@moxt-ai/mobius 0.0.369 → 0.0.370

package/dist/{cli-5UCO7ZEY.js → cli-EY6WXGHE.js}

@@ -1,6 +1,6 @@
 import {
   require_semver
-} from "./chunk-PG7W3R2P.js";
+} from "./chunk-AF2SHMNS.js";
 import {
   BoundedLineLog,
   MissingAdapter,
@@ -17,6 +17,7 @@ import {
   canonicalPath,
   decodeIdentifier,
   decodeRuntimeUpgradeVersion,
+  describeRelayFailure,
   discoverLocalAgentInventory,
   ensurePrivateDirectory,
   external_exports,
@@ -35,13 +36,13 @@ import {
   unhandledRejectionLogFilename,
   validateLocalPath,
   validatePairingId
-} from "./chunk-3GFBCVGZ.js";
+} from "./chunk-JYM22ZR6.js";
 import {
   __callDispose,
   __toESM,
   __using,
   package_default
-} from "./chunk-2RHEJMMU.js";
+} from "./chunk-F4ISBXGU.js";
 
 // ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -1343,9 +1344,9 @@ var Command = class _Command extends EventEmitter {
    * @param {object} [configuration] - configuration options
    * @return {(Command | object)} `this` command for chaining, or stored configuration
    */
-  configureHelp(configuration) {
-    if (configuration === void 0) return this._helpConfiguration;
-    this._helpConfiguration = configuration;
+  configureHelp(configuration2) {
+    if (configuration2 === void 0) return this._helpConfiguration;
+    this._helpConfiguration = configuration2;
     return this;
   }
   /**
@@ -1370,11 +1371,11 @@ var Command = class _Command extends EventEmitter {
    * @param {object} [configuration] - configuration options
    * @return {(Command | object)} `this` command for chaining, or stored configuration
    */
-  configureOutput(configuration) {
-    if (configuration === void 0) return this._outputConfiguration;
+  configureOutput(configuration2) {
+    if (configuration2 === void 0) return this._outputConfiguration;
     this._outputConfiguration = {
       ...this._outputConfiguration,
-      ...configuration
+      ...configuration2
     };
     return this;
   }
@@ -3984,7 +3985,7 @@ function controlSocketPath(stateDirectory, endpoint = "manager") {
 }
 async function readSocketMessage(socket, signal) {
   signal.throwIfAborted();
-  return await new Promise((resolve5, reject) => {
+  return await new Promise((resolve6, reject) => {
     let encoded = "";
     const finish = (error, value) => {
       signal.removeEventListener("abort", abort);
@@ -3992,7 +3993,7 @@ async function readSocketMessage(socket, signal) {
       socket.removeAllListeners("error");
       socket.removeAllListeners("end");
       if (error === void 0) {
-        resolve5(value);
+        resolve6(value);
       } else {
         reject(error);
       }
@@ -4028,14 +4029,14 @@ async function sendLocalRequest(stateDirectory, endpoint, command, signal) {
   deadline.throwIfAborted();
   const socket = createConnection(controlSocketPath(stateDirectory, endpoint));
   try {
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve6, reject) => {
       const abort = () => {
         socket.destroy();
         reject(deadline.reason);
       };
       socket.once("connect", () => {
         deadline.removeEventListener("abort", abort);
-        resolve5();
+        resolve6();
       });
       socket.once("error", reject);
       deadline.addEventListener("abort", abort, { once: true });
@@ -4089,21 +4090,21 @@ async function serveLocalControl(stateDirectory, endpoint, signal, handle, onLis
   });
   try {
     await platform.prepareControlSocket(path2);
-    await new Promise((resolve5, reject) => {
-      server.once("listening", resolve5);
+    await new Promise((resolve6, reject) => {
+      server.once("listening", resolve6);
       server.once("error", reject);
       server.listen(path2);
     });
     await platform.secureControlSocket(path2);
     await onListening();
     if (!signal.aborted) {
-      await new Promise((resolve5) => signal.addEventListener("abort", () => resolve5(), { once: true }));
+      await new Promise((resolve6) => signal.addEventListener("abort", () => resolve6(), { once: true }));
     }
   } finally {
     for (const socket of sockets) {
       socket.destroy();
     }
-    await new Promise((resolve5) => server.close(() => resolve5()));
+    await new Promise((resolve6) => server.close(() => resolve6()));
     await Promise.allSettled(requests);
     await platform.removeControlSocket(path2).catch(() => void 0);
   }
@@ -4893,13 +4894,13 @@ async function waitForManagerExit(stateDirectory, signal) {
     if (!await managerLockExists(stateDirectory)) {
       return;
     }
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve6, reject) => {
       const timeout = setTimeout(finish, 20);
       const abort = () => finish(deadline.reason);
       function finish(cause) {
         clearTimeout(timeout);
         deadline.removeEventListener("abort", abort);
-        cause === void 0 ? resolve5() : reject(cause);
+        cause === void 0 ? resolve6() : reject(cause);
       }
       deadline.addEventListener("abort", abort, { once: true });
     });
@@ -4963,13 +4964,13 @@ async function ensureManager(stateDirectory, launch, signal) {
         await launchManager(launch);
         managerStarted = true;
       }
-      await new Promise((resolve5, reject) => {
+      await new Promise((resolve6, reject) => {
         const timeout = setTimeout(finish, 50);
         const abort = () => finish(signal.reason);
         function finish(cause2) {
           clearTimeout(timeout);
           signal.removeEventListener("abort", abort);
-          cause2 === void 0 ? resolve5() : reject(cause2);
+          cause2 === void 0 ? resolve6() : reject(cause2);
         }
         signal.addEventListener("abort", abort, { once: true });
       });
@@ -5171,11 +5172,11 @@ async function checkDaemonReleaseUpgrade(signal, activity) {
     const _reservation = __using(_stack, reservation);
     signal.throwIfAborted();
     await requestInstalledDaemonReleaseSwitch(control.stateDirectory, launch, signal);
-    await new Promise((resolve5) => {
+    await new Promise((resolve6) => {
       if (signal.aborted) {
-        resolve5();
+        resolve6();
       } else {
-        signal.addEventListener("abort", () => resolve5(), { once: true });
+        signal.addEventListener("abort", () => resolve6(), { once: true });
       }
     });
   } catch (_) {
@@ -5444,12 +5445,593 @@ function registerDaemonProcessLifecycleHandlers(program2, context) {
   registerUpgradeCommand(program2, context);
 }
 
+// src/cli/handler/diagnose/index.ts
+import { fork } from "node:child_process";
+import { join as join13, resolve as resolve3 } from "node:path";
+
+// src/storage/diagnostics/relay-probe-files.ts
+import { mkdir, readFile as readFile6, rm as rm2, stat as stat2, writeFile as writeFile4 } from "node:fs/promises";
+import { join as join11 } from "node:path";
+var ProbeConfigurationFileError = class extends Error {
+  code = "probe_config_invalid";
+};
+async function readPrivateProbeConfiguration(path2, signal) {
+  signal.throwIfAborted();
+  const metadata = await stat2(path2);
+  if (!metadata.isFile() || metadata.size > 16384 || process.platform !== "win32" && (metadata.mode & 63) !== 0) {
+    throw new ProbeConfigurationFileError(
+      "The pairing configuration must be a private, small regular file (mode 0600)"
+    );
+  }
+  try {
+    return JSON.parse(await readFile6(path2, { encoding: "utf8", signal }));
+  } catch {
+    signal.throwIfAborted();
+    throw new ProbeConfigurationFileError("The pairing configuration is not valid JSON");
+  }
+}
+async function createProbeOutput(directory) {
+  await mkdir(directory, { mode: 448 });
+}
+async function ensureProbeDirectory(directory) {
+  await mkdir(directory, { recursive: true, mode: 448 });
+}
+async function writeProbeReport(directory, report) {
+  await writeFile4(join11(directory, "report.json"), `${JSON.stringify(report, null, 2)}
+`, { mode: 384 });
+}
+async function writeProbeEvents(directory, events) {
+  await writeFile4(join11(directory, "transport.jsonl"), events.map((event) => JSON.stringify(event)).join("\n"), {
+    mode: 384
+  });
+}
+async function removeProbeState(directory) {
+  await rm2(join11(directory, "state"), { recursive: true, force: true });
+}
+
+// src/cli/handler/diagnose/config.ts
+var pairing = external_exports.object({ pairingId: external_exports.string().min(1).max(128), pairingCode: external_exports.string().min(1).max(128) }).readonly();
+var configuration = external_exports.object({ relayOrigin: external_exports.url(), direct: pairing, proxy: pairing }).readonly();
+var RelayProbeError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+async function readProbeConfiguration(path2, signal) {
+  const value = await readPrivateProbeConfiguration(path2, signal);
+  const parsed = configuration.safeParse(value);
+  if (!parsed.success) {
+    throw new RelayProbeError(
+      "probe_config_invalid",
+      "Expected relayOrigin and direct/proxy pairingId and pairingCode"
+    );
+  }
+  const config = parsed.data;
+  const origin = new URL(config.relayOrigin);
+  if (!["https:", "http:"].includes(origin.protocol) || origin.protocol === "http:" && !["127.0.0.1", "localhost"].includes(origin.hostname) || origin.username || origin.password || origin.search || origin.hash || origin.pathname !== "/") {
+    throw new RelayProbeError(
+      "probe_origin_invalid",
+      "relayOrigin must use HTTPS (or loopback HTTP), without credentials or query parameters"
+    );
+  }
+  if (config.direct.pairingId === config.proxy.pairingId || config.direct.pairingCode === config.proxy.pairingCode) {
+    throw new RelayProbeError("probe_pairings_reused", "Direct and proxy probes require distinct, unused pairings");
+  }
+  return config;
+}
+function configuredProbeProxy() {
+  const value = process.env["https_proxy"] || process.env["HTTPS_PROXY"] || process.env["http_proxy"] || process.env["HTTP_PROXY"];
+  let proxy;
+  try {
+    proxy = new URL(value ?? "");
+  } catch {
+    throw new RelayProbeError("probe_proxy_missing", "Set HTTPS_PROXY or HTTP_PROXY to an HTTP or HTTPS proxy");
+  }
+  if (!["http:", "https:"].includes(proxy.protocol)) {
+    throw new RelayProbeError("probe_proxy_invalid", "The comparison requires an HTTP or HTTPS proxy");
+  }
+  return proxy;
+}
+function failureCode(error) {
+  const code = error instanceof Error ? Reflect.get(error, "code") : void 0;
+  return typeof code === "string" && /^[A-Za-z0-9_-]{1,128}$/u.test(code) ? code : "probe_failed";
+}
+
+// src/cli/handler/diagnose/routes.ts
+import { execFile } from "node:child_process";
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { promisify } from "node:util";
+var execute = promisify(execFile);
+var routeEvidenceSchema = external_exports.object({
+  hostname: external_exports.string(),
+  addresses: external_exports.array(external_exports.string()),
+  routes: external_exports.array(
+    external_exports.object({ address: external_exports.string(), interface: external_exports.string(), gateway: external_exports.string(), tunnelInterface: external_exports.boolean() })
+  ),
+  failures: external_exports.array(external_exports.string()),
+  omittedAddresses: external_exports.number().int().nonnegative()
+});
+async function addresses(hostname, signal) {
+  if (isIP(hostname) !== 0) {
+    return [hostname];
+  }
+  const aborted = Promise.withResolvers();
+  const abort = () => aborted.reject(signal.reason);
+  signal.addEventListener("abort", abort, { once: true });
+  try {
+    signal.throwIfAborted();
+    const found = await Promise.race([lookup(hostname, { all: true }), aborted.promise]);
+    return [...new Set(found.map((item) => item.address))];
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}
+async function collectRouteEvidence(hostname, cancellation) {
+  const signal = AbortSignal.any([cancellation, AbortSignal.timeout(5e3)]);
+  const evidence = { hostname, addresses: [], routes: [], failures: [], omittedAddresses: 0 };
+  try {
+    const resolved = await addresses(hostname.replace(/^\[|\]$/gu, ""), signal);
+    evidence.addresses.push(...resolved.slice(0, 8));
+    evidence.omittedAddresses = Math.max(0, resolved.length - evidence.addresses.length);
+    await Promise.all(
+      evidence.addresses.map(async (address) => {
+        try {
+          let networkInterface = "";
+          let gateway = "";
+          if (process.platform === "darwin") {
+            const { stdout } = await execute("/sbin/route", ["-n", "get", address], {
+              signal,
+              timeout: 2e3,
+              maxBuffer: 32768
+            });
+            networkInterface = stdout.match(/^\s*interface:\s*(\S+)/mu)?.[1] ?? "";
+            gateway = stdout.match(/^\s*gateway:\s*(\S+)/mu)?.[1] ?? "";
+          } else if (process.platform === "linux") {
+            const { stdout } = await execute("ip", ["-json", "route", "get", address], {
+              signal,
+              timeout: 2e3,
+              maxBuffer: 32768
+            });
+            const result = external_exports.array(external_exports.object({ dev: external_exports.string(), gateway: external_exports.string().optional() })).parse(JSON.parse(stdout));
+            networkInterface = result[0]?.dev ?? "";
+            gateway = result[0]?.gateway ?? "";
+          } else {
+            evidence.failures.push("route_platform_unsupported");
+            return;
+          }
+          if (networkInterface.length === 0) {
+            throw new RelayProbeError(
+              "route_interface_unavailable",
+              "The route did not identify an interface"
+            );
+          }
+          evidence.routes.push({
+            address,
+            interface: networkInterface,
+            gateway,
+            tunnelInterface: /^(?:utun|tun|tap|wg|tailscale)/u.test(networkInterface)
+          });
+        } catch (error) {
+          cancellation.throwIfAborted();
+          evidence.failures.push(failureCode(error));
+        }
+      })
+    );
+  } catch (error) {
+    cancellation.throwIfAborted();
+    evidence.failures.push(failureCode(error));
+  }
+  return evidence;
+}
+
+// src/cli/handler/diagnose/worker.ts
+import { join as join12 } from "node:path";
+async function runRelayProbeWorker(configPath, role, directory, signal) {
+  if (!process.send) {
+    throw new Error("The relay probe worker requires its coordinator");
+  }
+  const notify = (message) => {
+    if (process.connected) {
+      process.send?.({ ...message, role }, (error) => {
+        if (error !== null) {
+          controller.abort();
+        }
+      });
+    }
+  };
+  const controller = new AbortController();
+  const stopped = AbortSignal.any([signal, controller.signal]);
+  const start = Promise.withResolvers();
+  const onMessage = (value) => {
+    const message = external_exports.object({ action: external_exports.enum(["start", "stop"]) }).safeParse(value);
+    if (!message.success) {
+      return;
+    }
+    if (message.data.action === "start") {
+      start.resolve();
+    } else {
+      controller.abort();
+    }
+  };
+  const abort = () => {
+    controller.abort();
+    start.resolve();
+  };
+  process.on("message", onMessage);
+  process.once("disconnect", abort);
+  stopped.addEventListener("abort", abort, { once: true });
+  let routesBefore = [];
+  try {
+    const config = await readProbeConfiguration(configPath, stopped);
+    const origin = new URL(config.relayOrigin);
+    const proxy = role === "proxy" ? configuredProbeProxy() : null;
+    routesBefore = await Promise.all([
+      collectRouteEvidence(origin.hostname, stopped),
+      ...proxy === null ? [] : [collectRouteEvidence(proxy.hostname, stopped)]
+    ]);
+    const workspace = join12(directory, "workspace");
+    await ensureProbeDirectory(workspace);
+    const engine = new MobiusRuntimeEngine({
+      engineDataDir: join12(directory, "state"),
+      agentLaunchEnvironment: { HOME: join12(directory, "home"), PATH: "" }
+    });
+    const pairing2 = config[role];
+    const connection = await engine.pair(
+      {
+        relayOrigin: origin.href,
+        pairingId: pairing2.pairingId,
+        pairingCode: pairing2.pairingCode,
+        defaultWorkspace: workspace
+      },
+      stopped
+    );
+    notify({ kind: "prepared", channelId: connection.channelId, runtimeId: connection.runtimeId, routesBefore });
+    await start.promise;
+    if (!stopped.aborted) {
+      await engine.runLoop({
+        connection: { kind: "saved", connectionId: connection.connectionId },
+        signal: stopped,
+        onConnectionStatus: (status) => notify({ kind: "status", status, timestamp: (/* @__PURE__ */ new Date()).toISOString() })
+      });
+    }
+    const routesAfter = await Promise.all([
+      collectRouteEvidence(origin.hostname, AbortSignal.timeout(6e3)),
+      ...proxy === null ? [] : [collectRouteEvidence(proxy.hostname, AbortSignal.timeout(6e3))]
+    ]);
+    notify({ kind: "finished", routesAfter });
+  } catch (error) {
+    if (!stopped.aborted) {
+      notify({ kind: "failed", code: failureCode(error), details: describeRelayFailure(error), routesBefore });
+      process.exitCode = 1;
+    }
+  } finally {
+    stopped.removeEventListener("abort", abort);
+    process.off("message", onMessage);
+    process.off("disconnect", abort);
+    if (process.connected) {
+      process.disconnect();
+    }
+  }
+}
+
+// src/cli/handler/diagnose/index.ts
+var workerMessage = external_exports.discriminatedUnion("kind", [
+  external_exports.object({
+    kind: external_exports.literal("prepared"),
+    role: external_exports.enum(["direct", "proxy"]),
+    channelId: external_exports.string(),
+    runtimeId: external_exports.string(),
+    routesBefore: external_exports.array(routeEvidenceSchema)
+  }),
+  external_exports.object({
+    kind: external_exports.literal("status"),
+    role: external_exports.enum(["direct", "proxy"]),
+    status: external_exports.string(),
+    timestamp: external_exports.string()
+  }),
+  external_exports.object({
+    kind: external_exports.literal("finished"),
+    role: external_exports.enum(["direct", "proxy"]),
+    routesAfter: external_exports.array(routeEvidenceSchema)
+  }),
+  external_exports.object({
+    kind: external_exports.literal("failed"),
+    role: external_exports.enum(["direct", "proxy"]),
+    code: external_exports.string(),
+    details: external_exports.record(external_exports.string(), external_exports.string()),
+    routesBefore: external_exports.array(routeEvidenceSchema)
+  })
+]);
+var ProbeLeg = class {
+  role;
+  #child;
+  #directory;
+  #prepared = Promise.withResolvers();
+  closed;
+  #channelId = "";
+  #runtimeId = "";
+  #routesBefore = [];
+  #routesAfter = [];
+  #onlineCount = 0;
+  #lastStatus = "starting";
+  #events = [];
+  #preparationFailures = [];
+  #omittedEvents = 0;
+  constructor(role, config, directory, proxy) {
+    this.role = role;
+    this.#directory = directory;
+    const entrypoint = process.argv[1];
+    if (entrypoint === void 0) {
+      throw new RelayProbeError("probe_entrypoint_missing", "Cannot locate the Mobius CLI entrypoint");
+    }
+    const environment = {
+      HOME: join13(directory, "home"),
+      PATH: process.env["PATH"] ?? "",
+      MOBIUS_STATE_DIRECTORY: join13(directory, "state")
+    };
+    for (const name of [
+      "SystemRoot",
+      "WINDIR",
+      "TMPDIR",
+      "TMP",
+      "TEMP",
+      "NODE_EXTRA_CA_CERTS",
+      "SSL_CERT_FILE",
+      "SSL_CERT_DIR"
+    ]) {
+      if (process.env[name] !== void 0) {
+        environment[name] = process.env[name];
+      }
+    }
+    environment["NO_PROXY"] = environment["no_proxy"] = role === "direct" ? "*" : "";
+    if (role === "proxy") {
+      environment["HTTPS_PROXY"] = environment["HTTP_PROXY"] = proxy.href;
+    }
+    this.#child = fork(
+      resolve3(entrypoint),
+      ["_relay-probe-worker", "--config", config, "--role", role, "--directory", directory],
+      { env: environment, silent: true, windowsHide: true }
+    );
+    this.#child.stdout?.resume();
+    let pending = "";
+    this.#child.stderr?.on("data", (data) => {
+      pending += data.toString();
+      const lines = pending.split("\n");
+      pending = lines.pop() ?? "";
+      for (const line of lines) {
+        if (line.startsWith("Mobius relay diagnostic ")) {
+          process.stderr.write(`${role}: ${line}
+`);
+          try {
+            const event = external_exports.record(external_exports.string(), external_exports.string()).safeParse(JSON.parse(line.slice("Mobius relay diagnostic ".length)));
+            if (event.success && event.data["channelId"] === this.#channelId) {
+              this.#events.push(event.data);
+              if (this.#events.length > 2e3) {
+                this.#events.shift();
+                this.#omittedEvents += 1;
+              }
+            }
+          } catch {
+          }
+        }
+      }
+      if (pending.length > 32768) {
+        pending = "";
+      }
+    });
+    this.#child.on("message", (value) => {
+      const message = workerMessage.safeParse(value);
+      if (!message.success || message.data.role !== role) {
+        return;
+      }
+      const event = message.data;
+      switch (event.kind) {
+        case "prepared":
+          this.#channelId = event.channelId;
+          this.#runtimeId = event.runtimeId;
+          this.#routesBefore = event.routesBefore;
+          this.#prepared.resolve(event);
+          break;
+        case "status":
+          if (event.status === "online" && this.#lastStatus !== "online") {
+            this.#onlineCount += 1;
+          }
+          this.#lastStatus = event.status;
+          break;
+        case "finished":
+          this.#routesAfter = event.routesAfter;
+          break;
+        case "failed":
+          this.#routesBefore = event.routesBefore;
+          this.#preparationFailures.push(event.details);
+          this.#prepared.reject(new RelayProbeError(event.code, `The ${role} probe failed`));
+          break;
+      }
+    });
+    this.closed = new Promise((done) => {
+      this.#child.once("error", (error) => {
+        this.#prepared.reject(error);
+        done(1);
+      });
+      this.#child.once("close", (code) => {
+        this.#prepared.reject(
+          new RelayProbeError("probe_worker_exited", `The ${role} probe exited before preparation`)
+        );
+        done(code);
+      });
+    });
+    void this.#prepared.promise.catch(() => void 0);
+  }
+  prepare = async () => await this.#prepared.promise;
+  start = () => {
+    if (this.#child.connected) {
+      this.#child.send({ action: "start" }, () => void 0);
+    }
+  };
+  stop = () => {
+    if (this.#child.connected) {
+      this.#child.send({ action: "stop" }, () => void 0);
+    }
+  };
+  kill = () => {
+    this.#child.kill("SIGKILL");
+  };
+  report = async () => {
+    const events = this.#events;
+    await writeProbeEvents(this.#directory, events);
+    return {
+      role: this.role,
+      channelId: this.#channelId,
+      runtimeId: this.#runtimeId,
+      onlineCount: this.#onlineCount,
+      routesBefore: this.#routesBefore,
+      routesAfter: this.#routesAfter,
+      transportFailures: events.filter((event) => event["event"] === "relay_transport_failed"),
+      preparationFailures: this.#preparationFailures,
+      disconnects: events.filter((event) => event["event"] === "relay_connection_closed"),
+      exitCode: await this.closed,
+      omittedEvents: this.#omittedEvents
+    };
+  };
+};
+async function compare(configPath, output, duration, context) {
+  const config = await readProbeConfiguration(configPath, context.shutdownSignal);
+  const proxy = configuredProbeProxy();
+  const directory = resolve3(output);
+  await createProbeOutput(directory);
+  const legs = [];
+  let startedAt = null;
+  let endedAt = null;
+  let completed = false;
+  let failure = null;
+  const deadline = AbortSignal.timeout(6e4);
+  let durationTimer;
+  let abortPreparation = () => void 0;
+  try {
+    for (const role of ["direct", "proxy"]) {
+      context.shutdownSignal.throwIfAborted();
+      const legDirectory = join13(directory, role);
+      await ensureProbeDirectory(join13(legDirectory, "home"));
+      legs.push(new ProbeLeg(role, resolve3(configPath), legDirectory, proxy));
+    }
+    const cancelled = Promise.withResolvers();
+    context.shutdownSignal.throwIfAborted();
+    abortPreparation = () => cancelled.reject(new RelayProbeError("probe_cancelled", "Relay comparison preparation was cancelled"));
+    context.shutdownSignal.addEventListener("abort", abortPreparation, { once: true });
+    deadline.addEventListener("abort", abortPreparation, { once: true });
+    const prepared = await Promise.race([Promise.all(legs.map((leg) => leg.prepare())), cancelled.promise]);
+    context.shutdownSignal.throwIfAborted();
+    if (prepared[0]?.channelId === prepared[1]?.channelId || prepared[0]?.runtimeId === prepared[1]?.runtimeId) {
+      throw new RelayProbeError(
+        "probe_runtime_reused",
+        "The Relay returned the same Runtime for distinct pairings"
+      );
+    }
+    context.shutdownSignal.removeEventListener("abort", abortPreparation);
+    deadline.removeEventListener("abort", abortPreparation);
+    startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const finish = Promise.withResolvers();
+    const stop = () => finish.resolve();
+    context.shutdownSignal.addEventListener("abort", stop, { once: true });
+    durationTimer = setTimeout(() => {
+      completed = true;
+      finish.resolve();
+    }, duration * 1e3);
+    for (const leg of legs) {
+      leg.start();
+    }
+    try {
+      await Promise.race([
+        finish.promise,
+        ...legs.map(
+          (leg) => leg.closed.then(() => {
+            throw new RelayProbeError(
+              "probe_worker_exited",
+              `The ${leg.role} probe exited during comparison`
+            );
+          })
+        )
+      ]);
+    } finally {
+      context.shutdownSignal.removeEventListener("abort", stop);
+    }
+  } catch (error) {
+    if (!context.shutdownSignal.aborted) {
+      failure = failureCode(error);
+      process.exitCode = 1;
+    }
+  } finally {
+    endedAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (durationTimer !== void 0) {
+      clearTimeout(durationTimer);
+    }
+    context.shutdownSignal.removeEventListener("abort", abortPreparation);
+    deadline.removeEventListener("abort", abortPreparation);
+    for (const leg of legs) {
+      leg.stop();
+    }
+    const force = setTimeout(() => {
+      for (const leg of legs) {
+        leg.kill();
+      }
+    }, 1e4);
+    try {
+      await Promise.all(legs.map((leg) => leg.closed));
+      const reports = await Promise.all(legs.map((leg) => leg.report()));
+      if (reports.some((leg) => leg.exitCode !== 0 || leg.onlineCount === 0)) {
+        process.exitCode = 1;
+        failure ??= "probe_not_ready";
+      }
+      const report = {
+        version: context.version,
+        targetOrigin: new URL(config.relayOrigin).origin,
+        proxyOrigin: proxy.origin,
+        requestedDurationSeconds: duration,
+        startedAt,
+        endedAt,
+        completed,
+        failure,
+        directMeans: "No explicit HTTP proxy; operating-system TUN/VPN routing still applies",
+        legs: reports
+      };
+      await writeProbeReport(directory, report);
+      process.stdout.write(`${join13(directory, "report.json")}
+`);
+    } finally {
+      clearTimeout(force);
+      await Promise.all(legs.map((leg) => removeProbeState(join13(directory, leg.role))));
+    }
+  }
+}
+function registerDiagnoseCommand(program2, context) {
+  program2.command("diagnose").description("collect isolated network diagnostics").command("relay").description("compare fresh direct and proxied Runtime channels over the same observation window").requiredOption(
+    "--config <path>",
+    "private JSON with relayOrigin and distinct direct/proxy pairingId and pairingCode"
+  ).requiredOption("--output <directory>", "new directory for sanitized report.json and transport logs").option("--duration <seconds>", "observation duration after both pairings are prepared", "600").action(async (options) => {
+    const duration = Number(options.duration);
+    if (!Number.isSafeInteger(duration) || duration < 1 || duration > 86400) {
+      throw new RelayProbeError(
+        "probe_duration_invalid",
+        "--duration must be a whole number from 1 to 86400 seconds"
+      );
+    }
+    await compare(options.config, options.output, duration, context);
+  });
+  program2.command("_relay-probe-worker", { hidden: true }).requiredOption("--config <path>").requiredOption("--role <role>").requiredOption("--directory <path>").action(async (options) => {
+    const role = external_exports.enum(["direct", "proxy"]).parse(options.role);
+    await runRelayProbeWorker(options.config, role, options.directory, context.shutdownSignal);
+  });
+}
+
 // src/cli/handler/logs/logic/collect-local-logs.ts
-import { join as join12, relative as relative4, resolve as resolve3 } from "node:path";
+import { join as join15, relative as relative4, resolve as resolve4 } from "node:path";
 
 // src/storage/logs/log-files.ts
-import { lstat as lstat2, readdir, readFile as readFile6 } from "node:fs/promises";
-import { join as join11, relative as relative3 } from "node:path";
+import { lstat as lstat2, readdir, readFile as readFile7 } from "node:fs/promises";
+import { join as join14, relative as relative3 } from "node:path";
 var LOG_FILE_NAME_PATTERN = /^[\w.-]{1,128}\.log$/u;
 var INSTALLATIONS_DIRECTORY = "installations";
 var VERSIONS_DIRECTORY = "versions";
@@ -5457,17 +6039,17 @@ function isAbsent(cause) {
   return typeof cause === "object" && cause !== null && Reflect.get(cause, "code") === "ENOENT";
 }
 async function findLogDirectories(root, unreadable, signal) {
-  const versions = join11(root, VERSIONS_DIRECTORY);
-  const installationsRoots = [join11(root, INSTALLATIONS_DIRECTORY)];
+  const versions = join14(root, VERSIONS_DIRECTORY);
+  const installationsRoots = [join14(root, INSTALLATIONS_DIRECTORY)];
   for (const version of await listDirectories(versions, root, unreadable, signal)) {
-    installationsRoots.push(join11(versions, version, INSTALLATIONS_DIRECTORY));
+    installationsRoots.push(join14(versions, version, INSTALLATIONS_DIRECTORY));
   }
   const found = [];
   for (const installations of installationsRoots) {
     for (const dataDirectory of await listDirectories(installations, root, unreadable, signal)) {
-      const application = join11(installations, dataDirectory);
+      const application = join14(installations, dataDirectory);
       for (const installationId of await listDirectories(application, root, unreadable, signal)) {
-        const logs = join11(application, installationId, "logs");
+        const logs = join14(application, installationId, "logs");
         const status = await directoryStatus(logs);
         if (status === "listed") {
           found.push(logs);
@@ -5525,7 +6107,7 @@ async function readOwnedLogFile(path2, signal) {
     return { kind: "skipped" };
   }
   try {
-    return { kind: "read", content: await readFile6(path2, { encoding: "utf8", signal }) };
+    return { kind: "read", content: await readFile7(path2, { encoding: "utf8", signal }) };
   } catch (cause) {
     if (signal.aborted) {
       throw cause;
@@ -5540,14 +6122,14 @@ function ownedByCurrentUser(metadata) {
 // src/cli/handler/logs/logic/collect-local-logs.ts
 async function collectLocalDaemonLogs(stateDirectory, tailLines, signal) {
   signal.throwIfAborted();
-  const root = resolve3(stateDirectory);
+  const root = resolve4(stateDirectory);
   const entries = [];
   const unreadable = [];
   const directories = await findLogDirectories(root, unreadable, signal);
   for (const directory of directories) {
     const names = await listLogFiles(directory, root, unreadable);
     for (const name of names) {
-      const path2 = join12(directory, name);
+      const path2 = join15(directory, name);
       const reported = relative4(root, path2);
       const read = await readOwnedLogFile(path2, signal);
       if (read.kind === "unreadable") {
@@ -5569,7 +6151,7 @@ async function collectLocalDaemonLogs(stateDirectory, tailLines, signal) {
   return { entries, unreadable: [...unreadable].sort() };
 }
 function defaultStateDirectory(environment = process.env) {
-  return resolve3(readStateDirectory(environment));
+  return resolve4(readStateDirectory(environment));
 }
 
 // src/cli/handler/logs/index.ts
@@ -5634,7 +6216,7 @@ ${sections.join("\n")}`;
 }
 
 // src/cli/handler/pair/list.ts
-import { resolve as resolve4 } from "node:path";
+import { resolve as resolve5 } from "node:path";
 
 // src/cli/handler/pair/logic/pair-list-output.ts
 function savedPairSummary(connection) {
@@ -5685,7 +6267,7 @@ async function writePairList(path2, pairs, signal) {
 function registerPairListCommand(command, context) {
   command.command("list").description("list saved pairings").addOption(valueOption("--output-json <existing-file.json>", "write JSON to an existing file")).action(async (options) => {
     const installation = await openMobiusCliInstallation(context.shutdownSignal, process.env);
-    const outputPath = options.outputJson === void 0 ? null : resolve4(options.outputJson);
+    const outputPath = options.outputJson === void 0 ? null : resolve5(options.outputJson);
     const pairs = (await installation.listConnections(context.shutdownSignal)).map(savedPairSummary).sort(
       (left, right) => left.appId.localeCompare(right.appId) || left.connectionId.localeCompare(right.connectionId)
     );
@@ -5818,6 +6400,7 @@ function createProgram(cliContext) {
   registerVersionHandler(program2, cliContext);
   registerAgentsHandler(program2, cliContext);
   registerLogsCommand(program2, cliContext);
+  registerDiagnoseCommand(program2, cliContext);
   registerInternalRuntimeHandlers(program2, cliContext);
   registerPairHandlers(program2, cliContext);
   registerDaemonProcessLifecycleHandlers(program2, cliContext);
@@ -5856,4 +6439,4 @@ async function runCLI() {
 export {
   runCLI
 };
-//# sourceMappingURL=cli-5UCO7ZEY.js.map
+//# sourceMappingURL=cli-EY6WXGHE.js.map