@meistrari/tela-cli 0.7.0 → 0.7.4

package/src/diagnostics.ts

@@ -1,813 +0,0 @@
-import { accessSync, constants, existsSync, statSync } from 'node:fs'
-import { dirname } from 'node:path'
-import { buildAgentApiHeaders } from './auth.ts'
-import {
-    formatClaudeCliVersion,
-    inspectClaudeCli,
-    MIN_CLAUDE_VERSION_FOR_PROJECT_SCOPED_RUN,
-} from './claude.ts'
-import { inspectSavedConfig, redactSecret } from './config.ts'
-import { resolveSshPrivateKeyPath } from './forgejo.ts'
-import {
-    findRepositoryRoot,
-    getCurrentBranch,
-    getHeadShortSha,
-    getOriginUrl,
-    getShortStatus,
-    getStatusCounts,
-    getUpstreamBranch,
-} from './git.ts'
-import { commandExists } from './process.ts'
-
-export type DiagnosticStatus = 'pass' | 'warn' | 'fail'
-export type AgentApiReachabilityCategory = 'invalid_url' | 'tls_error' | 'network_error' | 'http_response'
-
-export interface AgentApiReachability {
-    reachable: boolean
-    category: AgentApiReachabilityCategory
-    statusCode?: number
-    detail: string
-}
-
-export interface RepoSnapshot {
-    cwd: string
-    inRepository: boolean
-    repoRoot?: string
-    branch?: string
-    upstream?: string | null
-    detached: boolean
-    dirty: boolean
-    originUrl?: string | null
-    shortStatus?: string
-    head?: string
-    statusCounts?: {
-        staged: number
-        unstaged: number
-        untracked: number
-        total: number
-    }
-}
-
-export interface StatusReport {
-    ok: boolean
-    config: {
-        present: boolean
-        valid: boolean
-        path: string
-        environment?: string
-        agentApiUrl?: string
-        authApiUrl?: string
-        telaApiUrl?: string
-        cloneRoot?: string
-        user?: string
-        workspace?: string
-        forgejoOrganization?: string
-        forgejoUserRegistered?: boolean
-        gitSshKeyTitle?: string
-        gitSshPublicKeyPath?: string
-        gitSshPrivateKeyPath?: string
-        accessToken?: string
-        sessionExpiresAt?: number
-        hasRefreshToken?: boolean
-        error?: string
-    }
-    repo: RepoSnapshot
-    tools: {
-        git: boolean
-        claude: boolean
-        claudeVersion?: string
-        claudeProjectScopedRunSupported?: boolean | null
-        claudeDetail?: string
-        agentApiReachable: boolean | null
-        agentApiCategory?: AgentApiReachabilityCategory
-        agentApiStatus?: number
-        agentApiDetail?: string
-    }
-    warnings: string[]
-    nextActions: string[]
-}
-
-function formatSessionState(expiresAt: number | undefined, hasRefreshToken: boolean | undefined): string | undefined {
-    if (!expiresAt) {
-        return undefined
-    }
-
-    const relative = expiresAt <= Date.now() ? 'expired' : 'active'
-    return `${relative}${hasRefreshToken ? ' · refresh token saved' : ''}`
-}
-
-export interface DoctorCheck {
-    id: string
-    group: string
-    status: DiagnosticStatus
-    summary: string
-    fixes: string[]
-    evidence?: string[]
-}
-
-export interface DoctorReport {
-    ok: boolean
-    checks: DoctorCheck[]
-    nextActions: string[]
-}
-
-function isDetachedHeadError(error: unknown): boolean {
-    return error instanceof Error && error.message.includes('Detached HEAD')
-}
-
-function classifyAgentApiReachabilityError(message: string): AgentApiReachabilityCategory {
-    return /tls|ssl|certificate|hostname|subject name/i.test(message)
-        ? 'tls_error'
-        : 'network_error'
-}
-
-export async function checkAgentApiReachability(url: string, fetchFn: typeof fetch = fetch): Promise<AgentApiReachability> {
-    try {
-        new URL(url)
-    }
-    catch {
-        return {
-            reachable: false,
-            category: 'invalid_url',
-            detail: 'Agent API origin URL must be a valid URL',
-        }
-    }
-
-    try {
-        const response = await fetchFn(url, {
-            method: 'GET',
-            signal: AbortSignal.timeout(5_000),
-        })
-
-        const detail = response.statusText
-            ? `HTTP ${response.status} ${response.statusText}`
-            : `HTTP ${response.status}`
-
-        return {
-            reachable: true,
-            category: 'http_response',
-            statusCode: response.status,
-            detail,
-        }
-    }
-    catch (error) {
-        const detail = error instanceof Error ? error.message : String(error)
-        return {
-            reachable: false,
-            category: classifyAgentApiReachabilityError(detail),
-            detail,
-        }
-    }
-}
-
-export function getAgentApiOriginCheckStatus(reachability: AgentApiReachability): string {
-    switch (reachability.category) {
-        case 'http_response':
-            return 'responded'
-        case 'invalid_url':
-            return 'invalid-url'
-        case 'tls_error':
-            return 'tls-error'
-        case 'network_error':
-            return 'network-error'
-    }
-}
-
-export function getAgentApiOriginWarning(reachability: AgentApiReachability): string | undefined {
-    switch (reachability.category) {
-        case 'http_response':
-            return undefined
-        case 'invalid_url':
-            return `Agent API origin URL is invalid: ${reachability.detail}`
-        case 'tls_error':
-            return `Agent API origin TLS check failed: ${reachability.detail}`
-        case 'network_error':
-            return `Agent API origin is unreachable: ${reachability.detail}`
-    }
-}
-
-export function getAgentApiOriginFixes(reachability: AgentApiReachability): string[] {
-    switch (reachability.category) {
-        case 'http_response':
-            return ['No action required.']
-        case 'invalid_url':
-            return ['Run `tela setup` and choose production, staging, or a valid custom Agent API origin URL.']
-        case 'tls_error':
-            return ['Check the configured hostname and TLS certificate, or choose the correct Agent API target in `tela setup`.']
-        case 'network_error':
-            return ['Check your network connection, VPN, or the configured Agent API origin in `tela setup`.']
-    }
-}
-
-export function getAgentApiOriginSummary(url: string, reachability: AgentApiReachability): string {
-    switch (reachability.category) {
-        case 'http_response':
-            return `Agent API origin responded at ${url} (${reachability.detail})`
-        case 'invalid_url':
-            return `Agent API origin URL is invalid: ${url}`
-        case 'tls_error':
-            return `Agent API origin TLS check failed at ${url}`
-        case 'network_error':
-            return `Agent API origin is unreachable at ${url}`
-    }
-}
-
-export async function inspectCurrentRepository(cwd = process.cwd()): Promise<RepoSnapshot> {
-    const repoRoot = await findRepositoryRoot(cwd)
-    if (!repoRoot) {
-        return {
-            cwd,
-            inRepository: false,
-            detached: false,
-            dirty: false,
-        }
-    }
-
-    const shortStatus = await getShortStatus(repoRoot)
-    const dirty = Boolean(shortStatus.trim())
-    const statusCounts = await getStatusCounts(repoRoot)
-    const head = await getHeadShortSha(repoRoot)
-
-    let branch: string | undefined
-    let detached = false
-    try {
-        branch = await getCurrentBranch(repoRoot)
-    }
-    catch (error) {
-        if (!isDetachedHeadError(error)) {
-            throw error
-        }
-
-        detached = true
-    }
-
-    let upstream: string | null | undefined
-    if (!detached) {
-        upstream = await getUpstreamBranch(repoRoot)
-    }
-
-    let originUrl: string | null = null
-    try {
-        originUrl = await getOriginUrl(repoRoot)
-    }
-    catch {
-        originUrl = null
-    }
-
-    return {
-        cwd,
-        inRepository: true,
-        repoRoot,
-        branch,
-        upstream,
-        detached,
-        dirty,
-        originUrl,
-        shortStatus: shortStatus.trim() || undefined,
-        head,
-        statusCounts,
-    }
-}
-
-function buildStatusNextActions(
-    warnings: string[],
-    repo: RepoSnapshot,
-    hasConfig: boolean,
-    hasAuth: boolean,
-    hasForgejoOrganization: boolean,
-    hasForgejoAccess: boolean,
-    hasGitSshKey: boolean,
-    claudeFix?: string,
-): string[] {
-    const actions: string[] = []
-
-    if (!hasConfig) {
-        actions.push('Run `tela setup` to configure the CLI.')
-    }
-    else if (!hasAuth) {
-        actions.push('Run `tela setup` to sign in again.')
-    }
-    else if (!hasForgejoOrganization) {
-        actions.push('Run `tela setup` again to choose a workspace organization for Forgejo access.')
-    }
-    else if (!hasForgejoAccess) {
-        actions.push('Run `tela setup` again to provision Forgejo access with your SSH key.')
-    }
-    else if (!hasGitSshKey) {
-        actions.push('Run `tela setup` again to choose the SSH key Tela should force on Git operations.')
-    }
-
-    if (!repo.inRepository) {
-        actions.push('Run `tela sync <repo>` or change into a cloned repository before mutating commands.')
-    }
-
-    if (repo.detached) {
-        actions.push('Check out a branch before syncing or pushing.')
-    }
-
-    if (repo.dirty) {
-        actions.push('Review local changes before syncing, or use `tela push` to stage and commit them.')
-    }
-
-    if (claudeFix) {
-        actions.push(claudeFix)
-    }
-
-    if (warnings.length === 0) {
-        actions.push('Run `tela sync --current`, `tela run`, or `tela push` when you are ready.')
-    }
-
-    return Array.from(new Set(actions))
-}
-
-export async function createStatusReport(
-    cwd = process.cwd(),
-    fetchFn: typeof fetch = fetch,
-): Promise<StatusReport> {
-    const [configInspection, gitAvailable, claudeInspection, repo] = await Promise.all([
-        Promise.resolve(inspectSavedConfig()),
-        commandExists('git'),
-        inspectClaudeCli(),
-        inspectCurrentRepository(cwd),
-    ])
-
-    const warnings: string[] = []
-    let reachability: AgentApiReachability | undefined
-    let claudeFix: string | undefined
-
-    if (!configInspection.exists) {
-        warnings.push('Tela CLI is not configured yet.')
-    }
-    else if (!configInspection.valid) {
-        warnings.push(`Tela CLI config is invalid: ${configInspection.error ?? 'unknown error'}`)
-    }
-    else if (!configInspection.config?.auth) {
-        warnings.push('Tela CLI is signed out.')
-    }
-    else {
-        if (!configInspection.config.forgejoOrganization) {
-            warnings.push('Forgejo organization selection is missing.')
-        }
-        if (!configInspection.config.forgejoUserRegistered) {
-            warnings.push('Forgejo user access is not provisioned yet.')
-        }
-        if (!configInspection.config.gitSshKey) {
-            warnings.push('Git SSH key selection is missing.')
-        }
-        else {
-            try {
-                resolveSshPrivateKeyPath(configInspection.config.gitSshKey.privateKeyPath)
-            }
-            catch (error) {
-                warnings.push(`Configured Git SSH private key is unavailable: ${error instanceof Error ? error.message : String(error)}`)
-            }
-        }
-    }
-
-    if (!gitAvailable) {
-        warnings.push('`git` is not available on PATH.')
-    }
-
-    if (!claudeInspection.available) {
-        warnings.push('`claude` is not available on PATH.')
-        claudeFix = 'Install the Claude CLI before using `tela run`, `tela push --claude`, or `tela feedback`.'
-    }
-    else if (!claudeInspection.supportsProjectScopedRun) {
-        const requiredVersion = formatClaudeCliVersion(MIN_CLAUDE_VERSION_FOR_PROJECT_SCOPED_RUN)
-        warnings.push(
-            claudeInspection.problem === 'unparseable'
-                ? `Claude CLI version could not be determined for project-scoped runs: ${claudeInspection.detail ?? 'unknown output'}`
-                : `Claude CLI must be updated to ${requiredVersion} or newer for project-scoped \`tela run\`.`,
-        )
-        claudeFix = `Update Claude CLI to version ${requiredVersion} or newer before using \`tela run\`.`
-    }
-
-    if (repo.detached) {
-        warnings.push('The current repository is on a detached HEAD.')
-    }
-
-    if (repo.dirty) {
-        warnings.push('The current repository has local changes.')
-    }
-
-    if (configInspection.valid && configInspection.config) {
-        reachability = await checkAgentApiReachability(configInspection.config.agentApiUrl, fetchFn)
-        const warning = getAgentApiOriginWarning(reachability)
-        if (warning) {
-            warnings.push(warning)
-        }
-    }
-
-    const nextActions = buildStatusNextActions(
-        warnings,
-        repo,
-        Boolean(configInspection.valid),
-        Boolean(configInspection.config?.auth),
-        Boolean(configInspection.config?.forgejoOrganization),
-        Boolean(configInspection.config?.forgejoUserRegistered),
-        Boolean(configInspection.config?.gitSshKey),
-        claudeFix,
-    )
-
-    return {
-        ok: warnings.length === 0,
-        config: {
-            present: configInspection.exists,
-            valid: configInspection.valid,
-            path: configInspection.path,
-            environment: configInspection.config?.environment,
-            agentApiUrl: configInspection.config?.agentApiUrl,
-            authApiUrl: configInspection.config?.authApiUrl,
-            telaApiUrl: configInspection.config?.telaApiUrl,
-            cloneRoot: configInspection.config?.cloneRoot,
-            user: configInspection.config?.auth?.user.email,
-            workspace: configInspection.config?.auth?.workspace.title,
-            forgejoOrganization: configInspection.config?.forgejoOrganization?.name,
-            forgejoUserRegistered: configInspection.config?.forgejoUserRegistered,
-            gitSshKeyTitle: configInspection.config?.gitSshKey?.title,
-            gitSshPublicKeyPath: configInspection.config?.gitSshKey?.publicKeyPath,
-            gitSshPrivateKeyPath: configInspection.config?.gitSshKey?.privateKeyPath,
-            accessToken: configInspection.config?.auth ? redactSecret(configInspection.config.auth.session.accessToken) : undefined,
-            sessionExpiresAt: configInspection.config?.auth?.session.expiresAt,
-            hasRefreshToken: Boolean(configInspection.config?.auth?.session.refreshToken),
-            error: configInspection.error,
-        },
-        repo,
-        tools: {
-            git: gitAvailable,
-            claude: claudeInspection.available,
-            claudeVersion: claudeInspection.version,
-            claudeProjectScopedRunSupported: claudeInspection.available
-                ? claudeInspection.supportsProjectScopedRun
-                : null,
-            claudeDetail: claudeInspection.detail,
-            agentApiReachable: reachability?.reachable ?? null,
-            agentApiCategory: reachability?.category,
-            agentApiStatus: reachability?.statusCode,
-            agentApiDetail: reachability?.detail,
-        },
-        warnings,
-        nextActions,
-    }
-}
-
-function buildCloneRootCheck(cloneRoot: string | undefined): DoctorCheck {
-    if (!cloneRoot) {
-        return {
-            id: 'clone-root',
-            group: 'filesystem',
-            status: 'warn',
-            summary: 'Clone root is unavailable because config is missing or invalid.',
-            fixes: ['Run `tela setup` to configure a clone root.'],
-        }
-    }
-
-    if (existsSync(cloneRoot)) {
-        const stats = statSync(cloneRoot)
-        if (!stats.isDirectory()) {
-            return {
-                id: 'clone-root',
-                group: 'filesystem',
-                status: 'fail',
-                summary: `Clone root exists but is not a directory: ${cloneRoot}`,
-                fixes: [
-                    `Move or remove \`${cloneRoot}\`, then rerun \`tela setup\`.`,
-                ],
-            }
-        }
-
-        try {
-            accessSync(cloneRoot, constants.R_OK | constants.W_OK | constants.X_OK)
-            return {
-                id: 'clone-root',
-                group: 'filesystem',
-                status: 'pass',
-                summary: `Clone root is ready: ${cloneRoot}`,
-                fixes: ['No action required.'],
-            }
-        }
-        catch (error) {
-            return {
-                id: 'clone-root',
-                group: 'filesystem',
-                status: 'fail',
-                summary: `Clone root is not writable: ${cloneRoot}`,
-                fixes: [
-                    `Fix permissions for \`${cloneRoot}\` or choose another clone root in \`tela setup\`.`,
-                ],
-                evidence: [error instanceof Error ? error.message : String(error)],
-            }
-        }
-    }
-
-    const parentDir = dirname(cloneRoot)
-    try {
-        accessSync(parentDir, constants.W_OK | constants.X_OK)
-        return {
-            id: 'clone-root',
-            group: 'filesystem',
-            status: 'warn',
-            summary: `Clone root does not exist yet: ${cloneRoot}`,
-            fixes: [
-                `Create it with \`mkdir -p ${cloneRoot}\` or rerun \`tela setup\`.`,
-            ],
-        }
-    }
-    catch (error) {
-        return {
-            id: 'clone-root',
-            group: 'filesystem',
-            status: 'fail',
-            summary: `Clone root parent is not writable: ${parentDir}`,
-            fixes: [
-                `Fix permissions for \`${parentDir}\` or choose another clone root in \`tela setup\`.`,
-            ],
-            evidence: [error instanceof Error ? error.message : String(error)],
-        }
-    }
-}
-
-function buildGitSshKeyCheck(gitSshKey: {
-    title?: string
-    publicKeyPath?: string
-    privateKeyPath?: string
-}): DoctorCheck {
-    if (!gitSshKey.privateKeyPath) {
-        return {
-            id: 'git-ssh-key',
-            group: 'access',
-            status: 'warn',
-            summary: 'No Git SSH key is configured.',
-            fixes: ['Run `tela setup` again and choose the SSH key to force on Git operations.'],
-        }
-    }
-
-    try {
-        const privateKeyPath = resolveSshPrivateKeyPath(gitSshKey.privateKeyPath)
-        return {
-            id: 'git-ssh-key',
-            group: 'access',
-            status: 'pass',
-            summary: `Git SSH key is configured: ${gitSshKey.title ?? '<unnamed>'}.`,
-            fixes: ['No action required.'],
-            evidence: [
-                gitSshKey.publicKeyPath ? `public key: ${gitSshKey.publicKeyPath}` : '',
-                `private key: ${privateKeyPath}`,
-            ].filter(Boolean),
-        }
-    }
-    catch (error) {
-        return {
-            id: 'git-ssh-key',
-            group: 'access',
-            status: 'fail',
-            summary: 'Configured Git SSH private key is unavailable.',
-            fixes: ['Restore the private key file or run `tela setup` again and choose another SSH key.'],
-            evidence: [error instanceof Error ? error.message : String(error)],
-        }
-    }
-}
-
-function buildRepoChecks(repo: RepoSnapshot): DoctorCheck[] {
-    if (!repo.inRepository) {
-        return [
-            {
-                id: 'repo-context',
-                group: 'repository',
-                status: 'warn',
-                summary: 'Current directory is not inside a git repository.',
-                fixes: [
-                    'Change into a Tela repository or run `tela sync <repo>` first.',
-                ],
-            },
-        ]
-    }
-
-    const checks: DoctorCheck[] = [
-        {
-            id: 'repo-context',
-            group: 'repository',
-            status: 'pass',
-            summary: `Inside git repository: ${repo.repoRoot}`,
-            fixes: ['No action required.'],
-        },
-    ]
-
-    checks.push({
-        id: 'repo-head',
-        group: 'repository',
-        status: repo.detached ? 'fail' : 'pass',
-        summary: repo.detached
-            ? 'Repository is on a detached HEAD.'
-            : `Current branch is ${repo.branch}.`,
-        fixes: repo.detached
-            ? ['Check out a branch before syncing or pushing.']
-            : ['No action required.'],
-    })
-
-    checks.push({
-        id: 'repo-worktree',
-        group: 'repository',
-        status: repo.dirty ? 'warn' : 'pass',
-        summary: repo.dirty
-            ? 'Repository has local changes.'
-            : 'Repository worktree is clean.',
-        fixes: repo.dirty
-            ? ['Review the local diff before syncing, or use `tela push` to stage and commit changes.']
-            : ['No action required.'],
-        evidence: repo.shortStatus ? [repo.shortStatus] : undefined,
-    })
-
-    checks.push({
-        id: 'repo-upstream',
-        group: 'repository',
-        status: repo.detached ? 'warn' : (repo.upstream ? 'pass' : 'warn'),
-        summary: repo.detached
-            ? 'Upstream check skipped because HEAD is detached.'
-            : (repo.upstream
-                ? `Upstream branch is ${repo.upstream}.`
-                : 'Current branch does not track an upstream.'),
-        fixes: repo.detached
-            ? ['Check out a branch before configuring tracking.']
-            : (repo.upstream
-                ? ['No action required.']
-                : ['Push the branch once or run `git branch --set-upstream-to origin/<branch>` after creating the remote branch.']),
-    })
-
-    checks.push({
-        id: 'repo-origin',
-        group: 'repository',
-        status: repo.originUrl ? 'pass' : 'warn',
-        summary: repo.originUrl
-            ? `Origin remote: ${repo.originUrl}`
-            : 'Origin remote is missing.',
-        fixes: repo.originUrl
-            ? ['No action required.']
-            : ['Add an origin remote or run `tela sync <repo>` to clone a fresh checkout.'],
-    })
-
-    return checks
-}
-
-function buildNextActions(checks: DoctorCheck[]): string[] {
-    const failing = checks.filter(check => check.status !== 'pass')
-    if (failing.length === 0) {
-        return ['Environment looks healthy. Run `tela status`, `tela sync`, `tela run`, or `tela push` as needed.']
-    }
-
-    return Array.from(new Set(failing.flatMap(check => check.fixes))).slice(0, 5)
-}
-
-export async function createDoctorReport(
-    cwd = process.cwd(),
-    fetchFn: typeof fetch = fetch,
-): Promise<DoctorReport> {
-    const [configInspection, gitAvailable, claudeInspection, repo] = await Promise.all([
-        Promise.resolve(inspectSavedConfig()),
-        commandExists('git'),
-        inspectClaudeCli(),
-        inspectCurrentRepository(cwd),
-    ])
-
-    const checks: DoctorCheck[] = [
-        configInspection.exists
-            ? (configInspection.valid
-                ? {
-                    id: 'config',
-                    group: 'config',
-                    status: 'pass',
-                    summary: `Config loaded from ${configInspection.path}`,
-                    fixes: ['No action required.'],
-                }
-                : {
-                    id: 'config',
-                    group: 'config',
-                    status: 'fail',
-                    summary: `Config file is invalid: ${configInspection.path}`,
-                    fixes: ['Run `tela setup` to rewrite the config file.'],
-                    evidence: configInspection.error ? [configInspection.error] : undefined,
-                })
-            : {
-                id: 'config',
-                group: 'config',
-                status: 'fail',
-                summary: 'Tela CLI config file is missing.',
-                fixes: ['Run `tela setup` to create the config file.'],
-            },
-        buildCloneRootCheck(configInspection.config?.cloneRoot),
-        {
-            id: 'tool-git',
-            group: 'tools',
-            status: gitAvailable ? 'pass' : 'fail',
-            summary: gitAvailable ? '`git` is available.' : '`git` is missing from PATH.',
-            fixes: gitAvailable ? ['No action required.'] : ['Install `git` and make sure it is available on PATH.'],
-        },
-        {
-            id: 'tool-claude',
-            group: 'tools',
-            status: !claudeInspection.available
-                ? 'warn'
-                : (claudeInspection.supportsProjectScopedRun ? 'pass' : 'fail'),
-            summary: !claudeInspection.available
-                ? '`claude` is not available on PATH.'
-                : (claudeInspection.supportsProjectScopedRun
-                    ? `Claude CLI is available (${claudeInspection.version ?? 'unknown version'}) and supports project-scoped runs.`
-                    : (claudeInspection.problem === 'unparseable'
-                        ? 'Claude CLI version could not be determined for project-scoped runs.'
-                        : `Claude CLI ${claudeInspection.version ?? '<unknown>'} is too old for project-scoped runs.`)),
-            fixes: !claudeInspection.available
-                ? ['Install the Claude CLI before using `tela run`, `tela push --claude`, or `tela feedback`.']
-                : (claudeInspection.supportsProjectScopedRun
-                    ? ['No action required.']
-                    : [`Update Claude CLI to version ${formatClaudeCliVersion(MIN_CLAUDE_VERSION_FOR_PROJECT_SCOPED_RUN)} or newer before using \`tela run\`.`]),
-            evidence: claudeInspection.available && claudeInspection.detail ? [claudeInspection.detail] : undefined,
-        },
-        ...buildRepoChecks(repo),
-    ]
-
-    if (configInspection.valid && configInspection.config) {
-        const reachability = await checkAgentApiReachability(configInspection.config.agentApiUrl, fetchFn)
-        checks.push({
-            id: 'agent-api-origin',
-            group: 'network',
-            status: reachability.reachable ? 'pass' : 'warn',
-            summary: getAgentApiOriginSummary(configInspection.config.agentApiUrl, reachability),
-            fixes: getAgentApiOriginFixes(reachability),
-            evidence: reachability.reachable ? undefined : [reachability.detail],
-        })
-
-        if (configInspection.config.auth) {
-            try {
-                const headers = await buildAgentApiHeaders(configInspection.config, { fetchFn })
-                checks.push({
-                    id: 'auth-session',
-                    group: 'auth',
-                    status: 'pass',
-                    summary: `Saved session is usable for ${configInspection.config.auth.user.email} in ${configInspection.config.auth.workspace.title}.`,
-                    fixes: ['No action required.'],
-                    evidence: [
-                        `data-token header: ${redactSecret(headers['x-data-token'])}`,
-                    ],
-                })
-            }
-            catch (error) {
-                const message = error instanceof Error ? error.message : String(error)
-                checks.push({
-                    id: 'auth-session',
-                    group: 'auth',
-                    status: 'fail',
-                    summary: 'Saved Tela session could not be refreshed or exchanged for a data token.',
-                    fixes: ['Run `tela setup` in an interactive terminal to sign in again.'],
-                    evidence: [message],
-                })
-            }
-        }
-        else {
-            checks.push({
-                id: 'auth-session',
-                group: 'auth',
-                status: 'fail',
-                summary: 'No saved Tela session is available.',
-                fixes: ['Run `tela setup` in an interactive terminal to sign in.'],
-            })
-        }
-
-        checks.push({
-            id: 'forgejo-organization',
-            group: 'access',
-            status: configInspection.config.forgejoOrganization ? 'pass' : 'warn',
-            summary: configInspection.config.forgejoOrganization
-                ? `Forgejo organization is selected: ${configInspection.config.forgejoOrganization.name}.`
-                : 'No Forgejo organization is selected.',
-            fixes: configInspection.config.forgejoOrganization
-                ? ['No action required.']
-                : ['Run `tela setup` again and choose a workspace organization for Forgejo access.'],
-        })
-
-        checks.push({
-            id: 'forgejo-user',
-            group: 'access',
-            status: configInspection.config.forgejoUserRegistered ? 'pass' : 'warn',
-            summary: configInspection.config.forgejoUserRegistered
-                ? 'Forgejo user access is provisioned.'
-                : 'Forgejo user access has not been provisioned yet.',
-            fixes: configInspection.config.forgejoUserRegistered
-                ? ['No action required.']
-                : ['Run `tela setup` again and complete SSH-key provisioning for Forgejo access.'],
-        })
-
-        checks.push(buildGitSshKeyCheck({
-            title: configInspection.config.gitSshKey?.title,
-            publicKeyPath: configInspection.config.gitSshKey?.publicKeyPath,
-            privateKeyPath: configInspection.config.gitSshKey?.privateKeyPath,
-        }))
-    }
-
-    const nextActions = buildNextActions(checks)
-
-    return {
-        ok: checks.every(check => check.status === 'pass'),
-        checks,
-        nextActions,
-    }
-}