@tokenfactory/acc-runner 0.44.0 → 0.44.2

package/dist/doctor.js

@@ -8,18 +8,20 @@ import os from "node:os";
 import path from "node:path";
 import { execa } from "execa";
 import chalk from "chalk";
-import { buildEnv } from "./bin-resolve.js";
+import { buildEnv, executableSearchPaths, resolveExecutable, unresolvedExecutableDetail, } from "./bin-resolve.js";
 import { authPrecedenceHint, servingAuthKind, describeServingAuthKind, anthropicApiKey, forwardsAmbientKey, } from "./provider-auth.js";
-import { openaiApiKey, openaiApiKeyFromKeychain, describeCodexAuthMode, } from "./provider-auth.js";
+import { openaiApiKey, openaiApiKeyFromKeychain, describeCodexAuthMode } from "./provider-auth.js";
 import { codexEngineEnabled, resolveCodexSpawnMode } from "./engines/codex.js";
+import { engineRegistrationState, getConfiguredChatEngine } from "./engines/registry.js";
 import { claudeCodeEngine } from "./engines/claude-code.js";
-import { claudeCodeChatEngine } from "./engines/claude-code-chat.js";
 import { applyBootstrapConfig, CONCURRENCY_ENV, concurrencyEnvExplicit, configSources, loadConfigOrNull, resolveConcurrencyLimit, resolveEffectiveConcurrency, resolveReservedReviewSlots, RESERVED_REVIEW_SLOT_ENV, supabaseConfigSource, } from "./config.js";
 import { getTokenProvider, resolveTokenMode } from "./token-provider.js";
 import { cacheDir } from "./runtime/cache-dir.js";
 import { cloneCacheRoot, listCachedClones } from "./runtime/clone-cache.js";
 import { createRunnerClient } from "./supabase.js";
 import { machineIdentity } from "./login.js";
+import { safeText } from "./machine-capabilities/redact.js";
+import { INSTANCE_ENV, INSTANCE_NAME_RE, instanceKeychainAccount, resolveInstance, } from "./instance.js";
 import { checkVersion } from "./version-check.js";
 import { PROTOCOL_VERSION } from "./types.js";
 import { locksDir, listStaleLocks } from "./runtime/locks.js";
@@ -32,6 +34,10 @@ import { getClaudeVersion, npmLatestVersion, readTaskEnv, } from "./runtime/vers
 import { compareSemver as compareSemverVer } from "./version-check.js";
 import { latestSelfUpdateAttempt } from "./runtime/self-upgrade.js";
 import { PACKAGE_VERSION } from "./pkg-version.js";
+import { resolveCredentialIdentity } from "./credential-identity.js";
+import { readRunningBuild } from "./runtime/running-build.js";
+import { runningBuildStatus } from "./build-fingerprint.js";
+import { probeMcpServer } from "./mcp-spawn.js";
 export const LAUNCHD_LABEL = "com.tokenfactory.acc-runner";
 export function launchdPlistPath() {
     return path.join(os.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
@@ -75,7 +81,7 @@ function maskKey(s) {
 function formatConfig(cfg, bootstrap) {
     const src = configSources(bootstrap);
     const lines = Object.keys(CONFIG_LABELS).map((k) => {
-        // v0.41-B: worktreeRepoPath is optional at the config layer
+        // worktreeRepoPath is optional at the config layer
         // (undefined means "use repoPath"). Render "<not set>" rather than
         // the literal string "undefined" so the doctor output is clean.
         const raw = cfg[k];
@@ -130,9 +136,26 @@ function formatRuntime() {
     ];
     return [chalk.bold("Runtime:"), ...lines].join("\n");
 }
-async function checkBinary(bin, args) {
+async function checkBinary(bin, args, resolveOptions = {}) {
+    const platform = resolveOptions.platform ?? process.platform;
+    const env = resolveOptions.env ?? buildEnv();
+    // AC4: no behaviour change on darwin/linux. Only Windows resolves a concrete
+    // shim up front (execa cannot find a PATHEXT `.cmd`/`.exe` by bare name); POSIX
+    // hands execa the bare name, keeping its own PATH resolution + ENOENT failure.
+    let command = bin;
+    if (platform === "win32") {
+        const options = { ...resolveOptions, env, platform };
+        const resolved = resolveExecutable(bin, options);
+        if (!resolved) {
+            return {
+                ok: false,
+                detail: unresolvedExecutableDetail(bin, executableSearchPaths(bin, options)),
+            };
+        }
+        command = resolved.command;
+    }
     try {
-        const { stdout } = await execa(bin, args, { env: buildEnv() });
+        const { stdout } = await execa(command, args, { env });
         const first = stdout.split(/\r?\n/)[0]?.trim() ?? bin;
         return { ok: true, detail: first };
     }
@@ -149,8 +172,8 @@ async function checkNode() {
         fix: "Install Node 20.6+ (https://nodejs.org).",
     };
 }
-async function checkClaude() {
-    const r = await checkBinary("claude", ["--version"]);
+export async function checkClaude(resolveOptions = {}) {
+    const r = await checkBinary("claude", ["--version"], resolveOptions);
     return {
         name: "claude CLI in PATH",
         ok: r.ok,
@@ -177,9 +200,7 @@ async function checkAnthropicKey() {
             return {
                 name,
                 ok: true,
-                detail: hint
-                    ? `${describeServingAuthKind(kind)} — ${hint}`
-                    : describeServingAuthKind(kind),
+                detail: hint ? `${describeServingAuthKind(kind)} — ${hint}` : describeServingAuthKind(kind),
             };
         }
         return {
@@ -218,16 +239,23 @@ async function checkAnthropicKey() {
  * Secrets are never printed (the probe detail redacts key material). The probe
  * is injectable so the doctor test exercises the rendering without live gh/auth.
  */
-export async function checkChatAuth(probe = () => claudeCodeChatEngine.credentialProbe()) {
+export async function checkChatAuth(probe, engineId) {
+    const engine = !probe || !engineId ? getConfiguredChatEngine() : null;
+    const selectedEngineId = engineId ?? engine?.id ?? "claude-code";
     const name = "chat lane credentials";
-    const result = await probe();
+    const result = await (probe ?? (() => engine.credentialProbe()))();
     if (!result.ok) {
+        const login = selectedEngineId === "codex"
+            ? "codex login"
+            : selectedEngineId === "gemini"
+                ? "gemini"
+                : "claude login";
         return {
             name,
             ok: false,
             warn: true,
-            detail: `chat lane unavailable — ${result.detail}`,
-            fix: "run an interactive `claude` login so the chat lane can serve turns on the operator's subscription (REVIEW-SUBS: ambient ANTHROPIC_API_KEY is no longer used).",
+            detail: `chat lane unavailable for ${selectedEngineId} — ${result.detail}`,
+            fix: `run \`${login}\` under the runner's OS user so ${selectedEngineId} can serve chat from that subscription; no API key is required.`,
         };
     }
     const draftOnly = result.tier === "draft-only";
@@ -237,10 +265,61 @@ export async function checkChatAuth(probe = () => claudeCodeChatEngine.credentia
         warn: draftOnly ? true : undefined,
         detail: `tier=${result.tier} (${result.channel}); ${result.detail}`,
         ...(draftOnly
-            ? { fix: "authenticate `gh` (run `gh auth login`) to lift the chat lane from draft-only to full (repo-mutating) turns." }
+            ? {
+                fix: "authenticate `gh` (run `gh auth login`) to lift the chat lane from draft-only to full (repo-mutating) turns.",
+            }
             : {}),
     };
 }
+/** Prove the installed/fallback MCP command can initialize and list its catalog. */
+export async function checkMcpServer(cfg, deps = {}) {
+    const name = "ACC MCP server";
+    if (!cfg)
+        return { name, ok: true, detail: "config unavailable (skipped)" };
+    let session;
+    try {
+        session = await (deps.loadSession ?? (() => getTokenProvider().load()))();
+    }
+    catch (err) {
+        return {
+            name,
+            ok: false,
+            detail: `runner session unavailable: ${err.message.split("\n")[0]}`,
+            fix: "Re-run `acc login`, then restart the runner.",
+        };
+    }
+    if (!session) {
+        return {
+            name,
+            ok: false,
+            detail: "runner session unavailable",
+            fix: "Run `acc login`, then restart the runner.",
+        };
+    }
+    const probe = deps.probe ?? ((args) => probeMcpServer(args));
+    const result = await probe({
+        cwd: cfg.repoPath,
+        taskId: "",
+        runnerId: session.runner_id,
+        accessToken: session.access_token,
+        publicUrl: cfg.publicUrl,
+        supabaseUrl: cfg.supabaseUrl,
+        supabaseAnonKey: cfg.supabaseAnonKey,
+    });
+    if (!result.ok) {
+        return {
+            name,
+            ok: false,
+            detail: `${result.command} healthcheck failed: ${result.detail}`,
+            fix: "Install the current `@tokenfactory/acc-mcp-server`, then restart every `acc-runner@*.service` instance.",
+        };
+    }
+    return {
+        name,
+        ok: true,
+        detail: `${result.detail} (${result.command})`,
+    };
+}
 /**
  * M4 (ENGINE-CODEX): per-engine validation for the codex engine — binary in
  * PATH + a usable auth channel. Skipped-green when the `engines.codex_enabled`
@@ -252,8 +331,28 @@ export async function checkChatAuth(probe = () => claudeCodeChatEngine.credentia
  */
 export async function checkCodexEngine() {
     const name = "codex engine";
-    if (!codexEngineEnabled()) {
-        return { name, ok: true, detail: "disabled (engines.codex_enabled=off)" };
+    // M5 (CODEX-DISPATCH-WIRE-1): gate on the ACTUAL dispatch registry, not just
+    // the raw flag. `engineRegistrationState` is the same resolution
+    // `getEngine("codex")` performs on dispatch, so doctor's verdict matches what
+    // a codex-pinned task actually gets — binary + login are necessary but not
+    // sufficient; the engine must be REGISTERED for the runner to serve it.
+    const regState = engineRegistrationState("codex");
+    if (regState === "flag_disabled") {
+        return {
+            name,
+            ok: true,
+            detail: "disabled (ACC_ENGINE_CODEX_ENABLED off — not registered for dispatch)",
+        };
+    }
+    if (regState === "unknown") {
+        // codex is a KNOWN batch engine, so this is only reachable if the registry
+        // build dropped it entirely — fail loudly rather than skip green.
+        return {
+            name,
+            ok: false,
+            detail: "codex is not present in this runner's engine registry build",
+            fix: "Rebuild/reinstall @tokenfactory/acc-runner; the codex engine is missing from the registry.",
+        };
     }
     const bin = await checkBinary("codex", ["--version"]);
     if (!bin.ok) {
@@ -276,25 +375,77 @@ export async function checkCodexEngine() {
             fix: "Set OPENAI_API_KEY (env or keychain) for the api-key channel, or use ACC_CODEX_AUTH_PREFERENCE=subscription_first with a `codex login` session.",
         };
     }
+    if (mode === "subscription") {
+        const auth = await checkBinary("codex", ["login", "status"]);
+        if (!auth.ok) {
+            return {
+                name,
+                ok: false,
+                detail: `${bin.detail}; subscription login unusable: ${auth.detail}`,
+                fix: "Run `codex login`, then re-run `acc doctor`.",
+            };
+        }
+        return {
+            name,
+            ok: true,
+            detail: `registered for dispatch; ${bin.detail}; ${describeCodexAuthMode(mode)}; ${auth.detail}`,
+        };
+    }
     return {
         name,
         ok: true,
-        detail: `${bin.detail}; ${describeCodexAuthMode(mode)}; OPENAI_API_KEY ${keyPresent ? "present" : "absent (subscription)"}`,
+        detail: `registered for dispatch; ${bin.detail}; ${describeCodexAuthMode(mode)}; OPENAI_API_KEY ${keyPresent ? "present" : "absent (subscription)"}`,
     };
 }
 export async function detectCapableEngines(deps = {}) {
     const claudeProbe = deps.claudeProbe ?? (() => claudeCodeEngine.healthProbe());
     const codexEnabled = deps.codexEnabled ?? codexEngineEnabled;
     const codexProbe = deps.codexProbe ?? checkCodexEngine;
+    const logRejected = deps.logRejected ?? ((line) => process.stderr.write(`${line}\n`));
     const engines = [];
-    if ((await claudeProbe()).ok)
+    const claude = await claudeProbe();
+    if (claude.ok) {
         engines.push(claudeCodeEngine.id);
+    }
+    else {
+        const detail = safeText(claude.detail, 300) ?? "probe failed";
+        logRejected(`[acc-runner] engine rejected: ${claudeCodeEngine.id}: ${detail}`);
+    }
     if (codexEnabled()) {
-        if ((await codexProbe()).ok)
+        const codex = await codexProbe();
+        if (codex.ok) {
             engines.push("codex");
+        }
+        else {
+            const detail = safeText(codex.detail, 300) ?? "probe failed";
+            logRejected(`[acc-runner] engine rejected: codex: ${detail}`);
+        }
     }
     return engines;
 }
+/**
+ * CAPS-ENGINES-STALE-KEYCHAIN-1 (AC5): surface WHY an enabled engine is or isn't
+ * advertised, on doctor's DEFAULT reporting path — so an operator sees the same
+ * rejection reason detectCapableEngines uses, without reading source. Runs that
+ * exact detection and folds every rejection line into the row's detail. `detect`
+ * is injectable so the reason is testable without the real binaries.
+ */
+export async function checkEngineDetection(detect = detectCapableEngines) {
+    const name = "engine detection";
+    const rejected = [];
+    const advertised = await detect({ logRejected: (line) => rejected.push(line) });
+    const adv = advertised.length ? advertised.join(", ") : "(default engine only)";
+    if (rejected.length === 0) {
+        return { name, ok: true, detail: `advertised: ${adv}` };
+    }
+    return {
+        name,
+        ok: false,
+        warn: true,
+        detail: `advertised: ${adv}; rejected — ${rejected.join(" ; ")}`,
+        fix: "An enabled engine failed its probe (reason above); fix its auth/binary or disable it.",
+    };
+}
 async function checkGh() {
     const ghOk = await checkBinary("gh", ["--version"]);
     if (!ghOk.ok) {
@@ -387,6 +538,34 @@ export async function checkGitAuth(cfg, probeFactory = (repoPath) => makeGitAuth
         fix: "Network/remote hiccup — re-run `doctor`; if it persists, check connectivity to GitHub.",
     };
 }
+/** NAMED-INSTANCES-1: names what diverges per instance — the name, its
+ * keychain slot, and the runner id that slot resolved to. Always OK: unnamed
+ * is normal, and a missing session already fails `runner registered`. */
+export async function checkInstance() {
+    const name = "runner instance";
+    let instance;
+    try {
+        instance = resolveInstance();
+    }
+    catch (err) {
+        const detail = err.message.split("\n")[0];
+        return {
+            name,
+            ok: false,
+            detail,
+            fix: `Fix ${INSTANCE_ENV} / --instance to match ${INSTANCE_NAME_RE.source}.`,
+        };
+    }
+    const slot = resolveTokenMode() === "env" ? "n/a (token mode: env)" : `"${instanceKeychainAccount()}"`;
+    const runner = await getTokenProvider()
+        .load()
+        .then((s) => s?.runner_id ?? "no session", () => "unreadable");
+    return {
+        name,
+        ok: true,
+        detail: `${instance ?? "default (unnamed)"}, keychain slot ${slot}, runner ${runner}`,
+    };
+}
 async function checkKeychain() {
     // v0.12.0 (T-52-7): env-token runners (containers) have no OS keychain;
     // the check is inapplicable rather than broken.
@@ -475,9 +654,7 @@ export async function checkEnvToken() {
     // confirm spare credentials are wired before relying on failover. A single-
     // credential runner reports "no fleet (single credential)".
     const fleetSize = provider.fleetSize();
-    const fleet = fleetSize > 1
-        ? `fleet of ${fleetSize} (failover armed)`
-        : "no fleet (single credential)";
+    const fleet = fleetSize > 1 ? `fleet of ${fleetSize} (failover armed)` : "no fleet (single credential)";
     const expMs = Date.parse(session.access_expires_at);
     if (Number.isFinite(expMs) && expMs <= Date.now()) {
         return {
@@ -493,6 +670,19 @@ export async function checkEnvToken() {
         detail: `runner ${session.runner_id} (id: ${idSource}), ${refresh}, ${fleet}, expires ${session.access_expires_at}`,
     };
 }
+export async function checkCredentialIdentity() {
+    // Resolve the SERVING model-credential account (BYOK key → null email;
+    // config-file or OS-keychain login → the account it carries), NOT the ACC
+    // runner session. Only the safe email/org/source labels are surfaced — never
+    // the underlying token material.
+    const id = await resolveCredentialIdentity();
+    return {
+        name: "model credential identity",
+        ok: true,
+        detail: `email=${id.account_email ?? "unknown"}, org=${id.account_org ?? "unknown"}, ` +
+            `source=${id.credential_source}`,
+    };
+}
 /**
  * RD-1 (BOOTSTRAP-CONFIG): best-effort load of the persisted keychain / env
  * session so the doctor can show WHERE the Supabase config resolved from and
@@ -622,7 +812,10 @@ async function checkOrphanWorktrees(cfg) {
         if (orphans.length === 0) {
             return { name: "no orphan worktrees", ok: true, detail: "clean" };
         }
-        const first = orphans.slice(0, 3).map((o) => o.taskId).join(", ");
+        const first = orphans
+            .slice(0, 3)
+            .map((o) => o.taskId)
+            .join(", ");
         const more = orphans.length > 3 ? ` (+${orphans.length - 3} more)` : "";
         return {
             name: "no orphan worktrees",
@@ -688,7 +881,7 @@ async function checkQuarantine() {
             name: "runner quarantine",
             ok: false,
             detail: `QUARANTINED (${q.cause}): ${q.detail} — task: ${q.taskId}, at: ${q.classifiedAt}${consec}`,
-            fix: `Resolve the underlying ${q.cause} issue then delete ${quarantineFile()} or run \`acc-runner quarantine clear\`.`,
+            fix: `Resolve the underlying ${q.cause} issue, then run \`acc-runner quarantine clear\` for this named instance (sentinel: ${quarantineFile()}); repeat for every instance on the host. Its running watcher resumes on the next recovery tick without a restart.`,
         };
     }
     catch (err) {
@@ -734,7 +927,10 @@ async function checkStaleLocks() {
         if (stale.length === 0) {
             return { name: "no stale task locks", ok: true, detail: "clean" };
         }
-        const first = stale.slice(0, 3).map((l) => l.taskId).join(", ");
+        const first = stale
+            .slice(0, 3)
+            .map((l) => l.taskId)
+            .join(", ");
         const more = stale.length > 3 ? ` (+${stale.length - 3} more)` : "";
         return {
             name: "no stale task locks",
@@ -845,7 +1041,9 @@ export async function checkSelfUpdateOn426(cfg) {
     const enabled = cfg?.selfUpdateOn426 === true;
     const attempt = await latestSelfUpdateAttempt().catch(() => null);
     const last = attempt
-        ? `; last attempt v${attempt.target} ${attempt.record.ok ? "ok" : `failed${attempt.record.error ? ` (${attempt.record.error})` : ""}`} at ${attempt.record.attemptedAt}`
+        ? `; last attempt v${attempt.target} ${attempt.record.ok
+            ? "ok"
+            : `failed${attempt.record.error ? ` (${attempt.record.error})` : ""}`} at ${attempt.record.attemptedAt}`
         : "";
     return {
         name: "self-update on 426",
@@ -918,9 +1116,7 @@ async function checkRegistration() {
             name: "runner registered",
             ok: false,
             detail: provider.mode === "env" ? "no session in env" : "no session in keychain",
-            fix: provider.mode === "env"
-                ? "Set ACC_RUNNER_ACCESS_TOKEN."
-                : "Run `acc-runner login`.",
+            fix: provider.mode === "env" ? "Set ACC_RUNNER_ACCESS_TOKEN." : "Run `acc-runner login`.",
         };
     }
     try {
@@ -956,7 +1152,11 @@ async function checkRegistration() {
                 fix: "Run `acc-runner logout` then `acc-runner login` again.",
             };
         }
-        return { name: "runner registered", ok: true, detail: `${session.runner_id} (status=${data.status})` };
+        return {
+            name: "runner registered",
+            ok: true,
+            detail: `${session.runner_id} (status=${data.status})`,
+        };
     }
     catch (err) {
         return {
@@ -993,7 +1193,11 @@ export async function checkConcurrency(cfg) {
         envExplicit,
     });
     if (!cfg) {
-        return { name, ok: true, detail: `effective ${localEff.concurrency} (source=${localEff.source}), reserve ${localEff.reservedReviewSlots} — config unavailable (skipped)` };
+        return {
+            name,
+            ok: true,
+            detail: `effective ${localEff.concurrency} (source=${localEff.source}), reserve ${localEff.reservedReviewSlots} — config unavailable (skipped)`,
+        };
     }
     const provider = getTokenProvider();
     let session;
@@ -1004,7 +1208,11 @@ export async function checkConcurrency(cfg) {
         session = null;
     }
     if (!session) {
-        return { name, ok: true, detail: `effective ${localEff.concurrency} (source=${localEff.source}), reserve ${localEff.reservedReviewSlots} — not registered (skipped)` };
+        return {
+            name,
+            ok: true,
+            detail: `effective ${localEff.concurrency} (source=${localEff.source}), reserve ${localEff.reservedReviewSlots} — not registered (skipped)`,
+        };
     }
     let row = null;
     try {
@@ -1016,12 +1224,20 @@ export async function checkConcurrency(cfg) {
             .eq("id", session.runner_id)
             .maybeSingle();
         if (error) {
-            return { name, ok: true, detail: `effective ${localEff.concurrency} (source=${localEff.source}) — server row unreadable (skipped): ${error.message.split("\n")[0]}` };
+            return {
+                name,
+                ok: true,
+                detail: `effective ${localEff.concurrency} (source=${localEff.source}) — server row unreadable (skipped): ${error.message.split("\n")[0]}`,
+            };
         }
         row = (data ?? null);
     }
     catch (err) {
-        return { name, ok: true, detail: `effective ${localEff.concurrency} (source=${localEff.source}) — server read failed (skipped): ${err.message.split("\n")[0]}` };
+        return {
+            name,
+            ok: true,
+            detail: `effective ${localEff.concurrency} (source=${localEff.source}) — server read failed (skipped): ${err.message.split("\n")[0]}`,
+        };
     }
     const eff = resolveEffectiveConcurrency({
         serverConcurrency: row?.desired_concurrency ?? null,
@@ -1099,12 +1315,20 @@ export async function checkRepoAssignments(cfg) {
             .eq("active", true)
             .eq("enforced", true);
         if (error) {
-            return { name, ok: true, detail: `no visible assignments (skipped): ${error.message.split("\n")[0]}` };
+            return {
+                name,
+                ok: true,
+                detail: `no visible assignments (skipped): ${error.message.split("\n")[0]}`,
+            };
         }
         rows = (data ?? []);
     }
     catch (err) {
-        return { name, ok: true, detail: `assignment read failed (skipped): ${err.message.split("\n")[0]}` };
+        return {
+            name,
+            ok: true,
+            detail: `assignment read failed (skipped): ${err.message.split("\n")[0]}`,
+        };
     }
     if (rows.length === 0) {
         return { name, ok: true, detail: "no enforced DB assignments visible" };
@@ -1224,6 +1448,38 @@ function format(outcome, strict = false) {
     const fix = !outcome.ok && outcome.fix ? chalk.gray(`\n        → ${outcome.fix}`) : "";
     return `${tag} ${outcome.name.padEnd(28, " ")} ${chalk.gray(outcome.detail)}${fix}`;
 }
+/**
+ * BUILD-FINGERPRINT-RUNNING-1 (AC4): compare the build the long-lived
+ * `watch`/companion process recorded at boot against the build THIS `acc doctor`
+ * process loaded (=== the installed on-disk build). Answers the operator's real
+ * question — "did the launchd process pick up the fix I just installed?" —
+ * WITHOUT needing any symbol name from the diff, the check the incident had to
+ * invent by grepping dist. A stale process is advisory (WARN), not a hard
+ * environment failure; `--strict` promotes it like every other WARN. No record
+ * (nothing long-lived has booted since the feature shipped) is not a problem.
+ */
+export async function checkRunningBuild(read = () => readRunningBuild()) {
+    const name = "Running build";
+    const status = runningBuildStatus(await read());
+    if (status.noRunningRecord) {
+        return {
+            name,
+            ok: true,
+            detail: "no running record — start the runner (`watch`/companion) to record it",
+        };
+    }
+    if (status.restart_required) {
+        return {
+            name,
+            ok: false,
+            warn: true,
+            detail: `STALE — process is running ${status.running?.dist_sha256} (${status.running?.commit_sha}) ` +
+                `but the installed build is ${status.installed.dist_sha256} (${status.installed.commit_sha})`,
+            fix: "Restart the runner (`watch`/companion) process to load the installed build.",
+        };
+    }
+    return { name, ok: true, detail: "up to date (running the installed build)" };
+}
 export async function doctorCommand(options = {}) {
     const rawCfg = loadConfigOrNull();
     // RD-1: overlay the persisted device-code bootstrap so the displayed config
@@ -1235,12 +1491,16 @@ export async function doctorCommand(options = {}) {
         checkClaude,
         checkAnthropicKey,
         checkChatAuth,
+        () => checkMcpServer(cfg),
         checkCodexEngine,
+        checkEngineDetection,
         checkGh,
         checkGit,
         () => checkGitAuth(cfg),
         checkKeychain,
+        checkInstance,
         checkEnvToken,
+        checkCredentialIdentity,
         () => checkBootstrapConfig(bootstrap),
         ...(cfg ? [() => checkServer(cfg.publicUrl)] : []),
         ...(cfg ? [() => checkProtocolVersion(cfg.publicUrl)] : []),
@@ -1259,6 +1519,7 @@ export async function doctorCommand(options = {}) {
         checkClaudeDrift,
         checkCaffeinate,
         checkLaunchd,
+        checkRunningBuild,
     ];
     const strict = options.strict === true;
     if (cfg && !options.checks) {
@@ -1303,9 +1564,7 @@ export async function doctorCommand(options = {}) {
             console.log(chalk.green(`✓ All checks passed${suffix}.`));
         }
         else {
-            const warnNote = warned > 0 && !strict
-                ? `, ${warned} advisory warning${warned === 1 ? "" : "s"}`
-                : "";
+            const warnNote = warned > 0 && !strict ? `, ${warned} advisory warning${warned === 1 ? "" : "s"}` : "";
             console.log(chalk.red(`✗ ${failed} check${failed === 1 ? "" : "s"} failed${warnNote}.`));
         }
     }