fix(diagnostics): classify zsh 'command not found: docker' as CLI-not-found (Codex P2 r3)

zsh's login-shell wording is reversed — 'zsh:1: command not found: docker'
(name AFTER the colon), not bash/sh's 'docker: command not found'. The CLI-not-
found case only matched the bash shape, so the common macOS #696 scenario fell
through to the generic 'command not found' branch and recorded
MCPX_DOCKER_EXEC_NOT_FOUND, conflating host-CLI-missing (#696) with in-container
exec ENOENT. Match 'command not found: docker' in both the isolation-spawn
helper and the unhinted classifyDocker fallback.

Added a classifier table case for the zsh wording (verified red→green: routed to
EXEC_NOT_FOUND without the fix, CLI_NOT_FOUND with it).

Related #696

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Author: Dumbris

internal/diagnostics/classifier.go

@@ -125,6 +125,7 @@ func classifyDocker(err error, _ ClassifierHints) Code {
 	case strings.Contains(msg, "docker not found in path"),
 		strings.Contains(msg, "docker not found in login shell"),
 		strings.Contains(msg, "docker: command not found"),
+		strings.Contains(msg, "command not found: docker"), // zsh: "zsh:1: command not found: docker"
 		strings.Contains(msg, "docker: not found"),
 		strings.Contains(msg, `"docker": executable file not found`):
 		return DockerCLINotFound
@@ -192,9 +193,13 @@ func classifyDockerIsolatedSpawn(err error) Code {
 	msg := strings.ToLower(err.Error())
 	switch {
 	// (1) docker binary unresolved: shellwrap resolution failure, or the shell
-	// / Go exec layer reporting `docker` itself missing.
+	// / Go exec layer reporting `docker` itself missing. Cover both shell
+	// wordings: bash/sh `docker: command not found` AND zsh's reversed
+	// `zsh:1: command not found: docker` (the common macOS login-shell shape) —
+	// the latter must beat the generic "command not found" → EXEC case below.
 	case strings.Contains(msg, `"docker": executable file not found`),
 		strings.Contains(msg, "docker: command not found"),
+		strings.Contains(msg, "command not found: docker"),
 		strings.Contains(msg, "docker: not found"),
 		strings.Contains(msg, "docker not found in path"),
 		strings.Contains(msg, "docker not found in login shell"):

internal/diagnostics/classifier_domains_test.go

@@ -97,6 +97,15 @@ func TestClassify_Docker_IsolationSpawn(t *testing.T) {
 			hint: ClassifierHints{Transport: "stdio", DockerIsolated: true},
 			want: DockerCLINotFound,
 		},
+		{
+			// #696 via zsh login shell: the common macOS shape is the REVERSED
+			// wording `zsh:1: command not found: docker` (name after the colon),
+			// which must still classify as CLI-not-found, not in-container EXEC.
+			name: "cli_not_found_zsh_reversed",
+			err:  errors.New("stdio transport (docker_isolation=true): recent stderr: zsh:1: command not found: docker"),
+			hint: ClassifierHints{Transport: "stdio", DockerIsolated: true},
+			want: DockerCLINotFound,
+		},
 		{
 			// shellwrap resolution failure surfaces this even without the hint.
 			name: "cli_not_found_resolve",