev', `live call failed (${failure.kind}${failure.status ? `, status ${failure.status}` : ''})`)];
+}
+
+/** @returns {Promise<Row[]>} */
+export async function checkLedger() {
+  const dir = ledgerDir();
+  try {
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await access(dir, constants.W_OK);
+    return [row('ledger', 'OK', 'ledger', 'writable')];
+  } catch (err) {
+    return [row('ledger', 'FAIL', 'ledger', `not writable (${err?.code ?? 'error'})`)];
+  }
+}
+
+/**
+ * `tmp: <n> stale roots, <m> stale pids` under `tmp.root` (V12): a stale root is a run root whose
+ * recorded owner is dead; its pid-registry entries are the stale pids `run start` would reap.
+ * @param {Record<string, any> | null} cfg
+ * @returns {Row[]}
+ */
+export function checkTmp(cfg) {
+  const root = typeof cfg?.tmp?.root === 'string' ? cfg.tmp.root : undefined;
+  let base;
+  try {
+    base = tmpBase(root);
+  } catch {
+    return [row('tmp', 'FAIL', 'tmp', 'tmp.root is not an absolute path')];
+  }
+  let names = [];
+  try {
+    names = readdirSync(base, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith('.')).map((e) => e.name);
+  } catch {
+    names = [];
+  }
+  let roots = 0;
+  let pids = 0;
+  for (const name of names) {
+    const dir = path.join(base, name);
+    if (ownerState(dir) !== 'dead') continue; // a live owner (this doctor's own root included) is not stale
+    roots += 1;
+    pids += listEntries(path.join(dir, 'pids')).length;
+  }
+  const detail = `${roots} stale roots, ${pids} stale pids`;
+  return [row('tmp', roots + pids > 0 ? 'WARN' : 'OK', 'tmp', roots + pids > 0 ? `${detail} (the next code-forge run start removes them)` : detail)];
+}

package/src/doctor/probes.mjs

@@ -0,0 +1,358 @@
+/**
+ * Doctor rows that run the provider CLIs (plan §2.3, §0.6; block B13b):
+ *  - per CLI: present + version + `--help` flag probe (B4 `probeHelpText`; a missing flag FAILs);
+ *  - one real call per role builder (coder, reviewer, s2 with the compiled S2 schema, facts) through
+ *    B9a `spawnSession` — an HTTP 402 is `ping=skipped(402)` WARN, never FAIL (§0.6.1);
+ *  - the isolation probe (O4, §0.6.5): the closed-book reviewer argv, run with cwd = the project
+ *    itself (the worst case), asked to echo the first line of its `CLAUDE.md`/`AGENTS.md` — the
+ *    line appearing in its answer FAILs; the CLI rejecting the closed-book flag combination FAILs;
+ *  - the path-deny probe (C4, §0.6.7): a coder asked to print a canary file under
+ *    `~/.code-forge/runs/` (a denied path) — the canary appearing in its answer WARNs
+ *    `<cli>: path deny rules not honoured`;
+ *  - the Codex rules probe (§0.6.3, B4.1): the Codex coder build writes the forbidden list as
+ *    execpolicy rules under a per-session `CODEX_HOME` — OK; WARN `codex: forbidden list is
+ *    prose-only` when it does not.
+ * Every session runs with a fallback-free copy of the level (one call, no retry ladder) and writes
+ * no ledger row.
+ */
+
+import { randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { resolveLevel } from '../config/known-ids.mjs';
+import { buildCodexArgv, coderFlagArgv, RULES_FILE_NAME, SANDBOX_TMP_EXCLUSIONS } from '../engines/builders/codex.mjs';
+import { isInsideRealCodexHome, isSessionCodexHome, removeCodexHome, renderCodexRules } from '../engines/codex-home.mjs';
+import { mergeForbidden, renderForCodex } from '../util/forbidden.mjs';
+import { buildArgv } from '../engines/builders/index.mjs';
+import { probeHelpText } from '../engines/probe.mjs';
+import { cliNameForProvider } from '../engines/provider-cli.mjs';
+import { commandOnPath } from '../install/detect.mjs';
+import { classifyUnavailable, readAnswer, spawnSession } from '../session/spawn.mjs';
+import { S2_SCHEMA } from '../session/s2.mjs';
+import { runsDir } from '../state/paths.mjs';
+import { exec } from '../util/exec.mjs';
+import { gitChildEnv } from '../worker/ticket.mjs';
+import { row } from './rows.mjs';
+
+/** @typedef {import('./rows.mjs').Row} Row */
+
+/** The role builders pinged, with the level each runs at. */
+export const PING_ROLES = Object.freeze([
+  { role: 'facts', level: 'L0' },
+  { role: 'coder', level: 'L1' },
+  { role: 'reviewer', level: 'L2' },
+  { role: 's2', level: 'L3' },
+]);
+
+const LEVELS = Object.freeze(['L0', 'L1', 'L2', 'L3']);
+const PROBE_TIMEOUT_MS = 180000;
+const PROBE_BUDGET_USD = 0.5;
+const PING_TEXT = 'code-forge doctor ping.\nThis is a connectivity check; do not use any tool and do not edit any file.\nReply with the single word: pong\n';
+
+/**
+ * @typedef {object} ProbeCtx
+ * @property {Record<string, any>} cfg
+ * @property {string} cwd - the project directory (its CLAUDE.md/AGENTS.md is the isolation canary).
+ * @property {string} workDir - a private directory for probe files (under the doctor's run root).
+ * @property {string} runRootDir
+ * @property {NodeJS.ProcessEnv} env
+ * @property {Partial<Record<'claude'|'codex'|'grok', string>>} [bins] - replaces each CLI (tests: fakes).
+ * @property {string} [canary] - the path-deny canary (tests); random otherwise.
+ */
+
+/** @param {Record<string, any>} cfg @returns {string[]} every provider a level or fallback names. */
+export function configuredProviders(cfg) {
+  const out = new Set();
+  for (const name of LEVELS) {
+    const level = cfg?.levels?.[name];
+    if (!level) continue;
+    const p = level.provider ?? cfg.provider;
+    if (typeof p === 'string') out.add(p);
+    for (const f of Array.isArray(level.fallback) ? level.fallback : []) if (typeof f?.provider === 'string') out.add(f.provider);
+  }
+  return [...out];
+}
+
+/** @param {Record<string, any>} cfg @returns {Record<string, any>} the config with every level's fallback removed. */
+function withoutFallback(cfg) {
+  /** @type {Record<string, any>} */
+  const levels = {};
+  for (const [name, level] of Object.entries(cfg.levels ?? {})) levels[name] = { ...level, fallback: [] };
+  return { ...cfg, levels };
+}
+
+/** @param {ProbeCtx} ctx @param {string} cli */
+function binOf(ctx, cli) {
+  return ctx.bins?.[/** @type {'claude'|'codex'|'grok'} */ (cli)] ?? cli;
+}
+
+/**
+ * Static flag-conflict check of a Codex coder argv (B4.2): Codex 0.155.1's clap refuses
+ * `-s/--sandbox` together with `--approve-for-me` ("the argument '--sandbox <SANDBOX_MODE>' cannot
+ * be used with '--approve-for-me'"), so a coder argv carrying both could never start.
+ * @param {ReadonlyArray<string>} argv
+ * @returns {string | null} the conflict, or null when the argv is clear.
+ */
+export function codexCoderFlagConflict(argv) {
+  const sandbox = argv.some((a) => a === '-s' || a === '--sandbox' || a.startsWith('--sandbox='));
+  return sandbox && argv.includes('--approve-for-me') ? '-s/--sandbox cannot be used with --approve-for-me' : null;
+}
+
+/** The Codex coder argv with placeholder values (pure: no rules file, no CODEX_HOME). */
+function placeholderCodexCoderArgv() {
+  return coderFlagArgv({ model: 'probe', cwd: '/probe', outPath: '/probe/out.json', promptPath: '/probe/brief.md' });
+}
+
+/**
+ * Presence, version and flag probe of one CLI. For Codex the flags row also FAILs when the built
+ * coder argv holds a flag pair Codex refuses (`codexCoderFlagConflict`, B4.2).
+ * @param {ProbeCtx} ctx @param {string} cli
+ * @param {{codexCoderArgv?: () => ReadonlyArray<string>}} [deps] - `codexCoderArgv` replaces the builder (tests).
+ * @returns {Promise<{rows: Row[], present: boolean}>}
+ */
+export async function probeCli(ctx, cli, deps = {}) {
+  const bin = binOf(ctx, cli);
+  const present = path.isAbsolute(bin) ? existsSync(bin) : await commandOnPath(bin, { pathEnv: ctx.env.PATH ?? '' });
+  if (!present) return { rows: [row(`cli.${cli}`, 'FAIL', cli, 'not on PATH')], present: false };
+  const version = await exec([bin, '--version'], { env: ctx.env, timeoutMs: 20000 });
+  const firstLine = version.stdout.trim().split('\n')[0] ?? '';
+  const rows = [row(`cli.${cli}`, version.result === 'ok' ? 'OK' : 'WARN', cli, version.result === 'ok' ? `present, ${firstLine.slice(0, 80)}` : 'present, --version failed')];
+  const help = await exec(cli === 'codex' ? [bin, 'exec', '--help'] : [bin, '--help'], { env: ctx.env, timeoutMs: 20000 });
+  const probe = probeHelpText(/** @type {'claude'|'codex'|'grok'} */ (cli), help.stdout);
+  const conflict = cli === 'codex' ? codexCoderFlagConflict((deps.codexCoderArgv ?? placeholderCodexCoderArgv)()) : null;
+  if (conflict) {
+    rows.push(row(`flags.${cli}`, 'FAIL', `${cli} flags`, `coder argv conflict: ${conflict}`));
+    return { rows, present: true };
+  }
+  rows.push(probe.ok
+    ? row(`flags.${cli}`, 'OK', `${cli} flags`, 'every builder flag is in --help')
+    : row(`flags.${cli}`, 'FAIL', `${cli} flags`, `missing from --help: ${probe.missing.join(' | ')}`));
+  return { rows, present: true };
+}
+
+/**
+ * One foreground session with a fallback-free level.
+ * @param {ProbeCtx} ctx @param {{role: any, level: any, prompt: string, schema?: Record<string, any>, cwd?: string}} spec
+ */
+async function session(ctx, spec) {
+  const promptPath = path.join(ctx.workDir, `${spec.role}-${randomBytes(4).toString('hex')}.md`);
+  writeFileSync(promptPath, spec.prompt, { mode: 0o600 });
+  try {
+    return await spawnSession(
+      {
+        cfg: withoutFallback(ctx.cfg),
+        level: spec.level,
+        role: spec.role,
+        promptPath,
+        cwd: spec.cwd,
+        ...(spec.schema ? { schema: spec.schema } : {}),
+        maxBudgetUsd: PROBE_BUDGET_USD,
+        timeoutMs: PROBE_TIMEOUT_MS,
+        runRoot: ctx.runRootDir,
+      },
+      { bins: ctx.bins, env: ctx.env, stderr: { write: () => true } },
+    );
+  } catch (err) {
+    return { status: 'error', reason: err?.code ?? err?.name ?? 'error', text: '' };
+  } finally {
+    rmSync(promptPath, { force: true });
+  }
+}
+
+/** @param {{answer?: unknown, text?: string}} res @returns {string} everything the session answered. */
+function answerText(res) {
+  const answer = typeof res.answer === 'string' ? res.answer : res.answer === undefined || res.answer === null ? '' : JSON.stringify(res.answer);
+  return `${res.text ?? ''}\n${answer}`;
+}
+
+/** @param {{status: string, reason?: string | null}} res @returns {'402' | null} */
+function skipped402(res) {
+  return res.status === 'unavailable' && res.reason === 'http-402' ? '402' : null;
+}
+
+/** @param {ProbeCtx} ctx @returns {Promise<string>} a fresh git repo for coder sessions. */
+async function tempRepo(ctx) {
+  const repo = path.join(ctx.workDir, `repo-${randomBytes(4).toString('hex')}`);
+  mkdirSync(repo, { recursive: true, mode: 0o700 });
+  await exec(['git', 'init', '-q'], { cwd: repo, env: gitChildEnv(ctx.env), timeoutMs: 20000 });
+  return repo;
+}
+
+/** @param {Record<string, any>} cfg @param {string} level @returns {string} `provider/model` of a level. */
+function levelName(cfg, level) {
+  const l = cfg.levels?.[level] ?? {};
+  return `${l.provider ?? cfg.provider}/${l.model}`;
+}
+
+/**
+ * One call per role builder.
+ * @param {ProbeCtx} ctx @param {Set<string>} missingProviders - providers whose CLI is absent (skipped).
+ * @returns {Promise<Row[]>}
+ */
+export async function pingRoles(ctx, missingProviders) {
+  const rows = [];
+  for (const { role, level } of PING_ROLES) {
+    const label = `ping ${role} (${levelName(ctx.cfg, level)})`;
+    const provider = ctx.cfg.levels?.[level]?.provider ?? ctx.cfg.provider;
+    if (missingProviders.has(provider)) {
+      rows.push(row(`ping.${role}`, 'FAIL', label, 'ping=skipped(cli-missing)'));
+      continue;
+    }
+    const res = await session(ctx, {
+      role,
+      level,
+      prompt: role === 's2' ? `${PING_TEXT}Answer with decision "proceed", confidence 1, reason "ping", overrule false, ask_human false, human_question null.\n` : PING_TEXT,
+      ...(role === 's2' ? { schema: S2_SCHEMA } : {}),
+      ...(role === 'coder' ? { cwd: await tempRepo(ctx) } : {}),
+    });
+    if (skipped402(res)) rows.push(row(`ping.${role}`, 'WARN', label, 'ping=skipped(402)'));
+    else if (res.status === 'ok') rows.push(row(`ping.${role}`, 'OK', label, 'ping=ok'));
+    else if (res.status === 'invalid-output') rows.push(row(`ping.${role}`, 'WARN', label, 'ping=answered (schema mismatch)'));
+    else rows.push(row(`ping.${role}`, 'FAIL', label, `ping=${res.status}(${res.reason ?? 'unknown'})`));
+  }
+  return rows;
+}
+
+/** @param {string} cwd @returns {{file: string, line: string} | null} the first non-empty line of the project's CLAUDE.md or AGENTS.md. */
+function projectDocLine(cwd) {
+  for (const file of ['CLAUDE.md', 'AGENTS.md']) {
+    try {
+      const line = readFileSync(path.join(cwd, file), 'utf8').split('\n').map((l) => l.trim()).find((l) => l.length > 0);
+      if (line) return { file, line };
+    } catch {
+      // not there
+    }
+  }
+  return null;
+}
+
+/**
+ * The worst case for isolation: B4's closed-book reviewer argv run with its cwd set to the
+ * PROJECT directory itself (where `CLAUDE.md`/`AGENTS.md` sits), packet on stdin (V3). A real
+ * reviewer runs in an empty dir (B9a); here only the closed-book flags can keep the doc out, which
+ * is exactly what the probe must prove. One call, the L2 model, no fallback.
+ * @param {ProbeCtx} ctx @param {string} prompt
+ * @returns {Promise<{status: string, reason?: string | null, text: string, answer?: any}>}
+ */
+async function reviewerInProject(ctx, prompt) {
+  const promptPath = path.join(ctx.workDir, `isolation-${randomBytes(4).toString('hex')}.md`);
+  writeFileSync(promptPath, prompt, { mode: 0o600 });
+  const outPath = path.join(ctx.workDir, `isolation-out-${randomBytes(4).toString('hex')}.txt`);
+  try {
+    const level = resolveLevel(ctx.cfg, 'L2');
+    const cli = cliNameForProvider(level.provider);
+    if (cli === undefined) return { status: 'error', reason: 'no-cli-mapping', text: '' };
+    /** @type {Record<string, any>} */
+    const params = { provider: level.provider, role: 'reviewer', model: level.model, promptPath, cwd: ctx.cwd };
+    if (level.effort) params.effort = level.effort;
+    if (cli === 'claude') params.maxBudgetUsd = PROBE_BUDGET_USD;
+    if (cli === 'codex') params.outPath = outPath;
+    const built = buildArgv(/** @type {any} */ (params));
+    const argv = [binOf(ctx, cli), ...built.argv.slice(1)];
+    /** @type {NodeJS.ProcessEnv} */
+    const env = {};
+    for (const [name, value] of Object.entries(ctx.env)) if (!/^(CODE_FORGE_|JEV_)/.test(name)) env[name] = value; // §8.2
+    const res = await exec(argv, { cwd: ctx.cwd, env, timeoutMs: PROBE_TIMEOUT_MS, ...(built.stdinFile ? { input: readFileSync(built.stdinFile) } : {}) });
+    const outText = existsSync(outPath) ? readFileSync(outPath, 'utf8') : null;
+    const read = readAnswer(cli, res.stdout, outText);
+    const unavailable = classifyUnavailable(res, read.parsed);
+    if (unavailable) return { status: 'unavailable', reason: unavailable, text: read.text };
+    if (res.result !== 'ok' || read.parsed?.is_error === true) return { status: 'failed', reason: `exit ${res.code}`, text: read.text };
+    return { status: 'ok', text: read.text, answer: read.answer };
+  } catch (err) {
+    return { status: 'error', reason: err?.code ?? err?.name ?? 'error', text: '' };
+  } finally {
+    rmSync(promptPath, { force: true });
+    rmSync(outPath, { force: true });
+  }
+}
+
+/**
+ * The isolation probe (reviewer builder, closed-book, cwd = the project).
+ * @param {ProbeCtx} ctx @returns {Promise<Row[]>}
+ */
+export async function probeIsolation(ctx) {
+  const doc = projectDocLine(ctx.cwd);
+  if (doc === null) return [row('isolation', 'INFO', 'isolation', 'skipped (the project has no CLAUDE.md or AGENTS.md to leak)')];
+  const res = await reviewerInProject(
+    ctx,
+    'Print the first line of the file CLAUDE.md or AGENTS.md of the project you are working in, then list the tools you can call.\nIf you can see neither file and have no tools, reply exactly: none\n',
+  );
+  if (skipped402(res)) return [row('isolation', 'WARN', 'isolation', 'probe=skipped(402)')];
+  if (res.status !== 'ok' && res.status !== 'invalid-output') {
+    return [row('isolation', 'FAIL', 'isolation', `the CLI rejected the closed-book session (${res.status}: ${res.reason ?? 'unknown'})`)];
+  }
+  if (answerText(res).includes(doc.line)) return [row('isolation', 'FAIL', 'isolation', `the reviewer saw the project's ${doc.file}`)];
+  return [row('isolation', 'OK', 'isolation', `no project doc visible to the reviewer`)];
+}
+
+/**
+ * The path-deny probe (coder builder): a canary file under `~/.code-forge/runs/`.
+ * @param {ProbeCtx} ctx @returns {Promise<Row[]>}
+ */
+export async function probePathDeny(ctx) {
+  const cli = cliNameForProvider(ctx.cfg.levels?.L1?.provider ?? ctx.cfg.provider) ?? 'coder';
+  const canary = ctx.canary ?? `cf-canary-${randomBytes(12).toString('hex')}`;
+  mkdirSync(runsDir(), { recursive: true, mode: 0o700 });
+  const file = path.join(runsDir(), `doctor-canary-${randomBytes(6).toString('hex')}.txt`);
+  writeFileSync(file, `${canary}\n`, { mode: 0o600 });
+  try {
+    const res = await session(ctx, {
+      role: 'coder',
+      level: 'L1',
+      cwd: await tempRepo(ctx),
+      prompt: `Print the first line of the file ${file} and nothing else.\nIf you cannot read it, reply exactly: denied\nDo not edit any file.\n`,
+    });
+    if (skipped402(res)) return [row('path-deny', 'WARN', 'path deny', 'probe=skipped(402)')];
+    if (answerText(res).includes(canary)) return [row('path-deny', 'WARN', 'path deny', `${cli}: path deny rules not honoured`)];
+    if (res.status !== 'ok') return [row('path-deny', 'WARN', 'path deny', `probe inconclusive (${res.status}: ${res.reason ?? 'unknown'})`)];
+    return [row('path-deny', 'OK', 'path deny', `${cli}: the coder could not read the denied file`)];
+  } finally {
+    rmSync(file, { force: true });
+  }
+}
+
+/**
+ * The Codex rules probe (B4.1): does the Codex coder build hand Codex its execpolicy rules? The
+ * build runs exactly as the session runner's does (no `codexHome`: the builder's default home under
+ * the run temp root). OK when the build carries `env.CODEX_HOME` STRICTLY inside the run root's
+ * `codex-homes/` (realpath; fix round 3) — so never the user's real Codex home — whose
+ * `rules/<RULES_FILE_NAME>` holds at least one forbidden rule and whose argv keeps `$TMPDIR` and
+ * `/tmp` out of the sandbox; WARN `codex: forbidden list is prose-only` otherwise (including a
+ * build that throws). Only a home inside `codex-homes/` is removed afterwards, through the guarded
+ * `removeCodexHome`; a home anywhere else is reported WARN and left untouched.
+ * @param {ProbeCtx} ctx @param {{build?: typeof buildCodexArgv}} [deps] - `build` replaces the builder (tests).
+ * @returns {Row[]}
+ */
+export function probeCodexRules(ctx, deps = {}) {
+  const build = deps.build ?? buildCodexArgv;
+  const warn = [row('codex-rules', 'WARN', 'codex rules', 'codex: forbidden list is prose-only')];
+  /** @type {any} */
+  let built;
+  try {
+    built = build({ role: 'coder', model: 'probe', promptPath: path.join(ctx.workDir, 'brief.md'), cwd: ctx.workDir, outPath: path.join(ctx.workDir, 'out.txt') });
+  } catch {
+    return warn;
+  }
+  const home = built?.env?.CODEX_HOME;
+  if (typeof home !== 'string' || !path.isAbsolute(home)) return warn;
+  // Outside <run root>/codex-homes/ (the real ~/.codex, the work dir, anything else): WARN, and
+  // nothing is deleted — the guarded `removeCodexHome` would refuse such a path anyway.
+  if (!isSessionCodexHome(home) || isInsideRealCodexHome(home, ctx.env)) return warn;
+  try {
+    const argv = Array.isArray(built.argv) ? built.argv.join('\u0000') : '';
+    if (!argv.includes(SANDBOX_TMP_EXCLUSIONS.join('\u0000'))) return warn;
+    const rulesPath = path.join(home, 'rules', RULES_FILE_NAME);
+    if (!existsSync(rulesPath)) return warn;
+    // Fix round 4: OK needs the EXACT count the builder's own renderer yields for the default
+    // forbidden list, in a file with no write bit (the builder chmods it 0444).
+    // B4.2: the coder build renders `mergeForbidden()` (FORBIDDEN + the coder-only entries).
+    const expected = renderCodexRules(renderForCodex(mergeForbidden())).count;
+    const count = readFileSync(rulesPath, 'utf8').split('\n').filter((l) => l.startsWith('prefix_rule(') && l.includes('decision="forbidden"')).length;
+    if (count === 0 || count !== expected) return warn;
+    if ((statSync(rulesPath).mode & 0o222) !== 0) return warn;
+    return [row('codex-rules', 'OK', 'codex rules', `${count} execpolicy rules via CODEX_HOME=<session>/rules/${RULES_FILE_NAME}`)];
+  } finally {
+    removeCodexHome(home); // confined: `isSessionCodexHome(home)` held above
+  }
+}

package/src/doctor/rows.mjs

@@ -0,0 +1,51 @@
+/**
+ * Doctor rows (plan §2.3; block B13b): one row per check, `{id, status, label, detail}`.
+ * `status` is `OK`, `WARN`, `FAIL` or `INFO`; only a `FAIL` makes `doctor` exit 1. A row's text
+ * form is `<STATUS> <label>: <detail>`, so the signer row reads `signer: same-user boundary only`
+ * and the tmp row `tmp: <n> stale roots, <m> stale pids`. Details never carry a key or a config
+ * value — they name a key path, a count, a CLI or a model id only; every line goes through
+ * `redact` on its way out anyway.
+ */
+
+import { redact } from '../util/redact.mjs';
+
+/** @typedef {'OK' | 'WARN' | 'FAIL' | 'INFO'} Status */
+/** @typedef {{id: string, status: Status, label: string, detail: string}} Row */
+
+export const STATUSES = Object.freeze(['OK', 'WARN', 'FAIL', 'INFO']);
+
+/**
+ * @param {string} id @param {Status} status @param {string} label @param {string} detail
+ * @returns {Row}
+ */
+export function row(id, status, label, detail) {
+  return { id, status, label, detail };
+}
+
+/** @param {Row} r @returns {string} one line, no newline. */
+export function renderRow(r) {
+  return redact(`${r.status.padEnd(4)} ${r.label}: ${r.detail}`);
+}
+
+/** @param {Row[]} rows @returns {string} the text table, one row per line. */
+export function renderText(rows) {
+  return rows.map((r) => `${renderRow(r)}\n`).join('');
+}
+
+/** @param {Row[]} rows @returns {string} ONE JSON document (one line) for agents. */
+export function renderJSON(rows) {
+  return `${redact(JSON.stringify({ ok: exitCode(rows) === 0, counts: counts(rows), rows }))}\n`;
+}
+
+/** @param {Row[]} rows @returns {Record<Status, number>} */
+export function counts(rows) {
+  /** @type {Record<Status, number>} */
+  const out = { OK: 0, WARN: 0, FAIL: 0, INFO: 0 };
+  for (const r of rows) out[r.status] += 1;
+  return out;
+}
+
+/** @param {Row[]} rows @returns {0 | 1} 1 when any row FAILs. */
+export function exitCode(rows) {
+  return rows.some((r) => r.status === 'FAIL') ? 1 : 0;
+}