@keel_flow/cli 0.2.0

package/dist/claude-auth.js

@@ -0,0 +1,75 @@
+// Claude subscription auth probe + login trigger for the keyless claude-bridge
+// provider.
+//
+// claude-bridge (the default provider) routes through the Claude Agent SDK on
+// SUBSCRIPTION auth — no API key. The SDK runs its own bundled native CLI, but
+// the OAuth credentials it rides are minted by the external `claude` CLI's login.
+// So: the `claude` binary is a LOGIN-TIME prerequisite (to sign in once), not a
+// runtime one. This module probes the login state and triggers the sign-in.
+import { execFileSync, spawnSync } from "node:child_process";
+import pc from "picocolors";
+// The default provider is claude-bridge (keyless, Claude subscription) when
+// KEEL_PROVIDER_KIND is UNSET — the friendly "no API key" path. An explicit value
+// passes through unchanged (even an unrecognized one, so a typo surfaces as a
+// "not a recognized kind" warning rather than being silently swallowed).
+// NOTE: the agentic CLI commands (orchestrate/build/learn) resolve their own
+// default separately, because claude-bridge is single-shot only and throws on
+// tool loops — defaulting THEM to claude-bridge would break them.
+export function resolveProviderKind(env = process.env) {
+    const raw = env["KEEL_PROVIDER_KIND"];
+    return raw && raw.length > 0 ? raw : "claude-bridge";
+}
+const defaultRunner = (cmd, args) => {
+    try {
+        const stdout = execFileSync(cmd, args, { stdio: ["ignore", "pipe", "ignore"] }).toString();
+        return { status: 0, stdout };
+    }
+    catch (err) {
+        const e = err;
+        if (e.code === "ENOENT")
+            return { status: 127, stdout: "" }; // binary not installed
+        return {
+            status: typeof e.status === "number" ? e.status : 1,
+            stdout: e.stdout != null ? String(e.stdout) : "",
+        };
+    }
+};
+// Probe the Claude subscription login state via `claude auth status --json`
+// (returns {loggedIn, subscriptionType, email, ...}). This is the readiness
+// signal for claude-bridge. cli-missing = the `claude` binary isn't installed;
+// logged-out = installed but not signed in; authed = ready.
+export function probeClaudeAuth(run = defaultRunner) {
+    const { status, stdout } = run("claude", ["auth", "status", "--json"]);
+    if (status === 127)
+        return { state: "cli-missing" };
+    try {
+        const parsed = JSON.parse(stdout);
+        if (parsed.loggedIn) {
+            return {
+                state: "authed",
+                ...(parsed.subscriptionType ? { subscriptionType: parsed.subscriptionType } : {}),
+                ...(parsed.email ? { email: parsed.email } : {}),
+            };
+        }
+        return { state: "logged-out" };
+    }
+    catch {
+        // Non-JSON / unexpected output → safest to treat as logged-out and prompt.
+        return { state: "logged-out" };
+    }
+}
+export const CLAUDE_INSTALL_HINT = "Install the Claude CLI once to sign in (https://claude.ai/download), then run: keel login";
+// Trigger the sign-in. "browser" runs `claude auth login` (interactive OAuth);
+// "token" runs `claude setup-token` to mint a long-lived CLAUDE_CODE_OAUTH_TOKEN
+// for headless/CI. Inherits stdio so the user sees the prompt/URL. Returns true
+// on success, false if the binary is missing or login failed.
+export function triggerClaudeLogin(mode = "browser") {
+    const args = mode === "token" ? ["setup-token"] : ["auth", "login"];
+    const res = spawnSync("claude", args, { stdio: "inherit" });
+    if (res.error && res.error.code === "ENOENT") {
+        process.stderr.write(pc.yellow(`\n${CLAUDE_INSTALL_HINT}\n`));
+        return false;
+    }
+    return res.status === 0;
+}
+//# sourceMappingURL=claude-auth.js.map

package/dist/claude-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-auth.js","sourceRoot":"","sources":["../src/claude-auth.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,YAAY;AACZ,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,kFAAkF;AAClF,gFAAgF;AAChF,4EAA4E;AAC5E,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,MAAM,YAAY,CAAC;AAI5B,4EAA4E;AAC5E,kFAAkF;AAClF,8EAA8E;AAC9E,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,MAAM,GAAG,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACtC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;AACvD,CAAC;AAaD,MAAM,aAAa,GAAe,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3F,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAmE,CAAC;QAC9E,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,uBAAuB;QACpF,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACnD,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;SACjD,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,MAAkB,aAAa;IAC7D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAI/B,CAAC;QACF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO;gBACL,KAAK,EAAE,QAAQ;gBACf,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAC9B,2FAA2F,CAAC;AAE9F,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAAC,OAA4B,SAAS;IACtE,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5D,IAAI,GAAG,CAAC,KAAK,IAAK,GAAG,CAAC,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,mBAAmB,IAAI,CAAC,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;AAC1B,CAAC"}

package/dist/doctor.d.ts

@@ -0,0 +1,18 @@
+import { probeClaudeAuth } from "./claude-auth.js";
+export interface DoctorCheck {
+    name: string;
+    status: "ok" | "warn" | "fail";
+    detail: string;
+}
+export interface DoctorReport {
+    checks: DoctorCheck[];
+    exitCode: 0 | 1;
+}
+export declare function runDoctor(opts: {
+    cwd: string;
+    apiTimeoutMs?: number;
+    authProbe?: () => ReturnType<typeof probeClaudeAuth>;
+}): Promise<DoctorReport>;
+export declare function collectEnvPreflight(): string[];
+export declare function printDoctorReport(report: DoctorReport): void;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAuB,MAAM,kBAAkB,CAAC;AAgBxE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;CACjB;AAMD,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,SAAS,CAAC,EAAE,MAAM,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;CACtD,GAAG,OAAO,CAAC,YAAY,CAAC,CA0exB;AAED,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAc9C;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAa5D"}

package/dist/doctor.js

@@ -0,0 +1,547 @@
+import { existsSync, statSync, readdirSync, readFileSync, writeFileSync, unlinkSync, mkdtempSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import pc from "picocolors";
+import { loadPending } from "@keel_flow/learn";
+import { cacheAgeMs, loadCache } from "@keel_flow/repo-map";
+import { probeClaudeAuth, resolveProviderKind } from "./claude-auth.js";
+const CI_NODE_MAJOR = 20;
+function detectCaseInsensitiveFs() {
+    const dir = mkdtempSync(join(tmpdir(), "keel-fs-probe-"));
+    const lower = join(dir, "probe_keel.tmp");
+    const upper = join(dir, "PROBE_KEEL.TMP");
+    try {
+        writeFileSync(lower, "");
+        return existsSync(upper);
+    }
+    finally {
+        try {
+            unlinkSync(lower);
+        }
+        catch { }
+    }
+}
+// Runs a battery of environmental sanity checks. Designed to fail
+// loud-and-explanatory rather than silent — common newcomer pitfalls
+// (Node too old, no provider, API unreachable) become a labelled list
+// instead of a cryptic stack trace during `keel verify` or `keel adopt`.
+export async function runDoctor(opts) {
+    const checks = [];
+    const cwd = opts.cwd;
+    const apiTimeoutMs = opts.apiTimeoutMs ?? 2000;
+    // 0. Environment preflight — surfaces local conditions that can mask CI divergence.
+    const nodeMajor = parseInt(process.versions.node.split(".")[0] ?? "0", 10);
+    if (nodeMajor === CI_NODE_MAJOR) {
+        checks.push({
+            name: "Node version (env preflight)",
+            status: "ok",
+            detail: `node ${process.versions.node} — matches CI target (Node ${CI_NODE_MAJOR})`,
+        });
+    }
+    else if (nodeMajor > CI_NODE_MAJOR) {
+        checks.push({
+            name: "Node version (env preflight)",
+            status: "warn",
+            detail: `node ${process.versions.node} — CI uses Node ${CI_NODE_MAJOR}; a local green here needs confirmation on the supported runtime (tsconfig lib / module resolution can differ between major versions)`,
+        });
+    }
+    else {
+        checks.push({
+            name: "Node version (env preflight)",
+            status: "fail",
+            detail: `node ${process.versions.node} — Keel requires >= ${CI_NODE_MAJOR}`,
+        });
+    }
+    const caseInsensitive = detectCaseInsensitiveFs();
+    if (caseInsensitive) {
+        checks.push({
+            name: "Filesystem case-sensitivity (env preflight)",
+            status: "warn",
+            detail: "case-insensitive filesystem detected — import paths that differ only in case will succeed locally but fail on the Linux CI runner; a local green is not a CI green",
+        });
+    }
+    else {
+        checks.push({
+            name: "Filesystem case-sensitivity (env preflight)",
+            status: "ok",
+            detail: "case-sensitive filesystem — import paths will behave the same as on Linux CI",
+        });
+    }
+    // 1. Node version (legacy check kept for compatibility)
+    if (nodeMajor >= 20) {
+        checks.push({ name: "Node version", status: "ok", detail: `node ${process.versions.node}` });
+    }
+    else {
+        checks.push({
+            name: "Node version",
+            status: "fail",
+            detail: `node ${process.versions.node} — Keel requires >= 20`,
+        });
+    }
+    // 2. Architecture map
+    const archPath = join(cwd, "architecture/data.ts");
+    if (existsSync(archPath)) {
+        checks.push({ name: "architecture/data.ts", status: "ok", detail: archPath });
+    }
+    else {
+        checks.push({
+            name: "architecture/data.ts",
+            status: "warn",
+            detail: `not found at ${archPath} — run from a Keel project root or use --cwd`,
+        });
+    }
+    // 3. Provider configuration. Default to claude-bridge (keyless Claude
+    // subscription) when KEEL_PROVIDER_KIND is unset — the friendly no-API-key path.
+    const providerKind = resolveProviderKind();
+    const anthKey = process.env["ANTHROPIC_API_KEY"];
+    const openaiKey = process.env["OPENAI_API_KEY"];
+    if (providerKind === "anthropic") {
+        if (anthKey) {
+            checks.push({
+                name: "Provider (anthropic)",
+                status: "ok",
+                detail: `ANTHROPIC_API_KEY set (last4: ${anthKey.slice(-4)})`,
+            });
+        }
+        else {
+            checks.push({
+                name: "Provider (anthropic)",
+                status: "warn",
+                detail: "ANTHROPIC_API_KEY not set — spec compliance + adopt + extend will fail",
+            });
+        }
+    }
+    else if (providerKind === "openai-compatible") {
+        if (openaiKey) {
+            const baseURL = process.env["OPENAI_BASE_URL"] ?? "https://api.openai.com/v1";
+            checks.push({
+                name: "Provider (openai-compatible)",
+                status: "ok",
+                detail: `OPENAI_API_KEY set, baseURL=${baseURL}`,
+            });
+        }
+        else {
+            checks.push({
+                name: "Provider (openai-compatible)",
+                status: "warn",
+                detail: "OPENAI_API_KEY not set",
+            });
+        }
+    }
+    else if (providerKind === "claude-bridge") {
+        // Probe the real subscription login state instead of assuming "ok" — a fresh
+        // user who never signed in would otherwise see green here and a dead agent.
+        if (process.env["CLAUDE_CODE_OAUTH_TOKEN"]) {
+            checks.push({
+                name: "Provider (claude-bridge)",
+                status: "ok",
+                detail: "CLAUDE_CODE_OAUTH_TOKEN set — keyless Claude subscription auth",
+            });
+        }
+        else {
+            const auth = (opts.authProbe ?? probeClaudeAuth)();
+            if (auth.state === "authed") {
+                checks.push({
+                    name: "Provider (claude-bridge)",
+                    status: "ok",
+                    detail: `signed in to Claude${auth.subscriptionType ? ` (${auth.subscriptionType})` : ""} — no API key required`,
+                });
+            }
+            else if (auth.state === "logged-out") {
+                checks.push({
+                    name: "Provider (claude-bridge)",
+                    status: "warn",
+                    detail: "not signed in to Claude — run `keel login` to enable the agent (keyless)",
+                });
+            }
+            else {
+                checks.push({
+                    name: "Provider (claude-bridge)",
+                    status: "warn",
+                    detail: "Claude CLI not found — install from https://claude.ai/download, then run `keel login`",
+                });
+            }
+        }
+    }
+    else {
+        checks.push({
+            name: `Provider (${providerKind})`,
+            status: "warn",
+            detail: `KEEL_PROVIDER_KIND=${providerKind} is not a recognized kind (expected anthropic, openai-compatible, or claude-bridge)`,
+        });
+    }
+    // 4. Workspace API reachability
+    const apiUrl = process.env["KEEL_API_URL"] ?? process.env["KEEL_WORKSPACE_URL"];
+    if (apiUrl) {
+        const healthUrl = `${apiUrl.replace(/\/$/, "")}/health`;
+        try {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), apiTimeoutMs);
+            const res = await fetch(healthUrl, { signal: controller.signal });
+            clearTimeout(timer);
+            if (res.ok) {
+                checks.push({ name: "Workspace API /health", status: "ok", detail: healthUrl });
+            }
+            else {
+                checks.push({
+                    name: "Workspace API /health",
+                    status: "warn",
+                    detail: `${healthUrl} returned ${res.status}`,
+                });
+            }
+        }
+        catch (err) {
+            checks.push({
+                name: "Workspace API /health",
+                status: "warn",
+                detail: `${healthUrl} unreachable: ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+    }
+    else {
+        checks.push({
+            name: "Workspace API",
+            status: "warn",
+            detail: "KEEL_API_URL not set — usage events + verify-run history will be local-only",
+        });
+    }
+    // 5. Single-user mode flag (informational; matters for the workspace + api)
+    const singleUser = process.env["KEEL_SINGLE_USER_MODE"];
+    checks.push({
+        name: "Single-user mode",
+        status: "ok",
+        detail: singleUser === "true" || singleUser === undefined
+            ? "enabled (default; no auth required)"
+            : "disabled — multi-user OAuth must be wired before the workspace API will authenticate any request",
+    });
+    // 6. Telemetry
+    const telemetryOff = process.env["KEEL_TELEMETRY"] === "off";
+    if (telemetryOff) {
+        checks.push({
+            name: "Telemetry",
+            status: "ok",
+            detail: "off (KEEL_TELEMETRY=off — local + remote disabled)",
+        });
+    }
+    else {
+        const workspaceId = process.env["KEEL_WORKSPACE_ID"];
+        const telemetryApiUrl = process.env["KEEL_API_URL"];
+        if (telemetryApiUrl && workspaceId) {
+            checks.push({
+                name: "Telemetry",
+                status: "ok",
+                detail: `forwarding to ${telemetryApiUrl}`,
+            });
+        }
+        else {
+            checks.push({ name: "Telemetry", status: "ok", detail: "local-only" });
+        }
+    }
+    // 7a. Orchestrate readiness — at least one LLM provider key configured
+    const orchestrateKey = anthKey ?? openaiKey;
+    if (orchestrateKey) {
+        const which = anthKey ? "anthropic" : "openai-compatible";
+        checks.push({
+            name: "Orchestrate readiness",
+            status: "ok",
+            detail: `at least one provider key configured (${which})`,
+        });
+    }
+    else {
+        checks.push({
+            name: "Orchestrate readiness",
+            status: "warn",
+            detail: "no LLM provider key configured — keel orchestrate will refuse to run. Run `keel setup` to fix.",
+        });
+    }
+    // 7b. Active builds — informational. Lists .keel/builds/<slug>/state.json with state.
+    const buildsRoot = join(cwd, ".keel", "builds");
+    if (existsSync(buildsRoot) && statSync(buildsRoot).isDirectory()) {
+        const entries = readdirSync(buildsRoot, { withFileTypes: true }).filter((d) => d.isDirectory());
+        const lines = [];
+        for (const entry of entries) {
+            const statePath = join(buildsRoot, entry.name, "state.json");
+            if (!existsSync(statePath))
+                continue;
+            try {
+                const parsed = JSON.parse(readFileSync(statePath, "utf-8"));
+                lines.push(`${entry.name}=${parsed.state ?? "?"}`);
+            }
+            catch {
+                lines.push(`${entry.name}=unreadable`);
+            }
+        }
+        checks.push({
+            name: "Active builds",
+            status: "ok",
+            detail: lines.length === 0 ? "none" : lines.join(", "),
+        });
+    }
+    else {
+        checks.push({
+            name: "Active builds",
+            status: "ok",
+            detail: "none (no .keel/builds directory)",
+        });
+    }
+    // 7c. Pending reflections
+    const reflectionsRoot = join(cwd, ".keel", "reflections");
+    if (existsSync(reflectionsRoot) && statSync(reflectionsRoot).isDirectory()) {
+        const count = readdirSync(reflectionsRoot).filter((f) => f.endsWith(".md")).length;
+        checks.push({
+            name: "Pending reflections",
+            status: "ok",
+            detail: count === 0 ? "none" : `${count} on disk (run \`keel reflect ls\` to inspect)`,
+        });
+    }
+    else {
+        checks.push({
+            name: "Pending reflections",
+            status: "ok",
+            detail: "none (no .keel/reflections directory)",
+        });
+    }
+    // 7d. Pending learnings
+    try {
+        const pending = await loadPending({ cwd });
+        checks.push({
+            name: "Pending learnings",
+            status: "ok",
+            detail: pending.length === 0
+                ? "none"
+                : `${pending.length} pending (run \`keel learn\` to review)`,
+        });
+    }
+    catch (err) {
+        checks.push({
+            name: "Pending learnings",
+            status: "warn",
+            detail: `count failed: ${err instanceof Error ? err.message : String(err)}`,
+        });
+    }
+    // 7e. Autonomous mode (Phase 3g)
+    const autonomous = process.env["KEEL_AUTONOMOUS"] === "true";
+    const apiUrlForGoals = process.env["KEEL_API_URL"];
+    const workspaceIdForGoals = process.env["KEEL_WORKSPACE_ID"];
+    if (autonomous) {
+        if (apiUrlForGoals && workspaceIdForGoals) {
+            try {
+                const url = `${apiUrlForGoals.replace(/\/$/, "")}/goals.list?input=${encodeURIComponent(JSON.stringify({ workspaceId: workspaceIdForGoals, status: "active" }))}`;
+                const res = await fetch(url, { signal: AbortSignal.timeout(apiTimeoutMs) });
+                if (res.ok) {
+                    const body = (await res.json());
+                    const active = body.result?.data?.length ?? 0;
+                    let pending = 0;
+                    for (const g of body.result?.data ?? []) {
+                        const aUrl = `${apiUrlForGoals.replace(/\/$/, "")}/goals.actions.list?input=${encodeURIComponent(JSON.stringify({ goalId: g.id, status: "pending-approval", limit: 50 }))}`;
+                        try {
+                            const ar = await fetch(aUrl, { signal: AbortSignal.timeout(apiTimeoutMs) });
+                            if (ar.ok) {
+                                const ab = (await ar.json());
+                                pending += ab.result?.data?.length ?? 0;
+                            }
+                        }
+                        catch {
+                            // tolerated; we report best-effort counts
+                        }
+                    }
+                    checks.push({
+                        name: "Autonomous mode",
+                        status: "ok",
+                        detail: `KEEL_AUTONOMOUS=true; ${active} active goal(s), ${pending} pending action(s)`,
+                    });
+                }
+                else {
+                    checks.push({
+                        name: "Autonomous mode",
+                        status: "warn",
+                        detail: `KEEL_AUTONOMOUS=true but API returned ${res.status}`,
+                    });
+                }
+            }
+            catch (err) {
+                checks.push({
+                    name: "Autonomous mode",
+                    status: "warn",
+                    detail: `KEEL_AUTONOMOUS=true but API unreachable: ${err instanceof Error ? err.message : String(err)}`,
+                });
+            }
+        }
+        else {
+            checks.push({
+                name: "Autonomous mode",
+                status: "warn",
+                detail: "KEEL_AUTONOMOUS=true but KEEL_API_URL or KEEL_WORKSPACE_ID is not set — scheduler cannot reach the goal store",
+            });
+        }
+    }
+    else {
+        checks.push({
+            name: "Autonomous mode",
+            status: "ok",
+            detail: "off (default; set KEEL_AUTONOMOUS=true on the api process to enable)",
+        });
+    }
+    // 7f. KB pipeline — Phase 4. Shows active embedder + context-aware flag +
+    // rerank state without ever instantiating a heavy model (HF loaders are not
+    // touched here; we read env-var precedence the way createEmbedder does).
+    const kbModel = (() => {
+        const forced = process.env["KEEL_KB_EMBEDDER"];
+        if (forced)
+            return forced;
+        if (process.env["VOYAGE_API_KEY"])
+            return "voyage-context-3";
+        if (process.env["OPENAI_API_KEY"])
+            return "text-embedding-3-small";
+        return "Xenova/all-MiniLM-L6-v2";
+    })();
+    const kbDim = kbModel === "voyage-context-3"
+        ? 1024
+        : kbModel === "text-embedding-3-small"
+            ? 1536
+            : 384;
+    const kbContextAware = kbModel === "voyage-context-3";
+    const rerank = process.env["KEEL_KB_RERANK"] === "true";
+    checks.push({
+        name: "KB pipeline",
+        status: "ok",
+        detail: `embedder=${kbModel} (${kbDim}-dim, ${kbContextAware ? "context-aware" : "not context-aware"}); rerank=${rerank ? "enabled" : "disabled"}`,
+    });
+    // 7g. Repo map (Phase 5). Auto-derived companion to architecture/data.ts.
+    // Status: present and fresh (< 10min), present but stale, or absent.
+    const repoMap = loadCache(cwd);
+    if (repoMap) {
+        const ageMs = cacheAgeMs(cwd);
+        const ageMin = ageMs !== null ? Math.round(ageMs / 60_000) : null;
+        const fresh = ageMs !== null && ageMs < 10 * 60 * 1000;
+        checks.push({
+            name: "Repo map",
+            status: "ok",
+            detail: `${repoMap.entries.length} entries from ${repoMap.files.length} files; age=${ageMin === null ? "?" : `${ageMin}min`}${fresh ? "" : " (stale; will rebuild on next session)"}`,
+        });
+    }
+    else {
+        checks.push({
+            name: "Repo map",
+            status: "ok",
+            detail: "absent (run `keel map --repo` to generate .keel/repo-map.cache.json)",
+        });
+    }
+    // 7h. ESLint plugin (Phase 6). Heuristic scan of eslint.config.{js,mjs,cjs,ts}
+    // for @keel_flow/eslint-plugin import; same plugin powers the editor-time
+    // surface of the principle checks that keel verify runs at gate time.
+    const eslintConfigCandidates = [
+        "eslint.config.js",
+        "eslint.config.mjs",
+        "eslint.config.cjs",
+        "eslint.config.ts",
+    ];
+    let eslintConfigPath = null;
+    for (const candidate of eslintConfigCandidates) {
+        const p = join(cwd, candidate);
+        if (existsSync(p)) {
+            eslintConfigPath = p;
+            break;
+        }
+    }
+    if (!eslintConfigPath) {
+        checks.push({
+            name: "ESLint plugin",
+            status: "warn",
+            detail: "no eslint.config.{js,mjs,cjs,ts} found — add @keel_flow/eslint-plugin to enable editor-time principle checks",
+        });
+    }
+    else {
+        let configText = "";
+        try {
+            configText = readFileSync(eslintConfigPath, "utf-8");
+        }
+        catch {
+            configText = "";
+        }
+        if (configText.includes("@keel_flow/eslint-plugin")) {
+            checks.push({
+                name: "ESLint plugin",
+                status: "ok",
+                detail: `@keel_flow/eslint-plugin wired in ${eslintConfigPath}`,
+            });
+        }
+        else {
+            checks.push({
+                name: "ESLint plugin",
+                status: "warn",
+                detail: `@keel_flow/eslint-plugin not referenced in ${eslintConfigPath} — add it to surface principle warnings in your editor`,
+            });
+        }
+    }
+    // 7i. Keel template detection. Confirms the project was scaffolded
+    // from one of the known templates (framework or ai-app) by checking
+    // the canonical pair: eslint.config.* + architecture/data.ts. Both
+    // templates emit both; absence means the project was either created
+    // by hand or has drifted off-template.
+    const archPresent = existsSync(archPath);
+    const eslintPresent = eslintConfigPath !== null;
+    if (archPresent && eslintPresent) {
+        checks.push({
+            name: "Keel template",
+            status: "ok",
+            detail: "architecture/data.ts + eslint.config.* present (known Keel template shape)",
+        });
+    }
+    else if (!archPresent && !eslintPresent) {
+        checks.push({
+            name: "Keel template",
+            status: "warn",
+            detail: "neither architecture/data.ts nor eslint.config.* present — this directory does not look like a Keel project (run `create-keel-app` to scaffold one)",
+        });
+    }
+    else {
+        const missing = !archPresent ? "architecture/data.ts" : "eslint.config.*";
+        checks.push({
+            name: "Keel template",
+            status: "warn",
+            detail: `${missing} missing — project deviates from the canonical Keel template shape`,
+        });
+    }
+    // 7. Principles file (Keel-shaped project)
+    const principlesPath = join(cwd, "principles/index.ts");
+    if (existsSync(principlesPath) && statSync(principlesPath).isFile()) {
+        checks.push({ name: "principles/index.ts", status: "ok", detail: principlesPath });
+    }
+    else {
+        checks.push({
+            name: "principles/index.ts",
+            status: "warn",
+            detail: `not found at ${principlesPath} — verify will skip principle checks`,
+        });
+    }
+    const failed = checks.some((c) => c.status === "fail");
+    return { checks, exitCode: failed ? 1 : 0 };
+}
+export function collectEnvPreflight() {
+    const warnings = [];
+    const nodeMajor = parseInt(process.versions.node.split(".")[0] ?? "0", 10);
+    if (nodeMajor !== CI_NODE_MAJOR) {
+        warnings.push(`Node ${process.versions.node} detected; CI uses Node ${CI_NODE_MAJOR}. A local green may not hold on the supported runtime.`);
+    }
+    if (detectCaseInsensitiveFs()) {
+        warnings.push("Case-insensitive filesystem detected. Import paths that differ only in case pass locally but fail on Linux CI.");
+    }
+    return warnings;
+}
+export function printDoctorReport(report) {
+    process.stdout.write("\nKeel Doctor\n");
+    process.stdout.write("─".repeat(50) + "\n");
+    for (const c of report.checks) {
+        const icon = c.status === "ok" ? pc.green("✓") : c.status === "warn" ? pc.yellow("⚠") : pc.red("✗");
+        process.stdout.write(`  ${icon} ${c.name}\n    ${pc.dim(c.detail)}\n`);
+    }
+    process.stdout.write("\n");
+    if (report.exitCode === 0) {
+        process.stdout.write(pc.green("✓ All required checks passed.\n"));
+    }
+    else {
+        process.stdout.write(pc.red("✗ One or more critical checks failed.\n"));
+    }
+}
+//# sourceMappingURL=doctor.js.map