@pugi/cli 0.1.0-beta.5 → 0.1.0-beta.51

package/dist/runtime/commands/doctor.js

@@ -0,0 +1,412 @@
+/**
+ * `pugi doctor` — environment health report (Leak L17, 2026-05-27).
+ *
+ * Parity command with Claude Code's `/doctor` (gap doc:
+ * docs/research/2026-05-27-pugi-gap-analysis-3-repos.md §6). Probes
+ * auth, API reachability, CLI version, workspace state, disk space,
+ * Node version, pnpm, git, MCP servers, config file, and session
+ * activity. Emits either a human-readable table OR a structured JSON
+ * envelope depending on `--json`.
+ *
+ * Module contract:
+ *
+ *   - This file owns the WIRING from CLI flags + workspace context to
+ *     the probe runner. The probes themselves live in
+ *     `core/diagnostics/probes/*.ts` and have NO module-level coupling
+ *     to the CLI dispatch surface.
+ *
+ *   - `runDoctorCommand` is the single entry point. Both the top-level
+ *     `pugi doctor` handler in `runtime/cli.ts` AND the in-REPL
+ *     `/doctor` slash command call it. The function returns the
+ *     `DoctorReport` so the REPL can render via the Ink table without
+ *     re-running the probes.
+ *
+ *   - Exit codes are derived from `exitCodeFor(overall)` in
+ *     `core/diagnostics/types.ts` and bubble up via `process.exitCode`
+ *     (matches the convention of every other CLI handler in cli.ts).
+ *
+ *   - The MCP probe is opportunistic: if `core/mcp/registry.js` is
+ *     unavailable for any reason (e.g. sibling L13 not yet landed,
+ *     unexpected schema change), the probe degrades to a graceful
+ *     `skipped` result so the rest of the table still renders.
+ */
+import { execFileSync } from 'node:child_process';
+import { constants as fsConstants, existsSync, accessSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { resolveActiveCredential } from '../../core/credentials.js';
+import { PUGI_CLI_VERSION } from '../version.js';
+import { runProbes, } from '../../core/diagnostics/probe-runner.js';
+import { computeOverall, countProbes, exitCodeFor, } from '../../core/diagnostics/types.js';
+import { probeAuth } from '../../core/diagnostics/probes/auth.js';
+import { probeApi } from '../../core/diagnostics/probes/api.js';
+import { probeCliVersion } from '../../core/diagnostics/probes/cli-version.js';
+import { probeWorkspace } from '../../core/diagnostics/probes/workspace.js';
+import { probeDisk } from '../../core/diagnostics/probes/disk.js';
+import { probeNode } from '../../core/diagnostics/probes/node.js';
+import { probePnpm } from '../../core/diagnostics/probes/pnpm.js';
+import { probeGit } from '../../core/diagnostics/probes/git.js';
+import { probeMcp } from '../../core/diagnostics/probes/mcp.js';
+import { probeConfig } from '../../core/diagnostics/probes/config.js';
+import { probeSession } from '../../core/diagnostics/probes/session.js';
+import { probeDenialTracking } from '../../core/diagnostics/probes/denial-tracking.js';
+import { probeBareMode } from '../../core/diagnostics/probes/bare-mode.js';
+import { probePugiMdHierarchy } from '../../core/diagnostics/probes/pugi-md.js';
+import { probeSandbox } from '../../core/diagnostics/probes/sandbox.js';
+import { probeHooks } from '../../core/diagnostics/probes/hooks.js';
+/**
+ * Default API URL when no PUGI_API_URL env override is set. Mirrors
+ * the constant in `core/credentials.ts` (kept local to avoid an
+ * extra named export from that module).
+ */
+const DEFAULT_API_URL = 'https://api.pugi.io';
+/**
+ * Build the standard probe set with production dependencies. Exported
+ * for the spec so the test can construct the same suite with stub
+ * deps + assert per-probe ordering + fail-isolation in isolation.
+ */
+export function buildDefaultProbes(ctx, options = {}) {
+    const fetchImpl = ctx.fetchImpl ?? globalThis.fetch.bind(globalThis);
+    const now = Date.now;
+    const probes = [
+        {
+            name: 'AUTH',
+            run: () => probeAuth(ctx, {
+                resolveCredential: (env, home) => {
+                    const credential = resolveActiveCredential(env, home);
+                    if (!credential)
+                        return null;
+                    return { apiUrl: credential.apiUrl, apiKey: credential.apiKey };
+                },
+                fetchImpl,
+                now,
+            }),
+            timeoutMs: 4_000,
+        },
+        {
+            name: 'API',
+            run: () => probeApi(ctx, {
+                resolveApiUrl: (env) => {
+                    return env.PUGI_API_URL ?? DEFAULT_API_URL;
+                },
+                fetchImpl,
+                now,
+            }),
+            timeoutMs: 4_000,
+        },
+        {
+            name: 'CLI VERSION',
+            run: () => probeCliVersion({
+                localVersion: options.localCliVersion ?? PUGI_CLI_VERSION,
+                fetchImpl,
+                now,
+            }),
+            timeoutMs: 4_000,
+        },
+        {
+            name: 'WORKSPACE',
+            run: async () => probeWorkspace(ctx, {
+                existsSync,
+                statSync,
+                accessSync,
+                W_OK: fsConstants.W_OK,
+            }),
+        },
+        {
+            name: 'DISK',
+            run: async () => probeDisk(ctx, {
+                getFreeBytes: (home) => getFreeBytesViaDf(home),
+            }),
+        },
+        {
+            name: 'NODE',
+            run: async () => probeNode({ version: process.version }),
+        },
+        {
+            name: 'PNPM',
+            run: async () => probePnpm({
+                resolveVersion: () => execFileSync('pnpm', ['--version'], {
+                    encoding: 'utf8',
+                    timeout: 2_000,
+                    stdio: ['ignore', 'pipe', 'ignore'],
+                }).trim(),
+            }),
+        },
+        {
+            name: 'GIT',
+            run: async () => probeGit(ctx, {
+                resolveVersion: () => execFileSync('git', ['--version'], {
+                    encoding: 'utf8',
+                    timeout: 2_000,
+                    stdio: ['ignore', 'pipe', 'ignore'],
+                }).trim(),
+                isInWorkTree: (cwd) => {
+                    try {
+                        const result = execFileSync('git', ['-C', cwd, 'rev-parse', '--is-inside-work-tree'], {
+                            encoding: 'utf8',
+                            timeout: 2_000,
+                            stdio: ['ignore', 'pipe', 'ignore'],
+                        }).trim();
+                        return result === 'true';
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                resolveHeadSha: (cwd) => {
+                    try {
+                        return execFileSync('git', ['-C', cwd, 'rev-parse', 'HEAD'], {
+                            encoding: 'utf8',
+                            timeout: 2_000,
+                            stdio: ['ignore', 'pipe', 'ignore'],
+                        }).trim();
+                    }
+                    catch {
+                        return null;
+                    }
+                },
+                resolveRoot: (cwd) => {
+                    try {
+                        return execFileSync('git', ['-C', cwd, 'rev-parse', '--show-toplevel'], {
+                            encoding: 'utf8',
+                            timeout: 2_000,
+                            stdio: ['ignore', 'pipe', 'ignore'],
+                        }).trim();
+                    }
+                    catch {
+                        return null;
+                    }
+                },
+            }),
+        },
+        {
+            name: 'MCP SERVERS',
+            run: async () => probeMcpSafely(ctx),
+        },
+        {
+            name: 'CONFIG',
+            run: async () => probeConfig(ctx, {
+                existsSync,
+                readFileSync: (p, encoding) => readFileSync(p, encoding),
+            }),
+        },
+        {
+            name: 'SESSION',
+            run: async () => probeSession(ctx, {
+                existsSync,
+                statSync,
+                readFileSync: (p, encoding) => readFileSync(p, encoding),
+            }, {
+                now,
+                ...(options.liveSessionId ? { liveSessionId: options.liveSessionId } : {}),
+            }),
+        },
+        // α7 L11 (2026-05-27): DENIAL TRACKING probe. Reports the live
+        // session's denial pressure when the REPL adapter wired the
+        // tracker through `runDoctorCommand`; degrades к `skipped` for
+        // top-level `pugi doctor` calls outside the REPL.
+        {
+            name: 'DENIAL TRACKING',
+            run: async () => probeDenialTracking({
+                ...(options.denialTracking ? { tracker: options.denialTracking } : {}),
+            }),
+        },
+        // Leak L22 (2026-05-27): BARE MODE row. Always present so the JSON
+        // schema stays stable; status flips to `ok` when `--bare` or
+        // `PUGI_BARE=1` is active, otherwise `skipped`.
+        {
+            name: 'BARE MODE',
+            run: async () => probeBareMode({ env: ctx.env }),
+        },
+        // Leak L32 (2026-05-27): PUGI.md HIERARCHY row. Reports how many
+        // ambient `PUGI.md` / `CLAUDE.md` files the cwd → homedir walk
+        // discovered, and the closest path. `skipped` when bare mode is
+        // active (walk disabled) or zero files found.
+        // Leak L3 (2026-05-28): SANDBOX row. Reports the platform's available
+        // OS-level sandbox primitive (Seatbelt / Landlock / AppContainer) and
+        // surfaces a `warning` status until the bash-tool sandbox adapter (#5)
+        // is armed. Operator-trust gap visibility — better к flag "not yet
+        // jailed" loud than let operators assume it's already on.
+        {
+            name: 'SANDBOX',
+            run: async () => probeSandbox(ctx),
+        },
+        // Leak L3 (2026-05-28): HOOKS row. Validates `.pugi/hooks-mvp.json`
+        // + `.pugi/hook-chains.json` syntax + shape before the first tool
+        // dispatch fires. Absence = skipped (most workspaces don't ship
+        // hooks); bad JSON = error с remediation hint.
+        {
+            name: 'HOOKS',
+            run: async () => probeHooks(ctx, {
+                existsSync,
+                readFileSync: (p, encoding) => readFileSync(p, encoding),
+            }),
+        },
+        {
+            name: 'PUGI.md HIERARCHY',
+            run: async () => probePugiMdHierarchy({
+                cwd: ctx.cwd,
+                homedir: ctx.home,
+                env: ctx.env,
+            }),
+        },
+    ];
+    return probes;
+}
+/**
+ * Run the full doctor sweep + emit the output via the supplied
+ * writeOutput sink. Returns the report so REPL callers can route it
+ * к the Ink renderer instead of the plain-text fallback.
+ */
+export async function runDoctorCommand(ctx) {
+    const probeCtx = {
+        cwd: ctx.cwd,
+        home: ctx.home,
+        env: ctx.env,
+    };
+    const probes = buildDefaultProbes(probeCtx, {
+        ...(ctx.liveSessionId ? { liveSessionId: ctx.liveSessionId } : {}),
+        ...(ctx.denialTracking ? { denialTracking: ctx.denialTracking } : {}),
+    });
+    const report = await runProbes(probes);
+    // Defensive recompute: even though runProbes already computed the
+    // overall + counts, recomputing here documents the invariant for the
+    // reader and gives the JSON envelope a single source of truth.
+    const overall = computeOverall(report.probes);
+    const counts = countProbes(report.probes);
+    const envelope = {
+        command: 'doctor',
+        overall,
+        counts,
+        durationMs: report.durationMs,
+        probes: report.probes,
+        meta: {
+            cliVersion: PUGI_CLI_VERSION,
+            nodeVersion: process.version,
+            cwd: ctx.cwd,
+        },
+    };
+    const text = renderDoctorTable(envelope);
+    ctx.writeOutput(envelope, text);
+    process.exitCode = exitCodeFor(overall);
+    return { ...report, overall, counts };
+}
+/**
+ * Plain-text table renderer. Mirrors the layout from the leak-parity
+ * spec but is intentionally column-light (3 columns: NAME / STATUS /
+ * DETAIL) so it composes well in narrow terminals without dragging
+ * a layout library into the CLI hot path. The Ink TUI renderer in
+ * `tui/doctor-table.tsx` is the colour-aware variant used inside the
+ * REPL.
+ */
+export function renderDoctorTable(envelope) {
+    const NAME_WIDTH = Math.max('NAME'.length, ...envelope.probes.map((row) => row.name.length));
+    const STATUS_WIDTH = Math.max('STATUS'.length, ...envelope.probes.map((row) => row.status.length));
+    const lines = [];
+    lines.push('Pugi Doctor — environment health report');
+    lines.push('='.repeat(50));
+    lines.push('');
+    for (const row of envelope.probes) {
+        const namePart = row.name.padEnd(NAME_WIDTH, ' ');
+        const statusPart = row.status.toUpperCase().padEnd(STATUS_WIDTH, ' ');
+        const latencyPart = typeof row.latencyMs === 'number' ? ` (${row.latencyMs}ms)` : '';
+        lines.push(`${namePart}  ${statusPart}  ${row.detail}${latencyPart}`);
+        if (row.remediation && (row.status === 'warn' || row.status === 'error')) {
+            lines.push(`${' '.repeat(NAME_WIDTH + STATUS_WIDTH + 4)}→ ${row.remediation}`);
+        }
+    }
+    lines.push('');
+    const { ok, warn, error: errorCount, skipped } = envelope.counts;
+    const summary = envelope.overall === 'healthy'
+        ? 'HEALTHY'
+        : envelope.overall === 'warning'
+            ? 'WARNINGS'
+            : 'ERRORS';
+    lines.push(`${errorCount} error(s), ${warn} warning(s), ${ok} ok, ${skipped} skipped. Overall: ${summary}`);
+    lines.push(`CLI ${envelope.meta.cliVersion}  Node ${envelope.meta.nodeVersion}  cwd ${envelope.meta.cwd}`);
+    return lines.join('\n');
+}
+/**
+ * Wrap the MCP probe in a dynamic import + try/catch so a missing
+ * sibling L13 surface (or a schema mismatch in `core/mcp/registry`)
+ * degrades the row к `skipped` instead of breaking the entire sweep.
+ * The probe-runner already isolates throws into `error` rows; this
+ * wrapper additionally distinguishes "feature not available" from
+ * "feature crashed".
+ */
+async function probeMcpSafely(ctx) {
+    try {
+        const mod = await import('../../core/mcp/registry.js');
+        if (typeof mod.loadMcpRegistry !== 'function') {
+            return {
+                name: 'MCP SERVERS',
+                status: 'skipped',
+                detail: 'MCP integration not exported by this build',
+            };
+        }
+        return await probeMcp(ctx, {
+            loadRegistry: (cwd, options) => mod.loadMcpRegistry(cwd, { connect: options.connect ?? false }),
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            name: 'MCP SERVERS',
+            status: 'skipped',
+            detail: 'MCP integration not available',
+            remediation: `Inspection failed: ${message}`,
+        };
+    }
+}
+/**
+ * Best-effort free-bytes lookup via `df -k <home>`. Parses the second
+ * line (header + one data row) and returns the `Available` column ×
+ * 1024. Throws on parse failure so the probe surfaces a `warn`
+ * instead of a misleading 0-bytes-free verdict.
+ *
+ * Exported for the spec so we can drive it through a stubbed
+ * execFileSync without spawning a real subprocess.
+ */
+export function getFreeBytesViaDf(home) {
+    const out = execFileSync('df', ['-k', home], {
+        encoding: 'utf8',
+        timeout: 2_000,
+        stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    return parseDfOutput(out);
+}
+/**
+ * Parse the textual output of `df -k`. Handles both BSD and GNU
+ * variants — both emit a `Available` column at index 3 of the data
+ * row, with one quirk: long device names wrap к the next line on
+ * GNU, so we collapse whitespace + tab newlines first.
+ */
+export function parseDfOutput(out) {
+    // Collapse multi-line device-name wraps into a single logical row.
+    const collapsed = out.replace(/\n\s+/g, ' ');
+    const lines = collapsed
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    if (lines.length < 2) {
+        throw new Error(`df output too short: ${JSON.stringify(out.slice(0, 64))}`);
+    }
+    const data = lines[1].split(/\s+/);
+    // Schema: Filesystem 1K-blocks Used Available Capacity Mounted-on
+    const availableField = data[3];
+    if (!availableField) {
+        throw new Error(`df output missing Available column: ${JSON.stringify(lines[1])}`);
+    }
+    const value = Number(availableField);
+    if (!Number.isFinite(value) || value < 0) {
+        throw new Error(`df Available column not numeric: ${availableField}`);
+    }
+    return value * 1024;
+}
+/**
+ * Default home dir resolver. Centralised so the CLI handler can call
+ * `runDoctorCommand` without re-importing `os.homedir` everywhere.
+ */
+export function defaultHome() {
+    return homedir();
+}
+//# sourceMappingURL=doctor.js.map

package/dist/runtime/commands/feedback.js

@@ -0,0 +1,184 @@
+/**
+ * `pugi feedback` + `/feedback` slash — Leak L21 (2026-05-27).
+ *
+ * In-CLI feedback collector. Parity with Claude Code's `/feedback`
+ * built-in. The operator never has to leave the terminal to file a
+ * bug / feature / general comment / praise. The wizard collects:
+ *
+ *   1. category   (bug / feature / general / praise)
+ *   2. rating     (1-5)
+ *   3. comment    (multi-line free text)
+ *   4. optional   redacted session context (last 5 turns)
+ *   5. confirm    (final y/n)
+ *
+ * # Module contract
+ *
+ *   - This file owns the WIRING from the CLI surface (TTY mount,
+ *     non-TTY JSON, slash dispatcher) to the queue + submitter
+ *     modules. The corpus + redactor + queue persistence live in
+ *     `core/feedback/{queue.ts,submitter.ts}`. The Ink prompt lives
+ *     in `tui/feedback-prompt.tsx`. Both have zero coupling to the
+ *     CLI dispatch surface.
+ *
+ *   - `runFeedbackCommand` is the single entry point. Both the top-
+ *     level `pugi feedback` handler в `runtime/cli.ts` AND the in-REPL
+ *     `/feedback` slash dispatcher call it. The function returns the
+ *     resolved `FeedbackRunResult` so the slash dispatcher can route
+ *     the outcome message to the REPL's system pane without re-prompting.
+ *
+ *   - Exit code is ALWAYS 0. Feedback is a brand surface — never a
+ *     gate. Failures land as result variants; the wrapper never
+ *     turns a network blip into a non-zero shell exit.
+ *
+ *   - The random-source-style test seam: the run helper accepts an
+ *     `interactive` flag that the spec sets to false, plus an injected
+ *     `draft` so unit tests can drive the submit + queue branches
+ *     without mounting Ink.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { enqueueFeedback, feedbackQueuePath, flushFeedbackQueue, } from '../../core/feedback/queue.js';
+import { feedbackSubmitUrl, redactSessionContext, submitFeedback, } from '../../core/feedback/submitter.js';
+/**
+ * Drive one feedback round. The function is async because of the
+ * submit round-trip, but everything else (queue write, redaction) is
+ * sync — no surprise concurrency.
+ */
+export async function runFeedbackCommand(ctx) {
+    if (ctx.draft == null) {
+        return { kind: 'cancelled' };
+    }
+    const envelope = {
+        category: ctx.draft.category,
+        rating: ctx.draft.rating,
+        comment: ctx.draft.comment,
+        ts: new Date().toISOString(),
+        cliVersion: ctx.cliVersion,
+        ...(ctx.tier ? { tier: ctx.tier } : {}),
+    };
+    if (ctx.draft.includeSessionContext && ctx.sessionContext) {
+        const sc = ctx.sessionContext();
+        if (sc)
+            envelope.sessionContext = sc;
+    }
+    let result;
+    try {
+        result = await ctx.submit(envelope);
+    }
+    catch (err) {
+        // Defensive: a thrown submitter (should not happen — the live
+        // submitter catches everything) is treated as transient so the
+        // envelope lands in the queue.
+        const reason = err instanceof Error ? err.message : String(err);
+        result = { kind: 'transient', reason };
+    }
+    if (result.kind === 'ok') {
+        return { kind: 'submitted', envelope, httpStatus: result.httpStatus };
+    }
+    if (result.kind === 'transient') {
+        const path = enqueueFeedback(envelope, ctx.cwd);
+        return { kind: 'queued', envelope, path, reason: result.reason };
+    }
+    // permanent — log + drop
+    return {
+        kind: 'dropped',
+        envelope,
+        reason: result.reason,
+        httpStatus: result.httpStatus,
+    };
+}
+/**
+ * Render one human-readable toast for the operator. Centralised so the
+ * top-level `pugi feedback` shell handler + the in-REPL `/feedback`
+ * slash dispatcher agree on the copy.
+ */
+export function renderFeedbackToast(result) {
+    switch (result.kind) {
+        case 'submitted':
+            return 'Feedback submitted. Thank you.';
+        case 'queued':
+            return `Feedback queued locally. Will sync on next online run. (${result.path})`;
+        case 'cancelled':
+            return 'Feedback cancelled. Nothing was sent.';
+        case 'dropped':
+            return `Feedback rejected by server (${result.httpStatus}): ${result.reason}. Not queued.`;
+        case 'noop':
+            return `No feedback collected: ${result.reason}`;
+    }
+}
+/**
+ * Background queue flush. Invoked silently on session start so any
+ * envelopes that landed during an offline run get drained when the
+ * operator next has connectivity. The function never throws — it
+ * returns the flush stats so the caller can log them at debug level.
+ */
+export async function flushFeedbackQueueSilently(cwd, config) {
+    // Short-circuit when the queue file does not exist. Avoids a
+    // pointless `fs.stat` round-trip on every cold session start.
+    if (!existsSync(feedbackQueuePath(cwd))) {
+        return { attempted: 0, succeeded: 0, failed: 0 };
+    }
+    const result = await flushFeedbackQueue(cwd, async (env) => {
+        const r = await submitFeedback(env, config);
+        if (r.kind === 'ok')
+            return true;
+        if (r.kind === 'permanent') {
+            // Permanent failures are "done" from the queue's POV — they
+            // would never resolve on retry. Drop them so the queue does
+            // not grow without bound.
+            return true;
+        }
+        return false;
+    });
+    return {
+        attempted: result.attempted,
+        succeeded: result.succeeded,
+        failed: result.failed,
+    };
+}
+/**
+ * Re-exports — the spec imports these via the command module so the
+ * dependency graph in the test stays single-rooted.
+ */
+export { feedbackQueuePath, feedbackSubmitUrl, redactSessionContext, submitFeedback, };
+/**
+ * Read the persona conversation log if present. Best-effort: returns
+ * an empty list when the file is missing or malformed. The CLI's REPL
+ * persists transcripts via the session module at a canonical relative
+ * path under `.pugi/sessions/`. The shell-level `pugi feedback` does
+ * not have access to a live session, so it tries to pick up the most
+ * recent persisted one for the `--with-context` path.
+ *
+ * Intentionally tolerant — feedback works even with no transcript.
+ */
+export function readMostRecentTranscript(cwd, options = {}) {
+    // The CLI may persist sessions in several places depending on the
+    // surface. We probe the conventional default; the spec drives the
+    // function via a fixture file instead of a live REPL.
+    const candidate = resolve(cwd, '.pugi', 'sessions', 'latest.jsonl');
+    if (!existsSync(candidate))
+        return [];
+    try {
+        const text = readFileSync(candidate, 'utf8');
+        const lines = text.split('\n').filter((l) => l.trim().length > 0);
+        const turns = [];
+        for (const line of lines) {
+            try {
+                const obj = JSON.parse(line);
+                if ((obj.role === 'user' || obj.role === 'assistant' || obj.role === 'system')
+                    && typeof obj.text === 'string') {
+                    turns.push({ role: obj.role, text: obj.text });
+                }
+            }
+            catch {
+                // skip malformed line
+            }
+        }
+        const cap = options.maxTurns ?? 5;
+        return turns.slice(-cap);
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=feedback.js.map