prismalens 0.0.1

package/dist/src/cli/doctor.js

@@ -0,0 +1,156 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Sumit Patel
+/**
+ * `prismalens doctor` — preflight checklist for the two-tier engine (ADR-0008/0010).
+ *
+ * Salvaged in spirit from the retired pl orchestrator's doctor, but pared down to the
+ * checks that actually gate a run:
+ *  - HARD: the configured harness binary is on PATH
+ *      (deepagents -> "deepagents", claude-code -> "claude", codex -> "codex")
+ *  - HARD: an LLM credential is present
+ *      (any provider credential env var from LLM_PROVIDERS, or, for claude-code,
+ *       a signed-in ~/.claude/.credentials.json)
+ *  - SOFT: workspace.base_dir is writable
+ *
+ * Prints pass/fail per check; exits non-zero iff a HARD check fails. No tinyexec /
+ * check-tool helper here — availability is a dependency-free PATH scan.
+ */
+import { accessSync, existsSync, constants as fsConstants } from "node:fs";
+import { access, mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { delimiter, join } from "node:path";
+import { HARNESS_BINARY } from "@prismalens/config/harness";
+import { LLM_CREDENTIAL_ENV_VARS } from "@prismalens/config/llm";
+import { defineCommand } from "citty";
+import consola from "consola";
+import { loadConfig } from "../config/loader.js";
+import { PlConfigSchema } from "../config/schema.js";
+import { resolveBaseDir } from "../core/session.js";
+/** Is `bin` an executable somewhere on PATH? Synchronous, dependency-free. */
+function isOnPath(bin) {
+    const pathEnv = process.env.PATH ?? "";
+    const exts = process.platform === "win32"
+        ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";")
+        : [""];
+    for (const dir of pathEnv.split(delimiter)) {
+        if (dir.length === 0)
+            continue;
+        for (const ext of exts) {
+            try {
+                accessSync(join(dir, bin + ext), fsConstants.X_OK);
+                return true;
+            }
+            catch {
+                // not in this dir / not executable — keep looking
+            }
+        }
+    }
+    return false;
+}
+function checkHarness(harness) {
+    const binary = HARNESS_BINARY[harness];
+    const pass = isOnPath(binary);
+    return {
+        name: "Harness binary",
+        pass,
+        detail: pass
+            ? `${binary} found on PATH (harness: ${harness})`
+            : `${binary} not found on PATH — install the "${harness}" harness`,
+        hard: true,
+    };
+}
+function checkCredential(harness) {
+    const envVar = LLM_CREDENTIAL_ENV_VARS.find((name) => (process.env[name]?.length ?? 0) > 0);
+    const credentialsFile = join(homedir(), ".claude", ".credentials.json");
+    const hasClaudeLogin = harness === "claude-code" && existsSync(credentialsFile);
+    if (envVar) {
+        return {
+            name: "LLM credential",
+            pass: true,
+            detail: `${envVar} is set`,
+            hard: true,
+        };
+    }
+    if (hasClaudeLogin) {
+        return {
+            name: "LLM credential",
+            pass: true,
+            detail: "~/.claude/.credentials.json present (Claude Code login)",
+            hard: true,
+        };
+    }
+    const hint = harness === "claude-code"
+        ? "set ANTHROPIC_API_KEY or sign in with `claude` (creates ~/.claude/.credentials.json)"
+        : `set one of ${LLM_CREDENTIAL_ENV_VARS.join(", ")}`;
+    return {
+        name: "LLM credential",
+        pass: false,
+        detail: `no LLM credential found — ${hint}`,
+        hard: true,
+    };
+}
+async function checkWorkspace(config) {
+    const baseDir = resolveBaseDir(config.workspace.base_dir);
+    try {
+        await mkdir(baseDir, { recursive: true });
+        await access(baseDir, fsConstants.W_OK);
+        return {
+            name: "Workspace",
+            pass: true,
+            detail: `${baseDir} is writable`,
+            hard: false,
+        };
+    }
+    catch {
+        return {
+            name: "Workspace",
+            pass: false,
+            detail: `${baseDir} is not writable — runs cannot persist here`,
+            hard: false,
+        };
+    }
+}
+export default defineCommand({
+    meta: {
+        name: "doctor",
+        description: "Preflight check the investigation environment",
+    },
+    async run() {
+        // loadConfig applies schema defaults, so this succeeds even with no config
+        // file. It only throws on an invalid file / unset ${VAR}; fall back to the
+        // built-in defaults so doctor can still report what it can.
+        let config;
+        try {
+            config = await loadConfig();
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            consola.warn(`Could not load config (${detail}); using built-in defaults.`);
+            config = PlConfigSchema.parse({});
+        }
+        const harness = config.agent.default;
+        const checks = [
+            checkHarness(harness),
+            checkCredential(harness),
+            await checkWorkspace(config),
+        ];
+        consola.log("");
+        for (const check of checks) {
+            const line = `${check.name}: ${check.detail}`;
+            if (check.pass)
+                consola.success(line);
+            else if (check.hard)
+                consola.error(line);
+            else
+                consola.warn(line);
+        }
+        consola.log("");
+        const hardFailures = checks.filter((c) => c.hard && !c.pass);
+        if (hardFailures.length > 0) {
+            consola.error(`${hardFailures.length} required check(s) failed — fix the above before investigating.`);
+            process.exit(1);
+        }
+        consola.success("All required checks passed.");
+    },
+});
+//# sourceMappingURL=doctor.js.map

package/dist/src/cli/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/cli/doctor.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6BAA6B;AAE7B;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAiB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAapD,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,GAAW;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GACT,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC3B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAC3D,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC;gBACJ,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBACnD,OAAO,IAAI,CAAC;YACb,CAAC;YAAC,MAAM,CAAC;gBACR,kDAAkD;YACnD,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACrC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO;QACN,IAAI,EAAE,gBAAgB;QACtB,IAAI;QACJ,MAAM,EAAE,IAAI;YACX,CAAC,CAAC,GAAG,MAAM,4BAA4B,OAAO,GAAG;YACjD,CAAC,CAAC,GAAG,MAAM,qCAAqC,OAAO,WAAW;QACnE,IAAI,EAAE,IAAI;KACV,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACxC,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAC1C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAC9C,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACxE,MAAM,cAAc,GACnB,OAAO,KAAK,aAAa,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;IAE1D,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,MAAM,SAAS;YAC1B,IAAI,EAAE,IAAI;SACV,CAAC;IACH,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO;YACN,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,yDAAyD;YACjE,IAAI,EAAE,IAAI;SACV,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GACT,OAAO,KAAK,aAAa;QACxB,CAAC,CAAC,sFAAsF;QACxF,CAAC,CAAC,cAAc,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvD,OAAO;QACN,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,6BAA6B,IAAI,EAAE;QAC3C,IAAI,EAAE,IAAI;KACV,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAgB;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG,OAAO,cAAc;YAChC,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,GAAG,OAAO,6CAA6C;YAC/D,IAAI,EAAE,KAAK;SACX,CAAC;IACH,CAAC;AACF,CAAC;AAED,eAAe,aAAa,CAAC;IAC5B,IAAI,EAAE;QACL,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,+CAA+C;KAC5D;IACD,KAAK,CAAC,GAAG;QACR,2EAA2E;QAC3E,2EAA2E;QAC3E,4DAA4D;QAC5D,IAAI,MAAgB,CAAC;QACrB,IAAI,CAAC;YACJ,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CACX,0BAA0B,MAAM,6BAA6B,CAC7D,CAAC;YACF,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAErC,MAAM,MAAM,GAAY;YACvB,YAAY,CAAC,OAAO,CAAC;YACrB,eAAe,CAAC,OAAO,CAAC;YACxB,MAAM,cAAc,CAAC,MAAM,CAAC;SAC5B,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,IAAI;gBAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;iBACjC,IAAI,KAAK,CAAC,IAAI;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;;gBACpC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CACZ,GAAG,YAAY,CAAC,MAAM,iEAAiE,CACvF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAChD,CAAC;CACD,CAAC,CAAC"}

package/dist/src/cli/init.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("citty").CommandDef<import("citty").ArgsDef>;
+export default _default;
+//# sourceMappingURL=init.d.ts.map

package/dist/src/cli/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/cli/init.ts"],"names":[],"mappings":";AAyEA,wBAyBG"}

package/dist/src/cli/init.js

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Sumit Patel
+/**
+ * `prismalens init` — scaffold a prismalens.config.yaml in the cwd.
+ *
+ * Behaviour (intentionally non-interactive, unlike the retired pl orchestrator's
+ * wizard): if a prismalens.config.yaml already exists, print a notice and do
+ * nothing; otherwise write a commented default. Values are sourced from the Zod
+ * schema's defaults so the scaffold can't drift from what the engine actually uses.
+ */
+import { existsSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { INVESTIGATION_DEFAULTS } from "@prismalens/config/investigation";
+import { defineCommand } from "citty";
+import consola from "consola";
+import { AgentConfigSchema, PlConfigSchema, } from "../config/schema.js";
+const CONFIG_FILENAME = "prismalens.config.yaml";
+/** Render a commented default config, sourcing live values from schema defaults. */
+function renderDefaultConfig(d) {
+    const harnessOptions = AgentConfigSchema.shape.default
+        .removeDefault()
+        .options.join(" | ");
+    return `# prismalens.config.yaml — investigation engine configuration (ADR-0008/0010).
+# Generated by \`prismalens init\`. Unset values fall back to built-in defaults;
+# \`prismalens doctor\` checks the bits that gate a run.
+
+# Repository under investigation (owner/name). Auto-detected from the git remote
+# when omitted.
+# repo: owner/name
+
+# Tier-2 harness backend the supervisor rents (ADR-0008).
+agent:
+  # Which agent harness to rent: ${harnessOptions}
+  default: ${d.agent.default}
+  # BARE model id, e.g. "gpt-oss:120b" — the harness applies its own provider prefix.
+  # Omit to let the chosen harness pick its own default.
+  # model: gpt-oss:120b
+
+# Read-only telemetry + app endpoints the harness may query. Point these at your
+# stack; defaults assume a local dev setup.
+telemetry:
+  prometheusUrl: ${INVESTIGATION_DEFAULTS.telemetry.prometheusUrl}
+  alertmanagerUrl: ${INVESTIGATION_DEFAULTS.telemetry.alertmanagerUrl}
+  apiUrl: ${INVESTIGATION_DEFAULTS.telemetry.apiUrl}
+
+# Read-only log-query system the harness may curl (Loki, Elasticsearch, …).
+# logs:
+#   kind: loki
+#   url: http://localhost:3100
+
+# Service catalog (ADR-0015). The alert's \`service\` label (else \`namespace\`/\`job\`)
+# selects an entry; \`--service <name>\` overrides. The matched service's repo/tier/
+# deps ride into the investigation context so a single-alert run isn't context-free.
+# services:
+#   checkout:
+#     tier: tier-1
+#     repo: acme/checkout
+#     depends_on: [payments, inventory]
+
+# Where runs, events, and reports are stored.
+workspace:
+  base_dir: ${d.workspace.base_dir}
+`;
+}
+export default defineCommand({
+    meta: {
+        name: "init",
+        description: `Scaffold a ${CONFIG_FILENAME} in the current directory`,
+    },
+    async run() {
+        const configPath = resolve(process.cwd(), CONFIG_FILENAME);
+        if (existsSync(configPath)) {
+            consola.info(`${CONFIG_FILENAME} already exists at ${configPath} — leaving it untouched.`);
+            return;
+        }
+        // PlConfigSchema.parse({}) yields the fully-defaulted config; the scaffold
+        // renders those exact values so it never drifts from the schema.
+        const defaults = PlConfigSchema.parse({});
+        await writeFile(configPath, renderDefaultConfig(defaults), "utf-8");
+        consola.success(`Created ${configPath}`);
+        consola.info("Edit it for your stack, then run `prismalens doctor` to verify your environment.");
+    },
+});
+//# sourceMappingURL=init.js.map

package/dist/src/cli/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/cli/init.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6BAA6B;AAE7B;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EACN,iBAAiB,EAEjB,cAAc,GACd,MAAM,qBAAqB,CAAC;AAE7B,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAEjD,oFAAoF;AACpF,SAAS,mBAAmB,CAAC,CAAW;IACvC,MAAM,cAAc,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO;SACpD,aAAa,EAAE;SACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,OAAO;;;;;;;;;;mCAU2B,cAAc;aACpC,CAAC,CAAC,KAAK,CAAC,OAAO;;;;;;;;mBAQT,sBAAsB,CAAC,SAAS,CAAC,aAAa;qBAC5C,sBAAsB,CAAC,SAAS,CAAC,eAAe;YACzD,sBAAsB,CAAC,SAAS,CAAC,MAAM;;;;;;;;;;;;;;;;;;cAkBrC,CAAC,CAAC,SAAS,CAAC,QAAQ;CACjC,CAAC;AACF,CAAC;AAED,eAAe,aAAa,CAAC;IAC5B,IAAI,EAAE;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,cAAc,eAAe,2BAA2B;KACrE;IACD,KAAK,CAAC,GAAG;QACR,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;QAE3D,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CACX,GAAG,eAAe,sBAAsB,UAAU,0BAA0B,CAC5E,CAAC;YACF,OAAO;QACR,CAAC;QAED,2EAA2E;QAC3E,iEAAiE;QACjE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAEpE,OAAO,CAAC,OAAO,CAAC,WAAW,UAAU,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CACX,kFAAkF,CAClF,CAAC;IACH,CAAC;CACD,CAAC,CAAC"}

package/dist/src/cli/investigate.d.ts

@@ -0,0 +1,101 @@
+import { type HarnessId } from "@prismalens/config/harness";
+import { type SandboxMode, type SandboxSelection } from "@prismalens/engine";
+import type { PlConfig } from "../config/schema.js";
+declare const _default: import("citty").CommandDef<{
+    readonly repo: {
+        readonly type: "string";
+        readonly description: "Path to the repository the harness investigates (its cwd). Defaults to the current directory.";
+    };
+    readonly query: {
+        readonly type: "string";
+        readonly alias: "q";
+        readonly description: "Investigate a synthesized alert from this one-line description (alternative to piping a FiringAlert JSON on stdin).";
+    };
+    readonly config: {
+        readonly type: "string";
+        readonly description: "Path to a prismalens.config.yaml (skips the upward config search).";
+    };
+    readonly model: {
+        readonly type: "string";
+        readonly description: "Override agent.model — a bare model id, e.g. gpt-oss:120b.";
+    };
+    readonly harness: {
+        readonly type: "enum";
+        readonly options: ["deepagents", "claude-code", "codex"];
+        readonly description: "Tier-2 harness backend. Defaults to agent.default in config.";
+    };
+    readonly mode: {
+        readonly type: "enum";
+        readonly options: ["read-only", "supervised", "auto", "dangerous"];
+        readonly description: "Permission posture the harness runs under (ADR-0017). Defaults to agent.permissions.mode in config (read-only).";
+    };
+    readonly dangerouslySkipPermissions: {
+        readonly type: "boolean";
+        readonly default: false;
+        readonly description: "Alias for --mode dangerous.";
+    };
+    readonly sandbox: {
+        readonly type: "enum";
+        readonly options: ["auto", "process", "srt", "e2b"];
+        readonly description: "Isolation boundary the harness runs in (ADR-0020): process (cooperative floor), srt (enforced), or auto. Defaults to agent.sandbox in config (auto — srt when its egress bridge is healthy, else the process floor).";
+    };
+    readonly service: {
+        readonly type: "string";
+        readonly description: "Select the service context by name from `services` in config (overrides the alert's service label).";
+    };
+    readonly json: {
+        readonly type: "boolean";
+        readonly default: false;
+        readonly description: "Print the InvestigationReport as JSON to stdout (suppresses the human renderer).";
+    };
+    readonly output: {
+        readonly type: "string";
+        readonly description: "Write the InvestigationReport JSON to this file.";
+    };
+    readonly quiet: {
+        readonly type: "boolean";
+        readonly default: false;
+        readonly description: "Suppress progress + the human renderer (errors still go to stderr).";
+    };
+}>;
+export default _default;
+/**
+ * The egress allowlist for an enforced sandbox (ADR-0020: allowlist, not closed) — the
+ * hostnames of every surface the harness will ACTUALLY contact: its own LLM endpoint
+ * (BYO-key baseURL, env override included) PLUS the read-only telemetry + log surfaces.
+ * The LLM + telemetry hosts carry the SAME `INVESTIGATION_DEFAULTS` fallback the request
+ * assembly applies (`run-investigation`), because an unset config field still resolves to
+ * a default the harness queries — omitting it hard-denied the model call and default
+ * telemetry, so every branch failed with no report. Mirrors the worker's
+ * `deriveWorkerAllowedHosts`. Non-URL values are skipped (no egress hole from a malformed
+ * endpoint); the `process` floor ignores this.
+ */
+export declare function collectAllowedDomains(config: PlConfig): string[];
+/**
+ * Resolve the isolation boundary for a run (ADR-0020/0017) — the single sandbox-resolution
+ * path shared by the `investigate` command and the JSON-RPC `serve` handler, so both honour
+ * `agent.sandbox` (and `--sandbox`) with identical semantics. Guards first: a mode that
+ * DEMANDS enforcement (`srt`/`e2b`) on a non-ACP (in-process) harness THROWS — the caller
+ * maps it to its own channel (CLI stderr+exit, or a JSON-RPC error), never a silent floor.
+ * Then resolves a boundary ONLY for an ACP harness; an in-process harness returns a null
+ * selection (it runs on the cooperative floor, claiming nothing — nothing dishonest). The
+ * returned `selection` is CALLER-OWNED — destroy it after the run. `degradeReason` is the
+ * honest note when `auto` fell short of srt (present only on a degrade).
+ */
+export declare function resolveRunSandbox(harness: HarnessId, mode: SandboxMode, config: PlConfig): Promise<{
+    selection: SandboxSelection | null;
+    degradeReason: string | null;
+}>;
+/**
+ * The sandbox guard (ADR-0020/0017), mirrored in the worker's `harnessTakesSandbox`: only
+ * ACP-transport harnesses are spawned as a child the engine can place inside a boundary.
+ * Returns whether this harness `takesSandbox` and whether the request is `blocked` — the
+ * fail-fast case where a mode that DEMANDS an enforced boundary (`srt`/`e2b`) was asked of a
+ * non-ACP harness. `auto`/`process` are never blocked: they run WITHOUT a sandbox on an
+ * in-process harness, claiming nothing, so nothing is dishonest.
+ */
+export declare function resolveSandboxGuard(harness: HarnessId, mode: SandboxMode): {
+    takesSandbox: boolean;
+    blocked: boolean;
+};
+//# sourceMappingURL=investigate.d.ts.map

package/dist/src/cli/investigate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"investigate.d.ts","sourceRoot":"","sources":["../../../src/cli/investigate.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAS9E,OAAO,EAIN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUpD,wBA+PG;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,EAAE,CA0BhE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,SAAS,EAClB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,QAAQ,GACd,OAAO,CAAC;IACV,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC,CAoBD;AA2BD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,SAAS,EAClB,IAAI,EAAE,WAAW,GACf;IAAE,YAAY,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAI7C"}