Module diagnostics 

Observability surface: introspect AgentSec’s runtime state.

Four entry points, each surfaced as a CLI subcommand and an MCP tool by the umbrella crate:

Entry	Role
info	Crate version + resolved paths + env state with per-var provenance.
status	Runtime activity overview (file counts, latest timestamps, Plain Mode).
recent_activity	Tail of paste_log/ and web_log/ audit rows.
doctor	Comprehensive health check (env / paths / hook wiring / MCP register).

§Env provenance

info reports four AgentSec-relevant env vars (AGENTSEC_HOME, HOME, ANTHROPIC_API_KEY, AGENTSEC_LLM_MODEL) with the source that produced the effective value:

• Process — set in the process environment, not present in the loaded .env file (or no .env was loaded).
• DotenvFile { path, line } — defined in the .env file at the given line; dotenvy loaded it without overriding an existing process-env value (so this is the effective source for vars that were unset before load).
• DotenvFileShadowed { path, line } — defined in the .env file at the given line but the process env already had the var set; the process value wins (dotenvy is non-overriding by default).
• Default(value) — not set anywhere; AgentSec’s builtin default applies.
• Unset — not set anywhere and no default applies (i.e. an optional var like ANTHROPIC_API_KEY left empty).

Secret values (ANTHROPIC_API_KEY) are always reported in redacted form (sk-***<last-4>); the raw value never enters the report.

Structs

AuditTail

One audit-log row excerpt.

DoctorCheck

One health check row.

DoctorReport

Health-check report: one row per check, each PASS / WARN / FAIL.

EnvVarStatus

One env var’s effective state + provenance.

InfoReport

Top-level info report.

PathsInfo

Display-friendly path bundle.

RecentActivityReport

Tail of audit log files. n of each kind (paste / web).

StatusReport

Runtime activity snapshot.

StorageItem

One row of the Storage section: where audit data physically lives.

Enums

DoctorStatus

Three-level check verdict.

EnvSource

Where the effective env value came from.

Constants

VERSION

Crate version embedded at compile time.

Functions

doctor

Run all health checks and return the aggregated report.

format_size

Format a byte count as a short human-readable string. Integer-only math (no f64) to avoid clippy precision-loss lint.

info

Build an InfoReport from a resolved Config and the live process environment.

recent_activity

Read the last n files (by filename order, which is timestamped) of paste_log/ and web_log/ and return their excerpts.

status

Build a StatusReport from the on-disk state at cfg.paths.