@jungjaehoon/mama-os 0.77.0 → 0.78.0

package/dist/cli/runtime/diagnostics.js

@@ -0,0 +1,953 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDiagnostics = runDiagnostics;
+const node_fs_1 = require("node:fs");
+const node_module_1 = require("node:module");
+const node_net_1 = require("node:net");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const viewer_server_js_1 = require("../../api/viewer-server.js");
+const index_js_1 = require("../../connectors/index.js");
+const config_js_1 = require("../../runtime/config.js");
+const backend_security_js_1 = require("../../runtime/backend-security.js");
+const connectors_js_1 = require("../../runtime/connectors.js");
+const timezone_js_1 = require("../../runtime/timezone.js");
+const document_toolkit_js_1 = require("../../tools/document-toolkit.js");
+const launch_files_js_1 = require("../launch-files.js");
+const rotating_log_js_1 = require("../../runtime/rotating-log.js");
+const secrets_js_1 = require("../secrets.js");
+const daemon_js_1 = require("../commands/daemon.js");
+const backend_probe_js_1 = require("./backend-probe.js");
+const daemon_control_js_1 = require("./daemon-control.js");
+const db_manager_1 = require("@jungjaehoon/mama-core/db-manager");
+const migrations_source_js_1 = require("../../storage/migrations-source.js");
+const systemd_service_js_1 = require("./systemd-service.js");
+/** The PATH a service manager gives a unit that does not set one ($PATH in start.sh). */
+const SERVICE_DEFAULT_PATH = {
+    darwin: ['/usr/bin', '/bin', '/usr/sbin', '/sbin'],
+    linux: ['/usr/local/sbin', '/usr/local/bin', '/usr/sbin', '/usr/bin', '/sbin', '/bin'],
+};
+/** systemd states of an installed unit that can be started or is running. */
+const SYSTEMD_USABLE = new Set(['active', 'inactive', 'activating', 'deactivating', 'reloading']);
+function findIn(name, dirs) {
+    for (const dir of dirs) {
+        const path = (0, node_path_1.join)(dir, name);
+        if ((0, node_fs_1.existsSync)(path))
+            return path;
+    }
+    return undefined;
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** auth.env's assignments, unquoted as sh reads them; values are never printed. */
+function readAuthEnv(root) {
+    const path = (0, node_path_1.join)(root, 'auth.env');
+    if (!(0, node_fs_1.existsSync)(path))
+        return {};
+    const values = {};
+    (0, node_fs_1.readFileSync)(path, 'utf8')
+        .split('\n')
+        .forEach((line, index) => {
+        if (line.trim() === '' || line.trim().startsWith('#'))
+            return;
+        const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+        // start.sh sources the file under `set -e`, so any other line runs as a command.
+        if (!match)
+            throw new Error(`line ${index + 1} is not an assignment`);
+        try {
+            values[match[1]] = (0, launch_files_js_1.shellWords)(match[2])[0] ?? '';
+        }
+        catch (error) {
+            throw new Error(`line ${index + 1}: ${message(error)}`);
+        }
+    });
+    return values;
+}
+async function defaultTelegramCall(token, method, params = {}) {
+    const query = new URLSearchParams(params).toString();
+    const response = await fetch(`https://api.telegram.org/bot${token}/${method}${query ? `?${query}` : ''}`, { signal: AbortSignal.timeout(8_000) });
+    return (await response.json());
+}
+/** True when something listens; a refusal means free; any other error (a host that cannot be
+ * reached or bound) rejects, since the viewer would fail on it too. */
+function portAnswers(port, host) {
+    return new Promise((resolve, reject) => {
+        const socket = (0, node_net_1.connect)({ port, host });
+        socket.setTimeout(1_000, () => {
+            socket.destroy();
+            resolve(false);
+        });
+        socket.once('connect', () => {
+            socket.destroy();
+            resolve(true);
+        });
+        socket.once('error', (error) => error.code === 'ECONNREFUSED' ? resolve(false) : reject(error));
+    });
+}
+function secretFix(name) {
+    return secrets_js_1.SECRET_NAMES.includes(name) || (0, secrets_js_1.isIcalSecret)(name)
+        ? `mama secret set ${name}`
+        : `add ${name} to auth.env`;
+}
+/**
+ * Check an install as its service would run it. Nothing here writes MAMA's files or starts a
+ * service; the database is opened read-only (which can leave its -wal and -shm beside it), and the
+ * backend's own status command may update the backend's config.
+ * Each check names what it found and, when it is not ok, what to do.
+ */
+async function runDiagnostics(options = {}) {
+    const home = options.home ?? (0, node_os_1.homedir)();
+    const configPath = options.configPath ?? (0, node_path_1.join)(home, '.mama', 'config.yaml');
+    const root = (0, node_path_1.dirname)(configPath);
+    const platform = options.platform ?? process.platform;
+    const run = options.run ?? backend_probe_js_1.defaultProbeRun;
+    const locate = options.findIn ?? findIn;
+    const checks = [];
+    if ((0, node_fs_1.existsSync)((0, daemon_control_js_1.restoreJournalPath)(root))) {
+        checks.push({
+            name: 'restore',
+            status: 'fail',
+            detail: 'an interrupted restore is unfinished; boot refuses until it is resolved',
+            fix: 'mama restore --rollback',
+        });
+    }
+    let config = null;
+    // Setting names can be anything the owner typed, so they stay out of the report.
+    let ignored = [];
+    try {
+        config = (0, config_js_1.loadConfig)({ home, path: configPath, onIgnored: (names) => (ignored = names) });
+        (0, daemon_js_1.validateDeliveryRoutes)(config);
+        (0, daemon_js_1.pathsFor)(configPath, config);
+        checks.push({
+            name: 'config',
+            status: 'ok',
+            detail: ignored.length > 0 ? `loads; ${ignored.length} setting(s) it ignores` : 'loads',
+            context: [configPath, ...(ignored.length > 0 ? [`ignored: ${ignored.join(', ')}`] : [])].join('; '),
+        });
+    }
+    catch (error) {
+        checks.push({
+            name: 'config',
+            status: 'fail',
+            detail: 'does not load as boot reads it',
+            context: message(error),
+            fix: `correct ${configPath}; the daemon refuses to boot until this passes`,
+        });
+    }
+    if (config)
+        checks.push(schemaCheck(config.database.path));
+    if (config) {
+        checks.push(config.member_root
+            ? { name: 'member_root', status: 'ok', detail: 'set', context: config.member_root }
+            : {
+                name: 'member_root',
+                status: 'warn',
+                detail: 'not set; the daemon needs it once a person is registered',
+                fix: 'set member_root to an absolute folder outside HOME in config.yaml',
+            });
+    }
+    // What the service runs: the start script's Node, PATH and exports, not this shell's.
+    const startPath = (0, node_path_1.join)(root, 'start.sh');
+    let servicePath = SERVICE_DEFAULT_PATH[platform] ?? [];
+    let exports = {};
+    // A script mama did not write is assumed to load auth.env; a generated one must still.
+    let loadsAuth = true;
+    if (!(0, node_fs_1.existsSync)(startPath)) {
+        checks.push({
+            name: 'start.sh',
+            status: 'fail',
+            detail: 'does not exist',
+            fix: 'mama service install writes it',
+        });
+    }
+    else {
+        // launchd and systemd run the script itself.
+        try {
+            (0, node_fs_1.accessSync)(startPath, node_fs_1.constants.X_OK);
+        }
+        catch {
+            checks.push({
+                name: 'start.sh',
+                status: 'fail',
+                detail: 'is not executable, so the service cannot run it',
+                fix: `chmod 700 ${startPath}`,
+            });
+        }
+        try {
+            const reading = (0, launch_files_js_1.readStartScript)((0, node_fs_1.readFileSync)(startPath, 'utf8'), home);
+            exports = (0, launch_files_js_1.startExports)(reading);
+            if (reading.generated && !reading.loadsAuthEnv) {
+                loadsAuth = false;
+                checks.push({
+                    name: 'start.sh',
+                    status: 'fail',
+                    detail: 'no longer loads auth.env, so the daemon gets none of its secrets',
+                    fix: 'mama service install --replace rewrites it',
+                });
+            }
+            if (reading.path !== null) {
+                servicePath = [
+                    ...(0, launch_files_js_1.startPathValue)(reading.path, home),
+                    ...(/\$\{?PATH\}?/.test(reading.path) ? servicePath : []),
+                ];
+            }
+            const [, node, cli] = reading.exec === null ? [] : (0, launch_files_js_1.shellWords)(reading.exec);
+            if (!reading.generated) {
+                checks.push({
+                    name: 'start.sh',
+                    status: 'warn',
+                    detail: 'not written by mama; its PATH and exports are read, its Node is not checked',
+                    fix: 'mama service install shows what it would change; --replace rewrites it',
+                });
+            }
+            else if (node === undefined || cli === undefined) {
+                checks.push({
+                    name: 'start.sh',
+                    status: 'fail',
+                    detail: 'has no exec line naming Node and the MAMA command',
+                    fix: 'mama service install --replace rewrites it',
+                });
+            }
+            else {
+                checks.push(nodeCheck(node, cli, run));
+            }
+        }
+        catch (error) {
+            checks.push({
+                name: 'start.sh',
+                status: 'fail',
+                detail: 'does not parse',
+                context: message(error),
+                fix: 'mama service install --replace rewrites it',
+            });
+        }
+    }
+    // start.sh loads auth.env with `set -a`, then its own exports override it.
+    let auth = {};
+    try {
+        if (loadsAuth)
+            auth = readAuthEnv(root);
+    }
+    catch (error) {
+        checks.push({
+            name: 'auth.env',
+            status: 'fail',
+            detail: 'does not parse; start.sh stops when it loads it',
+            context: message(error),
+            fix: `correct the quoting in ${(0, node_path_1.join)(root, 'auth.env')}`,
+        });
+    }
+    const serviceEnv = {
+        HOME: home,
+        USER: process.env.USER,
+        LOGNAME: process.env.LOGNAME,
+        ...auth,
+        ...exports,
+        PATH: servicePath.join(':'),
+    };
+    const secret = (name) => Boolean(serviceEnv[name]?.trim());
+    if (config) {
+        const backend = config.agent.backend;
+        const executable = locate(backend, servicePath);
+        if (!executable) {
+            checks.push({
+                name: 'backend',
+                status: 'fail',
+                detail: `${backend} is not on the service's PATH`,
+                fix: `install ${backend}, then run mama service install so start.sh includes it`,
+            });
+        }
+        else {
+            // The daemon's backend gets its environment without credential-shaped variables.
+            const env = (0, backend_security_js_1.backendEnvironment)(serviceEnv);
+            const codexHome = config.agent.codex_home ?? (0, node_path_1.join)(root, '.codex');
+            const probe = (0, backend_probe_js_1.probeBackend)(backend, executable, { codexHome, run, env });
+            if (probe.problem || !probe.versionOk) {
+                checks.push({
+                    name: 'backend',
+                    status: 'fail',
+                    detail: probe.problem ?? `${backend} ${probe.version} is older than ${probe.minimum}`,
+                    fix: `update ${backend} to ${probe.minimum} or newer`,
+                });
+            }
+            else if (!probe.loggedIn) {
+                checks.push({
+                    name: 'backend',
+                    status: 'fail',
+                    detail: `${backend} ${probe.version} is not signed in for the service`,
+                    fix: backend === 'claude' ? 'claude auth login' : `CODEX_HOME='${codexHome}' codex login`,
+                });
+            }
+            else {
+                checks.push({
+                    name: 'backend',
+                    status: 'ok',
+                    detail: `${backend} ${probe.version}, signed in`,
+                });
+            }
+        }
+        // The shell sandbox is required, so it must actually start, not only exist.
+        if (backend === 'claude')
+            checks.push(sandboxCheck(platform, servicePath, locate, run));
+        for (const messenger of ['telegram', 'discord', 'slack']) {
+            if (!config[messenger]?.enabled)
+                continue;
+            const missing = daemon_js_1.MESSENGER_SECRETS[messenger].filter((name) => !secret(name));
+            if (missing.length > 0) {
+                checks.push({
+                    name: messenger,
+                    status: 'fail',
+                    detail: `${missing.join(' and ')} not set; boot stops at the messengers stage`,
+                    fix: missing.map(secretFix).join('; '),
+                });
+            }
+            else if (messenger === 'telegram' && !options.offline) {
+                checks.push(await telegramCheck(serviceEnv.MAMA_TELEGRAM_TOKEN, config.telegram.owner_chat_id, options.telegramCall ?? defaultTelegramCall));
+            }
+            else {
+                checks.push({ name: messenger, status: 'ok', detail: 'secrets set' });
+            }
+        }
+        checks.push(...(await sourceChecks(config, configPath, servicePath, locate, secret, {
+            env: serviceEnv,
+            online: !options.offline,
+            load: options.loadSource ?? index_js_1.loadConnector,
+            timeoutMs: options.sourceTimeoutMs ?? SOURCE_PROBE_MS,
+        })));
+        checks.push(toolkitCheck(config));
+    }
+    let port = null;
+    try {
+        port = (0, viewer_server_js_1.resolveApiPort)(serviceEnv.MAMA_API_PORT);
+    }
+    catch (error) {
+        checks.push({
+            name: 'port',
+            status: 'fail',
+            detail: 'MAMA_API_PORT is not a usable port',
+            context: message(error),
+            fix: 'set MAMA_API_PORT in start.sh to an integer between 1024 and 65535',
+        });
+    }
+    checks.push(...(await daemonChecks(options.askStatus ?? (() => (0, daemon_js_1.askDaemon)('status', { home, configPath })), port, serviceEnv.MAMA_API_HOST ?? '127.0.0.1', options.portInUse ?? portAnswers)));
+    checks.push(serviceCheck(platform, home, options.serviceRun ?? systemd_service_js_1.defaultServiceRun));
+    // Each log against its own cap: the daemon rotates daemon.log and security-events.jsonl before
+    // they pass theirs, and start.sh empties crash.log at start past its own.
+    for (const [name, path, cap] of [
+        // The daemon's own log is wherever the config puts it.
+        [
+            'daemon.log',
+            config?.logging.file ?? (0, node_path_1.join)(root, 'logs', 'daemon.log'),
+            rotating_log_js_1.DAEMON_LOG_LIMITS.maxBytes,
+        ],
+        [
+            'security-events.jsonl',
+            (0, node_path_1.join)(root, 'logs', 'security-events.jsonl'),
+            rotating_log_js_1.SECURITY_LOG_LIMITS.maxBytes,
+        ],
+        [launch_files_js_1.CRASH_LOG_NAME, (0, node_path_1.join)(root, 'logs', launch_files_js_1.CRASH_LOG_NAME), launch_files_js_1.CRASH_LOG_CAP_BYTES],
+    ]) {
+        if (!(0, node_fs_1.existsSync)(path))
+            continue;
+        try {
+            (0, node_fs_1.accessSync)(path, node_fs_1.constants.R_OK);
+        }
+        catch (error) {
+            checks.push({
+                name: 'logs',
+                status: 'warn',
+                detail: `${name} cannot be read`,
+                context: message(error),
+                fix: `give ${name} back to the user that runs MAMA`,
+            });
+            continue;
+        }
+        const size = (0, node_fs_1.statSync)(path).size;
+        if (size > cap) {
+            checks.push({
+                name: 'logs',
+                status: 'warn',
+                detail: `${name} is ${(size / 1024 / 1024).toFixed(1)} MB, past its ${cap / 1024 / 1024} MB cap`,
+                fix: name === launch_files_js_1.CRASH_LOG_NAME
+                    ? 'start.sh empties it at the next start; read it first, it holds what the daemon could not write to its own log'
+                    : 'either an older daemon writes it without rotating (restart the daemon on this version) or its rotation fails, and the log says why',
+            });
+        }
+    }
+    return checks;
+}
+/**
+ * The database's schema against what this version knows, per migration source, read-only. A
+ * newer one, or a source this version does not know, is what boot refuses; an older one migrates
+ * at the next start.
+ */
+function schemaCheck(databasePath) {
+    try {
+        (0, node_fs_1.statSync)(databasePath);
+    }
+    catch (error) {
+        // Only a confirmed absence is a fresh install; a path the service cannot reach is not.
+        if (error.code === 'ENOENT') {
+            return {
+                name: 'schema',
+                status: 'ok',
+                detail: 'no database yet; the first start creates it',
+            };
+        }
+        return {
+            name: 'schema',
+            status: 'fail',
+            detail: 'the database cannot be read',
+            context: message(error),
+        };
+    }
+    try {
+        // The same read boot makes before it connects, so the two cannot disagree.
+        const states = (0, db_manager_1.readSchemaState)(databasePath, [
+            { name: db_manager_1.CORE_MIGRATION_SOURCE, dir: db_manager_1.MIGRATIONS_DIR },
+            migrations_source_js_1.STANDALONE_MIGRATION_SOURCE,
+        ]);
+        const summary = states
+            .map((state) => `${state.name} ${state.stored} of ${state.highest}`)
+            .join(', ');
+        if (states.some((state) => state.stored > state.highest)) {
+            return {
+                name: 'schema',
+                status: 'fail',
+                detail: `the database is newer than this MAMA (${summary}); boot refuses it`,
+                fix: 'install the version that wrote it, or mama restore a backup taken with this one',
+            };
+        }
+        const pending = states.reduce((sum, state) => sum + (state.highest - state.stored), 0);
+        return {
+            name: 'schema',
+            status: 'ok',
+            detail: pending > 0 ? `${summary}; the next start migrates it` : summary,
+        };
+    }
+    catch (error) {
+        // A file that is not a database fails at its first query, not at open.
+        return {
+            name: 'schema',
+            status: 'fail',
+            detail: 'the database cannot be read',
+            context: message(error),
+        };
+    }
+}
+/** start.sh's Node: still there, outside one version's folder, and able to load MAMA's SQLite. */
+function nodeCheck(node, cli, run) {
+    const rewrite = 'mama service install rewrites start.sh with a Node path that survives upgrades';
+    if (!(0, node_fs_1.existsSync)(node)) {
+        return {
+            name: 'node',
+            status: 'fail',
+            detail: 'the Node start.sh runs is gone',
+            context: node,
+            fix: rewrite,
+        };
+    }
+    if (!(0, node_fs_1.existsSync)(cli)) {
+        return {
+            name: 'node',
+            status: 'fail',
+            detail: 'the MAMA command start.sh runs is gone',
+            context: cli,
+            fix: 'mama service install from the current install rewrites start.sh',
+        };
+    }
+    // A Node upgrade across a major version cannot load a native module built for the old one.
+    let binding;
+    try {
+        binding = (0, node_path_1.dirname)((0, node_module_1.createRequire)(cli).resolve('better-sqlite3/package.json'));
+    }
+    catch (error) {
+        return {
+            name: 'node',
+            status: 'fail',
+            detail: 'the MAMA command start.sh runs has no SQLite module installed',
+            context: message(error),
+            fix: 'reinstall MAMA',
+        };
+    }
+    const load = run(node, [
+        '-e',
+        "new (require(process.argv[1]))(':memory:').close(); process.stdout.write(process.version)",
+        binding,
+    ]);
+    const version = /^v\d+\.\d+\.\d+$/.test(`${load.stdout ?? ''}`) ? `${load.stdout}` : 'Node';
+    if (load.error || load.status !== 0) {
+        return {
+            name: 'node',
+            status: 'fail',
+            detail: 'the Node start.sh runs cannot load the SQLite module MAMA was installed with',
+            context: node,
+            fix: 'reinstall MAMA with this Node, or point start.sh at the Node it was installed with',
+        };
+    }
+    if ((0, launch_files_js_1.versionedNodePath)(node)) {
+        return {
+            name: 'node',
+            status: 'warn',
+            detail: `start.sh runs ${version} from one version's folder; an upgrade or a switch removes it`,
+            context: node,
+            fix: node.includes('/Cellar/')
+                ? rewrite
+                : 'run mama service install from a shell whose node is not an nvm, volta or fnm version',
+        };
+    }
+    return { name: 'node', status: 'ok', detail: `${version} loads SQLite`, context: node };
+}
+function sandboxCheck(platform, servicePath, locate, run) {
+    if (platform === 'darwin') {
+        const result = run('/usr/bin/sandbox-exec', [
+            '-p',
+            '(version 1)(allow default)',
+            '/usr/bin/true',
+        ]);
+        return result.error || result.status !== 0
+            ? {
+                name: 'sandbox',
+                status: 'fail',
+                detail: 'sandbox-exec could not start a sandbox',
+                fix: 'sandbox-exec ships with macOS; check that nothing blocks it',
+            }
+            : { name: 'sandbox', status: 'ok', detail: 'starts' };
+    }
+    // Claude's Linux sandbox runs bwrap without network and relays through socat.
+    const bwrap = locate('bwrap', servicePath);
+    const socat = locate('socat', servicePath);
+    if (!bwrap || !socat) {
+        return {
+            name: 'sandbox',
+            status: 'fail',
+            detail: `${[!bwrap && 'bwrap', !socat && 'socat'].filter(Boolean).join(' and ')} not on the service's PATH`,
+            fix: 'install bubblewrap and socat',
+        };
+    }
+    const relay = run(socat, ['-V']);
+    if (relay.error || relay.status !== 0) {
+        return {
+            name: 'sandbox',
+            status: 'fail',
+            detail: 'socat does not run',
+            context: socat,
+            fix: 'reinstall socat',
+        };
+    }
+    const result = run(bwrap, ['--ro-bind', '/', '/', '--dev', '/dev', '--unshare-net', '/bin/true']);
+    return result.error || result.status !== 0
+        ? {
+            name: 'sandbox',
+            status: 'fail',
+            detail: 'bwrap could not start a sandbox without network',
+            fix: 'allow unprivileged user namespaces (kernel.unprivileged_userns_clone, or the AppArmor userns rule)',
+        }
+        : { name: 'sandbox', status: 'ok', detail: 'starts' };
+}
+async function telegramCheck(token, commonChat, call) {
+    let me;
+    try {
+        const reply = await call(token ?? '', 'getMe');
+        me = reply.ok === true ? reply.result : undefined;
+    }
+    catch (error) {
+        return {
+            name: 'telegram',
+            status: 'warn',
+            detail: `could not reach Telegram (${error instanceof Error ? error.name : 'error'})`,
+        };
+    }
+    if (!me) {
+        return {
+            name: 'telegram',
+            status: 'fail',
+            detail: 'Telegram refused the bot token',
+            fix: 'mama secret set MAMA_TELEGRAM_TOKEN with the token BotFather gave',
+        };
+    }
+    if (commonChat === undefined || commonChat === '') {
+        return { name: 'telegram', status: 'ok', detail: 'token valid; no common group configured' };
+    }
+    // Removed from the group, the bot hears nothing there whatever its privacy setting.
+    let status;
+    try {
+        const member = await call(token ?? '', 'getChatMember', {
+            chat_id: String(commonChat),
+            user_id: String(me.id),
+        });
+        if (member.ok !== true && member.error_code !== 400 && member.error_code !== 403) {
+            return {
+                name: 'telegram',
+                status: 'warn',
+                detail: `token valid; Telegram did not answer about the common group (${String(member.error_code)})`,
+            };
+        }
+        status =
+            member.ok === true ? member.result?.status : undefined;
+    }
+    catch (error) {
+        return {
+            name: 'telegram',
+            status: 'warn',
+            detail: `token valid; could not ask about the common group (${error instanceof Error ? error.name : 'error'})`,
+        };
+    }
+    if (typeof status !== 'string' || status === 'left' || status === 'kicked') {
+        return {
+            name: 'telegram',
+            status: 'fail',
+            detail: 'the bot is not in the common group',
+            fix: 'add the bot to the group owner_chat_id names',
+        };
+    }
+    const admin = status === 'administrator' || status === 'creator';
+    if (me.can_read_all_group_messages !== true && !admin) {
+        return {
+            name: 'telegram',
+            status: 'warn',
+            detail: 'the bot cannot read group messages',
+            fix: 'turn privacy off for the bot in BotFather, then remove and re-add it to the group',
+        };
+    }
+    return {
+        name: 'telegram',
+        status: 'ok',
+        detail: admin
+            ? 'token valid; an administrator of the common group, so it reads its messages'
+            : 'token valid; a member of the common group that reads its messages',
+    };
+}
+/** connectors.json as the connector runtime reads it, and what each enabled source needs. */
+async function sourceChecks(config, configPath, servicePath, locate, secret, start) {
+    const paths = (0, daemon_js_1.pathsFor)(configPath, config);
+    let plan;
+    try {
+        plan = (0, connectors_js_1.planConnectors)({
+            configPath: paths.connectorsConfigPath,
+            // Channel keys can be owner names; they stay out of the terminal and the report.
+            onIgnored: () => { },
+            ...(config.wiki?.enabled
+                ? { wikiRoot: (0, node_path_1.resolve)(config.wiki.vaultPath, config.wiki.wikiDir) }
+                : {}),
+        });
+    }
+    catch (error) {
+        return [
+            {
+                name: 'sources',
+                status: 'fail',
+                detail: 'connectors.json does not load as boot reads it',
+                context: message(error),
+                fix: `correct ${paths.connectorsConfigPath}`,
+            },
+        ];
+    }
+    const checks = [];
+    const timeZone = (0, timezone_js_1.createTimeZoneSetting)(config.timezone);
+    for (const name of plan.enabledConnectorNames) {
+        let connector;
+        try {
+            connector = await start.load(name, plan.config.config[name], (0, connectors_js_1.connectorLoadPaths)(name, {
+                statePath: paths.connectorsRoot,
+                kagemushaDbPath: paths.kagemushaDbPath,
+                timeZone,
+            }));
+        }
+        catch (error) {
+            checks.push({
+                name: `source ${name}`,
+                status: 'fail',
+                detail: 'cannot be built from connectors.json; boot stops at the connectors stage',
+                context: message(error),
+            });
+            continue;
+        }
+        const needs = connector.getAuthRequirements();
+        // A secret's name can carry an owner's channel key (iCal), so it stays out of the report.
+        const secrets = needs.flatMap((need) => need.type === 'token' && need.tokenName && !secret(need.tokenName) ? [need.tokenName] : []);
+        const commands = needs.flatMap((need) => need.type === 'cli' && need.cli && !locate(need.cli, servicePath)
+            ? [{ cli: need.cli, login: need.cliAuthCommand }]
+            : []);
+        if (secrets.length > 0 || commands.length > 0) {
+            checks.push({
+                name: `source ${name}`,
+                status: 'fail',
+                detail: [
+                    ...(secrets.length > 0 ? [`${secrets.length} secret(s) it needs are not set`] : []),
+                    ...commands.map(({ cli }) => `the ${cli} command is not on the service's PATH`),
+                ].join('; '),
+                ...(secrets.length > 0 ? { context: secrets.join(', ') } : {}),
+                fix: [
+                    ...secrets.map(secretFix),
+                    ...commands.map(({ cli, login }) => `install ${cli}${login ? ` and run ${login}` : ''}`),
+                ].join('; '),
+            });
+            continue;
+        }
+        if (!start.online)
+            continue;
+        // Boot starts each source in the daemon's environment; no source's start writes anything.
+        // Boot only starts a source; a poll then needs its credentials accepted, so ask that too.
+        let failure = null;
+        try {
+            await withEnvironment(start.env, () => bounded(start.timeoutMs, async () => {
+                try {
+                    await connector.init();
+                }
+                catch (error) {
+                    failure = {
+                        name: `source ${name}`,
+                        status: 'fail',
+                        detail: 'does not start; boot stops at the connectors stage',
+                        context: message(error),
+                    };
+                    return;
+                }
+                if (!(await connector.authenticate())) {
+                    failure = {
+                        name: `source ${name}`,
+                        status: 'fail',
+                        detail: 'starts, but its credentials or sign-in are refused, so its polls fail',
+                        fix: needs
+                            .map((need) => need.cliAuthCommand ?? (need.tokenName ? secretFix(need.tokenName) : ''))
+                            .filter(Boolean)
+                            .join('; ') || undefined,
+                    };
+                }
+            }));
+        }
+        catch (error) {
+            failure = {
+                name: `source ${name}`,
+                status: 'fail',
+                detail: 'could not be asked whether its credentials work',
+                context: message(error),
+            };
+        }
+        finally {
+            await connector.dispose();
+        }
+        if (failure)
+            checks.push(failure);
+    }
+    return checks;
+}
+/** Some sources fetch without a deadline; doctor waits this long for each before moving on. */
+const SOURCE_PROBE_MS = 20_000;
+function bounded(ms, run) {
+    let timer;
+    return Promise.race([
+        run(),
+        new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`no answer within ${ms / 1000} s`)), ms);
+        }),
+    ]).finally(() => clearTimeout(timer));
+}
+/** Run with process.env as the daemon's process has it, then put this shell's back. */
+async function withEnvironment(env, run) {
+    const saved = { ...process.env };
+    const replace = (next) => {
+        for (const name of Object.keys(process.env))
+            delete process.env[name];
+        for (const [name, value] of Object.entries(next)) {
+            if (value !== undefined)
+                process.env[name] = value;
+        }
+    };
+    replace(env);
+    try {
+        return await run();
+    }
+    finally {
+        replace(saved);
+    }
+}
+function toolkitCheck(config) {
+    if (!config.tools_root) {
+        return {
+            name: 'toolkit',
+            status: 'warn',
+            detail: 'tools_root is not set; document work has no toolkit',
+            fix: 'set tools_root outside HOME in config.yaml, then mama tools install',
+        };
+    }
+    // Boot reads the toolkit the same way; an unsafe tools_root stops it at the config stage.
+    let present;
+    try {
+        present = (0, document_toolkit_js_1.readDocumentToolkit)(config.tools_root, () => { }) !== null;
+    }
+    catch (error) {
+        return {
+            name: 'toolkit',
+            status: 'fail',
+            detail: 'tools_root is unsafe; boot refuses it',
+            context: message(error),
+            fix: 'make tools_root and the folders above it writable only by you (or sticky), and owned by you',
+        };
+    }
+    return present
+        ? { name: 'toolkit', status: 'ok', detail: 'installed', context: config.tools_root }
+        : {
+            name: 'toolkit',
+            status: 'warn',
+            detail: 'not installed under tools_root',
+            context: config.tools_root,
+            fix: 'mama tools install',
+        };
+}
+async function daemonChecks(ask, port, host, portInUse) {
+    let daemon;
+    try {
+        daemon = await ask();
+    }
+    catch (error) {
+        return [
+            {
+                name: 'daemon',
+                status: 'fail',
+                detail: 'holds the install but does not answer on its control socket',
+                context: message(error),
+                fix: 'daemon.log shows what it is doing (a migration can hold it); if it stays silent, mama stop and mama service start',
+            },
+        ];
+    }
+    if (daemon.state === 'stopped') {
+        const checks = [
+            {
+                name: 'daemon',
+                status: 'warn',
+                detail: daemon.holder ? `stopped; ${daemon.holder.command} holds the install` : 'stopped',
+                fix: 'mama service start',
+            },
+        ];
+        if (port === null)
+            return checks;
+        let used;
+        try {
+            used = await portInUse(port, host);
+        }
+        catch (error) {
+            checks.push({
+                name: 'port',
+                status: 'fail',
+                detail: 'MAMA_API_HOST is not an address this machine can bind',
+                context: message(error),
+                fix: 'set MAMA_API_HOST in start.sh to a local address, or remove it for 127.0.0.1',
+            });
+            return checks;
+        }
+        if (used) {
+            checks.push({
+                name: 'port',
+                status: 'fail',
+                detail: `port ${port} is in use by another process`,
+                fix: `free port ${port} or set MAMA_API_PORT in start.sh`,
+            });
+        }
+        return checks;
+    }
+    if (daemon.reply.ok !== true) {
+        return [
+            {
+                name: 'daemon',
+                status: 'fail',
+                detail: 'running, but it refused status',
+                context: String(daemon.reply.error),
+                fix: 'daemon.log shows why',
+            },
+        ];
+    }
+    const status = (daemon.reply.status ?? {});
+    const checks = [];
+    const stage = typeof status.stage === 'string' ? status.stage : 'unknown';
+    const startedAt = typeof status.startedAt === 'number' ? status.startedAt : Date.now();
+    // A replay or backfill does its work inside the boot, for as long as it takes.
+    if (status.command === 'replay' || status.command === 'backfill') {
+        return [
+            {
+                name: 'daemon',
+                status: 'warn',
+                detail: `stopped; ${status.command} holds the install (stage ${stage})`,
+                fix: `mama service start after the ${status.command} ends`,
+            },
+        ];
+    }
+    if (stage === 'running') {
+        checks.push({ name: 'daemon', status: 'ok', detail: 'running' });
+    }
+    else {
+        // A first poll of many sources can hold the connectors stage for minutes; time alone
+        // does not make a boot stuck, so this names the stage and how long it has been there.
+        const minutes = Math.floor((Date.now() - startedAt) / 60_000);
+        checks.push({
+            name: 'daemon',
+            status: 'warn',
+            detail: `at boot stage ${stage} for ${minutes} min`,
+            fix: 'daemon.log shows what that stage is doing',
+        });
+    }
+    // Each source as the running daemon last polled it.
+    for (const connector of (Array.isArray(status.connectors) ? status.connectors : [])) {
+        const lastPoll = typeof connector.lastPoll === 'string' ? connector.lastPoll : 'never';
+        checks.push(connector.healthy === true
+            ? { name: `source ${connector.name}`, status: 'ok', detail: `last poll ${lastPoll}` }
+            : {
+                name: `source ${connector.name}`,
+                status: 'warn',
+                detail: `unhealthy; last poll ${lastPoll}`,
+                ...(typeof connector.error === 'string' ? { context: connector.error } : {}),
+                fix: 'daemon.log shows this source; the daemon keeps polling it',
+            });
+    }
+    return checks;
+}
+function serviceCheck(platform, home, serviceRun) {
+    let launchd;
+    let unit;
+    try {
+        launchd = platform === 'darwin' ? (0, daemon_js_1.launchdService)() : { loaded: false, pid: null };
+        unit = (0, systemd_service_js_1.systemdUnitState)(home, serviceRun, platform);
+    }
+    catch (error) {
+        return {
+            name: 'service',
+            status: 'warn',
+            detail: `could not ask ${platform === 'darwin' ? 'launchd' : 'systemd'}`,
+            context: message(error),
+        };
+    }
+    if (launchd.loaded) {
+        return {
+            name: 'service',
+            status: 'ok',
+            detail: `launchd${launchd.pid === null ? ' (loaded, not running)' : ''}`,
+        };
+    }
+    if (unit === null) {
+        return {
+            name: 'service',
+            status: 'warn',
+            detail: 'no service manager runs the daemon',
+            fix: 'mama service install, then mama service start',
+        };
+    }
+    if (unit === 'failed') {
+        return {
+            name: 'service',
+            status: 'fail',
+            detail: 'systemd (failed)',
+            fix: 'journalctl --user -u mama.service shows why',
+        };
+    }
+    return SYSTEMD_USABLE.has(unit)
+        ? { name: 'service', status: 'ok', detail: `systemd (${unit})` }
+        : {
+            name: 'service',
+            status: 'warn',
+            detail: 'systemctl --user did not answer; no user session manager is running',
+            fix: 'log in on a session, or mama service install --enable-linger',
+        };
+}
+//# sourceMappingURL=diagnostics.js.map