@cavuno/board 1.39.0 → 1.40.0

package/dist/bin.mjs

@@ -104,6 +104,156 @@ function summarize(results) {
   return { exitCode: failed.length > 0 ? 1 : 0, passed, failed, skipped };
 }
 
+// src/doctor/cookie-conformance.ts
+import { existsSync, readdirSync, readFileSync as readFileSync2, statSync } from "fs";
+import { join, relative } from "path";
+var COOKIE = record("static.cookie-codec", 1);
+var SOURCE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs|astro|svelte|vue)$/;
+var REMEDIATION = "set cookies only through the SDK server cookie codec (buildCookie/buildClearCookie from @cavuno/board/server)";
+var SET_COOKIE_SINK = /set-cookie/i;
+var DOCUMENT_COOKIE_ASSIGN = /document\.cookie\s*\+?=(?!=)/i;
+var DOMAIN_SCOPE = /domain\s*=/i;
+var LOOKAHEAD_LINES = 3;
+function stripComments(line) {
+  let out = "";
+  let i = 0;
+  let quote = null;
+  while (i < line.length) {
+    const c = line[i];
+    if (quote !== null) {
+      out += c;
+      if (c === "\\" && i + 1 < line.length) {
+        out += line[i + 1];
+        i += 2;
+        continue;
+      }
+      if (c === quote) quote = null;
+      i += 1;
+      continue;
+    }
+    if (c === "'" || c === '"' || c === "`") {
+      quote = c;
+      out += c;
+      i += 1;
+      continue;
+    }
+    if (c === "/" && i + 1 < line.length && line[i - 1] !== "\\") {
+      const next = line[i + 1];
+      if (next === "/") {
+        break;
+      }
+      if (next === "*") {
+        i += 2;
+        while (i < line.length) {
+          if (line[i] === "*" && i + 1 < line.length && line[i + 1] === "/") {
+            i += 2;
+            break;
+          }
+          i += 1;
+        }
+        continue;
+      }
+    }
+    out += c;
+    i += 1;
+  }
+  return out;
+}
+function isCommentLine(line) {
+  const trimmed = line.trim();
+  if (trimmed.startsWith("*")) return true;
+  return stripComments(line).trim() === "";
+}
+function hasCookieWriteSink(line) {
+  return SET_COOKIE_SINK.test(line) || DOCUMENT_COOKIE_ASSIGN.test(line);
+}
+function statementWindow(lines, sinkIdx) {
+  const sinkStripped = stripComments(lines[sinkIdx]);
+  const parts = [sinkStripped];
+  if (sinkStripped.includes(";")) return sinkStripped;
+  let taken = 0;
+  for (let j = sinkIdx + 1; j < lines.length && taken < LOOKAHEAD_LINES; j += 1) {
+    const next = lines[j];
+    if (isCommentLine(next)) continue;
+    const stripped = stripComments(next);
+    parts.push(stripped);
+    taken += 1;
+    if (stripped.includes(";")) break;
+  }
+  return parts.join("\n");
+}
+function isOffendingSink(lines, index) {
+  const line = lines[index];
+  if (isCommentLine(line)) return false;
+  const stripped = stripComments(line);
+  if (!hasCookieWriteSink(stripped)) return false;
+  return DOMAIN_SCOPE.test(statementWindow(lines, index));
+}
+function walkSourceFiles(dir, out) {
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    if (name === "node_modules" || name.startsWith(".")) continue;
+    const full = join(dir, name);
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      walkSourceFiles(full, out);
+    } else if (st.isFile() && SOURCE_EXT.test(name)) {
+      out.push(full);
+    }
+  }
+}
+function truncate(line, max = 120) {
+  const t = line.trim();
+  return t.length > max ? `${t.slice(0, max)}\u2026` : t;
+}
+function checkCookieCodecConformance(projectRoot) {
+  const srcDir = join(projectRoot, "src");
+  if (!existsSync(srcDir)) {
+    return [
+      COOKIE(
+        "skip",
+        "no src/ directory \u2014 cookie-codec conformance scan skipped"
+      )
+    ];
+  }
+  const files = [];
+  walkSourceFiles(srcDir, files);
+  const findings = [];
+  for (const file of files) {
+    const rel = relative(projectRoot, file).split("\\").join("/");
+    let text;
+    try {
+      text = readFileSync2(file, "utf8");
+    } catch {
+      continue;
+    }
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+      if (!isOffendingSink(lines, i)) continue;
+      findings.push(`${rel}:${i + 1} \u2014 ${truncate(lines[i])}`);
+    }
+  }
+  if (findings.length === 0) {
+    return [
+      COOKIE(
+        "pass",
+        "no domain-scoped Set-Cookie or document.cookie writes in src/"
+      )
+    ];
+  }
+  return [COOKIE("fail", `${findings.join("; ")}; ${REMEDIATION}`)];
+}
+
 // src/doctor/probe.ts
 var FETCH_TIMEOUT_MS = 1e4;
 async function probe(fetchImpl, url) {
@@ -223,14 +373,82 @@ async function runReadProbes(fetchImpl, frontendUrl) {
   ];
 }
 
+// src/doctor/sandbox.ts
+var SANDBOX_GATE = record("sandbox.persona-gate", 1);
+var EXPECTED_PERSONA_COUNT = 8;
+function skipSandboxPersonaGate(reason) {
+  return SANDBOX_GATE("skip", reason);
+}
+async function checkSandboxPersonaGate(fetchImpl, env, boardContext) {
+  if (boardContext === null) {
+    return SANDBOX_GATE(
+      "skip",
+      "board did not resolve \u2014 fix static.board first"
+    );
+  }
+  const url = `${apiBase(env.apiUrl)}/v1/boards/${encodeURIComponent(env.boardKey)}/sandbox/personas`;
+  const result = await probe(fetchImpl, url);
+  if (boardContext.sandbox !== true) {
+    return result.status === 404 ? SANDBOX_GATE(
+      "pass",
+      "sandbox persona endpoint refuses (404) on a non-sandbox board"
+    ) : SANDBOX_GATE(
+      "fail",
+      `sandbox persona endpoint is reachable on a NON-sandbox board (HTTP ${result.status}) \u2014 the capability gate is not holding`
+    );
+  }
+  if (!result.ok) {
+    return SANDBOX_GATE(
+      "fail",
+      `sandbox persona roster did not resolve (HTTP ${result.status}) \u2014 the persona seed may have failed`
+    );
+  }
+  let personas;
+  let password;
+  try {
+    const parsed = JSON.parse(result.body);
+    personas = parsed.personas;
+    password = parsed.password;
+  } catch {
+    return SANDBOX_GATE(
+      "fail",
+      "sandbox persona endpoint returned 200 but not JSON \u2014 proxy or captive portal in the way?"
+    );
+  }
+  if (!Array.isArray(personas) || personas.length !== EXPECTED_PERSONA_COUNT) {
+    return SANDBOX_GATE(
+      "fail",
+      `expected ${EXPECTED_PERSONA_COUNT} personas, got ${Array.isArray(personas) ? personas.length : "a non-array"} \u2014 the persona seed is incomplete`
+    );
+  }
+  const unseeded = personas.filter((persona) => persona.seeded !== true);
+  if (unseeded.length > 0) {
+    const ids = unseeded.map((persona) => typeof persona.id === "string" ? persona.id : "?").join(", ");
+    return SANDBOX_GATE(
+      "fail",
+      `${unseeded.length} of ${EXPECTED_PERSONA_COUNT} personas are not seeded on the board (${ids}) \u2014 the persona seed failed or was purged; run POST /v1/boards/{key}/sandbox/reseed to restore the roster`
+    );
+  }
+  if (typeof password !== "string" || password.length === 0) {
+    return SANDBOX_GATE(
+      "fail",
+      "roster present but the published password is missing"
+    );
+  }
+  return SANDBOX_GATE(
+    "pass",
+    `sandbox roster complete and seeded (${EXPECTED_PERSONA_COUNT} personas)`
+  );
+}
+
 // src/doctor/theme.ts
 import { createHash } from "crypto";
-import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { join } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join2 } from "path";
 var THEME = record("static.theme", 1);
 function checkThemeFreshness(projectRoot, context) {
-  const tokensPath = join(projectRoot, "src/tokens.css");
-  if (!existsSync(tokensPath)) {
+  const tokensPath = join2(projectRoot, "src/tokens.css");
+  if (!existsSync2(tokensPath)) {
     return [
       THEME(
         "skip",
@@ -238,9 +456,9 @@ function checkThemeFreshness(projectRoot, context) {
       )
     ];
   }
-  const tokensHash = createHash("sha256").update(readFileSync2(tokensPath, "utf8"), "utf8").digest("hex");
-  const resolvedPath = join(projectRoot, "src/theme/resolved.ts");
-  const resolvedHash = existsSync(resolvedPath) ? readFileSync2(resolvedPath, "utf8").match(
+  const tokensHash = createHash("sha256").update(readFileSync3(tokensPath, "utf8"), "utf8").digest("hex");
+  const resolvedPath = join2(projectRoot, "src/theme/resolved.ts");
+  const resolvedHash = existsSync2(resolvedPath) ? readFileSync3(resolvedPath, "utf8").match(
     /tokensHash = '([0-9a-f]{64})'/
   )?.[1] ?? null : null;
   if (resolvedHash !== tokensHash) {
@@ -480,8 +698,8 @@ async function runWriteProbes(options) {
 }
 
 // src/doctor/run.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "fs";
+import { join as join3 } from "path";
 var STATIC_API = record("static.api", 1);
 var STATIC_BOARD = record("static.board", 1);
 var STATIC_SKILLS = record("static.skills", 1);
@@ -547,8 +765,8 @@ var SKILL_ROOTS = [
   ".cursor/skills"
 ];
 function checkSkillsFreshness(projectRoot) {
-  const roots = SKILL_ROOTS.map((root) => join2(projectRoot, root)).filter(
-    (root) => existsSync2(root)
+  const roots = SKILL_ROOTS.map((root) => join3(projectRoot, root)).filter(
+    (root) => existsSync3(root)
   );
   if (roots.length === 0) {
     return STATIC_SKILLS(
@@ -561,10 +779,10 @@ function checkSkillsFreshness(projectRoot) {
   const seen = /* @__PURE__ */ new Set();
   for (const root of roots) {
     for (const skill of corpus.skills) {
-      const copied = join2(root, skill.name, "SKILL.md");
-      if (!existsSync2(copied)) continue;
+      const copied = join3(root, skill.name, "SKILL.md");
+      if (!existsSync3(copied)) continue;
       seen.add(skill.name);
-      if (readFileSync3(copied, "utf8") !== skill.content) {
+      if (readFileSync4(copied, "utf8") !== skill.content) {
         stale.add(skill.name);
       }
     }
@@ -614,6 +832,12 @@ async function runDoctor(options) {
   results.push(
     ...checkThemeFreshness(options.projectRoot ?? process.cwd(), boardContext)
   );
+  results.push(
+    ...checkCookieCodecConformance(options.projectRoot ?? process.cwd())
+  );
+  results.push(
+    envOk ? await checkSandboxPersonaGate(fetchImpl, env, boardContext) : skipSandboxPersonaGate("env checks failed \u2014 fix them first")
+  );
   results.push(
     ...options.frontendUrl ? await runReadProbes(fetchImpl, options.frontendUrl) : skipReadProbes("no --frontend <url> given")
   );
@@ -640,12 +864,12 @@ async function runDoctor(options) {
 }
 
 // src/setup/run.ts
-import { cpSync, existsSync as existsSync3, mkdirSync, readFileSync as readFileSync4 } from "fs";
+import { cpSync, existsSync as existsSync4, mkdirSync, readFileSync as readFileSync5 } from "fs";
 import { dirname as dirname2, resolve as resolve2 } from "path";
 function detectFramework(cwd) {
   const pkgPath = resolve2(cwd, "package.json");
-  if (!existsSync3(pkgPath)) return null;
-  const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+  if (!existsSync4(pkgPath)) return null;
+  const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
   const deps = { ...pkg.dependencies, ...pkg.devDependencies };
   if (deps["@tanstack/react-start"]) return "tanstack-start";
   return null;
@@ -662,7 +886,7 @@ function runSetup(cwd = process.cwd()) {
     resolve2(cwd, ".codex", "skills"),
     resolve2(cwd, ".cursor", "skills")
   ];
-  const existing = roots.filter((root) => existsSync3(root));
+  const existing = roots.filter((root) => existsSync4(root));
   const targetDirs = existing.length > 0 ? existing : [roots[0]];
   const copied = [];
   for (const targetDir of targetDirs) {

package/dist/{board-RfZEAJse.d.ts → board-BxPUtrOl.d.ts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DxC1ze93.js';
+import { S as Schemas } from './_spec-DRbgPIlN.js';
 
 type PublicBoard = Schemas['PublicBoardContext'];
 type PublicBoardFeatures = PublicBoard['features'];

package/dist/{board-CqYibYUA.d.mts → board-DCiNpgFf.d.mts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-DxC1ze93.mjs';
+import { S as Schemas } from './_spec-DRbgPIlN.mjs';
 
 type PublicBoard = Schemas['PublicBoardContext'];
 type PublicBoardFeatures = PublicBoard['features'];

package/dist/doctor.js

@@ -132,6 +132,156 @@ function summarize(results) {
   return { exitCode: failed.length > 0 ? 1 : 0, passed, failed, skipped };
 }
 
+// src/doctor/cookie-conformance.ts
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
+var COOKIE = record("static.cookie-codec", 1);
+var SOURCE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs|astro|svelte|vue)$/;
+var REMEDIATION = "set cookies only through the SDK server cookie codec (buildCookie/buildClearCookie from @cavuno/board/server)";
+var SET_COOKIE_SINK = /set-cookie/i;
+var DOCUMENT_COOKIE_ASSIGN = /document\.cookie\s*\+?=(?!=)/i;
+var DOMAIN_SCOPE = /domain\s*=/i;
+var LOOKAHEAD_LINES = 3;
+function stripComments(line) {
+  let out = "";
+  let i = 0;
+  let quote = null;
+  while (i < line.length) {
+    const c = line[i];
+    if (quote !== null) {
+      out += c;
+      if (c === "\\" && i + 1 < line.length) {
+        out += line[i + 1];
+        i += 2;
+        continue;
+      }
+      if (c === quote) quote = null;
+      i += 1;
+      continue;
+    }
+    if (c === "'" || c === '"' || c === "`") {
+      quote = c;
+      out += c;
+      i += 1;
+      continue;
+    }
+    if (c === "/" && i + 1 < line.length && line[i - 1] !== "\\") {
+      const next = line[i + 1];
+      if (next === "/") {
+        break;
+      }
+      if (next === "*") {
+        i += 2;
+        while (i < line.length) {
+          if (line[i] === "*" && i + 1 < line.length && line[i + 1] === "/") {
+            i += 2;
+            break;
+          }
+          i += 1;
+        }
+        continue;
+      }
+    }
+    out += c;
+    i += 1;
+  }
+  return out;
+}
+function isCommentLine(line) {
+  const trimmed = line.trim();
+  if (trimmed.startsWith("*")) return true;
+  return stripComments(line).trim() === "";
+}
+function hasCookieWriteSink(line) {
+  return SET_COOKIE_SINK.test(line) || DOCUMENT_COOKIE_ASSIGN.test(line);
+}
+function statementWindow(lines, sinkIdx) {
+  const sinkStripped = stripComments(lines[sinkIdx]);
+  const parts = [sinkStripped];
+  if (sinkStripped.includes(";")) return sinkStripped;
+  let taken = 0;
+  for (let j = sinkIdx + 1; j < lines.length && taken < LOOKAHEAD_LINES; j += 1) {
+    const next = lines[j];
+    if (isCommentLine(next)) continue;
+    const stripped = stripComments(next);
+    parts.push(stripped);
+    taken += 1;
+    if (stripped.includes(";")) break;
+  }
+  return parts.join("\n");
+}
+function isOffendingSink(lines, index) {
+  const line = lines[index];
+  if (isCommentLine(line)) return false;
+  const stripped = stripComments(line);
+  if (!hasCookieWriteSink(stripped)) return false;
+  return DOMAIN_SCOPE.test(statementWindow(lines, index));
+}
+function walkSourceFiles(dir, out) {
+  let entries;
+  try {
+    entries = (0, import_node_fs2.readdirSync)(dir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    if (name === "node_modules" || name.startsWith(".")) continue;
+    const full = (0, import_node_path2.join)(dir, name);
+    let st;
+    try {
+      st = (0, import_node_fs2.statSync)(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      walkSourceFiles(full, out);
+    } else if (st.isFile() && SOURCE_EXT.test(name)) {
+      out.push(full);
+    }
+  }
+}
+function truncate(line, max = 120) {
+  const t = line.trim();
+  return t.length > max ? `${t.slice(0, max)}\u2026` : t;
+}
+function checkCookieCodecConformance(projectRoot) {
+  const srcDir = (0, import_node_path2.join)(projectRoot, "src");
+  if (!(0, import_node_fs2.existsSync)(srcDir)) {
+    return [
+      COOKIE(
+        "skip",
+        "no src/ directory \u2014 cookie-codec conformance scan skipped"
+      )
+    ];
+  }
+  const files = [];
+  walkSourceFiles(srcDir, files);
+  const findings = [];
+  for (const file of files) {
+    const rel = (0, import_node_path2.relative)(projectRoot, file).split("\\").join("/");
+    let text;
+    try {
+      text = (0, import_node_fs2.readFileSync)(file, "utf8");
+    } catch {
+      continue;
+    }
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+      if (!isOffendingSink(lines, i)) continue;
+      findings.push(`${rel}:${i + 1} \u2014 ${truncate(lines[i])}`);
+    }
+  }
+  if (findings.length === 0) {
+    return [
+      COOKIE(
+        "pass",
+        "no domain-scoped Set-Cookie or document.cookie writes in src/"
+      )
+    ];
+  }
+  return [COOKIE("fail", `${findings.join("; ")}; ${REMEDIATION}`)];
+}
+
 // src/doctor/probe.ts
 var FETCH_TIMEOUT_MS = 1e4;
 async function probe(fetchImpl, url) {
@@ -251,14 +401,82 @@ async function runReadProbes(fetchImpl, frontendUrl) {
   ];
 }
 
+// src/doctor/sandbox.ts
+var SANDBOX_GATE = record("sandbox.persona-gate", 1);
+var EXPECTED_PERSONA_COUNT = 8;
+function skipSandboxPersonaGate(reason) {
+  return SANDBOX_GATE("skip", reason);
+}
+async function checkSandboxPersonaGate(fetchImpl, env, boardContext) {
+  if (boardContext === null) {
+    return SANDBOX_GATE(
+      "skip",
+      "board did not resolve \u2014 fix static.board first"
+    );
+  }
+  const url = `${apiBase(env.apiUrl)}/v1/boards/${encodeURIComponent(env.boardKey)}/sandbox/personas`;
+  const result = await probe(fetchImpl, url);
+  if (boardContext.sandbox !== true) {
+    return result.status === 404 ? SANDBOX_GATE(
+      "pass",
+      "sandbox persona endpoint refuses (404) on a non-sandbox board"
+    ) : SANDBOX_GATE(
+      "fail",
+      `sandbox persona endpoint is reachable on a NON-sandbox board (HTTP ${result.status}) \u2014 the capability gate is not holding`
+    );
+  }
+  if (!result.ok) {
+    return SANDBOX_GATE(
+      "fail",
+      `sandbox persona roster did not resolve (HTTP ${result.status}) \u2014 the persona seed may have failed`
+    );
+  }
+  let personas;
+  let password;
+  try {
+    const parsed = JSON.parse(result.body);
+    personas = parsed.personas;
+    password = parsed.password;
+  } catch {
+    return SANDBOX_GATE(
+      "fail",
+      "sandbox persona endpoint returned 200 but not JSON \u2014 proxy or captive portal in the way?"
+    );
+  }
+  if (!Array.isArray(personas) || personas.length !== EXPECTED_PERSONA_COUNT) {
+    return SANDBOX_GATE(
+      "fail",
+      `expected ${EXPECTED_PERSONA_COUNT} personas, got ${Array.isArray(personas) ? personas.length : "a non-array"} \u2014 the persona seed is incomplete`
+    );
+  }
+  const unseeded = personas.filter((persona) => persona.seeded !== true);
+  if (unseeded.length > 0) {
+    const ids = unseeded.map((persona) => typeof persona.id === "string" ? persona.id : "?").join(", ");
+    return SANDBOX_GATE(
+      "fail",
+      `${unseeded.length} of ${EXPECTED_PERSONA_COUNT} personas are not seeded on the board (${ids}) \u2014 the persona seed failed or was purged; run POST /v1/boards/{key}/sandbox/reseed to restore the roster`
+    );
+  }
+  if (typeof password !== "string" || password.length === 0) {
+    return SANDBOX_GATE(
+      "fail",
+      "roster present but the published password is missing"
+    );
+  }
+  return SANDBOX_GATE(
+    "pass",
+    `sandbox roster complete and seeded (${EXPECTED_PERSONA_COUNT} personas)`
+  );
+}
+
 // src/doctor/theme.ts
 var import_node_crypto = require("crypto");
-var import_node_fs2 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs3 = require("fs");
+var import_node_path3 = require("path");
 var THEME = record("static.theme", 1);
 function checkThemeFreshness(projectRoot, context) {
-  const tokensPath = (0, import_node_path2.join)(projectRoot, "src/tokens.css");
-  if (!(0, import_node_fs2.existsSync)(tokensPath)) {
+  const tokensPath = (0, import_node_path3.join)(projectRoot, "src/tokens.css");
+  if (!(0, import_node_fs3.existsSync)(tokensPath)) {
     return [
       THEME(
         "skip",
@@ -266,9 +484,9 @@ function checkThemeFreshness(projectRoot, context) {
       )
     ];
   }
-  const tokensHash = (0, import_node_crypto.createHash)("sha256").update((0, import_node_fs2.readFileSync)(tokensPath, "utf8"), "utf8").digest("hex");
-  const resolvedPath = (0, import_node_path2.join)(projectRoot, "src/theme/resolved.ts");
-  const resolvedHash = (0, import_node_fs2.existsSync)(resolvedPath) ? (0, import_node_fs2.readFileSync)(resolvedPath, "utf8").match(
+  const tokensHash = (0, import_node_crypto.createHash)("sha256").update((0, import_node_fs3.readFileSync)(tokensPath, "utf8"), "utf8").digest("hex");
+  const resolvedPath = (0, import_node_path3.join)(projectRoot, "src/theme/resolved.ts");
+  const resolvedHash = (0, import_node_fs3.existsSync)(resolvedPath) ? (0, import_node_fs3.readFileSync)(resolvedPath, "utf8").match(
     /tokensHash = '([0-9a-f]{64})'/
   )?.[1] ?? null : null;
   if (resolvedHash !== tokensHash) {
@@ -508,8 +726,8 @@ async function runWriteProbes(options) {
 }
 
 // src/doctor/run.ts
-var import_node_fs3 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs4 = require("fs");
+var import_node_path4 = require("path");
 var STATIC_API = record("static.api", 1);
 var STATIC_BOARD = record("static.board", 1);
 var STATIC_SKILLS = record("static.skills", 1);
@@ -575,8 +793,8 @@ var SKILL_ROOTS = [
   ".cursor/skills"
 ];
 function checkSkillsFreshness(projectRoot) {
-  const roots = SKILL_ROOTS.map((root) => (0, import_node_path3.join)(projectRoot, root)).filter(
-    (root) => (0, import_node_fs3.existsSync)(root)
+  const roots = SKILL_ROOTS.map((root) => (0, import_node_path4.join)(projectRoot, root)).filter(
+    (root) => (0, import_node_fs4.existsSync)(root)
   );
   if (roots.length === 0) {
     return STATIC_SKILLS(
@@ -589,10 +807,10 @@ function checkSkillsFreshness(projectRoot) {
   const seen = /* @__PURE__ */ new Set();
   for (const root of roots) {
     for (const skill of corpus.skills) {
-      const copied = (0, import_node_path3.join)(root, skill.name, "SKILL.md");
-      if (!(0, import_node_fs3.existsSync)(copied)) continue;
+      const copied = (0, import_node_path4.join)(root, skill.name, "SKILL.md");
+      if (!(0, import_node_fs4.existsSync)(copied)) continue;
       seen.add(skill.name);
-      if ((0, import_node_fs3.readFileSync)(copied, "utf8") !== skill.content) {
+      if ((0, import_node_fs4.readFileSync)(copied, "utf8") !== skill.content) {
         stale.add(skill.name);
       }
     }
@@ -642,6 +860,12 @@ async function runDoctor(options) {
   results.push(
     ...checkThemeFreshness(options.projectRoot ?? process.cwd(), boardContext)
   );
+  results.push(
+    ...checkCookieCodecConformance(options.projectRoot ?? process.cwd())
+  );
+  results.push(
+    envOk ? await checkSandboxPersonaGate(fetchImpl, env, boardContext) : skipSandboxPersonaGate("env checks failed \u2014 fix them first")
+  );
   results.push(
     ...options.frontendUrl ? await runReadProbes(fetchImpl, options.frontendUrl) : skipReadProbes("no --frontend <url> given")
   );