doctor
Run a pass/fail table of local environment checks. kyku doctor never writes state, never touches .kyku.lock, and never mutates cloud resources.
kyku doctor [options]Checks
Section titled “Checks”| Check | Pass when | Fail when |
|---|---|---|
| Bun | Runtime is present and >= 1.0.0 |
Missing or too old |
| config | infrastructure.ts loads, or no config file (providers skipped) |
Config exists but cannot be loaded |
<provider> credentials |
Required env var is set and one cheap authenticated read succeeds | Named variable missing, file missing, or credentials rejected |
| state | No state file, or .kyku/state.<env>.json parses |
JSON / schema error |
| lock | No lock, or lock is fresh with a live PID on this host | Stale lock (age or dead PID). Prints pid, host, and age |
Missing tokens are named (HCLOUD_TOKEN is not set) instead of showing up later as a 403.
Provider probes (one GET / STS / token fetch each):
| Provider | Presence | Validity |
|---|---|---|
| Hetzner | HCLOUD_TOKEN |
GET /v1/locations |
| DigitalOcean | DIGITALOCEAN_TOKEN |
GET /v2/account |
| AWS | AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY, or INFRAM_AWS_ROLE_ARN |
STS GetCallerIdentity |
| GCP | GOOGLE_APPLICATION_CREDENTIALS (file must exist), or workload-identity env vars |
Obtain an access token |
| Kubernetes | KUBECONFIG (or ~/.kube/config) |
File exists and looks like a kubeconfig |
Doctor does not check quotas, auto-fix anything, or send telemetry.
Options
Section titled “Options”| Flag | Default | Description |
|---|---|---|
-c, --config <path> |
./infrastructure.ts |
Config used to decide which providers to probe |
-e, --env <environment> |
default |
Environment workspace (state + lock) |
--state-dir <dir> |
.kyku |
State directory |
Exit Codes
Section titled “Exit Codes”| Code | Meaning |
|---|---|
| 0 | Every check passed (typically well under 5 seconds) |
| 1 | At least one check failed |
Examples
Section titled “Examples”kyku doctorkyku doctor --config=./staging.ts --env=staging