@tacuchi/agent-workflow-cli 25.1.2 → 25.2.0

package/dist/application/doctor/auth-dsn.js

@@ -0,0 +1,143 @@
+import { readMcpConnections } from "../mcp-connections-service.js";
+import { testMcpConnection } from "../mcp-test-connection-service.js";
+import { buildEnvHelp, isDsnVisible } from "../self/mcp-config.js";
+/** El prefijo que hace único el id de un sujeto de este proveedor en todo el registro. */
+const SUBJECT_PREFIX = "env:";
+export const dsnAuthProvider = {
+    id: "dsn",
+    subjects(ctx) {
+        return readMcpConnections(ctx.paths, ctx.env).map((connection) => ({
+            id: `${SUBJECT_PREFIX}${connection.name}`,
+            label: connection.dsnVar,
+            locator: ctx.paths.userDsnFile(),
+        }));
+    },
+    async check(subject, ctx) {
+        const visible = isDsnVisible(ctx, subject.label);
+        return {
+            state: visible ? "present" : "absent",
+            // La evidencia dice PRESENTE o AUSENTE y se detiene ahí. Leer el valor
+            // para describirlo dejaría al informe a un defecto de redacción de
+            // publicarlo.
+            //
+            // El nombre de la variable va SIEMPRE entre paréntesis, y eso es
+            // load-bearing: el redactor lee `<algo>_DSN` seguido de `=`, `:` o un
+            // espacio como una asignación y reemplaza lo que viene después. Nombrar la
+            // variable es exactamente lo que este hallazgo le debe a la persona, así
+            // que el único lugar donde aparece tiene que ser una forma que el redactor
+            // no pueda leer como un valor: un paréntesis de cierre no es un separador,
+            // así que `(DB_X_DSN)` sobrevive y `DB_X_DSN: presente` no.
+            evidence: [`variable de entorno (${subject.label}): ${visible ? "presente" : "ausente"}`],
+        };
+    },
+    /**
+     * Ningún flujo, y declarado como tal.
+     *
+     * El informe lo publica: «esta autenticación no es automatizable» es una
+     * respuesta, y dejarla implícita haría que la persona espere una reparación
+     * que nunca va a existir.
+     */
+    flow() {
+        return null;
+    },
+    verify: {
+        authorization: "network_external",
+        async run(subject, ctx) {
+            const visible = isDsnVisible(ctx, subject.label);
+            if (!visible) {
+                return {
+                    state: "absent",
+                    evidence: [`variable de entorno (${subject.label}): ausente, no hay nada que verificar`],
+                };
+            }
+            // Acá NO se vuelve a comprobar la autorización: el llamador hace valer el
+            // `authorization` que este proveedor declara y sólo llega hasta acá cuando
+            // está concedida. Repetirlo serían dos controles del mismo hecho, y el que
+            // se rompiera quedaría tapado por el otro.
+            const result = await testMcpConnection({
+                dsnVar: subject.label,
+                env: { [subject.label]: ctx.env.get(subject.label) },
+                paths: ctx.paths,
+                platform: process.platform,
+            });
+            if (result.ok) {
+                return {
+                    state: "present",
+                    evidence: [
+                        `variable de entorno (${subject.label}): presente`,
+                        "la base respondió a un SELECT 1 de sólo lectura",
+                    ],
+                };
+            }
+            // La credencial ESTÁ y no sirve, y eso no es «ausente»: es una
+            // verificación que no pudo concluir que la autenticación funciona. Decirlo
+            // `present` porque la variable existe es la falsa salud que este modelo
+            // existe para no decir.
+            return {
+                state: "unverified",
+                evidence: [
+                    `variable de entorno (${subject.label}): presente`,
+                    `la base no respondió: ${result.error ?? "sin detalle"}`,
+                ],
+            };
+        },
+    },
+    /**
+     * La guía nombra la variable y el archivo de arranque, nunca el valor.
+     *
+     * El nombre de la conexión sale del id del sujeto por el prefijo que ESTE
+     * archivo le puso: es su propia codificación, decodificada con la misma
+     * constante y en el mismo módulo. No es leer un id ya renderizado por otro
+     * lado para recuperar un dato estructural — el prefijo está acá justamente
+     * para que los ids de este proveedor sean únicos en todo el registro.
+     */
+    guidance(subject, _ctx) {
+        return survivingGuidance(buildEnvHelp(subject.label, subject.id.slice(SUBJECT_PREFIX.length)));
+    },
+};
+/**
+ * La guía de `buildEnvHelp`, reescrita para que la redacción no la vuelva dañina.
+ *
+ * `buildEnvHelp` emite `export DB_X_DSN='<DSN>'`, que es correcto y no lleva
+ * ningún valor — pero `redactSensitiveText` lee `…_DSN=` como una asignación y
+ * reemplaza lo que sigue, así que la línea LLEGA a la persona como
+ * `export DB_X_DSN=***`. Quien la copie deja literalmente `***` en su archivo de
+ * arranque y el MCP falla con una credencial inválida en vez de con una ausente:
+ * una guía que empeora las cosas es peor que ninguna.
+ *
+ * Así que la línea se parte en dos: el nombre de la variable —lo único
+ * accionable que este hallazgo puede dar— va parentizado, y el valor se nombra
+ * como lo que es, algo que la persona pega y el CLI nunca ve. `next_step` se
+ * releva tal cual: no lleva el nombre pegado a un separador.
+ */
+function survivingGuidance(help) {
+    return [
+        // Ojo con la prosa: cualquier aparición del token de un secreto SEGUIDA de
+        // espacio se lleva la palabra siguiente. Por eso acá no se escribe la sigla
+        // suelta, y el nombre de la variable va siempre entre paréntesis.
+        `exportá en tu entorno la variable (${help.variable}) con la cadena de conexión; el valor lo pegás vos y el CLI no lo guarda en ningún lado`,
+        durableStep(help),
+        help.next_step,
+    ];
+}
+/**
+ * Cómo hacer que la variable sobreviva a la próxima terminal, en ESTA plataforma.
+ *
+ * `buildEnvHelp` sólo nombra un archivo de arranque en la rama *nix; en Windows
+ * devuelve dos comandos de PowerShell y ninguno lleva `>>`. Buscar el archivo y
+ * caer en «el de tu shell» dejaba a quien corre en Windows con una guía que
+ * nombra algo que no existe, y descartaba el único mecanismo durable que su
+ * plataforma tiene — que `buildEnvHelp` sí conoce y que acá se NOMBRA en vez de
+ * relevarse como comando: la línea literal es una asignación, y el redactor la
+ * entrega con `***` donde iba el valor.
+ */
+function durableStep(help) {
+    if (help.platform === "windows") {
+        return `para que sobreviva a la próxima terminal, guardala en tu entorno de usuario con SetEnvironmentVariable de PowerShell a nivel "User", nombrando la misma variable (${help.variable})`;
+    }
+    const named = help.commands.find((command) => command.includes(">>"));
+    const file = named?.split(">>").pop()?.trim();
+    const where = file === undefined || file.length === 0 ? "el de tu shell" : file;
+    return `dejala en tu archivo de arranque (${where}) para que sobreviva a la próxima terminal`;
+}
+//# sourceMappingURL=auth-dsn.js.map

package/dist/application/doctor/auth-dsn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-dsn.js","sourceRoot":"","sources":["../../../src/application/doctor/auth-dsn.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEnE,0FAA0F;AAC1F,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,CAAC,MAAM,eAAe,GAAmC;IAC7D,EAAE,EAAE,KAAK;IAET,QAAQ,CAAC,GAAe;QACtB,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACjE,EAAE,EAAE,GAAG,cAAc,GAAG,UAAU,CAAC,IAAI,EAAE;YACzC,KAAK,EAAE,UAAU,CAAC,MAAM;YACxB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE;SACjC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAA0B,EAAE,GAAe;QACrD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACrC,uEAAuE;YACvE,mEAAmE;YACnE,cAAc;YACd,EAAE;YACF,iEAAiE;YACjE,sEAAsE;YACtE,2EAA2E;YAC3E,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,4DAA4D;YAC5D,QAAQ,EAAE,CAAC,wBAAwB,OAAO,CAAC,KAAK,MAAM,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;SAC1F,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,IAAI;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE;QACN,aAAa,EAAE,kBAAkB;QACjC,KAAK,CAAC,GAAG,CAAC,OAA0B,EAAE,GAAe;YACnD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,KAAK,EAAE,QAAQ;oBACf,QAAQ,EAAE,CAAC,wBAAwB,OAAO,CAAC,KAAK,uCAAuC,CAAC;iBACzF,CAAC;YACJ,CAAC;YACD,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,2CAA2C;YAC3C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;gBACrC,MAAM,EAAE,OAAO,CAAC,KAAK;gBACrB,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;gBACpD,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO;oBACL,KAAK,EAAE,SAAS;oBAChB,QAAQ,EAAE;wBACR,wBAAwB,OAAO,CAAC,KAAK,aAAa;wBAClD,iDAAiD;qBAClD;iBACF,CAAC;YACJ,CAAC;YACD,+DAA+D;YAC/D,2EAA2E;YAC3E,wEAAwE;YACxE,wBAAwB;YACxB,OAAO;gBACL,KAAK,EAAE,YAAY;gBACnB,QAAQ,EAAE;oBACR,wBAAwB,OAAO,CAAC,KAAK,aAAa;oBAClD,yBAAyB,MAAM,CAAC,KAAK,IAAI,aAAa,EAAE;iBACzD;aACF,CAAC;QACJ,CAAC;KACF;IAED;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAA0B,EAAE,IAAgB;QACnD,OAAO,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;CACF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,SAAS,iBAAiB,CAAC,IAAqC;IAC9D,OAAO;QACL,2EAA2E;QAC3E,4EAA4E;QAC5E,kEAAkE;QAClE,sCAAsC,IAAI,CAAC,QAAQ,yFAAyF;QAC5I,WAAW,CAAC,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,IAAqC;IACxD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,qKAAqK,IAAI,CAAC,QAAQ,GAAG,CAAC;IAC/L,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,OAAO,qCAAqC,KAAK,4CAA4C,CAAC;AAChG,CAAC"}

package/dist/application/doctor/auth-flow.js

@@ -0,0 +1,28 @@
+export async function runDoctorAuthFlow(action, ctx) {
+    const argv = action.argv ?? [];
+    const program = argv[0];
+    if (program === undefined) {
+        // Una acción de flujo sin `argv` es un lote que no puede haber salido del
+        // anotador: se declara fallida en vez de correr algo inventado.
+        return {
+            status: "failed",
+            detail: "flujo de autenticación: la acción aprobada no lleva ningún programa sellado",
+        };
+    }
+    if (!ctx.process.hasTty()) {
+        // `blocked` y no `failed`: nada corrió y el recurso quedó como estaba. Un
+        // flujo interactivo sin terminal no es un intento fallido, es un intento que
+        // no corresponde hacer.
+        return {
+            status: "blocked",
+            detail: "flujo de autenticación: no hay terminal para heredar, y el secreto sólo puede ir de la persona al programa por ahí",
+        };
+    }
+    const { code } = await ctx.process.runInteractive(program, [...argv.slice(1)], {
+        cwd: ctx.paths.workspaceDir(),
+    });
+    return code === 0
+        ? { status: "applied", detail: `flujo de autenticación: ${program} terminó con código 0` }
+        : { status: "failed", detail: `flujo de autenticación: ${program} terminó con código ${code}` };
+}
+//# sourceMappingURL=auth-flow.js.map

package/dist/application/doctor/auth-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-flow.js","sourceRoot":"","sources":["../../../src/application/doctor/auth-flow.ts"],"names":[],"mappings":"AAiCA,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAyB,EACzB,GAAe;IAEf,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,gEAAgE;QAChE,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,6EAA6E;SACtF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,6EAA6E;QAC7E,wBAAwB;QACxB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EACJ,oHAAoH;SACvH,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QAC7E,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE;KAC9B,CAAC,CAAC;IACH,OAAO,IAAI,KAAK,CAAC;QACf,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,OAAO,uBAAuB,EAAE;QAC1F,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,2BAA2B,OAAO,uBAAuB,IAAI,EAAE,EAAE,CAAC;AACpG,CAAC"}

package/dist/application/doctor/auth-registry.js

@@ -0,0 +1,12 @@
+import { dsnAuthProvider } from "./auth-dsn.js";
+/**
+ * Los proveedores reales, y hoy hay exactamente uno.
+ *
+ * Ninguno declara flujo. No es una omisión: autenticar lo único autenticable de
+ * este CLI es exportar una cadena que sólo la persona conoce, y cualquier
+ * comando que el CLI corriera para conseguirla tendría que custodiarla. La
+ * maquinaria de flujos existe probada con un doble, y el catálogo real declara
+ * que no la usa.
+ */
+export const DOCTOR_AUTH_PROVIDERS = [dsnAuthProvider];
+//# sourceMappingURL=auth-registry.js.map

package/dist/application/doctor/auth-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-registry.js","sourceRoot":"","sources":["../../../src/application/doctor/auth-registry.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAKhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAqC,CAAC,eAAe,CAAC,CAAC"}

package/dist/application/doctor/hosts.js

@@ -0,0 +1,41 @@
+import { HARNESSES } from "../../domain/harnesses.js";
+import { reportAllHostStates } from "../self/host-states.js";
+/** Catalog order, and every consumer of the report sorts by it. */
+export const DOCTOR_HOST_ORDER = HARNESSES.map((spec) => spec.id);
+const PARTICIPATING = new Set(["ready", "installable", "residual-config"]);
+export async function selectDoctorHosts(ctx, options) {
+    const states = await reportAllHostStates(ctx);
+    const only = new Set(options.only);
+    const ordered = [...states].sort((left, right) => DOCTOR_HOST_ORDER.indexOf(left.host) - DOCTOR_HOST_ORDER.indexOf(right.host));
+    const known = new Set(DOCTOR_HOST_ORDER);
+    const unknownOnly = [...new Set(options.only)].filter((name) => !known.has(name));
+    const hosts = [];
+    const absent = [];
+    for (const state of ordered) {
+        // `--only` restricts; `--host` does not. Two flags because "which host am I
+        // on" and "which hosts do I care about" are different questions, and folding
+        // them made the invoking host silently hide every other one.
+        if (only.size > 0 && !only.has(state.host))
+            continue;
+        if (!PARTICIPATING.has(state.status)) {
+            absent.push(state.host);
+            continue;
+        }
+        hosts.push(viewOf(state, options.currentHost));
+    }
+    return { hosts, absent, states: ordered, unknownOnly };
+}
+function viewOf(state, currentHost) {
+    const spec = HARNESSES.find((candidate) => candidate.id === state.host);
+    return {
+        host: state.host,
+        target: state.target,
+        label: state.label,
+        status: state.status,
+        current: state.host === currentHost,
+        runtime: { state: state.runtime.state, version: state.runtime.version },
+        workline_installed: state.workline.installed,
+        mcp_host: spec?.mcpHostId ?? null,
+    };
+}
+//# sourceMappingURL=hosts.js.map

package/dist/application/doctor/hosts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosts.js","sourceRoot":"","sources":["../../../src/application/doctor/hosts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAkB,MAAM,2BAA2B,CAAC;AAUtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAG7D,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAyB,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAqBxF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE3E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAe,EACf,OAAmE;IAEnE,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAC9B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAC9F,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,iBAAiB,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAElF,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,4EAA4E;QAC5E,6EAA6E;QAC7E,6DAA6D;QAC7D,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACrD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,MAAM,CAAC,KAAsB,EAAE,WAA6B;IACnE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,WAAW;QACnC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE;QACvE,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QAC5C,QAAQ,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI;KAClC,CAAC;AACJ,CAAC"}

package/dist/application/doctor/native-host-state.js

@@ -0,0 +1,211 @@
+/**
+ * What the host itself says about its MCP servers.
+ *
+ * The CLI already runs these two commands and deliberately throws their output
+ * away (`checkNativeMcpHosts`), because there it only needed a yes/no about one
+ * entry. A doctor needs the opposite: the host's own verdict per server, ours
+ * and other people's alike, because an MCP that fails to connect is a problem
+ * the person has whether or not Workline wrote it.
+ *
+ * Both parsers fail CLOSED. Codex publishes JSON and Claude publishes prose with
+ * no contract at all, so a line whose mark is not recognized becomes
+ * `unverified` — never `connected`. A doctor that guesses health from an
+ * unfamiliar format is worse than one that says it could not tell.
+ */
+import { spawnSync as nodeSpawnSync } from "node:child_process";
+export const NATIVE_MCP_HOSTS = ["claude", "codex"];
+/**
+ * The ceiling. `claude mcp list` CONNECTS every server to report its health, so
+ * the diagnostic phase pays for the slowest one; without a bound a single hung
+ * server would hold the whole report.
+ */
+export const NATIVE_READ_TIMEOUT_MS = 15_000;
+export function readNativeMcpState(host, deps = {}) {
+    const run = deps.run ?? defaultRun;
+    const args = host === "codex" ? ["mcp", "list", "--json"] : ["mcp", "list"];
+    const result = run(host, args, deps.timeoutMs ?? NATIVE_READ_TIMEOUT_MS);
+    if (result.errorCode === "ENOENT") {
+        return {
+            ok: false,
+            host,
+            failure: "absent",
+            reason: `el binario '${host}' no está en el PATH`,
+        };
+    }
+    if (result.timedOut) {
+        return {
+            ok: false,
+            host,
+            failure: "failed",
+            reason: `'${host} ${args.join(" ")}' no respondió dentro del límite`,
+        };
+    }
+    if (result.errorCode !== null || result.status !== 0) {
+        return {
+            ok: false,
+            host,
+            failure: "failed",
+            reason: `'${host} ${args.join(" ")}' terminó con código ${result.status ?? "desconocido"}`,
+        };
+    }
+    return host === "codex" ? parseCodexMcpList(result.stdout) : parseClaudeMcpList(result.stdout);
+}
+export function parseCodexMcpList(stdout) {
+    let data;
+    try {
+        data = JSON.parse(stdout);
+    }
+    catch {
+        return {
+            ok: false,
+            host: "codex",
+            failure: "failed",
+            reason: "la salida de 'codex mcp list --json' no es JSON",
+        };
+    }
+    if (!Array.isArray(data)) {
+        return {
+            ok: false,
+            host: "codex",
+            failure: "failed",
+            reason: "'codex mcp list --json' no devolvió una lista",
+        };
+    }
+    const servers = [];
+    for (const raw of data) {
+        if (!isRecord(raw) || typeof raw.name !== "string")
+            continue;
+        servers.push({
+            host: "codex",
+            name: raw.name,
+            health: codexHealth(raw),
+            detail: typeof raw.disabled_reason === "string" ? raw.disabled_reason : null,
+            auth_status: typeof raw.auth_status === "string" ? raw.auth_status : null,
+            transport: transportType(raw.transport),
+        });
+    }
+    return { ok: true, host: "codex", servers };
+}
+/**
+ * Codex reports availability and credentials separately, and so does this.
+ *
+ * `enabled: false` is a deliberate state, not a fault — folding it into "failed"
+ * would put a warning on something the person turned off on purpose. A missing
+ * or non-boolean `enabled` is the fail-closed case: the shape moved and nobody
+ * can say what it means now.
+ */
+function codexHealth(raw) {
+    if (raw.enabled === false)
+        return "disabled";
+    if (raw.enabled !== true)
+        return "unverified";
+    return raw.auth_status === "not_logged_in" ? "needs-auth" : "connected";
+}
+function transportType(value) {
+    if (typeof value === "string")
+        return value;
+    if (isRecord(value) && typeof value.type === "string")
+        return value.type;
+    return null;
+}
+/**
+ * Claude publishes prose. Every mark it is known to print is listed here, and
+ * anything else is `unverified` with the status text it did print.
+ *
+ * The table carries more marks than one capture shows on purpose: the observed
+ * output uses `!` for the authentication case where an earlier capture showed
+ * `⏸`, and a parser that only knows the marks of the machine it was written on
+ * mis-reads the next version as healthy or as broken.
+ */
+const CLAUDE_MARKS = [
+    { mark: "✔", health: "connected" },
+    { mark: "✓", health: "connected" },
+    { mark: "✘", health: "failed" },
+    { mark: "✗", health: "failed" },
+    { mark: "⊘", health: "disabled" },
+    { mark: "⏸", health: "needs-auth" },
+    { mark: "!", health: "needs-auth" },
+];
+export function parseClaudeMcpList(stdout) {
+    const servers = [];
+    for (const line of stdout.split("\n")) {
+        const parsed = parseClaudeLine(line);
+        if (parsed !== null)
+            servers.push(parsed);
+    }
+    return { ok: true, host: "claude", servers };
+}
+function parseClaudeLine(line) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0)
+        return null;
+    // The name is the first whitespace-free token and it ends in a colon. Plugin
+    // servers are named `plugin:<pkg>:<server>`, so splitting on the FIRST colon
+    // would call every one of them `plugin`.
+    const firstSpace = trimmed.indexOf(" ");
+    if (firstSpace <= 0)
+        return null;
+    const token = trimmed.slice(0, firstSpace);
+    if (!token.endsWith(":"))
+        return null;
+    const name = token.slice(0, -1);
+    if (name.length === 0)
+        return null;
+    // The status sits at the end, after the last " - ". The command in between is
+    // deliberately not retained: it is the host's business, it can be long, and a
+    // report has no use for it.
+    const cut = trimmed.lastIndexOf(" - ");
+    const status = cut === -1 ? "" : trimmed.slice(cut + 3).trim();
+    const known = CLAUDE_MARKS.find((candidate) => status.startsWith(candidate.mark));
+    if (known === undefined) {
+        return {
+            host: "claude",
+            name,
+            health: "unverified",
+            detail: status.length === 0 ? "formato de línea no reconocido" : status,
+            auth_status: null,
+            transport: null,
+        };
+    }
+    const detail = status.slice(known.mark.length).trim();
+    return {
+        host: "claude",
+        name,
+        health: known.health,
+        detail: detail.length === 0 ? null : detail,
+        auth_status: null,
+        transport: null,
+    };
+}
+function defaultRun(command, args, timeoutMs) {
+    let result;
+    try {
+        result = nodeSpawnSync(command, [...args], {
+            encoding: "buffer",
+            shell: false,
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: timeoutMs,
+            windowsHide: true,
+        });
+    }
+    catch {
+        return { status: null, stdout: "", errorCode: "SPAWN_FAILED", timedOut: false };
+    }
+    const errorCode = readErrorCode(result.error);
+    return {
+        status: result.status,
+        stdout: result.stdout?.toString("utf8") ?? "",
+        errorCode: errorCode ?? null,
+        timedOut: errorCode === "ETIMEDOUT" || result.signal === "SIGTERM",
+    };
+}
+function readErrorCode(error) {
+    if (error === null || typeof error !== "object")
+        return null;
+    const code = error.code;
+    return typeof code === "string" ? code : null;
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=native-host-state.js.map

package/dist/application/doctor/native-host-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-host-state.js","sourceRoot":"","sources":["../../../src/application/doctor/native-host-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAyB,SAAS,IAAI,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AA6C7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,MAAM,UAAU,kBAAkB,CAAC,IAAmB,EAAE,OAAuB,EAAE;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,eAAe,IAAI,sBAAsB;SAClD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kCAAkC;SACrE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,MAAM,IAAI,aAAa,EAAE;SAC3F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,iDAAiD;SAC1D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,+CAA+C;SACxD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QAC7D,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC;YACxB,MAAM,EAAE,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI;YAC5E,WAAW,EAAE,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;YACzE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,GAA4B;IAC/C,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,UAAU,CAAC;IAC7C,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC;IAC9C,OAAO,GAAG,CAAC,WAAW,KAAK,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;AAC1E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAgE;IAChF,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE;IAClC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE;IAClC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC/B,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC/B,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE;IACjC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE;IACnC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE;CACpC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,6EAA6E;IAC7E,6EAA6E;IAC7E,yCAAyC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,8EAA8E;IAC9E,8EAA8E;IAC9E,4BAA4B;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,IAAI;YACJ,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,MAAM;YACvE,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAC3C,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,OAAe,EACf,IAAuB,EACvB,SAAiB;IAEjB,IAAI,MAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACzC,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,IAAI;SAClB,CAA6B,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;QAC7C,SAAS,EAAE,SAAS,IAAI,IAAI;QAC5B,QAAQ,EAAE,SAAS,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}