ima2-gen 3.13.1 → 3.14.0

package/bin/commands/upscale.js

@@ -4,9 +4,9 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { parseArgs } from "../lib/args.js";
-import { resolveServer } from "../lib/client.js";
+import { resolveServer, fetchServer } from "../lib/client.js";
 import { runMcpJob } from "../lib/mcpJob.js";
-import { color, die, fail, json, out } from "../lib/output.js";
+import { color, die, exitCodeForError, fail, json, out } from "../lib/output.js";
 import { createCliRequestId } from "../lib/recover-output.js";
 const MCP_UPSCALE_TIMEOUT_MS = 5 * 60_000 + 120_000 + 30_000;
 const SCALE_FACTORS = new Set(["2", "4", "8", "16"]);
@@ -51,11 +51,24 @@ function parsePercent(value, label) {
     return n;
 }
 export default async function upscaleCmd(argv) {
+    try {
+        await upscale(argv);
+    }
+    catch (error) {
+        if (!(error instanceof Error))
+            throw error;
+        fail({ json: argv.includes("--json"), code: error.code ?? "MCP_UPSCALE_FAILED",
+            message: error.message, exitCode: exitCodeForError(error) });
+    }
+}
+async function upscale(argv) {
     const args = parseArgs(argv, SPEC);
     if (args.help) {
         out(HELP);
         return;
     }
+    if (args._unknown.length)
+        die(2, `unknown option: ${args._unknown[0]}`);
     const file = args.positional[0];
     if (!file)
         die(2, "usage: ima2 upscale <generated-file> [options]");
@@ -106,7 +119,7 @@ export default async function upscaleCmd(argv) {
         });
         const target = args.out ? String(args.out) : args["out-dir"] ? join(String(args["out-dir"]), result.filename) : undefined;
         if (target) {
-            const response = await fetch(`${server.base}${result.url}`);
+            const response = await fetchServer(server.base, result.url);
             if (!response.ok)
                 die(1, `failed to download result: HTTP ${response.status}`);
             await mkdir(dirname(target), { recursive: true });
@@ -119,6 +132,7 @@ export default async function upscaleCmd(argv) {
     }
     catch (error) {
         const typed = error;
-        fail({ json: Boolean(args.json), code: typed.code ?? "MCP_UPSCALE_FAILED", message: typed.message, exitCode: 1 });
+        fail({ json: Boolean(args.json), code: typed.code ?? "MCP_UPSCALE_FAILED", message: typed.message,
+            exitCode: exitCodeForError(error) === 4 ? 4 : 1 });
     }
 }

package/bin/commands/video.js

@@ -1,7 +1,7 @@
 import { parseArgs } from "../lib/args.js";
-import { resolveServer } from "../lib/client.js";
+import { resolveServer, fetchServer } from "../lib/client.js";
 import { streamSse } from "../lib/sse.js";
-import { out, die, color, exitCodeForError } from "../lib/output.js";
+import { out, die, color, exitCodeForError, fail } from "../lib/output.js";
 import { writeFile, mkdir, readFile, stat } from "node:fs/promises";
 import { basename, dirname } from "node:path";
 import { runVideoGenerate } from "../lib/videoMcp.js";
@@ -69,10 +69,21 @@ async function writeBuffer(path, buf) {
 }
 async function downloadReturnedVideo(serverBase, data, outPath, signal) {
     const rawUrl = typeof data.url === "string" ? data.url : "";
-    const url = rawUrl.startsWith("/") ? `${serverBase}${rawUrl}` : rawUrl;
-    if (!url)
+    if (!rawUrl)
         die(1, "server did not return a video url");
-    const res = await fetch(url, { signal });
+    let url;
+    try {
+        url = new URL(rawUrl, `${serverBase}/`);
+        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password)
+            throw new Error();
+    }
+    catch {
+        die(1, "server returned an invalid video url");
+    }
+    // External signed media retains its query, but never inherits server credentials.
+    const res = url.origin === new URL(serverBase).origin
+        ? await fetchServer(serverBase, url.href, { signal })
+        : await fetch(url.href, { signal, credentials: "omit", redirect: "error" });
     if (!res.ok)
         die(1, `failed to download video: HTTP ${res.status}`);
     await writeBuffer(outPath, Buffer.from(await res.arrayBuffer()));
@@ -171,6 +182,17 @@ const HELP = `
     ima2 video analyze 1780226256355_50252101.mp4
 `;
 export default async function videoCmd(argv) {
+    try {
+        await dispatchVideo(argv);
+    }
+    catch (error) {
+        if (!(error instanceof Error))
+            throw error;
+        fail({ json: argv.includes("--json"), code: error.code ?? "VIDEO_FAILED",
+            message: error.message, exitCode: exitCodeForError(error) });
+    }
+}
+async function dispatchVideo(argv) {
     const sub = argv[0];
     if (sub === "edit")
         return videoEditCmd(argv.slice(1));
@@ -249,15 +271,8 @@ async function videoEditCmd(argv) {
     if (!args.video)
         die(2, "--video <url> is required");
     parseTimeoutSeconds(args.timeout);
-    let server;
-    try {
-        server = await resolveServer({ serverFlag: args.server });
-    }
-    catch (e) {
-        die(exitCodeForError(e), e.message);
-        throw e;
-    }
-    const res = await fetch(`${server.base}/api/video/edit`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ prompt, videoUrl: args.video }), signal: timeoutSignal(args.timeout) });
+    const server = await resolveServer({ serverFlag: args.server });
+    const res = await fetchServer(server.base, "/api/video/edit", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ prompt, videoUrl: args.video }), signal: timeoutSignal(args.timeout) });
     const data = await readJsonResponse(res, "edit");
     if (!res.ok)
         die(1, `edit failed: ${data.error ?? res.status}`);
@@ -288,15 +303,8 @@ async function videoExtendCmd(argv) {
     if (duration < 2 || duration > 10)
         die(2, "--duration must be between 2 and 10");
     parseTimeoutSeconds(args.timeout);
-    let server;
-    try {
-        server = await resolveServer({ serverFlag: args.server });
-    }
-    catch (e) {
-        die(exitCodeForError(e), e.message);
-        throw e;
-    }
-    const res = await fetch(`${server.base}/api/video/extend`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ prompt, videoUrl: args.video, duration }), signal: timeoutSignal(args.timeout) });
+    const server = await resolveServer({ serverFlag: args.server });
+    const res = await fetchServer(server.base, "/api/video/extend", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ prompt, videoUrl: args.video, duration }), signal: timeoutSignal(args.timeout) });
     const data = await readJsonResponse(res, "extend");
     if (!res.ok)
         die(1, `extend failed: ${data.error ?? res.status}`);
@@ -354,14 +362,7 @@ async function videoContinueCmd(argv) {
     const model = args.model ? canonicalVideoModel(String(args.model)) : GROK_VIDEO_MODEL_BASE;
     validateCliVideoResolution(model, resolution, "image-to-video");
     parseTimeoutSeconds(args.timeout);
-    let server;
-    try {
-        server = await resolveServer({ serverFlag: args.server });
-    }
-    catch (e) {
-        die(exitCodeForError(e), e.message);
-        throw e;
-    }
+    const server = await resolveServer({ serverFlag: args.server });
     const requestId = `req_cli_video_continue_${Date.now().toString(36)}`;
     const body = {
         prompt,
@@ -407,14 +408,7 @@ async function videoFrameCmd(argv) {
     if (position !== "last" && !/^\d+(\.\d+)?$/.test(position))
         die(2, "--position must be a non-negative number");
     parseTimeoutSeconds(args.timeout);
-    let server;
-    try {
-        server = await resolveServer({ serverFlag: args.server });
-    }
-    catch (e) {
-        die(exitCodeForError(e), e.message);
-        throw e;
-    }
+    const server = await resolveServer({ serverFlag: args.server });
     // A path that exists on disk is uploaded; anything else is treated as a
     // generated filename the server can resolve itself. Before this, a clip saved
     // with -o was rejected as "not found" while sitting in the current directory,
@@ -427,13 +421,13 @@ async function videoFrameCmd(argv) {
     }
     catch { /* not a local path; fall through to the generated-file lookup */ }
     const res = localBytes
-        ? await fetch(`${server.base}/api/video/frame`, {
+        ? await fetchServer(server.base, "/api/video/frame", {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({ video: localBytes.toString("base64"), position }),
             signal: timeoutSignal(args.timeout),
         })
-        : await fetch(`${server.base}/api/video/frame?file=${encodeURIComponent(file)}&position=${encodeURIComponent(position)}`, { signal: timeoutSignal(args.timeout) });
+        : await fetchServer(server.base, `/api/video/frame?file=${encodeURIComponent(file)}&position=${encodeURIComponent(position)}`, { signal: timeoutSignal(args.timeout) });
     if (!res.ok) {
         const payload = await readJsonResponse(res, "frame extraction");
         const detail = payload.error ?? String(res.status);
@@ -459,15 +453,8 @@ async function videoAnalyzeCmd(argv) {
     if (!videoUrl)
         die(2, "generated video filename required");
     parseTimeoutSeconds(args.timeout);
-    let server;
-    try {
-        server = await resolveServer({ serverFlag: args.server });
-    }
-    catch (e) {
-        die(exitCodeForError(e), e.message);
-        throw e;
-    }
-    const res = await fetch(`${server.base}/api/video/analyze`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ videoUrl }), signal: timeoutSignal(args.timeout) });
+    const server = await resolveServer({ serverFlag: args.server });
+    const res = await fetchServer(server.base, "/api/video/analyze", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ videoUrl }), signal: timeoutSignal(args.timeout) });
     const data = await readJsonResponse(res, "analyze");
     if (!res.ok)
         die(1, `analyze failed: ${data.error || res.status}`);

package/bin/ima2.js

@@ -7,16 +7,41 @@ import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { spawn, execFileSync } from "child_process";
 import { confirmDestructiveAction } from "./lib/destructive-confirm.js";
-import { doctor } from "./commands/doctor.js";
 import { openUrl, killProcessTree } from "./lib/platform.js";
-import { maybePromptGithubStar } from "./lib/star-prompt.js";
 import { ensureFreshUiDist } from "./lib/ui-build.js";
 import { codexFileLoginArgs, detectCodexAuth } from "../lib/codexDetect.js";
 import { packageCliCommand } from "../lib/packageCli.js";
-import { config as runtimeConfig } from "../config.js";
 import { errInfo } from "../lib/errInfo.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ROOT = join(__dirname, "..");
+let pkg = { version: "?", name: "ima2-gen" };
+try {
+    const metadata = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf-8"));
+    if (metadata && typeof metadata.version === "string" && typeof metadata.name === "string")
+        pkg = metadata;
+}
+catch { }
+// Installation diagnosis must run before any account/config initialization.
+if (process.argv[2] === "doctor" && process.argv.slice(3).includes("--installation")) {
+    const options = process.argv.slice(3);
+    const allowed = new Set(["--installation", "--json", "--help", "-h"]);
+    if (options.some((option) => !allowed.has(option)) || new Set(options).size !== options.length) {
+        console.error("Installation doctor accepts only --installation, --json and --help.");
+        exitFlushed(2);
+    }
+    if (options.includes("--help") || options.includes("-h")) {
+        console.log("Usage: ima2 doctor --installation [--json]\nOffline package, Node, native binding, skill and UI checks. No config, account or network checks.");
+        exitFlushed(0);
+    }
+    const { buildInstallationDoctorLines } = await import("./lib/doctor-runtime.js");
+    const { buildDoctorReport, renderDoctorReport } = await import("./lib/doctor-report.js");
+    const report = buildDoctorReport({ version: pkg.version, mode: "installation", lines: buildInstallationDoctorLines(ROOT) });
+    console.log(options.includes("--json") ? JSON.stringify(report) : renderDoctorReport(report));
+    exitFlushed(report.summary.exitCode);
+}
+const { config: runtimeConfig } = await import("../config.js");
+const { doctor } = await import("./commands/doctor.js");
+const { maybePromptGithubStar } = await import("./lib/star-prompt.js");
 // Config lives under runtimeConfig.storage.configDir (honors IMA2_CONFIG_DIR).
 // Legacy installs that stored config at <packageRoot>/.ima2/config.json will be
 // migrated on first write.
@@ -33,12 +58,6 @@ function runCodexLogin() {
         throw new Error("Codex login completed without a file-backed session for the GPT OAuth proxy");
     }
 }
-// Load package.json for version
-let pkg = { version: "?", name: "ima2-gen" };
-try {
-    pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf-8"));
-}
-catch { }
 function loadConfig() {
     if (existsSync(CONFIG_FILE)) {
         return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));

package/bin/lib/characterResolve.js

@@ -1,9 +1,10 @@
 // wp4 046: CLI-side character element resolution + binding precheck.
 // Prechecks are UX hints only — the server response is the final authority
 // (041/046 server-authority clause); server error codes pass through unchanged.
+import { fetchServer } from "./client.js";
 export async function resolveCharacterElement(serverBase, idOrName) {
     const base = serverBase.replace(/\/$/, "");
-    const response = await fetch(`${base}/api/assets?kind=element&limit=500`);
+    const response = await fetchServer(base, "/api/assets?kind=element&limit=500");
     if (!response.ok)
         throw new Error(`failed to list elements: HTTP ${response.status}`);
     const payload = await response.json();

package/bin/lib/client.js

@@ -1,7 +1,122 @@
 import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { PROVIDER_ERROR_MAP, statusForErrorCode } from "../../lib/errors/providerMap.js";
 export const DEFAULT_PORT = 3333;
+let binding;
+/** Service discovery must not inherit a previous command's credential selection. */
+export function clearServerBinding() { binding = undefined; }
+function transportError(code, message, status) {
+    return Object.assign(new Error(message), { code, ...(status === undefined ? {} : { status }) });
+}
+function serverOrigin(value) {
+    try {
+        if (typeof value !== "string" || !/^https?:\/\//i.test(value) || /[\s\\?#@]/.test(value))
+            throw new Error();
+        const url = new URL(value);
+        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/")
+            throw new Error();
+        return url.origin;
+    }
+    catch {
+        throw transportError("SERVER_URL_INVALID", "Server must be an HTTP(S) origin without credentials, query, fragment or path.");
+    }
+}
+function transportUrl(value, base) {
+    try {
+        const url = new URL(value, base);
+        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash
+            || [...url.searchParams.keys()].some((key) => /^token(?:\[|$)/i.test(key)))
+            throw new Error();
+        return url;
+    }
+    catch {
+        throw transportError("SERVER_URL_INVALID", "Invalid server request URL; URL credentials and LAN query tokens are not supported.");
+    }
+}
+function transportHeaders(init, origin) {
+    try {
+        const headers = new Headers(init.headers);
+        if (headers.has("cookie") || headers.has("x-ima2-token"))
+            throw new Error();
+        if (binding?.origin === origin && binding.token)
+            headers.set("x-ima2-token", binding.token);
+        return headers;
+    }
+    catch {
+        throw transportError("SERVER_CREDENTIAL_CONFLICT", "Use IMA2_LAN_TOKEN with an explicit server; caller cookie/token headers are not supported.");
+    }
+}
+async function checkAccess(response) {
+    if (response.status >= 300 && response.status < 400) {
+        try {
+            await response.body?.cancel();
+        }
+        catch { /* Preserve the safe redirect error. */ }
+        throw transportError("SERVER_REDIRECT_REJECTED", "Server redirects are not allowed.");
+    }
+    if (response.status !== 401 && response.status !== 403)
+        return;
+    const denied = transportError("SERVER_ACCESS_DENIED", "Server authentication or access was denied.", response.status);
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        throw denied;
+    }
+    const envelope = body && typeof body === "object" && !Array.isArray(body) ? body : {};
+    const nested = envelope.error && typeof envelope.error === "object" && !Array.isArray(envelope.error)
+        ? envelope.error : {};
+    const reserved = [envelope.code, nested.code].filter((code) => typeof code === "string"
+        && ["LAN_TOKEN_REQUIRED", "LOCAL_HOST_REJECTED", "LOCAL_ORIGIN_REJECTED", "SERVER_ACCESS_DENIED"].includes(code));
+    if (reserved.length) {
+        const code = reserved[0];
+        if (code === "SERVER_ACCESS_DENIED" || reserved.some((other) => other !== code)
+            || response.status !== (code === "LAN_TOKEN_REQUIRED" ? 401 : 403))
+            throw denied;
+        throw transportError(code, code === "LAN_TOKEN_REQUIRED"
+            ? "LAN authentication required. Specify a known --server or IMA2_SERVER and set IMA2_LAN_TOKEN."
+            : "Server access denied. Check the configured server Host/Origin policy.", response.status);
+    }
+    if (envelope.code !== undefined && nested.code !== undefined && envelope.code !== nested.code)
+        throw denied;
+    const code = typeof envelope.error === "string" ? envelope.code : nested.code;
+    const message = typeof envelope.error === "string" ? envelope.error : nested.message;
+    if (typeof code === "string" && typeof message === "string" && message.trim()
+        && (statusForErrorCode(code, 0) === 401 || Object.hasOwn(PROVIDER_ERROR_MAP, code))) {
+        throw Object.assign(transportError(code, message, response.status), { body });
+    }
+    throw denied;
+}
+/** Only explicit selection below can bind a secret; request URLs never do. */
+export async function fetchServerUrl(url, init = {}) {
+    const target = transportUrl(url);
+    const headers = transportHeaders(init, target.origin);
+    let response;
+    try {
+        response = await fetch(target.href, { ...init, headers, credentials: "omit", redirect: "error" });
+    }
+    catch (error) {
+        if (init.signal?.aborted)
+            throw error;
+        // Node's native fetch rejects redirect:error before exposing a Response.
+        const cause = error?.cause;
+        if (cause?.message === "unexpected redirect") {
+            throw transportError("SERVER_REDIRECT_REJECTED", "Server redirects are not allowed.");
+        }
+        throw transportError("NETWORK_FAILED", "Server request failed.");
+    }
+    await checkAccess(response);
+    return response;
+}
+export async function fetchServer(base, pathOrUrl, init = {}) {
+    const origin = serverOrigin(base);
+    const target = transportUrl(pathOrUrl, `${origin}/`);
+    if (target.origin !== origin)
+        throw transportError("SERVER_URL_INVALID", "Server request must stay on its selected origin.");
+    return fetchServerUrl(target.href, init);
+}
 function readAdvertise() {
     const p = process.env.IMA2_ADVERTISE_FILE ||
         join(process.env.IMA2_CONFIG_DIR || join(homedir(), ".ima2"), "server.json");
@@ -18,27 +133,38 @@ async function probe(base, timeoutMs = 600) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const r = await fetch(`${base}/api/health`, {
+        const r = await fetchServer(base, "/api/health", {
             signal: controller.signal,
             // CLI is short-lived: close the socket so process.exit() never races a
             // keep-alive handle (libuv UV_HANDLE_CLOSING assert on Windows, 260719).
             headers: { connection: "close" },
         });
         if (!r.ok)
-            return null;
-        return (await r.json());
+            throw transportError("SERVER_HTTP_ERROR", `Server health failed: HTTP ${r.status}`, r.status);
+        try {
+            return (await r.json());
+        }
+        catch (error) {
+            if (controller.signal.aborted)
+                throw error;
+            throw transportError("SERVER_INVALID_HEALTH", "Server returned an invalid health response.");
+        }
     }
-    catch {
-        return null;
+    catch (error) {
+        if (error?.code === "NETWORK_FAILED"
+            || (controller.signal.aborted && error?.name === "AbortError"))
+            return null;
+        throw error;
     }
     finally {
         clearTimeout(timer);
     }
 }
 export async function findRunningServer({ includeEnv = true } = {}) {
+    clearServerBinding();
+    if (includeEnv && process.env.IMA2_SERVER !== undefined)
+        return selectServer(process.env.IMA2_SERVER);
     const candidates = [];
-    if (includeEnv && process.env.IMA2_SERVER)
-        candidates.push(process.env.IMA2_SERVER.replace(/\/$/, ""));
     const adv = readAdvertise();
     if (adv?.backend?.url)
         candidates.push(String(adv.backend.url).replace(/\/$/, ""));
@@ -49,7 +175,8 @@ export async function findRunningServer({ includeEnv = true } = {}) {
     candidates.push(`http://localhost:${DEFAULT_PORT}`);
     const seen = new Set();
     const uniq = candidates.filter((c) => !seen.has(c) && seen.add(c));
-    for (const base of uniq) {
+    for (const candidate of uniq) {
+        const base = serverOrigin(candidate);
         const health = await probe(base);
         if (health)
             return { base, health };
@@ -57,21 +184,29 @@ export async function findRunningServer({ includeEnv = true } = {}) {
     return null;
 }
 export async function resolveServer({ serverFlag } = {}) {
-    if (serverFlag) {
-        const base = serverFlag.replace(/\/$/, "");
+    clearServerBinding();
+    if (serverFlag !== undefined)
+        return selectServer(serverFlag);
+    const found = await findRunningServer();
+    if (found)
+        return found;
+    throw transportError("SERVER_UNREACHABLE", "Server unreachable; is 'ima2 serve' running?");
+}
+async function selectServer(value) {
+    const base = serverOrigin(value);
+    const selected = { origin: base, token: process.env.IMA2_LAN_TOKEN || "" };
+    binding = selected;
+    try {
         const health = await probe(base);
         if (health)
             return { base, health };
-        const err = new Error(`server unreachable at ${base}`);
-        err.code = "SERVER_UNREACHABLE";
-        throw err;
+        throw transportError("SERVER_UNREACHABLE", "Selected server is unreachable.");
+    }
+    catch (error) {
+        if (binding === selected)
+            clearServerBinding();
+        throw error;
     }
-    const found = await findRunningServer();
-    if (found)
-        return found;
-    const err = new Error("server unreachable — is 'ima2 serve' running?");
-    err.code = "SERVER_UNREACHABLE";
-    throw err;
 }
 export async function request(base, path, { method = "GET", body, headers: extraHeaders, raw = false, timeoutMs = 180_000, } = {}) {
     const baseHeaders = raw
@@ -85,7 +220,7 @@ export async function request(base, path, { method = "GET", body, headers: extra
     let res;
     let text;
     try {
-        res = await fetch(base + path, {
+        res = await fetchServer(base, path, {
             method,
             // connection: close — see the health-check note above.
             headers: { connection: "close", ...finalHeaders },

package/bin/lib/config-store.js

@@ -1,9 +1,12 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { config as runtimeConfig } from "../../config.js";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, openSync, closeSync, renameSync, rmSync } from "fs";
+import { randomBytes } from "node:crypto";
+import { config as runtimeConfig, CONFIG_SOURCE_FILE } from "../../config.js";
+import { parsePublicOrigins } from "../../lib/localAccessPolicy.js";
 import { AUTH_CONFIG_KEYS, KEY_TO_ENV, WRITABLE_CONFIG_KEYS, isSensitiveConfigKey as isSensitiveConfigKeyShared, } from "../../lib/configKeys.js";
 export { KEY_TO_ENV, WRITABLE_CONFIG_KEYS };
 export const CONFIG_FILE = runtimeConfig.storage.configFile;
 export const CONFIG_DIR = runtimeConfig.storage.configDir;
+let fileSource = CONFIG_SOURCE_FILE ?? CONFIG_FILE;
 export const AUTH_KEYS = AUTH_CONFIG_KEYS;
 export function isAuthConfigKey(key) {
     return AUTH_CONFIG_KEYS.has(key);
@@ -15,15 +18,28 @@ export function isSensitiveConfigKey(key) {
     return isSensitiveConfigKeyShared(key);
 }
 export function redactValue(key, value) {
-    if (isSensitiveConfigKey(key))
+    if (key === "server.publicOrigins") {
+        try {
+            return parsePublicOrigins(value);
+        }
+        catch {
+            return "<invalid public origins>";
+        }
+    }
+    if (isSensitiveConfigKey(key) && key !== "security.lanTokenMaxBytes")
         return value ? "<redacted>" : value;
+    if (Array.isArray(value))
+        return value.map((item, index) => redactValue(`${key}.${index}`, item));
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([child, item]) => [child, redactValue(key ? `${key}.${child}` : child, item)]));
+    }
     return value;
 }
 export function loadFileCfg() {
-    if (!existsSync(CONFIG_FILE))
+    if (!existsSync(fileSource))
         return {};
     try {
-        return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
+        return JSON.parse(readFileSync(fileSource, "utf-8"));
     }
     catch {
         return {};
@@ -40,8 +56,25 @@ export function loadCliDefaults() {
     };
 }
 export function saveFileCfg(cfg) {
-    mkdirSync(CONFIG_DIR, { recursive: true });
-    writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2));
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    const temporary = `${CONFIG_FILE}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
+    let descriptor;
+    let owned = false;
+    try {
+        descriptor = openSync(temporary, "wx", 0o600);
+        owned = true;
+        writeFileSync(descriptor, JSON.stringify(cfg, null, 2));
+        closeSync(descriptor);
+        descriptor = undefined;
+        renameSync(temporary, CONFIG_FILE);
+        fileSource = CONFIG_FILE;
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+        if (owned)
+            rmSync(temporary, { force: true });
+    }
 }
 export function getNestedKey(obj, dotKey) {
     const parts = dotKey.split(".");

package/bin/lib/doctor-bundle.js

@@ -1,5 +1,6 @@
 import { hostname, platform, release } from "node:os";
 import { listProviders } from "../../lib/providers/registry.js";
+import { buildDoctorReport } from "./doctor-report.js";
 const SECRET_PATTERN = /(sk-|xai-|apikey-|Bearer\s+[A-Za-z0-9._-]+|-----BEGIN)/i;
 function hashHostname(value) {
     let hash = 0;
@@ -8,15 +9,18 @@ function hashHostname(value) {
     return `h${(hash >>> 0).toString(16)}`;
 }
 export function buildDoctorBundle(input) {
+    const report = input.report ?? buildDoctorReport({ version: input.version, mode: "standard", lines: input.providerLines });
+    const providers = buildDoctorReport({ version: input.version, mode: "standard", lines: input.providerLines });
     return {
+        schemaVersion: report.schemaVersion, checks: report.checks, summary: report.summary,
         version: input.version,
         node: process.version,
         platform: `${platform()} ${release()}`,
         hostnameHash: hashHostname(hostname()),
-        lanes: input.providerLines.map((line) => ({
+        lanes: providers.checks.filter((line) => line.lane).map((line) => ({
             lane: line.lane,
             kind: line.kind,
-            text: SECRET_PATTERN.test(line.text) ? "[redacted]" : line.text,
+            text: line.message,
         })),
     };
 }