feat(storage): resolve portable workspace roots

harness/tht/cli/__init__.py

@@ -41,6 +41,7 @@ from tht.cli.cte_cmd import cte_app  # noqa: E402
 from tht.cli.datamart_cmd import datamart_app  # noqa: E402
 from tht.cli.db_cmd import db_app  # noqa: E402
 from tht.cli.decision_cmd import decision_app  # noqa: E402
+from tht.cli.doctor_cmd import doctor  # noqa: E402
 from tht.cli.evidence_cmd import evidence_app  # noqa: E402
 from tht.cli.formula_cmd import formula_app  # noqa: E402
 from tht.cli.lsh_cmd import lsh_app  # noqa: E402
@@ -69,3 +70,4 @@ app.add_typer(cte_app, name="cte")
 app.add_typer(datamart_app, name="datamart")
 app.add_typer(lsh_app, name="lsh")
 app.add_typer(ollama_app, name="ollama")
+app.command("doctor")(doctor)

harness/tht/cli/doctor_cmd.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+from typing import Any
+
+import typer
+
+from tht.cli.config_cmd import CONFIG_OPT
+from tht.config import ConfigError, load_config
+
+
+def _emit(payload: dict[str, Any], as_json: bool) -> None:
+    if as_json:
+        # A single serializer call keeps stdout valid for machine consumers.
+        typer.echo(json.dumps(payload, sort_keys=True))
+        return
+    for component, result in payload["components"].items():
+        typer.echo(f"{component}: {result['status']}")
+
+
+def doctor(
+    config: Path = CONFIG_OPT,
+    as_json: bool = typer.Option(False, "--json", help="Emette diagnostica JSON."),
+) -> None:
+    """Validate portable storage configuration without contacting external services."""
+    data_root = os.environ.get("THT_DATA_ROOT")
+    components: dict[str, dict[str, Any]] = {
+        "config": {"status": "ok"},
+        "data_root": {"status": "ok" if data_root else "warning"},
+    }
+    try:
+        cfg = load_config(config)
+    except ConfigError as exc:
+        path_error = "outside workspace root" in str(exc)
+        target = "workspace_paths" if path_error else "config"
+        # Validation errors can contain Pydantic input excerpts, including credentials.
+        message = str(exc) if path_error else "configuration is invalid"
+        components[target] = {"status": "error", "message": message}
+        payload = {"ok": False, "components": components}
+        _emit(payload, as_json)
+        raise typer.Exit(code=1)
+
+    legacy_absolute = [
+        name
+        for name in ("sessions", "artifacts", "indexes")
+        if getattr(cfg.roots, name).is_absolute()
+    ]
+    components["workspace_paths"] = {
+        "status": "warning" if legacy_absolute else "ok",
+        "legacy_absolute": legacy_absolute,
+    }
+    _emit({"ok": True, "components": components}, as_json)