@moda-ai/cli 1.22.1 → 1.23.0

package/dist/doctor.js

@@ -1,1182 +0,0 @@
-import { createHash } from 'node:crypto';
-import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync, statSync } from 'node:fs';
-import { join } from 'node:path';
-import { callDataAPI } from './api-client.js';
-import { isAuthSessionValid, loadAuthSession } from './auth.js';
-import { resolveApiKey, resolveIngestUrl, resolveModaBaseUrl, resolveTenantId } from './config.js';
-import { readHarnessSyncState, scanHarness } from './harness.js';
-import { HARNESS_REPORT_APPROVAL_PATH, HARNESS_REPORT_APPROVAL_SCHEMA_VERSION, HARNESS_REPORT_PATH, hashHarnessReport, readHarnessReport, validateHarnessReport, } from './harness-report.js';
-import { ensureSecretFilePermissions, getActiveProfile, getModaPaths, isLoopbackBaseUrl, loadProfileConfig, resolveSecretReference, secretFilePathFromRef, } from './profiles.js';
-import { renderDoctorHuman, renderStatusHuman } from './tui.js';
-export async function runDoctorCommand(context) {
-    const report = await buildDoctorReport(context, {
-        offline: context.flags.offline === 'true',
-    });
-    if (context.outputMode === 'human') {
-        if (!context.quiet)
-            console.log(renderDoctorHuman(report));
-        return { exitCode: 0 };
-    }
-    context.output.writeData(report, {
-        status: report.summary.fail > 0 ? 'error' : 'success',
-        ...doctorAgentWriteOptions(report, 'doctor'),
-    });
-    return { exitCode: 0 };
-}
-export async function runStatusCommand(context) {
-    const report = await buildDoctorReport(context, {
-        offline: context.flags.offline === 'true' || context.flags.online !== 'true',
-    });
-    const topBroken = firstBrokenCheck(report.checks);
-    const statusPayload = {
-        schemaVersion: 'status.v0.1',
-        generatedAt: report.generatedAt,
-        status: report.summary.status,
-        activeProfile: report.profile.active,
-        auth: {
-            apiKey: resolveApiKey() ? 'configured' : 'missing',
-        },
-        workspace: {
-            tenantId: resolveTenantId() ?? null,
-            baseUrl: resolveModaBaseUrl(),
-            ingestUrl: resolveIngestUrl(),
-        },
-        dataFlow: checkStatus(report.checks, 'cloud_data_flow'),
-        harness: checkStatus(report.checks, 'harness_manifest_current'),
-        harnessSync: checkStatus(report.checks, 'harness_sync_state_present'),
-        harnessReport: checkStatus(report.checks, 'harness_report_approved_synced'),
-        shadowSpark: checkStatus(report.checks, 'shadow_spark_workspace_health'),
-        prompts: checkStatus(report.checks, 'prompts_discovered'),
-        skills: checkStatus(report.checks, 'skills_discovered'),
-        topBrokenCheck: topBroken
-            ? {
-                id: topBroken.id,
-                status: topBroken.status,
-                severity: topBroken.severity,
-                nextCommand: topBroken.nextCommand,
-            }
-            : null,
-        nextCommands: report.nextCommands.slice(0, 3),
-    };
-    if (context.outputMode === 'human') {
-        if (!context.quiet)
-            console.log(renderStatusHuman(statusPayload));
-        return { exitCode: 0 };
-    }
-    context.output.writeData(statusPayload, {
-        status: report.summary.fail > 0 ? 'error' : 'success',
-        ...doctorAgentWriteOptions(report, 'status'),
-    });
-    return { exitCode: 0 };
-}
-export async function buildDoctorReport(context, options) {
-    const checks = [];
-    const profileConfig = loadProfileConfig({ env: context.env });
-    const activeProfile = getActiveProfile({ profile: context.profile, env: context.env });
-    const paths = getModaPaths({ env: context.env });
-    const profileOptions = { profile: context.profile, env: context.env };
-    const apiKey = resolveApiKey(profileOptions);
-    const tenantId = resolveTenantId(profileOptions);
-    const baseUrl = resolveModaBaseUrl(profileOptions);
-    const ingestUrl = resolveIngestUrl(profileOptions);
-    checks.push({
-        id: 'active_profile_resolves',
-        group: 'config',
-        title: 'Active profile resolves',
-        status: activeProfile ? 'pass' : 'fail',
-        severity: activeProfile ? 'info' : 'critical',
-        evidence: [
-            { label: 'active_profile', value: profileConfig.active_profile },
-            { label: 'environment', value: activeProfile.environment },
-        ],
-        remediation: activeProfile ? undefined : 'Create or select a Moda profile.',
-        nextCommand: activeProfile ? undefined : 'moda profiles list',
-    });
-    checks.push({
-        id: 'api_key_resolves',
-        group: 'config',
-        title: 'API key resolves',
-        status: apiKey ? 'pass' : 'fail',
-        severity: apiKey ? 'info' : 'critical',
-        evidence: [{ label: 'source', value: apiKey ? 'environment/profile/config' : 'none' }],
-        remediation: apiKey ? undefined : 'Authenticate and create a tenant API key.',
-        nextCommand: apiKey ? undefined : 'moda init',
-    });
-    checks.push({
-        id: 'tenant_resolves',
-        group: 'config',
-        title: 'Tenant/workspace resolves',
-        status: tenantId ? 'pass' : 'warning',
-        severity: tenantId ? 'info' : 'warning',
-        evidence: [{ label: 'tenant_id', value: tenantId ? 'configured' : 'missing' }],
-        remediation: tenantId ? undefined : 'Select a tenant during init or set MODA_TENANT_ID.',
-        nextCommand: tenantId ? undefined : 'moda init',
-    });
-    checks.push(authTokenCheck(context, Boolean(apiKey)));
-    checks.push(configPermissionCheck(paths.legacyConfigPath));
-    if (activeProfile.api_key_ref) {
-        const secretPath = secretFilePathFromRef(activeProfile.api_key_ref);
-        if (secretPath)
-            checks.push(secretPermissionCheck(secretPath));
-        checks.push({
-            id: 'profile_api_key_ref_resolves',
-            group: 'config',
-            title: 'Profile API key reference resolves',
-            status: resolveSecretReference(activeProfile.api_key_ref) ? 'pass' : 'warning',
-            severity: 'warning',
-            evidence: [{ label: 'api_key_ref', value: activeProfile.api_key_ref }],
-            remediation: 'Create or update the profile API key reference.',
-            nextCommand: 'moda profiles create',
-        });
-    }
-    checks.push(urlCheck('base_url_valid', 'config', 'Base URL is valid', baseUrl));
-    checks.push(urlCheck('ingest_url_valid', 'config', 'Ingest URL is valid', ingestUrl));
-    checks.push(localBaseUrlCheck(activeProfile.environment, baseUrl));
-    const manifestPath = join(context.cwd, '.moda', 'harness.json');
-    const manifestExists = existsSync(manifestPath);
-    checks.push({
-        id: 'harness_manifest_exists',
-        group: 'harness',
-        title: 'Harness manifest exists',
-        status: manifestExists ? 'pass' : 'warning',
-        severity: manifestExists ? 'info' : 'warning',
-        evidence: [{ label: 'path', value: '.moda/harness.json' }],
-        remediation: manifestExists ? undefined : 'Run `moda harness scan --summary` to scan the project and write a harness manifest.',
-        nextCommand: manifestExists ? undefined : 'moda harness scan --summary',
-    });
-    checks.push(harnessCurrentCheck(context.cwd, manifestPath, manifestExists, tenantId));
-    checks.push(harnessSyncStateCheck(context.cwd));
-    checks.push(harnessReportStateCheck(context.cwd));
-    checks.push(discoveryCheck('prompts_discovered', 'harness', 'Prompts are discovered', context.cwd, [
-        'prompts',
-        '.moda/prompts.yml',
-    ], 'moda prompts init'));
-    checks.push(discoveryCheck('skills_discovered', 'harness', 'Skills are discovered', context.cwd, [
-        'skills',
-        '.claude/skills',
-        '.cursor/rules',
-    ], 'moda skills pull'));
-    checks.push(discoveryCheck('evals_discovered', 'harness', 'Evals/tests are discovered', context.cwd, [
-        'evals',
-        'tests',
-        '__tests__',
-    ]));
-    checks.push(sdkInitializationCheck(context.cwd));
-    checks.push(validationEventPathCheck(ingestUrl));
-    if (options.offline || !apiKey) {
-        checks.push(...offlineCloudChecks(options.offline));
-    }
-    else {
-        checks.push(...await cloudDataFlowChecks(ingestUrl, apiKey));
-    }
-    const nextCommands = nextCommandsForChecks(checks);
-    const summary = summarizeChecks(checks);
-    return {
-        schemaVersion: 'doctor.v0.1',
-        generatedAt: new Date().toISOString(),
-        profile: {
-            active: activeProfile.name,
-            requested: context.profile,
-        },
-        summary,
-        checks,
-        nextCommands,
-        fixPlan: checks
-            .filter((check) => check.status === 'fail' || check.status === 'warning')
-            .map((check) => ({
-            checkId: check.id,
-            command: check.nextCommand,
-            action: check.remediation ?? 'Review this diagnostic.',
-        })),
-    };
-}
-function authTokenCheck(context, hasApiKey) {
-    const session = loadAuthSession({
-        profile: context.profile,
-        env: context.env,
-        includeExpired: true,
-    });
-    const valid = isAuthSessionValid(session);
-    if (!valid && hasApiKey) {
-        return {
-            id: 'auth_token_valid',
-            group: 'config',
-            title: 'Browser auth token is valid',
-            status: 'skipped',
-            severity: 'info',
-            evidence: [{ label: 'reason', value: 'api key configured' }],
-        };
-    }
-    return {
-        id: 'auth_token_valid',
-        group: 'config',
-        title: 'Browser auth token is valid',
-        status: valid ? 'pass' : 'warning',
-        severity: valid ? 'info' : 'warning',
-        evidence: [
-            { label: 'token', value: session ? 'present' : 'missing' },
-            ...(session ? [{ label: 'expires_at', value: new Date(session.expires_at * 1000).toISOString() }] : []),
-        ],
-        remediation: valid ? undefined : 'Refresh browser authentication.',
-        nextCommand: valid ? undefined : 'moda init',
-    };
-}
-function configPermissionCheck(path) {
-    if (!existsSync(path)) {
-        return {
-            id: 'config_file_permissions',
-            group: 'config',
-            title: 'Config file permissions',
-            status: 'skipped',
-            severity: 'info',
-            evidence: [{ label: 'path', value: path }],
-        };
-    }
-    const permission = ensureSecretFilePermissions(path);
-    return {
-        id: 'config_file_permissions',
-        group: 'config',
-        title: 'Config file permissions',
-        status: permission.secure ? 'pass' : 'fail',
-        severity: permission.secure ? 'info' : 'critical',
-        evidence: [
-            { label: 'path', value: path },
-            { label: 'mode', value: permission.mode ?? 'unknown' },
-        ],
-        remediation: permission.secure ? undefined : 'Restrict config file permissions to the current user.',
-    };
-}
-function secretPermissionCheck(path) {
-    const permission = ensureSecretFilePermissions(path);
-    return {
-        id: 'secret_file_permissions',
-        group: 'config',
-        title: 'Secret file permissions',
-        status: permission.secure ? 'pass' : 'fail',
-        severity: permission.secure ? 'info' : 'critical',
-        evidence: [
-            { label: 'path', value: path },
-            { label: 'mode', value: permission.mode ?? 'unknown' },
-        ],
-        remediation: permission.secure ? undefined : 'Restrict secret file permissions to the current user.',
-    };
-}
-function urlCheck(id, group, title, value) {
-    let valid = false;
-    try {
-        const parsed = new URL(value);
-        valid = parsed.protocol === 'http:' || parsed.protocol === 'https:';
-    }
-    catch {
-        valid = false;
-    }
-    return {
-        id,
-        group,
-        title,
-        status: valid ? 'pass' : 'fail',
-        severity: valid ? 'info' : 'critical',
-        evidence: [{ label: 'url', value }],
-        remediation: valid ? undefined : 'Configure a valid http(s) URL.',
-        nextCommand: valid ? undefined : 'moda profiles create',
-    };
-}
-/**
- * Local stacks mount `/auth/cli` and `/api/*` CLI/control proxies on the
- * frontend (`:3000` by default). Pointing `base_url` at the backend (`:3001`)
- * breaks browser login even though some Nest routes still answer there.
- */
-function localBaseUrlCheck(environment, baseUrl) {
-    // Only the `local` profile targets a loopback worktree stack. `dev` defaults to
-    // remote `https://moda.dev`, so including it here warns valid remote configs.
-    if (environment !== 'local') {
-        return {
-            id: 'local_base_url_frontend',
-            group: 'config',
-            title: 'Local base URL targets the frontend',
-            status: 'skipped',
-            severity: 'info',
-            evidence: [{ label: 'environment', value: environment }],
-        };
-    }
-    let port = null;
-    let loopback = false;
-    try {
-        const parsed = new URL(baseUrl);
-        loopback = isLoopbackBaseUrl(baseUrl);
-        port = parsed.port || (parsed.protocol === 'https:' ? '443' : '80');
-    }
-    catch {
-        return {
-            id: 'local_base_url_frontend',
-            group: 'config',
-            title: 'Local base URL targets the frontend',
-            status: 'fail',
-            severity: 'critical',
-            evidence: [{ label: 'base_url', value: baseUrl }],
-            remediation: 'Set the local profile base URL to the frontend origin (http://localhost:3000).',
-            nextCommand: 'moda profiles create local --environment local --base-url http://localhost:3000',
-        };
-    }
-    const looksLikeBackend = loopback && (port === '3001' || port === '3002');
-    if (looksLikeBackend) {
-        return {
-            id: 'local_base_url_frontend',
-            group: 'config',
-            title: 'Local base URL targets the frontend',
-            status: 'warning',
-            severity: 'warning',
-            evidence: [
-                { label: 'base_url', value: baseUrl },
-                { label: 'port', value: port ?? 'unknown' },
-            ],
-            remediation: 'Local CLI auth and control APIs are served by the frontend. ' +
-                'Use http://localhost:3000 (or your worktree frontend port), not the backend :3001.',
-            nextCommand: 'moda profiles create local --environment local --base-url http://localhost:3000 --use',
-        };
-    }
-    if (!loopback) {
-        return {
-            id: 'local_base_url_frontend',
-            group: 'config',
-            title: 'Local base URL targets the frontend',
-            status: 'warning',
-            severity: 'warning',
-            evidence: [{ label: 'base_url', value: baseUrl }],
-            remediation: 'Local profile should use a loopback frontend URL (http://localhost:3000). ' +
-                'Activate with `moda profiles use local` or set MODA_PROFILE=local.',
-            nextCommand: 'moda profiles use local',
-        };
-    }
-    return {
-        id: 'local_base_url_frontend',
-        group: 'config',
-        title: 'Local base URL targets the frontend',
-        status: 'pass',
-        severity: 'info',
-        evidence: [{ label: 'base_url', value: baseUrl }],
-    };
-}
-function harnessCurrentCheck(cwd, manifestPath, manifestExists, tenantId) {
-    if (!manifestExists) {
-        return {
-            id: 'harness_manifest_current',
-            group: 'harness',
-            title: 'Harness manifest matches scanner output',
-            status: 'skipped',
-            severity: 'info',
-            evidence: [{ label: 'reason', value: 'manifest missing' }],
-            nextCommand: 'moda harness scan --summary',
-        };
-    }
-    try {
-        const current = scanHarness({
-            rootDir: cwd,
-            scannerVersion: 'doctor',
-            tenantId,
-            tenantSource: tenantId ? 'env_or_config' : undefined,
-        });
-        const saved = JSON.parse(readFileSync(manifestPath, 'utf8'));
-        const savedHash = stableGraphHash(saved);
-        const currentHash = stableGraphHash(current);
-        const matches = savedHash === currentHash;
-        return {
-            id: 'harness_manifest_current',
-            group: 'harness',
-            title: 'Harness manifest matches scanner output',
-            status: matches ? 'pass' : 'warning',
-            severity: matches ? 'info' : 'warning',
-            evidence: [
-                { label: 'saved_hash', value: savedHash.slice(0, 12) },
-                { label: 'current_hash', value: currentHash.slice(0, 12) },
-                ...(matches ? [] : [{ label: 'diff', value: 'Manifest hash differs from fresh scanner output.' }]),
-            ],
-            remediation: matches ? undefined : 'Refresh the local harness manifest.',
-            nextCommand: matches ? undefined : 'moda harness scan --summary',
-        };
-    }
-    catch (err) {
-        return {
-            id: 'harness_manifest_current',
-            group: 'harness',
-            title: 'Harness manifest matches scanner output',
-            status: 'fail',
-            severity: 'critical',
-            evidence: [{ label: 'error', value: err instanceof Error ? err.message : String(err) }],
-            remediation: 'Regenerate the harness manifest.',
-            nextCommand: 'moda harness scan --summary',
-        };
-    }
-}
-function harnessSyncStateCheck(cwd) {
-    const state = readHarnessSyncState(cwd);
-    if (!state) {
-        return {
-            id: 'harness_sync_state_present',
-            group: 'harness',
-            title: 'Harness sync state exists',
-            status: 'warning',
-            severity: 'warning',
-            evidence: [{ label: 'path', value: '.moda/sync-state.json' }],
-            remediation: 'Sync the harness graph so Moda can correlate local state with cloud state.',
-            nextCommand: 'moda harness sync --dry-run',
-        };
-    }
-    return {
-        id: 'harness_sync_state_present',
-        group: 'harness',
-        title: 'Harness sync state exists',
-        status: 'pass',
-        severity: 'info',
-        evidence: [
-            { label: 'updated_at', value: state.updatedAt },
-            { label: 'profile', value: state.profile },
-            { label: 'harness_id', value: state.harnessId },
-            { label: 'remote_version_id', value: state.remote.versionId || 'none' },
-        ],
-    };
-}
-function harnessReportStateCheck(cwd) {
-    const reportPath = join(cwd, HARNESS_REPORT_PATH);
-    if (!existsSync(reportPath)) {
-        return {
-            id: 'harness_report_approved_synced',
-            group: 'harness',
-            title: 'Harness analyst report is approved and synced',
-            status: 'warning',
-            severity: 'warning',
-            evidence: [{ label: 'path', value: HARNESS_REPORT_PATH }],
-            remediation: 'Run a Moda Analyst pass so the harness graph has cited evidence before cloud sync.',
-            nextCommand: 'moda harness analyze --summary',
-        };
-    }
-    try {
-        const report = readHarnessReport(reportPath);
-        const validation = validateHarnessReport(report, cwd);
-        const reportHash = hashHarnessReport(report);
-        const evidence = [
-            { label: 'path', value: HARNESS_REPORT_PATH },
-            { label: 'report_hash', value: reportHash.slice(0, 12) },
-            { label: 'validation', value: validation.status },
-        ];
-        if (validation.status !== 'pass') {
-            return {
-                id: 'harness_report_approved_synced',
-                group: 'harness',
-                title: 'Harness analyst report is approved and synced',
-                status: 'fail',
-                severity: 'critical',
-                evidence: [
-                    ...evidence,
-                    { label: 'errors', value: validation.errors.slice(0, 3).join(' | ') || 'validation failed' },
-                ],
-                remediation: 'Regenerate or fix the harness report before approving or syncing.',
-                nextCommand: 'moda harness analyze --summary',
-            };
-        }
-        const approval = readHarnessReportApproval(cwd);
-        const approved = approval?.schemaVersion === HARNESS_REPORT_APPROVAL_SCHEMA_VERSION &&
-            approval.reportId === report.reportId &&
-            approval.reportHash === reportHash &&
-            approval.approved === true;
-        evidence.push({ label: 'approval', value: approved ? 'approved' : approval ? 'stale_or_invalid' : 'missing' });
-        if (approval && !approved) {
-            return {
-                id: 'harness_report_approved_synced',
-                group: 'harness',
-                title: 'Harness analyst report is approved and synced',
-                status: 'fail',
-                severity: 'critical',
-                evidence,
-                remediation: 'Approval no longer matches the current report. Review and approve the report again.',
-                nextCommand: 'moda harness approve --yes',
-            };
-        }
-        if (!approved) {
-            return {
-                id: 'harness_report_approved_synced',
-                group: 'harness',
-                title: 'Harness analyst report is approved and synced',
-                status: 'warning',
-                severity: 'warning',
-                evidence,
-                remediation: 'Review and approve the validated harness report before syncing.',
-                nextCommand: 'moda harness approve --yes',
-            };
-        }
-        const state = readHarnessSyncState(cwd);
-        const synced = state?.source === 'approved_report' && state.report?.reportHash === reportHash;
-        evidence.push({ label: 'sync', value: synced ? 'synced' : 'not_synced_to_this_report' }, ...(state?.report?.reportHash ? [{ label: 'sync_report_hash', value: state.report.reportHash.slice(0, 12) }] : []));
-        return {
-            id: 'harness_report_approved_synced',
-            group: 'harness',
-            title: 'Harness analyst report is approved and synced',
-            status: synced ? 'pass' : 'warning',
-            severity: synced ? 'info' : 'warning',
-            evidence,
-            remediation: synced ? undefined : 'Sync the approved harness report so Moda cloud has the same harness graph.',
-            nextCommand: synced ? undefined : 'moda harness sync --from-report .moda/harness-report.json',
-        };
-    }
-    catch (err) {
-        return {
-            id: 'harness_report_approved_synced',
-            group: 'harness',
-            title: 'Harness analyst report is approved and synced',
-            status: 'fail',
-            severity: 'critical',
-            evidence: [
-                { label: 'path', value: HARNESS_REPORT_PATH },
-                { label: 'error', value: err instanceof Error ? err.message : String(err) },
-            ],
-            remediation: 'Regenerate the harness report.',
-            nextCommand: 'moda harness analyze --summary',
-        };
-    }
-}
-function readHarnessReportApproval(cwd) {
-    const approvalPath = join(cwd, HARNESS_REPORT_APPROVAL_PATH);
-    if (!existsSync(approvalPath))
-        return null;
-    try {
-        return JSON.parse(readFileSync(approvalPath, 'utf8'));
-    }
-    catch {
-        return {
-            schemaVersion: HARNESS_REPORT_APPROVAL_SCHEMA_VERSION,
-            reportId: 'unreadable',
-            reportHash: 'unreadable',
-            approved: true,
-            approvedAt: '',
-            approvedBy: 'local-human',
-            reportPath: HARNESS_REPORT_PATH,
-        };
-    }
-}
-function discoveryCheck(id, group, title, cwd, relativePaths, nextCommand) {
-    const found = relativePaths.filter((path) => existsSync(join(cwd, path)));
-    return {
-        id,
-        group,
-        title,
-        status: found.length > 0 ? 'pass' : 'warning',
-        severity: found.length > 0 ? 'info' : 'warning',
-        evidence: [{ label: 'paths', value: found.length > 0 ? found.join(', ') : 'none' }],
-        remediation: found.length > 0 ? undefined : `Expected one of: ${relativePaths.join(', ')}.`,
-        nextCommand: found.length > 0 ? undefined : nextCommand,
-    };
-}
-function sdkInitializationCheck(cwd) {
-    const candidates = ['src', 'app', 'agent_harness'];
-    let detected = false;
-    for (const candidate of candidates) {
-        const path = join(cwd, candidate);
-        if (!existsSync(path))
-            continue;
-        try {
-            const stat = statSync(path);
-            detected ||= stat.isDirectory() || stat.isFile();
-        }
-        catch {
-            // Ignore unreadable candidate paths; doctor reports higher-level gaps.
-        }
-    }
-    return {
-        id: 'sdk_initialization_detected',
-        group: 'harness',
-        title: 'SDK initialization is detectable',
-        status: detected ? 'warning' : 'skipped',
-        severity: 'warning',
-        evidence: [{ label: 'status', value: detected ? 'code present, instrumentation not verified' : 'no source candidates' }],
-        remediation: 'Use the generated integration guide to add Moda SDK instrumentation.',
-        nextCommand: 'moda init',
-    };
-}
-// Unused while coding-agent capture is disabled; kept for re-enablement.
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-function shadowSparkWorkspaceCheck(cwd, env) {
-    const repo = detectGitRepo(cwd);
-    if (!repo) {
-        return {
-            id: 'shadow_spark_workspace_health',
-            group: 'spark',
-            title: 'Shadow Spark workspace health',
-            status: 'skipped',
-            severity: 'info',
-            evidence: [{ label: 'reason', value: 'not inside a git repository' }],
-        };
-    }
-    const workspaceId = createHash('sha256')
-        .update(`${repo.toplevel}:${repo.originUrl || ''}`)
-        .digest('hex')
-        .slice(0, 16);
-    const path = join(getModaPaths({ env }).home, '.moda', 'workspaces', workspaceId);
-    const healthy = existsSync(join(path, '.git'));
-    return {
-        id: 'shadow_spark_workspace_health',
-        group: 'spark',
-        title: 'Shadow Spark workspace health',
-        status: healthy ? 'pass' : 'warning',
-        severity: healthy ? 'info' : 'warning',
-        evidence: [
-            { label: 'workspace_id', value: workspaceId },
-            { label: 'path', value: path },
-            { label: 'shadow_git', value: healthy ? 'present' : 'missing' },
-        ],
-        remediation: healthy ? undefined : 'Create a Shadow Spark snapshot.',
-        nextCommand: healthy ? undefined : 'moda spark snapshot --json',
-    };
-}
-// Unused while coding-agent capture is disabled; kept for re-enablement.
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-function hookCheck(env) {
-    const paths = getModaPaths({ env });
-    const hookCandidates = [
-        join(paths.home, '.claude', 'hooks', 'moda-snapshot.sh'),
-        join(paths.home, '.codex', 'hooks.json'),
-        join(paths.home, '.cursor', 'hooks.json'),
-    ];
-    const found = hookCandidates.filter((path) => existsSync(path));
-    return {
-        id: 'hooks_installed',
-        group: 'hooks',
-        title: 'Coding-agent hooks installed',
-        status: found.length > 0 ? 'pass' : 'warning',
-        severity: found.length > 0 ? 'info' : 'warning',
-        evidence: [{ label: 'installed', value: found.length > 0 ? String(found.length) : 'none' }],
-        remediation: found.length > 0 ? undefined : 'Install coding-agent trace hooks.',
-        nextCommand: found.length > 0 ? undefined : 'moda hooks install --agent=all',
-    };
-}
-// Unused while coding-agent capture is disabled; kept for re-enablement.
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-function hookTelemetryChecks(env, ingestUrl) {
-    const configs = agentTelemetryConfigs(env);
-    return [
-        hookFilesExecutableCheck(env),
-        agentConfigJsonCheck(configs),
-        agentConfigApiKeyCheck(configs),
-        otlpEndpointCheck(configs, ingestUrl),
-        agentConfigApiKeyStorageCheck(configs),
-    ];
-}
-function agentTelemetryConfigs(env) {
-    const paths = getModaPaths({ env });
-    const configs = [
-        {
-            agent: 'claude',
-            title: 'Claude Code',
-            path: join(paths.home, '.claude', 'settings.json'),
-            providerPath: 'claude',
-            providerAttribute: 'claude_code',
-        },
-        {
-            agent: 'codex',
-            title: 'Codex',
-            path: join(paths.home, '.codex', 'hooks.json'),
-            providerPath: 'codex',
-            providerAttribute: 'codex',
-        },
-        {
-            agent: 'cursor',
-            title: 'Cursor',
-            path: join(paths.home, '.cursor', 'hooks.json'),
-            providerPath: 'cursor',
-            providerAttribute: 'cursor',
-        },
-    ];
-    return configs.map((config) => {
-        if (!existsSync(config.path))
-            return { ...config, exists: false };
-        try {
-            const parsed = JSON.parse(readFileSync(config.path, 'utf8'));
-            if (!isRecord(parsed)) {
-                return { ...config, exists: true, error: 'JSON root is not an object.' };
-            }
-            return { ...config, exists: true, parsed };
-        }
-        catch (err) {
-            return {
-                ...config,
-                exists: true,
-                error: err instanceof Error ? err.message : String(err),
-            };
-        }
-    });
-}
-function hookFilesExecutableCheck(env) {
-    const paths = getModaPaths({ env });
-    const candidates = [
-        join(paths.home, '.claude', 'hooks', 'moda-snapshot.sh'),
-        join(paths.home, '.moda', 'hooks', 'moda-snapshot.sh'),
-    ];
-    const found = candidates.filter((path) => existsSync(path));
-    const notExecutable = found.filter((path) => {
-        try {
-            return (statSync(path).mode & 0o111) === 0;
-        }
-        catch {
-            return true;
-        }
-    });
-    return {
-        id: 'hook_files_executable',
-        group: 'hooks',
-        title: 'Hook files are executable',
-        status: found.length === 0 ? 'skipped' : notExecutable.length === 0 ? 'pass' : 'fail',
-        severity: notExecutable.length === 0 ? 'info' : 'critical',
-        evidence: [
-            { label: 'found', value: found.length > 0 ? found.map(relativeHomePath(paths.home)).join(', ') : 'none' },
-            ...(notExecutable.length > 0
-                ? [{ label: 'not_executable', value: notExecutable.map(relativeHomePath(paths.home)).join(', ') }]
-                : []),
-        ],
-        remediation: notExecutable.length > 0 ? 'Reinstall hooks so Moda can set executable permissions.' : undefined,
-        nextCommand: notExecutable.length > 0 || found.length === 0 ? 'moda hooks install --agent=all' : undefined,
-    };
-}
-function agentConfigJsonCheck(configs) {
-    const existing = configs.filter((config) => config.exists);
-    const invalid = existing.filter((config) => config.error);
-    return {
-        id: 'agent_config_json_valid',
-        group: 'hooks',
-        title: 'Agent config JSON is valid',
-        status: existing.length === 0 ? 'skipped' : invalid.length === 0 ? 'pass' : 'fail',
-        severity: invalid.length === 0 ? 'info' : 'critical',
-        evidence: [
-            { label: 'configs', value: existing.length > 0 ? existing.map((config) => config.agent).join(', ') : 'none' },
-            ...(invalid.length > 0
-                ? invalid.map((config) => ({ label: `${config.agent}_error`, value: config.error ?? 'invalid JSON' }))
-                : []),
-        ],
-        remediation: invalid.length > 0 ? 'Fix invalid agent hook config JSON.' : undefined,
-        nextCommand: invalid.length > 0 ? 'moda hooks install --agent=all' : undefined,
-    };
-}
-function agentConfigApiKeyCheck(configs) {
-    const parsed = configs.filter((config) => config.parsed);
-    const missing = parsed.filter((config) => !telemetryHeader(config).replace(/^Authorization=Bearer\s*/, '').trim());
-    return {
-        id: 'agent_config_api_key_resolves',
-        group: 'hooks',
-        title: 'API key exists in agent telemetry config',
-        status: parsed.length === 0 ? 'skipped' : missing.length === 0 ? 'pass' : 'warning',
-        severity: missing.length === 0 ? 'info' : 'warning',
-        evidence: [
-            { label: 'configs', value: parsed.length > 0 ? parsed.map((config) => config.agent).join(', ') : 'none' },
-            ...(missing.length > 0 ? [{ label: 'missing_or_empty', value: missing.map((config) => config.agent).join(', ') }] : []),
-        ],
-        remediation: missing.length > 0 ? 'Reinstall hooks after authenticating so telemetry has an API key.' : undefined,
-        nextCommand: missing.length > 0 ? 'moda hooks install --agent=all' : undefined,
-    };
-}
-function otlpEndpointCheck(configs, ingestUrl) {
-    const parsed = configs.filter((config) => config.parsed);
-    const expectedBase = ingestUrl.replace(/\/+$/, '');
-    const mismatches = [];
-    for (const config of parsed) {
-        const env = telemetryEnv(config);
-        const expected = {
-            OTEL_EXPORTER_OTLP_LOGS_ENDPOINT: `${expectedBase}/v1/otel/${config.providerPath}/logs`,
-            OTEL_EXPORTER_OTLP_METRICS_ENDPOINT: `${expectedBase}/v1/otel/${config.providerPath}/metrics`,
-            OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: `${expectedBase}/v1/otel/${config.providerPath}/traces`,
-        };
-        for (const [key, value] of Object.entries(expected)) {
-            if (env[key] !== value)
-                mismatches.push(`${config.agent}:${key}`);
-        }
-        const attrs = String(env.OTEL_RESOURCE_ATTRIBUTES ?? '');
-        if (!attrs.split(',').some((item) => item.trim() === `provider=${config.providerAttribute}`)) {
-            mismatches.push(`${config.agent}:OTEL_RESOURCE_ATTRIBUTES`);
-        }
-    }
-    return {
-        id: 'otlp_endpoints_match_profile',
-        group: 'hooks',
-        title: 'OTLP endpoints match active ingest URL',
-        status: parsed.length === 0 ? 'skipped' : mismatches.length === 0 ? 'pass' : 'warning',
-        severity: mismatches.length === 0 ? 'info' : 'warning',
-        evidence: [
-            { label: 'ingest_url', value: expectedBase },
-            { label: 'configs', value: parsed.length > 0 ? parsed.map((config) => config.agent).join(', ') : 'none' },
-            ...(mismatches.length > 0 ? [{ label: 'mismatches', value: mismatches.slice(0, 8).join(', ') }] : []),
-        ],
-        remediation: mismatches.length > 0 ? 'Reinstall hooks so agent telemetry points at the active Moda ingest URL.' : undefined,
-        nextCommand: mismatches.length > 0 ? 'moda hooks install --agent=all' : undefined,
-    };
-}
-function agentConfigApiKeyStorageCheck(configs) {
-    const withStoredKey = configs
-        .filter((config) => config.parsed)
-        .filter((config) => telemetryHeader(config).replace(/^Authorization=Bearer\s*/, '').trim().length > 0);
-    return {
-        id: 'agent_config_api_key_storage',
-        group: 'hooks',
-        title: 'API key storage in agent config',
-        status: withStoredKey.length > 0 ? 'warning' : 'pass',
-        severity: withStoredKey.length > 0 ? 'warning' : 'info',
-        evidence: [{ label: 'configs_with_key', value: withStoredKey.length > 0 ? withStoredKey.map((config) => config.agent).join(', ') : 'none' }],
-        remediation: withStoredKey.length > 0
-            ? 'Agent configs contain OTLP auth headers; ensure file permissions are restricted and rotate keys if exposed.'
-            : undefined,
-    };
-}
-function validationEventPathCheck(ingestUrl) {
-    return {
-        id: 'validation_event_path_defined',
-        group: 'cloud',
-        title: 'Validation event path is defined',
-        status: 'pass',
-        severity: 'info',
-        evidence: [{ label: 'path', value: `${ingestUrl.replace(/\/+$/, '')}/v1/otel/validation` }],
-    };
-}
-function telemetryEnv(config) {
-    return isRecord(config.parsed?.env) ? config.parsed.env : {};
-}
-function telemetryHeader(config) {
-    const env = telemetryEnv(config);
-    return typeof env.OTEL_EXPORTER_OTLP_HEADERS === 'string'
-        ? env.OTEL_EXPORTER_OTLP_HEADERS
-        : '';
-}
-function relativeHomePath(home) {
-    return (path) => path.startsWith(home) ? `~/${path.slice(home.length).replace(/^\/+/, '')}` : path;
-}
-function offlineCloudChecks(isOffline) {
-    const status = isOffline ? 'skipped' : 'warning';
-    const evidence = [{ label: 'mode', value: isOffline ? 'offline' : 'missing api key' }];
-    const remediation = isOffline
-        ? 'Rerun without --offline to check Moda Cloud.'
-        : 'Configure an API key before checking cloud data flow.';
-    const nextCommand = isOffline ? 'moda doctor --online' : 'moda init';
-    return [
-        {
-            id: 'cloud_api_reachable',
-            group: 'cloud',
-            title: 'Moda Cloud API is reachable',
-            status,
-            severity: 'warning',
-            evidence,
-            remediation,
-            nextCommand,
-        },
-        {
-            id: 'ingest_endpoint_reachable',
-            group: 'cloud',
-            title: 'Moda ingest endpoint is reachable',
-            status,
-            severity: 'warning',
-            evidence,
-            remediation,
-            nextCommand,
-        },
-        {
-            id: 'recent_data_flow',
-            group: 'cloud',
-            title: 'Recent traces/logs/runs exist',
-            status,
-            severity: 'warning',
-            evidence,
-            remediation,
-            nextCommand,
-        },
-        {
-            id: 'cloud_data_flow',
-            group: 'cloud',
-            title: 'Moda Cloud data flow',
-            status,
-            severity: 'warning',
-            evidence,
-            remediation,
-            nextCommand,
-        },
-    ];
-}
-async function cloudDataFlowChecks(ingestUrl, apiKey) {
-    let overview;
-    let cloudApiCheck;
-    try {
-        overview = await callDataAPI('/overview?days_back=1');
-        cloudApiCheck = {
-            id: 'cloud_api_reachable',
-            group: 'cloud',
-            title: 'Moda Cloud API is reachable',
-            status: 'pass',
-            severity: 'info',
-            evidence: [{ label: 'overview', value: 'reachable' }],
-        };
-    }
-    catch (err) {
-        const error = err instanceof Error ? err.message : String(err);
-        return [
-            {
-                id: 'cloud_api_reachable',
-                group: 'cloud',
-                title: 'Moda Cloud API is reachable',
-                status: 'warning',
-                severity: 'warning',
-                evidence: [{ label: 'error', value: error }],
-                remediation: 'Check API key and base URL.',
-                nextCommand: 'moda doctor --offline',
-            },
-            {
-                id: 'ingest_endpoint_reachable',
-                group: 'cloud',
-                title: 'Moda ingest endpoint is reachable',
-                status: 'skipped',
-                severity: 'warning',
-                evidence: [{ label: 'reason', value: 'cloud API unreachable' }],
-            },
-            {
-                id: 'recent_data_flow',
-                group: 'cloud',
-                title: 'Recent traces/logs/runs exist',
-                status: 'skipped',
-                severity: 'warning',
-                evidence: [{ label: 'reason', value: 'overview unavailable' }],
-            },
-            {
-                id: 'cloud_data_flow',
-                group: 'cloud',
-                title: 'Moda Cloud data flow',
-                status: 'warning',
-                severity: 'warning',
-                evidence: [{ label: 'error', value: error }],
-                remediation: 'Check API key, base URL, and whether data has reached Moda.',
-                nextCommand: 'moda doctor --offline',
-            },
-        ];
-    }
-    const ingestCheck = await ingestReachabilityCheck(ingestUrl, apiKey);
-    const recentCheck = recentDataFlowCheck(overview);
-    const cloudStatus = cloudApiCheck.status === 'pass' &&
-        ingestCheck.status === 'pass' &&
-        recentCheck.status === 'pass'
-        ? 'pass'
-        : 'warning';
-    return [
-        cloudApiCheck,
-        ingestCheck,
-        recentCheck,
-        {
-            id: 'cloud_data_flow',
-            group: 'cloud',
-            title: 'Moda Cloud data flow',
-            status: cloudStatus,
-            severity: cloudStatus === 'pass' ? 'info' : 'warning',
-            evidence: [
-                { label: 'cloud_api', value: cloudApiCheck.status },
-                { label: 'ingest', value: ingestCheck.status },
-                { label: 'recent_data', value: recentCheck.status },
-            ],
-            remediation: cloudStatus === 'pass' ? undefined : 'Check API key, ingest URL, and whether data has reached Moda.',
-            nextCommand: cloudStatus === 'pass' ? undefined : 'moda doctor --offline',
-        },
-    ];
-}
-async function ingestReachabilityCheck(ingestUrl, apiKey) {
-    const url = `${ingestUrl.replace(/\/+$/, '')}/`;
-    try {
-        const response = await fetch(url, {
-            method: 'GET',
-            headers: { Authorization: `Bearer ${apiKey}` },
-            signal: AbortSignal.timeout(10_000),
-        });
-        return {
-            id: 'ingest_endpoint_reachable',
-            group: 'cloud',
-            title: 'Moda ingest endpoint is reachable',
-            status: 'pass',
-            severity: 'info',
-            evidence: [
-                { label: 'url', value: url },
-                { label: 'http_status', value: String(response.status) },
-            ],
-        };
-    }
-    catch (err) {
-        return {
-            id: 'ingest_endpoint_reachable',
-            group: 'cloud',
-            title: 'Moda ingest endpoint is reachable',
-            status: 'warning',
-            severity: 'warning',
-            evidence: [{ label: 'error', value: err instanceof Error ? err.message : String(err) }],
-            remediation: 'Check the configured ingest URL and network reachability.',
-            nextCommand: 'moda profiles create',
-        };
-    }
-}
-function recentDataFlowCheck(overview) {
-    const data = isRecord(overview) ? overview : {};
-    const conversations = numberAt(data, ['conversations', 'total']);
-    const toolFailures = numberAt(data, ['tool_failures', 'total']);
-    const recentActivity = Array.isArray(data.recent_activity) ? data.recent_activity : [];
-    const lastEventAt = lastActivityTimestamp(recentActivity);
-    const hasData = conversations > 0 || toolFailures > 0 || Boolean(lastEventAt);
-    return {
-        id: 'recent_data_flow',
-        group: 'cloud',
-        title: 'Recent traces/logs/runs exist',
-        status: hasData ? 'pass' : 'warning',
-        severity: hasData ? 'info' : 'warning',
-        evidence: [
-            { label: 'conversations', value: String(conversations) },
-            { label: 'tool_failures', value: String(toolFailures) },
-            { label: 'last_event_at', value: lastEventAt ?? 'none' },
-        ],
-        remediation: hasData ? undefined : 'No recent Moda data was visible in the overview window.',
-        nextCommand: hasData ? undefined : 'moda hooks install --agent=all',
-    };
-}
-function numberAt(value, path) {
-    let cursor = value;
-    for (const key of path) {
-        if (!isRecord(cursor))
-            return 0;
-        cursor = cursor[key];
-    }
-    return typeof cursor === 'number' && Number.isFinite(cursor) ? cursor : 0;
-}
-function lastActivityTimestamp(items) {
-    const timestamps = items
-        .map((item) => isRecord(item) && typeof item.timestamp === 'string' ? item.timestamp : undefined)
-        .filter((item) => Boolean(item))
-        .sort();
-    return timestamps.at(-1);
-}
-function summarizeChecks(checks) {
-    const fail = checks.filter((check) => check.status === 'fail').length;
-    const warning = checks.filter((check) => check.status === 'warning').length;
-    const skipped = checks.filter((check) => check.status === 'skipped').length;
-    const pass = checks.filter((check) => check.status === 'pass').length;
-    return {
-        status: fail > 0 ? 'fail' : warning > 0 ? 'warning' : 'pass',
-        pass,
-        warning,
-        fail,
-        skipped,
-    };
-}
-function nextCommandsForChecks(checks) {
-    return [...new Set(checks
-            .filter((check) => check.status === 'fail' || check.status === 'warning')
-            .map((check) => check.nextCommand)
-            .filter((command) => Boolean(command)))];
-}
-function firstBrokenCheck(checks) {
-    return checks.find((check) => check.status === 'fail') ??
-        checks.find((check) => check.status === 'warning');
-}
-function checkStatus(checks, id) {
-    return checks.find((check) => check.id === id)?.status ?? 'skipped';
-}
-function doctorAgentWriteOptions(report, command) {
-    const broken = report.checks.filter((check) => check.status === 'fail' || check.status === 'warning');
-    return {
-        summary: `${command} completed with status ${report.summary.status}: ${report.summary.fail} failing checks and ${report.summary.warning} warnings.`,
-        findings: broken.slice(0, 16).map((check) => ({
-            id: check.id,
-            title: check.title,
-            status: check.status,
-            severity: check.severity,
-            description: check.remediation ?? `Doctor check ${check.id} is ${check.status}.`,
-            evidence_ref_ids: [`doctor:${check.id}`],
-        })),
-        evidenceRefs: report.checks.map((check) => ({
-            id: `doctor:${check.id}`,
-            kind: 'doctor_check',
-            label: check.title,
-            status: check.status,
-        })),
-        recommendedActions: report.fixPlan.slice(0, 16).map((item, index) => ({
-            id: `doctor_action_${index + 1}_${item.checkId}`,
-            title: item.action,
-            command: item.command,
-            rationale: `Doctor check ${item.checkId} is not passing.`,
-            mutability: item.command ? agentMutabilityForCommand(item.command) : 'unknown',
-            requires_approval: item.command ? agentCommandRequiresApproval(item.command) : true,
-        })),
-        nextCommands: report.nextCommands.slice(0, 16).map((nextCommand) => ({
-            command: nextCommand,
-            purpose: agentPurposeForCommand(nextCommand),
-            mutability: agentMutabilityForCommand(nextCommand),
-            requires_approval: agentCommandRequiresApproval(nextCommand),
-        })),
-        warnings: broken
-            .filter((check) => check.status === 'warning')
-            .slice(0, 16)
-            .map((check) => `${check.title}: ${check.remediation ?? check.status}`),
-    };
-}
-function agentMutabilityForCommand(command) {
-    if (/\bsync\b/.test(command))
-        return 'sync';
-    if (/\b(init|install|approve|pull|gen|promote|remove)\b/.test(command))
-        return 'write';
-    return 'read';
-}
-function agentCommandRequiresApproval(command) {
-    return agentMutabilityForCommand(command) !== 'read' && !command.includes('--dry-run');
-}
-function agentPurposeForCommand(command) {
-    if (command.includes('doctor'))
-        return 'Re-run Moda diagnostics.';
-    if (command.includes('harness approve'))
-        return 'Approve the validated harness report after review.';
-    if (command.includes('harness sync'))
-        return 'Sync harness state to Moda Cloud.';
-    if (command.includes('harness scan'))
-        return 'Refresh the local harness manifest.';
-    if (command.includes('init'))
-        return 'Run Moda onboarding.';
-    return 'Inspect or repair Moda setup.';
-}
-function detectGitRepo(cwd) {
-    const toplevel = spawnSync('git', ['rev-parse', '--show-toplevel'], {
-        cwd,
-        encoding: 'utf8',
-    });
-    if (toplevel.status !== 0 || !toplevel.stdout.trim())
-        return undefined;
-    const root = toplevel.stdout.trim();
-    const origin = spawnSync('git', ['config', '--get', 'remote.origin.url'], {
-        cwd: root,
-        encoding: 'utf8',
-    });
-    return {
-        toplevel: root,
-        originUrl: origin.status === 0 ? origin.stdout.trim() : '',
-    };
-}
-function stableGraphHash(graph) {
-    return createHash('sha256')
-        .update(JSON.stringify(sortJson({
-        ...graph,
-        scan: {
-            ...graph.scan,
-            createdAt: undefined,
-            scannerVersion: undefined,
-            skipped: undefined,
-        },
-    })))
-        .digest('hex');
-}
-function sortJson(value) {
-    if (Array.isArray(value))
-        return value.map((item) => sortJson(item));
-    if (value && typeof value === 'object') {
-        return Object.fromEntries(Object.entries(value)
-            .filter(([, item]) => item !== undefined)
-            .sort(([a], [b]) => a.localeCompare(b))
-            .map(([key, item]) => [key, sortJson(item)]));
-    }
-    return value;
-}
-function isRecord(value) {
-    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
-}
-//# sourceMappingURL=doctor.js.map