@xenosystem/agent-interface-host 0.1.3

package/dist/support/SupportDiagnosticsService.js

@@ -0,0 +1,1199 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from 'fs';
+import { homedir, cpus, freemem, totalmem, uptime as osUptime, platform, release, arch } from 'os';
+import { basename, join } from 'path';
+import { performance } from 'perf_hooks';
+import { getAgentSearchService } from '../agentSearch/AgentSearchService.js';
+import { getSearchSourceWatcher } from '../agentSearch/SearchSourceWatcher.js';
+import { getCodebaseIntelligenceService } from '../codebase/CodebaseIntelligenceService.js';
+import { getPluginMcpManagerService } from '../pluginMcp/PluginMcpManagerService.js';
+import { RuntimeEventStore } from '../runtime/RuntimeEventStore.js';
+import { peekSubagentScheduler } from '../subagents/SubagentScheduler.js';
+import { SubagentRunService } from '../subagents/SubagentRunService.js';
+import { collectAcpDiagnosticsSummary } from '../acp/AcpDiagnosticsService.js';
+const DEFAULT_XENO_DIR = join(homedir(), '.xeno');
+const REDACTED = '[redacted]';
+const SUPPORT_SECRET_PATTERN = /token|secret|password|cookie|authorization|api[-_]?key|credential|bearer|access[-_]?key|refresh[-_]?token|private[-_]?key/i;
+const SUPPORT_LOCAL_CLI_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+/**
+ * The composed scheduler's status, or an explicit statement that none is composed.
+ *
+ * Returning a marker rather than a fabricated status is the whole point: a support bundle is read
+ * by someone deciding whether to intervene, and "not composed" tells them to look at the
+ * composition while "running: false" tells them to look at the scheduler.
+ */
+function schedulerStatusOrAbsent() {
+    const scheduler = peekSubagentScheduler();
+    if (!scheduler) {
+        return { composed: false, reason: 'no scheduler registered with setSubagentScheduler()' };
+    }
+    return scheduler.status();
+}
+export class SupportDiagnosticsService {
+    rootDir;
+    supportDir;
+    migrationStatePath;
+    constructor(rootDir = DEFAULT_XENO_DIR) {
+        this.rootDir = rootDir;
+        this.supportDir = join(rootDir, 'support');
+        this.migrationStatePath = join(rootDir, 'migrations.json');
+    }
+    async createSupportBundle(request = {}) {
+        try {
+            ensureDir(this.supportDir);
+            const capturedAt = new Date().toISOString();
+            const profile = this.profile();
+            const search = request.includeSearchStatus !== false ? await getAgentSearchService().status() : undefined;
+            const searchProfile = request.includeSearchStatus !== false && request.includeSearchProfile !== false
+                ? await getAgentSearchService().profile({ limit: 25 })
+                : undefined;
+            const searchWatcher = request.includeSearchStatus !== false && request.includeSearchWatcher !== false
+                ? getSearchSourceWatcher().status()
+                : undefined;
+            const runtime = request.includeRuntimeSummary !== false ? collectRuntimeSummary(this.rootDir) : undefined;
+            const acp = request.includeAcpDiagnostics !== false ? collectAcpDiagnosticsSummary(this.rootDir) : undefined;
+            const subagents = request.includeSubagentSnapshot !== false ? collectSubagentSnapshot(this.rootDir) : undefined;
+            const cliControlPlane = request.includeCliControlPlane !== false
+                ? collectCliControlPlaneSnapshot(this.rootDir, request.cliControlPlaneSnapshot)
+                : undefined;
+            const pluginMcp = request.includePluginMcpSnapshot ? await getPluginMcpManagerService().snapshot({ includeSdkConfigured: true }) : undefined;
+            const policyAudit = collectPolicyAuditSummary(this.rootDir);
+            const utilityIpcPolicy = collectUtilityIpcPolicyCoverage();
+            const lsp = collectLspDegradedSummary();
+            const diagnostics = {
+                searchLifecycle: summarizeSearchLifecycle(search, searchProfile, searchWatcher),
+                subagentExecution: summarizeSubagentExecution(subagents),
+                acpSessionRuntime: summarizeAcpSessionRuntime(acp),
+                cliControlPlane: summarizeCliControlPlaneHealth(cliControlPlane),
+                policyAudit,
+                pluginMcpTrustDrift: summarizePluginMcpTrustDrift(pluginMcp),
+                lspDegradedStatus: lsp,
+                utilityIpcPolicy,
+            };
+            const repairRecommendations = buildRepairRecommendations(diagnostics);
+            const bundle = {
+                version: 1,
+                capturedAt,
+                app: readPackageSummary(),
+                profile: profile.success ? profile : undefined,
+                search,
+                searchProfile,
+                searchWatcher,
+                runtime,
+                acp,
+                subagents,
+                cliControlPlane,
+                pluginMcp,
+                diagnostics,
+                repairRecommendations,
+                files: collectXenoFileInventory(this.rootDir),
+                logs: request.includeRecentLogs ? collectRecentTextFiles(this.rootDir, 30) : [],
+            };
+            const redacted = redact(bundle, this.rootDir);
+            const path = join(this.supportDir, `support-bundle-${new Date().toISOString().replace(/[:.]/g, '-')}.json`);
+            writeFileSync(path, JSON.stringify(redacted, null, 2) + '\n', 'utf-8');
+            return {
+                success: true,
+                path,
+                summary: {
+                    capturedAt,
+                    fileCount: Array.isArray(redacted.files) ? redacted.files.length : 0,
+                    includedPluginMcp: !!request.includePluginMcpSnapshot,
+                    includedRuntimeSummary: request.includeRuntimeSummary !== false,
+                    includedAcpDiagnostics: request.includeAcpDiagnostics !== false,
+                    includedSubagents: request.includeSubagentSnapshot !== false,
+                    includedCliControlPlane: request.includeCliControlPlane !== false,
+                    includedRecentLogs: !!request.includeRecentLogs,
+                    searchHealth: diagnostics.searchLifecycle.health,
+                    subagentActiveRuns: diagnostics.subagentExecution.activeRunCount,
+                    acpSessionCount: diagnostics.acpSessionRuntime.sessionCount,
+                    acpFailedSessionCount: diagnostics.acpSessionRuntime.failedSessionCount,
+                    cliEndpointCount: diagnostics.cliControlPlane.endpointCount,
+                    cliReadyEndpointCount: diagnostics.cliControlPlane.readyEndpointCount,
+                    cliWorkflowAvailableCount: diagnostics.cliControlPlane.availableWorkflowCount,
+                    cliDashboardReadyCount: diagnostics.cliControlPlane.readyDashboardCount,
+                    policyDeniedCount: diagnostics.policyAudit.deniedCount,
+                    pluginMcpReviewRequired: diagnostics.pluginMcpTrustDrift.reviewRequiredCount,
+                    lspDegradedCount: diagnostics.lspDegradedStatus.degradedCount,
+                    utilityIpcGuardedHandlers: diagnostics.utilityIpcPolicy.guardedHandlerCount,
+                    repairRecommendationCount: repairRecommendations.length,
+                },
+            };
+        }
+        catch (err) {
+            return { success: false, error: errorMessage(err) };
+        }
+    }
+    async repairAll(request = {}) {
+        const startedAt = performance.now();
+        const repaired = [];
+        try {
+            try {
+                const status = await getAgentSearchService().reindex({ force: request.forceSearchReindex !== false });
+                const stats = asRecord(status.stats);
+                const documentCount = typeof stats.documentCount === 'number' ? stats.documentCount : 'unknown';
+                repaired.push({ id: 'agent-search-index', success: !status.error, detail: `ready=${status.ready} docs=${documentCount}` });
+            }
+            catch (err) {
+                repaired.push({ id: 'agent-search-index', success: false, error: errorMessage(err) });
+            }
+            try {
+                const migration = this.runMigrations();
+                repaired.push({ id: 'local-schema-migrations', success: migration.success, detail: `${migration.checks.length} checks`, error: migration.error });
+            }
+            catch (err) {
+                repaired.push({ id: 'local-schema-migrations', success: false, error: errorMessage(err) });
+            }
+            const diagnostics = await this.collectRepairDiagnostics();
+            return {
+                success: repaired.every((entry) => entry.success),
+                repaired,
+                repairRecommendations: buildRepairRecommendations(diagnostics),
+                durationMs: Math.round(performance.now() - startedAt),
+            };
+        }
+        catch (err) {
+            return {
+                success: false,
+                repaired,
+                repairRecommendations: [{
+                        id: 'support-repair-failed',
+                        severity: 'critical',
+                        title: 'Support repair failed before diagnostics completed',
+                        detail: errorMessage(err),
+                        action: 'Open the support bundle with recent logs enabled, then retry repair after restarting Hub.',
+                    }],
+                durationMs: Math.round(performance.now() - startedAt),
+                error: errorMessage(err),
+            };
+        }
+    }
+    runMigrations() {
+        const startedAt = performance.now();
+        const checks = [];
+        try {
+            ensureDir(this.rootDir);
+            ensureDir(join(this.rootDir, 'agent-chats'));
+            checks.push({ id: 'agent-chats-dir', status: 'ok', detail: 'Agent chat directory exists.' });
+            ensureDir(join(this.rootDir, 'runtime-events'));
+            checks.push({ id: 'runtime-events-dir', status: 'ok', detail: 'Runtime event directory exists.' });
+            ensureDir(join(this.rootDir, 'indexes', 'hub-search'));
+            checks.push({ id: 'search-index-dir', status: 'ok', detail: 'Search index directory exists.' });
+            ensureDir(join(this.rootDir, 'plugins'));
+            ensureDir(join(this.rootDir, 'mcp'));
+            checks.push({ id: 'plugin-mcp-dirs', status: 'ok', detail: 'Plugin and MCP directories exist.' });
+            const state = {
+                version: 1,
+                updatedAt: Date.now(),
+                checks: checks.map((check) => ({ id: check.id, status: check.status })),
+            };
+            writeFileSync(this.migrationStatePath, JSON.stringify(state, null, 2) + '\n', 'utf-8');
+            return {
+                success: true,
+                version: 1,
+                migrated: true,
+                path: this.migrationStatePath,
+                checks,
+                durationMs: Math.round(performance.now() - startedAt),
+            };
+        }
+        catch (err) {
+            return {
+                success: false,
+                version: 1,
+                migrated: false,
+                path: this.migrationStatePath,
+                checks,
+                durationMs: Math.round(performance.now() - startedAt),
+                error: errorMessage(err),
+            };
+        }
+    }
+    profile() {
+        const marks = {};
+        for (const entry of performance.getEntriesByType('mark')) {
+            marks[entry.name] = Math.round(entry.startTime);
+        }
+        return {
+            success: true,
+            capturedAt: new Date().toISOString(),
+            process: {
+                pid: process.pid,
+                uptimeSeconds: Math.round(process.uptime()),
+                memory: process.memoryUsage(),
+                cpuUsage: process.cpuUsage(),
+            },
+            host: {
+                platform: platform(),
+                release: release(),
+                arch: arch(),
+                cpuCount: cpus().length,
+                memoryTotalBytes: totalmem(),
+                memoryFreeBytes: freemem(),
+                osUptimeSeconds: Math.round(osUptime()),
+            },
+            marks,
+        };
+    }
+    async collectRepairDiagnostics() {
+        const search = await getAgentSearchService().status().catch((err) => ({ ready: false, building: false, error: errorMessage(err) }));
+        const searchProfile = await getAgentSearchService().profile({ limit: 25 }).catch(() => undefined);
+        const searchWatcher = getSearchSourceWatcher().status();
+        const subagents = collectSubagentSnapshot(this.rootDir);
+        const acp = collectAcpDiagnosticsSummary(this.rootDir);
+        const cliControlPlane = collectCliControlPlaneSnapshot(this.rootDir);
+        const pluginMcp = await getPluginMcpManagerService().snapshot({ includeSdkConfigured: true }).catch(() => undefined);
+        return {
+            searchLifecycle: summarizeSearchLifecycle(search, searchProfile, searchWatcher),
+            subagentExecution: summarizeSubagentExecution(subagents),
+            acpSessionRuntime: summarizeAcpSessionRuntime(acp),
+            cliControlPlane: summarizeCliControlPlaneHealth(cliControlPlane),
+            policyAudit: collectPolicyAuditSummary(this.rootDir),
+            pluginMcpTrustDrift: summarizePluginMcpTrustDrift(pluginMcp),
+            lspDegradedStatus: collectLspDegradedSummary(),
+            utilityIpcPolicy: collectUtilityIpcPolicyCoverage(),
+        };
+    }
+}
+function readPackageSummary() {
+    try {
+        const pkg = JSON.parse(readFileSync(join(process.cwd(), 'package.json'), 'utf-8'));
+        return {
+            name: pkg.name,
+            version: pkg.version,
+            productName: pkg.productName,
+        };
+    }
+    catch {
+        return { name: 'xeno-hub', version: 'unknown' };
+    }
+}
+function summarizeSearchLifecycle(search, profile, watcher) {
+    const status = asRecord(search);
+    const stats = asRecord(status.stats);
+    const health = asRecord(status.health);
+    const lifecycle = asRecord(status.lifecycle);
+    const queryProfile = asRecord(profile);
+    const watcherStatus = asRecord(watcher);
+    const healthIssues = Array.isArray(health.issues) ? health.issues : [];
+    const profileHealth = typeof queryProfile.health === 'string' ? queryProfile.health : undefined;
+    const hasError = typeof status.error === 'string' && status.error.length > 0;
+    const stale = health.stale === true || Number(lifecycle.staleDirtySourceCount || 0) > 0 || Number(watcherStatus.staleDirtySourceCount || 0) > 0;
+    const healthLabel = hasError || profileHealth === 'failing'
+        ? 'failing'
+        : health.healthy === false || stale || profileHealth === 'degraded' || status.ready === false
+            ? 'degraded'
+            : 'healthy';
+    return {
+        success: !hasError,
+        health: healthLabel,
+        ready: status.ready === true,
+        building: status.building === true,
+        backend: typeof stats.backend === 'string' ? stats.backend : undefined,
+        documentCount: finiteNumberOrUndefined(stats.documentCount),
+        stale,
+        activeJobStatus: typeof asRecord(lifecycle.activeJob).status === 'string' ? String(asRecord(lifecycle.activeJob).status) : undefined,
+        queuedJobCount: Array.isArray(lifecycle.queuedJobs) ? lifecycle.queuedJobs.length : 0,
+        dirtySourceCount: finiteNumber(watcherStatus.dirtySourceCount ?? (Array.isArray(lifecycle.dirtySources) ? lifecycle.dirtySources.length : 0)),
+        staleDirtySourceCount: finiteNumber(watcherStatus.staleDirtySourceCount ?? lifecycle.staleDirtySourceCount),
+        crashResumeAvailable: lifecycle.crashResumeAvailable === true,
+        cancellable: lifecycle.cancellable === true,
+        averageQueryMs: typeof queryProfile.averageQueryMs === 'number' ? Math.round(queryProfile.averageQueryMs) : null,
+        p95QueryMs: typeof queryProfile.p95QueryMs === 'number' ? Math.round(queryProfile.p95QueryMs) : null,
+        slowQueryCount: Array.isArray(queryProfile.slowQueries) ? queryProfile.slowQueries.length : finiteNumber(stats.slowQueryCount),
+        failedQueryCount: finiteNumber(queryProfile.failedQueryCount ?? stats.failedQueryCount),
+        watcherRunning: watcherStatus.running === true,
+        pendingReindex: watcherStatus.pendingReindex === true,
+        issues: healthIssues.slice(0, 20).map((issue) => {
+            const record = asRecord(issue);
+            return {
+                id: String(record.id || 'search-issue'),
+                severity: String(record.severity || 'warning'),
+                message: String(record.message || record.detail || 'Search health issue detected.').slice(0, 500),
+            };
+        }),
+    };
+}
+function summarizeSubagentExecution(subagents) {
+    const snapshot = asRecord(subagents);
+    const scheduler = asRecord(snapshot.scheduler);
+    const durable = asRecord(scheduler.durable);
+    const byStatus = asRecord(snapshot.byStatus);
+    return {
+        success: snapshot.success !== false,
+        schedulerRunning: scheduler.running === true,
+        activeRunCount: finiteNumber(snapshot.activeRunCount),
+        queuedCount: finiteNumber(byStatus.queued ?? durable.queuedCount),
+        runningCount: finiteNumber(byStatus.running ?? durable.runningCount),
+        waitingCount: finiteNumber(byStatus['waiting-for-permission']) + finiteNumber(byStatus['waiting-for-user']) + finiteNumber(durable.waitingCount),
+        recentRunCount: finiteNumber(snapshot.recentRunCount),
+        failedCount: finiteNumber(byStatus.failed),
+        cancelledCount: finiteNumber(byStatus.cancelled),
+        recoverableCount: Array.isArray(durable.recoverableRunIds) ? durable.recoverableRunIds.length : 0,
+        staleCount: finiteNumber(scheduler.lastStale) || (Array.isArray(durable.staleRunIds) ? durable.staleRunIds.length : 0),
+        timedOutCount: finiteNumber(scheduler.lastTimedOut) || (Array.isArray(durable.timedOutRunIds) ? durable.timedOutRunIds.length : 0),
+        lastRecovered: finiteNumber(scheduler.lastRecovered),
+        lastFailed: finiteNumber(scheduler.lastFailed),
+        lastTimedOut: finiteNumber(scheduler.lastTimedOut),
+        lastError: typeof scheduler.lastError === 'string' ? scheduler.lastError.slice(0, 500) : undefined,
+    };
+}
+function summarizeAcpSessionRuntime(acp) {
+    const summary = asRecord(acp);
+    const agents = Array.isArray(summary.agents) ? summary.agents : [];
+    return {
+        success: summary.success !== false,
+        protocol: typeof summary.protocol === 'string' ? summary.protocol : 'acp-v1-stdio',
+        eventCount: finiteNumber(summary.eventCount),
+        sessionCount: finiteNumber(summary.sessionCount),
+        activeSessionCount: finiteNumber(summary.activeSessionCount),
+        failedSessionCount: finiteNumber(summary.failedSessionCount),
+        pendingRequestCount: finiteNumber(summary.pendingRequestCount),
+        pendingPermissionCount: finiteNumber(summary.pendingPermissionCount),
+        malformedMessageCount: finiteNumber(summary.malformedMessageCount),
+        stderrLineCount: finiteNumber(summary.stderrLineCount),
+        agentCount: agents.length,
+        lastError: typeof summary.lastError === 'string' ? summary.lastError.slice(0, 500) : undefined,
+    };
+}
+function summarizeCliControlPlaneHealth(cliControlPlane) {
+    const snapshot = asRecord(cliControlPlane);
+    const endpoints = Array.isArray(snapshot.endpoints) ? snapshot.endpoints : [];
+    const remoteBackends = Array.isArray(snapshot.remoteBackends) ? snapshot.remoteBackends : [];
+    const lastInspection = asRecord(snapshot.lastInspection);
+    const workflows = Array.isArray(lastInspection.workflows) ? lastInspection.workflows : [];
+    const dashboards = Array.isArray(lastInspection.dashboards) ? lastInspection.dashboards : [];
+    const localReadyEndpointCount = endpoints.filter((entry) => {
+        const record = asRecord(entry);
+        return record.status === 'configured-local' || record.status === 'last-known-available';
+    }).length;
+    const inspectedEndpoint = typeof lastInspection.endpoint === 'string' ? lastInspection.endpoint : undefined;
+    const inspectedEndpointAlreadyCounted = !!inspectedEndpoint && endpoints.some((entry) => asRecord(entry).endpoint === inspectedEndpoint);
+    const readyEndpointCount = localReadyEndpointCount + (lastInspection.status === 'available' && !inspectedEndpointAlreadyCounted ? 1 : 0);
+    const nonLocalEndpointCount = finiteNumber(snapshot.nonLocalEndpointCount);
+    const missingActionCount = workflows.reduce((sum, workflow) => {
+        const record = asRecord(workflow);
+        return sum + finiteNumber(record.missingActionCount);
+    }, 0);
+    const lastInspectionStatus = typeof lastInspection.status === 'string' ? lastInspection.status : undefined;
+    const lastError = typeof snapshot.error === 'string'
+        ? snapshot.error.slice(0, 500)
+        : typeof lastInspection.error === 'string'
+            ? lastInspection.error.slice(0, 500)
+            : undefined;
+    return {
+        success: snapshot.success !== false && nonLocalEndpointCount === 0 && lastInspectionStatus !== 'blocked' && lastInspectionStatus !== 'offline',
+        checked: snapshot.checked === true,
+        endpointCount: finiteNumber(snapshot.endpointCount) || endpoints.length,
+        readyEndpointCount,
+        nonLocalEndpointCount,
+        remoteBackendCount: finiteNumber(snapshot.remoteBackendCount) || remoteBackends.length,
+        configuredAgentCount: finiteNumber(snapshot.configuredAgentCount),
+        lastInspectionStatus,
+        availableWorkflowCount: workflows.filter((workflow) => asRecord(workflow).available === true).length,
+        readyDashboardCount: dashboards.filter((dashboard) => asRecord(dashboard).status === 'ready').length,
+        partialDashboardCount: dashboards.filter((dashboard) => asRecord(dashboard).status === 'partial').length,
+        missingDashboardCount: dashboards.filter((dashboard) => asRecord(dashboard).status === 'missing').length,
+        missingActionCount,
+        versionSkewWarning: typeof lastInspection.versionSkewWarning === 'string' ? lastInspection.versionSkewWarning.slice(0, 500) : undefined,
+        lastError,
+    };
+}
+function summarizePluginMcpTrustDrift(pluginMcp) {
+    const snapshot = asRecord(pluginMcp);
+    const plugins = Array.isArray(snapshot.plugins) ? snapshot.plugins : [];
+    const servers = Array.isArray(snapshot.mcpServers) ? snapshot.mcpServers : [];
+    const stats = asRecord(snapshot.stats);
+    const effectivePolicy = asRecord(snapshot.effectivePolicy);
+    const targetsNeedingReview = [];
+    let reviewRequiredCount = 0;
+    let blockedCount = 0;
+    let configDriftCount = 0;
+    for (const plugin of plugins) {
+        const record = asRecord(plugin);
+        const trust = asRecord(record.trust);
+        const state = typeof trust.state === 'string' ? trust.state : 'unknown';
+        if (state === 'review-required')
+            reviewRequiredCount += 1;
+        if (state === 'blocked')
+            blockedCount += 1;
+        if (state !== 'trusted') {
+            targetsNeedingReview.push({
+                type: 'plugin',
+                name: String(record.name || 'unknown-plugin').slice(0, 120),
+                state,
+                risk: typeof trust.riskLevel === 'string' ? trust.riskLevel : undefined,
+                reason: firstString(trust.reasons),
+            });
+        }
+    }
+    for (const server of servers) {
+        const record = asRecord(server);
+        const trust = asRecord(record.trust);
+        const state = typeof trust.state === 'string' ? trust.state : 'unknown';
+        const drift = trust.configDrift === true;
+        if (state === 'review-required')
+            reviewRequiredCount += 1;
+        if (state === 'blocked')
+            blockedCount += 1;
+        if (drift)
+            configDriftCount += 1;
+        if (state !== 'trusted' || drift) {
+            targetsNeedingReview.push({
+                type: 'mcp',
+                name: String(record.name || 'unknown-mcp').slice(0, 120),
+                state,
+                risk: typeof trust.riskLevel === 'string' ? trust.riskLevel : undefined,
+                drift,
+                reason: firstString(trust.reasons),
+            });
+        }
+    }
+    const deniedByPolicyCount = normalizedList(effectivePolicy.pluginDenylist).length + normalizedList(effectivePolicy.mcpServerDenylist).length;
+    return {
+        success: !!pluginMcp,
+        pluginCount: finiteNumber(stats.pluginCount) || plugins.length,
+        mcpServerCount: finiteNumber(stats.mcpServerCount) || servers.length,
+        reviewRequiredCount,
+        blockedCount,
+        configDriftCount,
+        deniedByPolicyCount,
+        activePluginToolCount: finiteNumber(stats.activePluginToolCount),
+        connectedMcpServerCount: finiteNumber(stats.connectedMcpServerCount),
+        registryPolicy: typeof snapshot.mcpRegistryPolicy === 'string' ? snapshot.mcpRegistryPolicy : undefined,
+        targetsNeedingReview: targetsNeedingReview.slice(0, 25),
+    };
+}
+function collectPolicyAuditSummary(rootDir) {
+    const candidates = uniqueValues([
+        process.env.XENO_POLICY_AUDIT_PATH,
+        join(rootDir, 'audit', 'policy-decisions.jsonl'),
+        join(DEFAULT_XENO_DIR, 'audit', 'policy-decisions.jsonl'),
+    ]);
+    const path = candidates.find((candidate) => existsSync(candidate));
+    if (!path) {
+        return {
+            success: true,
+            checked: false,
+            entryCount: 0,
+            allowedCount: 0,
+            deniedCount: 0,
+            byAction: {},
+            byResourceKind: {},
+            recentDenials: [],
+        };
+    }
+    try {
+        const lines = readFileSync(path, 'utf-8').split(/\r?\n/).filter(Boolean).slice(-1000);
+        const byAction = {};
+        const byResourceKind = {};
+        const recentDenials = [];
+        let allowedCount = 0;
+        let deniedCount = 0;
+        for (const line of lines) {
+            let entry;
+            try {
+                entry = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            const action = typeof entry.action === 'string' ? entry.action : undefined;
+            const resource = asRecord(entry.resource);
+            const kind = typeof resource.kind === 'string' ? resource.kind : undefined;
+            const decision = asRecord(entry.decision);
+            if (action)
+                byAction[action] = (byAction[action] || 0) + 1;
+            if (kind)
+                byResourceKind[kind] = (byResourceKind[kind] || 0) + 1;
+            if (decision.allowed === true)
+                allowedCount += 1;
+            if (decision.allowed === false) {
+                deniedCount += 1;
+                recentDenials.push({
+                    action,
+                    kind,
+                    reason: String(decision.reason || 'Policy denied the request.').slice(0, 500),
+                    timestamp: typeof entry.timestamp === 'string' ? entry.timestamp : undefined,
+                });
+            }
+        }
+        return {
+            success: true,
+            checked: true,
+            entryCount: lines.length,
+            allowedCount,
+            deniedCount,
+            byAction,
+            byResourceKind,
+            recentDenials: recentDenials.slice(-20).reverse(),
+        };
+    }
+    catch (err) {
+        return {
+            success: false,
+            checked: true,
+            entryCount: 0,
+            allowedCount: 0,
+            deniedCount: 0,
+            byAction: {},
+            byResourceKind: {},
+            recentDenials: [],
+            error: errorMessage(err),
+        };
+    }
+}
+function collectLspDegradedSummary() {
+    try {
+        const rootDirectory = process.cwd();
+        const status = getCodebaseIntelligenceService().languageServiceStatus({
+            rootDirectory,
+            allowedDirectories: [rootDirectory],
+        });
+        if (!status.success) {
+            return {
+                success: false,
+                serviceCount: 0,
+                degradedCount: 0,
+                missingCount: 0,
+                runningCount: 0,
+                degradedServices: [],
+                error: status.error,
+            };
+        }
+        const services = status.services || [];
+        const degradedServices = services
+            .filter((service) => service.degraded || service.status === 'missing' || service.status === 'error')
+            .map((service) => ({
+            id: service.id,
+            label: service.label,
+            status: service.status,
+            languages: service.languages,
+            reason: service.degradedReason || service.lastError || service.detail,
+            installHint: service.installHint,
+        }));
+        return {
+            success: true,
+            serviceCount: services.length,
+            degradedCount: degradedServices.length,
+            missingCount: services.filter((service) => service.status === 'missing').length,
+            runningCount: services.filter((service) => service.status === 'running' || service.status === 'ready').length,
+            degradedServices: degradedServices.slice(0, 20),
+        };
+    }
+    catch (err) {
+        return {
+            success: false,
+            serviceCount: 0,
+            degradedCount: 0,
+            missingCount: 0,
+            runningCount: 0,
+            degradedServices: [],
+            error: errorMessage(err),
+        };
+    }
+}
+function collectUtilityIpcPolicyCoverage() {
+    const ipcDir = join(process.cwd(), 'src', 'main', 'ipc');
+    try {
+        const files = readdirSync(ipcDir).filter((name) => name.endsWith('.ts')).sort();
+        const guardedFiles = [];
+        const unguardedFiles = [];
+        let handlerCount = 0;
+        let guardedHandlerCount = 0;
+        for (const file of files) {
+            const path = join(ipcDir, file);
+            const text = readFileSync(path, 'utf-8');
+            const channels = extractIpcChannels(text);
+            if (channels.length === 0)
+                continue;
+            const guarded = /assertIpcPolicy|evaluateIpcPolicy|denyWithPolicy|evaluate[A-Za-z]+Policy|policyDecision|WorkspacePolicyService/.test(text);
+            handlerCount += channels.length;
+            if (guarded) {
+                guardedFiles.push(file);
+                guardedHandlerCount += channels.length;
+            }
+            else {
+                unguardedFiles.push(file);
+            }
+        }
+        return {
+            success: true,
+            checkedFileCount: files.length,
+            handlerCount,
+            guardedHandlerCount,
+            unguardedHandlerCount: Math.max(0, handlerCount - guardedHandlerCount),
+            guardedFiles: guardedFiles.slice(0, 100),
+            unguardedFiles: unguardedFiles.slice(0, 100),
+            knownUtilitySurfaces: ['files', 'capture', 'convert', 'content', 'exportBackup', 'webSearch', 'pluginMcp', 'apps', 'pixelBridge', 'motionBridge'],
+        };
+    }
+    catch (err) {
+        return {
+            success: false,
+            checkedFileCount: 0,
+            handlerCount: 0,
+            guardedHandlerCount: 0,
+            unguardedHandlerCount: 0,
+            guardedFiles: [],
+            unguardedFiles: [],
+            knownUtilitySurfaces: [],
+            error: errorMessage(err),
+        };
+    }
+}
+function buildRepairRecommendations(summary) {
+    const recommendations = [];
+    if (summary.searchLifecycle.health !== 'healthy' || summary.searchLifecycle.stale || summary.searchLifecycle.crashResumeAvailable) {
+        recommendations.push({
+            id: 'repair-search-lifecycle',
+            severity: summary.searchLifecycle.health === 'failing' ? 'critical' : 'warning',
+            title: 'Repair or resume search indexing',
+            detail: `Search is ${summary.searchLifecycle.health}; stale sources=${summary.searchLifecycle.staleDirtySourceCount}, dirty sources=${summary.searchLifecycle.dirtySourceCount}.`,
+            action: 'Run Support > Repair indexes. If an active job is stuck, cancel and force a rebuild from local sources.',
+        });
+    }
+    if (summary.subagentExecution.recoverableCount > 0 || summary.subagentExecution.staleCount > 0 || summary.subagentExecution.timedOutCount > 0 || summary.subagentExecution.lastError) {
+        recommendations.push({
+            id: 'repair-subagent-scheduler',
+            severity: summary.subagentExecution.lastError ? 'critical' : 'warning',
+            title: 'Sweep subagent scheduler state',
+            detail: `Recoverable=${summary.subagentExecution.recoverableCount}, stale=${summary.subagentExecution.staleCount}, timed out=${summary.subagentExecution.timedOutCount}.`,
+            action: 'Refresh the Subagents panel or restart Hub to trigger the scheduler sweep; cancel orphaned child runs if they remain active.',
+        });
+    }
+    if (summary.acpSessionRuntime.failedSessionCount > 0 || summary.acpSessionRuntime.malformedMessageCount > 0 || summary.acpSessionRuntime.pendingRequestCount > 0 || summary.acpSessionRuntime.lastError) {
+        recommendations.push({
+            id: 'review-acp-agent-runtime',
+            severity: summary.acpSessionRuntime.failedSessionCount > 0 || summary.acpSessionRuntime.pendingRequestCount > 0 ? 'warning' : 'info',
+            title: 'Review ACP agent runtime diagnostics',
+            detail: `ACP sessions=${summary.acpSessionRuntime.sessionCount}, failed=${summary.acpSessionRuntime.failedSessionCount}, pending requests=${summary.acpSessionRuntime.pendingRequestCount}, malformed messages=${summary.acpSessionRuntime.malformedMessageCount}.`,
+            action: 'Inspect the ACP diagnostics section and keep third-party ACP agents disabled until fixture lifecycle evidence is clean.',
+        });
+    }
+    if (summary.cliControlPlane.nonLocalEndpointCount > 0
+        || summary.cliControlPlane.lastInspectionStatus === 'blocked'
+        || summary.cliControlPlane.lastInspectionStatus === 'offline'
+        || summary.cliControlPlane.lastError
+        || summary.cliControlPlane.missingActionCount > 0) {
+        recommendations.push({
+            id: 'review-cli-control-plane',
+            severity: summary.cliControlPlane.lastInspectionStatus === 'blocked' || summary.cliControlPlane.nonLocalEndpointCount > 0 ? 'warning' : 'info',
+            title: 'Review CLI control-plane readiness',
+            detail: `CLI endpoints=${summary.cliControlPlane.endpointCount}, ready=${summary.cliControlPlane.readyEndpointCount}, workflows=${summary.cliControlPlane.availableWorkflowCount}, dashboards=${summary.cliControlPlane.readyDashboardCount}, missing actions=${summary.cliControlPlane.missingActionCount}.`,
+            action: 'Open the CLI workbench tab, inspect the local app-server manifest/OpenAPI contracts, and keep non-local or offline endpoints disabled until verified.',
+        });
+    }
+    if (summary.policyAudit.deniedCount > 0) {
+        recommendations.push({
+            id: 'review-policy-denials',
+            severity: 'warning',
+            title: 'Review recent policy denials',
+            detail: `${summary.policyAudit.deniedCount} denied policy decisions were found in the recent audit tail.`,
+            action: 'Open workspace/team/agent settings and grant the missing directory, plugin, MCP, app, or profile permission only if expected.',
+        });
+    }
+    if (summary.pluginMcpTrustDrift.reviewRequiredCount > 0 || summary.pluginMcpTrustDrift.configDriftCount > 0 || summary.pluginMcpTrustDrift.blockedCount > 0) {
+        recommendations.push({
+            id: 'review-plugin-mcp-trust',
+            severity: summary.pluginMcpTrustDrift.blockedCount > 0 ? 'critical' : 'warning',
+            title: 'Review Plugin/MCP trust decisions',
+            detail: `Review required=${summary.pluginMcpTrustDrift.reviewRequiredCount}, config drift=${summary.pluginMcpTrustDrift.configDriftCount}, blocked=${summary.pluginMcpTrustDrift.blockedCount}.`,
+            action: 'Open Plugin Manager, inspect permission/signature/config changes, then approve, deny, or update scoped policy.',
+        });
+    }
+    if (summary.lspDegradedStatus.degradedCount > 0) {
+        recommendations.push({
+            id: 'install-or-start-lsp',
+            severity: 'info',
+            title: 'Restore degraded language services',
+            detail: `${summary.lspDegradedStatus.degradedCount} language services are missing, stopped, or degraded.`,
+            action: 'Install the missing language servers shown in the LSP summary or start them from the Code workbench.',
+        });
+    }
+    if (summary.utilityIpcPolicy.unguardedFiles.length > 0) {
+        recommendations.push({
+            id: 'audit-utility-ipc-policy',
+            severity: 'warning',
+            title: 'Audit utility IPC policy coverage',
+            detail: `${summary.utilityIpcPolicy.unguardedFiles.length} IPC files with handlers did not expose an obvious policy guard marker.`,
+            action: 'Review the listed IPC files and add evaluateIpcPolicy/assertIpcPolicy for agent-scoped file, app, plugin, MCP, search, and content access.',
+        });
+    }
+    return recommendations;
+}
+function collectXenoFileInventory(rootDir) {
+    return collectRawXenoFileInventory(rootDir).map((file) => ({
+        ...file,
+        path: redactLocalPath(file.path, rootDir),
+    }));
+}
+function collectRawXenoFileInventory(rootDir) {
+    const files = [];
+    const visit = (dir, depth) => {
+        if (depth > 4 || !existsSync(dir))
+            return;
+        let names = [];
+        try {
+            names = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of names) {
+            const fullPath = join(dir, name);
+            let stat;
+            try {
+                stat = statSync(fullPath);
+            }
+            catch {
+                continue;
+            }
+            if (stat.isDirectory()) {
+                visit(fullPath, depth + 1);
+            }
+            else {
+                files.push({ path: fullPath, size: stat.size, mtimeMs: stat.mtimeMs });
+            }
+            if (files.length >= 5000)
+                return;
+        }
+    };
+    visit(rootDir, 0);
+    return files;
+}
+function collectRuntimeSummary(rootDir) {
+    try {
+        const store = new RuntimeEventStore(join(rootDir, 'runtime-events'));
+        const conversationIds = store.listConversationIds();
+        const recent = conversationIds.slice(-25).flatMap((conversationId) => {
+            const projection = store.project(conversationId);
+            if (!projection.success || !projection.projection)
+                return [];
+            return [{
+                    conversationId,
+                    eventCount: projection.projection.eventCount,
+                    lastEventType: projection.projection.lastEventType,
+                    lastEventAt: projection.projection.lastEventAt,
+                    activeToolCount: projection.projection.activeTools.length,
+                    toolCompletionCount: Object.values(projection.projection.toolCompletions).reduce((sum, count) => sum + count, 0),
+                    diagnostics: projection.projection.timeline?.diagnostics,
+                }];
+        });
+        return {
+            success: true,
+            conversationCount: conversationIds.length,
+            recent,
+        };
+    }
+    catch (err) {
+        return { success: false, error: errorMessage(err) };
+    }
+}
+function collectCliControlPlaneSnapshot(rootDir, lastKnownInspection) {
+    const workspacePath = join(rootDir, 'workspaces.json');
+    const endpointMap = new Map();
+    const remoteBackendMap = new Map();
+    let workspaceCount = 0;
+    let teamCount = 0;
+    let agentCount = 0;
+    let configuredAgentCount = 0;
+    let parseError;
+    try {
+        if (existsSync(workspacePath)) {
+            const parsed = JSON.parse(readFileSync(workspacePath, 'utf-8'));
+            const workspaces = Array.isArray(parsed) ? parsed : [];
+            workspaceCount = workspaces.length;
+            for (const workspaceValue of workspaces.slice(0, 1000)) {
+                const workspace = asRecord(workspaceValue);
+                const workspaceId = safeSupportText(workspace.id, 'workspace', 200);
+                const teams = Array.isArray(workspace.teams) ? workspace.teams : [];
+                teamCount += teams.length;
+                for (const teamValue of teams.slice(0, 1000)) {
+                    const team = asRecord(teamValue);
+                    const teamId = safeSupportText(team.id, 'team', 200);
+                    const agents = Array.isArray(team.agents) ? team.agents : [];
+                    agentCount += agents.length;
+                    for (const agentValue of agents.slice(0, 1000)) {
+                        const agent = asRecord(agentValue);
+                        const agentId = safeSupportText(agent.id, 'agent', 200);
+                        const runtimeSelection = asRecord(agent.runtimeSelection);
+                        const providerKind = typeof runtimeSelection.providerKind === 'string' ? runtimeSelection.providerKind : '';
+                        if (providerKind === 'cli-app-server') {
+                            configuredAgentCount += 1;
+                            const origin = sanitizeCliSupportOrigin(runtimeSelection.cliAppServerEndpoint);
+                            const key = origin.local ? origin.endpoint : `${origin.status}:${endpointMap.size}`;
+                            const existing = endpointMap.get(key) || {
+                                endpoint: origin.endpoint,
+                                local: origin.local,
+                                status: origin.status,
+                                agentCount: 0,
+                                workspaceIds: new Set(),
+                                teamIds: new Set(),
+                                agentIds: new Set(),
+                            };
+                            existing.agentCount += 1;
+                            if (workspaceId)
+                                existing.workspaceIds.add(workspaceId);
+                            if (teamId)
+                                existing.teamIds.add(teamId);
+                            if (agentId)
+                                existing.agentIds.add(agentId);
+                            endpointMap.set(key, existing);
+                        }
+                        else if (providerKind === 'cli-remote') {
+                            configuredAgentCount += 1;
+                            const backendId = safeSupportText(runtimeSelection.remoteBackendId, 'cli-remote', 200) || 'cli-remote';
+                            const existing = remoteBackendMap.get(backendId) || {
+                                backendId,
+                                agentCount: 0,
+                                workspaceIds: new Set(),
+                                teamIds: new Set(),
+                                agentIds: new Set(),
+                            };
+                            existing.agentCount += 1;
+                            if (workspaceId)
+                                existing.workspaceIds.add(workspaceId);
+                            if (teamId)
+                                existing.teamIds.add(teamId);
+                            if (agentId)
+                                existing.agentIds.add(agentId);
+                            remoteBackendMap.set(backendId, existing);
+                        }
+                    }
+                }
+            }
+        }
+    }
+    catch (err) {
+        parseError = errorMessage(err);
+    }
+    const lastInspection = summarizeCliControlPlaneLastInspection(lastKnownInspection);
+    const endpoints = Array.from(endpointMap.values()).map((entry) => ({
+        endpoint: entry.endpoint,
+        local: entry.local,
+        status: entry.status,
+        agentCount: entry.agentCount,
+        workspaceIds: Array.from(entry.workspaceIds).slice(0, 20),
+        teamIds: Array.from(entry.teamIds).slice(0, 20),
+        agentIds: Array.from(entry.agentIds).slice(0, 20),
+    }));
+    const remoteBackends = Array.from(remoteBackendMap.values()).map((entry) => ({
+        backendId: entry.backendId,
+        agentCount: entry.agentCount,
+        workspaceIds: Array.from(entry.workspaceIds).slice(0, 20),
+        teamIds: Array.from(entry.teamIds).slice(0, 20),
+        agentIds: Array.from(entry.agentIds).slice(0, 20),
+    }));
+    return {
+        success: !parseError,
+        checked: true,
+        workspacePath: redactLocalPath(workspacePath, rootDir),
+        workspaceFileExists: existsSync(workspacePath),
+        workspaceCount,
+        teamCount,
+        agentCount,
+        configuredAgentCount,
+        endpointCount: endpoints.length,
+        localEndpointCount: endpoints.filter((entry) => entry.local).length,
+        nonLocalEndpointCount: endpoints.filter((entry) => !entry.local && entry.status !== 'missing-endpoint').length,
+        remoteBackendCount: remoteBackends.length,
+        endpoints,
+        remoteBackends,
+        lastInspection,
+        error: parseError ? redactString(parseError, rootDir) : undefined,
+    };
+}
+function summarizeCliControlPlaneLastInspection(value) {
+    const record = asRecord(value);
+    if (Object.keys(record).length === 0)
+        return undefined;
+    const origin = sanitizeCliSupportOrigin(record.endpoint);
+    const manifest = asRecord(record.manifest);
+    const openapi = asRecord(record.openapi);
+    const workflows = Array.isArray(record.workflows) ? record.workflows : [];
+    const dashboards = Array.isArray(record.dashboards) ? record.dashboards : [];
+    return {
+        endpoint: origin.endpoint,
+        local: origin.local,
+        checkedAt: typeof record.checkedAt === 'number' && Number.isFinite(record.checkedAt) ? Math.max(0, Math.round(record.checkedAt)) : undefined,
+        status: safeEnum(record.status, ['idle', 'available', 'degraded', 'blocked', 'offline'], 'unknown'),
+        success: record.success === true || record.status === 'available',
+        error: safeSupportText(record.error, undefined, 500),
+        versionSkewWarning: safeSupportText(record.versionSkewWarning, undefined, 500),
+        manifest: {
+            ok: manifest.ok === true,
+            status: finiteNumber(manifest.status),
+            name: safeSupportText(manifest.name, undefined, 120),
+            version: safeSupportText(manifest.version, undefined, 120),
+            cliVersion: safeSupportText(manifest.cliVersion, undefined, 120),
+            appVersion: safeSupportText(manifest.appVersion, undefined, 120),
+            clientName: safeSupportText(manifest.clientName, undefined, 120),
+            capabilityCount: normalizedSafeStringList(manifest.capabilities, 40).length,
+        },
+        openapi: {
+            ok: openapi.ok === true,
+            status: finiteNumber(openapi.status),
+            title: safeSupportText(openapi.title, undefined, 120),
+            version: safeSupportText(openapi.version, undefined, 120),
+            operationCount: finiteNumber(openapi.operationCount),
+            pathCount: normalizedSafeStringList(openapi.paths, 200).length,
+        },
+        workflows: workflows.slice(0, 20).map(summarizeCliWorkflowSupportState),
+        dashboards: dashboards.slice(0, 20).map(summarizeCliDashboardSupportState),
+    };
+}
+function summarizeCliWorkflowSupportState(value) {
+    const workflow = asRecord(value);
+    const actions = Array.isArray(workflow.actions) ? workflow.actions : [];
+    const missing = normalizedSafeStringList(workflow.missing, 20);
+    return {
+        id: safeSupportText(workflow.id, 'workflow', 80),
+        label: safeSupportText(workflow.label, 'Workflow', 120),
+        available: workflow.available === true,
+        operationCount: finiteNumber(workflow.operationCount),
+        pathCount: normalizedSafeStringList(workflow.paths, 100).length,
+        actionCount: actions.length,
+        availableActionCount: actions.filter((action) => asRecord(action).available === true).length,
+        missingActionCount: missing.length,
+        missing: missing.slice(0, 12),
+    };
+}
+function summarizeCliDashboardSupportState(value) {
+    const dashboard = asRecord(value);
+    const actions = Array.isArray(dashboard.actions) ? dashboard.actions : [];
+    const missing = normalizedSafeStringList(dashboard.missing, 20);
+    return {
+        id: safeSupportText(dashboard.id, 'dashboard', 80),
+        label: safeSupportText(dashboard.label, 'Dashboard', 120),
+        status: safeEnum(dashboard.status, ['ready', 'partial', 'missing'], 'missing'),
+        operationCount: finiteNumber(dashboard.operationCount),
+        availableActionCount: finiteNumber(dashboard.availableActionCount),
+        requiredActionCount: finiteNumber(dashboard.requiredActionCount),
+        readOnlyProbeCount: finiteNumber(dashboard.readOnlyProbeCount),
+        mutatingOperationCount: finiteNumber(dashboard.mutatingOperationCount),
+        pathCount: normalizedSafeStringList(dashboard.paths, 100).length,
+        actionCount: actions.length,
+        missingActionCount: missing.length,
+        missing: missing.slice(0, 12),
+    };
+}
+function sanitizeCliSupportOrigin(value) {
+    if (typeof value !== 'string' || !value.trim())
+        return { endpoint: 'not-configured', local: false, status: 'missing-endpoint' };
+    try {
+        const url = new URL(value.trim());
+        if (url.protocol !== 'http:' && url.protocol !== 'https:')
+            return { endpoint: 'unsupported-protocol', local: false, status: 'blocked-protocol' };
+        const host = url.hostname.toLowerCase();
+        const local = SUPPORT_LOCAL_CLI_HOSTS.has(host) || host.endsWith('.localhost');
+        if (!local)
+            return { endpoint: 'non-local-origin', local: false, status: 'blocked-non-local' };
+        return { endpoint: `${url.protocol}//${url.host}`, local: true, status: 'configured-local' };
+    }
+    catch {
+        return { endpoint: 'invalid-origin', local: false, status: 'invalid-endpoint' };
+    }
+}
+function safeEnum(value, allowed, fallback) {
+    return typeof value === 'string' && allowed.includes(value) ? value : fallback;
+}
+function safeSupportText(value, fallback, limit = 200) {
+    if (typeof value !== 'string')
+        return fallback;
+    const trimmed = value.trim();
+    if (!trimmed)
+        return fallback;
+    const redacted = redactString(trimmed).slice(0, Math.max(1, limit));
+    return SUPPORT_SECRET_PATTERN.test(redacted) ? fallback : redacted;
+}
+function normalizedSafeStringList(value, limit) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const entry of value) {
+        const text = safeSupportText(entry, undefined, 200);
+        if (!text || seen.has(text))
+            continue;
+        seen.add(text);
+        out.push(text);
+        if (out.length >= limit)
+            break;
+    }
+    return out;
+}
+function collectSubagentSnapshot(rootDir) {
+    try {
+        const service = new SubagentRunService(join(rootDir, 'subagent-runs.json'));
+        const active = service.listRuns({ activeOnly: true, limit: 100 });
+        const recent = service.listRuns({ limit: 100 });
+        const byStatus = {};
+        for (const run of recent.runs || []) {
+            byStatus[run.status] = (byStatus[run.status] || 0) + 1;
+        }
+        return {
+            success: active.success && recent.success,
+            // `peek`, never `get`: the getter would BUILD a scheduler to answer, and an idle scheduler
+            // that has never existed reads exactly like a live one that is doing nothing.
+            scheduler: schedulerStatusOrAbsent(),
+            activeRunCount: active.runs?.length || 0,
+            recentRunCount: recent.runs?.length || 0,
+            byStatus,
+            recentRuns: (recent.runs || []).slice(0, 25).map((run) => ({
+                id: run.id,
+                status: run.status,
+                workspaceId: run.workspaceId,
+                teamId: run.teamId,
+                parentAgentId: run.parentAgentId,
+                childAgentId: run.childAgentId,
+                createdAt: run.createdAt,
+                updatedAt: run.updatedAt,
+                artifactCount: run.artifacts.length,
+                hasError: !!run.error,
+            })),
+            error: active.error || recent.error,
+        };
+    }
+    catch (err) {
+        return { success: false, error: errorMessage(err), scheduler: schedulerStatusOrAbsent() };
+    }
+}
+function collectRecentTextFiles(root, limit) {
+    const candidates = collectRawXenoFileInventory(root)
+        .filter((file) => /\.(log|jsonl|txt|md)$/i.test(file.path))
+        .sort((left, right) => right.mtimeMs - left.mtimeMs)
+        .slice(0, Math.max(1, Math.min(limit, 100)));
+    return candidates.flatMap((file) => {
+        try {
+            const text = readFileSync(file.path, 'utf-8').slice(-20_000);
+            return [{ path: redactLocalPath(file.path, root), text }];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+function extractIpcChannels(text) {
+    const channels = [];
+    const patterns = [
+        /\bsafeHandle\(\s*['"`]([^'"`]+)['"`]/g,
+        /\bipcMain\.handle\(\s*['"`]([^'"`]+)['"`]/g,
+    ];
+    for (const pattern of patterns) {
+        let match;
+        while ((match = pattern.exec(text)))
+            channels.push(match[1]);
+    }
+    return [...new Set(channels)];
+}
+function finiteNumberOrUndefined(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? Math.max(0, Math.round(value)) : undefined;
+}
+function finiteNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? Math.max(0, Math.round(value)) : 0;
+}
+function firstString(value) {
+    if (Array.isArray(value)) {
+        const first = value.find((entry) => typeof entry === 'string' && entry.trim());
+        return typeof first === 'string' ? first.slice(0, 500) : undefined;
+    }
+    return typeof value === 'string' && value.trim() ? value.slice(0, 500) : undefined;
+}
+function normalizedList(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((entry) => typeof entry === 'string' && !!entry.trim());
+}
+function uniqueValues(values) {
+    const out = [];
+    const seen = new Set();
+    for (const value of values) {
+        if (!value || seen.has(value))
+            continue;
+        seen.add(value);
+        out.push(value);
+    }
+    return out;
+}
+function redact(value, rootDir = DEFAULT_XENO_DIR) {
+    if (Array.isArray(value))
+        return value.map((entry) => redact(entry, rootDir));
+    if (!value || typeof value !== 'object')
+        return value;
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (/token|secret|password|cookie|authorization|api[-_]?key|credential/i.test(key)) {
+            out[key] = REDACTED;
+        }
+        else if (typeof entry === 'string') {
+            out[key] = redactString(entry, rootDir);
+        }
+        else {
+            out[key] = redact(entry, rootDir);
+        }
+    }
+    return out;
+}
+function redactString(value, rootDir = DEFAULT_XENO_DIR) {
+    return redactPathLikeString(value, rootDir)
+        .replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, `Bearer ${REDACTED}`)
+        .replace(/sk-[A-Za-z0-9_-]{20,}/g, REDACTED)
+        .replace(/xai-[A-Za-z0-9_-]{20,}/g, REDACTED)
+        .replace(/gh[pousr]_[A-Za-z0-9_]{20,}/g, REDACTED)
+        .replace(/AKIA[0-9A-Z]{16}/g, REDACTED)
+        .replace(/(api[_-]?key["'\s:=]{1,12})[A-Za-z0-9._~+/=-]{16,}/gi, `$1${REDACTED}`)
+        .replace(/(token["'\s:=]{1,12})[A-Za-z0-9._~+/=-]{16,}/gi, `$1${REDACTED}`);
+}
+function redactLocalPath(value, rootDir) {
+    const normalizedRoot = rootDir.replace(/\\/g, '/').replace(/\/+$/, '');
+    const normalizedValue = value.replace(/\\/g, '/');
+    if (normalizedValue === normalizedRoot)
+        return '~/.xeno';
+    if (normalizedValue.startsWith(`${normalizedRoot}/`)) {
+        return `~/.xeno/${normalizedValue.slice(normalizedRoot.length + 1)}`;
+    }
+    return normalizedValue.replace(homedir().replace(/\\/g, '/'), '~');
+}
+function redactPathLikeString(value, rootDir) {
+    let out = value;
+    const root = rootDir.replace(/\\/g, '/').replace(/\/+$/, '');
+    const home = homedir().replace(/\\/g, '/').replace(/\/+$/, '');
+    if (root)
+        out = replacePathPrefix(out, root, '~/.xeno');
+    if (home)
+        out = replacePathPrefix(out, home, '~');
+    out = out.replace(/(^|[^a-zA-Z])([A-Za-z]:[\\/][^\s"'`<>|]+)/g, (_match, prefix, pathMatch) => {
+        const normalized = pathMatch.replace(/\\/g, '/');
+        if (normalized.startsWith('~/.xeno') || normalized.startsWith('~'))
+            return `${prefix}${pathMatch}`;
+        return `${prefix}[path:${safePathBasename(pathMatch)}]`;
+    });
+    out = out.replace(/(^|[\s"'=:(])\/(?:Users|home|tmp|var|private|mnt|Volumes|opt|workspace|code)\/[^\s"'`<>),]+/g, (_match, prefix) => {
+        return `${prefix}[path]`;
+    });
+    return out;
+}
+function replacePathPrefix(value, prefix, replacement) {
+    return value.split(prefix).join(replacement);
+}
+function safePathBasename(value) {
+    const base = basename(value.replace(/\\/g, '/')).replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 80);
+    return base || 'local';
+}
+function ensureDir(path) {
+    if (!existsSync(path))
+        mkdirSync(path, { recursive: true });
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+let singleton = null;
+export function getSupportDiagnosticsService() {
+    if (!singleton)
+        singleton = new SupportDiagnosticsService();
+    return singleton;
+}
+//# sourceMappingURL=SupportDiagnosticsService.js.map