@biffo/cli 0.166.2 → 0.167.1

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command25 } from "commander";
+import { Command as Command26 } from "commander";
 
 // src/commands/core.ts
 import { Command as Command4 } from "commander";
@@ -948,6 +948,68 @@ var GitAdapter = class {
   async fetchPrune(cwd, remote = "origin") {
     await execa2("git", ["fetch", "--quiet", "--prune", remote], { cwd, reject: false });
   }
+  /**
+   * Is `cwd` the primary checkout, rather than a linked worktree?
+   *
+   * The distinction decides whether being off the integration branch is a
+   * defect or the mandated state: AGENTS.md §1 requires all work to happen in a
+   * worktree on its own branch, while §2 requires the primary to stay on `dev`.
+   * Reporting the former as a problem is a false positive in the one place
+   * everybody works.
+   *
+   * A linked worktree's git dir points inside `.git/worktrees/<name>`, while the
+   * common dir is the shared `.git`. They are equal only in the primary.
+   */
+  async isPrimaryWorktree(cwd) {
+    const opts = { cwd, reject: false };
+    const [dir, common] = await Promise.all([
+      execa2("git", ["rev-parse", "--absolute-git-dir"], opts),
+      execa2("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], opts)
+    ]);
+    if (dir.exitCode !== 0 || common.exitCode !== 0) return true;
+    return dir.stdout.trim() === common.stdout.trim();
+  }
+  /**
+   * Worktrees other than the primary, with the branch each is on (#797).
+   *
+   * `--porcelain` rather than the human format: the latter's alignment and
+   * annotations vary, and this has to survive paths with spaces.
+   */
+  async listWorktrees(cwd) {
+    const { stdout, exitCode } = await execa2("git", ["worktree", "list", "--porcelain"], {
+      cwd,
+      reject: false
+    });
+    if (exitCode !== 0) return [];
+    const out = [];
+    let path = "";
+    for (const line of stdout.split("\n")) {
+      if (line.startsWith("worktree ")) path = line.slice("worktree ".length);
+      else if (line.startsWith("branch ")) {
+        const branch = line.slice("branch ".length).replace("refs/heads/", "");
+        if (out.length > 0 || path !== cwd) out.push({ path, branch });
+      }
+    }
+    return out.filter((w) => w.path !== cwd);
+  }
+  /** How many commits `branch` is behind `base`; null when it cannot be measured. */
+  async countBehind(cwd, branch, base) {
+    const { stdout, exitCode } = await execa2("git", ["rev-list", "--count", `${branch}..${base}`], {
+      cwd,
+      reject: false
+    });
+    if (exitCode !== 0) return null;
+    const n = Number.parseInt(stdout.trim(), 10);
+    return Number.isNaN(n) ? null : n;
+  }
+  /** A file's contents at a ref, or null when it is absent there. */
+  async showFileAtRef(cwd, ref, path) {
+    const { stdout, exitCode } = await execa2("git", ["show", `${ref}:${path}`], {
+      cwd,
+      reject: false
+    });
+    return exitCode === 0 ? stdout : null;
+  }
   /** Every local branch with its upstream and tracking state (#758). */
   async listBranchRefs(cwd) {
     const { stdout, exitCode } = await execa2(
@@ -1280,7 +1342,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
+      await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
     }
     throw new Error(
       `Branch "${branch}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1295,7 +1357,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404) throw err;
       }
-      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
+      await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
     }
     throw new Error(
       `Ref "${ref}" not found in ${org}/${repo} after ${timeoutMs / 1e3}s \u2014 GitHub template generation may have stalled. Check the repository and re-run biffo init.`
@@ -1500,7 +1562,7 @@ var GitHubAdapter = class {
           }
           if (status !== 404 || Date.now() >= deadline) throw err;
           log.info("Branch protection endpoint not yet ready, retrying...");
-          await new Promise((resolve18) => setTimeout(resolve18, protectionIntervalMs));
+          await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
         }
       }
     }
@@ -1563,7 +1625,7 @@ var GitHubAdapter = class {
         }
         if (status !== 404 || Date.now() >= deadline) throw err;
         log.info("Branch protection endpoint not yet ready, retrying...");
-        await new Promise((resolve18) => setTimeout(resolve18, protectionIntervalMs));
+        await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
       }
     }
     log.success(
@@ -1818,7 +1880,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
+        await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
       }
     }
   }
@@ -1837,7 +1899,7 @@ var GitHubAdapter = class {
       } catch (err) {
         if (err.status !== 404 || Date.now() >= deadline) throw err;
         log.info(`Workflow ${workflowId} not yet indexed by GitHub Actions, retrying...`);
-        await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
+        await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
       }
     }
   }
@@ -1861,7 +1923,7 @@ var GitHubAdapter = class {
       } else {
         log.info("  Waiting for run to be queued...");
       }
-      await new Promise((resolve18) => setTimeout(resolve18, intervalMs));
+      await new Promise((resolve19) => setTimeout(resolve19, intervalMs));
     }
     throw new Error(
       `Workflow ${workflowId} did not complete within ${timeoutMs / 1e3 / 60} minutes`
@@ -3332,7 +3394,7 @@ var AwsAdapter = class {
         const code = err.Code;
         if (code === "OperationAborted" && attempt < maxAttempts) {
           log.info(`  Waiting for S3 to release "${bucketName}"... (${attempt}/${maxAttempts})`);
-          await new Promise((resolve18) => setTimeout(resolve18, retryDelayMs));
+          await new Promise((resolve19) => setTimeout(resolve19, retryDelayMs));
         } else if (code === "OperationAborted") {
           return false;
         } else {
@@ -8679,8 +8741,8 @@ async function runOwnershipCheck(argv) {
     const { stdout } = await execa6("git", ["diff", "--cached", "--name-status"], { cwd: root });
     ({ changed: changedFiles, deleted: deletedFiles } = parseNameStatus(stdout));
     if (messageFile) {
-      const { readFileSync: readFileSync25, existsSync: existsSync34 } = await import("fs");
-      if (existsSync34(messageFile)) commitMessage = readFileSync25(messageFile, "utf8");
+      const { readFileSync: readFileSync26, existsSync: existsSync35 } = await import("fs");
+      if (existsSync35(messageFile)) commitMessage = readFileSync26(messageFile, "utf8");
     }
   } else {
     const base = process.env["GITHUB_BASE_REF"] ?? args[0];
@@ -9072,20 +9134,247 @@ function rawArgsAfter(subcommand) {
   return at === -1 ? [] : process.argv.slice(at + 1);
 }
 
+// src/commands/doctor.ts
+import { existsSync as existsSync34, readFileSync as readFileSync25 } from "fs";
+import { join as join34, resolve as resolve18 } from "path";
+import chalk21 from "chalk";
+import { Command as Command24 } from "commander";
+
+// src/lib/doctor.ts
+function checkCheckoutCurrency(facts) {
+  const findings = [];
+  if (facts.currentBranch === "HEAD" || facts.currentBranch === "") {
+    findings.push({
+      check: "checkout-detached",
+      severity: "error",
+      detail: "The primary checkout has a detached HEAD, so nothing read from it can be attributed to a branch.",
+      remedy: `git switch ${facts.integrationBranch}`
+    });
+    return findings;
+  }
+  if (facts.isPrimary && facts.currentBranch !== facts.integrationBranch) {
+    findings.push({
+      check: "checkout-off-integration",
+      severity: "error",
+      detail: `The primary checkout is on '${facts.currentBranch}', not '${facts.integrationBranch}'. Anything read from it \u2014 versions, migrations, whether a feature exists \u2014 describes that branch, not the repo. This is how an audit gets run against dead code (AGENTS.md \xA72).`,
+      remedy: `git switch ${facts.integrationBranch} && git pull  (do the work in a worktree instead)`
+    });
+  }
+  if (facts.isPrimary && facts.isDirty) {
+    findings.push({
+      check: "checkout-dirty",
+      severity: "warn",
+      detail: "The primary checkout has uncommitted changes, so what it contains is neither the integration branch nor anything reviewed. Editing the primary directly is what AGENTS.md \xA71 exists to prevent; work belongs in a worktree.",
+      remedy: 'git stash push -m "<what this is>" or commit it on a branch, then work in a worktree'
+    });
+  }
+  if (facts.hasUpstream && facts.behind > 0) {
+    const diverged = facts.ahead > 0 ? `, and ${String(facts.ahead)} ahead (diverged)` : "";
+    const where = facts.isPrimary ? "The primary checkout" : "This worktree";
+    findings.push({
+      check: "checkout-behind",
+      // In a worktree, behind-its-own-upstream means someone else pushed to the
+      // branch — worth knowing, but not a reason to distrust everything read
+      // from it the way a stale primary is.
+      severity: facts.isPrimary ? "error" : "warn",
+      detail: `${where} is ${String(facts.behind)} commit(s) behind its upstream${diverged}. Every file read from it may be stale, including the ones that look like authoritative state.`,
+      remedy: "git pull --ff-only"
+    });
+  }
+  return findings;
+}
+function checkCoreVersionCurrency(facts) {
+  if (facts.localCoreVersion === null || facts.remoteCoreVersion === null) return [];
+  if (facts.localCoreVersion === facts.remoteCoreVersion) return [];
+  if (!facts.isPrimary) return [];
+  return [
+    {
+      check: "core-version-stale",
+      severity: "error",
+      detail: `This checkout records core ${facts.localCoreVersion}, but ${facts.integrationBranch} carries ${facts.remoteCoreVersion}. Sizing an upgrade or reasoning about which fixes this instance has from the local number will be wrong.`,
+      remedy: "git pull --ff-only, then re-read biffo.core.json"
+    }
+  ];
+}
+function checkFossilCoreVersion(facts) {
+  if (facts.fossilCoreVersion === null || facts.localCoreVersion === null) return [];
+  if (facts.fossilCoreVersion === facts.localCoreVersion) return [];
+  return [
+    {
+      check: "fossil-core-version",
+      severity: "warn",
+      detail: `core.version says ${facts.fossilCoreVersion} while biffo.core.json says ${facts.localCoreVersion}. core.version is inherited from \`biffo init\` and has not been maintained since; biffo.core.json is the authority. Reading the wrong one is #788.`,
+      remedy: "Ignore core.version. `biffo core upgrade` removes it when it can prove it is inherited, and deliberately keeps it when it may have been repurposed."
+    }
+  ];
+}
+function checkStaleBranches(facts) {
+  const gone = facts.branches.filter((b) => b.name !== facts.currentBranch && b.track.includes("gone")).map((b) => b.name);
+  if (gone.length === 0) return [];
+  const upgradeOnes = gone.filter((n) => n.startsWith(UPGRADE_BRANCH_PREFIX)).length;
+  const note = upgradeOnes > 0 ? ` (${String(upgradeOnes)} from core upgrades)` : "";
+  return [
+    {
+      check: "stale-branches",
+      severity: "warn",
+      detail: `${String(gone.length)} local branch(es) have a gone upstream${note} \u2014 their remote copy was deleted, which happens on merge. Squash merges mean \`git branch -d\` refuses them and \`--merged\` never lists them, so they accumulate silently (#758).`,
+      remedy: `git branch -D ${gone.slice(0, 3).join(" ")}${gone.length > 3 ? " \u2026" : ""}`
+    }
+  ];
+}
+function checkWorktrees(facts, behindThreshold = 50) {
+  const findings = [];
+  const goneBranches = new Set(
+    facts.branches.filter((b) => b.track.includes("gone")).map((b) => b.name)
+  );
+  const merged = facts.worktrees.filter((w) => goneBranches.has(w.branch));
+  if (merged.length > 0) {
+    findings.push({
+      check: "worktree-merged",
+      severity: "warn",
+      detail: `${String(merged.length)} worktree(s) sit on a branch whose remote copy is gone, i.e. whose PR has merged: ${merged.map((w) => w.path).join(", ")}.`,
+      remedy: "git worktree remove <path>"
+    });
+  }
+  const ancient = facts.worktrees.filter(
+    (w) => !goneBranches.has(w.branch) && w.behind !== null && w.behind >= behindThreshold
+  );
+  if (ancient.length > 0) {
+    findings.push({
+      check: "worktree-stale",
+      severity: "warn",
+      detail: `${String(ancient.length)} worktree(s) are more than ${String(behindThreshold)} commits behind ${facts.integrationBranch}: ${ancient.map((w) => `${w.path} (${String(w.behind)})`).join(", ")}. Reading one of these describes the repo as it was, not as it is.`,
+      remedy: "git worktree remove <path>, or rebase it onto the integration branch"
+    });
+  }
+  return findings;
+}
+function runDoctorChecks(facts) {
+  return [
+    ...checkCheckoutCurrency(facts),
+    ...checkCoreVersionCurrency(facts),
+    ...checkFossilCoreVersion(facts),
+    ...checkStaleBranches(facts),
+    ...checkWorktrees(facts)
+  ];
+}
+
+// src/commands/doctor.ts
+var INTEGRATION_BRANCH = "dev";
+var doctorCommand = new Command24("doctor").description(
+  "Report repo-state conditions that make everything read from this checkout unreliable"
+).option("--cwd <path>", "Repo root to inspect (defaults to the current directory)").option("--no-fetch", "Skip the fetch; report against refs as they already are locally").action(async (options) => {
+  const cwd = options.cwd ? resolve18(options.cwd) : process.cwd();
+  try {
+    const findings = await runDoctor({ cwd, fetch: options.fetch !== false });
+    printFindings(findings);
+    if (findings.some((f) => f.severity === "error")) process.exit(1);
+  } catch (err) {
+    log.error(err.message);
+    process.exit(1);
+  }
+});
+async function runDoctor(options, deps = { git: new GitAdapter() }) {
+  const { git } = deps;
+  if (!await git.isGitRepo(options.cwd)) {
+    throw new Error(`${options.cwd} is not a git repository.`);
+  }
+  if (options.fetch) await git.fetchPrune(options.cwd);
+  const currentBranch = await git.currentBranch(options.cwd);
+  const isPrimary = await git.isPrimaryWorktree(options.cwd);
+  const isDirty = await git.hasUncommittedChanges(options.cwd);
+  const { ahead, behind, hasUpstream } = await git.aheadBehind(options.cwd);
+  const branches = await git.listBranchRefs(options.cwd);
+  const worktreePaths = await git.listWorktrees(options.cwd);
+  const worktrees = await Promise.all(
+    worktreePaths.map(async (w) => ({
+      ...w,
+      behind: await git.countBehind(options.cwd, w.branch, `origin/${INTEGRATION_BRANCH}`)
+    }))
+  );
+  const facts = {
+    currentBranch,
+    isPrimary,
+    integrationBranch: INTEGRATION_BRANCH,
+    ahead,
+    behind,
+    hasUpstream,
+    isDirty,
+    localCoreVersion: readLocalCoreVersion(options.cwd),
+    remoteCoreVersion: parseCoreRecord(
+      await git.showFileAtRef(options.cwd, `origin/${INTEGRATION_BRANCH}`, INSTANCE_CORE_FILE)
+    ),
+    fossilCoreVersion: readFossil(options.cwd),
+    branches,
+    worktrees
+  };
+  return runDoctorChecks(facts);
+}
+function readLocalCoreVersion(cwd) {
+  const path = join34(cwd, INSTANCE_CORE_FILE);
+  if (!existsSync34(path)) return null;
+  try {
+    return parseCoreRecord(readFileSync25(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function parseCoreRecord(contents) {
+  if (contents === null) return null;
+  try {
+    const parsed = JSON.parse(contents);
+    return typeof parsed.version === "string" ? parsed.version : null;
+  } catch {
+    return null;
+  }
+}
+function readFossil(cwd) {
+  const path = join34(cwd, CORE_VERSION_FILE);
+  if (!existsSync34(path)) return null;
+  try {
+    const value = readFileSync25(path, "utf8").trim();
+    return value === "" ? null : value;
+  } catch {
+    return null;
+  }
+}
+function printFindings(findings) {
+  if (findings.length === 0) {
+    log.success("No findings \u2014 this checkout can be trusted.");
+    return;
+  }
+  const errors = findings.filter((f) => f.severity === "error");
+  const warnings = findings.filter((f) => f.severity === "warn");
+  console.log("");
+  for (const f of findings) {
+    const tag = f.severity === "error" ? chalk21.red("error") : chalk21.yellow(" warn");
+    console.log(`  ${tag}  ${chalk21.bold(f.check)}`);
+    console.log(`         ${f.detail}`);
+    console.log(chalk21.dim(`         fix: ${f.remedy}`));
+    console.log("");
+  }
+  console.log(
+    chalk21.dim(
+      `  ${String(errors.length)} error(s), ${String(warnings.length)} warning(s). Errors mean values read from this checkout may be wrong.
+`
+    )
+  );
+}
+
 // src/commands/teardown.ts
 import { execSync as execSync7 } from "child_process";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand3, STSClient as STSClient3 } from "@aws-sdk/client-sts";
-import chalk21 from "chalk";
-import { Command as Command24 } from "commander";
+import chalk22 from "chalk";
+import { Command as Command25 } from "commander";
 import inquirer8 from "inquirer";
-var teardownCommand = new Command24("teardown").description(
+var teardownCommand = new Command25("teardown").description(
   "Destroy all infrastructure then remove the repo, IAM role, and state bucket \u2014 single command"
 ).option("--project <name>", "Project name to tear down (reads session if omitted)").option("--skip-destroy", "Skip terraform destroy (only use if infrastructure is already gone)").option(
   "--confirm <name>",
   "Pre-confirm by supplying the project name (the scriptable form of the typed confirmation)"
 ).option("-y, --yes", "Skip the typed project-name confirmation entirely").action(
   async (options) => {
-    console.log(chalk21.bold("\n  Biffo \u2014 Teardown\n"));
+    console.log(chalk22.bold("\n  Biffo \u2014 Teardown\n"));
     const githubToken = resolveGithubToken4();
     const sts = new STSClient3({});
     const { Account: accountId } = await sts.send(new GetCallerIdentityCommand3({}));
@@ -9107,7 +9396,7 @@ var teardownCommand = new Command24("teardown").description(
       adminEmail = session.config.admin?.email ?? "noop@example.com";
       adminUsername = session.config.admin?.username ?? "noop";
       domain = session.config.project.domain ?? "";
-      console.log(chalk21.yellow("  Loaded session for: ") + chalk21.bold(projectName));
+      console.log(chalk22.yellow("  Loaded session for: ") + chalk22.bold(projectName));
       if (org && repo) console.log(`  Repository: ${org}/${repo}`);
       console.log();
     } else if (savedConfig) {
@@ -9120,7 +9409,7 @@ var teardownCommand = new Command24("teardown").description(
       adminEmail = savedConfig.admin.email;
       adminUsername = savedConfig.admin.username;
       domain = resolveDnsConfig(savedConfig).domain;
-      console.log(chalk21.yellow("  Loaded config for: ") + chalk21.bold(projectName));
+      console.log(chalk22.yellow("  Loaded config for: ") + chalk22.bold(projectName));
       console.log(`  Repository: ${org}/${repo}`);
       console.log();
     } else {
@@ -9191,35 +9480,35 @@ var teardownCommand = new Command24("teardown").description(
         throw err;
       }
     }
-    console.log(chalk21.red.bold("  This will permanently delete:\n"));
+    console.log(chalk22.red.bold("  This will permanently delete:\n"));
     if (deployedEnvs.length > 0 || hasGlobal) {
-      console.log(chalk21.red("  Infrastructure (via GitHub Actions terraform destroy):"));
+      console.log(chalk22.red("  Infrastructure (via GitHub Actions terraform destroy):"));
       for (const env of deployedEnvs) {
         console.log(
-          `    ${chalk21.red("\u2717")} ${env} \u2014 VPC, RDS, Lambda, Cognito, CloudFront, EventBridge`
+          `    ${chalk22.red("\u2717")} ${env} \u2014 VPC, RDS, Lambda, Cognito, CloudFront, EventBridge`
         );
       }
       if (hasGlobal) {
-        console.log(`    ${chalk21.red("\u2717")} global \u2014 Route 53 hosted zone, ACM certificate`);
+        console.log(`    ${chalk22.red("\u2717")} global \u2014 Route 53 hosted zone, ACM certificate`);
       }
       console.log();
     }
     for (const line of formatSiblingPlan(siblings, options.skipDestroy === true)) {
       console.log(line);
     }
-    console.log(chalk21.red("  Biffo resources:"));
-    console.log(`    ${chalk21.red("\u2717")} GitHub repository  ${chalk21.bold(`${org}/${repo}`)}`);
+    console.log(chalk22.red("  Biffo resources:"));
+    console.log(`    ${chalk22.red("\u2717")} GitHub repository  ${chalk22.bold(`${org}/${repo}`)}`);
     console.log(
-      `    ${chalk21.red("\u2717")} IAM role           ${chalk21.bold(`biffo-github-actions-${projectName}`)}`
+      `    ${chalk22.red("\u2717")} IAM role           ${chalk22.bold(`biffo-github-actions-${projectName}`)}`
     );
     console.log(
-      `    ${chalk21.red("\u2717")} S3 bucket          ${chalk21.bold(stateBucket)} (all versions)`
+      `    ${chalk22.red("\u2717")} S3 bucket          ${chalk22.bold(stateBucket)} (all versions)`
     );
-    console.log(`    ${chalk21.red("\u2717")} Local session file`);
+    console.log(`    ${chalk22.red("\u2717")} Local session file`);
     if (options.skipDestroy) {
       console.log();
       console.log(
-        chalk21.yellow(
+        chalk22.yellow(
           "  --skip-destroy: NO terraform destroy runs, for this project or any sibling.\n  Everything above is deleted, but any infrastructure still standing is left\n  standing \u2014 and, with the state buckets gone, orphaned."
         )
       );
@@ -9407,30 +9696,30 @@ async function assertSiblingsAreDestroyable(github, siblings) {
 }
 function formatSiblingPlan(siblings, skipDestroy) {
   if (siblings.length === 0) return [];
-  const lines = [chalk21.red(`  Sibling apps (${siblings.length}) \u2014 ADR-0007:`)];
+  const lines = [chalk22.red(`  Sibling apps (${siblings.length}) \u2014 ADR-0007:`)];
   for (const s of siblings) {
     const envs = s.environments.join(", ");
     if (s.repoState === "gone") {
       lines.push(
-        `    ${chalk21.yellow("!")} ${chalk21.bold(`${s.org}/${s.repo}`)} \u2014 repo already deleted; its ${envs} infrastructure CANNOT be destroyed and will be left standing`
+        `    ${chalk22.yellow("!")} ${chalk22.bold(`${s.org}/${s.repo}`)} \u2014 repo already deleted; its ${envs} infrastructure CANNOT be destroyed and will be left standing`
       );
       continue;
     }
     lines.push(
-      `    ${chalk21.red("\u2717")} GitHub repository  ${chalk21.bold(`${s.org}/${s.repo}`)} ` + (s.pathPrefix === ROOT_SIBLING_NAME ? "(the application, routed at /)" : `(routed at /${s.pathPrefix})`)
+      `    ${chalk22.red("\u2717")} GitHub repository  ${chalk22.bold(`${s.org}/${s.repo}`)} ` + (s.pathPrefix === ROOT_SIBLING_NAME ? "(the application, routed at /)" : `(routed at /${s.pathPrefix})`)
     );
     lines.push(
-      `      ${chalk21.red("\u2717")} ${skipDestroy ? "infrastructure NOT destroyed (--skip-destroy)" : `${envs} infrastructure \u2014 S3 site bucket, Lambda, API Gateway`}`
+      `      ${chalk22.red("\u2717")} ${skipDestroy ? "infrastructure NOT destroyed (--skip-destroy)" : `${envs} infrastructure \u2014 S3 site bucket, Lambda, API Gateway`}`
     );
     lines.push(
-      `      ${chalk21.red("\u2717")} IAM role           ${chalk21.bold(`biffo-github-actions-${s.projectName}`)}`
+      `      ${chalk22.red("\u2717")} IAM role           ${chalk22.bold(`biffo-github-actions-${s.projectName}`)}`
     );
     lines.push(
-      `      ${chalk21.red("\u2717")} S3 bucket          ${chalk21.bold(`${s.projectName}-terraform-state-${s.accountId}`)}`
+      `      ${chalk22.red("\u2717")} S3 bucket          ${chalk22.bold(`${s.projectName}-terraform-state-${s.accountId}`)}`
     );
     if (s.pendingRegistrationPr !== void 0) {
       lines.push(
-        chalk21.dim(`      registration PR #${s.pendingRegistrationPr} is still open \u2014 never routed`)
+        chalk22.dim(`      registration PR #${s.pendingRegistrationPr} is still open \u2014 never routed`)
       );
     }
   }
@@ -9468,7 +9757,7 @@ async function confirmTeardown(projectName, options) {
     {
       type: "input",
       name: "confirm",
-      message: `Type ${chalk21.bold(projectName)} to confirm:`
+      message: `Type ${chalk22.bold(projectName)} to confirm:`
     }
   ]);
   return confirm === projectName;
@@ -9486,7 +9775,7 @@ function resolveGithubToken4() {
 }
 
 // src/index.ts
-var program = new Command25();
+var program = new Command26();
 function cliVersion() {
   try {
     return getLatestCoreVersion();
@@ -9504,6 +9793,7 @@ program.addCommand(dataCommand);
 program.addCommand(coreCommand);
 program.addCommand(siblingCommand);
 program.addCommand(checkCommand);
+program.addCommand(doctorCommand);
 registerNonInteractive(program);
 program.parseAsync().catch((err) => {
   if (err instanceof NonInteractiveError) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.166.2",
+  "version": "0.167.1",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",