@namzu/cli 35.0.0 → 36.0.0

package/dist/chunks/chunk-MH6KUKVV.js

@@ -0,0 +1,1142 @@
+import { createRequire as __namzuCreateRequire } from 'node:module';
+const require = __namzuCreateRequire(import.meta.url);
+import {
+  describeBrowserPlan
+} from "./chunk-ZPR4IMRT.js";
+import {
+  readManifest
+} from "./chunk-AK2U3N2A.js";
+import {
+  listJobs
+} from "./chunk-SKKWMMFP.js";
+import {
+  schedulePaths
+} from "./chunk-A22MBIYU.js";
+import {
+  CLI_VERSION
+} from "./chunk-HE7WUOX2.js";
+import {
+  KEYCHAIN_SERVICE,
+  chainCapabilityDisagreements,
+  claudeCredentialSearchPaths,
+  discoverProviders,
+  hasApiCredential,
+  preferencesPath,
+  readPreferences,
+  requiresCredentialForModel,
+  resolveChainCapabilities,
+  unresolvedMembers,
+  wslWindowsHome
+} from "./chunk-SB6UD3ED.js";
+import {
+  PROVIDER_REGISTRY
+} from "./chunk-6LLJQ3KY.js";
+import {
+  EXIT_USAGE
+} from "./chunk-Y7B67G22.js";
+import {
+  describeSessionExportOff
+} from "./chunk-FTMTO72X.js";
+import {
+  capabilityCheckId,
+  probeOptionalPackage
+} from "./chunk-OH6TB27S.js";
+import {
+  LocalSandboxProvider,
+  SANDBOX_ISOLATION_CONTROLS,
+  SCOPE_ATTRIBUTE,
+  getLogCounters,
+  invariants,
+  isolationOf,
+  resolveNamzuHome
+} from "./chunk-K5HARZ7G.js";
+import {
+  __name
+} from "./chunk-76FLAFCG.js";
+
+// src/doctor/checks/browser.ts
+async function describeBrowserEngine(env, platform = process.platform, load = () => import("@namzu/browser")) {
+  const probe = await probeOptionalPackage("@namzu/browser");
+  if (probe.state !== "present") {
+    return {
+      status: "skipped",
+      message: probe.state === "absent" ? "@namzu/browser not installed; no browser tools" : "@namzu/browser failed to load; see browser.installed"
+    };
+  }
+  let mod;
+  try {
+    mod = await load();
+  } catch (error) {
+    return {
+      status: "skipped",
+      message: `@namzu/browser failed to load: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+  const detected = mod.detectBrowserEnvironment(env, platform);
+  const plan = mod.runnableBrowserPlan(detected);
+  const notes = plan.warnings.length > 0 ? ` (${plan.warnings.join(" ")})` : "";
+  if (plan.unavailableReason !== void 0) {
+    return {
+      status: "warn",
+      message: `no browser can run here: ${plan.unavailableReason}`,
+      remediation: plan.engine === "local" && plan.browser === "chromium" ? "namzu browser install" : "Install Google Chrome, or set browser.engine in your config."
+    };
+  }
+  if (plan.engine === "local" && plan.browser === "chromium") {
+    return {
+      status: "pass",
+      message: `${describeBrowserPlan(plan)}${notes}`,
+      remediation: "If the first browser call says Chromium is missing: namzu browser install"
+    };
+  }
+  return {
+    status: plan.warnings.length > 0 ? "warn" : "pass",
+    message: `${describeBrowserPlan(plan)}${notes}`
+  };
+}
+__name(describeBrowserEngine, "describeBrowserEngine");
+var browserEngineCheck = {
+  id: "browser.engine",
+  category: "custom",
+  run: /* @__PURE__ */ __name((ctx) => describeBrowserEngine(ctx.env), "run")
+};
+
+// src/doctor/checks/chain.ts
+async function describeProviderChain(options = {}) {
+  const path = preferencesPath(options.home);
+  let read;
+  try {
+    read = readPreferences(options.home);
+  } catch (err) {
+    return {
+      status: "fail",
+      message: `could not read ${path}: ${err instanceof Error ? err.message : String(err)}`,
+      remediation: "Fix or delete the file, then run `namzu` to pick a provider again."
+    };
+  }
+  if (read.status === "missing") {
+    return {
+      status: "skipped",
+      message: `no provider chain configured (${path} does not exist)`,
+      remediation: "Run `namzu` and pick a provider; the choice is saved to that file."
+    };
+  }
+  if (read.status === "needs-repick") {
+    return {
+      status: "fail",
+      message: `provider chain unusable: ${read.reason}`,
+      remediation: "Run `namzu` to pick again, or edit that file by hand."
+    };
+  }
+  let detected;
+  try {
+    detected = await discoverProviders({
+      ...options.env ? { env: options.env } : {},
+      ...options.home ? { home: options.home } : {},
+      ...options.skipKeychain ? { skipKeychain: true } : {},
+      ...options.skipProbes ? { skipProbes: true } : {}
+    });
+  } catch (err) {
+    return {
+      status: "inconclusive",
+      message: `provider chain read, but credential discovery failed: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const members = read.prefs.providers;
+  const lines = [];
+  let unusable = 0;
+  let primaryUnusable = false;
+  let anonymousZen = false;
+  for (const [index, member] of members.entries()) {
+    const entry = PROVIDER_REGISTRY[member.id];
+    const position = index === 0 ? "primary" : `fallback ${index}`;
+    const model = member.model ?? `${entry.defaultModel} (namzu default)`;
+    const det = detected.find((d) => d.entry.id === member.id);
+    const needsKey = requiresCredentialForModel(entry, member.model ?? entry.defaultModel);
+    const usable = needsKey ? hasApiCredential(entry, det?.apiKey) : Boolean(det);
+    if (entry.id === "zen" && usable && !hasApiCredential(entry, det?.apiKey)) anonymousZen = true;
+    if (!usable) {
+      unusable++;
+      if (index === 0) primaryUnusable = true;
+    }
+    const state = needsKey ? usable ? "credential found" : "NO CREDENTIAL" : entry.id === "zen" && usable ? hasApiCredential(entry, det?.apiKey) ? "credential found" : "experimental free models (gateway may refuse)" : usable ? "reachable" : "NOT REACHABLE";
+    lines.push(`${index + 1}. ${position} \xB7 ${entry.label} \xB7 ${model} \xB7 ${state}`);
+  }
+  const chain = lines.join("\n");
+  const resolved = await resolveChainCapabilities(members);
+  const disagreements = chainCapabilityDisagreements(members, resolved);
+  const accepted = read.prefs.allowCapabilityMismatch === true;
+  const unreadable = unresolvedMembers(members, resolved);
+  const primaryUnreadable = resolved[0]?.kind === "unresolved";
+  const sections = [chain];
+  if (disagreements.length > 0) {
+    sections.push(
+      accepted ? "The members declare different capabilities, and you have accepted that:" : "The members declare different capabilities, so a session will be REFUSED:",
+      ...disagreements.map((d) => `  - ${d.sentence}`)
+    );
+  }
+  if (unreadable.length > 0) {
+    sections.push(
+      "Could not read what these members declare:",
+      ...unreadable.map((line) => `  - ${line}`)
+    );
+  }
+  const message = sections.join("\n");
+  if (disagreements.length > 0 && !accepted) {
+    return {
+      status: "fail",
+      message: `provider chain cannot be honoured as written:
+${message}`,
+      remediation: 'Drop the member that disagrees, or set "allowCapabilityMismatch": true in your preferences to accept the limitation. namzu will not choose between advertising abilities a fallback lacks and costing your primary a capability on every turn.'
+    };
+  }
+  if (primaryUnusable || primaryUnreadable) {
+    return {
+      status: "fail",
+      message: `${unusable} of ${members.length} chain member(s) cannot be used:
+${message}`,
+      remediation: primaryUnusable ? "The primary provider has no usable credential, so no turn can start. Set its key, or run `namzu` to pick a provider that has one." : "The primary provider could not be loaded, so no turn can start. Run `namzu` to pick a provider that can."
+    };
+  }
+  if (unusable > 0 || unreadable.length > 0 || disagreements.length > 0 || anonymousZen) {
+    return {
+      // Anonymous Zen may be refused at inference time even when its model
+      // catalogue answers. That is unverified, not a failed credential check.
+      status: "warn",
+      message: unusable > 0 ? `${unusable} of ${members.length} chain member(s) cannot be used:
+${message}` : anonymousZen ? `provider chain configured, with experimental free-model access:
+${message}` : `provider chain usable, with limitations:
+${message}`,
+      remediation: anonymousZen ? "Zen free models are experimental; the gateway may refuse direct Namzu requests. OpenCode installation is recommended for its own client. If a turn is refused, configure OPENCODE_API_KEY or choose another provider." : unusable > 0 ? "The primary still works, so turns will start. But a fallback with no credential is not a fallback \u2014 set its key, or take it out of the chain." : "The primary still works. A fallback that declares less than your primary will serve shorter or less capable turns if the chain ever falls over to it."
+    };
+  }
+  return {
+    status: "pass",
+    message: members.length === 1 ? `1 provider configured (no fallback):
+${message}` : `${members.length} providers configured, in order:
+${message}`
+  };
+}
+__name(describeProviderChain, "describeProviderChain");
+var providerChainCheck = {
+  id: "providers.chain",
+  category: "providers",
+  run: /* @__PURE__ */ __name((ctx) => describeProviderChain({ env: ctx.env }), "run")
+};
+
+// src/doctor/checks/credentials.ts
+function missingClaudeSessionNote(env, windowsHome) {
+  const paths = claudeCredentialSearchPaths(void 0, env, windowsHome);
+  const keychain = process.platform === "darwin" && !env.CLAUDE_CONFIG_DIR ? ` and macOS Keychain service ${KEYCHAIN_SERVICE}` : "";
+  return `Claude Code session not detected; checked ${paths.join(", ")}${keychain}. Desktop sign-in does not guarantee a reusable Claude Code CLI session; Namzu does not read Desktop's credential store. Sign in to the standalone Claude Code CLI, or run \`namzu login claude\`.`;
+}
+__name(missingClaudeSessionNote, "missingClaudeSessionNote");
+var credentialSourcesCheck = {
+  id: "providers.credentials",
+  category: "providers",
+  run: /* @__PURE__ */ __name(async (ctx) => {
+    const env = ctx.env;
+    const windowsHome = wslWindowsHome(env);
+    let detected;
+    try {
+      detected = await discoverProviders({ env, windowsHome });
+    } catch (err) {
+      return {
+        status: "inconclusive",
+        message: `credential discovery failed: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+    const missingClaude = !detected.some((provider) => provider.entry.id === "anthropic");
+    const missingNote = missingClaude ? missingClaudeSessionNote(env, windowsHome) : "";
+    if (detected.length === 0) {
+      return {
+        status: "warn",
+        message: `no LLM credential found
+${missingNote}`,
+        remediation: "Namzu no longer reads the secrets file. It first reuses current Claude and Codex sessions on this device, then subscriptions signed in with `namzu login claude|codex`. API keys remain optional alternatives through ANTHROPIC_API_KEY or OPENAI_API_KEY; local Ollama and LM Studio servers are also detected."
+      };
+    }
+    const lines = detected.map((d) => {
+      switch (d.source.kind) {
+        case "env":
+          if (d.entry.id === "zen" && !hasApiCredential(d.entry, d.apiKey))
+            return `${d.entry.id} (env \xB7 ${d.source.envName}=public; free models experimental)`;
+          return `${d.entry.id} (env \xB7 ${d.source.envName})`;
+        case "public":
+          return `${d.entry.id} (experimental free models \xB7 gateway may refuse)`;
+        case "opencode-file":
+          return `${d.entry.id} (OpenCode API key \xB7 ${d.source.path})`;
+        case "keychain":
+          return `${d.entry.id} (keychain \xB7 ${d.source.service})`;
+        case "claude-file":
+          return `${d.entry.id} (Claude session \xB7 ${d.source.path})`;
+        case "gemini-file":
+          return `${d.entry.id} (Gemini session \xB7 ${d.source.path})`;
+        case "stored-gemini-key":
+          return `${d.entry.id} (saved Gemini API key \xB7 ${d.source.path})`;
+        case "stored-api-key":
+          return `${d.entry.id} (saved API key \xB7 ${d.source.path})`;
+        case "codex-file":
+          return `${d.entry.id} (Codex session \xB7 ${d.source.path})`;
+        case "stored":
+          return `${d.entry.id} (signed in \xB7 ${d.source.path})`;
+        case "probe":
+          return `${d.entry.id} (local \xB7 ${d.source.url.replace(/^https?:\/\//, "")})`;
+        case "session":
+          return `${d.entry.id} (typed \xB7 current session)`;
+      }
+    });
+    const onlyAnonymousZen = detected.every(
+      (d) => d.entry.id === "zen" && !hasApiCredential(d.entry, d.apiKey)
+    );
+    return {
+      status: onlyAnonymousZen ? "warn" : "pass",
+      message: `${detected.length} provider source(s) discovered: ${lines.join(", ")}${missingNote ? `
+${missingNote}` : ""}`,
+      ...onlyAnonymousZen ? {
+        remediation: "Zen free models are experimental; the gateway may refuse direct Namzu requests. OpenCode installation is recommended for its own client. If a turn is refused, configure OPENCODE_API_KEY or choose another provider."
+      } : {}
+    };
+  }, "run")
+};
+
+// src/doctor/checks/invariants.ts
+function label(row) {
+  return `${row.id} (${row.violations} violation${row.violations === 1 ? "" : "s"})`;
+}
+__name(label, "label");
+async function describeInvariants(registry) {
+  const ids = registry.listIds();
+  if (ids.length === 0) {
+    return { status: "skipped", message: "no invariants registered" };
+  }
+  const rows = await Promise.all(
+    ids.map(async (id) => ({
+      id,
+      outcome: await registry.evaluate(id, void 0),
+      violations: registry.violationCount(id)
+    }))
+  );
+  const violated = rows.filter((r) => r.outcome.state === "violated");
+  const unknown = rows.filter((r) => r.outcome.state === "unknown");
+  if (violated.length > 0) {
+    const detail = violated.map((r) => r.outcome.state === "violated" ? `${label(r)}: ${r.outcome.detail}` : label(r)).join("; ");
+    return {
+      status: "fail",
+      message: `${violated.length}/${ids.length} invariant(s) violated \u2014 ${detail}`,
+      remediation: "Check the warn/error logs at the module that registered the violated invariant."
+    };
+  }
+  if (unknown.length > 0) {
+    const names = unknown.map(label).join(", ");
+    return {
+      status: "skipped",
+      message: `${unknown.length}/${ids.length} invariant(s) have no subject outside a live turn: ${names}`
+    };
+  }
+  return {
+    status: "pass",
+    message: `${ids.length} invariant(s) hold: ${rows.map(label).join(", ")}`
+  };
+}
+__name(describeInvariants, "describeInvariants");
+var invariantsCheck = {
+  id: "runtime.invariants",
+  category: "runtime",
+  run: /* @__PURE__ */ __name(() => describeInvariants(invariants), "run")
+};
+
+// src/doctor/checks/logging.ts
+var FIELDS = [
+  "dropped",
+  "redacted",
+  "attributesDropped",
+  "valuesTruncated",
+  "recordsTruncated"
+];
+function summarise(counters) {
+  return FIELDS.map((f) => `${f}=${counters[f]}`).join(" ");
+}
+__name(summarise, "summarise");
+function describeLogPipeline(counters) {
+  if (counters === void 0) {
+    return {
+      status: "inconclusive",
+      message: "no log sink installed \u2014 records reach stderr through the legacy path, where nothing is counted, redacted or size-capped",
+      remediation: "A host owns its log destination: call installProcessSink(sink, level) during boot. The CLI does this itself, so seeing this from `namzu doctor` means that step did not run."
+    };
+  }
+  if (counters.dropped > 0) {
+    return {
+      status: "fail",
+      message: `${counters.dropped} log record(s) never reached the sink \u2014 ${summarise(counters)}`,
+      remediation: "A record is counted dropped when the installed sink threw, or when the sink is NOOP_SINK. Check the sink passed to installProcessSink: a sink that throws is caught so one bad record cannot fail a turn, which is exactly why the count is the only place this shows up."
+    };
+  }
+  return {
+    status: "pass",
+    message: `log pipeline live, nothing dropped \u2014 ${summarise(counters)}`
+  };
+}
+__name(describeLogPipeline, "describeLogPipeline");
+var loggingPipelineCheck = {
+  id: "logging.pipeline",
+  // `DoctorCategory` has no `logging` member, and widening that union is an
+  // SDK type change this check does not need — the same call the optional
+  // package probes made for `files` and `computer-use`.
+  category: "custom",
+  run: /* @__PURE__ */ __name(() => Promise.resolve(describeLogPipeline(getLogCounters())), "run")
+};
+
+// src/doctor/checks/providers.ts
+var providersRegisteredCheck = {
+  id: "providers.registered",
+  category: "providers",
+  run: /* @__PURE__ */ __name(async () => ({
+    status: "skipped",
+    message: "no provider auto-discovery in v1; register a provider check via registerDoctorCheck for your specific provider configuration (call provider.doctorCheck?() per registered provider)"
+  }), "run")
+};
+
+// src/doctor/checks/runtime.ts
+import { constants, access } from "node:fs/promises";
+import { tmpdir } from "node:os";
+var cwdWritableCheck = {
+  id: "runtime.cwd-writable",
+  category: "runtime",
+  run: /* @__PURE__ */ __name(async (ctx) => {
+    try {
+      await access(ctx.cwd, constants.W_OK);
+      return { status: "pass", message: `cwd writable: ${ctx.cwd}` };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return {
+        status: "fail",
+        message: `cwd not writable: ${ctx.cwd} (${message})`,
+        remediation: "Run from a directory you have write access to, or pass an explicit cwd."
+      };
+    }
+  }, "run")
+};
+var tmpdirWritableCheck = {
+  id: "runtime.tmpdir-writable",
+  category: "runtime",
+  run: /* @__PURE__ */ __name(async () => {
+    const dir = tmpdir();
+    try {
+      await access(dir, constants.W_OK);
+      return { status: "pass", message: `tmpdir writable: ${dir}` };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return {
+        status: "fail",
+        message: `tmpdir not writable: ${dir} (${message})`,
+        remediation: "Set TMPDIR / TMP / TEMP to a writable location."
+      };
+    }
+  }, "run")
+};
+
+// src/doctor/checks/sandbox.ts
+var quietLogger = (() => {
+  const noop = /* @__PURE__ */ __name(() => {
+  }, "noop");
+  const self = { info: noop, warn: noop, error: noop, debug: noop };
+  return { ...self, child: /* @__PURE__ */ __name(() => self, "child") };
+})();
+var listControls = /* @__PURE__ */ __name((report, want) => SANDBOX_ISOLATION_CONTROLS.filter((control) => report[control] === want).join(", "), "listControls");
+function describeIsolationHealth(environment) {
+  const report = isolationOf(environment);
+  const enforced = listControls(report, true);
+  const missing = listControls(report, false);
+  if (missing.length === 0) {
+    return { status: "pass", message: `${environment} enforces ${enforced}` };
+  }
+  if (enforced.length === 0) {
+    return {
+      status: "warn",
+      message: `${environment} enforces nothing \u2014 commands run unconfined`,
+      remediation: "Run the agent inside a container per task (@namzu/sandbox, container tier), or pass requireIsolation so a turn refuses rather than proceeding unconfined."
+    };
+  }
+  return {
+    status: "warn",
+    message: `${environment} enforces ${enforced} but not ${missing}`,
+    remediation: "Pass requireIsolation with the controls you depend on, so a host that cannot enforce one refuses instead of downgrading quietly."
+  };
+}
+__name(describeIsolationHealth, "describeIsolationHealth");
+var sandboxPlatformCheck = {
+  id: "sandbox.platform",
+  category: "sandbox",
+  run: /* @__PURE__ */ __name(async () => {
+    try {
+      return describeIsolationHealth(new LocalSandboxProvider(quietLogger).environment);
+    } catch (error) {
+      return {
+        status: "fail",
+        message: `sandbox probe failed: ${error instanceof Error ? error.message : String(error)}`,
+        remediation: "The local sandbox provider could not determine what this host enforces. Treat commands as unconfined until this is resolved."
+      };
+    }
+  }, "run")
+};
+
+// src/doctor/checks/scheduler.ts
+import { readFileSync, realpathSync } from "node:fs";
+var schedulerCheck = {
+  id: "scheduler.service",
+  category: "runtime",
+  async run(ctx) {
+    const paths = schedulePaths(resolveNamzuHome({ env: ctx.env }));
+    let jobs = 0;
+    try {
+      jobs = listJobs(paths).jobs.filter((j) => j.state === "active").length;
+    } catch {
+      jobs = 0;
+    }
+    let manifest;
+    try {
+      manifest = readManifest(paths);
+    } catch (error) {
+      return { status: "fail", message: error instanceof Error ? error.message : String(error) };
+    }
+    if (!manifest) {
+      return jobs > 0 ? {
+        status: "warn",
+        message: `${jobs} active scheduled job(s) and no scheduler installed; they will not run`,
+        remediation: "namzu schedule install"
+      } : { status: "skipped", message: "no scheduled jobs and no scheduler installed" };
+    }
+    for (const path of [manifest.nodePath, manifest.binPath]) {
+      try {
+        realpathSync(path);
+      } catch {
+        return {
+          status: "fail",
+          message: `the scheduler service starts ${path}, which no longer exists`,
+          remediation: "namzu schedule install"
+        };
+      }
+    }
+    let age;
+    try {
+      const beat = JSON.parse(readFileSync(paths.heartbeat, "utf8"));
+      age = beat.at ? Date.now() - Date.parse(beat.at) : void 0;
+    } catch {
+      age = void 0;
+    }
+    if (age === void 0 || age > 9e4) {
+      return {
+        status: "warn",
+        message: `${manifest.name} (${manifest.platform}) is installed but the daemon has not been seen ${age === void 0 ? "yet" : `for ${Math.round(age / 1e3)} s`}`,
+        remediation: "namzu schedule status"
+      };
+    }
+    return {
+      status: "pass",
+      message: `${manifest.name} (${manifest.platform}) running; ${jobs} active job(s)`
+    };
+  }
+};
+
+// src/doctor/checks/telemetry.ts
+var TELEMETRY = "@namzu/telemetry";
+async function describeInstalledPackage(specifier) {
+  const probe = await probeOptionalPackage(specifier);
+  switch (probe.state) {
+    case "absent":
+      return {
+        status: "skipped",
+        message: `${specifier} not installed (optional package)`
+      };
+    case "present":
+      return { status: "pass", message: `${specifier} is installed` };
+    case "broken":
+      return {
+        status: "fail",
+        // The reason is the whole value of separating these: "installed but
+        // will not load" sends the reader somewhere, and "not installed" would
+        // have sent them to install what is already there.
+        message: `${specifier} is installed but failed to load: ${probe.error.message}`,
+        remediation: `Reinstall ${specifier}, or remove it if you are not using it \u2014 it is optional and namzu runs without it.`
+      };
+  }
+}
+__name(describeInstalledPackage, "describeInstalledPackage");
+var telemetryInstalledCheck = {
+  id: "telemetry.installed",
+  category: "telemetry",
+  run: /* @__PURE__ */ __name(() => describeInstalledPackage(TELEMETRY), "run")
+};
+
+// src/doctor/checks/vault.ts
+var registered = [];
+var vaultRegisteredCheck = {
+  id: "vault.registered",
+  category: "vault",
+  run: /* @__PURE__ */ __name(async () => {
+    if (registered.length === 0) {
+      return {
+        status: "skipped",
+        message: "No credential provider is registered, so there is nothing to report on."
+      };
+    }
+    const lines = [];
+    let anyConfigured = false;
+    for (const entry of registered) {
+      for (const ref of entry.refs) {
+        const described = await entry.provider.describe(ref);
+        if (described.configured) anyConfigured = true;
+        lines.push(
+          `${entry.label}: ${ref} \u2014 ${described.configured ? "configured" : "not set"}${described.source ? ` (${described.source})` : ""}, ${described.writable ? "writable" : "read-only"}`
+        );
+      }
+    }
+    return {
+      // A provider registered and nothing configured is a real answer,
+      // not a failure: an operator who has not logged in yet is in a
+      // state the doctor should describe rather than complain about.
+      status: anyConfigured ? "pass" : "warn",
+      message: lines.join("\n")
+    };
+  }, "run")
+};
+
+// src/doctor/checks/index.ts
+function installedCheck(specifier, category) {
+  return {
+    id: capabilityCheckId(specifier),
+    category,
+    run: /* @__PURE__ */ __name(() => describeInstalledPackage(specifier), "run")
+  };
+}
+__name(installedCheck, "installedCheck");
+var sandboxInstalledCheck = installedCheck("@namzu/sandbox", "sandbox");
+var filesInstalledCheck = installedCheck("@namzu/files", "custom");
+var computerUseInstalledCheck = installedCheck(
+  "@namzu/computer-use",
+  "custom"
+);
+var browserInstalledCheck = installedCheck("@namzu/browser", "custom");
+var builtInDoctorChecks = [
+  sandboxPlatformCheck,
+  cwdWritableCheck,
+  tmpdirWritableCheck,
+  providersRegisteredCheck,
+  credentialSourcesCheck,
+  // After the credential scan: this one reports which of the credentials that
+  // found are actually WIRED INTO the chain, which only reads sensibly once
+  // the operator has seen what was found.
+  providerChainCheck,
+  vaultRegisteredCheck,
+  sandboxInstalledCheck,
+  filesInstalledCheck,
+  computerUseInstalledCheck,
+  browserInstalledCheck,
+  // After the package check: which browser it would drive here, and how.
+  browserEngineCheck,
+  telemetryInstalledCheck,
+  schedulerCheck,
+  // Last, deliberately: it reports what the pipeline did to the records
+  // every check above it just produced, so running it first would report a
+  // process that had barely logged anything yet.
+  loggingPipelineCheck,
+  invariantsCheck
+];
+
+// src/doctor/checks/session-export.ts
+async function describeSessionExportStatus(config, loader) {
+  const configured = config.telemetry?.sessionExport;
+  if (!configured) {
+    const off2 = await describeSessionExportOff(loader);
+    return {
+      status: "pass",
+      message: off2 ?? "Session export is off: telemetry.sessionExport is not configured."
+    };
+  }
+  const off = await describeSessionExportOff(loader);
+  if (off === null) {
+    return {
+      status: "fail",
+      message: `telemetry.sessionExport is configured (destination: ${configured.destination}) but "@namzu/telemetry" is not installed, so nothing would be recorded.`,
+      remediation: "Install @namzu/telemetry, or remove telemetry.sessionExport from your config. namzu refuses to start a session in this state rather than run one whose export silently does not exist."
+    };
+  }
+  const redactorCount = configured.redactors?.length ?? 1;
+  const typePhrase = configured.eventTypes ? `${configured.eventTypes.length} event type(s)` : "every session event";
+  return {
+    status: "pass",
+    message: `Session export is ON: ${typePhrase} is written to ${configured.destination}, with ${redactorCount} redactor(s) installed.`,
+    ...redactorCount === 0 ? {
+      remediation: "`redactors: []` turns redaction off entirely \u2014 credential-shaped values in tool results will be written verbatim. Remove the key to install the shipped `secrets` redactor."
+    } : {}
+  };
+}
+__name(describeSessionExportStatus, "describeSessionExportStatus");
+function sessionExportCheck(config, loader) {
+  return {
+    id: "telemetry.session-export",
+    category: "telemetry",
+    run: /* @__PURE__ */ __name(() => describeSessionExportStatus(config, loader), "run")
+  };
+}
+__name(sessionExportCheck, "sessionExportCheck");
+
+// src/doctor/registry.ts
+var DEFAULT_PER_CHECK_TIMEOUT_MS = 5e3;
+var DEFAULT_WALL_CLOCK_TIMEOUT_MS = 1e4;
+var DoctorRegistry = class {
+  static {
+    __name(this, "DoctorRegistry");
+  }
+  checks = /* @__PURE__ */ new Map();
+  log;
+  setLogger(log) {
+    this.log = log.child({ [SCOPE_ATTRIBUTE]: "doctor" });
+  }
+  register(check) {
+    if (this.checks.has(check.id)) {
+      throw new Error(
+        `Doctor check with id "${check.id}" is already registered. Pick a different id or call clear() first.`
+      );
+    }
+    this.checks.set(check.id, check);
+  }
+  unregister(id) {
+    return this.checks.delete(id);
+  }
+  clear() {
+    this.checks.clear();
+  }
+  list() {
+    return Array.from(this.checks.values());
+  }
+  async run(opts = {}) {
+    const ctx = buildContext(opts);
+    const perCheck = opts.perCheckTimeoutMs ?? DEFAULT_PER_CHECK_TIMEOUT_MS;
+    const wall = opts.wallClockTimeoutMs ?? DEFAULT_WALL_CLOCK_TIMEOUT_MS;
+    const signal = opts.signal;
+    const filteredChecks = opts.categories ? this.list().filter((c) => opts.categories?.includes(c.category)) : this.list();
+    const startedAt = Date.now();
+    const completed = /* @__PURE__ */ new Map();
+    const wallTimer = sleep(wall).then(() => "wall-timeout");
+    const abortPromise = signal ? signal.aborted ? Promise.resolve("aborted") : new Promise((resolve) => {
+      signal.addEventListener("abort", () => resolve("aborted"), {
+        once: true
+      });
+    }) : new Promise(() => {
+    });
+    const recordCompletion = /* @__PURE__ */ __name((record) => {
+      if (completed.has(record.id)) return;
+      completed.set(record.id, record);
+      this.invokeCallback("onCheckComplete", () => opts.onCheckComplete?.(record));
+    }, "recordCompletion");
+    const inFlight = filteredChecks.map(async (check) => {
+      this.invokeCallback("onCheckStart", () => opts.onCheckStart?.(check));
+      const t0 = Date.now();
+      const checkPromise = (async () => check.run(ctx))();
+      const timeoutPromise = sleep(perCheck).then(
+        () => ({
+          status: "inconclusive",
+          message: `check did not return within ${perCheck}ms`
+        })
+      );
+      let result;
+      try {
+        result = await Promise.race([checkPromise, timeoutPromise]);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        this.log?.warn("doctor check threw", {
+          "namzu.doctor.id": check.id,
+          "namzu.doctor.message": message
+        });
+        result = { status: "fail", message: `check threw: ${message}` };
+      }
+      recordCompletion({
+        id: check.id,
+        category: check.category,
+        status: result.status,
+        message: result.message,
+        remediation: result.remediation,
+        durationMs: result.durationMs ?? Date.now() - t0
+      });
+    });
+    const allChecks = Promise.all(inFlight);
+    const raceWinner = await Promise.race([allChecks, wallTimer, abortPromise]);
+    let records;
+    if (raceWinner === "wall-timeout" || raceWinner === "aborted") {
+      const reason = raceWinner === "aborted" ? "aborted by signal before this check completed" : `wall-clock timeout (${wall}ms) reached before this check completed`;
+      const unfinished = filteredChecks.filter((c) => !completed.has(c.id));
+      this.log?.warn(
+        raceWinner === "aborted" ? "doctor aborted by signal" : "doctor wall-clock timeout",
+        {
+          "namzu.doctor.wall": wall,
+          "namzu.doctor.total": filteredChecks.length,
+          "namzu.doctor.unfinished": unfinished.length
+        }
+      );
+      records = filteredChecks.map((check) => {
+        const existing = completed.get(check.id);
+        if (existing) return existing;
+        const record = {
+          id: check.id,
+          category: check.category,
+          status: "inconclusive",
+          message: reason,
+          durationMs: Date.now() - startedAt
+        };
+        recordCompletion(record);
+        return record;
+      });
+    } else {
+      records = filteredChecks.map((check) => {
+        const existing = completed.get(check.id);
+        if (existing) return existing;
+        return {
+          id: check.id,
+          category: check.category,
+          status: "inconclusive",
+          message: "check resolved without producing a record (internal)",
+          durationMs: Date.now() - startedAt
+        };
+      });
+    }
+    return buildReport(records, opts.version ?? "unknown");
+  }
+  /**
+   * Invoke a consumer callback (onCheckStart / onCheckComplete) with
+   * try/catch isolation. Per ses_013 C3: a throwing callback must not
+   * affect the doctor run or the final DoctorReport. Logged but
+   * swallowed.
+   */
+  invokeCallback(phase, fn) {
+    try {
+      fn();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.log?.warn("doctor callback threw", {
+        "namzu.doctor.phase": phase,
+        "namzu.doctor.message": message
+      });
+    }
+  }
+};
+var doctor = new DoctorRegistry();
+function createDoctorRegistry() {
+  return new DoctorRegistry();
+}
+__name(createDoctorRegistry, "createDoctorRegistry");
+function registerDoctorCheck(check) {
+  doctor.register(check);
+}
+__name(registerDoctorCheck, "registerDoctorCheck");
+function runDoctor(opts = {}) {
+  const registry = opts.registry ?? doctor;
+  return registry.run({
+    categories: opts.categories,
+    perCheckTimeoutMs: opts.perCheckTimeoutMs,
+    wallClockTimeoutMs: opts.wallClockTimeoutMs,
+    cwd: opts.cwd,
+    env: opts.env,
+    projectRoot: opts.projectRoot,
+    version: opts.version,
+    onCheckStart: opts.onCheckStart,
+    onCheckComplete: opts.onCheckComplete,
+    signal: opts.signal
+  });
+}
+__name(runDoctor, "runDoctor");
+function buildContext(opts) {
+  return Object.freeze({
+    cwd: opts.cwd ?? process.cwd(),
+    env: opts.env ?? process.env,
+    projectRoot: opts.projectRoot ?? null
+  });
+}
+__name(buildContext, "buildContext");
+function buildReport(records, version) {
+  const summary = {
+    pass: records.filter((r) => r.status === "pass").length,
+    fail: records.filter((r) => r.status === "fail").length,
+    inconclusive: records.filter((r) => r.status === "inconclusive").length,
+    warn: records.filter((r) => r.status === "warn").length,
+    skipped: records.filter((r) => r.status === "skipped").length,
+    total: records.length
+  };
+  const exit = summary.fail > 0 ? 1 : summary.total === 0 ? 2 : summary.inconclusive > 0 ? 69 : 0;
+  return Object.freeze({
+    version,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    checks: records,
+    summary,
+    exit
+  });
+}
+__name(buildReport, "buildReport");
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(() => resolve("sleep-done"), ms));
+}
+__name(sleep, "sleep");
+
+// src/commands/doctor.ts
+var VALID_CATEGORIES = [
+  "sandbox",
+  "providers",
+  "vault",
+  "telemetry",
+  "runtime",
+  "plugins",
+  "custom"
+];
+var HELP = `namzu doctor \u2014 health checks for the local Namzu environment
+
+Usage:
+  namzu doctor [options]
+
+Options:
+  --json                       Emit a machine-readable JSON report
+  --verbose                    Include stack traces on failures
+  --category <a,b,c>           Comma-separated category filter
+                               (sandbox, providers, vault, telemetry,
+                                runtime, plugins, custom)
+  --per-check-timeout <ms>     Per-check timeout (default 5000)
+  --wall-clock-timeout <ms>    Total wall-clock timeout (default 10000)
+  -h, --help                   Show this help
+
+Exit codes:
+  0   every check answered, and none of them failed
+  1   one or more checks reported \`fail\`
+  2   no checks registered (Namzu not configured here)
+  69  a check could not answer \u2014 it timed out, was aborted, or what it
+      reads threw. Separate from 0 because a report that did not manage
+      to look tells you nothing about the part it did look at, and
+      separate from 1 because nothing was established to have failed.
+  70  internal CLI error (sysexits EX_SOFTWARE)
+
+A \`skipped\` check does not affect the exit code: it means there was
+nothing here to check \u2014 an optional package absent, nothing configured
+yet \u2014 which is an ordinary state of a healthy machine.
+`;
+function parseArgs(args) {
+  let json = false;
+  let verbose = false;
+  let help = false;
+  let categories;
+  let perCheckTimeoutMs;
+  let wallClockTimeoutMs;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    switch (arg) {
+      case "--json":
+        json = true;
+        break;
+      case "--verbose":
+        verbose = true;
+        break;
+      case "-h":
+      case "--help":
+        help = true;
+        break;
+      case "--category": {
+        const value = args[++i];
+        if (!value) return { json, verbose, help, error: "--category requires a value" };
+        const parts = value.split(",").map((p) => p.trim()).filter(Boolean);
+        const invalid = parts.filter((p) => !VALID_CATEGORIES.includes(p));
+        if (invalid.length > 0) {
+          return {
+            json,
+            verbose,
+            help,
+            error: `unknown category: ${invalid.join(", ")} (valid: ${VALID_CATEGORIES.join(", ")})`
+          };
+        }
+        categories = parts;
+        break;
+      }
+      case "--per-check-timeout": {
+        const value = args[++i];
+        if (!value)
+          return {
+            json,
+            verbose,
+            help,
+            error: "--per-check-timeout requires a value"
+          };
+        const n = Number.parseInt(value, 10);
+        if (!Number.isFinite(n) || n <= 0) {
+          return {
+            json,
+            verbose,
+            help,
+            error: `--per-check-timeout must be a positive integer; got ${value}`
+          };
+        }
+        perCheckTimeoutMs = n;
+        break;
+      }
+      case "--wall-clock-timeout": {
+        const value = args[++i];
+        if (!value)
+          return {
+            json,
+            verbose,
+            help,
+            error: "--wall-clock-timeout requires a value"
+          };
+        const n = Number.parseInt(value, 10);
+        if (!Number.isFinite(n) || n <= 0) {
+          return {
+            json,
+            verbose,
+            help,
+            error: `--wall-clock-timeout must be a positive integer; got ${value}`
+          };
+        }
+        wallClockTimeoutMs = n;
+        break;
+      }
+      default:
+        return { json, verbose, help, error: `unknown option: ${arg}` };
+    }
+  }
+  return {
+    json,
+    verbose,
+    help,
+    categories,
+    perCheckTimeoutMs,
+    wallClockTimeoutMs
+  };
+}
+__name(parseArgs, "parseArgs");
+function statusGlyph(status) {
+  switch (status) {
+    case "pass":
+      return "\u2713";
+    case "fail":
+      return "\u2717";
+    case "inconclusive":
+      return "?";
+    case "warn":
+      return "!";
+    // The glyph `inconclusive` used to carry. It reads as "not applicable",
+    // which is what this status means and what that status never did — so
+    // the mark moves to the row it was describing all along, and the check
+    // that could not answer takes the question mark.
+    case "skipped":
+      return "\u2298";
+  }
+}
+__name(statusGlyph, "statusGlyph");
+function formatHumanReport(report, verbose) {
+  const lines = [];
+  lines.push(`namzu doctor \u2014 ${report.timestamp}`);
+  lines.push("");
+  const widestCategory = report.checks.reduce(
+    (w, c) => Math.max(w, c.category.length),
+    "category".length
+  );
+  for (const record of report.checks) {
+    const glyph = statusGlyph(record.status);
+    const category = record.category.padEnd(widestCategory);
+    const dur = `${record.durationMs}ms`;
+    const head = `  ${glyph} ${category}  ${record.id}  ${dur}`;
+    lines.push(head);
+    if (record.message) {
+      for (const line of record.message.split("\n")) lines.push(`     ${line}`);
+    }
+    if (record.remediation) {
+      const [first = "", ...rest] = record.remediation.split("\n");
+      lines.push(`     \u2192 ${first}`);
+      for (const line of rest) lines.push(`       ${line}`);
+    }
+  }
+  lines.push("");
+  const s = report.summary;
+  lines.push(
+    `  pass: ${s.pass}  fail: ${s.fail}  warn: ${s.warn}  inconc: ${s.inconclusive}  skipped: ${s.skipped}  total: ${s.total}`
+  );
+  lines.push(`  exit: ${report.exit}`);
+  if (report.exit === 69) {
+    lines.push("  (69: at least one check could not answer \u2014 see the ? rows above)");
+  }
+  if (verbose) {
+    const failed = report.checks.filter((c) => c.status === "fail");
+    if (failed.length > 0) {
+      lines.push("");
+      lines.push("Failures:");
+      for (const f of failed) {
+        lines.push(`  ${f.id}: ${f.message ?? "(no message)"}`);
+      }
+    }
+  }
+  return lines.join("\n");
+}
+__name(formatHumanReport, "formatHumanReport");
+async function runDoctorCommand(args, config = {}) {
+  const parsed = parseArgs(args);
+  if (parsed.error) {
+    process.stderr.write(`Error: ${parsed.error}
+
+${HELP}
+`);
+    return EXIT_USAGE;
+  }
+  if (parsed.help) {
+    process.stdout.write(`${HELP}
+`);
+    return 0;
+  }
+  const registry = createDoctorRegistry();
+  for (const check of builtInDoctorChecks) registry.register(check);
+  registry.register(sessionExportCheck(config));
+  const opts = {
+    registry,
+    version: CLI_VERSION,
+    categories: parsed.categories,
+    perCheckTimeoutMs: parsed.perCheckTimeoutMs,
+    wallClockTimeoutMs: parsed.wallClockTimeoutMs
+  };
+  const report = await runDoctor(opts);
+  if (parsed.json) {
+    process.stdout.write(`${JSON.stringify(report, null, 2)}
+`);
+  } else {
+    process.stdout.write(`${formatHumanReport(report, parsed.verbose)}
+`);
+  }
+  return report.exit;
+}
+__name(runDoctorCommand, "runDoctorCommand");
+var doctorCommand = {
+  name: "doctor",
+  description: "Run health checks against the local Namzu environment",
+  passThrough: true,
+  handler: /* @__PURE__ */ __name(async ({ rawArgs, ctx }) => runDoctorCommand(rawArgs, ctx.config), "handler")
+};
+
+export {
+  browserEngineCheck,
+  providerChainCheck,
+  credentialSourcesCheck,
+  providersRegisteredCheck,
+  cwdWritableCheck,
+  tmpdirWritableCheck,
+  sandboxPlatformCheck,
+  telemetryInstalledCheck,
+  vaultRegisteredCheck,
+  sandboxInstalledCheck,
+  filesInstalledCheck,
+  computerUseInstalledCheck,
+  browserInstalledCheck,
+  builtInDoctorChecks,
+  DoctorRegistry,
+  doctor,
+  createDoctorRegistry,
+  registerDoctorCheck,
+  runDoctor,
+  runDoctorCommand,
+  doctorCommand
+};
+//# sourceMappingURL=chunk-MH6KUKVV.js.map