badgr-cli 1.1.2 → 1.1.4

package/src/commands/diagnose.js

@@ -0,0 +1,798 @@
+import fs from 'fs';
+import { classifyPastedInput } from 'badgr-shared';
+import { callApi } from '../api.js';
+import { ensureLoggedIn } from '../onboarding.js';
+
+const DIAGNOSE_HELP = `
+Paste anything. Badgr detects the input, diagnoses it for free, then
+shows either missing information, a verified template, or a capped
+smoke-test plan. No GPU launches without explicit --approve.
+
+Usage:
+  badgr diagnose "<input>"
+  badgr diagnose "<input>" --smoke
+  badgr diagnose "<input>" --approve
+  badgr diagnose "<input>" --json
+  badgr diagnose <case_id_or_url> --approve   Resume an existing case (e.g.
+                                               one shared via a case link)
+
+Input (auto-detected):
+  GitHub issue URL       https://github.com/org/repo/issues/N
+  GitHub repo URL        https://github.com/org/repo
+  Docker image           owner/image:tag  or  image:tag
+  Local log / file       ./error.log  or  vllm.log
+  ComfyUI workflow       workflow.json  (JSON file)
+  Raw conversation       paste Discord / Slack / support thread text
+  Existing case          repro_xxxxxxxx  or  https://aibadgr.com/repro/repro_xxxxxxxx
+
+Flags:
+  --smoke                Free. Runs real, cheap mechanical validation of the
+                          produced command on top of the normal diagnosis --
+                          command syntax, CLI-entrypoint corroboration,
+                          referenced-file presence, Docker ENTRYPOINT/CMD
+                          consistency, required env vars -- plus a client-side
+                          check of any local file path you pasted (e.g. a
+                          .gguf path), which only this machine can see. Never
+                          starts a GPU, never requires login, never prints
+                          "Verified" -- only "Smoke Checked" (AGENTS.md proof
+                          levels). Can be combined with --approve: the smoke
+                          checks print first, then the normal approve flow
+                          runs (they are independent, non-blocking steps).
+                          Unrelated to "badgr run --smoke", which launches a
+                          real, billable cheapest-GPU job.
+  --approve              Approve the capped smoke test after diagnosis (opens
+                          browser sign-in automatically if not logged in).
+                          This is a real, billable GPU-provisioned run --
+                          distinct from the free --smoke flag above.
+  --docker <image>       Force Docker-image intake (override auto-detect)
+  --repo   <url>         Force repository intake (override auto-detect)
+  --comfyui <path>       Force ComfyUI workflow intake (override auto-detect)
+  --github <url>         Include a GitHub issue URL found inside pasted text
+                          as additional context. Opt-in only, never fetched
+                          automatically (see "Additional context found" below)
+  --json                 Machine-readable JSON output
+  --help, -h             Show this help
+
+Status: every run prints one of NEEDS INFO / READY / SMOKE CHECKED / INVALID / VERIFIED.
+        NEEDS INFO   -- cannot yet produce a complete command
+        READY        -- complete evidence-backed command, no smoke run
+        SMOKE CHECKED -- --smoke ran; all applicable checks PASS or SKIPPED
+        INVALID      -- --smoke ran and an applicable check actually FAILED
+        VERIFIED     -- only after a real successful run (never from --smoke)
+
+Run page: READY and SMOKE CHECKED results also create a free, anonymous
+          "Run" link (the same prepared case /run-issue's own confirm form
+          creates) -- a saved, runnable configuration you or anyone with the
+          link can open and click Run on. NEEDS INFO and INVALID never get
+          one (nothing runnable to save, or a check just proved it broken)
+          -- both print the correction instead. The page shows the exact
+          canonical "badgr ..." command --approve would run, not merely the
+          source command extraction found. Still no GPU starts until that
+          click. --approve reuses this same case rather than creating a
+          second one.
+
+Safety: nothing runs from AI-extracted data without --approve.
+        No GPU launches without explicit approval and a credit check.
+        --smoke never provisions a GPU and never requires login.
+
+Full interactive flow: https://aibadgr.com/run-issue`;
+
+function detectInput(raw, flags) {
+  if (flags.docker) {
+    return {
+      kind:  'docker_image',
+      label: `Docker image: ${flags.docker}`,
+      body:  { docker_image: flags.docker },
+    };
+  }
+  if (flags.repo) {
+    return {
+      kind:  'repo_url',
+      label: `GitHub repository: ${flags.repo}`,
+      body:  { repo_url: flags.repo },
+    };
+  }
+  if (flags.comfyui) {
+    if (!fs.existsSync(flags.comfyui)) throw new Error(`File not found: ${flags.comfyui}`);
+    return {
+      kind:  'comfyui_workflow',
+      label: `ComfyUI workflow: ${flags.comfyui}`,
+      body:  { workflow_json: fs.readFileSync(flags.comfyui, 'utf8') },
+    };
+  }
+
+  if (!raw) return null;
+
+  // Case-id / GitHub-URL-shape classification is shared with the web page
+  // (`classifyPastedInput`, packages/shared/src/index.ts) so the CLI and
+  // /run-issue never disagree about what a given paste is. A case_id (bare,
+  // or embedded in a /repro/<id> or /run-issue?case_id=<id> link — the two
+  // shapes an admin-prepared or self-created case gets shared as) resumes
+  // that existing case instead of diagnosing new input.
+  const classified = classifyPastedInput(raw);
+  if (classified.kind === 'existing_case') {
+    return { kind: 'existing_case', label: `Existing case: ${classified.body.case_id}`, caseId: classified.body.case_id };
+  }
+  if (classified.kind === 'github_issue') {
+    return { kind: 'github_issue', label: `GitHub issue: ${raw}`, body: classified.body };
+  }
+  if (classified.kind === 'repo_url') {
+    return { kind: 'repo_url', label: `GitHub repository: ${raw}`, body: classified.body };
+  }
+
+  // Local filesystem paths -- only the CLI has a filesystem to check
+  // against, so this stays CLI-only, sitting between the shared URL checks
+  // above and the shared Docker-image/text fallback below (matches
+  // classifyPastedInput's own precedence for everything except this).
+  if (fs.existsSync(raw)) {
+    const content = fs.readFileSync(raw, 'utf8');
+    if (raw.endsWith('.json') || raw.endsWith('.JSON')) {
+      let parsed;
+      try { parsed = JSON.parse(content); } catch { /* not valid JSON */ }
+      if (parsed && typeof parsed === 'object' && (parsed.nodes || parsed['1'] || parsed['0'])) {
+        return {
+          kind:  'comfyui_workflow',
+          label: `ComfyUI workflow: ${raw}`,
+          body:  { workflow_json: content },
+        };
+      }
+    }
+    return {
+      kind:  'log_file',
+      label: `Log / error file: ${raw}`,
+      body:  { text: content.slice(0, 50_000) },
+    };
+  }
+
+  if (classified.kind === 'docker_image') {
+    return { kind: 'docker_image', label: `Docker image: ${raw}`, body: classified.body };
+  }
+
+  return { kind: 'text', label: 'Text / conversation', body: classified.body };
+}
+
+function _printResult(result, chalk) {
+  const { extraction: e, static_incompatibilities, multi_gpu_detected, large_download, github_issue, detected_github_url } = result;
+
+  if (github_issue) {
+    console.log(`  ${chalk.bold('Issue:')}   ${github_issue.title}  ${chalk.dim(`[${github_issue.state}]`)}`);
+  }
+
+  // The conversation stays primary — a GitHub URL found inside pasted text
+  // is only ever offered here, never fetched automatically.
+  if (detected_github_url) {
+    console.log();
+    console.log(`  ${chalk.bold('Additional context found:')} ${detected_github_url}`);
+    console.log(`    ${chalk.dim(`Include it: badgr diagnose "<input>" --github ${detected_github_url}`)}`);
+  }
+
+  const wt = e.workload_type && e.workload_type !== 'unknown' ? e.workload_type : null;
+  const conf = e.confidence ? ` ${chalk.dim(`(${Math.round(e.confidence * 100)}% confidence)`)}` : '';
+  if (wt) console.log(`  ${chalk.bold('Workload:')} ${wt}${conf}`);
+  if (e.summary) console.log(`  ${chalk.bold('Summary:')} ${e.summary}`);
+  console.log();
+
+  if (e.docker_images?.length) {
+    console.log(`  ${chalk.bold('Image:')}   ${e.docker_images[0]}${e.docker_images.length > 1 ? chalk.dim(` +${e.docker_images.length - 1} more`) : ''}`);
+  }
+  if (e.models?.length) {
+    console.log(`  ${chalk.bold('Model:')}   ${e.models[0]}${e.models.length > 1 ? chalk.dim(` +${e.models.length - 1} more`) : ''}`);
+  }
+  if (e.commands?.length) {
+    console.log(`  ${chalk.bold('Command:')} ${e.commands[0]}`);
+  }
+  if (e.errors?.length) {
+    console.log(`  ${chalk.bold('Errors:')}`);
+    for (const err of e.errors.slice(0, 3)) console.log(`    ${chalk.red('✗')} ${err}`);
+  }
+
+  if (static_incompatibilities?.length) {
+    console.log();
+    console.log(`  ${chalk.bold('Diagnosis:')} ${chalk.yellow('Static incompatibility — no GPU needed')}`);
+    for (const inc of static_incompatibilities) console.log(`    ${chalk.yellow('!')} ${inc}`);
+  } else if (e.missing_information?.length) {
+    console.log();
+    console.log(`  ${chalk.bold('Diagnosis:')} Missing information`);
+    for (const m of e.missing_information) console.log(`    ${chalk.dim('?')} ${m}`);
+  } else if (wt) {
+    console.log();
+    console.log(`  ${chalk.bold('Diagnosis:')} Workload detected — ready for capped test`);
+  }
+
+  if (multi_gpu_detected) {
+    console.log(`  ${chalk.yellow('!')} Multi-GPU detected: ${multi_gpu_detected}`);
+    console.log(`    ${chalk.dim('Capped test will use a single GPU only.')}`);
+  }
+  if (large_download) {
+    console.log(`  ${chalk.yellow('!')} Large model download: ~${large_download.estimated_gb} GB`);
+    console.log(`    ${chalk.dim('Funding approval required before test launches.')}`);
+  }
+  if (result.secret_types_detected?.length) {
+    console.log(`  ${chalk.dim(`Secrets redacted before analysis: ${result.secret_types_detected.join(', ')}`)}`);
+  }
+  if (!result.ai_available) {
+    console.log(`  ${chalk.dim('(AI extraction unavailable — pattern matching only)')}`);
+  }
+
+  console.log();
+  if (static_incompatibilities?.length) {
+    console.log(`  ${chalk.bold('Recommended action:')} Fix the incompatibility listed above — no GPU test needed`);
+  } else if (e.missing_information?.length) {
+    console.log(`  ${chalk.bold('Recommended action:')} Provide the missing details above, then re-run`);
+  } else {
+    console.log(`  ${chalk.bold('Recommended action:')} Run ${chalk.cyan('badgr diagnose "<input>" --approve')} to launch a capped test`);
+  }
+}
+
+// Local-machine file paths (e.g. a pasted .gguf path) can only be checked
+// client-side -- the backend never sees this machine's filesystem, so it
+// must not (and does not) claim to validate them. Only paths that look like
+// a real filesystem reference (absolute, `./`, `../`, or `~/`) are checked;
+// bare words, URLs, and Docker image references are left alone.
+//
+// Path checks must respect context (locked Free Command Check spec, problem
+// #3): a repo path is checked against the repo tree, a container path
+// against Dockerfile/image evidence -- both server-side, inside
+// `mechanical_checks` -- and only a genuinely local path belongs to this
+// machine. Once a repository or Docker image is in evidence for this
+// workload, an absolute path *inside the resolved command* (e.g. "python3
+// /src/main.py") is a repo/container path, not a claim about this laptop,
+// so it must never be re-checked against the local filesystem here -- doing
+// so is exactly the "/src/main.py NOT FOUND on this machine" false failure
+// the spec calls out. `model_artifact` is different: it is always this
+// machine's own claim about a locally-downloaded checkpoint, never repo or
+// container evidence, so it stays checked regardless.
+function _localPathCandidates(e) {
+  const candidates = new Set();
+  const hasRepoOrContainerContext = Boolean(
+    e.repositories?.length || e.docker_images?.length || e.dockerfile
+  );
+  const maybeAdd = (value) => {
+    if (typeof value !== 'string') return;
+    const s = value.trim().replace(/^['"]|['"]$/g, '');
+    if (!s || /^https?:\/\//i.test(s)) return;
+    if (s.startsWith('/') || s.startsWith('./') || s.startsWith('../') || s.startsWith('~/')) {
+      candidates.add(s);
+    }
+  };
+  maybeAdd(e.model_artifact);
+  if (!hasRepoOrContainerContext) {
+    for (const tok of (e.commands?.[0] || '').split(/\s+/)) maybeAdd(tok);
+  }
+  return [...candidates];
+}
+
+// Locked status ladder (product-level labels, not the backend's internal
+// proof_level enum): NEEDS INFO / READY / SMOKE CHECKED / INVALID / VERIFIED.
+// Pure presentation over data /run-issue/extract already returns -- no new
+// endpoint, no new GPU behaviour. --smoke can reach SMOKE CHECKED or INVALID
+// (never VERIFIED, see AGENTS.md §12 and _printCopySummary below).
+//
+// The evidence-only judgment (needs_info/invalid/smoke_checked) is computed
+// once, server-side, in `_compute_smoke_status` (backend/run_issue_routes.py)
+// and read here via `e.smoke_status` -- this and /run-issue's `smokeStatus()`
+// (frontend/app/run-issue/page.tsx) both just render that one backend
+// verdict rather than each re-deriving pass/fail from mechanical_checks, so
+// the CLI and the web page can never disagree on what a given result means.
+// A `smoke_status` fallback derivation is kept only for a backend response
+// that predates this field (defensive, not the normal path).
+//
+// READY means "no smoke run" -- a command that's merely complete is never
+// itself proof of validity, so mechanical/local-file results only ever
+// change the printed word when --smoke actually ran them (locked spec
+// problem #6: a real FAIL must demote SMOKE CHECKED to INVALID; SKIPPED
+// checks never do). This part stays CLI-side: it depends on the --smoke
+// flag and this machine's own filesystem, neither of which the backend can
+// see.
+function _statusWord(result, smokeRequested) {
+  const e = result.extraction || {};
+  if (result.static_incompatibilities?.length || e.missing_information?.length) return 'NEEDS INFO';
+  if (!smokeRequested) return 'READY';
+  const backendStatus = e.smoke_status
+    || ((e.mechanical_checks || []).some((check) => check.status === 'fail') ? 'invalid' : 'smoke_checked');
+  const localFail = _localPathCandidates(e).some((p) => !fs.existsSync(p));
+  if (backendStatus === 'invalid' || localFail) return 'INVALID';
+  return backendStatus === 'ready' ? 'READY' : 'SMOKE CHECKED';
+}
+
+const _CHECK_LABELS = {
+  command_syntax:    'command syntax',
+  cli_entrypoint:    'CLI entrypoint',
+  referenced_files:  'referenced repo files',
+  docker_entrypoint: 'Docker metadata',
+  required_env_vars: 'required env vars',
+};
+
+// Compact, copy-pasteable result -- the literal STATUS word plus just enough
+// to forward to someone else. Additive to the detailed report above it;
+// does not replace it. Never prints "Verified" -- SMOKE CHECKED is the
+// ceiling for this free path.
+function _printCopySummary(result, flags, chalk, caseData) {
+  const e = result.extraction || {};
+  const status = _statusWord(result, flags.smoke);
+
+  console.log(`  ${chalk.bold(`STATUS: ${status}`)}`);
+  console.log();
+
+  if (status === 'NEEDS INFO') {
+    // Static incompatibilities and missing-information both mean "no
+    // command yet" -- whichever fired is the reason to surface here.
+    const reasons = result.static_incompatibilities?.length
+      ? result.static_incompatibilities
+      : (e.missing_information || []);
+    console.log(`  ${chalk.bold('Missing:')}`);
+    for (const r of reasons) console.log(`  - ${r}`);
+    console.log();
+    return;
+  }
+
+  // The prepared case's canonical `badgr ...` command (the exact line
+  // --approve would run) is preferred over the raw source command --
+  // /confirm can only compute it once a case exists (READY/SMOKE CHECKED),
+  // and only when there's enough evidence to convert (see
+  // _canonical_badgr_command's docstring, backend/run_issue_routes.py, for
+  // what it can't yet convert, e.g. training/ComfyUI). Falls back to the
+  // raw extracted command otherwise -- still true and still runnable input,
+  // just not guaranteed to already be `badgr`-shaped.
+  const badgrJob = caseData?.findings?.canonical_command || e.commands?.[0] || '(no command produced)';
+  console.log(`  ${chalk.bold('Badgr job:')}`);
+  console.log(`  ${badgrJob}`);
+  console.log();
+
+  if (caseData?.case_id) {
+    console.log(`  ${chalk.bold('Run:')}`);
+    console.log(`  ${chalk.cyan(_runPageUrl(caseData.case_id))}`);
+    console.log();
+  }
+
+  if (status === 'SMOKE CHECKED' || status === 'INVALID') {
+    console.log(`  ${chalk.bold('Checks:')}`);
+    const iconFor = (s) => (s === 'pass' ? '✓' : s === 'fail' ? '✗' : '-');
+    for (const check of (e.mechanical_checks || [])) {
+      console.log(`  ${iconFor(check.status)} ${_CHECK_LABELS[check.name] || check.name}`);
+    }
+    const localPaths = _localPathCandidates(e);
+    if (!localPaths.length) {
+      console.log('  - local file check skipped');
+    } else {
+      const allExist = localPaths.every((p) => fs.existsSync(p));
+      console.log(`  ${allExist ? '✓' : '✗'} local file check${allExist ? '' : ' (not found)'}`);
+    }
+    console.log();
+    if (status === 'INVALID') {
+      console.log('  A check above actually failed -- this command is not runnable as-is.');
+    } else {
+      console.log('  Not GPU-verified.');
+    }
+    console.log();
+  }
+}
+
+// --smoke's mechanical checks: prints the backend's evidence-backed
+// pass/fail/skip results (`extraction.mechanical_checks`, computed for
+// free from data already gathered by /run-issue/extract -- no extra
+// network call), plus this machine's own local-file existence check.
+// Deliberately never prints "Verified" -- see AGENTS.md §12; a genuinely
+// passing smoke check still only earns "Smoke Checked".
+function _printSmokeChecks(result, chalk) {
+  const e = result.extraction || {};
+  const mech = e.mechanical_checks || [];
+  const localPaths = _localPathCandidates(e);
+
+  console.log();
+  console.log(`  ${chalk.bold('Smoke Checked (free, no GPU, no login):')}`);
+
+  const icon = (status) => (
+    status === 'pass' ? chalk.green('✓') : status === 'fail' ? chalk.red('✗') : chalk.dim('-')
+  );
+  for (const check of mech) {
+    console.log(`    ${icon(check.status)} ${chalk.dim(`[${check.name}]`)} ${check.detail}`);
+  }
+  for (const p of localPaths) {
+    const exists = fs.existsSync(p);
+    console.log(`    ${exists ? chalk.green('✓') : chalk.red('✗')} ${chalk.dim('[local_file]')} ${p} ${exists ? 'exists on this machine' : 'NOT FOUND on this machine'}`);
+  }
+  if (!mech.length && !localPaths.length) {
+    console.log(`    ${chalk.dim('No mechanical checks applicable to this input.')}`);
+  }
+
+  const proofLevel = e.smoke_check?.proof_level;
+  if (proofLevel === 'smoke_checked') {
+    console.log(`    ${chalk.green('✓')} ${chalk.dim('[command_scope]')} Command is the repository/image/service's own documented default.`);
+  }
+  console.log();
+}
+
+function _confirmBodyFromExtraction(e) {
+  return {
+    workload_type:              e.workload_type || 'generic',
+    docker_image:               e.docker_images?.[0] || null,
+    model_id:                   e.models?.[0] || null,
+    launch_command:             e.commands?.[0] || null,
+    error_log:                  null,
+    expected_result:            e.expected_result || null,
+    environment_variable_names: e.environment_variable_names || [],
+    gpu_requirements:           Array.isArray(e.gpu_requirements)
+                                  ? e.gpu_requirements.join(', ')
+                                  : e.gpu_requirements || null,
+    source_summary:             e.summary || null,
+  };
+}
+
+function _runPageUrl(caseId) {
+  return `https://aibadgr.com/run-issue?case_id=${caseId}`;
+}
+
+// Creates the free, anonymous "prepared run" case that backs a shareable
+// Run Link -- the exact same /run-issue/confirm call and case object
+// /run-issue's own confirm step creates, so the CLI and the web page never
+// diverge on what a given diagnosis resolves to. No GPU, no login, no
+// payment -- confirm only ever inspects and plans (see its own docstring).
+// Called once per diagnosis (main flow), then reused by --approve below
+// instead of confirming a second time.
+//
+// Returns `{ caseData }` on success, `{ error }` on a network/API failure --
+// never throws, since a plain diagnosis must still succeed even if the
+// free run-page creation itself fails.
+async function _createRunPage(config, e, chalk) {
+  try {
+    const caseData = await callApi('/run-issue/confirm', {
+      method:    'POST',
+      apiKey:    config.apiKey || '',
+      baseUrl:   config.baseUrl,
+      body:      _confirmBodyFromExtraction(e),
+      timeoutMs: 20_000,
+    });
+    return caseData?.case_id ? { caseData } : { caseData: null };
+  } catch (err) {
+    return { error: err };
+  }
+}
+
+async function _doApprove(config, caseData, chalk) {
+  const { case_id: caseId, status, test_plan: plan, missing_information: missing } = caseData;
+
+  if (status === 'incompatible') {
+    console.log(chalk.yellow('\n  Static incompatibility — no GPU test needed.'));
+    console.log();
+    return;
+  }
+  if (status === 'missing_information') {
+    console.log(chalk.yellow('\n  Cannot approve — missing information:'));
+    for (const m of (missing || [])) console.log(`    ? ${m}`);
+    console.log();
+    return;
+  }
+  if (status === 'template_matched') {
+    console.log(chalk.green('\n  Matched a verified template — no new GPU test needed.'));
+    if (plan?.final_command) {
+      console.log();
+      console.log(`  ${chalk.bold('Verified command:')}`);
+      console.log(`  ${chalk.cyan(plan.final_command)}`);
+    }
+    console.log();
+    return;
+  }
+
+  if (plan) {
+    console.log();
+    if (plan.gpu_type)        console.log(`  ${chalk.bold('GPU:')}          ${plan.gpu_type}`);
+    if (plan.estimated_cost)  console.log(`  ${chalk.bold('Maximum cost:')} $${Number(plan.estimated_cost).toFixed(2)}`);
+    if (plan.max_runtime_min) console.log(`  ${chalk.bold('Max runtime:')}  ${plan.max_runtime_min} min`);
+    if (plan.requires_reduced_test)       console.log(`  ${chalk.yellow('!')} Multi-GPU detected — test uses a single GPU`);
+    if (plan.requires_funding_approval)   console.log(`  ${chalk.yellow('!')} Large download — funding required`);
+  }
+
+  await _approveAndRun(config, caseId, plan, chalk);
+}
+
+// Claim → approve → run for a case that already exists (just created via
+// /confirm above, or resumed via an existing_case input). Auth is required
+// from here on — diagnosis and case creation stay anonymous and free, but a
+// real GPU test needs a signed-in account. The CLI never grants a free-run
+// entitlement (web admin only, see grant_free_run in run_issue_routes.py);
+// it only redeems one a case already carries, same as normal billing.
+async function _approveAndRun(config, caseId, plan, chalk) {
+  const printResumeHint = () =>
+    console.error(chalk.dim(`  Resume this case: https://aibadgr.com/run-issue?case_id=${caseId}\n`));
+
+  let authConfig = config;
+  if (!authConfig.apiKey) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+      console.error(chalk.red('\n  ✗ Sign in required to approve a GPU test. Run: badgr login\n'));
+      printResumeHint();
+      process.exitCode = 1;
+      return;
+    }
+    console.log(chalk.yellow('\n  Sign in to continue. Opening browser...'));
+    try {
+      authConfig = await ensureLoggedIn(authConfig, chalk);
+    } catch (err) {
+      console.error(chalk.red(`\n  ✗ Sign-in failed: ${err.message}\n`));
+      printResumeHint();
+      process.exitCode = 1;
+      return;
+    }
+  }
+
+  try {
+    await callApi(`/run-issue/cases/${caseId}/claim`, {
+      method: 'POST', apiKey: authConfig.apiKey, baseUrl: authConfig.baseUrl, timeoutMs: 10_000,
+    });
+  } catch { /* already claimed — continue */ }
+
+  let approved;
+  try {
+    approved = await callApi(`/run-issue/cases/${caseId}/approve`, {
+      method:    'POST',
+      apiKey:    authConfig.apiKey,
+      baseUrl:   authConfig.baseUrl,
+      body: {
+        confirmed:               true,
+        funding_approved:        Boolean(plan?.requires_funding_approval),
+        reduced_test_confirmed:  Boolean(plan?.requires_reduced_test),
+      },
+      timeoutMs: 15_000,
+    });
+  } catch (err) {
+    if (err.httpStatus === 402 || err.message?.includes('402')) {
+      console.error(chalk.yellow('\n  ✗ Insufficient credits. Run: badgr billing\n'));
+    } else {
+      console.error(chalk.red(`\n  ✗ Approve failed: ${err.message}\n`));
+    }
+    process.exitCode = 1;
+    return;
+  }
+
+  console.log(chalk.dim('\n  Launching capped smoke test...'));
+  let ran;
+  try {
+    ran = await callApi(`/run-issue/cases/${caseId}/run`, {
+      method: 'POST', apiKey: authConfig.apiKey, baseUrl: authConfig.baseUrl, timeoutMs: 30_000,
+    });
+  } catch (err) {
+    console.error(chalk.red(`\n  ✗ Launch failed: ${err.message}\n`));
+    process.exitCode = 1;
+    return;
+  }
+
+  console.log();
+  console.log(chalk.green('  Smoke test launched.'));
+  console.log(`  ${chalk.bold('Case:')}     ${caseId}`);
+  if (ran?.job_id)      console.log(`  ${chalk.bold('Job:')}      ${ran.job_id}`);
+  if (ran?.free_run_used) console.log(`  ${chalk.bold('Billing:')}  Free run — no charge`);
+  console.log(`  ${chalk.bold('Evidence:')} https://aibadgr.com/repro/${caseId}`);
+  console.log();
+}
+
+// Resume an existing case (bare case_id or a shared /repro or /run-issue
+// link) instead of diagnosing new input. No /confirm — the case already
+// exists; this only reads its current state and, with --approve, redeems
+// whatever entitlement/billing state it already carries.
+async function _diagnoseExistingCase(config, caseId, flags, chalk) {
+  let caseData;
+  try {
+    caseData = await callApi(`/run-issue/cases/${caseId}`, {
+      apiKey: config.apiKey || '', baseUrl: config.baseUrl, timeoutMs: 15_000,
+    });
+  } catch (err) {
+    console.error(chalk.red(`\n  ✗ Could not load case ${caseId}: ${err.message}\n`));
+    process.exitCode = 1;
+    return;
+  }
+
+  if (flags.json) {
+    console.log(JSON.stringify(caseData, null, 2));
+    if (flags.approve) await _approveAndRun(config, caseId, caseData.test_plan, chalk);
+    return;
+  }
+
+  console.log();
+  console.log(`  ${chalk.bold('Case:')}      ${caseId}`);
+  console.log(`  ${chalk.bold('Status:')}    ${caseData.status}`);
+  if (caseData.workload_type) console.log(`  ${chalk.bold('Workload:')}  ${caseData.workload_type}`);
+  if (caseData.known_command) console.log(`  ${chalk.bold('Command:')}   ${caseData.known_command}`);
+  if ((caseData.missing_information || []).length) {
+    console.log();
+    console.log(`  ${chalk.bold('Missing information:')}`);
+    for (const m of caseData.missing_information) console.log(`    ? ${m}`);
+  }
+
+  // "Verified" is only ever earned here -- a case whose real GPU run
+  // actually completed (`lead_summary.status`, computed server-side by
+  // `_build_lead_summary` from `ReproCase.status`/`final_command`). Never
+  // reachable from --smoke, which never provisions anything.
+  console.log();
+  const existingStatus = caseData.lead_summary?.status === 'verified'
+    || caseData.status === 'verified' || caseData.status === 'completed'
+    ? 'VERIFIED'
+    : (caseData.missing_information || []).length ? 'NEEDS INFO' : 'READY';
+  console.log(`  ${chalk.bold(`STATUS: ${existingStatus}`)}`);
+  if (existingStatus === 'VERIFIED') {
+    console.log();
+    console.log(`  ${chalk.bold('Command:')}`);
+    console.log(`  ${caseData.final_command || caseData.known_command}`);
+    console.log();
+    console.log(`  ${chalk.bold('Result:')}`);
+    const resultLines = caseData.lead_summary?.test_checklist?.length
+      ? caseData.lead_summary.test_checklist
+      : ['Verified'];
+    for (const line of resultLines) console.log(`  - ${line}`);
+    if (caseData.actual_cost_aud != null) {
+      console.log(`  Verified on Badgr for AUD $${Number(caseData.actual_cost_aud).toFixed(2)}. GPU torn down after the test.`);
+    }
+  }
+
+  console.log();
+  if (caseData.free_verification_consumed) {
+    console.log(`  ${chalk.dim('This case\'s free run has already been used — further verification is normal billing.')}`);
+  } else if (caseData.free_verification_available) {
+    console.log(`  ${chalk.green(`1 free verification job available — up to $${(caseData.free_verification_max_cost_usd ?? 5).toFixed(0)}`)}`);
+  } else if (caseData.test_plan) {
+    console.log(`  ${chalk.dim(`Verification available — max $${Number(caseData.test_plan.max_cost_usd ?? 0).toFixed(2)}`)}`);
+  }
+  console.log();
+
+  if (flags.approve) {
+    await _approveAndRun(config, caseId, caseData.test_plan, chalk);
+  } else {
+    console.log(`  ${chalk.bold('Resume:')} badgr diagnose ${caseId} --approve`);
+    console.log();
+  }
+}
+
+export async function diagnoseCommand(config, args, chalk) {
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(DIAGNOSE_HELP);
+    return;
+  }
+
+  const flags = {};
+  let positional = null;
+  let i = 0;
+  while (i < args.length) {
+    const a = args[i];
+    if (a === '--docker')   { flags.docker  = args[++i]; i++; continue; }
+    if (a === '--repo')     { flags.repo    = args[++i]; i++; continue; }
+    if (a === '--comfyui')  { flags.comfyui = args[++i]; i++; continue; }
+    if (a === '--github')   { flags.github  = args[++i]; i++; continue; }
+    if (a === '--approve')  { flags.approve = true;  i++; continue; }
+    if (a === '--smoke')    { flags.smoke   = true;  i++; continue; }
+    if (a === '--json')     { flags.json    = true;  i++; continue; }
+    if (!a.startsWith('-') && positional === null) positional = a;
+    i++;
+  }
+
+  if (!positional && !flags.docker && !flags.repo && !flags.comfyui) {
+    console.log(DIAGNOSE_HELP);
+    return;
+  }
+
+  let detected;
+  try {
+    detected = detectInput(positional, flags);
+  } catch (err) {
+    console.error(chalk.red(`\n  ✗ ${err.message}\n`));
+    process.exitCode = 1;
+    return;
+  }
+
+  if (!detected) {
+    console.log(DIAGNOSE_HELP);
+    return;
+  }
+
+  if (detected.kind === 'existing_case') {
+    await _diagnoseExistingCase(config, detected.caseId, flags, chalk);
+    return;
+  }
+
+  // --github opts into fetching a GitHub issue URL found inside pasted text
+  // (see the "Additional context found" notice) — never fetched by default.
+  if (flags.github) detected.body.github_url = flags.github;
+
+  if (!flags.json) {
+    console.log();
+    console.log(`  ${chalk.bold('Detected:')} ${detected.label}`);
+    console.log(chalk.dim('  Analysing...'));
+  }
+
+  let result;
+  try {
+    result = await callApi('/run-issue/extract', {
+      method:    'POST',
+      apiKey:    config.apiKey || '',
+      baseUrl:   config.baseUrl,
+      body:      detected.body,
+      timeoutMs: 120_000,
+    });
+  } catch (err) {
+    console.error(chalk.red(`\n  ✗ ${err.message}\n`));
+    process.exitCode = 1;
+    return;
+  }
+
+  const status = _statusWord(result, flags.smoke);
+
+  // A command that's actually runnable also gets a free prepared Run
+  // page -- the same case /run-issue's own confirm step would create --
+  // so diagnosis ends at a page someone can click Run on, not just a
+  // printed command. Only READY and SMOKE CHECKED qualify: NEEDS INFO has
+  // nothing runnable to save yet, and INVALID is a command a real check
+  // just proved broken -- turning that into a clickable "Run" page would
+  // contradict the label. Both print their own guidance instead (Missing:
+  // / the failed check) and stop there.
+  let caseData = null;
+  let caseError = null;
+  if (status === 'READY' || status === 'SMOKE CHECKED') {
+    const created = await _createRunPage(config, result.extraction || {}, chalk);
+    if (created.error) caseError = created.error;
+    else caseData = created.caseData;
+  }
+
+  if (flags.json) {
+    const output = { detected: detected.kind, ...result, status };
+    if (flags.smoke) {
+      const e = result.extraction || {};
+      output.smoke = {
+        mechanical_checks: e.mechanical_checks || [],
+        local_file_checks: _localPathCandidates(e).map(p => ({ path: p, exists: fs.existsSync(p) })),
+      };
+    }
+    if (caseData?.case_id) {
+      output.run = {
+        case_id: caseData.case_id,
+        url: _runPageUrl(caseData.case_id),
+        canonical_command: caseData.findings?.canonical_command || null,
+      };
+    }
+    console.log(JSON.stringify(output, null, 2));
+
+    // --json must not silently skip --approve -- the JSON branch used to
+    // return here unconditionally, so a scripted `--approve --json` call
+    // never claimed/approved/launched anything (bug: approval was silently
+    // dropped in the one output mode automation actually uses). Approval
+    // output itself stays human-readable (chalk console lines), matching
+    // _diagnoseExistingCase's existing --json + --approve behaviour below.
+    if (flags.approve) {
+      if (caseError) {
+        console.error(chalk.red(`\n  ✗ Could not create case: ${caseError.message}\n`));
+        process.exitCode = 1;
+        return;
+      }
+      if (!caseData) {
+        console.error(chalk.yellow('\n  Cannot approve — missing information above.\n'));
+        return;
+      }
+      await _doApprove(config, caseData, chalk);
+    }
+    return;
+  }
+
+  console.log();
+  _printResult(result, chalk);
+
+  if (flags.smoke) {
+    _printSmokeChecks(result, chalk);
+  }
+
+  console.log();
+  _printCopySummary(result, flags, chalk, caseData);
+
+  console.log(chalk.dim('  Free diagnosis. No GPU was provisioned.'));
+  console.log(chalk.dim('  Full interactive flow: https://aibadgr.com/run-issue'));
+  console.log();
+
+  if (flags.approve) {
+    if (caseError) {
+      console.error(chalk.red(`\n  ✗ Could not create case: ${caseError.message}\n`));
+      process.exitCode = 1;
+      return;
+    }
+    if (!caseData) {
+      console.log(chalk.yellow('\n  Cannot approve — missing information above.\n'));
+      return;
+    }
+    await _doApprove(config, caseData, chalk);
+  }
+}