@gajae-code/coding-agent 0.16.7 → 0.17.1

package/dist/types/cli/doctor/context.d.ts

@@ -0,0 +1,89 @@
+import type { LocalRestorePlanV1 } from "../../extensibility/gjc-plugins/types";
+import type { MarketplaceRestorePlanV1 } from "../../extensibility/plugins/marketplace/manager";
+import type { DoctorOptions } from "./args";
+import type { DoctorFileObservation } from "./files";
+import { type ResolvedRoot } from "./ids";
+import type { InstallRestoreDescriptorV1 } from "./install-repairs";
+import type { ManagedLinkDescriptor } from "./managed-link";
+import type { PluginQuarantinePlan } from "./plugin-quarantine";
+import type { DoctorServiceObservation } from "./service-targets";
+import type { DoctorScope } from "./types";
+export interface DoctorConfigSource {
+    readonly scope: DoctorScope;
+    readonly root: ResolvedRoot;
+    readonly configPath: string;
+    readonly mcpPath: string;
+}
+export interface DoctorSettingTarget {
+    readonly kind: "config";
+    readonly targetId: string;
+    readonly source: DoctorConfigSource;
+    readonly schemaKey: "skills.enabled" | "skills.enableSkillCommands";
+    readonly observation: DoctorFileObservation;
+    readonly beforeValue: unknown;
+}
+export interface DoctorMcpTarget {
+    readonly kind: "mcp";
+    readonly targetId: string;
+    readonly source: DoctorConfigSource;
+    readonly serverName: string;
+    readonly field: "autoload" | "enabled";
+    readonly definitionIsMapping: boolean;
+    readonly observation: DoctorFileObservation;
+    readonly beforeValue: unknown;
+}
+export interface DoctorPermissionTarget {
+    readonly kind: "permission";
+    readonly targetId: string;
+    readonly source: DoctorConfigSource;
+    readonly observation: DoctorFileObservation;
+}
+export interface DoctorInstallTarget {
+    readonly kind: "binary" | "link";
+    readonly targetId: string;
+    readonly filePath: string;
+    readonly root: ResolvedRoot;
+    readonly installDescriptor?: InstallRestoreDescriptorV1;
+    readonly linkDescriptor?: ManagedLinkDescriptor;
+}
+export interface DoctorPluginTarget {
+    readonly kind: "plugin";
+    readonly targetId: string;
+    readonly family: "gjc" | "npm" | "marketplace";
+    readonly scope: DoctorScope;
+    readonly name: string;
+    readonly root: ResolvedRoot;
+    readonly quarantinePlan?: PluginQuarantinePlan;
+    /** Original read-only restore observation; apply is authorized against this exact plan, never a fresh one. */
+    readonly restorePlan?: LocalRestorePlanV1;
+    /** Original read-only private-marketplace restore observation; apply authorizes against this exact plan. */
+    readonly marketplaceRestorePlan?: MarketplaceRestorePlanV1;
+    /** Immutable stored-source identity a restore `--ref` must equal; absent means the source is unpinnable. */
+    readonly restoreRef?: string;
+    /** Stable artifact-tree digest the restore `--sha256` must equal; recomputed by the lifecycle from the resolved source. */
+    readonly restoreArtifactDigest?: string;
+    readonly registryPath?: string;
+}
+export interface DoctorServiceTarget {
+    readonly kind: "service" | "artifact";
+    readonly targetId: string;
+    readonly service: "broker" | "telegram" | "discord" | "slack";
+    readonly root: ResolvedRoot;
+    readonly slot?: "discovery" | "owner-lock" | "startup-marker";
+    readonly observation: DoctorServiceObservation;
+}
+export type DoctorTarget = DoctorSettingTarget | DoctorMcpTarget | DoctorPermissionTarget | DoctorInstallTarget | DoctorPluginTarget | DoctorServiceTarget;
+export interface DoctorContext {
+    readonly options: DoctorOptions;
+    readonly cwd: string;
+    readonly agentRoot: ResolvedRoot;
+    readonly installRoot: ResolvedRoot;
+    readonly sources: readonly DoctorConfigSource[];
+    readonly targets: Map<string, DoctorTarget>;
+    readonly compiled: boolean;
+    readonly executable: string;
+    readonly cliPath?: string;
+    readonly deadline: number;
+}
+/** Resolve only existing product directory conventions; this never initializes settings. */
+export declare function createDoctorContext(options: DoctorOptions): DoctorContext;

package/dist/types/cli/doctor/files.d.ts

@@ -0,0 +1,27 @@
+import type { NativeExactFileIdentity } from "@gajae-code/natives";
+export declare const DOCTOR_FILE_LIMIT: number;
+export interface DoctorFileIdentity {
+    readonly device: number;
+    readonly inode: number;
+    readonly size: number;
+    readonly modifiedMs: number;
+    readonly changedMs: number;
+    readonly mode: number;
+    readonly owner: number;
+    readonly links: number;
+}
+export type DoctorFileObservation = {
+    readonly status: "read";
+    readonly text: string;
+    readonly identity: DoctorFileIdentity;
+    /** Private commit authority, never serialized into the public diagnostic report. */
+    readonly exactIdentity: NativeExactFileIdentity;
+} | {
+    readonly status: "missing" | "unreadable" | "symlink" | "not_regular" | "limit_exceeded" | "changed";
+    readonly errno?: string;
+};
+export declare function doctorErrno(error: unknown): string;
+export declare function sameDoctorFile(left: DoctorFileIdentity, right: DoctorFileIdentity): boolean;
+/** Read one bounded regular file; absence is never inferred from access failure. */
+export declare function readDoctorFile(filePath: string, limit?: number): Promise<DoctorFileObservation>;
+export declare function doctorMapping(value: unknown): Record<string, unknown> | undefined;

package/dist/types/cli/doctor/ids.d.ts

@@ -0,0 +1,20 @@
+import type { DoctorScope } from "./types";
+export type RootKind = "config-user" | "config-project" | "agent" | "install";
+export interface ResolvedRoot {
+    readonly kind: RootKind;
+    readonly locator: string;
+    readonly rootId: string;
+    readonly resolution: "resolved" | "resolution_unknown";
+}
+export declare function canonicalDigest(parts: readonly string[]): string;
+export declare function resolveDoctorRoot(kind: RootKind, locator: string): ResolvedRoot;
+export declare function configTargetId(rootId: string, scope: DoctorScope, schemaKey: string): string;
+export declare function mcpTargetId(rootId: string, scope: DoctorScope, serverLogicalName: string, field: "autoload" | "enabled"): string;
+export declare function permissionTargetId(rootId: string): string;
+export declare function binaryTargetId(rootId: string, locator: string): string;
+export declare function linkTargetId(rootId: string, linkName: string): string;
+export declare function pluginTargetId(rootId: string, family: "gjc" | "npm" | "marketplace", scope: DoctorScope, name: string): string;
+export declare function serviceTargetId(rootId: string, service: "broker" | "telegram" | "discord" | "slack"): string;
+export declare function artifactTargetId(rootId: string, service: "broker" | "telegram" | "discord" | "slack", slot: "discovery" | "owner-lock" | "startup-marker"): string;
+export declare function candidateLinkId(rootId: string, kind: "source" | "wrapper" | "binary", locator: string): string;
+export declare function isDoctorTargetId(value: string): boolean;

package/dist/types/cli/doctor/install-repairs.d.ts

@@ -0,0 +1,94 @@
+/**
+ * `install.restore-binary` (D4) domain logic: read-only descriptor plus the
+ * bounded standalone-binary restore transaction.
+ *
+ * All mutation flows through the shared `install-activation.ts` authority so
+ * `gjc doctor` and `gjc update` never maintain competing activation state:
+ * this module never calls the native `exactReplaceRetained` primitive
+ * directly, it only builds/writes the v1 record and then delegates the
+ * actual promotion (and every retry of an interrupted one) to
+ * `reconcileActivationRecord`.
+ */
+import { type DirectoryIdentity, type FileIdentity } from "../install-activation";
+export type InstallSourceKind = "standalone" | "source" | "npm-wrapper" | "unknown";
+/**
+ * The trust anchor for "this target is the exact binary the current process
+ * was dispatched from": a real ELF/PE/Mach-O header on disk proves nothing
+ * about ownership by itself. Only the currently-running compiled image's own
+ * resolved path counts. Injectable so tests can simulate a compiled dispatch
+ * without spawning a real binary.
+ */
+export interface InstallDispatchAuthority {
+    readonly compiled: boolean;
+    /** Realpath of the currently dispatched compiled image (process.execPath). */
+    readonly selfPath: string;
+    readonly version: string;
+}
+export declare function currentInstallDispatchAuthority(): InstallDispatchAuthority;
+export interface InstallRestoreDescriptorV1 {
+    readonly schemaVersion: 1;
+    readonly kind: "install.restore-binary";
+    readonly targetPath: string;
+    readonly channel: string;
+    readonly version: string;
+    readonly ref?: string;
+    readonly owned: boolean;
+    readonly sourceKind: InstallSourceKind;
+    readonly targetIdentity?: FileIdentity;
+    readonly parentIdentity?: DirectoryIdentity;
+    readonly targetDigest?: string;
+    readonly platform: NodeJS.Platform;
+    readonly arch: string;
+    readonly writes: false;
+    readonly fetch: false;
+    readonly execute: false;
+}
+export interface RestoreCandidate {
+    readonly ref: string;
+    readonly channel: string;
+    readonly sha256: string;
+    readonly version: string;
+    readonly os: NodeJS.Platform;
+    readonly arch: string;
+}
+export interface InstallRepairDependencies {
+    readonly fetchCandidate: (candidate: RestoreCandidate, stagingPath: string) => Promise<void>;
+    readonly verifyCandidate: (stagingPath: string, candidate: RestoreCandidate) => Promise<void>;
+    readonly smokeCandidate: (stagingPath: string, candidate: RestoreCandidate) => Promise<void>;
+}
+export type InstallRepairState = "verified" | "not_needed" | "pending_activation" | "blocked" | "conflict" | "failed";
+export interface InstallRepairResult {
+    readonly state: InstallRepairState;
+    readonly reason?: string;
+    readonly recordPath?: string;
+    readonly sideEffectStarted: boolean;
+    /** Present only for a pre-mutation Windows sharing violation (nothing was renamed). */
+    readonly windowsErrorCode?: string;
+    readonly before?: {
+        readonly identity?: FileIdentity;
+        readonly digest?: string;
+    };
+    readonly after?: {
+        readonly identity?: FileIdentity;
+        readonly digest?: string;
+        readonly version?: string;
+    };
+}
+/**
+ * Read-only restore preview. Never writes, fetches, or executes anything.
+ * Tolerant of any on-disk state: a missing/symlinked/foreign target reports
+ * `sourceKind: "unknown"` with `owned: false` rather than throwing, since a
+ * dry-run/diagnostic descriptor must never fail on account of the very
+ * conditions it exists to report.
+ */
+export declare function describeInstallRestore(targetPath: string, authority?: InstallDispatchAuthority, channel?: string, ref?: string): Promise<InstallRestoreDescriptorV1>;
+/**
+ * Repair a proven-standalone target by staging, verifying, and promoting a
+ * pinned candidate through the shared activation authority.
+ *
+ * An unresolved transaction is resumed only for the identical explicit pin.
+ * Both fresh and resumed publication use the normal updater's mandatory
+ * installed verification and identity-bound compensation; no second candidate
+ * is activated implicitly.
+ */
+export declare function repairStandaloneBinary(targetPath: string, descriptor: InstallRestoreDescriptorV1, candidate: RestoreCandidate, authorizations: readonly string[], deps?: InstallRepairDependencies): Promise<InstallRepairResult>;

package/dist/types/cli/doctor/journal.d.ts

@@ -0,0 +1,43 @@
+import type { DoctorJournalAuthority } from "@gajae-code/natives";
+import type { DoctorCheck } from "./types";
+export type DoctorJournalPhase = "created" | "before" | "prepared" | "applying" | "applied_unverified" | "verified" | "failed" | "uncertain";
+export interface DoctorJournalRecord {
+    readonly runId: string;
+    readonly repairId: string;
+    readonly phase: DoctorJournalPhase;
+    readonly targetId: string;
+    readonly before?: Record<string, unknown>;
+    readonly after?: Record<string, unknown>;
+    readonly outcome?: string;
+    readonly at: string;
+}
+export type DoctorJournalReadStatus = "ok" | "missing" | "malformed" | "unreadable" | "unsupported" | "changed";
+export interface DoctorJournalReadResult {
+    readonly status: DoctorJournalReadStatus;
+    readonly records: readonly DoctorJournalRecord[];
+    readonly malformedLines: readonly number[];
+    readonly error?: string;
+}
+export type DoctorReconcileOutcome = "not_applied" | "applied_unverified" | "conflict" | "verified" | "unknown";
+export interface DoctorReconcileEvidence {
+    readonly check: DoctorCheck;
+    readonly current: Record<string, unknown>;
+}
+export declare class DoctorJournalCreateError extends Error {
+    readonly reasonCode: string;
+    readonly sideEffectStarted: boolean;
+    constructor(reasonCode: string, sideEffectStarted: boolean);
+}
+export declare class DoctorJournal {
+    #private;
+    readonly path: string;
+    constructor(pathname: string, runId: string, native: DoctorJournalAuthority);
+    static create(root: string, runId: string): Promise<DoctorJournal>;
+    append(input: Omit<DoctorJournalRecord, "runId" | "at">): Promise<void>;
+    close(): void;
+    static read(pathname: string): Promise<DoctorJournalRecord[]>;
+    static readDetailed(pathname: string): Promise<DoctorJournalReadResult>;
+}
+/** Classifies fresh selected-target evidence, never the historical phase by itself. */
+export declare function reconcileDoctorEvidence(record: DoctorJournalRecord, evidence?: DoctorReconcileEvidence): DoctorReconcileOutcome;
+export declare function reconcileDoctorJournal(pathname: string, evidence?: DoctorReconcileEvidence): Promise<DoctorJournalRecord | undefined>;

package/dist/types/cli/doctor/managed-link.d.ts

@@ -0,0 +1,39 @@
+export type ManagedLinkKind = "source" | "wrapper" | "binary";
+export interface ManagedLinkCandidate {
+    readonly id: string;
+    readonly kind: ManagedLinkKind;
+    readonly path: string;
+    readonly exists: boolean;
+    readonly provenance: "workspace" | "unknown";
+}
+export interface ManagedLinkDescriptor {
+    readonly schemaVersion: 1;
+    readonly targetId: string;
+    readonly alias: string;
+    readonly targetPath: string;
+    readonly parentPath: string;
+    readonly status: "healthy" | "broken" | "foreign" | "unknown";
+    readonly receiptTrusted: boolean;
+    readonly candidates: readonly ManagedLinkCandidate[];
+    readonly reasonCode?: string;
+}
+export interface ManagedLinkRepairRequest {
+    readonly targetPath: string;
+    readonly alias: string;
+    readonly root: string;
+    readonly ref: string;
+    readonly mode: "dry-run" | "fix";
+    readonly allowRisks: readonly string[];
+    readonly yes: boolean;
+    readonly journalRoot?: string;
+    readonly runId?: string;
+}
+export interface ManagedLinkRepairResult {
+    readonly state: "planned" | "verified" | "not_needed" | "blocked" | "rolled_back" | "rollback_conflict" | "unsupported" | "failed" | "uncertain";
+    readonly changed: boolean;
+    readonly sideEffectStarted: boolean;
+    readonly reasonCode?: string;
+}
+/** Public values describe candidates; the private map retains the original filesystem authority. */
+export declare function describeManagedLink(targetPath: string, root: string, alias?: string): Promise<ManagedLinkDescriptor>;
+export declare function repairManagedLink(request: ManagedLinkRepairRequest, descriptor: ManagedLinkDescriptor): Promise<ManagedLinkRepairResult>;

package/dist/types/cli/doctor/native-probe.d.ts

@@ -0,0 +1,2 @@
+import type { DoctorProbeReceipt } from "./probe-types";
+export declare function collectNativeProbe(): Promise<DoctorProbeReceipt>;

package/dist/types/cli/doctor/permission-repairs.d.ts

@@ -0,0 +1,25 @@
+import { type NativeExactFileIdentity, type NativePermissionRepairResult } from "@gajae-code/natives";
+import type { DoctorCheck, DoctorRepair, DoctorScope } from "./types";
+export interface DoctorPermissionRepairRequest {
+    readonly filePath: string;
+    readonly rootPath: string;
+    readonly scope: DoctorScope;
+    readonly targetId: string;
+    readonly repairId: string;
+    readonly runId: string;
+    readonly mode: "dry-run" | "fix";
+    readonly authorization?: readonly string[];
+    readonly journalRoot: string;
+    readonly expected: {
+        readonly identity: NativeExactFileIdentity;
+        readonly mode: number;
+    };
+    readonly collectAfterChecks: () => Promise<readonly DoctorCheck[]>;
+}
+export interface DoctorPermissionRepairResult {
+    readonly repair: DoctorRepair;
+    readonly native: NativePermissionRepairResult;
+    readonly journalPath?: string;
+    readonly afterChecks?: readonly DoctorCheck[];
+}
+export declare function applyDoctorPermissionRepair(r: DoctorPermissionRepairRequest): Promise<DoctorPermissionRepairResult>;

package/dist/types/cli/doctor/plugin-quarantine.d.ts

@@ -0,0 +1,77 @@
+/**
+ * D7 plugin.quarantine-selected — core-owned durable disable/quarantine writer
+ * for exactly one selected (family, scope, name) target, across all three
+ * plugin families (GJC bundles, npm packages, marketplace-installed plugins).
+ *
+ * This module NEVER installs, fetches, reinstalls, imports, or executes
+ * plugin code. It only flips the durable "enabled" bit each family's real
+ * session-startup consumer already honors:
+ *   - gjc:         GjcPluginRegistryEntry.enabled (readEffectiveRegistryUnpersisted /
+ *                   loadEffectiveGjcPluginRegistry -> session-validation -> activation).
+ *   - npm (user):   gjc-plugins.lock.json PluginRuntimeState.enabled, consumed by
+ *                   getEnabledPlugins() (extensibility/plugins/loader.ts).
+ *   - npm (project): .gjc/plugin-overrides.json `disabled` list, consumed by the
+ *                   same getEnabledPlugins().
+ *   - marketplace:  installed_plugins.json InstalledPluginEntry.enabled, consumed
+ *                   by listClaudePluginRoots() (discovery/helpers.ts) via
+ *                   `entry.enabled === false` skip.
+ *
+ * Disable-only: this action never re-enables (D7 has no enable path; an
+ * unsafe target requires only plugin-change authorization to quarantine, but
+ * re-enabling it is a deliberate separate decision outside this module).
+ */
+export type PluginQuarantineFamily = "gjc" | "npm" | "marketplace";
+export interface PluginQuarantineTarget {
+    family: PluginQuarantineFamily;
+    scope: "user" | "project";
+    name: string;
+}
+export interface PluginQuarantineRequest extends PluginQuarantineTarget {
+    /** Absolute project cwd; required for gjc/npm project-scope targets. */
+    cwd: string;
+    /** Home identity used for the marketplace startup-filter reread. */
+    home: string;
+    /** Explicit override for the marketplace installed_plugins.json path (tests). */
+    registryPath?: string;
+    /** Journal identity — required by applyPluginQuarantine, ignored by preview. */
+    journalRoot?: string;
+    runId?: string;
+    rootId: string;
+}
+export type PluginQuarantineBlockReason = "invalid_target" | "not_installed" | "unsafe_link" | "registry_unreadable" | "malformed_registry" | "identity_mismatch";
+export interface PluginQuarantinePlan {
+    target: PluginQuarantineTarget;
+    targetId?: string;
+    enabled: boolean;
+    baseline: string;
+    status: "ready" | "not_needed" | "blocked";
+    reason?: PluginQuarantineBlockReason;
+}
+export type PluginQuarantineApplyStatus = "verified" | "not_needed" | "conflict" | "blocked" | "uncertain";
+export interface PluginQuarantineApplyResult {
+    status: PluginQuarantineApplyStatus;
+    reason?: string;
+    /** True once any durable mutation attempt started (journal `applying` appended). */
+    sideEffectStarted: boolean;
+    /** Fresh post-commit startup-filter observation for the selected target only. */
+    targetExcludedFromStartup?: boolean;
+    journalPath?: string;
+}
+/**
+ * Read-only preview: resolves the exact family writer's current durable
+ * enablement state and CAS baseline for one (family, scope, name) target.
+ * Never imports, fetches, or executes plugin code, and performs no writes.
+ */
+export declare function previewPluginQuarantine(input: PluginQuarantineRequest): Promise<PluginQuarantinePlan>;
+/**
+ * Mutating action. Authorization is checked before any risk evaluation, lock
+ * acquisition, or journal access — an unauthorized caller learns nothing
+ * beyond "authorization required" and causes zero side effects. D7 is
+ * disable-only: `enabled: true` is never accepted here.
+ *
+ * Runs the canonical create -> before -> applying -> verified|failed -> close
+ * journal cycle (one journal per run, `plugin.quarantine-selected` selection),
+ * then independently re-reads the real startup consumer for the selected
+ * target only before reporting `verified` (never a fabricated generic ready).
+ */
+export declare function applyPluginQuarantine(input: PluginQuarantineRequest, authorizations: readonly string[], expected: PluginQuarantinePlan): Promise<PluginQuarantineApplyResult>;

package/dist/types/cli/doctor/plugin-restore.d.ts

@@ -0,0 +1,40 @@
+import type { GjcBundleIdentity, GjcLifecycleResult, GjcUpdateApplyResult, LocalRestorePlanV1, ReviewedRestoreTokenV1 } from "../../extensibility/gjc-plugins/types";
+import type { MarketplaceManager, MarketplaceRestoreApplyResult, MarketplaceRestorePlanV1, MarketplaceReviewedRestoreTokenV1 } from "../../extensibility/plugins/marketplace/manager";
+export interface PluginRestoreTargetV1 {
+    identity: GjcBundleIdentity;
+    cwd: string;
+}
+export type PluginRestoreActionV1 = {
+    kind: "preview";
+    target: PluginRestoreTargetV1;
+} | {
+    kind: "authorize";
+    target: PluginRestoreTargetV1;
+    plan: LocalRestorePlanV1;
+    authorizations: readonly string[];
+} | {
+    kind: "apply";
+    target: PluginRestoreTargetV1;
+    token: ReviewedRestoreTokenV1;
+} | {
+    kind: "marketplace-preview";
+    manager: MarketplaceManager;
+    pluginId: string;
+    scope: "user" | "project";
+} | {
+    kind: "marketplace-authorize";
+    manager: MarketplaceManager;
+    plan: MarketplaceRestorePlanV1;
+    authorizations: readonly string[];
+} | {
+    kind: "marketplace-apply";
+    manager: MarketplaceManager;
+    token: MarketplaceReviewedRestoreTokenV1;
+};
+/**
+ * Typed doctor dispatch surface for both restore lanes (GJC bundles and
+ * proven-private marketplace plugins). Every branch is action + explicit
+ * authorization before any effect; `action` alone never authorizes a write.
+ */
+export type PluginRestoreActionResultV1 = GjcLifecycleResult<LocalRestorePlanV1 | ReviewedRestoreTokenV1 | GjcUpdateApplyResult> | MarketplaceRestorePlanV1 | MarketplaceReviewedRestoreTokenV1 | MarketplaceRestoreApplyResult;
+export declare function runPluginRestoreAction(action: PluginRestoreActionV1): Promise<PluginRestoreActionResultV1>;

package/dist/types/cli/doctor/plugin-targets.d.ts

@@ -0,0 +1,11 @@
+import { MarketplaceManager } from "../../extensibility/plugins/marketplace/index.js";
+import type { DoctorContext } from "./context";
+import type { DoctorCheck } from "./types";
+/**
+ * Construct the marketplace manager exactly as the ordinary plugin CLI does, so
+ * doctor reads and repairs the same canonical registries and cache roots the
+ * product itself owns. Never a doctor-private layout.
+ */
+export declare function createDoctorMarketplaceManager(cwd: string): Promise<MarketplaceManager>;
+/** Inventory only: registry data is read, never source-resolved or executed. */
+export declare function collectPluginTargets(context: DoctorContext): Promise<DoctorCheck[]>;

package/dist/types/cli/doctor/probe-client.d.ts

@@ -0,0 +1,9 @@
+import type { DoctorContext } from "./context";
+import type { DoctorProbeKind, DoctorProbeReceipt } from "./probe-types";
+export interface DoctorProbeResult {
+    readonly status: "completed" | "failed" | "timeout" | "cancelled";
+    readonly reasonCode: string;
+    readonly receipt?: DoctorProbeReceipt;
+}
+/** Run a bounded child of the current product runtime, never a PATH-discovered executable. */
+export declare function collectDoctorProbe(context: DoctorContext, kind: DoctorProbeKind): Promise<DoctorProbeResult>;

package/dist/types/cli/doctor/probe-types.d.ts

@@ -0,0 +1,18 @@
+import type { DoctorCheck } from "./types";
+/** Maximum UTF-8 payload accepted by the doctor probe transport. */
+export declare const PROBE_OUTPUT_LIMIT_BYTES: number;
+/**
+ * Producer-side budget for a projection receipt. Kept below the transport limit
+ * so the probe never has to discard a whole surface: the producer sheds its own
+ * lowest-value item checks instead. The headroom covers the trailing newline
+ * and transport framing.
+ */
+export declare const PROJECTION_RECEIPT_BUDGET_BYTES: number;
+export type DoctorProbeKind = "native" | "projection";
+export interface DoctorProbeReceipt {
+    readonly schemaVersion: 1;
+    readonly kind: DoctorProbeKind;
+    readonly status: "completed" | "failed";
+    readonly reasonCode: string;
+    readonly checks: readonly DoctorCheck[];
+}

package/dist/types/cli/doctor/probe.d.ts

@@ -0,0 +1,3 @@
+import type { DoctorProbeKind } from "./probe-types";
+/** Only the fixed product probes are executable; no caller-provided program or module path. */
+export declare function runDoctorProbe(kind: DoctorProbeKind): Promise<void>;

package/dist/types/cli/doctor/projection-probe.d.ts

@@ -0,0 +1,2 @@
+import type { DoctorProbeReceipt } from "./probe-types";
+export declare function collectProjectionProbe(): Promise<DoctorProbeReceipt>;

package/dist/types/cli/doctor/repairs.d.ts

@@ -0,0 +1,28 @@
+import { type DoctorAction } from "./args";
+import type { DoctorContext } from "./context";
+import type { DoctorCheck, DoctorRepair } from "./types";
+export interface DoctorSelectedRepairResult {
+    readonly repair: DoctorRepair;
+    readonly invocationError?: string;
+    readonly afterChecks?: readonly DoctorCheck[];
+}
+/**
+ * Whether this host can run the journal-fenced repair lanes at all. Only Linux
+ * and macOS carry the native journal implementation, so a journal-backed action
+ * is refused before planning/effect on every other platform.
+ */
+export declare function journalRepairSupported(action: DoctorAction, platform?: NodeJS.Platform): boolean;
+/**
+ * Refuse the selected action because the diagnosis it would be planned against
+ * never settled.
+ *
+ * A collector that lost its timeout race is not stopped — it keeps running and
+ * keeps writing into the shared {@link DoctorContext}. Planning there would read
+ * a half-populated target map, so the action is refused before
+ * {@link planSelectedDoctorRepair} ever touches that state. Diagnosis output is
+ * unaffected: it still reports everything that was collected.
+ */
+export declare function refuseUnsettledDoctorRepair(context: DoctorContext, before: readonly DoctorCheck[]): DoctorRepair | undefined;
+/** Plan data is descriptive only; no domain module, lock, journal, or candidate is materialized here. */
+export declare function planSelectedDoctorRepair(context: DoctorContext, before: readonly DoctorCheck[]): DoctorRepair | undefined;
+export declare function executeSelectedDoctorRepair(context: DoctorContext, runId: string, plan: DoctorRepair, collectAfterChecks: () => Promise<readonly DoctorCheck[]>): Promise<DoctorSelectedRepairResult>;

package/dist/types/cli/doctor/report.d.ts

@@ -0,0 +1,27 @@
+import type { DoctorCheck, DoctorMode, DoctorRepair, DoctorReport } from "./types";
+export declare const DOCTOR_EXIT_CODES: {
+    readonly ok: 0;
+    readonly findings: 1;
+    readonly usage: 2;
+    readonly incomplete: 3;
+    readonly mutationFailure: 4;
+    readonly interrupted: 130;
+};
+export interface FinalizeInput {
+    readonly schemaVersion?: 1;
+    readonly runId: string;
+    readonly mode: DoctorMode;
+    readonly generatedAt: string;
+    readonly durationMs: number;
+    readonly subject: DoctorReport["subject"];
+    readonly selection: DoctorReport["selection"];
+    readonly coverage: DoctorReport["coverage"];
+    readonly checks: readonly DoctorCheck[];
+    readonly repairs?: readonly DoctorRepair[];
+    readonly limits?: DoctorReport["limits"];
+    readonly invocationError?: string;
+    readonly interrupted?: boolean;
+}
+export declare function finalizeReport(input: FinalizeInput): DoctorReport;
+export declare function renderDoctorJson(report: DoctorReport): string;
+export declare function renderDoctorText(report: DoctorReport): string;

package/dist/types/cli/doctor/runner.d.ts

@@ -0,0 +1,4 @@
+import type { DoctorOptions } from "./args";
+import type { DoctorReport } from "./types";
+/** Diagnose first; only a resolved, authorized single action can enter its domain transaction. */
+export declare function collectDoctorReport(options: DoctorOptions): Promise<DoctorReport>;

package/dist/types/cli/doctor/safety.d.ts

@@ -0,0 +1,10 @@
+export interface DoctorSafetyResult {
+    readonly safe: boolean;
+    readonly reasonCode?: string;
+    readonly platform?: string;
+}
+export interface DoctorExpectedIdentity {
+    readonly dev: bigint;
+    readonly ino: bigint;
+}
+export declare function authorizePosixConfigPermission(filePath: string, expected?: DoctorExpectedIdentity): Promise<DoctorSafetyResult>;

package/dist/types/cli/doctor/service-repairs.d.ts

@@ -0,0 +1,8 @@
+import type { DoctorContext, DoctorServiceTarget } from "./context";
+import type { DoctorCheck, DoctorRepair } from "./types";
+export interface DoctorStaleArtifactResult {
+    readonly repair: DoctorRepair;
+    readonly afterChecks?: readonly DoctorCheck[];
+}
+/** One canonical stale slot, retained in quarantine; never starts or signals a service. */
+export declare function applyDoctorStaleArtifact(context: DoctorContext, runId: string, target: DoctorServiceTarget, collectAfterChecks: () => Promise<readonly DoctorCheck[]>): Promise<DoctorStaleArtifactResult>;

package/dist/types/cli/doctor/service-targets.d.ts

@@ -0,0 +1,41 @@
+import type { NativeExactFileIdentity } from "@gajae-code/natives";
+import type { DoctorContext } from "./context";
+import { type DoctorFileObservation } from "./files";
+import type { DoctorCheck } from "./types";
+export declare const DOCTOR_SERVICES: readonly ["broker", "telegram", "discord", "slack"];
+export type DoctorServiceKind = (typeof DOCTOR_SERVICES)[number];
+export type DoctorArtifactSlot = "discovery" | "owner-lock" | "startup-marker";
+export interface DoctorServicePaths {
+    readonly state: string;
+    readonly owner: string;
+    readonly restartIntent: string;
+    readonly directoryOwner?: string;
+    readonly startupMarker?: string;
+}
+export interface DoctorDirectoryObservation {
+    readonly status: "directory";
+    readonly mode: number;
+    readonly owner: number;
+    readonly exactIdentity: NativeExactFileIdentity;
+}
+export type DoctorArtifactObservation = DoctorFileObservation | DoctorDirectoryObservation;
+export interface DoctorServiceObservation {
+    readonly service: DoctorServiceKind;
+    readonly paths: DoctorServicePaths;
+    readonly state: DoctorFileObservation;
+    readonly owner: DoctorFileObservation;
+    readonly restartIntent: DoctorFileObservation;
+    readonly directoryOwner?: DoctorArtifactObservation;
+    readonly startupMarker?: DoctorFileObservation;
+    readonly ownerMarker?: {
+        readonly path: string;
+        readonly observation: DoctorFileObservation;
+    };
+}
+/** Only product-defined paths are addressable; record content never supplies a path. */
+export declare function doctorServicePaths(agentDir: string, service: DoctorServiceKind): DoctorServicePaths;
+export declare function parseServiceRecord(observation: DoctorFileObservation): Record<string, unknown> | undefined;
+export declare function readDoctorService(root: string, service: DoctorServiceKind): Promise<DoctorServiceObservation>;
+export declare function serviceArtifactObservation(service: DoctorServiceObservation, slot: DoctorArtifactSlot): DoctorArtifactObservation | undefined;
+/** Metadata only: no service import, connection, process probe, or ownership acquisition. */
+export declare function collectServiceTargets(context: DoctorContext): Promise<DoctorCheck[]>;