@elie-laloum/outpost 1.1.4 → 3.0.0

package/dist/application/doctor-image.js

@@ -0,0 +1,133 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { OutpostError } from "../domain/errors.js";
+import { executeProcess } from "../infrastructure/process.js";
+import { registerCleanup } from "../infrastructure/shutdown.js";
+import { diagnosticContainer } from "../providers/diagnostic-container.js";
+import { agentVersions } from "../providers/versions.constants.js";
+import { diagnoseAgentCli } from "./doctor-agent.js";
+import { diagnosticProbe } from "./diagnostic-probe.js";
+import { doctorDefaults } from "./doctor.constants.js";
+export async function diagnoseImage(options, execute = executeProcess) {
+    const stop = new AbortController();
+    const pending = inspectImage(options, execute, stop.signal);
+    const unregister = registerCleanup(async () => {
+        stop.abort(new OutpostError("aborted", "Image diagnostics interrupted"));
+        await pending;
+    });
+    try {
+        return await pending;
+    }
+    finally {
+        unregister();
+    }
+}
+async function inspectImage({ provider, agent, image }, execute, signal) {
+    const directory = await mkdtemp(join(tmpdir(), "outpost-doctor-"));
+    const checks = [];
+    let lease;
+    let retained = false;
+    let container;
+    const tracked = (command) => {
+        if (command.arguments?.[0] === "create") {
+            const index = command.arguments.indexOf("--name");
+            container = command.arguments[index + 1];
+        }
+        return execute(command);
+    };
+    try {
+        lease = await diagnosticContainer(provider, image, doctorDefaults.deadlineMs, tracked).acquire({
+            repository: directory,
+            directory,
+            gitDirectories: [],
+            variables: {},
+            signal,
+        });
+        checks.push({
+            id: "image.runtime",
+            status: "pass",
+            message: "Temporary sandbox started with network disabled and an empty workspace.",
+        });
+        const sandbox = lease;
+        const invoke = (command) => sandbox.invoke({ ...command, signal });
+        for (const executable of ["node", "git"]) {
+            checks.push(await diagnosticProbe({
+                id: `image.${executable}`,
+                command: { executable, arguments: ["--version"] },
+                failureStatus: "fail",
+                readVersion: true,
+                remedy: `Install ${executable} in the image and rebuild it.`,
+            }, invoke));
+        }
+        checks.push(await diagnosticProbe({
+            id: "image.home",
+            command: {
+                executable: "sh",
+                arguments: ["-c", 'test -d "$HOME" && test -w "$HOME"'],
+            },
+            failureStatus: "fail",
+            remedy: "Check the image user and permissions of the private agent home.",
+        }, invoke));
+        const agentVersion = await diagnosticProbe({
+            id: "agent.sandbox",
+            command: { executable: agent, arguments: ["--version"] },
+            failureStatus: "fail",
+            readVersion: true,
+            referenceVersion: agentVersions[agent],
+            remedy: `Install ${agent} in the image and rebuild it. This check does not bootstrap agents.`,
+        }, invoke);
+        checks.push(agentVersion);
+        if (agentVersion.status === "fail")
+            checks.push({
+                id: "agent.cli",
+                status: "skipped",
+                message: "CLI help checks require a successful agent version probe.",
+            });
+        else
+            checks.push(...(await diagnoseAgentCli(agent, invoke)));
+    }
+    catch (error) {
+        retained = error instanceof AggregateError;
+        checks.push({
+            id: "image.runtime",
+            status: "fail",
+            message: "Image diagnostics could not start. Check that the image exists locally, its UID matches the host, and sh, sleep, setsid, kill, tar and cp are installed. No image is downloaded.",
+        });
+    }
+    finally {
+        if (lease) {
+            try {
+                await lease.release();
+                checks.push({
+                    id: "image.cleanup",
+                    status: "pass",
+                    message: "Diagnostic container removed.",
+                });
+            }
+            catch {
+                retained = true;
+            }
+        }
+        if (retained)
+            checks.push({
+                id: "image.cleanup",
+                status: "fail",
+                message: `Cleanup could not be confirmed. Inspect container ${container ?? "creation state"} with ${provider}; temporary workspace retained at ${directory}.`,
+            });
+        if (!retained) {
+            try {
+                await rm(directory, { recursive: true, force: true });
+            }
+            catch {
+                checks.push({
+                    id: "image.workspace",
+                    status: "fail",
+                    message: `Could not remove temporary workspace ${directory}.`,
+                });
+            }
+        }
+    }
+    return checks;
+}
+//# sourceMappingURL=doctor-image.js.map

package/dist/application/doctor-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-image.js","sourceRoot":"","sources":["../../src/application/doctor-image.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA2B,EAC3B,UAAoB,cAAc;IAElC,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,IAAI,EAAE;QAC5C,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC,CAAC;QACzE,MAAM,OAAO,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,UAAU,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAsB,EAC9C,OAAiB,EACjB,MAAmB;IAEnB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,KAA+B,CAAC;IACpC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAA6B,CAAC;IAClC,MAAM,OAAO,GAAa,CAAC,OAAO,EAAE,EAAE;QACpC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAC/B,QAAQ,EACR,KAAK,EACL,cAAc,CAAC,UAAU,EACzB,OAAO,CACR,CAAC,OAAO,CAAC;YACR,UAAU,EAAE,SAAS;YACrB,SAAS;YACT,cAAc,EAAE,EAAE;YAClB,SAAS,EAAE,EAAE;YACb,MAAM;SACP,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,eAAe;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EACL,yEAAyE;SAC5E,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC;QACtB,MAAM,MAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CACnC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,KAAK,MAAM,UAAU,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CACT,MAAM,eAAe,CACnB;gBACE,EAAE,EAAE,SAAS,UAAU,EAAE;gBACzB,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE;gBACjD,aAAa,EAAE,MAAM;gBACrB,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,WAAW,UAAU,+BAA+B;aAC7D,EACD,MAAM,CACP,CACF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CACT,MAAM,eAAe,CACnB;YACE,EAAE,EAAE,YAAY;YAChB,OAAO,EAAE;gBACP,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,CAAC,IAAI,EAAE,oCAAoC,CAAC;aACxD;YACD,aAAa,EAAE,MAAM;YACrB,MAAM,EACJ,iEAAiE;SACpE,EACD,MAAM,CACP,CACF,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,eAAe,CACxC;YACE,EAAE,EAAE,eAAe;YACnB,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE;YACxD,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC;YACtC,MAAM,EAAE,WAAW,KAAK,qEAAqE;SAC9F,EACD,MAAM,CACP,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1B,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM;YAChC,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,WAAW;gBACf,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;;YACA,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,GAAG,KAAK,YAAY,cAAc,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,eAAe;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EACL,kLAAkL;SACrL,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,eAAe;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,+BAA+B;iBACzC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ;YACV,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,eAAe;gBACnB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,qDAAqD,SAAS,IAAI,gBAAgB,SAAS,QAAQ,qCAAqC,SAAS,GAAG;aAC9J,CAAC,CAAC;QACL,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,iBAAiB;oBACrB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,wCAAwC,SAAS,GAAG;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { mkdtemp, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type { SandboxLease } from \"../domain/sandbox.types.ts\";\nimport { executeProcess } from \"../infrastructure/process.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { diagnosticContainer } from \"../providers/diagnostic-container.ts\";\nimport { agentVersions } from \"../providers/versions.constants.ts\";\nimport { diagnoseAgentCli } from \"./doctor-agent.ts\";\nimport { diagnosticProbe } from \"./diagnostic-probe.ts\";\nimport { doctorDefaults } from \"./doctor.constants.ts\";\nimport type { DiagnosticCheck, DoctorImageOptions } from \"./doctor.types.ts\";\n\nexport async function diagnoseImage(\n  options: DoctorImageOptions,\n  execute: Executor = executeProcess,\n): Promise<readonly DiagnosticCheck[]> {\n  const stop = new AbortController();\n  const pending = inspectImage(options, execute, stop.signal);\n  const unregister = registerCleanup(async () => {\n    stop.abort(new OutpostError(\"aborted\", \"Image diagnostics interrupted\"));\n    await pending;\n  });\n  try {\n    return await pending;\n  } finally {\n    unregister();\n  }\n}\n\nasync function inspectImage(\n  { provider, agent, image }: DoctorImageOptions,\n  execute: Executor,\n  signal: AbortSignal,\n): Promise<readonly DiagnosticCheck[]> {\n  const directory = await mkdtemp(join(tmpdir(), \"outpost-doctor-\"));\n  const checks: DiagnosticCheck[] = [];\n  let lease: SandboxLease | undefined;\n  let retained = false;\n  let container: string | undefined;\n  const tracked: Executor = (command) => {\n    if (command.arguments?.[0] === \"create\") {\n      const index = command.arguments.indexOf(\"--name\");\n      container = command.arguments[index + 1];\n    }\n    return execute(command);\n  };\n  try {\n    lease = await diagnosticContainer(\n      provider,\n      image,\n      doctorDefaults.deadlineMs,\n      tracked,\n    ).acquire({\n      repository: directory,\n      directory,\n      gitDirectories: [],\n      variables: {},\n      signal,\n    });\n    checks.push({\n      id: \"image.runtime\",\n      status: \"pass\",\n      message:\n        \"Temporary sandbox started with network disabled and an empty workspace.\",\n    });\n    const sandbox = lease;\n    const invoke: Executor = (command) =>\n      sandbox.invoke({ ...command, signal });\n    for (const executable of [\"node\", \"git\"]) {\n      checks.push(\n        await diagnosticProbe(\n          {\n            id: `image.${executable}`,\n            command: { executable, arguments: [\"--version\"] },\n            failureStatus: \"fail\",\n            readVersion: true,\n            remedy: `Install ${executable} in the image and rebuild it.`,\n          },\n          invoke,\n        ),\n      );\n    }\n    checks.push(\n      await diagnosticProbe(\n        {\n          id: \"image.home\",\n          command: {\n            executable: \"sh\",\n            arguments: [\"-c\", 'test -d \"$HOME\" && test -w \"$HOME\"'],\n          },\n          failureStatus: \"fail\",\n          remedy:\n            \"Check the image user and permissions of the private agent home.\",\n        },\n        invoke,\n      ),\n    );\n    const agentVersion = await diagnosticProbe(\n      {\n        id: \"agent.sandbox\",\n        command: { executable: agent, arguments: [\"--version\"] },\n        failureStatus: \"fail\",\n        readVersion: true,\n        referenceVersion: agentVersions[agent],\n        remedy: `Install ${agent} in the image and rebuild it. This check does not bootstrap agents.`,\n      },\n      invoke,\n    );\n    checks.push(agentVersion);\n    if (agentVersion.status === \"fail\")\n      checks.push({\n        id: \"agent.cli\",\n        status: \"skipped\",\n        message: \"CLI help checks require a successful agent version probe.\",\n      });\n    else checks.push(...(await diagnoseAgentCli(agent, invoke)));\n  } catch (error) {\n    retained = error instanceof AggregateError;\n    checks.push({\n      id: \"image.runtime\",\n      status: \"fail\",\n      message:\n        \"Image diagnostics could not start. Check that the image exists locally, its UID matches the host, and sh, sleep, setsid, kill, tar and cp are installed. No image is downloaded.\",\n    });\n  } finally {\n    if (lease) {\n      try {\n        await lease.release();\n        checks.push({\n          id: \"image.cleanup\",\n          status: \"pass\",\n          message: \"Diagnostic container removed.\",\n        });\n      } catch {\n        retained = true;\n      }\n    }\n    if (retained)\n      checks.push({\n        id: \"image.cleanup\",\n        status: \"fail\",\n        message: `Cleanup could not be confirmed. Inspect container ${container ?? \"creation state\"} with ${provider}; temporary workspace retained at ${directory}.`,\n      });\n    if (!retained) {\n      try {\n        await rm(directory, { recursive: true, force: true });\n      } catch {\n        checks.push({\n          id: \"image.workspace\",\n          status: \"fail\",\n          message: `Could not remove temporary workspace ${directory}.`,\n        });\n      }\n    }\n  }\n  return checks;\n}\n"]}

package/dist/application/doctor-protocol.d.ts

@@ -0,0 +1,3 @@
+import type { AgentProtocolReport } from "./doctor-protocol.types.ts";
+import type { DoctorAgent } from "./doctor.types.ts";
+export declare function diagnoseAgentProtocol(agent: DoctorAgent): AgentProtocolReport;

package/dist/application/doctor-protocol.js

@@ -0,0 +1,29 @@
+import { isDeepStrictEqual } from "node:util";
+import { claude } from "../adapters/agents/claude-adapter.js";
+import { codex } from "../adapters/agents/codex-adapter.js";
+import { protocolFixtures } from "../adapters/agents/protocol-fixtures.constants.js";
+import { agentVersions } from "../providers/versions.constants.js";
+export function diagnoseAgentProtocol(agent) {
+    const adapter = { claude, codex }[agent]();
+    const checks = protocolFixtures[agent].map((fixture) => {
+        const events = fixture.lines.flatMap((line) => adapter.events(line));
+        const passed = isDeepStrictEqual(events, fixture.expected);
+        return {
+            id: `protocol.fixture.${fixture.name}`,
+            status: passed ? "pass" : "fail",
+            message: passed
+                ? "Bundled synthetic events decode to the expected structural observations. No installed CLI or model was invoked."
+                : "Bundled synthetic events do not match the expected structural observations.",
+        };
+    });
+    return {
+        scope: "bundled-protocol-fixtures",
+        agent,
+        referenceVersion: agentVersions[agent],
+        installedCli: "unverified",
+        modelCompatibility: "unverified",
+        checks,
+        hasFailures: checks.some((check) => check.status === "fail"),
+    };
+}
+//# sourceMappingURL=doctor-protocol.js.map

package/dist/application/doctor-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-protocol.js","sourceRoot":"","sources":["../../src/application/doctor-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sCAAsC,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,qCAAqC,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mDAAmD,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAInE,MAAM,UAAU,qBAAqB,CAAC,KAAkB;IACtD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAsB,gBAAgB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO;YACL,EAAE,EAAE,oBAAoB,OAAO,CAAC,IAAI,EAAE;YACtC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAChC,OAAO,EAAE,MAAM;gBACb,CAAC,CAAC,iHAAiH;gBACnH,CAAC,CAAC,6EAA6E;SAClF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,KAAK,EAAE,2BAA2B;QAClC,KAAK;QACL,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC;QACtC,YAAY,EAAE,YAAY;QAC1B,kBAAkB,EAAE,YAAY;QAChC,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;KAC7D,CAAC;AACJ,CAAC","sourcesContent":["import { isDeepStrictEqual } from \"node:util\";\nimport { claude } from \"../adapters/agents/claude-adapter.ts\";\nimport { codex } from \"../adapters/agents/codex-adapter.ts\";\nimport { protocolFixtures } from \"../adapters/agents/protocol-fixtures.constants.ts\";\nimport { agentVersions } from \"../providers/versions.constants.ts\";\nimport type { AgentProtocolReport } from \"./doctor-protocol.types.ts\";\nimport type { DiagnosticCheck, DoctorAgent } from \"./doctor.types.ts\";\n\nexport function diagnoseAgentProtocol(agent: DoctorAgent): AgentProtocolReport {\n  const adapter = { claude, codex }[agent]();\n  const checks: DiagnosticCheck[] = protocolFixtures[agent].map((fixture) => {\n    const events = fixture.lines.flatMap((line) => adapter.events(line));\n    const passed = isDeepStrictEqual(events, fixture.expected);\n    return {\n      id: `protocol.fixture.${fixture.name}`,\n      status: passed ? \"pass\" : \"fail\",\n      message: passed\n        ? \"Bundled synthetic events decode to the expected structural observations. No installed CLI or model was invoked.\"\n        : \"Bundled synthetic events do not match the expected structural observations.\",\n    };\n  });\n  return {\n    scope: \"bundled-protocol-fixtures\",\n    agent,\n    referenceVersion: agentVersions[agent],\n    installedCli: \"unverified\",\n    modelCompatibility: \"unverified\",\n    checks,\n    hasFailures: checks.some((check) => check.status === \"fail\"),\n  };\n}\n"]}

package/dist/application/doctor-protocol.types.d.ts

@@ -0,0 +1,10 @@
+import type { DiagnosticCheck, DoctorAgent } from "./doctor.types.ts";
+export interface AgentProtocolReport {
+    readonly scope: "bundled-protocol-fixtures";
+    readonly agent: DoctorAgent;
+    readonly referenceVersion: string;
+    readonly installedCli: "unverified";
+    readonly modelCompatibility: "unverified";
+    readonly checks: readonly DiagnosticCheck[];
+    readonly hasFailures: boolean;
+}

package/dist/application/doctor-protocol.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=doctor-protocol.types.js.map

package/dist/application/doctor-protocol.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-protocol.types.js","sourceRoot":"","sources":["../../src/application/doctor-protocol.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { DiagnosticCheck, DoctorAgent } from \"./doctor.types.ts\";\n\nexport interface AgentProtocolReport {\n  readonly scope: \"bundled-protocol-fixtures\";\n  readonly agent: DoctorAgent;\n  readonly referenceVersion: string;\n  readonly installedCli: \"unverified\";\n  readonly modelCompatibility: \"unverified\";\n  readonly checks: readonly DiagnosticCheck[];\n  readonly hasFailures: boolean;\n}\n"]}

package/dist/application/doctor-sandbox.constants.d.ts

@@ -0,0 +1,5 @@
+export declare const sandboxDiagnosticDefaults: Readonly<{
+    maximumDeadlineMs: 60000;
+    command: "process.stdout.write('outpost-stdout'); process.stderr.write('outpost-stderr'); process.exitCode = 7";
+    home: "const fs = require('node:fs'); fs.accessSync(process.argv[1], fs.constants.R_OK | fs.constants.W_OK); if (!fs.statSync(process.argv[1]).isDirectory()) process.exit(1)";
+}>;

package/dist/application/doctor-sandbox.constants.js

@@ -0,0 +1,6 @@
+export const sandboxDiagnosticDefaults = Object.freeze({
+    maximumDeadlineMs: 60_000,
+    command: "process.stdout.write('outpost-stdout'); process.stderr.write('outpost-stderr'); process.exitCode = 7",
+    home: "const fs = require('node:fs'); fs.accessSync(process.argv[1], fs.constants.R_OK | fs.constants.W_OK); if (!fs.statSync(process.argv[1]).isDirectory()) process.exit(1)",
+});
+//# sourceMappingURL=doctor-sandbox.constants.js.map

package/dist/application/doctor-sandbox.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-sandbox.constants.js","sourceRoot":"","sources":["../../src/application/doctor-sandbox.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,iBAAiB,EAAE,MAAM;IACzB,OAAO,EACL,sGAAsG;IACxG,IAAI,EAAE,wKAAwK;CAC/K,CAAC,CAAC","sourcesContent":["export const sandboxDiagnosticDefaults = Object.freeze({\n  maximumDeadlineMs: 60_000,\n  command:\n    \"process.stdout.write('outpost-stdout'); process.stderr.write('outpost-stderr'); process.exitCode = 7\",\n  home: \"const fs = require('node:fs'); fs.accessSync(process.argv[1], fs.constants.R_OK | fs.constants.W_OK); if (!fs.statSync(process.argv[1]).isDirectory()) process.exit(1)\",\n});\n"]}

package/dist/application/doctor-sandbox.d.ts

@@ -0,0 +1,4 @@
+import type { SandboxLease } from "../domain/sandbox.types.ts";
+import type { SandboxDiagnosticOptions, SandboxDiagnosticReport } from "./doctor-sandbox.types.ts";
+import type { Sandbox } from "./outpost.types.ts";
+export declare function diagnoseSandbox(target: Sandbox | SandboxLease, options?: SandboxDiagnosticOptions): Promise<SandboxDiagnosticReport>;

package/dist/application/doctor-sandbox.js

@@ -0,0 +1,133 @@
+import { invariant } from "../domain/errors.js";
+import { agentVersions } from "../providers/versions.constants.js";
+import { diagnoseAgentCli } from "./doctor-agent.js";
+import { diagnosticProbe } from "./diagnostic-probe.js";
+import { doctorDefaults } from "./doctor.constants.js";
+import { diagnoseTransfers } from "./doctor-transfers.js";
+import { sandboxDiagnosticDefaults } from "./doctor-sandbox.constants.js";
+export async function diagnoseSandbox(target, options = {}) {
+    if ("diagnose" in target)
+        return target.diagnose(options);
+    const deadlineMs = options.deadlineMs ?? doctorDefaults.deadlineMs;
+    invariant(Number.isInteger(deadlineMs) &&
+        deadlineMs > 0 &&
+        deadlineMs <= sandboxDiagnosticDefaults.maximumDeadlineMs, "Diagnostic deadlineMs must be an integer from 1 to 60000");
+    options.signal?.throwIfAborted();
+    const invoke = (command) => {
+        options.signal?.throwIfAborted();
+        return target.invoke({
+            ...command,
+            deadlineMs,
+            retain: command.retain ?? doctorDefaults.retain,
+            signal: options.signal
+                ? AbortSignal.any([options.signal, AbortSignal.timeout(deadlineMs)])
+                : AbortSignal.timeout(deadlineMs),
+        });
+    };
+    const checks = [];
+    for (const executable of ["node", "git"]) {
+        checks.push(await diagnosticProbe({
+            id: `sandbox.${executable}`,
+            command: { executable, arguments: ["--version"] },
+            readVersion: true,
+            failureStatus: "fail",
+            remedy: `Install ${executable} in this sandbox.`,
+        }, invoke));
+    }
+    try {
+        const result = await invoke({
+            executable: "node",
+            arguments: ["-e", sandboxDiagnosticDefaults.command],
+        });
+        const passed = result.status === 7 &&
+            result.stdout === "outpost-stdout" &&
+            result.stderr === "outpost-stderr";
+        checks.push({
+            id: "sandbox.command",
+            status: passed ? "pass" : "fail",
+            message: passed
+                ? "Observed separate output streams and nonzero process exit status."
+                : "Command output or exit status did not match the diagnostic sentinel.",
+        });
+    }
+    catch {
+        checks.push({
+            id: "sandbox.command",
+            status: "fail",
+            message: "Bounded command probe failed or was interrupted.",
+        });
+    }
+    checks.push(await diagnosticProbe({
+        id: "sandbox.home",
+        command: {
+            executable: "node",
+            arguments: ["-e", sandboxDiagnosticDefaults.home, target.home],
+        },
+        failureStatus: "fail",
+        remedy: "Check the lease home directory and its permissions.",
+    }, invoke));
+    if (options.agent) {
+        const version = await diagnosticProbe({
+            id: "agent.sandbox",
+            command: { executable: options.agent, arguments: ["--version"] },
+            readVersion: true,
+            referenceVersion: agentVersions[options.agent],
+            failureStatus: "fail",
+            remedy: "Install the agent explicitly; diagnostics never bootstrap it.",
+        }, invoke);
+        checks.push(version);
+        if (version.status !== "fail")
+            checks.push(...(await diagnoseAgentCli(options.agent, invoke)));
+    }
+    if (options.transfers === true)
+        checks.push(...(await diagnoseTransfers(target, { deadlineMs, ...(options.signal ? { signal: options.signal } : {}) }, invoke)));
+    checks.push({
+        id: "model",
+        status: "skipped",
+        message: "Authentication, model access and installed agent protocol compatibility are unverified. No model request was made.",
+    });
+    const observed = (id) => {
+        const check = checks.find((check) => check.id === id);
+        if (!check)
+            return "unverified";
+        return check.status === "pass" ? "pass" : "fail";
+    };
+    return {
+        scope: "owned-sandbox",
+        ownership: "caller",
+        ...(options.provider
+            ? {
+                provider: {
+                    name: options.provider.name,
+                    placement: options.provider.placement,
+                },
+            }
+            : {}),
+        capabilities: [
+            {
+                id: "command",
+                advertised: true,
+                observed: observed("sandbox.command"),
+            },
+            {
+                id: "transfers",
+                advertised: true,
+                observed: observed("sandbox.transfers"),
+            },
+            {
+                id: "batchTransfers",
+                advertised: target.fileTransfers !== undefined,
+                observed: "unverified",
+            },
+            {
+                id: "interactiveTerminal",
+                advertised: "unknown",
+                observed: "unverified",
+            },
+        ],
+        checks,
+        modelCompatibility: "unverified",
+        hasFailures: checks.some((check) => check.status === "fail"),
+    };
+}
+//# sourceMappingURL=doctor-sandbox.js.map

package/dist/application/doctor-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-sandbox.js","sourceRoot":"","sources":["../../src/application/doctor-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAO1E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA8B,EAC9B,UAAoC,EAAE;IAEtC,IAAI,UAAU,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC,UAAU,CAAC;IACnE,SAAS,CACP,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAC1B,UAAU,GAAG,CAAC;QACd,UAAU,IAAI,yBAAyB,CAAC,iBAAiB,EAC3D,0DAA0D,CAC3D,CAAC;IACF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,MAAM,MAAM,GAAa,CAAC,OAAO,EAAE,EAAE;QACnC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,OAAO;YACV,UAAU;YACV,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM;YAC/C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACpB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;gBACpE,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACpC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,MAAM,UAAU,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CACT,MAAM,eAAe,CACnB;YACE,EAAE,EAAE,WAAW,UAAU,EAAE;YAC3B,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE;YACjD,WAAW,EAAE,IAAI;YACjB,aAAa,EAAE,MAAM;YACrB,MAAM,EAAE,WAAW,UAAU,mBAAmB;SACjD,EACD,MAAM,CACP,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;YAC1B,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,CAAC,IAAI,EAAE,yBAAyB,CAAC,OAAO,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,KAAK,CAAC;YACnB,MAAM,CAAC,MAAM,KAAK,gBAAgB;YAClC,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,iBAAiB;YACrB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAChC,OAAO,EAAE,MAAM;gBACb,CAAC,CAAC,mEAAmE;gBACrE,CAAC,CAAC,sEAAsE;SAC3E,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,iBAAiB;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kDAAkD;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,IAAI,CACT,MAAM,eAAe,CACnB;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE;YACP,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,CAAC,IAAI,EAAE,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;SAC/D;QACD,aAAa,EAAE,MAAM;QACrB,MAAM,EAAE,qDAAqD;KAC9D,EACD,MAAM,CACP,CACF,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,eAAe,CACnC;YACE,EAAE,EAAE,eAAe;YACnB,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE;YAChE,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC;YAC9C,aAAa,EAAE,MAAM;YACrB,MAAM,EAAE,+DAA+D;SACxE,EACD,MAAM,CACP,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI;QAC5B,MAAM,CAAC,IAAI,CACT,GAAG,CAAC,MAAM,iBAAiB,CACzB,MAAM,EACN,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACrE,MAAM,CACP,CAAC,CACH,CAAC;IACJ,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,OAAO;QACX,MAAM,EAAE,SAAS;QACjB,OAAO,EACL,oHAAoH;KACvH,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,YAAqB,CAAC;QACzC,OAAO,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,MAAgB,CAAC;IACzE,CAAC,CAAC;IACF,OAAO;QACL,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,QAAQ;QACnB,GAAG,CAAC,OAAO,CAAC,QAAQ;YAClB,CAAC,CAAC;gBACE,QAAQ,EAAE;oBACR,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;oBAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;iBACtC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE;YACZ;gBACE,EAAE,EAAE,SAAS;gBACb,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC;aACtC;YACD;gBACE,EAAE,EAAE,WAAW;gBACf,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,CAAC;aACxC;YACD;gBACE,EAAE,EAAE,gBAAgB;gBACpB,UAAU,EAAE,MAAM,CAAC,aAAa,KAAK,SAAS;gBAC9C,QAAQ,EAAE,YAAY;aACvB;YACD;gBACE,EAAE,EAAE,qBAAqB;gBACzB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,YAAY;aACvB;SACF;QACD,MAAM;QACN,kBAAkB,EAAE,YAAY;QAChC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;KAC7D,CAAC;AACJ,CAAC","sourcesContent":["import { invariant } from \"../domain/errors.ts\";\nimport type { SandboxLease } from \"../domain/sandbox.types.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\nimport { agentVersions } from \"../providers/versions.constants.ts\";\nimport { diagnoseAgentCli } from \"./doctor-agent.ts\";\nimport { diagnosticProbe } from \"./diagnostic-probe.ts\";\nimport { doctorDefaults } from \"./doctor.constants.ts\";\nimport type { DiagnosticCheck } from \"./doctor.types.ts\";\nimport { diagnoseTransfers } from \"./doctor-transfers.ts\";\nimport { sandboxDiagnosticDefaults } from \"./doctor-sandbox.constants.ts\";\nimport type {\n  SandboxDiagnosticOptions,\n  SandboxDiagnosticReport,\n} from \"./doctor-sandbox.types.ts\";\nimport type { Sandbox } from \"./outpost.types.ts\";\n\nexport async function diagnoseSandbox(\n  target: Sandbox | SandboxLease,\n  options: SandboxDiagnosticOptions = {},\n): Promise<SandboxDiagnosticReport> {\n  if (\"diagnose\" in target) return target.diagnose(options);\n  const deadlineMs = options.deadlineMs ?? doctorDefaults.deadlineMs;\n  invariant(\n    Number.isInteger(deadlineMs) &&\n      deadlineMs > 0 &&\n      deadlineMs <= sandboxDiagnosticDefaults.maximumDeadlineMs,\n    \"Diagnostic deadlineMs must be an integer from 1 to 60000\",\n  );\n  options.signal?.throwIfAborted();\n  const invoke: Executor = (command) => {\n    options.signal?.throwIfAborted();\n    return target.invoke({\n      ...command,\n      deadlineMs,\n      retain: command.retain ?? doctorDefaults.retain,\n      signal: options.signal\n        ? AbortSignal.any([options.signal, AbortSignal.timeout(deadlineMs)])\n        : AbortSignal.timeout(deadlineMs),\n    });\n  };\n  const checks: DiagnosticCheck[] = [];\n  for (const executable of [\"node\", \"git\"]) {\n    checks.push(\n      await diagnosticProbe(\n        {\n          id: `sandbox.${executable}`,\n          command: { executable, arguments: [\"--version\"] },\n          readVersion: true,\n          failureStatus: \"fail\",\n          remedy: `Install ${executable} in this sandbox.`,\n        },\n        invoke,\n      ),\n    );\n  }\n  try {\n    const result = await invoke({\n      executable: \"node\",\n      arguments: [\"-e\", sandboxDiagnosticDefaults.command],\n    });\n    const passed =\n      result.status === 7 &&\n      result.stdout === \"outpost-stdout\" &&\n      result.stderr === \"outpost-stderr\";\n    checks.push({\n      id: \"sandbox.command\",\n      status: passed ? \"pass\" : \"fail\",\n      message: passed\n        ? \"Observed separate output streams and nonzero process exit status.\"\n        : \"Command output or exit status did not match the diagnostic sentinel.\",\n    });\n  } catch {\n    checks.push({\n      id: \"sandbox.command\",\n      status: \"fail\",\n      message: \"Bounded command probe failed or was interrupted.\",\n    });\n  }\n  checks.push(\n    await diagnosticProbe(\n      {\n        id: \"sandbox.home\",\n        command: {\n          executable: \"node\",\n          arguments: [\"-e\", sandboxDiagnosticDefaults.home, target.home],\n        },\n        failureStatus: \"fail\",\n        remedy: \"Check the lease home directory and its permissions.\",\n      },\n      invoke,\n    ),\n  );\n  if (options.agent) {\n    const version = await diagnosticProbe(\n      {\n        id: \"agent.sandbox\",\n        command: { executable: options.agent, arguments: [\"--version\"] },\n        readVersion: true,\n        referenceVersion: agentVersions[options.agent],\n        failureStatus: \"fail\",\n        remedy: \"Install the agent explicitly; diagnostics never bootstrap it.\",\n      },\n      invoke,\n    );\n    checks.push(version);\n    if (version.status !== \"fail\")\n      checks.push(...(await diagnoseAgentCli(options.agent, invoke)));\n  }\n  if (options.transfers === true)\n    checks.push(\n      ...(await diagnoseTransfers(\n        target,\n        { deadlineMs, ...(options.signal ? { signal: options.signal } : {}) },\n        invoke,\n      )),\n    );\n  checks.push({\n    id: \"model\",\n    status: \"skipped\",\n    message:\n      \"Authentication, model access and installed agent protocol compatibility are unverified. No model request was made.\",\n  });\n  const observed = (id: string) => {\n    const check = checks.find((check) => check.id === id);\n    if (!check) return \"unverified\" as const;\n    return check.status === \"pass\" ? (\"pass\" as const) : (\"fail\" as const);\n  };\n  return {\n    scope: \"owned-sandbox\",\n    ownership: \"caller\",\n    ...(options.provider\n      ? {\n          provider: {\n            name: options.provider.name,\n            placement: options.provider.placement,\n          },\n        }\n      : {}),\n    capabilities: [\n      {\n        id: \"command\",\n        advertised: true,\n        observed: observed(\"sandbox.command\"),\n      },\n      {\n        id: \"transfers\",\n        advertised: true,\n        observed: observed(\"sandbox.transfers\"),\n      },\n      {\n        id: \"batchTransfers\",\n        advertised: target.fileTransfers !== undefined,\n        observed: \"unverified\",\n      },\n      {\n        id: \"interactiveTerminal\",\n        advertised: \"unknown\",\n        observed: \"unverified\",\n      },\n    ],\n    checks,\n    modelCompatibility: \"unverified\",\n    hasFailures: checks.some((check) => check.status === \"fail\"),\n  };\n}\n"]}

package/dist/application/doctor-sandbox.types.d.ts

@@ -0,0 +1,23 @@
+import type { SandboxProvider } from "../domain/sandbox.types.ts";
+import type { DiagnosticCheck, DoctorAgent } from "./doctor.types.ts";
+export interface SandboxDiagnosticOptions {
+    readonly agent?: DoctorAgent;
+    readonly deadlineMs?: number;
+    readonly signal?: AbortSignal;
+    readonly transfers?: boolean;
+    readonly provider?: Pick<SandboxProvider, "name" | "placement">;
+}
+export interface DiagnosticCapability {
+    readonly id: "command" | "transfers" | "batchTransfers" | "interactiveTerminal";
+    readonly advertised: boolean | "unknown";
+    readonly observed: "pass" | "fail" | "unverified";
+}
+export interface SandboxDiagnosticReport {
+    readonly scope: "owned-sandbox";
+    readonly ownership: "caller";
+    readonly provider?: Pick<SandboxProvider, "name" | "placement">;
+    readonly capabilities: readonly DiagnosticCapability[];
+    readonly checks: readonly DiagnosticCheck[];
+    readonly modelCompatibility: "unverified";
+    readonly hasFailures: boolean;
+}

package/dist/application/doctor-sandbox.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=doctor-sandbox.types.js.map

package/dist/application/doctor-sandbox.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-sandbox.types.js","sourceRoot":"","sources":["../../src/application/doctor-sandbox.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { SandboxProvider } from \"../domain/sandbox.types.ts\";\nimport type { DiagnosticCheck, DoctorAgent } from \"./doctor.types.ts\";\n\nexport interface SandboxDiagnosticOptions {\n  readonly agent?: DoctorAgent;\n  readonly deadlineMs?: number;\n  readonly signal?: AbortSignal;\n  readonly transfers?: boolean;\n  readonly provider?: Pick<SandboxProvider, \"name\" | \"placement\">;\n}\n\nexport interface DiagnosticCapability {\n  readonly id:\n    \"command\" | \"transfers\" | \"batchTransfers\" | \"interactiveTerminal\";\n  readonly advertised: boolean | \"unknown\";\n  readonly observed: \"pass\" | \"fail\" | \"unverified\";\n}\n\nexport interface SandboxDiagnosticReport {\n  readonly scope: \"owned-sandbox\";\n  readonly ownership: \"caller\";\n  readonly provider?: Pick<SandboxProvider, \"name\" | \"placement\">;\n  readonly capabilities: readonly DiagnosticCapability[];\n  readonly checks: readonly DiagnosticCheck[];\n  readonly modelCompatibility: \"unverified\";\n  readonly hasFailures: boolean;\n}\n"]}

package/dist/application/doctor-transfers.constants.d.ts

@@ -0,0 +1,6 @@
+export declare const transferDiagnosticRecipe: Readonly<{
+    base64: "AAECA/7/AG91dHBvc3QK";
+    create: "require('node:fs').mkdirSync(process.argv[1])";
+    verify: "const fs = require('node:fs'); if (fs.readFileSync(process.argv[1]).toString('base64') !== process.argv[2]) process.exit(1)";
+    cleanup: "require('node:fs').rmSync(process.argv[1], { recursive: true, force: true })";
+}>;

package/dist/application/doctor-transfers.constants.js

@@ -0,0 +1,7 @@
+export const transferDiagnosticRecipe = Object.freeze({
+    base64: "AAECA/7/AG91dHBvc3QK",
+    create: "require('node:fs').mkdirSync(process.argv[1])",
+    verify: "const fs = require('node:fs'); if (fs.readFileSync(process.argv[1]).toString('base64') !== process.argv[2]) process.exit(1)",
+    cleanup: "require('node:fs').rmSync(process.argv[1], { recursive: true, force: true })",
+});
+//# sourceMappingURL=doctor-transfers.constants.js.map

package/dist/application/doctor-transfers.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-transfers.constants.js","sourceRoot":"","sources":["../../src/application/doctor-transfers.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,MAAM,EAAE,sBAAsB;IAC9B,MAAM,EAAE,+CAA+C;IACvD,MAAM,EACJ,6HAA6H;IAC/H,OAAO,EACL,8EAA8E;CACjF,CAAC,CAAC","sourcesContent":["export const transferDiagnosticRecipe = Object.freeze({\n  base64: \"AAECA/7/AG91dHBvc3QK\",\n  create: \"require('node:fs').mkdirSync(process.argv[1])\",\n  verify:\n    \"const fs = require('node:fs'); if (fs.readFileSync(process.argv[1]).toString('base64') !== process.argv[2]) process.exit(1)\",\n  cleanup:\n    \"require('node:fs').rmSync(process.argv[1], { recursive: true, force: true })\",\n});\n"]}

package/dist/application/doctor-transfers.d.ts

@@ -0,0 +1,4 @@
+import type { SandboxLease, TransferOptions } from "../domain/sandbox.types.ts";
+import type { Executor } from "../infrastructure/process.types.ts";
+import type { DiagnosticCheck } from "./doctor.types.ts";
+export declare function diagnoseTransfers(lease: SandboxLease, options: TransferOptions, invoke: Executor): Promise<DiagnosticCheck[]>;

package/dist/application/doctor-transfers.js

@@ -0,0 +1,88 @@
+import { randomUUID } from "node:crypto";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { doctorDefaults } from "./doctor.constants.js";
+import { transferDiagnosticRecipe as recipe } from "./doctor-transfers.constants.js";
+export async function diagnoseTransfers(lease, options, invoke) {
+    const checks = [];
+    const directory = await mkdtemp(join(tmpdir(), "outpost-probe-"));
+    const remote = `${lease.root.replace(/[\\/]$/, "")}/.outpost-probe-${randomUUID()}`;
+    const source = join(directory, "source");
+    let cleanupNeeded = false;
+    try {
+        cleanupNeeded = true;
+        const result = await invoke({
+            executable: "node",
+            arguments: ["-e", recipe.create, remote],
+        });
+        if (result.status !== 0) {
+            cleanupNeeded = false;
+            throw new Error("create");
+        }
+        const payload = Buffer.from(recipe.base64, "base64");
+        await writeFile(source, payload, { mode: 0o600 });
+        const bounded = () => ({
+            ...options,
+            signal: options.signal
+                ? AbortSignal.any([
+                    options.signal,
+                    AbortSignal.timeout(options.deadlineMs ?? doctorDefaults.deadlineMs),
+                ])
+                : AbortSignal.timeout(options.deadlineMs ?? doctorDefaults.deadlineMs),
+        });
+        await lease.upload(source, `${remote}/payload`, bounded());
+        const verified = await invoke({
+            executable: "node",
+            arguments: ["-e", recipe.verify, `${remote}/payload`, recipe.base64],
+        });
+        if (verified.status !== 0)
+            throw new Error("verify");
+        const destination = join(directory, "download");
+        await lease.download(`${remote}/payload`, destination, bounded());
+        if (!(await readFile(destination)).equals(payload))
+            throw new Error("download");
+        checks.push({
+            id: "sandbox.transfers",
+            status: "pass",
+            message: "Binary upload verified by a sandbox process; downloaded bytes match. Symlinks, permissions, directories and batch transfers remain unverified.",
+        });
+    }
+    catch {
+        checks.push({
+            id: "sandbox.transfers",
+            status: "fail",
+            message: "Bounded binary transfer probe failed or was interrupted.",
+        });
+    }
+    finally {
+        if (cleanupNeeded) {
+            try {
+                const result = await lease.invoke({
+                    executable: "node",
+                    arguments: ["-e", recipe.cleanup, remote],
+                    deadlineMs: options.deadlineMs ?? doctorDefaults.deadlineMs,
+                    signal: AbortSignal.timeout(options.deadlineMs ?? doctorDefaults.deadlineMs),
+                    retain: doctorDefaults.retain,
+                });
+                if (result.status !== 0)
+                    throw new Error("cleanup");
+                checks.push({
+                    id: "sandbox.transfers.cleanup",
+                    status: "pass",
+                    message: "Temporary sandbox probe directory removed.",
+                });
+            }
+            catch {
+                checks.push({
+                    id: "sandbox.transfers.cleanup",
+                    status: "fail",
+                    message: `Temporary probe cleanup could not be confirmed; inspect ${remote}. The caller still owns the sandbox.`,
+                });
+            }
+        }
+        await rm(directory, { recursive: true, force: true });
+    }
+    return checks;
+}
+//# sourceMappingURL=doctor-transfers.js.map

package/dist/application/doctor-transfers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-transfers.js","sourceRoot":"","sources":["../../src/application/doctor-transfers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,wBAAwB,IAAI,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAErF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAmB,EACnB,OAAwB,EACxB,MAAgB;IAEhB,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,mBAAmB,UAAU,EAAE,EAAE,CAAC;IACpF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;YAC1B,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;SACzC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,aAAa,GAAG,KAAK,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC;YACrB,GAAG,OAAO;YACV,MAAM,EAAE,OAAO,CAAC,MAAM;gBACpB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC;oBACd,OAAO,CAAC,MAAM;oBACd,WAAW,CAAC,OAAO,CACjB,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC,UAAU,CAChD;iBACF,CAAC;gBACJ,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC,UAAU,CAAC;SACzE,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC;YAC5B,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;SACrE,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,MAAM,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,mBAAmB;YACvB,MAAM,EAAE,MAAM;YACd,OAAO,EACL,gJAAgJ;SACnJ,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,mBAAmB;YACvB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;oBAChC,UAAU,EAAE,MAAM;oBAClB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC;oBACzC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC,UAAU;oBAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CACzB,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC,UAAU,CAChD;oBACD,MAAM,EAAE,cAAc,CAAC,MAAM;iBAC9B,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;gBACpD,MAAM,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,2BAA2B;oBAC/B,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,4CAA4C;iBACtD,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,2BAA2B;oBAC/B,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,2DAA2D,MAAM,sCAAsC;iBACjH,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { mkdtemp, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { SandboxLease, TransferOptions } from \"../domain/sandbox.types.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\nimport { doctorDefaults } from \"./doctor.constants.ts\";\nimport type { DiagnosticCheck } from \"./doctor.types.ts\";\nimport { transferDiagnosticRecipe as recipe } from \"./doctor-transfers.constants.ts\";\n\nexport async function diagnoseTransfers(\n  lease: SandboxLease,\n  options: TransferOptions,\n  invoke: Executor,\n): Promise<DiagnosticCheck[]> {\n  const checks: DiagnosticCheck[] = [];\n  const directory = await mkdtemp(join(tmpdir(), \"outpost-probe-\"));\n  const remote = `${lease.root.replace(/[\\\\/]$/, \"\")}/.outpost-probe-${randomUUID()}`;\n  const source = join(directory, \"source\");\n  let cleanupNeeded = false;\n  try {\n    cleanupNeeded = true;\n    const result = await invoke({\n      executable: \"node\",\n      arguments: [\"-e\", recipe.create, remote],\n    });\n    if (result.status !== 0) {\n      cleanupNeeded = false;\n      throw new Error(\"create\");\n    }\n    const payload = Buffer.from(recipe.base64, \"base64\");\n    await writeFile(source, payload, { mode: 0o600 });\n    const bounded = () => ({\n      ...options,\n      signal: options.signal\n        ? AbortSignal.any([\n            options.signal,\n            AbortSignal.timeout(\n              options.deadlineMs ?? doctorDefaults.deadlineMs,\n            ),\n          ])\n        : AbortSignal.timeout(options.deadlineMs ?? doctorDefaults.deadlineMs),\n    });\n    await lease.upload(source, `${remote}/payload`, bounded());\n    const verified = await invoke({\n      executable: \"node\",\n      arguments: [\"-e\", recipe.verify, `${remote}/payload`, recipe.base64],\n    });\n    if (verified.status !== 0) throw new Error(\"verify\");\n    const destination = join(directory, \"download\");\n    await lease.download(`${remote}/payload`, destination, bounded());\n    if (!(await readFile(destination)).equals(payload))\n      throw new Error(\"download\");\n    checks.push({\n      id: \"sandbox.transfers\",\n      status: \"pass\",\n      message:\n        \"Binary upload verified by a sandbox process; downloaded bytes match. Symlinks, permissions, directories and batch transfers remain unverified.\",\n    });\n  } catch {\n    checks.push({\n      id: \"sandbox.transfers\",\n      status: \"fail\",\n      message: \"Bounded binary transfer probe failed or was interrupted.\",\n    });\n  } finally {\n    if (cleanupNeeded) {\n      try {\n        const result = await lease.invoke({\n          executable: \"node\",\n          arguments: [\"-e\", recipe.cleanup, remote],\n          deadlineMs: options.deadlineMs ?? doctorDefaults.deadlineMs,\n          signal: AbortSignal.timeout(\n            options.deadlineMs ?? doctorDefaults.deadlineMs,\n          ),\n          retain: doctorDefaults.retain,\n        });\n        if (result.status !== 0) throw new Error(\"cleanup\");\n        checks.push({\n          id: \"sandbox.transfers.cleanup\",\n          status: \"pass\",\n          message: \"Temporary sandbox probe directory removed.\",\n        });\n      } catch {\n        checks.push({\n          id: \"sandbox.transfers.cleanup\",\n          status: \"fail\",\n          message: `Temporary probe cleanup could not be confirmed; inspect ${remote}. The caller still owns the sandbox.`,\n        });\n      }\n    }\n    await rm(directory, { recursive: true, force: true });\n  }\n  return checks;\n}\n"]}

package/dist/application/doctor.constants.d.ts

@@ -0,0 +1,9 @@
+import type { DoctorProvider, DoctorReport } from "./doctor.types.ts";
+export declare const doctorDefaults: Readonly<{
+    readonly provider: "docker";
+    readonly agent: "codex";
+    readonly deadlineMs: 5000;
+    readonly retain: 4096;
+    readonly minimumNodeMajor: 24;
+}>;
+export declare const providerDiagnostics: Readonly<Record<DoctorProvider, Pick<DoctorReport, "placement" | "interactiveTerminal">>>;

package/dist/application/doctor.constants.js

@@ -0,0 +1,15 @@
+export const doctorDefaults = Object.freeze({
+    provider: "docker",
+    agent: "codex",
+    deadlineMs: 5_000,
+    retain: 4_096,
+    minimumNodeMajor: 24,
+});
+export const providerDiagnostics = {
+    docker: { placement: "mounted", interactiveTerminal: true },
+    podman: { placement: "mounted", interactiveTerminal: true },
+    local: { placement: "host", interactiveTerminal: true },
+    vercel: { placement: "remote", interactiveTerminal: false },
+    daytona: { placement: "remote", interactiveTerminal: false },
+};
+//# sourceMappingURL=doctor.constants.js.map

package/dist/application/doctor.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.constants.js","sourceRoot":"","sources":["../../src/application/doctor.constants.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IACb,gBAAgB,EAAE,EAAE;CACZ,CAAC,CAAC;AACZ,MAAM,CAAC,MAAM,mBAAmB,GAK5B;IACF,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE;IAC3D,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE;IAC3D,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE;IACvD,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE;IAC3D,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE;CAC7D,CAAC","sourcesContent":["import type { DoctorProvider, DoctorReport } from \"./doctor.types.ts\";\nexport const doctorDefaults = Object.freeze({\n  provider: \"docker\",\n  agent: \"codex\",\n  deadlineMs: 5_000,\n  retain: 4_096,\n  minimumNodeMajor: 24,\n} as const);\nexport const providerDiagnostics: Readonly<\n  Record<\n    DoctorProvider,\n    Pick<DoctorReport, \"placement\" | \"interactiveTerminal\">\n  >\n> = {\n  docker: { placement: \"mounted\", interactiveTerminal: true },\n  podman: { placement: \"mounted\", interactiveTerminal: true },\n  local: { placement: \"host\", interactiveTerminal: true },\n  vercel: { placement: \"remote\", interactiveTerminal: false },\n  daytona: { placement: \"remote\", interactiveTerminal: false },\n};\n"]}

package/dist/application/doctor.d.ts

@@ -0,0 +1,3 @@
+import type { Executor } from "../infrastructure/process.types.ts";
+import type { DoctorOptions, DoctorReport } from "./doctor.types.ts";
+export declare function diagnose(options: DoctorOptions, execute?: Executor): Promise<DoctorReport>;