diff --git a/src/ui/style.css b/src/ui/style.css
index ca76564..667f03f 100644
--- a/src/ui/style.css
+++ b/src/ui/style.css
@@ -1228,12 +1228,78 @@ body {
.doctor-migration-status { color: var(--text-muted); font-size: 0.66rem; text-transform: uppercase; }
.doctor-migration-actions { display: flex; justify-content: flex-end; align-items: center; gap: 10px; margin-top: 10px; }
.doctor-privacy-detail { color: var(--text-muted); font-size: 0.72rem; line-height: 1.5; }
+.doctor-readonly {
+ display: inline-flex; margin-left: 6px; padding: 2px 6px; border: 1px solid var(--border);
+ border-radius: 999px; color: var(--text-muted); font-size: 0.58rem; text-transform: uppercase;
+ letter-spacing: 0.04em; vertical-align: 1px;
+}
+.doctor-runtime { display: grid; gap: 10px; }
+.doctor-runtime-head { display: flex; justify-content: space-between; gap: 12px; align-items: center; font-size: 0.76rem; }
+.doctor-runtime-head > div { display: flex; align-items: center; gap: 8px; }
+.doctor-runtime-head > span { color: var(--text-muted); font-family: "Geist Mono", monospace; font-size: 0.68rem; }
+.doctor-runtime-status { padding: 2px 7px; border-radius: 999px; background: var(--surface-inset); color: var(--text-muted); font-size: 0.62rem; text-transform: uppercase; }
+.doctor-runtime-status[data-status="healthy"] { color: #57d977; border: 1px solid color-mix(in oklab, #57d977 45%, transparent); }
+.doctor-runtime-grid { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 8px; }
+.doctor-runtime-flags { display: flex; flex-wrap: wrap; gap: 6px; }
+.doctor-runtime-flags span { padding: 3px 7px; border-radius: 5px; border: 1px solid var(--border); color: var(--text-muted); font-size: 0.64rem; }
+.doctor-runtime-flags span[data-enabled="true"] { color: var(--accent); border-color: color-mix(in oklab, var(--accent) 45%, var(--border)); }
+.doctor-runtime-findings .doctor-finding:last-child { margin-bottom: 0; }
+.runtime-map-heading, .runtime-subheading, .runtime-intent-row {
+ display: flex; justify-content: space-between; align-items: flex-start; gap: 12px;
+}
+.runtime-map-heading > div:first-child, .runtime-subheading > div:first-child, .runtime-intent-row > div:first-child { display: grid; gap: 2px; }
+.runtime-map-heading b, .runtime-subheading b, .runtime-intent-row b { font-size: 0.8rem; }
+.runtime-map-heading span, .runtime-subheading span, .runtime-intent-row span { color: var(--text-muted); font-size: 0.66rem; }
+.runtime-subheading { padding-top: 5px; border-top: 1px dashed var(--border); }
+.runtime-legend, .runtime-intent-flags { display: flex; flex-wrap: wrap; justify-content: flex-end; gap: 5px; }
+.runtime-legend span, .runtime-policy, .runtime-intent-flags span {
+ padding: 2px 6px; border: 1px solid var(--border); border-radius: 999px; font-size: 0.6rem; white-space: nowrap;
+}
+.runtime-legend span[data-policy="shared-candidate"], .runtime-policy[data-policy="shared-candidate"] { color: #57d977; border-color: color-mix(in oklab, #57d977 45%, var(--border)); }
+.runtime-legend span[data-policy="review"], .runtime-policy[data-policy="review"] { color: #f0ce48; border-color: color-mix(in oklab, #f0ce48 45%, var(--border)); }
+.runtime-legend span[data-policy="isolate"], .runtime-policy[data-policy="isolate"] { color: #f47b66; border-color: color-mix(in oklab, #f47b66 45%, var(--border)); }
+.runtime-session-grid, .runtime-shared-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(245px, 1fr)); gap: 8px; }
+.runtime-session-card, .runtime-shared-card { border: 1px solid var(--border); border-radius: 9px; background: var(--surface-inset); padding: 10px; min-width: 0; }
+.runtime-shared-card { border-color: color-mix(in oklab, var(--accent) 50%, var(--border)); }
+.runtime-session-head { display: flex; align-items: flex-start; justify-content: space-between; gap: 10px; }
+.runtime-session-head > div { display: grid; gap: 2px; min-width: 0; }
+.runtime-session-head b { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: 0.76rem; }
+.runtime-session-head span, .runtime-session-meta { color: var(--text-muted); font-size: 0.62rem; }
+.runtime-session-head strong { font-family: "Geist Mono", monospace; font-size: 0.7rem; white-space: nowrap; }
+.runtime-memory-bar { height: 4px; margin: 8px 0 6px; border-radius: 999px; background: var(--border); overflow: hidden; }
+.runtime-memory-bar i { display: block; height: 100%; border-radius: inherit; background: var(--accent); }
+.runtime-mcp-list { display: flex; flex-wrap: wrap; gap: 5px; margin-top: 8px; }
+.runtime-mcp-chip { max-width: 100%; padding: 3px 6px; border: 1px solid var(--border); border-radius: 5px; font-size: 0.64rem; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.runtime-mcp-chip small { color: var(--text-muted); }
+.runtime-mcp-chip[data-policy="isolate"] { border-color: color-mix(in oklab, #f47b66 40%, var(--border)); }
+.runtime-mcp-chip[data-policy="review"] { border-color: color-mix(in oklab, #f0ce48 40%, var(--border)); }
+.runtime-mcp-chip[data-policy="shared-candidate"] { border-color: color-mix(in oklab, #57d977 35%, var(--border)); }
+.runtime-none { color: var(--text-muted); font-size: 0.62rem; font-style: italic; }
+.runtime-session-actions { display: flex; align-items: center; justify-content: space-between; gap: 8px; margin-top: 9px; padding-top: 8px; border-top: 1px dashed var(--border); }
+.runtime-session-actions > div { display: flex; flex-wrap: wrap; gap: 4px; }
+.runtime-stop-btn { padding: 4px 7px; font-size: 0.62rem; }
+.runtime-stop-btn:hover:not(:disabled) { color: #f47b66; border-color: color-mix(in oklab, #f47b66 55%, var(--border)); }
+.runtime-attention { padding: 2px 5px; border-radius: 4px; background: color-mix(in oklab, #f0ce48 12%, transparent); color: #d9b833; font-size: 0.58rem; }
+.runtime-attention[data-flag="high-memory"] { background: color-mix(in oklab, #f47b66 12%, transparent); color: #f47b66; }
+.runtime-shared-links { display: flex; flex-wrap: wrap; gap: 5px; margin-top: 8px; }
+.runtime-shared-links span { color: var(--text-muted); font-size: 0.62rem; }
+.runtime-duplicate-list { border: 1px solid var(--border); border-radius: 8px; overflow: hidden; }
+.runtime-duplicate-row { display: flex; align-items: center; justify-content: space-between; gap: 10px; padding: 8px 10px; border-bottom: 1px solid var(--border); }
+.runtime-duplicate-row:last-child { border-bottom: 0; }
+.runtime-duplicate-row > div { display: grid; gap: 2px; min-width: 0; }
+.runtime-duplicate-row b { font-size: 0.72rem; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.runtime-duplicate-row span { color: var(--text-muted); font-size: 0.62rem; }
+.runtime-intent-row { padding: 10px; border: 1px solid var(--border); border-radius: 8px; }
+.runtime-intent-flags span[data-enabled="true"] { color: #57d977; border-color: color-mix(in oklab, #57d977 45%, var(--border)); }
@media (max-width: 760px) {
.doctor-modal { width: calc(100vw - 20px); }
.doctor-body { padding-left: 14px; padding-right: 14px; }
.doctor-score-row { grid-template-columns: 1fr; }
.doctor-summary-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+ .doctor-runtime-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+ .runtime-map-heading, .runtime-subheading, .runtime-intent-row { flex-direction: column; }
+ .runtime-legend, .runtime-intent-flags { justify-content: flex-start; }
.doctor-migration-controls { align-items: stretch; flex-direction: column; }
}
.toast-close {
diff --git a/tests/e2e/dashboard.spec.mjs b/tests/e2e/dashboard.spec.mjs
index da73f19..55bdc33 100644
--- a/tests/e2e/dashboard.spec.mjs
+++ b/tests/e2e/dashboard.spec.mjs
@@ -3889,6 +3889,35 @@ test.describe('Harness Doctor control plane', () => {
expect(report.contextMap.nodes.some(node => node.relation === 'direct')).toBe(true);
});
+ test('runtime doctor API is read-only and privacy bounded', async () => {
+ const response = await fetch(`${env.baseURL}/api/runtime-doctor`);
+ expect(response.status).toBe(200);
+ const report = await response.json();
+ expect(report.ok).toBe(true);
+ expect(typeof report.detected).toBe('boolean');
+ expect(Array.isArray(report.topology.sessions)).toBe(true);
+ expect(Array.isArray(report.topology.duplicateDirectMcps)).toBe(true);
+ expect(Array.isArray(report.topology.sharedRuntimes)).toBe(true);
+ if (report.detected) {
+ expect(report.methodology.readOnly).toBe(true);
+ expect(report.methodology.secretValuesReturned).toBe(false);
+ expect(report.exposure.commandLineSecretProcesses).toBeGreaterThanOrEqual(0);
+ }
+ expect(JSON.stringify(report)).not.toContain('api-token=');
+ });
+
+ test('runtime stop rejects a stale process identity without signalling anything', async () => {
+ const response = await fetch(`${env.baseURL}/api/runtime/session/stop`, {
+ method: 'POST',
+ headers: { 'Content-Type': 'application/json', Origin: env.baseURL },
+ body: JSON.stringify({ sessionId: 'codex:999999:stale', confirmation: 'codex:999999:stale' }),
+ });
+ expect(response.status).toBe(409);
+ const result = await response.json();
+ expect(result.ok).toBe(false);
+ expect(result.error).toMatch(process.platform === 'linux' ? /ended or changed identity/ : /Linux only/);
+ });
+
test('Harness Doctor modal renders score, context, migration, and privacy controls', async ({ page }) => {
const errors = [];
page.on('console', message => { if (message.type() === 'error') errors.push(message.text()); });
@@ -3898,6 +3927,10 @@ test.describe('Harness Doctor control plane', () => {
await expect(page.locator('.doctor-score-value')).toContainText('Grade');
await expect(page.locator('#doctorContextMap .doctor-map-node').first()).toBeVisible();
await expect(page.locator('#doctorContextMap .doctor-map-node[data-relation="direct"]')).toHaveCount(1);
+ await expect(page.locator('#doctorRuntime')).toBeVisible();
+ await expect(page.locator('#doctorRuntime')).toContainText(/Live agent sessions/);
+ await expect(page.locator('#doctorRuntime')).toContainText(/1MCP is not running|enabled servers/);
+ await expect(page.locator('#doctorRuntime')).toContainText(/IntentProbe runtime security/);
await expect(page.locator('#doctorMigrationTarget option')).toHaveCount(3);
await expect(page.locator('#doctorMigrationTarget option[value="dsh"]')).toHaveCount(1);
await expect(page.locator('#doctorMetricsEnabled')).not.toBeChecked();
@@ -3908,6 +3941,18 @@ test.describe('Harness Doctor control plane', () => {
await expect(page.locator('#doctorBadge')).toHaveClass(/hidden/);
});
+ test('runtime inspection failure does not hide a successful control-plane audit', async ({ page }) => {
+ await page.route('**/api/runtime-doctor**', route => route.fulfill({
+ status: 500,
+ contentType: 'application/json',
+ body: JSON.stringify({ ok: false, error: 'fixture failure' }),
+ }));
+ await page.goto(env.baseURL);
+ await page.locator('#doctorBtn').click();
+ await expect(page.locator('#doctorOverview')).toContainText('Grade');
+ await expect(page.locator('#doctorRuntime')).toContainText('Runtime inspection failed');
+ });
+
test('copy-only skill migration previews, applies, and undoes', async () => {
const previewResponse = await fetch(`${env.baseURL}/api/migration/preview?scope=global&target=codex&targetScope=global&harness=claude`);
const preview = await previewResponse.json();
diff --git a/tests/unit/test-runtime-doctor.mjs b/tests/unit/test-runtime-doctor.mjs
new file mode 100644
index 0000000..5b756f6
--- /dev/null
+++ b/tests/unit/test-runtime-doctor.mjs
@@ -0,0 +1,282 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { chmod, mkdtemp, mkdir, writeFile, rm, symlink } from "node:fs/promises";
+import { createServer } from "node:http";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import {
+ analyzeOneMcpConfig,
+ buildRuntimeFindings,
+ collectProcessGroup,
+ collectRuntimeDoctorReport,
+ commandLineHasSecret,
+ fetchLoopbackHealth,
+ parseOneMcpFlags,
+ stopRuntimeSession,
+} from "../../src/runtime-doctor.mjs";
+
+describe("MCP Runtime Doctor", () => {
+ it("extracts only operational 1MCP flags", () => {
+ const flags = parseOneMcpFlags([
+ "node", "/opt/bin/1mcp", "serve", "--transport", "http", "--port=3050",
+ "--host", "127.0.0.1", "--enable-async-loading", "--enable-session-persistence",
+ ]);
+ assert.equal(flags.port, 3050);
+ assert.equal(flags.host, "127.0.0.1");
+ assert.equal(flags.asyncLoading, true);
+ assert.equal(flags.lazyLoading, false);
+ assert.equal(flags.sessionPersistence, true);
+ assert.equal(parseOneMcpFlags(["1mcp", "serve", "--port", ""]).port, 3050);
+ });
+
+ it("detects but never needs to return command-line credential values", () => {
+ assert.equal(commandLineHasSecret(["node", "server", "--api-token=redacted-value"]), true);
+ assert.equal(commandLineHasSecret(["node", "server", "--password", "redacted-value"]), true);
+ assert.equal(commandLineHasSecret(["node", "server", "--enable-auth"]), false);
+ assert.equal(commandLineHasSecret(["node", "server", "--max-tokens", "4096"]), false);
+ assert.equal(commandLineHasSecret(["node", "server", "--token-limit", "8000"]), false);
+ assert.equal(commandLineHasSecret(["node", "server", "--password-file", "/run/secrets/demo"]), false);
+ assert.equal(commandLineHasSecret(["node", "server", "max_tokens=4096"]), false);
+ });
+
+ it("uses only the runtime descendant tree when its cgroup is shared", async () => {
+ const processes = new Map([
+ [100, { pid: 100, ppid: 1, cgroupPath: "/shared.scope", tokens: ["1mcp", "serve"] }],
+ [101, { pid: 101, ppid: 100, cgroupPath: "/shared.scope", tokens: ["node", "backend", "--api-token=redacted"] }],
+ [200, { pid: 200, ppid: 1, cgroupPath: "/shared.scope", tokens: ["editor"] }],
+ ]);
+ const resources = await collectProcessGroup(
+ { pid: 100, cgroupPath: "/shared.scope" },
+ processes,
+ "/sys/fs/cgroup",
+ {},
+ );
+ assert.equal(resources.processCount, 2);
+ assert.equal(resources.commandLineSecretProcesses, 1);
+ assert.equal(resources.memoryBytes, null);
+ assert.equal(resources.taskCount, null);
+ });
+
+ it("counts floating npx packages without exposing environment values", () => {
+ const summary = analyzeOneMcpConfig({
+ mcpServers: {
+ floating: { command: "npx", args: ["-y", "demo-mcp@latest"] },
+ exact: { command: "npx", args: ["@scope/server@1.2.3"], env: { API_TOKEN: "redacted" } },
+ disabled: { command: "npx", args: ["unused"], disabled: true },
+ },
+ });
+ assert.deepEqual(summary, {
+ configuredCount: 3,
+ enabledCount: 2,
+ disabledCount: 1,
+ floatingNpxCount: 1,
+ secretEnvKeyCount: 1,
+ });
+ });
+
+ it("turns runtime pressure and exposure into explainable findings", () => {
+ const findings = buildRuntimeFindings({
+ runtime: { unhealthyServers: 1 },
+ inventory: { enabledCount: 17, floatingNpxCount: 2 },
+ resources: { memoryMaxRatio: 0.4, memoryHighRatio: 0.5, taskRatio: 0.7 },
+ features: { lazyLoading: false },
+ exposure: { commandLineSecretProcesses: 1 },
+ });
+ assert.deepEqual(findings.map(finding => finding.code), [
+ "unhealthy-upstreams", "command-line-secret", "floating-npx", "task-pressure", "lazy-loading-off",
+ ]);
+ });
+
+ it("settles safely when a loopback health response exceeds 64 KiB", async () => {
+ const server = createServer((_request, response) => {
+ response.writeHead(200, { "Content-Type": "application/json" });
+ response.write("x".repeat(65536));
+ setTimeout(() => response.end("x"), 10);
+ });
+ await new Promise(resolve => server.listen(0, "127.0.0.1", resolve));
+ try {
+ const address = server.address();
+ assert.ok(address && typeof address === "object");
+ const result = await Promise.race([
+ fetchLoopbackHealth("127.0.0.1", address.port, 500),
+ new Promise((_, reject) => setTimeout(() => reject(new Error("health request did not settle")), 1000)),
+ ]);
+ assert.equal(result, null);
+ } finally {
+ await new Promise(resolve => server.close(resolve));
+ }
+ });
+
+ it("collects a bounded report from a fake procfs and cgroup", async () => {
+ const root = await mkdtemp(join(tmpdir(), "cco-runtime-doctor-"));
+ const home = join(root, "home");
+ const procRoot = join(root, "proc");
+ const cgroupRoot = join(root, "cgroup");
+ const group = "user.slice/1mcp.service";
+ const configPath = join(home, ".config", "1mcp", "mcp.json");
+ try {
+ await Promise.all([
+ mkdir(join(procRoot, "100"), { recursive: true }),
+ mkdir(join(procRoot, "101"), { recursive: true }),
+ mkdir(join(cgroupRoot, group), { recursive: true }),
+ mkdir(join(home, ".config", "1mcp"), { recursive: true }),
+ ]);
+ await Promise.all([
+ writeFile(join(procRoot, "100", "cmdline"), [
+ "node", join(home, "bin", "1mcp"), "serve", "--transport", "http",
+ "--port", "3050", "--config", configPath, "--enable-async-loading", "",
+ ].join("\0")),
+ writeFile(join(procRoot, "101", "cmdline"), "node\0backend\0--api-token=redacted\0"),
+ writeFile(join(procRoot, "100", "cgroup"), `0::/${group}\n`),
+ writeFile(join(procRoot, "101", "cgroup"), `0::/${group}\n`),
+ writeFile(join(procRoot, "100", "status"), "Name:\t1mcp\nPPid:\t1\nUid:\t1000\t1000\t1000\t1000\n"),
+ writeFile(join(procRoot, "101", "status"), "Name:\tnode\nPPid:\t100\nUid:\t1000\t1000\t1000\t1000\n"),
+ writeFile(join(cgroupRoot, group, "memory.current"), "2048\n"),
+ writeFile(join(cgroupRoot, group, "memory.high"), "4096\n"),
+ writeFile(join(cgroupRoot, group, "memory.max"), "8192\n"),
+ writeFile(join(cgroupRoot, group, "pids.current"), "7\n"),
+ writeFile(join(cgroupRoot, group, "pids.max"), "10\n"),
+ writeFile(configPath, JSON.stringify({ mcpServers: { demo: { command: "npx", args: ["demo-mcp"] } } })),
+ ]);
+
+ const report = await collectRuntimeDoctorReport({
+ home, procRoot, cgroupRoot, platform: "linux", uid: 1000, env: {},
+ healthFetcher: async () => ({
+ status: "healthy", version: "0.39.3", system: { uptime: 60 },
+ servers: { healthy: 1, unhealthy: 0 },
+ }),
+ });
+ assert.equal(report.detected, true);
+ assert.equal(report.runtime.version, "0.39.3");
+ assert.equal(report.resources.processCount, 2);
+ assert.equal(report.resources.taskRatio, 0.7);
+ assert.equal(report.exposure.commandLineSecretProcesses, 1);
+ assert.equal(report.methodology.secretValuesReturned, false);
+ assert.ok(report.findings.some(finding => finding.code === "command-line-secret"));
+ } finally {
+ await rm(root, { recursive: true, force: true });
+ }
+ });
+
+ it("maps live sessions, duplicate direct MCPs, shared sockets, and IntentProbe readiness", async () => {
+ const root = await mkdtemp(join(tmpdir(), "cco-runtime-map-"));
+ const home = join(root, "home");
+ const bin = join(root, "bin");
+ const procRoot = join(root, "proc");
+ const cgroupRoot = join(root, "cgroup");
+ const group = "user.slice/1mcp.service";
+ const configPath = join(home, ".config", "1mcp", "mcp.json");
+ const processRows = [
+ { pid: 100, ppid: 1, name: "claude", rss: 1000, start: 1000, cmd: ["claude"] },
+ { pid: 101, ppid: 100, name: "npm exec gmail", rss: 200, start: 1010, cmd: ["npx", "-y", "gmail-mcp@1.2.3"] },
+ { pid: 102, ppid: 101, name: "node", rss: 300, start: 1020, cmd: ["node", "gmail-mcp"] },
+ { pid: 103, ppid: 100, name: "codex", rss: 50, start: 1030, cmd: ["codex", "mcp-server"] },
+ { pid: 104, ppid: 100, name: "node", rss: 111, start: 1040, cmd: ["node", "/srv/mcp-a/build/index.js"] },
+ { pid: 105, ppid: 100, name: "npm exec tool", rss: 33, start: 1050, cmd: ["npx", "tool@1.0.0", "--profile", "a"] },
+ { pid: 200, ppid: 100, name: "codex", rss: 2000, start: 2000, cmd: ["codex"] },
+ { pid: 201, ppid: 200, name: "npm exec gmail", rss: 200, start: 2010, cmd: ["npx", "-y", "gmail-mcp@1.2.3"] },
+ { pid: 202, ppid: 201, name: "node", rss: 300, start: 2020, cmd: ["node", "gmail-mcp"] },
+ { pid: 203, ppid: 200, name: "node", rss: 100, start: 2030, cmd: ["node", "cco-server"] },
+ { pid: 204, ppid: 200, name: "node", rss: 222, start: 2040, cmd: ["node", "/srv/mcp-b/build/index.js"] },
+ { pid: 300, ppid: 1, name: "node", rss: 400, start: 3000, cmd: ["node", join(home, "bin", "1mcp"), "serve", "--port", "3050", "--config", configPath] },
+ { pid: 301, ppid: 300, name: "node", rss: 600, start: 3010, cmd: ["node", "search-mcp"] },
+ ];
+ const statText = row => `${row.pid} (${row.name}) S ${row.ppid} ${Array(17).fill("0").join(" ")} ${row.start}\n`;
+ const statusText = row => [
+ `Name:\t${row.name}`,
+ "State:\tS (sleeping)",
+ `PPid:\t${row.ppid}`,
+ "Uid:\t1000\t1000\t1000\t1000",
+ `VmRSS:\t${row.rss} kB`,
+ "Threads:\t2",
+ "",
+ ].join("\n");
+ try {
+ await Promise.all([
+ mkdir(join(procRoot, "net"), { recursive: true }),
+ mkdir(join(cgroupRoot, group), { recursive: true }),
+ mkdir(join(home, ".config", "1mcp"), { recursive: true }),
+ mkdir(join(home, ".claude"), { recursive: true }),
+ mkdir(bin, { recursive: true }),
+ ]);
+ for (const row of processRows) {
+ await mkdir(join(procRoot, String(row.pid)), { recursive: true });
+ await Promise.all([
+ writeFile(join(procRoot, String(row.pid), "status"), statusText(row)),
+ writeFile(join(procRoot, String(row.pid), "cmdline"), `${row.cmd.join("\0")}\0`),
+ writeFile(join(procRoot, String(row.pid), "stat"), statText(row)),
+ writeFile(join(procRoot, String(row.pid), "cgroup"), row.pid >= 300 ? `0::/${group}\n` : "0::/user.slice\n"),
+ ]);
+ }
+ await mkdir(join(procRoot, "102", "fd"), { recursive: true });
+ await symlink("socket:[12345]", join(procRoot, "102", "fd", "5"));
+ await Promise.all([
+ writeFile(join(procRoot, "uptime"), "1000.00 0.00\n"),
+ writeFile(join(procRoot, "net", "tcp"), " sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode\n 0: 0100007F:C350 0100007F:0BEA 01 00000000:00000000 00:00000000 00000000 1000 0 12345\n"),
+ writeFile(join(procRoot, "net", "tcp6"), " sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode\n"),
+ writeFile(join(cgroupRoot, group, "memory.current"), "1024000\n"),
+ writeFile(join(cgroupRoot, group, "memory.high"), "4096000\n"),
+ writeFile(join(cgroupRoot, group, "memory.max"), "8192000\n"),
+ writeFile(join(cgroupRoot, group, "pids.current"), "4\n"),
+ writeFile(join(cgroupRoot, group, "pids.max"), "20\n"),
+ writeFile(configPath, JSON.stringify({ mcpServers: { search: { command: "npx", args: ["search-mcp@2.0.0"] } } })),
+ writeFile(join(home, ".claude", "settings.json"), JSON.stringify({ hooks: { PreToolUse: [{ command: "intentprobe runtime scan --stdin" }] } })),
+ writeFile(join(bin, "intentprobe"), "#!/bin/sh\nexit 0\n"),
+ ]);
+ await chmod(join(bin, "intentprobe"), 0o755);
+
+ const report = await collectRuntimeDoctorReport({
+ home, procRoot, cgroupRoot, platform: "linux", uid: 1000, currentPid: 203,
+ env: { PATH: bin },
+ mcpItems: [
+ { category: "mcp", name: "gmail", mcpConfig: { command: "npx", args: ["-y", "gmail-mcp@1.2.3"] } },
+ { category: "mcp", name: "local-a", mcpConfig: { command: "node", args: ["/srv/mcp-a/build/index.js"] } },
+ { category: "mcp", name: "local-b", mcpConfig: { command: "node", args: ["/srv/mcp-b/build/index.js"] } },
+ { category: "mcp", name: "profile-a", mcpConfig: { command: "npx", args: ["tool@1.0.0", "--profile", "a"] } },
+ { category: "mcp", name: "profile-b", mcpConfig: { command: "npx", args: ["tool@1.0.0", "--profile", "b"] } },
+ ],
+ healthFetcher: async () => ({ status: "healthy", version: "0.40.0", servers: { healthy: 1, unhealthy: 0 } }),
+ });
+
+ assert.equal(report.methodology.version, 2);
+ assert.equal(report.topology.sessions.length, 2);
+ assert.deepEqual(report.topology.sessions.map(session => session.memoryBytes), [1694 * 1024, 2822 * 1024]);
+ assert.deepEqual(report.topology.sessions.map(session => session.controllable), [false, false]);
+ assert.deepEqual(
+ report.topology.sessions[0].mcpServers.map(server => server.name).sort(),
+ ["gmail", "local-a", "profile-a"],
+ );
+ assert.deepEqual(
+ report.topology.sessions[1].mcpServers.map(server => server.name).sort(),
+ ["gmail", "local-b"],
+ );
+ assert.equal(report.topology.duplicateDirectMcps.length, 1);
+ assert.equal(report.topology.duplicateDirectMcps[0].name, "gmail");
+ assert.equal(report.topology.duplicateDirectMcps[0].sessions.length, 2);
+ assert.equal(report.topology.duplicateDirectMcps[0].instanceCount, 2);
+ assert.equal(report.topology.duplicateDirectMcps[0].memoryBytes, 1000 * 1024);
+ assert.equal(report.topology.sharedRuntimes[0].connectedSessions.length, 1);
+ assert.equal(report.topology.sharedRuntimes[0].connectedSessions[0].label, "Claude Code #1");
+ assert.equal(report.intentProbe.installed, true);
+ assert.equal(report.intentProbe.hookConfigured, true);
+ assert.equal(report.intentProbe.receiptIngestion, "not-connected");
+ assert.equal(JSON.stringify(report).includes("gmail-mcp@1.2.3"), false);
+
+ const signals = [];
+ const stopped = await stopRuntimeSession(report.topology.sessions[0].id, {
+ procRoot, platform: "linux", uid: 1000, currentPid: 9999,
+ env: {}, sendSignal: (pid, signal) => signals.push([pid, signal]),
+ });
+ assert.equal(stopped.ok, true);
+ assert.deepEqual(signals, [[100, "SIGTERM"]]);
+
+ const stale = await stopRuntimeSession("claude:100:999999", {
+ procRoot, platform: "linux", uid: 1000, currentPid: 9999, env: {},
+ sendSignal: () => assert.fail("stale identity must never be signalled"),
+ });
+ assert.equal(stale.ok, false);
+ } finally {
+ await rm(root, { recursive: true, force: true });
+ }
+ });
+});