stim 1.19.0 → 1.20.0

package/dist/doctor-C2MSuMMg.mjs

@@ -0,0 +1,515 @@
+import { _ as loadConfig$1, p as getProject } from "./config-D0LhTY3S.mjs";
+import { Et as repoRoot, I as projectSettingsContext } from "./settings-Bbztm4oV.mjs";
+import { f as refuseNoProject, l as phaseLine } from "./command-output-BjPN99ZB.mjs";
+import { d as projectRegistry } from "./project-B8_duAzW.mjs";
+import { J as inspectWatchmanMemory, Q as memorySweepIsScoped, a as inspectBudget, n as budgetLine } from "./budget-BONq9vXY.mjs";
+import { C as inspectDeviceHostMachines, b as inspectBuildMachines, d as simulatorRuntime, s as offloadCheck } from "./client-BLy1Pw2V.mjs";
+import { I as memoryCulpritFindings, L as readMemoryCulprits, h as listIosRuntimesAsync, l as iosRuntimeMatches, x as pickDefaultIosCreation } from "./ios-CXLIUxXJ.mjs";
+import { T as detectXcodeMajor } from "./toolchain-DqyDXs30.mjs";
+import { o as compareStimVersions, s as inspectStimVersions } from "./eas-session-ledger-DZlC-Fq3.mjs";
+import { h as resolveDeviceType, v as resolveRuntime } from "./support-DCco5fut.mjs";
+import { r as maintenanceStatus, t as maintenanceLine } from "./status-BDGHwkCs.mjs";
+import { a as writeIgnoreDirs, i as watchedCheckouts, n as inspectNestedWorktrees, r as nestedWorktreeFinding, s as recordDoctorRun } from "./doctor-watchman-CB4NnVZm.mjs";
+import { i as runDoctor, o as readMachineSettings } from "./doctor-DPAqhVCK.mjs";
+import { dirname, join, sep } from "path";
+import { isJsonObject, maintenanceNdjsonFile, readHostedAppMetadata, readHostedSessions } from "@stim-cli/core/state";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { InvalidArgumentError } from "commander";
+import chalk from "chalk";
+//#region src/diagnostics/sandbox.ts
+/**
+* What a sandboxed harness has to permit for Stim to work: its state
+* directory, the XPC service simctl talks to, and the port adb's server binds.
+*/
+function sandboxAllowance(stimHome = "~/.stim") {
+	return {
+		allowWrite: [stimHome],
+		allowMachLookup: ["com.apple.coresimulator.*"],
+		allowLocalBinding: true
+	};
+}
+function detectHarness(env = process.env) {
+	if (env.CLAUDECODE || env.CLAUDE_CODE_ENTRYPOINT) return "claude-code";
+	if (Object.keys(env).some((k) => k.startsWith("CODEX_"))) return "codex";
+	return null;
+}
+function expandHome(value, home) {
+	const v = value.trim();
+	if (v === "~" || v === "$HOME") return home;
+	if (v.startsWith("~/")) return join(home, v.slice(2));
+	if (v.startsWith("$HOME/")) return join(home, v.slice(6));
+	return v;
+}
+/**
+* Whether the sandbox actually stops Stim, rather than whether a harness that
+* can sandbox is present: a session with its sandbox off exports the same
+* variables as one with it on, so only a write says which this is.
+*/
+function sandboxBlocksStimHome(stimHome, home = homedir()) {
+	const dir = expandHome(stimHome, home);
+	const probe = join(dir, `.probe-${process.pid}-${Math.random().toString(36).slice(2)}`);
+	try {
+		mkdirSync(dir, { recursive: true });
+		writeFileSync(probe, "");
+		rmSync(probe, { force: true });
+		return false;
+	} catch (err) {
+		const code = err.code;
+		return code === "EPERM" || code === "EACCES";
+	}
+}
+/** Where a per-user, gitignored Claude Code settings file belongs for this project. */
+function claudeLocalSettingsPath(root) {
+	return join(root, ".claude", "settings.local.json");
+}
+/** Every settings file that may already carry the allowance, most local first. */
+function allowanceSearchPaths(settingsRoot, home = homedir()) {
+	return [
+		claudeLocalSettingsPath(settingsRoot),
+		join(settingsRoot, ".claude", "settings.json"),
+		join(home, ".claude", "settings.json")
+	];
+}
+function isPlainObject(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* Absent, unreadable and present-but-not-an-object are three different states.
+* Collapsing them loses the one distinction that matters before a write: a
+* file whose contents did not parse still holds settings we must not destroy.
+*/
+function readSettings(path) {
+	let raw;
+	try {
+		raw = readFileSync(path, "utf-8");
+	} catch (err) {
+		return err.code === "ENOENT" ? { kind: "absent" } : { kind: "invalid" };
+	}
+	try {
+		const parsed = JSON.parse(raw);
+		return isPlainObject(parsed) ? {
+			kind: "object",
+			value: parsed
+		} : { kind: "invalid" };
+	} catch {
+		return { kind: "invalid" };
+	}
+}
+function nested(source, ...keys) {
+	let cursor = source;
+	for (const key of keys) {
+		if (!isPlainObject(cursor)) return void 0;
+		cursor = cursor[key];
+	}
+	return cursor;
+}
+/** Whether an allowWrite entry covers the Stim home, including as a parent. */
+function covers(entry, target, home) {
+	const posix = (value) => {
+		const expanded = expandHome(value, home);
+		return sep === "/" ? expanded : expanded.replaceAll(sep, "/");
+	};
+	const e = posix(entry).replace(/\/+\*+$/, "").replace(/\/+$/, "");
+	const t = posix(target).replace(/\/+$/, "");
+	return e === t || t.startsWith(`${e}/`);
+}
+/**
+* Which parts of the allowance the settings files already carry. Any file may
+* supply any part, so a project that solved this in one place is not asked to
+* repeat it in another.
+*/
+function missingAllowance(paths, stimHome = "~/.stim", home = homedir()) {
+	const files = paths.map((p) => {
+		const read = readSettings(p);
+		return read.kind === "object" ? read.value : null;
+	});
+	const list = (...keys) => files.flatMap((f) => {
+		const value = nested(f, ...keys);
+		return Array.isArray(value) ? value.map(String) : [];
+	});
+	const missing = [];
+	if (!list("sandbox", "filesystem", "allowWrite").some((w) => covers(w, stimHome, home))) missing.push("sandbox.filesystem.allowWrite");
+	if (!list("sandbox", "network", "allowMachLookup").some((l) => l.toLowerCase().startsWith("com.apple.coresimulator"))) missing.push("sandbox.network.allowMachLookup");
+	if (!files.some((f) => nested(f, "sandbox", "network", "allowLocalBinding") === true)) missing.push("sandbox.network.allowLocalBinding");
+	return missing;
+}
+/**
+* The key that stops a merge, or null when the settings can take the
+* allowance. A value of an unexpected shape is someone else's, and rewriting
+* it would lose whatever it means.
+*/
+function unmergeableKey(settings) {
+	if (!("sandbox" in settings)) return null;
+	if (!isPlainObject(settings.sandbox)) return "sandbox";
+	const sandbox = settings.sandbox;
+	if ("filesystem" in sandbox && !isPlainObject(sandbox.filesystem)) return "sandbox.filesystem";
+	if ("network" in sandbox && !isPlainObject(sandbox.network)) return "sandbox.network";
+	return null;
+}
+/** Merge the allowance into a settings object, leaving everything else as it is. */
+function withAllowance(settings, allowance) {
+	const next = { ...settings };
+	const sandbox = isPlainObject(next.sandbox) ? { ...next.sandbox } : {};
+	const filesystem = isPlainObject(sandbox.filesystem) ? { ...sandbox.filesystem } : {};
+	const network = isPlainObject(sandbox.network) ? { ...sandbox.network } : {};
+	const writes = Array.isArray(filesystem.allowWrite) ? filesystem.allowWrite.map(String) : [];
+	const lookups = Array.isArray(network.allowMachLookup) ? network.allowMachLookup.map(String) : [];
+	filesystem.allowWrite = [.../* @__PURE__ */ new Set([...writes, ...allowance.allowWrite])];
+	network.allowMachLookup = [.../* @__PURE__ */ new Set([...lookups, ...allowance.allowMachLookup])];
+	network.allowLocalBinding = true;
+	sandbox.filesystem = filesystem;
+	sandbox.network = network;
+	next.sandbox = sandbox;
+	return next;
+}
+/**
+* Write the allowance into a Claude Code local settings file, creating it if
+* needed. Refuses whenever the current contents cannot be read back, because
+* the merge would replace settings rather than extend them.
+*/
+function applyClaudeAllowance(path, allowance) {
+	const read = readSettings(path);
+	if (read.kind === "invalid") return {
+		status: "refused",
+		reason: `${path} is not a plain JSON object, so Stim cannot merge into it without losing what is there. Comments make a settings file unparseable here even though Claude Code accepts them.`
+	};
+	const existing = read.kind === "object" ? read.value : {};
+	const blocker = unmergeableKey(existing);
+	if (blocker) return {
+		status: "refused",
+		reason: `${path} holds a "${blocker}" that is not an object, so Stim cannot merge into it without discarding that value.`
+	};
+	mkdirSync(dirname(path), { recursive: true });
+	const tmp = `${path}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+	writeFileSync(tmp, `${JSON.stringify(withAllowance(existing, allowance), null, 2)}\n`);
+	try {
+		renameSync(tmp, path);
+	} catch (err) {
+		rmSync(tmp, { force: true });
+		throw err;
+	}
+	return { status: read.kind === "absent" ? "created" : "updated" };
+}
+/**
+* The finding a sandboxed session should see: what fails, and the one command
+* that fixes it where the harness has a per-path allowance.
+*/
+function sandboxFinding(settingsRoot, { env = process.env, home = homedir(), stimHome = process.env.STIM_HOME || "~/.stim", blocked } = {}) {
+	const harness = detectHarness(env);
+	if (!harness) return null;
+	if (!(blocked ?? sandboxBlocksStimHome(stimHome, home))) return null;
+	const symptoms = `Writes to ${stimHome} raise EPERM on a directory you can write, the simulator service looks dead, and the adb server looks unreachable.`;
+	const title = "This session sandboxes shell commands, and Stim is not allowed through";
+	if (harness === "codex") return {
+		level: "cost",
+		title,
+		detail: `${symptoms} Codex has one sandbox setting and no per-path allowance, so there is nothing to add.`,
+		fix: "Run Stim with the sandbox off, or start Codex with `codex -s danger-full-access`, which turns the whole sandbox off rather than allowing these three. See `stim guide errors sandbox`."
+	};
+	const paths = allowanceSearchPaths(settingsRoot, home);
+	const missing = missingAllowance(paths, stimHome, home);
+	if (missing.length === 0) return {
+		level: "cost",
+		title: "Stim is allowed through this sandbox, but the session has not picked it up",
+		detail: `${symptoms} ${paths[0]} already grants all three, so the settings were read before they were written.`,
+		fix: "Restart the session for the allowance to take effect."
+	};
+	return {
+		level: "cost",
+		title,
+		detail: `${symptoms} Missing: ${missing.join(", ")}.`,
+		fix: `Run \`stim doctor --fix\` to write sandbox.filesystem.allowWrite, sandbox.network.allowMachLookup, and sandbox.network.allowLocalBinding into ${paths[0]}, merged with what is there, or add the missing keys by hand. See \`stim guide errors sandbox\`.`
+	};
+}
+//#endregion
+//#region src/device-host/agent-driver.ts
+function hostedAgentDriverFinding(driver, apps) {
+	if (apps === 0 || driver !== void 0 && driver !== "none") return null;
+	return {
+		code: "hosted-agent-driver",
+		level: "note",
+		title: `${apps === 1 ? "A hosted app runs" : `${apps} hosted apps run`} with no agent driver`,
+		detail: "The client's coding agent cannot drive these apps because `hosting.agentDriver` is none, so stim-server starts no driver. agent-device confines macOS control to one macos-app lease and iOS or Android control to one device through its daemon policy.",
+		fix: "stim settings set hosting.agentDriver agent-device, with agent-device 0.21.22 or later"
+	};
+}
+function runningHostedApps() {
+	try {
+		return readHostedSessions().filter((session) => {
+			if (![
+				"macos",
+				"ios",
+				"android"
+			].includes(session.platform) || session.state !== "ready" || !session.appAttempt) return false;
+			try {
+				return readHostedAppMetadata(session.id, session.appAttempt).state === "installed";
+			} catch {
+				return false;
+			}
+		}).length;
+	} catch {
+		return 0;
+	}
+}
+/** Notes installed hosted apps on this Mac while `hosting.agentDriver` starts no driver. */
+function inspectHostedAgentDriver() {
+	const hosting = loadConfig$1()?.hosting;
+	return hostedAgentDriverFinding(isJsonObject(hosting) ? hosting.agentDriver : void 0, runningHostedApps());
+}
+//#endregion
+//#region src/commands/doctor.ts
+function parseDoctorPlatform(value) {
+	if (value === "ios" || value === "android") return value;
+	throw new InvalidArgumentError("expected one of: ios, android");
+}
+/**
+* The simulator runtime `stim ios` would build for here: the one `ios.runtime` names, else the workspace's own
+* simulator's, else the one it would create a simulator on.
+*/
+async function iosTargetRuntime(root, settings) {
+	if (!settings) return null;
+	try {
+		const runtimes = await listIosRuntimesAsync();
+		const runtime = resolveRuntime(null, settings);
+		if (runtime) return runtimes.find((each) => iosRuntimeMatches(each, runtime))?.identifier ?? null;
+		const udid = getProject(root)?.platforms?.ios?.deviceUdid;
+		const own = typeof udid === "string" ? simulatorRuntime(udid) : null;
+		if (own) return own;
+		const deviceType = resolveDeviceType(null, settings) ?? void 0;
+		return pickDefaultIosCreation([], runtimes, { deviceType })?.runtimeId ?? null;
+	} catch {
+		return null;
+	}
+}
+function withoutUnhandledRejection(started) {
+	started.catch(() => {});
+	return started;
+}
+function doctorTarget(platform) {
+	if (platform === "ios") return "iOS";
+	if (platform === "android") return "Android";
+	return "all platforms";
+}
+function stimVersionLines(report) {
+	const resolved = report.resolved ? `${report.resolved.version ?? "unknown version"} at ${report.resolved.path}` : "not found on PATH";
+	const paths = `${report.installations.length} distinct PATH install${report.installations.length === 1 ? "" : "s"}`;
+	const pathVersions = [...new Set(report.installations.map((entry) => entry.version).filter(Boolean))];
+	const versions = pathVersions.length > 1 ? ` (${pathVersions.join(", ")})` : "";
+	return [
+		phaseLine("version", report.runningVersion),
+		phaseLine("resolved", resolved),
+		phaseLine("installs", paths + versions)
+	];
+}
+function budgetLines(budget) {
+	return budget ? [phaseLine("budget", budgetLine(budget))] : [];
+}
+function doctorSuccessLines(platform, stim, budget = null, projectLines = []) {
+	return [
+		`Doctor (${doctorTarget(platform)})`,
+		phaseLine("result", "PASS"),
+		phaseLine("findings", "0"),
+		...stimVersionLines(stim),
+		...budgetLines(budget),
+		"",
+		"Shared",
+		phaseLine("settings", "every Stim setting type, machine config paths, companions and inert keys"),
+		phaseLine("storage", "temporary staging and build-cache volume placement"),
+		...projectLines
+	];
+}
+function shadowedStimFinding(report) {
+	if (!report.resolvedIsOlder || !report.resolved?.version || !report.highestVersion) return null;
+	const newer = [...(compareStimVersions(report.runningVersion, report.resolved.version) ?? 0) > 0 ? [{
+		path: report.runningPath,
+		version: report.runningVersion
+	}] : [], ...report.installations.filter((entry) => entry.version && (compareStimVersions(entry.version, report.resolved?.version ?? "") ?? 0) > 0)].find((entry) => entry.version === report.highestVersion);
+	const newerLocation = newer?.path ? ` at ${newer.path}` : "";
+	return {
+		level: "cost",
+		title: "The Stim resolved from PATH is older than another installation",
+		detail: `${report.resolved.path} reports ${report.resolved.version}, while ${report.highestVersion} is also installed${newerLocation}. A shell command named stim uses the first executable on PATH, so newer commands and fixes can appear to be missing.`,
+		fix: `Update or remove ${report.resolved.path}, or put the ${report.highestVersion} installation earlier on PATH. Then run \`stim doctor\` again.`
+	};
+}
+/**
+* Status goes to stderr so `--json --fix` still prints one parseable payload
+* on stdout, and the report that follows shows what the write left.
+*/
+function applySandboxFix(root, env = process.env) {
+	const harness = detectHarness(env);
+	if (harness === "codex") {
+		console.error(chalk.yellow("Nothing to apply under Codex."));
+		console.error(chalk.dim("Its sandbox is one setting, `sandbox_mode`, with no per-path allowance: the only value that clears Stim is `danger-full-access`, which turns the sandbox off rather than allowing these three. Run Stim with the sandbox off instead, or set it yourself."));
+		process.exitCode = 1;
+		return;
+	}
+	if (harness !== "claude-code") {
+		console.error(chalk.dim("No sandboxing harness detected, so there is nothing to apply."));
+		return;
+	}
+	const settingsRoot = repoRoot(root) ?? root;
+	const stimHome = env.STIM_HOME || "~/.stim";
+	const target = claudeLocalSettingsPath(settingsRoot);
+	const missing = missingAllowance(allowanceSearchPaths(settingsRoot), stimHome);
+	if (missing.length === 0) {
+		console.error(chalk.green("Stim is already allowed through this sandbox. Nothing to apply."));
+		return;
+	}
+	const result = applyClaudeAllowance(target, sandboxAllowance(stimHome));
+	if (result.status === "refused") {
+		console.error(chalk.red(result.reason));
+		console.error(chalk.dim(`Nothing was written. Add ${missing.join(", ")} by hand.`));
+		process.exitCode = 1;
+		return;
+	}
+	console.error(chalk.green(`${result.status === "created" ? "Wrote" : "Updated"} ${target}`));
+	console.error(chalk.dim("Added writes to Stim's state directory, the simulator XPC service, and local port binding. Claude Code reads project settings from the directory a session starts in, so this file only counts for sessions rooted there. Restart the session for it to take effect."));
+}
+function doctorCommand(program, version, inspectVersions = inspectStimVersions, host = process.platform, registry = projectRegistry) {
+	program.command("doctor").description("Inspect the source checkout and report project state that can make native worktrees slow or invalid. The checkout is left untouched unless --fix is passed; --platform filters native findings. Each run in a supported native app is recorded in Stim state so guide can say when doctor is due.").option("--json", "print the findings as JSON").option("--platform <platform>", "report shared findings plus only this native platform: ios or android", parseDoctorPlatform).option("--fix", "repair the sandbox allowance when the report names it, and stale Android .cxx configurations in a React Native or Expo checkout; add linked worktrees nested in a checkout to its .watchmanconfig ignore_dirs; ask each remote Mac in remote.machines for build and device-host approval. Stop native builds first. Generated CMake output must be ignored and untracked; custom launcher settings and source files are preserved.").action(async (opts) => {
+		const root = registry.findProjectRoot(process.cwd());
+		if (!root) {
+			refuseNoProject({ json: Boolean(opts.json) });
+			return;
+		}
+		const settingsContext = projectSettingsContext(root);
+		const machineSettings = readMachineSettings(settingsContext);
+		const settings = machineSettings.corrupt ? null : machineSettings.settings;
+		const selected = registry.selectDoctor(root, opts.platform);
+		const doctors = await selected.load();
+		if (opts.fix) {
+			if (sandboxFinding(repoRoot(root) ?? root)) applySandboxFix(root);
+			for (const doctor of doctors) {
+				if (!doctor.repair) continue;
+				try {
+					const repair = doctor.repair(opts.platform, settings, settingsContext.repoRoot);
+					for (const path of repair.removed) console.error(phaseLine("cache", `removed ${path}; next build reconfigures`));
+					for (const { path, reason } of repair.refused) console.error(phaseLine("cache", `kept ${path}: ${reason}`));
+					if (repair.refused.length > 0) process.exitCode = 1;
+				} catch (error) {
+					console.error(phaseLine("cache", `Project repair failed: ${error.message}`));
+					process.exitCode = 1;
+				}
+			}
+			const nestedToFix = inspectNestedWorktrees(root);
+			const watchedToFix = await watchedCheckouts(nestedToFix.map((entry) => entry.checkout));
+			for (const entry of nestedToFix) {
+				let result;
+				try {
+					result = writeIgnoreDirs(entry);
+				} catch (error) {
+					result = {
+						status: "refused",
+						reason: `${entry.configPath} could not be written: ${error.message}`
+					};
+				}
+				if (result.status === "refused") {
+					console.error(phaseLine("checkout", `kept ${result.reason}; add ${entry.add.join(", ")} to ignore_dirs by hand`));
+					process.exitCode = 1;
+				} else {
+					console.error(phaseLine("checkout", `${result.status} ${entry.configPath}: ignore_dirs ${entry.add.join(", ")}`));
+					if (watchedToFix.has(entry.checkout)) console.error(phaseLine("checkout", `Watchman watches ${entry.checkout} and reads the file only when it adds a root: run \`watchman watch-del ${entry.checkout}\`, then restart watchman to free its memory`));
+				}
+			}
+		}
+		const stim = await inspectVersions(version);
+		const { findings, context } = runDoctor(root, {
+			xcodeMajor: selected.platforms.includes("ios") && host === "darwin" ? detectXcodeMajor() : null,
+			platform: opts.platform,
+			platforms: selected.platforms,
+			host,
+			machineSettings,
+			repoRoot: settingsContext.repoRoot
+		}, doctors.map((doctor) => doctor.inspect));
+		if (selected.problem) findings.unshift({
+			level: "cost",
+			...selected.problem.kind === "not-an-app" ? { code: "not-an-app" } : {},
+			title: selected.problem.kind === "unreadable" ? "The project could not be read" : "This directory has no supported app for this operation",
+			detail: selected.problem.message,
+			fix: selected.problem.remedy
+		});
+		for (const doctor of doctors) if (doctor.inspectAsync) findings.push(...await doctor.inspectAsync(context));
+		if (detectHarness()) {
+			const sandbox = sandboxFinding(repoRoot(root) ?? root);
+			if (sandbox) findings.push(sandbox);
+		}
+		const shadowed = shadowedStimFinding(stim);
+		if (shadowed) findings.push(shadowed);
+		const budget = await inspectBudget(root);
+		findings.push(...budget.findings);
+		const watchmanMemory = withoutUnhandledRejection(inspectWatchmanMemory());
+		const deviceHosts = withoutUnhandledRejection(inspectDeviceHostMachines({ fix: opts.fix === true }));
+		const nestedWorktrees = inspectNestedWorktrees(root);
+		const watched = withoutUnhandledRejection(watchedCheckouts(nestedWorktrees.map((entry) => entry.checkout)));
+		const targetInspectors = doctors.flatMap((doctor) => {
+			const inspect = doctor.offloadTargets?.(context, () => iosTargetRuntime(root, settings));
+			return inspect ? [inspect] : [];
+		});
+		const remoteMachinesInspection = withoutUnhandledRejection(inspectBuildMachines({
+			fix: opts.fix === true,
+			check: targetInspectors.length ? offloadCheck(root, async () => (await Promise.all(targetInspectors.map((inspect) => inspect()))).flat()) : null
+		}));
+		const watchman = await watchmanMemory;
+		if (watchman) findings.push(watchman);
+		if (!memorySweepIsScoped()) findings.push(...memoryCulpritFindings(readMemoryCulprits()));
+		const watchedRoots = await watched;
+		for (const entry of nestedWorktrees) findings.push(nestedWorktreeFinding(entry, watchedRoots.has(entry.checkout)));
+		const remoteMachines = await remoteMachinesInspection;
+		findings.push(...remoteMachines.findings);
+		const deviceHostMachines = await deviceHosts;
+		const reported = new Set(remoteMachines.findings.map((each) => each.title));
+		findings.push(...deviceHostMachines.findings.filter((each) => !reported.has(each.title)));
+		const agentDriver = inspectHostedAgentDriver();
+		if (agentDriver) findings.push(agentDriver);
+		const maintenance = maintenanceStatus();
+		const maintenanceLines = [
+			phaseLine("maintenance.mode", maintenance.mode),
+			phaseLine("maintenance log", maintenanceNdjsonFile()),
+			phaseLine("last pass", maintenanceLine(maintenance, false) ?? "no pass has run yet")
+		];
+		if (opts.json) {
+			console.log(JSON.stringify({
+				project: root,
+				platform: opts.platform ?? null,
+				stim,
+				budget: budget.report,
+				maintenance: {
+					...maintenance,
+					logPath: maintenanceNdjsonFile()
+				},
+				remoteMachines: remoteMachines.machines,
+				deviceHosts: deviceHostMachines.machines,
+				findings
+			}));
+			recordDoctorRun(root, opts.platform, version, void 0, selected.platforms);
+			return;
+		}
+		if (findings.length === 0) {
+			const lines = [...doctorSuccessLines(opts.platform, stim, budget.report, doctors.flatMap((doctor) => doctor.successLines?.(opts.platform) ?? [])), ...maintenanceLines];
+			for (const [index, line] of lines.entries()) if (index === 1) console.log(chalk.green(line));
+			else if (line && !line.startsWith("  ")) console.log(chalk.bold(line));
+			else console.log(chalk.dim(line));
+			recordDoctorRun(root, opts.platform, version, void 0, selected.platforms);
+			return;
+		}
+		const ordered = findings.toSorted((a, b) => a.level === b.level ? 0 : a.level === "cost" ? -1 : 1);
+		console.log(chalk.bold(`Doctor (${doctorTarget(opts.platform)})`));
+		for (const line of [
+			...stimVersionLines(stim),
+			...budgetLines(budget.report),
+			...maintenanceLines
+		]) console.log(chalk.dim(line));
+		for (const f of ordered) {
+			const tag = f.level === "cost" ? chalk.yellow("costs time") : chalk.dim("note");
+			console.log(`\n${tag}  ${chalk.bold(f.title)}`);
+			console.log(`  ${f.detail}`);
+			if (f.fix) console.log(chalk.dim(`  -> ${f.fix}`));
+		}
+		console.log(chalk.dim(`\n${findings.length} finding(s). Fix relevant "costs time" findings before copying the source checkout into a native worktree.`));
+		recordDoctorRun(root, opts.platform, version, void 0, selected.platforms);
+	});
+}
+//#endregion
+export { applySandboxFix, doctorCommand as default, doctorSuccessLines, parseDoctorPlatform, shadowedStimFinding };