@agentbridge1/cli 0.0.6 → 0.0.8

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "builtAt": "2026-06-06T12:05:27.957Z",
-  "gitHead": "ec17ba8",
-  "sourceLatestMtime": "2026-06-06T11:59:41.649Z",
-  "sourceLatestFile": "src/commands/watch.ts"
+  "builtAt": "2026-06-20T05:37:34.216Z",
+  "gitHead": "fb83b92",
+  "sourceLatestMtime": "2026-06-20T04:44:28.305Z",
+  "sourceLatestFile": "src/commands/setup-mcp.ts"
 }

package/dist/commands/connect.js

@@ -4,6 +4,8 @@ exports.runConnect = runConnect;
 const config_1 = require("../config");
 const errors_1 = require("../errors");
 const http_1 = require("../http");
+const install_rules_1 = require("./install-rules");
+const mcp_config_1 = require("../mcp-config");
 function resolveBaseUrl(override) {
     return (override ??
         process.env.AGENTBRIDGE_BASE_URL ??
@@ -132,64 +134,12 @@ async function resolveExecutionSurfaceFromHello(projectId, apiKey, apiBaseUrl) {
         };
     }
 }
-async function bootstrapDefaultConnection(projectId, apiKey, apiBaseUrl) {
-    const url = `${apiBaseUrl}/v1/dev/projects/${projectId}/connections/bootstrap-default`;
-    try {
-        const res = await fetch(url, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${apiKey}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify({}),
-        });
-        if (!res.ok)
-            return { ok: false, status: res.status, reason: `http_${res.status}` };
-        const body = (await res.json());
-        const nextApiKey = body.api_key?.trim();
-        const executionSurfaceId = body.execution_surface_id?.trim();
-        if (!nextApiKey || !executionSurfaceId) {
-            return { ok: false, status: 200, reason: "invalid_payload" };
-        }
-        return { ok: true, apiKey: nextApiKey, executionSurfaceId };
-    }
-    catch {
-        return { ok: false, status: 0, reason: "network_error" };
-    }
-}
-async function rotateActiveConnectionKey(projectId, apiKey, apiBaseUrl) {
-    const listUrl = `${apiBaseUrl}/v1/dev/projects/${projectId}/connections`;
-    try {
-        const listRes = await fetch(listUrl, {
-            headers: { Authorization: `Bearer ${apiKey}` },
-        });
-        if (!listRes.ok)
-            return { ok: false, reason: `list_http_${listRes.status}` };
-        const listBody = (await listRes.json());
-        const activeConnection = (listBody.connections ?? []).find((connection) => connection?.id && connection?.status === "active");
-        if (!activeConnection?.id)
-            return { ok: false, reason: "no_active_connection" };
-        const rotateUrl = `${apiBaseUrl}/v1/dev/projects/${projectId}/connections/${activeConnection.id}/rotate-key`;
-        const rotateRes = await fetch(rotateUrl, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${apiKey}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify({}),
-        });
-        if (!rotateRes.ok)
-            return { ok: false, reason: `rotate_http_${rotateRes.status}` };
-        const rotateBody = (await rotateRes.json());
-        const rotatedApiKey = rotateBody.api_key?.trim();
-        const executionSurfaceId = rotateBody.connection?.execution_surface?.id?.trim();
-        if (!rotatedApiKey || !executionSurfaceId)
-            return { ok: false, reason: "invalid_payload" };
-        return { ok: true, apiKey: rotatedApiKey, executionSurfaceId };
-    }
-    catch {
-        return { ok: false, reason: "network_error" };
-    }
+/**
+ * Merge the AgentBridge MCP server entry into .cursor/mcp.json (project-level).
+ * Preserves any other MCP servers already configured.
+ */
+function writeMcpConfig(projectId, apiKey, apiBaseUrl) {
+    return (0, mcp_config_1.writeServerMcpConfig)(projectId, apiKey, apiBaseUrl);
 }
 async function runConnect(options = {}) {
     process.stdout.write("AgentBridge connect\n");
@@ -249,86 +199,67 @@ async function runConnect(options = {}) {
         throw err;
     }
     process.stdout.write("OK\n");
-    let effectiveApiKey = apiKey;
     const diagnostics = {
         helloIdentityModel: "unknown",
         helloStatus: "not_attempted",
-        bootstrapStatus: "not_attempted",
-        rotateStatus: "not_attempted",
     };
-    const helloResolution = await resolveExecutionSurfaceFromHello(projectId, effectiveApiKey, apiBaseUrl);
+    const helloResolution = await resolveExecutionSurfaceFromHello(projectId, apiKey, apiBaseUrl);
     diagnostics.helloIdentityModel = helloResolution.identityModel;
     diagnostics.helloStatus = helloResolution.status;
-    let executionSurfaceId = helloResolution.executionSurfaceId;
-    let connectionUpgraded = false;
-    if (!executionSurfaceId) {
-        diagnostics.bootstrapStatus = "attempted";
-        const bootstrapAttempt = await bootstrapDefaultConnection(projectId, effectiveApiKey, apiBaseUrl);
-        if (bootstrapAttempt.ok) {
-            effectiveApiKey = bootstrapAttempt.apiKey;
-            executionSurfaceId = bootstrapAttempt.executionSurfaceId;
-            diagnostics.bootstrapStatus = "ok";
-            diagnostics.rotateStatus = "skipped";
-            connectionUpgraded = true;
-        }
-        else if (bootstrapAttempt.status === 409) {
-            diagnostics.bootstrapStatus = "http_409_existing_connection";
-            const rotated = await rotateActiveConnectionKey(projectId, effectiveApiKey, apiBaseUrl);
-            if (rotated.ok) {
-                diagnostics.rotateStatus = "ok";
-                effectiveApiKey = rotated.apiKey;
-                executionSurfaceId = rotated.executionSurfaceId;
-                connectionUpgraded = true;
-            }
-            else {
-                diagnostics.rotateStatus = rotated.reason;
-            }
-        }
-        else {
-            diagnostics.bootstrapStatus = bootstrapAttempt.reason;
-            diagnostics.rotateStatus = "skipped";
-        }
-    }
-    else {
-        diagnostics.bootstrapStatus = "skipped";
-        diagnostics.rotateStatus = "skipped";
-    }
+    const executionSurfaceId = helloResolution.executionSurfaceId;
     if (!executionSurfaceId) {
         (0, config_1.updateConfig)({
             projectId,
-            apiKey: effectiveApiKey,
+            apiKey,
             apiBaseUrl,
         });
-        throw new errors_1.SafeCliError([
-            "Connection incomplete.",
-            "Project access was verified, but AgentBridge could not create or resolve an execution surface.",
-            "Tracked work cannot start yet.",
-            "",
-            `hello identity model: ${diagnostics.helloIdentityModel}`,
-            `hello status: ${diagnostics.helloStatus}`,
-            `bootstrap-default status: ${diagnostics.bootstrapStatus}`,
-            `rotate-key status: ${diagnostics.rotateStatus}`,
-            `backend URL: ${apiBaseUrl}`,
-        ].join("\n"));
+        const helloWhy = helloResolution.identityModel === "legacy"
+            ? "This API key is a legacy project agent key, not a room connection key from room create or rotate."
+            : helloResolution.status === "unknown_identity_model"
+                ? "The server /hello response did not include identity_model work_identity for this key."
+                : helloResolution.status === "missing_execution_surface"
+                    ? "/hello returned work_identity but no execution_surface.id."
+                    : helloResolution.status.startsWith("http_")
+                        ? `/hello failed (${helloResolution.status}).`
+                        : "AgentBridge could not resolve an execution surface for this key.";
+        throw (0, errors_1.catalogCliError)("CONNECT_EXECUTION_SURFACE_MISSING", {
+            what: `Project access was verified, but connect could not bind an execution surface (hello: ${diagnostics.helloIdentityModel}, status: ${diagnostics.helloStatus}).`,
+            why: helloWhy,
+        });
     }
     // Persist credentials
     (0, config_1.updateConfig)({
         projectId,
-        apiKey: effectiveApiKey,
+        apiKey,
         apiBaseUrl,
         ...(executionSurfaceId ? { executionSurfaceId } : {}),
     });
     process.stdout.write("Credentials saved to .agentbridge/config.json\n");
-    if (connectionUpgraded) {
-        process.stdout.write("Auto-configured an AgentConnection key and execution surface for this project.\n");
+    process.stdout.write(`Execution surface: ${executionSurfaceId}\n`);
+    // Auto-write .cursor/mcp.json (merge — preserves other MCP servers)
+    try {
+        const mcpPath = writeMcpConfig(projectId, apiKey, apiBaseUrl);
+        process.stdout.write(`MCP config written: ${mcpPath}\n`);
     }
-    else {
-        process.stdout.write(`Execution surface: ${executionSurfaceId}\n`);
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stdout.write(`⚠  Could not write MCP config automatically: ${msg}\n`);
+        process.stdout.write("   Run `agentbridge setup-mcp` to generate it manually.\n");
+    }
+    // Auto-install project rules (soft — failure is non-blocking)
+    try {
+        await (0, install_rules_1.runInstallRules)({ projectId, apiKey, apiBaseUrl });
+        process.stdout.write("AgentBridge rules installed.\n");
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stdout.write(`⚠  Could not install project rules: ${msg}\n`);
+        process.stdout.write("   Run `agentbridge install-rules` manually after connecting.\n");
     }
     // Pick or auto-select an agent identity
     let activeAgentId = options.agentId ?? cfg.activeAgentId;
     if (!activeAgentId) {
-        const agents = await listAgents(projectId, effectiveApiKey, apiBaseUrl);
+        const agents = await listAgents(projectId, apiKey, apiBaseUrl);
         if (agents.length === 1 && agents[0]) {
             activeAgentId = agents[0].id;
             (0, config_1.updateConfig)({ activeAgentId });
@@ -357,15 +288,23 @@ async function runConnect(options = {}) {
         process.stdout.write([
             "",
             "Next:",
-            "  agentbridge doctor",
-            "  agentbridge watch",
+            "  1. Restart your editor to activate the MCP server.",
+            "  2. agentbridge doctor   (verify CLI + MCP + rules are aligned)",
+            "  3. agentbridge start \"task summary\"",
+            "  4. agentbridge watch",
             "",
         ].join("\n"));
     }
     else {
         process.stdout.write("✓ Connected.\n");
-        process.stdout.write("Run `agentbridge use <agent-id>` and then:\n");
-        process.stdout.write("  agentbridge doctor\n");
-        process.stdout.write("  agentbridge watch\n");
+        process.stdout.write([
+            "",
+            "Next:",
+            "  1. Run `agentbridge use <agent-id>` to select an agent identity.",
+            "  2. Restart your editor to activate the MCP server.",
+            "  3. agentbridge doctor",
+            "  4. agentbridge start \"task summary\"",
+            "",
+        ].join("\n"));
     }
 }

package/dist/commands/doctor.js

@@ -11,9 +11,15 @@ const dist_freshness_1 = require("./dist-freshness");
 const session_state_1 = require("../session-state");
 const server_sync_1 = require("../server-sync");
 const recovery_reconcile_1 = require("../recovery-reconcile");
+const rules_sync_1 = require("../rules-sync");
 function cliRootFromCommandDir() {
     return (0, node_path_1.resolve)(__dirname, "..", "..");
 }
+function isRecoveryBaselinePendingHello(hello) {
+    return (hello.setup_required === true ||
+        hello.agentbridge_status === "recovery_baseline_pending" ||
+        hello.instruction?.recovery_status === "baseline_required");
+}
 function normalizeReasonCandidate(value) {
     if (!value)
         return undefined;
@@ -87,26 +93,78 @@ function extractHttpReason(error) {
     }
     return `http_${error.status}`;
 }
-function detectGovernanceSignals(workspaceRoot) {
-    const rulesMdcPath = (0, node_path_1.resolve)(workspaceRoot, ".cursor", "rules", "agentbridge.mdc");
-    const rulesMarkdownPath = (0, node_path_1.resolve)(workspaceRoot, "AGENTBRIDGE.md");
+function detectGovernanceSignals(workspaceRoot, expectedProjectId) {
+    const analysis = (0, rules_sync_1.analyzeRulesArtifacts)(workspaceRoot, expectedProjectId);
     const mcpConfigPath = (0, node_path_1.resolve)(workspaceRoot, ".cursor", "mcp.json");
-    const rulesInstalled = (0, node_fs_1.existsSync)(rulesMdcPath) && (0, node_fs_1.existsSync)(rulesMarkdownPath);
     let mcpConfigured = false;
+    let mcpProjectId = null;
     if ((0, node_fs_1.existsSync)(mcpConfigPath)) {
         try {
             const parsed = JSON.parse((0, node_fs_1.readFileSync)(mcpConfigPath, "utf8"));
-            mcpConfigured = Boolean(parsed?.mcpServers &&
-                (parsed.mcpServers["agentbridge"] || parsed.mcpServers["agentbridge-mcp"]));
+            const entry = parsed?.mcpServers?.["agentbridge"] ?? parsed?.mcpServers?.["agentbridge-mcp"];
+            mcpConfigured = Boolean(entry);
+            if (entry?.env?.AGENTBRIDGE_PROJECT_ID) {
+                mcpProjectId = entry.env.AGENTBRIDGE_PROJECT_ID;
+            }
         }
         catch {
             mcpConfigured = false;
         }
     }
+    const mcpCredentialMismatch = mcpConfigured && mcpProjectId !== null && expectedProjectId !== undefined
+        ? mcpProjectId !== expectedProjectId
+        : false;
     return {
-        rulesInstalled,
+        rulesFilesPresent: analysis.filesPresent,
+        rulesFormat: analysis.format,
+        rulesProjectIdInRepo: analysis.projectIdInRepo,
+        rulesProjectIdMatches: analysis.projectIdMatchesConfig,
+        rulesInstalled: analysis.protocolRulesValid,
+        rulesIssues: analysis.issues,
         mcpConfigured,
-        governanceStatus: rulesInstalled && mcpConfigured ? "active" : "inactive",
+        mcpCredentialMismatch,
+        mcpProjectId,
+        governanceStatus: analysis.protocolRulesValid && mcpConfigured ? "active" : "inactive",
+    };
+}
+function isRouteMissingBody(body) {
+    return body.toLowerCase().includes("route not found");
+}
+function mapProjectAccessFailure(error) {
+    if (error instanceof http_1.CliHttpError) {
+        const reason = extractHttpReason(error);
+        if (reason === "not_project_member") {
+            return {
+                status: "failed",
+                reason,
+                suggestedNextAction: "use an API key/agent that is a member of this project, or add this agent to the project.",
+            };
+        }
+        if (reason === "unauthorized") {
+            return {
+                status: "failed",
+                reason,
+                suggestedNextAction: "verify AGENTBRIDGE_API_KEY is valid for this environment and has project read access.",
+            };
+        }
+        if (reason === "project_not_found") {
+            return {
+                status: "failed",
+                reason,
+                suggestedNextAction: "verify AGENTBRIDGE_PROJECT_ID points to an existing project in this API environment.",
+            };
+        }
+        return {
+            status: "failed",
+            reason,
+            suggestedNextAction: "confirm project ID, API key, and base URL are correct and that this key has project read access.",
+        };
+    }
+    const messageReason = error instanceof Error ? normalizeReasonCandidate(error.message) : undefined;
+    return {
+        status: "failed",
+        reason: messageReason ?? "network_error",
+        suggestedNextAction: "check network reachability to the API base URL and retry doctor.",
     };
 }
 async function checkProjectAccess(ctx) {
@@ -119,46 +177,33 @@ async function checkProjectAccess(ctx) {
     const projectId = ctx.projectId;
     const apiKey = ctx.apiKey;
     const apiBaseUrl = ctx.apiBaseUrl;
+    const syncCtx = { projectId, apiKey, apiBaseUrl, apiKeySource: "config" };
+    const summaryPath = `/v1/dev/projects/${encodeURIComponent(projectId)}/summary`;
+    const packetPath = `/v1/dev/projects/${encodeURIComponent(projectId)}/packet`;
     try {
-        const packet = await (0, http_1.getJson)({ projectId, apiKey, apiBaseUrl, apiKeySource: "config" }, `/v1/dev/projects/${encodeURIComponent(projectId)}/packet`);
-        return { status: "ok", packet };
+        await (0, http_1.getJson)(syncCtx, summaryPath);
+        let packet;
+        try {
+            packet = await (0, http_1.getJson)(syncCtx, packetPath);
+        }
+        catch {
+            // Summary proves access; packet is optional (recovery metadata only).
+        }
+        return { status: "ok", packet, projectId };
     }
     catch (error) {
-        if (error instanceof http_1.CliHttpError) {
-            const reason = extractHttpReason(error);
-            if (reason === "not_project_member") {
-                return {
-                    status: "failed",
-                    reason,
-                    suggestedNextAction: "use an API key/agent that is a member of this project, or add this agent to the project.",
-                };
+        if (error instanceof http_1.CliHttpError &&
+            error.status === 404 &&
+            isRouteMissingBody(error.body ?? "")) {
+            try {
+                const packet = await (0, http_1.getJson)(syncCtx, packetPath);
+                return { status: "ok", packet };
             }
-            if (reason === "unauthorized") {
-                return {
-                    status: "failed",
-                    reason,
-                    suggestedNextAction: "verify AGENTBRIDGE_API_KEY is valid for this environment and has project read access.",
-                };
+            catch (packetError) {
+                return mapProjectAccessFailure(packetError);
             }
-            if (reason === "project_not_found") {
-                return {
-                    status: "failed",
-                    reason,
-                    suggestedNextAction: "verify AGENTBRIDGE_PROJECT_ID points to an existing project in this API environment.",
-                };
-            }
-            return {
-                status: "failed",
-                reason,
-                suggestedNextAction: "confirm project ID, API key, and base URL are correct and that this key has project read access.",
-            };
         }
-        const messageReason = error instanceof Error ? normalizeReasonCandidate(error.message) : undefined;
-        return {
-            status: "failed",
-            reason: messageReason ?? "network_error",
-            suggestedNextAction: "check network reachability to the API base URL and retry doctor.",
-        };
+        return mapProjectAccessFailure(error);
     }
 }
 async function checkIdentityAccess(ctx) {
@@ -173,7 +218,8 @@ async function checkIdentityAccess(ctx) {
     }
     const helloUrl = `${ctx.apiBaseUrl}/v1/dev/projects/${ctx.projectId}/hello`;
     let identityModel = "unknown";
-    let executionSurfaceId = null;
+    let helloExecutionSurfaceId = null;
+    let baselinePending = false;
     try {
         const helloRes = await fetch(helloUrl, {
             method: "POST",
@@ -185,18 +231,22 @@ async function checkIdentityAccess(ctx) {
         });
         if (helloRes.ok) {
             const hello = (await helloRes.json());
+            baselinePending = isRecoveryBaselinePendingHello(hello);
             if (hello.identity_model === "work_identity") {
                 identityModel = "work_identity";
             }
             else if (hello.identity_model === "legacy") {
                 identityModel = "legacy";
             }
-            executionSurfaceId = hello.execution_surface?.id?.trim() || null;
+            helloExecutionSurfaceId = hello.execution_surface?.id?.trim() || null;
         }
     }
     catch {
         // Keep default unknown/null and continue with identity resolution checks.
     }
+    const configSurfaceId = ctx.configExecutionSurfaceId?.trim() || null;
+    const executionSurfaceId = helloExecutionSurfaceId || configSurfaceId;
+    const executionSurfaceSource = helloExecutionSurfaceId ? "hello" : configSurfaceId ? "config" : undefined;
     try {
         const syncCtx = {
             projectId: ctx.projectId,
@@ -209,18 +259,28 @@ async function checkIdentityAccess(ctx) {
             (0, server_sync_1.listWorkIdentities)(syncCtx),
         ]);
         const callerId = callerPacket?.work_identity?.id ?? null;
-        const startCapable = Boolean(executionSurfaceId);
-        if (callerId) {
-            return { status: "ok", identityModel, executionSurfaceId, startCapable };
+        const callerResolvable = Boolean(callerId) || identities.length === 1;
+        if (identityModel === "unknown" &&
+            callerResolvable &&
+            (baselinePending || Boolean(configSurfaceId))) {
+            identityModel = "work_identity";
         }
-        if (identities.length === 1) {
-            return { status: "ok", identityModel, executionSurfaceId, startCapable };
+        const startCapable = Boolean(executionSurfaceId);
+        if (callerResolvable) {
+            return {
+                status: "ok",
+                identityModel,
+                executionSurfaceId,
+                executionSurfaceSource,
+                startCapable,
+            };
         }
         return {
             status: "failed",
             reason: "caller_identity_unresolved",
             identityModel,
             executionSurfaceId,
+            executionSurfaceSource,
             startCapable,
         };
     }
@@ -230,6 +290,7 @@ async function checkIdentityAccess(ctx) {
             reason: "caller_identity_unresolved",
             identityModel,
             executionSurfaceId,
+            executionSurfaceSource,
             startCapable: Boolean(executionSurfaceId),
         };
     }
@@ -256,7 +317,7 @@ async function runDoctor(cliRootOverride) {
     const projectConfigPresent = projectIdPresent && apiKeyPresent && baseUrlPresent;
     const activeSession = (0, session_state_1.readSessionState)();
     const hasActiveWork = Boolean(activeSession?.id || activeSession?.serverSessionId);
-    const governance = detectGovernanceSignals(workspaceRoot);
+    const governance = detectGovernanceSignals(workspaceRoot, resolvedProjectId ?? undefined);
     const envContributed = Boolean(process.env.AGENTBRIDGE_PROJECT_ID) ||
         Boolean(process.env.AGENTBRIDGE_API_KEY) ||
         Boolean(process.env.AGENTBRIDGE_BASE_URL) ||
@@ -290,15 +351,64 @@ async function runDoctor(cliRootOverride) {
     if (projectAccess.reason) {
         lines.push(`Project access reason: ${projectAccess.reason}`);
     }
+    lines.push(`API key accepted by server: ${projectAccess.status === "ok"
+        ? "yes"
+        : projectAccess.status === "skipped"
+            ? "skipped"
+            : "no"}`);
     const identityAccess = await checkIdentityAccess({
         projectId: resolvedProjectId,
         apiKey: resolvedApiKey,
         apiBaseUrl: resolvedBaseUrl,
-        configComplete: projectConfigPresent && projectAccess.status === "ok",
+        configComplete: projectConfigPresent,
+        configExecutionSurfaceId: cfg.executionSurfaceId,
     });
+    lines.push(`Rules files present: ${governance.rulesFilesPresent ? "yes" : "no"}`);
+    lines.push(`Rules format: ${governance.rulesFormat}`);
+    if (governance.rulesProjectIdInRepo) {
+        lines.push(`Rules project ID: ${governance.rulesProjectIdInRepo}`);
+    }
+    if (governance.rulesProjectIdMatches !== null) {
+        lines.push(`Rules project ID match: ${governance.rulesProjectIdMatches ? "yes" : "no"}`);
+    }
     lines.push(`Rules installed: ${governance.rulesInstalled ? "yes" : "no"}`);
     lines.push(`MCP configured: ${governance.mcpConfigured ? "yes" : "no"}`);
+    if (governance.mcpConfigured && governance.mcpProjectId) {
+        lines.push(`MCP project id: ${governance.mcpProjectId}`);
+    }
     lines.push(`Agent governance: ${governance.governanceStatus}`);
+    const cliConnected = projectAccess.status === "ok";
+    const supervisionStatus = !cliConnected
+        ? "blind"
+        : governance.mcpCredentialMismatch
+            ? "broken"
+            : !governance.mcpConfigured && !governance.rulesInstalled
+                ? "blind"
+                : !governance.mcpConfigured || !governance.rulesInstalled
+                    ? "degraded"
+                    : "ready";
+    lines.push(`Supervision status: ${supervisionStatus}`);
+    if (supervisionStatus === "broken") {
+        lines.push(`  Supervision note: BROKEN — CLI project id (${projectAccess.projectId ?? "?"}) does not match MCP project id (${governance.mcpProjectId ?? "?"}).`);
+        lines.push("  Fix: run `agentbridge connect` again to re-write the MCP config with the correct credentials.");
+    }
+    else if (supervisionStatus === "blind") {
+        lines.push("  Supervision note: watch can observe filesystem changes only — MCP and rules both missing.");
+    }
+    else if (supervisionStatus === "degraded") {
+        if (!governance.mcpConfigured) {
+            lines.push("  Supervision note: MCP not configured — agent tool usage and implementation packets are invisible to watch.");
+        }
+        else {
+            lines.push("  Supervision note: rules not installed — agent is not operating under AgentBridge protocol.");
+        }
+    }
+    if (governance.rulesIssues.length > 0) {
+        for (const issue of governance.rulesIssues) {
+            lines.push(`Rules issue: ${issue}`);
+        }
+        lines.push("Rules fix: run `agentbridge install-rules`");
+    }
     lines.push(`Start capable: ${identityAccess.startCapable ? "yes" : "no"}`);
     if (projectAccess.status === "failed" && projectAccess.reason) {
         const view = (0, error_catalog_1.catalogViewForDoctorReason)(projectAccess.reason, projectAccess.suggestedNextAction);
@@ -354,7 +464,7 @@ async function runDoctor(cliRootOverride) {
     lines.push("Product status:");
     if (productStatus === "ready") {
         lines.push("- Connection: ready");
-        lines.push("- Governance: " + governance.governanceStatus);
+        lines.push(`- Supervision: ${supervisionStatus}`);
         lines.push("- Recovery: ready");
         lines.push(`- Rules: ${governance.rulesInstalled ? "installed" : "missing"}`);
         lines.push(`- MCP: ${governance.mcpConfigured ? "configured" : "missing"}`);
@@ -362,17 +472,17 @@ async function runDoctor(cliRootOverride) {
     }
     else if (productStatus === "ready_basic_recovery") {
         lines.push("- Connection: ready");
-        lines.push("- Governance: " + governance.governanceStatus);
+        lines.push(`- Supervision: ${supervisionStatus}`);
         lines.push("- Recovery: basic");
         lines.push(`- Rules: ${governance.rulesInstalled ? "installed" : "missing"}`);
         lines.push(`- MCP: ${governance.mcpConfigured ? "configured" : "missing"}`);
         lines.push("- Note: Project context exists, but domains are not fully mapped yet.");
-        lines.push("- Next: run `agent recover --force` for a full domain rebuild, or `agentbridge watch` for live supervision");
+        lines.push("- Next: run `agentbridge recover --force` for a full domain rebuild, or `agentbridge watch` for live supervision");
     }
     else if (productStatus === "active_work_found") {
         const recoveryBasic = (0, recovery_reconcile_1.recoveryIsBasicPacket)(projectAccess.packet);
         lines.push("- Connection: ready");
-        lines.push("- Governance: " + governance.governanceStatus);
+        lines.push(`- Supervision: ${supervisionStatus}`);
         lines.push("- Recovery: " + (recoveryBasic ? "basic" : "ready"));
         lines.push(`- Rules: ${governance.rulesInstalled ? "installed" : "missing"}`);
         lines.push(`- MCP: ${governance.mcpConfigured ? "configured" : "missing"}`);
@@ -384,7 +494,7 @@ async function runDoctor(cliRootOverride) {
     }
     else if (productStatus === "needs_recover") {
         lines.push("- Connection: ready");
-        lines.push("- Governance: " + governance.governanceStatus);
+        lines.push(`- Supervision: ${supervisionStatus}`);
         lines.push("- Recovery: required");
         lines.push(`- Rules: ${governance.rulesInstalled ? "installed" : "missing"}`);
         lines.push(`- MCP: ${governance.mcpConfigured ? "configured" : "missing"}`);
@@ -392,13 +502,23 @@ async function runDoctor(cliRootOverride) {
     }
     else {
         lines.push("- Connection: incomplete");
-        lines.push("- Governance: " + governance.governanceStatus);
+        lines.push(`- Supervision: ${supervisionStatus}`);
         lines.push("- Recovery: pending");
         lines.push(`- Rules: ${governance.rulesInstalled ? "installed" : "missing"}`);
         lines.push(`- MCP: ${governance.mcpConfigured ? "configured" : "missing"}`);
         if (!projectConfigPresent) {
             lines.push("- Note: Connection details are missing. Add credentials, then rerun agentbridge doctor.");
         }
+        else if (projectAccess.status === "failed" &&
+            (projectAccess.reason === "unauthorized" ||
+                projectAccess.reason === "forbidden" ||
+                projectAccess.reason === "not_project_member")) {
+            lines.push("- Reason: API key rejected by server.");
+            lines.push("- Next: run `agentbridge room exit`, get a fresh key from the dashboard, then `agentbridge connect`.");
+            if (identityAccess.executionSurfaceId) {
+                lines.push("- Note: Config still has a saved execution surface, but the server rejected the stored API key.");
+            }
+        }
         else if (!identityAccess.startCapable) {
             lines.push("- Reason: execution surface missing.");
             lines.push("- Next: agentbridge connect");
@@ -406,7 +526,11 @@ async function runDoctor(cliRootOverride) {
         else {
             lines.push("- Note: Connection check failed. Verify credentials/network, then rerun agentbridge doctor.");
         }
-        if (identityAccess.startCapable) {
+        if (identityAccess.startCapable &&
+            projectAccess.status === "failed" &&
+            projectAccess.reason !== "unauthorized" &&
+            projectAccess.reason !== "forbidden" &&
+            projectAccess.reason !== "not_project_member") {
             lines.push("- Next: agentbridge doctor");
         }
     }
@@ -418,6 +542,9 @@ async function runDoctor(cliRootOverride) {
     }
     lines.push(`- Caller identity model: ${identityAccess.identityModel}`);
     lines.push(`- Execution surface present: ${identityAccess.executionSurfaceId ? "yes" : "no"}`);
+    if (identityAccess.executionSurfaceSource) {
+        lines.push(`- Execution surface source: ${identityAccess.executionSurfaceSource}`);
+    }
     lines.push(`- Start capable (strict/session modes): ${identityAccess.startCapable ? "yes" : "no"}`);
     if (identityAccess.status !== "ok") {
         lines.push("- Note: internal identity mismatch affects strict/resume flows, not room-level inferred watch startup.");