@pixelzx/genesis 2026.7.8 → 2026.7.9

package/dist/dispatch-acp-manager.runtime-C1nWu1uE.js

@@ -0,0 +1,3 @@
+import { r as getSessionBindingService } from "./session-binding-service-BOdf-6dc.js";
+import { n as getAcpSessionManager } from "./manager-CSBGjyBv.js";
+export { getAcpSessionManager, getSessionBindingService };

package/dist/dispatch-acp-manager.runtime.js

@@ -1 +1 @@
-export * from "./dispatch-acp-manager.runtime-CynWPlJS.js";
+export * from "./dispatch-acp-manager.runtime-C1nWu1uE.js";

package/dist/dispatch-acp.runtime-CWcJoK7v.js

@@ -0,0 +1,19 @@
+//#region src/auto-reply/reply/dispatch-acp.runtime.ts
+let dispatchAcpPromise = null;
+let dispatchAcpCommandBypassPromise = null;
+function loadDispatchAcp() {
+	dispatchAcpPromise ??= import("./dispatch-acp-CkcF0OCD.js");
+	return dispatchAcpPromise;
+}
+function loadDispatchAcpCommandBypass() {
+	dispatchAcpCommandBypassPromise ??= import("./dispatch-acp-command-bypass-Bjnjj4XQ.js");
+	return dispatchAcpCommandBypassPromise;
+}
+async function shouldBypassAcpDispatchForCommand(...args) {
+	return (await loadDispatchAcpCommandBypass()).shouldBypassAcpDispatchForCommand(...args);
+}
+async function tryDispatchAcpReply(...args) {
+	return await (await loadDispatchAcp()).tryDispatchAcpReply(...args);
+}
+//#endregion
+export { shouldBypassAcpDispatchForCommand, tryDispatchAcpReply };

package/dist/dispatch-acp.runtime.js

@@ -1 +1 @@
-export * from "./dispatch-acp.runtime-OwR8G8Qt.js";
+export * from "./dispatch-acp.runtime-CWcJoK7v.js";

package/dist/doctor-device-pairing-Ccd9bfi0.js

@@ -0,0 +1,307 @@
+import { t as formatCliCommand } from "./command-format-B3Q5KD9o.js";
+import { _ as resolveStateDir } from "./paths-Bv2rGpO9.js";
+import { t as sanitizeTerminalText } from "./safe-text-BV3CaaRc.js";
+import { n as normalizeDeviceAuthScopes } from "./device-auth-DtRVQUtN.js";
+import { r as callGateway } from "./call-CoL9QpLf.js";
+import { t as note } from "./note-CCJmtpzn.js";
+import { c as roleScopesAllow } from "./pairing-token-Bia1olYb.js";
+import { c as listApprovedPairedDeviceRoles, g as summarizeDeviceTokens, l as listDevicePairing } from "./device-pairing-DcVtuZyt.js";
+import fs from "node:fs";
+import path from "node:path";
+//#region src/commands/doctor-device-pairing.ts
+function hasNumberVersion(value) {
+	return "version" in value && typeof value.version === "number";
+}
+function isDeviceAuthStoreTokenEntry(value) {
+	return typeof value === "object" && value !== null && "token" in value && typeof value.token === "string" && "role" in value && typeof value.role === "string" && "scopes" in value && Array.isArray(value.scopes) && value.scopes.every((scope) => typeof scope === "string") && "updatedAtMs" in value && typeof value.updatedAtMs === "number";
+}
+function uniqueStrings(...items) {
+	const values = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!item) continue;
+		if (Array.isArray(item)) {
+			for (const value of item) {
+				const trimmed = value.trim();
+				if (trimmed) values.add(trimmed);
+			}
+			continue;
+		}
+		const trimmed = item.trim();
+		if (trimmed) values.add(trimmed);
+	}
+	return [...values];
+}
+function normalizeGatewayPairedDevice(device) {
+	return {
+		...device,
+		tokenSummaries: device.tokens ?? []
+	};
+}
+function normalizeLocalPairedDevice(device) {
+	return {
+		...device,
+		tokenSummaries: summarizeDeviceTokens(device.tokens) ?? []
+	};
+}
+async function loadDoctorPairingSnapshot(params) {
+	if (params.healthOk) try {
+		const payload = await callGateway({
+			method: "device.pair.list",
+			timeoutMs: 5e3,
+			config: params.cfg
+		});
+		return {
+			pending: payload.pending,
+			paired: payload.paired.map((device) => normalizeGatewayPairedDevice(device))
+		};
+	} catch {}
+	if (params.cfg.gateway?.mode === "remote") return null;
+	const local = await listDevicePairing();
+	return {
+		pending: local.pending,
+		paired: local.paired.map((device) => normalizeLocalPairedDevice(device))
+	};
+}
+function resolveApprovedScopes(device) {
+	return normalizeDeviceAuthScopes(device.approvedScopes ?? device.scopes);
+}
+function formatScopes(scopes) {
+	return scopes.length > 0 ? scopes.join(", ") : "none";
+}
+function formatRoles(roles) {
+	return roles.length > 0 ? roles.join(", ") : "none";
+}
+function quoteCliArg(value) {
+	if (/^[A-Za-z0-9_/:=.,@%+-]+$/.test(value)) return value;
+	return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function formatCliArgs(args) {
+	return formatCliCommand(args.map(quoteCliArg).join(" "));
+}
+function describeDevice(params) {
+	const label = sanitizeTerminalText(params.displayName?.trim() || "") || sanitizeTerminalText(params.clientId?.trim() || "");
+	return label ? `${label} (${params.deviceId})` : params.deviceId;
+}
+function findTokenSummary(device, role) {
+	const normalizedRole = role.trim();
+	return device.tokenSummaries.find((entry) => entry.role === normalizedRole && !entry.revokedAtMs);
+}
+function hasPendingScopeUpgrade(params) {
+	for (const role of params.requestedRoles) {
+		if (!params.approvedRoles.includes(role)) continue;
+		const requestedForRole = params.pendingScopes.filter((scope) => role === "operator" ? scope.startsWith("operator.") : !scope.startsWith("operator."));
+		if (requestedForRole.length === 0) continue;
+		if (!roleScopesAllow({
+			role,
+			requestedScopes: requestedForRole,
+			allowedScopes: params.approvedScopes
+		})) return true;
+	}
+	return false;
+}
+function resolvePendingPairingIssue(pending, paired) {
+	const deviceLabel = describeDevice({
+		deviceId: pending.deviceId,
+		displayName: pending.displayName,
+		clientId: pending.clientId
+	});
+	const approveCommand = formatCliArgs([
+		"genesis",
+		"devices",
+		"approve",
+		pending.requestId
+	]);
+	const inspectCommand = formatCliArgs([
+		"genesis",
+		"devices",
+		"list"
+	]);
+	if (!paired) return {
+		kind: "first-time",
+		pending,
+		deviceLabel,
+		approveCommand,
+		inspectCommand
+	};
+	if (paired.publicKey !== pending.publicKey) return {
+		kind: "public-key-repair",
+		pending,
+		deviceLabel,
+		approveCommand,
+		inspectCommand,
+		removeCommand: formatCliArgs([
+			"genesis",
+			"devices",
+			"remove",
+			pending.deviceId
+		])
+	};
+	const requestedRoles = uniqueStrings(pending.roles, pending.role);
+	const approvedRoles = listApprovedPairedDeviceRoles(paired);
+	if (requestedRoles.some((role) => !approvedRoles.includes(role))) return {
+		kind: "role-upgrade",
+		pending,
+		deviceLabel,
+		approveCommand,
+		inspectCommand,
+		approvedRoles,
+		requestedRoles
+	};
+	const approvedScopes = resolveApprovedScopes(paired);
+	const requestedScopes = normalizeDeviceAuthScopes(pending.scopes);
+	if (hasPendingScopeUpgrade({
+		requestedRoles,
+		pendingScopes: requestedScopes,
+		approvedRoles,
+		approvedScopes
+	})) return {
+		kind: "scope-upgrade",
+		pending,
+		deviceLabel,
+		approveCommand,
+		inspectCommand,
+		approvedScopes,
+		requestedScopes
+	};
+	return {
+		kind: "repair",
+		pending,
+		deviceLabel,
+		approveCommand,
+		inspectCommand
+	};
+}
+function formatPendingPairingIssue(issue) {
+	switch (issue.kind) {
+		case "first-time": return `- Pending device pairing request ${issue.pending.requestId} for ${issue.deviceLabel}. Review with ${issue.inspectCommand}, then approve with ${issue.approveCommand}.`;
+		case "public-key-repair": return `- Pending device repair ${issue.pending.requestId} for ${issue.deviceLabel}: the current device identity no longer matches the approved pairing record. This commonly loops on pairing-required for an already paired device. Remove the stale record with ${issue.removeCommand}, then rerun ${issue.inspectCommand} and approve with ${issue.approveCommand}.`;
+		case "role-upgrade": return `- Pending role upgrade ${issue.pending.requestId} for ${issue.deviceLabel}: approved roles [${formatRoles(issue.approvedRoles)}], requested roles [${formatRoles(issue.requestedRoles)}]. Review with ${issue.inspectCommand}, then approve with ${issue.approveCommand}.`;
+		case "scope-upgrade": return `- Pending scope upgrade ${issue.pending.requestId} for ${issue.deviceLabel}: approved scopes [${formatScopes(issue.approvedScopes)}], requested scopes [${formatScopes(issue.requestedScopes)}]. Review with ${issue.inspectCommand}, then approve with ${issue.approveCommand}.`;
+		case "repair": return `- Pending device repair ${issue.pending.requestId} for ${issue.deviceLabel}: the device is already paired, but a new approval is still required before the requested auth can be used. Review with ${issue.inspectCommand}, then approve with ${issue.approveCommand}.`;
+	}
+	throw new Error("Unsupported pending pairing issue");
+}
+function collectPendingPairingIssues(snapshot) {
+	const pairedByDeviceId = new Map(snapshot.paired.map((device) => [device.deviceId, device]));
+	return snapshot.pending.map((pending) => formatPendingPairingIssue(resolvePendingPairingIssue(pending, pairedByDeviceId.get(pending.deviceId))));
+}
+function collectPairedRecordIssues(snapshot) {
+	const lines = [];
+	for (const device of snapshot.paired) {
+		const deviceLabel = describeDevice({
+			deviceId: device.deviceId,
+			displayName: device.displayName,
+			clientId: device.clientId
+		});
+		const approvedRoles = listApprovedPairedDeviceRoles(device);
+		const approvedScopes = resolveApprovedScopes(device);
+		if (approvedRoles.includes("operator") && approvedScopes.length === 0) lines.push(`- Paired device ${deviceLabel} is missing its approved operator scope baseline. Scope upgrades can get stuck in pairing-required until the device repairs or is re-approved.`);
+		for (const role of approvedRoles) {
+			const token = findTokenSummary(device, role);
+			const rotateCommand = formatCliArgs([
+				"genesis",
+				"devices",
+				"rotate",
+				"--device",
+				device.deviceId,
+				"--role",
+				role
+			]);
+			if (!token) {
+				lines.push(`- Paired device ${deviceLabel} has no active ${role} device token even though the role is approved. This commonly ends in pairing-required or device-token-mismatch. Rotate a fresh token with ${rotateCommand}.`);
+				continue;
+			}
+			if (token.scopes.length > 0 && !roleScopesAllow({
+				role,
+				requestedScopes: token.scopes,
+				allowedScopes: approvedScopes
+			})) lines.push(`- Paired device ${deviceLabel} has a ${role} token outside the approved scope baseline [${formatScopes(approvedScopes)}]. Rotate it with ${rotateCommand}.`);
+		}
+	}
+	return lines;
+}
+function readJsonFile(filePath) {
+	try {
+		if (!fs.existsSync(filePath)) return null;
+		return JSON.parse(fs.readFileSync(filePath, "utf8"));
+	} catch {
+		return null;
+	}
+}
+function readLocalIdentity(env = process.env) {
+	const identity = readJsonFile(path.join(resolveStateDir(env), "identity", "device.json"));
+	if (!identity || typeof identity !== "object" || !hasNumberVersion(identity) || identity.version !== 1 || !("deviceId" in identity) || typeof identity.deviceId !== "string" || !identity.deviceId.trim()) return null;
+	return {
+		version: 1,
+		deviceId: identity.deviceId
+	};
+}
+function readLocalDeviceAuthStore(env = process.env) {
+	const store = readJsonFile(path.join(resolveStateDir(env), "identity", "device-auth.json"));
+	if (!store || typeof store !== "object" || !hasNumberVersion(store) || store.version !== 1 || !("deviceId" in store) || typeof store.deviceId !== "string" || !store.deviceId.trim() || !("tokens" in store) || typeof store.tokens !== "object" || store.tokens === null) return null;
+	const tokens = {};
+	for (const [role, entry] of Object.entries(store.tokens)) {
+		if (!isDeviceAuthStoreTokenEntry(entry)) return null;
+		tokens[role] = entry;
+	}
+	return {
+		version: 1,
+		deviceId: store.deviceId,
+		tokens
+	};
+}
+function collectLocalDeviceAuthIssues(snapshot) {
+	const identity = readLocalIdentity();
+	const store = readLocalDeviceAuthStore();
+	if (!identity || !store || store.deviceId !== identity.deviceId) return [];
+	const paired = snapshot.paired.find((device) => device.deviceId === identity.deviceId);
+	if (!paired) return [];
+	const deviceLabel = describeDevice({
+		deviceId: paired.deviceId,
+		displayName: paired.displayName,
+		clientId: paired.clientId
+	});
+	const lines = [];
+	const approvedRoles = new Set(listApprovedPairedDeviceRoles(paired));
+	for (const entry of Object.values(store.tokens)) {
+		const role = entry.role.trim();
+		if (!role) continue;
+		const rotateCommand = formatCliArgs([
+			"genesis",
+			"devices",
+			"rotate",
+			"--device",
+			paired.deviceId,
+			"--role",
+			role
+		]);
+		const pairedToken = findTokenSummary(paired, role);
+		if (!pairedToken) {
+			if (approvedRoles.has(role)) continue;
+			lines.push(`- Local cached ${role} device auth for ${deviceLabel} no longer has a matching active gateway token. Reconnect with shared gateway auth to refresh it, or rotate with ${rotateCommand}.`);
+			continue;
+		}
+		const gatewayIssuedAtMs = pairedToken.rotatedAtMs ?? pairedToken.createdAtMs;
+		if (entry.updatedAtMs < gatewayIssuedAtMs) {
+			lines.push(`- Local cached ${role} device token for ${deviceLabel} predates the gateway rotation. This is a stale device-token pattern and can fail with device token mismatch. Reconnect with shared gateway auth to refresh it, or rotate again with ${rotateCommand}.`);
+			continue;
+		}
+		const cachedScopes = normalizeDeviceAuthScopes(entry.scopes);
+		const pairedScopes = normalizeDeviceAuthScopes(pairedToken.scopes);
+		if (cachedScopes.join("\n") !== pairedScopes.join("\n")) lines.push(`- Local cached ${role} device scopes for ${deviceLabel} differ from the gateway record. Cached scopes [${formatScopes(cachedScopes)}], gateway scopes [${formatScopes(pairedScopes)}]. Reconnect with shared gateway auth to refresh it, or rotate with ${rotateCommand}.`);
+	}
+	return lines;
+}
+async function noteDevicePairingHealth(params) {
+	const snapshot = await loadDoctorPairingSnapshot(params);
+	if (!snapshot) return;
+	const lines = [
+		...collectPendingPairingIssues(snapshot),
+		...collectPairedRecordIssues(snapshot),
+		...collectLocalDeviceAuthIssues(snapshot)
+	];
+	if (lines.length === 0) return;
+	note(lines.join("\n"), "Device pairing");
+}
+//#endregion
+export { noteDevicePairingHealth };

package/dist/doctor-gateway-daemon-flow-vXXN636C.js

@@ -0,0 +1,250 @@
+import { o as getResolvedLoggerSettings } from "./logger-BRmjL88V.js";
+import { v as sleep } from "./utils-CWrkFsp0.js";
+import { t as formatCliCommand } from "./command-format-B3Q5KD9o.js";
+import { u as resolveGatewayPort } from "./paths-Bv2rGpO9.js";
+import { f as resolveGatewaySystemdServiceName, h as resolveNodeLaunchAgentLabel, l as resolveGatewayLaunchAgentLabel, p as resolveGatewayWindowsTaskName } from "./constants-a99_SBoO.js";
+import { n as buildGatewayInstallPlan, r as gatewayInstallErrorHint } from "./auth-install-policy-DEqnEXbn.js";
+import { n as GATEWAY_DAEMON_RUNTIME_OPTIONS, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from "./daemon-runtime-CJizAliC.js";
+import { t as resolveGatewayInstallToken } from "./gateway-install-token-DP3i7WjH.js";
+import { a as isSystemdUserServiceAvailable, h as classifySystemdUnavailableDetail } from "./systemd-BTGP8qYT.js";
+import { i as launchAgentPlistExists, n as isLaunchAgentListed, r as isLaunchAgentLoaded, s as repairLaunchAgentBootstrap } from "./launchd-BkMiQmu-.js";
+import { a as inspectPortUsage, s as formatPortDiagnostics } from "./ports-C52nWpb8.js";
+import { r as resolveGatewayService, t as describeGatewayServiceRestart } from "./service-DiHWY6iI.js";
+import { i as resolveDaemonContainerContext, r as formatRuntimeStatus, t as buildPlatformRuntimeLogHints } from "./runtime-hints-D_7O3wjD.js";
+import "./config-DYHZ3jG1.js";
+import { n as renderSystemdUnavailableHints, t as isSystemdUnavailableDetail } from "./systemd-hints-DVl7S0v7.js";
+import { r as isWSLEnv, t as isWSL } from "./wsl-MRqgi1hF.js";
+import { t as readLastGatewayErrorLine } from "./diagnostics-BuUW0Us9.js";
+import "./logging-D96hbuQz.js";
+import { t as note } from "./note-CCJmtpzn.js";
+import { n as formatHealthCheckFailure } from "./health-format-BFbPd0XF.js";
+import { n as healthCommand } from "./health-QMMhy2Dz.js";
+//#region src/commands/doctor-format.ts
+function formatGatewayRuntimeSummary(runtime) {
+	return formatRuntimeStatus(runtime);
+}
+function buildGatewayRuntimeHints(runtime, options = {}) {
+	const hints = [];
+	if (!runtime) return hints;
+	const platform = options.platform ?? process.platform;
+	const env = options.env ?? process.env;
+	const container = Boolean(resolveDaemonContainerContext(env));
+	const fileLog = (() => {
+		try {
+			return getResolvedLoggerSettings().file;
+		} catch {
+			return null;
+		}
+	})();
+	if (platform === "linux" && isSystemdUnavailableDetail(runtime.detail)) {
+		hints.push(...renderSystemdUnavailableHints({
+			wsl: isWSLEnv(),
+			kind: classifySystemdUnavailableDetail(runtime.detail),
+			container
+		}));
+		if (fileLog) hints.push(`File logs: ${fileLog}`);
+		return hints;
+	}
+	if (runtime.cachedLabel && platform === "darwin") {
+		const label = resolveGatewayLaunchAgentLabel(env.GENESIS_PROFILE);
+		hints.push(`LaunchAgent label cached but plist missing. Clear with: launchctl bootout gui/$UID/${label}`);
+		hints.push(`Then reinstall: ${formatCliCommand("genesis gateway install", env)}`);
+	}
+	if (runtime.missingUnit) {
+		hints.push(`Service not installed. Run: ${formatCliCommand("genesis gateway install", env)}`);
+		if (fileLog) hints.push(`File logs: ${fileLog}`);
+		return hints;
+	}
+	if (runtime.status === "stopped") {
+		hints.push("Service is loaded but not running (likely exited immediately).");
+		if (fileLog) hints.push(`File logs: ${fileLog}`);
+		hints.push(...buildPlatformRuntimeLogHints({
+			platform,
+			env,
+			systemdServiceName: resolveGatewaySystemdServiceName(env.GENESIS_PROFILE),
+			windowsTaskName: resolveGatewayWindowsTaskName(env.GENESIS_PROFILE)
+		}));
+	}
+	return hints;
+}
+//#endregion
+//#region src/commands/doctor-gateway-daemon-flow.ts
+async function maybeRepairLaunchAgentBootstrap(params) {
+	if (process.platform !== "darwin") return false;
+	if (!await isLaunchAgentListed({ env: params.env })) return false;
+	if (await isLaunchAgentLoaded({ env: params.env })) return false;
+	if (!await launchAgentPlistExists(params.env)) return false;
+	note("LaunchAgent is listed but not loaded in launchd.", `${params.title} LaunchAgent`);
+	if (!await params.prompter.confirmRuntimeRepair({
+		message: `Repair ${params.title} LaunchAgent bootstrap now?`,
+		initialValue: true
+	})) return false;
+	params.runtime.log(`Bootstrapping ${params.title} LaunchAgent...`);
+	const repair = await repairLaunchAgentBootstrap({ env: params.env });
+	if (!repair.ok) {
+		params.runtime.error(`${params.title} LaunchAgent bootstrap failed: ${repair.detail ?? "unknown error"}`);
+		return false;
+	}
+	if (!await isLaunchAgentLoaded({ env: params.env })) {
+		params.runtime.error(`${params.title} LaunchAgent still not loaded after repair.`);
+		return false;
+	}
+	note(`${params.title} LaunchAgent repaired.`, `${params.title} LaunchAgent`);
+	return true;
+}
+async function maybeRepairGatewayDaemon(params) {
+	if (params.healthOk) return;
+	const service = resolveGatewayService();
+	let loaded = false;
+	try {
+		loaded = await service.isLoaded({ env: process.env });
+	} catch {
+		loaded = false;
+	}
+	let serviceRuntime;
+	if (loaded) serviceRuntime = await service.readRuntime(process.env).catch(() => void 0);
+	if (process.platform === "darwin" && params.cfg.gateway?.mode !== "remote") {
+		const gatewayRepaired = await maybeRepairLaunchAgentBootstrap({
+			env: process.env,
+			title: "Gateway",
+			runtime: params.runtime,
+			prompter: params.prompter
+		});
+		await maybeRepairLaunchAgentBootstrap({
+			env: {
+				...process.env,
+				GENESIS_LAUNCHD_LABEL: resolveNodeLaunchAgentLabel()
+			},
+			title: "Node",
+			runtime: params.runtime,
+			prompter: params.prompter
+		});
+		if (gatewayRepaired) {
+			loaded = await service.isLoaded({ env: process.env });
+			if (loaded) serviceRuntime = await service.readRuntime(process.env).catch(() => void 0);
+		}
+	}
+	if (params.cfg.gateway?.mode !== "remote") {
+		const diagnostics = await inspectPortUsage(resolveGatewayPort(params.cfg, process.env));
+		if (diagnostics.status === "busy") note(formatPortDiagnostics(diagnostics).join("\n"), "Gateway port");
+		else if (loaded && serviceRuntime?.status === "running") {
+			const lastError = await readLastGatewayErrorLine(process.env);
+			if (lastError) note(`Last gateway error: ${lastError}`, "Gateway");
+		}
+	}
+	if (!loaded) {
+		if (process.platform === "linux") {
+			if (!await isSystemdUserServiceAvailable().catch(() => false)) {
+				note(renderSystemdUnavailableHints({
+					wsl: await isWSL(),
+					kind: "generic_unavailable"
+				}).join("\n"), "Gateway");
+				return;
+			}
+		}
+		note("Gateway service not installed.", "Gateway");
+		if (params.cfg.gateway?.mode !== "remote") {
+			if (await params.prompter.confirmRuntimeRepair({
+				message: "Install gateway service now?",
+				initialValue: true
+			})) {
+				const daemonRuntime = await params.prompter.select({
+					message: "Gateway service runtime",
+					options: GATEWAY_DAEMON_RUNTIME_OPTIONS,
+					initialValue: DEFAULT_GATEWAY_DAEMON_RUNTIME
+				}, DEFAULT_GATEWAY_DAEMON_RUNTIME);
+				const tokenResolution = await resolveGatewayInstallToken({
+					config: params.cfg,
+					env: process.env
+				});
+				for (const warning of tokenResolution.warnings) note(warning, "Gateway");
+				if (tokenResolution.unavailableReason) {
+					note([
+						"Gateway service install aborted.",
+						tokenResolution.unavailableReason,
+						"Fix gateway auth config/token input and rerun doctor."
+					].join("\n"), "Gateway");
+					return;
+				}
+				const port = resolveGatewayPort(params.cfg, process.env);
+				const { programArguments, workingDirectory, environment } = await buildGatewayInstallPlan({
+					env: process.env,
+					port,
+					runtime: daemonRuntime,
+					warn: (message, title) => note(message, title),
+					config: params.cfg
+				});
+				try {
+					await service.install({
+						env: process.env,
+						stdout: process.stdout,
+						programArguments,
+						workingDirectory,
+						environment
+					});
+				} catch (err) {
+					note(`Gateway service install failed: ${String(err)}`, "Gateway");
+					note(gatewayInstallErrorHint(), "Gateway");
+				}
+			}
+		}
+		return;
+	}
+	const summary = formatGatewayRuntimeSummary(serviceRuntime);
+	const hints = buildGatewayRuntimeHints(serviceRuntime, {
+		platform: process.platform,
+		env: process.env
+	});
+	if (summary || hints.length > 0) {
+		const lines = [];
+		if (summary) lines.push(`Runtime: ${summary}`);
+		lines.push(...hints);
+		note(lines.join("\n"), "Gateway");
+	}
+	if (serviceRuntime?.status !== "running") {
+		if (await params.prompter.confirmRuntimeRepair({
+			message: "Start gateway service now?",
+			initialValue: true
+		})) {
+			const restartStatus = describeGatewayServiceRestart("Gateway", await service.restart({
+				env: process.env,
+				stdout: process.stdout
+			}));
+			if (!restartStatus.scheduled) await sleep(1500);
+			else note(restartStatus.message, "Gateway");
+		}
+	}
+	if (process.platform === "darwin") {
+		const label = resolveGatewayLaunchAgentLabel(process.env.GENESIS_PROFILE);
+		note(`LaunchAgent loaded; stopping requires "${formatCliCommand("genesis gateway stop")}" or launchctl bootout gui/$UID/${label}.`, "Gateway");
+	}
+	if (serviceRuntime?.status === "running") {
+		if (await params.prompter.confirmRuntimeRepair({
+			message: "Restart gateway service now?",
+			initialValue: true
+		})) {
+			const restartStatus = describeGatewayServiceRestart("Gateway", await service.restart({
+				env: process.env,
+				stdout: process.stdout
+			}));
+			if (restartStatus.scheduled) {
+				note(restartStatus.message, "Gateway");
+				return;
+			}
+			await sleep(1500);
+			try {
+				await healthCommand({
+					json: false,
+					timeoutMs: 1e4
+				}, params.runtime);
+			} catch (err) {
+				if (String(err).includes("gateway closed")) {
+					note("Gateway not running.", "Gateway");
+					note(params.gatewayDetailsMessage, "Gateway connection");
+				} else params.runtime.error(formatHealthCheckFailure(err));
+			}
+		}
+	}
+}
+//#endregion
+export { maybeRepairGatewayDaemon };

package/dist/doctor-gateway-health-to-oUHeN.js

@@ -0,0 +1,63 @@
+import { i as formatErrorMessage } from "./errors-CufR9eHH.js";
+import { n as buildGatewayConnectionDetails, r as callGateway } from "./call-CoL9QpLf.js";
+import { t as note } from "./note-CCJmtpzn.js";
+import { n as formatHealthCheckFailure } from "./health-format-BFbPd0XF.js";
+import { n as healthCommand } from "./health-QMMhy2Dz.js";
+import { t as collectChannelStatusIssues } from "./channels-status-issues-4qduZzFD.js";
+//#region src/commands/doctor-gateway-health.ts
+async function checkGatewayHealth(params) {
+	const gatewayDetails = buildGatewayConnectionDetails({ config: params.cfg });
+	const timeoutMs = typeof params.timeoutMs === "number" && params.timeoutMs > 0 ? params.timeoutMs : 1e4;
+	let healthOk = false;
+	try {
+		await healthCommand({
+			json: false,
+			timeoutMs,
+			config: params.cfg
+		}, params.runtime);
+		healthOk = true;
+	} catch (err) {
+		if (String(err).includes("gateway closed")) {
+			note("Gateway not running.", "Gateway");
+			note(gatewayDetails.message, "Gateway connection");
+		} else params.runtime.error(formatHealthCheckFailure(err));
+	}
+	return { healthOk };
+}
+async function noteGatewayChannelStatusIssues(params) {
+	try {
+		const issues = collectChannelStatusIssues(await callGateway({
+			method: "channels.status",
+			params: {
+				probe: true,
+				timeoutMs: params?.probeTimeoutMs ?? 5e3
+			},
+			timeoutMs: params?.callTimeoutMs ?? 6e3
+		}));
+		if (issues.length === 0) return;
+		note(issues.map((issue) => `- ${issue.channel} ${issue.accountId}: ${issue.message}${issue.fix ? ` (${issue.fix})` : ""}`).join("\n"), "Channel warnings");
+	} catch {}
+}
+async function probeGatewayMemoryStatus(params) {
+	const timeoutMs = typeof params.timeoutMs === "number" && params.timeoutMs > 0 ? params.timeoutMs : 8e3;
+	try {
+		const payload = await callGateway({
+			method: "doctor.memory.status",
+			timeoutMs,
+			config: params.cfg
+		});
+		return {
+			checked: true,
+			ready: payload.embedding.ok,
+			error: payload.embedding.error
+		};
+	} catch (err) {
+		return {
+			checked: true,
+			ready: false,
+			error: `gateway memory probe unavailable: ${formatErrorMessage(err)}`
+		};
+	}
+}
+//#endregion
+export { checkGatewayHealth, noteGatewayChannelStatusIssues, probeGatewayMemoryStatus };