fboxrec 0.1.0

package/dist/cli/main.cjs

@@ -0,0 +1,723 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/dump/serializer.ts
+var import_node_zlib = require("zlib");
+
+// src/encoder.ts
+var import_msgpackr = require("msgpackr");
+
+// ../format/src/parse.ts
+var MAX_DECOMPRESSED_BYTES = 1024 * 1024 * 1024;
+
+// src/dump/serializer.ts
+var FLIGHTBOX_VERSION = "0.1.0";
+
+// src/cli/open.ts
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var http = __toESM(require("http"));
+var import_node_crypto2 = require("crypto");
+var import_node_child_process = require("child_process");
+
+// src/dump/sinks/sigv4.ts
+var import_node_crypto = require("crypto");
+function sha256Hex(data) {
+  return (0, import_node_crypto.createHash)("sha256").update(data).digest("hex");
+}
+function hmac(key, data) {
+  return (0, import_node_crypto.createHmac)("sha256", key).update(data, "utf8").digest();
+}
+function uriEncode(str, encodeSlash) {
+  let out = "";
+  for (const ch of str) {
+    if (/[A-Za-z0-9\-._~]/.test(ch) || ch === "/" && !encodeSlash) {
+      out += ch;
+    } else {
+      for (const byte of Buffer.from(ch, "utf8")) {
+        out += "%" + byte.toString(16).toUpperCase().padStart(2, "0");
+      }
+    }
+  }
+  return out;
+}
+function timestamps(now) {
+  const iso = now.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
+  return { amzDate: iso, dateStamp: iso.slice(0, 8) };
+}
+function canonicalUri(url) {
+  return url.pathname.split("/").map((seg) => uriEncode(safeDecode(seg), true)).join("/") || "/";
+}
+function safeDecode(seg) {
+  try {
+    return decodeURIComponent(seg);
+  } catch {
+    return seg;
+  }
+}
+function byCodePoint(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function canonicalQuery(params) {
+  return params.map(([k, v]) => [uriEncode(k, true), uriEncode(v, true)]).sort((a, b) => a[0] === b[0] ? byCodePoint(a[1], b[1]) : byCodePoint(a[0], b[0])).map(([k, v]) => `${k}=${v}`).join("&");
+}
+function signingKey(secret, dateStamp, region, service) {
+  return hmac(hmac(hmac(hmac(`AWS4${secret}`, dateStamp), region), service), "aws4_request");
+}
+function signHeaders(input) {
+  const service = input.service ?? "s3";
+  const { amzDate, dateStamp } = timestamps(input.now ?? /* @__PURE__ */ new Date());
+  const headers = {
+    host: input.url.host,
+    "x-amz-content-sha256": input.payloadHash,
+    "x-amz-date": amzDate,
+    ...input.creds.sessionToken ? { "x-amz-security-token": input.creds.sessionToken } : {},
+    ...Object.fromEntries(
+      Object.entries(input.headers ?? {}).map(([k, v]) => [k.toLowerCase(), v])
+    )
+  };
+  const names = Object.keys(headers).sort();
+  const canonicalHeaders = names.map((n) => `${n}:${headers[n].trim()}
+`).join("");
+  const signedHeaders = names.join(";");
+  const canonicalRequest = [
+    input.method.toUpperCase(),
+    canonicalUri(input.url),
+    canonicalQuery([...input.url.searchParams.entries()]),
+    canonicalHeaders,
+    signedHeaders,
+    input.payloadHash
+  ].join("\n");
+  const scope = `${dateStamp}/${input.region}/${service}/aws4_request`;
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    scope,
+    sha256Hex(canonicalRequest)
+  ].join("\n");
+  const signature = (0, import_node_crypto.createHmac)(
+    "sha256",
+    signingKey(input.creds.secretAccessKey, dateStamp, input.region, service)
+  ).update(stringToSign, "utf8").digest("hex");
+  headers.authorization = `AWS4-HMAC-SHA256 Credential=${input.creds.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+  return headers;
+}
+function presignUrl(input) {
+  const service = input.service ?? "s3";
+  const method = input.method ?? "GET";
+  const { amzDate, dateStamp } = timestamps(input.now ?? /* @__PURE__ */ new Date());
+  const scope = `${dateStamp}/${input.region}/${service}/aws4_request`;
+  const params = [
+    ...input.url.searchParams.entries(),
+    ["X-Amz-Algorithm", "AWS4-HMAC-SHA256"],
+    ["X-Amz-Credential", `${input.creds.accessKeyId}/${scope}`],
+    ["X-Amz-Date", amzDate],
+    ["X-Amz-Expires", String(Math.floor(input.expiresSec))],
+    ["X-Amz-SignedHeaders", "host"]
+  ];
+  if (input.creds.sessionToken) {
+    params.push(["X-Amz-Security-Token", input.creds.sessionToken]);
+  }
+  const query = canonicalQuery(params);
+  const canonicalRequest = [
+    method.toUpperCase(),
+    canonicalUri(input.url),
+    query,
+    `host:${input.url.host}
+`,
+    "host",
+    "UNSIGNED-PAYLOAD"
+  ].join("\n");
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    scope,
+    sha256Hex(canonicalRequest)
+  ].join("\n");
+  const signature = (0, import_node_crypto.createHmac)(
+    "sha256",
+    signingKey(input.creds.secretAccessKey, dateStamp, input.region, service)
+  ).update(stringToSign, "utf8").digest("hex");
+  return `${input.url.origin}${canonicalUri(input.url)}?${query}&X-Amz-Signature=${signature}`;
+}
+
+// src/dump/sinks/credentials.ts
+var REFRESH_MARGIN_MS = 5 * 6e4;
+var METADATA_TIMEOUT_MS = 1e3;
+var cache = null;
+function fromStatic(cfg) {
+  const key = cfg.accessKeyId ?? process.env.FLIGHTBOX_S3_KEY;
+  const secret = cfg.secretAccessKey ?? process.env.FLIGHTBOX_S3_SECRET;
+  if (!key || !secret) return null;
+  return {
+    accessKeyId: key,
+    secretAccessKey: secret,
+    sessionToken: cfg.sessionToken ?? process.env.FLIGHTBOX_S3_TOKEN,
+    source: "static"
+  };
+}
+function fromAwsEnv() {
+  const key = process.env.AWS_ACCESS_KEY_ID;
+  const secret = process.env.AWS_SECRET_ACCESS_KEY;
+  if (!key || !secret) return null;
+  return {
+    accessKeyId: key,
+    secretAccessKey: secret,
+    sessionToken: process.env.AWS_SESSION_TOKEN,
+    source: "aws-env"
+  };
+}
+async function fetchJson(url, init) {
+  try {
+    const res = await fetch(url, {
+      ...init,
+      signal: AbortSignal.timeout(METADATA_TIMEOUT_MS)
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+async function fromEcs() {
+  const fullUri = process.env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
+  const relativeUri = process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI;
+  if (!fullUri && !relativeUri) return null;
+  const url = fullUri ?? `http://169.254.170.2${relativeUri}`;
+  const body = await fetchJson(url);
+  if (!body?.AccessKeyId || !body?.SecretAccessKey) return null;
+  return {
+    accessKeyId: body.AccessKeyId,
+    secretAccessKey: body.SecretAccessKey,
+    sessionToken: body.Token,
+    expiresAtMs: body.Expiration ? Date.parse(body.Expiration) : void 0,
+    source: "ecs-task-role"
+  };
+}
+async function fromImdsV2() {
+  const base = process.env.AWS_EC2_METADATA_SERVICE_ENDPOINT?.replace(/\/$/, "") ?? "http://169.254.169.254";
+  let token;
+  try {
+    const res = await fetch(`${base}/latest/api/token`, {
+      method: "PUT",
+      headers: { "x-aws-ec2-metadata-token-ttl-seconds": "21600" },
+      signal: AbortSignal.timeout(METADATA_TIMEOUT_MS)
+    });
+    if (!res.ok) return null;
+    token = await res.text();
+  } catch {
+    return null;
+  }
+  const tokenHeader = { "x-aws-ec2-metadata-token": token };
+  let role;
+  try {
+    const res = await fetch(`${base}/latest/meta-data/iam/security-credentials/`, {
+      headers: tokenHeader,
+      signal: AbortSignal.timeout(METADATA_TIMEOUT_MS)
+    });
+    if (!res.ok) return null;
+    role = (await res.text()).split("\n")[0].trim();
+    if (!role) return null;
+  } catch {
+    return null;
+  }
+  const body = await fetchJson(
+    `${base}/latest/meta-data/iam/security-credentials/${role}`,
+    { headers: tokenHeader }
+  );
+  if (!body?.AccessKeyId || !body?.SecretAccessKey) return null;
+  return {
+    accessKeyId: body.AccessKeyId,
+    secretAccessKey: body.SecretAccessKey,
+    sessionToken: body.Token,
+    expiresAtMs: body.Expiration ? Date.parse(body.Expiration) : void 0,
+    source: "ec2-imdsv2"
+  };
+}
+async function resolveCredentials(cfg = {}) {
+  const staticCreds = fromStatic(cfg);
+  if (staticCreds) return staticCreds;
+  const envCreds = fromAwsEnv();
+  if (envCreds) return envCreds;
+  if (cache && (cache.expiresAtMs === void 0 || cache.expiresAtMs - Date.now() > REFRESH_MARGIN_MS)) {
+    return cache;
+  }
+  cache = await fromEcs() ?? await fromImdsV2();
+  return cache;
+}
+
+// src/cli/open.ts
+var MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript",
+  ".css": "text/css",
+  ".map": "application/json",
+  ".json": "application/json",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".ico": "image/x-icon"
+};
+function viewerDistDir() {
+  return path.resolve(__dirname, "..", "..", "viewer-dist");
+}
+async function fetchS3(source) {
+  const m = /^s3:\/\/([^/]+)\/(.+)$/.exec(source);
+  if (!m) throw new Error(`invalid s3 url: ${source}`);
+  const [, bucket, key] = m;
+  const creds = await resolveCredentials({});
+  if (!creds) {
+    throw new Error(
+      "no AWS credentials found (chain: FLIGHTBOX_S3_KEY/SECRET -> AWS_* env -> ECS -> IMDSv2)"
+    );
+  }
+  const endpoint = process.env.FLIGHTBOX_S3_ENDPOINT?.replace(/\/$/, "");
+  const region = process.env.FLIGHTBOX_S3_REGION || (endpoint ? "auto" : "us-east-1");
+  const url = endpoint ? new URL(`${endpoint}/${bucket}/${key}`) : new URL(`https://${bucket}.s3.${region}.amazonaws.com/${key}`);
+  const presigned = presignUrl({ url, creds, region, expiresSec: 300 });
+  return fetchCapped(presigned);
+}
+var MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024;
+var DOWNLOAD_TIMEOUT_MS = 6e4;
+async function fetchCapped(url) {
+  const res = await fetch(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+  if (!res.ok) throw new Error(`fetch failed: HTTP ${res.status}`);
+  const len = Number(res.headers.get("content-length") ?? 0);
+  if (len > MAX_DOWNLOAD_BYTES) {
+    throw new Error(`remote file is ${len} bytes \u2014 larger than any plausible incident`);
+  }
+  const buf = Buffer.from(await res.arrayBuffer());
+  if (buf.length > MAX_DOWNLOAD_BYTES) {
+    throw new Error(`remote file exceeds the ${MAX_DOWNLOAD_BYTES} byte limit`);
+  }
+  return buf;
+}
+async function loadSource(source) {
+  if (source.startsWith("s3://")) {
+    return { data: await fetchS3(source), label: source };
+  }
+  if (source.startsWith("http://") || source.startsWith("https://")) {
+    return { data: await fetchCapped(source), label: source };
+  }
+  return { data: fs.readFileSync(source), label: path.resolve(source) };
+}
+async function openCommand(source, opts = {}) {
+  const dist = viewerDistDir();
+  if (!fs.existsSync(path.join(dist, "index.html"))) {
+    throw new Error(
+      `bundled viewer not found at ${dist} \u2014 this build of flightbox was packaged without it (run: pnpm build)`
+    );
+  }
+  const { data, label } = await loadSource(source);
+  const incidentPath = `/__incident-${(0, import_node_crypto2.randomBytes)(16).toString("hex")}`;
+  const server = http.createServer((req, res) => {
+    const host = String(req.headers.host ?? "");
+    const hostname = host.replace(/:\d+$/, "");
+    if (hostname !== "localhost" && hostname !== "127.0.0.1" && hostname !== "[::1]") {
+      res.writeHead(403).end("forbidden");
+      return;
+    }
+    const url = new URL(req.url ?? "/", "http://localhost");
+    if (url.pathname === incidentPath) {
+      res.writeHead(200, {
+        "content-type": "application/octet-stream",
+        "content-length": data.length
+      });
+      res.end(data);
+      return;
+    }
+    let rel = url.pathname === "/" ? "/index.html" : url.pathname;
+    const file = path.join(dist, path.normalize(rel));
+    if (!file.startsWith(dist) || !fs.existsSync(file) || !fs.statSync(file).isFile()) {
+      res.writeHead(404).end("not found");
+      return;
+    }
+    res.writeHead(200, {
+      "content-type": MIME[path.extname(file)] ?? "application/octet-stream"
+    });
+    res.end(fs.readFileSync(file));
+  });
+  await new Promise((resolve3) => server.listen(opts.port ?? 4560, "127.0.0.1", resolve3));
+  const port = server.address().port;
+  const viewerUrl = `http://localhost:${port}/?src=${encodeURIComponent(incidentPath)}`;
+  process.stderr.write(`flightbox: serving ${label}
+`);
+  process.stdout.write(`${viewerUrl}
+`);
+  if (opts.openBrowser !== false) {
+    const cmd = process.platform === "win32" ? ["cmd", ["/c", "start", "", viewerUrl]] : process.platform === "darwin" ? ["open", [viewerUrl]] : ["xdg-open", [viewerUrl]];
+    try {
+      (0, import_node_child_process.spawn)(cmd[0], cmd[1], { detached: true, stdio: "ignore" }).unref();
+    } catch {
+    }
+  }
+  return server;
+}
+
+// src/cli/doctor.ts
+var fs2 = __toESM(require("fs"));
+var path3 = __toESM(require("path"));
+
+// src/config.ts
+var path2 = __toESM(require("path"));
+var DEFAULTS = {
+  bufferMb: 64,
+  dir: ".flightbox",
+  slowRequestMs: 5e3,
+  cooldownMs: 6e4,
+  heapPct: 0.9,
+  stallMs: 1e3,
+  shedLagMs: 50,
+  maxStageMb: 500,
+  minDiskFreePct: 5,
+  viewerOrigin: "https://viewer.flightbox.dev"
+};
+function envNumber(name) {
+  const raw = process.env[name];
+  if (raw === void 0 || raw === "") return void 0;
+  const n = Number(raw);
+  return Number.isFinite(n) ? n : void 0;
+}
+function envBool(name) {
+  return process.env[name] === "1" || process.env[name] === "true";
+}
+function envS3Sink() {
+  const bucket = process.env.FLIGHTBOX_S3_BUCKET;
+  if (!bucket) return null;
+  return {
+    type: "s3",
+    bucket,
+    prefix: process.env.FLIGHTBOX_S3_PREFIX ?? "",
+    endpoint: process.env.FLIGHTBOX_S3_ENDPOINT,
+    region: process.env.FLIGHTBOX_S3_REGION,
+    presign: { enabled: true }
+  };
+}
+function validateSink(sink) {
+  switch (sink.type) {
+    case "s3": {
+      if (!sink.bucket || typeof sink.bucket !== "string") {
+        throw new Error('flightbox: s3 sink requires a non-empty "bucket"');
+      }
+      if (sink.endpoint !== void 0 && !/^https?:\/\//.test(sink.endpoint)) {
+        throw new Error(`flightbox: s3 sink "endpoint" must be an http(s) URL, got ${sink.endpoint}`);
+      }
+      if (sink.prefix !== void 0 && typeof sink.prefix !== "string") {
+        throw new Error('flightbox: s3 sink "prefix" must be a string');
+      }
+      const hrs = sink.presign?.expiresHours;
+      if (hrs !== void 0 && (!Number.isFinite(hrs) || hrs <= 0 || hrs > 168)) {
+        throw new Error(`flightbox: s3 presign.expiresHours must be in (0, 168], got ${hrs}`);
+      }
+      break;
+    }
+    case "http": {
+      if (!/^https?:\/\//.test(sink.url ?? "")) {
+        throw new Error(`flightbox: http sink "url" must be an http(s) URL, got ${sink.url}`);
+      }
+      break;
+    }
+    case "disk": {
+      if (!sink.dir || typeof sink.dir !== "string") {
+        throw new Error('flightbox: disk sink requires a non-empty "dir"');
+      }
+      if (sink.maxMb !== void 0 && (!Number.isFinite(sink.maxMb) || sink.maxMb < 1)) {
+        throw new Error(`flightbox: disk sink "maxMb" must be >= 1, got ${sink.maxMb}`);
+      }
+      break;
+    }
+    default:
+      throw new Error(`flightbox: unknown sink type "${sink.type}"`);
+  }
+}
+function resolveConfig(user = {}) {
+  const bufferMb = envNumber("FLIGHTBOX_BUFFER_MB") ?? user.bufferMb ?? DEFAULTS.bufferMb;
+  const dir = process.env.FLIGHTBOX_DIR || user.dir || DEFAULTS.dir;
+  const service = process.env.FLIGHTBOX_SERVICE || user.service || path2.basename(process.cwd());
+  const slowRequestMs = envNumber("FLIGHTBOX_TRIGGER_SLOW_MS") ?? user.triggers?.slowRequestMs ?? DEFAULTS.slowRequestMs;
+  const cooldownMs = user.triggers?.cooldownMs ?? DEFAULTS.cooldownMs;
+  const heapPct = envNumber("FLIGHTBOX_TRIGGER_HEAP_PCT") ?? user.triggers?.heapPct ?? DEFAULTS.heapPct;
+  const stallMs = envNumber("FLIGHTBOX_TRIGGER_STALL_MS") ?? user.triggers?.stallMs ?? DEFAULTS.stallMs;
+  const shedLagMs = envNumber("FLIGHTBOX_SHED_LAG_MS") ?? user.shedding?.shedLagMs ?? DEFAULTS.shedLagMs;
+  const maxStageMb = envNumber("FLIGHTBOX_MAX_STAGE_MB") ?? user.staging?.maxStageMb ?? DEFAULTS.maxStageMb;
+  const minDiskFreePct = user.staging?.minDiskFreePct ?? DEFAULTS.minDiskFreePct;
+  if (!Number.isFinite(bufferMb) || bufferMb < 1 || bufferMb > 4096) {
+    throw new RangeError(`flightbox: bufferMb must be between 1 and 4096, got ${bufferMb}`);
+  }
+  if (!Number.isFinite(slowRequestMs) || slowRequestMs < 50) {
+    throw new RangeError(`flightbox: triggers.slowRequestMs must be >= 50, got ${slowRequestMs}`);
+  }
+  if (!Number.isFinite(cooldownMs) || cooldownMs < 0) {
+    throw new RangeError(`flightbox: triggers.cooldownMs must be >= 0, got ${cooldownMs}`);
+  }
+  if (!Number.isFinite(heapPct) || heapPct <= 0 || heapPct >= 1) {
+    throw new RangeError(`flightbox: triggers.heapPct must be in (0,1), got ${heapPct}`);
+  }
+  if (!Number.isFinite(stallMs) || stallMs < 50) {
+    throw new RangeError(`flightbox: triggers.stallMs must be >= 50, got ${stallMs}`);
+  }
+  if (!Number.isFinite(shedLagMs) || shedLagMs < 1) {
+    throw new RangeError(`flightbox: shedding.shedLagMs must be >= 1, got ${shedLagMs}`);
+  }
+  if (!Number.isFinite(maxStageMb) || maxStageMb < 1) {
+    throw new RangeError(`flightbox: staging.maxStageMb must be >= 1, got ${maxStageMb}`);
+  }
+  if (!Number.isFinite(minDiskFreePct) || minDiskFreePct < 0 || minDiskFreePct > 50) {
+    throw new RangeError(`flightbox: staging.minDiskFreePct must be 0-50, got ${minDiskFreePct}`);
+  }
+  const sinks = [...user.sinks ?? []];
+  const s3FromEnv = envS3Sink();
+  if (s3FromEnv && !sinks.some((s) => s.type === "s3")) sinks.push(s3FromEnv);
+  sinks.forEach(validateSink);
+  return {
+    service,
+    bufferMb,
+    dir: path2.resolve(dir),
+    triggers: { slowRequestMs, cooldownMs, heapPct, stallMs },
+    staging: { maxStageMb, minDiskFreePct },
+    shedding: { shedLagMs },
+    token: process.env.FLIGHTBOX_TOKEN || user.token,
+    viewerOrigin: process.env.FLIGHTBOX_VIEWER_ORIGIN || user.viewerOrigin || DEFAULTS.viewerOrigin,
+    sinks,
+    allowWorkerThreads: envBool("FLIGHTBOX_ALLOW_WORKER_THREADS") || (user.allowWorkerThreads ?? false),
+    log: user.log ?? ((msg) => process.stderr.write(`flightbox: ${msg}
+`))
+  };
+}
+
+// src/cli/doctor.ts
+var failures = 0;
+function ok(msg) {
+  process.stdout.write(`  \u2713 ${msg}
+`);
+}
+function warn(msg) {
+  process.stdout.write(`  ! ${msg}
+`);
+}
+function fail(msg) {
+  failures++;
+  process.stdout.write(`  \u2717 ${msg}
+`);
+}
+var CORS_FIX = (origin) => JSON.stringify(
+  [
+    {
+      AllowedOrigins: [origin],
+      AllowedMethods: ["GET"],
+      AllowedHeaders: ["*"],
+      MaxAgeSeconds: 3600
+    }
+  ],
+  null,
+  2
+);
+async function doctorCommand() {
+  process.stdout.write("flightbox doctor\n\n");
+  const major = Number(process.versions.node.split(".")[0]);
+  if (major >= 18) ok(`node ${process.versions.node} (>= 18)`);
+  else fail(`node ${process.versions.node} \u2014 flightbox needs >= 18 (global fetch, stable ALS)`);
+  let config;
+  try {
+    config = resolveConfig();
+    ok(
+      `config: service=${config.service}, bufferMb=${config.bufferMb}, dir=${config.dir}, slowMs=${config.triggers.slowRequestMs}, sinks=[${config.sinks.map((s) => s.type).join(", ") || "none"}]`
+    );
+  } catch (err) {
+    fail(`config invalid: ${err.message}`);
+    return 1;
+  }
+  try {
+    const probe = path3.join(config.dir, "staging", `doctor-${process.pid}.probe`);
+    fs2.mkdirSync(path3.dirname(probe), { recursive: true });
+    fs2.writeFileSync(probe, "ok");
+    fs2.unlinkSync(probe);
+    ok(`staging dir writable: ${path3.join(config.dir, "staging")}`);
+  } catch (err) {
+    fail(`staging dir not writable: ${err.message}`);
+  }
+  const statfsSync2 = fs2.statfsSync;
+  if (typeof statfsSync2 === "function") {
+    try {
+      const s = statfsSync2(config.dir);
+      const freePct = Number(s.bavail) / Number(s.blocks) * 100;
+      if (freePct >= config.staging.minDiskFreePct) {
+        ok(`disk ${freePct.toFixed(1)}% free (floor: ${config.staging.minDiskFreePct}%)`);
+      } else {
+        fail(`disk only ${freePct.toFixed(1)}% free \u2014 below the ${config.staging.minDiskFreePct}% floor; the agent would disable itself (ADR 006)`);
+      }
+    } catch {
+      warn("could not stat disk free space");
+    }
+  }
+  if (!config.token) {
+    warn("FLIGHTBOX_TOKEN not set \u2014 the manual HTTP dump endpoint is disarmed");
+  } else {
+    ok("manual dump endpoint armed (/__flightbox/dump)");
+  }
+  const s3 = config.sinks.find((s) => s.type === "s3");
+  if (!s3) {
+    warn("no s3 sink configured \u2014 on ephemeral platforms (Render/Railway/Heroku) crash dumps need one (\xA75)");
+  } else {
+    await checkS3(s3, config.viewerOrigin);
+  }
+  process.stdout.write(failures === 0 ? "\nall clear \u2708\n" : `
+${failures} problem(s) found
+`);
+  return failures === 0 ? 0 : 1;
+}
+async function checkS3(s3, viewerOrigin) {
+  const creds = await resolveCredentials(s3);
+  if (!creds) {
+    fail("S3 credentials: none resolved (chain: static -> AWS_* env -> ECS task role -> IMDSv2)");
+    return;
+  }
+  ok(
+    `S3 credentials via ${creds.source}` + (creds.expiresAtMs ? ` (expire ${new Date(creds.expiresAtMs).toISOString()})` : "")
+  );
+  warn(
+    "S3 check writes and deletes a probe object (needs PutObject + DeleteObject); a mid-run failure may leave one doctor-probe-*.txt behind"
+  );
+  const region = s3.region || (s3.endpoint ? "auto" : "us-east-1");
+  const key = `${s3.prefix ?? ""}doctor-probe-${Date.now()}.txt`;
+  const objectUrl = s3.endpoint ? new URL(`${s3.endpoint.replace(/\/$/, "")}/${s3.bucket}/${key}`) : new URL(`https://${s3.bucket}.s3.${region}.amazonaws.com/${key}`);
+  const body = Buffer.from("flightbox doctor probe");
+  try {
+    const headers = signHeaders({
+      method: "PUT",
+      url: objectUrl,
+      payloadHash: sha256Hex(body),
+      creds,
+      region
+    });
+    const res = await fetch(objectUrl, { method: "PUT", headers, body });
+    if (res.ok) ok(`S3 PUT s3://${s3.bucket}/${key}`);
+    else {
+      fail(`S3 PUT failed: HTTP ${res.status} ${(await res.text()).slice(0, 120)}`);
+      return;
+    }
+  } catch (err) {
+    fail(`S3 unreachable: ${err.message}`);
+    return;
+  }
+  const presigned = presignUrl({ url: objectUrl, creds, region, expiresSec: 300 });
+  try {
+    const res = await fetch(presigned);
+    if (res.ok && Buffer.from(await res.arrayBuffer()).equals(body)) {
+      ok("presigned GET round-trips (magic links will work)");
+    } else {
+      fail(`presigned GET failed: HTTP ${res.status}`);
+    }
+  } catch (err) {
+    fail(`presigned GET failed: ${err.message}`);
+  }
+  const origin = s3.presign?.viewerOrigin ?? viewerOrigin;
+  try {
+    const res = await fetch(presigned, {
+      method: "OPTIONS",
+      headers: { Origin: origin, "Access-Control-Request-Method": "GET" }
+    });
+    const allowed = res.headers.get("access-control-allow-origin");
+    if (allowed === "*" || allowed === origin) {
+      ok(`bucket CORS allows ${origin}`);
+    } else {
+      fail(
+        `bucket CORS does NOT allow ${origin} \u2014 magic links will fail in the browser.
+    Fix (AWS: bucket \u2192 Permissions \u2192 CORS; R2: bucket \u2192 Settings \u2192 CORS policy):
+` + CORS_FIX(origin).split("\n").map((l) => `    ${l}`).join("\n")
+      );
+    }
+  } catch {
+    warn("could not probe CORS (endpoint rejected OPTIONS) \u2014 verify manually");
+  }
+  try {
+    const headers = signHeaders({
+      method: "DELETE",
+      url: objectUrl,
+      payloadHash: sha256Hex(""),
+      creds,
+      region
+    });
+    await fetch(objectUrl, { method: "DELETE", headers });
+  } catch {
+  }
+}
+
+// src/cli/main.ts
+var USAGE = `flightbox v${FLIGHTBOX_VERSION}
+
+Usage:
+  flightbox open <source> [--port N] [--no-open]
+      Open an incident in the bundled local viewer (fully offline).
+      <source>: a local .fbox file, s3://bucket/key, or an https:// URL
+      (remote sources are downloaded with THIS machine's credentials \u2014
+       works inside air-gapped VPCs and over SSH tunnels).
+
+  flightbox doctor
+      Verify config, staging dir, disk headroom, S3 credentials chain,
+      sink connectivity, and bucket CORS for magic links.
+
+  flightbox --version
+`;
+async function main() {
+  const argv = process.argv.slice(2);
+  const command = argv[0];
+  switch (command) {
+    case "open": {
+      const source = argv[1];
+      if (!source) {
+        process.stderr.write("flightbox open: missing <source>\n");
+        process.exit(1);
+      }
+      const portIdx = argv.indexOf("--port");
+      const port = portIdx !== -1 ? Number(argv[portIdx + 1]) : 4560;
+      const openBrowser = !argv.includes("--no-open");
+      try {
+        await openCommand(source, { port, openBrowser });
+      } catch (err) {
+        process.stderr.write(`flightbox open: ${err.message}
+`);
+        process.exit(1);
+      }
+      break;
+    }
+    case "doctor":
+      process.exit(await doctorCommand());
+      break;
+    case "--version":
+    case "-v":
+      process.stdout.write(`${FLIGHTBOX_VERSION}
+`);
+      break;
+    case void 0:
+    case "--help":
+    case "-h":
+      process.stdout.write(USAGE);
+      break;
+    default:
+      process.stdout.write(USAGE);
+      process.exit(1);
+  }
+}
+void main();