@cleocode/cleo 2026.10.2 → 2026.10.4

package/dist/cli/doctor-AX5TICQO.js

@@ -0,0 +1,1253 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  createDoctorProgress
+} from "./chunk-W3JLYKKY.js";
+import {
+  readMigrationConflicts
+} from "./chunk-REUTEW3O.js";
+import {
+  doctorReleaseReadinessCommand
+} from "./chunk-A2IUEIM5.js";
+import {
+  doctorRepairCommand
+} from "./chunk-DYABOIHB.js";
+import {
+  doctorSkillFixturesCommand
+} from "./chunk-YUZJI67I.js";
+import {
+  doctorSplitBrainCommand
+} from "./chunk-5ZFFUFH7.js";
+import {
+  doctorSupersededStoreCommand
+} from "./chunk-S24YI723.js";
+import {
+  doctorToolLocksCommand
+} from "./chunk-OAPN46TC.js";
+import {
+  doctorTwinCollapseCommand
+} from "./chunk-37NU2XDP.js";
+import {
+  doctorWorktreeStoresCommand
+} from "./chunk-EGOTK2HA.js";
+import {
+  doctorMalformedIdsCommand
+} from "./chunk-AYA6F4ZT.js";
+import {
+  doctorManifestRowsCommand
+} from "./chunk-NRKWJLMS.js";
+import {
+  doctorMemoryGuardCommand
+} from "./chunk-YGKEECTI.js";
+import {
+  doctorMigrationsCommand
+} from "./chunk-KJDWWQFY.js";
+import {
+  doctorNexusResidencyCommand
+} from "./chunk-EBRZ76HS.js";
+import {
+  doctorProjectIdentityCommand
+} from "./chunk-5J2VH3BC.js";
+import {
+  doctorRegistryCommand
+} from "./chunk-MNJRLSEQ.js";
+import {
+  runDoctorProjects
+} from "./chunk-3PGH67MT.js";
+import {
+  doctorDepCyclesCommand
+} from "./chunk-XRAX6XFP.js";
+import {
+  doctorExodusResidueCommand
+} from "./chunk-GFGLLDXX.js";
+import {
+  doctorExodusCommand
+} from "./chunk-DVTPIZJM.js";
+import {
+  doctorFkCheckCommand
+} from "./chunk-2JIJD2I7.js";
+import {
+  doctorGlobalDeliveryCommand
+} from "./chunk-LKNUA3SB.js";
+import {
+  doctorHeavyCommandHookCommand
+} from "./chunk-QPUY2HQZ.js";
+import {
+  doctorLegacyBackupsCommand
+} from "./chunk-JNZJPIPJ.js";
+import {
+  doctorLegacyReaperCommand
+} from "./chunk-NSHV2JNM.js";
+import {
+  doctorAcBindingsCommand
+} from "./chunk-ZZTHTMQP.js";
+import {
+  doctorAcceptanceDriftCommand
+} from "./chunk-LWQBJQSE.js";
+import {
+  doctorCredentialsCommand
+} from "./chunk-BCEXRFA2.js";
+import {
+  doctorDbSubstrateCommand
+} from "./chunk-KHB52JNB.js";
+import "./chunk-47JYZAMS.js";
+import "./chunk-C3B7C43W.js";
+import {
+  isSubCommandDispatch
+} from "./chunk-YY66LFZF.js";
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import {
+  dispatchFromCli,
+  dispatchRaw
+} from "./chunk-3IOQVUO7.js";
+import "./chunk-AWCQH2W5.js";
+import "./chunk-OGV57L4J.js";
+import "./chunk-ZBISIPCK.js";
+import {
+  cliError,
+  cliOutput,
+  humanLine
+} from "./chunk-3ZO3M37V.js";
+import "./chunk-6JSJNYH2.js";
+import "./chunk-QFFQSKRC.js";
+
+// packages/cleo/src/cli/commands/doctor.ts
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { getProjectRoot as getProjectRoot2, pushWarning } from "@cleocode/core";
+import { renderInvariantAuditLines } from "@cleocode/core/doctor/invariant-audit-render.js";
+import {
+  quarantineRogueCleoDir,
+  scanRogueCleoDirs
+} from "@cleocode/core/system/rogue-cleo-detector.js";
+
+// packages/cleo/src/cli/commands/doctor-knowledge.ts
+import { readFile } from "node:fs/promises";
+import {
+  applyPreparedKnowledgeRepair,
+  cancelPreparedKnowledgeRepair,
+  createKnowledgeRepairInvocation,
+  inspectPreparedKnowledgeRepair,
+  KnowledgeRepairError,
+  listPreparedKnowledgeRepairs,
+  parseKnowledgeRepairProposal,
+  prepareKnowledgeRepair,
+  prepareKnowledgeRollback,
+  resumePreparedKnowledgeRepair,
+  runKnowledgeDoctor
+} from "@cleocode/core/doctor/knowledge.js";
+import { getProjectRoot } from "@cleocode/core/paths.js";
+var doctorKnowledgeSubcommand = defineCommand({
+  meta: {
+    name: "knowledge",
+    description: "Assess project knowledge and apply bounded, sourced, reversible repairs"
+  },
+  args: {
+    fix: {
+      type: "boolean",
+      description: "Apply deterministic repairs to confirmed derived defects"
+    },
+    "dry-run": { type: "boolean", description: "Preview findings and proposals without mutations" },
+    resolve: { type: "string", description: "Apply a sourced repair proposal from a JSON file" },
+    prepare: { type: "string", description: "Persist a sourced JSON proposal without applying it" },
+    apply: {
+      type: "string",
+      description: "Apply an immutable prepared job under a fresh bounded attempt"
+    },
+    jobs: {
+      type: "boolean",
+      description: "Discover durable repairs for an explicit original actor"
+    },
+    cursor: { type: "string", description: "Exact JSON nextCursor from the preceding --jobs page" },
+    inspect: {
+      type: "string",
+      description: "Inspect a prepared job, retained receipts and lifecycle ledger"
+    },
+    cancel: {
+      type: "string",
+      description: "Request cancellation; committed repair effects are preserved"
+    },
+    resume: {
+      type: "string",
+      description: "Explicitly retry recoverable work while retaining prior attempts"
+    },
+    actor: {
+      type: "string",
+      description: "Explicit stable repair actor; must match prepared work"
+    },
+    "proposal-id": {
+      type: "string",
+      description: "Immutable proposal identity for job operations or new rollback"
+    },
+    limit: {
+      type: "string",
+      description: "Page size: --jobs 1\u2013100 (default 25); inspection 1\u20131000 (default 100)"
+    },
+    offset: { type: "string", default: "0", description: "Inspection ledger page offset" },
+    rollback: {
+      type: "string",
+      description: "Restore a prior repair receipt after checking its post-state"
+    },
+    decision: {
+      type: "string",
+      description: "Assess explicit decision-to-task-to-code evidence and supported linking actions"
+    },
+    task: {
+      type: "string",
+      description: "Include evidence-derived footprint findings for one task"
+    },
+    "budget-ms": {
+      type: "string",
+      default: "2000",
+      description: "Shared invocation budget in milliseconds (1\u2013120000), default 2000; synchronous work is cooperative"
+    },
+    json: { type: "boolean", description: "Output one structured envelope" }
+  },
+  async run({ args }) {
+    const startedAt = Date.now();
+    const root = getProjectRoot();
+    let context;
+    let pending;
+    try {
+      const budgetMs = Number(args["budget-ms"]);
+      if (!Number.isSafeInteger(budgetMs) || budgetMs < 1 || budgetMs > 12e4)
+        throw new KnowledgeRepairError(
+          "E_REPAIR_INPUT",
+          "--budget-ms must be an integer between 1 and 120000."
+        );
+      const deadlineAt = startedAt + budgetMs;
+      const actions = [
+        args.fix,
+        args.resolve,
+        args.rollback,
+        args.prepare,
+        args.apply,
+        args.inspect,
+        args.cancel,
+        args.resume,
+        args.jobs
+      ];
+      if (actions.filter(Boolean).length > 1)
+        throw new KnowledgeRepairError(
+          "E_REPAIR_INPUT",
+          "Select exactly one repair lifecycle action."
+        );
+      if (args["dry-run"] && (args.prepare || args.apply || args.inspect || args.cancel || args.resume || args.rollback || args.jobs))
+        throw new KnowledgeRepairError(
+          "E_REPAIR_INPUT",
+          "--dry-run cannot execute a repair lifecycle action."
+        );
+      const lifecycle = actions.some(Boolean) && !args["dry-run"];
+      if (lifecycle && !args.actor?.trim())
+        throw new KnowledgeRepairError(
+          "E_REPAIR_ACTOR",
+          "--actor explicitly identifies the stable repair caller."
+        );
+      if ((args.apply || args.inspect || args.cancel || args.resume || args.rollback) && !args["proposal-id"]?.trim())
+        throw new KnowledgeRepairError(
+          "E_REPAIR_INPUT",
+          "--proposal-id must identify the immutable prepared input or new rollback."
+        );
+      if (args.cursor && !args.jobs)
+        throw new KnowledgeRepairError("E_REPAIR_INPUT", "--cursor requires --jobs.");
+      if (args.jobs) {
+        if (args["proposal-id"] || Number(args.offset) !== 0)
+          throw new KnowledgeRepairError(
+            "E_REPAIR_INPUT",
+            "--jobs uses its returned cursor, not proposal identity or offset."
+          );
+        context = await createKnowledgeRepairInvocation(
+          root,
+          args.actor,
+          "knowledge-inventory",
+          deadlineAt
+        );
+        cliOutput(
+          await listPreparedKnowledgeRepairs(context, {
+            limit: Number(args.limit ?? "25"),
+            after: args.cursor === void 0 ? void 0 : JSON.parse(args.cursor)
+          }),
+          { command: "doctor", operation: "doctor.knowledge" }
+        );
+        return;
+      }
+      let proposal = args.prepare || args.resolve ? parseKnowledgeRepairProposal(await readFile(args.prepare || args.resolve, "utf8")) : void 0;
+      if (proposal && args["proposal-id"] && proposal.id !== args["proposal-id"])
+        throw new KnowledgeRepairError(
+          "E_REPAIR_INPUT",
+          "--proposal-id differs from the sourced proposal."
+        );
+      if (!lifecycle || args.fix) {
+        const report = await runKnowledgeDoctor(root, {
+          budgetMs: Math.max(0, deadlineAt - Date.now()),
+          fix: args.fix,
+          dryRun: true,
+          proposal,
+          taskId: args.task,
+          decisionId: args.decision
+        });
+        if (!lifecycle || report.health.coverage.maintenanceState === "pending" || !report.proposals[0]) {
+          cliOutput(report, { command: "doctor", operation: "doctor.knowledge" });
+          return;
+        }
+        proposal = report.proposals[0];
+      }
+      if (proposal && args["proposal-id"] && proposal.id !== args["proposal-id"])
+        throw new KnowledgeRepairError(
+          "E_REPAIR_INPUT",
+          "--proposal-id differs from the assessed proposal."
+        );
+      const proposalId = proposal?.id ?? args["proposal-id"];
+      if (!proposalId || !args.actor)
+        throw new KnowledgeRepairError(
+          "E_REPAIR_INPUT",
+          "Explicit actor and immutable proposal identity are required."
+        );
+      context = await createKnowledgeRepairInvocation(root, args.actor, proposalId, deadlineAt);
+      if (args.inspect) {
+        cliOutput(
+          await inspectPreparedKnowledgeRepair(
+            context,
+            args.inspect,
+            Number(args.limit ?? "100"),
+            Number(args.offset)
+          ),
+          { command: "doctor", operation: "doctor.knowledge" }
+        );
+        return;
+      }
+      if (args.cancel) {
+        cliOutput(await cancelPreparedKnowledgeRepair(context, args.cancel), {
+          command: "doctor",
+          operation: "doctor.knowledge"
+        });
+        return;
+      }
+      if (proposal) pending = await prepareKnowledgeRepair(context, proposal);
+      else if (args.rollback) pending = await prepareKnowledgeRollback(context, args.rollback);
+      if (args.prepare) {
+        cliOutput(pending, { command: "doctor", operation: "doctor.knowledge" });
+        return;
+      }
+      const jobId = pending?.jobId ?? args.apply ?? args.resume;
+      if (!jobId) throw new KnowledgeRepairError("E_REPAIR_INPUT", "A prepared job is required.");
+      const result = args.resume ? await resumePreparedKnowledgeRepair(context, jobId) : await applyPreparedKnowledgeRepair(context, jobId);
+      cliOutput(result, { command: "doctor", operation: "doctor.knowledge" });
+    } catch (error) {
+      cliError(
+        error instanceof Error ? error.message : String(error),
+        6,
+        {
+          name: error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : "E_REPAIR_INPUT",
+          details: {
+            prepared: pending,
+            attemptFailure: error instanceof KnowledgeRepairError ? error.attemptFailure : void 0,
+            recoveryState: error instanceof KnowledgeRepairError ? error.recoveryState : void 0,
+            deadlineAt: context?.deadlineAt,
+            elapsedMs: Date.now() - startedAt
+          }
+        },
+        { operation: "doctor.knowledge" }
+      );
+      process.exitCode = 6;
+    } finally {
+      context?.close();
+    }
+  }
+});
+
+// packages/cleo/src/cli/commands/doctor.ts
+var FIXTURE_ID_PATTERNS = [/^E\d+$/, /^T\d+EP$/];
+var FIXTURE_TITLE_KEYWORDS = [
+  "test epic",
+  "with no files",
+  "standalone epic",
+  "fixture"
+];
+async function scanTestFixturesInProd(projectRoot) {
+  const { getDb, getNativeDb } = await import("@cleocode/core/store/sqlite.js");
+  await getDb(projectRoot);
+  const nativeDb = getNativeDb(projectRoot);
+  if (!nativeDb) return [];
+  const rows = nativeDb.prepare("SELECT id, title, type, status FROM tasks WHERE status != 'deleted' LIMIT 2000").all();
+  const matches = [];
+  for (const row of rows) {
+    const lower = (row.title ?? "").toLowerCase();
+    const idPatternMatch = FIXTURE_ID_PATTERNS.some((p) => p.test(row.id));
+    const titleKeywordMatch = FIXTURE_TITLE_KEYWORDS.find((kw) => lower.includes(kw));
+    if (idPatternMatch) {
+      matches.push({
+        id: row.id,
+        title: row.title ?? "",
+        type: row.type ?? "",
+        confidence: "HIGH",
+        rationale: `id matches fixture pattern (^E\\d+$ or ^T\\d+EP$)`
+      });
+    } else if (titleKeywordMatch) {
+      matches.push({
+        id: row.id,
+        title: row.title ?? "",
+        type: row.type ?? "",
+        confidence: "MED",
+        rationale: `title contains fixture keyword "${titleKeywordMatch}"`
+      });
+    }
+  }
+  return matches;
+}
+async function quarantineTestFixtures(projectRoot, matches) {
+  if (matches.length === 0) return 0;
+  const cleoDir = join(projectRoot, ".cleo");
+  const quarantineDir = join(
+    cleoDir,
+    "quarantine",
+    `fixture-scan-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`
+  );
+  mkdirSync(quarantineDir, { recursive: true });
+  const manifest = matches.map((m) => ({ ...m, quarantinedAt: (/* @__PURE__ */ new Date()).toISOString() }));
+  writeFileSync(
+    join(quarantineDir, "manifest.jsonl"),
+    manifest.map((m) => JSON.stringify(m)).join("\n") + "\n"
+  );
+  const { getNativeDb } = await import("@cleocode/core/store/sqlite.js");
+  const nativeDb = getNativeDb();
+  if (nativeDb) {
+    for (const m of matches) {
+      try {
+        nativeDb.prepare(
+          "UPDATE tasks SET labels_json = json_insert(COALESCE(labels_json, '[]'), '$[#]', 'fixture-quarantine'), status = 'cancelled' WHERE id = ?"
+        ).run(m.id);
+      } catch {
+      }
+    }
+  }
+  return matches.length;
+}
+function renderHookMatrixHuman(data) {
+  const { events, providers, matrix, summary, caampVersion, detectedProvider } = data;
+  humanLine(`
+Provider Hook Matrix (CAAMP ${caampVersion} canonical taxonomy)
+`);
+  if (detectedProvider) {
+    humanLine(`Detected provider: ${detectedProvider}
+`);
+  }
+  if (providers.length === 0) {
+    humanLine("No providers found in CAAMP registry.");
+    return;
+  }
+  const EVENT_COL = Math.max(...events.map((e) => e.length), "Event".length);
+  const provCols = providers.map((p) => Math.max(p.length, 5));
+  const headerParts = [
+    "Event".padEnd(EVENT_COL),
+    ...providers.map((p, i) => p.padEnd(provCols[i]))
+  ];
+  humanLine(`  ${headerParts.join("  ")}`);
+  const sepParts = ["-".repeat(EVENT_COL), ...provCols.map((w) => "-".repeat(w))];
+  humanLine(`  ${sepParts.join("  ")}`);
+  for (const event of events) {
+    const cells = providers.map((p, i) => {
+      const supported = matrix[event]?.[p] === true;
+      const symbol = supported ? "\u2713" : "-";
+      return symbol.padEnd(provCols[i]);
+    });
+    humanLine(`  ${event.padEnd(EVENT_COL)}  ${cells.join("  ")}`);
+  }
+  humanLine("");
+  const coverageParts = summary.map(
+    (s) => `${s.providerId} ${s.supportedCount}/${s.totalCanonical} (${s.coverage}%)`
+  );
+  humanLine(`Coverage: ${coverageParts.join(", ")}
+`);
+}
+function renderInvariantAuditHuman(result) {
+  for (const line of renderInvariantAuditLines(result)) {
+    humanLine(line);
+  }
+}
+var doctorCommand = defineCommand({
+  meta: { name: "doctor", description: "Run system diagnostics and health checks" },
+  subCommands: {
+    knowledge: doctorKnowledgeSubcommand,
+    // T10307 / Saga T10281 / Epic T10282 — DB-substrate walker
+    "db-substrate": doctorDbSubstrateCommand,
+    // T10309 / Saga T10281 / Epic T10282 — Legacy-backup walker
+    "legacy-backups": doctorLegacyBackupsCommand,
+    // T12131 — the reaper that kills live Codex sessions
+    "legacy-reaper": doctorLegacyReaperCommand,
+    // T12128 — task ids that fail the write-path validator
+    "malformed-ids": doctorMalformedIdsCommand,
+    // T12796 — the migration journal of each store (read-only; the live journal count)
+    migrations: doctorMigrationsCommand,
+    // T12686 — manifest rows whose metadata violates the stored field contract (+ --repair/--rollback)
+    "manifest-rows": doctorManifestRowsCommand,
+    // T12095 — pre-dual-scope store files still on disk under their old LIVE names
+    "superseded-store": doctorSupersededStoreCommand,
+    // T12535 — twin collapses (bare schema_meta / sticky_tags → prefixed twins): report + --retry
+    "twin-collapse": doctorTwinCollapseCommand,
+    // T12460 — project stores stranded inside CLEO worktrees (read-only report)
+    "worktree-stores": doctorWorktreeStoresCommand,
+    // T12097 — machine-wide guard for test runs started OUTSIDE cleo verify
+    "memory-guard": doctorMemoryGuardCommand,
+    // T13124 — the heavy-command hook per agent harness in use (+ --fix installs it)
+    "heavy-command-hook": doctorHeavyCommandHookCommand,
+    // T12353 · T12716 — tracked .cleo/project.json / project-id vs project-info.json (+ --resolve migrate / re-key)
+    "project-identity": doctorProjectIdentityCommand,
+    // T12596 · T12598 — ~/.cleo, the global hub and every harness skill install must resolve
+    "global-delivery": doctorGlobalDeliveryCommand,
+    // T12645 — caamp test fixtures left in the real skills root (quarantine with a receipt)
+    "skill-fixtures": doctorSkillFixturesCommand,
+    // T12471 — machine-wide registry integrity: rebind moved by id, flag split/missing/temp
+    projects: doctorRegistryCommand,
+    // T12329 — import rows only a diverged store copy has, under new ids (dry-run first)
+    "split-brain": doctorSplitBrainCommand,
+    // T12157 — the two acceptance stores (json column vs text+child rows) must agree
+    "acceptance-drift": doctorAcceptanceDriftCommand,
+    // T12790 — evidence bindings whose AC row is gone (no FK): report + --fix (audited)
+    "ac-bindings": doctorAcBindingsCommand,
+    // T12886 — stored task dependency cycles + repair plan (read-only)
+    "dep-cycles": doctorDepCyclesCommand,
+    // T12158 — tables nexus resolves by bare name must actually live where it assumes
+    "nexus-residency": doctorNexusResidencyCommand,
+    // T12113 (gh#1222) — evidence-tool semaphore holders + orphan reaping
+    "tool-locks": doctorToolLocksCommand,
+    // T12326 — project credentials still keyed by project PATH (+ --fix re-keys)
+    credentials: doctorCredentialsCommand,
+    // T11777 / Saga T11242 / Epic T11249 — exodus stranded-residue check (+ --fix)
+    "exodus-residue": doctorExodusResidueCommand,
+    // T11837 / Saga T11242 / Epic T11833 — read-only exodus health report
+    "exodus-health": doctorExodusCommand,
+    // T11530 / Saga T11242 / Epic T11249 — consolidated FK integrity check
+    "fk-check": doctorFkCheckCommand,
+    // T11829 / Saga T11242 / Epic T11833 — DHQ-060 malformed-DB repair entry point
+    repair: doctorRepairCommand,
+    // T10458 / Saga T10431 / Epic T10436 — Release-readiness preflight
+    "release-readiness": doctorReleaseReadinessCommand
+  },
+  args: {
+    detailed: {
+      type: "boolean",
+      description: "Show detailed health check results"
+    },
+    comprehensive: {
+      type: "boolean",
+      description: "Run comprehensive doctor report"
+    },
+    full: {
+      type: "boolean",
+      description: "Run operational smoke tests across all domains"
+    },
+    fix: {
+      type: "boolean",
+      description: "Auto-fix failed checks"
+    },
+    coherence: {
+      type: "boolean",
+      description: "Run coherence check across task data"
+    },
+    hooks: {
+      type: "boolean",
+      description: "Show cross-provider hook support matrix (CAAMP canonical taxonomy)"
+    },
+    "all-projects": {
+      type: "boolean",
+      description: "Probe DB + config health for every registered project (nexus.db)"
+    },
+    "ignore-unreachable": {
+      type: "boolean",
+      description: "When used with --all-projects, exit 1 instead of 2 on unreachable projects"
+    },
+    "scan-rogue-cleo-dirs": {
+      type: "boolean",
+      description: "Scan for rogue .cleo/ directories inside sub-packages and print forensic report"
+    },
+    "quarantine-rogue-cleo-dirs": {
+      type: "boolean",
+      description: "Move all rogue .cleo/ sub-package directories to .cleo/quarantine/ (never deletes)"
+    },
+    "scan-stray-nexus-dbs": {
+      type: "boolean",
+      description: "Scan ~/.local/share/cleo/ for orphaned nexus.db files and print report (T9052)"
+    },
+    "audit-worktrees": {
+      type: "boolean",
+      description: "Audit orphaned agent worktree directories and report what cleo gc --worktrees would remove (T9043)"
+    },
+    /**
+     * T9790: list orphan `.cleo/` directories under
+     * `<projectRoot>/.claude/worktrees/` with full provenance. Read-only.
+     */
+    "audit-worktree-orphans": {
+      type: "boolean",
+      description: "List orphan .cleo/ directories under .claude/worktrees/ (T9790, fallout from T9550/T9580)"
+    },
+    /**
+     * T9962: timeout in seconds for --audit-worktree-orphans and
+     * --prune-worktree-orphans. On expiry the scan returns a partial result.
+     * Default: 30 seconds.
+     */
+    timeout: {
+      type: "string",
+      description: "Timeout in seconds for worktree-orphan audit/prune scan (default: 30). Partial results are returned on expiry."
+    },
+    /**
+     * T9962: per-level fan-out cap for --audit-worktree-orphans.
+     * Default: 500.
+     */
+    "max-entries-per-level": {
+      type: "string",
+      description: "Per-level entry hard-stop for worktree-orphan scan (default: 500). Scan aborts with partial result when exceeded."
+    },
+    /**
+     * T9790: archive then remove every orphan reported by
+     * `--audit-worktree-orphans`. Combine with `--dry-run` to preview
+     * without touching the filesystem.
+     */
+    "prune-worktree-orphans": {
+      type: "boolean",
+      description: "Archive then remove orphan .cleo/ directories under .claude/worktrees/ (T9790)"
+    },
+    "audit-temp": {
+      type: "boolean",
+      description: "Audit orphaned CLEO-generated temp directories and report what cleo gc --temp would remove (T9043)"
+    },
+    /**
+     * T10119: audit every Saga (`type='epic'` + `label='saga'`) for
+     * ADR-073 §1.2 invariant violations (I5/I7 + depth ladder) and
+     * auto-close drift. Read-only; non-zero exit when any I-invariant
+     * fails so the check is CI-gateable.
+     *
+     * As of T10340 (R6), `--audit-sagas` is a focused alias on top of
+     * `--audit-invariants` — it filters the registry walk to ADR-073
+     * only. The implementation re-uses the central walker so the two
+     * surfaces stay in lock-step.
+     *
+     * @task T10119
+     * @task T10340
+     * @saga T10113
+     * @epic T10209
+     */
+    "audit-sagas": {
+      type: "boolean",
+      description: "Audit every Saga for ADR-073 \xA71.2 invariant violations (I5/I7/depth) + auto-close drift \u2014 focused alias on top of --audit-invariants (T10119, T10340)"
+    },
+    /**
+     * T10340: walk the central `INVARIANTS_REGISTRY` and audit every
+     * registered invariant against the project's current state.
+     *
+     * Output groups violations by ADR + severity and includes an
+     * actionable repair command per violation. Supports `--json` for
+     * machine consumption. Exit code is non-zero when any
+     * `severity:'error'` violation is observed.
+     *
+     * @task T10340 — R6
+     * @epic T10327 — E-INVARIANT-REGISTRY-SSOT
+     * @saga T10326 — SG-SUBSTRATE-RECONCILIATION
+     */
+    "audit-invariants": {
+      type: "boolean",
+      description: "Walk the central INVARIANTS_REGISTRY and audit every registered invariant \u2014 groups by ADR + severity with repair commands (T10340 / Saga T10326 R6)"
+    },
+    /**
+     * T9983: migrate the worktree-include file location from
+     * `<root>/.cleo/worktree-include` (legacy) to `<root>/.worktreeinclude`
+     * (canonical, matches Claude Code Desktop + worktrunk-core). Backs the
+     * legacy file up to `.cleo/backups/worktree-include-<iso>.bak` before
+     * removing it from the legacy path. Combine with `--dry-run` to preview.
+     */
+    "migrate-worktree-include": {
+      type: "boolean",
+      description: "Migrate <root>/.cleo/worktree-include (legacy) \u2192 <root>/.worktreeinclude (canonical, T9983). Combine with --dry-run to preview."
+    },
+    /**
+     * T11489 — DHQ-037/019: detect and auto-heal a leaked `core.worktree` key
+     * in the shared `.git/config`. Reports E_WT_CONFIG_LEAK when found; heals
+     * automatically unless `--dry-run` is passed.
+     */
+    "check-worktree-config": {
+      type: "boolean",
+      description: "Detect and auto-heal a leaked core.worktree key in .git/config (T11489 / DHQ-037). Combine with --dry-run to report without healing."
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "With --quarantine-rogue-cleo-dirs, --scan-stray-nexus-dbs, or --check-worktree-config: print what would be done without acting"
+    },
+    /**
+     * Show brain.db health dashboard (T1908 / BBTT-W2-4).
+     * Aggregates 8 named flags: row counts, dedup ratio, last consolidation,
+     * recency violations, learnings ratio, pattern bloat, fixture pollution,
+     * daemon liveness. Exits 1 on any P0 flag failure.
+     */
+    brain: {
+      type: "boolean",
+      description: "Show brain.db health dashboard with 8 named BBTT flags (T1908)"
+    },
+    /**
+     * T1909 / BBTT-W3-3: Scan tasks.db for test-fixture rows using heuristics.
+     *
+     * Detects rows matching: id ^E\d+$, id ^T\d+EP$, or title containing
+     * "Test Epic", "with no files", "standalone epic", "fixture".
+     * Reports each match with a confidence score (HIGH/MED/LOW).
+     *
+     * Pass --quarantine to move matched rows to .cleo/quarantine/
+     * (T1864 pattern — NEVER deletes). Dry-run by default.
+     */
+    "scan-test-fixtures-in-prod": {
+      type: "boolean",
+      description: "Scan tasks.db for test-fixture rows using heuristics (T1909)"
+    },
+    quarantine: {
+      type: "boolean",
+      description: "With --scan-test-fixtures-in-prod: move matches to .cleo/quarantine/ (no delete)"
+    },
+    // Global output format flags — read directly from args (no optsWithGlobals in citty)
+    json: {
+      type: "boolean",
+      description: "Output as JSON"
+    },
+    human: {
+      type: "boolean",
+      description: "Force human-readable output"
+    },
+    quiet: {
+      type: "boolean",
+      description: "Suppress non-essential output"
+    }
+  },
+  async run({ args, cmd, rawArgs }) {
+    if (isSubCommandDispatch(rawArgs, cmd.subCommands)) return;
+    const isHuman = args.human === true || !!process.stdout.isTTY && args.json !== true;
+    const progress = createDoctorProgress(isHuman);
+    progress.start();
+    try {
+      if (args["check-worktree-config"]) {
+        const { execFileSync: execFile } = await import("node:child_process");
+        const { join: pathJoin } = await import("node:path");
+        const { existsSync } = await import("node:fs");
+        const { detectAndHealCoreWorktreeLeak } = await import("@cleocode/worktree");
+        const projectRoot = getProjectRoot2();
+        let gitRoot = projectRoot;
+        try {
+          gitRoot = execFile("git", ["rev-parse", "--show-toplevel"], {
+            cwd: projectRoot,
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"]
+          }).trim();
+        } catch {
+        }
+        const isDryRun = args["dry-run"] === true;
+        progress.step(0, "Checking for leaked core.worktree in .git/config");
+        if (isDryRun) {
+          const gitConfigPath = pathJoin(gitRoot, ".git", "config");
+          let leakedValue;
+          if (existsSync(gitConfigPath)) {
+            try {
+              leakedValue = execFile("git", ["config", "--file", gitConfigPath, "--get", "core.worktree"], {
+                encoding: "utf-8",
+                stdio: ["pipe", "pipe", "pipe"]
+              }).trim() || void 0;
+            } catch {
+            }
+          }
+          const report = {
+            gitRoot,
+            gitConfigPath,
+            leakDetected: !!leakedValue,
+            leakedValue,
+            healed: false,
+            dryRun: true,
+            message: leakedValue ? `DRY-RUN: core.worktree="${leakedValue}" found \u2014 would unset` : "No core.worktree leak detected"
+          };
+          progress.complete(report.message);
+          cliOutput(report, { command: "doctor", operation: "doctor.check-worktree-config" });
+          if (leakedValue) process.exitCode = 2;
+        } else {
+          const result = detectAndHealCoreWorktreeLeak(gitRoot);
+          const report = {
+            gitRoot,
+            ...result,
+            dryRun: false,
+            message: result.leakDetected ? result.healed ? `E_WT_CONFIG_LEAK healed: removed core.worktree="${result.leakedValue}"` : `E_WT_CONFIG_LEAK detected but heal FAILED: ${result.healError}` : "No core.worktree leak detected"
+          };
+          progress.complete(report.message);
+          cliOutput(report, { command: "doctor", operation: "doctor.check-worktree-config" });
+          if (result.leakDetected && !result.healed) process.exitCode = 1;
+        }
+        return;
+      }
+      if (args.brain) {
+        const { computeBrainHealthDashboard } = await import("@cleocode/core/memory/brain-health-dashboard.js");
+        const projectRoot = getProjectRoot2();
+        const dashboard = await computeBrainHealthDashboard(projectRoot);
+        cliOutput(dashboard, { command: "doctor", operation: "doctor.brain" });
+        if (dashboard.hasP0Failure) {
+          process.exitCode = 1;
+        }
+        return;
+      }
+      if (args["scan-test-fixtures-in-prod"]) {
+        const projectRoot = getProjectRoot2();
+        const matches = await scanTestFixturesInProd(projectRoot);
+        const dryRun = args["dry-run"] !== false && args.quarantine !== true;
+        const quarantined = !dryRun && matches.length > 0 ? await quarantineTestFixtures(projectRoot, matches) : void 0;
+        cliOutput(
+          { matches, dryRun, quarantined },
+          { command: "doctor", operation: "doctor.scan-test-fixtures" }
+        );
+        if (matches.some((m) => m.confidence === "HIGH")) {
+          process.exitCode = 1;
+        }
+        return;
+      }
+      if (args["all-projects"]) {
+        progress.step(0, "Probing registered projects");
+        await runDoctorProjects({
+          json: args.json === true,
+          quiet: args.quiet === true,
+          ignoreUnreachable: args["ignore-unreachable"] === true
+        });
+        progress.complete("Project health report complete");
+      } else if (args.hooks) {
+        progress.step(0, "Building provider hook matrix");
+        if (isHuman) {
+          const response = await dispatchRaw("query", "admin", "hooks.matrix", {
+            detectProvider: true
+          });
+          progress.complete("Hook matrix complete");
+          if (response.success && response.data) {
+            renderHookMatrixHuman(response.data);
+          } else {
+            cliError(response.error?.message ?? "Failed to build hook matrix", 1, {
+              name: "E_INTERNAL"
+            });
+            process.exitCode = 1;
+          }
+        } else {
+          await dispatchFromCli(
+            "query",
+            "admin",
+            "hooks.matrix",
+            { detectProvider: true },
+            { command: "doctor", operation: "admin.hooks.matrix" }
+          );
+          progress.complete("Hook matrix complete");
+        }
+      } else if (args.full) {
+        progress.step(0, "Running operational smoke tests");
+        await dispatchFromCli(
+          "query",
+          "admin",
+          "smoke",
+          {},
+          { command: "doctor", operation: "admin.smoke" }
+        );
+        progress.complete("Smoke tests complete");
+      } else if (args.coherence) {
+        progress.step(0, "Running coherence check");
+        await dispatchFromCli(
+          "query",
+          "check",
+          "coherence",
+          {},
+          { command: "doctor", operation: "check.coherence" }
+        );
+        progress.complete("Coherence check complete");
+      } else if (args.fix) {
+        progress.step(4, "Applying fixes");
+        await dispatchFromCli(
+          "mutate",
+          "admin",
+          "health",
+          { mode: "repair" },
+          { command: "doctor", operation: "admin.health" }
+        );
+        progress.complete("Fixes applied");
+      } else if (args.comprehensive) {
+        progress.step(0, "Checking CLEO directory");
+        await dispatchFromCli(
+          "query",
+          "admin",
+          "health",
+          { mode: "diagnose" },
+          { command: "doctor", operation: "admin.health" }
+        );
+        progress.complete("Comprehensive diagnostics complete");
+      } else if (args["scan-rogue-cleo-dirs"]) {
+        progress.step(0, "Scanning for rogue .cleo/ directories");
+        const projectRoot = getProjectRoot2();
+        const reports = scanRogueCleoDirs(projectRoot);
+        progress.complete(
+          `Found ${reports.length} rogue .cleo/ director${reports.length === 1 ? "y" : "ies"}`
+        );
+        cliOutput(reports, { command: "doctor", operation: "doctor.scan-rogue-cleo-dirs" });
+      } else if (args["quarantine-rogue-cleo-dirs"]) {
+        const isDryRun = args["dry-run"] === true;
+        progress.step(0, `${isDryRun ? "[DRY RUN] " : ""}Scanning for rogue .cleo/ directories`);
+        const projectRoot = getProjectRoot2();
+        const reports = scanRogueCleoDirs(projectRoot);
+        if (reports.length === 0) {
+          progress.complete("No rogue .cleo/ directories found \u2014 nothing to quarantine");
+          cliOutput(
+            { quarantined: [] },
+            { command: "doctor", operation: "doctor.quarantine-rogue-dirs" }
+          );
+          return;
+        }
+        const quarantined = [];
+        const errors = [];
+        for (const report of reports) {
+          if (isDryRun) {
+            const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+            const targetPath = `${projectRoot}/.cleo/quarantine/${report.packageName}-${timestamp}`;
+            quarantined.push({
+              packageName: report.packageName,
+              from: report.path,
+              to: targetPath
+            });
+          } else {
+            try {
+              const { quarantinePath } = quarantineRogueCleoDir(report, projectRoot);
+              quarantined.push({
+                packageName: report.packageName,
+                from: report.path,
+                to: quarantinePath
+              });
+            } catch (err) {
+              errors.push({
+                packageName: report.packageName,
+                path: report.path,
+                error: err instanceof Error ? err.message : String(err)
+              });
+            }
+          }
+        }
+        const verb = isDryRun ? "Would quarantine" : "Quarantined";
+        progress.complete(
+          `${verb} ${quarantined.length} director${quarantined.length === 1 ? "y" : "ies"}${errors.length > 0 ? `, ${errors.length} failed` : ""}`
+        );
+        cliOutput(
+          { dryRun: isDryRun, quarantined, errors },
+          { command: "doctor", operation: "doctor.quarantine-rogue-dirs" }
+        );
+        if (errors.length > 0) {
+          process.exitCode = 1;
+        }
+      } else if (args["scan-stray-nexus-dbs"]) {
+        progress.step(0, "Scanning for stray nexus.db files");
+        const { detectAndRemoveLegacyGlobalFiles, detectAndRemoveStrayProjectNexus } = await import("@cleocode/core/store/cleanup-legacy.js");
+        const { getCleoHome } = await import("@cleocode/core");
+        const cleoHome = getCleoHome();
+        const projectRoot = getProjectRoot2();
+        const legacyResult = detectAndRemoveLegacyGlobalFiles(cleoHome);
+        const strayResult = detectAndRemoveStrayProjectNexus(projectRoot);
+        const isDryRun = args["dry-run"] === true;
+        const report = {
+          cleoHome,
+          projectRoot,
+          legacy: {
+            removed: legacyResult.removed.length,
+            files: legacyResult.removed
+          },
+          stray: {
+            removed: strayResult.removed,
+            path: strayResult.path
+          },
+          dryRun: isDryRun
+        };
+        progress.complete(
+          `Found ${legacyResult.removed.length} legacy + ${strayResult.removed ? 1 : 0} stray nexus.db`
+        );
+        cliOutput(report, { command: "doctor", operation: "doctor.scan-stray-nexus-dbs" });
+      } else if (args["audit-worktrees"]) {
+        progress.step(0, "Auditing orphaned agent worktrees");
+        const { auditOrphanWorktrees } = await import("@cleocode/core/gc/index.js");
+        const checkResult = auditOrphanWorktrees();
+        progress.complete(`Worktree audit complete \u2014 ${checkResult.status}`);
+        cliOutput(checkResult, { command: "doctor", operation: "doctor.audit-worktrees" });
+        if (checkResult.details?.["orphans"] && checkResult.details["orphans"].length > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+          process.exitCode = 2;
+        }
+      } else if (args["audit-worktree-orphans"]) {
+        progress.step(0, "Comprehensive worktree anomaly audit (T9808 / council D009)");
+        const { auditWorktreeOrphansComprehensive, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
+        const projectRoot = getProjectRoot2();
+        const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
+        const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
+        const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
+        const [comprehensive, legacyScanResult] = await Promise.all([
+          auditWorktreeOrphansComprehensive(projectRoot),
+          scanWorktreeOrphansBudgeted(projectRoot, {
+            timeoutMs,
+            maxEntriesPerLevel: Number.isFinite(maxEntriesPerLevel) ? maxEntriesPerLevel : 500
+          })
+        ]);
+        const legacyOrphans = legacyScanResult.orphans;
+        const totalAnomalies = comprehensive.count;
+        if (legacyScanResult.softWarnMessage) {
+          pushWarning({
+            code: "W_DOCTOR_SCAN_SOFT_WARN",
+            message: legacyScanResult.softWarnMessage,
+            severity: "warn"
+          });
+        }
+        if (legacyScanResult.isPartial) {
+          const reason = legacyScanResult.partialReason === "timeout" ? `timed out after ${timeoutSecs}s (use --timeout <seconds> to adjust)` : `per-level entry cap of ${maxEntriesPerLevel} exceeded (use --max-entries-per-level <n> to adjust)`;
+          pushWarning({
+            code: "W_DOCTOR_SCAN_PARTIAL",
+            message: `legacy orphan scan is PARTIAL \u2014 ${reason}. Results may be incomplete.`,
+            severity: "warn",
+            context: {
+              partialReason: legacyScanResult.partialReason,
+              timeoutSecs,
+              maxEntriesPerLevel
+            }
+          });
+        }
+        progress.complete(
+          `Found ${totalAnomalies} anomal${totalAnomalies === 1 ? "y" : "ies"}` + (legacyOrphans.length > 0 ? ` (${legacyOrphans.length} legacy orphan(s))` : "") + (legacyScanResult.isPartial ? " [PARTIAL]" : "")
+        );
+        cliOutput(
+          {
+            projectRoot,
+            comprehensive,
+            legacyOrphans,
+            legacyScanPartial: legacyScanResult.isPartial,
+            legacyScanPartialReason: legacyScanResult.partialReason,
+            count: totalAnomalies
+          },
+          { command: "doctor", operation: "doctor.audit-worktree-orphans" }
+        );
+        if (totalAnomalies > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+          process.exitCode = 2;
+        }
+      } else if (args["prune-worktree-orphans"]) {
+        const isDryRun = args["dry-run"] === true;
+        progress.step(
+          0,
+          `${isDryRun ? "[DRY RUN] " : ""}Scanning + pruning worktree-orphan .cleo/ directories`
+        );
+        const { pruneWorktreeOrphans, scanWorktreeOrphansBudgeted } = await import("@cleocode/core/doctor/worktree-orphans.js");
+        const projectRoot = getProjectRoot2();
+        const timeoutSecs = args["timeout"] !== void 0 ? Number.parseInt(String(args["timeout"]), 10) : 30;
+        const timeoutMs = Number.isFinite(timeoutSecs) && timeoutSecs > 0 ? timeoutSecs * 1e3 : 3e4;
+        const maxEntriesPerLevel = args["max-entries-per-level"] !== void 0 ? Number.parseInt(String(args["max-entries-per-level"]), 10) : 500;
+        const scanResult = await scanWorktreeOrphansBudgeted(projectRoot, {
+          timeoutMs,
+          maxEntriesPerLevel: Number.isFinite(maxEntriesPerLevel) ? maxEntriesPerLevel : 500
+        });
+        if (scanResult.softWarnMessage) {
+          pushWarning({
+            code: "W_DOCTOR_SCAN_SOFT_WARN",
+            message: scanResult.softWarnMessage,
+            severity: "warn"
+          });
+        }
+        if (scanResult.isPartial) {
+          const reason = scanResult.partialReason === "timeout" ? `timed out after ${timeoutSecs}s (use --timeout <seconds> to adjust)` : `per-level entry cap of ${maxEntriesPerLevel} exceeded (use --max-entries-per-level <n> to adjust)`;
+          pushWarning({
+            code: "W_DOCTOR_SCAN_PARTIAL",
+            message: `orphan scan is PARTIAL \u2014 ${reason}. Only orphans found before abort will be pruned.`,
+            severity: "warn",
+            context: {
+              partialReason: scanResult.partialReason,
+              timeoutSecs,
+              maxEntriesPerLevel
+            }
+          });
+        }
+        const orphans = scanResult.orphans;
+        if (orphans.length === 0) {
+          progress.complete(
+            `No worktree orphans found \u2014 nothing to prune${scanResult.isPartial ? " [PARTIAL SCAN]" : ""}`
+          );
+          cliOutput(
+            {
+              projectRoot,
+              dryRun: isDryRun,
+              archivePath: null,
+              pruned: [],
+              rejected: [],
+              totalSizeBytes: 0,
+              scanPartial: scanResult.isPartial,
+              scanPartialReason: scanResult.partialReason
+            },
+            { command: "doctor", operation: "doctor.prune-worktree-orphans" }
+          );
+          return;
+        }
+        const archiveDir = join(projectRoot, ".cleo", "backups");
+        const auditLogPath = join(projectRoot, ".cleo", "audit", "worktree-prune.jsonl");
+        const result = await pruneWorktreeOrphans(orphans, {
+          archiveDir,
+          auditLogPath,
+          dryRun: isDryRun,
+          projectRoot
+        });
+        const verb = isDryRun ? "Would prune" : "Pruned";
+        progress.complete(
+          `${verb} ${result.pruned.length} orphan${result.pruned.length === 1 ? "" : "s"}${result.rejected.length > 0 ? `, ${result.rejected.length} rejected` : ""}${scanResult.isPartial ? " [PARTIAL SCAN]" : ""}`
+        );
+        cliOutput(
+          {
+            projectRoot,
+            ...result,
+            scanPartial: scanResult.isPartial,
+            scanPartialReason: scanResult.partialReason
+          },
+          { command: "doctor", operation: "doctor.prune-worktree-orphans" }
+        );
+        if (result.rejected.length > 0) {
+          process.exitCode = 1;
+        }
+      } else if (args["migrate-worktree-include"]) {
+        const isDryRun = args["dry-run"] === true;
+        progress.step(
+          0,
+          `${isDryRun ? "[DRY RUN] " : ""}Migrating .cleo/worktree-include \u2192 .worktreeinclude`
+        );
+        const { migrateWorktreeIncludeFile } = await import("@cleocode/core");
+        const projectRoot = getProjectRoot2();
+        const result = await migrateWorktreeIncludeFile(projectRoot, { dryRun: isDryRun });
+        progress.complete(`Migration ${result.action}`);
+        cliOutput(result, { command: "doctor", operation: "doctor.migrate-worktree-include" });
+      } else if (args["audit-temp"]) {
+        progress.step(0, "Auditing orphaned CLEO temp directories");
+        const { auditOrphanTempDirs } = await import("@cleocode/core/gc/index.js");
+        const checkResult = await auditOrphanTempDirs();
+        progress.complete(`Temp audit complete \u2014 ${checkResult.status}`);
+        cliOutput(checkResult, { command: "doctor", operation: "doctor.audit-temp" });
+        if (checkResult.details?.["orphans"] && checkResult.details["orphans"].length > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+          process.exitCode = 2;
+        }
+      } else if (args["audit-invariants"] || args["audit-sagas"]) {
+        const isFocusedAlias = args["audit-sagas"] === true && args["audit-invariants"] !== true;
+        const adrFilter = isFocusedAlias ? "ADR-073" : void 0;
+        const stepLabel = isFocusedAlias ? "Auditing Saga hierarchy for ADR-073 invariants" : "Walking central INVARIANTS_REGISTRY";
+        progress.step(0, stepLabel);
+        const { auditInvariantRegistry } = await import("@cleocode/core/doctor/invariant-audit.js");
+        const projectRoot = getProjectRoot2();
+        const result = await auditInvariantRegistry(projectRoot, { adrFilter });
+        const operation = isFocusedAlias ? "doctor.audit-sagas" : "doctor.audit-invariants";
+        const summary = `Invariant audit complete \u2014 ${result.totalCount} entries walked, ${result.errorCount} error / ${result.warningCount} warning / ${result.infoCount} info violation(s), ${result.notApplicableCount} not-applicable, ${result.documentedCount} documented`;
+        progress.complete(summary);
+        if (isHuman && args.json !== true) {
+          renderInvariantAuditHuman(result);
+        }
+        cliOutput(result, { command: "doctor", operation });
+        if (result.errorCount > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+          process.exitCode = 2;
+        }
+      } else {
+        progress.step(0, "Checking CLEO directory");
+        await dispatchFromCli(
+          "query",
+          "admin",
+          "health",
+          { detailed: args.detailed },
+          { command: "doctor", operation: "admin.health" }
+        );
+        try {
+          const projectRoot = getProjectRoot2();
+          const conflicts = readMigrationConflicts(projectRoot);
+          if (conflicts.length > 0) {
+            progress.complete(
+              `Health check complete \u2014 ${conflicts.length} agent migration conflict(s) detected`
+            );
+            humanLine(
+              `
+[MIGRATE-AGENTS-V2-CONFLICT] ${conflicts.length} agent(s) have conflicting .cant content between disk and signaldock.db:`
+            );
+            for (const c of conflicts) {
+              humanLine(
+                `  - ${c.agentName} (${c.filePath})
+    disk sha256:     ${c.newSha256 ?? "unknown"}
+    registry sha256: ${c.existingSha256 ?? "unknown"}
+    Resolve: inspect the conflict and either update the registry via
+    'cleo agent install --force <path>' or remove the conflicting file.`
+              );
+            }
+            humanLine(`  Audit log: .cleo/audit/migration-agents-v2.jsonl
+`);
+            if (process.exitCode === void 0 || process.exitCode === 0) {
+              process.exitCode = 2;
+            }
+          } else {
+            progress.complete("Health check complete");
+          }
+        } catch {
+          progress.complete("Health check complete");
+        }
+        try {
+          const projectRoot = getProjectRoot2();
+          const { auditSagaHierarchy } = await import("@cleocode/core/doctor/saga-audit.js");
+          const sagaAudit = await auditSagaHierarchy(projectRoot);
+          if (sagaAudit.sagas.length === 0) {
+            humanLine("\nSaga Hierarchy: no sagas found in tasks.db");
+          } else {
+            const header = `
+Saga Hierarchy (${sagaAudit.sagas.length} saga(s), ${sagaAudit.count} violation(s), ${sagaAudit.driftCount} drift warning(s)):`;
+            humanLine(header);
+            for (const s of sagaAudit.sagas) {
+              const violationSuffix = s.violations.length > 0 ? `, ${s.violations.length} violation(s)` : "";
+              humanLine(
+                `  ${s.sagaId} \xB7 status=${s.status} \xB7 ${s.doneCount}/${s.memberCount} members done${violationSuffix}`
+              );
+              for (const v of s.violations) {
+                humanLine(`    [${v.kind}] ${v.message}`);
+              }
+            }
+          }
+          if (sagaAudit.count > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+            process.exitCode = 2;
+          }
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          humanLine(`
+Saga Hierarchy: audit skipped (${msg})`);
+        }
+        try {
+          const { scanDependencyCycles } = await import("@cleocode/core/doctor/dependency-cycles.js");
+          const cycles = await scanDependencyCycles(getProjectRoot2());
+          humanLine(
+            `
+Dependency cycles: ${cycles.cycleCount} (${cycles.edgeCount} edge(s) checked)`
+          );
+          for (const c of cycles.components) humanLine(`  ${c.cycle.join(" \u2192 ")}`);
+          if (cycles.repairPlan.length > 0) {
+            humanLine("  Repair plan (review first; `cleo doctor dep-cycles` for JSON):");
+            for (const r of cycles.repairPlan) humanLine(`    ${r.command}`);
+          }
+          if (cycles.cycleCount > 0 && (process.exitCode === void 0 || process.exitCode === 0)) {
+            process.exitCode = 2;
+          }
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          humanLine(`
+Dependency cycles: check skipped (${msg})`);
+        }
+      }
+    } catch (err) {
+      progress.error("Health check failed");
+      throw err;
+    }
+  }
+});
+export {
+  doctorCommand
+};
+//# sourceMappingURL=doctor-AX5TICQO.js.map