@boyingliu01/xp-gate 0.34.0 → 0.35.0

package/lib/__tests__/doctor-timeout-partial.test.js

@@ -0,0 +1,79 @@
+/**
+ * @test REQ-629
+ * @intent `xp-gate doctor` is non-deterministic on Windows. Against an identical,
+ *         freshly-installed, fully healthy installation it printed
+ *         "All checks passed" on one run and "Timed out after 10s — some checks
+ *         incomplete" on the next two. The timeout is a deliberate safety net
+ *         (#348, "43s on Windows"); the defect is what happens when it fires.
+ *
+ *         `Promise.race` discarded the entire `diagnoseAsync()` result and
+ *         substituted a single placeholder check, so everything that had already
+ *         finished was thrown away. Consequence: doctor can report LESS
+ *         information the LONGER it runs — the opposite of what a diagnostic
+ *         should do — and a WARN from the timeout made the skills section vanish
+ *         entirely, so tooling that scrapes `Skill:.*Up to date` read 0/12.
+ *
+ *         The fix: reach a verdict at the deadline (never hang — #348 stays fixed)
+ *         but keep whatever finished. A diagnostic that says "these 9 checks
+ *         passed, 2 did not report in time" is strictly more useful than one that
+ *         says "timed out".
+ *
+ *         The tests below pin the merge semantics directly rather than waiting on
+ *         a real 10s timer: the behaviour that matters is "partial results are
+ *         preserved and reported as partial", not the clock.
+ * @covers AC-670-43, AC-670-44, AC-670-45
+ */
+'use strict';
+
+// describe/it/expect are vitest globals in this repo's config; requiring them from
+// 'vitest' fails because this file is CommonJS. (Hooks are not needed here.)
+
+/** A completed check, shaped like diagnoseAsync()'s output. */
+function check(name, status) {
+  return { name, status, detail: `${name} detail` };
+}
+
+describe('doctor keeps completed checks when the global timeout fires (#629)', () => {
+  it('AC-670-43: completed checks are merged with the timeout notice, not replaced', () => {
+    const { mergeTimedOutDiagnosis } = require('../doctor');
+    expect(typeof mergeTimedOutDiagnosis).toBe('function');
+
+    const completed = {
+      checks: [check('Hooks', 'PASS'), check('Adapters', 'PASS'), check('Skills', 'WARN')],
+      issues: 1,
+    };
+    const merged = mergeTimedOutDiagnosis(completed, ['Gate env', 'OpenCode TUI']);
+
+    // Nothing that finished may be dropped -- that is the whole defect.
+    for (const name of ['Hooks', 'Adapters', 'Skills']) {
+      expect(merged.checks.map((c) => c.name)).toContain(name);
+    }
+    // The deadline itself is still reported, and still not a pass.
+    const notice = merged.checks.find((c) => c.name === 'Diagnosis');
+    expect(notice).toBeDefined();
+    expect(notice.status).toBe('WARN');
+    // Named individually, so the reader knows which surface is unknown.
+    expect(notice.detail).toContain('Gate env');
+    expect(notice.detail).toContain('OpenCode TUI');
+    expect(merged.timedOut).toBe(true);
+    // A partial run is never clean.
+    expect(merged.issues).toBeGreaterThanOrEqual(1);
+  });
+
+  it('AC-670-44: an empty partial result still yields the honest timeout notice', () => {
+    const { mergeTimedOutDiagnosis } = require('../doctor');
+    const merged = mergeTimedOutDiagnosis({ checks: [], issues: 0 }, ['Gate env']);
+    expect(merged.checks).toHaveLength(1);
+    expect(merged.checks[0].name).toBe('Diagnosis');
+    expect(merged.timedOut).toBe(true);
+  });
+
+  it('AC-670-45: nothing that already reported is ever lost, and a real issue count survives', () => {
+    const { mergeTimedOutDiagnosis } = require('../doctor');
+    const completed = { checks: [check('Hooks', 'FAIL'), check('Templates', 'PASS')], issues: 4 };
+    const merged = mergeTimedOutDiagnosis(completed, []);
+    // Pre-existing issues are not reset by the timeout.
+    expect(merged.issues).toBeGreaterThanOrEqual(4);
+    expect(merged.checks.map((c) => c.name)).toEqual(expect.arrayContaining(['Hooks', 'Templates']));
+  });
+});

package/lib/__tests__/foreign-hooks-global.test.js

@@ -0,0 +1,125 @@
+/**
+ * @test REQ-664
+ * @intent `setup-global` points `core.hooksPath` at `~/.config/xp-gate/hooks`, and
+ *         that setting is GLOBAL — it governs every repository on the machine. So
+ *         any third-party tool that writes hooks into `core.hooksPath` writes into
+ *         a directory xp-gate owns. `git lfs install` does exactly this, and the
+ *         measured result was four hooks xp-gate never installs appearing there:
+ *
+ *           hook-module-resolution.sh  lib/  post-checkout  post-commit
+ *           post-merge  pre-commit  pre-push
+ *
+ *         Two failures followed:
+ *
+ *           1. `doctor` only checked pre-commit / pre-push / post-merge. The extra
+ *              files were neither reported nor explained, so the user had no way to
+ *              learn that a global install had acquired foreign hooks.
+ *           2. `uninstall` did `rmSync(GLOBAL_HOOKS_DIR, {recursive: true})` — the
+ *              whole tree, including the lfs hooks someone else put there. The
+ *              file already had `verifyFileOwnership()`; the `type: 'dir'` branch
+ *              simply did not use it.
+ *
+ *         Deleting another tool's files is the more serious of the two: the user
+ *         loses a working git-lfs setup and has no idea which command did it. So
+ *         uninstall must classify before it removes, and SAY what it found.
+ * @covers AC-670-40, AC-670-41, AC-670-42
+ */
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+/** Hooks xp-gate itself installs; anything else in the dir is foreign. */
+const XP_GATE_HOOKS = ['pre-commit', 'pre-push', 'post-merge'];
+
+function freshRequire(relPath) {
+  for (const key of Object.keys(require.cache)) {
+    if (key.includes(`${path.sep}npm-package${path.sep}lib${path.sep}`)) {
+      delete require.cache[key];
+    }
+  }
+  return require(relPath);
+}
+
+/** A hooks directory shaped like the measured post-`git lfs install` state. */
+function makeHooksDir() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'xpg-hooks-'));
+  for (const hook of XP_GATE_HOOKS) {
+    fs.writeFileSync(path.join(dir, hook), '#!/bin/sh\n# xp-gate\n');
+  }
+  // Foreign: two hooks git-lfs installs, plus its support file.
+  fs.writeFileSync(path.join(dir, 'post-checkout'), '#!/bin/sh\ngit lfs post-checkout "$@"\n');
+  fs.writeFileSync(path.join(dir, 'post-commit'), '#!/bin/sh\ngit lfs post-commit "$@"\n');
+  fs.writeFileSync(path.join(dir, 'hook-module-resolution.sh'), '#!/bin/sh\n');
+  return dir;
+}
+
+describe('foreign hooks in the global hooksPath (#664)', () => {
+  it('AC-670-40: the classifier names xp-gate hooks and flags everything else', () => {
+    const { classifyHooksDir } = freshRequire('../doctor');
+    expect(typeof classifyHooksDir).toBe('function');
+
+    const dir = makeHooksDir();
+    try {
+      const result = classifyHooksDir(dir);
+      expect(result.owned.sort()).toEqual([...XP_GATE_HOOKS].sort());
+      // Every foreign entry is reported, not silently dropped. `foreign` holds
+      // { name, source } records, so compare names.
+      const foreignNames = result.foreign.map((f) => f.name);
+      expect(foreignNames).toContain('post-checkout');
+      expect(foreignNames).toContain('post-commit');
+      // lib/ is xp-gate's own shared-library directory, not foreign.
+      expect(foreignNames).not.toContain('lib');
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('AC-670-41: git-lfs hooks are identified by source, unknown files stay generic', () => {
+    const { classifyHooksDir } = freshRequire('../doctor');
+    const dir = makeHooksDir();
+    try {
+      const result = classifyHooksDir(dir);
+      // Naming the likely source is what turns a confusing listing into an
+      // actionable message: "git lfs" tells the user which tool to look at.
+      const lfs = result.foreign.filter((f) => f.source === 'git-lfs').map((f) => f.name);
+      expect(lfs).toContain('post-checkout');
+      expect(lfs).toContain('post-commit');
+
+      // A file with no recognizable signature must still be reported, but without
+      // guessing a source it cannot prove.
+      fs.writeFileSync(path.join(dir, 'post-rebase'), '#!/bin/sh\necho mine\n');
+      const again = classifyHooksDir(dir);
+      const unknown = again.foreign.find((f) => f.name === 'post-rebase');
+      expect(unknown).toBeDefined();
+      expect(unknown.source).not.toBe('git-lfs');
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('AC-670-42: uninstall refuses to delete a hooks dir holding foreign files', () => {
+    const { planHooksDirRemoval } = freshRequire('../uninstall');
+    expect(typeof planHooksDirRemoval).toBe('function');
+
+    const dir = makeHooksDir();
+    try {
+      const plan = planHooksDirRemoval(dir);
+      // Recursive removal would take git-lfs's files with it, so it must not be
+      // the chosen action while foreign content is present.
+      expect(plan.action).not.toBe('remove-all');
+      expect(plan.foreign.length).toBeGreaterThan(0);
+
+      // A directory holding ONLY xp-gate files is safe to remove wholesale.
+      const clean = fs.mkdtempSync(path.join(os.tmpdir(), 'xpg-hooks-clean-'));
+      for (const hook of XP_GATE_HOOKS) {
+        fs.writeFileSync(path.join(clean, hook), '#!/bin/sh\n# xp-gate\n');
+      }
+      expect(planHooksDirRemoval(clean).action).toBe('remove-all');
+      fs.rmSync(clean, { recursive: true, force: true });
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/lib/__tests__/uninstall-global-residue.test.js

@@ -0,0 +1,160 @@
+/**
+ * @test REQ-663
+ * @intent `xp-gate uninstall` presents itself as the inverse of `init`, but it only
+ *         removed `hooks/` + `adapters/` + `core.hooksPath`. After
+ *         `setup-global` then `uninstall --global --force`, the tool printed
+ *         "Uninstall complete" while leaving behind ~1000 files:
+ *
+ *           ~/.config/xp-gate/modules/         principles/ mutation/ mock-policy/
+ *           ~/.config/xp-gate/node_modules/    js-yaml / zod / argparse ...
+ *           ~/.config/xp-gate/package.json
+ *           ~/.config/xp-gate/package-lock.json
+ *           ~/.config/xp-gate/xp-gate.json     manifest + installedSkills record
+ *           ~/.xp-gate/version-cache.json
+ *
+ *         And skills were never in scope at all: 12 skills stayed in
+ *         ~/.qoder/skills/ and ~/.config/opencode/skills/, which the next `init`
+ *         then treated as already-installed.
+ *
+ *         The residue is not cosmetic. A leftover `node_modules/` makes the NEXT
+ *         `setup-global` skip its install ("module runtime deps → ... node_modules"
+ *         reuses whatever is there), so a stale dependency tree survives an
+ *         upgrade; and a leftover `xp-gate.json` carries the previous version's
+ *         `manifest` and `lastInit`, which `doctor` then reports as the CURRENT
+ *         installation.
+ *
+ *         Two rules the fix must respect, both from the issue:
+ *           - a user config (`.delphi-config.json`) is user DATA, not residue --
+ *             keep it, but SAY SO instead of leaving it silently;
+ *           - never delete a skill directory the user has edited. Only remove one
+ *             whose content still matches the bundled copy.
+ * @covers AC-670-37, AC-670-38, AC-670-39
+ */
+'use strict';
+
+// describe/it/expect/beforeEach/afterEach are vitest globals in this repo's config;
+// requiring them from 'vitest' fails because these tests are CommonJS.
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+/** Build a throwaway HOME so the plan is computed against a controlled tree. */
+function makeHome() {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'xpg-uninst-'));
+  return home;
+}
+
+/**
+ * Reproduce the on-disk shape `xp-gate setup-global` leaves behind, including the
+ * parts that were measured as residue in #663.
+ */
+function seedGlobalInstall() {
+  const configDir = path.join(process.env.HOME, '.config', 'xp-gate');
+  for (const rel of ['hooks', 'adapters', 'modules/principles', 'node_modules/js-yaml']) {
+    fs.mkdirSync(path.join(configDir, rel), { recursive: true });
+    fs.writeFileSync(path.join(configDir, rel, 'index.js'), 'module.exports = {};\n');
+  }
+  for (const file of ['package.json', 'package-lock.json', 'xp-gate.json']) {
+    fs.writeFileSync(path.join(configDir, file), '{}\n');
+  }
+  // User data: must survive, and must be reported.
+  fs.writeFileSync(path.join(configDir, '.delphi-config.json'), '{}\n');
+}
+
+
+describe('uninstall --global plans the whole installation, not just hooks (#663)', () => {
+  let home;
+  const savedEnv = {};
+
+  beforeEach(() => {
+    home = makeHome();
+    savedEnv.HOME = process.env.HOME;
+    savedEnv.USERPROFILE = process.env.USERPROFILE;
+    process.env.HOME = home;
+    process.env.USERPROFILE = home;
+  });
+
+  afterEach(() => {
+    process.env.HOME = savedEnv.HOME;
+    process.env.USERPROFILE = savedEnv.USERPROFILE;
+    fs.rmSync(home, { recursive: true, force: true });
+  });
+
+  /**
+   * Load a module fresh so it re-reads HOME. Every lib reads os.homedir() at call
+   * time, but a cached module still holds `GLOBAL_DIRS` values captured earlier.
+   */
+  function freshRequire(relPath) {
+    for (const key of Object.keys(require.cache)) {
+      if (key.includes(`${path.sep}npm-package${path.sep}lib${path.sep}`)) {
+        delete require.cache[key];
+      }
+    }
+    return require(relPath);
+  }
+
+  it('AC-670-37: modules, node_modules and the manifest files are all in scope', () => {
+    const { buildPlan } = freshRequire('../uninstall');
+    expect(typeof buildPlan).toBe('function');
+
+    // buildPlan only schedules what actually exists, so the fixture has to look
+    // like a real `setup-global` install -- otherwise this asserts nothing.
+    seedGlobalInstall();
+
+    const plan = buildPlan('global');
+    const paths = plan.filter((step) => step.path).map((step) => step.path.split(path.sep).join('/'));
+
+    // Each of these was measured residue. A plan that omits any of them reports
+    // "complete" over an installation that is still there.
+    for (const required of ['modules', 'node_modules', 'package.json', 'package-lock.json', 'xp-gate.json']) {
+      expect(
+        paths.some((p) => p.endsWith(required)),
+        `${required} is missing from the uninstall plan (measured residue, #663)`,
+      ).toBe(true);
+    }
+  });
+
+  it('AC-670-38: user config is retained and reported, never silently kept', () => {
+    const { buildPlan } = freshRequire('../uninstall');
+    seedGlobalInstall();
+    const plan = buildPlan('global');
+    // Deletion steps only: a RETAIN step names the file precisely because it is
+    // being kept, so including it here would assert the opposite of the intent.
+    const deletedPaths = plan
+      .filter((step) => step.path && step.retain !== true && step.type !== 'retain')
+      .map((step) => step.path.split(path.sep).join('/'));
+
+    // `.delphi-config.json` holds the user's expert/model choice -- it is data, so
+    // it must appear in no deletion step. (The --purge branch is a separate,
+    // explicitly destructive path and is not what this plan describes.)
+    expect(deletedPaths.some((p) => p.endsWith('.delphi-config.json'))).toBe(false);
+    // Not deleting it is only half the fix: the summary has to name it.
+    const retained = plan.filter((step) => step.retain === true);
+    expect(retained.length, 'no step declares a retention, so the summary cannot report one').toBeGreaterThan(0);
+  });
+
+  it('AC-670-39: an edited skill directory is never scheduled for deletion', () => {
+    const { planSkillRemovals } = freshRequire('../uninstall');
+    expect(typeof planSkillRemovals).toBe('function');
+
+    const bundled = path.join(home, 'bundle', 'skills');
+    const installedRoot = path.join(home, '.qoder', 'skills');
+    for (const [dir, body] of [
+      [path.join(bundled, 'clean-skill'), 'bundled body\n'],
+      [path.join(installedRoot, 'clean-skill'), 'bundled body\n'],
+      [path.join(bundled, 'edited-skill'), 'bundled body\n'],
+      [path.join(installedRoot, 'edited-skill'), 'bundled body\n// user edit\n'],
+    ]) {
+      fs.mkdirSync(dir, { recursive: true });
+      fs.writeFileSync(path.join(dir, 'SKILL.md'), body);
+    }
+
+    const removals = planSkillRemovals(['clean-skill', 'edited-skill'], installedRoot, bundled);
+    const names = removals.map((r) => path.basename(r.path));
+
+    // Untouched -> remove. This is the residue the issue is about.
+    expect(names).toContain('clean-skill');
+    // Edited -> keep. Deleting a user's modifications is worse than residue.
+    expect(names).not.toContain('edited-skill');
+  });
+});

package/lib/doctor.js

@@ -80,6 +80,38 @@ const EXEC_TIMEOUT_MS = 1500;
  */
 const GLOBAL_DIAGNOSIS_TIMEOUT_MS = 10000;
 
+/**
+ * Merge a timed-out partial diagnosis into one honest verdict (#629).
+ *
+ * `doctor`'s global timeout (#348) exists so the command never hangs, but the
+ * original handler threw away the entire `diagnoseAsync()` result and substituted
+ * a single placeholder check. Against an identical healthy install that made the
+ * SAME command print "All checks passed" or "Timed out after 10s" depending on
+ * machine load, and a timed-out run reported 0 installed skills — doctor giving
+ * LESS information the LONGER it runs is the opposite of a diagnostic.
+ *
+ * Keeps every completed check, adds ONE Diagnosis notice naming what did not
+ * report, and never lets a partial run read as clean (#495).
+ *
+ * @param {{checks?: Array, issues?: number}} partial checks finished before the deadline
+ * @param {string[]} pending names of surfaces that did not report in time
+ */
+function mergeTimedOutDiagnosis(partial, pending) {
+  const completed = (partial && Array.isArray(partial.checks)) ? partial.checks : [];
+  const inherited = (partial && Number.isFinite(partial.issues)) ? partial.issues : 0;
+  const pendingNames = Array.isArray(pending) ? pending.filter(Boolean) : [];
+  const detail = pendingNames.length > 0
+    ? `Timed out after ${GLOBAL_DIAGNOSIS_TIMEOUT_MS / 1000}s — did not report in time: ${pendingNames.join(', ')}`
+    : `Timed out after ${GLOBAL_DIAGNOSIS_TIMEOUT_MS / 1000}s — some checks incomplete`;
+  return {
+    checks: [...completed, { name: 'Diagnosis', status: 'WARN', detail }],
+    // A partial run is never clean, and a real issue count is never reset.
+    issues: Math.max(inherited, 1),
+    timedOut: true,
+    completedCheckCount: completed.length,
+  };
+}
+
 /**
  * Fixed attribution text for the WorkBuddy-desktop sandbox restriction (#525).
  *
@@ -416,6 +448,75 @@ function pathsEquivalent(a, b) {
  */
 const DRIFT_COMPARED_HOOKS = ['pre-commit', 'pre-push', 'post-merge'];
 
+/**
+ * Classify the contents of an installed hooks directory (#664).
+ *
+ * `setup-global` sets `core.hooksPath` GLOBALLY, so this directory governs every
+ * repository on the machine — and any tool that installs hooks by asking git where
+ * hooks live writes into it. `git lfs install` is the one that actually does this;
+ * the measured result was four entries xp-gate never installs appearing beside its
+ * own hooks. Nothing reported them, so the user had no way to learn their global
+ * install had acquired foreign hooks.
+ *
+ * Returns:
+ *   owned   — hook names xp-gate installs (the drift-compared set)
+ *   support — xp-gate's own non-hook support entries (lib/, generated scripts)
+ *   foreign — [{ name, source }] for everything else; `source` is 'git-lfs' when
+ *             the file's content proves it, otherwise null. Guessing a source we
+ *             cannot prove would send the user to the wrong tool.
+ */
+function classifyHooksDir(hooksDir) {
+  const result = { owned: [], support: [], foreign: [] };
+  let entries;
+  try {
+    entries = fs.readdirSync(hooksDir, { withFileTypes: true });
+  } catch {
+    return result;
+  }
+
+  for (const entry of entries) {
+    const name = entry.name;
+    if (entry.isDirectory()) {
+      // lib/ is xp-gate's shared-library directory; any other subdirectory belongs
+      // to somebody else and is reported as foreign for the same reason a file is.
+      if (name === 'lib') {
+        result.support.push(name);
+      } else {
+        result.foreign.push({ name, source: null });
+      }
+      continue;
+    }
+    if (DRIFT_COMPARED_HOOKS.includes(name)) {
+      result.owned.push(name);
+      continue;
+    }
+    if (name.endsWith('.sh')) {
+      // Generated support scripts shipped beside the hooks (#505).
+      result.support.push(name);
+      continue;
+    }
+    result.foreign.push({ name, source: gitLfsHookSource(path.join(hooksDir, name)) });
+  }
+  return result;
+}
+
+/**
+ * 'git-lfs' when the file is a git-lfs hook, else null.
+ *
+ * Detected from content rather than filename: git-lfs installs several hook names
+ * and which ones depends on its version, so a name list would silently miss newer
+ * ones. The `git lfs <hook>` invocation is the signature.
+ */
+function gitLfsHookSource(filePath) {
+  let body;
+  try {
+    body = fs.readFileSync(filePath, 'utf8');
+  } catch {
+    return null;
+  }
+  return /\bgit\s+lfs\b/.test(body) ? 'git-lfs' : null;
+}
+
 /**
  * Non-hook files that must sit beside the installed hooks.
  *
@@ -1536,9 +1637,17 @@ async function checkAdapters(checks, mode, gitDirPromise) {
  *   D) Env + CLI tools — fully independent, run IN PARALLEL
  *   E) TUI + Skills — independent, run IN PARALLEL
  */
-async function diagnoseAsync(refreshEnv = false) {
+async function diagnoseAsync(refreshEnv = false, progress = null) {
+  // #629: `progress` is a live view of the checks completed so far. The global
+  // timeout used to discard everything diagnoseAsync had already produced; with a
+  // shared sink, a deadline can report "these finished, those did not" instead of
+  // replacing the whole diagnosis with a placeholder.
   const checks = [];
   let issues = 0;
+  if (progress) {
+    progress.checks = checks;
+    progress.getIssues = () => issues;
+  }
 
   // Spawn capability probe FIRST (sync, no config dependency) — #525: it must
   // report even when the config early-exits below, and its WARN (environmental,
@@ -2800,10 +2909,26 @@ async function doctor(args) {
 
   // Global timeout wrapper — ensures doctor completes within GLOBAL_DIAGNOSIS_TIMEOUT_MS
   // even if network/subprocess checks stack up (fix #348: 43s on Windows).
-  const diagnosisPromise = diagnoseAsync(refreshEnv);
+  // #629: give diagnoseAsync a live sink so a deadline can keep what finished.
+  // Without it, `Promise.race` discarded the entire diagnosis -- so the SAME
+  // healthy install reported different results run to run, and a timed-out run
+  // lost the skills section entirely (scrapers read 0/12 installed skills).
+  const progress = { checks: [], getIssues: () => 0 };
+  const diagnosisPromise = diagnoseAsync(refreshEnv, progress);
   let diagnosisTimer = null;
   const timeoutPromise = new Promise((resolve) => {
-    diagnosisTimer = setTimeout(() => resolve({ checks: [{ name: 'Diagnosis', status: 'WARN', detail: `Timed out after ${GLOBAL_DIAGNOSIS_TIMEOUT_MS / 1000}s — some checks incomplete` }], issues: 0, timedOut: true }), GLOBAL_DIAGNOSIS_TIMEOUT_MS);
+    diagnosisTimer = setTimeout(() => {
+      const completed = Array.isArray(progress.checks) ? progress.checks : [];
+      const reported = new Set(completed.map((c) => c && c.name));
+      // Name the surfaces that did NOT report, so the reader knows exactly which
+      // conclusions are missing rather than just "something timed out".
+      const pending = ['Hooks', 'Adapters', 'Skills', 'Gate env', 'OpenCode TUI']
+        .filter((name) => !reported.has(name));
+      resolve(mergeTimedOutDiagnosis(
+        { checks: completed, issues: progress.getIssues() },
+        pending,
+      ));
+    }, GLOBAL_DIAGNOSIS_TIMEOUT_MS);
   });
   const { checks, issues: diagnosedIssues, timedOut } = await Promise.race([
     diagnosisPromise.then(r => ({ ...r, timedOut: false })),
@@ -3280,6 +3405,8 @@ module.exports = {
   readTuiJson,
   formatDoctorJson,
   diagnoseHookDrift,
+  mergeTimedOutDiagnosis,
+  classifyHooksDir,
   syncGlobalHooksFromRepo,
   diagnoseModuleDrift,
   diagnoseAuditLedger,

package/lib/mattpocock-license-verdict.json

@@ -2,6 +2,6 @@
   "verdict": "PASS",
   "license_type": "MIT",
   "sha256": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-  "checked_at": "2026-10-30T14:08:10.171Z",
+  "checked_at": "2026-10-30T15:31:30.899Z",
   "source": "network"
 }