ghostrail 0.15.1 → 0.16.0

package/dist/doctor/checks.js

@@ -0,0 +1,414 @@
+/**
+ * Pure check functions: each takes already-gathered facts and returns a
+ * {@link DoctorCheck} (or one per item, for the checks that repeat per prompt).
+ * No I/O here — see probes.ts for that — so every rule is testable without a
+ * container, a tracker, or the network. Rules are documented in
+ * specs/doctor-command.spec.md.
+ */
+import { DEFAULT_CONTAINER_IMAGE } from "../backend/docker.js";
+export function checkConfig(parsed) {
+    const id = "config";
+    const label = "config";
+    if (parsed.ok) {
+        return { id, label, status: "pass", detail: "ghostrail.toml parses" };
+    }
+    const detail = parsed.errors
+        .map((error) => `config error at ${error.path || "(root)"}: ${error.message}`)
+        .join("; ");
+    return {
+        id,
+        label,
+        status: "fail",
+        detail,
+        fix: `fix ${parsed.errors.length === 1 ? "the error" : "these errors"} in ghostrail.toml`,
+    };
+}
+/** One check per configured prompt path: exists on disk, and is committed. */
+export function checkPrompt(fact) {
+    const id = `prompt:${fact.field}`;
+    const label = `prompt (${fact.field})`;
+    if (!fact.exists) {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: `${fact.path} does not exist`,
+            fix: `create ${fact.path}`,
+        };
+    }
+    if (!fact.committed) {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: `${fact.path} exists but is not committed; a fresh clone or worktree will not have it`,
+            fix: `git add ${fact.path} && git commit`,
+        };
+    }
+    return { id, label, status: "pass", detail: `${fact.path} exists and is committed` };
+}
+/** Package-manager subcommands that are not a `package.json` script name. */
+const PACKAGE_MANAGER_BUILTINS = new Set([
+    "install",
+    "ci",
+    "add",
+    "remove",
+    "rm",
+    "dlx",
+    "exec",
+    "create",
+    "init",
+    "link",
+    "unlink",
+    "publish",
+    "update",
+    "outdated",
+    "list",
+    "ls",
+    "why",
+    "store",
+    "prune",
+    "audit",
+    "dedupe",
+    "pack",
+    "patch",
+    "rebuild",
+]);
+/**
+ * The `package.json` script name a gate command invokes, if it looks like a
+ * package-manager script invocation (`pnpm <script>`, `npm run <script>`,
+ * `yarn <script>`); undefined for anything else, including a package-manager
+ * builtin like `pnpm install`. Best-effort: a command this misses is simply not
+ * checked further, never reported as broken on a guess.
+ */
+export function scriptNameOf(command) {
+    const [head, ...rest] = command.trim().split(/\s+/);
+    const next = rest[0];
+    if (head === "pnpm" || head === "yarn") {
+        if (next === undefined || next.startsWith("-"))
+            return undefined;
+        if (next === "run")
+            return rest[1];
+        if (PACKAGE_MANAGER_BUILTINS.has(next))
+            return undefined;
+        return next;
+    }
+    if (head === "npm") {
+        if (next !== "run" && next !== "run-script")
+            return undefined;
+        return rest[1];
+    }
+    return undefined;
+}
+/** Gate commands that name a `package.json` script the project does not have. */
+export function unresolvedGateCommands(commands, scripts) {
+    if (scripts === undefined)
+        return [];
+    const unresolved = [];
+    for (const command of commands) {
+        const script = scriptNameOf(command);
+        if (script !== undefined && !(script in scripts))
+            unresolved.push(command);
+    }
+    return unresolved;
+}
+export function checkGate(commands, scripts) {
+    const id = "gate";
+    const label = "gate";
+    if (commands.length === 0) {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: "[gate].commands is empty; nothing verifies an agent's changes",
+            fix: "add CI-mirroring commands to [gate].commands in ghostrail.toml",
+        };
+    }
+    const unresolved = unresolvedGateCommands(commands, scripts);
+    if (unresolved.length > 0) {
+        return {
+            id,
+            label,
+            status: "warn",
+            detail: `no matching package.json script for: ${unresolved.join(", ")}`,
+            fix: "add the missing script(s) to package.json, or fix the gate command",
+        };
+    }
+    return { id, label, status: "pass", detail: `${commands.length} gate command(s) configured` };
+}
+export function checkBackend(facts) {
+    const id = "backend";
+    const label = "backend";
+    if (facts.kind !== "container") {
+        return { id, label, status: "pass", detail: `${facts.kind} needs no image` };
+    }
+    if (facts.quick) {
+        return { id, label, status: "warn", detail: "skipped docker/image checks (--quick)" };
+    }
+    if (facts.dockerAvailable === false) {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: "docker is not reachable",
+            fix: "start Docker; `docker version` should succeed",
+        };
+    }
+    if (facts.image === undefined) {
+        return {
+            id,
+            label,
+            status: "warn",
+            detail: `using the default ${DEFAULT_CONTAINER_IMAGE} image, which has no node, pnpm, git, gh, or claude, so a run will provision and then fail at the gate`,
+            fix: "set [backend].image, or build the shipped image with `ghostrail image build`",
+        };
+    }
+    if (facts.imagePresent === false) {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: `image ${facts.image} not found locally`,
+            fix: `ghostrail image build --tag ${facts.image}`,
+        };
+    }
+    return { id, label, status: "pass", detail: `image ${facts.image} present, docker reachable` };
+}
+export function checkClaudeProfile(facts) {
+    const id = "claude-profile";
+    const label = "claude profile";
+    if (!facts.present) {
+        return {
+            id,
+            label,
+            status: "pass",
+            detail: "no ghostrail Claude profile in use; runs use your normal ~/.claude",
+        };
+    }
+    const redirectNote = "runs redirect HOME (and pass --settings) at this profile, which carries no " +
+        ".credentials.json by design, so only ANTHROPIC_API_KEY / CLAUDE_CODE_OAUTH_TOKEN " +
+        "survive that redirect; an interactive login in your real home is invisible to the agent";
+    if (facts.missingPins.length > 0) {
+        return {
+            id,
+            label,
+            status: "warn",
+            detail: `${redirectNote}. Requested via --pin but not installed: ${facts.missingPins.join(", ")}`,
+            fix: `ghostrail claude-setup --pin ${facts.missingPins.join(" --pin ")} --write`,
+        };
+    }
+    return { id, label, status: "pass", detail: redirectNote };
+}
+/** Whether a raw env value is unset, present-but-blank, or a real value. Never returns the value. */
+export function classifyCredential(value) {
+    if (value === undefined)
+        return "unset";
+    return value.trim().length === 0 ? "blank" : "set";
+}
+export function checkClaudeAuthCredential(anthropicApiKey, oauthToken) {
+    const id = "credential:claude-auth";
+    const label = "credential (claude auth)";
+    const apiKey = classifyCredential(anthropicApiKey);
+    const oauth = classifyCredential(oauthToken);
+    if (apiKey === "blank") {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: "ANTHROPIC_API_KEY is set but empty",
+            fix: "unset ANTHROPIC_API_KEY or give it a real value",
+        };
+    }
+    if (oauth === "blank") {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: "CLAUDE_CODE_OAUTH_TOKEN is set but empty",
+            fix: "unset CLAUDE_CODE_OAUTH_TOKEN, or run `claude setup-token`",
+        };
+    }
+    if (apiKey === "unset" && oauth === "unset") {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: "neither ANTHROPIC_API_KEY nor CLAUDE_CODE_OAUTH_TOKEN is set",
+            fix: "run `claude setup-token`, or set ANTHROPIC_API_KEY",
+        };
+    }
+    if (apiKey === "set" && oauth === "set") {
+        return {
+            id,
+            label,
+            status: "warn",
+            detail: "ANTHROPIC_API_KEY is set alongside CLAUDE_CODE_OAUTH_TOKEN; the API key wins, so a stale key silently beats a good token",
+            fix: "unset ANTHROPIC_API_KEY to bill the Pro/Max subscription via the OAuth token",
+        };
+    }
+    return {
+        id,
+        label,
+        status: "pass",
+        detail: `using ${apiKey === "set" ? "ANTHROPIC_API_KEY" : "CLAUDE_CODE_OAUTH_TOKEN"}`,
+    };
+}
+export function checkLinearCredential(linearApiKey) {
+    const id = "credential:linear";
+    const label = "credential (linear)";
+    const shape = classifyCredential(linearApiKey);
+    if (shape === "unset") {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: "LINEAR_API_KEY is not set; required for every run",
+            fix: "ghostrail secrets-setup --write",
+        };
+    }
+    if (shape === "blank") {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: "LINEAR_API_KEY is set but empty",
+            fix: "unset LINEAR_API_KEY or give it a real value",
+        };
+    }
+    return { id, label, status: "pass", detail: "LINEAR_API_KEY is set" };
+}
+export function checkGithubCredential(ghToken, githubToken) {
+    const id = "credential:github";
+    const label = "credential (github)";
+    const gh = classifyCredential(ghToken);
+    const github = classifyCredential(githubToken);
+    if (gh === "blank") {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: "GH_TOKEN is set but empty",
+            fix: "unset GH_TOKEN or give it a real value",
+        };
+    }
+    if (github === "blank") {
+        return {
+            id,
+            label,
+            status: "fail",
+            detail: "GITHUB_TOKEN is set but empty",
+            fix: "unset GITHUB_TOKEN or give it a real value",
+        };
+    }
+    if (gh === "unset" && github === "unset") {
+        return {
+            id,
+            label,
+            status: "warn",
+            detail: "neither GH_TOKEN nor GITHUB_TOKEN is set; publishing a PR will fail",
+            fix: "ghostrail secrets-setup --write",
+        };
+    }
+    return {
+        id,
+        label,
+        status: "pass",
+        detail: `using ${gh === "set" ? "GH_TOKEN" : "GITHUB_TOKEN"}`,
+    };
+}
+export function checkClaudeProbe(result, backendKind) {
+    const id = "probe:claude-auth";
+    const label = "probe (claude auth)";
+    switch (result.kind) {
+        case "not-run":
+            return {
+                id,
+                label,
+                status: "warn",
+                detail: "not run: no claude credential is set",
+            };
+        case "skipped":
+            return {
+                id,
+                label,
+                status: "warn",
+                detail: "skipped (--quick); presence of a credential does not mean it authenticates",
+            };
+        case "ok":
+            return {
+                id,
+                label,
+                status: "pass",
+                detail: `claude -p answered inside the configured backend (${backendKind})`,
+            };
+        case "invalid-token":
+            return {
+                id,
+                label,
+                status: "fail",
+                detail: `claude -p failed inside the configured backend (${backendKind}): 401 Invalid bearer token`,
+                fix: "the token is expired or revoked; run `claude setup-token`",
+            };
+        case "error":
+            return {
+                id,
+                label,
+                status: "fail",
+                detail: `claude -p failed inside the configured backend (${backendKind}): ${result.message}`,
+            };
+    }
+}
+export function checkLinearProbe(result) {
+    const id = "probe:linear-auth";
+    const label = "probe (linear auth)";
+    switch (result.kind) {
+        case "not-run":
+            return { id, label, status: "warn", detail: "not run: LINEAR_API_KEY is not usable" };
+        case "skipped":
+            return { id, label, status: "warn", detail: "skipped (--quick)" };
+        case "ok":
+            return { id, label, status: "pass", detail: "LINEAR_API_KEY authenticated" };
+        case "unauthorized":
+            return {
+                id,
+                label,
+                status: "fail",
+                detail: "LINEAR_API_KEY was rejected (unauthorized)",
+                fix: "generate a new key at Linear Settings > Security & Access",
+            };
+        case "error":
+            return {
+                id,
+                label,
+                status: "fail",
+                detail: `LINEAR_API_KEY probe failed: ${result.message}`,
+            };
+    }
+}
+const HISTORY_SAMPLE = 5;
+export function checkHistory(rows) {
+    const id = "history";
+    const label = "recent history";
+    if (rows.length === 0) {
+        return {
+            id,
+            label,
+            status: "pass",
+            detail: "no run history yet (the store is empty or absent, not evidence of health)",
+        };
+    }
+    const sample = rows.slice(0, HISTORY_SAMPLE);
+    const states = sample.map((row) => row.state ?? "unknown").join(", ");
+    const mostRecent = sample[0];
+    if (mostRecent?.state === "failed") {
+        const error = mostRecent.error ?? "no error was recorded for it";
+        return {
+            id,
+            label,
+            status: "warn",
+            detail: `recent runs: ${states}. The most recent run failed: ${error}`,
+        };
+    }
+    return { id, label, status: "pass", detail: `recent runs: ${states}` };
+}
+//# sourceMappingURL=checks.js.map

package/dist/doctor/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/doctor/checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAM/D,MAAM,UAAU,WAAW,CACzB,MAAoE;IAEpE,MAAM,EAAE,GAAG,QAAQ,CAAC;IACpB,MAAM,KAAK,GAAG,QAAQ,CAAC;IACvB,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;SACzB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,KAAK,CAAC,IAAI,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;SAC7E,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,EAAE;QACF,KAAK;QACL,MAAM,EAAE,MAAM;QACd,MAAM;QACN,GAAG,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,oBAAoB;KAC1F,CAAC;AACJ,CAAC;AAWD,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,IAAgB;IAC1C,MAAM,EAAE,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC,KAAK,GAAG,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,iBAAiB;YACrC,GAAG,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,0EAA0E;YAC9F,GAAG,EAAE,WAAW,IAAI,CAAC,IAAI,gBAAgB;SAC1C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,0BAA0B,EAAE,CAAC;AACvF,CAAC;AAED,6EAA6E;AAC7E,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,SAAS;IACT,IAAI;IACJ,KAAK;IACL,QAAQ;IACR,IAAI;IACJ,KAAK;IACL,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,UAAU;IACV,MAAM;IACN,IAAI;IACJ,KAAK;IACL,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACjE,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QAC9D,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CACpC,QAA2B,EAC3B,OAA4C;IAE5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,QAA2B,EAC3B,OAA4C;IAE5C,MAAM,EAAE,GAAG,MAAM,CAAC;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC;IACrB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,+DAA+D;YACvE,GAAG,EAAE,gEAAgE;SACtE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,wCAAwC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACvE,GAAG,EAAE,oEAAoE;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,6BAA6B,EAAE,CAAC;AAChG,CAAC;AAYD,MAAM,UAAU,YAAY,CAAC,KAAmB;IAC9C,MAAM,EAAE,GAAG,SAAS,CAAC;IACrB,MAAM,KAAK,GAAG,SAAS,CAAC;IACxB,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,iBAAiB,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;QACpC,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,yBAAyB;YACjC,GAAG,EAAE,+CAA+C;SACrD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,qBAAqB,uBAAuB,wGAAwG;YAC5J,GAAG,EAAE,8EAA8E;SACpF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACjC,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,SAAS,KAAK,CAAC,KAAK,oBAAoB;YAChD,GAAG,EAAE,+BAA+B,KAAK,CAAC,KAAK,EAAE;SAClD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,CAAC,KAAK,4BAA4B,EAAE,CAAC;AACjG,CAAC;AAQD,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,MAAM,EAAE,GAAG,gBAAgB,CAAC;IAC5B,MAAM,KAAK,GAAG,gBAAgB,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,oEAAoE;SAC7E,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAChB,6EAA6E;QAC7E,mFAAmF;QACnF,yFAAyF,CAAC;IAC5F,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,YAAY,4CAA4C,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACjG,GAAG,EAAE,gCAAgC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU;SACjF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC7D,CAAC;AAID,qGAAqG;AACrG,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,eAAmC,EACnC,UAA8B;IAE9B,MAAM,EAAE,GAAG,wBAAwB,CAAC;IACpC,MAAM,KAAK,GAAG,0BAA0B,CAAC;IACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAE7C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,oCAAoC;YAC5C,GAAG,EAAE,iDAAiD;SACvD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,0CAA0C;YAClD,GAAG,EAAE,4DAA4D;SAClE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,8DAA8D;YACtE,GAAG,EAAE,oDAAoD;SAC1D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACxC,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,0HAA0H;YAC5H,GAAG,EAAE,8EAA8E;SACpF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE;QACF,KAAK;QACL,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB,EAAE;KACtF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAgC;IACpE,MAAM,EAAE,GAAG,mBAAmB,CAAC;IAC/B,MAAM,KAAK,GAAG,qBAAqB,CAAC;IACpC,MAAM,KAAK,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,mDAAmD;YAC3D,GAAG,EAAE,iCAAiC;SACvC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,iCAAiC;YACzC,GAAG,EAAE,8CAA8C;SACpD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAA2B,EAC3B,WAA+B;IAE/B,MAAM,EAAE,GAAG,mBAAmB,CAAC;IAC/B,MAAM,KAAK,GAAG,qBAAqB,CAAC;IACpC,MAAM,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,2BAA2B;YACnC,GAAG,EAAE,wCAAwC;SAC9C,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,+BAA+B;YACvC,GAAG,EAAE,4CAA4C;SAClD,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,qEAAqE;YAC7E,GAAG,EAAE,iCAAiC;SACvC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE;QACF,KAAK;QACL,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,SAAS,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,EAAE;KAC9D,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,gBAAgB,CAAC,MAAyB,EAAE,WAAwB;IAClF,MAAM,EAAE,GAAG,mBAAmB,CAAC;IAC/B,MAAM,KAAK,GAAG,qBAAqB,CAAC;IACpC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO;gBACL,EAAE;gBACF,KAAK;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,sCAAsC;aAC/C,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO;gBACL,EAAE;gBACF,KAAK;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,4EAA4E;aACrF,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,EAAE;gBACF,KAAK;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,qDAAqD,WAAW,GAAG;aAC5E,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,EAAE;gBACF,KAAK;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,mDAAmD,WAAW,6BAA6B;gBACnG,GAAG,EAAE,2DAA2D;aACjE,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,EAAE;gBACF,KAAK;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,mDAAmD,WAAW,MAAM,MAAM,CAAC,OAAO,EAAE;aAC7F,CAAC;IACN,CAAC;AACH,CAAC;AASD,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IACxD,MAAM,EAAE,GAAG,mBAAmB,CAAC;IAC/B,MAAM,KAAK,GAAG,qBAAqB,CAAC;IACpC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;QACxF,KAAK,SAAS;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACpE,KAAK,IAAI;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC/E,KAAK,cAAc;YACjB,OAAO;gBACL,EAAE;gBACF,KAAK;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,4CAA4C;gBACpD,GAAG,EAAE,2DAA2D;aACjE,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,EAAE;gBACF,KAAK;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,gCAAgC,MAAM,CAAC,OAAO,EAAE;aACzD,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,UAAU,YAAY,CAAC,IAAuB;IAClD,MAAM,EAAE,GAAG,SAAS,CAAC;IACrB,MAAM,KAAK,GAAG,gBAAgB,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,2EAA2E;SACpF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,UAAU,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,8BAA8B,CAAC;QACjE,OAAO;YACL,EAAE;YACF,KAAK;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,gBAAgB,MAAM,iCAAiC,KAAK,EAAE;SACvE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,MAAM,EAAE,EAAE,CAAC;AACzE,CAAC"}

package/dist/doctor/index.d.ts

@@ -0,0 +1,6 @@
+export { checkBackend, checkClaudeAuthCredential, checkClaudeProbe, checkClaudeProfile, checkConfig, checkGate, checkGithubCredential, checkHistory, checkLinearCredential, checkLinearProbe, checkPrompt, type ClaudeProbeResult, classifyCredential, type CredentialShape, type LinearProbeResult, type PromptField, scriptNameOf, unresolvedGateCommands, } from "./checks.js";
+export { claudeProbeInvocation, isCommitted, isDockerAvailable, isImagePresent, interpretClaudeProbe, probeClaudeAuth, probeLinearAuth, readPackageScripts, } from "./probes.js";
+export { hasFailure, orderedFixes, renderDoctorJson, renderDoctorText } from "./report.js";
+export { type DoctorDeps, type DoctorRunOptions, runDoctor } from "./run.js";
+export type { DoctorCheck, DoctorReport, DoctorStatus } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/doctor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/doctor/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,YAAY,EACZ,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC7E,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/doctor/index.js

@@ -0,0 +1,5 @@
+export { checkBackend, checkClaudeAuthCredential, checkClaudeProbe, checkClaudeProfile, checkConfig, checkGate, checkGithubCredential, checkHistory, checkLinearCredential, checkLinearProbe, checkPrompt, classifyCredential, scriptNameOf, unresolvedGateCommands, } from "./checks.js";
+export { claudeProbeInvocation, isCommitted, isDockerAvailable, isImagePresent, interpretClaudeProbe, probeClaudeAuth, probeLinearAuth, readPackageScripts, } from "./probes.js";
+export { hasFailure, orderedFixes, renderDoctorJson, renderDoctorText } from "./report.js";
+export { runDoctor } from "./run.js";
+//# sourceMappingURL=index.js.map

package/dist/doctor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/doctor/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EAEX,kBAAkB,EAIlB,YAAY,EACZ,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAA0C,SAAS,EAAE,MAAM,UAAU,CAAC"}

package/dist/doctor/probes.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The I/O doctor's checks are built on: git, docker, a real `claude -p` call,
+ * and a Linear GraphQL query. Each is a free function so `run.ts` can swap in a
+ * fake for tests — nothing here is ever exercised by the test suite for real.
+ */
+import type { ExecOptions, ExecResult } from "../backend/types.js";
+import type { BackendKind } from "../config/schema.js";
+import type { ClaudeProbeResult, LinearProbeResult } from "./checks.js";
+/** Whether `relPath` is present in the repo's `HEAD` tree (not merely on disk). */
+export declare function isCommitted(repoPath: string, relPath: string): Promise<boolean>;
+/** The repo's `package.json` `scripts` table, or undefined if there is none to read. */
+export declare function readPackageScripts(repoPath: string): Promise<Record<string, unknown> | undefined>;
+/** True if the Docker CLI and daemon are reachable. */
+export declare function isDockerAvailable(): Promise<boolean>;
+/** True if `image` is present in the local Docker image store. */
+export declare function isImagePresent(image: string): Promise<boolean>;
+export interface ClaudeAuthProbeOptions {
+    backendKind: BackendKind;
+    /** The configured (or default) container image; ignored for a non-container backend. */
+    image?: string;
+    /** The environment to read ANTHROPIC_API_KEY / CLAUDE_CODE_OAUTH_TOKEN from. */
+    env: Record<string, string | undefined>;
+    timeoutMs?: number;
+}
+/**
+ * The command (and its exec options) a `claude -p` auth probe would run for the
+ * given backend: directly on the host for anything other than `container`,
+ * inside a disposable `docker run --rm` for `container` — the whole point being
+ * that a container only ever receives forwarded env vars, so a host-side login
+ * proves nothing about it. Pure: builds the invocation, never runs it.
+ */
+export declare function claudeProbeInvocation(options: ClaudeAuthProbeOptions): {
+    command: string[];
+    execOptions: ExecOptions;
+};
+/** Run the probe {@link claudeProbeInvocation} builds, and classify the result. */
+export declare function probeClaudeAuth(options: ClaudeAuthProbeOptions): Promise<ClaudeProbeResult>;
+/** Classify a `claude -p` probe's raw result into a {@link ClaudeProbeResult}. */
+export declare function interpretClaudeProbe(result: ExecResult): ClaudeProbeResult;
+/** Send one cheap authenticated Linear query to check the key actually works. */
+export declare function probeLinearAuth(apiKey: string, fetchImpl?: typeof fetch): Promise<LinearProbeResult>;
+//# sourceMappingURL=probes.d.ts.map

package/dist/doctor/probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probes.d.ts","sourceRoot":"","sources":["../../src/doctor/probes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAExE,mFAAmF;AACnF,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIrF;AAED,wFAAwF;AACxF,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAW9C;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAEpD;AAED,kEAAkE;AAClE,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGpE;AAKD,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,WAAW,CAAC;IACzB,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG;IACtE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;CAC1B,CAmBA;AAED,mFAAmF;AACnF,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAIjG;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAQ1E;AAID,iFAAiF;AACjF,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CA2B5B"}

package/dist/doctor/probes.js

@@ -0,0 +1,136 @@
+/**
+ * The I/O doctor's checks are built on: git, docker, a real `claude -p` call,
+ * and a Linear GraphQL query. Each is a free function so `run.ts` can swap in a
+ * fake for tests — nothing here is ever exercised by the test suite for real.
+ */
+import { readFile } from "node:fs/promises";
+import { join, sep } from "node:path";
+import { describeAgentFailure } from "../agent/failure.js";
+import { ContainerBackend } from "../backend/container.js";
+import { DEFAULT_CONTAINER_IMAGE } from "../backend/docker.js";
+import { spawnCollect } from "../backend/proc.js";
+/** Whether `relPath` is present in the repo's `HEAD` tree (not merely on disk). */
+export async function isCommitted(repoPath, relPath) {
+    const posixPath = relPath.split(sep).join("/");
+    const result = await spawnCollect(["git", "-C", repoPath, "cat-file", "-e", `HEAD:${posixPath}`]);
+    return result.exitCode === 0;
+}
+/** The repo's `package.json` `scripts` table, or undefined if there is none to read. */
+export async function readPackageScripts(repoPath) {
+    try {
+        const raw = await readFile(join(repoPath, "package.json"), "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed.scripts !== null && typeof parsed.scripts === "object") {
+            return parsed.scripts;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** True if the Docker CLI and daemon are reachable. */
+export function isDockerAvailable() {
+    return ContainerBackend.isAvailable();
+}
+/** True if `image` is present in the local Docker image store. */
+export async function isImagePresent(image) {
+    const result = await spawnCollect(["docker", "image", "inspect", image]);
+    return result.exitCode === 0;
+}
+const PROBE_PROMPT = "Reply with exactly the single word: ok";
+const DEFAULT_PROBE_TIMEOUT_MS = 30_000;
+function forwardedClaudeAuth(env) {
+    const out = {};
+    for (const key of ["ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"]) {
+        const value = env[key];
+        if (value !== undefined && value.trim().length > 0)
+            out[key] = value;
+    }
+    return out;
+}
+/** `-e KEY=VALUE` flags for each forwarded env entry, in insertion order. */
+function dockerEnvFlags(env) {
+    const flags = [];
+    for (const [key, value] of Object.entries(env))
+        flags.push("-e", `${key}=${value}`);
+    return flags;
+}
+/**
+ * The command (and its exec options) a `claude -p` auth probe would run for the
+ * given backend: directly on the host for anything other than `container`,
+ * inside a disposable `docker run --rm` for `container` — the whole point being
+ * that a container only ever receives forwarded env vars, so a host-side login
+ * proves nothing about it. Pure: builds the invocation, never runs it.
+ */
+export function claudeProbeInvocation(options) {
+    const forwarded = forwardedClaudeAuth(options.env);
+    const timeoutMs = options.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
+    const claudeArgs = ["claude", "-p", PROBE_PROMPT, "--output-format", "json"];
+    if (options.backendKind === "container") {
+        return {
+            command: [
+                "docker",
+                "run",
+                "--rm",
+                ...dockerEnvFlags(forwarded),
+                options.image ?? DEFAULT_CONTAINER_IMAGE,
+                ...claudeArgs,
+            ],
+            execOptions: { timeoutMs },
+        };
+    }
+    return { command: claudeArgs, execOptions: { env: forwarded, timeoutMs } };
+}
+/** Run the probe {@link claudeProbeInvocation} builds, and classify the result. */
+export async function probeClaudeAuth(options) {
+    const { command, execOptions } = claudeProbeInvocation(options);
+    const result = await spawnCollect(command, execOptions);
+    return interpretClaudeProbe(result);
+}
+/** Classify a `claude -p` probe's raw result into a {@link ClaudeProbeResult}. */
+export function interpretClaudeProbe(result) {
+    if (result.exitCode === 0)
+        return { kind: "ok" };
+    const text = `${result.stdout}\n${result.stderr}`;
+    if (/401/.test(text) && /invalid bearer token/i.test(text))
+        return { kind: "invalid-token" };
+    return {
+        kind: "error",
+        message: describeAgentFailure(result.exitCode, result.stdout, result.stderr),
+    };
+}
+const LINEAR_PROBE_BODY = JSON.stringify({ query: "{ viewer { id } }" });
+/** Send one cheap authenticated Linear query to check the key actually works. */
+export async function probeLinearAuth(apiKey, fetchImpl = fetch) {
+    let response;
+    try {
+        response = await fetchImpl("https://api.linear.app/graphql", {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: apiKey },
+            body: LINEAR_PROBE_BODY,
+        });
+    }
+    catch (error) {
+        return { kind: "error", message: error instanceof Error ? error.message : String(error) };
+    }
+    if (response.status === 401)
+        return { kind: "unauthorized" };
+    if (!response.ok)
+        return { kind: "error", message: `HTTP ${response.status}` };
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        return { kind: "ok" };
+    }
+    const firstError = body.errors?.[0]?.message;
+    if (firstError !== undefined) {
+        return /auth/i.test(firstError)
+            ? { kind: "unauthorized" }
+            : { kind: "error", message: firstError };
+    }
+    return { kind: "ok" };
+}
+//# sourceMappingURL=probes.js.map

package/dist/doctor/probes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probes.js","sourceRoot":"","sources":["../../src/doctor/probes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKlD,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,OAAe;IACjE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,SAAS,EAAE,CAAC,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACxD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAClE,OAAO,MAAM,CAAC,OAAkC,CAAC;QACnD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,gBAAgB,CAAC,WAAW,EAAE,CAAC;AACxC,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAC9D,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAWxC,SAAS,mBAAmB,CAAC,GAAuC;IAClE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,yBAAyB,CAAU,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CAAC,GAA2B;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IAInE,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,wBAAwB,CAAC;IAChE,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAE7E,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACxC,OAAO;YACL,OAAO,EAAE;gBACP,QAAQ;gBACR,KAAK;gBACL,MAAM;gBACN,GAAG,cAAc,CAAC,SAAS,CAAC;gBAC5B,OAAO,CAAC,KAAK,IAAI,uBAAuB;gBACxC,GAAG,UAAU;aACd;YACD,WAAW,EAAE,EAAE,SAAS,EAAE;SAC3B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA+B;IACnE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAClD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC7F,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAEzE,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,YAA0B,KAAK;IAE/B,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,gCAAgC,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,EAAE;YACtE,IAAI,EAAE,iBAAiB;SACxB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAE/E,IAAI,IAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IAC7C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE;YAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}

package/dist/doctor/report.d.ts

@@ -0,0 +1,13 @@
+import type { DoctorReport } from "./types.js";
+export declare function hasFailure(report: DoctorReport): boolean;
+/**
+ * Every check's fix, most blocking first: every `fail` check's fix in check
+ * order, then every `warn` check's fix in check order. A check with no `fix`
+ * (typically a `pass`) contributes nothing.
+ */
+export declare function orderedFixes(report: DoctorReport): string[];
+/** One line per check, then an ordered "fix this first" list. */
+export declare function renderDoctorText(report: DoctorReport): string;
+/** Machine-readable form, for a wrapper or the board to render. */
+export declare function renderDoctorJson(report: DoctorReport): string;
+//# sourceMappingURL=report.d.ts.map