xbp_cli/commands/

system_diag.rs

use crate::codetime::SystemInventory;
use crate::commands::service::load_xbp_config;
use crate::commands::worktree_watch::{
    collect_worktree_watch_diagnostic, WorktreeWatchDiagnostic,
};
use crate::config::{ensure_global_xbp_paths, sync_system_inventory};
use crate::logging::{log_info, log_warn};
use crate::strategies::{get_all_services, ProjectDetector};
use crate::utils::{collect_listening_port_ownership, command_exists, ListeningPortOwnership};
use anyhow::Result;
use colored::Colorize;
use indicatif::{ProgressBar, ProgressStyle};
use netstat2::{get_sockets_info, AddressFamilyFlags, ProtocolFlags, ProtocolSocketInfo};
use serde::{Deserialize, Serialize};
use std::collections::{BTreeMap, HashMap};
use std::env;
use std::fs;
use std::fs::OpenOptions;
use std::path::PathBuf;
use std::time::{Duration, Instant};
use sysinfo::{Disks, Networks, System};
use tokio::process::Command;

#[derive(Debug, Serialize, Deserialize)]
pub struct SystemMetrics {
    pub cpu_usage: f32,
    pub memory_total: u64,
    pub memory_used: u64,
    pub memory_percent: f32,
    pub disk_total: u64,
    pub disk_used: u64,
    pub disk_percent: f32,
    pub network_rx: u64,
    pub network_tx: u64,
    pub uptime: u64,
    pub process_count: usize,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct PortCheck {
    pub port: u16,
    pub is_open: bool,
    pub is_blocked: bool,
    pub pids: Vec<u32>,
    pub xbp_projects: Vec<String>,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct InternetSpeed {
    pub download_mbps: f64,
    pub upload_mbps: f64,
    pub ping_ms: f64,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct OsInfo {
    pub name: Option<String>,
    pub version: Option<String>,
    pub kernel_version: Option<String>,
    pub arch: Option<String>,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct CpuInfo {
    pub brand: Option<String>,
    pub cores: usize,
    pub usage: f32,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct DiskInfo {
    pub mount: String,
    pub fs: Option<String>,
    pub total: u64,
    pub used: u64,
    pub percent: f32,
    pub bar: String,
    pub is_current: bool,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct ShellInfo {
    pub shell: Option<String>,
    pub term: Option<String>,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct ProxyDetection {
    pub nginx_sites_available: Option<usize>,
    pub nginx_active: Option<bool>,
    pub traefik_active: Option<bool>,
    pub apache_active: Option<bool>,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct ExposureInfo {
    pub public_ipv4: Option<String>,
    pub listening_on_all_interfaces: Vec<String>,
    pub firewall_hint: Option<String>,
    pub summary: Option<String>,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct ToolVersion {
    pub present: bool,
    pub version: Option<String>,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct PathPermissionCheck {
    pub path: String,
    pub purpose: String,
    pub required: String,
    pub exists: bool,
    pub readable: bool,
    pub writable: bool,
    pub creatable: bool,
    pub ok: bool,
    pub message: Option<String>,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct DiagnosticReport {
    pub system_metrics: SystemMetrics,
    pub os: Option<OsInfo>,
    pub cpu: Option<CpuInfo>,
    pub gpu_candidates: Vec<String>,
    pub disks: Vec<DiskInfo>,
    pub shell: Option<ShellInfo>,
    pub proxy_detection: Option<ProxyDetection>,
    pub clipboard_tools: HashMap<String, bool>,
    pub exposure: Option<ExposureInfo>,
    pub pm2_process_count: Option<usize>,
    pub tool_versions: HashMap<String, ToolVersion>,
    pub service_statuses: HashMap<String, String>,
    pub feature_flags: HashMap<String, bool>,
    pub xbp_cli_version: String,
    pub project_config_present: bool,
    pub configured_services: Vec<String>,
    pub provider_manifests: Vec<String>,
    pub nginx_status: Option<NginxStatus>,
    pub port_checks: Vec<PortCheck>,
    pub internet_speed: Option<InternetSpeed>,
    pub connectivity: bool,
    pub installed_programs: HashMap<String, bool>,
    pub path_permission_checks: Vec<PathPermissionCheck>,
    pub codetime: Option<CodeTimeDiagnostic>,
    pub worktree_watch: Option<WorktreeWatchDiagnostic>,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct CodeTimeDiagnostic {
    pub saved_config_path: String,
    pub refreshed: bool,
    pub inventory: SystemInventory,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct NginxStatus {
    pub is_running: bool,
    pub is_enabled: bool,
    pub config_valid: bool,
    pub error: Option<String>,
}

const PM2_DIAG_TIMEOUT: Duration = Duration::from_secs(12);
const PORT_OWNERSHIP_TIMEOUT: Duration = Duration::from_secs(20);
const PER_PORT_CHECK_TIMEOUT: Duration = Duration::from_secs(2);
const TOOL_VERSION_TIMEOUT: Duration = Duration::from_secs(10);
const PROGRAM_CHECK_TIMEOUT: Duration = Duration::from_secs(3);
const COMMAND_CAPTURE_TIMEOUT: Duration = Duration::from_secs(5);
const INTERNET_SPEED_TIMEOUT: Duration = Duration::from_secs(20);
const NGINX_CHECK_TIMEOUT: Duration = Duration::from_secs(4);
const SYSTEM_INVENTORY_TIMEOUT: Duration = Duration::from_secs(25);
const DOWNLOAD_PROBE_REQUEST_TIMEOUT: Duration = Duration::from_secs(12);
const DOWNLOAD_PROBE_MAX_DURATION: Duration = Duration::from_secs(8);
const DOWNLOAD_PROBE_TARGET_BYTES: u64 = 8_000_000;
const DOWNLOAD_PROBE_MIN_BYTES: u64 = 1_000_000;
const DOWNLOAD_PROBE_URLS: &[&str] = &[
    "https://speed.cloudflare.com/__down?bytes=20000000",
    "https://speed.hetzner.de/10MB.bin",
    "https://proof.ovh.net/files/10Mb.dat",
];

#[derive(Debug, Clone, Copy, Default)]
pub struct DiagnosticRunOptions {
    pub skip_speed_test: bool,
    pub codetime: bool,
    pub cursor: bool,
}

pub async fn get_system_metrics() -> Result<SystemMetrics> {
    let mut sys = System::new_all();
    sys.refresh_all();

    let cpu_usage =
        sys.cpus().iter().map(|cpu| cpu.cpu_usage()).sum::<f32>() / sys.cpus().len() as f32;
    let memory_total = sys.total_memory();
    let memory_used = sys.used_memory();
    let memory_percent = (memory_used as f32 / memory_total as f32) * 100.0;

    let mut disk_total = 0;
    let mut disk_used = 0;
    for disk in Disks::new_with_refreshed_list().iter() {
        disk_total += disk.total_space();
        disk_used += disk.total_space() - disk.available_space();
    }
    let disk_percent = if disk_total > 0 {
        (disk_used as f32 / disk_total as f32) * 100.0
    } else {
        0.0
    };

    let networks = Networks::new_with_refreshed_list();
    let mut network_rx = 0;
    let mut network_tx = 0;
    for (_interface_name, network) in &networks {
        network_rx += network.total_received();
        network_tx += network.total_transmitted();
    }

    let uptime = System::uptime();
    let process_count = sys.processes().len();

    Ok(SystemMetrics {
        cpu_usage,
        memory_total,
        memory_used,
        memory_percent,
        disk_total,
        disk_used,
        disk_percent,
        network_rx,
        network_tx,
        uptime,
        process_count,
    })
}

pub async fn check_nginx_status() -> Result<NginxStatus> {
    let is_running: bool = check_systemctl_status("nginx").await?;
    let is_enabled: bool = check_systemctl_enabled("nginx").await?;

    let config_valid: bool = if is_running {
        match Command::new("nginx").arg("-t").output().await {
            Ok(output) => output.status.success(),
            Err(_) => false,
        }
    } else {
        false
    };

    Ok(NginxStatus {
        is_running,
        is_enabled,
        config_valid,
        error: None,
    })
}

async fn check_systemctl_status(service: &str) -> Result<bool> {
    if !cfg!(target_os = "linux") || !command_exists("systemctl") {
        return Ok(false);
    }

    let output = Command::new("systemctl")
        .arg("is-active")
        .arg(service)
        .output()
        .await?;

    Ok(output.status.success())
}

async fn check_systemctl_enabled(service: &str) -> Result<bool> {
    if !cfg!(target_os = "linux") || !command_exists("systemctl") {
        return Ok(false);
    }

    let output = Command::new("systemctl")
        .arg("is-enabled")
        .arg(service)
        .output()
        .await?;

    Ok(output.status.success())
}

pub async fn check_port_availability(
    port: u16,
    ownership: Option<&ListeningPortOwnership>,
) -> Result<PortCheck> {
    use std::net::TcpListener;

    let is_open: bool = TcpListener::bind(format!("127.0.0.1:{}", port)).is_ok();

    let is_blocked: bool = if cfg!(target_os = "linux") {
        check_firewall_blocked(port).await.unwrap_or(false)
    } else {
        false
    };

    Ok(PortCheck {
        port,
        is_open,
        is_blocked,
        pids: ownership
            .map(|value| value.pids.clone())
            .unwrap_or_default(),
        xbp_projects: ownership
            .map(|value| value.xbp_projects.clone())
            .unwrap_or_default(),
    })
}

async fn check_firewall_blocked(port: u16) -> Result<bool> {
    let output: std::process::Output = Command::new("iptables")
        .arg("-L")
        .arg("-n")
        .output()
        .await?;

    if !output.status.success() {
        return Ok(false);
    }

    let stdout = String::from_utf8_lossy(&output.stdout);
    let port_str = port.to_string();
    Ok(stdout.contains(&format!("dpt:{}", port_str)) && stdout.contains("DROP"))
}

pub async fn check_internet_connectivity() -> Result<bool> {
    let result: std::process::Output = if cfg!(target_os = "windows") {
        Command::new("ping")
            .arg("-n")
            .arg("1")
            .arg("-w")
            .arg("2000")
            .arg("8.8.8.8")
            .output()
            .await?
    } else {
        Command::new("ping")
            .arg("-c")
            .arg("1")
            .arg("-W")
            .arg("2")
            .arg("8.8.8.8")
            .output()
            .await?
    };

    Ok(result.status.success())
}

pub async fn measure_internet_speed() -> Result<InternetSpeed> {
    if let Ok(speed) = measure_speed_with_speedtest_cli().await {
        if speed.download_mbps >= 1.0 || speed.upload_mbps >= 0.5 {
            return Ok(speed);
        }
    }

    let ping: f64 = measure_ping().await?;
    let download_mbps = measure_download_speed().await.unwrap_or(0.0);
    let upload_mbps = 0.0;

    Ok(InternetSpeed {
        download_mbps,
        upload_mbps,
        ping_ms: ping,
    })
}

fn parse_speed_value(token: &str) -> Option<f64> {
    token.trim().replace(',', ".").parse::<f64>().ok()
}

async fn measure_speed_with_speedtest_cli() -> Result<InternetSpeed> {
    let output: std::process::Output = Command::new("speedtest-cli")
        .arg("--simple")
        .output()
        .await?;

    if !output.status.success() {
        return Err(anyhow::anyhow!("speedtest-cli failed"));
    }

    let stdout: std::borrow::Cow<'_, str> = String::from_utf8_lossy(&output.stdout);
    let mut ping_ms: f64 = 0.0;
    let mut download_mbps: f64 = 0.0;
    let mut upload_mbps: f64 = 0.0;

    for line in stdout.lines() {
        if line.starts_with("Ping:") {
            if let Some(val) = line.split_whitespace().nth(1) {
                ping_ms = parse_speed_value(val).unwrap_or(0.0);
            }
        } else if line.starts_with("Download:") {
            if let Some(val) = line.split_whitespace().nth(1) {
                download_mbps = parse_speed_value(val).unwrap_or(0.0);
            }
        } else if line.starts_with("Upload:") {
            if let Some(val) = line.split_whitespace().nth(1) {
                upload_mbps = parse_speed_value(val).unwrap_or(0.0);
            }
        }
    }

    Ok(InternetSpeed {
        download_mbps,
        upload_mbps,
        ping_ms,
    })
}

async fn measure_ping() -> Result<f64> {
    let output: std::process::Output = if cfg!(target_os = "windows") {
        Command::new("ping")
            .arg("-n")
            .arg("4")
            .arg("8.8.8.8")
            .output()
            .await?
    } else {
        Command::new("ping")
            .arg("-c")
            .arg("4")
            .arg("8.8.8.8")
            .output()
            .await?
    };

    if !output.status.success() {
        return Ok(0.0);
    }

    let stdout = String::from_utf8_lossy(&output.stdout);

    if cfg!(target_os = "windows") {
        for line in stdout.lines() {
            if line.contains("Average") {
                if let Some(avg_part) = line.split('=').next_back() {
                    let avg_str = avg_part.trim().trim_end_matches("ms");
                    if let Ok(avg) = avg_str.parse::<f64>() {
                        return Ok(avg);
                    }
                }
            }
        }
    } else {
        for line in stdout.lines() {
            if line.contains("avg") || line.contains("rtt") {
                if let Some(avg_str) = line.split('/').nth(4) {
                    if let Ok(avg) = avg_str.trim().parse::<f64>() {
                        return Ok(avg);
                    }
                }
            }
        }
    }

    Ok(0.0)
}

async fn measure_download_speed() -> Result<f64> {
    let client: reqwest::Client = reqwest::Client::builder()
        .timeout(DOWNLOAD_PROBE_REQUEST_TIMEOUT)
        .build()?;
    let mut last_error: Option<String> = None;

    for url in DOWNLOAD_PROBE_URLS {
        match measure_download_speed_probe(&client, url).await {
            Ok(mbps) => return Ok(mbps),
            Err(err) => last_error = Some(err.to_string()),
        }
    }

    Err(anyhow::anyhow!(
        "all download probes failed{}",
        last_error
            .map(|value| format!(" (last error: {})", value))
            .unwrap_or_default()
    ))
}

async fn measure_download_speed_probe(client: &reqwest::Client, url: &str) -> Result<f64> {
    let start = Instant::now();
    let mut response: reqwest::Response = client
        .get(url)
        .header("Cache-Control", "no-cache")
        .header("Pragma", "no-cache")
        .send()
        .await?;

    if !response.status().is_success() {
        return Err(anyhow::anyhow!(
            "download probe {} returned status {}",
            url,
            response.status()
        ));
    }

    let mut total_bytes: u64 = 0;

    loop {
        if total_bytes >= DOWNLOAD_PROBE_TARGET_BYTES
            || start.elapsed() >= DOWNLOAD_PROBE_MAX_DURATION
        {
            break;
        }

        let chunk = response.chunk().await?;
        let Some(bytes) = chunk else {
            break;
        };

        total_bytes = total_bytes.saturating_add(bytes.len() as u64);
    }

    if total_bytes < DOWNLOAD_PROBE_MIN_BYTES {
        return Err(anyhow::anyhow!(
            "insufficient sample from {}: {} bytes",
            url,
            total_bytes
        ));
    }

    let elapsed_seconds = start.elapsed().as_secs_f64().max(0.001);
    let megabits = (total_bytes as f64 * 8.0) / 1_000_000.0;
    Ok(megabits / elapsed_seconds)
}

pub async fn check_installed_programs() -> HashMap<String, bool> {
    let programs = vec![
        "jq",
        "curl",
        "nginx",
        "git",
        "docker",
        "kubectl",
        "microk8s",
        "node",
        "npm",
        "python",
        "python3",
        "pip",
        "pip3",
        "cargo",
        "rustc",
        "pm2",
        "speedtest-cli",
        "systemctl",
        "launchctl",
    ];

    let mut results = HashMap::new();

    for program in programs {
        let is_installed = check_program_installed(program).await;
        results.insert(program.to_string(), is_installed);
    }

    results
}

fn can_create_file_in_dir(dir: &std::path::Path) -> bool {
    use std::time::{SystemTime, UNIX_EPOCH};

    if !dir.is_dir() {
        return false;
    }

    let nonce = SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .map(|d| d.as_nanos())
        .unwrap_or_default();
    let probe = dir.join(format!(
        ".xbp_diag_perm_probe_{}_{}",
        std::process::id(),
        nonce
    ));

    match OpenOptions::new().write(true).create_new(true).open(&probe) {
        Ok(_) => {
            let _ = fs::remove_file(&probe);
            true
        }
        Err(_) => false,
    }
}

fn check_path_permission_entry(
    path: PathBuf,
    purpose: &str,
    require_read: bool,
    require_write: bool,
    require_create: bool,
    optional: bool,
) -> PathPermissionCheck {
    let exists = path.exists();
    let mut readable = false;
    let mut writable = false;
    let mut creatable = false;
    let mut message = None;

    if exists {
        if path.is_dir() {
            readable = fs::read_dir(&path).is_ok();
            writable = can_create_file_in_dir(&path);
            creatable = writable;
        } else if path.is_file() {
            readable = fs::File::open(&path).is_ok();
            writable = OpenOptions::new().write(true).open(&path).is_ok();
            if let Some(parent) = path.parent() {
                creatable = can_create_file_in_dir(parent);
            }
        } else {
            message = Some("Path exists but is not a regular file/directory".to_string());
        }
    } else if let Some(parent) = path.parent() {
        // Missing path: we can still estimate create capability via parent directory.
        creatable = can_create_file_in_dir(parent);
        readable = parent.exists() && fs::read_dir(parent).is_ok();
        writable = parent.exists() && can_create_file_in_dir(parent);
        if optional {
            message = Some("Path missing (optional)".to_string());
        } else if require_create && !creatable {
            message =
                Some("Path missing and cannot be created with current permissions".to_string());
        } else {
            message = Some("Path missing".to_string());
        }
    } else if optional {
        message = Some("Path missing (optional)".to_string());
    } else {
        message = Some("Path missing".to_string());
    }

    let mut missing = Vec::new();
    if require_read && !readable {
        missing.push("read");
    }
    if require_write && !writable {
        missing.push("write");
    }
    if require_create && !creatable {
        missing.push("create");
    }

    let mut ok = missing.is_empty();
    if optional && !exists {
        ok = true;
    }
    if !ok {
        let detail = format!("Missing required access: {}", missing.join(", "));
        message = match message {
            Some(existing) => Some(format!("{}; {}", existing, detail)),
            None => Some(detail),
        };
    }

    let required = match (require_read, require_write, require_create) {
        (true, true, true) => "read/write/create",
        (true, true, false) => "read/write",
        (true, false, true) => "read/create",
        (false, true, true) => "write/create",
        (true, false, false) => "read",
        (false, true, false) => "write",
        (false, false, true) => "create",
        (false, false, false) => "none",
    }
    .to_string();

    PathPermissionCheck {
        path: path.display().to_string(),
        purpose: purpose.to_string(),
        required,
        exists,
        readable,
        writable,
        creatable,
        ok,
        message,
    }
}

async fn get_path_permission_checks() -> Vec<PathPermissionCheck> {
    let mut checks = Vec::new();

    if cfg!(target_os = "linux") {
        checks.push(check_path_permission_entry(
            PathBuf::from("/etc/systemd/system"),
            "Install/update systemd unit files",
            true,
            true,
            true,
            false,
        ));
        checks.push(check_path_permission_entry(
            PathBuf::from("/etc/default/xbp"),
            "Optional runtime environment file for xbp-api.service",
            true,
            true,
            true,
            true,
        ));
        checks.push(check_path_permission_entry(
            PathBuf::from("/etc/nginx"),
            "Read/write Nginx configuration root",
            true,
            true,
            false,
            false,
        ));
        checks.push(check_path_permission_entry(
            PathBuf::from("/etc/nginx/sites-available"),
            "Manage Nginx site configurations",
            true,
            true,
            true,
            false,
        ));
        checks.push(check_path_permission_entry(
            PathBuf::from("/etc/nginx/sites-enabled"),
            "Enable/disable Nginx sites",
            true,
            true,
            true,
            false,
        ));
        checks.push(check_path_permission_entry(
            PathBuf::from("/var/log"),
            "Write XBP and service log files",
            true,
            true,
            true,
            false,
        ));
        checks.push(check_path_permission_entry(
            PathBuf::from("/var/lib/xbp"),
            "State directory used by generated systemd services",
            true,
            true,
            true,
            true,
        ));
        checks.push(check_path_permission_entry(
            PathBuf::from("/var/log/nginx"),
            "Read Nginx access/error logs for diagnostics and metrics",
            true,
            true,
            true,
            true,
        ));
        checks.push(check_path_permission_entry(
            PathBuf::from("/run"),
            "Runtime sockets/state files used by services",
            true,
            true,
            true,
            false,
        ));
        checks.push(check_path_permission_entry(
            PathBuf::from("/usr/local/bin/xbp"),
            "Installed XBP CLI binary path",
            true,
            true,
            true,
            true,
        ));
    } else if let Ok(current) = env::current_dir() {
        checks.push(check_path_permission_entry(
            current,
            "Current project directory",
            true,
            true,
            true,
            false,
        ));
    }

    if let Ok(current) = env::current_dir() {
        checks.push(check_path_permission_entry(
            current.join(".xbp"),
            "Local XBP project metadata directory",
            true,
            true,
            true,
            true,
        ));
    }

    // Established global XBP home (shared Windows/WSL mutations + config).
    if let Ok(paths) = ensure_global_xbp_paths() {
        checks.push(check_path_permission_entry(
            paths.root_dir.clone(),
            "Global XBP home (config + worktree-watch mutations)",
            true,
            true,
            true,
            true,
        ));
        checks.push(check_path_permission_entry(
            paths.root_dir.join("mutations"),
            "Worktree-watch mutation spool root under global XBP home",
            true,
            true,
            true,
            true,
        ));
    }

    checks
}

async fn run_command_with_timeout(
    program: &str,
    args: &[&str],
    timeout: Duration,
) -> Option<std::process::Output> {
    let mut cmd = Command::new(program);
    cmd.args(args);
    cmd.kill_on_drop(true);
    match tokio::time::timeout(timeout, cmd.output()).await {
        Ok(Ok(output)) => Some(output),
        _ => None,
    }
}

async fn check_program_installed(program: &str) -> bool {
    let output = if cfg!(target_os = "windows") {
        run_command_with_timeout("where", &[program], PROGRAM_CHECK_TIMEOUT).await
    } else {
        run_command_with_timeout("which", &[program], PROGRAM_CHECK_TIMEOUT).await
    };

    output.map(|value| value.status.success()).unwrap_or(false)
}

fn render_percent_bar(percent: f32, width: usize) -> String {
    let pct = percent.clamp(0.0, 100.0);
    let filled = ((pct / 100.0) * width as f32).round() as usize;
    let filled = filled.min(width);
    let empty = width.saturating_sub(filled);
    format!("{}{}", "█".repeat(filled), "░".repeat(empty))
}

async fn get_os_info() -> Option<OsInfo> {
    Some(OsInfo {
        name: System::name(),
        version: System::os_version(),
        kernel_version: System::kernel_version(),
        arch: Some(std::env::consts::ARCH.to_string()),
    })
}

async fn get_cpu_info() -> Option<CpuInfo> {
    let mut sys = System::new_all();
    sys.refresh_cpu_all();
    let cores = sys.cpus().len();
    let usage = if cores > 0 {
        sys.cpus().iter().map(|c| c.cpu_usage()).sum::<f32>() / cores as f32
    } else {
        0.0
    };
    let brand = sys.cpus().first().map(|c| c.brand().to_string());
    Some(CpuInfo {
        brand,
        cores,
        usage,
    })
}

async fn run_command_capture(program: &str, args: &[&str]) -> Option<String> {
    let output = run_command_with_timeout(program, args, COMMAND_CAPTURE_TIMEOUT).await?;
    let stdout: String = String::from_utf8_lossy(&output.stdout).trim().to_string();
    let stderr: String = String::from_utf8_lossy(&output.stderr).trim().to_string();
    let combined: String = if !stdout.is_empty() { stdout } else { stderr };
    if combined.is_empty() {
        None
    } else {
        Some(combined)
    }
}

async fn get_gpu_candidates() -> Vec<String> {
    let mut out: Vec<String> = Vec::new();

    if cfg!(target_os = "windows") {
        if let Some(s) = run_command_capture(
            "powershell",
            &[
                "-Command",
                "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name",
            ],
        )
        .await
        {
            for line in s.lines().map(|l| l.trim()).filter(|l| !l.is_empty()) {
                out.push(line.to_string());
            }
        }
        return out;
    }

    if let Some(s) = run_command_capture("nvidia-smi", &["-L"]).await {
        for line in s.lines().map(|l| l.trim()).filter(|l| !l.is_empty()) {
            out.push(line.to_string());
        }
    }

    if out.is_empty() {
        if let Some(s) =
            run_command_capture("sh", &["-c", "lspci | grep -Ei 'vga|3d|display'"]).await
        {
            for line in s.lines().map(|l| l.trim()).filter(|l| !l.is_empty()) {
                out.push(line.to_string());
            }
        }
    }

    if out.is_empty() {
        if let Some(s) =
            run_command_capture("sh", &["-c", "lshw -C display 2>/dev/null | head"]).await
        {
            for line in s.lines().map(|l| l.trim()).filter(|l| !l.is_empty()) {
                out.push(line.to_string());
            }
        }
    }

    out
}

async fn get_disk_infos() -> Vec<DiskInfo> {
    let disks = Disks::new_with_refreshed_list();
    let cwd = env::current_dir().ok();

    let mut candidates: Vec<(usize, usize)> = Vec::new();
    if let Some(cwd) = &cwd {
        for (i, d) in disks.iter().enumerate() {
            let mp = d.mount_point();
            if cwd.starts_with(mp) {
                candidates.push((mp.as_os_str().len(), i));
            }
        }
    }
    candidates.sort_by_key(|candidate| std::cmp::Reverse(candidate.0));
    let current_idx = candidates.first().map(|(_, idx)| *idx);

    disks
        .iter()
        .enumerate()
        .map(|(i, d)| {
            let total = d.total_space();
            let used = total.saturating_sub(d.available_space());
            let percent = if total > 0 {
                (used as f32 / total as f32) * 100.0
            } else {
                0.0
            };
            let mount = d.mount_point().to_string_lossy().to_string();
            let fs = if d.file_system().is_empty() {
                None
            } else {
                Some(d.file_system().to_string_lossy().to_string())
            };
            DiskInfo {
                mount,
                fs,
                total,
                used,
                percent,
                bar: render_percent_bar(percent, 20),
                is_current: current_idx == Some(i),
            }
        })
        .collect()
}

fn get_shell_info() -> Option<ShellInfo> {
    let shell = env::var("SHELL")
        .ok()
        .or_else(|| env::var("ComSpec").ok())
        .or_else(|| env::var("0").ok());
    let term = env::var("TERM").ok();
    if shell.is_none() && term.is_none() {
        None
    } else {
        Some(ShellInfo { shell, term })
    }
}

async fn systemctl_active(service: &str) -> Option<bool> {
    if !cfg!(target_os = "linux") || !command_exists("systemctl") {
        return None;
    }
    let output = Command::new("systemctl")
        .arg("is-active")
        .arg(service)
        .output()
        .await
        .ok()?;
    Some(output.status.success())
}

async fn get_service_statuses() -> HashMap<String, String> {
    let mut out = HashMap::new();
    let services = [
        "nginx",
        "traefik",
        "apache2",
        "httpd",
        "postgresql",
        "postgrest",
        "prometheus",
        "grafana-server",
        "kafka",
        "xbp",
    ];

    for s in services {
        let v = systemctl_active(s).await;
        let status = match v {
            Some(true) => "active",
            Some(false) => "inactive",
            None => "unknown",
        };
        out.insert(s.to_string(), status.to_string());
    }

    out
}

async fn get_proxy_detection() -> Option<ProxyDetection> {
    let nginx_sites_available = if cfg!(target_os = "linux") {
        let p = PathBuf::from("/etc/nginx/sites-available");
        if p.exists() {
            fs::read_dir(&p)
                .ok()
                .map(|rd| rd.filter_map(|e| e.ok()).count())
        } else {
            None
        }
    } else {
        None
    };

    let nginx_active = systemctl_active("nginx").await;
    let traefik_active = systemctl_active("traefik").await;
    let apache_active = match systemctl_active("apache2").await {
        Some(v) => Some(v),
        None => systemctl_active("httpd").await,
    };

    if nginx_sites_available.is_none()
        && nginx_active.is_none()
        && traefik_active.is_none()
        && apache_active.is_none()
    {
        None
    } else {
        Some(ProxyDetection {
            nginx_sites_available,
            nginx_active,
            traefik_active,
            apache_active,
        })
    }
}

async fn get_clipboard_tools() -> HashMap<String, bool> {
    let mut tools = vec!["xclip", "xsel", "wl-copy", "pbcopy"];
    if cfg!(target_os = "windows") {
        tools.push("clip");
    }
    let mut out = HashMap::new();
    for t in tools {
        out.insert(t.to_string(), check_program_installed(t).await);
    }
    out
}

fn get_listeners_on_all_interfaces() -> Vec<String> {
    let af_flags = AddressFamilyFlags::IPV4 | AddressFamilyFlags::IPV6;
    let proto_flags = ProtocolFlags::TCP;
    let sockets = get_sockets_info(af_flags, proto_flags).unwrap_or_default();

    let mut out = Vec::new();
    for socket in sockets {
        if let ProtocolSocketInfo::Tcp(tcp) = socket.protocol_socket_info {
            let state = format!("{:?}", tcp.state);
            if state != "Listen" && state != "LISTEN" {
                continue;
            }
            let addr = tcp.local_addr.to_string();
            if addr == "0.0.0.0" || addr == "::" {
                out.push(format!("{}:{}", addr, tcp.local_port));
            }
        }
    }
    out.sort();
    out.dedup();
    out
}

async fn get_firewall_hint() -> Option<String> {
    if !cfg!(target_os = "linux") {
        return None;
    }

    if let Some(s) = run_command_capture("sh", &["-c", "ufw status 2>/dev/null | head -n 1"]).await
    {
        if !s.trim().is_empty() {
            return Some(s.trim().to_string());
        }
    }

    if let Some(s) =
        run_command_capture("sh", &["-c", "nft list ruleset 2>/dev/null | head -n 1"]).await
    {
        if !s.trim().is_empty() {
            return Some("nftables detected".to_string());
        }
    }

    if let Some(s) = run_command_capture("sh", &["-c", "iptables -S 2>/dev/null | head -n 1"]).await
    {
        if !s.trim().is_empty() {
            return Some("iptables detected".to_string());
        }
    }

    None
}

async fn get_public_ipv4(connectivity: bool) -> Option<String> {
    if !connectivity {
        return None;
    }
    let client = reqwest::Client::builder()
        .timeout(Duration::from_secs(3))
        .build()
        .ok()?;
    let text = client
        .get("https://api.ipify.org")
        .send()
        .await
        .ok()?
        .text()
        .await
        .ok()?;
    let ip = text.trim().to_string();
    if ip.is_empty() {
        None
    } else {
        Some(ip)
    }
}

async fn get_exposure_info(connectivity: bool) -> Option<ExposureInfo> {
    let public_ipv4 = get_public_ipv4(connectivity).await;
    let listening_on_all_interfaces = get_listeners_on_all_interfaces();
    let firewall_hint = get_firewall_hint().await;
    let summary = Some(if listening_on_all_interfaces.is_empty() {
        "No listeners on 0.0.0.0/:: detected".to_string()
    } else {
        "Listeners on 0.0.0.0/:: detected (may be publicly reachable)".to_string()
    });
    Some(ExposureInfo {
        public_ipv4,
        listening_on_all_interfaces,
        firewall_hint,
        summary,
    })
}

async fn get_pm2_process_count() -> Option<usize> {
    let mut cmd = if cfg!(target_os = "windows") {
        let mut cmd = Command::new("powershell");
        cmd.arg("-NoProfile").arg("-Command").arg("pm2 jlist");
        cmd
    } else {
        let mut cmd = Command::new("pm2");
        cmd.arg("jlist");
        cmd
    };
    cmd.kill_on_drop(true);

    let output = match tokio::time::timeout(PM2_DIAG_TIMEOUT, cmd.output()).await {
        Ok(Ok(output)) => output,
        Ok(Err(_)) | Err(_) => return None,
    };

    if !output.status.success() {
        return None;
    }
    let stdout = String::from_utf8_lossy(&output.stdout);
    let value: serde_json::Value = serde_json::from_str(&stdout).ok()?;
    value.as_array().map(|arr| arr.len())
}

async fn get_version(cmd: &str, args: &[&str]) -> ToolVersion {
    match run_command_with_timeout(cmd, args, TOOL_VERSION_TIMEOUT).await {
        Some(o) => {
            let stdout = String::from_utf8_lossy(&o.stdout).trim().to_string();
            let stderr = String::from_utf8_lossy(&o.stderr).trim().to_string();
            let line = stdout
                .lines()
                .next()
                .filter(|l| !l.trim().is_empty())
                .map(|l| l.trim().to_string())
                .or_else(|| {
                    stderr
                        .lines()
                        .next()
                        .filter(|l| !l.trim().is_empty())
                        .map(|l| l.trim().to_string())
                });
            ToolVersion {
                present: o.status.success() || line.is_some(),
                version: line,
            }
        }
        None => ToolVersion {
            present: false,
            version: None,
        },
    }
}

async fn get_tool_versions() -> HashMap<String, ToolVersion> {
    let mut out = HashMap::new();

    out.insert(
        "python3".to_string(),
        get_version("python3", &["--version"]).await,
    );
    out.insert(
        "python".to_string(),
        get_version("python", &["--version"]).await,
    );
    out.insert(
        "node".to_string(),
        get_version("node", &["--version"]).await,
    );
    out.insert("npm".to_string(), get_version("npm", &["--version"]).await);
    out.insert(
        "pnpm".to_string(),
        get_version("pnpm", &["--version"]).await,
    );
    out.insert("pm2".to_string(), get_version("pm2", &["--version"]).await);
    out.insert(
        "docker".to_string(),
        get_version("docker", &["--version"]).await,
    );
    out.insert(
        "docker-compose".to_string(),
        get_version("docker-compose", &["--version"]).await,
    );
    out.insert(
        "kubectl".to_string(),
        get_version("kubectl", &["version", "--client"]).await,
    );
    out.insert(
        "microk8s".to_string(),
        get_version("microk8s", &["version"]).await,
    );
    out.insert(
        "rustc".to_string(),
        get_version("rustc", &["--version"]).await,
    );
    out.insert(
        "cargo".to_string(),
        get_version("cargo", &["--version"]).await,
    );
    out.insert(
        "rustup".to_string(),
        get_version("rustup", &["--version"]).await,
    );

    out
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum SectionState {
    Healthy,
    Warn,
    Fail,
    Info,
}

fn section_badge(state: SectionState) -> colored::ColoredString {
    match state {
        SectionState::Healthy => "OK".green().bold(),
        SectionState::Warn => "WARN".yellow().bold(),
        SectionState::Fail => "FAIL".red().bold(),
        SectionState::Info => "INFO".cyan().bold(),
    }
}

fn print_section_header(title: &str, state: SectionState, summary: &str) {
    println!(
        "\n{} {} {}",
        section_badge(state),
        title.bright_white().bold(),
        summary.bright_black()
    );
}

fn diag_bool(value: bool) -> colored::ColoredString {
    if value {
        "true".green()
    } else {
        "false".red()
    }
}

fn diag_bool_fragment(label: &str, value: bool) -> String {
    format!("{}={}", label, diag_bool(value))
}

fn diag_ratio(passing: usize, total: usize) -> String {
    format!(
        "{}{}",
        passing.to_string().green(),
        format!("/{}", total).bright_white()
    )
}

fn color_service_status(status: &str) -> colored::ColoredString {
    let lower = status.to_ascii_lowercase();
    if lower.contains("running") || lower.contains("active") || lower.contains("online") {
        status.green()
    } else if lower.contains("stopped") || lower.contains("failed") || lower.contains("error") {
        status.red()
    } else if lower.contains("degraded") || lower.contains("warn") {
        status.yellow()
    } else {
        status.bright_white()
    }
}

fn render_feature_flags(flags: &HashMap<String, bool>) -> String {
    let mut items = flags
        .iter()
        .map(|(name, value)| format!("{}={}", name, diag_bool(*value)))
        .collect::<Vec<_>>();
    items.sort();
    items.join("  ")
}

fn summarize_path_permissions(report: &DiagnosticReport) -> (usize, usize) {
    let total = report.path_permission_checks.len();
    let passing = report
        .path_permission_checks
        .iter()
        .filter(|item| item.ok)
        .count();
    (passing, total)
}

fn summarize_port_checks(report: &DiagnosticReport) -> (usize, usize, usize) {
    let total = report.port_checks.len();
    let open = report
        .port_checks
        .iter()
        .filter(|item| item.is_open)
        .count();
    let blocked = report
        .port_checks
        .iter()
        .filter(|item| item.is_blocked)
        .count();
    (open, blocked, total)
}

pub async fn print_diagnostic_report(report: &DiagnosticReport) {
    let feature_flags = render_feature_flags(&report.feature_flags);
    let env_summary = format!(
        "v{} | {} | connectivity {}",
        report.xbp_cli_version,
        feature_flags,
        if report.connectivity {
            "online"
        } else {
            "offline"
        }
    );
    print_section_header(
        "Environment",
        if report.connectivity {
            SectionState::Healthy
        } else {
            SectionState::Warn
        },
        &env_summary,
    );

    println!(
        "  {} {}",
        "XBP version:".bright_white(),
        report.xbp_cli_version.bright_cyan()
    );
    println!("  {} {}", "Feature flags:".bright_white(), feature_flags);

    if let Some(os) = &report.os {
        let os_line = [
            os.name.clone().unwrap_or_else(|| "Unknown OS".to_string()),
            os.version.clone().unwrap_or_default(),
        ]
        .into_iter()
        .filter(|s| !s.is_empty())
        .collect::<Vec<_>>()
        .join(" ");
        println!("  {} {}", "OS:".bright_white(), os_line);
        if let Some(kernel) = &os.kernel_version {
            println!("  {} {}", "Kernel:".bright_white(), kernel);
        }
        if let Some(arch) = &os.arch {
            println!("  {} {}", "Arch:".bright_white(), arch);
        }
    }

    if let Some(cpu) = &report.cpu {
        println!(
            "  {} {} ({} cores, {:.1}% avg)",
            "CPU:".bright_white(),
            cpu.brand.clone().unwrap_or_else(|| "Unknown".into()),
            cpu.cores,
            cpu.usage
        );
    }

    if let Some(shell) = &report.shell {
        if let Some(s) = &shell.shell {
            println!("  {} {}", "Shell:".bright_white(), s);
        }
        if let Some(t) = &shell.term {
            println!("  {} {}", "TERM:".bright_white(), t);
        }
    }

    println!(
        "  {} {}",
        "Connectivity:".bright_white(),
        if report.connectivity {
            "online".green()
        } else {
            "offline".red()
        }
    );

    if let Some(speed) = &report.internet_speed {
        println!("  {} {:.2} ms", "Ping:".bright_white(), speed.ping_ms);
        println!(
            "  {} {:.2} Mbps",
            "Download:".bright_white(),
            speed.download_mbps
        );
        if speed.upload_mbps > 0.0 {
            println!(
                "  {} {:.2} Mbps",
                "Upload:".bright_white(),
                speed.upload_mbps
            );
        }
    }

    if !report.gpu_candidates.is_empty() {
        print_section_header(
            "GPU candidates",
            SectionState::Info,
            &format!("{} candidate(s)", report.gpu_candidates.len()),
        );
        for line in &report.gpu_candidates {
            println!("  {}", line);
        }
    }

    if !report.disks.is_empty() {
        print_section_header(
            "Disks",
            SectionState::Info,
            &format!("{} mount(s)", report.disks.len()),
        );
        for disk in &report.disks {
            let current = if disk.is_current { " *" } else { "" };
            let fs = disk.fs.clone().unwrap_or_else(|| "-".to_string());
            println!(
                "  {}{}  {} {:>5.1}%  {} ({} / {} GB)",
                disk.mount,
                current,
                fs,
                disk.percent,
                disk.bar,
                disk.used / 1024 / 1024 / 1024,
                disk.total / 1024 / 1024 / 1024
            );
        }
        println!("  {} current mount", "*".bright_cyan());
    }

    print_section_header(
        "System metrics",
        SectionState::Info,
        &format!("{} processes", report.system_metrics.process_count),
    );
    let metrics = &report.system_metrics;

    let cpu_color = if metrics.cpu_usage > 80.0 {
        "red"
    } else if metrics.cpu_usage > 50.0 {
        "yellow"
    } else {
        "green"
    };
    println!(
        "  {} {:.1}%",
        "CPU usage:".bright_white(),
        format!("{}", metrics.cpu_usage).color(cpu_color)
    );

    let mem_color = if metrics.memory_percent > 80.0 {
        "red"
    } else if metrics.memory_percent > 50.0 {
        "yellow"
    } else {
        "green"
    };
    println!(
        "  {} {:.1}% ({} MB / {} MB)",
        "Memory:".bright_white(),
        format!("{}", metrics.memory_percent).color(mem_color),
        metrics.memory_used / 1024 / 1024,
        metrics.memory_total / 1024 / 1024
    );

    let disk_color = if metrics.disk_percent > 80.0 {
        "red"
    } else if metrics.disk_percent > 50.0 {
        "yellow"
    } else {
        "green"
    };
    println!(
        "  {} {:.1}% ({} GB / {} GB)",
        "Disk:".bright_white(),
        format!("{}", metrics.disk_percent).color(disk_color),
        metrics.disk_used / 1024 / 1024 / 1024,
        metrics.disk_total / 1024 / 1024 / 1024
    );

    println!(
        "  {} {} MB down / {} MB up",
        "Network:".bright_white(),
        metrics.network_rx / 1024 / 1024,
        metrics.network_tx / 1024 / 1024
    );

    let uptime_hours = metrics.uptime / 3600;
    let uptime_minutes = (metrics.uptime % 3600) / 60;
    println!(
        "  {} {}h {}m",
        "Uptime:".bright_white(),
        uptime_hours,
        uptime_minutes
    );
    println!(
        "  {} {}",
        "Processes:".bright_white(),
        metrics.process_count
    );

    let (open_ports, blocked_ports, _) = summarize_port_checks(report);
    let runtime_state = if blocked_ports == 0 {
        SectionState::Healthy
    } else {
        SectionState::Fail
    };
    print_section_header(
        "Runtime",
        runtime_state,
        &format!(
            "services={} | pm2={} | ports={} open / {} blocked",
            report.service_statuses.len(),
            report.pm2_process_count.unwrap_or(0),
            open_ports,
            blocked_ports
        ),
    );

    if let Some(proxy) = &report.proxy_detection {
        println!("  {}", "Proxy stack:".bright_white());
        if let Some(n) = proxy.nginx_sites_available {
            println!("    {} {}", "sites-available:".bright_white(), n);
        }
        if let Some(v) = proxy.nginx_active {
            println!("    {} {}", "nginx active:".bright_white(), diag_bool(v));
        }
        if let Some(v) = proxy.traefik_active {
            println!("    {} {}", "traefik active:".bright_white(), diag_bool(v));
        }
        if let Some(v) = proxy.apache_active {
            println!("    {} {}", "apache active:".bright_white(), diag_bool(v));
        }
    }

    if let Some(count) = report.pm2_process_count {
        println!("  {} {}", "PM2 process count:".bright_white(), count);
    }

    if !report.service_statuses.is_empty() {
        println!("  {}", "Services:".bright_white());
        let mut items: Vec<_> = report.service_statuses.iter().collect();
        items.sort_by_key(|(k, _)| *k);
        for (name, status) in items {
            println!("    {:15} {}", name, color_service_status(status));
        }
    }

    if let Some(nginx) = &report.nginx_status {
        println!("  {}", "Nginx:".bright_white());
        println!(
            "    {} {}",
            if nginx.is_running {
                "OK".green()
            } else {
                "NO".red()
            },
            if nginx.is_running {
                "Running".green()
            } else {
                "Stopped".red()
            }
        );
        println!(
            "    {} {}",
            if nginx.is_enabled {
                "OK".green()
            } else {
                "NO".red()
            },
            if nginx.is_enabled {
                "Enabled".green()
            } else {
                "Disabled".red()
            }
        );
        println!(
            "    {} {}",
            if nginx.config_valid {
                "OK".green()
            } else {
                "NO".red()
            },
            if nginx.config_valid {
                "Config valid".green()
            } else {
                "Config invalid".red()
            }
        );
    }

    if !report.port_checks.is_empty() {
        println!("  {}", "Port coverage:".bright_white());
        let (xbp_ports, other_ports): (Vec<_>, Vec<_>) = report
            .port_checks
            .iter()
            .partition(|port_check| !port_check.xbp_projects.is_empty());

        for port_check in xbp_ports.iter().chain(other_ports.iter()) {
            let status_icon = if port_check.is_open {
                "OK".green()
            } else {
                "NO".red()
            };
            let blocked_text = if port_check.is_blocked {
                " (BLOCKED)".red().to_string()
            } else {
                String::new()
            };
            let xbp_suffix = if port_check.xbp_projects.is_empty() {
                String::new()
            } else {
                format!(" [XBP: {}]", port_check.xbp_projects.join(", "))
            };
            let line = format!(
                "    {} Port {}: {}{}{}",
                status_icon,
                port_check.port,
                if port_check.is_open {
                    "Available".green().to_string()
                } else {
                    "In use".red().to_string()
                },
                blocked_text,
                xbp_suffix
            );

            if port_check.xbp_projects.is_empty() {
                println!("{}", line);
            } else {
                println!("{}", line.bright_magenta());
            }
        }
    }

    let (path_passing, path_total) = summarize_path_permissions(report);
    let project_state = if report.project_config_present || !report.provider_manifests.is_empty() {
        if path_passing == path_total {
            SectionState::Healthy
        } else {
            SectionState::Warn
        }
    } else {
        SectionState::Info
    };
    print_section_header(
        "Project",
        project_state,
        &format!(
            "config={} | services={} | manifests={} | paths={}",
            diag_bool(report.project_config_present),
            report.configured_services.len(),
            report.provider_manifests.len(),
            diag_ratio(path_passing, path_total)
        ),
    );

    if !report.configured_services.is_empty() {
        println!(
            "  {} {}",
            "Configured services:".bright_white(),
            report.configured_services.join(", ").bright_white()
        );
    }

    if !report.provider_manifests.is_empty() {
        println!(
            "  {} {}",
            "Provider manifests:".bright_white(),
            report.provider_manifests.join(", ").bright_white()
        );
    }

    if !report.path_permission_checks.is_empty() {
        println!(
            "  {} {}",
            "Checks passing:".bright_white(),
            diag_ratio(path_passing, path_total)
        );

        for item in &report.path_permission_checks {
            let icon = if item.ok { "OK".green() } else { "NO".red() };
            println!(
                "    {} {} [{}]",
                icon,
                item.path.bright_white(),
                item.required
            );
            println!("      purpose: {}", item.purpose);
            println!(
                "      status: {} {} {} {}",
                diag_bool_fragment("exists", item.exists),
                diag_bool_fragment("read", item.readable),
                diag_bool_fragment("write", item.writable),
                diag_bool_fragment("create", item.creatable)
            );
            if let Some(msg) = &item.message {
                println!("      note: {}", msg);
            }
        }
    }

    print_section_header(
        "XBP readiness",
        if report.project_config_present {
            SectionState::Healthy
        } else {
            SectionState::Warn
        },
        &format!(
            "version={} | feature flags={} | manifests={}",
            report.xbp_cli_version,
            report.feature_flags.len(),
            report.provider_manifests.len()
        ),
    );
    println!(
        "  {} {}",
        "CLI version:".bright_white(),
        report.xbp_cli_version.bright_cyan()
    );
    println!("  {} {}", "Feature flags:".bright_white(), feature_flags);
    println!(
        "  {} {}",
        "Project config:".bright_white(),
        if report.project_config_present {
            "detected".green()
        } else {
            "missing".red()
        }
    );
    println!(
        "  {} {}",
        "Provider manifests:".bright_white(),
        report.provider_manifests.len()
    );

    if let Some(watch) = &report.worktree_watch {
        let watch_state = if watch.branch_spool_exists || watch.watcher_running {
            SectionState::Healthy
        } else if watch.notes.iter().any(|note| note.contains("Failed")) {
            SectionState::Warn
        } else {
            SectionState::Info
        };
        let summary = match (
            watch.repo_owner.as_deref(),
            watch.repo_name.as_deref(),
            watch.branch.as_deref(),
        ) {
            (Some(owner), Some(name), Some(branch)) => format!(
                "runtime={} | {}/{} @ {} | events={} commits={}",
                watch.runtime_key, owner, name, branch, watch.event_jsonl_files, watch.commit_jsonl_files
            ),
            _ => format!(
                "runtime={} | global home only | wsl={}",
                watch.runtime_key,
                diag_bool(watch.is_wsl)
            ),
        };
        print_section_header("Worktree watch", watch_state, &summary);

        println!(
            "  {} {}",
            "Global XBP home:".bright_white(),
            watch.global_xbp_root.bright_cyan()
        );
        println!(
            "  {} {}",
            "Mutations root:".bright_white(),
            watch.mutations_root
        );
        println!(
            "  {} {} | {} {}",
            "Platform:".bright_white(),
            watch.platform,
            "runtime:".bright_white(),
            watch.runtime_key.bright_cyan()
        );
        println!(
            "  {} {}",
            "WSL:".bright_white(),
            diag_bool(watch.is_wsl)
        );

        if let (Some(owner), Some(name), Some(branch)) = (
            watch.repo_owner.as_deref(),
            watch.repo_name.as_deref(),
            watch.branch.as_deref(),
        ) {
            println!(
                "  {} {}/{} ({})",
                "Repository:".bright_white(),
                owner,
                name,
                branch
            );
        }

        if let Some(spool) = &watch.branch_spool {
            println!(
                "  {} {} {}",
                "Branch spool:".bright_white(),
                spool,
                if watch.branch_spool_exists {
                    "(exists)".green()
                } else {
                    "(missing)".yellow()
                }
            );
        }

        println!(
            "  {} events={} commits={}",
            "Spool files:".bright_white(),
            watch.event_jsonl_files,
            watch.commit_jsonl_files
        );

        if let Some(state_path) = &watch.watcher_state_path {
            println!(
                "  {} {} | present={} running={}",
                "Watcher state:".bright_white(),
                state_path,
                diag_bool(watch.watcher_state_present),
                diag_bool(watch.watcher_running)
            );
        }

        if !watch.alternate_spool_roots.is_empty() {
            println!("  {}", "Alternate spools (legacy / shared):".bright_white());
            for root in &watch.alternate_spool_roots {
                println!("    {}", root);
            }
        }

        if !watch.notes.is_empty() {
            println!("  {}", "Notes:".bright_white());
            for note in &watch.notes {
                println!("    - {}", note);
            }
        }
    }

    if let Some(codetime) = &report.codetime {
        print_section_header(
            "CodeTime inventory",
            if codetime.refreshed {
                SectionState::Healthy
            } else {
                SectionState::Info
            },
            &format!(
                "saved={} | refreshed={}",
                codetime.saved_config_path,
                diag_bool(codetime.refreshed)
            ),
        );
        println!(
            "  {} {}",
            "Saved in:".bright_white(),
            codetime.saved_config_path
        );
        println!(
            "  {} {}",
            "Refreshed:".bright_white(),
            if codetime.refreshed {
                "cached"
            } else {
                "fresh"
            }
        );
        if let Some(user) = &codetime.inventory.system_user {
            println!("  {} {}", "User:".bright_white(), user);
        }
        if let Some(host) = &codetime.inventory.host_name {
            println!("  {} {}", "Host:".bright_white(), host);
        }
        println!(
            "  {} {} / {}",
            "Platform:".bright_white(),
            codetime.inventory.platform,
            codetime.inventory.architecture
        );
        if let Some(os) = &codetime.inventory.operating_system {
            let os_label = os
                .long_version
                .clone()
                .or_else(|| match (&os.name, &os.version) {
                    (Some(name), Some(version)) => Some(format!("{} {}", name, version)),
                    (Some(name), None) => Some(name.clone()),
                    (None, Some(version)) => Some(version.clone()),
                    (None, None) => None,
                });
            if let Some(os_label) = os_label {
                println!("  {} {}", "Operating system:".bright_white(), os_label);
            }
            if let Some(kernel_version) = &os.kernel_version {
                println!("  {} {}", "Kernel:".bright_white(), kernel_version);
            }
        }
        if !codetime.inventory.drives.is_empty() {
            let drives = codetime
                .inventory
                .drives
                .iter()
                .map(|drive| match &drive.file_system {
                    Some(file_system) => format!("{} ({})", drive.mount, file_system),
                    None => drive.mount.clone(),
                })
                .collect::<Vec<_>>()
                .join(", ");
            println!("  {} {}", "Drives:".bright_white(), drives);
        }
        if let Some(home) = codetime.inventory.standard_paths.get("home") {
            println!("  {} {}", "Home:".bright_white(), home);
        }
        if let Some(xbp_root) = codetime.inventory.standard_paths.get("xbp_global_root") {
            println!("  {} {}", "XBP root:".bright_white(), xbp_root);
        }
        if let Some(cursor_root) = codetime.inventory.standard_paths.get("cursor_roaming") {
            println!("  {} {}", "Cursor root:".bright_white(), cursor_root);
        }

        let installed_tool_labels = codetime
            .inventory
            .installed_tools
            .iter()
            .filter(|tool| tool.present)
            .map(|tool| match &tool.version {
                Some(version) => format!("{} ({})", tool.name, version),
                None => tool.name.clone(),
            })
            .collect::<Vec<_>>();
        println!(
            "  {} {}",
            "Installed tools:".bright_white(),
            if installed_tool_labels.is_empty() {
                "0".to_string()
            } else {
                format!(
                    "{} ({})",
                    installed_tool_labels.len(),
                    format_sample_list(&installed_tool_labels, 8)
                )
            }
        );

        let identity_labels = codetime
            .inventory
            .git_identities
            .iter()
            .map(
                |identity| match (&identity.user_name, &identity.user_email) {
                    (Some(name), Some(email)) => format!("{} <{}>", name, email),
                    (Some(name), None) => name.clone(),
                    (None, Some(email)) => email.clone(),
                    (None, None) => identity.scope.clone(),
                },
            )
            .collect::<Vec<_>>();
        if !identity_labels.is_empty() {
            println!(
                "  {} {}",
                "Git identities:".bright_white(),
                format_sample_list(&identity_labels, 4)
            );
        }

        let repo_names = codetime
            .inventory
            .github_repos
            .iter()
            .map(|repo| repo.full_name.clone())
            .collect::<Vec<_>>();
        println!(
            "  {} {}",
            "Seen GitHub repos:".bright_white(),
            if repo_names.is_empty() {
                "0".to_string()
            } else {
                format!(
                    "{} ({})",
                    repo_names.len(),
                    format_sample_list(&repo_names, 5)
                )
            }
        );

        let project_names = codetime
            .inventory
            .xbp_projects
            .iter()
            .map(|project| project.name.clone())
            .collect::<Vec<_>>();
        println!(
            "  {} {}",
            "Seen XBP projects:".bright_white(),
            if project_names.is_empty() {
                "0".to_string()
            } else {
                format!(
                    "{} ({})",
                    project_names.len(),
                    format_sample_list(&project_names, 5)
                )
            }
        );

        if let Some(cursor) = &codetime.inventory.cursor {
            println!(
                "  {} {}",
                "Cursor present:".bright_white(),
                diag_bool(cursor.exists)
            );
            println!(
                "  {} workspaceStorage={} extensions={} logs={}",
                "Cursor details:".bright_white(),
                cursor.workspace_storage_entries,
                cursor.extensions_entries,
                diag_bool(cursor.logs_exists)
            );
            if let Some(note) = &cursor.note {
                println!("  {} {}", "Cursor note:".bright_white(), note);
            }
        }
    }

    if !report.clipboard_tools.is_empty() {
        println!("\n{}", "Clipboard tools".bright_yellow().bold());
        let mut items: Vec<_> = report.clipboard_tools.iter().collect();
        items.sort_by_key(|(k, _)| *k);
        for (name, value) in items {
            println!("  {:10} {}", name, diag_bool(*value));
        }
    }

    if !report.installed_programs.is_empty() {
        print_section_header(
            "Installed programs",
            SectionState::Info,
            &format!("{} program(s)", report.installed_programs.len()),
        );

        let mut programs: Vec<_> = report.installed_programs.iter().collect();
        programs.sort_by_key(|(name, _)| *name);
        for (program, installed) in programs {
            let status_icon = if *installed { "OK".green() } else { "NO".red() };
            let status_text = if *installed {
                "Installed".green()
            } else {
                "Missing".red()
            };
            println!("  {} {:15} {}", status_icon, program, status_text);
        }
    }

    if !report.tool_versions.is_empty() {
        print_section_header(
            "Tool versions",
            SectionState::Info,
            &format!("{} tool(s)", report.tool_versions.len()),
        );
        let mut items: Vec<_> = report.tool_versions.iter().collect();
        items.sort_by_key(|(k, _)| *k);
        for (name, v) in items {
            if v.present {
                println!(
                    "  {:12} {}",
                    name,
                    v.version
                        .clone()
                        .unwrap_or_else(|| "present".to_string())
                        .green()
                );
            } else {
                println!("  {:12} {}", name, "not found".red());
            }
        }
    }
}
fn format_sample_list(items: &[String], limit: usize) -> String {
    if items.is_empty() {
        return String::new();
    }

    let shown = items.iter().take(limit).cloned().collect::<Vec<_>>();
    let remaining = items.len().saturating_sub(shown.len());
    if remaining == 0 {
        shown.join(", ")
    } else {
        format!("{} +{} more", shown.join(", "), remaining)
    }
}

fn format_eta(duration: Duration) -> String {
    let total_seconds = duration.as_secs();
    let minutes = total_seconds / 60;
    let seconds = total_seconds % 60;
    if minutes > 0 {
        format!("{}m {:02}s", minutes, seconds)
    } else {
        format!("{}s", seconds)
    }
}

fn estimate_diag_timeout_budget(
    ports_count: usize,
    skip_speed_test: bool,
    include_codetime: bool,
) -> Duration {
    // This is a conservative upper bound shown to operators while diagnostics runs.
    let fixed_seconds =
        2 + 2 + 2 + 2 + 3 + 3 + 10 + 4 + PM2_DIAG_TIMEOUT.as_secs() + NGINX_CHECK_TIMEOUT.as_secs();
    let port_seconds =
        PORT_OWNERSHIP_TIMEOUT.as_secs() + (ports_count as u64 * PER_PORT_CHECK_TIMEOUT.as_secs());
    let speed_seconds = if skip_speed_test {
        0
    } else {
        INTERNET_SPEED_TIMEOUT.as_secs()
    };
    let codetime_seconds = if include_codetime {
        SYSTEM_INVENTORY_TIMEOUT.as_secs()
    } else {
        0
    };
    Duration::from_secs(fixed_seconds + port_seconds + speed_seconds + codetime_seconds)
}

fn set_step_message(
    pb: &ProgressBar,
    step_index: usize,
    step_total: usize,
    started_at: Instant,
    estimated_budget: Duration,
    label: &str,
    timeout: Option<Duration>,
) {
    let elapsed = started_at.elapsed();
    let remaining = estimated_budget.saturating_sub(elapsed);
    let timeout_suffix = timeout
        .map(|value| format!(" | timeout {}s", value.as_secs()))
        .unwrap_or_default();
    pb.set_message(format!(
        "[{}/{}] {} | ETA {}{}",
        step_index,
        step_total,
        label,
        format_eta(remaining),
        timeout_suffix
    ));
}

async fn collect_port_ownership_with_timeout() -> BTreeMap<u16, ListeningPortOwnership> {
    let task = tokio::task::spawn_blocking(collect_listening_port_ownership);
    match tokio::time::timeout(PORT_OWNERSHIP_TIMEOUT, task).await {
        Ok(Ok(Ok(ports))) => ports,
        Ok(Ok(Err(err))) => {
            let _ = log_warn("diag", "Port ownership scan failed", Some(err.as_str())).await;
            BTreeMap::new()
        }
        Ok(Err(err)) => {
            let message = format!("Port ownership scan task failed: {}", err);
            let _ = log_warn("diag", "Port ownership scan failed", Some(message.as_str())).await;
            BTreeMap::new()
        }
        Err(_) => {
            let timeout_note = format!(
                "Port ownership scan timed out after {} seconds",
                PORT_OWNERSHIP_TIMEOUT.as_secs()
            );
            let _ = log_warn(
                "diag",
                "Port ownership scan timed out",
                Some(timeout_note.as_str()),
            )
            .await;
            BTreeMap::new()
        }
    }
}

async fn sync_system_inventory_with_timeout(include_cursor: bool) -> Option<CodeTimeDiagnostic> {
    let current_dir = env::current_dir().ok();
    let task = tokio::task::spawn_blocking(move || {
        sync_system_inventory(true, include_cursor, current_dir.as_deref())
    });

    match tokio::time::timeout(SYSTEM_INVENTORY_TIMEOUT, task).await {
        Ok(Ok(Ok(result))) => Some(CodeTimeDiagnostic {
            saved_config_path: result.config_path.display().to_string(),
            refreshed: result.refreshed,
            inventory: result.inventory,
        }),
        Ok(Ok(Err(err))) => {
            let _ = log_warn("diag", "System inventory sync failed", Some(err.as_str())).await;
            None
        }
        Ok(Err(err)) => {
            let message = format!("System inventory task failed: {}", err);
            let _ = log_warn(
                "diag",
                "System inventory sync failed",
                Some(message.as_str()),
            )
            .await;
            None
        }
        Err(_) => {
            let message = format!(
                "System inventory sync timed out after {} seconds",
                SYSTEM_INVENTORY_TIMEOUT.as_secs()
            );
            let _ = log_warn(
                "diag",
                "System inventory sync timed out",
                Some(message.as_str()),
            )
            .await;
            None
        }
    }
}

pub async fn run_full_diagnostics(
    ports: Vec<u16>,
    options: DiagnosticRunOptions,
) -> Result<DiagnosticReport> {
    let _ = log_info("diag", "Running system diagnostics...", None).await;

    let estimated_budget =
        estimate_diag_timeout_budget(ports.len(), options.skip_speed_test, options.codetime);
    let timeout_summary = format!(
        "Estimated max runtime {} (PM2 {}s, ports {}s + {}s/port{}{})",
        format_eta(estimated_budget),
        PM2_DIAG_TIMEOUT.as_secs(),
        PORT_OWNERSHIP_TIMEOUT.as_secs(),
        PER_PORT_CHECK_TIMEOUT.as_secs(),
        if options.skip_speed_test {
            ", speed test skipped"
        } else {
            ", speed test up to 20s"
        },
        if options.codetime {
            ", codetime inventory up to 25s"
        } else {
            ""
        }
    );
    let _ = log_info(
        "diag",
        "Diagnostics timeout budget",
        Some(timeout_summary.as_str()),
    )
    .await;

    let pb: ProgressBar = ProgressBar::new_spinner();
    pb.enable_steady_tick(Duration::from_millis(80));
    pb.set_style(
        ProgressStyle::with_template("{spinner} {msg}")
            .unwrap_or_else(|_| ProgressStyle::default_spinner()),
    );
    let started_at = Instant::now();
    let step_total = if options.codetime { 14 } else { 13 };
    let mut step_index = 1usize;

    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Collecting system metrics",
        None,
    );
    step_index += 1;
    let system_metrics = get_system_metrics().await?;

    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Collecting OS/CPU/GPU",
        None,
    );
    step_index += 1;
    let os = get_os_info().await;
    let cpu = get_cpu_info().await;
    let gpu_candidates = get_gpu_candidates().await;

    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Collecting disks",
        None,
    );
    step_index += 1;
    let disks = get_disk_infos().await;

    let codetime = if options.codetime {
        set_step_message(
            &pb,
            step_index,
            step_total,
            started_at,
            estimated_budget,
            if options.cursor {
                "Refreshing CodeTime + Cursor inventory"
            } else {
                "Refreshing CodeTime inventory"
            },
            Some(SYSTEM_INVENTORY_TIMEOUT),
        );
        step_index += 1;
        sync_system_inventory_with_timeout(options.cursor).await
    } else {
        None
    };

    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Collecting shell + clipboard",
        None,
    );
    step_index += 1;
    let shell = get_shell_info();
    let clipboard_tools = get_clipboard_tools().await;

    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Detecting proxies",
        None,
    );
    step_index += 1;
    let proxy_detection = get_proxy_detection().await;

    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Checking network/public IP",
        None,
    );
    step_index += 1;
    let connectivity = check_internet_connectivity().await.unwrap_or(false);
    let exposure = get_exposure_info(connectivity).await;

    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Checking tools",
        Some(TOOL_VERSION_TIMEOUT),
    );
    step_index += 1;
    let installed_programs = check_installed_programs().await;
    let tool_versions = get_tool_versions().await;

    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Checking file permissions",
        None,
    );
    step_index += 1;
    let path_permission_checks = get_path_permission_checks().await;

    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Checking services",
        None,
    );
    step_index += 1;
    let service_statuses = get_service_statuses().await;

    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Checking PM2 process table",
        Some(PM2_DIAG_TIMEOUT),
    );
    step_index += 1;
    let pm2_process_count = get_pm2_process_count().await;

    let ports_timeout_budget = PORT_OWNERSHIP_TIMEOUT
        + Duration::from_secs(ports.len() as u64 * PER_PORT_CHECK_TIMEOUT.as_secs());
    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Checking ports",
        Some(ports_timeout_budget),
    );
    step_index += 1;
    let port_ownership = collect_port_ownership_with_timeout().await;

    let mut port_checks = Vec::new();
    for port in ports {
        let timed_check = tokio::time::timeout(
            PER_PORT_CHECK_TIMEOUT,
            check_port_availability(port, port_ownership.get(&port)),
        )
        .await;
        match timed_check {
            Ok(Ok(check)) => port_checks.push(check),
            Ok(Err(err)) => {
                let details = format!("Port {} check failed: {}", port, err);
                let _ = log_warn("diag", "Port check failed", Some(details.as_str())).await;
            }
            Err(_) => {
                let details = format!(
                    "Port {} check timed out after {} seconds",
                    port,
                    PER_PORT_CHECK_TIMEOUT.as_secs()
                );
                let _ = log_warn("diag", "Port check timed out", Some(details.as_str())).await;
            }
        }
    }

    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Measuring internet speed",
        Some(INTERNET_SPEED_TIMEOUT),
    );
    step_index += 1;
    let internet_speed = if options.skip_speed_test {
        let _ = log_info(
            "diag",
            "Skipping internet speed test (--no-speed-test)",
            None,
        )
        .await;
        None
    } else if connectivity {
        match tokio::time::timeout(INTERNET_SPEED_TIMEOUT, measure_internet_speed()).await {
            Ok(Ok(speed)) => Some(speed),
            Ok(Err(err)) => {
                let details = format!("Internet speed probe failed: {}", err);
                let _ = log_warn(
                    "diag",
                    "Internet speed probe failed",
                    Some(details.as_str()),
                )
                .await;
                None
            }
            Err(_) => {
                let details = format!(
                    "Internet speed probe timed out after {} seconds",
                    INTERNET_SPEED_TIMEOUT.as_secs()
                );
                let _ = log_warn(
                    "diag",
                    "Internet speed probe timed out",
                    Some(details.as_str()),
                )
                .await;
                None
            }
        }
    } else {
        None
    };

    set_step_message(
        &pb,
        step_index,
        step_total,
        started_at,
        estimated_budget,
        "Checking nginx",
        Some(NGINX_CHECK_TIMEOUT),
    );
    let nginx_status = match tokio::time::timeout(NGINX_CHECK_TIMEOUT, check_nginx_status()).await {
        Ok(Ok(status)) => Some(status),
        Ok(Err(err)) => {
            let details = format!("Nginx status check failed: {}", err);
            let _ = log_warn("diag", "Nginx status check failed", Some(details.as_str())).await;
            None
        }
        Err(_) => {
            let details = format!(
                "Nginx status check timed out after {} seconds",
                NGINX_CHECK_TIMEOUT.as_secs()
            );
            let _ = log_warn(
                "diag",
                "Nginx status check timed out",
                Some(details.as_str()),
            )
            .await;
            None
        }
    };

    let current_dir = env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
    let config = load_xbp_config().await.ok();
    let project_config_present = config.is_some();
    let configured_services = config
        .as_ref()
        .map(|cfg| {
            get_all_services(cfg)
                .into_iter()
                .map(|service| format!("{}:{}", service.name, service.port))
                .collect::<Vec<_>>()
        })
        .unwrap_or_default();
    let provider_manifests: Vec<String> = ProjectDetector::detect_provider_manifests(&current_dir);

    let mut feature_flags: HashMap<String, bool> = HashMap::new();
    feature_flags.insert("monitoring".to_string(), cfg!(feature = "monitoring"));
    feature_flags.insert(
        "kafka".to_string(),
        cfg!(all(feature = "kafka", not(windows))),
    );
    feature_flags.insert("kubernetes".to_string(), cfg!(feature = "kubernetes"));
    feature_flags.insert("docker".to_string(), cfg!(feature = "docker"));

    let xbp_cli_version = env!("CARGO_PKG_VERSION").to_string();
    let worktree_watch = Some(collect_worktree_watch_diagnostic());

    pb.finish_and_clear();

    Ok(DiagnosticReport {
        system_metrics,
        os,
        cpu,
        gpu_candidates,
        disks,
        shell,
        proxy_detection,
        clipboard_tools,
        exposure,
        pm2_process_count,
        tool_versions,
        service_statuses,
        feature_flags,
        xbp_cli_version,
        project_config_present,
        configured_services,
        provider_manifests,
        nginx_status,
        port_checks,
        internet_speed,
        connectivity,
        installed_programs,
        path_permission_checks,
        codetime,
        worktree_watch,
    })
}