sidekick-shared 0.27.6 → 0.28.0

package/dist/esm/credentialIO.js

@@ -0,0 +1,283 @@
+/**
+ * Platform-aware credential I/O for Claude Code.
+ *
+ * On macOS, Claude Code stores OAuth credentials in the system Keychain
+ * (service "Claude Code-credentials", suffixed per config directory). On
+ * Linux/WSL/Windows, credentials live in `<home>/.credentials.json`. When the
+ * Keychain is unavailable (locked, SSH) Claude Code falls back to the file on
+ * macOS too, so reads consult the file after a Keychain miss.
+ *
+ * Keychain writes mirror Claude Code 2.1.x exactly: the payload is hex-encoded
+ * (`-X`) and sent through `security -i` only while the command line fits the
+ * tool's line buffer; longer payloads go through argv. `security -i` silently
+ * truncates longer lines, which once stored half a credential (the `mcpOAuth`
+ * tokens make blobs of 4 KB and more) — a login Claude Code then reports as
+ * "Not logged in". Every write is read back and compared before it counts.
+ *
+ * Both accounts.ts and credentials.ts consume this module so that all
+ * credential access is platform-correct in one place.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { execFileSync } from 'child_process';
+import { claudeKeychainAccountName, claudeKeychainService, getLiveClaudeHome, } from './claudeProfiles';
+import { forgetClaudeCredentialHome, recordClaudeCredentialHome } from './claudeCredentialLedger';
+import { atomicWriteFileSync } from './writers/atomic';
+export const KEYCHAIN_SERVICE = 'Claude Code-credentials';
+const SECURITY_TIMEOUT_MS = 4000;
+/** `security` exits with this status when no item matches. */
+const SECURITY_ITEM_NOT_FOUND = 44;
+/**
+ * Claude Code's ceiling for a `security -i` command line (the tool reads at
+ * most 4095 bytes per line). Longer commands go through argv instead.
+ */
+export const SECURITY_INTERACTIVE_LINE_LIMIT = 4032;
+/**
+ * Written as the item comment (`-j`) on every Keychain item Sidekick creates,
+ * so ownership is provable from the item itself even after its directory and
+ * the ledger that described it are gone.
+ */
+export const SIDEKICK_KEYCHAIN_COMMENT_PREFIX = 'sidekick-agent-hub:';
+/** A credential write that did not land, or could not be verified. */
+export class ClaudeCredentialWriteError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ClaudeCredentialWriteError';
+    }
+}
+function quoteSecurityInteractiveArg(value) {
+    // `security -i` is not a POSIX shell: adjacent quoted segments do NOT
+    // concatenate (so the shell-style '\'' splice splits the token), and
+    // backslash escapes the next character even inside single quotes.
+    return `'${value.replace(/\\/g, '\\\\').replace(/'/g, `\\'`)}'`;
+}
+function getCredentialsFilePath(configDir) {
+    return path.join(configDir ?? getLiveClaudeHome(), '.credentials.json');
+}
+function parseStoredText(raw, source) {
+    const text = raw.trim();
+    if (!text)
+        return { status: 'corrupt', source, length: 0 };
+    // `security -w` prints hex when the stored bytes are not plain text.
+    const decoded = source === 'keychain' && !text.startsWith('{') && /^(?:[0-9a-f]{2})+$/i.test(text)
+        ? Buffer.from(text, 'hex').toString('utf8')
+        : text;
+    try {
+        const parsed = JSON.parse(decoded);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return { status: 'ok', blob: parsed, source };
+        }
+    }
+    catch {
+        /* fall through */
+    }
+    return { status: 'corrupt', source, length: decoded.length };
+}
+function readCredentialsFileStore(configDir) {
+    let raw;
+    try {
+        raw = fs.readFileSync(getCredentialsFilePath(configDir), 'utf8');
+    }
+    catch (error) {
+        return error.code === 'ENOENT'
+            ? { status: 'absent' }
+            : { status: 'error', reason: String(error.message ?? error) };
+    }
+    return parseStoredText(raw, 'file');
+}
+function securityErrorStatus(error) {
+    const status = error.status;
+    return typeof status === 'number' ? status : null;
+}
+function readKeychainStore(service) {
+    try {
+        const raw = execFileSync('security', ['find-generic-password', '-a', claudeKeychainAccountName(), '-s', service, '-w'], {
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout: SECURITY_TIMEOUT_MS,
+            killSignal: 'SIGKILL',
+        });
+        return parseStoredText(String(raw), 'keychain');
+    }
+    catch (error) {
+        if (securityErrorStatus(error) === SECURITY_ITEM_NOT_FOUND)
+            return { status: 'absent' };
+        return { status: 'error', reason: String(error?.message ?? error) };
+    }
+}
+/**
+ * Read one Claude credential store with a definite outcome. On macOS the
+ * Keychain item is authoritative; the file is consulted only when the item is
+ * absent (Claude Code's own fallback), unless `keychainOnly` is set.
+ */
+export function readClaudeCredentialStore(configDir, options = {}) {
+    if (process.platform === 'darwin') {
+        const keychain = readKeychainStore(claudeKeychainService(configDir));
+        if (keychain.status !== 'absent' || options.keychainOnly)
+            return keychain;
+    }
+    return readCredentialsFileStore(configDir);
+}
+/**
+ * Read the active Claude Code credentials as a parsed object.
+ *
+ * - macOS: reads from system Keychain via the `security` CLI, then the file
+ * - Linux / WSL / Windows: reads `<home>/.credentials.json`
+ *
+ * Returns `null` when credentials are absent or unreadable. Callers that must
+ * tell "absent" from "could not read" use {@link readClaudeCredentialStore}.
+ */
+export function readActiveCredentials(configDir) {
+    if (process.platform === 'darwin') {
+        const keychain = readKeychainStore(claudeKeychainService(configDir));
+        if (keychain.status === 'ok')
+            return keychain.blob;
+    }
+    const file = readCredentialsFileStore(configDir);
+    return file.status === 'ok' ? file.blob : null;
+}
+function runKeychainWrite(service, hex, comment) {
+    const account = claudeKeychainAccountName();
+    const args = ['add-generic-password', '-U', '-a', account, '-s', service];
+    const interactive = [
+        'add-generic-password',
+        '-U',
+        '-a',
+        quoteSecurityInteractiveArg(account),
+        '-s',
+        quoteSecurityInteractiveArg(service),
+    ];
+    if (comment) {
+        args.push('-j', comment);
+        interactive.push('-j', quoteSecurityInteractiveArg(comment));
+    }
+    args.push('-X', hex);
+    interactive.push('-X', quoteSecurityInteractiveArg(hex));
+    const line = `${interactive.join(' ')}\n`;
+    if (Buffer.byteLength(line, 'utf8') <= SECURITY_INTERACTIVE_LINE_LIMIT) {
+        execFileSync('security', ['-i'], {
+            input: line,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout: SECURITY_TIMEOUT_MS,
+            killSignal: 'SIGKILL',
+        });
+        return;
+    }
+    // The same trade-off Claude Code makes for large payloads: the hex is on the
+    // command line (visible to `ps`) for the duration of this call.
+    execFileSync('security', args, {
+        stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: SECURITY_TIMEOUT_MS,
+        killSignal: 'SIGKILL',
+    });
+}
+/**
+ * Write a credential blob to a store and verify it by reading it back.
+ * `configDir` undefined targets the live home; only the guarded live installer
+ * in accounts.ts may do that (see {@link writeLiveClaudeCredentialStoreUnguarded}).
+ */
+function writeClaudeCredentialStore(credentials, configDir) {
+    const json = JSON.stringify(credentials);
+    let expected;
+    try {
+        expected = JSON.stringify(JSON.parse(json));
+    }
+    catch {
+        throw new ClaudeCredentialWriteError('Refusing to store a credential that is not JSON.');
+    }
+    if (process.platform === 'darwin') {
+        const service = claudeKeychainService(configDir);
+        const comment = configDir
+            ? `${SIDEKICK_KEYCHAIN_COMMENT_PREFIX}${path.resolve(configDir)}`
+            : null;
+        try {
+            runKeychainWrite(service, Buffer.from(json, 'utf8').toString('hex'), comment);
+        }
+        catch (error) {
+            throw new ClaudeCredentialWriteError(`Keychain write failed: ${error?.message ?? error}`);
+        }
+        const readBack = readKeychainStore(service);
+        if (readBack.status === 'error') {
+            throw new ClaudeCredentialWriteError('The Keychain write could not be verified (read-back failed); treating it as not written.');
+        }
+        if (readBack.status !== 'ok' || JSON.stringify(readBack.blob) !== expected) {
+            throw new ClaudeCredentialWriteError('The Keychain item did not hold the credential after writing it.');
+        }
+        return;
+    }
+    // Linux / WSL / Windows — file-based (tmp + fsync + rename, retried on Windows)
+    atomicWriteFileSync(getCredentialsFilePath(configDir), json, 0o600);
+    const readBack = readCredentialsFileStore(configDir);
+    if (readBack.status !== 'ok' || JSON.stringify(readBack.blob) !== expected) {
+        throw new ClaudeCredentialWriteError('The credentials file did not hold the credential after writing it.');
+    }
+}
+/**
+ * Write credentials to a profile home's Claude Code credential store.
+ *
+ * - macOS: the suffixed Keychain item for `configDir`
+ * - Linux / WSL / Windows: atomic-writes `<configDir>/.credentials.json`
+ *
+ * `configDir` is required: the live store is written only through the guarded
+ * installer in accounts.ts, which refuses downgrades and captures the outgoing
+ * login first. Throws {@link ClaudeCredentialWriteError} when the write did
+ * not land intact.
+ */
+export function writeActiveCredentials(credentials, configDir) {
+    if (!configDir) {
+        throw new ClaudeCredentialWriteError('writeActiveCredentials() needs a config directory; the live Claude login is only written through a guarded account switch.');
+    }
+    recordClaudeCredentialHome(configDir, 'profile');
+    writeClaudeCredentialStore(credentials, configDir);
+}
+/**
+ * Write the live store with no guard. Internal: the only caller is
+ * `installIntoLiveClaudeStore` in accounts.ts (a test enforces this).
+ */
+export function writeLiveClaudeCredentialStoreUnguarded(credentials) {
+    writeClaudeCredentialStore(credentials, undefined);
+}
+function deleteKeychainItem(service, withAccount) {
+    try {
+        execFileSync('security', [
+            'delete-generic-password',
+            ...(withAccount ? ['-a', claudeKeychainAccountName()] : []),
+            '-s',
+            service,
+        ], {
+            stdio: ['ignore', 'ignore', 'ignore'],
+            timeout: SECURITY_TIMEOUT_MS,
+            killSignal: 'SIGKILL',
+        });
+        return 'deleted';
+    }
+    catch (error) {
+        return securityErrorStatus(error) === SECURITY_ITEM_NOT_FOUND ? 'absent' : 'error';
+    }
+}
+/**
+ * Remove the credential store of a config directory (an abandoned isolated
+ * login, a removed profile, the profile home of the account that became
+ * live). Never throws; returns true when the store is gone afterwards.
+ */
+export function deleteStoredCredentials(configDir) {
+    let gone = true;
+    if (process.platform === 'darwin') {
+        const service = claudeKeychainService(configDir);
+        let outcome = deleteKeychainItem(service, true);
+        // Items written before the account name was pinned may carry another one.
+        if (outcome === 'absent')
+            outcome = deleteKeychainItem(service, false);
+        if (outcome === 'error')
+            gone = false;
+    }
+    try {
+        fs.rmSync(getCredentialsFilePath(configDir), { force: true });
+    }
+    catch {
+        gone = false;
+    }
+    if (gone)
+        forgetClaudeCredentialHome(configDir);
+    return gone;
+}

package/dist/esm/credentials.js

@@ -0,0 +1,49 @@
+/**
+ * Read Claude Max OAuth credentials from disk.
+ *
+ * Shared by sidekick-cli, sidekick-vscode, and any external consumer.
+ */
+import { parseClaudeCredentialBlob } from './claudeCredentials';
+import { readActiveCredentials } from './credentialIO';
+function readParsed() {
+    try {
+        return parseClaudeCredentialBlob(readActiveCredentials());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Reads Claude Max OAuth credentials.
+ *
+ * On macOS reads from system Keychain; on Linux/Windows reads from
+ * `~/.claude/.credentials.json`. Returns `null` if credentials are
+ * absent, the token is missing, or the token is expired. Never throws.
+ */
+export async function readClaudeMaxCredentials() {
+    const parsed = readParsed();
+    if (!parsed)
+        return null;
+    if (parsed.expiresAt && Date.now() > parsed.expiresAt)
+        return null;
+    return parsed;
+}
+/**
+ * Like {@link readClaudeMaxCredentials} but returns the stored credential even
+ * when the access token has lapsed: the CLI refreshes it on next use, so an
+ * expired access token is still a valid login (until the refresh token expires).
+ */
+export function readClaudeMaxCredentialsRaw() {
+    return readParsed();
+}
+/**
+ * Synchronous convenience — returns just the access token or `null`.
+ */
+export function readClaudeMaxAccessTokenSync() {
+    const parsed = readParsed();
+    if (!parsed)
+        return null;
+    if (parsed.expiresAt && Date.now() > parsed.expiresAt)
+        return null;
+    return parsed.accessToken;
+}

package/dist/esm/doctor.js

@@ -0,0 +1,305 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { getActiveAccountStatus } from './accountStatus';
+import { resolveProjectIdentity } from './paths';
+import { discoverSessionDirectory, encodeWorkspacePath, findSubdirectorySessionDirs, getMostRecentlyActiveSessionDir, getSessionDirectory, } from './parsers/sessionPathResolver';
+import { toLegacyProviderStatus } from './providerStatus';
+import { fetchProviderServiceStatus } from './providerServiceStatus';
+import { getOpenCodeDataDir } from './providers/openCode';
+import { createSessionProviders } from './providers/factory';
+import { detectProvider } from './providers/detect';
+import { OpenCodeDatabase } from './providers/openCodeDatabase';
+import { getClaudeProjectsDir } from './claudePaths';
+/** Collects the Claude Code path-resolution detail used by both host surfaces. */
+export function getSessionDiagnostics(workspacePath) {
+    const encodedPath = encodeWorkspacePath(workspacePath);
+    const expectedSessionDir = getSessionDirectory(workspacePath);
+    const projectsDir = getClaudeProjectsDir();
+    let existingProjectDirs = [];
+    let expectedDirExists = false;
+    try {
+        if (fs.existsSync(projectsDir)) {
+            existingProjectDirs = fs
+                .readdirSync(projectsDir)
+                .filter((name) => {
+                try {
+                    return fs.statSync(path.join(projectsDir, name)).isDirectory();
+                }
+                catch {
+                    return false;
+                }
+            })
+                .sort();
+        }
+        expectedDirExists = fs.existsSync(expectedSessionDir);
+    }
+    catch {
+        // Diagnostics remain useful even if a directory cannot be read.
+    }
+    const discoveredSessionDir = discoverSessionDirectory(workspacePath);
+    const workspaceBasename = path.basename(workspacePath).toLowerCase();
+    const similarDirs = existingProjectDirs.filter((directory) => {
+        const lower = directory.toLowerCase();
+        return (lower.includes(workspaceBasename) || workspaceBasename.includes(lower.split('-').pop() || ''));
+    });
+    const subdirectoryMatches = findSubdirectorySessionDirs(workspacePath);
+    return {
+        workspacePath,
+        encodedPath,
+        expectedSessionDir,
+        expectedDirExists,
+        discoveredSessionDir,
+        existingProjectDirs,
+        similarDirs,
+        platform: process.platform,
+        subdirectoryMatches,
+        selectedSubdirectoryMatch: subdirectoryMatches.length > 0 ? getMostRecentlyActiveSessionDir(subdirectoryMatches) : null,
+    };
+}
+function statusUnavailable() {
+    return {
+        indicator: 'none',
+        description: 'Status unavailable',
+        affectedComponents: [],
+        activeIncident: null,
+        updatedAt: new Date().toISOString(),
+    };
+}
+async function checkSessionProvider(providerId, workspacePath) {
+    const { providers } = createSessionProviders({ providerIds: [providerId] });
+    const provider = providers[0];
+    const title = `Session discovery (${provider?.displayName ?? providerId})`;
+    try {
+        if (!provider)
+            throw new Error(`${providerId} could not be initialized.`);
+        const sessions = provider.listSessionFilesAsync
+            ? await provider.listSessionFilesAsync(workspacePath)
+            : provider.findAllSessions(workspacePath);
+        if (sessions.length > 0) {
+            return {
+                id: 'session_discovery',
+                status: 'ok',
+                title,
+                message: `Found ${sessions.length} ${provider.displayName} session${sessions.length === 1 ? '' : 's'} for ${workspacePath}.`,
+            };
+        }
+        const operation = provider.getLastOperationStatus?.();
+        const runtime = provider.getRuntimeStatus?.();
+        const issue = operation && !operation.usable
+            ? operation.runtimeStatus
+            : runtime && !runtime.available
+                ? runtime
+                : undefined;
+        return {
+            id: 'session_discovery',
+            status: 'warning',
+            title,
+            message: issue?.message ?? `No ${provider.displayName} sessions found for ${workspacePath}.`,
+            repair: issue?.kind === 'sqlite_missing'
+                ? 'Install sqlite3 and ensure it is on PATH, then rerun sidekick doctor.'
+                : `Start ${provider.displayName} in this project, or inspect ${provider.getSessionDirectory(workspacePath)}.`,
+        };
+    }
+    catch (error) {
+        return {
+            id: 'session_discovery',
+            status: 'warning',
+            title,
+            message: error instanceof Error ? error.message : String(error),
+            repair: `Check ${providerId} session storage permissions and rerun sidekick doctor.`,
+        };
+    }
+    finally {
+        for (const candidate of providers)
+            candidate.dispose();
+    }
+}
+export async function runDoctor(options = {}) {
+    const project = resolveProjectIdentity(options.cwd);
+    const sessions = getSessionDiagnostics(project.cwd);
+    const accounts = getActiveAccountStatus(undefined, { selfHeal: false });
+    const sessionProvider = options.provider && options.provider !== 'auto' ? options.provider : detectProvider();
+    let openCode = options.openCodeStatus;
+    if (!openCode) {
+        const database = new OpenCodeDatabase(getOpenCodeDataDir());
+        database.open();
+        openCode = database.getRuntimeStatus();
+        database.close();
+    }
+    const serviceStatus = options.fetchServiceStatuses || !options.fetchStatuses
+        ? await (options.fetchServiceStatuses ??
+            (async () => {
+                const [claude, openai] = await Promise.all([
+                    fetchProviderServiceStatus('claude-code'),
+                    fetchProviderServiceStatus('codex'),
+                ]);
+                return { claude, openai };
+            }))().catch(() => {
+            const unavailable = (provider) => ({
+                availability: 'unavailable',
+                provider,
+                checkedAt: new Date().toISOString(),
+                sourceUrl: `https://status.${provider === 'codex' ? 'openai' : 'claude'}.com/api/v2/summary.json`,
+                reason: 'network_error',
+            });
+            return { claude: unavailable('claude-code'), openai: unavailable('codex') };
+        })
+        : undefined;
+    const providerStatus = serviceStatus
+        ? {
+            claude: toLegacyProviderStatus(serviceStatus.claude),
+            openai: toLegacyProviderStatus(serviceStatus.openai),
+        }
+        : await options.fetchStatuses().catch(() => ({
+            claude: statusUnavailable(),
+            openai: statusUnavailable(),
+        }));
+    const checks = [];
+    checks.push(project.hasLegacyMismatch
+        ? {
+            id: 'project_slug',
+            status: 'warning',
+            title: 'Project path resolves to a different slug',
+            message: `Legacy ${project.legacySlug}; canonical ${project.canonicalSlug}.`,
+            repair: `Open the resolved path (${project.resolvedCwd}) and merge any legacy project stores into the canonical slug. Sidekick readers keep the legacy fallback.`,
+        }
+        : {
+            id: 'project_slug',
+            status: 'ok',
+            title: 'Project identity',
+            message: `Canonical slug: ${project.canonicalSlug}`,
+        });
+    checks.push(await checkSessionProvider(sessionProvider, project.resolvedCwd));
+    const openCodeCheck = openCode.available
+        ? {
+            id: 'opencode_sqlite',
+            status: 'ok',
+            title: 'OpenCode database',
+            message: 'OpenCode database and sqlite3 are available.',
+        }
+        : openCode.kind === 'db_missing'
+            ? {
+                id: 'opencode_sqlite',
+                status: 'info',
+                title: 'OpenCode database',
+                message: 'No OpenCode database was found; this is expected if OpenCode is not used.',
+            }
+            : {
+                id: 'opencode_sqlite',
+                status: 'warning',
+                title: 'OpenCode database',
+                message: openCode.message ?? `OpenCode database unavailable (${openCode.kind}).`,
+                repair: openCode.kind === 'sqlite_missing'
+                    ? 'Install sqlite3 and ensure the sqlite3 executable is on PATH, then rerun sidekick doctor.'
+                    : 'Make sqlite3 executable and verify the OpenCode database is readable.',
+            };
+    if (sessionProvider !== 'opencode' && openCodeCheck.status === 'warning') {
+        openCodeCheck.status = 'info';
+        openCodeCheck.message += ' This does not affect the selected session provider.';
+    }
+    checks.push(openCodeCheck);
+    checks.push({
+        id: 'accounts',
+        status: accounts.ok ? 'ok' : 'info',
+        title: 'Accounts and credentials',
+        message: accounts.ok
+            ? `Detected ${[accounts.claude.present && 'Claude', accounts.codex.present && 'Codex'].filter(Boolean).join(' and ')} credentials.`
+            : (accounts.error ?? 'No Claude or Codex credentials were detected.'),
+        ...(!accounts.ok
+            ? {
+                repair: 'Sign in with claude or codex to refresh account quota. Existing sessions can be monitored without saved credentials.',
+            }
+            : {}),
+    });
+    const unavailableProviders = serviceStatus
+        ? Object.entries(serviceStatus)
+            .filter(([, status]) => status.availability === 'unavailable')
+            .map(([name]) => name)
+        : Object.entries(providerStatus)
+            .filter(([, status]) => status.description === 'Status unavailable')
+            .map(([name]) => name);
+    const degradedProviders = serviceStatus
+        ? Object.entries(serviceStatus)
+            .filter(([, status]) => status.availability === 'observed' && status.severity !== 'none')
+            .map(([name]) => name)
+        : Object.entries(providerStatus)
+            .filter(([, status]) => status.indicator !== 'none')
+            .map(([name]) => name);
+    const partialProviders = serviceStatus
+        ? Object.entries(serviceStatus)
+            .filter(([, status]) => status.availability === 'observed' && status.incidents === null)
+            .map(([name]) => name)
+        : [];
+    const observations = [
+        ...(degradedProviders.length
+            ? [`Public vendor degradation reported for: ${degradedProviders.join(', ')}.`]
+            : []),
+        ...(unavailableProviders.length
+            ? [`Status pages unavailable for: ${unavailableProviders.join(', ')}.`]
+            : []),
+        ...(partialProviders.length
+            ? [`Incident information unavailable for: ${partialProviders.join(', ')}.`]
+            : []),
+    ];
+    checks.push({
+        id: 'provider_api',
+        status: degradedProviders.includes(sessionProvider === 'codex' ? 'openai' : sessionProvider === 'claude-code' ? 'claude' : '')
+            ? 'warning'
+            : observations.length
+                ? 'info'
+                : 'ok',
+        title: 'Public provider service status',
+        message: (observations.length
+            ? observations.join(' ')
+            : 'Claude and OpenAI status pages report normal operation.') +
+            ' Public status does not establish request connectivity or authentication.',
+    });
+    const deprecatedSettings = options.deprecatedSettings ?? [];
+    checks.push({
+        id: 'deprecated_settings',
+        status: deprecatedSettings.length > 0 ? 'warning' : 'ok',
+        title: 'Deprecated settings',
+        message: deprecatedSettings.length > 0
+            ? deprecatedSettings
+                .map((setting) => `${setting.key}${setting.replacement ? ` → ${setting.replacement}` : ''}`)
+                .join(', ')
+            : 'No deprecated Sidekick settings detected.',
+        ...(deprecatedSettings.length > 0
+            ? {
+                repair: 'Move each configured value to its replacement and remove the deprecated setting.',
+            }
+            : {}),
+    });
+    const status = checks.some((check) => check.status === 'error')
+        ? 'unhealthy'
+        : checks.some((check) => check.status === 'warning')
+            ? 'attention'
+            : 'healthy';
+    return {
+        schemaVersion: 1,
+        generatedAt: new Date().toISOString(),
+        project,
+        status,
+        checks,
+        accounts,
+        openCode,
+        providerStatus,
+        ...(serviceStatus ? { serviceStatus } : {}),
+        sessions,
+        sessionProvider,
+    };
+}
+export function formatHealthReport(report) {
+    const icon = { ok: '✓', warning: '!', error: '✕', info: '·' };
+    const lines = [
+        `Sidekick Doctor — ${report.status}`,
+        `Project: ${report.project.resolvedCwd}`,
+        '',
+    ];
+    for (const check of report.checks) {
+        lines.push(`${icon[check.status]} ${check.title}: ${check.message}`);
+        if (check.repair)
+            lines.push(`  Repair: ${check.repair}`);
+    }
+    return lines.join('\n');
+}