@stratusagent/cli 0.11.2 → 0.11.3

package/dist/commands/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../../src/commands/credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAElG,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAG1D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,OAAgC,EAChC,OAAmB,EACnB,MAAsB,EAAE,EACP,EAAE;IACnB,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE9C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,kCAAkC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrF,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,gEAAgE,CAAC,CAAC;YAC5F,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;YAC1D,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;YACxC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,OAAO,GAAG,CAAC,CAAC;YAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC/C,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,sEAAsE;QACtE,mBAAmB;QACnB,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,0CAA0C,eAAe,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACnH,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAEhC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACxC,SAAS,CACP,OAAO,CAAC,MAAM,EACd,KAAK,KAAK,SAAS;gBACjB,CAAC,CAAC,8BAA8B,IAAI,iDAAiD;gBACrF,CAAC,CAAC,SAAS,KAAK,uCAAuC,IAAI,iDAAiD,CAC/G,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,QAAQ,KAAK,GAAG,CAAC,CAAC;QACtG,OAAO,CAAC,CAAC;IACX,CAAC;IAED,SAAS,CACP,OAAO,CAAC,MAAM,EACd,yBAAyB,IAAI,qHAAqH,CACnJ,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,IAAI,MAAM,mBAAmB,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IACzF,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,gCAAgC,IAAI,mFAAmF,IAAI,KAAK,CAAC,CAAC;QAC5J,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;IAC9F,CAAC;IACD,MAAM,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvC,SAAS,CACP,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,OAAO,KAAK,SAAS;QAC3B,CAAC,CAAC,UAAU,IAAI,OAAO,eAAe,CAAC,GAAG,CAAC,0BAA0B;QACrE,CAAC,CAAC,UAAU,IAAI,QAAQ,OAAO,CAAC,OAAO,OAAO,eAAe,CAAC,GAAG,CAAC,uEAAuE,CAC5I,CAAC;IACF,uEAAuE;IACvE,wEAAwE;IACxE,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,0DAA0D,IAAI,kBAAkB,CAAC,CAAC;IAC5G,OAAO,CAAC,CAAC;AACX,CAAC,CAAC"}

package/dist/commands/dashboard.d.ts

@@ -0,0 +1,14 @@
+import type { CliStreams, CliEnvironment } from '../environment.ts';
+import type { ParsedDashboardCommand } from '../parse.ts';
+export declare const openExternalUrl: (url: string) => Promise<void>;
+/**
+ * `stratus dashboard` — open the web UI against a running daemon, starting
+ * one in the foreground when there is none.
+ *
+ * The daemon is started by calling `runServe`, not by rebuilding its wiring:
+ * channels, approvals, the credential preflight, and the log writer are all
+ * decisions `serve` already makes, and a second copy of them here would drift
+ * the first time either side gained a rule.
+ */
+export declare const runDashboard: (command: ParsedDashboardCommand, streams: CliStreams, env?: CliEnvironment) => Promise<number>;
+//# sourceMappingURL=dashboard.d.ts.map

package/dist/commands/dashboard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard.d.ts","sourceRoot":"","sources":["../../src/commands/dashboard.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAK1D,eAAO,MAAM,eAAe,GAAU,KAAK,MAAM,KAAG,OAAO,CAAC,IAAI,CAa/D,CAAC;AAmCF;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GACvB,SAAS,sBAAsB,EAC/B,SAAS,UAAU,EACnB,MAAK,cAAmB,KACvB,OAAO,CAAC,MAAM,CA0JhB,CAAC"}

package/dist/commands/dashboard.js

@@ -0,0 +1,195 @@
+import { spawn } from 'node:child_process';
+import { gatewayToken, readGatewayInfo, gatewayAnswering, HomeHeldError } from "../daemon.js";
+import { writeLine } from "../io.js";
+import { runServe } from "./serve.js";
+const DASHBOARD_TITLE = 'Stratus Agent Dashboard';
+export const openExternalUrl = async (url) => {
+    const platform = process.platform;
+    const command = platform === 'darwin' ? 'open' : platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    await new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: 'ignore', detached: platform !== 'win32' });
+        child.once('error', reject);
+        child.once('spawn', () => {
+            child.unref();
+            resolve();
+        });
+    });
+};
+/**
+ * A one-time URL for the browser.
+ *
+ * This is the whole reason the exchange exists: the CLI can read the token
+ * file and a page cannot, so the CLI lends its authority for exactly one
+ * short-lived trip.
+ */
+const mintDashboardUrl = async (env, base, fetchImpl) => {
+    const token = await gatewayToken(env, undefined);
+    const response = await fetchImpl(`${base}/api/v1/auth/ott`, {
+        method: 'POST',
+        headers: { authorization: `Bearer ${token}` },
+    });
+    if (!response.ok) {
+        throw new Error(`The gateway at ${base} refused to open a dashboard session (HTTP ${response.status}).`);
+    }
+    const payload = await response.json();
+    // The relative form joined to the base we already reached, in preference to
+    // the absolute one: this command knows exactly which address answered, and
+    // the daemon can only infer it from headers.
+    if (payload.path) {
+        return `${base.replace(/\/+$/, '')}${payload.path}`;
+    }
+    if (!payload.url) {
+        throw new Error(`The gateway at ${base} did not return a dashboard URL.`);
+    }
+    return payload.url;
+};
+/**
+ * `stratus dashboard` — open the web UI against a running daemon, starting
+ * one in the foreground when there is none.
+ *
+ * The daemon is started by calling `runServe`, not by rebuilding its wiring:
+ * channels, approvals, the credential preflight, and the log writer are all
+ * decisions `serve` already makes, and a second copy of them here would drift
+ * the first time either side gained a rule.
+ */
+export const runDashboard = async (command, streams, env = {}) => {
+    const fetchImpl = env.fetch ?? globalThis.fetch;
+    if (typeof fetchImpl !== 'function') {
+        writeLine(streams.stderr, 'Error: fetch is unavailable, so the dashboard cannot reach a gateway.');
+        return 1;
+    }
+    const existing = await readGatewayInfo(env);
+    let base = existing && await gatewayAnswering(env, existing.url, fetchImpl) ? existing.url : undefined;
+    const ownDaemon = new AbortController();
+    let serving;
+    if (!base) {
+        writeLine(streams.stdout, 'No daemon is running — starting one. It stops when you do.');
+        writeLine(streams.stdout, 'Run `stratus service install` to keep one running instead.');
+        // One attempt at a daemon of our own. `runServe` can reject before it
+        // publishes anything — an unreadable roster, a session store that will
+        // not open — and a rejected promise nobody is watching for fifteen
+        // seconds is an unhandled rejection, which terminates the process
+        // instead of reaching the message below. Captured rather than
+        // swallowed, so the reason the daemon gave is the reason this command
+        // reports.
+        let daemonFailure;
+        let daemonSettled = false;
+        let daemonExit = Promise.resolve();
+        let attemptedAt = 0;
+        const attempt = () => {
+            daemonFailure = undefined;
+            daemonSettled = false;
+            attemptedAt = Date.now();
+            serving = runServe({
+                command: 'serve',
+                events: false,
+                // Explicitly on. A trusted config may set `api.enabled: false` —
+                // a reasonable thing for a headless box — but this command exists
+                // to open the dashboard, and honouring it here would start a
+                // daemon with no API and then time out waiting for the one it
+                // promised.
+                api: true,
+                ...(command.port !== undefined ? { apiPort: command.port } : {}),
+                // Passed whenever it was asked for, including when it is the
+                // default. `--host 127.0.0.1` against a config saying `0.0.0.0`
+                // is an operator narrowing the bind, and dropping it because it
+                // matched the default did the reverse of what they typed.
+                ...(command.host !== undefined ? { apiHost: command.host } : {}),
+            }, 
+            // The daemon's own chatter belongs on stderr here: stdout is where
+            // this command says where to point a browser, and interleaving the
+            // two makes the one line that matters hard to find.
+            { stdout: streams.stderr, stderr: streams.stderr }, { ...env, shutdownSignal: ownDaemon.signal });
+            daemonExit = serving.then(() => { daemonSettled = true; }, (error) => { daemonFailure = error; daemonSettled = true; });
+        };
+        attempt();
+        // Gated on a daemon actually answering, not on a delay: one publishes
+        // where it bound the moment it binds, and anything less would be a race
+        // dressed up as a timeout. It also stops the moment our daemon gives up
+        // — except when it gave up because another one holds the home. An
+        // installed service still starting has not published its address yet
+        // and is about to: that is the daemon to wait for. And a daemon still
+        // draining may simply exit, with nothing replacing it — so while the
+        // home is held, our own attempt is repeated about once a second, and
+        // takes the home the moment it is free.
+        const startedBy = Date.now() + 15_000;
+        while (!base && Date.now() < startedBy) {
+            const info = await readGatewayInfo(env);
+            if (info && await gatewayAnswering(env, info.url, fetchImpl)) {
+                base = info.url;
+                break;
+            }
+            if (daemonSettled) {
+                if (!(daemonFailure instanceof HomeHeldError)) {
+                    break;
+                }
+                if (Date.now() - attemptedAt >= 1_000) {
+                    attempt();
+                }
+            }
+            await new Promise((resolve) => setTimeout(resolve, 150));
+        }
+        if (!base) {
+            ownDaemon.abort();
+            await daemonExit;
+            writeLine(streams.stderr, daemonFailure instanceof HomeHeldError
+                ? 'Error: another daemon holds this home but never published its address. It may still be starting or '
+                    + 'draining — try again in a moment, or check `stratus service status`.'
+                : daemonFailure
+                    ? `Error: the daemon could not start: ${daemonFailure instanceof Error ? daemonFailure.message : String(daemonFailure)}`
+                    : 'Error: the daemon did not start serving its control API. Is @stratusagent/control-api installed?');
+            return 1;
+        }
+        if (daemonFailure instanceof HomeHeldError) {
+            // The daemon that answered is the one that held the home. Ours never
+            // started, so there is nothing of ours to wait for or to stop: from
+            // here this is the found-a-running-daemon case.
+            serving = undefined;
+        }
+    }
+    let url;
+    try {
+        url = await mintDashboardUrl(env, base, fetchImpl);
+    }
+    catch (error) {
+        ownDaemon.abort();
+        await serving?.catch(() => 0);
+        writeLine(streams.stderr, `Error: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
+    writeLine(streams.stdout, `${DASHBOARD_TITLE} ready at ${base}`);
+    writeLine(streams.stdout, 'That link signs one browser in and can only be used once.');
+    if (command.openBrowser) {
+        try {
+            await (env.openExternal ?? openExternalUrl)(url);
+            writeLine(streams.stdout, 'Opened your default browser.');
+        }
+        catch (error) {
+            writeLine(streams.stderr, `Warning: Could not open the browser automatically: ${error instanceof Error ? error.message : String(error)}`);
+            writeLine(streams.stdout, `Open this yourself: ${url}`);
+        }
+    }
+    else {
+        writeLine(streams.stdout, `Open this to sign in: ${url}`);
+    }
+    if (!serving) {
+        // Someone else owns the daemon; this command's job is done.
+        return 0;
+    }
+    writeLine(streams.stdout, 'Press Ctrl+C to stop the daemon.');
+    if (env.dashboardAutoShutdownMs !== undefined) {
+        await new Promise((resolve) => setTimeout(resolve, env.dashboardAutoShutdownMs));
+        ownDaemon.abort();
+    }
+    // An attempt still in flight when the daemon answered may yet be refused
+    // — the holder published while ours was claiming. The dashboard found a
+    // daemon; that refusal is not its failure.
+    return serving.catch((error) => {
+        if (error instanceof HomeHeldError) {
+            return 0;
+        }
+        throw error;
+    });
+};
+//# sourceMappingURL=dashboard.js.map

package/dist/commands/dashboard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard.js","sourceRoot":"","sources":["../../src/commands/dashboard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9F,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAElD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IAC3F,MAAM,IAAI,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAErE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;QACxF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,KAAK,EAC5B,GAAmB,EACnB,IAAY,EACZ,SAAuB,EACN,EAAE;IACnB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,kBAAkB,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,8CAA8C,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAqC,CAAC;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,6CAA6C;IAC7C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,kCAAkC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC;AACrB,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,OAA+B,EAC/B,OAAmB,EACnB,MAAsB,EAAE,EACP,EAAE;IACnB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,uEAAuE,CAAC,CAAC;QACnG,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,IAAI,GAAG,QAAQ,IAAI,MAAM,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvG,MAAM,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IACxC,IAAI,OAAoC,CAAC;IAEzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,4DAA4D,CAAC,CAAC;QACxF,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,4DAA4D,CAAC,CAAC;QAExF,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,kEAAkE;QAClE,8DAA8D;QAC9D,sEAAsE;QACtE,WAAW;QACX,IAAI,aAAsB,CAAC;QAC3B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QAClD,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,aAAa,GAAG,SAAS,CAAC;YAC1B,aAAa,GAAG,KAAK,CAAC;YACtB,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO,GAAG,QAAQ,CAChB;gBACE,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,KAAK;gBACb,iEAAiE;gBACjE,kEAAkE;gBAClE,6DAA6D;gBAC7D,8DAA8D;gBAC9D,YAAY;gBACZ,GAAG,EAAE,IAAI;gBACT,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,6DAA6D;gBAC7D,gEAAgE;gBAChE,gEAAgE;gBAChE,0DAA0D;gBAC1D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;YACD,mEAAmE;YACnE,mEAAmE;YACnE,oDAAoD;YACpD,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAClD,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,SAAS,CAAC,MAAM,EAAE,CAC7C,CAAC;YACF,UAAU,GAAG,OAAO,CAAC,IAAI,CACvB,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,EAC/B,CAAC,KAAc,EAAE,EAAE,GAAG,aAAa,GAAG,KAAK,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,CACrE,CAAC;QACJ,CAAC,CAAC;QACF,OAAO,EAAE,CAAC;QAEV,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,wCAAwC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACtC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,IAAI,IAAI,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC7D,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,CAAC,aAAa,YAAY,aAAa,CAAC,EAAE,CAAC;oBAC9C,MAAM;gBACR,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,IAAI,KAAK,EAAE,CAAC;oBACtC,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,UAAU,CAAC;YACjB,SAAS,CACP,OAAO,CAAC,MAAM,EACd,aAAa,YAAY,aAAa;gBACpC,CAAC,CAAC,qGAAqG;sBACnG,sEAAsE;gBAC1E,CAAC,CAAC,aAAa;oBACb,CAAC,CAAC,sCAAsC,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;oBACxH,CAAC,CAAC,kGAAkG,CACzG,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,aAAa,YAAY,aAAa,EAAE,CAAC;YAC3C,qEAAqE;YACrE,oEAAoE;YACpE,gDAAgD;YAChD,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;IACH,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,eAAe,aAAa,IAAI,EAAE,CAAC,CAAC;IACjE,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,2DAA2D,CAAC,CAAC;IAEvF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC;YACjD,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,sDAAsD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1I,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,4DAA4D;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACjF,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IACD,yEAAyE;IACzE,wEAAwE;IACxE,2CAA2C;IAC3C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACtC,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;YACnC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/commands/doctor.d.ts

@@ -0,0 +1,40 @@
+import { type CredentialProviderName } from '@stratusagent/state';
+import type { CliStreams, CliEnvironment } from '../environment.ts';
+import type { ParsedDoctorCommand } from '../parse.ts';
+/** One resolved setting, with the thing that decided it. */
+interface DoctorSetting {
+    value: string;
+    source: string;
+}
+export interface DoctorReport {
+    configInUse?: string;
+    /** Config files that exist but lost to `configInUse`, nearest first. */
+    configShadowed: string[];
+    provider: DoctorSetting;
+    model?: DoctorSetting;
+    soul?: DoctorSetting;
+    agent?: string;
+    /** The model a failing run retries on, when one is configured. */
+    fallback?: {
+        provider: string;
+        model: string;
+    };
+    signIns: Array<{
+        provider: CredentialProviderName;
+        status: string;
+    }>;
+    slackAgents: string[];
+    slackPackageInstalled: boolean;
+    rosterCount: number;
+    problems: string[];
+}
+/**
+ * `stratus doctor` — what a run would resolve to right now, and which file
+ * or variable decided each part. Every "why is it using X" question needs
+ * the precedence chain, and reading it out of the source is not something
+ * anyone should have to do.
+ */
+export declare const collectDoctorReport: (command: ParsedDoctorCommand, warn: (message: string) => void, env?: CliEnvironment) => Promise<DoctorReport>;
+export declare const runDoctor: (command: ParsedDoctorCommand, streams: CliStreams, env?: CliEnvironment) => Promise<number>;
+export {};
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAEA,OAAO,EAgBL,KAAK,sBAAsB,EAI5B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,4DAA4D;AAC5D,UAAU,aAAa;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,sBAAsB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,SAAS,mBAAmB,EAC5B,MAAM,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,EAC/B,MAAK,cAAmB,KACvB,OAAO,CAAC,YAAY,CAsTtB,CAAC;AAEF,eAAO,MAAM,SAAS,GACpB,SAAS,mBAAmB,EAC5B,SAAS,UAAU,EACnB,MAAK,cAAmB,KACvB,OAAO,CAAC,MAAM,CAqEhB,CAAC"}

package/dist/commands/doctor.js

@@ -0,0 +1,357 @@
+import { readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { agentsDirPath, defaultApiKeyEnvName, DEFAULT_STRATUS_AGENT, globalConfigPath, loadChannelCredentials, loadCredentials, loadRosterSouls, loadSoulFile, readNonEmptyString, readProcessEnv, readWorkingDirectory, DEFAULT_CONFIG_FILENAME, loadConfigFile, resolveRuntimeConfig as resolveStateRuntimeConfig, CREDENTIAL_PROVIDER_NAMES, } from '@stratusagent/state';
+import { readServiceCommand } from "../service.js";
+import { serviceEnvFor } from "../daemon.js";
+import { writeLine, pathExists } from "../io.js";
+import { loadSlackAdapter } from "../loaders.js";
+/**
+ * `stratus doctor` — what a run would resolve to right now, and which file
+ * or variable decided each part. Every "why is it using X" question needs
+ * the precedence chain, and reading it out of the source is not something
+ * anyone should have to do.
+ */
+export const collectDoctorReport = async (command, warn, env = {}) => {
+    const processEnv = readProcessEnv(env);
+    const cwd = readWorkingDirectory(env);
+    const problems = [];
+    // Config discovery, spelled out rather than delegated: doctor has to
+    // report the files that LOST as well as the one in use, which is the
+    // whole point when a stray project config is the answer.
+    // Which of the two named it, not just that one did: telling someone to
+    // fix STRATUS_CONFIG when --config is what is set leaves the real
+    // override in place — the same mistake as provider and key attribution,
+    // in the one place a typo is most likely.
+    const explicitSource = command.configPath !== undefined
+        ? { name: '--config', value: command.configPath }
+        : readNonEmptyString(processEnv.STRATUS_CONFIG)
+            ? { name: 'STRATUS_CONFIG', value: String(processEnv.STRATUS_CONFIG) }
+            : undefined;
+    const explicit = explicitSource?.value;
+    const candidates = explicitSource
+        ? [{ path: path.resolve(cwd, explicitSource.value), label: explicitSource.name }]
+        : [
+            { path: path.join(cwd, DEFAULT_CONFIG_FILENAME), label: 'project' },
+            { path: globalConfigPath(env), label: 'global' },
+        ];
+    const present = [];
+    let unreadable;
+    for (const candidate of candidates) {
+        try {
+            await readFile(candidate.path, 'utf8');
+            present.push(candidate);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'ENOENT') {
+                // resolveConfigLocation throws here rather than trying the next
+                // candidate, so discovery stops: a lower-priority file that a real
+                // run never reaches must not be reported as the config in use.
+                unreadable = candidate;
+                problems.push(`${candidate.path} exists but cannot be read (${error.message}). Every run fails here — discovery never reaches a lower-priority config.`);
+                break;
+            }
+            if (explicit) {
+                // Discovery treats a missing candidate as "try the next one", but
+                // an explicitly named config has no next one: a real run calls
+                // loadConfigFile on it and fails. Reporting built-in defaults here
+                // would describe a run that cannot happen, and hide the typo.
+                problems.push(`${candidate.path} does not exist, but ${candidate.label} names it — every run with this setting fails. `
+                    + 'Fix the path, or drop the setting to fall back to config discovery.');
+            }
+        }
+    }
+    const winner = unreadable ?? present[0];
+    const shadowed = unreadable ? [] : present.slice(1);
+    if (winner && shadowed.length > 0 && winner.label.startsWith('project')) {
+        problems.push(`${winner.path} outranks ${shadowed.map((entry) => entry.path).join(' and ')} for runs started in this directory. `
+            + 'Run from elsewhere, or pass --config to pick one explicitly.');
+    }
+    let fileConfig = {};
+    let configFatal = unreadable !== undefined;
+    if (winner && !unreadable) {
+        try {
+            fileConfig = await loadConfigFile(winner.path);
+        }
+        catch (error) {
+            // resolveRuntimeConfig propagates this — no run reaches provider or
+            // credential resolution, so presenting defaults as resolved settings
+            // would describe a run that cannot happen.
+            configFatal = true;
+            problems.push(`${winner.path} could not be parsed (${error.message}). Every run fails until it is fixed or removed.`);
+            warn(`ignoring unreadable config ${winner.path}`);
+        }
+    }
+    // Which variable supplied a value, not just the value: naming the wrong
+    // one sends the reader to unset something that was never the cause,
+    // leaving the real override in place.
+    const envPick = (name) => {
+        const value = readNonEmptyString(processEnv[name]);
+        return typeof value === 'string' ? { name, value } : undefined;
+    };
+    /**
+     * The verdict comes from the resolver, not from a second copy of its
+     * rules. Everything below only *attributes* values to the file or
+     * variable that supplied them — which the resolver does not report —
+     * while whether a run works at all, and what it bills, is whatever
+     * resolveRuntimeConfig actually returns or throws.
+     */
+    const envSoul = envPick('STRATUS_SOUL');
+    const soulValue = envSoul?.value ?? fileConfig.soul;
+    const soulSource = envSoul ? envSoul.name : (winner ? winner.path : '');
+    const soulPath = typeof soulValue === 'string' ? path.resolve(cwd, soulValue) : undefined;
+    // Loaded here for ATTRIBUTION only — the soul's frontmatter is what
+    // explains a provider nobody wrote in a config file. Whether a run works
+    // is still the resolver's verdict below.
+    const soul = soulPath ? await loadSoulFile(soulPath).catch(() => undefined) : undefined;
+    let resolved;
+    if (!configFatal) {
+        try {
+            resolved = await resolveStateRuntimeConfig(command.configPath ? { configPath: command.configPath } : {}, env);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            problems.push(`No run can start: ${message}`);
+            if (soulPath && /soul/i.test(message)) {
+                // Worth saying explicitly: a soul that fails to load is fatal, not
+                // a quiet downgrade to the built-in agent.
+                problems.push(`Every run fails until ${soulPath} is fixed or the soul setting is removed — the built-in agent is not substituted.`);
+            }
+        }
+    }
+    const envProviderPick = envPick('STRATUS_PROVIDER');
+    const providerSource = envProviderPick
+        ? envProviderPick.name
+        : soul?.provider
+            ? `${soulPath} (soul frontmatter)`
+            : fileConfig.provider
+                ? (winner?.path ?? 'config')
+                : 'built-in default — nothing set a provider';
+    // When resolution fails the intended provider is still worth reporting:
+    // "why is it anthropic" is exactly the question, and the problems below
+    // already say no run can start.
+    const intendedProvider = envProviderPick?.value ?? soul?.provider ?? fileConfig.provider ?? 'demo';
+    const provider = resolved
+        ? { value: resolved.provider, source: providerSource }
+        : { value: `${intendedProvider} (unreachable)`, source: providerSource };
+    if (provider.value === 'demo') {
+        // Setup writes the config file, which is the LOWEST precedence of the
+        // three — so when an env var or a soul chose demo, "run setup" is
+        // advice that changes nothing and leaves every run on demo.
+        const fix = envProviderPick
+            ? `Unset ${envProviderPick.name}; it outranks both your config and any soul.`
+            : soul?.provider === 'demo'
+                ? `Change or remove the provider pin in ${soulPath}; a soul outranks the config file.`
+                : fileConfig.provider === 'demo'
+                    ? `Change "provider" in ${winner?.path}, or run \`stratus setup\` → Providers.`
+                    : 'Run `stratus setup` → Providers and sign in, then Save & finish.';
+        problems.push(`Provider is the offline demo model, so replies are canned. ${fix}`);
+    }
+    let model;
+    if (resolved && resolved.provider !== 'demo') {
+        const envModel = envPick('STRATUS_MODEL');
+        // A soul's model belongs to the soul's provider, and the config's model
+        // to the config's provider — either can be stranded by an override.
+        const soulModelApplies = soul?.provider === undefined || soul.provider === resolved.provider;
+        const configModelApplies = (fileConfig.provider ?? 'openai') === resolved.provider;
+        model = {
+            value: resolved.model,
+            source: envModel
+                ? envModel.name
+                : soulModelApplies && soul?.model === resolved.model
+                    ? `${soulPath} (soul frontmatter)`
+                    : configModelApplies && fileConfig.model === resolved.model
+                        ? (winner?.path ?? 'config')
+                        : 'built-in default for this provider',
+        };
+    }
+    const credentials = await loadCredentials(env);
+    const signIns = [];
+    const usedKeyEnvVar = resolved && resolved.provider !== 'demo' ? resolved.apiKeyEnvVar : undefined;
+    const usesAuthToken = resolved?.provider === 'anthropic' && resolved.authToken !== undefined;
+    const fallback = resolved && resolved.provider !== 'demo' ? resolved.fallback : undefined;
+    for (const target of CREDENTIAL_PROVIDER_NAMES) {
+        const stored = credentials[target];
+        const label = stored?.type === 'oauth_token'
+            ? (target === 'codex' ? 'ChatGPT sign-in (codex login)' : 'Claude subscription (Pro/Max)')
+            : 'API key';
+        const isDefault = resolved?.provider === target;
+        const isFallback = fallback?.provider === target;
+        // A provider no resolved run consults is reported, never diagnosed:
+        // flagging an override on a credential nothing reads is a false alarm.
+        if (!isDefault && !isFallback) {
+            signIns.push({
+                provider: target,
+                status: stored
+                    ? `${label} (unused — ${resolved ? resolved.provider : 'nothing'} serves your runs)`
+                    : 'not signed in',
+            });
+            continue;
+        }
+        const envVar = isDefault ? usedKeyEnvVar : defaultApiKeyEnvName(target);
+        const viaEnv = isDefault
+            ? usedKeyEnvVar !== undefined
+            : fallback?.apiKey !== undefined && fallback.apiKey === readNonEmptyString(processEnv[String(envVar)]);
+        const where = isDefault ? 'runs are' : 'fallback runs are';
+        if (stored && viaEnv) {
+            signIns.push({ provider: target, status: `${label}, overridden by ${envVar} in your environment` });
+            // The costly case: an env key silently demotes a subscription to
+            // per-token billing, and nothing in a normal run says so.
+            problems.push(stored.type === 'oauth_token'
+                ? `${envVar} in your environment outranks your saved ${target} subscription sign-in, so ${where} billed per token instead of through your plan. Unset it (check your shell profile) to use the subscription.`
+                : `${envVar} in your environment outranks your saved ${target} sign-in. Unset it to use the one \`stratus setup\` stored.`);
+            continue;
+        }
+        if (viaEnv) {
+            signIns.push({ provider: target, status: `using ${envVar} from your environment` });
+            continue;
+        }
+        if (stored) {
+            signIns.push({ provider: target, status: isDefault && usesAuthToken ? `${label} — runs go through the Claude Code runtime` : label });
+            continue;
+        }
+        signIns.push({ provider: target, status: 'not signed in' });
+    }
+    // A fallback the resolver dropped is the quiet failure: the config still
+    // names one, but a failing primary has nothing to retry on.
+    if (fileConfig.fallbackModel !== undefined && resolved && resolved.provider !== 'demo' && !fallback) {
+        problems.push(`A fallback model (${fileConfig.fallbackModel}) is configured but could not be resolved — usually no sign-in for its provider, or an endpoint its saved key is not sent to. `
+            + 'A failing primary model has nothing to retry on.');
+    }
+    const channels = await loadChannelCredentials(env);
+    const slackAgents = Object.keys(channels.slack ?? {}).sort();
+    const slackPackageInstalled = (await loadSlackAdapter()) !== undefined;
+    if (slackAgents.length > 0 && !slackPackageInstalled) {
+        problems.push(`Slack tokens are stored for ${slackAgents.length} agent(s) but @stratusagent/channel-slack is not installed, so \`stratus serve\` skips them. `
+            + 'Install it with: npm install -g @stratusagent/channel-slack');
+    }
+    let rosterCount = 0;
+    try {
+        rosterCount = (await readdir(agentsDirPath(env))).filter((file) => file.endsWith('.md')).length;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT') {
+            throw error;
+        }
+    }
+    // Tokens keyed to an agent the roster no longer has are loaded and
+    // skipped on every start, silently.
+    let rosterEntries = [];
+    let rosterLoaded = true;
+    try {
+        rosterEntries = await loadRosterSouls(env, warn);
+    }
+    catch (error) {
+        // Doctor exists to name problems, so a roster it cannot load is a
+        // finding to report — not an exception that replaces the report.
+        rosterLoaded = false;
+        problems.push(error instanceof Error ? error.message : String(error));
+    }
+    const rosterIds = new Set(rosterEntries.map((entry) => entry.soul.agent.id));
+    rosterIds.add(DEFAULT_STRATUS_AGENT.id);
+    if (soul) {
+        rosterIds.add(soul.agent.id);
+    }
+    // Only against a roster that actually loaded. "No agent has this id" is
+    // a claim about the roster, and a refused one cannot support it — every
+    // stored token would be reported as orphaned, and this advises clearing
+    // them. Advice is not deletion, but an operator who follows it loses the
+    // same credentials by hand.
+    const orphans = rosterLoaded ? slackAgents.filter((id) => !rosterIds.has(id)) : [];
+    if (orphans.length > 0) {
+        problems.push(`Slack tokens are stored for ${orphans.join(', ')}, which no agent matches — \`stratus serve\` skips them. `
+            + 'Clear them from `stratus setup` → Channels.');
+    }
+    // The invisible failure doctor exists to surface: the service unit embeds
+    // absolute node and entrypoint paths, and upgrading node (an nvm version
+    // directory, say) leaves the unit pointing at an interpreter that no
+    // longer exists. The service stops working and nothing else says so.
+    const unitCommand = await readServiceCommand(serviceEnvFor(env));
+    if (unitCommand?.execPath !== undefined && !(await pathExists(unitCommand.execPath))) {
+        problems.push(`The service unit points at a node interpreter that no longer exists (${unitCommand.execPath}), so stratusd cannot start. `
+            + 'Run `stratus update` (or `stratus service install`) to rewrite it with current paths.');
+    }
+    if (unitCommand?.scriptPath !== undefined && !(await pathExists(unitCommand.scriptPath))) {
+        problems.push(`The service unit points at a CLI entrypoint that no longer exists (${unitCommand.scriptPath}), so stratusd cannot start. `
+            + 'Run `stratus update` (or `stratus service install`) to rewrite it with current paths.');
+    }
+    return {
+        ...(winner ? { configInUse: winner.path } : {}),
+        configShadowed: shadowed.map((entry) => entry.path),
+        provider,
+        ...(model ? { model } : {}),
+        ...(soulPath ? { soul: { value: soulPath, source: soulSource } } : {}),
+        ...(soul ? { agent: `${soul.agent.name} (${soul.agent.id})` } : {}),
+        ...(fallback ? { fallback: { provider: fallback.provider, model: fallback.model } } : {}),
+        signIns,
+        slackAgents,
+        slackPackageInstalled,
+        rosterCount,
+        problems,
+    };
+};
+export const runDoctor = async (command, streams, env = {}) => {
+    const report = await collectDoctorReport(command, (message) => {
+        writeLine(streams.stderr, `Warning: ${message}.`);
+    }, env);
+    if (command.format === 'json') {
+        writeLine(streams.stdout, JSON.stringify(report, null, 2));
+        return report.problems.length > 0 ? 1 : 0;
+    }
+    const field = (label, setting) => {
+        if (!setting) {
+            return;
+        }
+        writeLine(streams.stdout, `  ${label.padEnd(10)}${setting.value}`);
+        writeLine(streams.stdout, `  ${''.padEnd(10)}from ${setting.source}`);
+    };
+    writeLine(streams.stdout, 'Stratus Agent — what a run would use right now');
+    writeLine(streams.stdout);
+    field('provider', report.provider);
+    field('model', report.model);
+    field('soul', report.soul);
+    if (report.agent) {
+        writeLine(streams.stdout, `  ${'agent'.padEnd(10)}${report.agent}`);
+    }
+    else if (report.soul) {
+        // A soul is configured but did not load — saying "built-in" here would
+        // describe a run that cannot happen.
+        writeLine(streams.stdout, `  ${'agent'.padEnd(10)}unresolved — the configured soul could not be read`);
+    }
+    else {
+        writeLine(streams.stdout, `  ${'agent'.padEnd(10)}${DEFAULT_STRATUS_AGENT.name} (built-in — no soul configured)`);
+    }
+    writeLine(streams.stdout);
+    writeLine(streams.stdout, 'Files');
+    writeLine(streams.stdout, `  config    ${report.configInUse ?? 'none found — built-in defaults apply'}`);
+    for (const shadowedPath of report.configShadowed) {
+        writeLine(streams.stdout, `            (${shadowedPath} exists but is outranked)`);
+    }
+    writeLine(streams.stdout, `  agents    ${report.rosterCount} soul file${report.rosterCount === 1 ? '' : 's'}`);
+    if (report.fallback) {
+        writeLine(streams.stdout, `  ${'fallback'.padEnd(10)}${report.fallback.provider} · ${report.fallback.model}`);
+        writeLine(streams.stdout, `  ${''.padEnd(10)}used when the default model errors mid-run`);
+    }
+    writeLine(streams.stdout);
+    writeLine(streams.stdout, 'Sign-ins');
+    for (const entry of report.signIns) {
+        writeLine(streams.stdout, `  ${entry.provider.padEnd(10)}${entry.status}`);
+    }
+    writeLine(streams.stdout);
+    writeLine(streams.stdout, 'Channels');
+    writeLine(streams.stdout, `  slack     ${report.slackAgents.length === 0
+        ? 'no agents connected'
+        : `${report.slackAgents.length} connected (${report.slackAgents.join(', ')})`}`);
+    writeLine(streams.stdout, `            @stratusagent/channel-slack ${report.slackPackageInstalled ? 'installed' : 'not installed'}`);
+    writeLine(streams.stdout);
+    if (report.problems.length === 0) {
+        writeLine(streams.stdout, 'No problems found.');
+        return 0;
+    }
+    writeLine(streams.stdout, `${report.problems.length} problem${report.problems.length === 1 ? '' : 's'} found:`);
+    for (const problem of report.problems) {
+        writeLine(streams.stdout, `  ! ${problem}`);
+    }
+    return 1;
+};
+//# sourceMappingURL=doctor.js.map