fix(cli): follow up on local diagnostic review findings

[Wibias]

Summary

Follow-up to #1448 for CodeRabbit findings that landed immediately before the merge.

• make fetchServiceMemory's fixed timeout contract explicit instead of advertising an ignored timeoutMs dependency option
• correct the management API SOT so local-read capabilities are attributed to ocx doctor and OAuth health, not ocx status
• add a compile-time regression guard for the doctor timeout dependency contract

Root cause

fetchServiceMemory accepted the broad LocalManagementReadDeps type even though it intentionally overwrote timeoutMs with its own 2-second doctor timeout. Separately, the SOT grouped ocx status with the capability-based health collectors even though status only uses direct /healthz probing.

Validation

• focused type-contract regression added before the implementation change
• final PR diff checked: 3 files only, with no unrelated SOT changes
• React Doctor: passed
• Cross-platform CI: queued for the current head

Follow-up to #1448.

Summary by CodeRabbit

• Bug Fixes

  • Improved local management health-read request handling.
  • Prevented service memory checks from accepting unsupported timeout settings.
  • Improved health capability checks for diagnostics and OAuth health reporting.

• Documentation

  • Clarified direct health-probe connections, scoped capabilities, failure reporting, and runtime requirements.

• Tests

  • Added coverage for service memory request behavior and doctor health checks.

• Chores

  • Updated continuous integration validation for doctor service-memory checks.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7fa05f85-31ca-4041-9ac4-fa026b76ac3a

📥 Commits

Reviewing files that changed from the base of the PR and between 7b0fc59 and cd57463.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

The change adds request-specific dependency typing for local management reads, verifies the fetchServiceMemory dependency contract, wires a dedicated TypeScript contract project into CI, and updates health-capability documentation.

Changes

Local management read dependencies

Layer / File(s)	Summary
Dependency contract and validation src/server/local-management-read-client.ts, tests/doctor-service-memory-contract.test.ts	LocalManagementReadRequestDeps extends LocalManagementReadDeps. fetchBoundLocalManagementRead accepts the extended type. A Bun contract test verifies that timeoutMs is absent from fetchServiceMemory dependency keys.
Contract test CI wiring tests/tsconfig.doctor-service-memory-contract.json, .github/workflows/ci.yml	A dedicated TypeScript project includes the source tree and contract test. The CI gates job checks this project.
Health capability documentation structure/05_gui-and-management-api.md	The documentation identifies OAuth health and ocx doctor as capability consumers and describes their read-only probes, HMAC capabilities, direct-listener behavior, and attestation requirements.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• lidge-jun/opencodex#1448: Introduces the local management read dependency seam extended by this change.
• lidge-jun/opencodex#936: Covers related local-management attestation and health-check behavior.
• lidge-jun/opencodex#707: Introduces related management authentication and model-probe infrastructure.

Suggested labels: chore

Suggested reviewers: ingwannu, lidge-jun

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the pull request as a CLI follow-up that addresses local diagnostic review findings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/follow-up-1448-coderabbit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/doctor-service-memory-contract.test.ts`:
- Around line 4-11: Include tests/doctor-service-memory-contract.test.ts in CI’s
TypeScript checking by adding a test-specific TypeScript configuration that
extends the existing config and includes this test, then update the CI tsc
--noEmit step to use it. Ensure the TimeoutOptionIsHidden compile-time guard is
evaluated while preserving the existing runtime test.

🪄 Autofix

❌ Autofix failed (check again to retry)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d23a3fec-ac5d-4a8e-92fa-6d5efa0e9aac

📥 Commits

Reviewing files that changed from the base of the PR and between bd5bc56 and 07133ab.

📒 Files selected for processing (2)

• src/server/local-management-read-client.ts
• tests/doctor-service-memory-contract.test.ts

[coderabbitai]

The agent generated fixes only for .github/workflows/ files, which cannot be committed due to permission restrictions. Please apply these changes manually.

---

⚠️ 1 file(s) could not be committed — the agent does not have permission to push to .github/workflows/. Please apply these changes manually:

.github/workflows/ci.yml — 3 changes:

Lines 37–42

       - "package.json"
       - "bun.lock"
       - "tsconfig.json"
+      - "tsconfig.test.json"
       - "README.md"
       - "LICENSE"
       - ".github/workflows/ci.yml"

Lines 185–190

               - 'package.json'
               - 'bun.lock'
               - 'tsconfig.json'
+              - 'tsconfig.test.json'
               - 'README.md'
               - 'LICENSE'
               - '.github/workflows/ci.yml'

Lines 405–411

           bun install --frozen-lockfile
 
       - name: Typecheck
-        run: bun x tsc --noEmit
+        run: bun x tsc --noEmit --project tsconfig.test.json
 
       - name: GUI tests
         run: cd gui && bun test tests