@xopcai/xopc 0.0.6 → 0.0.8

package/dist/src/cli/commands/doctor/checks/gateway-service.js

@@ -0,0 +1,64 @@
+import { init_loader, loadConfig } from "../../../../config/loader.js";
+import { resolveGatewayService } from "../../../../daemon/service.js";
+import { existsSync } from "node:fs";
+//#region src/cli/commands/doctor/checks/gateway-service.ts
+init_loader();
+async function checkGatewayService(ctx) {
+	if (!existsSync(ctx.configPath)) return {
+		id: "gateway-service",
+		label: "Gateway service",
+		status: "skip",
+		message: "No config file; skipped.",
+		hints: []
+	};
+	try {
+		loadConfig(ctx.configPath);
+	} catch {
+		return {
+			id: "gateway-service",
+			label: "Gateway service",
+			status: "skip",
+			message: "Config could not be loaded; skipped.",
+			hints: []
+		};
+	}
+	let service;
+	try {
+		service = await resolveGatewayService();
+	} catch (e) {
+		return {
+			id: "gateway-service",
+			label: "Gateway service",
+			status: "skip",
+			message: `Service backend unavailable: ${e instanceof Error ? e.message : String(e)}`,
+			hints: []
+		};
+	}
+	const env = { ...process.env };
+	if (!await service.isLoaded({ env })) return {
+		id: "gateway-service",
+		label: "Gateway service",
+		status: "warn",
+		message: "Gateway is not installed as a system service.",
+		hints: ["Install: xopc gateway install (or your platform equivalent)"]
+	};
+	const runtime = await service.getRuntime({ env });
+	if (runtime.status === "running" && runtime.pid) return {
+		id: "gateway-service",
+		label: "Gateway service",
+		status: "pass",
+		message: `Gateway service is running (PID ${runtime.pid}).`,
+		hints: [service.label]
+	};
+	return {
+		id: "gateway-service",
+		label: "Gateway service",
+		status: "warn",
+		message: `Gateway service is installed but not running (status: ${runtime.status}).`,
+		hints: ["Start: xopc gateway start"]
+	};
+}
+//#endregion
+export { checkGatewayService };
+
+//# sourceMappingURL=gateway-service.js.map

package/dist/src/cli/commands/doctor/checks/gateway-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-service.js","names":[],"sources":["../../../../../../src/cli/commands/doctor/checks/gateway-service.ts"],"sourcesContent":["import { loadConfig } from '../../../../config/loader.js';\nimport { existsSync } from 'node:fs';\nimport { resolveGatewayService } from '../../../../daemon/service.js';\nimport type { CheckResult, DoctorContext } from '../types.js';\n\nexport async function checkGatewayService(ctx: DoctorContext): Promise<CheckResult> {\n  if (!existsSync(ctx.configPath)) {\n    return {\n      id: 'gateway-service',\n      label: 'Gateway service',\n      status: 'skip',\n      message: 'No config file; skipped.',\n      hints: [],\n    };\n  }\n\n  try {\n    loadConfig(ctx.configPath);\n  } catch {\n    return {\n      id: 'gateway-service',\n      label: 'Gateway service',\n      status: 'skip',\n      message: 'Config could not be loaded; skipped.',\n      hints: [],\n    };\n  }\n\n  let service;\n  try {\n    service = await resolveGatewayService();\n  } catch (e) {\n    const msg = e instanceof Error ? e.message : String(e);\n    return {\n      id: 'gateway-service',\n      label: 'Gateway service',\n      status: 'skip',\n      message: `Service backend unavailable: ${msg}`,\n      hints: [],\n    };\n  }\n\n  const env: Record<string, string | undefined> = { ...process.env };\n  const loaded = await service.isLoaded({ env });\n  if (!loaded) {\n    return {\n      id: 'gateway-service',\n      label: 'Gateway service',\n      status: 'warn',\n      message: 'Gateway is not installed as a system service.',\n      hints: ['Install: xopc gateway install (or your platform equivalent)'],\n    };\n  }\n\n  const runtime = await service.getRuntime({ env });\n  if (runtime.status === 'running' && runtime.pid) {\n    return {\n      id: 'gateway-service',\n      label: 'Gateway service',\n      status: 'pass',\n      message: `Gateway service is running (PID ${runtime.pid}).`,\n      hints: [service.label],\n    };\n  }\n\n  return {\n    id: 'gateway-service',\n    label: 'Gateway service',\n    status: 'warn',\n    message: `Gateway service is installed but not running (status: ${runtime.status}).`,\n    hints: ['Start: xopc gateway start'],\n  };\n}\n"],"mappings":";;;;aAA0D;AAK1D,eAAsB,oBAAoB,KAA0C;AAClF,KAAI,CAAC,WAAW,IAAI,WAAW,CAC7B,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,EAAE;EACV;AAGH,KAAI;AACF,aAAW,IAAI,WAAW;SACpB;AACN,SAAO;GACL,IAAI;GACJ,OAAO;GACP,QAAQ;GACR,SAAS;GACT,OAAO,EAAE;GACV;;CAGH,IAAI;AACJ,KAAI;AACF,YAAU,MAAM,uBAAuB;UAChC,GAAG;AAEV,SAAO;GACL,IAAI;GACJ,OAAO;GACP,QAAQ;GACR,SAAS,gCALC,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;GAMpD,OAAO,EAAE;GACV;;CAGH,MAAM,MAA0C,EAAE,GAAG,QAAQ,KAAK;AAElE,KAAI,CADW,MAAM,QAAQ,SAAS,EAAE,KAAK,CAAC,CAE5C,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,CAAC,8DAA8D;EACvE;CAGH,MAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,KAAK,CAAC;AACjD,KAAI,QAAQ,WAAW,aAAa,QAAQ,IAC1C,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS,mCAAmC,QAAQ,IAAI;EACxD,OAAO,CAAC,QAAQ,MAAM;EACvB;AAGH,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS,yDAAyD,QAAQ,OAAO;EACjF,OAAO,CAAC,4BAA4B;EACrC"}

package/dist/src/cli/commands/doctor/checks/node-version.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult, DoctorContext } from '../types.js';
+export declare function checkNodeVersion(_ctx: DoctorContext): Promise<CheckResult>;

package/dist/src/cli/commands/doctor/checks/node-version.js

@@ -0,0 +1,33 @@
+//#region src/cli/commands/doctor/checks/node-version.ts
+function parseNodeMajorVersion() {
+	const match = process.version.match(/^v(\d+)/);
+	return match ? parseInt(match[1], 10) : 0;
+}
+async function checkNodeVersion(_ctx) {
+	const major = parseNodeMajorVersion();
+	if (major === 0) return {
+		id: "node-version",
+		label: "Node.js",
+		status: "warn",
+		message: "Could not parse Node.js version.",
+		hints: [`process.version=${process.version}`]
+	};
+	if (major < 22) return {
+		id: "node-version",
+		label: "Node.js",
+		status: "fail",
+		message: `Node ${major} is below the required minimum (22).`,
+		hints: ["Install Node.js 22+ from https://nodejs.org/"]
+	};
+	return {
+		id: "node-version",
+		label: "Node.js",
+		status: "pass",
+		message: `Node.js ${process.version} meets the project requirement (>= 22).`,
+		hints: []
+	};
+}
+//#endregion
+export { checkNodeVersion };
+
+//# sourceMappingURL=node-version.js.map

package/dist/src/cli/commands/doctor/checks/node-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-version.js","names":[],"sources":["../../../../../../src/cli/commands/doctor/checks/node-version.ts"],"sourcesContent":["import type { CheckResult, DoctorContext } from '../types.js';\n\nfunction parseNodeMajorVersion(): number {\n  const match = process.version.match(/^v(\\d+)/);\n  return match ? parseInt(match[1]!, 10) : 0;\n}\n\nexport async function checkNodeVersion(_ctx: DoctorContext): Promise<CheckResult> {\n  const major = parseNodeMajorVersion();\n  if (major === 0) {\n    return {\n      id: 'node-version',\n      label: 'Node.js',\n      status: 'warn',\n      message: 'Could not parse Node.js version.',\n      hints: [`process.version=${process.version}`],\n    };\n  }\n  if (major < 22) {\n    return {\n      id: 'node-version',\n      label: 'Node.js',\n      status: 'fail',\n      message: `Node ${major} is below the required minimum (22).`,\n      hints: ['Install Node.js 22+ from https://nodejs.org/'],\n    };\n  }\n  return {\n    id: 'node-version',\n    label: 'Node.js',\n    status: 'pass',\n    message: `Node.js ${process.version} meets the project requirement (>= 22).`,\n    hints: [],\n  };\n}\n"],"mappings":";AAEA,SAAS,wBAAgC;CACvC,MAAM,QAAQ,QAAQ,QAAQ,MAAM,UAAU;AAC9C,QAAO,QAAQ,SAAS,MAAM,IAAK,GAAG,GAAG;;AAG3C,eAAsB,iBAAiB,MAA2C;CAChF,MAAM,QAAQ,uBAAuB;AACrC,KAAI,UAAU,EACZ,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,CAAC,mBAAmB,QAAQ,UAAU;EAC9C;AAEH,KAAI,QAAQ,GACV,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS,QAAQ,MAAM;EACvB,OAAO,CAAC,+CAA+C;EACxD;AAEH,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS,WAAW,QAAQ,QAAQ;EACpC,OAAO,EAAE;EACV"}

package/dist/src/cli/commands/doctor/checks/provider-auth.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult, DoctorContext } from '../types.js';
+export declare function checkProviderAuth(ctx: DoctorContext): Promise<CheckResult>;

package/dist/src/cli/commands/doctor/checks/provider-auth.js

@@ -0,0 +1,91 @@
+import { getAgentDefaultModelRef, init_schema, parseModelRef } from "../../../../config/schema.js";
+import { init_loader, loadConfig } from "../../../../config/loader.js";
+import { PROVIDER_ENV_MAP, getApiKeyFromEnv, init_env_keys } from "../../../../providers/env-keys.js";
+import { existsSync } from "node:fs";
+//#region src/cli/commands/doctor/checks/provider-auth.ts
+init_loader();
+init_schema();
+init_env_keys();
+function collectProviderIdsFromConfig(cfg) {
+	const ids = /* @__PURE__ */ new Set();
+	const addRef = (ref) => {
+		if (!ref?.trim()) return;
+		const parsed = parseModelRef(ref.trim());
+		if (parsed) ids.add(parsed.provider.toLowerCase());
+	};
+	addRef(getAgentDefaultModelRef(cfg));
+	const raw = cfg.agents?.defaults?.model;
+	if (raw && typeof raw === "object" && "fallbacks" in raw && Array.isArray(raw.fallbacks)) for (const f of raw.fallbacks) addRef(typeof f === "string" ? f : void 0);
+	const list = cfg.agents?.list;
+	if (Array.isArray(list)) for (const e of list) {
+		const m = e?.model;
+		if (typeof m === "string") addRef(m);
+		else if (m && typeof m === "object" && "primary" in m) {
+			addRef(typeof m.primary === "string" ? m.primary : void 0);
+			const fb = m.fallbacks;
+			if (Array.isArray(fb)) for (const f of fb) addRef(f);
+		}
+	}
+	const img = cfg.agents?.defaults?.imageModel;
+	if (typeof img === "string") addRef(img);
+	else if (img && typeof img === "object" && "primary" in img) addRef(typeof img.primary === "string" ? img.primary : void 0);
+	const ss = cfg.agents?.defaults?.sessionSearch?.summaryModel;
+	if (typeof ss === "string") addRef(ss);
+	return ids;
+}
+function anyProviderEnvPresent() {
+	for (const vars of Object.values(PROVIDER_ENV_MAP)) for (const v of vars) if (process.env[v]?.trim()) return true;
+	for (const [k, val] of Object.entries(process.env)) {
+		if (!val?.trim()) continue;
+		if (k.endsWith("_API_KEY") || k.endsWith("_TOKEN")) return true;
+	}
+	return false;
+}
+async function checkProviderAuth(ctx) {
+	if (!existsSync(ctx.configPath)) return {
+		id: "provider-auth",
+		label: "Provider auth",
+		status: "skip",
+		message: "No config file; skipped.",
+		hints: []
+	};
+	let cfg;
+	try {
+		cfg = loadConfig(ctx.configPath);
+	} catch {
+		return {
+			id: "provider-auth",
+			label: "Provider auth",
+			status: "skip",
+			message: "Config could not be loaded; skipped.",
+			hints: []
+		};
+	}
+	const fromConfig = collectProviderIdsFromConfig(cfg);
+	const checkIds = fromConfig.size > 0 ? [...fromConfig] : Object.keys(PROVIDER_ENV_MAP);
+	for (const id of checkIds) if (getApiKeyFromEnv(id)?.trim()) return {
+		id: "provider-auth",
+		label: "Provider auth",
+		status: "pass",
+		message: "At least one LLM provider API key is available.",
+		hints: []
+	};
+	if (anyProviderEnvPresent()) return {
+		id: "provider-auth",
+		label: "Provider auth",
+		status: "pass",
+		message: "Environment contains provider credentials.",
+		hints: []
+	};
+	return {
+		id: "provider-auth",
+		label: "Provider auth",
+		status: "warn",
+		message: "No API keys detected for configured providers.",
+		hints: ["Set keys via: xopc auth set <provider> <key>", "Or export the provider env vars from the pi-ai docs."]
+	};
+}
+//#endregion
+export { checkProviderAuth };
+
+//# sourceMappingURL=provider-auth.js.map

package/dist/src/cli/commands/doctor/checks/provider-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-auth.js","names":[],"sources":["../../../../../../src/cli/commands/doctor/checks/provider-auth.ts"],"sourcesContent":["import { existsSync } from 'node:fs';\n\nimport { loadConfig } from '../../../../config/loader.js';\nimport type { Config } from '../../../../config/schema.js';\nimport { parseModelRef, getAgentDefaultModelRef } from '../../../../config/schema.js';\nimport { getApiKeyFromEnv, PROVIDER_ENV_MAP } from '../../../../providers/env-keys.js';\nimport type { CheckResult, DoctorContext } from '../types.js';\n\nfunction collectProviderIdsFromConfig(cfg: Config): Set<string> {\n  const ids = new Set<string>();\n\n  const addRef = (ref: string | undefined) => {\n    if (!ref?.trim()) return;\n    const parsed = parseModelRef(ref.trim());\n    if (parsed) ids.add(parsed.provider.toLowerCase());\n  };\n\n  addRef(getAgentDefaultModelRef(cfg));\n\n  const raw = cfg.agents?.defaults?.model;\n  if (raw && typeof raw === 'object' && 'fallbacks' in raw && Array.isArray(raw.fallbacks)) {\n    for (const f of raw.fallbacks) {\n      addRef(typeof f === 'string' ? f : undefined);\n    }\n  }\n\n  const list = cfg.agents?.list;\n  if (Array.isArray(list)) {\n    for (const e of list) {\n      const m = e?.model;\n      if (typeof m === 'string') addRef(m);\n      else if (m && typeof m === 'object' && 'primary' in m) {\n        addRef(typeof m.primary === 'string' ? m.primary : undefined);\n        const fb = (m as { fallbacks?: string[] }).fallbacks;\n        if (Array.isArray(fb)) {\n          for (const f of fb) addRef(f);\n        }\n      }\n    }\n  }\n\n  const img = cfg.agents?.defaults?.imageModel;\n  if (typeof img === 'string') addRef(img);\n  else if (img && typeof img === 'object' && 'primary' in img) {\n    addRef(typeof img.primary === 'string' ? img.primary : undefined);\n  }\n\n  const ss = cfg.agents?.defaults?.sessionSearch?.summaryModel;\n  if (typeof ss === 'string') addRef(ss);\n\n  return ids;\n}\n\nfunction anyProviderEnvPresent(): boolean {\n  for (const vars of Object.values(PROVIDER_ENV_MAP)) {\n    for (const v of vars) {\n      if (process.env[v]?.trim()) return true;\n    }\n  }\n  for (const [k, val] of Object.entries(process.env)) {\n    if (!val?.trim()) continue;\n    if (k.endsWith('_API_KEY') || k.endsWith('_TOKEN')) return true;\n  }\n  return false;\n}\n\nexport async function checkProviderAuth(ctx: DoctorContext): Promise<CheckResult> {\n  if (!existsSync(ctx.configPath)) {\n    return {\n      id: 'provider-auth',\n      label: 'Provider auth',\n      status: 'skip',\n      message: 'No config file; skipped.',\n      hints: [],\n    };\n  }\n\n  let cfg: Config;\n  try {\n    cfg = loadConfig(ctx.configPath);\n  } catch {\n    return {\n      id: 'provider-auth',\n      label: 'Provider auth',\n      status: 'skip',\n      message: 'Config could not be loaded; skipped.',\n      hints: [],\n    };\n  }\n\n  const fromConfig = collectProviderIdsFromConfig(cfg);\n  const checkIds = fromConfig.size > 0 ? [...fromConfig] : Object.keys(PROVIDER_ENV_MAP);\n\n  for (const id of checkIds) {\n    const key = getApiKeyFromEnv(id);\n    if (key?.trim()) {\n      return {\n        id: 'provider-auth',\n        label: 'Provider auth',\n        status: 'pass',\n        message: 'At least one LLM provider API key is available.',\n        hints: [],\n      };\n    }\n  }\n\n  if (anyProviderEnvPresent()) {\n    return {\n      id: 'provider-auth',\n      label: 'Provider auth',\n      status: 'pass',\n      message: 'Environment contains provider credentials.',\n      hints: [],\n    };\n  }\n\n  return {\n    id: 'provider-auth',\n    label: 'Provider auth',\n    status: 'warn',\n    message: 'No API keys detected for configured providers.',\n    hints: ['Set keys via: xopc auth set <provider> <key>', 'Or export the provider env vars from the pi-ai docs.'],\n  };\n}\n"],"mappings":";;;;;aAE0D;aAE4B;eACC;AAGvF,SAAS,6BAA6B,KAA0B;CAC9D,MAAM,sBAAM,IAAI,KAAa;CAE7B,MAAM,UAAU,QAA4B;AAC1C,MAAI,CAAC,KAAK,MAAM,CAAE;EAClB,MAAM,SAAS,cAAc,IAAI,MAAM,CAAC;AACxC,MAAI,OAAQ,KAAI,IAAI,OAAO,SAAS,aAAa,CAAC;;AAGpD,QAAO,wBAAwB,IAAI,CAAC;CAEpC,MAAM,MAAM,IAAI,QAAQ,UAAU;AAClC,KAAI,OAAO,OAAO,QAAQ,YAAY,eAAe,OAAO,MAAM,QAAQ,IAAI,UAAU,CACtF,MAAK,MAAM,KAAK,IAAI,UAClB,QAAO,OAAO,MAAM,WAAW,IAAI,KAAA,EAAU;CAIjD,MAAM,OAAO,IAAI,QAAQ;AACzB,KAAI,MAAM,QAAQ,KAAK,CACrB,MAAK,MAAM,KAAK,MAAM;EACpB,MAAM,IAAI,GAAG;AACb,MAAI,OAAO,MAAM,SAAU,QAAO,EAAE;WAC3B,KAAK,OAAO,MAAM,YAAY,aAAa,GAAG;AACrD,UAAO,OAAO,EAAE,YAAY,WAAW,EAAE,UAAU,KAAA,EAAU;GAC7D,MAAM,KAAM,EAA+B;AAC3C,OAAI,MAAM,QAAQ,GAAG,CACnB,MAAK,MAAM,KAAK,GAAI,QAAO,EAAE;;;CAMrC,MAAM,MAAM,IAAI,QAAQ,UAAU;AAClC,KAAI,OAAO,QAAQ,SAAU,QAAO,IAAI;UAC/B,OAAO,OAAO,QAAQ,YAAY,aAAa,IACtD,QAAO,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU,KAAA,EAAU;CAGnE,MAAM,KAAK,IAAI,QAAQ,UAAU,eAAe;AAChD,KAAI,OAAO,OAAO,SAAU,QAAO,GAAG;AAEtC,QAAO;;AAGT,SAAS,wBAAiC;AACxC,MAAK,MAAM,QAAQ,OAAO,OAAO,iBAAiB,CAChD,MAAK,MAAM,KAAK,KACd,KAAI,QAAQ,IAAI,IAAI,MAAM,CAAE,QAAO;AAGvC,MAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,QAAQ,IAAI,EAAE;AAClD,MAAI,CAAC,KAAK,MAAM,CAAE;AAClB,MAAI,EAAE,SAAS,WAAW,IAAI,EAAE,SAAS,SAAS,CAAE,QAAO;;AAE7D,QAAO;;AAGT,eAAsB,kBAAkB,KAA0C;AAChF,KAAI,CAAC,WAAW,IAAI,WAAW,CAC7B,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,EAAE;EACV;CAGH,IAAI;AACJ,KAAI;AACF,QAAM,WAAW,IAAI,WAAW;SAC1B;AACN,SAAO;GACL,IAAI;GACJ,OAAO;GACP,QAAQ;GACR,SAAS;GACT,OAAO,EAAE;GACV;;CAGH,MAAM,aAAa,6BAA6B,IAAI;CACpD,MAAM,WAAW,WAAW,OAAO,IAAI,CAAC,GAAG,WAAW,GAAG,OAAO,KAAK,iBAAiB;AAEtF,MAAK,MAAM,MAAM,SAEf,KADY,iBAAiB,GAAG,EACvB,MAAM,CACb,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,EAAE;EACV;AAIL,KAAI,uBAAuB,CACzB,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,EAAE;EACV;AAGH,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,CAAC,gDAAgD,uDAAuD;EAChH"}

package/dist/src/cli/commands/doctor/checks/security-audit.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult, DoctorContext } from '../types.js';
+export declare function checkSecurityAudit(ctx: DoctorContext): Promise<CheckResult>;

package/dist/src/cli/commands/doctor/checks/security-audit.js

@@ -0,0 +1,85 @@
+import { init_loader, loadConfig } from "../../../../config/loader.js";
+import { existsSync, statSync } from "node:fs";
+//#region src/cli/commands/doctor/checks/security-audit.ts
+init_loader();
+function isLoopbackHost(host) {
+	const normalized = host.trim().toLowerCase();
+	return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "::1" || normalized === "0:0:0:0:0:0:0:1";
+}
+function isAllInterfaces(host) {
+	const n = host.trim();
+	return n === "0.0.0.0" || n === "::" || n === "*";
+}
+async function checkSecurityAudit(ctx) {
+	if (!existsSync(ctx.configPath)) return {
+		id: "security-audit",
+		label: "Security",
+		status: "skip",
+		message: "No config file; skipped.",
+		hints: []
+	};
+	let cfg;
+	try {
+		cfg = loadConfig(ctx.configPath);
+	} catch {
+		return {
+			id: "security-audit",
+			label: "Security",
+			status: "skip",
+			message: "Config could not be loaded; skipped.",
+			hints: []
+		};
+	}
+	const hints = [];
+	const host = cfg.gateway?.host?.trim() || "127.0.0.1";
+	const auth = cfg.gateway?.auth;
+	const mode = auth?.mode ?? "token";
+	const token = auth?.token?.trim() ?? "";
+	if (isAllInterfaces(host) && (mode === "none" || !token)) return {
+		id: "security-audit",
+		label: "Security",
+		status: "fail",
+		message: "Gateway is bound to all interfaces without token authentication (critical).",
+		hints: ["Set gateway.host to 127.0.0.1 or enable gateway.auth (token).", "Do not expose an unauthenticated gateway on the network."]
+	};
+	if (isAllInterfaces(host) && mode !== "none" && token) hints.push("Listening on all network interfaces; prefer 127.0.0.1 or firewall rules if the token could leak.");
+	if (!isLoopbackHost(host) && !isAllInterfaces(host)) {
+		if (mode === "none" || !token) return {
+			id: "security-audit",
+			label: "Security",
+			status: "fail",
+			message: "Gateway is reachable on a non-loopback address without authentication.",
+			hints: ["Use gateway.auth.mode \"token\" and set gateway.auth.token, or bind to loopback only."]
+		};
+		hints.push("Non-loopback bind is safer with a strong token and firewall rules.");
+	}
+	if (isLoopbackHost(host) && (mode === "none" || !token)) return {
+		id: "security-audit",
+		label: "Security",
+		status: "warn",
+		message: "Gateway has no token auth (loopback only).",
+		hints: ["Consider gateway.auth.token for defense in depth."]
+	};
+	if (token.length > 0 && token.length < 16) hints.push("Auth token is shorter than 16 characters; use a longer random token.");
+	if (process.platform !== "win32") try {
+		if (statSync(ctx.configPath).mode & 63) hints.push("Config file is group/world-readable; consider chmod 600 (contains secrets).");
+	} catch {}
+	if (hints.length > 0) return {
+		id: "security-audit",
+		label: "Security",
+		status: "warn",
+		message: "Non-critical security recommendations.",
+		hints
+	};
+	return {
+		id: "security-audit",
+		label: "Security",
+		status: "pass",
+		message: "No critical gateway exposure issues detected.",
+		hints: []
+	};
+}
+//#endregion
+export { checkSecurityAudit };
+
+//# sourceMappingURL=security-audit.js.map

package/dist/src/cli/commands/doctor/checks/security-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-audit.js","names":[],"sources":["../../../../../../src/cli/commands/doctor/checks/security-audit.ts"],"sourcesContent":["import { existsSync, statSync } from 'node:fs';\n\nimport { loadConfig } from '../../../../config/loader.js';\nimport type { Config } from '../../../../config/schema.js';\nimport type { CheckResult, DoctorContext } from '../types.js';\n\nfunction isLoopbackHost(host: string): boolean {\n  const normalized = host.trim().toLowerCase();\n  return (\n    normalized === '127.0.0.1' ||\n    normalized === 'localhost' ||\n    normalized === '::1' ||\n    normalized === '0:0:0:0:0:0:0:1'\n  );\n}\n\nfunction isAllInterfaces(host: string): boolean {\n  const n = host.trim();\n  return n === '0.0.0.0' || n === '::' || n === '*';\n}\n\nexport async function checkSecurityAudit(ctx: DoctorContext): Promise<CheckResult> {\n  if (!existsSync(ctx.configPath)) {\n    return {\n      id: 'security-audit',\n      label: 'Security',\n      status: 'skip',\n      message: 'No config file; skipped.',\n      hints: [],\n    };\n  }\n\n  let cfg: Config;\n  try {\n    cfg = loadConfig(ctx.configPath);\n  } catch {\n    return {\n      id: 'security-audit',\n      label: 'Security',\n      status: 'skip',\n      message: 'Config could not be loaded; skipped.',\n      hints: [],\n    };\n  }\n\n  const hints: string[] = [];\n  const host = cfg.gateway?.host?.trim() || '127.0.0.1';\n  const auth = cfg.gateway?.auth;\n  const mode = auth?.mode ?? 'token';\n  const token = auth?.token?.trim() ?? '';\n\n  if (isAllInterfaces(host) && (mode === 'none' || !token)) {\n    return {\n      id: 'security-audit',\n      label: 'Security',\n      status: 'fail',\n      message: 'Gateway is bound to all interfaces without token authentication (critical).',\n      hints: [\n        'Set gateway.host to 127.0.0.1 or enable gateway.auth (token).',\n        'Do not expose an unauthenticated gateway on the network.',\n      ],\n    };\n  }\n\n  if (isAllInterfaces(host) && mode !== 'none' && token) {\n    hints.push('Listening on all network interfaces; prefer 127.0.0.1 or firewall rules if the token could leak.');\n  }\n\n  if (!isLoopbackHost(host) && !isAllInterfaces(host)) {\n    if (mode === 'none' || !token) {\n      return {\n        id: 'security-audit',\n        label: 'Security',\n        status: 'fail',\n        message: 'Gateway is reachable on a non-loopback address without authentication.',\n        hints: ['Use gateway.auth.mode \"token\" and set gateway.auth.token, or bind to loopback only.'],\n      };\n    }\n    hints.push('Non-loopback bind is safer with a strong token and firewall rules.');\n  }\n\n  if (isLoopbackHost(host) && (mode === 'none' || !token)) {\n    return {\n      id: 'security-audit',\n      label: 'Security',\n      status: 'warn',\n      message: 'Gateway has no token auth (loopback only).',\n      hints: ['Consider gateway.auth.token for defense in depth.'],\n    };\n  }\n\n  if (token.length > 0 && token.length < 16) {\n    hints.push('Auth token is shorter than 16 characters; use a longer random token.');\n  }\n\n  if (process.platform !== 'win32') {\n    try {\n      const st = statSync(ctx.configPath);\n      const perms = st.mode & 0o777;\n      if (perms & 0o077) {\n        hints.push('Config file is group/world-readable; consider chmod 600 (contains secrets).');\n      }\n    } catch {\n      /* ignore */\n    }\n  }\n\n  if (hints.length > 0) {\n    return {\n      id: 'security-audit',\n      label: 'Security',\n      status: 'warn',\n      message: 'Non-critical security recommendations.',\n      hints,\n    };\n  }\n\n  return {\n    id: 'security-audit',\n    label: 'Security',\n    status: 'pass',\n    message: 'No critical gateway exposure issues detected.',\n    hints: [],\n  };\n}\n"],"mappings":";;;aAE0D;AAI1D,SAAS,eAAe,MAAuB;CAC7C,MAAM,aAAa,KAAK,MAAM,CAAC,aAAa;AAC5C,QACE,eAAe,eACf,eAAe,eACf,eAAe,SACf,eAAe;;AAInB,SAAS,gBAAgB,MAAuB;CAC9C,MAAM,IAAI,KAAK,MAAM;AACrB,QAAO,MAAM,aAAa,MAAM,QAAQ,MAAM;;AAGhD,eAAsB,mBAAmB,KAA0C;AACjF,KAAI,CAAC,WAAW,IAAI,WAAW,CAC7B,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,EAAE;EACV;CAGH,IAAI;AACJ,KAAI;AACF,QAAM,WAAW,IAAI,WAAW;SAC1B;AACN,SAAO;GACL,IAAI;GACJ,OAAO;GACP,QAAQ;GACR,SAAS;GACT,OAAO,EAAE;GACV;;CAGH,MAAM,QAAkB,EAAE;CAC1B,MAAM,OAAO,IAAI,SAAS,MAAM,MAAM,IAAI;CAC1C,MAAM,OAAO,IAAI,SAAS;CAC1B,MAAM,OAAO,MAAM,QAAQ;CAC3B,MAAM,QAAQ,MAAM,OAAO,MAAM,IAAI;AAErC,KAAI,gBAAgB,KAAK,KAAK,SAAS,UAAU,CAAC,OAChD,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,CACL,iEACA,2DACD;EACF;AAGH,KAAI,gBAAgB,KAAK,IAAI,SAAS,UAAU,MAC9C,OAAM,KAAK,mGAAmG;AAGhH,KAAI,CAAC,eAAe,KAAK,IAAI,CAAC,gBAAgB,KAAK,EAAE;AACnD,MAAI,SAAS,UAAU,CAAC,MACtB,QAAO;GACL,IAAI;GACJ,OAAO;GACP,QAAQ;GACR,SAAS;GACT,OAAO,CAAC,wFAAsF;GAC/F;AAEH,QAAM,KAAK,qEAAqE;;AAGlF,KAAI,eAAe,KAAK,KAAK,SAAS,UAAU,CAAC,OAC/C,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,CAAC,oDAAoD;EAC7D;AAGH,KAAI,MAAM,SAAS,KAAK,MAAM,SAAS,GACrC,OAAM,KAAK,uEAAuE;AAGpF,KAAI,QAAQ,aAAa,QACvB,KAAI;AAGF,MAFW,SAAS,IAAI,WAAW,CAClB,OAAA,GAEf,OAAM,KAAK,8EAA8E;SAErF;AAKV,KAAI,MAAM,SAAS,EACjB,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT;EACD;AAGH,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,EAAE;EACV"}

package/dist/src/cli/commands/doctor/checks/session-integrity.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult, DoctorContext } from '../types.js';
+export declare function checkSessionIntegrity(ctx: DoctorContext): Promise<CheckResult>;

package/dist/src/cli/commands/doctor/checks/session-integrity.js

@@ -0,0 +1,118 @@
+import { init_agent_scope, resolveDefaultAgentId } from "../../../../agent/agent-scope.js";
+import { init_paths, resolveSessionsDir, resolveSessionsIndexPath } from "../../../../config/paths.js";
+import { init_loader, loadConfig } from "../../../../config/loader.js";
+import { resolveSessionShardRelativePath } from "../../../../session/shard-path.js";
+import { join } from "node:path";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+//#region src/cli/commands/doctor/checks/session-integrity.ts
+init_agent_scope();
+init_loader();
+init_paths();
+function sanitizeSessionKeyToFileStem(key) {
+	return key.replace(/[^a-zA-Z0-9_-]/g, "_");
+}
+function findSessionFileInDir(baseDir, safeStem) {
+	if (!existsSync(baseDir)) return false;
+	const entries = readdirSync(baseDir, { withFileTypes: true });
+	for (const entry of entries) {
+		if (entry.isFile() && entry.name === `${safeStem}.json`) return true;
+		if (entry.isDirectory() && entry.name !== "archive") {
+			if (findSessionFileInDir(join(baseDir, entry.name), safeStem)) return true;
+		}
+	}
+	return false;
+}
+function transcriptExists(sessionsDir, key) {
+	const safeStem = sanitizeSessionKeyToFileStem(key);
+	if (existsSync(join(sessionsDir, resolveSessionShardRelativePath(key), `${safeStem}.json`))) return true;
+	return findSessionFileInDir(sessionsDir, safeStem);
+}
+async function checkSessionIntegrity(ctx) {
+	if (!ctx.options.deep) return {
+		id: "session-integrity",
+		label: "Sessions",
+		status: "skip",
+		message: "Deep mode off; session scan skipped.",
+		hints: ["Run: xopc doctor --deep"]
+	};
+	if (!existsSync(ctx.configPath)) return {
+		id: "session-integrity",
+		label: "Sessions",
+		status: "skip",
+		message: "No config file; skipped.",
+		hints: []
+	};
+	let config;
+	try {
+		config = loadConfig(ctx.configPath);
+	} catch {
+		return {
+			id: "session-integrity",
+			label: "Sessions",
+			status: "skip",
+			message: "Config could not be loaded; skipped.",
+			hints: []
+		};
+	}
+	const agentId = resolveDefaultAgentId(config);
+	const indexPath = resolveSessionsIndexPath(config, agentId);
+	const sessionsDir = resolveSessionsDir(config, agentId);
+	if (!existsSync(sessionsDir)) return {
+		id: "session-integrity",
+		label: "Sessions",
+		status: "warn",
+		message: "Sessions directory is missing.",
+		hints: [sessionsDir]
+	};
+	if (!existsSync(indexPath)) return {
+		id: "session-integrity",
+		label: "Sessions",
+		status: "warn",
+		message: "Session index file is missing.",
+		hints: [indexPath]
+	};
+	let index;
+	try {
+		index = JSON.parse(readFileSync(indexPath, "utf-8"));
+	} catch {
+		return {
+			id: "session-integrity",
+			label: "Sessions",
+			status: "warn",
+			message: "Session index is not valid JSON.",
+			hints: [indexPath]
+		};
+	}
+	const sample = [...Array.isArray(index.sessions) ? index.sessions : []].sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime()).slice(0, 20);
+	if (sample.length === 0) return {
+		id: "session-integrity",
+		label: "Sessions",
+		status: "pass",
+		message: "Session index is valid; no sessions to sample.",
+		hints: []
+	};
+	const missing = [];
+	for (const s of sample) {
+		const key = s.key?.trim();
+		if (!key) continue;
+		if (!transcriptExists(sessionsDir, key)) missing.push(key);
+	}
+	if (missing.length > 0) return {
+		id: "session-integrity",
+		label: "Sessions",
+		status: "warn",
+		message: `${missing.length} of ${sample.length} sampled session transcripts are missing on disk.`,
+		hints: missing.slice(0, 5).map((k) => `Missing transcript for: ${k}`)
+	};
+	return {
+		id: "session-integrity",
+		label: "Sessions",
+		status: "pass",
+		message: `Sampled ${sample.length} recent session(s); transcript files are present.`,
+		hints: []
+	};
+}
+//#endregion
+export { checkSessionIntegrity };
+
+//# sourceMappingURL=session-integrity.js.map

package/dist/src/cli/commands/doctor/checks/session-integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-integrity.js","names":[],"sources":["../../../../../../src/cli/commands/doctor/checks/session-integrity.ts"],"sourcesContent":["import { existsSync, readFileSync, readdirSync } from 'node:fs';\nimport { join } from 'node:path';\n\nimport { resolveDefaultAgentId } from '../../../../agent/agent-scope.js';\nimport { loadConfig } from '../../../../config/loader.js';\nimport { resolveSessionsDir, resolveSessionsIndexPath } from '../../../../config/paths.js';\nimport { resolveSessionShardRelativePath } from '../../../../session/shard-path.js';\nimport type { SessionIndex, SessionMetadata } from '../../../../session/types.js';\nimport type { CheckResult, DoctorContext } from '../types.js';\n\nfunction sanitizeSessionKeyToFileStem(key: string): string {\n  return key.replace(/[^a-zA-Z0-9_-]/g, '_');\n}\n\nfunction findSessionFileInDir(baseDir: string, safeStem: string): boolean {\n  if (!existsSync(baseDir)) return false;\n  const entries = readdirSync(baseDir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (entry.isFile() && entry.name === `${safeStem}.json`) return true;\n    if (entry.isDirectory() && entry.name !== 'archive') {\n      if (findSessionFileInDir(join(baseDir, entry.name), safeStem)) return true;\n    }\n  }\n  return false;\n}\n\nfunction transcriptExists(sessionsDir: string, key: string): boolean {\n  const safeStem = sanitizeSessionKeyToFileStem(key);\n  const shard = resolveSessionShardRelativePath(key);\n  const primary = join(sessionsDir, shard, `${safeStem}.json`);\n  if (existsSync(primary)) return true;\n  return findSessionFileInDir(sessionsDir, safeStem);\n}\n\nexport async function checkSessionIntegrity(ctx: DoctorContext): Promise<CheckResult> {\n  if (!ctx.options.deep) {\n    return {\n      id: 'session-integrity',\n      label: 'Sessions',\n      status: 'skip',\n      message: 'Deep mode off; session scan skipped.',\n      hints: ['Run: xopc doctor --deep'],\n    };\n  }\n\n  if (!existsSync(ctx.configPath)) {\n    return {\n      id: 'session-integrity',\n      label: 'Sessions',\n      status: 'skip',\n      message: 'No config file; skipped.',\n      hints: [],\n    };\n  }\n\n  let config;\n  try {\n    config = loadConfig(ctx.configPath);\n  } catch {\n    return {\n      id: 'session-integrity',\n      label: 'Sessions',\n      status: 'skip',\n      message: 'Config could not be loaded; skipped.',\n      hints: [],\n    };\n  }\n\n  const agentId = resolveDefaultAgentId(config);\n  const indexPath = resolveSessionsIndexPath(config, agentId);\n  const sessionsDir = resolveSessionsDir(config, agentId);\n\n  if (!existsSync(sessionsDir)) {\n    return {\n      id: 'session-integrity',\n      label: 'Sessions',\n      status: 'warn',\n      message: 'Sessions directory is missing.',\n      hints: [sessionsDir],\n    };\n  }\n\n  if (!existsSync(indexPath)) {\n    return {\n      id: 'session-integrity',\n      label: 'Sessions',\n      status: 'warn',\n      message: 'Session index file is missing.',\n      hints: [indexPath],\n    };\n  }\n\n  let index: SessionIndex;\n  try {\n    index = JSON.parse(readFileSync(indexPath, 'utf-8')) as SessionIndex;\n  } catch {\n    return {\n      id: 'session-integrity',\n      label: 'Sessions',\n      status: 'warn',\n      message: 'Session index is not valid JSON.',\n      hints: [indexPath],\n    };\n  }\n\n  const sessions: SessionMetadata[] = Array.isArray(index.sessions) ? index.sessions : [];\n  const sorted = [...sessions].sort(\n    (a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime(),\n  );\n  const sample = sorted.slice(0, 20);\n  if (sample.length === 0) {\n    return {\n      id: 'session-integrity',\n      label: 'Sessions',\n      status: 'pass',\n      message: 'Session index is valid; no sessions to sample.',\n      hints: [],\n    };\n  }\n\n  const missing: string[] = [];\n  for (const s of sample) {\n    const key = s.key?.trim();\n    if (!key) continue;\n    if (!transcriptExists(sessionsDir, key)) {\n      missing.push(key);\n    }\n  }\n\n  if (missing.length > 0) {\n    return {\n      id: 'session-integrity',\n      label: 'Sessions',\n      status: 'warn',\n      message: `${missing.length} of ${sample.length} sampled session transcripts are missing on disk.`,\n      hints: missing.slice(0, 5).map((k) => `Missing transcript for: ${k}`),\n    };\n  }\n\n  return {\n    id: 'session-integrity',\n    label: 'Sessions',\n    status: 'pass',\n    message: `Sampled ${sample.length} recent session(s); transcript files are present.`,\n    hints: [],\n  };\n}\n"],"mappings":";;;;;;;kBAGyE;aACf;YACiC;AAK3F,SAAS,6BAA6B,KAAqB;AACzD,QAAO,IAAI,QAAQ,mBAAmB,IAAI;;AAG5C,SAAS,qBAAqB,SAAiB,UAA2B;AACxE,KAAI,CAAC,WAAW,QAAQ,CAAE,QAAO;CACjC,MAAM,UAAU,YAAY,SAAS,EAAE,eAAe,MAAM,CAAC;AAC7D,MAAK,MAAM,SAAS,SAAS;AAC3B,MAAI,MAAM,QAAQ,IAAI,MAAM,SAAS,GAAG,SAAS,OAAQ,QAAO;AAChE,MAAI,MAAM,aAAa,IAAI,MAAM,SAAS;OACpC,qBAAqB,KAAK,SAAS,MAAM,KAAK,EAAE,SAAS,CAAE,QAAO;;;AAG1E,QAAO;;AAGT,SAAS,iBAAiB,aAAqB,KAAsB;CACnE,MAAM,WAAW,6BAA6B,IAAI;AAGlD,KAAI,WADY,KAAK,aADP,gCAAgC,IAAI,EACT,GAAG,SAAS,OAAO,CACrC,CAAE,QAAO;AAChC,QAAO,qBAAqB,aAAa,SAAS;;AAGpD,eAAsB,sBAAsB,KAA0C;AACpF,KAAI,CAAC,IAAI,QAAQ,KACf,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,CAAC,0BAA0B;EACnC;AAGH,KAAI,CAAC,WAAW,IAAI,WAAW,CAC7B,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,EAAE;EACV;CAGH,IAAI;AACJ,KAAI;AACF,WAAS,WAAW,IAAI,WAAW;SAC7B;AACN,SAAO;GACL,IAAI;GACJ,OAAO;GACP,QAAQ;GACR,SAAS;GACT,OAAO,EAAE;GACV;;CAGH,MAAM,UAAU,sBAAsB,OAAO;CAC7C,MAAM,YAAY,yBAAyB,QAAQ,QAAQ;CAC3D,MAAM,cAAc,mBAAmB,QAAQ,QAAQ;AAEvD,KAAI,CAAC,WAAW,YAAY,CAC1B,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,CAAC,YAAY;EACrB;AAGH,KAAI,CAAC,WAAW,UAAU,CACxB,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,CAAC,UAAU;EACnB;CAGH,IAAI;AACJ,KAAI;AACF,UAAQ,KAAK,MAAM,aAAa,WAAW,QAAQ,CAAC;SAC9C;AACN,SAAO;GACL,IAAI;GACJ,OAAO;GACP,QAAQ;GACR,SAAS;GACT,OAAO,CAAC,UAAU;GACnB;;CAOH,MAAM,SAHS,CAAC,GADoB,MAAM,QAAQ,MAAM,SAAS,GAAG,MAAM,WAAW,EAAE,CAC3D,CAAC,MAC1B,GAAG,MAAM,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,GAAG,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,CAC5E,CACqB,MAAM,GAAG,GAAG;AAClC,KAAI,OAAO,WAAW,EACpB,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,EAAE;EACV;CAGH,MAAM,UAAoB,EAAE;AAC5B,MAAK,MAAM,KAAK,QAAQ;EACtB,MAAM,MAAM,EAAE,KAAK,MAAM;AACzB,MAAI,CAAC,IAAK;AACV,MAAI,CAAC,iBAAiB,aAAa,IAAI,CACrC,SAAQ,KAAK,IAAI;;AAIrB,KAAI,QAAQ,SAAS,EACnB,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS,GAAG,QAAQ,OAAO,MAAM,OAAO,OAAO;EAC/C,OAAO,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,MAAM,2BAA2B,IAAI;EACtE;AAGH,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS,WAAW,OAAO,OAAO;EAClC,OAAO,EAAE;EACV"}

package/dist/src/cli/commands/doctor/checks/state-integrity.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult, DoctorContext } from '../types.js';
+export declare function checkStateIntegrity(ctx: DoctorContext): Promise<CheckResult>;

package/dist/src/cli/commands/doctor/checks/state-integrity.js

@@ -0,0 +1,99 @@
+import { join } from "node:path";
+import { accessSync, chmodSync, constants, existsSync, mkdirSync, statSync } from "node:fs";
+//#region src/cli/commands/doctor/checks/state-integrity.ts
+function isWritable(dir) {
+	try {
+		accessSync(dir, constants.W_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function checkStateIntegrity(ctx) {
+	const root = ctx.stateDir;
+	const hints = [];
+	if (!existsSync(root)) {
+		if (ctx.options.fix) try {
+			mkdirSync(root, {
+				recursive: true,
+				mode: 448
+			});
+			if (process.platform !== "win32") chmodSync(root, 448);
+			return {
+				id: "state-integrity",
+				label: "State directory",
+				status: "pass",
+				message: "Created state directory with safe permissions.",
+				hints: [root],
+				fixed: true
+			};
+		} catch (e) {
+			return {
+				id: "state-integrity",
+				label: "State directory",
+				status: "fail",
+				message: `State directory missing and could not create: ${e instanceof Error ? e.message : String(e)}`,
+				hints: [root]
+			};
+		}
+		return {
+			id: "state-integrity",
+			label: "State directory",
+			status: "fail",
+			message: "State directory does not exist.",
+			hints: [
+				`Expected: ${root}`,
+				"Run: xopc init",
+				"Or: xopc doctor --fix"
+			]
+		};
+	}
+	if (!isWritable(root)) return {
+		id: "state-integrity",
+		label: "State directory",
+		status: "fail",
+		message: "State directory is not writable.",
+		hints: [root]
+	};
+	if (process.platform !== "win32") try {
+		if ((statSync(root).mode & 511) !== 448) {
+			if (ctx.options.fix) {
+				chmodSync(root, 448);
+				return {
+					id: "state-integrity",
+					label: "State directory",
+					status: "pass",
+					message: "State directory permissions set to 700.",
+					hints: [root],
+					fixed: true
+				};
+			}
+			return {
+				id: "state-integrity",
+				label: "State directory",
+				status: "warn",
+				message: "State directory permissions are not 700 (recommended for privacy).",
+				hints: [root, "Run: xopc doctor --fix"]
+			};
+		}
+	} catch {}
+	const agentsDir = join(root, "agents");
+	if (!existsSync(agentsDir) && ctx.options.fix) try {
+		mkdirSync(agentsDir, {
+			recursive: true,
+			mode: 448
+		});
+		hints.push(`Created: ${agentsDir}`);
+	} catch {}
+	return {
+		id: "state-integrity",
+		label: "State directory",
+		status: "pass",
+		message: "State directory exists and is usable.",
+		hints: hints.length ? hints : [root]
+	};
+}
+//#endregion
+export { checkStateIntegrity };
+
+//# sourceMappingURL=state-integrity.js.map

package/dist/src/cli/commands/doctor/checks/state-integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-integrity.js","names":[],"sources":["../../../../../../src/cli/commands/doctor/checks/state-integrity.ts"],"sourcesContent":["import { existsSync, mkdirSync, chmodSync, accessSync, constants, statSync } from 'node:fs';\nimport { join } from 'node:path';\n\nimport type { CheckResult, DoctorContext } from '../types.js';\n\nfunction isWritable(dir: string): boolean {\n  try {\n    accessSync(dir, constants.W_OK);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport async function checkStateIntegrity(ctx: DoctorContext): Promise<CheckResult> {\n  const root = ctx.stateDir;\n  const hints: string[] = [];\n\n  if (!existsSync(root)) {\n    if (ctx.options.fix) {\n      try {\n        mkdirSync(root, { recursive: true, mode: 0o700 });\n        if (process.platform !== 'win32') {\n          chmodSync(root, 0o700);\n        }\n        return {\n          id: 'state-integrity',\n          label: 'State directory',\n          status: 'pass',\n          message: 'Created state directory with safe permissions.',\n          hints: [root],\n          fixed: true,\n        };\n      } catch (e) {\n        const msg = e instanceof Error ? e.message : String(e);\n        return {\n          id: 'state-integrity',\n          label: 'State directory',\n          status: 'fail',\n          message: `State directory missing and could not create: ${msg}`,\n          hints: [root],\n        };\n      }\n    }\n    return {\n      id: 'state-integrity',\n      label: 'State directory',\n      status: 'fail',\n      message: 'State directory does not exist.',\n      hints: [`Expected: ${root}`, 'Run: xopc init', 'Or: xopc doctor --fix'],\n    };\n  }\n\n  if (!isWritable(root)) {\n    return {\n      id: 'state-integrity',\n      label: 'State directory',\n      status: 'fail',\n      message: 'State directory is not writable.',\n      hints: [root],\n    };\n  }\n\n  if (process.platform !== 'win32') {\n    try {\n      const mode = statSync(root).mode & 0o777;\n      if (mode !== 0o700) {\n        if (ctx.options.fix) {\n          chmodSync(root, 0o700);\n          return {\n            id: 'state-integrity',\n            label: 'State directory',\n            status: 'pass',\n            message: 'State directory permissions set to 700.',\n            hints: [root],\n            fixed: true,\n          };\n        }\n        return {\n          id: 'state-integrity',\n          label: 'State directory',\n          status: 'warn',\n          message: 'State directory permissions are not 700 (recommended for privacy).',\n          hints: [root, 'Run: xopc doctor --fix'],\n        };\n      }\n    } catch {\n      /* ignore stat errors */\n    }\n  }\n\n  const agentsDir = join(root, 'agents');\n  if (!existsSync(agentsDir) && ctx.options.fix) {\n    try {\n      mkdirSync(agentsDir, { recursive: true, mode: 0o700 });\n      hints.push(`Created: ${agentsDir}`);\n    } catch {\n      /* best-effort */\n    }\n  }\n\n  return {\n    id: 'state-integrity',\n    label: 'State directory',\n    status: 'pass',\n    message: 'State directory exists and is usable.',\n    hints: hints.length ? hints : [root],\n  };\n}\n"],"mappings":";;;AAKA,SAAS,WAAW,KAAsB;AACxC,KAAI;AACF,aAAW,KAAK,UAAU,KAAK;AAC/B,SAAO;SACD;AACN,SAAO;;;AAIX,eAAsB,oBAAoB,KAA0C;CAClF,MAAM,OAAO,IAAI;CACjB,MAAM,QAAkB,EAAE;AAE1B,KAAI,CAAC,WAAW,KAAK,EAAE;AACrB,MAAI,IAAI,QAAQ,IACd,KAAI;AACF,aAAU,MAAM;IAAE,WAAW;IAAM,MAAM;IAAO,CAAC;AACjD,OAAI,QAAQ,aAAa,QACvB,WAAU,MAAM,IAAM;AAExB,UAAO;IACL,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO,CAAC,KAAK;IACb,OAAO;IACR;WACM,GAAG;AAEV,UAAO;IACL,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,SAAS,iDALC,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;IAMpD,OAAO,CAAC,KAAK;IACd;;AAGL,SAAO;GACL,IAAI;GACJ,OAAO;GACP,QAAQ;GACR,SAAS;GACT,OAAO;IAAC,aAAa;IAAQ;IAAkB;IAAwB;GACxE;;AAGH,KAAI,CAAC,WAAW,KAAK,CACnB,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,CAAC,KAAK;EACd;AAGH,KAAI,QAAQ,aAAa,QACvB,KAAI;AAEF,OADa,SAAS,KAAK,CAAC,OAAO,SACtB,KAAO;AAClB,OAAI,IAAI,QAAQ,KAAK;AACnB,cAAU,MAAM,IAAM;AACtB,WAAO;KACL,IAAI;KACJ,OAAO;KACP,QAAQ;KACR,SAAS;KACT,OAAO,CAAC,KAAK;KACb,OAAO;KACR;;AAEH,UAAO;IACL,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO,CAAC,MAAM,yBAAyB;IACxC;;SAEG;CAKV,MAAM,YAAY,KAAK,MAAM,SAAS;AACtC,KAAI,CAAC,WAAW,UAAU,IAAI,IAAI,QAAQ,IACxC,KAAI;AACF,YAAU,WAAW;GAAE,WAAW;GAAM,MAAM;GAAO,CAAC;AACtD,QAAM,KAAK,YAAY,YAAY;SAC7B;AAKV,QAAO;EACL,IAAI;EACJ,OAAO;EACP,QAAQ;EACR,SAAS;EACT,OAAO,MAAM,SAAS,QAAQ,CAAC,KAAK;EACrC"}

package/dist/src/cli/commands/doctor/checks/version-check.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult, DoctorContext } from '../types.js';
+export declare function checkVersionUpdate(_ctx: DoctorContext): Promise<CheckResult>;