@outerlayer/cli 0.2.0 → 0.4.0

package/dist/chunk-NYC54VBD.js

@@ -0,0 +1,1084 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { isLinkedRepository } from './chunk-3TT7RQYB.js';
+import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-5DLBAXY5.js';
+import { sanitizeTerminal } from './chunk-6Y63SXFO.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-G7FSV7JX.js';
+import { C } from './chunk-YRYMNBGQ.js';
+import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
+import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-WIOZAJ2W.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-UFFXNXLQ.js';
+import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
+import { findGitDirs } from './chunk-BJ3KTMDH.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, accessSync, constants, statSync, readdirSync } from 'fs';
+import { join, dirname } from 'path';
+import { execFileSync } from 'child_process';
+
+createRequire(import.meta.url);
+function manifestPath(home = homeFromEnv()) {
+  return join(home, ".outerlayer", "hooks-manifest.json");
+}
+function readManifestFile(home) {
+  try {
+    const parsed = JSON.parse(readFileSync(manifestPath(home), "utf8"));
+    if (parsed?.version !== 1) {
+      return { manifest: null, newerVersion: typeof parsed?.version === "number" && parsed.version > 1 };
+    }
+    return {
+      manifest: {
+        version: 1,
+        installs: parsed.installs ?? {},
+        wrapped: parsed.wrapped ?? {},
+        statusline: parsed.statusline ?? {}
+      },
+      newerVersion: false
+    };
+  } catch {
+    return { manifest: null, newerVersion: false };
+  }
+}
+function readManifest(home = homeFromEnv()) {
+  return readManifestFile(home).manifest;
+}
+function writeManifest(home, manifest) {
+  const path = manifestPath(home);
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, JSON.stringify(manifest, null, 2) + "\n", { mode: 384 });
+    renameSync(tmp, path);
+  } catch {
+  }
+}
+function emptyManifest() {
+  return { version: 1, installs: {}, wrapped: {}, statusline: {} };
+}
+function withoutUpdatedAt(manifest) {
+  return JSON.parse(JSON.stringify(manifest), (key, value) => key === "updatedAt" ? void 0 : value);
+}
+function updateManifest(home, opts, mutate) {
+  const { manifest, newerVersion } = readManifestFile(home);
+  if (newerVersion) return;
+  if (!manifest && !opts.createIfMissing) return;
+  const next = manifest ?? emptyManifest();
+  const before = JSON.stringify(next);
+  mutate(next);
+  if (manifest && JSON.stringify(withoutUpdatedAt(next)) === JSON.stringify(withoutUpdatedAt(JSON.parse(before)))) return;
+  writeManifest(home, next);
+}
+function recordInstall(home, settingsPath2, record, now = Date.now) {
+  updateManifest(home, { createIfMissing: true }, (manifest) => {
+    manifest.installs[settingsPath2] = {
+      cliBin: record.cliBin,
+      events: [...record.events],
+      updatedAt: new Date(now()).toISOString()
+    };
+  });
+}
+function recordRemoval(home, settingsPath2) {
+  updateManifest(home, { createIfMissing: false }, (manifest) => {
+    delete manifest.installs[settingsPath2];
+    delete manifest.wrapped[settingsPath2];
+    delete manifest.statusline[settingsPath2];
+  });
+}
+function recordWrapped(home, settingsPath2, wrapped, now = Date.now) {
+  if (wrapped.length === 0) return;
+  updateManifest(home, { createIfMissing: true }, (manifest) => {
+    const existing = manifest.wrapped[settingsPath2] ?? [];
+    const at = new Date(now()).toISOString();
+    for (const w of wrapped) {
+      if (existing.some((e) => e.event === w.event && e.original === w.original)) continue;
+      existing.push({ event: w.event, original: w.original, updatedAt: at });
+    }
+    manifest.wrapped[settingsPath2] = existing;
+  });
+}
+function recordUnwrapped(home, settingsPath2) {
+  updateManifest(home, { createIfMissing: false }, (manifest) => {
+    delete manifest.wrapped[settingsPath2];
+  });
+}
+function recordStatusline(home, settingsPath2, outcome, original, now = Date.now) {
+  updateManifest(home, { createIfMissing: true }, (manifest) => {
+    manifest.statusline[settingsPath2] = {
+      outcome,
+      ...original !== void 0 ? { original } : {},
+      updatedAt: new Date(now()).toISOString()
+    };
+  });
+}
+var LAPTOP_CHECKS_NOT_APPLICABLE = {
+  name: "Laptop checks",
+  status: "skipped",
+  detail: "this is a runner host, which runs builds and no sessions of its own, so the Claude Code home, transcripts, hooks, spool, daemon and status line do not apply"
+};
+function runDoctor(env = {}) {
+  const home = env.home ?? homeFromEnv();
+  const now = env.now ?? Date.now;
+  const laptop = env.runnerHost !== true;
+  const transcripts = laptop ? scanTranscripts(home) : void 0;
+  return [
+    ...laptop ? [checkClaudeDir(home), checkTranscripts(transcripts, now), ...checkHooks(home, env.cwd, transcripts, now)] : [LAPTOP_CHECKS_NOT_APPLICABLE],
+    ...checkDeadHooksState(env.cwd),
+    ...laptop ? [checkSpoolWritable(home)] : [],
+    checkLastSync(home, now),
+    ...laptop ? [checkDaemon(home)] : [],
+    checkCleanupPeriod(home),
+    checkDiskHeadroom(home),
+    checkClaudeVersion(env),
+    checkSettingsValid(home, env.cwd),
+    ...laptop ? checkStatusline(home, now, env.cwd) : [],
+    ...checkInstalls(env),
+    ...checkContextSource(home, env.cwd),
+    ...checkInstalledCli(home, env.cwd ?? process.cwd())
+  ];
+}
+function checkInstalledCli(home, cwd) {
+  const name = "Installed CLI";
+  const result = checkInstalledCliStaleness({ home, cwd });
+  if (result === null) return [];
+  const installedLabel = result.installedId !== null ? sanitizeForContext(result.installedId) : "unknown";
+  const workspaceLabel = result.workspaceId !== null ? sanitizeForContext(result.workspaceId) : null;
+  const at = result.workspaceDistDir !== null ? ` at ${sanitizeForContext(workspaceRootOf(result.workspaceDistDir))}` : "";
+  if (result.stale) {
+    return [
+      {
+        name,
+        status: "warn",
+        detail: `installed copy (${installedLabel}) is behind the workspace build${at} (${workspaceLabel})`,
+        fix: installedCliFix(result.workspaceDistDir, result.workspaceRootTrusted)
+      }
+    ];
+  }
+  if (workspaceLabel === null) {
+    const detail = result.ambiguousWorkspace ? `installed (${installedLabel}) \u2014 more than one candidate workspace build found nearby; refusing to guess which one to compare against` : `installed (${installedLabel}) \u2014 no workspace build to compare (comparison needs a nearby checkout with a stamped build)`;
+    return [{ name, status: "pass", detail }];
+  }
+  if (result.unorderable) {
+    return [
+      {
+        name,
+        status: "pass",
+        detail: `installed (${installedLabel}) differs from the workspace build${at} (${workspaceLabel}) \u2014 build order could not be established`
+      }
+    ];
+  }
+  if (result.installedAhead) {
+    return [{ name, status: "pass", detail: `installed (${installedLabel}) is ahead of the workspace build${at} (${workspaceLabel})` }];
+  }
+  if (result.installedId !== result.workspaceId) {
+    return [{ name, status: "pass", detail: `installed (${installedLabel}) differs from the workspace build${at} (${workspaceLabel})` }];
+  }
+  return [{ name, status: "pass", detail: `matches the workspace build${at} (${installedLabel})` }];
+}
+function installedCliFix(workspaceDistDir, trusted) {
+  const command = refreshCommand(workspaceDistDir, trusted);
+  if (command) return `Refresh it: ${command}`;
+  const root = sanitizeForContext(workspaceRootOf(workspaceDistDir));
+  return `Workspace build found at ${root}. Rebuild it (yarn workspace @outerlayer/cli build) and copy packages/cli/dist to ~/.outerlayer/cli/dist to refresh the installed copy.`;
+}
+function checkStatusline(home, now, cwd) {
+  const name = "Status line";
+  let installed = false;
+  let wrapping;
+  let foreign;
+  for (const scope of ["user", "project"]) {
+    let settings;
+    try {
+      settings = readSettings(settingsPath(scope, { home, cwd }));
+    } catch {
+      continue;
+    }
+    const slot = settings?.statusLine;
+    if (!slot || typeof slot !== "object") continue;
+    if (isOurStatuslineSlot(slot)) {
+      installed = true;
+      const original = statuslineWrappedOriginal(slot);
+      if (original !== null) wrapping = original;
+      break;
+    }
+    if (typeof slot.command === "string") foreign = slot.command;
+  }
+  if (!installed) {
+    const manifest = readManifest(home);
+    const record = ["user", "project"].map((scope) => manifest?.statusline[settingsPath(scope, { home, cwd })]).find((r) => r !== void 0);
+    if (record) {
+      return [{
+        name,
+        status: "warn",
+        detail: `the OuterLayer segment was installed (recorded ${record.updatedAt}) but the slot no longer holds it \u2014 settings were rewritten or reset${record.original !== void 0 ? `; it wrapped: ${record.original}` : ""}`,
+        fix: "Run `outerlayer init` to reinstall the segment."
+      }];
+    }
+    return [
+      foreign !== void 0 ? { name, status: "warn", detail: `slot occupied by: ${foreign}`, fix: "Run `outerlayer init` to add the OuterLayer segment (wraps the existing command, never replaces it)." } : { name, status: "warn", detail: "not installed", fix: "Run `outerlayer init`." }
+    ];
+  }
+  const checks = [
+    { name, status: "pass", detail: wrapping ? `installed, wrapping: ${wrapping}` : "installed" }
+  ];
+  const stateName = "Status-line state";
+  const state = readStatuslineState(home);
+  if (!state) {
+    checks.push({ name: stateName, status: "warn", detail: "no state file \u2014 line runs degraded (session cost only)", fix: "Start `outerlayer daemon` (it maintains this file)." });
+    return checks;
+  }
+  const age = now() - Date.parse(state.generatedAt);
+  if (!Number.isFinite(age) || age > STATE_FRESH_MS) {
+    checks.push({ name: stateName, status: "warn", detail: `state ${formatAgo(age)} \u2014 line runs degraded`, fix: "Restart `outerlayer daemon`." });
+    return checks;
+  }
+  checks.push({ name: stateName, status: "pass", detail: `fresh (${formatAgo(age)})` });
+  return checks;
+}
+function checkClaudeDir(home) {
+  const dir = join(home, ".claude");
+  return existsSync(dir) ? { name: "Claude Code home", status: "pass", detail: dir } : { name: "Claude Code home", status: "fail", detail: `${dir} not found`, fix: "Install Claude Code, then run a session so transcripts exist." };
+}
+function scanTranscripts(home) {
+  const root = join(home, ".claude", "projects");
+  let count = 0;
+  let newest = 0;
+  if (!existsSync(root)) return { exists: false, count, newest };
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const p = join(dir, entry.name);
+      if (!entry.isDirectory() && !entry.isSymbolicLink() && !entry.name.endsWith(".jsonl")) continue;
+      let st;
+      try {
+        st = statSync(p);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) walk(p);
+      else if (entry.name.endsWith(".jsonl") && st.size > 0) {
+        count += 1;
+        if (st.mtimeMs > newest) newest = st.mtimeMs;
+      }
+    }
+  };
+  walk(root);
+  return { exists: true, count, newest };
+}
+function checkTranscripts(transcripts, now) {
+  if (!transcripts.exists) {
+    return { name: "Transcripts", status: "warn", detail: "no projects directory yet", fix: "Run a Claude Code session, then re-check." };
+  }
+  if (transcripts.count === 0) {
+    return { name: "Transcripts", status: "warn", detail: "0 transcripts found", fix: "Run a Claude Code session, then run `outerlayer doctor` again." };
+  }
+  const age = formatAgeH(now() - transcripts.newest);
+  return { name: "Transcripts", status: "pass", detail: `${transcripts.count} transcripts, newest ${age}` };
+}
+function formatAgeH(ms) {
+  const ageH = ms / 36e5;
+  return ageH < 1 ? "<1h ago" : ageH < 48 ? `${Math.round(ageH)}h ago` : `${Math.round(ageH / 24)}d ago`;
+}
+var HOOK_FIRING_GAP_MS = 24 * 60 * 60 * 1e3;
+function newestHookFiring(home) {
+  let newest = null;
+  for (const event of REGISTERED_EVENTS) {
+    try {
+      const ms = statSync(hookFiredMarkerPath(event, home)).mtimeMs;
+      if (newest === null || ms > newest) newest = ms;
+    } catch {
+    }
+  }
+  return newest;
+}
+function checkHooks(home, cwd, transcripts, now) {
+  const lastFired = newestHookFiring(home);
+  const firingFresh = lastFired !== null && transcripts.count > 0 && transcripts.newest - lastFired <= HOOK_FIRING_GAP_MS;
+  const checks = [checkHooksInstalled(home, cwd, firingFresh)];
+  const firing = checkHooksFiring(transcripts, lastFired, now);
+  if (firing) checks.push(firing);
+  const wrapped = checkWrappedHooks(home, cwd);
+  if (wrapped) checks.push(wrapped);
+  return checks;
+}
+function isExecutable(path) {
+  if (process.platform === "win32") return true;
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function checkHooksInstalled(home, cwd, firingFresh) {
+  const name = "Hooks installed";
+  const readablePaths = [];
+  for (const scope of ["user", "project"]) {
+    const path = settingsPath(scope, { home, cwd });
+    let settings;
+    try {
+      settings = readSettings(path);
+    } catch {
+      continue;
+    }
+    readablePaths.push(path);
+    if (!settings?.hooks) continue;
+    const installed = REGISTERED_EVENTS.filter(
+      (event) => (settings.hooks?.[event] ?? []).some((b) => (b.hooks ?? []).some(isOurHookCommand))
+    );
+    if (installed.length === REGISTERED_EVENTS.length) {
+      const missing = ourCommandBins(settings).filter((bin) => !cliBinResolvable(bin));
+      if (missing.length > 0) {
+        return {
+          name,
+          status: "fail",
+          detail: `hooks in ${path} run ${missing.join(", ")}, which no longer exists \u2014 no session is being captured`,
+          fix: "Run `outerlayer init` to reinstall."
+        };
+      }
+      const unexecutable = ourDirectScriptBins(settings).filter((bin) => !isExecutable(bin));
+      if (unexecutable.length > 0) {
+        return {
+          name,
+          status: "fail",
+          detail: `hooks in ${path} run ${unexecutable.join(", ")} directly, and it is not executable \u2014 every hook fails with "Permission denied" and no session is linked to its work item`,
+          fix: "Run `outerlayer init` to rewrite the hooks so they run through node."
+        };
+      }
+      return { name, status: "pass", detail: `${installed.join(", ")} (${scope})` };
+    }
+    if (installed.length > 0) {
+      return { name, status: "warn", detail: `only ${installed.join(", ")} installed`, fix: "Run `outerlayer init` to (re)install all lifecycle hooks." };
+    }
+  }
+  const manifest = readManifest(home);
+  const recorded = readablePaths.find((p) => manifest?.installs[p]);
+  if (recorded) {
+    const record = manifest.installs[recorded];
+    return {
+      name,
+      status: "fail",
+      detail: `hooks were installed into ${recorded} (recorded ${record.updatedAt}) but the settings file no longer contains them \u2014 it was rewritten or reset`,
+      fix: "Run `outerlayer init` to reinstall."
+    };
+  }
+  if (firingFresh) {
+    return { name, status: "pass", detail: "not in user/project settings, but hooks are firing \u2014 installed in another scope (managed settings?)" };
+  }
+  return { name, status: "fail", detail: "no OuterLayer hooks found", fix: "Run `outerlayer init`." };
+}
+function checkWrappedHooks(home, cwd) {
+  const manifest = readManifest(home);
+  if (!manifest) return null;
+  const missing = [];
+  for (const scope of ["user", "project"]) {
+    const path = settingsPath(scope, { home, cwd });
+    const records = manifest.wrapped[path];
+    if (!records || records.length === 0) continue;
+    let settings;
+    try {
+      settings = readSettings(path);
+    } catch {
+      continue;
+    }
+    const present = /* @__PURE__ */ new Set();
+    const hooks = settings?.hooks ?? {};
+    for (const event of Object.keys(hooks)) {
+      for (const block of hooks[event] ?? []) {
+        for (const h of block.hooks ?? []) {
+          const original = wrappedOriginalCommand(h);
+          if (original !== null) present.add(`${event}\0${original}`);
+        }
+      }
+    }
+    for (const r of records) {
+      if (!present.has(`${r.event}\0${r.original}`)) missing.push(`${r.event}: ${r.original}`);
+    }
+  }
+  if (missing.length === 0) return null;
+  return {
+    name: "Wrapped hooks",
+    status: "warn",
+    detail: `recorded as wrapped but the settings no longer carry the wrapped form \u2014 ${missing.join("; ")}`,
+    fix: "Run `outerlayer hooks wrap` to re-wrap, or `outerlayer hooks unwrap` if the wrap is no longer wanted."
+  };
+}
+function checkHooksFiring(transcripts, lastFired, now) {
+  const name = "Hooks firing";
+  if (transcripts.count === 0) return null;
+  if (lastFired === null) {
+    return {
+      name,
+      status: "warn",
+      detail: "no firing evidence recorded yet \u2014 every hook run writes a marker, and none exists",
+      fix: "Start a Claude Code session, then re-run doctor."
+    };
+  }
+  if (transcripts.newest - lastFired > HOOK_FIRING_GAP_MS) {
+    return {
+      name,
+      status: "fail",
+      detail: `sessions as recent as ${formatAgeH(now() - transcripts.newest)}, but no lifecycle hook has fired since ${formatAgeH(now() - lastFired)}`,
+      fix: "Hooks are configured but not running \u2014 run `outerlayer init` and check `claude --debug` hook output."
+    };
+  }
+  return { name, status: "pass", detail: `last fired ${formatAgeH(now() - lastFired)}` };
+}
+function checkDeadHooksState(cwd) {
+  const dir = cwd ?? process.cwd();
+  const state = deadHooksState(dir);
+  if (state.hooksDir === void 0) return [];
+  const name = "Git hooks directory";
+  if (state.unreadableError) {
+    return [
+      {
+        name,
+        status: "fail",
+        detail: `${sanitizeForContext(state.hooksDir)} could not be read (${state.unreadableError.code ?? state.unreadableError.message}) \u2014 git's hooks status is unknown, not confirmed healthy`,
+        fix: "Fix the directory's permissions so it can be listed, then re-run `outerlayer doctor`."
+      }
+    ];
+  }
+  if (!state.dead) {
+    return [{ name, status: "pass", detail: `hooks present at ${sanitizeForContext(state.hooksDir)}` }];
+  }
+  const fix = `Run \`${preparePackageManagerCommand(state.repoRoot ?? dir)}\` to (re)generate the hooks directory.`;
+  return [
+    {
+      name,
+      status: "fail",
+      detail: `${sanitizeForContext(state.hooksDir)} is missing or empty \u2014 core.hooksPath points at a dead directory, so git runs no hooks at all`,
+      fix
+    }
+  ];
+}
+function checkSpoolWritable(home) {
+  const dir = spoolDir(home);
+  try {
+    if (!existsSync(dir)) return { name: "Spool writable", status: "warn", detail: "spool not created yet", fix: "Run `outerlayer init` (creates the spool on first hook)." };
+    accessSync(dir, constants.W_OK);
+    return { name: "Spool writable", status: "pass", detail: dir };
+  } catch {
+    return { name: "Spool writable", status: "fail", detail: `${dir} not writable`, fix: "Fix permissions on ~/.outerlayer/spool." };
+  }
+}
+function checkLastSync(home, now) {
+  const name = "Cloud sync";
+  if (!existsSync(join(home, ".outerlayer", "config.json"))) {
+    return { name, status: "warn", detail: "not configured \u2014 sessions stay on this machine", fix: "Run `outerlayer login` to connect." };
+  }
+  const health = assessSyncHealth(readSyncStatus(home), now(), SYNC_STALE_AFTER_MS);
+  const detail = [health.headline, ...health.details].join("; ");
+  if (health.level === "error") {
+    return { name, status: "fail", detail, fix: "Check the destination and API key in ~/.outerlayer/config.json, then run `outerlayer sync` to see the full error." };
+  }
+  if (health.level === "warn" || health.level === "unknown") {
+    return { name, status: "warn", detail, fix: "Run `outerlayer sync` to confirm the connection works." };
+  }
+  return { name, status: "pass", detail };
+}
+function checkDaemon(home) {
+  const pidfile = join(home, ".outerlayer", "daemon.pid");
+  const heartbeat = join(home, ".outerlayer", "daemon.heartbeat");
+  if (!existsSync(pidfile)) {
+    return { name: "Daemon running", status: "warn", detail: "not running", fix: "Start it with `outerlayer daemon` (or a login agent)." };
+  }
+  try {
+    const beatMs = statSync(heartbeat).mtimeMs;
+    const staleMin = (Date.now() - beatMs) / 6e4;
+    if (staleMin > 30) {
+      return { name: "Daemon running", status: "warn", detail: `heartbeat ${Math.round(staleMin)}m stale`, fix: "Restart `outerlayer daemon`." };
+    }
+    return { name: "Daemon running", status: "pass", detail: "heartbeat fresh" };
+  } catch {
+    return { name: "Daemon running", status: "warn", detail: "pidfile present, no heartbeat", fix: "Restart `outerlayer daemon`." };
+  }
+}
+function checkCleanupPeriod(home) {
+  const path = join(home, ".claude", "settings.json");
+  let settings;
+  try {
+    settings = readSettings(path);
+  } catch {
+    return { name: "Retention (cleanupPeriodDays)", status: "warn", detail: "settings unreadable" };
+  }
+  const raw = settings?.cleanupPeriodDays;
+  const days = typeof raw === "number" ? raw : 30;
+  if (days === 0) {
+    return {
+      name: "Retention (cleanupPeriodDays)",
+      status: "fail",
+      detail: "set to 0 \u2014 this DISABLES transcript persistence (upstream anthropics/claude-code#23710 and #59248)",
+      fix: "Remove cleanupPeriodDays or set it \u226514; run `outerlayer daemon` to mirror before deletion."
+    };
+  }
+  if (days < 14) {
+    return { name: "Retention (cleanupPeriodDays)", status: "warn", detail: `${days}d \u2014 transcripts deleted quickly`, fix: "Run `outerlayer daemon` so raws are mirrored before cleanup." };
+  }
+  return { name: "Retention (cleanupPeriodDays)", status: "pass", detail: `${days}d` };
+}
+function checkDiskHeadroom(home) {
+  try {
+    accessSync(home, constants.W_OK);
+    return { name: "Disk headroom", status: "pass", detail: "home writable (raw mirror capped at 5 GiB, LRU)" };
+  } catch {
+    return { name: "Disk headroom", status: "fail", detail: "home not writable", fix: "Free space / fix permissions on your home directory." };
+  }
+}
+function checkClaudeVersion(env) {
+  let version;
+  try {
+    version = (env.claudeVersion ?? defaultClaudeVersion)();
+  } catch {
+    return { name: "Claude Code version", status: "warn", detail: "could not run `claude --version`", fix: "Ensure `claude` is on PATH." };
+  }
+  const parsed = version.match(/\d+\.\d+\.\d+/)?.[0];
+  if (!parsed) return { name: "Claude Code version", status: "warn", detail: `unrecognized: ${version}` };
+  if (compareVersions(parsed, SUPPORTED_VERSIONS.max) > 0) {
+    return { name: "Claude Code version", status: "warn", detail: `${parsed} is newer than validated (${SUPPORTED_VERSIONS.max}) \u2014 parser runs best-effort`, fix: "Update OuterLayer if you see parse warnings." };
+  }
+  if (compareVersions(parsed, SUPPORTED_VERSIONS.min) < 0) {
+    return { name: "Claude Code version", status: "warn", detail: `${parsed} is older than validated (${SUPPORTED_VERSIONS.min})` };
+  }
+  return { name: "Claude Code version", status: "pass", detail: parsed };
+}
+function checkSettingsValid(home, cwd) {
+  for (const scope of ["user", "project"]) {
+    const path = settingsPath(scope, { home, cwd });
+    if (!existsSync(path)) continue;
+    try {
+      readSettings(path);
+    } catch (err) {
+      return { name: "Settings JSON valid", status: "fail", detail: `${path} is corrupt`, fix: err instanceof Error ? err.message : "Fix the JSON syntax." };
+    }
+  }
+  return { name: "Settings JSON valid", status: "pass", detail: "all settings files parse" };
+}
+function checkInstalls(env) {
+  let installs;
+  try {
+    installs = (env.claudeInstalls ?? defaultClaudeInstalls)();
+  } catch {
+    return [];
+  }
+  if (installs.length > 1) {
+    return [{ name: "Claude Code installs", status: "warn", detail: `multiple found: ${installs.join(", ")}`, fix: "Multiple installs can diverge in version; keep one." }];
+  }
+  return [];
+}
+function defaultClaudeVersion() {
+  return execFileSync("claude", ["--version"], { encoding: "utf8", timeout: 5e3 }).trim();
+}
+function defaultClaudeInstalls() {
+  try {
+    const out = execFileSync(process.platform === "win32" ? "where" : "which", ["-a", "claude"], { encoding: "utf8", timeout: 5e3 });
+    return out.split(/\r?\n/).filter((l) => l.trim().length > 0);
+  } catch {
+    return [];
+  }
+}
+function contextDegradedFix(kind) {
+  switch (kind) {
+    case "unreachable":
+      return "Check network/VPN access to the control plane, then run `outerlayer context materialize`.";
+    case "no-access":
+      return "Check your git credentials (SSH key or token) and org/SSO access to the control plane, then retry.";
+    case "designation-unverified":
+      return "Check OuterLayer cloud connectivity/config (~/.outerlayer/config.json), then run `outerlayer context materialize`.";
+    case "not-governed":
+      return "Expected if the control plane's `governs` list changed intentionally; otherwise re-designate the source.";
+    case "adoption-conflict":
+      return "Remove the committed AGENTS.md/.claude/.outerlayer files in a commit, then run `outerlayer context materialize`.";
+    case "conflict":
+      return "Revoke the designation from all but one of the claiming factories, then run `outerlayer context materialize`.";
+  }
+}
+function checkContextSource(home, cwd) {
+  const dir = cwd ?? process.cwd();
+  let repoRoot;
+  let gitCommonDir;
+  try {
+    repoRoot = execFileSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 2e3
+    }).trim();
+    gitCommonDir = execFileSync("git", ["-C", dir, "rev-parse", "--path-format=absolute", "--git-common-dir"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 2e3
+    }).trim();
+  } catch {
+    return [];
+  }
+  if (!repoRoot || !gitCommonDir) return [];
+  const pin = readPin(repoRoot);
+  const manifest = readContextManifest(gitCommonDir);
+  const degraded = readDegraded(gitCommonDir);
+  const sourceCache = readSourceCache(gitCommonDir);
+  const looksGoverned = pin !== void 0 || sourceCache?.status === "governed";
+  if (!pin && !manifest && !degraded && !looksGoverned) return [];
+  const checks = [];
+  const name = "Context source";
+  if (pin && manifest && pin.sha !== manifest.sha) {
+    checks.push({
+      name,
+      status: "warn",
+      detail: `pin (${pin.sha.slice(0, 7)}) and manifest (${manifest.sha.slice(0, 7)}) disagree`,
+      fix: "Run `outerlayer context materialize` to reconcile."
+    });
+  } else if (pin ?? manifest) {
+    const sha = (pin ?? manifest).sha;
+    checks.push({ name, status: degraded ? "warn" : "pass", detail: `materialized at ${sha.slice(0, 7)}` });
+  }
+  if (degraded) {
+    checks.push({
+      name: "Context source degradation",
+      status: degraded.kind === "adoption-conflict" || degraded.kind === "conflict" ? "fail" : "warn",
+      detail: degraded.message,
+      fix: contextDegradedFix(degraded.kind)
+    });
+  }
+  if ((pin || manifest) && !contextExcludesPresent(gitCommonDir)) {
+    checks.push({
+      name: "Context exclude block",
+      status: "warn",
+      detail: "materialized paths are not excluded in .git/info/exclude",
+      fix: "Run `outerlayer context materialize` to repair it."
+    });
+  }
+  if (pin && !readCloudConfig(home).url) {
+    checks.push({
+      name,
+      status: "warn",
+      detail: "a pin exists but OuterLayer cloud sync isn't configured \u2014 the designation cannot be confirmed",
+      fix: "Run `outerlayer login` to connect."
+    });
+  }
+  if (looksGoverned) {
+    let tracked = "";
+    try {
+      tracked = execFileSync("git", ["-C", repoRoot, "ls-files", "--", "AGENTS.md", ".claude", ".outerlayer"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 2e3
+      }).trim();
+    } catch {
+      tracked = "";
+    }
+    if (tracked) {
+      const paths = tracked.split("\n");
+      const sample = paths.slice(0, 3).join(", ") + (paths.length > 3 ? ", \u2026" : "");
+      checks.push({
+        name,
+        status: "fail",
+        detail: `committed context files shadow the control plane: ${sample}`,
+        fix: "Remove the committed AGENTS.md/.claude/.outerlayer files in a commit, then run `outerlayer context materialize`."
+      });
+    }
+  }
+  return checks;
+}
+var PROTECT_DEFAULT_BRANCH_DOCS = "https://docs.outerlayer.ai/github-app-and-build-tokens#protect-the-default-branch";
+var CONNECT_REPOSITORY_DOCS = "https://docs.outerlayer.ai/connect-repository";
+var REPOSITORY_ACCESS_TIMEOUT_MS = 3e4;
+async function githubAppChecks(options = {}) {
+  let credentials;
+  try {
+    credentials = resolveCredentials({ home: options.home, env: options.env });
+  } catch {
+    return [];
+  }
+  const fetchImpl = options.fetchImpl ?? defaultFetch;
+  const bounded = (input, init) => fetchImpl(input, { ...init, signal: AbortSignal.timeout(REPOSITORY_ACCESS_TIMEOUT_MS) });
+  let data;
+  try {
+    ({ data } = await getJson(credentials.url, "/v1/repositories/access", credentials.apiKey, credentials.appId, bounded));
+  } catch (err) {
+    return [githubAppRefusalCheck(err)];
+  }
+  if (!Array.isArray(data)) {
+    return [{ name: "GitHub App", status: "warn", detail: "the gateway's answer listed no repositories", fix: "Update the outerlayer CLI and the gateway to the same release." }];
+  }
+  if (data.length === 0) {
+    return [{ name: "GitHub App", status: "pass", detail: "the factory has no connected repositories" }];
+  }
+  return data.map(repositoryAccessCheck);
+}
+function githubAppRefusalCheck(err) {
+  const name = "GitHub App";
+  const code = err instanceof WorkCommandError ? err.code : void 0;
+  if (code === "repository_tokens_unavailable") {
+    return { name, status: "pass", detail: "the gateway has no GitHub App configured, so there is nothing to check" };
+  }
+  if (code === "git_connection_missing") {
+    return {
+      name,
+      status: "warn",
+      detail: "the factory has no GitHub App installation",
+      fix: `Connect a repository: ${CONNECT_REPOSITORY_DOCS}`
+    };
+  }
+  const message = sanitizeTerminal(err instanceof Error ? err.message : String(err));
+  if (err instanceof WorkCommandError && err.status === 403) {
+    return { name, status: "warn", detail: `the key cannot read the factory's repositories: ${message}`, fix: "Use a key that holds git.read." };
+  }
+  return { name, status: "warn", detail: `could not read the factory's repositories: ${message}`, fix: "Run `outerlayer doctor` again; check the gateway URL in ~/.outerlayer/config.json." };
+}
+function describeMissing(missing) {
+  const held = missing.granted === null ? "not granted" : `has ${sanitizeTerminal(missing.granted)}`;
+  const app = missing.requestedByApp === false ? "; the App does not request it" : "";
+  return `${sanitizeTerminal(missing.permission)}: ${sanitizeTerminal(missing.required)} (${held}${app})`;
+}
+function nameMissing(missing) {
+  return missing.map((m) => `${sanitizeTerminal(m.permission)}: ${sanitizeTerminal(m.required)}`).join(", ");
+}
+function missingPermissionFixes(missing, settingsUrl) {
+  const notRequested = missing.filter((m) => m.requestedByApp === false);
+  const requested = missing.filter((m) => m.requestedByApp === true);
+  const unknown = missing.filter((m) => typeof m.requestedByApp !== "boolean");
+  const fixes = [];
+  if (notRequested.length > 0) {
+    fixes.push(
+      `The GitHub App's own settings must add ${nameMissing(notRequested)}; there is nothing for an owner to accept until they do.`
+    );
+  }
+  if (requested.length > 0) {
+    fixes.push(`An owner of the installation accepts ${nameMissing(requested)} at ${settingsUrl}.`);
+  } else if (unknown.length === 0) {
+    fixes.push(`Then an owner of the installation accepts them at ${settingsUrl}.`);
+  }
+  if (unknown.length > 0) {
+    fixes.push(
+      `If the GitHub App's own settings do not request ${nameMissing(unknown)}, add them there first. Then an owner of the installation accepts them at ${settingsUrl}.`
+    );
+  }
+  return fixes;
+}
+function repositoryAccessCheck(access) {
+  const name = `GitHub App: ${sanitizeTerminal(access.repository)}`;
+  const settingsUrl = sanitizeTerminal(access.installationSettingsUrl);
+  if (!access.inInstallation) {
+    return {
+      name,
+      status: "warn",
+      detail: "the GitHub App installation does not include this repository",
+      fix: `Add the repository to the installation: ${settingsUrl}`
+    };
+  }
+  const branch = sanitizeTerminal(access.defaultBranch ?? "the default branch");
+  const problems = [];
+  const fixes = [];
+  if (access.missingPermissions.length > 0) {
+    problems.push(`the installation has not accepted ${access.missingPermissions.map(describeMissing).join(", ")}`);
+    fixes.push(...missingPermissionFixes(access.missingPermissions, settingsUrl));
+  }
+  if (access.requiresPullRequest === false) {
+    problems.push(`${branch} does not require a pull request, so a build's push token can write to it directly`);
+    fixes.push(`Require a pull request on ${branch} and keep CI secrets in protected environments: ${PROTECT_DEFAULT_BRANCH_DOCS}`);
+  }
+  if (problems.length > 0) {
+    return { name, status: "warn", detail: problems.join("; "), fix: fixes.join(" ") };
+  }
+  const pullRequest = access.requiresPullRequest === true ? `${branch} requires a pull request` : `GitHub would not say whether ${branch} requires a pull request`;
+  return { name, status: "pass", detail: `every permission builds need is accepted; ${pullRequest}` };
+}
+var CREDENTIAL_CHECK_TIMEOUT_MS = 15e3;
+var LOGIN_FIX = "Run `outerlayer login` to sign in again.";
+var CONNECT_FIX = "Run `outerlayer connect` to choose a factory for this repository.";
+var SETUP_PANEL_FIX = "Link the repository on the factory's setup panel in the dashboard.";
+var MINT_KEY_FIX = "Mint a key for a factory that exists: dashboard \u2192 Settings \u2192 API keys.";
+async function askGateway(fetchImpl, url, path, credential, appId) {
+  const headers = { authorization: `Bearer ${credential}` };
+  if (appId !== void 0) headers["x-outerlayer-app-id"] = appId;
+  try {
+    const res = await fetchImpl(`${url.replace(/\/+$/, "")}${path}`, {
+      method: "GET",
+      headers,
+      signal: AbortSignal.timeout(CREDENTIAL_CHECK_TIMEOUT_MS)
+    });
+    return { status: res.status, body: await res.json().catch(() => void 0) };
+  } catch (err) {
+    return { failure: sanitizeTerminal(err instanceof Error ? err.message : String(err)) };
+  }
+}
+function unansweredDetail(reply) {
+  if ("failure" in reply) return `the gateway did not answer: ${reply.failure}`;
+  const { status, body } = reply;
+  if (status === 408 || status === 429 || status >= 500) return `the gateway did not answer (HTTP ${status})`;
+  if (status >= 200 && status < 300 && body === void 0) return `the gateway did not answer with JSON (HTTP ${status})`;
+  return void 0;
+}
+function refusalMessage(body) {
+  const message = body?.error?.message;
+  return typeof message === "string" ? sanitizeTerminal(message) : "";
+}
+var NETWORK_FIX = "Check the network and the gateway address, then run `outerlayer doctor` again.";
+var UPDATE_FIX = "Update the outerlayer CLI and the gateway to the same release.";
+var skippedCheck = (name, detail, fix) => ({ name, status: "skipped", detail, ...fix ? { fix } : {} });
+function withSkippedRest(first, reason) {
+  return [first, skippedCheck("Factory", reason), skippedCheck("Repository", reason)];
+}
+function parseListedFactories(body) {
+  const rows = body?.data;
+  if (!Array.isArray(rows)) return void 0;
+  const out = [];
+  for (const row of rows) {
+    const org = row?.organization;
+    if (typeof row?.id !== "string" || typeof row.name !== "string" || typeof org?.name !== "string") return void 0;
+    out.push({
+      id: row.id,
+      name: sanitizeTerminal(row.name),
+      organization: sanitizeTerminal(org.name),
+      linked: typeof row.linked === "boolean" ? row.linked : null
+    });
+  }
+  return out;
+}
+var factorySlug = (f) => `${f.organization}/${f.name}`;
+async function loginChecks(fetchImpl, url, token, appId, local, inRepository) {
+  const query = local === void 0 ? "" : `?${new URLSearchParams({ repository: local }).toString()}`;
+  const reply = await askGateway(fetchImpl, url, `/v1/me/factories${query}`, token);
+  const name = "Login";
+  const unanswered = unansweredDetail(reply);
+  if (unanswered !== void 0) {
+    return withSkippedRest({ name, status: "warn", detail: unanswered, fix: NETWORK_FIX }, "the login check did not finish");
+  }
+  const { status, body } = reply;
+  if (status === 401) {
+    return withSkippedRest({ name, status: "fail", detail: "the gateway refused the saved login", fix: LOGIN_FIX }, "the login check failed");
+  }
+  const factories = status >= 200 && status < 300 ? parseListedFactories(body) : void 0;
+  if (factories === void 0) {
+    const detail = `the gateway did not answer the factory list (HTTP ${status})`;
+    return withSkippedRest({ name, status: "warn", detail, fix: UPDATE_FIX }, "the login check did not finish");
+  }
+  const login = { name, status: "pass", detail: "the gateway accepts the saved login" };
+  if (appId === void 0) {
+    if (!inRepository) {
+      const reason = "this directory is not in a git repository, so no factory is chosen";
+      return [login, skippedCheck("Factory", reason, "Run this inside a connected repository, or set OUTERLAYER_APP_ID."), skippedCheck("Repository", reason)];
+    }
+    return [
+      login,
+      { name: "Factory", status: "fail", detail: "no factory is chosen for this repository", fix: CONNECT_FIX },
+      skippedCheck("Repository", "the factory check failed")
+    ];
+  }
+  const factory = factories.find((f) => f.id === appId);
+  if (factory === void 0) {
+    return [
+      login,
+      { name: "Factory", status: "fail", detail: `the factory ${sanitizeTerminal(appId)} is not one this login can use`, fix: CONNECT_FIX },
+      skippedCheck("Repository", "the factory check failed")
+    ];
+  }
+  const factoryCheck = { name: "Factory", status: "pass", detail: `${factorySlug(factory)} is a factory this login can use` };
+  if (local === void 0) return [login, factoryCheck, skippedCheck("Repository", "not inside a git repository with a remote")];
+  const shown = sanitizeTerminal(local);
+  if (factory.linked === null) {
+    return [login, factoryCheck, skippedCheck("Repository", `the link to ${shown} could not be read: this login lacks git.read on ${factorySlug(factory)}`)];
+  }
+  if (factory.linked) {
+    return [login, factoryCheck, { name: "Repository", status: "pass", detail: `${shown} is linked to ${factorySlug(factory)}` }];
+  }
+  const elsewhere = factories.find((f) => f.id !== factory.id && f.linked === true);
+  const fix = elsewhere === void 0 ? SETUP_PANEL_FIX : `Run \`outerlayer connect --factory ${factorySlug(elsewhere)}\` to use the factory this repository is linked to.`;
+  return [login, factoryCheck, { name: "Repository", status: "warn", detail: `${shown} is not linked to ${factorySlug(factory)}`, fix }];
+}
+async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
+  const name = "Factory key";
+  if (appId === void 0) {
+    return withSkippedRest(
+      { name, status: "fail", detail: "the key has no factory id", fix: "Set OUTERLAYER_APP_ID, or save the factory's id as appId in ~/.outerlayer/config.json." },
+      "the factory key check failed"
+    );
+  }
+  const factoryPath = `/v1/apps/${encodeURIComponent(appId)}`;
+  const reply = await askGateway(fetchImpl, url, factoryPath, key, appId);
+  const unanswered = unansweredDetail(reply);
+  if (unanswered !== void 0) {
+    return withSkippedRest({ name, status: "warn", detail: unanswered, fix: NETWORK_FIX }, "the factory key check did not finish");
+  }
+  const { status, body } = reply;
+  const message = refusalMessage(body);
+  const removeKey = `Mint a fresh key under Settings \u2192 API keys, or remove it so a saved login takes over.`;
+  if (status === 401) {
+    return withSkippedRest(
+      { name, status: "fail", detail: "the gateway refused the key", fix: `The key in ${source} is unknown or was revoked. ${removeKey}` },
+      "the factory key check failed"
+    );
+  }
+  if (status === 403 && /no longer a member/i.test(message)) {
+    return withSkippedRest(
+      { name, status: "fail", detail: message, fix: `The key in ${source} belongs to someone who left the organization. ${removeKey}` },
+      "the factory key check failed"
+    );
+  }
+  const accepted = { name, status: "pass", detail: `the gateway accepts the key from ${source}` };
+  const shownAppId = sanitizeTerminal(appId);
+  if (status === 403 && /missing required permission/i.test(message)) {
+    const permission = /'([^']+)'/.exec(message)?.[1] ?? "factory.read";
+    return [
+      accepted,
+      { name: "Factory", status: "fail", detail: `the key cannot read the factory ${shownAppId}: ${message}`, fix: `Use a key that holds ${permission}.` },
+      skippedCheck("Repository", "the factory check failed")
+    ];
+  }
+  if (status === 404) {
+    return [
+      accepted,
+      { name: "Factory", status: "fail", detail: `the factory ${shownAppId} does not exist`, fix: MINT_KEY_FIX },
+      skippedCheck("Repository", "the factory check failed")
+    ];
+  }
+  if (status === 403) {
+    return withSkippedRest(
+      {
+        name,
+        status: "fail",
+        detail: message || "the gateway refused the key (HTTP 403)",
+        fix: `The key in ${source} is not allowed to read this factory. ${removeKey}`
+      },
+      "the factory key check failed"
+    );
+  }
+  if (status < 200 || status >= 300) {
+    return withSkippedRest(
+      { name, status: "warn", detail: `the gateway did not answer the key check (HTTP ${status})`, fix: NETWORK_FIX },
+      "the factory key check did not finish"
+    );
+  }
+  const row = body?.data;
+  if (typeof row?.id !== "string") {
+    return withSkippedRest(
+      { name, status: "warn", detail: `the gateway did not answer the factory read with a factory (HTTP ${status})`, fix: UPDATE_FIX },
+      "the factory key check did not finish"
+    );
+  }
+  const label = [row.display_name, row.name].find((v) => typeof v === "string") ?? appId;
+  const factory = { name: "Factory", status: "pass", detail: `${sanitizeTerminal(label)} (${shownAppId}) is readable with this key` };
+  if (local === void 0) return [accepted, factory, skippedCheck("Repository", "not inside a git repository with a remote")];
+  const links = await askGateway(fetchImpl, url, `${factoryPath}/git/links`, key, appId);
+  const shown = sanitizeTerminal(local);
+  if ("failure" in links) {
+    return [accepted, factory, skippedCheck("Repository", `the link to ${shown} could not be read: the gateway did not answer`)];
+  }
+  const listed = links.status >= 200 && links.status < 300 ? links.body?.data : void 0;
+  if (!Array.isArray(listed)) {
+    const detail = links.status === 404 ? "the gateway does not list linked repositories" : links.status === 403 ? `the link to ${shown} could not be read: the key lacks git.read` : `the link to ${shown} could not be read (HTTP ${links.status})`;
+    return [accepted, factory, skippedCheck("Repository", detail)];
+  }
+  const linked = listed;
+  if (linked.some((l) => isLinkedRepository(local, l))) {
+    return [accepted, factory, { name: "Repository", status: "pass", detail: `${shown} is linked to the factory` }];
+  }
+  return [accepted, factory, { name: "Repository", status: "warn", detail: `${shown} is not linked to the factory`, fix: SETUP_PANEL_FIX }];
+}
+async function credentialChecks(options = {}) {
+  const env = options.env ?? process.env;
+  const cwd = options.cwd ?? process.cwd();
+  const resolved = resolveGatewayCredentials({ home: options.home, env, cwd });
+  if (resolved.credential === void 0 || resolved.url === void 0) {
+    const reason = resolved.credential === void 0 ? "no login and no factory key is saved" : "no gateway address is saved";
+    return withSkippedRest(skippedCheck("Credential", reason, "Run `outerlayer login` to sign in."), "there is no credential to check");
+  }
+  const fetchImpl = options.fetchImpl ?? defaultFetch;
+  const local = resolveRepoIdentity(cwd).gitRepo;
+  if (resolved.kind === "login") {
+    return loginChecks(fetchImpl, resolved.url, resolved.credential, resolved.appId, local, findGitDirs(cwd) !== void 0);
+  }
+  const source = env.OUTERLAYER_API_KEY ? "OUTERLAYER_API_KEY" : "~/.outerlayer/config.json";
+  return factoryKeyChecks(fetchImpl, resolved.url, resolved.credential, resolved.appId, source, local);
+}
+function doctorExitCode(checks) {
+  return checks.some((c) => c.status === "fail") ? 1 : 0;
+}
+
+// src/doctor-report.ts
+async function gatherDoctorChecks() {
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-XVJYZ4IQ.js');
+  const configPath = defaultRunnerConfigPath();
+  const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
+  const credential = await credentialChecks();
+  checks.push(...credential);
+  if (credential[0]?.status === "pass") checks.push(...await githubAppChecks());
+  const runnerVm = runnerVmOf(configPath);
+  if (runnerVm !== void 0) {
+    const { realLima } = await import('./lima-XN65D7GN.js');
+    const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
+    checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
+  } else if (hasRunnerBlock(configPath)) {
+    const { runnerHostChecks } = await import('./doctor-UFVL4PZY.js');
+    const hooks = (() => {
+      try {
+        return loadRunnerConfig(configPath).hooks;
+      } catch {
+        return void 0;
+      }
+    })();
+    const gateway = (() => {
+      try {
+        const { url, apiKey, appId } = loadRunnerConfig(configPath);
+        return { url, apiKey, appId };
+      } catch {
+        return void 0;
+      }
+    })();
+    const repos = (() => {
+      try {
+        return loadRunnerConfig(configPath).repos;
+      } catch {
+        return void 0;
+      }
+    })();
+    const runner = (() => {
+      try {
+        const { concurrency, build } = loadRunnerConfig(configPath);
+        return { concurrency, buildMemory: build?.memory ?? "8g" };
+      } catch {
+        return void 0;
+      }
+    })();
+    checks.push(...await runnerHostChecks({ configPath, hooks, gateway, repos, runner }));
+  }
+  return checks;
+}
+function summarizeChecks(checks) {
+  const failures = checks.filter((c) => c.status === "fail").length;
+  const warnings = checks.filter((c) => c.status === "warn").length;
+  const skipped = checks.filter((c) => c.status === "skipped").length;
+  return { passed: checks.length - failures - warnings - skipped, warnings, failures, skipped };
+}
+function icon(status) {
+  if (status === "pass") return `${C.green}\u2713${C.reset}`;
+  if (status === "warn") return `${C.yellow}!${C.reset}`;
+  if (status === "skipped") return `${C.dim}-${C.reset}`;
+  return `${C.red}\u2717${C.reset}`;
+}
+function summaryText(summary) {
+  return `${summary.passed} passed, ${summary.warnings} warnings, ${summary.failures} failures, ${summary.skipped} skipped`;
+}
+function renderDoctorText(checks) {
+  const summary = summarizeChecks(checks);
+  let out = "\nOuterLayer doctor\n\n";
+  for (const c of checks) {
+    out += `  ${icon(c.status)} ${c.name}${C.dim} \u2014 ${c.detail}${C.reset}
+`;
+    if (c.fix && c.status !== "pass") out += `      ${C.dim}\u21B3 ${c.fix}${C.reset}
+`;
+  }
+  out += `
+${summary.failures === 0 ? `${C.green}\u2713${C.reset}` : `${C.red}\u2717${C.reset}`} ${summaryText(summary)}
+`;
+  return out;
+}
+
+export { doctorExitCode, gatherDoctorChecks, readManifest, recordInstall, recordRemoval, recordStatusline, recordUnwrapped, recordWrapped, renderDoctorText, summarizeChecks, summaryText };