@amsterdamdatalabs/enact-extensions 0.1.55 → 0.1.57

package/README.md

@@ -58,11 +58,11 @@ node scripts/enact-extensions.mjs sync extensions/plugin-dev
 node scripts/enact-extensions.mjs list
 ```
 
-`install` / `uninstall` / `doctor` only accept plugin names listed in
-[`bundled-extensions.json`](bundled-extensions.json) — today that is **`enact-repo`**
-only — and only in repo-local `--repo <path>` form. Any other name is refused with a
-clear error before anything is touched. `scripts/lib/allowed-plugins.mjs` is the CLI's
-allow-list gate; the repo-local install library stays name-agnostic.
+`install` / `uninstall` / `doctor` accept any bundle resolvable by bare name or
+explicit plugin path, and only in repo-local `--repo <path>` form.
+[`bundled-extensions.json`](bundled-extensions.json) names the default bundle set;
+it is not an install or doctor allow-list. An unknown or unresolvable bundle fails
+clearly before anything is touched.
 
 ### Repo-local install (`--repo`)
 
@@ -71,41 +71,50 @@ Install a bundle **into a git repository** as committed, relative files, followi
 ```bash
 enact-extensions install enact-repo --repo <path> [--host claude,codex,cursor,kimi,opencode] [--force]
 enact-extensions install enact-repo --repo <path> --dry-run    # preview; writes nothing
-enact-extensions uninstall enact-repo --repo <path> [--purge] [--force]
+enact-extensions uninstall enact-repo --repo <path> [--purge]
 enact-extensions uninstall enact-repo --repo <path> --dry-run [--purge]   # preview; writes nothing
 enact-extensions doctor enact-repo --repo <path> [--json]      # read-only health check
 ```
 
-`<path>` must be the git repository root (not a subdirectory, not `$HOME`). `--host` defaults to every repo host the bundle targets.
+`<path>` must be the git repository root (not a subdirectory, not `$HOME`) and must
+already contain a regular, non-symlink root `enact-config.toml`. Install is
+reconciliation, never enrollment: an unmarked repository is refused before any
+file is read or written. `--host` defaults to every repo host the bundle targets.
 
-`--dry-run` prints exactly what would be written, merged, removed, or restored — one line per file, naming the action and the reason (including a drift/conflict refusal, if the real run would refuse) — and exits with the same success/failure a real run would, without touching the filesystem.
+`--dry-run` prints exactly what would be deleted or rebuilt — one line per file,
+naming the action and reason — and exits with the same success/failure a real run
+would, without touching the filesystem. `install --force` is an explicit,
+announced request for the same authoritative repair performed by a normal install;
+it never enables a merge, preservation, or restore path.
 
 `doctor enact-repo --repo <path>` is read-only. It reports the installed and current
 bundle versions, lock integrity and drift, and each host's lock-owned native paths.
 It also reports Codex and Kimi trust notes, Cursor MCP approval, Kimi's global-hook
-status, required global binaries, the root `enact-config.toml` `[extensions]` marker,
-an optional `enact-hook doctor --repo` result, and the per-repo hook logs. It never
-writes; it exits non-zero only for a hard requirement such as a missing install,
-lock-integrity failure, missing required binary, or invalid/missing `[extensions]`
-marker.
-
-| Host | Files written in the repo |
+status, required global binaries, the root `enact-config.toml` marker and whether its
+`[extensions]` roster is present, an optional `enact-hook doctor --repo` result, and
+the per-repo hook logs. A pre-existing regular marker without `[extensions]` is valid
+for doctor; install adds this extension's roster declaration. Doctor never writes; it
+exits non-zero only for a hard requirement such as a missing install, lock-integrity
+failure, missing required binary, or missing/invalid root marker.
+
+| Host | Canonical files rebuilt in the repo |
 | --- | --- |
-| Claude Code | `.claude/agents/*.md`, `.claude/skills/<skill>/`, root `.mcp.json`, and hook entries merged into `.claude/settings.json`. Trust the folder before loading the project configuration. |
+| Claude Code | `.claude/agents/*.md`, `.claude/skills/<skill>/`, root `.mcp.json`, and `.claude/settings.json`. Trust the folder before loading the project configuration. |
 | Codex | `.codex/agents/*.toml`, `.agents/skills/<skill>/`, `.codex/config.toml` MCP tables, and `.codex/hooks.json`. Trust the exact project path and review hooks with `/hooks`. |
 | Cursor | `.cursor/agents/*.md`, `.cursor/skills/<skill>/`, `.cursor/mcp.json`, and `.cursor/hooks.json`. |
 | Kimi Code | `.kimi-code/agents/*.md`, `.kimi-code/skills/<skill>/`, and `.kimi-code/mcp.json`. Kimi hooks remain global-only and are installed by `enact-vps`, never by this repo-local command. |
-| OpenCode | A hook-free bundle writes `.opencode/agents/*.md`, `.opencode/skills/<skill>/`, and root `opencode.json` MCP entries. `enact-repo` declares hooks, so its repo-local OpenCode install is refused before any write; install its explicit global OpenCode plugin through `enact-vps`. |
+| OpenCode | `.opencode/agents/*.md`, `.opencode/skills/<skill>/`, and root `opencode.json`. The repo-local installer also removes the retired `.opencode/plugins` root. |
 
 Skills are installed at each host's native project discovery path: `.agents/skills/` for
 Codex and `.claude/skills/`, `.cursor/skills/`, `.kimi-code/skills/`, or
-`.opencode/skills/` for the other hosts. An existing same-named skill directory that
-the bundle does not manage is never overwritten, even with `--force`.
+`.opencode/skills/` for the other hosts. These paths are components of authoritative
+roots, so stale, foreign, or drifted entries are deleted and regenerated from the
+bundle on every reconciliation.
 
-`lean-ctx` config: regardless of `--host`, the bundle's baseline `lean-ctx/config.toml` and `lean-ctx/layout.toml` are installed as managed whole files at `.agents/lean-ctx/config/lean-ctx/` — every host's `.mcp.json`/hooks equivalent runs `enact-hook lean-ctx ...`, which resolves its config from this repo-local path. Managed like any other whole file: drift is detected, `--force` takes over and records a pre-existing user `config.toml`/`layout.toml` for byte-exact restore on uninstall.
+`lean-ctx` config: regardless of `--host`, the bundle's baseline `lean-ctx/config.toml` and `lean-ctx/layout.toml` are installed as canonical whole files at `.agents/lean-ctx/config/lean-ctx/` — every host's `.mcp.json`/hooks equivalent runs `enact-hook lean-ctx ...`, which resolves its config from this repo-local path. Drift is repaired by replacing the owned file; uninstall does not restore prior content.
 
-Always written: root `enact-config.toml`'s `[extensions]` marker and the bare
-`[extensions.<name>]` declaration for the installed bundle. The shared file's tables
+Install text-surgeries only the pre-existing root `enact-config.toml`'s `[extensions]`
+scope and the bare `[extensions.<name>]` declaration for the installed bundle. The shared file's tables
 have one owner: `version`/`[hooks]`/`[rules]`/`[repo]` are `enact-hook`,
 `[extensions]` is enact-extensions, and `[controls]` is enact-repo-controls. The
 installer edits only its own block, removes the legacy marker-only `[skills]` block,
@@ -113,12 +122,13 @@ and never writes `[hooks]`. It also manages the baseline `lean-ctx` config,
 `.agents/.gitignore` runtime entries, and `.agents/enact-repo.lock.json`. Commit all
 of it except what `.gitignore` excludes.
 
-The lock records every managed file (sha256), every entry merged into a user file, and the plugin version, all as relative paths:
+The lock records every canonical managed file (sha256), the owned roots, and the
+plugin version, all as relative paths. Its reconciliation contract is:
 
-- **Re-runs are idempotent.** An unchanged bundle produces no diff. Narrowing `--host` removes the dropped hosts' managed content.
-- **Merged user files are edited surgically.** `.claude/settings.json`, `.cursor/hooks.json`, `.cursor/mcp.json`, `.kimi-code/mcp.json`, `.codex/hooks.json`, and `.codex/config.toml` only gain or lose the bundle's own entries. Key order and indentation are preserved.
-- **Refusals (override with `--force`).** Install stops if a managed file or entry was edited since the last install, or if a same-named native agent, skill, or MCP entry exists that the bundle does not own. The error names each file.
-- **Uninstall removes exactly what the lock records.** It deletes a merged file only if install created it and it is now empty, then deletes the lock. `enact-config.toml` stays unless you pass `--purge`. `--purge` cuts only the `[extensions]` block install wrote, at text level; it refuses if that block was edited (with `--force`, it keeps the block). It deletes the file only if install created it and nothing but `version = 1` remains.
+- **Re-runs are idempotent.** An unchanged bundle produces byte-identical owned files.
+- **Roots are rebuilt, never merged.** `.agents`, `.claude`, `.codex`, `.cursor`, `.kimi-code`, and `.opencode` are Enact-owned roots. Reconciliation deletes their contents and writes only the canonical projection; it also deletes retired `.claude-plugin`, `.codex-plugin`, `.cursor-plugin`, `.kimi-plugin`, and `.opencode/plugins` roots.
+- **Runtime boundaries are explicit.** `.agents/hooks/` and `.agents/lean-ctx/{data,cache,state,bin}/` remain outside Enact ownership; their writers retain them through install and both uninstall modes.
+- **Uninstall removes the authoritative deployment.** It removes Enact-owned native roots and the extension declaration, without restoring foreign or prior files. `enact-config.toml` remains a pre-existing central marker; `--purge` additionally cuts an `[extensions]` block this installer appended, using text-level surgery only.
 
 Install the CLI itself globally (the CLI binary only — no plugins, no host config):
 

package/extensions/enact-repo/.agents/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "enact-repo",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Baseline agent setup for any repository: the full Enact skill catalog plus guard, briefing, and code-review-graph hooks and MCP tooling, installed at repo scope.",
   "author": {
     "name": "amsterdamdatalabs"

package/extensions/enact-repo/README.md

@@ -69,27 +69,38 @@ host, with no `--host` appended.
 
 ## Repo-local install
 
-Install into a repository with `enact-extensions install enact-repo --repo <repo-root>` (see the
-top-level README, "Repo-local install"). The command writes direct native project files only:
+Install into an already centrally managed repository with `enact-extensions install enact-repo --repo <repo-root>`
+(see the top-level README, "Repo-local install"). Root `enact-config.toml` must already exist;
+install is reconciliation, not enrollment. The command writes direct native project files only:
 `.claude/agents` and `.claude/skills`; `.codex/agents` and `.agents/skills`;
-`.cursor/agents` and `.cursor/skills`; `.kimi-code/agents` and `.kimi-code/skills`; and,
-for hook-free bundles, `.opencode/agents` and `.opencode/skills`. It also writes each host's
+`.cursor/agents` and `.cursor/skills`; `.kimi-code/agents` and `.kimi-code/skills`; and
+`.opencode/agents` and `.opencode/skills`. It also writes each host's
 native MCP and hook configuration where supported. It never writes a plugin root, marketplace,
 or plugin registration.
-Kimi hooks are global-only and are installed by `enact-vps`, not by this bundle. OpenCode has no
-repo-local hook carrier: an OpenCode install of a hook-bearing bundle fails before writing anything
-and requires the explicit global OpenCode plugin through `enact-vps`. The installer also marks the
-repo as managed through root `enact-config.toml` (the file `enact-hook` checks): it creates the
-file with `version = 1` when missing, manages the `[extensions]` declaration for this bundle by
-text-level surgery only, removes the legacy marker-only `[skills]` block, and never writes
-`[hooks]`; installs the baseline `lean-ctx/config.toml` and
-`lean-ctx/layout.toml` as managed whole files at `.agents/lean-ctx/config/lean-ctx/` (tracked by
-the lock like any other managed file — drift detection, `--force` takeover with originals
-restore on uninstall, all reused from the existing managed-file machinery); and ignores
-`lean-ctx`'s runtime-generated dirs via `.agents/.gitignore` (`/lean-ctx/data/`,
+Kimi hooks are global-only and are installed by `enact-vps`, not by this bundle. OpenCode's
+process-level hook carrier is separate from this repo-local installer; OpenCode bundles always
+install their native local files and remove legacy plugin roots. The installer rebuilds the owned
+roots `.agents`, `.claude`, `.codex`, `.cursor`, `.kimi-code`, and `.opencode` from the canonical
+bundle on every run: stale, foreign, and drifted content is deleted, never merged, adopted, or
+restored. It removes the retired `.claude-plugin`, `.codex-plugin`, `.cursor-plugin`,
+`.kimi-plugin`, and `.opencode/plugins` roots. It modifies only `[extensions]` in the pre-existing
+marker through text-level surgery, removes the legacy marker-only `[skills]` block, and never
+writes `[hooks]`. The baseline `lean-ctx/config.toml` and `lean-ctx/layout.toml` live at
+`.agents/lean-ctx/config/lean-ctx/`. The explicit unmanaged runtime boundaries are
+`.agents/hooks/` and `.agents/lean-ctx/{data,cache,state,bin}/`; they are written by their own
+runtimes and ignored via `.agents/.gitignore` (`/lean-ctx/data/`,
 `/lean-ctx/cache/`, `/lean-ctx/state/`, `/lean-ctx/bin/` — the `config/` dir itself stays
 committed).
 
+## Commands
+
+The authoritative bundle currently declares no `commands/` source. A 2026-09-18 audit of
+`test-repo-only-for-global-tools-m5` found native agent profiles but no native command artifact.
+The installer therefore does not invent a command projection. Documented future repo-local command
+paths are `.claude/commands/` (frontmatter Markdown), `.cursor/commands/` (plain Markdown), and
+`.opencode/commands/` (frontmatter Markdown); Codex has no documented project-local command path.
+Command projection remains pending a canonical Enact command source.
+
 ## Canonical install path
 
 The canonical install entrypoint is `extensions/enact-repo/.agents/plugin.json`. `enact-extensions

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/enact-extensions",
-  "version": "0.1.55",
+  "version": "0.1.57",
   "description": "Create and validate Enact multi-platform plugin manifests",
   "license": "UNLICENSED",
   "type": "module",

package/scripts/enact-extensions.mjs

@@ -37,17 +37,16 @@ Usage:
   enact-extensions sync [path|name]       Sync host manifests from .agents/plugin.json (default: cwd)
   enact-extensions sync [path|name] --name <id>   Create .agents/plugin.json then sync (new plugin)
   enact-extensions install <name> --repo <path> [--host claude,codex,cursor,kimi,opencode] [--force]
-                                          Install a bundle INTO a git repo as committed, relative files
-                                          (per-host project standard; state in .agents/<name>.lock.json)
-  enact-extensions install <name> --repo <path> --dry-run  Print exactly what install would write/merge, per
+                                          Rebuild Enact-owned native roots in an already marked git repo
+                                          (state in .agents/<name>.lock.json)
+  enact-extensions install <name> --repo <path> --dry-run  Print exactly what install would delete/write, per
                                           file (action + reason), and exit with the same success/failure
                                           the real run would have. Touches nothing.
-  enact-extensions uninstall <name> --repo <path> [--purge] [--force]
-                                          Remove exactly what the repo lock records (--purge also removes
-                                          the [extensions] block install wrote to enact-config.toml, and the
-                                          file itself if install created it and only version = 1 remains)
+  enact-extensions uninstall <name> --repo <path> [--purge]
+                                          Remove the authoritative native roots and this extension declaration
+                                          (--purge also cuts a table this extension appended)
   enact-extensions uninstall <name> --repo <path> --dry-run [--purge]
-                                          Print exactly what uninstall would remove/restore, per file
+                                          Print exactly what uninstall would remove, per file
                                           (action + reason), and exit with the same success/failure the
                                           real run would have. Touches nothing.
   enact-extensions doctor enact-repo --repo <path> [--json]
@@ -72,15 +71,15 @@ Options:
   --stdout                 (index only) Alias for --out -.
   --json                   (list/doctor) Emit JSON to stdout instead of human output.
   --name <id>              (sync only) Plugin name for a new .agents/plugin.json.
-  --repo <path>            (install/uninstall/doctor) Target the git repository root at <path>.
-                           Never writes under $HOME; never writes absolute paths.
+  --repo <path>            (install/uninstall/doctor) Target an already marked git repository root at <path>.
+                           Root enact-config.toml is required; never writes under $HOME or absolute paths.
   --host <list>            (install --repo) Hosts to install for: claude,codex,cursor,kimi,opencode
                            (default: every repo host the bundle targets).
   --dry-run                (install/uninstall --repo) Print exactly what would change, per file, and
                            exit with the same success/failure the real run would have. Writes nothing.
-  --force                  (install/uninstall --repo) Overwrite user-edited managed content and take over
-                           same-named entries not owned by the bundle. Never overwrites a user skill dir.
-  --purge                  (uninstall --repo) Also remove the [extensions] block install wrote to enact-config.toml.
+  --force                  (install --repo) Explicitly request the authoritative repair. It deletes and
+                           rebuilds the same owned roots as every install; it never preserves or restores foreign content.
+  --purge                  (uninstall --repo) Also cut an [extensions] block this extension appended.
 
 Name resolution (bare plugin names):
   When a bare name (no "/" in it) is given, it is resolved in this order:
@@ -99,7 +98,7 @@ Examples:
   enact-extensions install enact-repo --repo ~/code/my-service --host claude,cursor
   enact-extensions install enact-repo --repo . --dry-run       Preview the plan; writes nothing
   enact-extensions uninstall enact-repo --repo . --purge
-  enact-extensions uninstall enact-repo --repo . --dry-run     Preview what would be removed/restored
+  enact-extensions uninstall enact-repo --repo . --dry-run     Preview what would be removed
   enact-extensions doctor enact-repo --repo .                  Read-only health check
   enact-extensions doctor enact-repo --repo . --json
 `;
@@ -154,12 +153,12 @@ function parseArgs(argv) {
       options.repo = argv[++i];
     } else if (arg === "--host" && argv[i + 1]) {
       options.host = argv[++i];
-    } else if (arg === "--force") {
-      options.force = true;
     } else if (arg === "--purge") {
       options.purge = true;
     } else if (arg === "--dry-run") {
       options.dryRun = true;
+    } else if (arg === "--force") {
+      options.force = true;
     } else if (arg === "--json") {
       options.json = true;
     } else if (arg === "-h" || arg === "--help") {
@@ -205,7 +204,10 @@ try {
     !["install", "uninstall"].includes(command) &&
     (options.force || options.purge || options.host || options.dryRun)
   ) {
-    fail("--host/--force/--purge/--dry-run only apply to install|uninstall <name> --repo <path>");
+    fail("--host/--purge/--dry-run/--force only apply to install|uninstall <name> --repo <path>");
+  }
+  if (options.force && command !== "install") {
+    fail("--force applies only to install <name> --repo <path>");
   }
 
   function printRepoDoctorReport(report) {
@@ -530,7 +532,12 @@ try {
     }
     const result =
       command === "install"
-        ? runRepoInstall(pluginRoot, { repo: options.repo, host: options.host, force: options.force, dryRun })
+        ? runRepoInstall(pluginRoot, {
+            repo: options.repo,
+            host: options.host,
+            force: options.force,
+            dryRun,
+          })
         : runRepoUninstall(repoPluginName, { repo: options.repo, purge: options.purge, force: options.force, dryRun });
     if (dryRun) {
       if (result.actions.length === 0) {
@@ -539,6 +546,7 @@ try {
         for (const a of result.actions) {
           console.log(`[dry-run] would ${a.action}: ${a.file} — ${a.reason}`);
         }
+        console.log(`would change ${result.actions.length} file(s)`);
       }
     }
     exit(0);

package/scripts/lib/run-repo-doctor.mjs

@@ -10,10 +10,9 @@
  *   - plugin version vs bundle version    (outdated?), plus per-file content
  *                                          drift against what the CURRENT
  *                                          bundle would generate
- *   - lock integrity                      (every managed file present + hash
- *                                          match; every merged JSON entry /
- *                                          TOML block present; list drifted
- *                                          or missing)
+ *   - lock integrity                      (every canonical managed file
+ *                                          present + hash match; no foreign
+ *                                          content inside owned roots)
  *   - per-host status: direct native files recorded in the lock (never a
  *     plugin root or marketplace), codex (files present; read-only
  *     ~/.codex/config.toml projects."<repo>".trust_level; hooks-review-
@@ -48,21 +47,21 @@
 
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, lstatSync, readFileSync, readlinkSync } from "node:fs";
+import { existsSync, lstatSync, readdirSync, readFileSync, readlinkSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, join } from "node:path";
 import * as TOML from "@iarna/toml";
-import { entryPresent, findBlock } from "../../dist/index.js";
+import { findBlock } from "../../dist/index.js";
 import {
   abs,
   buildPlan,
   CONFIG_PATH,
   fileSha,
   HOOK_LOG_FILES,
+  inspectExtensionsScope,
   lockRel,
   REPO_HOSTS,
   readBundle,
-  readJsonStrict,
   readLock,
   resolveRepoRoot,
   sha256,
@@ -299,8 +298,8 @@ function runHookDoctor(repo, enactHook) {
 }
 
 // ---------------------------------------------------------------------------
-// lock integrity — every managed file present + hash match; every merged
-// JSON entry / TOML block present; lists drifted/missing.
+// lock integrity — every canonical managed file present + hash match, plus
+// no foreign content inside an owned root.
 // ---------------------------------------------------------------------------
 function checkLockIntegrity(repo, name, lock) {
   const missingFiles = [];
@@ -309,24 +308,6 @@ function checkLockIntegrity(repo, name, lock) {
     if (!existsSync(abs(repo, rel))) missingFiles.push(rel);
     else if (fileSha(repo, rel) !== want) driftedFiles.push(rel);
   }
-  const jsonIssues = [];
-  for (const [rel, record] of Object.entries(lock.merged)) {
-    const path = abs(repo, rel);
-    if (!existsSync(path)) {
-      jsonIssues.push(`${rel} (file missing)`);
-      continue;
-    }
-    let doc;
-    try {
-      doc = readJsonStrict(path, rel);
-    } catch (err) {
-      jsonIssues.push(`${rel} (${err instanceof Error ? err.message : String(err)})`);
-      continue;
-    }
-    for (const entry of record.entries) {
-      if (!entryPresent(doc, entry)) jsonIssues.push(`${rel} (${entry.path.join(".")})`);
-    }
-  }
   const tomlIssues = [];
   for (const [rel, record] of Object.entries(lock.toml)) {
     const path = abs(repo, rel);
@@ -358,13 +339,41 @@ function checkLockIntegrity(repo, name, lock) {
     }
     if (!existsSync(path)) symlinkIssues.push(`${rel} (dangling -> ${target})`);
   }
+  const rootIssues = [];
+  for (const root of lock.ownedRoots ?? []) {
+    const expectedFiles = new Set(
+      [...Object.keys(lock.files ?? {}), lockRel(name)].filter((rel) => rel.startsWith(`${root}/`)),
+    );
+    const expectedDirs = new Set([root]);
+    for (const rel of expectedFiles) {
+      const parts = rel.split("/");
+      for (let i = 1; i < parts.length; i++) expectedDirs.add(parts.slice(0, i).join("/"));
+    }
+    const boundaries = new Set((lock.unmanagedBoundaries ?? []).filter((rel) => rel.startsWith(`${root}/`)));
+    const visit = (rel) => {
+      if ([...boundaries].some((boundary) => rel === boundary || rel.startsWith(`${boundary}/`))) return;
+      const path = abs(repo, rel);
+      const state = lstatSync(path, { throwIfNoEntry: false });
+      if (!state) return;
+      if (!state.isDirectory() || state.isSymbolicLink()) {
+        if (!expectedFiles.has(rel)) rootIssues.push(`${rel} (foreign file)`);
+        return;
+      }
+      if (!expectedDirs.has(rel)) {
+        rootIssues.push(`${rel} (foreign directory)`);
+        return;
+      }
+      for (const entry of readdirSync(path, { withFileTypes: true })) visit(`${rel}/${entry.name}`);
+    };
+    if (existsSync(abs(repo, root))) visit(root);
+  }
   const valid =
     missingFiles.length === 0 &&
     driftedFiles.length === 0 &&
-    jsonIssues.length === 0 &&
     tomlIssues.length === 0 &&
-    symlinkIssues.length === 0;
-  return { valid, missingFiles, driftedFiles, jsonIssues, tomlIssues, symlinkIssues };
+    symlinkIssues.length === 0 &&
+    rootIssues.length === 0;
+  return { valid, missingFiles, driftedFiles, tomlIssues, symlinkIssues, rootIssues };
 }
 
 // ---------------------------------------------------------------------------
@@ -478,9 +487,9 @@ function checkMarker(repo) {
       note: "missing -- enact-hook only acts in repos containing this file; re-run install",
     };
   }
-  let doc;
+  let extensions;
   try {
-    doc = TOML.parse(readFileSync(path, "utf8"));
+    extensions = inspectExtensionsScope(readFileSync(path, "utf8"), "checking central-management marker");
   } catch (err) {
     return {
       ...base,
@@ -488,25 +497,20 @@ function checkMarker(repo) {
       parses: false,
       extensionsPresent: false,
       valid: false,
-      note: `cannot parse: ${err instanceof Error ? err.message : String(err)}`,
+      note: err instanceof Error ? err.message : String(err),
     };
   }
-  // `[extensions]` is the marker: its presence is what makes a repo
-  // enact-hook-managed, and its sub-tables are the declared extension set.
-  const extensionsPresent = doc.extensions !== undefined;
-  const declared = extensionsPresent
-    ? Object.entries(doc.extensions)
-        .filter(([, v]) => v && typeof v === "object" && !Array.isArray(v))
-        .map(([k]) => k)
-    : [];
+  // The root file is the central-management marker. `[extensions]` is our
+  // optional roster, inspected only through its own textual scope.
+  const extensionsPresent = extensions.present;
   return {
     ...base,
     present: true,
     parses: true,
     extensionsPresent,
-    declared,
-    valid: extensionsPresent,
-    note: extensionsPresent ? undefined : "present but has no [extensions] table -- re-run install",
+    declared: extensions.declarations,
+    valid: true,
+    note: extensionsPresent ? undefined : "present; [extensions] roster will be added by install",
   };
 }
 
@@ -582,9 +586,9 @@ export function runRepoDoctor(pluginRoot, options = {}) {
   if (!lockIntegrity.valid) {
     problems.push(
       `lock integrity: ${lockIntegrity.missingFiles.length} missing + ${lockIntegrity.driftedFiles.length} drifted managed file(s), ` +
-        `${lockIntegrity.jsonIssues.length} json + ${lockIntegrity.tomlIssues.length} toml + ` +
-        `${lockIntegrity.symlinkIssues.length} symlink issue(s) -- ` +
-        `re-run "install --force" to repair or "uninstall --force" to remove`,
+        `${lockIntegrity.tomlIssues.length} toml + ` +
+        `${lockIntegrity.symlinkIssues.length} symlink + ${lockIntegrity.rootIssues.length} owned-root issue(s) -- ` +
+        `re-run install to repair or uninstall to remove`,
     );
   }