@clearlydev/nx-archweave 0.2.2 → 0.3.0

package/dist/generators/doctor/generator.js

@@ -288,6 +288,30 @@ function buildOverEngineeringPrompt(locale) {
   return [...body, "", renderFindingSchemaInstruction(locale, OVER_ENGINEERING_PRIORITIES), "", renderDedupInstruction(locale)].join("\n");
 }
 
+// ../review-policy/dist/verdict-gate/verdict-comment.js
+var VERDICT_MARKER = "<!-- archweave-verdict -->";
+function renderCommitLine(locale, shortSha) {
+  return locale === "en" ? `<sub>Commit \`${shortSha}\` \xB7 this comment is updated on every review round.</sub>` : `<sub>\uCEE4\uBC0B \`${shortSha}\` \xB7 \uC774 \uCF54\uBA58\uD2B8\uB294 \uB9AC\uBDF0 \uB77C\uC6B4\uB4DC\uB9C8\uB2E4 \uAC31\uC2E0\uB429\uB2C8\uB2E4.</sub>`;
+}
+var NOT_RUN_REASON = {
+  en: {
+    secret: (secretName) => `the ${secretName} secret is not registered`,
+    fork: () => "this pull request comes from a fork, and GitHub passes no secrets to runs from forks",
+    dependabot: (secretName) => `Dependabot runs receive only Dependabot secrets, and ${secretName} is not one of them`,
+    rounds: (_secretName, maxRounds) => `the automated review round limit (${maxRounds}) is reached`
+  },
+  ko: {
+    secret: (secretName) => `${secretName} \uC2DC\uD06C\uB9BF\uC774 \uB4F1\uB85D\uB418\uC9C0 \uC54A\uC74C`,
+    fork: () => "\uD3EC\uD06C\uC5D0\uC11C \uC628 pull request\uC774\uACE0, GitHub\uB294 \uD3EC\uD06C \uC2E4\uD589\uC5D0 \uC2DC\uD06C\uB9BF\uC744 \uB118\uAE30\uC9C0 \uC54A\uC74C",
+    dependabot: (secretName) => `Dependabot \uC2E4\uD589\uC740 Dependabot \uC2DC\uD06C\uB9BF\uB9CC \uBC1B\uB294\uB370, ${secretName}\uB294 \uADF8\uC911\uC5D0 \uC5C6\uC74C`,
+    rounds: (_secretName, maxRounds) => `\uC790\uB3D9 \uB9AC\uBDF0 \uB77C\uC6B4\uB4DC \uD55C\uB3C4(${maxRounds})\uC5D0 \uB3C4\uB2EC\uD568`
+  }
+};
+function renderNotRunNotice(locale, reason, secretName, maxRounds) {
+  const why = NOT_RUN_REASON[locale][reason](secretName, maxRounds);
+  return locale === "en" ? `AI review did not run for this commit (${why}). A green check here does not mean the change was reviewed.` : `\uC774 \uCEE4\uBC0B\uC5D0\uB294 AI \uB9AC\uBDF0\uAC00 \uC2E4\uD589\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4(${why}). \uC774 green \uCCB4\uD06C\uB294 \uBCC0\uACBD \uC0AC\uD56D\uC774 \uB9AC\uBDF0\uB418\uC5C8\uB2E4\uB294 \uB73B\uC774 \uC544\uB2D9\uB2C8\uB2E4.`;
+}
+
 // ../review-policy/dist/verdict-gate/verdict-gate.js
 var ROUND_MARKER = "<!-- archweave-review-round -->";
 
@@ -369,8 +393,35 @@ function renderRoundGateStep(maxRounds) {
     "    fi"
   ].join("\n");
 }
+function shellQuote(text) {
+  return `'${text.replace(/'/g, `'\\''`)}'`;
+}
+function renderNotRunFunction(secretName, maxRounds, locale) {
+  const reasons = ["secret", "fork", "dependabot", "rounds"];
+  const [commitBefore, commitAfter] = renderCommitLine(locale, "\0").split("\0");
+  return [
+    "not_run() {",
+    '  case "$1" in',
+    ...reasons.map((reason) => `    ${reason}) annotation=${shellQuote(renderNotRunNotice("en", reason, secretName, maxRounds))}; notice=${shellQuote(renderNotRunNotice(locale, reason, secretName, maxRounds))} ;;`),
+    "  esac",
+    '  echo "::notice title=AI review did not run::$annotation"',
+    `  printf '%s\\n' "$notice" >> "$GITHUB_STEP_SUMMARY"`,
+    `  short_sha=$(printf '%s' "$HEAD_SHA" | cut -c1-7)`,
+    '  case "$short_sha" in',
+    "    '' | *[!0-9a-f]*) short_sha= ;;",
+    "  esac",
+    "  {",
+    '    echo "notice-body<<ARCHWEAVE_NOT_RUN_EOF"',
+    `    printf '%s\\n' ${shellQuote(VERDICT_MARKER)} "\u2139\uFE0F $notice"`,
+    `    if [ -n "$short_sha" ]; then printf '\\n%s\\n' ${shellQuote(commitBefore)}"$short_sha"${shellQuote(commitAfter)}; fi`,
+    '    echo "ARCHWEAVE_NOT_RUN_EOF"',
+    '    echo "run=false"',
+    '  } >> "$GITHUB_OUTPUT"',
+    "}"
+  ];
+}
 var JUDGE_CONDITION = "steps.ai-review-result.outputs.run == 'true'";
-function renderAiReviewResultStep() {
+function renderAiReviewResultStep(secretName, maxRounds, locale) {
   return [
     "- name: Check the AI review result",
     "  id: ai-review-result",
@@ -379,15 +430,26 @@ function renderAiReviewResultStep() {
     "    REVIEW_ENABLED: ${{ needs.ai-review.outputs.enabled }}",
     "    REVIEW_ALLOWED: ${{ needs.ai-review.outputs.allowed }}",
     "    LAST_COMMENT_ID: ${{ needs.ai-review.outputs.last-comment-id }}",
+    "    HEAD_SHA: ${{ github.event.pull_request.head.sha }}",
+    "    HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}",
+    "    REPOSITORY: ${{ github.repository }}",
+    "    PR_AUTHOR: ${{ github.event.pull_request.user.login }}",
     "  run: |",
+    ...renderNotRunFunction(secretName, maxRounds, locale).map((line) => `    ${line}`),
     '    if [ "$AI_REVIEW_RESULT" != success ]; then',
     `      echo "::error title=AI review did not succeed::The AI review job ended with '$AI_REVIEW_RESULT'."`,
     "      exit 1",
     "    fi",
     '    case "$REVIEW_ENABLED/$REVIEW_ALLOWED" in',
-    "      false/* | true/false)",
-    '        echo "The AI review did not run (no secret, or the round limit) - nothing to judge."',
-    '        echo "run=false" >> "$GITHUB_OUTPUT"',
+    "      false/*)",
+    '        if [ "$HEAD_REPOSITORY" != "$REPOSITORY" ]; then not_run fork',
+    `        elif [ "$PR_AUTHOR" = 'dependabot[bot]' ]; then not_run dependabot`,
+    "        else not_run secret",
+    "        fi",
+    "        exit 0",
+    "        ;;",
+    "      true/false)",
+    "        not_run rounds",
     "        exit 0",
     "        ;;",
     "      true/true)",
@@ -431,7 +493,7 @@ function renderBlockStep() {
     "- name: Fail on a blocking verdict",
     "  if: steps.verdict.outputs.blocked == 'true'",
     "  run: |",
-    '    echo "The review verdict is BLOCK - see the verdict comment on this pull request."',
+    '    echo "The review check failed: the verdict is BLOCK, or the AI review left no readable summary. See the verdict comment on this pull request."',
     "    exit 1"
   ].join("\n");
 }
@@ -446,6 +508,9 @@ function renderVerdictCommentStep() {
     "    PREVIOUS_ID: ${{ needs.review.outputs.previous-comment-id }}",
     "  run: |",
     `    payload=$(jq -n --arg body "$VERDICT_BODY" '{body: $body}')`,
+    '    if [ -z "$PREVIOUS_ID" ]; then',
+    `      PREVIOUS_ID=$(gh api "repos/$REPOSITORY/issues/$PR_NUMBER/comments" --paginate --jq '.[] | select(.user.login == "github-actions[bot]") | select(.body | contains("${VERDICT_MARKER}")) | .id' | tail -n 1) || PREVIOUS_ID=`,
+    "    fi",
     '    case "$PREVIOUS_ID" in',
     "      ''|*[!0-9]*) PREVIOUS_ID= ;;",
     "    esac",
@@ -516,10 +581,11 @@ function renderWorkspaceSetupSteps(packageManager) {
   ].join("\n"));
   return steps.join("\n\n");
 }
+var REVIEW_JOB_TIMEOUT_MINUTES = 15;
 function renderReviewWorkflow(input, parts) {
   const aiReviewSteps = [renderSecretGateStep(parts.secretName), renderRoundGateStep(input.maxRounds), ...parts.reviewSteps];
   const reviewSteps = [
-    renderAiReviewResultStep(),
+    renderAiReviewResultStep(parts.secretName, input.maxRounds, input.locale),
     renderCheckoutStep(JUDGE_CONDITION),
     renderWorkspaceSetupSteps(input.packageManager),
     renderVerdictGateStep(input.maxRounds, input.locale),
@@ -537,6 +603,7 @@ function renderReviewWorkflow(input, parts) {
     "jobs:",
     "  ai-review:",
     "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${REVIEW_JOB_TIMEOUT_MINUTES}`,
     indentBlock(renderReviewPermissions(parts.idToken), 4),
     "    outputs:",
     "      enabled: ${{ steps.secret-gate.outputs.enabled }}",
@@ -549,11 +616,12 @@ function renderReviewWorkflow(input, parts) {
     "    needs: ai-review",
     "    if: always()",
     "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${REVIEW_JOB_TIMEOUT_MINUTES}`,
     "    permissions:",
     "      contents: read",
     "      pull-requests: read",
     "    outputs:",
-    "      comment-body: ${{ steps.verdict.outputs.comment-body }}",
+    "      comment-body: ${{ steps.verdict.outputs.comment-body || steps.ai-review-result.outputs.notice-body }}",
     "      previous-comment-id: ${{ steps.verdict.outputs.previous-comment-id }}",
     "    steps:",
     indentBlock(reviewSteps.join("\n\n"), 6),
@@ -563,6 +631,7 @@ function renderReviewWorkflow(input, parts) {
     // Runs after a BLOCK failed the review job, too: the comment explains the red check.
     "    if: ${{ !cancelled() && needs.review.outputs.comment-body != '' }}",
     "    runs-on: ubuntu-latest",
+    `    timeout-minutes: ${REVIEW_JOB_TIMEOUT_MINUTES}`,
     "    permissions:",
     "      pull-requests: write",
     "    steps:",
@@ -574,17 +643,27 @@ function renderReviewWorkflow(input, parts) {
 // ../template-engine/dist/review/claude/claude-provider.js
 var SECRET_NAME = "CLAUDE_CODE_OAUTH_TOKEN";
 var ALLOWED_TOOLS = "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)";
+var CLAUDE_STEP_ID = "claude-review";
+var PR_CONTEXT = ["REPO: ${{ github.repository }}", "PR NUMBER: ${{ github.event.pull_request.number }}"];
 function renderWorkflowInstructions(locale) {
   const lines = locale === "en" ? [
-    "Review the diff of this pull request using `gh pr diff` and `gh pr view`.",
-    "Post specific findings as inline comments and exactly one top-level summary comment.",
+    ...PR_CONTEXT,
+    "",
+    "Review the diff of this pull request using `gh pr diff <PR NUMBER>` and `gh pr view <PR NUMBER>`.",
+    "Post specific findings as inline comments with `mcp__github_inline_comment__create_inline_comment` (pass `confirmed: true`), and exactly one top-level summary comment.",
+    "Post the summary with `gh pr comment <PR NUMBER> --body-file - <<'ARCHWEAVE_EOF'`, the body on the following lines, then a line `ARCHWEAVE_EOF` (the quoted delimiter keeps backticks and `$` literal). Never pass the body with `--body \"...\"` or `$(...)`.",
+    "Run each `gh` command on its own: no pipes to other programs, no `&&` chains.",
     `Always include the literal marker ${ROUND_MARKER} in the top-level summary comment.`,
     "If there are no findings that require action, post exactly one top-level comment saying so (and still include the marker).",
     "Do not modify any code, and never approve or merge the pull request.",
     "Write summaries and explanations in English; keep file names, function names, and identifiers verbatim."
   ] : [
-    "\uC774 pull request\uC758 diff\uB97C `gh pr diff`\uC640 `gh pr view`\uB85C \uD655\uC778\uD558\uACE0 \uB9AC\uBDF0\uD558\uC138\uC694.",
-    "\uAD6C\uCCB4\uC801 \uC9C0\uC801\uC740 inline comment\uB85C, \uC804\uCCB4 \uC694\uC57D\uC740 \uC815\uD655\uD788 \uD55C \uAC1C\uC758 top-level comment\uB85C \uAC8C\uC2DC\uD558\uC138\uC694.",
+    ...PR_CONTEXT,
+    "",
+    "\uC774 pull request\uC758 diff\uB97C `gh pr diff <PR NUMBER>`\uC640 `gh pr view <PR NUMBER>`\uB85C \uD655\uC778\uD558\uACE0 \uB9AC\uBDF0\uD558\uC138\uC694.",
+    "\uAD6C\uCCB4\uC801 \uC9C0\uC801\uC740 `mcp__github_inline_comment__create_inline_comment`(`confirmed: true` \uC804\uB2EC)\uB85C inline comment\uB97C \uB2EC\uACE0, \uC804\uCCB4 \uC694\uC57D\uC740 \uC815\uD655\uD788 \uD55C \uAC1C\uC758 top-level comment\uB85C \uAC8C\uC2DC\uD558\uC138\uC694.",
+    "\uC694\uC57D\uC740 `gh pr comment <PR NUMBER> --body-file - <<'ARCHWEAVE_EOF'`\uB85C \uAC8C\uC2DC\uD558\uC138\uC694. \uB2E4\uC74C \uC904\uBD80\uD130 \uBCF8\uBB38\uC744 \uC4F0\uACE0, \uB9C8\uC9C0\uB9C9 \uC904\uC5D0 `ARCHWEAVE_EOF`\uB9CC \uC4F0\uC138\uC694(\uB530\uC634\uD45C \uCE5C \uAD6C\uBD84\uC790\uB77C \uBC31\uD2F1\uACFC `$`\uAC00 \uADF8\uB300\uB85C \uB0A8\uC544\uC694). \uBCF8\uBB38\uC744 `--body \"...\"`\uB098 `$(...)`\uB85C \uB118\uAE30\uC9C0 \uB9C8\uC138\uC694.",
+    "`gh` \uBA85\uB839\uC740 \uD558\uB098\uC529 \uB530\uB85C \uC2E4\uD589\uD558\uC138\uC694. \uB2E4\uB978 \uD504\uB85C\uADF8\uB7A8\uC73C\uB85C \uD30C\uC774\uD504\uD558\uAC70\uB098 `&&`\uB85C \uC787\uC9C0 \uB9C8\uC138\uC694.",
     `top-level \uC694\uC57D \uCF54\uBA58\uD2B8\uC5D0\uB294 \uBC18\uB4DC\uC2DC \uB9AC\uD130\uB7F4 \uB9C8\uCEE4 ${ROUND_MARKER}\uB97C \uD3EC\uD568\uD558\uC138\uC694.`,
     '\uC870\uCE58\uAC00 \uD544\uC694\uD55C \uBB38\uC81C\uAC00 \uC5C6\uC73C\uBA74 "\uC870\uCE58\uAC00 \uD544\uC694\uD55C \uBB38\uC81C\uB97C \uCC3E\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4."\uB77C\uB294 top-level comment\uB97C \uC815\uD655\uD788 \uD55C \uAC1C \uAC8C\uC2DC\uD558\uC138\uC694(\uC774\uB54C\uB3C4 \uB9C8\uCEE4\uB294 \uD3EC\uD568).',
     "\uCF54\uB4DC\uB97C \uC218\uC815\uD558\uC9C0 \uB9C8\uC138\uC694(Do not modify any code). PR\uC744 \uC2B9\uC778\uD558\uAC70\uB098 \uBCD1\uD569\uD558\uC9C0 \uB9C8\uC138\uC694(never approve or merge).",
@@ -601,6 +680,20 @@ function composePrompt(input) {
   sections.push(renderFindingsBlockInstruction(input.locale));
   return sections.join("\n\n---\n\n");
 }
+function renderDeniedToolsStep() {
+  return [
+    "- name: Show denied tool calls",
+    `  if: always() && steps.${CLAUDE_STEP_ID}.outputs.execution_file != ''`,
+    "  env:",
+    `    EXECUTION_FILE: \${{ steps.${CLAUDE_STEP_ID}.outputs.execution_file }}`,
+    "  run: |",
+    '    [ -f "$EXECUTION_FILE" ] || exit 0',
+    `    stop_token="archweave-$(od -An -N16 -tx1 /dev/urandom | tr -d ' \\n')"`,
+    '    echo "::stop-commands::$stop_token"',
+    `    jq -c '.[] | select(.type == "result") | .permission_denials[]? | {tool: .tool_name, command: ((.tool_input.command // "") | tostring | .[0:200])}' "$EXECUTION_FILE" || echo "Could not read the execution file."`,
+    '    echo "::$stop_token::"'
+  ].join("\n");
+}
 function buildWorkflowYaml(input) {
   return renderReviewWorkflow(input, {
     name: "Claude Code Review",
@@ -611,6 +704,7 @@ function buildWorkflowYaml(input) {
       renderCheckoutStep(REVIEW_GATE_CONDITION),
       [
         "- name: Run Claude review",
+        `  id: ${CLAUDE_STEP_ID}`,
         `  if: ${REVIEW_GATE_CONDITION}`,
         `  uses: ${pinnedUses("anthropics/claude-code-action")}`,
         "  with:",
@@ -619,7 +713,8 @@ function buildWorkflowYaml(input) {
         indentBlock(composePrompt(input), 6),
         "    claude_args: |",
         `      --allowedTools "${ALLOWED_TOOLS}"`
-      ].join("\n")
+      ].join("\n"),
+      renderDeniedToolsStep()
     ]
   });
 }
@@ -687,7 +782,9 @@ function buildWorkflowYaml2(input) {
         `    CURSOR_API_KEY: \${{ secrets.${SECRET_NAME2} }}`,
         "    GH_TOKEN: ${{ github.token }}",
         "  run: |",
-        `    agent -p "$(cat <<'${PROMPT_HEREDOC_DELIMITER}'`,
+        // cursor-agent stops at "Workspace Trust Required" without --trust (2026.10.22 on
+        // Actions); the folder is this run's own checkout, and forks never get the secret.
+        `    agent --trust -p "$(cat <<'${PROMPT_HEREDOC_DELIMITER}'`,
         indentBlock(composePrompt2(input), 4),
         `    ${PROMPT_HEREDOC_DELIMITER}`,
         '    )"'
@@ -731,6 +828,7 @@ function composePrompt3(input) {
   sections.push(renderFindingsBlockInstruction(input.locale));
   return sections.join("\n\n---\n\n");
 }
+var GEMINI_CLI_VERSION = "0.65.0";
 function buildWorkflowYaml3(input) {
   return renderReviewWorkflow(input, {
     name: "Gemini Code Review",
@@ -745,8 +843,13 @@ function buildWorkflowYaml3(input) {
         `  uses: ${pinnedUses("google-github-actions/run-gemini-cli")}`,
         "  env:",
         "    GITHUB_TOKEN: ${{ github.token }}",
+        // Gemini CLI 0.65 refuses to run in a folder it hasn't been told to trust (measured
+        // 2026-10-25 on Actions). The folder is this run's own checkout; pull requests from forks
+        // never get here, because they get no secret.
+        "    GEMINI_CLI_TRUST_WORKSPACE: 'true'",
         "  with:",
         `    gemini_api_key: \${{ secrets.${SECRET_NAME3} }}`,
+        `    gemini_cli_version: '${GEMINI_CLI_VERSION}'`,
         "    prompt: |",
         indentBlock(composePrompt3(input), 6)
       ].join("\n")
@@ -919,7 +1022,8 @@ var REVIEW_CHECK_IDS = [
   "review-alt-file-coexistence",
   "review-config-consistency",
   "review-workflow-providers",
-  "review-workflow-pnpm"
+  "review-workflow-pnpm",
+  "review-workflow-fail-open"
 ];
 var WORKFLOWS_DIR = ".github/workflows";
 function archweaveWorkflows(root) {
@@ -976,6 +1080,25 @@ function buildReviewPnpmCheck(root, workflows) {
     suggestedAction: "Regenerate the workflow: nx g @clearlydev/nx-archweave:add-review --onConflict=overwrite."
   });
 }
+var FAIL_CLOSED_VERDICT_MODE = "ARCHWEAVE_VERDICT_OUTPUT: 'github-output'";
+function buildReviewFailOpenCheck(root, workflows) {
+  const id = "review-workflow-fail-open";
+  const label = "Review check fails closed";
+  if (workflows.length === 0)
+    return createDoctorCheck({ id, label, status: "not-applicable", message: "no nx-archweave review workflow", evidence: [] });
+  const failOpen = workflows.filter((path) => !readFileSync2(join2(root, path), "utf-8").includes(FAIL_CLOSED_VERDICT_MODE));
+  if (failOpen.length === 0) {
+    return createDoctorCheck({ id, label, status: "pass", message: "a review run that leaves no readable summary fails the review check", evidence: workflows });
+  }
+  return createDoctorCheck({
+    id,
+    label,
+    status: "error",
+    message: "fail-open workflow: generated before nx-archweave 0.2.2, it passes the review check when the AI review posts no summary or one that cannot be read, so an unreviewed pull request can merge",
+    evidence: failOpen,
+    suggestedAction: "Re-run add-review: nx g @clearlydev/nx-archweave:add-review --onConflict=overwrite. The report shows the difference before anything is replaced."
+  });
+}
 function buildReviewChecks(root) {
   const config = readToolkitConfigState(root);
   const mainWorkflowPath = REVIEW_PROVIDERS[resolveProviderId(config)].workflowFileName;
@@ -989,7 +1112,8 @@ function buildReviewChecks(root) {
     buildReviewAltFileCoexistenceCheck(mainWorkflowPath, altWorkflowPath, mainExists, altExists),
     buildReviewConfigConsistencyCheck(root, mainWorkflowPath, mainExists, config),
     buildReviewProvidersCheck(workflows),
-    buildReviewPnpmCheck(root, workflows)
+    buildReviewPnpmCheck(root, workflows),
+    buildReviewFailOpenCheck(root, workflows)
   ];
 }
 function buildReviewWorkflowPresentCheck(mainWorkflowPath, mainExists, mainIsOurs, config) {
@@ -1228,15 +1352,22 @@ var BACKEND_CHECK_IDS = [
   "backend-config-consistency",
   "shared-types-lib",
   "boundary-constraints-applied",
-  "boundary-tags-exist"
+  "boundary-tags-exist",
+  "boundary-untagged-projects"
 ];
 var CHECK_LABELS = {
   "backend-framework": "Backend framework (root package.json only)",
   "backend-config-consistency": "Backend config consistency",
   "shared-types-lib": "shared-types library",
   "boundary-constraints-applied": "Module-boundary constraints",
-  "boundary-tags-exist": "Boundary tags exist"
+  "boundary-tags-exist": "Boundary tags exist",
+  "boundary-untagged-projects": "Projects without a boundary tag"
 };
+var UNTAGGED_LISTED = 10;
+function isEndToEndRoot(projectRoot) {
+  const base = projectRoot.split("/").pop() ?? "";
+  return base === "e2e" || base.endsWith("-e2e");
+}
 function collectScopeTags(root, projects) {
   if (projects !== void 0)
     return new Set(projects.flatMap((project) => project.tags));
@@ -1393,13 +1524,15 @@ function buildBackendChecks(root, projects) {
     suggestedAction: classification === "enforced" ? void 0 : "Run add-backend with --applyEslint, or merge its snippet yourself."
   }));
   if (classification !== "enforced") {
-    checks.push(createDoctorCheck({
-      id: "boundary-tags-exist",
-      label: CHECK_LABELS["boundary-tags-exist"],
-      status: "not-applicable",
-      message: "Skipped \u2014 boundary constraints are not enforced (see boundary-constraints-applied)",
-      evidence: []
-    }));
+    for (const id of ["boundary-tags-exist", "boundary-untagged-projects"]) {
+      checks.push(createDoctorCheck({
+        id,
+        label: CHECK_LABELS[id],
+        status: "not-applicable",
+        message: "Skipped \u2014 boundary constraints are not enforced (see boundary-constraints-applied)",
+        evidence: []
+      }));
+    }
   } else {
     const tags = collectScopeTags(root, projects);
     const required = readsBackendOnly(root) ? [boundaryTags.backend] : [boundaryTags.frontend, boundaryTags.backend];
@@ -1412,9 +1545,36 @@ function buildBackendChecks(root, projects) {
       evidence: missing.length === 0 ? [] : missing,
       suggestedAction: missing.length === 0 ? void 0 : "Add the missing tag(s) to the app project.json tags or package.json nx.tags (add-backend does this for the two apps)."
     }));
+    checks.push(buildUntaggedProjectsCheck(projects, [boundaryTags.frontend, boundaryTags.backend, boundaryTags.shared]));
   }
   return checks;
 }
+function buildUntaggedProjectsCheck(projects, roleTags) {
+  const id = "boundary-untagged-projects";
+  if (projects === void 0) {
+    return createDoctorCheck({
+      id,
+      label: CHECK_LABELS[id],
+      status: "not-applicable",
+      message: "Skipped \u2014 needs the workspace's Nx project list (run doctor through nx g)",
+      evidence: []
+    });
+  }
+  const untagged = projects.filter((project) => project.root !== "" && project.root !== "." && !isEndToEndRoot(project.root)).filter((project) => !project.tags.some((tag) => roleTags.includes(tag))).map((project) => project.name);
+  if (untagged.length === 0) {
+    return createDoctorCheck({ id, label: CHECK_LABELS[id], status: "pass", message: `every project carries one of ${roleTags.join(", ")}`, evidence: [] });
+  }
+  const listed = untagged.slice(0, UNTAGGED_LISTED).join(", ");
+  const more = untagged.length > UNTAGGED_LISTED ? ` and ${untagged.length - UNTAGGED_LISTED} more` : "";
+  return createDoctorCheck({
+    id,
+    label: CHECK_LABELS[id],
+    status: "warning",
+    message: `${untagged.length} project(s) carry none of ${roleTags.join(", ")}, so the frontend/backend deny rules don't cover them: ${listed}${more}`,
+    evidence: untagged,
+    suggestedAction: `Give each one the tag of its side (${roleTags.join(", ")}) in package.json nx.tags or project.json tags. When you generate a library, pass it right away: nx g @nx/js:lib libs/<name> --tags=${roleTags[2]}.`
+  });
+}
 
 // ../template-engine/dist/doctor/fsd-like-check.js
 import { existsSync as existsSync4, readdirSync as readdirSync3 } from "node:fs";
@@ -1665,7 +1825,7 @@ var NOT_APPLICABLE_IDS = [
   ...REVIEW_CHECK_IDS,
   ...BACKEND_CHECK_IDS
 ];
-function runDoctorChecks(root, projects) {
+function runDoctorChecks(root, projects, nxSupport) {
   const env = detectEnvironment(root);
   if (!env.hasNxWorkspace) {
     const checks2 = [
@@ -1695,7 +1855,7 @@ function runDoctorChecks(root, projects) {
       message: "nx.json found",
       evidence: ["nx.json"]
     }),
-    buildNxVersionCheck(env),
+    buildNxVersionCheck(env, nxSupport),
     buildFsdLikeCheck(root, projects),
     buildFsdEnforcementCheck(root, projects),
     buildFsdRuleAnchoredCheck(root, projects),
@@ -1724,12 +1884,25 @@ function runDoctorChecks(root, projects) {
   const overallStatus = computeOverallStatus(checks);
   return { checks, overallStatus };
 }
-var VALIDATED_NX_MAJOR = 23;
+var VALIDATED_NX_MAJORS = [23, 24];
+var VALIDATED_RANGE_TEXT = `${VALIDATED_NX_MAJORS[0]}.x\u2013${VALIDATED_NX_MAJORS[VALIDATED_NX_MAJORS.length - 1]}.x`;
 function extractMajor(version) {
   const match = /(\d+)/.exec(version);
   return match ? Number(match[1]) : null;
 }
-function buildNxVersionCheck(env) {
+function buildNxVersionCheck(env, nxSupport) {
+  if (nxSupport?.inRange === false && nxSupport.installedVersion !== void 0) {
+    const major2 = extractMajor(nxSupport.installedVersion);
+    const supported = `${nxSupport.supportedMajors.min}.x\u2013${nxSupport.supportedMajors.max}.x`;
+    return createDoctorCheck({
+      id: "nx-version",
+      label: "Nx version",
+      status: "error",
+      message: `Nx ${nxSupport.installedVersion} is installed, outside the majors the plugin's @nx/devkit ${nxSupport.devkitVersion} supports (nx ${supported}) \u2014 the generators may fail to load or misbehave`,
+      evidence: [`nx@${nxSupport.installedVersion}`, `@nx/devkit@${nxSupport.devkitVersion}`],
+      suggestedAction: `Install the @clearlydev/nx-archweave release built for Nx ${major2 ?? "this"}${major2 === null ? "" : ".x"}, or keep nx at ${supported}.`
+    });
+  }
   if (env.rootPackageJsonError) {
     return createDoctorCheck({
       id: "nx-version",
@@ -1759,30 +1932,30 @@ function buildNxVersionCheck(env) {
       evidence: [`nx@${env.nxVersion}`]
     });
   }
-  if (major === VALIDATED_NX_MAJOR) {
+  if (VALIDATED_NX_MAJORS.includes(major)) {
     return createDoctorCheck({
       id: "nx-version",
       label: "Nx version",
       status: "pass",
-      message: `Nx ${env.nxVersion} \u2014 within the toolkit-validated range (${VALIDATED_NX_MAJOR}.x)`,
+      message: `Nx ${env.nxVersion} \u2014 within the toolkit-validated range (${VALIDATED_RANGE_TEXT})`,
       evidence: [`nx@${env.nxVersion}`]
     });
   }
-  if (major < VALIDATED_NX_MAJOR) {
+  if (major < VALIDATED_NX_MAJORS[0]) {
     return createDoctorCheck({
       id: "nx-version",
       label: "Nx version",
       status: "warning",
-      message: `Nx ${env.nxVersion} is below the toolkit-validated range (${VALIDATED_NX_MAJOR}.x) \u2014 generator behavior is not guaranteed`,
+      message: `Nx ${env.nxVersion} is below the toolkit-validated range (${VALIDATED_RANGE_TEXT}) \u2014 generator behavior is not guaranteed`,
       evidence: [`nx@${env.nxVersion}`],
-      suggestedAction: `Upgrade the workspace to Nx ${VALIDATED_NX_MAJOR}.x before running the generators.`
+      suggestedAction: `Upgrade the workspace to Nx ${VALIDATED_NX_MAJORS[VALIDATED_NX_MAJORS.length - 1]}.x before running the generators.`
     });
   }
   return createDoctorCheck({
     id: "nx-version",
     label: "Nx version",
     status: "warning",
-    message: `Nx ${env.nxVersion} is above the toolkit-validated range (${VALIDATED_NX_MAJOR}.x) \u2014 may work, unvalidated`,
+    message: `Nx ${env.nxVersion} is above the toolkit-validated range (${VALIDATED_RANGE_TEXT}) \u2014 may work, unvalidated`,
     evidence: [`nx@${env.nxVersion}`],
     suggestedAction: "Proceed with care and report issues; validation for newer majors lands with toolkit updates."
   });
@@ -2714,7 +2887,7 @@ function diskRunNx(root) {
 var DOCTOR_TARGET_ENVIRONMENT = "claude-code";
 async function buildDoctorReportWithIntegrations(root, options = {}, deps = {}) {
   const integrationsRoot = deps.integrationsRoot ?? createIntegrationsCompositionRoot();
-  const baseReport = runDoctorChecks(root, options.projects);
+  const baseReport = runDoctorChecks(root, options.projects, options.nxSupport);
   const declaredIds = readEnabledIntegrationIds(root);
   const runNx = diskRunNx(root);
   const driftResults = await detectIntegrationsDrift({
@@ -3163,11 +3336,49 @@ function buildPolicySuggestion(tree, sourceRoot, current) {
   });
 }
 
+// src/generators/doctor/nx-support.ts
+import { readFileSync as readFileSync9 } from "node:fs";
+import { createRequire } from "node:module";
+import { join as join12 } from "node:path";
+var MAJORS_EITHER_SIDE = 1;
+function majorOf(version) {
+  const match = /^(\d+)\./.exec(version.trim());
+  return match ? Number(match[1]) : void 0;
+}
+function readOwnDevkitVersion() {
+  try {
+    const path = createRequire(import.meta.url).resolve("@nx/devkit/package.json");
+    const version = JSON.parse(readFileSync9(path, "utf-8")).version;
+    return typeof version === "string" ? version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readInstalledNx(root) {
+  try {
+    const version = JSON.parse(readFileSync9(join12(root, "node_modules", "nx", "package.json"), "utf-8")).version;
+    return typeof version === "string" ? version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readNxSupport(root, deps = {}) {
+  const devkitVersion = (deps.devkitVersion ?? readOwnDevkitVersion)();
+  const devkitMajor = devkitVersion === void 0 ? void 0 : majorOf(devkitVersion);
+  if (devkitVersion === void 0 || devkitMajor === void 0) return void 0;
+  const supportedMajors = { min: devkitMajor - MAJORS_EITHER_SIDE, max: devkitMajor + MAJORS_EITHER_SIDE };
+  const installedVersion = (deps.installedNx ?? readInstalledNx)(root);
+  const installedMajor = installedVersion === void 0 ? void 0 : majorOf(installedVersion);
+  const inRange = installedMajor === void 0 ? void 0 : installedMajor >= supportedMajors.min && installedMajor <= supportedMajors.max;
+  return { devkitVersion, supportedMajors, installedVersion, inRange };
+}
+
 // src/generators/doctor/generator.ts
 async function doctorGenerator(tree, options) {
   const base = await buildDoctorReportWithIntegrations(tree.root, {
     liveIntegrations: options.liveIntegrations ?? false,
-    projects: doctorProjects(tree)
+    projects: doctorProjects(tree),
+    nxSupport: readNxSupport(tree.root)
   });
   const checks = base.overallStatus === "unsupported" ? base.checks : [...base.checks, ...buildWorkspaceChecks(tree)];
   const report = { checks, overallStatus: base.overallStatus === "unsupported" ? base.overallStatus : computeOverallStatus(checks) };