@elie-laloum/outpost 2.0.0 → 3.0.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 3.0.0
+
+- Canonicalize temporary recovery verification directories across platforms and reuse existing Podman cache volumes without recreation.
+- Breaking: custom implementations of `Sandbox`, `TaskContext` and `WorkflowResult` must provide `diagnose`, `reportUsage` and `usage`, respectively; exhaustive workflow observers must handle the new `attempt` and `usage` events. Factory-created objects provide these members automatically.
+- Treat uncertain or legacy lock ownership conservatively; simultaneous writers to the same configured journal now conflict instead of sharing the file.
+- Add shared workflow attempt and observed usage budgets, including retries and agent repairs, with graceful admission draining and cooperative token-limit cancellation.
+- Add structured workflow usage/lifecycle events and an optional OpenTelemetry entry point with injected tracer/meter, fixed span names, counters and duration histograms without task contents or identifiers.
+- Diagnose caller-owned sandboxes through an exclusive operation, with optional binary transfer probes and cleanup; report observed capabilities separately from advertised contracts and bundled agent protocol fixture checks.
+- Add credential-free cloud contract fixtures and explicitly enabled scheduled Vercel/Daytona checks with sanitized reports, independent cleanup and optional live CLI syntax probes; authenticated model turns remain outside this suite.
+- Wait for Daytona command exit status after output closes, and register allocation cleanup before discovering the sandbox home.
+- Add explicit recovery retention plans, revalidated cleanup and quota admission; protect recovery artifacts, uncertain logs and workspaces containing ignored files.
+- Observe lock ownership using Linux host, boot, namespace and process-start identity; serialize stale-lock reclamation and refuse uncertain owners.
+- Verify retained Git bundles, objects and patch applicability in an isolated copy without inherited Git filters or changes to the source repository.
+- Add opt-in Docker/Podman dependency caches with explicit invalidation keys and repository, image and user scoping; add pinned agent-image build tooling and a gated publication workflow with signed provenance verification.
+- Download changed untracked files from Vercel/Daytona using SHA-256 manifests and bounded gzip batches; reuse verified unchanged files while retaining complete recovery payloads and protecting ignored host files.
+- Record atomic SHA-256 manifests for new remote transfer backups before host apply; add opt-in `recovery verify --checksums` with bounded streaming verification, explicit missing/mismatched results and preserved host state on capture failure.
+- Add read-only `recovery verify --directory` checks for retained transfer metadata and required backup files, with bounded state parsing and explicit separation from content integrity or restoration validation.
+- Add optional `recovery inspect --locks` with bounded lock metadata reads and local PID observations; report invalid or unverifiable records explicitly without claiming ownership or deleting locks.
+- Add optional `recovery inspect --git` workspace reports with branch/detached HEAD, clean/dirty status, Git locks and explicit unregistered/unavailable states, without refreshing indexes or pruning registrations.
+- Add read-only `outpost recovery inspect` reports for recovery files, logs, locks and managed workspaces, with metadata-only logical sizes, symlink protection and explicit partial results when traversal limits or filesystem errors prevent a complete inventory.
+- Check default agent start/resume/fork CLI help inside diagnostic images, verifying command usage and declared options instead of trusting a successful help exit; keep real execution and protocol compatibility explicitly unverified.
+- Extend `doctor --image` to check a local Docker/Podman image in a temporary sandbox, without image downloads or networking; report image agent versions and cleanup failures separately from host checks.
+- Add `outpost doctor` with bounded host prerequisite checks, Docker/Podman connectivity, host agent version comparison, explicit unchecked capabilities and JSON reports.
+
 ## 2.0.0
 
 - Normalize the workflow test directory before computing relative repository paths, fixing macOS CI with symlinked temporary directories.

package/dist/adapters/agents/claude-diagnostics.d.ts

@@ -0,0 +1 @@
+export declare function claudeDiagnostics(): readonly import("./cli-diagnostics.types.ts").AgentCliDiagnostic[];

package/dist/adapters/agents/claude-diagnostics.js

@@ -0,0 +1,7 @@
+import { claudeDiagnosticUsage } from "./cli-diagnostics.constants.js";
+import { cliDiagnostics } from "./cli-diagnostics.js";
+import { claudeRequest } from "./claude-request.js";
+export function claudeDiagnostics() {
+    return cliDiagnostics((input) => claudeRequest({}, input), claudeDiagnosticUsage);
+}
+//# sourceMappingURL=claude-diagnostics.js.map

package/dist/adapters/agents/claude-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-diagnostics.js","sourceRoot":"","sources":["../../../src/adapters/agents/claude-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,CACnB,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,EACnC,qBAAqB,CACtB,CAAC;AACJ,CAAC","sourcesContent":["import { claudeDiagnosticUsage } from \"./cli-diagnostics.constants.ts\";\nimport { cliDiagnostics } from \"./cli-diagnostics.ts\";\nimport { claudeRequest } from \"./claude-request.ts\";\n\nexport function claudeDiagnostics() {\n  return cliDiagnostics(\n    (input) => claudeRequest({}, input),\n    claudeDiagnosticUsage,\n  );\n}\n"]}

package/dist/adapters/agents/cli-diagnostics.constants.d.ts

@@ -0,0 +1,12 @@
+import type { AgentCliScenario } from "./cli-diagnostics.types.ts";
+export declare const cliDiagnosticScenarios: readonly AgentCliScenario[];
+export declare const codexDiagnosticUsage: {
+    readonly start: "codex exec";
+    readonly resume: "codex exec resume";
+    readonly fork: "codex exec fork";
+};
+export declare const claudeDiagnosticUsage: {
+    readonly start: "claude";
+    readonly resume: "claude";
+    readonly fork: "claude";
+};

package/dist/adapters/agents/cli-diagnostics.constants.js

@@ -0,0 +1,24 @@
+export const cliDiagnosticScenarios = [
+    { mode: "start", input: {} },
+    {
+        mode: "resume",
+        input: { continuation: { id: "00000000-0000-0000-0000-000000000000" } },
+    },
+    {
+        mode: "fork",
+        input: {
+            continuation: { id: "00000000-0000-0000-0000-000000000000", fork: true },
+        },
+    },
+];
+export const codexDiagnosticUsage = {
+    start: "codex exec",
+    resume: "codex exec resume",
+    fork: "codex exec fork",
+};
+export const claudeDiagnosticUsage = {
+    start: "claude",
+    resume: "claude",
+    fork: "claude",
+};
+//# sourceMappingURL=cli-diagnostics.constants.js.map

package/dist/adapters/agents/cli-diagnostics.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-diagnostics.constants.js","sourceRoot":"","sources":["../../../src/adapters/agents/cli-diagnostics.constants.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,sBAAsB,GAAgC;IACjE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE;IAC5B;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,sCAAsC,EAAE,EAAE;KACxE;IACD;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE;YACL,YAAY,EAAE,EAAE,EAAE,EAAE,sCAAsC,EAAE,IAAI,EAAE,IAAI,EAAE;SACzE;KACF;CACF,CAAC;AACF,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,mBAAmB;IAC3B,IAAI,EAAE,iBAAiB;CACf,CAAC;AACX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,QAAQ;CACN,CAAC","sourcesContent":["import type { AgentCliScenario } from \"./cli-diagnostics.types.ts\";\n\nexport const cliDiagnosticScenarios: readonly AgentCliScenario[] = [\n  { mode: \"start\", input: {} },\n  {\n    mode: \"resume\",\n    input: { continuation: { id: \"00000000-0000-0000-0000-000000000000\" } },\n  },\n  {\n    mode: \"fork\",\n    input: {\n      continuation: { id: \"00000000-0000-0000-0000-000000000000\", fork: true },\n    },\n  },\n];\nexport const codexDiagnosticUsage = {\n  start: \"codex exec\",\n  resume: \"codex exec resume\",\n  fork: \"codex exec fork\",\n} as const;\nexport const claudeDiagnosticUsage = {\n  start: \"claude\",\n  resume: \"claude\",\n  fork: \"claude\",\n} as const;\n"]}

package/dist/adapters/agents/cli-diagnostics.d.ts

@@ -0,0 +1,4 @@
+import type { AgentInput } from "../../domain/agent.types.ts";
+import type { Command } from "../../domain/command.types.ts";
+import type { AgentCliDiagnostic, AgentCliMode } from "./cli-diagnostics.types.ts";
+export declare function cliDiagnostics(request: (input: AgentInput) => Command, usage: Readonly<Record<AgentCliMode, string>>): readonly AgentCliDiagnostic[];

package/dist/adapters/agents/cli-diagnostics.js

@@ -0,0 +1,14 @@
+import { cliDiagnosticScenarios } from "./cli-diagnostics.constants.js";
+export function cliDiagnostics(request, usage) {
+    return cliDiagnosticScenarios.map(({ mode, input }) => {
+        const command = request(input);
+        const args = command.arguments ?? [];
+        return {
+            mode,
+            usage: usage[mode],
+            options: args.filter((argument) => argument.startsWith("--")),
+            command: { ...command, arguments: [...args, "--help"] },
+        };
+    });
+}
+//# sourceMappingURL=cli-diagnostics.js.map

package/dist/adapters/agents/cli-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-diagnostics.js","sourceRoot":"","sources":["../../../src/adapters/agents/cli-diagnostics.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAMxE,MAAM,UAAU,cAAc,CAC5B,OAAuC,EACvC,KAA6C;IAE7C,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACrC,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC;YAClB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { AgentInput } from \"../../domain/agent.types.ts\";\nimport type { Command } from \"../../domain/command.types.ts\";\nimport { cliDiagnosticScenarios } from \"./cli-diagnostics.constants.ts\";\nimport type {\n  AgentCliDiagnostic,\n  AgentCliMode,\n} from \"./cli-diagnostics.types.ts\";\n\nexport function cliDiagnostics(\n  request: (input: AgentInput) => Command,\n  usage: Readonly<Record<AgentCliMode, string>>,\n): readonly AgentCliDiagnostic[] {\n  return cliDiagnosticScenarios.map(({ mode, input }) => {\n    const command = request(input);\n    const args = command.arguments ?? [];\n    return {\n      mode,\n      usage: usage[mode],\n      options: args.filter((argument) => argument.startsWith(\"--\")),\n      command: { ...command, arguments: [...args, \"--help\"] },\n    };\n  });\n}\n"]}

package/dist/adapters/agents/cli-diagnostics.types.d.ts

@@ -0,0 +1,13 @@
+import type { AgentInput } from "../../domain/agent.types.ts";
+import type { Command } from "../../domain/command.types.ts";
+export type AgentCliMode = "start" | "resume" | "fork";
+export interface AgentCliScenario {
+    readonly mode: AgentCliMode;
+    readonly input: AgentInput;
+}
+export interface AgentCliDiagnostic {
+    readonly mode: AgentCliMode;
+    readonly command: Command;
+    readonly usage: string;
+    readonly options: readonly string[];
+}

package/dist/adapters/agents/cli-diagnostics.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli-diagnostics.types.js.map

package/dist/adapters/agents/cli-diagnostics.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-diagnostics.types.js","sourceRoot":"","sources":["../../../src/adapters/agents/cli-diagnostics.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { AgentInput } from \"../../domain/agent.types.ts\";\nimport type { Command } from \"../../domain/command.types.ts\";\n\nexport type AgentCliMode = \"start\" | \"resume\" | \"fork\";\nexport interface AgentCliScenario {\n  readonly mode: AgentCliMode;\n  readonly input: AgentInput;\n}\nexport interface AgentCliDiagnostic {\n  readonly mode: AgentCliMode;\n  readonly command: Command;\n  readonly usage: string;\n  readonly options: readonly string[];\n}\n"]}

package/dist/adapters/agents/codex-diagnostics.d.ts

@@ -0,0 +1 @@
+export declare function codexDiagnostics(): readonly import("./cli-diagnostics.types.ts").AgentCliDiagnostic[];

package/dist/adapters/agents/codex-diagnostics.js

@@ -0,0 +1,7 @@
+import { codexDiagnosticUsage } from "./cli-diagnostics.constants.js";
+import { cliDiagnostics } from "./cli-diagnostics.js";
+import { codexRequest } from "./codex-request.js";
+export function codexDiagnostics() {
+    return cliDiagnostics((input) => codexRequest({}, input), codexDiagnosticUsage);
+}
+//# sourceMappingURL=codex-diagnostics.js.map

package/dist/adapters/agents/codex-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-diagnostics.js","sourceRoot":"","sources":["../../../src/adapters/agents/codex-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,UAAU,gBAAgB;IAC9B,OAAO,cAAc,CACnB,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,EAClC,oBAAoB,CACrB,CAAC;AACJ,CAAC","sourcesContent":["import { codexDiagnosticUsage } from \"./cli-diagnostics.constants.ts\";\nimport { cliDiagnostics } from \"./cli-diagnostics.ts\";\nimport { codexRequest } from \"./codex-request.ts\";\n\nexport function codexDiagnostics() {\n  return cliDiagnostics(\n    (input) => codexRequest({}, input),\n    codexDiagnosticUsage,\n  );\n}\n"]}

package/dist/adapters/agents/protocol-fixtures.constants.d.ts

@@ -0,0 +1,2 @@
+import type { AgentProtocolFixture } from "./protocol-fixtures.types.ts";
+export declare const protocolFixtures: Readonly<Record<"claude" | "codex", readonly AgentProtocolFixture[]>>;

package/dist/adapters/agents/protocol-fixtures.constants.js

@@ -0,0 +1,68 @@
+export const protocolFixtures = {
+    codex: [
+        {
+            name: "turn",
+            lines: [
+                '{"type":"thread.started","thread_id":"fixture-conversation"}',
+                '{"type":"item.started","item":{"type":"command_execution","command":"fixture-command"}}',
+                '{"type":"item.completed","item":{"type":"agent_message","text":"fixture-result"}}',
+                '{"type":"turn.completed","usage":{"input_tokens":10,"cached_input_tokens":2,"output_tokens":3}}',
+            ],
+            expected: [
+                { kind: "conversation", id: "fixture-conversation" },
+                { kind: "tool", name: "command", input: "fixture-command" },
+                { kind: "text", text: "fixture-result" },
+                { kind: "usage", tokens: { input: 10, cached: 2, output: 3 } },
+                { kind: "finished" },
+            ],
+        },
+        {
+            name: "failure",
+            lines: ['{"type":"turn.failed","error":{"message":"fixture-failure"}}'],
+            expected: [{ kind: "failure", message: "fixture-failure" }],
+        },
+        {
+            name: "unknown",
+            lines: ['{"type":"future.event"}', "invalid-json"],
+            expected: [
+                { kind: "raw", value: { type: "future.event" } },
+                { kind: "raw", value: "invalid-json" },
+            ],
+        },
+    ],
+    claude: [
+        {
+            name: "turn",
+            lines: [
+                '{"type":"system","session_id":"fixture-conversation"}',
+                '{"type":"assistant","message":{"content":[{"type":"tool_use","name":"command","input":"fixture-command"},{"type":"text","text":"fixture-result"}]}}',
+                '{"type":"result","result":"fixture-result","usage":{"input_tokens":10,"cache_creation_input_tokens":1,"cache_read_input_tokens":2,"output_tokens":3}}',
+            ],
+            expected: [
+                { kind: "conversation", id: "fixture-conversation" },
+                { kind: "tool", name: "command", input: "fixture-command" },
+                { kind: "text", text: "fixture-result" },
+                { kind: "result", text: "fixture-result" },
+                {
+                    kind: "usage",
+                    tokens: { input: 10, cached: 2, cacheCreated: 1, output: 3 },
+                },
+                { kind: "finished" },
+            ],
+        },
+        {
+            name: "failure",
+            lines: ['{"type":"result","is_error":true,"result":"fixture-failure"}'],
+            expected: [{ kind: "failure", message: "fixture-failure" }],
+        },
+        {
+            name: "unknown",
+            lines: ['{"type":"future.event"}', "invalid-json"],
+            expected: [
+                { kind: "raw", value: { type: "future.event" } },
+                { kind: "raw", value: "invalid-json" },
+            ],
+        },
+    ],
+};
+//# sourceMappingURL=protocol-fixtures.constants.js.map

package/dist/adapters/agents/protocol-fixtures.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-fixtures.constants.js","sourceRoot":"","sources":["../../../src/adapters/agents/protocol-fixtures.constants.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,gBAAgB,GAEzB;IACF,KAAK,EAAE;QACL;YACE,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE;gBACL,8DAA8D;gBAC9D,yFAAyF;gBACzF,mFAAmF;gBACnF,iGAAiG;aAClG;YACD,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,sBAAsB,EAAE;gBACpD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE;gBAC3D,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE;gBACxC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE;gBAC9D,EAAE,IAAI,EAAE,UAAU,EAAE;aACrB;SACF;QACD;YACE,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,CAAC,8DAA8D,CAAC;YACvE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;SAC5D;QACD;YACE,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,CAAC,yBAAyB,EAAE,cAAc,CAAC;YAClD,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE;gBAChD,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE;aACvC;SACF;KACF;IACD,MAAM,EAAE;QACN;YACE,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE;gBACL,uDAAuD;gBACvD,qJAAqJ;gBACrJ,uJAAuJ;aACxJ;YACD,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,sBAAsB,EAAE;gBACpD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE;gBAC3D,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE;gBACxC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE;gBAC1C;oBACE,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;iBAC7D;gBACD,EAAE,IAAI,EAAE,UAAU,EAAE;aACrB;SACF;QACD;YACE,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,CAAC,8DAA8D,CAAC;YACvE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;SAC5D;QACD;YACE,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,CAAC,yBAAyB,EAAE,cAAc,CAAC;YAClD,QAAQ,EAAE;gBACR,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE;gBAChD,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE;aACvC;SACF;KACF;CACF,CAAC","sourcesContent":["import type { AgentProtocolFixture } from \"./protocol-fixtures.types.ts\";\n\nexport const protocolFixtures: Readonly<\n  Record<\"claude\" | \"codex\", readonly AgentProtocolFixture[]>\n> = {\n  codex: [\n    {\n      name: \"turn\",\n      lines: [\n        '{\"type\":\"thread.started\",\"thread_id\":\"fixture-conversation\"}',\n        '{\"type\":\"item.started\",\"item\":{\"type\":\"command_execution\",\"command\":\"fixture-command\"}}',\n        '{\"type\":\"item.completed\",\"item\":{\"type\":\"agent_message\",\"text\":\"fixture-result\"}}',\n        '{\"type\":\"turn.completed\",\"usage\":{\"input_tokens\":10,\"cached_input_tokens\":2,\"output_tokens\":3}}',\n      ],\n      expected: [\n        { kind: \"conversation\", id: \"fixture-conversation\" },\n        { kind: \"tool\", name: \"command\", input: \"fixture-command\" },\n        { kind: \"text\", text: \"fixture-result\" },\n        { kind: \"usage\", tokens: { input: 10, cached: 2, output: 3 } },\n        { kind: \"finished\" },\n      ],\n    },\n    {\n      name: \"failure\",\n      lines: ['{\"type\":\"turn.failed\",\"error\":{\"message\":\"fixture-failure\"}}'],\n      expected: [{ kind: \"failure\", message: \"fixture-failure\" }],\n    },\n    {\n      name: \"unknown\",\n      lines: ['{\"type\":\"future.event\"}', \"invalid-json\"],\n      expected: [\n        { kind: \"raw\", value: { type: \"future.event\" } },\n        { kind: \"raw\", value: \"invalid-json\" },\n      ],\n    },\n  ],\n  claude: [\n    {\n      name: \"turn\",\n      lines: [\n        '{\"type\":\"system\",\"session_id\":\"fixture-conversation\"}',\n        '{\"type\":\"assistant\",\"message\":{\"content\":[{\"type\":\"tool_use\",\"name\":\"command\",\"input\":\"fixture-command\"},{\"type\":\"text\",\"text\":\"fixture-result\"}]}}',\n        '{\"type\":\"result\",\"result\":\"fixture-result\",\"usage\":{\"input_tokens\":10,\"cache_creation_input_tokens\":1,\"cache_read_input_tokens\":2,\"output_tokens\":3}}',\n      ],\n      expected: [\n        { kind: \"conversation\", id: \"fixture-conversation\" },\n        { kind: \"tool\", name: \"command\", input: \"fixture-command\" },\n        { kind: \"text\", text: \"fixture-result\" },\n        { kind: \"result\", text: \"fixture-result\" },\n        {\n          kind: \"usage\",\n          tokens: { input: 10, cached: 2, cacheCreated: 1, output: 3 },\n        },\n        { kind: \"finished\" },\n      ],\n    },\n    {\n      name: \"failure\",\n      lines: ['{\"type\":\"result\",\"is_error\":true,\"result\":\"fixture-failure\"}'],\n      expected: [{ kind: \"failure\", message: \"fixture-failure\" }],\n    },\n    {\n      name: \"unknown\",\n      lines: ['{\"type\":\"future.event\"}', \"invalid-json\"],\n      expected: [\n        { kind: \"raw\", value: { type: \"future.event\" } },\n        { kind: \"raw\", value: \"invalid-json\" },\n      ],\n    },\n  ],\n};\n"]}

package/dist/adapters/agents/protocol-fixtures.types.d.ts

@@ -0,0 +1,6 @@
+import type { AgentEvent } from "../../domain/agent.types.ts";
+export interface AgentProtocolFixture {
+    readonly name: string;
+    readonly lines: readonly string[];
+    readonly expected: readonly AgentEvent[];
+}

package/dist/adapters/agents/protocol-fixtures.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=protocol-fixtures.types.js.map

package/dist/adapters/agents/protocol-fixtures.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-fixtures.types.js","sourceRoot":"","sources":["../../../src/adapters/agents/protocol-fixtures.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { AgentEvent } from \"../../domain/agent.types.ts\";\n\nexport interface AgentProtocolFixture {\n  readonly name: string;\n  readonly lines: readonly string[];\n  readonly expected: readonly AgentEvent[];\n}\n"]}

package/dist/application/diagnostic-probe.d.ts

@@ -0,0 +1,3 @@
+import type { Executor } from "../infrastructure/process.types.ts";
+import type { DiagnosticCheck, DiagnosticProbe } from "./doctor.types.ts";
+export declare function diagnosticProbe(probe: DiagnosticProbe, execute?: Executor): Promise<DiagnosticCheck>;

package/dist/application/diagnostic-probe.js

@@ -0,0 +1,55 @@
+import { OutpostError } from "../domain/errors.js";
+import { executeProcess } from "../infrastructure/process.js";
+import { doctorDefaults } from "./doctor.constants.js";
+export async function diagnosticProbe(probe, execute = executeProcess) {
+    const failure = (reason) => ({
+        id: probe.id,
+        status: probe.failureStatus,
+        message: `${reason}. ${probe.remedy}`,
+    });
+    try {
+        const result = await execute({
+            ...probe.command,
+            deadlineMs: doctorDefaults.deadlineMs,
+            retain: probe.command.retain ?? doctorDefaults.retain,
+        });
+        if (result.status !== 0)
+            return failure(`Exited with status ${result.status}`);
+        if (!probe.readVersion)
+            return {
+                id: probe.id,
+                status: "pass",
+                message: "Check succeeded.",
+            };
+        const version = /\bv?(\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?)\b/.exec(result.stdout || result.stderr)?.[1];
+        if (!version)
+            return failure("Version could not be identified");
+        if (probe.referenceVersion)
+            return {
+                id: probe.id,
+                status: version === probe.referenceVersion ? "pass" : "warn",
+                version,
+                referenceVersion: probe.referenceVersion,
+                message: version === probe.referenceVersion
+                    ? "Matches the version pinned by Outpost; protocol and authentication are not tested."
+                    : "Differs from the version pinned by Outpost; compatibility is unverified.",
+            };
+        return {
+            id: probe.id,
+            status: "pass",
+            version,
+            message: "Version identified.",
+        };
+    }
+    catch (error) {
+        if (error instanceof OutpostError && error.code === "timeout")
+            return failure("Check timed out");
+        if (error &&
+            typeof error === "object" &&
+            "code" in error &&
+            error.code === "ENOENT")
+            return failure("Executable not found on PATH");
+        return failure("Command could not be executed");
+    }
+}
+//# sourceMappingURL=diagnostic-probe.js.map

package/dist/application/diagnostic-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostic-probe.js","sourceRoot":"","sources":["../../src/application/diagnostic-probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAsB,EACtB,UAAoB,cAAc;IAElC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAmB,EAAE,CAAC,CAAC;QACpD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,OAAO,EAAE,GAAG,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE;KACtC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;YAC3B,GAAG,KAAK,CAAC,OAAO;YAChB,UAAU,EAAE,cAAc,CAAC,UAAU;YACrC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM;SACtD,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YACrB,OAAO,OAAO,CAAC,sBAAsB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,WAAW;YACpB,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,kBAAkB;aAC5B,CAAC;QACJ,MAAM,OAAO,GAAG,kDAAkD,CAAC,IAAI,CACrE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAC/B,EAAE,CAAC,CAAC,CAAC,CAAC;QACP,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,iCAAiC,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,gBAAgB;YACxB,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBAC5D,OAAO;gBACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,OAAO,EACL,OAAO,KAAK,KAAK,CAAC,gBAAgB;oBAChC,CAAC,CAAC,oFAAoF;oBACtF,CAAC,CAAC,0EAA0E;aACjF,CAAC;QACJ,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,MAAM,EAAE,MAAM;YACd,OAAO;YACP,OAAO,EAAE,qBAAqB;SAC/B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAC3D,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACpC,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ;YAEvB,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;AACH,CAAC","sourcesContent":["import { OutpostError } from \"../domain/errors.ts\";\nimport { executeProcess } from \"../infrastructure/process.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\nimport { doctorDefaults } from \"./doctor.constants.ts\";\nimport type { DiagnosticCheck, DiagnosticProbe } from \"./doctor.types.ts\";\n\nexport async function diagnosticProbe(\n  probe: DiagnosticProbe,\n  execute: Executor = executeProcess,\n): Promise<DiagnosticCheck> {\n  const failure = (reason: string): DiagnosticCheck => ({\n    id: probe.id,\n    status: probe.failureStatus,\n    message: `${reason}. ${probe.remedy}`,\n  });\n  try {\n    const result = await execute({\n      ...probe.command,\n      deadlineMs: doctorDefaults.deadlineMs,\n      retain: probe.command.retain ?? doctorDefaults.retain,\n    });\n    if (result.status !== 0)\n      return failure(`Exited with status ${result.status}`);\n    if (!probe.readVersion)\n      return {\n        id: probe.id,\n        status: \"pass\",\n        message: \"Check succeeded.\",\n      };\n    const version = /\\bv?(\\d+\\.\\d+\\.\\d+(?:-[\\w.-]+)?(?:\\+[\\w.-]+)?)\\b/.exec(\n      result.stdout || result.stderr,\n    )?.[1];\n    if (!version) return failure(\"Version could not be identified\");\n    if (probe.referenceVersion)\n      return {\n        id: probe.id,\n        status: version === probe.referenceVersion ? \"pass\" : \"warn\",\n        version,\n        referenceVersion: probe.referenceVersion,\n        message:\n          version === probe.referenceVersion\n            ? \"Matches the version pinned by Outpost; protocol and authentication are not tested.\"\n            : \"Differs from the version pinned by Outpost; compatibility is unverified.\",\n      };\n    return {\n      id: probe.id,\n      status: \"pass\",\n      version,\n      message: \"Version identified.\",\n    };\n  } catch (error) {\n    if (error instanceof OutpostError && error.code === \"timeout\")\n      return failure(\"Check timed out\");\n    if (\n      error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n    )\n      return failure(\"Executable not found on PATH\");\n    return failure(\"Command could not be executed\");\n  }\n}\n"]}

package/dist/application/doctor-agent.constants.d.ts

@@ -0,0 +1,9 @@
+import { claudeDiagnostics } from "../adapters/agents/claude-diagnostics.ts";
+import { codexDiagnostics } from "../adapters/agents/codex-diagnostics.ts";
+export declare const agentDiagnosticPlans: {
+    readonly claude: typeof claudeDiagnostics;
+    readonly codex: typeof codexDiagnostics;
+};
+export declare const agentDiagnosticDefaults: Readonly<{
+    retain: 65536;
+}>;

package/dist/application/doctor-agent.constants.js

@@ -0,0 +1,8 @@
+import { claudeDiagnostics } from "../adapters/agents/claude-diagnostics.js";
+import { codexDiagnostics } from "../adapters/agents/codex-diagnostics.js";
+export const agentDiagnosticPlans = {
+    claude: claudeDiagnostics,
+    codex: codexDiagnostics,
+};
+export const agentDiagnosticDefaults = Object.freeze({ retain: 65_536 });
+//# sourceMappingURL=doctor-agent.constants.js.map

package/dist/application/doctor-agent.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-agent.constants.js","sourceRoot":"","sources":["../../src/application/doctor-agent.constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAE3E,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,gBAAgB;CACf,CAAC;AACX,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC","sourcesContent":["import { claudeDiagnostics } from \"../adapters/agents/claude-diagnostics.ts\";\nimport { codexDiagnostics } from \"../adapters/agents/codex-diagnostics.ts\";\n\nexport const agentDiagnosticPlans = {\n  claude: claudeDiagnostics,\n  codex: codexDiagnostics,\n} as const;\nexport const agentDiagnosticDefaults = Object.freeze({ retain: 65_536 });\n"]}

package/dist/application/doctor-agent.d.ts

@@ -0,0 +1,3 @@
+import type { Executor } from "../infrastructure/process.types.ts";
+import type { DiagnosticCheck, DoctorAgent } from "./doctor.types.ts";
+export declare function diagnoseAgentCli(agent: DoctorAgent, execute: Executor): Promise<readonly DiagnosticCheck[]>;

package/dist/application/doctor-agent.js

@@ -0,0 +1,53 @@
+import { stripVTControlCharacters } from "node:util";
+import { diagnosticProbe } from "./diagnostic-probe.js";
+import { agentDiagnosticDefaults, agentDiagnosticPlans, } from "./doctor-agent.constants.js";
+export async function diagnoseAgentCli(agent, execute) {
+    const checks = [];
+    for (const plan of agentDiagnosticPlans[agent]()) {
+        let help = "";
+        const check = await diagnosticProbe({
+            id: `agent.cli.${plan.mode}`,
+            command: { ...plan.command, retain: agentDiagnosticDefaults.retain },
+            failureStatus: "fail",
+            remedy: "The default Outpost invocation with --help failed. Check the agent CLI in this image and rebuild it if needed.",
+        }, async (command) => {
+            const result = await execute(command);
+            help = stripVTControlCharacters(`${result.stdout}\n${result.stderr}`);
+            return result;
+        });
+        if (check.status !== "pass") {
+            checks.push(check);
+            continue;
+        }
+        const usage = help
+            .split(/\r?\n/)
+            .some((line) => line.trim().startsWith(`Usage: ${plan.usage} [`));
+        if (!usage) {
+            checks.push({
+                id: check.id,
+                status: "warn",
+                message: "Command exited successfully but the expected help could not be identified; CLI support is unverified.",
+            });
+            continue;
+        }
+        const declared = new Set([
+            ...help.matchAll(/^\s*(?:-[A-Za-z0-9?],?\s+)?(--[A-Za-z][\w-]*)\b/gm),
+        ].map((match) => match[1]));
+        const missing = plan.options.filter((option) => !declared.has(option));
+        if (missing.length) {
+            checks.push({
+                id: check.id,
+                status: "fail",
+                message: `Help does not declare required options: ${missing.join(", ")}. Rebuild the image with a CLI supporting Outpost's default invocation.`,
+            });
+            continue;
+        }
+        checks.push({
+            id: check.id,
+            status: "pass",
+            message: "Help identifies the command and declares the options used by Outpost's default invocation. Conversation execution and event decoding are not tested.",
+        });
+    }
+    return checks;
+}
+//# sourceMappingURL=doctor-agent.js.map

package/dist/application/doctor-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-agent.js","sourceRoot":"","sources":["../../src/application/doctor-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAkB,EAClB,OAAiB;IAEjB,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC;YACE,EAAE,EAAE,aAAa,IAAI,CAAC,IAAI,EAAE;YAC5B,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,uBAAuB,CAAC,MAAM,EAAE;YACpE,aAAa,EAAE,MAAM;YACrB,MAAM,EACJ,gHAAgH;SACnH,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,GAAG,wBAAwB,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACtE,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI;aACf,KAAK,CAAC,OAAO,CAAC;aACd,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EACL,uGAAuG;aAC1G,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB;YACE,GAAG,IAAI,CAAC,QAAQ,CAAC,mDAAmD,CAAC;SACtE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAC3B,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,yEAAyE;aAChJ,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EACL,sJAAsJ;SACzJ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { stripVTControlCharacters } from \"node:util\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\nimport { diagnosticProbe } from \"./diagnostic-probe.ts\";\nimport {\n  agentDiagnosticDefaults,\n  agentDiagnosticPlans,\n} from \"./doctor-agent.constants.ts\";\nimport type { DiagnosticCheck, DoctorAgent } from \"./doctor.types.ts\";\n\nexport async function diagnoseAgentCli(\n  agent: DoctorAgent,\n  execute: Executor,\n): Promise<readonly DiagnosticCheck[]> {\n  const checks: DiagnosticCheck[] = [];\n  for (const plan of agentDiagnosticPlans[agent]()) {\n    let help = \"\";\n    const check = await diagnosticProbe(\n      {\n        id: `agent.cli.${plan.mode}`,\n        command: { ...plan.command, retain: agentDiagnosticDefaults.retain },\n        failureStatus: \"fail\",\n        remedy:\n          \"The default Outpost invocation with --help failed. Check the agent CLI in this image and rebuild it if needed.\",\n      },\n      async (command) => {\n        const result = await execute(command);\n        help = stripVTControlCharacters(`${result.stdout}\\n${result.stderr}`);\n        return result;\n      },\n    );\n    if (check.status !== \"pass\") {\n      checks.push(check);\n      continue;\n    }\n    const usage = help\n      .split(/\\r?\\n/)\n      .some((line) => line.trim().startsWith(`Usage: ${plan.usage} [`));\n    if (!usage) {\n      checks.push({\n        id: check.id,\n        status: \"warn\",\n        message:\n          \"Command exited successfully but the expected help could not be identified; CLI support is unverified.\",\n      });\n      continue;\n    }\n    const declared = new Set(\n      [\n        ...help.matchAll(/^\\s*(?:-[A-Za-z0-9?],?\\s+)?(--[A-Za-z][\\w-]*)\\b/gm),\n      ].map((match) => match[1]),\n    );\n    const missing = plan.options.filter((option) => !declared.has(option));\n    if (missing.length) {\n      checks.push({\n        id: check.id,\n        status: \"fail\",\n        message: `Help does not declare required options: ${missing.join(\", \")}. Rebuild the image with a CLI supporting Outpost's default invocation.`,\n      });\n      continue;\n    }\n    checks.push({\n      id: check.id,\n      status: \"pass\",\n      message:\n        \"Help identifies the command and declares the options used by Outpost's default invocation. Conversation execution and event decoding are not tested.\",\n    });\n  }\n  return checks;\n}\n"]}

package/dist/application/doctor-image.d.ts

@@ -0,0 +1,3 @@
+import type { Executor } from "../infrastructure/process.types.ts";
+import type { DiagnosticCheck, DoctorImageOptions } from "./doctor.types.ts";
+export declare function diagnoseImage(options: DoctorImageOptions, execute?: Executor): Promise<readonly DiagnosticCheck[]>;

package/dist/application/doctor-image.js

@@ -0,0 +1,133 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { OutpostError } from "../domain/errors.js";
+import { executeProcess } from "../infrastructure/process.js";
+import { registerCleanup } from "../infrastructure/shutdown.js";
+import { diagnosticContainer } from "../providers/diagnostic-container.js";
+import { agentVersions } from "../providers/versions.constants.js";
+import { diagnoseAgentCli } from "./doctor-agent.js";
+import { diagnosticProbe } from "./diagnostic-probe.js";
+import { doctorDefaults } from "./doctor.constants.js";
+export async function diagnoseImage(options, execute = executeProcess) {
+    const stop = new AbortController();
+    const pending = inspectImage(options, execute, stop.signal);
+    const unregister = registerCleanup(async () => {
+        stop.abort(new OutpostError("aborted", "Image diagnostics interrupted"));
+        await pending;
+    });
+    try {
+        return await pending;
+    }
+    finally {
+        unregister();
+    }
+}
+async function inspectImage({ provider, agent, image }, execute, signal) {
+    const directory = await mkdtemp(join(tmpdir(), "outpost-doctor-"));
+    const checks = [];
+    let lease;
+    let retained = false;
+    let container;
+    const tracked = (command) => {
+        if (command.arguments?.[0] === "create") {
+            const index = command.arguments.indexOf("--name");
+            container = command.arguments[index + 1];
+        }
+        return execute(command);
+    };
+    try {
+        lease = await diagnosticContainer(provider, image, doctorDefaults.deadlineMs, tracked).acquire({
+            repository: directory,
+            directory,
+            gitDirectories: [],
+            variables: {},
+            signal,
+        });
+        checks.push({
+            id: "image.runtime",
+            status: "pass",
+            message: "Temporary sandbox started with network disabled and an empty workspace.",
+        });
+        const sandbox = lease;
+        const invoke = (command) => sandbox.invoke({ ...command, signal });
+        for (const executable of ["node", "git"]) {
+            checks.push(await diagnosticProbe({
+                id: `image.${executable}`,
+                command: { executable, arguments: ["--version"] },
+                failureStatus: "fail",
+                readVersion: true,
+                remedy: `Install ${executable} in the image and rebuild it.`,
+            }, invoke));
+        }
+        checks.push(await diagnosticProbe({
+            id: "image.home",
+            command: {
+                executable: "sh",
+                arguments: ["-c", 'test -d "$HOME" && test -w "$HOME"'],
+            },
+            failureStatus: "fail",
+            remedy: "Check the image user and permissions of the private agent home.",
+        }, invoke));
+        const agentVersion = await diagnosticProbe({
+            id: "agent.sandbox",
+            command: { executable: agent, arguments: ["--version"] },
+            failureStatus: "fail",
+            readVersion: true,
+            referenceVersion: agentVersions[agent],
+            remedy: `Install ${agent} in the image and rebuild it. This check does not bootstrap agents.`,
+        }, invoke);
+        checks.push(agentVersion);
+        if (agentVersion.status === "fail")
+            checks.push({
+                id: "agent.cli",
+                status: "skipped",
+                message: "CLI help checks require a successful agent version probe.",
+            });
+        else
+            checks.push(...(await diagnoseAgentCli(agent, invoke)));
+    }
+    catch (error) {
+        retained = error instanceof AggregateError;
+        checks.push({
+            id: "image.runtime",
+            status: "fail",
+            message: "Image diagnostics could not start. Check that the image exists locally, its UID matches the host, and sh, sleep, setsid, kill, tar and cp are installed. No image is downloaded.",
+        });
+    }
+    finally {
+        if (lease) {
+            try {
+                await lease.release();
+                checks.push({
+                    id: "image.cleanup",
+                    status: "pass",
+                    message: "Diagnostic container removed.",
+                });
+            }
+            catch {
+                retained = true;
+            }
+        }
+        if (retained)
+            checks.push({
+                id: "image.cleanup",
+                status: "fail",
+                message: `Cleanup could not be confirmed. Inspect container ${container ?? "creation state"} with ${provider}; temporary workspace retained at ${directory}.`,
+            });
+        if (!retained) {
+            try {
+                await rm(directory, { recursive: true, force: true });
+            }
+            catch {
+                checks.push({
+                    id: "image.workspace",
+                    status: "fail",
+                    message: `Could not remove temporary workspace ${directory}.`,
+                });
+            }
+        }
+    }
+    return checks;
+}
+//# sourceMappingURL=doctor-image.js.map

package/dist/application/doctor-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-image.js","sourceRoot":"","sources":["../../src/application/doctor-image.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA2B,EAC3B,UAAoB,cAAc;IAElC,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,IAAI,EAAE;QAC5C,IAAI,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC,CAAC;QACzE,MAAM,OAAO,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,UAAU,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAsB,EAC9C,OAAiB,EACjB,MAAmB;IAEnB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,KAA+B,CAAC;IACpC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAA6B,CAAC;IAClC,MAAM,OAAO,GAAa,CAAC,OAAO,EAAE,EAAE;QACpC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAC/B,QAAQ,EACR,KAAK,EACL,cAAc,CAAC,UAAU,EACzB,OAAO,CACR,CAAC,OAAO,CAAC;YACR,UAAU,EAAE,SAAS;YACrB,SAAS;YACT,cAAc,EAAE,EAAE;YAClB,SAAS,EAAE,EAAE;YACb,MAAM;SACP,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,eAAe;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EACL,yEAAyE;SAC5E,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC;QACtB,MAAM,MAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CACnC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,KAAK,MAAM,UAAU,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CACT,MAAM,eAAe,CACnB;gBACE,EAAE,EAAE,SAAS,UAAU,EAAE;gBACzB,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE;gBACjD,aAAa,EAAE,MAAM;gBACrB,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,WAAW,UAAU,+BAA+B;aAC7D,EACD,MAAM,CACP,CACF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CACT,MAAM,eAAe,CACnB;YACE,EAAE,EAAE,YAAY;YAChB,OAAO,EAAE;gBACP,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,CAAC,IAAI,EAAE,oCAAoC,CAAC;aACxD;YACD,aAAa,EAAE,MAAM;YACrB,MAAM,EACJ,iEAAiE;SACpE,EACD,MAAM,CACP,CACF,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,eAAe,CACxC;YACE,EAAE,EAAE,eAAe;YACnB,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE;YACxD,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC;YACtC,MAAM,EAAE,WAAW,KAAK,qEAAqE;SAC9F,EACD,MAAM,CACP,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1B,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM;YAChC,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,WAAW;gBACf,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;;YACA,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,GAAG,KAAK,YAAY,cAAc,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,eAAe;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EACL,kLAAkL;SACrL,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,eAAe;oBACnB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,+BAA+B;iBACzC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ;YACV,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,eAAe;gBACnB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,qDAAqD,SAAS,IAAI,gBAAgB,SAAS,QAAQ,qCAAqC,SAAS,GAAG;aAC9J,CAAC,CAAC;QACL,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,iBAAiB;oBACrB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,wCAAwC,SAAS,GAAG;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { mkdtemp, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { OutpostError } from \"../domain/errors.ts\";\nimport type { SandboxLease } from \"../domain/sandbox.types.ts\";\nimport { executeProcess } from \"../infrastructure/process.ts\";\nimport type { Executor } from \"../infrastructure/process.types.ts\";\nimport { registerCleanup } from \"../infrastructure/shutdown.ts\";\nimport { diagnosticContainer } from \"../providers/diagnostic-container.ts\";\nimport { agentVersions } from \"../providers/versions.constants.ts\";\nimport { diagnoseAgentCli } from \"./doctor-agent.ts\";\nimport { diagnosticProbe } from \"./diagnostic-probe.ts\";\nimport { doctorDefaults } from \"./doctor.constants.ts\";\nimport type { DiagnosticCheck, DoctorImageOptions } from \"./doctor.types.ts\";\n\nexport async function diagnoseImage(\n  options: DoctorImageOptions,\n  execute: Executor = executeProcess,\n): Promise<readonly DiagnosticCheck[]> {\n  const stop = new AbortController();\n  const pending = inspectImage(options, execute, stop.signal);\n  const unregister = registerCleanup(async () => {\n    stop.abort(new OutpostError(\"aborted\", \"Image diagnostics interrupted\"));\n    await pending;\n  });\n  try {\n    return await pending;\n  } finally {\n    unregister();\n  }\n}\n\nasync function inspectImage(\n  { provider, agent, image }: DoctorImageOptions,\n  execute: Executor,\n  signal: AbortSignal,\n): Promise<readonly DiagnosticCheck[]> {\n  const directory = await mkdtemp(join(tmpdir(), \"outpost-doctor-\"));\n  const checks: DiagnosticCheck[] = [];\n  let lease: SandboxLease | undefined;\n  let retained = false;\n  let container: string | undefined;\n  const tracked: Executor = (command) => {\n    if (command.arguments?.[0] === \"create\") {\n      const index = command.arguments.indexOf(\"--name\");\n      container = command.arguments[index + 1];\n    }\n    return execute(command);\n  };\n  try {\n    lease = await diagnosticContainer(\n      provider,\n      image,\n      doctorDefaults.deadlineMs,\n      tracked,\n    ).acquire({\n      repository: directory,\n      directory,\n      gitDirectories: [],\n      variables: {},\n      signal,\n    });\n    checks.push({\n      id: \"image.runtime\",\n      status: \"pass\",\n      message:\n        \"Temporary sandbox started with network disabled and an empty workspace.\",\n    });\n    const sandbox = lease;\n    const invoke: Executor = (command) =>\n      sandbox.invoke({ ...command, signal });\n    for (const executable of [\"node\", \"git\"]) {\n      checks.push(\n        await diagnosticProbe(\n          {\n            id: `image.${executable}`,\n            command: { executable, arguments: [\"--version\"] },\n            failureStatus: \"fail\",\n            readVersion: true,\n            remedy: `Install ${executable} in the image and rebuild it.`,\n          },\n          invoke,\n        ),\n      );\n    }\n    checks.push(\n      await diagnosticProbe(\n        {\n          id: \"image.home\",\n          command: {\n            executable: \"sh\",\n            arguments: [\"-c\", 'test -d \"$HOME\" && test -w \"$HOME\"'],\n          },\n          failureStatus: \"fail\",\n          remedy:\n            \"Check the image user and permissions of the private agent home.\",\n        },\n        invoke,\n      ),\n    );\n    const agentVersion = await diagnosticProbe(\n      {\n        id: \"agent.sandbox\",\n        command: { executable: agent, arguments: [\"--version\"] },\n        failureStatus: \"fail\",\n        readVersion: true,\n        referenceVersion: agentVersions[agent],\n        remedy: `Install ${agent} in the image and rebuild it. This check does not bootstrap agents.`,\n      },\n      invoke,\n    );\n    checks.push(agentVersion);\n    if (agentVersion.status === \"fail\")\n      checks.push({\n        id: \"agent.cli\",\n        status: \"skipped\",\n        message: \"CLI help checks require a successful agent version probe.\",\n      });\n    else checks.push(...(await diagnoseAgentCli(agent, invoke)));\n  } catch (error) {\n    retained = error instanceof AggregateError;\n    checks.push({\n      id: \"image.runtime\",\n      status: \"fail\",\n      message:\n        \"Image diagnostics could not start. Check that the image exists locally, its UID matches the host, and sh, sleep, setsid, kill, tar and cp are installed. No image is downloaded.\",\n    });\n  } finally {\n    if (lease) {\n      try {\n        await lease.release();\n        checks.push({\n          id: \"image.cleanup\",\n          status: \"pass\",\n          message: \"Diagnostic container removed.\",\n        });\n      } catch {\n        retained = true;\n      }\n    }\n    if (retained)\n      checks.push({\n        id: \"image.cleanup\",\n        status: \"fail\",\n        message: `Cleanup could not be confirmed. Inspect container ${container ?? \"creation state\"} with ${provider}; temporary workspace retained at ${directory}.`,\n      });\n    if (!retained) {\n      try {\n        await rm(directory, { recursive: true, force: true });\n      } catch {\n        checks.push({\n          id: \"image.workspace\",\n          status: \"fail\",\n          message: `Could not remove temporary workspace ${directory}.`,\n        });\n      }\n    }\n  }\n  return checks;\n}\n"]}

package/dist/application/doctor-protocol.d.ts

@@ -0,0 +1,3 @@
+import type { AgentProtocolReport } from "./doctor-protocol.types.ts";
+import type { DoctorAgent } from "./doctor.types.ts";
+export declare function diagnoseAgentProtocol(agent: DoctorAgent): AgentProtocolReport;