jishushell 0.0.1 → 0.4.2-beta2

package/dist/doctor.js

@@ -0,0 +1,937 @@
+/**
+ * JishuShell Doctor — 环境诊断与自动修复
+ *
+ * 用法:
+ *   jishushell doctor          检查所有组件状态
+ *   jishushell doctor --fix    检查并尝试自动修复
+ *
+ * Nomad 检查依据 install/jishu-install.sh 及 src/services/setup-manager.ts：
+ *   - 二进制路径: ~/.jishushell/bin/nomad  (v1.11.3)
+ *   - 配置文件:   ~/.jishushell/nomad/nomad.hcl
+ *   - 数据目录:   ~/.jishushell/nomad/data/
+ *   - Alloc 目录: ~/.jishushell/nomad/data/alloc/
+ *   - 日志文件:   ~/.jishushell/nomad/nomad.log
+ *   - HTTP API:   localhost:4646  (ACL enabled)
+ *   - systemd:    /etc/systemd/system/nomad.service
+ *   - macOS:      ~/Library/LaunchAgents/com.jishushell.nomad.plist
+ */
+import { execFileSync, execSync } from "child_process";
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from "fs";
+import * as http from "http";
+import { homedir } from "os";
+import { join } from "path";
+import { AUTH_FILE, INSTANCES_DIR, JISHUSHELL_HOME, PANEL_CONFIG_FILE, ensureDirs, getNomadToken, getPanelConfig, } from "./config.js";
+import { loadNomadToken } from "./services/setup-manager.js";
+// ── ANSI 颜色（非 TTY 时自动禁用）──────────────────────────────────────────
+const isTTY = process.stdout.isTTY ?? false;
+const c = {
+    bold: (s) => isTTY ? `\x1b[1m${s}\x1b[0m` : s,
+    green: (s) => isTTY ? `\x1b[32m${s}\x1b[0m` : s,
+    yellow: (s) => isTTY ? `\x1b[33m${s}\x1b[0m` : s,
+    red: (s) => isTTY ? `\x1b[31m${s}\x1b[0m` : s,
+    cyan: (s) => isTTY ? `\x1b[36m${s}\x1b[0m` : s,
+    dim: (s) => isTTY ? `\x1b[2m${s}\x1b[0m` : s,
+};
+function log(msg) { process.stdout.write(msg + "\n"); }
+// ── 内部工具函数 ──────────────────────────────────────────────────────────────
+function httpGet(url, timeoutMs = 3000) {
+    return new Promise((resolve, reject) => {
+        const req = http.get(url, { timeout: timeoutMs }, (res) => {
+            let body = "";
+            res.on("data", (d) => { body += d; });
+            res.on("end", () => resolve({ status: res.statusCode ?? 0, body }));
+        });
+        req.on("timeout", () => { req.destroy(); reject(new Error("timeout")); });
+        req.on("error", reject);
+    });
+}
+function httpGetWithHeaders(url, headers, timeoutMs = 3000) {
+    return new Promise((resolve, reject) => {
+        const u = new URL(url);
+        const options = {
+            hostname: u.hostname,
+            port: u.port ? parseInt(u.port, 10) : 80,
+            path: u.pathname + u.search,
+            method: "GET",
+            headers,
+            timeout: timeoutMs,
+        };
+        const req = http.request(options, (res) => {
+            let body = "";
+            res.on("data", (d) => { body += d; });
+            res.on("end", () => resolve({ status: res.statusCode ?? 0, body }));
+        });
+        req.on("timeout", () => { req.destroy(); reject(new Error("timeout")); });
+        req.on("error", reject);
+        req.end();
+    });
+}
+function commandExists(cmd) {
+    try {
+        execFileSync("which", [cmd], { stdio: "ignore", timeout: 2000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isPortListening(port) {
+    try {
+        if (process.platform === "darwin") {
+            const out = execSync(`lsof -iTCP:${port} -sTCP:LISTEN -t 2>/dev/null`, {
+                encoding: "utf-8", timeout: 3000,
+            });
+            return out.trim().length > 0;
+        }
+        const out = execSync(`ss -tlnp 2>/dev/null | grep ":${port} "`, {
+            encoding: "utf-8", timeout: 3000,
+        });
+        return out.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+// ── Nomad 路径常量（与 setup-manager.ts 保持一致）────────────────────────────
+const NOMAD_BIN_DIR = join(JISHUSHELL_HOME, "bin");
+const NOMAD_LOCAL_BIN = join(NOMAD_BIN_DIR, "nomad");
+const NOMAD_DIR = join(JISHUSHELL_HOME, "nomad");
+const NOMAD_CONFIG = join(NOMAD_DIR, "nomad.hcl");
+const NOMAD_DATA_DIR = join(NOMAD_DIR, "data");
+const NOMAD_ALLOC_DIR = join(NOMAD_DIR, "data", "alloc");
+const NOMAD_LOG = join(NOMAD_DIR, "nomad.log");
+const NOMAD_SERVICE = "/etc/systemd/system/nomad.service";
+const NOMAD_MIN_VER = "1.11.3";
+function nomadEnabled() {
+    return getPanelConfig().service_manager === "nomad";
+}
+// ════════════════════════════════════════════════════════════════════════════
+// 类别: 系统环境
+// ════════════════════════════════════════════════════════════════════════════
+const checkNode = {
+    id: "node", label: "Node.js 版本", category: "系统环境", severity: "error",
+    async check() {
+        const version = process.version;
+        const major = parseInt(version.replace("v", "").split(".")[0], 10);
+        if (major >= 22)
+            return { ok: true, detail: version };
+        if (major >= 18)
+            return { ok: false, detail: `${version}（需要 ≥22）`, hint: "nvm install 22 && nvm use 22", fixable: false };
+        return { ok: false, detail: `${version}（版本过低，需要 ≥22）`, hint: "访问 https://nodejs.org 安装 Node.js 22+", fixable: false };
+    },
+};
+const checkDockerBin = {
+    id: "docker-bin", label: "Docker 已安装", category: "系统环境", severity: "error",
+    async check() {
+        if (commandExists("docker"))
+            return { ok: true, detail: "docker 命令可用" };
+        return { ok: false, detail: "未找到 docker 命令", hint: "curl -fsSL https://get.docker.com | sh", fixable: false };
+    },
+};
+const checkDockerDaemon = {
+    id: "docker-daemon", label: "Docker 守护进程", category: "系统环境", severity: "error",
+    async check() {
+        try {
+            execFileSync("docker", ["info"], { stdio: "ignore", timeout: 6000 });
+            const ver = execSync("docker --version 2>/dev/null", { encoding: "utf-8", timeout: 3000 }).trim();
+            return { ok: true, detail: ver.replace("Docker version ", "").split(",")[0] };
+        }
+        catch { }
+        try {
+            execFileSync("sudo", ["-n", "docker", "info"], { stdio: "ignore", timeout: 6000 });
+            return { ok: true, detail: "运行中（通过 sudo 访问 — 重新登录可激活 docker 组权限）" };
+        }
+        catch { }
+        return { ok: false, detail: "Docker 守护进程未运行", hint: "sudo systemctl start docker", fixable: true };
+    },
+    async fix() {
+        try {
+            execSync("sudo systemctl start docker", { stdio: "ignore", timeout: 30000 });
+            await new Promise((r) => setTimeout(r, 2000));
+            try {
+                execFileSync("docker", ["info"], { stdio: "ignore", timeout: 6000 });
+                return { ok: true, message: "Docker 守护进程已成功启动" };
+            }
+            catch { }
+            return { ok: true, message: "Docker 启动命令已执行（请手动验证）" };
+        }
+        catch (e) {
+            return { ok: false, message: `启动失败: ${e.message}` };
+        }
+    },
+};
+const checkDockerGroup = {
+    id: "docker-group", label: "Docker 用户权限", category: "系统环境", severity: "warning",
+    async check() {
+        if (!commandExists("docker"))
+            return { ok: true, detail: "跳过（docker 未安装）" };
+        try {
+            execFileSync("docker", ["info"], { stdio: "ignore", timeout: 4000 });
+            return { ok: true, detail: "无需 sudo 即可使用 Docker" };
+        }
+        catch { }
+        const user = process.env.USER || process.env.LOGNAME || "";
+        return { ok: false, detail: `${user || "当前用户"} 不在 docker 组中，需要 sudo`, hint: `sudo usermod -aG docker ${user || "$USER"}  （执行后重新登录）`, fixable: true };
+    },
+    async fix() {
+        const user = process.env.USER || process.env.LOGNAME || "";
+        if (!user)
+            return { ok: false, message: "无法获取当前用户名（USER/LOGNAME 未设置）" };
+        try {
+            execSync(`sudo usermod -aG docker ${user}`, { stdio: "ignore", timeout: 10000 });
+            return { ok: true, message: `已将 ${user} 加入 docker 组。需要重新登录后生效。` };
+        }
+        catch (e) {
+            return { ok: false, message: `操作失败: ${e.message}` };
+        }
+    },
+};
+const checkDiskSpace = {
+    id: "disk-space", label: "磁盘空间", category: "系统环境", severity: "warning",
+    async check() {
+        try {
+            const raw = execSync("df -k / 2>/dev/null | awk 'NR==2{print $4, $5}'", { encoding: "utf-8", timeout: 3000 }).trim();
+            const parts = raw.split(/\s+/);
+            const availKB = parseInt(parts[0], 10);
+            const pct = parseInt((parts[1] || "0").replace("%", ""), 10);
+            const avail = availKB > 1024 * 1024 ? `${(availKB / 1024 / 1024).toFixed(1)} GB` : `${Math.round(availKB / 1024)} MB`;
+            if (pct >= 95)
+                return { ok: false, detail: `根分区已用 ${pct}%，可用 ${avail}（磁盘即将耗尽！）`, hint: "sudo journalctl --vacuum-size=100M && docker system prune -f", fixable: false };
+            if (pct >= 85)
+                return { ok: false, detail: `根分区已用 ${pct}%，可用 ${avail}（建议清理）`, hint: "docker system prune -f  或清理 /var/log", fixable: false };
+            return { ok: true, detail: `根分区已用 ${pct}%，可用 ${avail}` };
+        }
+        catch {
+            return { ok: true, detail: "无法读取磁盘信息（已跳过）" };
+        }
+    },
+};
+const checkMemory = {
+    id: "memory", label: "内存", category: "系统环境", severity: "warning",
+    async check() {
+        if (process.platform !== "linux")
+            return { ok: true, detail: "非 Linux 平台，已跳过" };
+        try {
+            const meminfo = readFileSync("/proc/meminfo", "utf-8");
+            const totalMatch = meminfo.match(/MemTotal:\s+(\d+)\s+kB/);
+            const availMatch = meminfo.match(/MemAvailable:\s+(\d+)\s+kB/);
+            if (!totalMatch || !availMatch)
+                return { ok: true, detail: "/proc/meminfo 格式异常，已跳过" };
+            const totalKB = parseInt(totalMatch[1], 10);
+            const availKB = parseInt(availMatch[1], 10);
+            const usedPct = Math.round((1 - availKB / totalKB) * 100);
+            const totalMB = Math.round(totalKB / 1024);
+            const availMB = Math.round(availKB / 1024);
+            if (availKB < 100 * 1024)
+                return { ok: false, detail: `可用内存不足（${availMB} MB / ${totalMB} MB，已用 ${usedPct}%）`, hint: "jishushell restart  或检查内存占用异常的进程", fixable: false };
+            return { ok: true, detail: `可用 ${availMB} MB / ${totalMB} MB（已用 ${usedPct}%）` };
+        }
+        catch {
+            return { ok: true, detail: "内存信息不可读（已跳过）" };
+        }
+    },
+};
+// ════════════════════════════════════════════════════════════════════════════
+// 类别: 配置
+// ════════════════════════════════════════════════════════════════════════════
+const checkConfigDir = {
+    id: "config-dir", label: "配置目录", category: "配置", severity: "error",
+    async check() {
+        if (existsSync(JISHUSHELL_HOME) && existsSync(INSTANCES_DIR))
+            return { ok: true, detail: JISHUSHELL_HOME };
+        return { ok: false, detail: `目录不存在: ${!existsSync(JISHUSHELL_HOME) ? JISHUSHELL_HOME : INSTANCES_DIR}`, fixable: true };
+    },
+    async fix() {
+        try {
+            ensureDirs();
+            return { ok: true, message: `已创建目录: ${JISHUSHELL_HOME}` };
+        }
+        catch (e) {
+            return { ok: false, message: `创建失败: ${e.message}` };
+        }
+    },
+};
+const checkPanelConfig = {
+    id: "panel-config", label: "面板配置文件", category: "配置", severity: "warning",
+    async check() {
+        if (!existsSync(PANEL_CONFIG_FILE))
+            return { ok: false, detail: "panel.json 不存在", hint: "jishushell install", fixable: true };
+        try {
+            const cfg = getPanelConfig();
+            if (Object.keys(cfg).length === 0)
+                return { ok: false, detail: "panel.json 为空", hint: "jishushell install --force", fixable: true };
+            return { ok: true, detail: `service_manager=${cfg.service_manager ?? "process"}, port=${cfg.panel_port ?? 8090}` };
+        }
+        catch {
+            return { ok: false, detail: "panel.json 格式错误（JSON 解析失败）", hint: "jishushell install --force", fixable: true };
+        }
+    },
+    async fix() {
+        try {
+            ensureDirs();
+            if (!existsSync(PANEL_CONFIG_FILE)) {
+                writeFileSync(PANEL_CONFIG_FILE, JSON.stringify({ service_manager: "process", panel_port: 8090 }, null, 2), { mode: 0o600 });
+                return { ok: true, message: "已创建默认 panel.json（service_manager=process, port=8090）" };
+            }
+            return { ok: false, message: "panel.json 已存在但内容异常，请运行: jishushell install --force" };
+        }
+        catch (e) {
+            return { ok: false, message: `创建失败: ${e.message}` };
+        }
+    },
+};
+const checkJwtSecret = {
+    id: "jwt-secret", label: "JWT 签名密钥", category: "配置", severity: "error",
+    async check() {
+        const secretFile = join(JISHUSHELL_HOME, "jwt-secret");
+        if (!existsSync(secretFile))
+            return { ok: false, detail: "jwt-secret 文件不存在", fixable: true };
+        try {
+            const stored = readFileSync(secretFile, "utf-8").trim();
+            if (stored.length >= 32)
+                return { ok: true, detail: "密钥文件存在且有效" };
+            return { ok: false, detail: "密钥长度不足（应 ≥32 字符）", fixable: true };
+        }
+        catch (e) {
+            return { ok: false, detail: `读取失败: ${e.message}`, fixable: true };
+        }
+    },
+    async fix() {
+        const secretFile = join(JISHUSHELL_HOME, "jwt-secret");
+        try {
+            ensureDirs();
+            try {
+                unlinkSync(secretFile);
+            }
+            catch { }
+            writeFileSync(secretFile, randomBytes(48).toString("base64url"), { mode: 0o600 });
+            return { ok: true, message: "已重新生成 JWT 密钥（已有登录会话将失效，需重新登录）" };
+        }
+        catch (e) {
+            return { ok: false, message: `生成失败: ${e.message}` };
+        }
+    },
+};
+const checkAuth = {
+    id: "auth", label: "管理员密码", category: "配置", severity: "warning",
+    async check() {
+        if (!existsSync(AUTH_FILE))
+            return { ok: false, detail: "admin 密码未设置", hint: "jishushell onboard", fixable: false };
+        try {
+            const auth = JSON.parse(readFileSync(AUTH_FILE, "utf-8"));
+            if (auth.password_hash)
+                return { ok: true, detail: "管理员密码已配置" };
+            return { ok: false, detail: "auth.json 无效（缺少 password_hash）", hint: "jishushell onboard", fixable: false };
+        }
+        catch {
+            return { ok: false, detail: "auth.json 格式错误", hint: "jishushell onboard", fixable: false };
+        }
+    },
+};
+const checkFilePermissions = {
+    id: "file-permissions", label: "配置文件权限", category: "配置", severity: "warning",
+    async check() {
+        if (process.platform === "win32")
+            return { ok: true, detail: "Windows 平台跳过权限检查" };
+        const targets = [
+            { path: join(JISHUSHELL_HOME, "jwt-secret"), label: "jwt-secret" },
+            { path: AUTH_FILE, label: "auth.json" },
+            { path: join(JISHUSHELL_HOME, "encryption-key"), label: "encryption-key" },
+        ];
+        const bad = [];
+        const extras = [];
+        for (const t of targets) {
+            if (!existsSync(t.path))
+                continue;
+            try {
+                const modeRaw = process.platform === "darwin"
+                    ? execSync(`stat -f "%p" "${t.path}" 2>/dev/null`, { encoding: "utf-8", timeout: 2000 }).trim()
+                    : execSync(`stat -c "%a" "${t.path}" 2>/dev/null`, { encoding: "utf-8", timeout: 2000 }).trim();
+                const modeStr = modeRaw.slice(-3);
+                const tooOpen = !modeStr.endsWith("00");
+                const icon = tooOpen ? c.yellow("!") : c.green("✓");
+                extras.push(c.dim(`      ├─ ${icon}  ${t.label.padEnd(18)} ${modeStr}`));
+                if (tooOpen)
+                    bad.push(`${t.label}(${modeStr})`);
+            }
+            catch {
+                extras.push(c.dim(`      ├─ ?  ${t.label.padEnd(18)} 读取失败`));
+            }
+        }
+        if (extras.length > 0)
+            extras[extras.length - 1] = extras[extras.length - 1].replace("├─", "└─");
+        if (bad.length > 0) {
+            const badPaths = targets.filter((t) => bad.some((b) => b.startsWith(t.label))).map((t) => `"${t.path}"`).join(" ");
+            return { ok: false, detail: `文件权限过宽: ${bad.join(", ")}`, hint: `chmod 600 ${badPaths}`, fixable: true, extras };
+        }
+        return { ok: true, detail: "敏感文件权限正常（600）", extras: extras.length > 0 ? extras : undefined };
+    },
+    async fix() {
+        const targets = [join(JISHUSHELL_HOME, "jwt-secret"), AUTH_FILE, join(JISHUSHELL_HOME, "encryption-key")];
+        const fixed = [];
+        for (const t of targets) {
+            if (!existsSync(t))
+                continue;
+            try {
+                execSync(`chmod 600 "${t}"`, { stdio: "ignore", timeout: 3000 });
+                fixed.push(t.split("/").pop());
+            }
+            catch { }
+        }
+        return fixed.length > 0 ? { ok: true, message: `已修复权限: ${fixed.join(", ")}` } : { ok: false, message: "无可修复文件或操作失败" };
+    },
+};
+// ════════════════════════════════════════════════════════════════════════════
+// 类别: 服务状态
+// ════════════════════════════════════════════════════════════════════════════
+const checkPanel = {
+    id: "panel", label: "面板服务", category: "服务状态", severity: "warning",
+    async check() {
+        const cfg = getPanelConfig();
+        const port = parseInt(String(cfg.panel_port ?? ""), 10) || 8090;
+        try {
+            const res = await httpGet(`http://localhost:${port}/api/auth/status`, 3000);
+            if (res.status > 0) {
+                try {
+                    const body = JSON.parse(res.body);
+                    const initialized = body.initialized ?? body.setup_complete ?? false;
+                    return { ok: true, detail: initialized ? `运行中，端口 :${port}（已完成初始配置）` : `运行中，端口 :${port}（尚未完成初始密码设置，请运行 jishushell onboard）` };
+                }
+                catch {
+                    return { ok: true, detail: `运行中，端口 :${port}（HTTP ${res.status}）` };
+                }
+            }
+        }
+        catch { }
+        return { ok: false, detail: `端口 ${port} 无响应`, hint: "jishushell start", fixable: true };
+    },
+    async fix() {
+        try {
+            execFileSync(process.execPath, [process.argv[1], "start"], { stdio: "ignore", timeout: 15000 });
+            return { ok: true, message: "面板服务启动命令已执行" };
+        }
+        catch (e) {
+            return { ok: false, message: `启动失败: ${e.message}` };
+        }
+    },
+};
+const checkSystemdEnabled = {
+    id: "systemd-enabled", label: "面板开机自启", category: "服务状态", severity: "warning",
+    async check() {
+        if (process.platform === "darwin")
+            return { ok: true, detail: "macOS 平台，已跳过" };
+        try {
+            execSync("systemctl --version 2>/dev/null", { stdio: "ignore", timeout: 2000 });
+        }
+        catch {
+            return { ok: true, detail: "非 systemd 系统，已跳过" };
+        }
+        try {
+            const status = execSync("systemctl is-enabled jishushell 2>/dev/null", { encoding: "utf-8", timeout: 3000 }).trim();
+            if (status === "enabled")
+                return { ok: true, detail: "jishushell.service 已启用（开机自启）" };
+            if (status === "static" || status === "alias")
+                return { ok: true, detail: `jishushell.service: ${status}` };
+            return { ok: false, detail: `jishushell.service: ${status}（未开机自启）`, hint: "sudo systemctl enable jishushell", fixable: true };
+        }
+        catch {
+            return { ok: false, detail: "jishushell.service 未注册", hint: "jishushell install", fixable: false };
+        }
+    },
+    async fix() {
+        try {
+            execSync("sudo systemctl enable jishushell", { stdio: "ignore", timeout: 10000 });
+            return { ok: true, message: "已启用 jishushell.service 开机自启" };
+        }
+        catch (e) {
+            return { ok: false, message: `启用失败: ${e.message}` };
+        }
+    },
+};
+// ════════════════════════════════════════════════════════════════════════════
+// 类别: Nomad
+// ════════════════════════════════════════════════════════════════════════════
+/**
+ * 检查 Nomad 二进制（~/.jishushell/bin/nomad）
+ * 依据: install/jishu-install.sh _install_nomad_binary()
+ * 安装路径: JISHUSHELL_BIN_DIR=${JISHUSHELL_HOME}/bin/nomad
+ * 要求版本: NOMAD_VERSION=1.11.3
+ */
+const checkNomadBin = {
+    id: "nomad-bin", label: "Nomad 二进制", category: "Nomad", severity: "error",
+    async check() {
+        if (!nomadEnabled())
+            return { ok: true, detail: "未使用 Nomad（已跳过）" };
+        // 优先检查本地安装路径
+        const binPath = existsSync(NOMAD_LOCAL_BIN) ? NOMAD_LOCAL_BIN : "nomad";
+        try {
+            const versionOut = execFileSync(binPath, ["version"], { encoding: "utf-8", timeout: 5000 }).trim();
+            const match = versionOut.match(/(\d+\.\d+\.\d+)/);
+            const version = match ? match[1] : versionOut.split("\n")[0];
+            const inPath = (process.env.PATH || "").split(":").includes(NOMAD_BIN_DIR);
+            const pathMark = inPath ? c.green("✓ 在 PATH 中") : c.yellow("! 不在 PATH（需 source ~/.bashrc 或重新登录）");
+            const extras = [
+                c.dim(`      ├─ 路径: ${binPath === "nomad" ? "（系统 PATH）" : NOMAD_LOCAL_BIN}`),
+                c.dim(`      └─ ${NOMAD_BIN_DIR} → `) + pathMark,
+            ];
+            // 版本检查
+            const [maj, min, pat] = version.split(".").map(Number);
+            const [rMaj, rMin, rPat] = NOMAD_MIN_VER.split(".").map(Number);
+            const vOk = maj > rMaj || (maj === rMaj && (min > rMin || (min === rMin && pat >= rPat)));
+            if (!vOk) {
+                return { ok: false, detail: `v${version}（需要 ≥${NOMAD_MIN_VER}，请升级）`, hint: "jishushell install --force", fixable: false, extras };
+            }
+            return { ok: true, detail: `v${version}`, extras };
+        }
+        catch {
+            if (!existsSync(NOMAD_LOCAL_BIN)) {
+                return { ok: false, detail: `${NOMAD_LOCAL_BIN} 不存在`, hint: "jishushell install（将下载 Nomad 二进制到 ~/.jishushell/bin/）", fixable: false };
+            }
+            return { ok: false, detail: `${NOMAD_LOCAL_BIN} 不可执行或架构不兼容`, hint: `chmod 755 ${NOMAD_LOCAL_BIN}`, fixable: true };
+        }
+    },
+    async fix() {
+        if (!existsSync(NOMAD_LOCAL_BIN))
+            return { ok: false, message: "Nomad 二进制不存在，请运行: jishushell install" };
+        try {
+            execSync(`chmod 755 "${NOMAD_LOCAL_BIN}"`, { stdio: "ignore", timeout: 3000 });
+            return { ok: true, message: `已修复 Nomad 二进制可执行权限: ${NOMAD_LOCAL_BIN}` };
+        }
+        catch (e) {
+            return { ok: false, message: `chmod 失败: ${e.message}` };
+        }
+    },
+};
+/**
+ * 检查 Nomad 配置文件与数据目录
+ * 依据: install/jishu-install.sh _ensure_nomad_hcl()
+ * nomad.hcl 关键字段: data_dir, bind_addr, server, client, acl { enabled = true }
+ */
+const checkNomadConfig = {
+    id: "nomad-config", label: "Nomad 配置", category: "Nomad", severity: "error",
+    async check() {
+        if (!nomadEnabled())
+            return { ok: true, detail: "未使用 Nomad（已跳过）" };
+        const ck = (v) => v ? c.green("✓") : c.red("✗");
+        const extras = [
+            c.dim(`      ├─ ${ck(existsSync(NOMAD_CONFIG))}  nomad.hcl${existsSync(NOMAD_CONFIG) ? "" : "（不存在）"}`),
+            c.dim(`      ├─ ${ck(existsSync(NOMAD_DATA_DIR))}  nomad/data/${existsSync(NOMAD_DATA_DIR) ? "" : "（不存在）"}`),
+            c.dim(`      ├─ ${ck(existsSync(NOMAD_ALLOC_DIR))}  nomad/data/alloc/${existsSync(NOMAD_ALLOC_DIR) ? "" : "（不存在）"}`),
+            c.dim(`      └─ ${existsSync(NOMAD_LOG) ? c.green("✓") : c.dim("·")}  nomad.log${existsSync(NOMAD_LOG) ? "" : "（未启动过）"}`),
+        ];
+        if (!existsSync(NOMAD_CONFIG)) {
+            return { ok: false, detail: "nomad.hcl 不存在，Nomad 无法启动", hint: "jishushell install", fixable: true, extras };
+        }
+        if (!existsSync(NOMAD_DATA_DIR) || !existsSync(NOMAD_ALLOC_DIR)) {
+            return { ok: false, detail: "数据目录不完整", fixable: true, extras };
+        }
+        // 校验 ACL 配置
+        try {
+            const content = readFileSync(NOMAD_CONFIG, "utf-8");
+            if (!content.includes("acl") || !content.includes("enabled = true")) {
+                return { ok: false, detail: "nomad.hcl 缺少 ACL 配置（acl { enabled = true }）", hint: "jishushell install --force", fixable: false, extras };
+            }
+        }
+        catch { }
+        return { ok: true, detail: "nomad.hcl 及数据目录正常", extras };
+    },
+    async fix() {
+        try {
+            mkdirSync(NOMAD_DATA_DIR, { recursive: true });
+            mkdirSync(NOMAD_ALLOC_DIR, { recursive: true });
+            if (!existsSync(NOMAD_CONFIG)) {
+                // 模板与 install/jishu-install.sh _ensure_nomad_hcl() 保持一致
+                const hcl = `data_dir = "${NOMAD_DATA_DIR}"
+
+bind_addr = "127.0.0.1"
+
+leave_on_terminate = true
+
+advertise {
+  http = "127.0.0.1"
+  rpc  = "127.0.0.1"
+  serf = "127.0.0.1"
+}
+
+server {
+  enabled          = true
+  bootstrap_expect = 1
+}
+
+client {
+  enabled = true
+  servers = ["127.0.0.1:4647"]
+  alloc_dir = "${NOMAD_ALLOC_DIR}"
+
+  drain_on_shutdown {
+    deadline           = "30s"
+    force              = true
+    ignore_system_jobs = true
+  }
+}
+
+plugin "docker" {
+  config {
+    disable_log_collection = true
+    volumes {
+      enabled = true
+    }
+  }
+}
+
+acl {
+  enabled = true
+}
+`;
+                writeFileSync(NOMAD_CONFIG, hcl, { mode: 0o600 });
+                return { ok: true, message: `已创建 nomad.hcl 及数据目录` };
+            }
+            return { ok: true, message: "已创建缺失的数据目录" };
+        }
+        catch (e) {
+            return { ok: false, message: `创建失败: ${e.message}` };
+        }
+    },
+};
+/**
+ * 检查 Nomad Agent 运行状态（端口 4646 + HTTP API + ACL Token）
+ * 依据: install/jishu-install.sh start_nomad() / install_nomad_systemd()
+ * 启动命令: sudo nohup nomad agent -config=~/.jishushell/nomad/nomad.hcl > nomad.log 2>&1 &
+ */
+const checkNomadAgent = {
+    id: "nomad-agent", label: "Nomad Agent", category: "Nomad", severity: "error",
+    async check() {
+        if (!nomadEnabled())
+            return { ok: true, detail: "未使用 Nomad（已跳过）" };
+        if (!isPortListening(4646)) {
+            return { ok: false, detail: "端口 4646 未监听（Agent 未运行）", hint: "jishushell doctor --fix  或  sudo systemctl start nomad", fixable: true };
+        }
+        loadNomadToken();
+        const nomadAddr = process.env.NOMAD_ADDR || "http://127.0.0.1:4646";
+        const token = getNomadToken();
+        try {
+            const result = token
+                ? await httpGetWithHeaders(`${nomadAddr}/v1/agent/self`, { "X-Nomad-Token": token }, 3000)
+                : await httpGet(`${nomadAddr}/v1/agent/self`, 3000);
+            if (result.status === 200) {
+                try {
+                    const body = JSON.parse(result.body);
+                    const nodeStatus = body?.stats?.client?.node_status ?? "ready";
+                    const peers = body?.stats?.nomad?.peers ?? "?";
+                    const extras = [
+                        c.dim(`      ├─ 节点状态: ${nodeStatus}`),
+                        c.dim(`      └─ Raft peers: ${peers}`),
+                    ];
+                    return { ok: true, detail: "运行中，ACL Token 有效", extras };
+                }
+                catch {
+                    return { ok: true, detail: "运行中，ACL Token 有效" };
+                }
+            }
+            if (result.status === 403) {
+                return { ok: false, detail: "运行中，但 ACL Token 无效或已过期", hint: "在 panel.json 中更新 nomad_token 字段", fixable: false };
+            }
+            return { ok: true, detail: `运行中（HTTP ${result.status}）` };
+        }
+        catch {
+            return { ok: true, detail: "运行中（验证 ACL Token 超时，已忽略）" };
+        }
+    },
+    async fix() {
+        // 1. 尝试 systemctl
+        try {
+            execSync("sudo systemctl start nomad", { stdio: "ignore", timeout: 15000 });
+            await new Promise((r) => setTimeout(r, 3000));
+            if (isPortListening(4646))
+                return { ok: true, message: "Nomad Agent 已通过 systemctl 启动" };
+        }
+        catch { }
+        // 2. 直接 nohup（与 install/jishu-install.sh start_nomad() 保持一致）
+        if (existsSync(NOMAD_LOCAL_BIN) && existsSync(NOMAD_CONFIG)) {
+            try {
+                execSync(`sudo nohup "${NOMAD_LOCAL_BIN}" agent -config="${NOMAD_CONFIG}" > "${NOMAD_LOG}" 2>&1 &`, { stdio: "ignore", timeout: 5000 });
+                await new Promise((r) => setTimeout(r, 5000));
+                if (isPortListening(4646))
+                    return { ok: true, message: "Nomad Agent 已启动（nohup 模式）" };
+                return { ok: false, message: `启动命令已执行，但端口 4646 尚未就绪。查看日志: ${NOMAD_LOG}` };
+            }
+            catch (e) {
+                return { ok: false, message: `nohup 启动失败: ${e.message}` };
+            }
+        }
+        return { ok: false, message: "Nomad 未安装或配置缺失，请运行: jishushell install" };
+    },
+};
+/**
+ * 检查 nomad.service 是否注册并设为开机自启
+ * 依据: install/jishu-install.sh install_nomad_systemd() / _install_nomad_launchd()
+ * Linux 服务文件: /etc/systemd/system/nomad.service
+ * macOS plist:   ~/Library/LaunchAgents/com.jishushell.nomad.plist
+ */
+const checkNomadSystemd = {
+    id: "nomad-systemd", label: "Nomad 开机自启", category: "Nomad", severity: "warning",
+    async check() {
+        if (!nomadEnabled())
+            return { ok: true, detail: "未使用 Nomad（已跳过）" };
+        if (process.platform === "darwin") {
+            const plist = join(homedir(), "Library/LaunchAgents/com.jishushell.nomad.plist");
+            if (existsSync(plist))
+                return { ok: true, detail: "launchd: com.jishushell.nomad 已安装" };
+            return { ok: false, detail: "Nomad launchd plist 不存在", hint: "jishushell install", fixable: false };
+        }
+        if (!existsSync(NOMAD_SERVICE)) {
+            return { ok: false, detail: "nomad.service 未注册（运行 jishushell install 可注册）", hint: "jishushell install", fixable: false };
+        }
+        try {
+            const status = execSync("systemctl is-enabled nomad 2>/dev/null", { encoding: "utf-8", timeout: 3000 }).trim();
+            if (status === "enabled")
+                return { ok: true, detail: "nomad.service 已启用（开机自启）" };
+            return { ok: false, detail: `nomad.service: ${status}（未开机自启）`, hint: "sudo systemctl enable nomad", fixable: true };
+        }
+        catch {
+            return { ok: false, detail: "nomad.service 存在但 is-enabled 查询失败", hint: "sudo systemctl enable nomad", fixable: true };
+        }
+    },
+    async fix() {
+        try {
+            execSync("sudo systemctl enable nomad", { stdio: "ignore", timeout: 10000 });
+            return { ok: true, message: "已启用 nomad.service 开机自启" };
+        }
+        catch (e) {
+            return { ok: false, message: `启用失败: ${e.message}` };
+        }
+    },
+};
+/**
+ * 列出 Nomad 集群中的 Jobs 及其运行状态
+ * API: GET /v1/jobs  (需 X-Nomad-Token)
+ */
+const checkNomadJobs = {
+    id: "nomad-jobs", label: "Nomad Jobs", category: "Nomad", severity: "warning",
+    async check() {
+        if (!nomadEnabled())
+            return { ok: true, detail: "未使用 Nomad（已跳过）" };
+        if (!isPortListening(4646))
+            return { ok: false, detail: "Nomad 未运行，无法获取 Jobs 列表", fixable: false };
+        const nomadAddr = process.env.NOMAD_ADDR || "http://127.0.0.1:4646";
+        const token = getNomadToken();
+        try {
+            const res = token
+                ? await httpGetWithHeaders(`${nomadAddr}/v1/jobs`, { "X-Nomad-Token": token }, 5000)
+                : await httpGet(`${nomadAddr}/v1/jobs`, 5000);
+            if (res.status === 403)
+                return { ok: false, detail: "ACL Token 无效，无法列出 Jobs", hint: "在 panel.json 中更新 nomad_token", fixable: false };
+            if (res.status !== 200)
+                return { ok: false, detail: `Nomad API 返回 HTTP ${res.status}`, fixable: false };
+            const jobs = JSON.parse(res.body);
+            if (jobs.length === 0)
+                return { ok: true, detail: "暂无 Job（集群为空）" };
+            const unhealthy = jobs.filter((j) => j.Status !== "running");
+            const extras = jobs.map((j, idx) => {
+                const branch = idx === jobs.length - 1 ? "└─" : "├─";
+                const icon = j.Status === "running" ? c.green("✓") : c.yellow("!");
+                const status = j.Status === "running" ? c.green(j.Status) : c.yellow(j.Status);
+                return c.dim(`      ${branch} ${icon}  ${j.ID.padEnd(26)}`) + " " + status + c.dim(` [${j.Type}]`);
+            });
+            if (unhealthy.length > 0)
+                return { ok: false, detail: `${jobs.length} 个 job，${unhealthy.length} 个非 running 状态`, extras };
+            return { ok: true, detail: `${jobs.length} 个 job，全部 running`, extras };
+        }
+        catch (e) {
+            return { ok: false, detail: `查询失败: ${e.message}`, fixable: false };
+        }
+    },
+};
+// ════════════════════════════════════════════════════════════════════════════
+// 类别: AI 组件
+// ════════════════════════════════════════════════════════════════════════════
+const checkOpenclawPkg = {
+    id: "openclaw-pkg", label: "OpenClaw 包", category: "AI 组件", severity: "warning",
+    async check() {
+        const oclawBin = join(JISHUSHELL_HOME, "packages/openclaw/bin/openclaw");
+        const oclawPkg = join(JISHUSHELL_HOME, "packages/openclaw/lib/node_modules/openclaw/package.json");
+        if (!existsSync(oclawBin))
+            return { ok: false, detail: "OpenClaw 未安装", hint: "jishushell install --skip-nomad --skip-docker", fixable: false };
+        try {
+            const pkg = JSON.parse(readFileSync(oclawPkg, "utf-8"));
+            return { ok: true, detail: `v${pkg.version}` };
+        }
+        catch {
+            return { ok: true, detail: "已安装（版本信息不可读）" };
+        }
+    },
+};
+const checkOpenclawImage = {
+    id: "openclaw-image", label: "OpenClaw Docker 镜像", category: "AI 组件", severity: "warning",
+    async check() {
+        const imageTag = getPanelConfig().openclaw_image || "openclaw:v1.0";
+        let dockerAccessible = false;
+        try {
+            execFileSync("docker", ["info"], { stdio: "ignore", timeout: 4000 });
+            dockerAccessible = true;
+        }
+        catch {
+            try {
+                execFileSync("sudo", ["-n", "docker", "info"], { stdio: "ignore", timeout: 4000 });
+                dockerAccessible = true;
+            }
+            catch { }
+        }
+        if (!dockerAccessible)
+            return { ok: false, detail: "Docker 不可访问，无法检查镜像", fixable: false };
+        const inspectOk = (useSudo) => {
+            const args = useSudo ? ["sudo", "-n", "docker", "image", "inspect", imageTag] : ["docker", "image", "inspect", imageTag];
+            try {
+                execFileSync(args[0], args.slice(1), { stdio: "ignore", timeout: 5000 });
+                return true;
+            }
+            catch {
+                return false;
+            }
+        };
+        if (inspectOk(false) || inspectOk(true))
+            return { ok: true, detail: imageTag };
+        return { ok: false, detail: `本地未找到镜像 ${imageTag}`, hint: `docker pull ${imageTag}  或  jishushell install`, fixable: false };
+    },
+};
+// ════════════════════════════════════════════════════════════════════════════
+// 类别: 网络
+// ════════════════════════════════════════════════════════════════════════════
+const checkNetwork = {
+    id: "network", label: "网络连通性", category: "网络", severity: "warning",
+    async check() {
+        for (const ip of ["1.1.1.1", "8.8.8.8"]) {
+            try {
+                execSync(`ping -c 1 -W 2 ${ip} 2>/dev/null`, { stdio: "ignore", timeout: 5000 });
+                return { ok: true, detail: `外网可达（${ip}）` };
+            }
+            catch { }
+        }
+        try {
+            execSync("nslookup registry.npmjs.org 2>/dev/null", { stdio: "ignore", timeout: 4000 });
+            return { ok: true, detail: "DNS 解析正常（ICMP 可能被防火墙阻断）" };
+        }
+        catch { }
+        return { ok: false, detail: "无法连通外网（ping 及 DNS 均失败）", hint: "检查网络: ip route && cat /etc/resolv.conf", fixable: false };
+    },
+};
+// ════════════════════════════════════════════════════════════════════════════
+// 所有检查项（按执行顺序）
+// ════════════════════════════════════════════════════════════════════════════
+export const ALL_CHECKS = [
+    // 系统环境
+    checkNode,
+    checkDockerBin,
+    checkDockerDaemon,
+    checkDockerGroup,
+    checkDiskSpace,
+    checkMemory,
+    // 配置
+    checkConfigDir,
+    checkPanelConfig,
+    checkJwtSecret,
+    checkAuth,
+    checkFilePermissions,
+    // 服务状态
+    checkPanel,
+    checkSystemdEnabled,
+    // Nomad
+    checkNomadBin,
+    checkNomadConfig,
+    checkNomadAgent,
+    checkNomadSystemd,
+    checkNomadJobs,
+    // AI 组件
+    checkOpenclawPkg,
+    checkOpenclawImage,
+    // 网络
+    checkNetwork,
+];
+// ════════════════════════════════════════════════════════════════════════════
+// 输出格式化
+// ════════════════════════════════════════════════════════════════════════════
+function formatRow(check, result) {
+    const isWarn = !result.ok && check.severity === "warning";
+    const icon = result.ok ? c.green("✓") : isWarn ? c.yellow("!") : c.red("✗");
+    const tag = result.ok ? "" : isWarn ? c.yellow(" [WARN] ") : c.red(" [ERROR]");
+    const label = (result.ok ? c.green : isWarn ? c.yellow : c.red)(check.label.padEnd(22));
+    return `    ${icon}  ${label}${tag}  ${c.dim(result.detail)}`;
+}
+// ════════════════════════════════════════════════════════════════════════════
+// 主入口
+// ════════════════════════════════════════════════════════════════════════════
+/**
+ * 运行所有诊断检查，返回是否全部 error 级别检查通过。
+ */
+export async function runDoctorChecks(opts = {}) {
+    const { fix = false } = opts;
+    log("");
+    log(c.bold(c.cyan("  JishuShell Doctor")));
+    log(c.dim("  ────────────────────────────────────────────────"));
+    if (fix) {
+        log(c.dim("  模式: ") + c.bold("检查 + 自动修复"));
+    }
+    else {
+        log(c.dim("  运行 ") + c.bold("jishushell doctor --fix") + c.dim(" 可尝试自动修复问题"));
+    }
+    log("");
+    const categories = [...new Set(ALL_CHECKS.map((ch) => ch.category))];
+    const results = new Map();
+    for (const category of categories) {
+        log(c.bold(`  ▸ ${category}`));
+        for (const check of ALL_CHECKS.filter((ch) => ch.category === category)) {
+            let result = await check.check();
+            results.set(check.id, result);
+            if (!result.ok && fix && result.fixable && check.fix) {
+                log(formatRow(check, result));
+                if (result.extras) {
+                    for (const line of result.extras)
+                        log(line);
+                }
+                process.stdout.write(c.dim(`      ↻  修复中: ${check.label}…`));
+                const fixResult = await check.fix();
+                process.stdout.write("\r" + " ".repeat(55) + "\r");
+                result = await check.check();
+                results.set(check.id, result);
+                log(formatRow(check, result));
+                if (result.extras) {
+                    for (const line of result.extras)
+                        log(line);
+                }
+                const fixIcon = fixResult.ok ? c.green("✓") : c.red("✗");
+                log(c.dim(`      └─ ${fixIcon} ${fixResult.message}`));
+            }
+            else {
+                log(formatRow(check, result));
+                if (result.extras) {
+                    for (const line of result.extras)
+                        log(line);
+                }
+                if (!result.ok && result.hint) {
+                    log(c.dim(`      └─ 建议: ${result.hint}`));
+                }
+            }
+        }
+        log("");
+    }
+    // 汇总
+    const errors = ALL_CHECKS.filter((ch) => !results.get(ch.id).ok && ch.severity === "error");
+    const warnings = ALL_CHECKS.filter((ch) => !results.get(ch.id).ok && ch.severity === "warning");
+    log(c.dim("  ────────────────────────────────────────────────"));
+    if (errors.length === 0 && warnings.length === 0) {
+        log(c.bold(c.green("  ✓  全部检查通过！")));
+    }
+    else {
+        if (errors.length > 0)
+            log(c.bold(c.red(`  ✗  ${errors.length} 个错误（Error）`)));
+        if (warnings.length > 0)
+            log(c.bold(c.yellow(`  !  ${warnings.length} 个警告（Warning）`)));
+        if (fix && (errors.length > 0 || warnings.length > 0)) {
+            log(c.dim("  部分问题需要手动处理，请参考上方的「建议」提示。"));
+        }
+    }
+    log("");
+    return errors.length === 0;
+}
+//# sourceMappingURL=doctor.js.map