@phuetz/code-buddy 2.0.0 → 2.1.0

package/dist/doctor/integrations.js

@@ -0,0 +1,227 @@
+/**
+ * `buddy doctor` — Integrations section (comparatif plan P3).
+ *
+ * Aggregates EXISTING diagnostics without any network probe:
+ * - LM Resizer protocol (`diagnoseLmResizer`: bounded local `--help` runs only);
+ * - Code Explorer index freshness vs git HEAD (`getFreshness`, autoIndex off);
+ * - MCP configuration structure (`loadMCPConfig`, no server is started);
+ * - resource catalog observations (`ResourceCatalog.list`, never `probe`);
+ * - Skills Hub integrity (`listWithIntegrity`, same data as `buddy skills doctor`).
+ *
+ * Every probe is fail-soft: a broken source becomes a `warn` check, never a crash.
+ */
+import { z } from 'zod';
+const KNOWN_MCP_TRANSPORTS = new Set(['stdio', 'http', 'sse', 'streamable_http']);
+function check(id, name, status, message, optional) {
+    return { id, section: 'integrations', name, status, message, ...(optional ? { optional } : {}) };
+}
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+async function lmResizerCheck(deps) {
+    try {
+        if (deps.noSubprocess && !deps.lmResizer) {
+            const { isLmResizerEnabled, resolveLmResizerBin } = await import('../context/lm-resizer-compressor.js');
+            if (!isLmResizerEnabled()) {
+                return check('lm-resizer', 'LM Resizer', 'ok', 'disabled (CODEBUDDY_LM_RESIZER unset): tool observations stay raw', true);
+            }
+            const { commandExistsOnPath } = await import('./index.js');
+            const binary = resolveLmResizerBin();
+            return commandExistsOnPath(binary)
+                ? check('lm-resizer', 'LM Resizer', 'ok', `enabled, ${binary} found; protocol not probed (no child process in this mode — run buddy doctor --integrations)`, true)
+                : check('lm-resizer', 'LM Resizer', 'warn', `enabled but binary unavailable (${binary}); observations stay raw`);
+        }
+        const diagnose = deps.lmResizer ?? (async () => (await import('../context/lm-resizer-diagnostics.js')).diagnoseLmResizer());
+        const d = await diagnose();
+        if (!d.enabled) {
+            return check('lm-resizer', 'LM Resizer', 'ok', 'disabled (CODEBUDDY_LM_RESIZER unset): tool observations stay raw', true);
+        }
+        if (!d.available) {
+            return check('lm-resizer', 'LM Resizer', 'warn', `enabled but binary unavailable (${d.binary}); observations stay raw`);
+        }
+        if (!d.toolOutputSupported) {
+            return check('lm-resizer', 'LM Resizer', 'warn', `enabled but ${d.binary} (${d.version}) lacks the tool-output protocol; compression is inactive — install a compatible release`);
+        }
+        return check('lm-resizer', 'LM Resizer', 'ok', `tool-output protocol supported (${d.version})`);
+    }
+    catch (error) {
+        return check('lm-resizer', 'LM Resizer', 'warn', `diagnostic failed: ${errorText(error)}`);
+    }
+}
+async function codeExplorerCheck(cwd, deps) {
+    try {
+        const freshness = deps.codeExplorerFreshness ?? (async (dir) => {
+            const { CodeExplorerManager } = await import('../plugins/code-explorer/CodeExplorerManager.js');
+            return new CodeExplorerManager(dir).getFreshness(undefined, { autoIndex: false });
+        });
+        const f = await freshness(cwd);
+        if (!f.indexed)
+            return check('code-explorer', 'Code Explorer index', 'ok', 'repository not indexed (optional)', true);
+        if (f.unverified)
+            return check('code-explorer', 'Code Explorer index', 'warn', 'index present but freshness could not be verified against git HEAD');
+        if (f.stale) {
+            const behind = typeof f.commitsBehind === 'number' ? `${f.commitsBehind} commit(s) behind HEAD` : 'does not match HEAD';
+            return check('code-explorer', 'Code Explorer index', 'warn', `stale: ${behind} — re-run the Code Explorer analyze step`);
+        }
+        return check('code-explorer', 'Code Explorer index', 'ok', 'index matches git HEAD');
+    }
+    catch (error) {
+        return check('code-explorer', 'Code Explorer index', 'warn', `freshness check failed: ${errorText(error)}`);
+    }
+}
+async function mcpCheck(cwd, deps) {
+    try {
+        // Explicit project directory: never process.chdir() (global state shared across awaits).
+        // Diagnostics use the strictly read-only loader: no restore/rename/chmod/create of
+        // config or backups/temporaries, and corrupt sources surface as honest warnings.
+        let servers;
+        let warnings = [];
+        if (deps.mcpServers) {
+            servers = await deps.mcpServers(cwd);
+        }
+        else {
+            const { loadMCPConfigReadOnly } = await import('../mcp/config.js');
+            const result = loadMCPConfigReadOnly({ includeDisabled: true, cwd });
+            servers = result.servers;
+            warnings = result.warnings;
+        }
+        const disabled = servers.filter((s) => s.enabled === false).length;
+        const unusable = servers.filter((s) => {
+            if (s.enabled === false)
+                return false;
+            const type = s.transport && typeof s.transport === 'object' ? s.transport.type : undefined;
+            if (typeof type === 'string')
+                return !KNOWN_MCP_TRANSPORTS.has(type);
+            return typeof s.command !== 'string' || s.command.trim() === '';
+        }).map((s) => s.name);
+        const base = servers.length === 0
+            ? 'no MCP server configured'
+            : `${servers.length} configured (${disabled} disabled); no server started`;
+        const parts = [base];
+        if (warnings.length > 0)
+            parts.push(`configuration warnings: ${warnings.join('; ')}`);
+        if (unusable.length > 0)
+            parts.push(`unusable transport configuration: ${unusable.join(', ')}`);
+        const message = parts.join('; ');
+        if (warnings.length > 0 || unusable.length > 0) {
+            return check('mcp', 'MCP servers', 'warn', message);
+        }
+        if (servers.length === 0)
+            return check('mcp', 'MCP servers', 'ok', message, true);
+        return check('mcp', 'MCP servers', 'ok', message);
+    }
+    catch (error) {
+        return check('mcp', 'MCP servers', 'warn', `configuration unreadable: ${errorText(error)}`);
+    }
+}
+async function resourcesCheck(deps) {
+    try {
+        const list = deps.resources ?? (async () => new (await import('../fleet/resource-catalog.js')).ResourceCatalog().list());
+        const entries = await list();
+        if (entries.length === 0)
+            return check('resources', 'Resource catalog', 'ok', 'no resource declared (buddy resources add)', true);
+        const count = (state) => entries.filter((e) => e.state === state).length;
+        const summary = `${entries.length} declared: ${count('online')} online, ${count('stale')} stale, ${count('offline')} offline, ${count('unknown')} unknown (read-only, no probe)`;
+        const attention = entries.filter((e) => e.state === 'stale' || e.state === 'offline').map((e) => `${e.resource.id}=${e.state}`);
+        return attention.length > 0
+            ? check('resources', 'Resource catalog', 'warn', `${summary}; refresh explicitly with buddy resources probe <id>: ${attention.join(', ')}`)
+            : check('resources', 'Resource catalog', 'ok', summary);
+    }
+    catch (error) {
+        return check('resources', 'Resource catalog', 'warn', `catalog unreadable: ${errorText(error)}`);
+    }
+}
+async function skillsCheck(deps) {
+    try {
+        const list = deps.skillsIntegrity ?? (async () => (await import('../skills/hub.js')).getSkillsHub().listWithIntegrity());
+        const skills = await list();
+        const missing = skills.filter((s) => !s.exists).length;
+        const modified = skills.filter((s) => s.exists && !s.integrityOk).length;
+        if (missing + modified > 0) {
+            return check('skills', 'Skills Hub integrity', 'warn', `${skills.length} installed: ${missing} missing SKILL.md, ${modified} modified — run buddy skills doctor`);
+        }
+        return check('skills', 'Skills Hub integrity', 'ok', `${skills.length} installed, all intact`, skills.length === 0);
+    }
+    catch (error) {
+        return check('skills', 'Skills Hub integrity', 'warn', `lockfile unreadable: ${errorText(error)}`);
+    }
+}
+async function codeExecPolicyCheck(deps) {
+    try {
+        const model = deps.configuredModel
+            ? await deps.configuredModel()
+            : await (async () => {
+                const { getSettingsManager } = await import('../utils/settings-manager.js');
+                const settings = getSettingsManager().readUserSettingsIfPresent();
+                return settings?.defaultModel ?? settings?.model ?? process.env.GROK_MODEL;
+            })();
+        const { resolveCodeExecPolicy } = await import('../config/code-exec-policy.js');
+        const resolved = resolveCodeExecPolicy(model);
+        const evidence = resolved.evidence ? `, evidence ${resolved.evidence}` : '';
+        return check('code-exec-policy', 'Programmatic tool calling', 'ok', `code_exec policy ${resolved.policy} for ${model ?? 'unknown model'} (source ${resolved.source}${evidence})`, true);
+    }
+    catch (error) {
+        return check('code-exec-policy', 'Programmatic tool calling', 'warn', `policy unreadable: ${errorText(error)}`);
+    }
+}
+export async function runIntegrationChecks(cwd, deps = {}) {
+    return Promise.all([
+        lmResizerCheck(deps),
+        codeExplorerCheck(cwd, deps),
+        mcpCheck(cwd, deps),
+        resourcesCheck(deps),
+        skillsCheck(deps),
+        codeExecPolicyCheck(deps),
+    ]);
+}
+// ── JSON report ─────────────────────────────────────────────────────────────
+export const doctorJsonReportSchema = z.object({
+    version: z.literal(1),
+    generatedAt: z.string(),
+    offline: z.boolean(),
+    summary: z.object({
+        passed: z.number().int().nonnegative(),
+        warnings: z.number().int().nonnegative(),
+        errors: z.number().int().nonnegative(),
+        optionalNotInstalled: z.number().int().nonnegative(),
+    }).strict(),
+    checks: z.array(z.object({
+        id: z.string().regex(/^[a-z0-9][a-z0-9-]*$/),
+        section: z.enum(['core', 'integrations']),
+        name: z.string(),
+        status: z.enum(['ok', 'warn', 'error']),
+        message: z.string(),
+        fixable: z.boolean(),
+        optional: z.boolean(),
+    }).strict()),
+    fixes: z.array(z.object({ success: z.boolean(), message: z.string(), action: z.string() }).strict()).optional(),
+}).strict();
+export function slugifyCheckName(name) {
+    return name.toLowerCase().normalize('NFKD').replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'check';
+}
+export function buildDoctorJsonReport(checks, summary, options) {
+    const seen = new Map();
+    const report = {
+        version: 1,
+        generatedAt: (options.now ?? new Date()).toISOString(),
+        offline: options.offline,
+        summary,
+        checks: checks.map((c) => {
+            const baseId = c.id ?? slugifyCheckName(c.name);
+            const n = (seen.get(baseId) ?? 0) + 1;
+            seen.set(baseId, n);
+            return {
+                id: n === 1 ? baseId : `${baseId}-${n}`,
+                section: c.section ?? 'core',
+                name: c.name,
+                status: c.status,
+                message: c.message,
+                fixable: c.fixable === true,
+                optional: c.optional === true,
+            };
+        }),
+        ...(options.fixes ? { fixes: options.fixes } : {}),
+    };
+    return doctorJsonReportSchema.parse(report);
+}
+//# sourceMappingURL=integrations.js.map

package/dist/doctor/triage.d.ts

@@ -0,0 +1,108 @@
+/**
+ * `buddy triage` — local, redacted support bundle (P7).
+ *
+ * Collects the offline doctor report, versions, recent failed runs, a bounded
+ * log tail and configuration KEY NAMES, then writes `triage.json` and a
+ * prompt (≤ 8 KiB) into a fresh 0700 directory. Nothing is sent anywhere and
+ * no agent is launched: the suggested command is printed for the user.
+ *
+ * Fail closed: every string goes through literal masking of known secret
+ * values, then the redaction engine; the serialized bundle and prompt are
+ * scanned again and any section still flagged is withheld. If the scan itself
+ * fails, nothing is written.
+ */
+import type { DoctorCheck } from './index.js';
+import type { DoctorJsonReport } from './integrations.js';
+export declare const TRIAGE_PROMPT_MAX_BYTES = 8192;
+export interface TriageFailedRun {
+    runId: string;
+    status: string;
+    startedAt: string;
+    eventCount: number;
+    objective: string;
+}
+export interface TriageBundle {
+    version: 1;
+    generatedAt: string;
+    networkUsed: false;
+    versions: {
+        node: string;
+        buddy: string;
+        os: string;
+    };
+    doctor: DoctorJsonReport | {
+        withheld: true;
+        reason: string;
+    };
+    failedRuns: TriageFailedRun[] | {
+        withheld: true;
+        reason: string;
+    };
+    logs: {
+        file: string | null;
+        lines: string[];
+    } | {
+        withheld: true;
+        reason: string;
+    };
+    config: {
+        files: Array<{
+            file: string;
+            keys: string[];
+        }>;
+    } | {
+        withheld: true;
+        reason: string;
+    };
+    redactions: number;
+    withheld: string[];
+}
+export interface TriageDeps {
+    runDoctor?: () => Promise<{
+        checks: DoctorCheck[];
+        report: DoctorJsonReport;
+    }>;
+    listRuns?: (limit: number) => Array<{
+        runId: string;
+        status: string;
+        startedAt: number;
+        eventCount: number;
+        objective: string;
+    }>;
+    redact?: (text: string) => {
+        redacted: string;
+        count: number;
+    };
+}
+export interface TriageOptions {
+    cwd: string;
+    homeDir?: string;
+    outParent?: string;
+    logFile?: string | null;
+    logLines?: number;
+    env?: NodeJS.ProcessEnv;
+    now?: Date;
+    buddyVersion?: string;
+    deps?: TriageDeps;
+}
+export interface TriageResult {
+    dir: string;
+    jsonPath: string;
+    promptPath: string;
+    promptBytes: number;
+    redactions: number;
+    withheld: string[];
+    suggestedCommand: string;
+    bundle: TriageBundle;
+}
+/** Literal values that must never leave the machine, longest first. */
+export declare function collectSecretValues(cwd: string, home: string, env: NodeJS.ProcessEnv): string[];
+export declare function createMasker(secretValues: string[], redact: NonNullable<TriageDeps['redact']>, home?: string): {
+    mask: (input: string) => string;
+    leaks: (text: string) => boolean;
+    count: () => number;
+};
+/** Last `maxLines` lines of a file, reading at most 256 KiB from its end. */
+export declare function tailFile(file: string, maxLines: number): string[];
+export declare function buildTriagePrompt(bundle: TriageBundle, maxBytes?: number): string;
+export declare function writeTriageBundle(options: TriageOptions): Promise<TriageResult>;

package/dist/doctor/triage.js

@@ -0,0 +1,304 @@
+/**
+ * `buddy triage` — local, redacted support bundle (P7).
+ *
+ * Collects the offline doctor report, versions, recent failed runs, a bounded
+ * log tail and configuration KEY NAMES, then writes `triage.json` and a
+ * prompt (≤ 8 KiB) into a fresh 0700 directory. Nothing is sent anywhere and
+ * no agent is launched: the suggested command is printed for the user.
+ *
+ * Fail closed: every string goes through literal masking of known secret
+ * values, then the redaction engine; the serialized bundle and prompt are
+ * scanned again and any section still flagged is withheld. If the scan itself
+ * fails, nothing is written.
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+export const TRIAGE_PROMPT_MAX_BYTES = 8192;
+const DEFAULT_LOG_LINES = 200;
+const LOG_TAIL_READ_BYTES = 256 * 1024;
+const LOG_LINE_MAX_CHARS = 400;
+const SECRET_NAME = /(KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|AUTH|CREDENTIAL|COOKIE|SESSION|PRIVATE)/i;
+const PLACEHOLDER = /\[REDACTED(?::[A-Z0-9_]+)?\]/g;
+// ── Masking ─────────────────────────────────────────────────────────────────
+function parseEnvFile(file) {
+    const entries = new Map();
+    let text;
+    try {
+        text = fs.readFileSync(file, 'utf8');
+    }
+    catch {
+        return entries;
+    }
+    for (const raw of text.split(/\r?\n/)) {
+        const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_.-]*)\s*=\s*(.*)$/.exec(raw);
+        if (!match)
+            continue;
+        const value = match[2].trim().replace(/^(['"])(.*)\1$/, '$2');
+        entries.set(match[1], value);
+    }
+    return entries;
+}
+function envFiles(cwd, home) {
+    return [path.join(cwd, '.env'), path.join(cwd, '.env.local'), path.join(home, '.codebuddy', '.env')];
+}
+/** Literal values that must never leave the machine, longest first. */
+export function collectSecretValues(cwd, home, env) {
+    const values = new Set();
+    const consider = (name, value) => {
+        if (!value)
+            return;
+        const trimmed = value.trim();
+        if (trimmed.length < 6)
+            return;
+        if (SECRET_NAME.test(name) || /:\/\/[^\s/@]+:[^\s/@]+@/.test(trimmed))
+            values.add(trimmed);
+    };
+    for (const file of envFiles(cwd, home)) {
+        for (const [name, value] of parseEnvFile(file))
+            consider(name, value);
+    }
+    for (const [name, value] of Object.entries(env))
+        consider(name, value);
+    return [...values].sort((a, b) => b.length - a.length);
+}
+export function createMasker(secretValues, redact, home) {
+    let total = 0;
+    const mask = (input) => {
+        let text = input;
+        for (const value of secretValues) {
+            if (text.includes(value)) {
+                const parts = text.split(value);
+                total += parts.length - 1;
+                text = parts.join('[REDACTED:VALUE]');
+            }
+        }
+        // The home path carries the account name; keep paths readable as `~`.
+        if (home && home.length > 1)
+            text = text.split(home).join('~');
+        text = text.replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s:@/]+:[^\s@/]+@/gi, (_m, scheme) => {
+            total += 1;
+            return `${scheme}[REDACTED:USERINFO]@`;
+        });
+        // Fixed point: replacements can expose a new match (`token: <jwt>`).
+        for (let i = 0; i < 3; i++) {
+            const result = redact(text);
+            total += result.count;
+            if (result.redacted === text)
+                break;
+            text = result.redacted;
+        }
+        return text;
+    };
+    const leaks = (text) => {
+        const stripped = text.replace(PLACEHOLDER, '');
+        if (secretValues.some((value) => stripped.includes(value)))
+            return true;
+        if (/[a-z][a-z0-9+.-]*:\/\/[^\s:@/]+:[^\s@/]+@/i.test(stripped))
+            return true;
+        return redact(stripped).count > 0;
+    };
+    return { mask, leaks, count: () => total };
+}
+async function defaultRedact() {
+    const { getDataRedactionEngine } = await import('../security/data-redaction.js');
+    const engine = getDataRedactionEngine();
+    return (text) => {
+        const result = engine.redact(text);
+        return { redacted: result.redacted, count: result.redactions.length };
+    };
+}
+// ── Collectors ──────────────────────────────────────────────────────────────
+async function defaultRunDoctor(cwd) {
+    const { runDoctorChecks, summarizeDoctorChecks } = await import('./index.js');
+    const { runIntegrationChecks, buildDoctorJsonReport } = await import('./integrations.js');
+    const checks = [...(await runDoctorChecks(cwd, { offline: true, noSubprocess: true })), ...(await runIntegrationChecks(cwd, { noSubprocess: true }))];
+    return { checks, report: buildDoctorJsonReport(checks, summarizeDoctorChecks(checks), { offline: true }) };
+}
+async function defaultListRuns(limit) {
+    const { RunStore } = await import('../observability/run-store.js');
+    return RunStore.getInstance().listRuns(limit);
+}
+/** Last `maxLines` lines of a file, reading at most 256 KiB from its end. */
+export function tailFile(file, maxLines) {
+    let fd;
+    try {
+        fd = fs.openSync(file, 'r');
+        const size = fs.fstatSync(fd).size;
+        const length = Math.min(size, LOG_TAIL_READ_BYTES);
+        const buffer = Buffer.alloc(length);
+        fs.readSync(fd, buffer, 0, length, size - length);
+        const lines = buffer.toString('utf8').split(/\r?\n/);
+        if (length < size)
+            lines.shift(); // first line is probably partial
+        return lines.filter((line) => line.trim() !== '').slice(-maxLines)
+            .map((line) => (line.length > LOG_LINE_MAX_CHARS ? `${line.slice(0, LOG_LINE_MAX_CHARS)}…` : line));
+    }
+    catch {
+        return [];
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+function jsonKeys(file) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? Object.keys(parsed).sort() : [];
+    }
+    catch {
+        return null;
+    }
+}
+function configKeyNames(cwd, home) {
+    const out = [];
+    const label = (file) => (file.startsWith(home) ? `~${file.slice(home.length)}` : path.relative(cwd, file) || file);
+    for (const file of [path.join(home, '.codebuddy', 'settings.json'), path.join(home, '.codebuddy', 'user-settings.json'), path.join(cwd, '.codebuddy', 'settings.json')]) {
+        const keys = jsonKeys(file);
+        if (keys)
+            out.push({ file: label(file), keys });
+    }
+    for (const file of envFiles(cwd, home)) {
+        if (!fs.existsSync(file))
+            continue;
+        out.push({ file: label(file), keys: [...parseEnvFile(file).keys()].sort() });
+    }
+    return out;
+}
+// ── Prompt ──────────────────────────────────────────────────────────────────
+function byteLength(text) {
+    return Buffer.byteLength(text, 'utf8');
+}
+function truncateBytes(text, max) {
+    if (byteLength(text) <= max)
+        return text;
+    const marker = '\n…[truncated]\n';
+    let slice = Buffer.from(text, 'utf8').subarray(0, max - byteLength(marker)).toString('utf8');
+    slice = slice.replace(/�$/, '');
+    return slice + marker;
+}
+export function buildTriagePrompt(bundle, maxBytes = TRIAGE_PROMPT_MAX_BYTES) {
+    const head = [
+        '# Code Buddy triage',
+        '',
+        'Diagnose this Code Buddy installation from the local bundle below. Secret values are masked as [REDACTED:…];',
+        'do not ask the user to paste keys, tokens or passwords. Propose concrete fixes and the command to verify each one.',
+        '',
+        `Versions: Buddy ${bundle.versions.buddy}, Node ${bundle.versions.node}, ${bundle.versions.os}`,
+        '',
+    ].join('\n');
+    const doctor = 'withheld' in bundle.doctor
+        ? `## Doctor (offline)\nwithheld: ${bundle.doctor.reason}\n`
+        : `## Doctor (offline): ${bundle.doctor.summary.errors} error(s), ${bundle.doctor.summary.warnings} warning(s)\n${bundle.doctor.checks
+            .filter((c) => c.status !== 'ok')
+            .map((c) => `- [${c.status}] ${c.name}: ${c.message}`)
+            .join('\n') || '- all checks ok'}\n`;
+    const runs = Array.isArray(bundle.failedRuns)
+        ? `## Recent failed or stuck runs\n${bundle.failedRuns.map((r) => `- ${r.runId} ${r.status} ${r.startedAt} events=${r.eventCount}: ${r.objective}`).join('\n') || '- none'}\n`
+        : `## Recent failed or stuck runs\nwithheld: ${bundle.failedRuns.reason}\n`;
+    const config = 'withheld' in bundle.config
+        ? `## Configuration keys\nwithheld: ${bundle.config.reason}\n`
+        : `## Configuration keys (names only)\n${bundle.config.files.map((f) => `- ${f.file}: ${f.keys.join(', ') || '(empty)'}`).join('\n') || '- none found'}\n`;
+    const withheld = bundle.withheld.length > 0 ? `Withheld sections: ${bundle.withheld.join(', ')}\n` : '';
+    const fixed = [head, doctor, runs, config, withheld].join('\n');
+    const logLines = 'withheld' in bundle.logs ? [] : [...bundle.logs.lines];
+    const logHeader = 'withheld' in bundle.logs ? `## Log tail\nwithheld: ${bundle.logs.reason}\n` : '## Log tail (most recent last)\n```\n';
+    const logFooter = 'withheld' in bundle.logs ? '' : '```\n';
+    const budget = maxBytes - byteLength(fixed) - byteLength(logHeader) - byteLength(logFooter) - 2;
+    // Keep the most recent lines that fit.
+    const kept = [];
+    let used = 0;
+    for (let i = logLines.length - 1; i >= 0; i--) {
+        const size = byteLength(logLines[i]) + 1;
+        if (used + size > budget)
+            break;
+        kept.unshift(logLines[i]);
+        used += size;
+    }
+    const logs = budget > 0 ? `${logHeader}${kept.map((l) => `${l}\n`).join('')}${logFooter}` : '';
+    return truncateBytes(`${fixed}\n${logs}`, maxBytes);
+}
+// ── Main ────────────────────────────────────────────────────────────────────
+function stamp(now) {
+    return now.toISOString().replace(/[:.]/g, '-');
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+export async function writeTriageBundle(options) {
+    const env = options.env ?? process.env;
+    const home = options.homeDir ?? os.homedir();
+    const now = options.now ?? new Date();
+    const deps = options.deps ?? {};
+    const redact = deps.redact ?? (await defaultRedact());
+    const masker = createMasker(collectSecretValues(options.cwd, home, env), redact, home);
+    const withheld = [];
+    const doctorRaw = await (deps.runDoctor ?? (() => defaultRunDoctor(options.cwd)))();
+    const doctor = {
+        ...doctorRaw.report,
+        checks: doctorRaw.report.checks.map((c) => ({ ...c, name: masker.mask(c.name), message: masker.mask(c.message) })),
+    };
+    const runs = deps.listRuns ? deps.listRuns(50) : await defaultListRuns(50);
+    const failedRuns = runs
+        .filter((r) => r.status === 'failed' || r.status === 'running')
+        .slice(0, 10)
+        .map((r) => ({
+        runId: masker.mask(r.runId),
+        status: r.status,
+        startedAt: new Date(r.startedAt).toISOString(),
+        eventCount: r.eventCount,
+        objective: masker.mask((r.objective ?? '').slice(0, 160)),
+    }));
+    const logFile = options.logFile === undefined
+        ? (env.LOG_FILE !== undefined ? env.LOG_FILE || null : path.join(home, '.codebuddy', 'logs', 'codebuddy.log'))
+        : options.logFile;
+    const logLines = logFile ? tailFile(logFile, options.logLines ?? DEFAULT_LOG_LINES).map(masker.mask) : [];
+    const displayLog = logFile ? (logFile.startsWith(home) ? `~${logFile.slice(home.length)}` : logFile) : null;
+    const bundle = {
+        version: 1,
+        generatedAt: now.toISOString(),
+        networkUsed: false,
+        versions: { node: process.version, buddy: options.buddyVersion ?? 'unknown', os: `${os.platform()} ${os.release()} ${os.arch()}` },
+        doctor,
+        failedRuns,
+        logs: { file: displayLog, lines: logLines },
+        config: { files: configKeyNames(options.cwd, home).map((f) => ({ file: masker.mask(f.file), keys: f.keys.map(masker.mask) })) },
+        redactions: 0,
+        withheld,
+    };
+    // Fail closed: withhold any section still flagged after masking.
+    for (const section of ['doctor', 'failedRuns', 'logs', 'config']) {
+        if (masker.leaks(JSON.stringify(bundle[section]))) {
+            bundle[section] = { withheld: true, reason: 'secret scan still matched after redaction' };
+            withheld.push(section);
+        }
+    }
+    bundle.redactions = masker.count();
+    const prompt = buildTriagePrompt(bundle);
+    const json = JSON.stringify(bundle, null, 2);
+    if (masker.leaks(json) || masker.leaks(prompt)) {
+        throw new Error('TRIAGE_SECRET_SCAN_FAILED: refusing to write a bundle that still matches the secret scanner');
+    }
+    const parent = options.outParent ?? path.join(home, '.codebuddy', 'triage');
+    fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const dir = fs.mkdtempSync(path.join(parent, `triage-${stamp(now)}-`));
+    fs.chmodSync(dir, 0o700);
+    const jsonPath = path.join(dir, 'triage.json');
+    const promptPath = path.join(dir, 'prompt.md');
+    fs.writeFileSync(jsonPath, `${json}\n`, { mode: 0o600, flag: 'wx' });
+    fs.writeFileSync(promptPath, prompt, { mode: 0o600, flag: 'wx' });
+    fs.chmodSync(jsonPath, 0o600);
+    fs.chmodSync(promptPath, 0o600);
+    return {
+        dir,
+        jsonPath,
+        promptPath,
+        promptBytes: byteLength(prompt),
+        redactions: bundle.redactions,
+        withheld,
+        suggestedCommand: `buddy -p "$(cat ${shellQuote(promptPath)})"`,
+        bundle,
+    };
+}
+//# sourceMappingURL=triage.js.map

package/dist/fleet/collaboration.d.ts

@@ -0,0 +1,44 @@
+/** Explicit, process-independent connections for a bounded fleet review. */
+import { FleetListener } from './fleet-listener.js';
+export interface CollaborationPeer {
+    id: string;
+    url: string;
+    tokenEnv: string;
+    role: string;
+}
+export interface CollaborationConfig {
+    version: 1;
+    peers: CollaborationPeer[];
+}
+export interface PeerResult {
+    id: string;
+    status: 'ready' | 'completed' | 'failed';
+    hostname?: string;
+    pid?: number;
+    model?: string;
+    text?: string;
+    error?: string;
+}
+export interface CollaborationReport {
+    status: 'complete' | 'partial' | 'failed';
+    peers: PeerResult[];
+    synthesis?: {
+        peer: string;
+        text: string;
+    };
+    synthesisError?: string;
+}
+/** Configuration stores environment variable names, never bearer tokens. */
+export declare function parseCollaborationConfig(value: unknown): CollaborationConfig;
+type Connection = Pick<FleetListener, 'connect' | 'disconnect' | 'request'>;
+export interface CollaborationOptions {
+    goal?: string;
+    timeoutMs?: number;
+    env?: NodeJS.ProcessEnv;
+    signal?: AbortSignal;
+    onProgress?: (message: string) => void;
+    createListener?: (options: ConstructorParameters<typeof FleetListener>[0]) => Connection;
+}
+/** Parallel reviews followed by a synthesis. Peer chat does not execute remote tools. */
+export declare function runCollaboration(config: CollaborationConfig, options?: CollaborationOptions): Promise<CollaborationReport>;
+export {};