@clearlydev/nx-archweave 0.2.1 → 0.3.0

package/dist/generators/doctor/generator.js

@@ -288,6 +288,30 @@ function buildOverEngineeringPrompt(locale) {
   return [...body, "", renderFindingSchemaInstruction(locale, OVER_ENGINEERING_PRIORITIES), "", renderDedupInstruction(locale)].join("\n");
 }
 
+// ../review-policy/dist/verdict-gate/verdict-comment.js
+var VERDICT_MARKER = "<!-- archweave-verdict -->";
+function renderCommitLine(locale, shortSha) {
+  return locale === "en" ? `<sub>Commit \`${shortSha}\` \xB7 this comment is updated on every review round.</sub>` : `<sub>\uCEE4\uBC0B \`${shortSha}\` \xB7 \uC774 \uCF54\uBA58\uD2B8\uB294 \uB9AC\uBDF0 \uB77C\uC6B4\uB4DC\uB9C8\uB2E4 \uAC31\uC2E0\uB429\uB2C8\uB2E4.</sub>`;
+}
+var NOT_RUN_REASON = {
+  en: {
+    secret: (secretName) => `the ${secretName} secret is not registered`,
+    fork: () => "this pull request comes from a fork, and GitHub passes no secrets to runs from forks",
+    dependabot: (secretName) => `Dependabot runs receive only Dependabot secrets, and ${secretName} is not one of them`,
+    rounds: (_secretName, maxRounds) => `the automated review round limit (${maxRounds}) is reached`
+  },
+  ko: {
+    secret: (secretName) => `${secretName} \uC2DC\uD06C\uB9BF\uC774 \uB4F1\uB85D\uB418\uC9C0 \uC54A\uC74C`,
+    fork: () => "\uD3EC\uD06C\uC5D0\uC11C \uC628 pull request\uC774\uACE0, GitHub\uB294 \uD3EC\uD06C \uC2E4\uD589\uC5D0 \uC2DC\uD06C\uB9BF\uC744 \uB118\uAE30\uC9C0 \uC54A\uC74C",
+    dependabot: (secretName) => `Dependabot \uC2E4\uD589\uC740 Dependabot \uC2DC\uD06C\uB9BF\uB9CC \uBC1B\uB294\uB370, ${secretName}\uB294 \uADF8\uC911\uC5D0 \uC5C6\uC74C`,
+    rounds: (_secretName, maxRounds) => `\uC790\uB3D9 \uB9AC\uBDF0 \uB77C\uC6B4\uB4DC \uD55C\uB3C4(${maxRounds})\uC5D0 \uB3C4\uB2EC\uD568`
+  }
+};
+function renderNotRunNotice(locale, reason, secretName, maxRounds) {
+  const why = NOT_RUN_REASON[locale][reason](secretName, maxRounds);
+  return locale === "en" ? `AI review did not run for this commit (${why}). A green check here does not mean the change was reviewed.` : `\uC774 \uCEE4\uBC0B\uC5D0\uB294 AI \uB9AC\uBDF0\uAC00 \uC2E4\uD589\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4(${why}). \uC774 green \uCCB4\uD06C\uB294 \uBCC0\uACBD \uC0AC\uD56D\uC774 \uB9AC\uBDF0\uB418\uC5C8\uB2E4\uB294 \uB73B\uC774 \uC544\uB2D9\uB2C8\uB2E4.`;
+}
+
 // ../review-policy/dist/verdict-gate/verdict-gate.js
 var ROUND_MARKER = "<!-- archweave-review-round -->";
 
@@ -320,13 +344,14 @@ function renderConcurrencyBlock() {
     "  cancel-in-progress: false"
   ].join("\n");
 }
-function renderPermissionsBlock() {
-  return ["permissions:", "  contents: read", "  pull-requests: write", "  id-token: write"].join("\n");
+var REVIEW_GATE_CONDITION = "steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
+function renderReviewPermissions(idToken) {
+  return ["permissions:", "  contents: read", "  pull-requests: write", ...idToken ? ["  id-token: write"] : []].join("\n");
 }
 function renderCheckoutStep(gateCondition, extraWith = []) {
   return [
     "- name: Checkout repository",
-    `  if: ${gateCondition}`,
+    ...gateCondition === void 0 ? [] : [`  if: ${gateCondition}`],
     `  uses: ${pinnedUses("actions/checkout")}`,
     "  with:",
     ...extraWith.map((line) => `    ${line}`),
@@ -368,10 +393,84 @@ function renderRoundGateStep(maxRounds) {
     "    fi"
   ].join("\n");
 }
+function shellQuote(text) {
+  return `'${text.replace(/'/g, `'\\''`)}'`;
+}
+function renderNotRunFunction(secretName, maxRounds, locale) {
+  const reasons = ["secret", "fork", "dependabot", "rounds"];
+  const [commitBefore, commitAfter] = renderCommitLine(locale, "\0").split("\0");
+  return [
+    "not_run() {",
+    '  case "$1" in',
+    ...reasons.map((reason) => `    ${reason}) annotation=${shellQuote(renderNotRunNotice("en", reason, secretName, maxRounds))}; notice=${shellQuote(renderNotRunNotice(locale, reason, secretName, maxRounds))} ;;`),
+    "  esac",
+    '  echo "::notice title=AI review did not run::$annotation"',
+    `  printf '%s\\n' "$notice" >> "$GITHUB_STEP_SUMMARY"`,
+    `  short_sha=$(printf '%s' "$HEAD_SHA" | cut -c1-7)`,
+    '  case "$short_sha" in',
+    "    '' | *[!0-9a-f]*) short_sha= ;;",
+    "  esac",
+    "  {",
+    '    echo "notice-body<<ARCHWEAVE_NOT_RUN_EOF"',
+    `    printf '%s\\n' ${shellQuote(VERDICT_MARKER)} "\u2139\uFE0F $notice"`,
+    `    if [ -n "$short_sha" ]; then printf '\\n%s\\n' ${shellQuote(commitBefore)}"$short_sha"${shellQuote(commitAfter)}; fi`,
+    '    echo "ARCHWEAVE_NOT_RUN_EOF"',
+    '    echo "run=false"',
+    '  } >> "$GITHUB_OUTPUT"',
+    "}"
+  ];
+}
+var JUDGE_CONDITION = "steps.ai-review-result.outputs.run == 'true'";
+function renderAiReviewResultStep(secretName, maxRounds, locale) {
+  return [
+    "- name: Check the AI review result",
+    "  id: ai-review-result",
+    "  env:",
+    "    AI_REVIEW_RESULT: ${{ needs.ai-review.result }}",
+    "    REVIEW_ENABLED: ${{ needs.ai-review.outputs.enabled }}",
+    "    REVIEW_ALLOWED: ${{ needs.ai-review.outputs.allowed }}",
+    "    LAST_COMMENT_ID: ${{ needs.ai-review.outputs.last-comment-id }}",
+    "    HEAD_SHA: ${{ github.event.pull_request.head.sha }}",
+    "    HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}",
+    "    REPOSITORY: ${{ github.repository }}",
+    "    PR_AUTHOR: ${{ github.event.pull_request.user.login }}",
+    "  run: |",
+    ...renderNotRunFunction(secretName, maxRounds, locale).map((line) => `    ${line}`),
+    '    if [ "$AI_REVIEW_RESULT" != success ]; then',
+    `      echo "::error title=AI review did not succeed::The AI review job ended with '$AI_REVIEW_RESULT'."`,
+    "      exit 1",
+    "    fi",
+    '    case "$REVIEW_ENABLED/$REVIEW_ALLOWED" in',
+    "      false/*)",
+    '        if [ "$HEAD_REPOSITORY" != "$REPOSITORY" ]; then not_run fork',
+    `        elif [ "$PR_AUTHOR" = 'dependabot[bot]' ]; then not_run dependabot`,
+    "        else not_run secret",
+    "        fi",
+    "        exit 0",
+    "        ;;",
+    "      true/false)",
+    "        not_run rounds",
+    "        exit 0",
+    "        ;;",
+    "      true/true)",
+    '        case "$LAST_COMMENT_ID" in',
+    "          '' | *[!0-9]*) ;;",
+    "          *)",
+    '            echo "run=true" >> "$GITHUB_OUTPUT"',
+    "            exit 0",
+    "            ;;",
+    "        esac",
+    "        ;;",
+    "    esac",
+    `    echo "::error title=Review verdict not computed::The AI review job's results did not reach this job, so no verdict can be computed. Re-run all jobs."`,
+    "    exit 1"
+  ].join("\n");
+}
 function renderVerdictGateStep(maxRounds, locale) {
   return [
     "- name: Compute review verdict",
-    "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'",
+    "  id: verdict",
+    `  if: ${JUDGE_CONDITION}`,
     "  env:",
     "    GH_TOKEN: ${{ github.token }}",
     "    GITHUB_REPOSITORY: ${{ github.repository }}",
@@ -379,7 +478,8 @@ function renderVerdictGateStep(maxRounds, locale) {
     `    ARCHWEAVE_MAX_ROUNDS: '${maxRounds}'`,
     `    ARCHWEAVE_LOCALE: '${locale}'`,
     "    ARCHWEAVE_HEAD_SHA: ${{ github.event.pull_request.head.sha }}",
-    "    ARCHWEAVE_ROUND_AFTER_ID: ${{ steps.round-gate.outputs.last-comment-id }}",
+    "    ARCHWEAVE_ROUND_AFTER_ID: ${{ needs.ai-review.outputs.last-comment-id }}",
+    "    ARCHWEAVE_VERDICT_OUTPUT: 'github-output'",
     "  run: |",
     "    if [ -x node_modules/.bin/archweave-review-verdict ]; then",
     "      node_modules/.bin/archweave-review-verdict",
@@ -388,16 +488,49 @@ function renderVerdictGateStep(maxRounds, locale) {
     "    fi"
   ].join("\n");
 }
+function renderBlockStep() {
+  return [
+    "- name: Fail on a blocking verdict",
+    "  if: steps.verdict.outputs.blocked == 'true'",
+    "  run: |",
+    '    echo "The review check failed: the verdict is BLOCK, or the AI review left no readable summary. See the verdict comment on this pull request."',
+    "    exit 1"
+  ].join("\n");
+}
+function renderVerdictCommentStep() {
+  return [
+    "- name: Post review verdict",
+    "  env:",
+    "    GH_TOKEN: ${{ github.token }}",
+    "    REPOSITORY: ${{ github.repository }}",
+    "    PR_NUMBER: ${{ github.event.pull_request.number }}",
+    "    VERDICT_BODY: ${{ needs.review.outputs.comment-body }}",
+    "    PREVIOUS_ID: ${{ needs.review.outputs.previous-comment-id }}",
+    "  run: |",
+    `    payload=$(jq -n --arg body "$VERDICT_BODY" '{body: $body}')`,
+    '    if [ -z "$PREVIOUS_ID" ]; then',
+    `      PREVIOUS_ID=$(gh api "repos/$REPOSITORY/issues/$PR_NUMBER/comments" --paginate --jq '.[] | select(.user.login == "github-actions[bot]") | select(.body | contains("${VERDICT_MARKER}")) | .id' | tail -n 1) || PREVIOUS_ID=`,
+    "    fi",
+    '    case "$PREVIOUS_ID" in',
+    "      ''|*[!0-9]*) PREVIOUS_ID= ;;",
+    "    esac",
+    `    if [ -n "$PREVIOUS_ID" ] && printf '%s' "$payload" | gh api -X PATCH "repos/$REPOSITORY/issues/comments/$PREVIOUS_ID" --input - > /dev/null; then`,
+    "      exit 0",
+    "    fi",
+    `    printf '%s' "$payload" | gh api -X POST "repos/$REPOSITORY/issues/$PR_NUMBER/comments" --input - > /dev/null \\`,
+    '      || echo "Could not post the verdict comment (continuing)."'
+  ].join("\n");
+}
 var SETUP_NODE_VERSION = "22";
 var FALLBACK_PNPM_VERSION = "10";
 var INSTALL_LINES = {
-  pnpm: ["    pnpm install --frozen-lockfile"],
-  npm: ["    npm ci"],
+  pnpm: ["    pnpm install --frozen-lockfile --ignore-scripts"],
+  npm: ["    npm ci --ignore-scripts"],
   yarn: [
     "    corepack enable yarn",
-    '    if [ "$(yarn --version | cut -d. -f1)" -ge 2 ]; then yarn install --immutable; else yarn install --frozen-lockfile; fi'
+    '    if [ "$(yarn --version | cut -d. -f1)" -ge 2 ]; then YARN_ENABLE_SCRIPTS=false yarn install --immutable --mode=skip-build; else yarn install --frozen-lockfile --ignore-scripts; fi'
   ],
-  bun: ["    bun install --frozen-lockfile"]
+  bun: ["    bun install --frozen-lockfile --ignore-scripts"]
 };
 function renderPnpmVersionStep(gate) {
   return [
@@ -413,7 +546,7 @@ function renderPnpmVersionStep(gate) {
   ].join("\n");
 }
 function renderWorkspaceSetupSteps(packageManager) {
-  const gate = "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
+  const gate = `  if: ${JUDGE_CONDITION}`;
   const steps = [];
   if (packageManager === "pnpm") {
     steps.push(renderPnpmVersionStep(gate));
@@ -448,21 +581,89 @@ function renderWorkspaceSetupSteps(packageManager) {
   ].join("\n"));
   return steps.join("\n\n");
 }
+var REVIEW_JOB_TIMEOUT_MINUTES = 15;
+function renderReviewWorkflow(input, parts) {
+  const aiReviewSteps = [renderSecretGateStep(parts.secretName), renderRoundGateStep(input.maxRounds), ...parts.reviewSteps];
+  const reviewSteps = [
+    renderAiReviewResultStep(parts.secretName, input.maxRounds, input.locale),
+    renderCheckoutStep(JUDGE_CONDITION),
+    renderWorkspaceSetupSteps(input.packageManager),
+    renderVerdictGateStep(input.maxRounds, input.locale),
+    renderBlockStep()
+  ];
+  return [
+    `name: ${parts.name}`,
+    "",
+    renderTriggerBlock(),
+    "",
+    renderConcurrencyBlock(),
+    "",
+    "permissions: {}",
+    "",
+    "jobs:",
+    "  ai-review:",
+    "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${REVIEW_JOB_TIMEOUT_MINUTES}`,
+    indentBlock(renderReviewPermissions(parts.idToken), 4),
+    "    outputs:",
+    "      enabled: ${{ steps.secret-gate.outputs.enabled }}",
+    "      allowed: ${{ steps.round-gate.outputs.allowed }}",
+    "      last-comment-id: ${{ steps.round-gate.outputs.last-comment-id }}",
+    "    steps:",
+    indentBlock(aiReviewSteps.join("\n\n"), 6),
+    "",
+    "  review:",
+    "    needs: ai-review",
+    "    if: always()",
+    "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${REVIEW_JOB_TIMEOUT_MINUTES}`,
+    "    permissions:",
+    "      contents: read",
+    "      pull-requests: read",
+    "    outputs:",
+    "      comment-body: ${{ steps.verdict.outputs.comment-body || steps.ai-review-result.outputs.notice-body }}",
+    "      previous-comment-id: ${{ steps.verdict.outputs.previous-comment-id }}",
+    "    steps:",
+    indentBlock(reviewSteps.join("\n\n"), 6),
+    "",
+    "  review-comment:",
+    "    needs: review",
+    // Runs after a BLOCK failed the review job, too: the comment explains the red check.
+    "    if: ${{ !cancelled() && needs.review.outputs.comment-body != '' }}",
+    "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${REVIEW_JOB_TIMEOUT_MINUTES}`,
+    "    permissions:",
+    "      pull-requests: write",
+    "    steps:",
+    indentBlock(renderVerdictCommentStep(), 6),
+    ""
+  ].join("\n");
+}
 
 // ../template-engine/dist/review/claude/claude-provider.js
 var SECRET_NAME = "CLAUDE_CODE_OAUTH_TOKEN";
 var ALLOWED_TOOLS = "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)";
+var CLAUDE_STEP_ID = "claude-review";
+var PR_CONTEXT = ["REPO: ${{ github.repository }}", "PR NUMBER: ${{ github.event.pull_request.number }}"];
 function renderWorkflowInstructions(locale) {
   const lines = locale === "en" ? [
-    "Review the diff of this pull request using `gh pr diff` and `gh pr view`.",
-    "Post specific findings as inline comments and exactly one top-level summary comment.",
+    ...PR_CONTEXT,
+    "",
+    "Review the diff of this pull request using `gh pr diff <PR NUMBER>` and `gh pr view <PR NUMBER>`.",
+    "Post specific findings as inline comments with `mcp__github_inline_comment__create_inline_comment` (pass `confirmed: true`), and exactly one top-level summary comment.",
+    "Post the summary with `gh pr comment <PR NUMBER> --body-file - <<'ARCHWEAVE_EOF'`, the body on the following lines, then a line `ARCHWEAVE_EOF` (the quoted delimiter keeps backticks and `$` literal). Never pass the body with `--body \"...\"` or `$(...)`.",
+    "Run each `gh` command on its own: no pipes to other programs, no `&&` chains.",
     `Always include the literal marker ${ROUND_MARKER} in the top-level summary comment.`,
     "If there are no findings that require action, post exactly one top-level comment saying so (and still include the marker).",
     "Do not modify any code, and never approve or merge the pull request.",
     "Write summaries and explanations in English; keep file names, function names, and identifiers verbatim."
   ] : [
-    "\uC774 pull request\uC758 diff\uB97C `gh pr diff`\uC640 `gh pr view`\uB85C \uD655\uC778\uD558\uACE0 \uB9AC\uBDF0\uD558\uC138\uC694.",
-    "\uAD6C\uCCB4\uC801 \uC9C0\uC801\uC740 inline comment\uB85C, \uC804\uCCB4 \uC694\uC57D\uC740 \uC815\uD655\uD788 \uD55C \uAC1C\uC758 top-level comment\uB85C \uAC8C\uC2DC\uD558\uC138\uC694.",
+    ...PR_CONTEXT,
+    "",
+    "\uC774 pull request\uC758 diff\uB97C `gh pr diff <PR NUMBER>`\uC640 `gh pr view <PR NUMBER>`\uB85C \uD655\uC778\uD558\uACE0 \uB9AC\uBDF0\uD558\uC138\uC694.",
+    "\uAD6C\uCCB4\uC801 \uC9C0\uC801\uC740 `mcp__github_inline_comment__create_inline_comment`(`confirmed: true` \uC804\uB2EC)\uB85C inline comment\uB97C \uB2EC\uACE0, \uC804\uCCB4 \uC694\uC57D\uC740 \uC815\uD655\uD788 \uD55C \uAC1C\uC758 top-level comment\uB85C \uAC8C\uC2DC\uD558\uC138\uC694.",
+    "\uC694\uC57D\uC740 `gh pr comment <PR NUMBER> --body-file - <<'ARCHWEAVE_EOF'`\uB85C \uAC8C\uC2DC\uD558\uC138\uC694. \uB2E4\uC74C \uC904\uBD80\uD130 \uBCF8\uBB38\uC744 \uC4F0\uACE0, \uB9C8\uC9C0\uB9C9 \uC904\uC5D0 `ARCHWEAVE_EOF`\uB9CC \uC4F0\uC138\uC694(\uB530\uC634\uD45C \uCE5C \uAD6C\uBD84\uC790\uB77C \uBC31\uD2F1\uACFC `$`\uAC00 \uADF8\uB300\uB85C \uB0A8\uC544\uC694). \uBCF8\uBB38\uC744 `--body \"...\"`\uB098 `$(...)`\uB85C \uB118\uAE30\uC9C0 \uB9C8\uC138\uC694.",
+    "`gh` \uBA85\uB839\uC740 \uD558\uB098\uC529 \uB530\uB85C \uC2E4\uD589\uD558\uC138\uC694. \uB2E4\uB978 \uD504\uB85C\uADF8\uB7A8\uC73C\uB85C \uD30C\uC774\uD504\uD558\uAC70\uB098 `&&`\uB85C \uC787\uC9C0 \uB9C8\uC138\uC694.",
     `top-level \uC694\uC57D \uCF54\uBA58\uD2B8\uC5D0\uB294 \uBC18\uB4DC\uC2DC \uB9AC\uD130\uB7F4 \uB9C8\uCEE4 ${ROUND_MARKER}\uB97C \uD3EC\uD568\uD558\uC138\uC694.`,
     '\uC870\uCE58\uAC00 \uD544\uC694\uD55C \uBB38\uC81C\uAC00 \uC5C6\uC73C\uBA74 "\uC870\uCE58\uAC00 \uD544\uC694\uD55C \uBB38\uC81C\uB97C \uCC3E\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4."\uB77C\uB294 top-level comment\uB97C \uC815\uD655\uD788 \uD55C \uAC1C \uAC8C\uC2DC\uD558\uC138\uC694(\uC774\uB54C\uB3C4 \uB9C8\uCEE4\uB294 \uD3EC\uD568).',
     "\uCF54\uB4DC\uB97C \uC218\uC815\uD558\uC9C0 \uB9C8\uC138\uC694(Do not modify any code). PR\uC744 \uC2B9\uC778\uD558\uAC70\uB098 \uBCD1\uD569\uD558\uC9C0 \uB9C8\uC138\uC694(never approve or merge).",
@@ -479,42 +680,44 @@ function composePrompt(input) {
   sections.push(renderFindingsBlockInstruction(input.locale));
   return sections.join("\n\n---\n\n");
 }
-function buildWorkflowYaml(input) {
-  const steps = [
-    renderSecretGateStep(SECRET_NAME),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep("steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'"),
-    [
-      "- name: Run Claude review",
-      "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'",
-      `  uses: ${pinnedUses("anthropics/claude-code-action")}`,
-      "  with:",
-      `    claude_code_oauth_token: \${{ secrets.${SECRET_NAME} }}`,
-      "    prompt: |",
-      indentBlock(composePrompt(input), 6),
-      "    claude_args: |",
-      `      --allowedTools "${ALLOWED_TOOLS}"`
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
+function renderDeniedToolsStep() {
   return [
-    "name: Claude Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
+    "- name: Show denied tool calls",
+    `  if: always() && steps.${CLAUDE_STEP_ID}.outputs.execution_file != ''`,
+    "  env:",
+    `    EXECUTION_FILE: \${{ steps.${CLAUDE_STEP_ID}.outputs.execution_file }}`,
+    "  run: |",
+    '    [ -f "$EXECUTION_FILE" ] || exit 0',
+    `    stop_token="archweave-$(od -An -N16 -tx1 /dev/urandom | tr -d ' \\n')"`,
+    '    echo "::stop-commands::$stop_token"',
+    `    jq -c '.[] | select(.type == "result") | .permission_denials[]? | {tool: .tool_name, command: ((.tool_input.command // "") | tostring | .[0:200])}' "$EXECUTION_FILE" || echo "Could not read the execution file."`,
+    '    echo "::$stop_token::"'
   ].join("\n");
 }
+function buildWorkflowYaml(input) {
+  return renderReviewWorkflow(input, {
+    name: "Claude Code Review",
+    secretName: SECRET_NAME,
+    // The Claude GitHub App signs in with the workflow's OIDC token (claude-code-action's FAQ).
+    idToken: true,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION),
+      [
+        "- name: Run Claude review",
+        `  id: ${CLAUDE_STEP_ID}`,
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        `  uses: ${pinnedUses("anthropics/claude-code-action")}`,
+        "  with:",
+        `    claude_code_oauth_token: \${{ secrets.${SECRET_NAME} }}`,
+        "    prompt: |",
+        indentBlock(composePrompt(input), 6),
+        "    claude_args: |",
+        `      --allowedTools "${ALLOWED_TOOLS}"`
+      ].join("\n"),
+      renderDeniedToolsStep()
+    ]
+  });
+}
 var claudeProvider = {
   id: "claude",
   workflowFileName: ".github/workflows/claude-code-review.yml",
@@ -553,49 +756,41 @@ function composePrompt2(input) {
   return sections.join("\n\n---\n\n");
 }
 function buildWorkflowYaml2(input) {
-  const gateCondition = "steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
-  const steps = [
-    renderSecretGateStep(SECRET_NAME2),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep(gateCondition),
-    [
-      "- name: Install cursor-agent CLI",
-      `  if: ${gateCondition}`,
-      "  run: |",
-      "    curl https://cursor.com/install -fsS | bash",
-      '    echo "$HOME/.cursor/bin" >> "$GITHUB_PATH"'
-    ].join("\n"),
-    [
-      "- name: Run Cursor review",
-      `  if: ${gateCondition}`,
-      "  env:",
-      `    CURSOR_API_KEY: \${{ secrets.${SECRET_NAME2} }}`,
-      "    GH_TOKEN: ${{ github.token }}",
-      "  run: |",
-      `    agent -p "$(cat <<'${PROMPT_HEREDOC_DELIMITER}'`,
-      indentBlock(composePrompt2(input), 4),
-      `    ${PROMPT_HEREDOC_DELIMITER}`,
-      '    )"'
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: Cursor Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "Cursor Code Review",
+    secretName: SECRET_NAME2,
+    // An API key: the Cursor CLI needs no OIDC token.
+    idToken: false,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION),
+      [
+        "- name: Install cursor-agent CLI",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  run: |",
+        // HTTPS only, TLS 1.2 or newer. Cursor publishes no pinned version or checksum for
+        // this installer; docs/pr-review.md states what that leaves open.
+        "    curl --proto '=https' --tlsv1.2 -fsS https://cursor.com/install | bash",
+        // The docs name ~/.cursor/bin; the installer currently links `agent` into ~/.local/bin.
+        // Both go on the PATH, so the next step finds it wherever the installer puts it.
+        '    echo "$HOME/.local/bin" >> "$GITHUB_PATH"',
+        '    echo "$HOME/.cursor/bin" >> "$GITHUB_PATH"'
+      ].join("\n"),
+      [
+        "- name: Run Cursor review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  env:",
+        `    CURSOR_API_KEY: \${{ secrets.${SECRET_NAME2} }}`,
+        "    GH_TOKEN: ${{ github.token }}",
+        "  run: |",
+        // cursor-agent stops at "Workspace Trust Required" without --trust (2026.10.22 on
+        // Actions); the folder is this run's own checkout, and forks never get the secret.
+        `    agent --trust -p "$(cat <<'${PROMPT_HEREDOC_DELIMITER}'`,
+        indentBlock(composePrompt2(input), 4),
+        `    ${PROMPT_HEREDOC_DELIMITER}`,
+        '    )"'
+      ].join("\n")
+    ]
+  });
 }
 var cursorProvider = {
   id: "cursor",
@@ -633,41 +828,33 @@ function composePrompt3(input) {
   sections.push(renderFindingsBlockInstruction(input.locale));
   return sections.join("\n\n---\n\n");
 }
+var GEMINI_CLI_VERSION = "0.65.0";
 function buildWorkflowYaml3(input) {
-  const steps = [
-    renderSecretGateStep(SECRET_NAME3),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep("steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'"),
-    [
-      "- name: Run Gemini review",
-      "  if: steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'",
-      `  uses: ${pinnedUses("google-github-actions/run-gemini-cli")}`,
-      "  env:",
-      "    GITHUB_TOKEN: ${{ github.token }}",
-      "  with:",
-      `    gemini_api_key: \${{ secrets.${SECRET_NAME3} }}`,
-      "    prompt: |",
-      indentBlock(composePrompt3(input), 6)
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: Gemini Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "Gemini Code Review",
+    secretName: SECRET_NAME3,
+    // An API key: run-gemini-cli uses OIDC only for Google Cloud workload identity federation.
+    idToken: false,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION),
+      [
+        "- name: Run Gemini review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        `  uses: ${pinnedUses("google-github-actions/run-gemini-cli")}`,
+        "  env:",
+        "    GITHUB_TOKEN: ${{ github.token }}",
+        // Gemini CLI 0.65 refuses to run in a folder it hasn't been told to trust (measured
+        // 2026-10-25 on Actions). The folder is this run's own checkout; pull requests from forks
+        // never get here, because they get no secret.
+        "    GEMINI_CLI_TRUST_WORKSPACE: 'true'",
+        "  with:",
+        `    gemini_api_key: \${{ secrets.${SECRET_NAME3} }}`,
+        `    gemini_cli_version: '${GEMINI_CLI_VERSION}'`,
+        "    prompt: |",
+        indentBlock(composePrompt3(input), 6)
+      ].join("\n")
+    ]
+  });
 }
 var geminiProvider = {
   id: "gemini",
@@ -706,64 +893,49 @@ function composePrompt4(input) {
   return sections.join("\n\n---\n\n");
 }
 function buildWorkflowYaml4(input) {
-  const gateCondition = "steps.secret-gate.outputs.enabled == 'true' && steps.round-gate.outputs.allowed == 'true'";
-  const steps = [
-    renderSecretGateStep(SECRET_NAME4),
-    renderRoundGateStep(input.maxRounds),
-    renderCheckoutStep(gateCondition, ["ref: refs/pull/${{ github.event.pull_request.number }}/merge"]),
-    [
-      "- name: Fetch base and head refs for the PR",
-      `  if: ${gateCondition}`,
-      "  env:",
-      "    PR_BASE_REF: ${{ github.event.pull_request.base.ref }}",
-      "    PR_NUMBER: ${{ github.event.pull_request.number }}",
-      "  run: |",
-      "    # Explicit destinations: the sandboxed review step has no network, so both sides",
-      "    # of the diff must survive as stable local refs (FETCH_HEAD alone is ambiguous).",
-      "    git fetch --no-tags origin \\",
-      '      "+refs/heads/$PR_BASE_REF:refs/remotes/origin/pr-base" \\',
-      '      "+refs/pull/$PR_NUMBER/head:refs/remotes/origin/pr-head"'
-    ].join("\n"),
-    [
-      "- name: Run Codex review",
-      "  id: codex-review",
-      `  if: ${gateCondition}`,
-      `  uses: ${pinnedUses("openai/codex-action")}`,
-      "  with:",
-      `    openai-api-key: \${{ secrets.${SECRET_NAME4} }}`,
-      '    permission-profile: ":read-only"',
-      "    prompt: |",
-      indentBlock(composePrompt4(input), 6)
-    ].join("\n"),
-    [
-      "- name: Post review comment",
-      `  if: ${gateCondition}`,
-      "  env:",
-      "    GH_TOKEN: ${{ github.token }}",
-      "    PR_NUMBER: ${{ github.event.pull_request.number }}",
-      "    REVIEW_BODY: ${{ steps.codex-review.outputs.final-message }}",
-      "  run: |",
-      '    printf %s "$REVIEW_BODY" | gh pr comment "$PR_NUMBER" --body-file -'
-    ].join("\n"),
-    renderWorkspaceSetupSteps(input.packageManager),
-    renderVerdictGateStep(input.maxRounds, input.locale)
-  ];
-  return [
-    "name: GPT Code Review",
-    "",
-    renderTriggerBlock(),
-    "",
-    renderConcurrencyBlock(),
-    "",
-    renderPermissionsBlock(),
-    "",
-    "jobs:",
-    "  review:",
-    "    runs-on: ubuntu-latest",
-    "    steps:",
-    indentBlock(steps.join("\n\n"), 6),
-    ""
-  ].join("\n");
+  return renderReviewWorkflow(input, {
+    name: "GPT Code Review",
+    secretName: SECRET_NAME4,
+    // An API key: codex-action needs no OIDC token.
+    idToken: false,
+    reviewSteps: [
+      renderCheckoutStep(REVIEW_GATE_CONDITION, ["ref: refs/pull/${{ github.event.pull_request.number }}/merge"]),
+      [
+        "- name: Fetch base and head refs for the PR",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  env:",
+        "    PR_BASE_REF: ${{ github.event.pull_request.base.ref }}",
+        "    PR_NUMBER: ${{ github.event.pull_request.number }}",
+        "  run: |",
+        "    # Explicit destinations: the sandboxed review step has no network, so both sides",
+        "    # of the diff must survive as stable local refs (FETCH_HEAD alone is ambiguous).",
+        "    git fetch --no-tags origin \\",
+        '      "+refs/heads/$PR_BASE_REF:refs/remotes/origin/pr-base" \\',
+        '      "+refs/pull/$PR_NUMBER/head:refs/remotes/origin/pr-head"'
+      ].join("\n"),
+      [
+        "- name: Run Codex review",
+        "  id: codex-review",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        `  uses: ${pinnedUses("openai/codex-action")}`,
+        "  with:",
+        `    openai-api-key: \${{ secrets.${SECRET_NAME4} }}`,
+        '    permission-profile: ":read-only"',
+        "    prompt: |",
+        indentBlock(composePrompt4(input), 6)
+      ].join("\n"),
+      [
+        "- name: Post review comment",
+        `  if: ${REVIEW_GATE_CONDITION}`,
+        "  env:",
+        "    GH_TOKEN: ${{ github.token }}",
+        "    PR_NUMBER: ${{ github.event.pull_request.number }}",
+        "    REVIEW_BODY: ${{ steps.codex-review.outputs.final-message }}",
+        "  run: |",
+        '    printf %s "$REVIEW_BODY" | gh pr comment "$PR_NUMBER" --body-file -'
+      ].join("\n")
+    ]
+  });
 }
 var gptProvider = {
   id: "gpt",
@@ -850,7 +1022,8 @@ var REVIEW_CHECK_IDS = [
   "review-alt-file-coexistence",
   "review-config-consistency",
   "review-workflow-providers",
-  "review-workflow-pnpm"
+  "review-workflow-pnpm",
+  "review-workflow-fail-open"
 ];
 var WORKFLOWS_DIR = ".github/workflows";
 function archweaveWorkflows(root) {
@@ -907,6 +1080,25 @@ function buildReviewPnpmCheck(root, workflows) {
     suggestedAction: "Regenerate the workflow: nx g @clearlydev/nx-archweave:add-review --onConflict=overwrite."
   });
 }
+var FAIL_CLOSED_VERDICT_MODE = "ARCHWEAVE_VERDICT_OUTPUT: 'github-output'";
+function buildReviewFailOpenCheck(root, workflows) {
+  const id = "review-workflow-fail-open";
+  const label = "Review check fails closed";
+  if (workflows.length === 0)
+    return createDoctorCheck({ id, label, status: "not-applicable", message: "no nx-archweave review workflow", evidence: [] });
+  const failOpen = workflows.filter((path) => !readFileSync2(join2(root, path), "utf-8").includes(FAIL_CLOSED_VERDICT_MODE));
+  if (failOpen.length === 0) {
+    return createDoctorCheck({ id, label, status: "pass", message: "a review run that leaves no readable summary fails the review check", evidence: workflows });
+  }
+  return createDoctorCheck({
+    id,
+    label,
+    status: "error",
+    message: "fail-open workflow: generated before nx-archweave 0.2.2, it passes the review check when the AI review posts no summary or one that cannot be read, so an unreviewed pull request can merge",
+    evidence: failOpen,
+    suggestedAction: "Re-run add-review: nx g @clearlydev/nx-archweave:add-review --onConflict=overwrite. The report shows the difference before anything is replaced."
+  });
+}
 function buildReviewChecks(root) {
   const config = readToolkitConfigState(root);
   const mainWorkflowPath = REVIEW_PROVIDERS[resolveProviderId(config)].workflowFileName;
@@ -920,7 +1112,8 @@ function buildReviewChecks(root) {
     buildReviewAltFileCoexistenceCheck(mainWorkflowPath, altWorkflowPath, mainExists, altExists),
     buildReviewConfigConsistencyCheck(root, mainWorkflowPath, mainExists, config),
     buildReviewProvidersCheck(workflows),
-    buildReviewPnpmCheck(root, workflows)
+    buildReviewPnpmCheck(root, workflows),
+    buildReviewFailOpenCheck(root, workflows)
   ];
 }
 function buildReviewWorkflowPresentCheck(mainWorkflowPath, mainExists, mainIsOurs, config) {
@@ -1038,13 +1231,14 @@ function buildReviewConfigConsistencyCheck(root, mainWorkflowPath, mainExists, c
       evidence: [mainWorkflowPath, CONFIG_PATH]
     });
   }
+  const earlierVersion = !/^ {2}review-comment:$/m.test(workflowContent);
   return createDoctorCheck({
     id: "review-config-consistency",
     label: "Review config/workflow consistency",
     status: "warning",
-    message: `${mainWorkflowPath} differs from what ${CONFIG_PATH}'s review options would generate`,
+    message: earlierVersion ? `${mainWorkflowPath} was generated by an earlier nx-archweave version: it installs dependencies in the job that holds the provider secret` : `${mainWorkflowPath} differs from what ${CONFIG_PATH}'s review options would generate`,
     evidence: [mainWorkflowPath, CONFIG_PATH],
-    suggestedAction: `Re-run the add-review generator with --onConflict=overwrite to re-sync ${mainWorkflowPath} with ${CONFIG_PATH}, or update ${CONFIG_PATH} to match the installed file.`
+    suggestedAction: earlierVersion ? `Re-run add-review --onConflict=overwrite to regenerate ${mainWorkflowPath}: the verdict then runs in a job without the secret, an OIDC token or install scripts. Edits you made to the file are replaced; the report shows the difference first.` : `Re-run the add-review generator with --onConflict=overwrite to re-sync ${mainWorkflowPath} with ${CONFIG_PATH}, or update ${CONFIG_PATH} to match the installed file.`
   });
 }
 
@@ -1158,15 +1352,22 @@ var BACKEND_CHECK_IDS = [
   "backend-config-consistency",
   "shared-types-lib",
   "boundary-constraints-applied",
-  "boundary-tags-exist"
+  "boundary-tags-exist",
+  "boundary-untagged-projects"
 ];
 var CHECK_LABELS = {
   "backend-framework": "Backend framework (root package.json only)",
   "backend-config-consistency": "Backend config consistency",
   "shared-types-lib": "shared-types library",
   "boundary-constraints-applied": "Module-boundary constraints",
-  "boundary-tags-exist": "Boundary tags exist"
+  "boundary-tags-exist": "Boundary tags exist",
+  "boundary-untagged-projects": "Projects without a boundary tag"
 };
+var UNTAGGED_LISTED = 10;
+function isEndToEndRoot(projectRoot) {
+  const base = projectRoot.split("/").pop() ?? "";
+  return base === "e2e" || base.endsWith("-e2e");
+}
 function collectScopeTags(root, projects) {
   if (projects !== void 0)
     return new Set(projects.flatMap((project) => project.tags));
@@ -1323,13 +1524,15 @@ function buildBackendChecks(root, projects) {
     suggestedAction: classification === "enforced" ? void 0 : "Run add-backend with --applyEslint, or merge its snippet yourself."
   }));
   if (classification !== "enforced") {
-    checks.push(createDoctorCheck({
-      id: "boundary-tags-exist",
-      label: CHECK_LABELS["boundary-tags-exist"],
-      status: "not-applicable",
-      message: "Skipped \u2014 boundary constraints are not enforced (see boundary-constraints-applied)",
-      evidence: []
-    }));
+    for (const id of ["boundary-tags-exist", "boundary-untagged-projects"]) {
+      checks.push(createDoctorCheck({
+        id,
+        label: CHECK_LABELS[id],
+        status: "not-applicable",
+        message: "Skipped \u2014 boundary constraints are not enforced (see boundary-constraints-applied)",
+        evidence: []
+      }));
+    }
   } else {
     const tags = collectScopeTags(root, projects);
     const required = readsBackendOnly(root) ? [boundaryTags.backend] : [boundaryTags.frontend, boundaryTags.backend];
@@ -1342,9 +1545,36 @@ function buildBackendChecks(root, projects) {
       evidence: missing.length === 0 ? [] : missing,
       suggestedAction: missing.length === 0 ? void 0 : "Add the missing tag(s) to the app project.json tags or package.json nx.tags (add-backend does this for the two apps)."
     }));
+    checks.push(buildUntaggedProjectsCheck(projects, [boundaryTags.frontend, boundaryTags.backend, boundaryTags.shared]));
   }
   return checks;
 }
+function buildUntaggedProjectsCheck(projects, roleTags) {
+  const id = "boundary-untagged-projects";
+  if (projects === void 0) {
+    return createDoctorCheck({
+      id,
+      label: CHECK_LABELS[id],
+      status: "not-applicable",
+      message: "Skipped \u2014 needs the workspace's Nx project list (run doctor through nx g)",
+      evidence: []
+    });
+  }
+  const untagged = projects.filter((project) => project.root !== "" && project.root !== "." && !isEndToEndRoot(project.root)).filter((project) => !project.tags.some((tag) => roleTags.includes(tag))).map((project) => project.name);
+  if (untagged.length === 0) {
+    return createDoctorCheck({ id, label: CHECK_LABELS[id], status: "pass", message: `every project carries one of ${roleTags.join(", ")}`, evidence: [] });
+  }
+  const listed = untagged.slice(0, UNTAGGED_LISTED).join(", ");
+  const more = untagged.length > UNTAGGED_LISTED ? ` and ${untagged.length - UNTAGGED_LISTED} more` : "";
+  return createDoctorCheck({
+    id,
+    label: CHECK_LABELS[id],
+    status: "warning",
+    message: `${untagged.length} project(s) carry none of ${roleTags.join(", ")}, so the frontend/backend deny rules don't cover them: ${listed}${more}`,
+    evidence: untagged,
+    suggestedAction: `Give each one the tag of its side (${roleTags.join(", ")}) in package.json nx.tags or project.json tags. When you generate a library, pass it right away: nx g @nx/js:lib libs/<name> --tags=${roleTags[2]}.`
+  });
+}
 
 // ../template-engine/dist/doctor/fsd-like-check.js
 import { existsSync as existsSync4, readdirSync as readdirSync3 } from "node:fs";
@@ -1595,7 +1825,7 @@ var NOT_APPLICABLE_IDS = [
   ...REVIEW_CHECK_IDS,
   ...BACKEND_CHECK_IDS
 ];
-function runDoctorChecks(root, projects) {
+function runDoctorChecks(root, projects, nxSupport) {
   const env = detectEnvironment(root);
   if (!env.hasNxWorkspace) {
     const checks2 = [
@@ -1625,7 +1855,7 @@ function runDoctorChecks(root, projects) {
       message: "nx.json found",
       evidence: ["nx.json"]
     }),
-    buildNxVersionCheck(env),
+    buildNxVersionCheck(env, nxSupport),
     buildFsdLikeCheck(root, projects),
     buildFsdEnforcementCheck(root, projects),
     buildFsdRuleAnchoredCheck(root, projects),
@@ -1654,12 +1884,25 @@ function runDoctorChecks(root, projects) {
   const overallStatus = computeOverallStatus(checks);
   return { checks, overallStatus };
 }
-var VALIDATED_NX_MAJOR = 23;
+var VALIDATED_NX_MAJORS = [23, 24];
+var VALIDATED_RANGE_TEXT = `${VALIDATED_NX_MAJORS[0]}.x\u2013${VALIDATED_NX_MAJORS[VALIDATED_NX_MAJORS.length - 1]}.x`;
 function extractMajor(version) {
   const match = /(\d+)/.exec(version);
   return match ? Number(match[1]) : null;
 }
-function buildNxVersionCheck(env) {
+function buildNxVersionCheck(env, nxSupport) {
+  if (nxSupport?.inRange === false && nxSupport.installedVersion !== void 0) {
+    const major2 = extractMajor(nxSupport.installedVersion);
+    const supported = `${nxSupport.supportedMajors.min}.x\u2013${nxSupport.supportedMajors.max}.x`;
+    return createDoctorCheck({
+      id: "nx-version",
+      label: "Nx version",
+      status: "error",
+      message: `Nx ${nxSupport.installedVersion} is installed, outside the majors the plugin's @nx/devkit ${nxSupport.devkitVersion} supports (nx ${supported}) \u2014 the generators may fail to load or misbehave`,
+      evidence: [`nx@${nxSupport.installedVersion}`, `@nx/devkit@${nxSupport.devkitVersion}`],
+      suggestedAction: `Install the @clearlydev/nx-archweave release built for Nx ${major2 ?? "this"}${major2 === null ? "" : ".x"}, or keep nx at ${supported}.`
+    });
+  }
   if (env.rootPackageJsonError) {
     return createDoctorCheck({
       id: "nx-version",
@@ -1689,30 +1932,30 @@ function buildNxVersionCheck(env) {
       evidence: [`nx@${env.nxVersion}`]
     });
   }
-  if (major === VALIDATED_NX_MAJOR) {
+  if (VALIDATED_NX_MAJORS.includes(major)) {
     return createDoctorCheck({
       id: "nx-version",
       label: "Nx version",
       status: "pass",
-      message: `Nx ${env.nxVersion} \u2014 within the toolkit-validated range (${VALIDATED_NX_MAJOR}.x)`,
+      message: `Nx ${env.nxVersion} \u2014 within the toolkit-validated range (${VALIDATED_RANGE_TEXT})`,
       evidence: [`nx@${env.nxVersion}`]
     });
   }
-  if (major < VALIDATED_NX_MAJOR) {
+  if (major < VALIDATED_NX_MAJORS[0]) {
     return createDoctorCheck({
       id: "nx-version",
       label: "Nx version",
       status: "warning",
-      message: `Nx ${env.nxVersion} is below the toolkit-validated range (${VALIDATED_NX_MAJOR}.x) \u2014 generator behavior is not guaranteed`,
+      message: `Nx ${env.nxVersion} is below the toolkit-validated range (${VALIDATED_RANGE_TEXT}) \u2014 generator behavior is not guaranteed`,
       evidence: [`nx@${env.nxVersion}`],
-      suggestedAction: `Upgrade the workspace to Nx ${VALIDATED_NX_MAJOR}.x before running the generators.`
+      suggestedAction: `Upgrade the workspace to Nx ${VALIDATED_NX_MAJORS[VALIDATED_NX_MAJORS.length - 1]}.x before running the generators.`
     });
   }
   return createDoctorCheck({
     id: "nx-version",
     label: "Nx version",
     status: "warning",
-    message: `Nx ${env.nxVersion} is above the toolkit-validated range (${VALIDATED_NX_MAJOR}.x) \u2014 may work, unvalidated`,
+    message: `Nx ${env.nxVersion} is above the toolkit-validated range (${VALIDATED_RANGE_TEXT}) \u2014 may work, unvalidated`,
     evidence: [`nx@${env.nxVersion}`],
     suggestedAction: "Proceed with care and report issues; validation for newer majors lands with toolkit updates."
   });
@@ -2644,7 +2887,7 @@ function diskRunNx(root) {
 var DOCTOR_TARGET_ENVIRONMENT = "claude-code";
 async function buildDoctorReportWithIntegrations(root, options = {}, deps = {}) {
   const integrationsRoot = deps.integrationsRoot ?? createIntegrationsCompositionRoot();
-  const baseReport = runDoctorChecks(root, options.projects);
+  const baseReport = runDoctorChecks(root, options.projects, options.nxSupport);
   const declaredIds = readEnabledIntegrationIds(root);
   const runNx = diskRunNx(root);
   const driftResults = await detectIntegrationsDrift({
@@ -3093,11 +3336,49 @@ function buildPolicySuggestion(tree, sourceRoot, current) {
   });
 }
 
+// src/generators/doctor/nx-support.ts
+import { readFileSync as readFileSync9 } from "node:fs";
+import { createRequire } from "node:module";
+import { join as join12 } from "node:path";
+var MAJORS_EITHER_SIDE = 1;
+function majorOf(version) {
+  const match = /^(\d+)\./.exec(version.trim());
+  return match ? Number(match[1]) : void 0;
+}
+function readOwnDevkitVersion() {
+  try {
+    const path = createRequire(import.meta.url).resolve("@nx/devkit/package.json");
+    const version = JSON.parse(readFileSync9(path, "utf-8")).version;
+    return typeof version === "string" ? version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readInstalledNx(root) {
+  try {
+    const version = JSON.parse(readFileSync9(join12(root, "node_modules", "nx", "package.json"), "utf-8")).version;
+    return typeof version === "string" ? version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readNxSupport(root, deps = {}) {
+  const devkitVersion = (deps.devkitVersion ?? readOwnDevkitVersion)();
+  const devkitMajor = devkitVersion === void 0 ? void 0 : majorOf(devkitVersion);
+  if (devkitVersion === void 0 || devkitMajor === void 0) return void 0;
+  const supportedMajors = { min: devkitMajor - MAJORS_EITHER_SIDE, max: devkitMajor + MAJORS_EITHER_SIDE };
+  const installedVersion = (deps.installedNx ?? readInstalledNx)(root);
+  const installedMajor = installedVersion === void 0 ? void 0 : majorOf(installedVersion);
+  const inRange = installedMajor === void 0 ? void 0 : installedMajor >= supportedMajors.min && installedMajor <= supportedMajors.max;
+  return { devkitVersion, supportedMajors, installedVersion, inRange };
+}
+
 // src/generators/doctor/generator.ts
 async function doctorGenerator(tree, options) {
   const base = await buildDoctorReportWithIntegrations(tree.root, {
     liveIntegrations: options.liveIntegrations ?? false,
-    projects: doctorProjects(tree)
+    projects: doctorProjects(tree),
+    nxSupport: readNxSupport(tree.root)
   });
   const checks = base.overallStatus === "unsupported" ? base.checks : [...base.checks, ...buildWorkspaceChecks(tree)];
   const report = { checks, overallStatus: base.overallStatus === "unsupported" ? base.overallStatus : computeOverallStatus(checks) };