@namzu/cli 10.0.0 → 12.0.0

package/dist/context/sandbox.d.ts

@@ -0,0 +1,54 @@
+import { type Logger, type SandboxProvider } from '@namzu/sdk';
+import type { SandboxConfig } from '../config/schema.js';
+/**
+ * The sandbox a CLI run executes its commands in.
+ *
+ * There was none. `sandboxProvider` appeared zero times in this package,
+ * so `context.sandbox` was always undefined and `BashTool` took its
+ * fallback branch — `execAsync` in the host process, with the host
+ * environment, meaning every credential the operator's shell holds went
+ * to every command the model chose to run. The isolation the docs
+ * described held on no path.
+ *
+ * On by default now. What it enforces is a property of the machine, and
+ * this module's other job is to make sure nobody has to guess which.
+ */
+export interface ResolvedSandbox {
+    /** Absent when the operator turned it off. */
+    readonly provider?: SandboxProvider;
+    /** One line for the operator, always — including when it is off. */
+    readonly notice: string;
+    /**
+     * True when commands run on the host with no confinement.
+     *
+     * Either because the sandbox is off, or because this platform's
+     * environment enforces nothing. A caller that wants to warn louder in
+     * that case does not have to re-derive it from the notice text.
+     */
+    readonly unconfined: boolean;
+}
+/**
+ * Build the sandbox for a run, or explain why there is none.
+ *
+ * Never throws for an ordinary platform shortfall — a machine that cannot
+ * confine the network still runs the CLI, and says so. It DOES throw when
+ * the operator named a control under `requireIsolation` that this machine
+ * cannot enforce, because that request is the one case where continuing
+ * quietly would be answering a question they asked with a different
+ * answer than the true one.
+ */
+export declare function resolveSandbox(log: Logger, config: SandboxConfig | undefined): ResolvedSandbox;
+/**
+ * `namzu.sandbox.resolved`'s severity: `warn` when nothing is confined,
+ * `info` otherwise. Extracted from the emit call site (`tui/agent.ts`) so
+ * this mapping — the one that decides whether an unconfined sandbox reads
+ * as routine or as something an operator should act on — is testable
+ * without depending on which isolation tier the test happens to run under.
+ * `resolveSandbox` reports whatever THIS machine actually enforces, and
+ * CI's machine is not every reader's; the existing tests in this file
+ * already work around that by branching at runtime on `resolved.unconfined`
+ * rather than asserting a fixed tier. A pure function over `ResolvedSandbox`
+ * sidesteps the need for that workaround entirely for this one property.
+ */
+export declare function sandboxResolvedSeverity(sandbox: ResolvedSandbox): 'info' | 'warn';
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/context/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/context/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,MAAM,EAGX,KAAK,eAAe,EAEpB,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAExD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,eAAe;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;IACnC,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,eAAe,CAuC9F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,GAAG,MAAM,CAEjF"}

package/dist/context/sandbox.js

@@ -0,0 +1,61 @@
+import { LocalSandboxProvider, SANDBOX_ISOLATION_CONTROLS, isolationOf, } from '@namzu/sdk';
+/**
+ * Build the sandbox for a run, or explain why there is none.
+ *
+ * Never throws for an ordinary platform shortfall — a machine that cannot
+ * confine the network still runs the CLI, and says so. It DOES throw when
+ * the operator named a control under `requireIsolation` that this machine
+ * cannot enforce, because that request is the one case where continuing
+ * quietly would be answering a question they asked with a different
+ * answer than the true one.
+ */
+export function resolveSandbox(log, config) {
+    if (config?.enabled === false) {
+        return {
+            notice: "Sandbox off by configuration: commands run in this process, with this shell's environment. Remove `sandbox.enabled: false` to turn it back on.",
+            unconfined: true,
+        };
+    }
+    const required = (config?.requireIsolation ?? []);
+    // Constructing with the requirement is what makes `requireIsolation`
+    // mean something: the provider refuses rather than downgrading, and the
+    // refusal names the control. Catching it here would turn a stated
+    // requirement back into a preference.
+    const provider = new LocalSandboxProvider(log, { requireIsolation: required });
+    const report = isolationOf(provider.environment);
+    const enforced = SANDBOX_ISOLATION_CONTROLS.filter((c) => report[c]);
+    const missing = SANDBOX_ISOLATION_CONTROLS.filter((c) => !report[c]);
+    if (enforced.length === 0) {
+        // The honest case, and the one most likely to be misread. The
+        // sandbox is attached and confines nothing, which is not the same as
+        // no sandbox and is emphatically not protection.
+        return {
+            provider,
+            notice: `Sandbox on (${provider.environment}), but this platform enforces none of ${SANDBOX_ISOLATION_CONTROLS.join(', ')} — commands are not confined. Name what you need under \`sandbox.requireIsolation\` to be refused instead of surprised.`,
+            unconfined: true,
+        };
+    }
+    return {
+        provider,
+        notice: missing.length === 0
+            ? `Sandbox on (${provider.environment}): enforcing ${enforced.join(', ')}.`
+            : `Sandbox on (${provider.environment}): enforcing ${enforced.join(', ')}; NOT enforcing ${missing.join(', ')}.`,
+        unconfined: false,
+    };
+}
+/**
+ * `namzu.sandbox.resolved`'s severity: `warn` when nothing is confined,
+ * `info` otherwise. Extracted from the emit call site (`tui/agent.ts`) so
+ * this mapping — the one that decides whether an unconfined sandbox reads
+ * as routine or as something an operator should act on — is testable
+ * without depending on which isolation tier the test happens to run under.
+ * `resolveSandbox` reports whatever THIS machine actually enforces, and
+ * CI's machine is not every reader's; the existing tests in this file
+ * already work around that by branching at runtime on `resolved.unconfined`
+ * rather than asserting a fixed tier. A pure function over `ResolvedSandbox`
+ * sidesteps the need for that workaround entirely for this one property.
+ */
+export function sandboxResolvedSeverity(sandbox) {
+    return sandbox.unconfined ? 'warn' : 'info';
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/context/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/context/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,oBAAoB,EAEpB,0BAA0B,EAG1B,WAAW,GACX,MAAM,YAAY,CAAA;AAiCnB;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,MAAiC;IAC5E,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO;YACN,MAAM,EACL,gJAAgJ;YACjJ,UAAU,EAAE,IAAI;SAChB,CAAA;IACF,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,gBAAgB,IAAI,EAAE,CAAuC,CAAA;IACvF,qEAAqE;IACrE,wEAAwE;IACxE,kEAAkE;IAClE,sCAAsC;IACtC,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAA;IAE9E,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IACpE,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAEpE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,8DAA8D;QAC9D,qEAAqE;QACrE,iDAAiD;QACjD,OAAO;YACN,QAAQ;YACR,MAAM,EAAE,eAAe,QAAQ,CAAC,WAAW,yCAAyC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,yHAAyH;YAClP,UAAU,EAAE,IAAI;SAChB,CAAA;IACF,CAAC;IAED,OAAO;QACN,QAAQ;QACR,MAAM,EACL,OAAO,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,eAAe,QAAQ,CAAC,WAAW,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC3E,CAAC,CAAC,eAAe,QAAQ,CAAC,WAAW,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAClH,UAAU,EAAE,KAAK;KACjB,CAAA;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAwB;IAC/D,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;AAC5C,CAAC"}

package/dist/doctor/checks/index.d.ts

@@ -1,11 +1,16 @@
 import type { DoctorCheck } from '@namzu/sdk';
 import { providerChainCheck } from './chain.js';
 import { credentialSourcesCheck } from './credentials.js';
+import { invariantsCheck } from './invariants.js';
+import { loggingPipelineCheck } from './logging.js';
 import { providersRegisteredCheck } from './providers.js';
 import { cwdWritableCheck, tmpdirWritableCheck } from './runtime.js';
 import { sandboxPlatformCheck } from './sandbox.js';
 import { telemetryInstalledCheck } from './telemetry.js';
 import { vaultRegisteredCheck } from './vault.js';
-export { credentialSourcesCheck, providerChainCheck, providersRegisteredCheck, cwdWritableCheck, tmpdirWritableCheck, sandboxPlatformCheck, telemetryInstalledCheck, vaultRegisteredCheck, };
+export declare const sandboxInstalledCheck: DoctorCheck;
+export declare const filesInstalledCheck: DoctorCheck;
+export declare const computerUseInstalledCheck: DoctorCheck;
+export { credentialSourcesCheck, providerChainCheck, providersRegisteredCheck, cwdWritableCheck, tmpdirWritableCheck, invariantsCheck, loggingPipelineCheck, sandboxPlatformCheck, telemetryInstalledCheck, vaultRegisteredCheck, };
 export declare const builtInDoctorChecks: readonly DoctorCheck[];
 //# sourceMappingURL=index.d.ts.map

package/dist/doctor/checks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,EACN,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,GACpB,CAAA;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,WAAW,EAYrD,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,YAAY,CAAA;AAGhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAA4B,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AA2BjD,eAAO,MAAM,qBAAqB,EAAE,WAAyD,CAAA;AAC7F,eAAO,MAAM,mBAAmB,EAAE,WAAsD,CAAA;AACxF,eAAO,MAAM,yBAAyB,EAAE,WAGvC,CAAA;AAOD,OAAO,EACN,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,GACpB,CAAA;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,WAAW,EAoBrD,CAAA"}

package/dist/doctor/checks/index.js

@@ -1,11 +1,46 @@
+import { capabilityCheckId } from '../../context/capabilities.js';
 import { providerChainCheck } from './chain.js';
 import { credentialSourcesCheck } from './credentials.js';
+import { invariantsCheck } from './invariants.js';
+import { loggingPipelineCheck } from './logging.js';
 import { providersRegisteredCheck } from './providers.js';
 import { cwdWritableCheck, tmpdirWritableCheck } from './runtime.js';
 import { sandboxPlatformCheck } from './sandbox.js';
-import { telemetryInstalledCheck } from './telemetry.js';
+import { describeInstalledPackage, telemetryInstalledCheck } from './telemetry.js';
 import { vaultRegisteredCheck } from './vault.js';
-export { credentialSourcesCheck, providerChainCheck, providersRegisteredCheck, cwdWritableCheck, tmpdirWritableCheck, sandboxPlatformCheck, telemetryInstalledCheck, vaultRegisteredCheck, };
+/**
+ * Build an `installed` check for one optional package, over the same
+ * absent/present/broken mapping `telemetryInstalledCheck` already used.
+ *
+ * `telemetryInstalledCheck` keeps its own hand-written definition below
+ * rather than being rebuilt through this factory — it shipped first, and
+ * `doctor/checks/__tests__/telemetry.test.ts` already exercises that exact
+ * object with zero edits required by NZ-BOOT-02. A fifth optional package
+ * needs one call to this factory, not a fourth hand-written check that can
+ * drift from the other three.
+ */
+function installedCheck(specifier, category) {
+    return {
+        id: capabilityCheckId(specifier),
+        category,
+        run: () => describeInstalledPackage(specifier),
+    };
+}
+// `sandboxPlatformCheck` already owns the `sandbox` category for a different
+// question (does THIS PLATFORM enforce isolation); this check asking IS THE
+// PACKAGE HERE fits the same category. `DoctorCategory` has no `files` or
+// `computer-use` member, and widening that union is an SDK type change this
+// task does not make, so those two register under `custom` — the category
+// the registry's own tests already use for exactly this situation.
+export const sandboxInstalledCheck = installedCheck('@namzu/sandbox', 'sandbox');
+export const filesInstalledCheck = installedCheck('@namzu/files', 'custom');
+export const computerUseInstalledCheck = installedCheck('@namzu/computer-use', 'custom');
+// NOTE the fix versus the original submission: sandboxInstalledCheck /
+// filesInstalledCheck / computerUseInstalledCheck are NOT repeated here.
+// They already carry their own `export` keyword above; naming them again in
+// this aggregation block is a duplicate-export declaration and fails
+// `tsc --build` with TS2323/TS2484 (confirmed by building this exact file).
+export { credentialSourcesCheck, providerChainCheck, providersRegisteredCheck, cwdWritableCheck, tmpdirWritableCheck, invariantsCheck, loggingPipelineCheck, sandboxPlatformCheck, telemetryInstalledCheck, vaultRegisteredCheck, };
 export const builtInDoctorChecks = [
     sandboxPlatformCheck,
     cwdWritableCheck,
@@ -17,6 +52,14 @@ export const builtInDoctorChecks = [
     // the operator has seen what was found.
     providerChainCheck,
     vaultRegisteredCheck,
+    sandboxInstalledCheck,
+    filesInstalledCheck,
+    computerUseInstalledCheck,
     telemetryInstalledCheck,
+    // Last, deliberately: it reports what the pipeline did to the records
+    // every check above it just produced, so running it first would report a
+    // process that had barely logged anything yet.
+    loggingPipelineCheck,
+    invariantsCheck,
 ];
 //# sourceMappingURL=index.js.map

package/dist/doctor/checks/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/doctor/checks/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,EACN,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,GACpB,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IAC1D,oBAAoB;IACpB,gBAAgB;IAChB,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,4EAA4E;IAC5E,0EAA0E;IAC1E,wCAAwC;IACxC,kBAAkB;IAClB,oBAAoB;IACpB,uBAAuB;CACvB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/doctor/checks/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,SAAiB,EAAE,QAAiC;IAC3E,OAAO;QACN,EAAE,EAAE,iBAAiB,CAAC,SAAS,CAAC;QAChC,QAAQ;QACR,GAAG,EAAE,GAA+B,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC;KAC1E,CAAA;AACF,CAAC;AAED,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAgB,cAAc,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAA;AAC7F,MAAM,CAAC,MAAM,mBAAmB,GAAgB,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAgB,cAAc,CACnE,qBAAqB,EACrB,QAAQ,CACR,CAAA;AAED,uEAAuE;AACvE,yEAAyE;AACzE,4EAA4E;AAC5E,qEAAqE;AACrE,4EAA4E;AAC5E,OAAO,EACN,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,GACpB,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IAC1D,oBAAoB;IACpB,gBAAgB;IAChB,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,4EAA4E;IAC5E,0EAA0E;IAC1E,wCAAwC;IACxC,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;IACnB,yBAAyB;IACzB,uBAAuB;IACvB,sEAAsE;IACtE,yEAAyE;IACzE,+CAA+C;IAC/C,oBAAoB;IACpB,eAAe;CACf,CAAA"}

package/dist/doctor/checks/invariants.d.ts

@@ -0,0 +1,23 @@
+import type { DoctorCheck, DoctorCheckResult, InvariantRegistry } from '@namzu/sdk';
+/**
+ * Evaluate every invariant `registry` holds and fold the outcomes, plus each
+ * invariant's own violation counter, into one doctor row.
+ *
+ * Exported separately from the `DoctorCheck` — same reasoning as
+ * `describeInstalledPackage` on the telemetry check — so a test can drive a
+ * SCOPED registry directly, rather than mutating the process-wide singleton
+ * every other test also reads. The check itself is still exercised through
+ * `invariantsCheck.run`, because a helper proven in isolation says nothing
+ * about whether the check reaches it.
+ *
+ * Every invariant is evaluated with `ctx: undefined`. `namzu doctor` runs
+ * with no live run and no candidate compaction reduction — there is nothing
+ * a real invariant's check could read that is specific to one run — so
+ * `undefined` is the honest context, not a shortcut: each check registered
+ * against it is written to answer `unknown` rather than guess (see
+ * `compaction.ts` and `claim-disk.ts` in `@namzu/sdk`), and this row reports
+ * that state rather than papering over it as a pass.
+ */
+export declare function describeInvariants(registry: InvariantRegistry): Promise<DoctorCheckResult>;
+export declare const invariantsCheck: DoctorCheck;
+//# sourceMappingURL=invariants.d.ts.map

package/dist/doctor/checks/invariants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invariants.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/invariants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAanF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyDhG;AAED,eAAO,MAAM,eAAe,EAAE,WAI7B,CAAA"}

package/dist/doctor/checks/invariants.js

@@ -0,0 +1,79 @@
+import { invariants } from '@namzu/sdk';
+function label(row) {
+    return `${row.id} (${row.violations} violation${row.violations === 1 ? '' : 's'})`;
+}
+/**
+ * Evaluate every invariant `registry` holds and fold the outcomes, plus each
+ * invariant's own violation counter, into one doctor row.
+ *
+ * Exported separately from the `DoctorCheck` — same reasoning as
+ * `describeInstalledPackage` on the telemetry check — so a test can drive a
+ * SCOPED registry directly, rather than mutating the process-wide singleton
+ * every other test also reads. The check itself is still exercised through
+ * `invariantsCheck.run`, because a helper proven in isolation says nothing
+ * about whether the check reaches it.
+ *
+ * Every invariant is evaluated with `ctx: undefined`. `namzu doctor` runs
+ * with no live run and no candidate compaction reduction — there is nothing
+ * a real invariant's check could read that is specific to one run — so
+ * `undefined` is the honest context, not a shortcut: each check registered
+ * against it is written to answer `unknown` rather than guess (see
+ * `compaction.ts` and `claim-disk.ts` in `@namzu/sdk`), and this row reports
+ * that state rather than papering over it as a pass.
+ */
+export async function describeInvariants(registry) {
+    const ids = registry.listIds();
+    if (ids.length === 0) {
+        return { status: 'skipped', message: 'no invariants registered' };
+    }
+    const rows = await Promise.all(ids.map(async (id) => ({
+        id,
+        outcome: await registry.evaluate(id, undefined),
+        violations: registry.violationCount(id),
+    })));
+    const violated = rows.filter((r) => r.outcome.state === 'violated');
+    const unknown = rows.filter((r) => r.outcome.state === 'unknown');
+    if (violated.length > 0) {
+        const detail = violated
+            .map((r) => (r.outcome.state === 'violated' ? `${label(r)}: ${r.outcome.detail}` : label(r)))
+            .join('; ');
+        return {
+            status: 'fail',
+            message: `${violated.length}/${ids.length} invariant(s) violated — ${detail}`,
+            remediation: 'Check the warn/error logs at the module that registered the violated invariant.',
+        };
+    }
+    if (unknown.length > 0) {
+        const names = unknown.map(label).join(', ');
+        // `skipped`, not `inconclusive`, and the difference is the whole
+        // behaviour of this row. `inconclusive` maps to exit 69 in
+        // `doctor/registry.ts` and means "I asked and could not establish an
+        // answer" — a real signal that something is wrong with the check
+        // itself. A runtime invariant outside a live run is a different thing:
+        // the question has no subject yet, every registered check is written
+        // to answer `unknown` here on purpose, and so this state is reached on
+        // EVERY doctor run. Reporting it as inconclusive made `namzu doctor`
+        // exit 69 unconditionally, which retires the one code that was
+        // supposed to mean something.
+        //
+        // `skipped` is not "satisfied" either — the summary counts it
+        // separately from `pass`, and the message still names which invariants
+        // went unevaluated and how many violations each has accumulated. The
+        // violation counters above are what actually carry a live run's
+        // findings back to this row.
+        return {
+            status: 'skipped',
+            message: `${unknown.length}/${ids.length} invariant(s) have no subject outside a live run: ${names}`,
+        };
+    }
+    return {
+        status: 'pass',
+        message: `${ids.length} invariant(s) hold: ${rows.map(label).join(', ')}`,
+    };
+}
+export const invariantsCheck = {
+    id: 'runtime.invariants',
+    category: 'runtime',
+    run: () => describeInvariants(invariants),
+};
+//# sourceMappingURL=invariants.js.map

package/dist/doctor/checks/invariants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invariants.js","sourceRoot":"","sources":["../../../src/doctor/checks/invariants.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAQvC,SAAS,KAAK,CAAC,GAAiB;IAC/B,OAAO,GAAG,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,aAAa,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAA;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAA2B;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;IAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAA;IAClE,CAAC;IAED,MAAM,IAAI,GAAmB,MAAM,OAAO,CAAC,GAAG,CAC7C,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACtB,EAAE;QACF,OAAO,EAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;QAC/C,UAAU,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;KACvC,CAAC,CAAC,CACH,CAAA;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;IAEjE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,QAAQ;aACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;aAC5F,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,OAAO;YACN,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,4BAA4B,MAAM,EAAE;YAC7E,WAAW,EACV,iFAAiF;SAClF,CAAA;IACF,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3C,iEAAiE;QACjE,2DAA2D;QAC3D,qEAAqE;QACrE,iEAAiE;QACjE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,+DAA+D;QAC/D,8BAA8B;QAC9B,EAAE;QACF,8DAA8D;QAC9D,uEAAuE;QACvE,qEAAqE;QACrE,gEAAgE;QAChE,6BAA6B;QAC7B,OAAO;YACN,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,qDAAqD,KAAK,EAAE;SACpG,CAAA;IACF,CAAC;IAED,OAAO;QACN,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,uBAAuB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACzE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAgB;IAC3C,EAAE,EAAE,oBAAoB;IACxB,QAAQ,EAAE,SAAS;IACnB,GAAG,EAAE,GAA+B,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;CACrE,CAAA"}

package/dist/doctor/checks/logging.d.ts

@@ -0,0 +1,10 @@
+import type { DoctorCheck, DoctorCheckResult, LogSinkCounters } from '@namzu/sdk';
+/**
+ * Exported separately from the check so all three outcomes can be driven
+ * directly, the same arrangement `describeInstalledPackage` uses: a check
+ * whose only entry point is `run` can be tested for the state the machine
+ * happens to be in and nothing else.
+ */
+export declare function describeLogPipeline(counters: LogSinkCounters | undefined): DoctorCheckResult;
+export declare const loggingPipelineCheck: DoctorCheck;
+//# sourceMappingURL=logging.d.ts.map

package/dist/doctor/checks/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAkCjF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,iBAAiB,CA6B5F;AAED,eAAO,MAAM,oBAAoB,EAAE,WAOlC,CAAA"}

package/dist/doctor/checks/logging.js

@@ -0,0 +1,69 @@
+import { getLogCounters } from '@namzu/sdk';
+/**
+ * What the log pipeline actually did to this process's records.
+ *
+ * `LogSinkCounters` has counted five things on every record since the sink
+ * seam landed — dropped, redacted, attributes shed, values truncated,
+ * records shrunk — and until this check nothing read any of them. That is
+ * `declared-but-undriven` with an unusually direct tell: the comment above
+ * `createLogger` promised "a caller that wants to observe the pipeline — a
+ * test, `namzu doctor` later — reads `.counters` off the same reference",
+ * and `namzu doctor` did not. This file is that comment coming true.
+ *
+ * The counters only became readable as part of this change. They lived on
+ * whatever logger `createLogger` happened to build, and `getRootLogger`
+ * builds a new one on every call, so each count died with the expression
+ * that produced it. `installProcessSink` now owns one set for the process
+ * and every logger routed through it adds to those totals.
+ */
+/** Field-by-field, so a new counter cannot be silently left unreported. */
+const FIELDS = [
+    'dropped',
+    'redacted',
+    'attributesDropped',
+    'valuesTruncated',
+    'recordsTruncated',
+];
+function summarise(counters) {
+    return FIELDS.map((f) => `${f}=${counters[f]}`).join(' ');
+}
+/**
+ * Exported separately from the check so all three outcomes can be driven
+ * directly, the same arrangement `describeInstalledPackage` uses: a check
+ * whose only entry point is `run` can be tested for the state the machine
+ * happens to be in and nothing else.
+ */
+export function describeLogPipeline(counters) {
+    if (counters === undefined) {
+        // NOT `pass`, and not five zeros dressed up as one. Nothing measured
+        // these records, so "nothing was dropped" is a claim this check has no
+        // standing to make — and it is the claim a reader would take from a
+        // green row. The CLI installs a sink during boot, so reaching here at
+        // all means that boot step did not run.
+        return {
+            status: 'inconclusive',
+            message: 'no log sink installed — records reach stderr through the legacy path, where nothing is counted, redacted or size-capped',
+            remediation: 'A host owns its log destination: call installProcessSink(sink, level) during boot. The CLI does this itself, so seeing this from `namzu doctor` means that step did not run.',
+        };
+    }
+    if (counters.dropped > 0) {
+        return {
+            status: 'fail',
+            message: `${counters.dropped} log record(s) never reached the sink — ${summarise(counters)}`,
+            remediation: 'A record is counted dropped when the installed sink threw, or when the sink is NOOP_SINK. Check the sink passed to installProcessSink: a sink that throws is caught so one bad record cannot fail a run, which is exactly why the count is the only place this shows up.',
+        };
+    }
+    return {
+        status: 'pass',
+        message: `log pipeline live, nothing dropped — ${summarise(counters)}`,
+    };
+}
+export const loggingPipelineCheck = {
+    id: 'logging.pipeline',
+    // `DoctorCategory` has no `logging` member, and widening that union is an
+    // SDK type change this check does not need — the same call the optional
+    // package probes made for `files` and `computer-use`.
+    category: 'custom',
+    run: () => Promise.resolve(describeLogPipeline(getLogCounters())),
+};
+//# sourceMappingURL=logging.js.map

package/dist/doctor/checks/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../../../src/doctor/checks/logging.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C;;;;;;;;;;;;;;;;GAgBG;AAEH,2EAA2E;AAC3E,MAAM,MAAM,GAAuC;IAClD,SAAS;IACT,UAAU;IACV,mBAAmB;IACnB,iBAAiB;IACjB,kBAAkB;CAClB,CAAA;AAED,SAAS,SAAS,CAAC,QAAyB;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAqC;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,wCAAwC;QACxC,OAAO;YACN,MAAM,EAAE,cAAc;YACtB,OAAO,EACN,yHAAyH;YAC1H,WAAW,EACV,8KAA8K;SAC/K,CAAA;IACF,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACN,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,2CAA2C,SAAS,CAAC,QAAQ,CAAC,EAAE;YAC5F,WAAW,EACV,0QAA0Q;SAC3Q,CAAA;IACF,CAAC;IAED,OAAO;QACN,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,wCAAwC,SAAS,CAAC,QAAQ,CAAC,EAAE;KACtE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAgB;IAChD,EAAE,EAAE,kBAAkB;IACtB,0EAA0E;IAC1E,wEAAwE;IACxE,sDAAsD;IACtD,QAAQ,EAAE,QAAQ;IAClB,GAAG,EAAE,GAA+B,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,cAAc,EAAE,CAAC,CAAC;CAC7F,CAAA"}

package/dist/doctor/checks/session-export.d.ts

@@ -0,0 +1,21 @@
+import type { DoctorCheck, DoctorCheckResult } from '@namzu/sdk';
+import type { NamzuCliConfig } from '../../config/schema.js';
+import { type TelemetryLoader } from '../../integrations/telemetry/session-export.js';
+/**
+ * Is this machine sending conversation content anywhere?
+ *
+ * A doctor row rather than only a boot line, because the two answer for
+ * different people at different moments: the boot narrative tells whoever
+ * started the run, and `namzu doctor` is what somebody runs when they are
+ * asked "does this tool send our transcripts off the box" and need an answer
+ * they can paste.
+ *
+ * The row is a `pass` in both directions on purpose. Export being ON is not
+ * a fault — it is a configuration somebody chose — so reporting it as a
+ * warning would train a reader to ignore the one row that describes their
+ * data leaving. What the row owes them is the destination and the redactor
+ * count, which is exactly what `describeSessionExport` already builds.
+ */
+export declare function describeSessionExportStatus(config: NamzuCliConfig, loader?: TelemetryLoader): Promise<DoctorCheckResult>;
+export declare function sessionExportCheck(config: NamzuCliConfig, loader?: TelemetryLoader): DoctorCheck;
+//# sourceMappingURL=session-export.d.ts.map

package/dist/doctor/checks/session-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-export.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/session-export.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,EACN,KAAK,eAAe,EAEpB,MAAM,gDAAgD,CAAA;AAEvD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,2BAA2B,CAChD,MAAM,EAAE,cAAc,EACtB,MAAM,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAyC5B;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,WAAW,CAMhG"}

package/dist/doctor/checks/session-export.js

@@ -0,0 +1,62 @@
+import { describeSessionExportOff, } from '../../integrations/telemetry/session-export.js';
+/**
+ * Is this machine sending conversation content anywhere?
+ *
+ * A doctor row rather than only a boot line, because the two answer for
+ * different people at different moments: the boot narrative tells whoever
+ * started the run, and `namzu doctor` is what somebody runs when they are
+ * asked "does this tool send our transcripts off the box" and need an answer
+ * they can paste.
+ *
+ * The row is a `pass` in both directions on purpose. Export being ON is not
+ * a fault — it is a configuration somebody chose — so reporting it as a
+ * warning would train a reader to ignore the one row that describes their
+ * data leaving. What the row owes them is the destination and the redactor
+ * count, which is exactly what `describeSessionExport` already builds.
+ */
+export async function describeSessionExportStatus(config, loader) {
+    const configured = config.telemetry?.sessionExport;
+    if (!configured) {
+        const off = await describeSessionExportOff(loader);
+        return {
+            status: 'pass',
+            message: off ?? 'Session export is off: telemetry.sessionExport is not configured.',
+        };
+    }
+    // The disclosure is built from the config, not from a live listener: a
+    // doctor run must be able to answer this without starting a session, and
+    // starting one to find out what it would export would be the check
+    // causing the thing it reports on.
+    const off = await describeSessionExportOff(loader);
+    if (off === null) {
+        // Configured, but the package that would do it is not installed. The
+        // run itself refuses in this state (`attachSessionExport`), and saying
+        // so here is what stops an operator discovering it at run time.
+        return {
+            status: 'fail',
+            message: `telemetry.sessionExport is configured (destination: ${configured.destination}) but "@namzu/telemetry" is not installed, so nothing would be recorded.`,
+            remediation: 'Install @namzu/telemetry, or remove telemetry.sessionExport from your config. namzu refuses to start a session in this state rather than run one whose export silently does not exist.',
+        };
+    }
+    const redactorCount = configured.redactors?.length ?? 1;
+    const typePhrase = configured.eventTypes
+        ? `${configured.eventTypes.length} event type(s)`
+        : 'every run event';
+    return {
+        status: 'pass',
+        message: `Session export is ON: ${typePhrase} is written to ${configured.destination}, with ${redactorCount} redactor(s) installed.`,
+        ...(redactorCount === 0
+            ? {
+                remediation: '`redactors: []` turns redaction off entirely — credential-shaped values in tool results will be written verbatim. Remove the key to install the shipped `secrets` redactor.',
+            }
+            : {}),
+    };
+}
+export function sessionExportCheck(config, loader) {
+    return {
+        id: 'telemetry.session-export',
+        category: 'telemetry',
+        run: () => describeSessionExportStatus(config, loader),
+    };
+}
+//# sourceMappingURL=session-export.js.map

package/dist/doctor/checks/session-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-export.js","sourceRoot":"","sources":["../../../src/doctor/checks/session-export.ts"],"names":[],"mappings":"AAGA,OAAO,EAEN,wBAAwB,GACxB,MAAM,gDAAgD,CAAA;AAEvD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,MAAsB,EACtB,MAAwB;IAExB,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,EAAE,aAAa,CAAA;IAClD,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAA;QAClD,OAAO;YACN,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,IAAI,mEAAmE;SACnF,CAAA;IACF,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,mEAAmE;IACnE,mCAAmC;IACnC,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAA;IAClD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAClB,qEAAqE;QACrE,uEAAuE;QACvE,gEAAgE;QAChE,OAAO;YACN,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uDAAuD,UAAU,CAAC,WAAW,0EAA0E;YAChK,WAAW,EACV,wLAAwL;SACzL,CAAA;IACF,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAA;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU;QACvC,CAAC,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,gBAAgB;QACjD,CAAC,CAAC,iBAAiB,CAAA;IACpB,OAAO;QACN,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,yBAAyB,UAAU,kBAAkB,UAAU,CAAC,WAAW,UAAU,aAAa,yBAAyB;QACpI,GAAG,CAAC,aAAa,KAAK,CAAC;YACtB,CAAC,CAAC;gBACA,WAAW,EACV,6KAA6K;aAC9K;YACF,CAAC,CAAC,EAAE,CAAC;KACN,CAAA;AACF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAsB,EAAE,MAAwB;IAClF,OAAO;QACN,EAAE,EAAE,0BAA0B;QAC9B,QAAQ,EAAE,WAAW;QACrB,GAAG,EAAE,GAA+B,EAAE,CAAC,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC;KAClF,CAAA;AACF,CAAC"}

package/dist/doctor/checks/telemetry.d.ts

@@ -8,38 +8,25 @@ import type { DoctorCheck, DoctorCheckResult } from '@namzu/sdk';
  * deferred to a follow-up check that the consumer can register
  * themselves once their telemetry config is known.
  *
- * ## Resolving and loading are asked separately, on purpose
- *
- * This used to be one `import()` in a `try`, and every rejection was reported
- * as `not installed (optional package)`. A package that IS installed and throws
- * on load — a broken build, a native binding that will not open, a dependency
- * of its own that cannot resolve — was reported as absent. One word, two facts,
- * and the reader is told the reassuring one.
- *
- * Splitting the question is what makes each answer honest, and a code check on
- * the thrown error is not enough to do it: a transitive dependency that cannot
- * resolve raises `ERR_MODULE_NOT_FOUND` exactly as a missing `@namzu/telemetry`
- * does, so matching on the code would report a broken installation as no
- * installation. `resolve` asks only about THIS specifier, so it separates the
- * two by construction rather than by reading a message that may be reworded.
- *
- *   - cannot resolve  → the package is not here          → `skipped`
- *   - resolves, import throws → it is here and unusable  → `fail`
+ * The three-state resolve-then-import probe this used to do inline now
+ * lives at `context/capabilities.ts` as `probeOptionalPackage` (NZ-BOOT-02),
+ * extracted so the boot path can report the SAME answer about
+ * `@namzu/sandbox`, `@namzu/files` and `@namzu/computer-use` that this file
+ * has always given about telemetry, instead of inventing its own. What
+ * stays here is the one thing the doctor still owns: turning that answer
+ * into the prose and remediation a `DoctorCheckResult` carries.
  */
 /**
- * Whether `specifier` is installed, and whether it loads.
+ * `specifier`'s `CapabilityProbe`, read as a `DoctorCheckResult`.
  *
  * Exported separately from the `DoctorCheck` so all three outcomes can be
- * driven with a specifier the test controls — there is no way to uninstall or
- * break the real optional package from inside a test run. The check itself is
- * still exercised through `telemetryInstalledCheck.run`, because a helper
- * proven in isolation says nothing about whether the check reaches it. Same
- * arrangement, and the same reason, as `describeProviderChain`.
- *
- * The import goes through the RESOLVED path rather than the specifier, so one
- * code path serves a package name and a file, which is what lets the
- * present-but-broken case be reached at all. Resolution has already applied the
- * package's export map by that point.
+ * asserted directly — there is no way to uninstall or break a real optional
+ * package from inside a test run, so `capabilities.test.ts` drives
+ * `probeOptionalPackage` with fixtures and this function's own tests only
+ * need to check the mapping. The check itself is still exercised through
+ * `telemetryInstalledCheck.run`, because a helper proven in isolation says
+ * nothing about whether the check reaches it. Same arrangement, and the
+ * same reason, as `describeProviderChain`.
  */
 export declare function describeInstalledPackage(specifier: string): Promise<DoctorCheckResult>;
 export declare const telemetryInstalledCheck: DoctorCheck;

package/dist/doctor/checks/telemetry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/telemetry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAIhE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA0B5F;AAED,eAAO,MAAM,uBAAuB,EAAE,WAIrC,CAAA"}
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAMhE;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoB5F;AAED,eAAO,MAAM,uBAAuB,EAAE,WAIrC,CAAA"}