@robota-sdk/agent-command 3.0.0-beta.79 → 3.0.0-beta.81

package/src/doctor/doctor-repair.ts

@@ -0,0 +1,136 @@
+/**
+ * The doctor's closed repair allowlist (OBSERVABILITY-1991).
+ *
+ * Two entries, both existing idempotent writers, both gated on the state being re-read IMMEDIATELY
+ * before the write (the report a user read a minute ago is not the state on disk now):
+ * - the host's own user settings file (id `settings.user.<family>`) exists but holds nothing
+ *   (`empty`); rewriting it as `{}` through `writeSettings` loses no content and changes neither
+ *   onboarding (`isFirstRun` keys on a separate marker) nor provider setup (which keys on document
+ *   content).
+ * - `storage.user` — the host's user store root or its sessions directory is missing or not
+ *   owner-only; `ensureOwnerOnlyDirectory` creates and tightens both.
+ * Anything else — an unknown id, a state that is not the repairable one, an already-clean check —
+ * is refused with no write.
+ */
+import { ensureOwnerOnlyDirectory } from '@robota-sdk/agent-core/node';
+import { inspectSettingsLayers, writeSettings } from '@robota-sdk/agent-framework';
+
+import {
+  isRepairableSettingsLayer,
+  settingsCheckId,
+  userSettingsCheckId,
+} from './doctor-settings-probe.js';
+import { userStorageState } from './doctor-storage-probe.js';
+
+import type { IDoctorDeps, IDoctorInputs } from './doctor-types.js';
+
+export const STORAGE_REPAIR_ID = 'storage.user';
+
+/** The closed allowlist for this composition: the host's user settings layer id and `storage.user`. */
+export function doctorRepairAllowlist(inputs: IDoctorInputs): readonly string[] {
+  const settings = userSettingsCheckId(inputs);
+  return settings === undefined ? [STORAGE_REPAIR_ID] : [settings, STORAGE_REPAIR_ID];
+}
+
+export interface IDoctorRepairPlan {
+  readonly id: string;
+  /** What the writer will do, for the confirmation prompt. */
+  readonly description: string;
+  readonly path: string;
+}
+
+export type TDoctorRepairPlanResult =
+  | { readonly ok: true; readonly plan: IDoctorRepairPlan }
+  | { readonly ok: false; readonly reason: string };
+
+export type TDoctorRepairOutcome =
+  | { readonly applied: true; readonly plan: IDoctorRepairPlan }
+  | { readonly applied: false; readonly reason: string };
+
+export function isDoctorRepairId(id: string, inputs: IDoctorInputs): boolean {
+  return doctorRepairAllowlist(inputs).includes(id);
+}
+
+function planSettingsRepair(id: string, inputs: IDoctorInputs): TDoctorRepairPlanResult {
+  const layer = inspectSettingsLayers(inputs.settingsSources).layers.find(
+    (candidate) => settingsCheckId(candidate.source) === id,
+  );
+  if (layer === undefined || layer.source.kind !== 'host') {
+    return { ok: false, reason: `${id}: no user settings layer in this composition` };
+  }
+  if (!isRepairableSettingsLayer(layer, inputs)) {
+    return { ok: false, reason: `${id}: state is ${layer.state}; only an empty file is rewritten` };
+  }
+  return {
+    ok: true,
+    plan: {
+      id,
+      description: 'rewrite the empty user settings file as {}',
+      path: layer.source.path,
+    },
+  };
+}
+
+function planStorageRepair(inputs: IDoctorInputs, deps: IDoctorDeps): TDoctorRepairPlanResult {
+  const state = userStorageState(inputs, deps);
+  const { root } = inputs.userStorage;
+  if (state !== 'missing' && state !== 'too-open') {
+    return {
+      ok: false,
+      reason: `storage.user: state is ${state}; only a missing or too-open directory is repaired`,
+    };
+  }
+  return {
+    ok: true,
+    plan: {
+      id: 'storage.user',
+      description:
+        'create the user store root and its sessions directory as owner-only directories',
+      path: root,
+    },
+  };
+}
+
+/** Re-read the state now and decide whether `id` is repairable in it. Never writes. */
+export function planDoctorRepair(
+  id: string,
+  inputs: IDoctorInputs,
+  deps: IDoctorDeps,
+): TDoctorRepairPlanResult {
+  if (!isDoctorRepairId(id, inputs)) {
+    return {
+      ok: false,
+      reason: `${id}: not a repairable check (allowlist: ${doctorRepairAllowlist(inputs).join(', ')})`,
+    };
+  }
+  return id === STORAGE_REPAIR_ID
+    ? planStorageRepair(inputs, deps)
+    : planSettingsRepair(id, inputs);
+}
+
+/**
+ * Plan, confirm, re-plan, write. `confirm` is the host's prompt (`--yes` supplies `() => true`); a
+ * refusal or an absent prompt writes nothing. The plan is recomputed after confirmation so a state
+ * that changed while the user was deciding is refused rather than overwritten.
+ */
+export async function applyDoctorRepair(
+  id: string,
+  inputs: IDoctorInputs,
+  deps: IDoctorDeps,
+  confirm: (plan: IDoctorRepairPlan) => Promise<boolean>,
+): Promise<TDoctorRepairOutcome> {
+  const first = planDoctorRepair(id, inputs, deps);
+  if (!first.ok) return { applied: false, reason: first.reason };
+  if (!(await confirm(first.plan)))
+    return { applied: false, reason: `${id}: repair not confirmed; nothing written` };
+  const current = planDoctorRepair(id, inputs, deps);
+  if (!current.ok)
+    return { applied: false, reason: `${current.reason} (state changed before the write)` };
+  if (current.plan.id === STORAGE_REPAIR_ID) {
+    const { root, sessions } = inputs.userStorage;
+    ensureOwnerOnlyDirectory(sessions, { withinRoot: root });
+  } else {
+    writeSettings(current.plan.path, {});
+  }
+  return { applied: true, plan: current.plan };
+}

package/src/doctor/doctor-runner.ts

@@ -0,0 +1,122 @@
+/**
+ * The doctor runner (OBSERVABILITY-1991): one pass over every probe, one redaction boundary, one
+ * exit-code aggregation. Reachable without a session — it constructs no provider, no preset and no
+ * session; the host supplies what it composed and the checks only it can make.
+ */
+import { probeExtensions } from './doctor-extensions-probe.js';
+import {
+  collectSettingsSecrets,
+  describeDiagnosticError,
+  redactDiagnosticText,
+} from './doctor-redaction.js';
+import { probeProvider, probeSettings } from './doctor-settings-probe.js';
+import { probeStorageAndTrust } from './doctor-storage-probe.js';
+
+import type { ISettingsProbeResult } from './doctor-settings-probe.js';
+import type { IDoctorCheck, IDoctorDeps, IDoctorInputs, IDoctorReport } from './doctor-types.js';
+
+/** A probe that throws is a `fail` check carrying the owner's error class — never a default value. */
+function probeFailure(id: string, label: string, error: Error): IDoctorCheck {
+  return { id, label, status: 'fail', cause: describeDiagnosticError(error) };
+}
+
+async function guarded<T>(
+  id: string,
+  label: string,
+  probe: () => Promise<T> | T,
+  onValue: (value: T) => readonly IDoctorCheck[],
+): Promise<readonly IDoctorCheck[]> {
+  try {
+    return onValue(await probe());
+  } catch (error) {
+    // allow-fallback: the probe's own failure is reported as a check, per the fallback declaration
+    return [probeFailure(id, label, error instanceof Error ? error : new Error(String(error)))];
+  }
+}
+
+function redactCheck(check: IDoctorCheck, secrets: readonly string[]): IDoctorCheck {
+  const redact = (text: string): string => redactDiagnosticText(text, secrets);
+  return {
+    ...check,
+    label: redact(check.label),
+    ...(check.path === undefined ? {} : { path: redact(check.path) }),
+    ...(check.cause === undefined ? {} : { cause: redact(check.cause) }),
+    ...(check.detail === undefined ? {} : { detail: check.detail.map(redact) }),
+  };
+}
+
+/** Aggregate checks into the report; `fail` alone raises the exit code (CLI-067). */
+export function buildDoctorReport(checks: readonly IDoctorCheck[]): IDoctorReport {
+  const failCount = checks.filter((check) => check.status === 'fail').length;
+  const warnCount = checks.filter((check) => check.status === 'warn').length;
+  return {
+    checks,
+    failCount,
+    warnCount,
+    repairable: checks.flatMap((check) => (check.repair === undefined ? [] : [check.repair])),
+    exitCode: failCount === 0 ? 0 : 1,
+  };
+}
+
+/** The settings probe under its own boundary: its failure is a `fail` check and later probes run without layers. */
+function guardedSettings(inputs: IDoctorInputs): {
+  checks: readonly IDoctorCheck[];
+  result?: ISettingsProbeResult;
+} {
+  try {
+    const result = probeSettings(inputs);
+    return { checks: result.checks, result };
+  } catch (error) {
+    // allow-fallback: the settings probe's own failure is a `fail` check; later probes run without layers
+    const cause = error instanceof Error ? error : new Error(String(error));
+    return { checks: [probeFailure('settings', 'Settings', cause)] };
+  }
+}
+
+/** Run every probe and return the redacted report. */
+export async function runDoctor(inputs: IDoctorInputs, deps: IDoctorDeps): Promise<IDoctorReport> {
+  const checks: IDoctorCheck[] = [...inputs.hostChecks];
+  if (inputs.compositionFailure !== undefined) checks.push(inputs.compositionFailure);
+
+  const settings = guardedSettings(inputs);
+  checks.push(...settings.checks);
+  const inspection = settings.result?.inspection;
+
+  const secrets = collectSettingsSecrets(
+    (inspection?.layers ?? []).map((layer) => layer.settings),
+    inputs.env,
+  );
+
+  checks.push(
+    ...(await guarded(
+      'provider',
+      'Provider',
+      () => probeProvider(inputs, deps),
+      (provider) => {
+        if (provider.resolvedApiKey !== undefined) secrets.push(provider.resolvedApiKey);
+        return provider.checks;
+      },
+    )),
+  );
+
+  if (inspection !== undefined) {
+    checks.push(
+      ...(await guarded(
+        'storage',
+        'Storage',
+        () => probeStorageAndTrust(inputs, deps, inspection),
+        (c) => c,
+      )),
+    );
+    checks.push(
+      ...(await guarded(
+        'extensions',
+        'Extensions',
+        () => probeExtensions(inputs, deps, inspection),
+        (c) => c,
+      )),
+    );
+  }
+
+  return buildDoctorReport(checks.map((check) => redactCheck(check, secrets)));
+}

package/src/doctor/doctor-settings-probe.ts

@@ -0,0 +1,239 @@
+/**
+ * Settings and provider probes (OBSERVABILITY-1991).
+ *
+ * Every fact here comes from an owner API — `inspectSettingsLayers` for the layers and their
+ * provenance, `readProviderSettings` for the runtime-equivalent provider resolution. The probe adds
+ * no reader of its own; that is the CLI-067 discipline the old `diagnose` command broke three times.
+ */
+import { basename, dirname } from 'node:path';
+
+import { findProviderDefinition } from '@robota-sdk/agent-core';
+import { inspectSettingsLayers, readProviderSettings } from '@robota-sdk/agent-framework';
+
+import { describeDiagnosticError } from './doctor-redaction.js';
+
+import type { IDoctorCheck, IDoctorDeps, IDoctorInputs } from './doctor-types.js';
+import type { IProviderDefinitionConfig } from '@robota-sdk/agent-core';
+import type {
+  ISettingsInspection,
+  ISettingsLayerInspection,
+  TSettingsSource,
+} from '@robota-sdk/agent-framework';
+
+const HTTP_PORT = 80;
+const HTTPS_PORT = 443;
+
+/**
+ * `settings.<scope>.<family>` — the id a user types into `--repair`. The family is the name of the
+ * directory the file lives in, without its leading dot, so the id follows whatever layout the host
+ * composed rather than a product name written here.
+ */
+export function settingsCheckId(source: TSettingsSource): string {
+  const path = source.kind === 'host' ? source.path : source.relativePath;
+  const family = basename(dirname(path)).replace(/^\./, '');
+  return `settings.${source.scope}.${family}`;
+}
+
+/** The check id of the host's own user settings file — the settings repair target. */
+export function userSettingsCheckId(inputs: IDoctorInputs): string | undefined {
+  const source = inputs.settingsSources.find(
+    (candidate) => candidate.kind === 'host' && candidate.path === inputs.userSettingsPath,
+  );
+  return source === undefined ? undefined : settingsCheckId(source);
+}
+
+function layerCause(layer: ISettingsLayerInspection): string {
+  const cause = layer.cause;
+  if (cause === undefined) return layer.state;
+  switch (cause.state) {
+    case 'unreadable':
+      return cause.errno === undefined ? 'unreadable' : `unreadable (${cause.errno})`;
+    case 'invalid-json':
+      return cause.offset === undefined ? 'invalid-json' : `invalid-json at offset ${cause.offset}`;
+    case 'schema-invalid':
+      return `schema-invalid: ${(cause.issues ?? []).map((issue) => `${issue.path} (${issue.code})`).join(', ')}`;
+    default:
+      return cause.state;
+  }
+}
+
+/** Only the host's own user settings file, and only when it is empty, is a settings repair target. */
+export function isRepairableSettingsLayer(
+  layer: ISettingsLayerInspection,
+  inputs: IDoctorInputs,
+): boolean {
+  return (
+    layer.source.kind === 'host' &&
+    layer.source.path === inputs.userSettingsPath &&
+    layer.state === 'empty'
+  );
+}
+
+function layerCheck(layer: ISettingsLayerInspection, inputs: IDoctorInputs): IDoctorCheck {
+  const id = settingsCheckId(layer.source);
+  const path = layer.source.kind === 'host' ? layer.source.path : layer.source.relativePath;
+  if (layer.state === 'absent') {
+    return { id, label: 'Settings layer', status: 'not-configured', path, cause: 'absent' };
+  }
+  if (layer.state === 'ok') return { id, label: 'Settings layer', status: 'ok', path, cause: 'ok' };
+  const repairable = isRepairableSettingsLayer(layer, inputs);
+  return {
+    id,
+    label: 'Settings layer',
+    status: 'fail',
+    path,
+    cause: layerCause(layer),
+    detail: repairable
+      ? ['The file exists but holds nothing; rewriting it as {} loses no content.']
+      : ['Session start will refuse this configuration. Fix the file at the named path.'],
+    ...(repairable ? { repair: id } : {}),
+  };
+}
+
+function provenanceCheck(inspection: ISettingsInspection): IDoctorCheck {
+  const lines = [
+    ...inspection.provenance.map(
+      (entry) => `${entry.key}: ${entry.rule} ← ${entry.contributors.join(' → ')}`,
+    ),
+    ...inspection.hookSources.map(
+      (hook, index) => `settings hook ${index + 1}: ${hook.event}/${hook.type} ← ${hook.source}`,
+    ),
+  ];
+  if (inspection.partial) {
+    return {
+      id: 'settings.merge',
+      label: 'Merged settings',
+      status: 'warn',
+      cause: 'partial — a present layer is broken; session start will refuse this configuration',
+      detail: lines.length === 0 ? ['(no key declared by a healthy layer)'] : lines,
+    };
+  }
+  return {
+    id: 'settings.merge',
+    label: 'Merged settings',
+    status: 'ok',
+    cause: `${inspection.provenance.length} key(s) from ${inspection.layers.filter((l) => l.state === 'ok').length} layer(s)`,
+    detail: lines.length === 0 ? ['(no settings declared)'] : lines,
+  };
+}
+
+export interface ISettingsProbeResult {
+  readonly inspection: ISettingsInspection;
+  readonly checks: readonly IDoctorCheck[];
+}
+
+/** Every layer in precedence order, then the merged view with its provenance. */
+export function probeSettings(inputs: IDoctorInputs): ISettingsProbeResult {
+  const inspection = inspectSettingsLayers(inputs.settingsSources);
+  return {
+    inspection,
+    checks: [
+      ...inspection.layers.map((layer) => layerCheck(layer, inputs)),
+      provenanceCheck(inspection),
+    ],
+  };
+}
+
+function resolutionCheck(config: IProviderDefinitionConfig): IDoctorCheck {
+  const source =
+    config.source === 'env-default'
+      ? `env-default via ${config.sourceEnvVar ?? 'environment'}`
+      : 'settings profile';
+  return {
+    id: 'provider.resolution',
+    label: 'Provider',
+    status: 'ok',
+    cause: `${config.name} (${config.model}) — ${source}`,
+  };
+}
+
+function endpointOf(
+  config: IProviderDefinitionConfig,
+  inputs: IDoctorInputs,
+): { host: string; port: number; origin: string } | undefined {
+  const definition = findProviderDefinition(inputs.providerDefinitions, config.name);
+  const baseURL = config.baseURL ?? definition?.defaults?.baseURL;
+  if (baseURL !== undefined) {
+    try {
+      const url = new URL(baseURL);
+      const port =
+        url.port === '' ? (url.protocol === 'http:' ? HTTP_PORT : HTTPS_PORT) : Number(url.port);
+      return {
+        host: url.hostname,
+        port,
+        origin: config.baseURL === undefined ? 'definition defaults.baseURL' : 'profile baseURL',
+      };
+    } catch {
+      // allow-fallback: an unparseable baseURL is reported by the caller as a warn, never guessed
+      return undefined;
+    }
+  }
+  const endpoint = definition?.endpoint;
+  return endpoint === undefined ? undefined : { ...endpoint, origin: 'definition endpoint' };
+}
+
+async function reachabilityCheck(
+  config: IProviderDefinitionConfig,
+  inputs: IDoctorInputs,
+  deps: IDoctorDeps,
+): Promise<IDoctorCheck> {
+  const endpoint = endpointOf(config, inputs);
+  if (endpoint === undefined) {
+    return {
+      id: 'provider.reachability',
+      label: 'Provider reachability',
+      status: 'warn',
+      cause: `not checked: ${config.name} declares no endpoint (no profile baseURL, defaults.baseURL or definition endpoint)`,
+    };
+  }
+  const result = await deps.probeEndpoint(endpoint.host, endpoint.port);
+  const target = `${endpoint.host}:${endpoint.port} (${endpoint.origin})`;
+  return result.reachable
+    ? {
+        id: 'provider.reachability',
+        label: 'Provider reachability',
+        status: 'ok',
+        cause: `${target} reachable in ${result.elapsedMs ?? 0}ms`,
+      }
+    : {
+        id: 'provider.reachability',
+        label: 'Provider reachability',
+        status: 'warn',
+        cause: `${target} unreachable: ${result.error ?? 'connection failed'}`,
+        detail: ['Check proxy settings, firewall, or the profile baseURL.'],
+      };
+}
+
+/** Runtime-equivalent resolution, then TCP reachability of the host the resolved profile implies. */
+export async function probeProvider(
+  inputs: IDoctorInputs,
+  deps: IDoctorDeps,
+): Promise<{ readonly checks: readonly IDoctorCheck[]; readonly resolvedApiKey?: string }> {
+  let config: IProviderDefinitionConfig;
+  try {
+    config = readProviderSettings(inputs.settingsSources, {
+      providerDefinitions: inputs.providerDefinitions,
+      env: { ...inputs.env },
+    });
+  } catch (error) {
+    // allow-fallback: resolution failure IS the finding; it is reported, never defaulted
+    return {
+      checks: [
+        {
+          id: 'provider.resolution',
+          label: 'Provider',
+          status: 'fail',
+          cause: describeDiagnosticError(error instanceof Error ? error : new Error(String(error))),
+          detail: [
+            inputs.diagnosticGuidance?.providerResolution ??
+              'Configure a provider or set its API key environment variable.',
+          ],
+        },
+      ],
+    };
+  }
+  return {
+    checks: [resolutionCheck(config), await reachabilityCheck(config, inputs, deps)],
+    ...(config.apiKey === undefined ? {} : { resolvedApiKey: config.apiKey }),
+  };
+}

package/src/doctor/doctor-storage-probe.ts

@@ -0,0 +1,187 @@
+/**
+ * Storage, workspace-trust and provider-security probes (OBSERVABILITY-1991). Read-only: existence,
+ * `W_OK` access and mode bits are inspected, never written.
+ */
+import type { IDoctorCheck, IDoctorDeps, IDoctorInputs } from './doctor-types.js';
+import type { ISettingsInspection } from '@robota-sdk/agent-framework';
+
+const FORBIDDEN_MODE_BITS = 0o077;
+
+export type TUserStorageState = 'ok' | 'missing' | 'unwritable' | 'too-open' | 'mode-not-probed';
+
+/** The state the repair allowlist re-reads immediately before writing. */
+export function userStorageState(inputs: IDoctorInputs, deps: IDoctorDeps): TUserStorageState {
+  const { root, sessions } = inputs.userStorage;
+  const facts = [deps.inspectPath(root), deps.inspectPath(sessions)];
+  if (facts.some((f) => !f.exists)) return 'missing';
+  if (facts.some((f) => !f.isDirectory || !f.writable)) return 'unwritable';
+  if (deps.ownerOnlyGuarantee() !== 'posix-mode') return 'mode-not-probed';
+  return facts.some((f) => f.mode !== undefined && (f.mode & FORBIDDEN_MODE_BITS) !== 0)
+    ? 'too-open'
+    : 'ok';
+}
+
+function userStorageCheck(inputs: IDoctorInputs, deps: IDoctorDeps): IDoctorCheck {
+  const { root, sessions } = inputs.userStorage;
+  const base = { id: 'storage.user', label: 'User storage', path: root } as const;
+  switch (userStorageState(inputs, deps)) {
+    case 'missing':
+      return {
+        ...base,
+        status: 'warn',
+        cause: 'not initialized (created on first write)',
+        detail: [root, sessions],
+        repair: 'storage.user',
+      };
+    case 'unwritable':
+      return {
+        ...base,
+        status: 'fail',
+        cause: 'exists but is not a writable directory',
+        detail: [root, sessions],
+      };
+    case 'too-open':
+      return {
+        ...base,
+        status: 'warn',
+        cause: 'not owner-only (mode allows group/other access)',
+        detail: [root, sessions],
+        repair: 'storage.user',
+      };
+    case 'mode-not-probed':
+      return {
+        ...base,
+        status: 'not-probed',
+        cause: 'owner-only mode is not asserted on this platform (windows-acl)',
+      };
+    default:
+      return { ...base, status: 'ok', cause: 'writable, owner-only' };
+  }
+}
+
+function projectStorageCheck(inputs: IDoctorInputs, deps: IDoctorDeps): IDoctorCheck {
+  const access = inputs.projectAccess;
+  if (access.status !== 'trusted') {
+    return {
+      id: 'storage.project',
+      label: 'Project storage',
+      status: 'not-configured',
+      cause: 'project sources are disabled in an untrusted workspace',
+    };
+  }
+  const root = inputs.projectStorageRoot;
+  if (root === undefined) {
+    return {
+      id: 'storage.project',
+      label: 'Project storage',
+      status: 'not-configured',
+      cause: 'the host names no project state root',
+    };
+  }
+  const facts = deps.inspectPath(root);
+  if (!facts.exists) {
+    return {
+      id: 'storage.project',
+      label: 'Project storage',
+      status: 'not-configured',
+      path: root,
+      cause: 'absent (created on first write)',
+    };
+  }
+  return facts.isDirectory && facts.writable
+    ? {
+        id: 'storage.project',
+        label: 'Project storage',
+        status: 'ok',
+        path: root,
+        cause: 'writable',
+      }
+    : {
+        id: 'storage.project',
+        label: 'Project storage',
+        status: 'fail',
+        path: root,
+        cause: 'exists but is not a writable directory',
+      };
+}
+
+function trustCheck(inputs: IDoctorInputs): IDoctorCheck {
+  const access = inputs.projectAccess;
+  if (access.status === 'trusted') {
+    return {
+      id: 'workspace.trust',
+      label: 'Workspace trust',
+      status: 'ok',
+      path: access.identity.displayPath,
+      cause: 'trusted',
+    };
+  }
+  const cause =
+    access.cause === undefined
+      ? access.trustState
+      : `${access.trustState}: ${access.cause.name}: ${access.cause.message}`;
+  return {
+    id: 'workspace.trust',
+    label: 'Workspace trust',
+    status:
+      access.trustState === 'store-unavailable' || access.trustState === 'identity-unavailable'
+        ? 'fail'
+        : 'warn',
+    ...(access.displayPath === undefined ? {} : { path: access.displayPath }),
+    cause,
+    detail: [
+      inputs.diagnosticGuidance?.projectTrust ??
+        'Project sources are disabled. Approve this workspace with the host.',
+    ],
+  };
+}
+
+/**
+ * The credential-quarantine report `robota diagnose` already shipped (CLI-067), over the inspection's
+ * parsed layers instead of a private re-read: a lower-trust layer that changed a profile's `baseURL`
+ * without supplying its own key had the inherited key removed. Neither key is ever shown.
+ */
+function providerSecurityCheck(settings: ISettingsInspection): IDoctorCheck | undefined {
+  const seen = new Map<string, { baseURL?: string; apiKey?: string }>();
+  let quarantined = false;
+  for (const layer of settings.layers) {
+    for (const [name, profile] of Object.entries(layer.settings?.providers ?? {})) {
+      const previous = seen.get(name);
+      if (
+        previous?.apiKey !== undefined &&
+        profile.baseURL !== undefined &&
+        profile.baseURL !== previous.baseURL &&
+        profile.apiKey === undefined
+      ) {
+        quarantined = true;
+      }
+      seen.set(name, {
+        baseURL: profile.baseURL ?? previous?.baseURL,
+        apiKey: profile.apiKey ?? previous?.apiKey,
+      });
+    }
+  }
+  return quarantined
+    ? {
+        id: 'provider.security',
+        label: 'Provider security',
+        status: 'warn',
+        cause: 'provider endpoint quarantined; inherited credential removed (credential redacted)',
+      }
+    : undefined;
+}
+
+/** Workspace trust, storage, then the provider-security report. */
+export function probeStorageAndTrust(
+  inputs: IDoctorInputs,
+  deps: IDoctorDeps,
+  settings: ISettingsInspection,
+): IDoctorCheck[] {
+  const security = providerSecurityCheck(settings);
+  return [
+    trustCheck(inputs),
+    userStorageCheck(inputs, deps),
+    projectStorageCheck(inputs, deps),
+    ...(security === undefined ? [] : [security]),
+  ];
+}