klyro 1.0.1 → 1.0.2

package/dist/agent/stream-budget.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Rate-limit scheduler for provider streams.
+ *
+ * A global in-flight counter + FIFO semaphore caps concurrent
+ * `ProviderAdapter.stream` calls at `MAX_CONCURRENT_STREAMS` (4). An
+ * adaptive cooldown collapses the cap to 1 while a recent 429 was
+ * observed (`noteRateLimited`), honouring an optional server-provided
+ * `Retry-After` delay, otherwise 60s.
+ *
+ * Consumed by `retryingAdapter` (see `./retry.js`), which acquires one
+ * slot around each `inner.stream` call and releases it in a `finally`.
+ * Aborted waiters are dequeued and rejected promptly.
+ */
+export declare const MAX_CONCURRENT_STREAMS = 4;
+/** Fallback cooldown when no Retry-After delay was provided. */
+export declare const DEFAULT_RATE_LIMIT_COOLDOWN_MS = 60000;
+/**
+ * Record a 429 (or equivalent) rate-limit signal. Collapses the stream
+ * cap to 1 for `retryAfterMs` (or 60s when absent/invalid).
+ */
+export declare function noteRateLimited(retryAfterMs?: number): void;
+/**
+ * Acquire a stream slot. Grants immediately when `inFlight` is under the
+ * effective cap, otherwise queues FIFO until a release (or the cooldown
+ * lifting) frees one. Abort-aware: an already-aborted signal rejects
+ * immediately; aborting while queued dequeues and rejects promptly.
+ */
+export declare function acquireStreamSlot(signal?: AbortSignal): Promise<() => void>;
+/** Observable budget state (tests/diagnostics). */
+export declare function streamBudgetState(): {
+    inFlight: number;
+    queued: number;
+    cap: number;
+};
+/** Reset the budget (counters, cooldown, queued waiters). Tests only. */
+export declare function setStreamBudgetForTests(): void;

package/dist/agent/stream-budget.js

@@ -0,0 +1,121 @@
+/**
+ * Rate-limit scheduler for provider streams.
+ *
+ * A global in-flight counter + FIFO semaphore caps concurrent
+ * `ProviderAdapter.stream` calls at `MAX_CONCURRENT_STREAMS` (4). An
+ * adaptive cooldown collapses the cap to 1 while a recent 429 was
+ * observed (`noteRateLimited`), honouring an optional server-provided
+ * `Retry-After` delay, otherwise 60s.
+ *
+ * Consumed by `retryingAdapter` (see `./retry.js`), which acquires one
+ * slot around each `inner.stream` call and releases it in a `finally`.
+ * Aborted waiters are dequeued and rejected promptly.
+ */
+export const MAX_CONCURRENT_STREAMS = 4;
+/** Fallback cooldown when no Retry-After delay was provided. */
+export const DEFAULT_RATE_LIMIT_COOLDOWN_MS = 60_000;
+let inFlight = 0;
+/** `Date.now()` timestamp until which the cap stays collapsed at 1. */
+let recent429Until = 0;
+const queue = [];
+function abortError() {
+    const err = new Error('stream slot acquisition aborted');
+    err.name = 'AbortError';
+    return err;
+}
+function effectiveCap(now = Date.now()) {
+    return now < recent429Until ? 1 : MAX_CONCURRENT_STREAMS;
+}
+function makeRelease() {
+    let released = false;
+    return () => {
+        if (released)
+            return;
+        released = true;
+        inFlight = Math.max(0, inFlight - 1);
+        pump();
+    };
+}
+/** Grant queued waiters while a slot is free under the current cap. */
+function pump() {
+    while (queue.length > 0 && inFlight < effectiveCap()) {
+        const waiter = queue.shift();
+        if (!waiter)
+            break;
+        if (waiter.signal?.aborted) {
+            waiter.reject(abortError());
+            continue;
+        }
+        if (waiter.signal && waiter.onAbort) {
+            waiter.signal.removeEventListener('abort', waiter.onAbort);
+        }
+        inFlight += 1;
+        waiter.resolve(makeRelease());
+    }
+}
+/**
+ * Record a 429 (or equivalent) rate-limit signal. Collapses the stream
+ * cap to 1 for `retryAfterMs` (or 60s when absent/invalid).
+ */
+export function noteRateLimited(retryAfterMs) {
+    const cooldown = typeof retryAfterMs === 'number' &&
+        Number.isFinite(retryAfterMs) &&
+        retryAfterMs >= 0
+        ? retryAfterMs
+        : DEFAULT_RATE_LIMIT_COOLDOWN_MS;
+    recent429Until = Date.now() + cooldown;
+    // Wake queued waiters once the cooldown lifts even if no release
+    // happens in between (holders may outlive the cooldown). Unref'd so
+    // tests and short-lived processes never hang on this timer.
+    if (cooldown > 0 && cooldown < 3_600_000) {
+        const timer = setTimeout(pump, cooldown);
+        timer.unref?.();
+    }
+}
+/**
+ * Acquire a stream slot. Grants immediately when `inFlight` is under the
+ * effective cap, otherwise queues FIFO until a release (or the cooldown
+ * lifting) frees one. Abort-aware: an already-aborted signal rejects
+ * immediately; aborting while queued dequeues and rejects promptly.
+ */
+export function acquireStreamSlot(signal) {
+    if (signal?.aborted)
+        return Promise.reject(abortError());
+    if (inFlight < effectiveCap()) {
+        inFlight += 1;
+        return Promise.resolve(makeRelease());
+    }
+    return new Promise((resolve, reject) => {
+        const waiter = { resolve, reject };
+        if (signal) {
+            waiter.signal = signal;
+            waiter.onAbort = () => {
+                const idx = queue.indexOf(waiter);
+                if (idx >= 0)
+                    queue.splice(idx, 1);
+                reject(abortError());
+            };
+            signal.addEventListener('abort', waiter.onAbort, { once: true });
+        }
+        queue.push(waiter);
+        // Re-check: the cap may have widened (cooldown expiry) between the
+        // fast-path check and the push.
+        pump();
+    });
+}
+/** Observable budget state (tests/diagnostics). */
+export function streamBudgetState() {
+    return { inFlight, queued: queue.length, cap: effectiveCap() };
+}
+/** Reset the budget (counters, cooldown, queued waiters). Tests only. */
+export function setStreamBudgetForTests() {
+    inFlight = 0;
+    recent429Until = 0;
+    const pending = queue.splice(0, queue.length);
+    for (const waiter of pending) {
+        if (waiter.signal && waiter.onAbort) {
+            waiter.signal.removeEventListener('abort', waiter.onAbort);
+        }
+        waiter.reject(new Error('stream budget reset'));
+    }
+}

package/dist/checkpoints/store.d.ts

@@ -1,5 +1,14 @@
 /**
  * 4.5 — Checkpoint snapshots: every mutation to checkpoints dir
+ *
+ * Snapshot bytes stay RAW (no redaction): checkpoint copies must be
+ * bit-identical to the working tree so undo() restores exact fidelity —
+ * redacting at snapshot time would corrupt restores (a redacted snapshot
+ * written back would permanently replace real code with [REDACTED]).
+ * Same-trust-domain rationale: snapshots never leave the project dir and
+ * are only read back by undo() into the same tree, so secret hygiene is
+ * enforced at the trace/persist boundaries (TraceWriter, SessionStore)
+ * instead of here.
  */
 export declare function snapshot(cwd: string, files: string[]): Promise<string>;
 export declare function listCheckpoints(cwd: string): Promise<string[]>;

package/dist/checkpoints/store.js

@@ -1,12 +1,34 @@
 /**
  * 4.5 — Checkpoint snapshots: every mutation to checkpoints dir
+ *
+ * Snapshot bytes stay RAW (no redaction): checkpoint copies must be
+ * bit-identical to the working tree so undo() restores exact fidelity —
+ * redacting at snapshot time would corrupt restores (a redacted snapshot
+ * written back would permanently replace real code with [REDACTED]).
+ * Same-trust-domain rationale: snapshots never leave the project dir and
+ * are only read back by undo() into the same tree, so secret hygiene is
+ * enforced at the trace/persist boundaries (TraceWriter, SessionStore)
+ * instead of here.
  */
 import * as fs from 'node:fs/promises';
+import * as fsSync from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 function ckptDir(cwd) {
     return path.join(cwd, '.klyro', 'checkpoints');
 }
+/**
+ * Best-effort permission lockdown (0600 files / 0700 dirs).
+ * Windows ACLs ignore POSIX mode bits — no-op by design.
+ */
+function lockDown(p, mode) {
+    if (process.platform === 'win32')
+        return;
+    try {
+        fsSync.chmodSync(p, mode);
+    }
+    catch { /* best-effort only */ }
+}
 /** Best-effort fsync of a just-written file (crash safety). */
 async function fsyncFile(p) {
     try {
@@ -35,9 +57,11 @@ function containedPath(cwd, base, rel) {
 export async function snapshot(cwd, files) {
     const dir = ckptDir(cwd);
     await fs.mkdir(dir, { recursive: true });
+    lockDown(dir, 0o700);
     const id = `${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
     const dest = path.join(dir, id);
     await fs.mkdir(dest, { recursive: true });
+    lockDown(dest, 0o700);
     const missing = [];
     const kept = [];
     for (const f of files) {
@@ -52,6 +76,7 @@ export async function snapshot(cwd, files) {
                 continue;
             await fs.mkdir(path.dirname(out), { recursive: true });
             await fs.writeFile(out, data);
+            lockDown(out, 0o600);
             await fsyncFile(out);
             kept.push(rel);
         }
@@ -65,6 +90,7 @@ export async function snapshot(cwd, files) {
     // SessionStore.writeIndex atomic pattern).
     const metaPath = path.join(dest, '.meta.json');
     await fs.writeFile(metaPath, JSON.stringify({ id, files: kept, missing, ts: Date.now() }, null, 2));
+    lockDown(metaPath, 0o600);
     await fsyncFile(metaPath);
     // Best-effort last.diff for the repair guard (guardRepair reads it).
     try {

package/dist/cli/commit.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `klyro commit` — conventional commit of already-staged changes.
+ *
+ * Steps:
+ *   (a) `git status --porcelain` must show staged entries (index column set).
+ *       Nothing staged → error 'nothing staged (git add first)', exit 2.
+ *       (`--yes` never bypasses this — there is nothing to commit.)
+ *   (b) Secret-scan the staged diff via `redact()`: if redaction shrinks or
+ *       alters the diff, refuse and list the files (exit 2) unless
+ *       `--force-secret` is passed.
+ *   (c) Build a conventional message: type heuristic + top-dir scope +
+ *       `--message` summary (or `update <n> files`).
+ *   (d) `git commit -m` via execFileSync (no shell). Verification hooks always
+ *       run — by construction this file contains no flag that skips them.
+ *   (e) `--dry-run` prints the message + files and exits 0 without committing.
+ */
+export interface CommitOptions {
+    cwd: string;
+    yes?: boolean;
+    dryRun?: boolean;
+    message?: string;
+    forceSecret?: boolean;
+}
+/** Porcelain XY: staged iff the index (first) column is set. Handles renames. */
+export declare function stagedFilesFromPorcelain(porcelain: string): string[];
+/** Type heuristic: test-only→test, docs-only→docs, lockfiles→chore, else feat. */
+export declare function commitTypeFor(files: string[]): string;
+/** Scope = most common top-level dir among staged files with a dir; '' if none. */
+export declare function commitScopeFor(files: string[]): string;
+export declare function buildCommitMessage(files: string[], summaryOpt?: string): string;
+export declare function runCommit(opts: CommitOptions): Promise<number>;

package/dist/cli/commit.js

@@ -0,0 +1,142 @@
+/**
+ * `klyro commit` — conventional commit of already-staged changes.
+ *
+ * Steps:
+ *   (a) `git status --porcelain` must show staged entries (index column set).
+ *       Nothing staged → error 'nothing staged (git add first)', exit 2.
+ *       (`--yes` never bypasses this — there is nothing to commit.)
+ *   (b) Secret-scan the staged diff via `redact()`: if redaction shrinks or
+ *       alters the diff, refuse and list the files (exit 2) unless
+ *       `--force-secret` is passed.
+ *   (c) Build a conventional message: type heuristic + top-dir scope +
+ *       `--message` summary (or `update <n> files`).
+ *   (d) `git commit -m` via execFileSync (no shell). Verification hooks always
+ *       run — by construction this file contains no flag that skips them.
+ *   (e) `--dry-run` prints the message + files and exits 0 without committing.
+ */
+import { execFileSync } from 'node:child_process';
+import { redact } from '../policy/secret-redactor.js';
+function git(cwd, args) {
+    return execFileSync('git', args, { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] }).toString();
+}
+/** Porcelain XY: staged iff the index (first) column is set. Handles renames. */
+export function stagedFilesFromPorcelain(porcelain) {
+    const out = [];
+    for (const line of porcelain.split('\n')) {
+        if (line.length < 4)
+            continue;
+        const indexStatus = line[0];
+        if (indexStatus === ' ' || indexStatus === '?' || indexStatus === '!')
+            continue;
+        let file = line.slice(3).trim();
+        // Rename/copy form: "old -> new" — the new path is what's committed.
+        const arrow = file.indexOf(' -> ');
+        if (arrow !== -1)
+            file = file.slice(arrow + 4);
+        // Quoted paths from core.quotePath — strip surrounding quotes.
+        if (file.startsWith('"') && file.endsWith('"'))
+            file = file.slice(1, -1);
+        if (file)
+            out.push(file);
+    }
+    return out;
+}
+const LOCKFILES = new Set([
+    'package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'Cargo.lock',
+    'Gemfile.lock', 'poetry.lock', 'composer.lock',
+]);
+function isTestPath(f) {
+    const l = f.toLowerCase();
+    return (l.includes('.test.') || l.includes('.spec.') ||
+        l.includes('__tests__') || /(^|\/)tests?\//.test(l) || /(^|\/)spec\//.test(l));
+}
+function isDocsPath(f) {
+    const l = f.toLowerCase();
+    return l.endsWith('.md') || l.startsWith('docs/') || l.includes('/docs/');
+}
+/** Type heuristic: test-only→test, docs-only→docs, lockfiles→chore, else feat. */
+export function commitTypeFor(files) {
+    if (files.length > 0 && files.every((f) => LOCKFILES.has(f.split('/').pop() ?? f)))
+        return 'chore';
+    if (files.length > 0 && files.every(isTestPath))
+        return 'test';
+    if (files.length > 0 && files.every(isDocsPath))
+        return 'docs';
+    return 'feat';
+}
+/** Scope = most common top-level dir among staged files with a dir; '' if none. */
+export function commitScopeFor(files) {
+    const counts = new Map();
+    for (const f of files) {
+        const slash = f.indexOf('/');
+        if (slash > 0) {
+            const top = f.slice(0, slash);
+            counts.set(top, (counts.get(top) ?? 0) + 1);
+        }
+    }
+    let best = '';
+    let bestN = 0;
+    for (const [dir, n] of counts) {
+        if (n > bestN) {
+            best = dir;
+            bestN = n;
+        }
+    }
+    return best;
+}
+export function buildCommitMessage(files, summaryOpt) {
+    const type = commitTypeFor(files);
+    const scope = commitScopeFor(files);
+    const summary = (summaryOpt ?? '').trim() || `update ${files.length} file${files.length === 1 ? '' : 's'}`;
+    return scope ? `${type}(${scope}): ${summary}` : `${type}: ${summary}`;
+}
+export async function runCommit(opts) {
+    void opts.yes; // accepted for uniformity; never bypasses the staged check
+    const cwd = opts.cwd;
+    let porcelain;
+    try {
+        porcelain = git(cwd, ['status', '--porcelain']);
+    }
+    catch (err) {
+        process.stderr.write(`klyro: commit: not a git repo or git unavailable (${err instanceof Error ? err.message.split('\n')[0] : String(err)})\n`);
+        return 2;
+    }
+    const staged = stagedFilesFromPorcelain(porcelain);
+    if (staged.length === 0) {
+        process.stderr.write('klyro: commit: nothing staged (git add first)\n');
+        return 2;
+    }
+    let namesOnly;
+    try {
+        namesOnly = git(cwd, ['diff', '--cached', '--name-only']).split('\n').map((s) => s.trim()).filter(Boolean);
+    }
+    catch {
+        namesOnly = staged;
+    }
+    const files = namesOnly.length > 0 ? namesOnly : staged;
+    // (b) secret scan of the staged diff (read-only — redact() never writes).
+    try {
+        const diff = git(cwd, ['diff', '--cached', '--']);
+        if (redact(diff) !== diff && !opts.forceSecret) {
+            process.stderr.write(`klyro: commit: refused — possible secret in staged diff (files: ${files.join(', ')}). Review with \`git diff --cached\`, unstage the secret, or re-run with --force-secret.\n`);
+            return 2;
+        }
+    }
+    catch {
+        // Could not read the diff — proceed; the commit itself is authoritative.
+    }
+    const message = buildCommitMessage(files, opts.message);
+    if (opts.dryRun) {
+        process.stdout.write(`${message}\nfiles:\n${files.map((f) => `  ${f}`).join('\n')}\n`);
+        return 0;
+    }
+    try {
+        // NOTE: verification hooks must run — no skip flag is ever passed here.
+        execFileSync('git', ['commit', '-m', message], { cwd, stdio: 'inherit' });
+    }
+    catch {
+        process.stderr.write('klyro: commit: `git commit` failed (see output above)\n');
+        return 1;
+    }
+    return 0;
+}

package/dist/cli/config.d.ts

@@ -17,8 +17,53 @@ export declare const ConfigSchema: z.ZodObject<{
     api_key: z.ZodOptional<z.ZodString>;
     'model.default': z.ZodOptional<z.ZodString>;
     'model.small': z.ZodOptional<z.ZodString>;
+    providers: z.ZodOptional<z.ZodObject<{
+        failover: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            provider: z.ZodEnum<{
+                openai: "openai";
+                anthropic: "anthropic";
+            }>;
+            baseURL: z.ZodOptional<z.ZodString>;
+            apiKey: z.ZodOptional<z.ZodString>;
+            apiKeyEnv: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
 }, z.core.$loose>;
 export type KlyroConfig = z.infer<typeof ConfigSchema>;
+export declare const FailoverEntrySchema: z.ZodObject<{
+    provider: z.ZodEnum<{
+        openai: "openai";
+        anthropic: "anthropic";
+    }>;
+    baseURL: z.ZodOptional<z.ZodString>;
+    apiKey: z.ZodOptional<z.ZodString>;
+    apiKeyEnv: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type FailoverEntry = z.infer<typeof FailoverEntrySchema>;
+export declare const FailoverConfigSchema: z.ZodObject<{
+    failover: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        provider: z.ZodEnum<{
+            openai: "openai";
+            anthropic: "anthropic";
+        }>;
+        baseURL: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        apiKeyEnv: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export interface ResolvedProviderEntry {
+    provider: 'openai' | 'anthropic';
+    baseURL?: string;
+    apiKey?: string;
+}
+/**
+ * Build the ordered provider chain: primary (existing precedence:
+ * flags > env > merged config > defaults) followed by `providers.failover`
+ * entries. `apiKeyEnv` names an env var resolved at build time; entries
+ * whose key is missing/empty are skipped (with a stderr reason) so a
+ * half-configured fallback can never become the active provider.
+ */
+export declare function resolveProviderChain(cwd?: string, flags?: Record<string, unknown>): Promise<ResolvedProviderEntry[]>;
 export declare function getConfigDir(): string;
 export declare function getConfigPath(): string;
 export declare function getConfigSearchPaths(cwd?: string): Array<{

package/dist/cli/config.js

@@ -24,8 +24,90 @@ export const ConfigSchema = z
     // Global flags persisted
     'model.default': z.string().optional(),
     'model.small': z.string().optional(),
+    // Provider failover chain (L15): ordered fallbacks after the primary.
+    // Optional so existing configs keep validating; invalid entries exit 3.
+    providers: z
+        .object({
+        failover: z
+            .array(z.object({
+            provider: z.enum(['openai', 'anthropic']),
+            baseURL: z.string().optional(),
+            apiKey: z.string().optional(),
+            apiKeyEnv: z.string().optional(),
+        }))
+            .optional(),
+    })
+        .optional(),
 })
     .passthrough();
+// --- Provider failover chain (L15 differentiator) ---
+// `providers.failover` is an ordered list of fallback providers. Entries
+// with unresolvable/missing API keys are skipped at chain-build time.
+export const FailoverEntrySchema = z.object({
+    provider: z.enum(['openai', 'anthropic']),
+    baseURL: z.string().optional(),
+    apiKey: z.string().optional(),
+    apiKeyEnv: z.string().optional(),
+});
+export const FailoverConfigSchema = z.object({
+    failover: z.array(FailoverEntrySchema).optional(),
+});
+/**
+ * Build the ordered provider chain: primary (existing precedence:
+ * flags > env > merged config > defaults) followed by `providers.failover`
+ * entries. `apiKeyEnv` names an env var resolved at build time; entries
+ * whose key is missing/empty are skipped (with a stderr reason) so a
+ * half-configured fallback can never become the active provider.
+ */
+export async function resolveProviderChain(cwd = process.cwd(), flags = {}) {
+    const merged = await loadMergedConfig(cwd, flags);
+    const chain = [];
+    const skipped = [];
+    // Primary — mirror the precedence resolveProvider uses: explicit flags,
+    // then KLYRO_* env, then merged config.
+    const flagProvider = typeof flags['provider'] === 'string' ? flags['provider'] : undefined;
+    const flagBaseUrl = typeof flags['baseUrl'] === 'string' ? flags['baseUrl'] : typeof flags['baseURL'] === 'string' ? flags['baseURL'] : undefined;
+    const flagApiKey = typeof flags['apiKey'] === 'string' ? flags['apiKey'] : undefined;
+    const primaryProvider = (flagProvider ?? merged.provider ?? process.env.KLYRO_PROVIDER ?? 'openai');
+    const primaryBaseURL = flagBaseUrl ?? merged.baseUrl ?? merged.baseURL ?? process.env.KLYRO_BASE_URL;
+    const primaryApiKey = flagApiKey ?? merged.apiKey ?? merged.api_key ?? process.env.KLYRO_API_KEY;
+    if (primaryProvider === 'openai' || primaryProvider === 'anthropic') {
+        chain.push({
+            provider: primaryProvider,
+            ...(primaryBaseURL ? { baseURL: primaryBaseURL } : {}),
+            ...(primaryApiKey ? { apiKey: primaryApiKey } : {}),
+        });
+    }
+    // Failover list — validated leniently (invalid entries skipped, never fatal).
+    const providersRaw = merged.providers;
+    const parsed = FailoverConfigSchema.safeParse(providersRaw ?? {});
+    if (parsed.success && parsed.data.failover) {
+        for (const entry of parsed.data.failover) {
+            let key = entry.apiKey;
+            if (!key && entry.apiKeyEnv) {
+                const v = process.env[entry.apiKeyEnv];
+                if (v && v.length > 0)
+                    key = v;
+            }
+            if (!key) {
+                skipped.push(`failover ${entry.provider}${entry.apiKeyEnv ? ` (env ${entry.apiKeyEnv} unset)` : ' (no apiKey)'}`);
+                continue;
+            }
+            chain.push({
+                provider: entry.provider,
+                ...(entry.baseURL ? { baseURL: entry.baseURL } : {}),
+                apiKey: key,
+            });
+        }
+    }
+    for (const reason of skipped) {
+        try {
+            process.stderr.write(`klyro: skipping failover entry — ${reason}\n`);
+        }
+        catch { /* ignore */ }
+    }
+    return chain;
+}
 // --- Paths ---
 export function getConfigDir() {
     if (process.env.KLYRO_CONFIG_DIR)

package/dist/cli/doctor.d.ts

@@ -5,4 +5,5 @@
  */
 export declare function runDoctor(opts?: {
     json?: boolean;
+    cwd?: string;
 }): Promise<number>;

package/dist/cli/doctor.js

@@ -10,7 +10,6 @@ import { spawn } from 'node:child_process';
 import { getConfigPath, loadConfig } from './config.js';
 import { resolveProvider, providerHelp } from '../providers.js';
 import { getDefaultSessionsDir } from '../persistence/session.js';
-import { builtinRegistry } from '../tools/registry.js';
 function checkNode() {
     const v = process.versions.node;
     const major = Number(v.split('.')[0] ?? 0);
@@ -94,26 +93,92 @@ function checkGit() {
         });
     });
 }
-function checkTools() {
-    const reg = builtinRegistry();
-    return { name: 'Tools', ok: true, detail: `${reg.list().length} tools: ${reg.list().map((t) => t.name).join(', ')}` };
+async function checkTools() {
+    try {
+        const { builtinRegistry } = await import('../tools/registry.js');
+        const reg = builtinRegistry();
+        return { name: 'Tools', ok: true, detail: `${reg.list().length} tools: ${reg.list().map((t) => t.name).join(', ')}` };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { name: 'Tools', ok: false, detail: `registry unavailable: ${msg}` };
+    }
 }
 function checkPlatform() {
     const ok = ['win32', 'linux', 'darwin'].includes(process.platform);
     return { name: 'Platform', ok, detail: `${process.platform} ${process.arch} ${ok ? '✓' : '✗ unsupported'}` };
 }
+async function checkMcp(cwd) {
+    try {
+        const { loadMcpServers } = await import('../mcp/config.js');
+        const cfg = loadMcpServers(cwd);
+        const names = Object.keys(cfg.servers);
+        if (names.length === 0)
+            return { name: 'MCP servers', ok: true, detail: 'none' };
+        let project = 0;
+        for (const n of names) {
+            if (cfg.sources[n] === 'project')
+                project++;
+        }
+        return { name: 'MCP servers', ok: true, detail: `${names.length} servers (global ${names.length - project}/project ${project})` };
+    }
+    catch {
+        return { name: 'MCP servers', ok: true, detail: 'none' };
+    }
+}
+function countTrustEntries(p) {
+    try {
+        const raw = fsSync.readFileSync(p, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return Object.keys(parsed).length;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+async function checkTrust() {
+    try {
+        const [{ defaultTrustStorePath }] = [await import('../context/trust.js')];
+        const [{ defaultMcpTrustStorePath }] = [await import('../mcp/trust.js')];
+        const ctx = countTrustEntries(defaultTrustStorePath());
+        const mcp = countTrustEntries(defaultMcpTrustStorePath());
+        if (ctx === null && mcp === null)
+            return { name: 'Trust stores', ok: true, detail: 'none' };
+        return {
+            name: 'Trust stores',
+            ok: true,
+            detail: `context-trust ${ctx ?? 0} entries, mcp-trust ${mcp ?? 0} entries`,
+        };
+    }
+    catch {
+        return { name: 'Trust stores', ok: true, detail: 'none' };
+    }
+}
 export async function runDoctor(opts = {}) {
+    const cwd = opts.cwd ?? process.cwd();
     const checks = [];
     checks.push(checkNode());
     checks.push(await checkConfig());
     checks.push(await checkProvider());
     checks.push(await checkSessions());
     checks.push(await checkGit());
-    checks.push(checkTools());
+    checks.push(await checkTools());
     checks.push(checkPlatform());
+    const mcpCheck = await checkMcp(cwd);
+    const trustCheck = await checkTrust();
+    checks.push(mcpCheck);
+    checks.push(trustCheck);
     const allOk = checks.every((c) => c.ok);
     if (opts.json) {
-        process.stdout.write(JSON.stringify({ ok: allOk, checks }, null, 2) + '\n');
+        process.stdout.write(JSON.stringify({
+            ok: allOk,
+            checks,
+            mcp: { ok: mcpCheck.ok, detail: mcpCheck.detail },
+            trust: { ok: trustCheck.ok, detail: trustCheck.detail },
+        }, null, 2) + '\n');
         return allOk ? 0 : 1;
     }
     process.stdout.write('\nklyro doctor\n');