@codyswann/lisa 2.265.0 → 2.266.0

package/dist/health/hook-inspection.js

@@ -0,0 +1,123 @@
+/** Installed and executable Git-hook inspection without running hooks. */
+/* eslint-disable jsdoc/require-param-description, jsdoc/require-returns -- typed hook readers are self-describing */
+import { execFile } from "node:child_process";
+import path from "node:path";
+import { projectPathKind, readProjectFile, readProjectText, } from "./read-only-fs.js";
+const GIT_TIMEOUT_MS = 10_000;
+const MAX_GIT_OUTPUT_BYTES = 16 * 1024;
+const HUSKY_HOOKS = [
+    "commit-msg",
+    "post-checkout",
+    "pre-commit",
+    "pre-push",
+    "prepare-commit-msg",
+];
+const LEFTHOOK_HOOKS = [
+    "commit-msg",
+    "pre-commit",
+    "pre-push",
+    "prepare-commit-msg",
+];
+/**
+ * Default fixed-argv local git-config reader.
+ * @param projectRoot
+ * @param timeoutMs
+ * @param signal
+ */
+export const readCoreHooksPath = async (projectRoot, timeoutMs, signal) => new Promise((resolve, reject) => {
+    execFile(
+    // eslint-disable-next-line sonarjs/no-os-command-from-path -- fixed user-installed git executable
+    "git", ["config", "--local", "--get", "core.hooksPath"], {
+        cwd: projectRoot,
+        encoding: "utf8",
+        maxBuffer: MAX_GIT_OUTPUT_BYTES,
+        signal,
+        killSignal: "SIGKILL",
+        timeout: Math.max(1, Math.min(timeoutMs, GIT_TIMEOUT_MS)),
+    }, (error, stdout) => {
+        if (error === null) {
+            resolve(stdout.trim() || undefined);
+            return;
+        }
+        if (error.code === 1) {
+            resolve(undefined);
+            return;
+        }
+        reject(error);
+    });
+});
+/**
+ * Check executable regular files under one project-relative prefix.
+ * @param projectRoot
+ * @param prefix
+ * @param names
+ */
+async function executableDrift(projectRoot, prefix, names) {
+    const checks = await Promise.all(names.map(async (name) => {
+        const relative = path.join(prefix, name);
+        const file = await readProjectFile(projectRoot, relative);
+        return file !== undefined && (file.mode & 0o100) !== 0
+            ? undefined
+            : relative.split(path.sep).join("/");
+    }));
+    return checks.filter((item) => item !== undefined);
+}
+/**
+ * Inspect Lefthook wrappers when the git directory is locally readable.
+ * @param projectRoot
+ */
+async function inspectLefthook(projectRoot) {
+    const gitKind = await projectPathKind(projectRoot, ".git");
+    if (gitKind !== "directory") {
+        return { status: "warn", drift: ["lefthook installation unavailable"] };
+    }
+    const modeDrift = await executableDrift(projectRoot, path.join(".git", "hooks"), LEFTHOOK_HOOKS);
+    const contentDrift = (await Promise.all(LEFTHOOK_HOOKS.map(async (name) => {
+        const relative = path.join(".git", "hooks", name);
+        const content = await readProjectText(projectRoot, relative);
+        return content !== undefined &&
+            !content.toLowerCase().includes("lefthook")
+            ? relative.split(path.sep).join("/")
+            : undefined;
+    }))).filter((item) => item !== undefined);
+    const drift = [...new Set([...modeDrift, ...contentDrift])].sort((left, right) => left.localeCompare(right));
+    return drift.length === 0
+        ? { status: "pass", drift: [] }
+        : { status: "fail", drift };
+}
+/**
+ * Inspect actual installed hook state for applicable stacks.
+ * @param projectRoot - Canonical host root
+ * @param types - Safely detected project types
+ * @param reader - core.hooksPath reader
+ * @param timeoutMs - Remaining shared deadline
+ * @param signal - Shared cancellation signal
+ * @returns Hook installation status
+ */
+export async function inspectHookInstallation(projectRoot, types, reader, timeoutMs, signal) {
+    if (types.includes("rails"))
+        return inspectLefthook(projectRoot);
+    if (!types.includes("typescript")) {
+        return { status: "warn", drift: ["unsupported hook stack"] };
+    }
+    const modeDrift = [
+        ...(await executableDrift(projectRoot, ".husky", HUSKY_HOOKS)),
+    ];
+    const hooksPath = await reader(projectRoot, timeoutMs, signal).catch(() => null);
+    if (hooksPath === null) {
+        return modeDrift.length === 0
+            ? { status: "warn", drift: ["core.hooksPath unavailable"] }
+            : { status: "fail", drift: modeDrift };
+    }
+    const drift = [
+        ...modeDrift,
+        ...(hooksPath === ".husky" || hooksPath === ".husky/_"
+            ? []
+            : ["core.hooksPath"]),
+    ];
+    return drift.length === 0
+        ? { status: "pass", drift: [] }
+        : { status: "fail", drift };
+}
+/* eslint-enable jsdoc/require-param-description, jsdoc/require-returns -- restore repository documentation defaults */
+//# sourceMappingURL=hook-inspection.js.map

package/dist/health/hook-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-inspection.js","sourceRoot":"","sources":["../../src/health/hook-inspection.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,qHAAqH;AACrH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,WAAW,GAAG;IAClB,YAAY;IACZ,eAAe;IACf,YAAY;IACZ,UAAU;IACV,oBAAoB;CACZ,CAAC;AACX,MAAM,cAAc,GAAG;IACrB,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,oBAAoB;CACZ,CAAC;AAkBX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAoB,KAAK,EACrD,WAAW,EACX,SAAS,EACT,MAAM,EACN,EAAE,CACF,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,QAAQ;IACN,kGAAkG;IAClG,KAAK,EACL,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAChD;QACE,GAAG,EAAE,WAAW;QAChB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,oBAAoB;QAC/B,MAAM;QACN,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;KAC1D,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAChB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAK,KAA+C,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,SAAS,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,WAAmB,EACnB,MAAc,EACd,KAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC1D,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YACpD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CACH,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,WAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,mCAAmC,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,eAAe,CACrC,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1B,cAAc,CACf,CAAC;IACF,MAAM,YAAY,GAAG,CACnB,MAAM,OAAO,CAAC,GAAG,CACf,cAAc,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC7D,OAAO,OAAO,KAAK,SAAS;YAC1B,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC3C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC,CACH,CACF,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9D,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAC3C,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AACD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,KAA6B,EAC7B,MAAuB,EACvB,SAAiB,EACjB,MAAmB;IAEnB,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,eAAe,CAAC,WAAW,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,SAAS,GAAG;QAChB,GAAG,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;KAC/D,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAClE,GAAG,EAAE,CAAC,IAAI,CACX,CAAC;IACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC;YAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,4BAA4B,CAAC,EAAE;YAC3D,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,GAAG,SAAS;QACZ,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,UAAU;YACpD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;KACxB,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AACD,uHAAuH"}

package/dist/health/index.d.ts

@@ -1,3 +1,4 @@
 export * from "./contract.js";
+export * from "./deterministic.js";
 export * from "./storage.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/health/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/health/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/health/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC"}

package/dist/health/index.js

@@ -1,3 +1,4 @@
 export * from "./contract.js";
+export * from "./deterministic.js";
 export * from "./storage.js";
 //# sourceMappingURL=index.js.map

package/dist/health/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/health/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/health/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC"}

package/dist/health/plugin-inspection.d.ts

@@ -0,0 +1,37 @@
+import { type ProjectType } from "../core/config.js";
+/**
+ * Injectable fixed-argv reader for actual project plugin installation.
+ * Implementations must honor `signal` and release any owned handles before
+ * settling.
+ */
+export type InstalledPluginReader = (projectRoot: string, timeoutMs: number, signal: AbortSignal) => Promise<readonly string[]>;
+/** Structured plugin inspection outcome. */
+export type PluginInspection = {
+    readonly status: "pass";
+    readonly drift: readonly string[];
+} | {
+    readonly status: "warn";
+    readonly drift: readonly string[];
+} | {
+    readonly status: "fail";
+    readonly drift: readonly string[];
+};
+/**
+ * Default fixed-argv Claude installed-plugin reader.
+ * @param projectRoot
+ * @param timeoutMs
+ * @param signal
+ */
+export declare const readInstalledClaudePlugins: InstalledPluginReader;
+/**
+ * Inspect settings, marker, and actual installed plugin state.
+ * @param projectRoot - Canonical host root
+ * @param config - Safe project config
+ * @param types - Safely detected project types
+ * @param reader - Actual installed-plugin reader
+ * @param timeoutMs - Remaining shared deadline
+ * @param signal - Shared cancellation signal
+ * @returns Pass, fail, or optional-harness warning
+ */
+export declare function inspectPlugins(projectRoot: string, config: Readonly<Record<string, unknown>>, types: readonly ProjectType[], reader: InstalledPluginReader, timeoutMs: number, signal: AbortSignal): Promise<PluginInspection>;
+//# sourceMappingURL=plugin-inspection.d.ts.map

package/dist/health/plugin-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-inspection.d.ts","sourceRoot":"","sources":["../../src/health/plugin-inspection.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAa3B;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAEhC,4CAA4C;AAC5C,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,qBA4CrC,CAAC;AAwBL;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,qBAAqB,EAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,gBAAgB,CAAC,CA0D3B"}

package/dist/health/plugin-inspection.js

@@ -0,0 +1,128 @@
+/** Bounded actual plugin-installation inspection for deterministic health. */
+/* eslint-disable jsdoc/require-param-description, jsdoc/require-returns -- typed plugin readers are self-describing */
+import { execFile } from "node:child_process";
+import path from "node:path";
+import { DEFAULT_HARNESS, harnessIncludesAgent, } from "../core/config.js";
+import { selectProjectLisaPluginsFromState } from "../core/lisa-plugin-selection.js";
+import { getPackageVersion } from "../cli/version.js";
+import { projectPathKind, readProjectJsonObject, readProjectText, } from "./read-only-fs.js";
+const MAX_PLUGIN_OUTPUT_BYTES = 256 * 1024;
+const MAX_INSTALLED_PLUGINS = 512;
+const PLUGIN_TIMEOUT_MS = 15_000;
+/**
+ * Default fixed-argv Claude installed-plugin reader.
+ * @param projectRoot
+ * @param timeoutMs
+ * @param signal
+ */
+export const readInstalledClaudePlugins = async (projectRoot, timeoutMs, signal) => new Promise((resolve, reject) => {
+    execFile(
+    // eslint-disable-next-line sonarjs/no-os-command-from-path -- fixed user-installed Claude executable
+    "claude", ["plugin", "list", "--json"], {
+        cwd: projectRoot,
+        encoding: "utf8",
+        maxBuffer: MAX_PLUGIN_OUTPUT_BYTES,
+        signal,
+        killSignal: "SIGKILL",
+        timeout: Math.max(1, Math.min(timeoutMs, PLUGIN_TIMEOUT_MS)),
+    }, (error, stdout) => {
+        if (error !== null) {
+            reject(error);
+            return;
+        }
+        try {
+            const parsed = JSON.parse(stdout);
+            if (!Array.isArray(parsed) || parsed.length > MAX_INSTALLED_PLUGINS) {
+                throw new Error("Installed plugin response exceeded its contract");
+            }
+            const ids = parsed.flatMap(entry => {
+                if (entry === null || typeof entry !== "object")
+                    return [];
+                const id = Reflect.get(entry, "id");
+                const projectPath = Reflect.get(entry, "projectPath");
+                return typeof id === "string" && projectPath === projectRoot
+                    ? [id]
+                    : [];
+            });
+            resolve([...new Set(ids)].sort((left, right) => left.localeCompare(right)));
+        }
+        catch (parseError) {
+            reject(parseError);
+        }
+    });
+});
+/**
+ * Resolve configured harness without accepting invalid strings.
+ * @param config
+ */
+function configuredHarness(config) {
+    const harness = config.harness ?? DEFAULT_HARNESS;
+    return typeof harness === "string" &&
+        [
+            "claude",
+            "codex",
+            "cursor",
+            "agy",
+            "copilot",
+            "opencode",
+            "fleet",
+        ].includes(harness)
+        ? harness
+        : undefined;
+}
+/**
+ * Inspect settings, marker, and actual installed plugin state.
+ * @param projectRoot - Canonical host root
+ * @param config - Safe project config
+ * @param types - Safely detected project types
+ * @param reader - Actual installed-plugin reader
+ * @param timeoutMs - Remaining shared deadline
+ * @param signal - Shared cancellation signal
+ * @returns Pass, fail, or optional-harness warning
+ */
+export async function inspectPlugins(projectRoot, config, types, reader, timeoutMs, signal) {
+    const harness = configuredHarness(config);
+    if (harness === undefined || !harnessIncludesAgent(harness, "claude")) {
+        return { status: "warn", drift: ["unsupported harness"] };
+    }
+    const settings = await readProjectJsonObject(projectRoot, path.join(".claude", "settings.json"));
+    if (settings === undefined) {
+        return { status: "fail", drift: [".claude/settings.json"] };
+    }
+    const enabled = settings.enabledPlugins;
+    if (enabled === null ||
+        typeof enabled !== "object" ||
+        Array.isArray(enabled)) {
+        return { status: "fail", drift: ["plugin settings"] };
+    }
+    const hasWiki = (await projectPathKind(projectRoot, path.join("wiki", "lisa-wiki.config.json"))) === "file";
+    const expected = [
+        ...selectProjectLisaPluginsFromState(config, types, hasWiki),
+    ]
+        .map(plugin => `${plugin}@lisa`)
+        .sort((left, right) => left.localeCompare(right));
+    const settingsDrift = expected.filter(plugin => Reflect.get(enabled, plugin) !== true);
+    const marker = await readProjectText(projectRoot, path.join(".claude", ".lisa-plugins-synced"));
+    const drift = [
+        ...settingsDrift,
+        ...(marker?.trim() === getPackageVersion()
+            ? []
+            : ["plugin version marker"]),
+    ];
+    if (drift.length > 0)
+        return { status: "fail", drift };
+    const installed = await reader(projectRoot, timeoutMs, signal).catch(() => undefined);
+    if (installed === undefined) {
+        return {
+            status: "warn",
+            drift: ["actual plugin installation unavailable"],
+        };
+    }
+    const installedSet = new Set(installed);
+    const missing = expected.filter(plugin => !installedSet.has(plugin));
+    return missing.length === 0
+        ? { status: "pass", drift: [] }
+        : { status: "fail", drift: missing };
+}
+/* eslint-enable jsdoc/require-param-description, jsdoc/require-returns -- restore repository documentation defaults */
+//# sourceMappingURL=plugin-inspection.js.map

package/dist/health/plugin-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-inspection.js","sourceRoot":"","sources":["../../src/health/plugin-inspection.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,uHAAuH;AACvH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,eAAe,EACf,oBAAoB,GAGrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,uBAAuB,GAAG,GAAG,GAAG,IAAI,CAAC;AAC3C,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAmBjC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA0B,KAAK,EACpE,WAAW,EACX,SAAS,EACT,MAAM,EACN,EAAE,CACF,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,QAAQ;IACN,qGAAqG;IACrG,QAAQ,EACR,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAC5B;QACE,GAAG,EAAE,WAAW;QAChB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,uBAAuB;QAClC,MAAM;QACN,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;KAC7D,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAChB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAAC;YAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;gBACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,OAAO,EAAE,CAAC;gBAC3D,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACpC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;gBACtD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,WAAW,KAAK,WAAW;oBAC1D,CAAC,CAAC,CAAC,EAAE,CAAC;oBACN,CAAC,CAAC,EAAE,CAAC;YACT,CAAC,CAAC,CAAC;YACH,OAAO,CACL,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CACnE,CAAC;QACJ,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,CAAC,UAAU,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACH,SAAS,iBAAiB,CACxB,MAAyC;IAEzC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;IAClD,OAAO,OAAO,OAAO,KAAK,QAAQ;QAChC;YACE,QAAQ;YACR,OAAO;YACP,QAAQ;YACR,KAAK;YACL,SAAS;YACT,UAAU;YACV,OAAO;SACR,CAAC,QAAQ,CAAC,OAAO,CAAC;QACnB,CAAC,CAAE,OAAmB;QACtB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,MAAyC,EACzC,KAA6B,EAC7B,MAA6B,EAC7B,SAAiB,EACjB,MAAmB;IAEnB,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAC1C,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CACtC,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,CAAC;IACxC,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GACX,CAAC,MAAM,eAAe,CACpB,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAC3C,CAAC,KAAK,MAAM,CAAC;IAChB,MAAM,QAAQ,GAAG;QACf,GAAG,iCAAiC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;KAC7D;SACE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC;SAC/B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CACnC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,CAChD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAC7C,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,GAAG,aAAa;QAChB,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,iBAAiB,EAAE;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;KAC/B,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,KAAK,CAClE,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,CAAC,wCAAwC,CAAC;SAClD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AACD,uHAAuH"}

package/dist/health/project-probes.d.ts

@@ -0,0 +1,34 @@
+import type { SyncReport } from "../sync/config-sync.js";
+import type { HealthFinding } from "./contract.js";
+import type { HealthProjectShape } from "./template-inspection.js";
+/** Result of safely loading committed project configuration. */
+export interface HealthConfigState {
+    readonly config: Readonly<Record<string, unknown>>;
+    readonly present: boolean;
+    readonly readable: boolean;
+}
+/**
+ * Project and legacy overlay check derived from doctor without mutation.
+ * @param projectRoot
+ * @param configState
+ * @param shape
+ */
+export declare function projectStateFinding(projectRoot: string, configState: HealthConfigState, shape: HealthProjectShape | undefined): Promise<HealthFinding>;
+/**
+ * Local wiki contract check derived from doctor without network or writes.
+ * @param projectRoot
+ */
+export declare function wikiFinding(projectRoot: string): Promise<HealthFinding>;
+/** Offline representation of doctor's network-only starter check. */
+export declare function starterFinding(): HealthFinding;
+/**
+ * Read-only canonical instruction check.
+ * @param projectRoot
+ */
+export declare function instructionFinding(projectRoot: string): Promise<HealthFinding>;
+/**
+ * Convert one dry-run sync report into required-key and sync findings.
+ * @param report
+ */
+export declare function configFindings(report: SyncReport): readonly [HealthFinding, HealthFinding];
+//# sourceMappingURL=project-probes.d.ts.map

package/dist/health/project-probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-probes.d.ts","sourceRoot":"","sources":["../../src/health/project-probes.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAKnE,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,iBAAiB,EAC9B,KAAK,EAAE,kBAAkB,GAAG,SAAS,GACpC,OAAO,CAAC,aAAa,CAAC,CAqCxB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAyC7E;AAED,qEAAqE;AACrE,wBAAgB,cAAc,IAAI,aAAa,CAM9C;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC,CA0BxB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,GACjB,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC,CA2BzC"}

package/dist/health/project-probes.js

@@ -0,0 +1,104 @@
+/** Safe local project/doctor-derived deterministic health probes. */
+/* eslint-disable jsdoc/require-param-description, jsdoc/require-returns -- typed doctor projections are self-describing */
+import path from "node:path";
+import { CLAUDE_MD_AGENTS_IMPORT } from "../claude/claude-md-installer.js";
+import { LISA_HOOKS_SUBDIR, LISA_RULES_SUBDIR, } from "../codex/hooks-installer.js";
+import { LISA_SKILLS_SUBDIR } from "../codex/skills-installer.js";
+import { LISA_RULES_END_MARKER, LISA_RULES_START_MARKER, } from "../core/instruction-files-migration.js";
+import { deterministicFinding, namedReason } from "./finding-utils.js";
+import { projectPathKind, readProjectText } from "./read-only-fs.js";
+const PROJECT_STATE_CHECK = "project.state";
+const PROJECT_WIKI_CHECK = "project.wiki";
+/**
+ * Project and legacy overlay check derived from doctor without mutation.
+ * @param projectRoot
+ * @param configState
+ * @param shape
+ */
+export async function projectStateFinding(projectRoot, configState, shape) {
+    if (!configState.present || !configState.readable || shape === undefined) {
+        return deterministicFinding(PROJECT_STATE_CHECK, "fail", "Project config or project shape is missing, malformed, or unsafe.");
+    }
+    if (shape.types.length === 0) {
+        return deterministicFinding(PROJECT_STATE_CHECK, "warn", "No supported Lisa project type was safely detected.");
+    }
+    const legacy = await Promise.all([LISA_HOOKS_SUBDIR, LISA_RULES_SUBDIR, LISA_SKILLS_SUBDIR].map(async (subdir) => {
+        const relative = path.join(".codex", subdir);
+        return (await projectPathKind(projectRoot, relative)) === "directory"
+            ? relative.split(path.sep).join("/")
+            : undefined;
+    }));
+    const present = legacy.filter((item) => item !== undefined);
+    return present.length === 0
+        ? deterministicFinding(PROJECT_STATE_CHECK, "pass", "Project config, type, and local doctor state are readable.")
+        : deterministicFinding(PROJECT_STATE_CHECK, "warn", namedReason("Legacy Codex overlay paths", present));
+}
+/**
+ * Local wiki contract check derived from doctor without network or writes.
+ * @param projectRoot
+ */
+export async function wikiFinding(projectRoot) {
+    const wiki = await projectPathKind(projectRoot, "wiki");
+    if (wiki === "missing") {
+        return deterministicFinding(PROJECT_WIKI_CHECK, "pass", "No local wiki contract is present.");
+    }
+    if (wiki !== "directory") {
+        return deterministicFinding(PROJECT_WIKI_CHECK, "fail", "The local wiki path is unsafe or not a directory.");
+    }
+    const required = [
+        "wiki/lisa-wiki.config.json",
+        "wiki/schema/llm-wiki-contract.md",
+        "wiki/index.md",
+    ];
+    const missing = (await Promise.all(required.map(async (relative) => (await projectPathKind(projectRoot, relative)) === "file"
+        ? undefined
+        : relative))).filter((item) => item !== undefined);
+    return missing.length === 0
+        ? deterministicFinding(PROJECT_WIKI_CHECK, "pass", "Local wiki contract files are present.")
+        : deterministicFinding(PROJECT_WIKI_CHECK, "fail", namedReason("Missing wiki contract files", missing));
+}
+/** Offline representation of doctor's network-only starter check. */
+export function starterFinding() {
+    return deterministicFinding("starters.remote", "warn", "Starter repository reachability is unavailable in the offline deterministic path.");
+}
+/**
+ * Read-only canonical instruction check.
+ * @param projectRoot
+ */
+export async function instructionFinding(projectRoot) {
+    const [agents, claude] = await Promise.all([
+        readProjectText(projectRoot, "AGENTS.md"),
+        readProjectText(projectRoot, "CLAUDE.md"),
+    ]);
+    const drift = [
+        ...(agents === undefined ? ["AGENTS.md"] : []),
+        ...(agents?.includes(LISA_RULES_START_MARKER) === true ||
+            agents?.includes(LISA_RULES_END_MARKER) === true
+            ? ["AGENTS.md legacy managed block"]
+            : []),
+        ...(claude === undefined || !claude.includes(CLAUDE_MD_AGENTS_IMPORT)
+            ? ["CLAUDE.md"]
+            : []),
+    ];
+    return drift.length === 0
+        ? deterministicFinding("instructions.canonical", "pass", "Instruction files are canonical.")
+        : deterministicFinding("instructions.canonical", "fail", namedReason("Instruction file drift", drift));
+}
+/**
+ * Convert one dry-run sync report into required-key and sync findings.
+ * @param report
+ */
+export function configFindings(report) {
+    const keys = report.missingRequired.map(item => item.key);
+    const actions = report.actions.map(action => action.key);
+    return [
+        keys.length === 0
+            ? deterministicFinding("config.required", "pass", "Required config keys are populated.")
+            : deterministicFinding("config.required", "fail", namedReason("Missing required config keys", keys)),
+        actions.length === 0
+            ? deterministicFinding("config.sync", "pass", "Config and mirrored artifacts are synchronized.")
+            : deterministicFinding("config.sync", "fail", namedReason("Config sync drift", actions)),
+    ];
+}
+/* eslint-enable jsdoc/require-param-description, jsdoc/require-returns -- restore repository documentation defaults */
+//# sourceMappingURL=project-probes.js.map

package/dist/health/project-probes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-probes.js","sourceRoot":"","sources":["../../src/health/project-probes.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,2HAA2H;AAC3H,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,wCAAwC,CAAC;AAGhD,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGrE,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAC5C,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAS1C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,WAA8B,EAC9B,KAAqC;IAErC,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzE,OAAO,oBAAoB,CACzB,mBAAmB,EACnB,MAAM,EACN,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,oBAAoB,CACzB,mBAAmB,EACnB,MAAM,EACN,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAC5D,KAAK,EAAC,MAAM,EAAC,EAAE;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,WAAW;YACnE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CACF,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC5E,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,oBAAoB,CAClB,mBAAmB,EACnB,MAAM,EACN,4DAA4D,CAC7D;QACH,CAAC,CAAC,oBAAoB,CAClB,mBAAmB,EACnB,MAAM,EACN,WAAW,CAAC,4BAA4B,EAAE,OAAO,CAAC,CACnD,CAAC;AACR,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,WAAmB;IACnD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,oBAAoB,CACzB,kBAAkB,EAClB,MAAM,EACN,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,OAAO,oBAAoB,CACzB,kBAAkB,EAClB,MAAM,EACN,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,4BAA4B;QAC5B,kCAAkC;QAClC,eAAe;KAChB,CAAC;IACF,MAAM,OAAO,GAAG,CACd,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,QAAQ,EAAC,EAAE,CAC5B,CAAC,MAAM,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,MAAM;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,QAAQ,CACb,CACF,CACF,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,oBAAoB,CAClB,kBAAkB,EAClB,MAAM,EACN,wCAAwC,CACzC;QACH,CAAC,CAAC,oBAAoB,CAClB,kBAAkB,EAClB,MAAM,EACN,WAAW,CAAC,6BAA6B,EAAE,OAAO,CAAC,CACpD,CAAC;AACR,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc;IAC5B,OAAO,oBAAoB,CACzB,iBAAiB,EACjB,MAAM,EACN,mFAAmF,CACpF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB;IAEnB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC;QACzC,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC;KAC1C,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,uBAAuB,CAAC,KAAK,IAAI;YACtD,MAAM,EAAE,QAAQ,CAAC,qBAAqB,CAAC,KAAK,IAAI;YAC9C,CAAC,CAAC,CAAC,gCAAgC,CAAC;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACnE,CAAC,CAAC,CAAC,WAAW,CAAC;YACf,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,oBAAoB,CAClB,wBAAwB,EACxB,MAAM,EACN,kCAAkC,CACnC;QACH,CAAC,CAAC,oBAAoB,CAClB,wBAAwB,EACxB,MAAM,EACN,WAAW,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAC7C,CAAC;AACR,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzD,OAAO;QACL,IAAI,CAAC,MAAM,KAAK,CAAC;YACf,CAAC,CAAC,oBAAoB,CAClB,iBAAiB,EACjB,MAAM,EACN,qCAAqC,CACtC;YACH,CAAC,CAAC,oBAAoB,CAClB,iBAAiB,EACjB,MAAM,EACN,WAAW,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAClD;QACL,OAAO,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,oBAAoB,CAClB,aAAa,EACb,MAAM,EACN,iDAAiD,CAClD;YACH,CAAC,CAAC,oBAAoB,CAClB,aAAa,EACb,MAAM,EACN,WAAW,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAC1C;KACN,CAAC;AACJ,CAAC;AACD,uHAAuH"}

package/dist/health/read-only-fs.d.ts

@@ -0,0 +1,54 @@
+/** Stable metadata and bytes captured from one confined regular file. */
+export interface ProjectFileSnapshot {
+    readonly bytes: Buffer;
+    readonly mode: number;
+}
+/** Safe path kinds understood by deterministic health. */
+export type ProjectPathKind = "missing" | "file" | "directory";
+/**
+ * Resolve a project-relative path without permitting traversal.
+ * @param root - Canonical project root
+ * @param relativePath - Project-relative path
+ * @returns Confined absolute path
+ */
+export declare function resolveProjectPath(root: string, relativePath: string): string;
+/**
+ * Read one stable regular file without following a target outside the project.
+ * @param root - Canonical project root
+ * @param relativePath - Project-relative path
+ * @param maximumBytes - Maximum permitted file size
+ * @returns File bytes, or undefined when absent
+ */
+export declare function readProjectFile(root: string, relativePath: string, maximumBytes?: number): Promise<ProjectFileSnapshot | undefined>;
+/**
+ * Read just the bytes from one confined stable regular file.
+ * @param root - Canonical project root
+ * @param relativePath - Project-relative path
+ * @param maximumBytes - Maximum permitted file size
+ * @returns File bytes, or undefined when absent
+ */
+export declare function readProjectBytes(root: string, relativePath: string, maximumBytes?: number): Promise<Buffer | undefined>;
+/**
+ * Classify a confined path without following symbolic links or accepting
+ * special files such as FIFOs and devices.
+ * @param root - Canonical project root
+ * @param relativePath - Project-relative path
+ * @returns Safe path kind
+ */
+export declare function projectPathKind(root: string, relativePath: string): Promise<ProjectPathKind>;
+/**
+ * Read strict UTF-8 text from a confined project file.
+ * @param root - Canonical project root
+ * @param relativePath - Project-relative path
+ * @param maximumBytes - Maximum permitted file size
+ * @returns Text, or undefined when absent
+ */
+export declare function readProjectText(root: string, relativePath: string, maximumBytes?: number): Promise<string | undefined>;
+/**
+ * Read a JSON object without exposing its values in failures.
+ * @param root - Canonical project root
+ * @param relativePath - Project-relative JSON path
+ * @returns Parsed object, or undefined when absent
+ */
+export declare function readProjectJsonObject(root: string, relativePath: string): Promise<Readonly<Record<string, unknown>> | undefined>;
+//# sourceMappingURL=read-only-fs.d.ts.map

package/dist/health/read-only-fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only-fs.d.ts","sourceRoot":"","sources":["../../src/health/read-only-fs.ts"],"names":[],"mappings":"AAQA,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,0DAA0D;AAC1D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,CAAC;AAE/D;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAS7E;AAsCD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,YAAY,SAAoB,GAC/B,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAmC1C;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,YAAY,SAAoB,GAC/B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,CAAC,CAiB1B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,YAAY,SAAoB,GAC/B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAK7B;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAQxD"}