@bridge_gpt/mcp-server 0.2.41 → 0.2.42

package/build/conductor/git-hooks.js

@@ -9,8 +9,8 @@
  * unsafe to merge is left untouched with a warning. Missing hooks are a degraded
  * OPTIONAL capability — never a fatal error.
  */
-import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync, } from "node:fs";
-import { dirname, isAbsolute, resolve } from "node:path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync, } from "node:fs";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { runGitCommand } from "./git-inspection.js";
 /** Markers delimiting the conductor-managed block inside a hook file. */
@@ -36,10 +36,120 @@ export function resolveGitHooksDirectory(deps = {}) {
     const absoluteCommonDir = isAbsolute(commonDir) ? commonDir : resolve(cwd, commonDir);
     return { is_worktree: true, hooks_dir: resolve(absoluteCommonDir, "hooks") };
 }
-/** Best-effort default path to the compiled conductor bin (`build/conductor-bin.js`). */
-function defaultConductorBin() {
-    // This file compiles to build/conductor/git-hooks.js; the bin is build/conductor-bin.js.
-    return resolve(dirname(fileURLToPath(import.meta.url)), "..", "conductor-bin.js");
+/** The file name every managed hook body must invoke. */
+export const CONDUCTOR_BIN_FILENAME = "conductor-bin.js";
+/**
+ * The sanitized failure reason. Names the layout categories that were searched
+ * so the operator can act, and nothing else — no probed path, no caught error
+ * text, no credential-bearing string can reach it.
+ */
+export const CONDUCTOR_HOOK_BIN_UNRESOLVED_REASON = `no usable ${CONDUCTOR_BIN_FILENAME} was found for the executing artifact ` +
+    "(searched: the sibling bundle layout, the parent TypeScript-emit layout, and " +
+    `the invocation target when it is named ${CONDUCTOR_BIN_FILENAME}). ` +
+    "Reinstall or rebuild the package so a conductor binary ships beside the executing module.";
+/**
+ * Absolute, canonical path of the `conductor-bin.js` belonging to the artifact
+ * that is currently executing (BAPI-772, the BAPI-768 pattern applied to hooks).
+ *
+ * ## Why this cannot be path arithmetic
+ *
+ * The old implementation hard-coded ONE layout — `dirname(import.meta.url)/../
+ * conductor-bin.js`, the tsc emit — and returned it unverified. In the shipped
+ * esbuild bundle this module IS `build/conductor-bin.js`, so the directory hop
+ * landed on `<pkg>/conductor-bin.js`, a path that has never existed. Every hook
+ * installed from the published package embedded that dead path, and because hook
+ * bodies discard output and end in `|| true`, each commit ENOENTed in silence
+ * while `conductor doctor` still called the hooks healthy.
+ *
+ * So this resolver PROBES. Candidates are drawn only from the executing module's
+ * own URL and Node's actual invocation target — never `process.cwd()` or an
+ * assumed package root, which could point a hook at a *different build* than the
+ * one the operator installed from. Every candidate is canonicalized through
+ * `realpath` (which also collapses `..` segments and rejects a dangling symlink)
+ * and must stat as a regular file before it can be returned.
+ */
+export function resolveConductorHookBin(overrides = {}) {
+    const deps = {
+        moduleUrl: overrides.moduleUrl ?? import.meta.url,
+        argv1: overrides.argv1 ?? process.argv[1],
+        realpath: overrides.realpath ?? defaultRealpath,
+        isFile: overrides.isFile ?? defaultIsFile,
+    };
+    const moduleFile = moduleFilePath(deps.moduleUrl);
+    const candidates = [];
+    if (moduleFile !== null) {
+        const dir = dirname(moduleFile);
+        // Bundled layout: the bin sits beside the executing module (and in the
+        // single-file bundle it IS the executing module).
+        candidates.push(join(dir, CONDUCTOR_BIN_FILENAME));
+        // tsc layout: `build/conductor/git-hooks.js` → `build/conductor-bin.js`.
+        candidates.push(join(dir, "..", CONDUCTOR_BIN_FILENAME));
+    }
+    // Last resort, and only ever a validated one: a packaged install launches
+    // through a `node_modules/.bin` symlink. Accepted only when the invocation
+    // target is exactly the conductor bin — `index.js` or `conductor-bin.js.bak`
+    // must never become a hook target.
+    if (typeof deps.argv1 === "string" && deps.argv1.length > 0) {
+        if (basename(deps.argv1) === CONDUCTOR_BIN_FILENAME)
+            candidates.push(deps.argv1);
+    }
+    const seen = new Set();
+    for (const candidate of candidates) {
+        // Canonicalize BEFORE probing so duplicates that differ only by symlink or
+        // `..` segment collapse, and a written hook can only ever embed a canonical
+        // path to an existing file.
+        //
+        // The whole loop is exception-contained: this resolver's contract is that it
+        // returns a discriminated result and NEVER throws, and that has to hold for
+        // an injected boundary too — otherwise a filesystem error (whose message can
+        // carry a home-dir path or credential) escapes as a raw exception and defeats
+        // the sanitized `reason` this function exists to produce.
+        let canonical;
+        try {
+            canonical = deps.realpath(candidate);
+        }
+        catch {
+            continue;
+        }
+        if (canonical === null)
+            continue;
+        if (seen.has(canonical))
+            continue;
+        seen.add(canonical);
+        try {
+            if (deps.isFile(canonical))
+                return { ok: true, path: canonical };
+        }
+        catch {
+            continue;
+        }
+    }
+    return { ok: false, reason: CONDUCTOR_HOOK_BIN_UNRESOLVED_REASON };
+}
+/** `file://` URL → filesystem path, or `null` when the URL is unusable. */
+function moduleFilePath(moduleUrl) {
+    try {
+        return fileURLToPath(moduleUrl);
+    }
+    catch {
+        return null;
+    }
+}
+function defaultRealpath(filePath) {
+    try {
+        return realpathSync(filePath);
+    }
+    catch {
+        return null;
+    }
+}
+function defaultIsFile(filePath) {
+    try {
+        return statSync(filePath).isFile();
+    }
+    catch {
+        return false;
+    }
 }
 function wrapManagedBlock(body) {
     return [BRIDGE_CONDUCTOR_HOOK_START, body, BRIDGE_CONDUCTOR_HOOK_END].join("\n");
@@ -107,27 +217,56 @@ export function mergeManagedHookSnippet(existing, managedBlock) {
     const content = `${existing}${separator}${managedBlock}\n`;
     return { ok: true, content, action: "appended" };
 }
+/** Stable discriminator for an install that never touched the filesystem. */
+export const CONDUCTOR_BIN_UNRESOLVED_ERROR = "CONDUCTOR_BIN_UNRESOLVED";
 function snippetForHook(name, conductorBin) {
     return name === "post-commit"
         ? buildPostCommitHookSnippet(conductorBin)
         : buildReferenceTransactionHookSnippet(conductorBin);
 }
+/**
+ * Re-validate a resolution before it can reach a hook body. A success produced
+ * by an injected {@link GitHooksDeps.resolveBin} seam goes through the same
+ * realpath + regular-file rules the production resolver applies, so the seam can
+ * substitute a fixture binary but can never bypass validation.
+ */
+function validateResolvedBin(resolution) {
+    if (!resolution.ok)
+        return resolution;
+    const canonical = defaultRealpath(resolution.path);
+    if (canonical === null || !defaultIsFile(canonical)) {
+        return { ok: false, reason: CONDUCTOR_HOOK_BIN_UNRESOLVED_REASON };
+    }
+    return { ok: true, path: canonical };
+}
 /**
  * Install or update the managed `post-commit` and `reference-transaction` hooks.
  * Creates the hooks directory when needed and marks hook files executable on
  * POSIX. A non-worktree directory is reported as a degraded optional capability
  * (warning), never a fatal error.
+ *
+ * BAPI-772: the conductor binary is resolved and validated BEFORE any filesystem
+ * mutation. When it cannot be resolved this returns the failure variant and
+ * touches nothing — a dead hook is now structurally unwritable rather than
+ * silently installed. The generated runtime bodies are unchanged (detached,
+ * output discarded, `|| true`): only installation-time resolution is fail-loud.
  */
 export function installConductorGitHooks(deps = {}) {
     const platform = deps.platform ?? process.platform;
-    const conductorBin = deps.conductorBin ?? defaultConductorBin();
+    const resolution = validateResolvedBin(deps.resolveBin ? deps.resolveBin() : resolveConductorHookBin());
+    if (!resolution.ok) {
+        return { ok: false, error: CONDUCTOR_BIN_UNRESOLVED_ERROR, reason: resolution.reason };
+    }
+    const conductorBin = resolution.path;
     const { is_worktree, hooks_dir } = resolveGitHooksDirectory(deps);
     if (!is_worktree || hooks_dir === null) {
         return {
+            ok: true,
             is_worktree: false,
             hooks_dir: null,
             installed: [],
             warnings: ["not a git worktree; git hooks were not installed (degraded optional capability)"],
+            conductor_bin: conductorBin,
         };
     }
     const warnings = [];
@@ -166,7 +305,35 @@ export function installConductorGitHooks(deps = {}) {
         }
         installed.push({ name, path: hookPath, action: merge.action });
     }
-    return { is_worktree: true, hooks_dir, installed, warnings };
+    return { ok: true, is_worktree: true, hooks_dir, installed, warnings, conductor_bin: conductorBin };
+}
+/**
+ * Extract the JSON-quoted binary argument from the managed block's generated
+ * `node "<path>" git-hook ...` command (BAPI-772).
+ *
+ * Parsing is deliberately narrow rather than a general shell tokenization: only
+ * the exact command shape this module writes is recognized, and the quoted
+ * argument is read back with `JSON.parse` — the same encoding
+ * {@link buildPostCommitHookSnippet} used to write it, so a path containing
+ * spaces or quotes round-trips exactly. A hook that was hand-edited into an
+ * unrecognized shape yields `null` rather than a throw or a guess.
+ */
+export function extractManagedHookBinPath(content) {
+    const startIdx = content.indexOf(BRIDGE_CONDUCTOR_HOOK_START);
+    const endIdx = content.indexOf(BRIDGE_CONDUCTOR_HOOK_END);
+    if (startIdx === -1 || endIdx === -1 || endIdx <= startIdx)
+        return null;
+    const block = content.slice(startIdx, endIdx);
+    const match = /\bnode\s+("(?:[^"\\]|\\.)*")\s+git-hook\b/.exec(block);
+    if (match === null)
+        return null;
+    try {
+        const parsed = JSON.parse(match[1]);
+        return typeof parsed === "string" && parsed.length > 0 ? parsed : null;
+    }
+    catch {
+        return null;
+    }
 }
 /**
  * Inspect the managed git hooks WITHOUT modifying anything. Reports worktree
@@ -193,6 +360,8 @@ export function inspectConductorGitHooks(deps = {}) {
         const exists = existsSync(hookPath);
         let executable = false;
         let managedPresent = false;
+        let embeddedBinPath = null;
+        let embeddedBinIsFile = false;
         if (exists) {
             try {
                 const mode = statSync(hookPath).mode;
@@ -202,7 +371,24 @@ export function inspectConductorGitHooks(deps = {}) {
                 /* unreadable stat — leave executable false */
             }
             try {
-                managedPresent = readFileSync(hookPath, "utf-8").includes(BRIDGE_CONDUCTOR_HOOK_START);
+                const content = readFileSync(hookPath, "utf-8");
+                managedPresent = content.includes(BRIDGE_CONDUCTOR_HOOK_START);
+                if (managedPresent) {
+                    // BAPI-772: a managed block is not enough — the block written by an
+                    // older build can point at a binary that never existed. Stat the
+                    // embedded target READ-ONLY so a dead hook is visible instead of
+                    // reported healthy. Nothing here rewrites or canonicalizes the hook.
+                    embeddedBinPath = extractManagedHookBinPath(content);
+                    embeddedBinIsFile = embeddedBinPath !== null && defaultIsFile(embeddedBinPath);
+                    if (embeddedBinPath === null) {
+                        warnings.push(`${name} hook has a managed block with no recognizable conductor command; ` +
+                            "reinstall with `conductor install-git-hooks`");
+                    }
+                    else if (!embeddedBinIsFile) {
+                        warnings.push(`${name} hook points at a missing or invalid conductor binary (${embeddedBinPath}); ` +
+                            "the hook is dead — reinstall with `conductor install-git-hooks`");
+                    }
+                }
             }
             catch {
                 /* unreadable — leave managedPresent false */
@@ -211,8 +397,16 @@ export function inspectConductorGitHooks(deps = {}) {
         else {
             warnings.push(`${name} hook not installed (degraded optional capability)`);
         }
-        hooks.push({ name, path: hookPath, exists, executable, managed_block_present: managedPresent });
+        hooks.push({
+            name,
+            path: hookPath,
+            exists,
+            executable,
+            managed_block_present: managedPresent,
+            embedded_bin_path: embeddedBinPath,
+            embedded_bin_is_file: embeddedBinIsFile,
+        });
     }
-    const degraded = hooks.some((h) => !h.exists || !h.managed_block_present);
+    const degraded = hooks.some((h) => !h.exists || !h.managed_block_present || !h.embedded_bin_is_file);
     return { is_worktree: true, hooks_dir, hooks, warnings, degraded };
 }

package/build/conductor/install-doctor.js

@@ -17,13 +17,25 @@
  * additive: a change to any legacy builder cannot silently alter what the unified
  * doctor reports about it.
  *
+ * BAPI-775 adds three more named sections for the LOCAL conductor capabilities
+ * `install conductor` can now provision: host MCP profile-token presence,
+ * managed hook-target usability, and native ledger loadability. All three are
+ * DERIVED — from the shared read-only host-config inspector and from the legacy
+ * conductor report already composed above — so none of them re-probes anything
+ * or can drift from the report embedded beneath it. All three are non-fatal, so
+ * a missing local capability can never change
+ * {@link conductorInstallDoctorExitCode}.
+ *
  * STRICTLY READ-ONLY. No POST, no filesystem write, no install-state write, no
  * workflow scaffold, no schema migration, no hook installation. It is invoked
  * from a write-capable installer, so that boundary is pinned by tests.
  */
 import { readdir as fsReaddir, readFile as fsReadFile, stat as fsStat } from "node:fs/promises";
 import os from "node:os";
-import { buildConductorDoctorReport, formatConductorDoctorReport, } from "./doctor.js";
+import { buildConductorDoctorReport, describeNativeLedgerAvailability, formatConductorDoctorReport, } from "./doctor.js";
+import { MANAGED_HOOK_NAMES } from "./git-hooks.js";
+import { inspectBridgeApiProfileToken, } from "../mcp-host-config.js";
+import { MCP_PACKAGE_NAME } from "../mcp-identity.js";
 import { collectExecutorServiceDiagnostics, formatExecutorServiceDiagnosticsReport, } from "../doctor.js";
 import { collectInstallStatusChecks, formatInstallStatusReport, } from "../install-doctor.js";
 import { ConductorBridgeApiError, fetchConductorReadiness, } from "./bridge-api-client.js";
@@ -39,6 +51,26 @@ export const CONDUCTOR_OPERATOR_RUNBOOK_POINTER = "docs/claude/epic-conductor-v2
  */
 export const EXECUTOR_PROVISIONING_GUIDANCE = "`install conductor` writes the unit and starts it, each behind its own consent; " +
     "readiness still comes only from a live server observation";
+/**
+ * The `BRIDGE_MCP_PROFILE` token that makes the 8 conductor MCP tools visible.
+ *
+ * The tools are profile-gated, never core, and this is the only token that
+ * un-gates them — so the doctor names it explicitly rather than describing the
+ * gap abstractly (BAPI-775).
+ */
+export const CONDUCTOR_PROFILE_TOKEN = "conductor";
+/** Remediation for a host MCP config that carries no Bridge entry at all. */
+export const CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION = "no supported host MCP config carries a Bridge entry — run " +
+    `\`npx ${MCP_PACKAGE_NAME} install\` to register one, then re-run \`install conductor\`.`;
+/** Remediation for an entry that exists but lacks the conductor token. */
+export const CONDUCTOR_PROFILE_TOKEN_REMEDIATION = "re-run `install conductor` and accept the tool-visibility consent; the conductor " +
+    "tools become visible after the MCP client is restarted.";
+/** Remediation surfaced whenever the managed conductor hooks are not usable. */
+export const CONDUCTOR_HOOK_TARGET_REMEDIATION = "re-run `install conductor` and accept the local-observability consent, or run " +
+    "`conductor install-git-hooks` directly.";
+/** Remediation surfaced when the ledger's native binding does not load. */
+export const CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION = "`better-sqlite3` is an optionalDependency npm silently skips on a build failure — " +
+    "reinstall it for this Node runtime to restore local conductor observability.";
 /** Remediation surfaced whenever no healthy generated service unit is detected. */
 export const EXECUTOR_INSTALL_SERVICE_REMEDIATION = "generate a persistent unit with `install conductor --executor-id <id>` or " +
     "`executor install-service` (or run the executor by hand) — " +
@@ -382,6 +414,183 @@ function executorObservationSection(readiness) {
     };
 }
 // ---------------------------------------------------------------------------
+// Local conductor capability sections (BAPI-775)
+//
+// Three INDEPENDENT read-only checks — host profile token, managed hook targets,
+// native ledger loadability. All three are non-fatal by construction: a missing
+// local conductor capability is a repairable gap, and letting one flip
+// `conductorInstallDoctorExitCode` to 1 would make every ordinary install fail
+// on a capability it never asked for.
+// ---------------------------------------------------------------------------
+/**
+ * Whether this host looks like a conductor context.
+ *
+ * Composed from the two facts already collected: the resolved MCP-profile
+ * inspection (`BAPI_CONDUCTOR_ENABLED` or a registered epic-tick schedule) and
+ * the read-only host token inspection. Outside such a context a missing local
+ * capability is ADVISORY — reporting it as a gap would train operators of
+ * ordinary repositories to ignore this whole part of the report.
+ */
+function detectConductorContext(legacyConductor, profile) {
+    // Read defensively: an INJECTED report sentinel (and the installer's own
+    // degraded-doctor fallback) may populate only the fields a test cares about,
+    // and a doctor that throws on a partially-built report would abort the run it
+    // exists to diagnose. Same posture as the defensive legacy formatters below.
+    return (legacyConductor?.mcp_profile?.conductor_context_detected === true ||
+        profile?.tokenPresent === true);
+}
+/**
+ * Host MCP profile-token presence.
+ *
+ * Reports CONFIG IDENTIFIERS AND BOOLEANS ONLY — never an entry, an `env`
+ * object, a command line, an API key, or an unrelated profile token — and names
+ * only the three configs the merge path can write, so nothing here can imply
+ * that Codex or Copilot configuration was inspected or changed.
+ */
+function conductorProfileTokenSection(profile, conductorContext) {
+    const base = { id: "conductor-profile-token", label: "MCP conductor profile token" };
+    if (profile === null) {
+        return {
+            ...base,
+            status: "degraded",
+            detail: "the host MCP profile token could not be inspected",
+            remediation: CONDUCTOR_PROFILE_TOKEN_REMEDIATION,
+        };
+    }
+    const carrying = profile.configs
+        .filter((c) => c.state === "token-present")
+        .map((c) => c.path);
+    const scope = "inspected .mcp.json, .vscode/mcp.json, .cursor/mcp.json only " +
+        "(Codex and Copilot host configuration is not inspected)";
+    if (carrying.length > 0) {
+        return {
+            ...base,
+            status: "ok",
+            detail: `\`${profile.token}\` present in ${carrying.join(", ")}; ${scope}`,
+        };
+    }
+    // "No entry anywhere" and "an entry without the token" are different findings
+    // with different next steps, so they never collapse into one remediation.
+    const detail = profile.bridgeEntryPresent
+        ? `no supported host config carries the \`${profile.token}\` token; ${scope}`
+        : `no supported host config carries a Bridge entry; ${scope}`;
+    const remediation = profile.bridgeEntryPresent
+        ? CONDUCTOR_PROFILE_TOKEN_REMEDIATION
+        : CONDUCTOR_PROFILE_TOKEN_NO_ENTRY_REMEDIATION;
+    return conductorContext
+        ? { ...base, status: "degraded", detail, remediation }
+        : { ...base, status: "ok", detail: `advisory — ${detail}`, remediation };
+}
+/**
+ * Managed conductor hook targets, DERIVED from `legacyConductor.git_hooks`.
+ *
+ * Derived, never re-probed: a second parse of the same hook files is a second
+ * chance to disagree with the report embedded right below this section. Healthy
+ * requires each managed hook to exist, carry the managed block, and point at an
+ * embedded binary that stats as a regular file — a hook whose target vanished is
+ * a dead hook, and reporting it as installed is the exact failure BAPI-772 made
+ * structurally impossible at INSTALL time but which can still arise later.
+ *
+ * Renders hook NAME and boolean state only. The embedded absolute binary path is
+ * read for the file check and never copied into this section.
+ */
+function conductorHookTargetsSection(legacyConductor, conductorContext) {
+    const base = { id: "conductor-hook-targets", label: "Conductor hook targets" };
+    // Nullish, not `=== null`: an injected builder may resolve `undefined`, and a
+    // doctor that throws on it would abort the run it exists to diagnose.
+    if (legacyConductor === null || legacyConductor === undefined) {
+        return {
+            ...base,
+            status: "degraded",
+            detail: "hook targets could not be derived (the conductor doctor was not collected)",
+            remediation: CONDUCTOR_HOOK_TARGET_REMEDIATION,
+        };
+    }
+    // Defensive for the same reason as {@link detectConductorContext}: an injected
+    // sentinel need not carry every legacy field.
+    const hooks = legacyConductor.git_hooks;
+    if (hooks === undefined) {
+        return {
+            ...base,
+            status: "degraded",
+            detail: "hook targets could not be derived (the conductor doctor reported no hook state)",
+            remediation: CONDUCTOR_HOOK_TARGET_REMEDIATION,
+        };
+    }
+    if (!hooks.is_worktree) {
+        return {
+            ...base,
+            status: "ok",
+            detail: "advisory — not a git worktree, so no managed conductor hooks apply",
+        };
+    }
+    const usable = (name) => {
+        const hook = (hooks.hooks ?? []).find((h) => h.name === name);
+        return (hook !== undefined &&
+            hook.exists &&
+            hook.managed_block_present &&
+            hook.embedded_bin_is_file);
+    };
+    const rendered = MANAGED_HOOK_NAMES.map((name) => `${name}=${usable(name)}`).join(", ");
+    const allUsable = MANAGED_HOOK_NAMES.every((name) => usable(name));
+    if (allUsable) {
+        return { ...base, status: "ok", detail: `managed hooks usable: ${rendered}` };
+    }
+    const detail = `managed hooks usable: ${rendered}`;
+    return conductorContext
+        ? { ...base, status: "degraded", detail, remediation: CONDUCTOR_HOOK_TARGET_REMEDIATION }
+        : {
+            ...base,
+            status: "ok",
+            detail: `advisory — ${detail}`,
+            remediation: CONDUCTOR_HOOK_TARGET_REMEDIATION,
+        };
+}
+/**
+ * Native ledger loadability, DERIVED from `legacyConductor.native_ledger`.
+ *
+ * No parallel `better-sqlite3` check: the mapping from an inspection to
+ * available/degraded lives in one place ({@link describeNativeLedgerAvailability}),
+ * so this section and the conductor doctor can never disagree about whether the
+ * binding loads. A degraded result carries the module name, the ABI, and the
+ * sanitized failure kind, because the common cause is npm silently skipping an
+ * optionalDependency build and that is undiagnosable without the ABI.
+ */
+function conductorLedgerLoadabilitySection(legacyConductor) {
+    const base = {
+        id: "conductor-ledger-loadability",
+        label: "Conductor ledger loadability",
+    };
+    if (legacyConductor === null || legacyConductor === undefined) {
+        return {
+            ...base,
+            status: "degraded",
+            detail: "ledger loadability could not be derived (the conductor doctor was not collected)",
+            remediation: CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION,
+        };
+    }
+    const inspection = legacyConductor.native_ledger;
+    if (inspection === undefined) {
+        return {
+            ...base,
+            status: "degraded",
+            detail: "ledger loadability could not be derived (the conductor doctor reported no native-ledger state)",
+            remediation: CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION,
+        };
+    }
+    const availability = describeNativeLedgerAvailability(inspection);
+    if (availability.status === "available") {
+        return { ...base, status: "ok", detail: "ledger available — the native binding loads" };
+    }
+    return {
+        ...base,
+        status: "degraded",
+        detail: `ledger degraded — ${availability.module} did not load ` +
+            `(NODE_MODULE_VERSION ${availability.nodeModulesAbi}, failure: ${availability.failureKind})`,
+        remediation: CONDUCTOR_LEDGER_LOADABILITY_REMEDIATION,
+    };
+}
+// ---------------------------------------------------------------------------
 // Runner
 // ---------------------------------------------------------------------------
 async function inspectWorkflowPresence(readWorkflowFile) {
@@ -539,6 +748,26 @@ export async function runConductorInstallDoctor(deps) {
     // --- Server observation: the authoritative executor fact, last so it reads
     // as the conclusion of the three-part executor story.
     sections.push(executorObservationSection(readiness));
+    // --- Local conductor capabilities (BAPI-775): three independent read-only
+    // checks, appended after the executor story so they read as their own group.
+    // Every one of them is non-fatal, so none can change the doctor's exit code.
+    const inspectProfile = deps.inspectProfileToken ??
+        ((projectRoot, token) => inspectBridgeApiProfileToken(projectRoot, token, {
+            readFile: (filePath) => fsReadFile(filePath, "utf-8"),
+        }));
+    let profileToken = null;
+    try {
+        profileToken = await inspectProfile(deps.projectRoot ?? process.cwd(), CONDUCTOR_PROFILE_TOKEN);
+    }
+    catch {
+        // The shared inspector never throws for the ordinary absent/malformed
+        // cases; this guards an injected fake. A null inspection reports the
+        // collection gap rather than losing the section.
+    }
+    const conductorContext = detectConductorContext(legacyConductor, profileToken);
+    sections.push(conductorProfileTokenSection(profileToken, conductorContext));
+    sections.push(conductorHookTargetsSection(legacyConductor, conductorContext));
+    sections.push(conductorLedgerLoadabilitySection(legacyConductor));
     return {
         legacyConductor,
         legacyExecutorPreflight,