tumwater 0.2.0 → 0.4.0

package/dist/src/doctor/doctor.js

@@ -1,43 +1,65 @@
-// vocabulary: plain
 import { loadConfigSafe } from "../config/config.js";
 import { envPath } from "../files/files.js";
 import { orchestratorAlive, readOrchestratorInfo } from "../team/orchestrator-info.js";
 import { systemProcessProbe } from "../process/process-table.js";
 import { checkOrphans } from "./doctor-orphans.js";
-import { checkBudget, checkClaudeWindow, checkErrorStreaks, checkMainRed, checkMaintenanceQuota, checkPause, checkProviderHolds, checkQuietHours } from "./doctor-holds.js";
+import { checkBudget, checkErrorStreaks, checkMainRed, checkMaintenanceQuota, checkPause, checkProviderHolds, checkQuietHours, checkSubscriptionWindow } from "./doctor-holds.js";
 import { checkRootInstall } from "./doctor-install.js";
 import { checkNotify } from "./doctor-notify.js";
 import { checkLaunchServicesPorts } from "./doctor-launch-services.js";
 import { plural } from "../text/phrases.js";
 import { shortSha } from "../text/format.js";
-import { checkAgentBinary, checkBrief, checkBootstrap, checkBuild, checkBuildCheck, checkClaudeTranscripts, checkFunes, checkGitBinary, checkConfigKeyNames, checkInit, checkDiskSpace, checkEventLog, checkFlakyChecks, checkOpencodeVersion, checkMergeLock, checkNodeVersion, checkPiExtensions, checkProviderConcurrency, checkProviderContention, checkRepo, checkStateDir, checkWorktreePool, checkLeftoverRoleBranches, checkWorkInstances, } from "./doctor-checks.js";
-import { checkClaudeAuth, checkClaudeVersion, checkAnthroApiKey, checkFallbackChain, checkFallbackModel, checkImageInput, checkOpencode, checkTierModels } from "./doctor-model-checks.js";
-import { agentQualifiedSelector } from "../config/config-views.js";
+import { failOutcome } from "./outcome.js";
+import { errorMessage } from "../text/text.js";
+import { checkBackendBinary, checkBrief, checkBootstrap, checkClaudeTranscripts, checkExecPath, checkFunes, checkGitBinary, checkConfigKeyNames, checkInit, checkOpencodeVersion, checkNodeVersion, checkPiExtensions, checkRepo, } from "./doctor-checks.js";
+import { checkBuild, checkBuildCheck, checkCiParity, checkDiskSpace, checkEventLog, checkFlakyChecks, checkPostMergeChurn, checkQaCoverage, checkStateDir, } from "./doctor-project-checks.js";
+import { sampleFreeBytes } from "../gates/disk-gate.js";
+import { checkCheckContention, checkLeftoverRoleBranches, checkMergeLock, checkProviderConcurrency, checkProviderContention, checkTumwaterPins, checkWorkInstances, checkWorktreePool, } from "./doctor-contention-checks.js";
+import { checkFeedbackFiling, checkImageInput, checkTierModels } from "./doctor-model-checks.js";
+import { checkFallbackChain, checkFallbackModel } from "./doctor-fallback-checks.js";
+import { checkAnthroApiKey, checkClaudeAuth, checkClaudeVersion } from "./doctor-claude-checks.js";
+import { checkOpencode } from "./doctor-opencode-checks.js";
+import { checkCodexAccount, checkCodexAuth, checkCodexHome, checkCodexLeaks, checkCodexModels, checkCodexSessions, checkCodexWriteGuard, checkCodexVersion, } from "./doctor-codex-checks.js";
+import { backendQualifiedSelector } from "../config/config-views.js";
 import { seamsInUse } from "../config/config-fallbacks.js";
-import { checkBacklogHeadings, checkFixClaims, checkLiveFinished, checkPlanDependencies, checkRefusedEntries, checkRegressedFixes, checkStaleQueuedMerges, checkStaleBugs, checkStalePrompts, checkStaleQuestions, checkStalledPlans, checkStrandedPlans, checkUncommittedBacklog, checkValidationGaps, checkWaitingBugs } from "./doctor-backlog.js";
+import { checkBacklogHeadings, checkFixClaims, checkLiveFinished, checkPlanDependencies, checkStalledEntries, checkStrandedPlans, checkValidationGaps } from "./doctor-backlog-plans.js";
+import { checkRefusedEntries, checkRegressedFixes, checkStaleBugs, checkStaleQuestions, checkWaitingBugs } from "./doctor-backlog-bugs.js";
+import { checkMergeQueueFiles, checkPostReviews, checkStaleQueuedMerges, checkStalePrompts, checkUncommittedBacklog } from "./doctor-backlog.js";
 /** Pre-flight environment check (`tumwater doctor`). The harness's preconditions are
  * scattered across fail-fast checks that each command re-runs on its own (requireReadyRepo in
  * cli.ts walks git-binary → repo → tumwater.json → commits and stops at the first failure;
- * cmdRun adds pi-on-PATH and orchestrator-alive), so a user facing a partially initialized or
+ * cmdStart adds pi-on-PATH and orchestrator-alive), so a user facing a partially initialized or
  * drifted environment gets one error at a time. doctor runs every check, reports each result
  * individually instead of stopping at the first failure, and exits 0/1 so it can be scripted —
  * the pre-flight sibling of `status --json`, which queries live team state while doctor
  * verdicts on the environment. Every check is read-only against .tumwater/ (works with or
  * without a running harness) and none runs the project's build/test: that can take minutes and
  * belongs in the review gate / red-main check, not a pre-flight. The individual checks live in
- * doctor-checks.ts and doctor-model-checks.ts; this module composes them into the report. */
-/** Wrap a possibly-absent doctor check into the report's `checks` spread: null omits the row
- * entirely (the pi-extensions row for a team with no pi seam; the funes row when funes is not
- * on PATH); an outcome contributes `{ name, ...outcome }`. */
-function appendNamedOutcome(name, outcome) {
-    return outcome === null ? [] : [{ name, ...outcome }];
+ * doctor-checks.ts, doctor-project-checks.ts, doctor-contention-checks.ts, doctor-model-checks.ts,
+ * doctor-claude-checks.ts, doctor-opencode-checks.ts, doctor-backlog.ts,
+ * doctor-backlog-plans.ts and doctor-backlog-bugs.ts;
+ * this module composes them into the report. */
+/** Run one doctor check, turning a throw or rejection into a fail row: a check that crashed
+ * verified nothing, so it must not read as a pass or abort the report. */
+export async function runDoctorCheck(run) {
+    try {
+        return await run();
+    }
+    catch (err) {
+        return failOutcome(`the check threw: ${errorMessage(err)}`);
+    }
 }
 /** Run every check in order and compose the report. Read-only against .tumwater/ by
  * construction — no check removes or repairs anything (the state-dir probe writes a temp file
  * and deletes it again; the orphan check reports processes, never signals them) — so doctor
  * works identically with or without a running harness. `probe` feeds the orphan and port
- * checks, so tests can pin the report without reading the host's process table. */
-export async function runDoctor(root, pathEnv = envPath(), probe = systemProcessProbe, probeImages = "never") {
+ * checks, so tests can pin the report without reading the host's process table. `diskSample`
+ * feeds the disk check the same way, so tests can pin the report without reading the host's
+ * real free space (a hosted runner under the 10 GB floor would fail its row). `only` runs
+ * just the named checks, in report order; a skipped check is never evaluated, and a named
+ * conditional check that returns null leaves no row. A check that throws becomes its own fail
+ * row, and every other check still runs. */
+export async function runDoctor(root, pathEnv = envPath(), probe = systemProcessProbe, probeImages = "never", only, diskSample = sampleFreeBytes) {
     // Loaded once for the checks that read config (repo's baseBranch); a broken file stays
     // undefined — checkInit reports it verbatim — so doctor still runs every other check.
     const { config } = loadConfigSafe(root);
@@ -48,7 +70,7 @@ export async function runDoctor(root, pathEnv = envPath(), probe = systemProcess
     const routing = config
         ? seamsInUse(config).map((s) => ({
             label: s.label,
-            selector: s.model !== undefined ? agentQualifiedSelector({ ...s, model: s.model }) : "no model declared",
+            selector: s.model !== undefined ? backendQualifiedSelector({ ...s, model: s.model }) : "no model declared",
             backend: s.agent ?? "pi",
         }))
         : [];
@@ -56,80 +78,107 @@ export async function runDoctor(root, pathEnv = envPath(), probe = systemProcess
     const header = orchestratorAlive(root, info) && info
         ? `tumwater doctor — running (pid ${info.pid}${info.build ? `, version ${shortSha(info.build.sha)}${info.build.stale ? " — update available" : ""}${info.build.restartBlocked ? " (restart blocked)" : ""}` : ""})`
         : "tumwater doctor — not running";
-    const checks = [
-        { name: "node", ...checkNodeVersion() },
-        { name: "git binary", ...checkGitBinary(pathEnv) },
-        { name: "repo", ...(await checkRepo(root, config)) },
-        { name: "init", ...checkInit(root) },
-        { name: "config key names", ...checkConfigKeyNames(root) },
-        { name: "brief", ...checkBrief(root) },
+    const steps = [
+        { name: "node", run: () => checkNodeVersion() },
+        { name: "node binary", run: () => checkExecPath() },
+        { name: "git binary", run: () => checkGitBinary(pathEnv) },
+        { name: "repo", run: () => checkRepo(root, config) },
+        { name: "init", run: () => checkInit(root) },
+        { name: "config key names", run: () => checkConfigKeyNames(root) },
+        { name: "brief", run: () => checkBrief(root) },
         // New-project bootstrap (plans/work-ratio.md, part 2/2): an active hold reports as ok
         // information, never a warning — a young project is not misconfigured.
-        { name: "bootstrap", ...checkBootstrap(root, config) },
-        { name: "pause", ...checkPause(root) },
-        { name: "quiet hours", ...checkQuietHours(config) },
-        { name: "budget", ...checkBudget(root, config, (orchestratorAlive(root, info) && info?.budget) || null) },
-        { name: "claude window", ...checkClaudeWindow(root, undefined, (orchestratorAlive(root, info) && info?.chain) || undefined, config) },
-        { name: "provider waits", ...checkProviderHolds(root) },
-        { name: "maintenance allowance", ...checkMaintenanceQuota(root, config, orchestratorAlive(root, info)) },
-        { name: "provider concurrency", ...checkProviderConcurrency(config, root) },
-        { name: "provider contention", ...checkProviderContention(root, config) },
-        { name: "repeated failures", ...checkErrorStreaks(root, config) },
-        { name: "main's check", ...checkMainRed(root, config) },
-        { name: "over-cap model", ...checkFallbackModel(root, undefined, (orchestratorAlive(root, info) && info?.fallbackDemoted) || null) },
-        { name: "fallback chain", ...(await checkFallbackChain(root)) },
-        { name: "models for each tier", ...(await checkTierModels(root)) },
-        { name: "image input", ...(await checkImageInput(root, undefined, undefined, undefined, probeImages, pathEnv)) },
-        { name: "claude auth", ...(await checkClaudeAuth(root, pathEnv)) },
-        { name: "claude api key", ...(await checkAnthroApiKey(root, undefined, pathEnv)) },
-        { name: "claude version", ...(await checkClaudeVersion(root, pathEnv)) },
-        { name: "opencode version", ...(await checkOpencodeVersion(root, pathEnv)) },
-        { name: "opencode", ...(await checkOpencode(root, pathEnv)) },
-        { name: "backend binary", ...checkAgentBinary(root, pathEnv) },
+        { name: "bootstrap", run: () => checkBootstrap(root, config) },
+        { name: "pause", run: () => checkPause(root) },
+        { name: "quiet hours", run: () => checkQuietHours(config) },
+        { name: "budget", run: () => checkBudget(root, config, (orchestratorAlive(root, info) && info?.budget) || null) },
+        { name: "claude window", run: () => checkSubscriptionWindow("claude", root, undefined, (orchestratorAlive(root, info) && info?.chain) || undefined, config) },
+        { name: "codex window", run: () => checkSubscriptionWindow("codex", root, undefined, (orchestratorAlive(root, info) && info?.chain) || undefined, config) },
+        { name: "provider waits", run: () => checkProviderHolds(root) },
+        { name: "maintenance allowance", run: () => checkMaintenanceQuota(root, config, orchestratorAlive(root, info)) },
+        { name: "provider concurrency", run: () => checkProviderConcurrency(config, root) },
+        { name: "provider contention", run: () => checkProviderContention(root, config) },
+        { name: "check contention", run: () => checkCheckContention(root, config) },
+        { name: "repeated failures", run: () => checkErrorStreaks(root, config) },
+        { name: "main's check", run: () => checkMainRed(root, config) },
+        { name: "over-cap model", run: () => checkFallbackModel(root, undefined, (orchestratorAlive(root, info) && info?.fallbackDemoted) || null) },
+        { name: "fallback chain", run: () => checkFallbackChain(root) },
+        { name: "models for each tier", run: () => checkTierModels(root) },
+        { name: "image input", run: () => checkImageInput(root, undefined, undefined, undefined, probeImages, pathEnv) },
+        { name: "claude auth", run: () => checkClaudeAuth(root, pathEnv) },
+        { name: "claude api key", run: () => checkAnthroApiKey(root, undefined, pathEnv) },
+        { name: "claude version", run: () => checkClaudeVersion(root, pathEnv) },
+        { name: "opencode version", run: () => checkOpencodeVersion(root, pathEnv) },
+        { name: "opencode", run: () => checkOpencode(root, pathEnv) },
+        { name: "codex version", run: () => checkCodexVersion(root, pathEnv) },
+        { name: "codex login", run: () => checkCodexAuth(root, pathEnv) },
+        { name: "codex home", run: () => checkCodexHome(root) },
+        { name: "codex models", run: () => checkCodexModels(root) },
+        { name: "codex account", run: () => checkCodexAccount(root) },
+        { name: "codex leaks", run: () => checkCodexLeaks(root) },
+        { name: "codex sessions", run: () => checkCodexSessions(root) },
+        { name: "codex write guard", run: () => checkCodexWriteGuard(root, pathEnv) },
+        { name: "backend binary", run: () => checkBackendBinary(root, pathEnv) },
+        { name: "feedback filing", run: () => checkFeedbackFiling(root, pathEnv) },
         // The transcript total is informational and only read when a seam routes to claude.
-        { name: "claude transcripts", ...checkClaudeTranscripts(config) },
+        { name: "claude transcripts", run: () => checkClaudeTranscripts(config) },
         // The receive-side guards name what a running team skips, so an operator tool meant for the
         // team (a pi package, an extension file, an mcp.json server, or funes) does not vanish
         // silently. Each check returns null to omit its row: the pi row for a team with no pi seam,
-        // the funes row when funes is not on PATH.
-        ...(appendNamedOutcome("pi extensions", checkPiExtensions(config, undefined, pathEnv))),
-        ...(appendNamedOutcome("funes", checkFunes(config, pathEnv))),
-        { name: "state dir", ...checkStateDir(root) },
-        { name: "event log", ...checkEventLog(root) },
-        { name: "notify", ...checkNotify(root, config) },
-        { name: "merge lock", ...checkMergeLock(root) },
-        { name: "workspaces", ...checkWorktreePool(root) },
-        { name: "parallel instances", ...checkWorkInstances(root, config) },
-        { name: "leftover role branches", ...(await checkLeftoverRoleBranches(root, config)) },
+        // the funes row when funes is not on PATH, and the claude/codex window rows when that backend
+        // has no subscription account.
+        { name: "pi extensions", run: () => checkPiExtensions(config, undefined, pathEnv) },
+        { name: "funes", run: () => checkFunes(config, pathEnv) },
+        { name: "state dir", run: () => checkStateDir(root) },
+        { name: "event log", run: () => checkEventLog(root) },
+        { name: "notify", run: () => checkNotify(root, config) },
+        { name: "merge lock", run: () => checkMergeLock(root) },
+        { name: "workspaces", run: () => checkWorktreePool(root) },
+        { name: "parallel instances", run: () => checkWorkInstances(root, config) },
+        { name: "leftover role branches", run: () => checkLeftoverRoleBranches(root, config) },
+        { name: "tumwater pins", run: () => checkTumwaterPins(root) },
         // The disk floor (plans/disk-floor.md, part 1/4): a broken config stays undefined (checkInit
         // reports it), so the check falls back to the 10 GB default rather than skipping itself.
-        { name: "disk space", ...checkDiskSpace(root, config?.diskHoldGB ?? 10, config?.diskReclaimGB ?? 40) },
-        { name: "check", ...checkBuildCheck(root, config) },
-        { name: "root install", ...checkRootInstall(root) },
+        { name: "disk space", run: () => checkDiskSpace(root, config?.diskHoldGB ?? 10, config?.diskReclaimGB ?? 40, diskSample) },
+        { name: "check", run: () => checkBuildCheck(root, config) },
+        { name: "ci parity", run: () => checkCiParity(root, config, Date.now()) },
+        { name: "qa coverage", run: () => checkQaCoverage(root, Date.now()) },
+        { name: "root install", run: () => checkRootInstall(root) },
         // The review gate's flake memory, surfaced read-only: naming which checks the gate kept
         // excusing as flakes (ok/warn only, so a flaky suite never fails a scripted pre-flight).
-        { name: "flaky checks", ...checkFlakyChecks(root) },
-        { name: "claimed bugs", ...checkFixClaims(root) },
-        { name: "validation gaps", ...checkValidationGaps(root) },
-        { name: "plans stuck in Planned", ...checkStrandedPlans(root) },
-        { name: "backlog headings", ...checkBacklogHeadings(root) },
-        { name: "backlog archive", ...checkLiveFinished(root) },
-        { name: "refusals", ...checkRefusedEntries(root) },
-        { name: "stalled plans", ...checkStalledPlans(root) },
-        { name: "plan dependencies", ...checkPlanDependencies(root) },
-        { name: "stale questions", ...checkStaleQuestions(root) },
-        { name: "stale bugs", ...checkStaleBugs(root) },
-        { name: "waiting bugs", ...checkWaitingBugs(root) },
-        { name: "regressed fixes", ...checkRegressedFixes(root) },
-        { name: "stale merge-queue entries", ...checkStaleQueuedMerges(root, Date.now()) },
-        { name: "stale prompts", ...checkStalePrompts(root, Date.now()) },
-        { name: "uncommitted backlog", ...(await checkUncommittedBacklog(root, config)) },
+        { name: "flaky checks", run: () => checkFlakyChecks(root) },
+        { name: "post-merge churn", run: () => checkPostMergeChurn(root) },
+        { name: "claimed bugs", run: () => checkFixClaims(root) },
+        { name: "validation gaps", run: () => checkValidationGaps(root) },
+        { name: "plans stuck in Planned", run: () => checkStrandedPlans(root) },
+        { name: "backlog headings", run: () => checkBacklogHeadings(root) },
+        { name: "backlog archive", run: () => checkLiveFinished(root) },
+        { name: "refusals", run: () => checkRefusedEntries(root) },
+        { name: "stalled entries", run: () => checkStalledEntries(root) },
+        { name: "plan dependencies", run: () => checkPlanDependencies(root) },
+        { name: "stale questions", run: () => checkStaleQuestions(root) },
+        { name: "stale bugs", run: () => checkStaleBugs(root) },
+        { name: "waiting bugs", run: () => checkWaitingBugs(root) },
+        { name: "regressed fixes", run: () => checkRegressedFixes(root) },
+        { name: "stale merge-queue entries", run: () => checkStaleQueuedMerges(root, Date.now()) },
+        { name: "merge-queue files", run: () => checkMergeQueueFiles(root) },
+        { name: "post-merge reviews", run: () => checkPostReviews(root) },
+        { name: "stale prompts", run: () => checkStalePrompts(root, Date.now()) },
+        { name: "uncommitted backlog", run: () => checkUncommittedBacklog(root, config) },
         // The running team's own view of its build (staleness and what auto-restart made of it)
         // when there is one; without it the check still stands on its own git comparison.
-        { name: "update", ...(await checkBuild(root, undefined, undefined, (orchestratorAlive(root, info) && info?.build) || null)) },
-        { name: "orphans", ...(await checkOrphans(root, probe)) },
-        { name: "macOS port leak", ...(await checkLaunchServicesPorts(probe)) },
+        { name: "update", run: () => checkBuild(root, undefined, undefined, (orchestratorAlive(root, info) && info?.build) || null) },
+        { name: "orphans", run: () => checkOrphans(root, probe) },
+        { name: "macOS port leak", run: () => checkLaunchServicesPorts(probe) },
     ];
+    const checks = [];
+    for (const step of steps) {
+        if (only && !only.includes(step.name))
+            continue;
+        const outcome = await runDoctorCheck(step.run);
+        if (outcome !== null)
+            checks.push({ name: step.name, ...outcome });
+    }
     const problems = checks.filter((c) => c.level === "fail").length;
     return { header, checks, routing, verdict: problems === 0 ? "ready to run" : plural(problems, "problem") };
 }

package/dist/src/doctor/image-probe.js

@@ -11,14 +11,17 @@ import os from "node:os";
 import path from "node:path";
 import { randomInt } from "node:crypto";
 import zlib from "node:zlib";
+import { DAY_MS } from "../text/datetime.js";
 import { PiStreamParser } from "../pi/pi-stream.js";
-import { resolveAgentBin } from "../pi/pi-bin.js";
+import { resolveBackendBin } from "../pi/pi-bin.js";
 import { imageProbesPath } from "../paths.js";
+import { removeTree } from "../files/files.js";
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
+import { isJsonObject, validEntries } from "../files/json-object.js";
 import { boundedProbe } from "./probe.js";
 /** How long a cached image-probe verdict stays valid while the claim is unchanged (7 days) —
  * a model's endpoint can change underneath a stale pass, so the answer is dated. */
-export const IMAGE_PROBE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+export const IMAGE_PROBE_TTL_MS = 7 * DAY_MS;
 /** The probe's deadline (90 s): a local model may need to load, far beyond the quick credential
  * probes, but a doctor run is still a pre-flight — a hung backend must lose, not stall the
  * report. */
@@ -41,10 +44,20 @@ export function imageProbeEntryFresh(entry, now = Date.now()) {
         entry.claim &&
         now - entry.at <= IMAGE_PROBE_TTL_MS);
 }
+/** Whether a parsed cache entry has the shape of an `ImageProbeCacheEntry`. */
+function isImageProbeCacheEntry(value) {
+    return (isJsonObject(value) &&
+        (value.verdict === "pass" || value.verdict === "fail") &&
+        typeof value.detail === "string" &&
+        typeof value.at === "number" &&
+        Number.isFinite(value.at) &&
+        typeof value.claim === "boolean");
+}
 /** Read the probe cache, or an empty cache when the file is missing or torn (the harness's
- * no-data policy: a crashed writer never takes down a reader). */
+ * no-data policy: a crashed writer never takes down a reader). An entry of a foreign shape is
+ * dropped, so it reads as unprobed, and the doctor's next cache write leaves it out. */
 export function readImageProbeCache(root) {
-    return readJsonFile(imageProbesPath(root)) ?? {};
+    return validEntries(readJsonFile(imageProbesPath(root)), isImageProbeCacheEntry);
 }
 /** Write the probe cache atomically (tmp+rename) so a concurrent reader never sees a torn
  * file. */
@@ -167,7 +180,7 @@ function isFourDigitNumber(text) {
 /** Probe one claimed pi seam with a real image (plans/image-input.md "Doctor"). Runs the
  * resolved pi binary in a run's environment (the caller passes `env`, typically
  * `childEnv({ PATH: pathEnv })` which inherits `PI_CODING_AGENT_DIR`, so the probe reads the
- * same models.json a real tick would):
+ * same models.json a real run would):
  *
  *   `pi --print --mode json --no-session --no-tools --no-mcp --provider P --model M
  *        --thinking <level> @<png> "Reply with only the 4-digit number shown in the image."`
@@ -183,13 +196,13 @@ function isFourDigitNumber(text) {
  * injectable so tests need no real pi. */
 export async function runImageProbe(config, seam, env, timeoutMs = PROBE_TIMEOUT_MS, code) {
     const envBin = env.TUMWATER_PI_BIN?.trim();
-    // Resolve from the run's own environment (env override → config), exactly as a real tick's
+    // Resolve from the run's own environment (env override → config), exactly as a real run's
     // spawn would rather than only the harness process env — so tests can point a fake pi there.
     const bin = envBin
         ? envBin.includes("/")
             ? path.resolve(envBin)
             : envBin
-        : resolveAgentBin(config).bin;
+        : resolveBackendBin(config).bin;
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "tumwater-image-probe-"));
     const wrong = []; // the per-attempt "answered …" detail for a wrong answer
     const misread = []; // whether each wrong answer was a (wrong) 4-digit number
@@ -239,6 +252,6 @@ export async function runImageProbe(config, seam, env, timeoutMs = PROBE_TIMEOUT
             : { verdict: "fail", detail: `two wrong answers (${wrong[1]})` };
     }
     finally {
-        fs.rmSync(dir, { recursive: true, force: true });
+        removeTree(dir);
     }
 }

package/dist/src/doctor/outcome.js

@@ -1,8 +1,9 @@
 /** The doctor report's one-line outcome contract, in its own module so every check module
  * shares the shape and its constructors without a runtime import cycle: doctor-checks.ts
  * value-imports claudeSeamsInUse from doctor-model-checks.ts, so that pair cannot value-import
- * each other. doctor-checks.ts, doctor-model-checks.ts, doctor-orphans.ts, doctor-backlog.ts,
- * doctor-holds.ts, and doctor-launch-services.ts all import from here. */
+ * each other. doctor-checks.ts, doctor-project-checks.ts, doctor-contention-checks.ts,
+ * doctor-model-checks.ts, doctor-orphans.ts, doctor-backlog.ts, doctor-holds.ts, and
+ * doctor-launch-services.ts all import from here. */
 /** Constructors for the one CheckOutcome shape, so each check names its verdict
  * (`okOutcome(detail)`) instead of repeating the two-field literal. */
 export function okOutcome(detail) {

package/dist/src/doctor/probe.js

@@ -1,5 +1,16 @@
 import { spawn } from "node:child_process";
-import { releaseChildHandles, signalTree } from "../process/process.js";
+import { captureCappedOutput, releaseChildHandles, signalTree } from "../process/process.js";
+/** How long a backend credential/version probe may take before it counts as unknown — a doctor
+ * run is a pre-flight, not a place to wait out a hung backend. Shared by the pi, claude, opencode
+ * and codex credential probes (doctor-pi-checks.ts, doctor-claude-checks.ts,
+ * doctor-opencode-checks.ts, doctor-codex-checks.ts). */
+export const AUTH_CHECK_TIMEOUT_MS = 15_000;
+/** Cap on a credential probe's captured stdout. The auth reply is a tiny JSON object; a binary
+ * whose output is a runaway log (or a pipe held open with no EOF) must not grow `out` without
+ * bound. Sibling probes share EXEC_MAX_BUFFER, but 1 MiB is already orders of magnitude past any
+ * real reply, so it is the tighter bound here. Over it the probe kills the child and reads as
+ * unknown. */
+export const AUTH_CHECK_MAX_OUTPUT_BYTES = 1024 * 1024;
 /** One bounded probe of a resolved binary: `null` when the spawn threw, the child errored,
  * the deadline passed, or stdout overran `maxOutputBytes` — every case the caller must read as
  * "could not check", never as a verdict. The child runs detached and at the deadline (or on
@@ -10,7 +21,9 @@ import { releaseChildHandles, signalTree } from "../process/process.js";
  * full stderr pipe would block the child. `timeoutMs` and `maxOutputBytes` are test seams;
  * production callers pass their own named constants. One home of the shape, shared by the
  * model checks' credential/version probes, the tier-model probes, and the image-input probe —
- * before the split each doctor module carried its own byte-for-byte copy. */
+ * before the split each doctor module carried its own byte-for-byte copy. The credential probes'
+ * named budgets (AUTH_CHECK_TIMEOUT_MS, AUTH_CHECK_MAX_OUTPUT_BYTES) live beside it here, so the
+ * backend check modules share them without importing them from one another. */
 export function boundedProbe(bin, args, env, timeoutMs, maxOutputBytes) {
     return new Promise((resolve) => {
         let child;
@@ -29,8 +42,6 @@ export function boundedProbe(bin, args, env, timeoutMs, maxOutputBytes) {
             resolve(null);
             return;
         }
-        let out = "";
-        let bytes = 0;
         let settled = false;
         let timer;
         const settle = (result) => {
@@ -46,19 +57,17 @@ export function boundedProbe(bin, args, env, timeoutMs, maxOutputBytes) {
             resolve(result);
         };
         // Deadline or runaway output: kill the whole group, tear down the handles, and settle —
-        // do not wait for a `'close'` the group may never deliver.
+        // do not wait for a `'close'` the group may never deliver. Overrun shares the path: it
+        // passes `abort` as captureCappedOutput's onOverflow.
         const abort = () => {
             signalTree(child, "SIGKILL");
             settle(null);
         };
         timer = setTimeout(abort, timeoutMs);
-        child.stdout?.on("data", (chunk) => {
-            out += chunk.toString("utf8");
-            bytes += chunk.length;
-            if (bytes > maxOutputBytes)
-                abort();
-        });
+        // Captured stdout is capped at maxOutputBytes (reads past it abort); stderr was piped to
+        // ignore at spawn, so captureCappedOutput attaches nothing to it.
+        const captured = captureCappedOutput(child, maxOutputBytes, abort);
         child.on("error", () => settle(null));
-        child.on("close", (code) => settle({ code, stdout: out }));
+        child.on("close", (code) => settle({ code, stdout: captured.stdout }));
     });
 }