baychat 0.13.0 → 0.14.0

package/dist/doctor-command.js

@@ -0,0 +1,154 @@
+"use strict";
+// `baychat doctor` — the I/O half of the diagnosis.
+//
+// `doctor.ts` decides what is wrong from a description of a machine. This file
+// builds that description from the real one and prints the result. The split is
+// the reason the whole report is testable against fixtures, including machines
+// nobody here owns — a Mac, a Windows box, a beta user's laptop with a broken
+// Codex install.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.currentDoctorEnv = currentDoctorEnv;
+exports.cmdDoctor = cmdDoctor;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const config_1 = require("./config");
+const doctor_1 = require("./doctor");
+const commands_1 = require("./relay/commands");
+const credential_refresh_1 = require("./credential-refresh");
+const client_paths_1 = require("./client-paths");
+const runtime_binary_1 = require("./runtime-binary");
+/** How long `claude mcp list` may take before we treat it as unanswerable. */
+const MCP_LIST_TIMEOUT_MS = 15_000;
+/**
+ * An environment variable naming a runtime's executable explicitly, for the
+ * machine where resolution genuinely cannot work it out.
+ *
+ * Documented in the `binary` check's remedy, so a user who hits an unresolvable
+ * runtime is told the escape hatch at the moment they need it.
+ */
+function overrideFor(command) {
+    return process.env[`BAYCHAT_${command.toUpperCase()}_BIN`];
+}
+/** Where Codex is, so a snap install's own config location is checked too. */
+function codexPath() {
+    const resolved = (0, runtime_binary_1.resolveRuntimeBinary)("codex", (0, runtime_binary_1.currentBinaryEnv)(overrideFor("codex")));
+    return resolved.ok ? resolved.path : undefined;
+}
+async function currentDoctorEnv() {
+    return {
+        home: os.homedir(),
+        platform: process.platform,
+        now: Date.now(),
+        device: (0, config_1.loadDeviceCredentials)(),
+        relay: await (0, commands_1.tryRelayStatus)(),
+        readText(filePath) {
+            try {
+                return fs.readFileSync(filePath, "utf8");
+            }
+            catch {
+                // Missing, unreadable, or a directory — all mean "nothing to inspect".
+                // The checks turn that into a finding; there is nothing to log here.
+                return null;
+            }
+        },
+        staleConfigs(token) {
+            // Uses the same reader the refresh does, so "doctor says stale" and
+            // "login fixed it" can never disagree about which files count.
+            return (0, credential_refresh_1.staleClientConfigs)(token, {
+                readFile: (filePath) => {
+                    try {
+                        return fs.readFileSync(filePath, "utf8");
+                    }
+                    catch {
+                        // Absent or unreadable: nothing to compare, so nothing to report.
+                        return null;
+                    }
+                },
+                writeFile: () => undefined,
+                copyFile: () => undefined,
+                mkdirp: () => undefined,
+            }, (0, client_paths_1.currentPathEnv)());
+        },
+        resolveBinary(command) {
+            return (0, runtime_binary_1.resolveRuntimeBinary)(command, (0, runtime_binary_1.currentBinaryEnv)(overrideFor(command)));
+        },
+        mcpList(runtime) {
+            // Ask the runtime itself. Its own answer is correct wherever its config
+            // turns out to live — which, for a snap install, is not where we wrote.
+            const resolved = (0, runtime_binary_1.resolveRuntimeBinary)(runtime, (0, runtime_binary_1.currentBinaryEnv)(overrideFor(runtime)));
+            if (!resolved.ok)
+                return null;
+            // Same .cmd rule as the probe: an npm-installed CLI on Windows is a shim
+            // that cannot be spawned without a shell, and this call would otherwise
+            // throw EINVAL and be reported as "could not run `codex mcp list`".
+            const plan = (0, runtime_binary_1.spawnPlanFor)(resolved.path, process.platform);
+            try {
+                return (0, child_process_1.execFileSync)(plan.file, [...plan.prefixArgs, "mcp", "list"], {
+                    encoding: "utf8",
+                    timeout: MCP_LIST_TIMEOUT_MS,
+                    stdio: ["ignore", "pipe", "pipe"],
+                });
+            }
+            catch (err) {
+                // A non-zero exit can still carry the listing on stdout, so it is worth
+                // reading before giving up. Only a genuinely empty result becomes
+                // "could not run", which the check reports as unknown rather than as
+                // "not registered".
+                const stdout = err.stdout;
+                return stdout && stdout.trim() !== "" ? stdout : null;
+            }
+        },
+    };
+}
+/**
+ * `baychat doctor [--json]`
+ *
+ * Exit codes match `relay status`: 0 clear, 1 something is broken, 2 there is
+ * mail nobody read.
+ */
+async function cmdDoctor(argv) {
+    const report = (0, doctor_1.buildReport)(await currentDoctorEnv());
+    if (argv.includes("--json")) {
+        // The whole report as data, so a beta user can paste one blob into a
+        // support thread and it can be read without a round of questions.
+        console.log(JSON.stringify(report, null, 2));
+        return (0, doctor_1.exitCodeFor)(report);
+    }
+    for (const line of (0, doctor_1.renderReport)(report))
+        console.log(line);
+    return (0, doctor_1.exitCodeFor)(report);
+}

package/dist/doctor.js

@@ -0,0 +1,502 @@
+"use strict";
+// One command that says which link in the chain is broken, and what to type.
+//
+// WHY THIS EXISTS. Connecting an agent has four independent parts — a device
+// credential, a running relay, a runtime that has BayChat's MCP server AND its
+// skill, and a session registered with the relay — and until now nothing
+// reported on any of them together. On 2026-08-30 three of those were broken at
+// once on a developer machine, each silently, and finding out took an hour of
+// reading code. A beta user on a machine we will never touch has no such hour
+// and no such code.
+//
+// So every check here answers two questions and no others: what did we observe,
+// and what do I type. A check that cannot say the second is not worth printing.
+//
+// THREE RULES THIS FILE HOLDS.
+//
+//   1. NEVER PRINT A CREDENTIAL. The whole point of the output is that it gets
+//      pasted into a support thread. Names and expiry dates, never tokens.
+//   2. SKIP IS NOT FAIL. Claude Desktop has no CLI binary; a stopped relay knows
+//      nothing about sessions. Reporting those as failures sends people hunting
+//      for things that do not exist, which is worse than staying quiet.
+//   3. OBSERVE, DO NOT ACT. Nothing here writes, installs, or starts anything.
+//      A diagnostic that repairs things cannot be trusted to describe them.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildReport = buildReport;
+exports.mailboxCheck = mailboxCheck;
+exports.exitCodeFor = exitCodeFor;
+exports.renderReport = renderReport;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const mailbox_1 = require("./relay/mailbox");
+const parent_watch_1 = require("./relay/parent-watch");
+const client_paths_1 = require("./client-paths");
+const runtime_binary_1 = require("./runtime-binary");
+const runtimes_1 = require("./runtimes");
+/**
+ * The runtimes worth reporting on.
+ *
+ * Deliberately not every entry in `RUNTIME_SPECS`: Pi, Hermes and `generic`
+ * leave no detectable footprint on this machine, so every check for them would
+ * be a `skip` and the report would be mostly noise about software the user
+ * probably does not run.
+ */
+const REPORTED = ["claude", "codex", "cursor", "desktop"];
+/** Runtimes that ARE a local command, and so can have a binary at all. */
+const HAS_BINARY = { claude: "claude", codex: "codex" };
+/**
+ * The command that sets each runtime up.
+ *
+ * NOT `baychat connect <runtime>` for all of them: `connect` accepts only
+ * codex, cursor and desktop, so a remedy of "baychat connect claude" is a line
+ * telling the user to run something that errors. Claude Code is set up by
+ * `baychat login`, which registers its MCP server and installs its skill.
+ *
+ * A remedy that does not work is worse than no remedy, because the user spends
+ * their trust on it before finding out.
+ */
+const SETUP_COMMAND = {
+    claude: "baychat login",
+    codex: "baychat connect codex",
+    cursor: "baychat connect cursor",
+    desktop: "baychat connect desktop",
+};
+function setupCommand(runtime) {
+    return SETUP_COMMAND[runtime] ?? `baychat connect ${runtime}`;
+}
+/** How close to expiry a device credential is worth warning about. */
+const EXPIRY_WARNING_MS = 3 * 86_400_000;
+function buildReport(env) {
+    return {
+        credentials: credentialsCheck(env),
+        relay: relayCheck(env),
+        mailbox: mailboxCheck(),
+        staleCredentials: staleCredentialCheck(env),
+        runtimes: REPORTED.map((runtime) => runtimeReport(runtime, env)),
+        pending: pendingCheck(env),
+    };
+}
+/**
+ * Is every mailbox registration one the relay can actually act on?
+ *
+ * This check exists because both sides of the mailbox transport fail silently.
+ * The agent blocks on its FIFO and sees a perfectly healthy wait; the daemon
+ * never learns the session exists. Nothing is logged, nothing errors, and the
+ * agent is simply unreachable — the shape of the 2026-08-30 evening, in a new
+ * place. Neither side can detect it, so this is the only place that can.
+ *
+ * Takes no `DoctorEnv`: the mailbox root is resolved from the environment the
+ * same way the agent and daemon resolve it, and reading it is the check.
+ *
+ * `skip` when no mailbox exists. Most machines will never use this rung, and a
+ * check that fails for everyone who does not need it is noise.
+ */
+function mailboxCheck() {
+    const live = [];
+    const problems = [];
+    // Every candidate root: an agent may have fallen back past the one this
+    // process would pick, and a mailbox we never look in is invisible.
+    const dirs = (0, mailbox_1.mailboxRootCandidates)().flatMap((root) => {
+        try {
+            return fs
+                .readdirSync(root, { withFileTypes: true })
+                .filter((e) => e.isDirectory())
+                .map((e) => path.join(root, e.name));
+        }
+        catch {
+            return [];
+        }
+    });
+    for (const dir of dirs) {
+        try {
+            fs.accessSync(dir, fs.constants.R_OK | fs.constants.X_OK);
+        }
+        catch {
+            problems.push(`the relay cannot read ${dir} — that session armed somewhere this relay has no access to`);
+            continue;
+        }
+        const reg = (0, mailbox_1.readRegistration)(dir);
+        if (!reg) {
+            problems.push(`${dir} holds no readable registration`);
+            continue;
+        }
+        if (!(0, parent_watch_1.processIsAlive)(reg.pid)) {
+            problems.push(`${reg.session} registered a mailbox but process ${reg.pid} is no longer running`);
+            continue;
+        }
+        live.push(reg.session);
+    }
+    if (problems.length > 0)
+        return { name: "mailbox", status: "fail", detail: problems.join("; ") };
+    if (live.length === 0)
+        return { name: "mailbox", status: "skip", detail: "no session is using the mailbox transport" };
+    // NOT "reachable". A registration says the agent armed, not that it is still
+    // waiting — and that cannot be checked without ending the wait. Delivery is
+    // where the truth is established, honestly, as pending-or-delivered.
+    return { name: "mailbox", status: "pass", detail: `registered a mailbox FIFO: ${live.join(", ")}` };
+}
+/**
+ * The process exit code for a report.
+ *
+ * Follows the convention `relay status` already set, because a user who has
+ * learned one should not have to learn a second: 0 clear, 1 something is broken,
+ * 2 there is mail nobody read.
+ */
+function exitCodeFor(report) {
+    const checks = allChecks(report);
+    if (checks.some((c) => c.status === "fail"))
+        return 1;
+    if (report.pending.status === "warn")
+        return 2;
+    return 0;
+}
+/** The whole report as lines, ready to print. */
+function renderReport(report) {
+    const lines = [];
+    lines.push(...renderSummaryCheck(report.credentials));
+    lines.push(...renderSummaryCheck(report.staleCredentials));
+    lines.push(...renderSummaryCheck(report.relay));
+    lines.push(...renderSummaryCheck(report.mailbox));
+    for (const block of report.runtimes) {
+        const [first, ...rest] = block.checks;
+        lines.push(...renderGroupCheck(block.runtime, first));
+        // Continuation rows carry no label, so the runtime name reads as a heading
+        // for its group rather than repeating four times.
+        for (const check of rest)
+            lines.push(...renderGroupCheck("", check));
+    }
+    lines.push(...renderSummaryCheck(report.pending));
+    return lines;
+}
+// ─── Individual checks ──────────────────────────────────────────────────────
+function credentialsCheck(env) {
+    if (!env.device) {
+        return {
+            name: "credentials",
+            status: "fail",
+            detail: "this machine has never been connected",
+            remedy: "baychat login",
+        };
+    }
+    const name = env.device.user.name;
+    const expiresAt = Date.parse(env.device.expiresAt);
+    // An unparseable expiry is treated as expired for the same reason
+    // `deviceStateFrom` does: calling it live sends the user into a flow that
+    // fails at the first authenticated call, blaming the server.
+    if (Number.isNaN(expiresAt) || expiresAt <= env.now) {
+        return {
+            name: "credentials",
+            status: "fail",
+            detail: `credential for "${name}" has expired`,
+            remedy: "baychat login",
+        };
+    }
+    const left = expiresAt - env.now;
+    if (left <= EXPIRY_WARNING_MS) {
+        return {
+            name: "credentials",
+            status: "warn",
+            detail: `paired as "${name}" — ${remaining(left)} left`,
+            remedy: "baychat login",
+        };
+    }
+    return { name: "credentials", status: "pass", detail: `paired as "${name}" — ${remaining(left)} left` };
+}
+/**
+ * Client configs still holding a PREVIOUS credential.
+ *
+ * The renewal fault, made visible. Every connected client keeps a copy of the
+ * device token, so a renewal that updates only `~/.baychat/credentials.json`
+ * leaves them authenticating with one that is about to expire — and the failure
+ * arrives hours later, in a different tool, with nothing tying it back to the
+ * login that caused it.
+ *
+ * Reported as a failure rather than a warning: it is not "will break later",
+ * it is already wrong, and it is silent until the old token lapses.
+ */
+function staleCredentialCheck(env) {
+    if (!env.device)
+        return { name: "clients", status: "skip", detail: "not logged in" };
+    const stale = env.staleConfigs(env.device.token);
+    if (stale.length === 0) {
+        return { name: "clients", status: "pass", detail: "all connected clients hold the current credential" };
+    }
+    return {
+        name: "clients",
+        status: "fail",
+        detail: `${stale.length} config(s) still hold a previous credential: ${stale.map((p) => display(p, env)).join(", ")}`,
+        remedy: "baychat login",
+    };
+}
+/**
+ * How long is left, in the largest unit that is still honest.
+ *
+ * Flooring to days printed "0 day(s)" for a credential with hours to live —
+ * technically true, and read by everyone as a rendering bug rather than as the
+ * urgent warning it actually was.
+ */
+function remaining(ms) {
+    const hours = Math.floor(ms / 3_600_000);
+    if (hours < 1)
+        return "under an hour";
+    if (hours < 48)
+        return `${hours} hour(s)`;
+    return `${Math.floor(hours / 24)} day(s)`;
+}
+function relayCheck(env) {
+    if (!env.relay) {
+        return {
+            name: "relay",
+            status: "fail",
+            detail: "not running — messages arriving now wake nothing",
+            remedy: "baychat relay start",
+        };
+    }
+    // The transport is optional across the process boundary: a CLI newer than the
+    // daemon it queries gets none, and naming one anyway would be a guess.
+    const transport = env.relay.transport
+        ? `, transport ${env.relay.transport}${env.relay.transportDetail ? ` (${env.relay.transportDetail})` : ""}`
+        : "";
+    return { name: "relay", status: "pass", detail: `running (pid ${env.relay.pid})${transport}` };
+}
+function pendingCheck(env) {
+    if (!env.relay) {
+        return { name: "pending", status: "skip", detail: "relay not running — nothing to report" };
+    }
+    const count = env.relay.pending.length;
+    if (count === 0)
+        return { name: "pending", status: "pass", detail: "none" };
+    return {
+        name: "pending",
+        status: "warn",
+        detail: `${count} message(s) reached this machine and nothing answered — latest: ${env.relay.pending[count - 1].reason}`,
+        remedy: "baychat relay status",
+    };
+}
+/**
+ * One runtime's block — or a single line saying it is simply not set up here.
+ *
+ * A machine that only runs Claude Code would otherwise show four permanent `✗`
+ * rows for Codex, four more for Cursor, and four for Desktop. That is not a
+ * diagnosis, it is a wall of red about software the user does not have, and its
+ * only effect is to teach them that red rows in this report do not mean
+ * anything. So a runtime with neither an MCP registration nor a skill is
+ * reported as UNCONFIGURED — with the command that would configure it — and is
+ * not counted as a failure.
+ *
+ * A runtime with one but not the other is a different animal entirely: that is a
+ * half-finished install, it is genuinely broken, and it stays a failure.
+ */
+function runtimeReport(runtime, env) {
+    const spec = runtimes_1.RUNTIME_SPECS[runtime];
+    const mcp = mcpCheck(runtime, env);
+    const skill = skillCheck(runtime, env);
+    if (mcp.status === "fail" && skill.status !== "pass") {
+        return {
+            runtime,
+            label: spec.label,
+            checks: [
+                {
+                    name: "setup",
+                    status: "skip",
+                    detail: "not configured on this machine",
+                    remedy: setupCommand(runtime),
+                },
+            ],
+        };
+    }
+    return {
+        runtime,
+        label: spec.label,
+        checks: [mcp, skill, binaryCheck(runtime, env), sessionCheck(runtime, env)],
+    };
+}
+/**
+ * Is BayChat actually registered as an MCP server for this runtime?
+ *
+ * "The config file exists" is not the question — the observed failure was a
+ * `~/.codex/config.toml` full of plugins and trust levels with no `mcp_servers`
+ * block at all. So the check is whether the file names BayChat.
+ */
+function mcpCheck(runtime, env) {
+    const remedy = setupCommand(runtime);
+    const command = HAS_BINARY[runtime];
+    // ASK THE RUNTIME, DO NOT READ A FILE WE GUESSED.
+    //
+    // Reading the config we believe a runtime uses gives a confident answer to
+    // the wrong question. On 2026-08-30 that produced a FALSE PASS: connect had
+    // written a correct block into ~/.codex/config.toml, this check read it back
+    // and reported "registered", and the Codex on that machine — a snap install,
+    // reading ~/snap/codex/current/config.toml — listed no MCP servers at all.
+    // A check that confirms our own write is not a check.
+    //
+    // `<runtime> mcp list` is the runtime's own answer about its own state, and
+    // it is correct wherever the config turns out to live.
+    if (command) {
+        const listed = env.mcpList(runtime);
+        if (listed === null) {
+            // Unknown, not absent. Reporting "not registered" because we could not
+            // run the command would send a user to reinstall something that is fine.
+            return { name: "mcp", status: "skip", detail: `could not run \`${command} mcp list\``, remedy };
+        }
+        return listed.includes("baychat")
+            ? { name: "mcp", status: "pass", detail: `${command} lists baychat` }
+            : { name: "mcp", status: "fail", detail: `\`${command} mcp list\` does not list baychat`, remedy };
+    }
+    // No CLI to ask — a GUI client. Every location this client might read is
+    // checked, because "the file we would write" and "the file it opens" are not
+    // reliably the same question.
+    const paths = (0, client_paths_1.configPathsFor)(runtime, { home: env.home, platform: env.platform });
+    if (paths.length === 0) {
+        return { name: "mcp", status: "skip", detail: `no known config location on ${env.platform}` };
+    }
+    for (const configPath of paths) {
+        const contents = env.readText(configPath);
+        if (contents?.includes("baychat")) {
+            return { name: "mcp", status: "pass", detail: display(configPath, env) };
+        }
+    }
+    return {
+        name: "mcp",
+        status: "fail",
+        detail: `no baychat entry in ${paths.map((p) => display(p, env)).join(" or ")}`,
+        remedy,
+    };
+}
+/**
+ * Is the runtime's BayChat skill on disk?
+ *
+ * Separate from the MCP check because they fail independently: a runtime with
+ * the MCP server and no skill has the tools and has never been told the rules of
+ * the room — which is exactly how a Codex session comes to "not understand
+ * BayChat" while appearing connected.
+ */
+function skillCheck(runtime, env) {
+    const spec = runtimes_1.RUNTIME_SPECS[runtime];
+    if (!spec.command) {
+        return { name: "skill", status: "skip", detail: spec.fallback ?? "no command mechanism" };
+    }
+    const file = `${env.home}/${spec.command.dir}/${spec.command.file}`;
+    if (env.readText(file) === null) {
+        return {
+            name: "skill",
+            status: "fail",
+            detail: `${display(file, env)} missing`,
+            remedy: setupCommand(runtime),
+        };
+    }
+    return { name: "skill", status: "pass", detail: display(file, env) };
+}
+function binaryCheck(runtime, env) {
+    const command = HAS_BINARY[runtime];
+    if (!command) {
+        return { name: "binary", status: "skip", detail: `${runtimes_1.RUNTIME_SPECS[runtime].label} is not a command-line runtime` };
+    }
+    const resolved = env.resolveBinary(command);
+    if (!resolved.ok) {
+        return {
+            name: "binary",
+            status: "fail",
+            detail: (0, runtime_binary_1.summarizeResolutionFailure)(resolved),
+            remedy: `install ${command}, or set BAYCHAT_${command.toUpperCase()}_BIN to its path`,
+        };
+    }
+    return { name: "binary", status: "pass", detail: `${resolved.path} (${resolved.version})` };
+}
+/**
+ * Has any session of this runtime registered with the relay?
+ *
+ * Skipped rather than failed when the relay is down: session state lives in the
+ * daemon, so with no daemon there is no evidence either way, and "never
+ * attached" would be an invented finding.
+ */
+function sessionCheck(runtime, env) {
+    if (!env.relay) {
+        return { name: "session", status: "skip", detail: "relay not running — cannot tell" };
+    }
+    const mine = env.relay.sessions.filter((s) => s.runtime === runtime);
+    if (mine.length === 0) {
+        // A warning, not a failure. The runtime IS set up — nobody has started a
+        // session in it yet, which is a normal state of a working machine at 9am and
+        // resolves itself the moment they do.
+        return {
+            name: "session",
+            status: "warn",
+            detail: "configured, but no session of this runtime has attached",
+            remedy: `in ${runtimes_1.RUNTIME_SPECS[runtime].label}, run: ${runtimes_1.RUNTIME_SPECS[runtime].invocation}`,
+        };
+    }
+    return { name: "session", status: "pass", detail: mine.map((s) => `"${s.name}"`).join(", ") };
+}
+// ─── Rendering ──────────────────────────────────────────────────────────────
+const GLYPH = { pass: "✓", fail: "✗", warn: "!", skip: "–" };
+const LABEL_WIDTH = 12;
+const CHECK_WIDTH = 8;
+/**
+ * A check inside a runtime's block: `codex   ✗ mcp   …`.
+ *
+ * The label is the runtime on the first row and blank on the rest, so the name
+ * reads as a heading for the group instead of repeating on every line.
+ */
+function renderGroupCheck(label, check) {
+    return withRemedy(`${label.padEnd(LABEL_WIDTH)}${GLYPH[check.status]} ${check.name.padEnd(CHECK_WIDTH)}${check.detail}`, check);
+}
+/**
+ * A standalone check, whose name IS its heading: `credentials  ✓  …`.
+ *
+ * Rendered separately rather than through `renderGroupCheck` because passing the
+ * name as both label and column printed it twice ("credentials ✓ credentials").
+ * The detail column stays aligned with the runtime blocks.
+ */
+function renderSummaryCheck(check) {
+    return withRemedy(`${check.name.padEnd(LABEL_WIDTH)}${GLYPH[check.status]} ${" ".repeat(CHECK_WIDTH)}${check.detail}`, check);
+}
+/**
+ * The remedy sits directly under its finding. A block of fixes at the bottom
+ * makes the reader match them back up, and they mismatch them.
+ */
+function withRemedy(line, check) {
+    if (!check.remedy)
+        return [line];
+    return [line, `${" ".repeat(LABEL_WIDTH + 2 + CHECK_WIDTH)}→ ${check.remedy}`];
+}
+function allChecks(report) {
+    return [report.credentials, report.staleCredentials, report.relay, report.mailbox, ...report.runtimes.flatMap((r) => r.checks), report.pending];
+}
+/** Shorten a path under the user's home, which is where nearly all of these are. */
+function display(filePath, env) {
+    return filePath.startsWith(env.home) ? `~${filePath.slice(env.home.length)}` : filePath;
+}