@consiliency/agent-board-cli 1.22.5 → 1.24.0

package/dist/doctor_scopes.js

@@ -0,0 +1,1535 @@
+// CREDPATH IF-0-CREDPATH-4 — where each harness registers the board, and how doctor reads it.
+//
+// `HARNESS_CONFIG_SCOPES` is the frozen scope table. The plan froze a first version and required
+// SL-5 to re-check every row against the installed harness before building on it; the rows below
+// are the re-checked table, and each amendment says what was measured and how (dev0, 2026-09-25):
+//
+//   claude 2.1.282  The binary names `managed-mcp.json`, `managed-settings.d` and
+//                   `CLAUDE_CONFIG_DIR`; the plan's row had none of them. Added: the managed MCP
+//                   file, managed settings (`managedMcpServers` + `hooks`, file and `.d/*.json`
+//                   drop-ins), and `CLAUDE_CONFIG_DIR` relocating `.claude.json` and
+//                   `settings.json`. `~/.claude/settings.local.json` stays excluded: Claude Code
+//                   does not read it at user scope (the v11 incident).
+//   codex 0.157.0   `codex mcp list` in a temp `CODEX_HOME` MEASURED a project layer the plan
+//                   lacked: `<dir>/.codex/config.toml` for every dir from cwd up to the git root,
+//                   each loaded only when the nearest `[projects."<path>"]` entry at or above it
+//                   says `trust_level = "trusted"` (root trusted + sub untrusted → root only; no
+//                   entry → not loaded).
+//   grok 0.1.220    Row kept as its README documents (`~/.grok/README.md:1873,1889`). The
+//                   measurement is display-only: `grok mcp list` shows a user-scope server (the
+//                   positive control) but not a project one, so it is not evidence either way.
+//   agy 1.2.11      `agy mcp add` / `disable` in a temp HOME wrote
+//                   `{"mcpServers":{<name>:{command,args,disabled}}}`; an empty file is no entries.
+//                   `~/.gemini/config/projects/*.json` holds only `id`/`name`: no project scope.
+//   opencode 1.18.32 `opencode debug config` MEASURED a walk the plan lacked: `opencode.json[c]` and
+//                   `.opencode/opencode.json[c]` in every dir from cwd up to the git root are
+//                   merged, and plugins are deduplicated BY NAME, ignoring the version (user
+//                   `@0.1.1` + project bare → one entry). dev0's live entry is versioned.
+//   pi 0.87.1       Installed on dev0 (the brief said otherwise). Its `docs/packages.md`:
+//                   `PI_CODING_AGENT_DIR` relocates `~/.pi/agent`; entries are strings or
+//                   `{source}` objects; npm packages are identified by name WITHOUT the version,
+//                   and a project entry replaces the personal one. dev0's live entry is
+//                   `npm:@consiliency/agent-board-pi@0.3.1`.
+//
+// Consequence for "exactly once": a harness that deduplicates by name (claude, codex and grok by
+// server name across layers; opencode and pi by package name) cannot load one server twice under
+// one name, so duplicates are counted over DISTINCT names in the merged set. Two differently
+// named board servers are two processes, and that is what fails.
+//
+// PRECEDENCE (code-review round 1, Astra 3). A same-named entry at a higher layer overrides the
+// lower one, so doctor first builds each harness's EFFECTIVE server map and only then judges it:
+// a board entry that a higher layer disables or re-points is not a registration. Each row carries
+// `rank` (higher overrides) and, for a walked row, which end of the walk wins. Measured on dev0,
+// 2026-09-26, in temp homes with real `git init` repositories:
+//   codex 0.157.1   `codex mcp list --json`: a trusted project layer overrides the user layer
+//                   FIELD BY FIELD (`enabled = false` alone disables the user's server; `command`
+//                   alone keeps the user's `args`), and the layer nearest cwd wins.
+//   opencode 1.18.32 `opencode debug config`: field-by-field too; user < every `opencode.json[c]`
+//                   (nearest cwd wins) < every `.opencode/` file, where the FARTHEST (git root)
+//                   wins — measured, and the opposite of the `opencode.json` walk.
+//   claude 2.1.283  `claude mcp get` with a temp `CLAUDE_CONFIG_DIR`: local (`projects[cwd]`)
+//                   beats user (measured: it names the winning scope, not its fields). That the
+//                   whole entry is REPLACED, not overlaid, is inferred from claude keeping each
+//                   scope as its own map, not measured. project vs user could not be measured (an
+//                   unapproved `.mcp.json` is not shown); the documented order local > project >
+//                   user is used, and managed scopes are ranked above all.
+//   grok            unmeasured (display-only, above): ranked like codex, which it mirrors.
+//
+// CCPLUGIN IF-0-CCPLUGIN-3 — claude plugins are read by a dedicated reader (`readClaudePluginScopes`),
+// not a `ScopeRow`. SL-2.0 measured it with `claude plugin list --json`, `plugin install/enable/
+// disable --scope …` and `claude mcp get` (which spawns the server, so a marker command shows
+// WHICH tree ran), in temp `HOME`/`CLAUDE_CONFIG_DIR`s, claude 2.1.283 on dev0, 2026-09-26:
+//   enable       `enabledPlugins` is per plugin id, local > project > user, the highest scope that
+//                holds a BOOLEAN wins (all 18 user/project/local combinations of true/false/absent
+//                measured). A non-boolean (`["1.31.0"]`, `"true"`, `1`, `null`, `{}`) defines
+//                nothing: `plugin list` shows it disabled at user scope and the user value
+//                standing under a local one. Managed settings are ranked above all (inferred: not
+//                writable without root).
+//   row          `installed_plugins.json` is `{version: 2, plugins: {<id>: [row…]}}`, a row
+//                `{scope, installPath, version, installedAt, lastUpdated, gitCommitSha?,
+//                projectPath?}` (`projectPath` on local and project rows). AMENDS the plan: the
+//                loaded row is NOT the one whose scope matches the winning enable. It is the FIRST
+//                row, in array order, that applies to the cwd — scope user/managed, or a
+//                `projectPath` equal to the cwd or in the same git repository (the binary's
+//                `uw`). Measured by reordering rows: [user, local(cwd)] loads the user row's tree
+//                in the local row's own project; [local(cwd), user] loads the local one. Claude
+//                skips a first row whose path fails its own trust check and takes the next; doctor
+//                stops there with `plugin_path_untrusted` instead (stricter, deliberately).
+//   source       a github marketplace source is `{source:"github", repo, ref?, path?,
+//                sparsePaths?, skipLfs?}`, identical in `extraKnownMarketplaces` and
+//                `known_marketplaces.json` (measured: `marketplace add anthropics/claude-code@main`).
+//                There is no marketplace-level `sha`; that is the plugin-entry source's, and the
+//                installed row carries `gitCommitSha`. `source_ref` is `ref`. Repos compare
+//                case-insensitively, as the binary's own matcher does.
+//   tree         a github-sourced plugin runs from its row's `installPath` in the cache (measured:
+//                editing the cached `plugin.json` changed what ran, the marketplace clone's did
+//                not). A DIRECTORY-sourced plugin runs from the source directory, not the cache
+//                (editing the source without reinstalling changed what ran). Ours never has a
+//                directory source; for a FOREIGN directory plugin this is a floor: doctor reads
+//                the cache copy, which may not be what runs.
+//   auto-update  off globally when `DISABLE_UPDATES` or `DISABLE_AUTOUPDATER` is truthy
+//                (1/true/yes/on), `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` is non-empty, or
+//                `.claude.json` has `autoUpdates: false` (unless `installMethod` is native and
+//                `autoUpdatesProtectedForNative`); `FORCE_AUTOUPDATE_PLUGINS` lifts that gate.
+//                Then per marketplace: the highest settings scope DECLARING it (its `autoUpdate`,
+//                if boolean), else `known_marketplaces.json`, else a default that is on only for
+//                official names (read from the binary, not run). Floor: the binary reads a repo
+//                scope's (project/local) declaration only behind an internal gate doctor cannot
+//                see; doctor counts it. Env inputs are as doctor sees them.
+//
+//   disabled     `.claude.json` `projects[<key>].disabledMcpServers` turns a server off in ONE project
+//                (measured 2026-09-26, `claude mcp get`/`mcp list` with marker commands: the
+//                disabled server shows "Disabled for this project" and is never spawned). `<key>`
+//                is the git root of the cwd's REALPATH, else that realpath: a subdirectory and a
+//                symlinked cwd are covered, a key naming the subdirectory itself is not, and a
+//                non-git parent's key does not reach a child. Entries match the server name
+//                EXACTLY (case- and space-sensitive); non-string entries are skipped and a
+//                non-array list is ignored. It disables a user, local or project (`.mcp.json`)
+//                server of that name, and a PLUGIN server by `plugin:<plugin>:<server>` (the bare
+//                server name or `plugin:<plugin>` does not). A LOCAL server
+//                (`projects[<key>].mcpServers`) is keyed the same way (measured: a local server
+//                under the root key runs in a subdirectory), so every `.claude.json` `projects`
+//                read goes through `claudeProjectKey` (pinned by DM-8's source scan).
+//   handlers     (panel B2; read from the binary's hook schema and executors, not run) a hook
+//                handler's `type` is `command`, `http`, `prompt`, `agent` or `mcp_tool`.
+//                FileChanged runs through the outside-REPL executor, which runs command, http and
+//                mcp_tool handlers and refuses prompt and agent ("not yet supported outside
+//                REPL"). SessionStart runs through the main executor, where prompt and agent run
+//                when a conversation context exists (refused otherwise, and agent always on
+//                PermissionRequest). Stop, PreToolUse and UserPromptSubmit run all five. Doctor
+//                keeps EVERY handler: our plugin must be exactly the frozen set (both events, one
+//                command handler each, nothing else of any type on any event), and ANY non-command
+//                handler on SessionStart or FileChanged, in any scope, makes registration
+//                undetermined (`unjudgeable_hook`) — conservatively including a prompt/agent one
+//                on FileChanged that the binary refuses. Its url, prompt, server or tool is never
+//                kept, so never echoed. Floor: what such a handler does is not judged.
+//   hook policy  (round-2 F027/F028) MEASURED with `claude --init-only` ("Run Setup and
+//                SessionStart:startup hooks, then exit": no model, no credentials in the temp
+//                config), 2.1.283, 2026-09-26, marker-writing SessionStart hooks in user settings
+//                and a directory plugin: `disableAllHooks: true` in user, project OR local
+//                settings stops every settings and plugin hook; the highest scope holding a
+//                boolean wins (local false over user true → hooks run); `allowManagedHooksOnly`
+//                and `strictPluginOnlyCustomization` outside managed settings change nothing;
+//                `CLAUDE_CODE_SAFE_MODE` or `CLAUDE_CODE_SIMPLE` truthy stops them all (`0` does
+//                not). MANAGED settings need root, so their rules are READ from the binary (hook
+//                loader and plugin-hook gate), not run: managed `disableAllHooks` → no hooks;
+//                managed `allowManagedHooksOnly`, safe mode, or a non-managed `disableAllHooks` →
+//                managed settings hooks only, and plugin hooks only from plugins managed
+//                `enabledPlugins` enables (none in safe mode); managed
+//                `strictPluginOnlyCustomization` (true, or listing "hooks") → settings hooks from
+//                managed settings only, plugins unaffected. Doctor applies this BEFORE counting:
+//                a wake hook the policy switches off is `hooks_disabled_by_policy` (a failure,
+//                never a pass). The binary takes the managed-plugin set from managed
+//                `prependPlugins`/`appendPlugins` when present; doctor cannot evaluate that, so a
+//                restricted policy with either is undetermined (`hook_policy_unjudgeable`).
+//                Floors: `--safe-mode` and `--bare` on a launch's argv are invisible (env only,
+//                as doctor sees it); a settings file the binary rejects as invalid is dropped
+//                whole by it and read by doctor.
+//   managed tier (round-3 N1, evidence-first per the owner; READ from the 2.1.283 binaries —
+//                linux-x64, darwin-arm64 and win32-x64 packages — not run) the managed tier is ONE
+//                source, first-wins: server-managed > MDM > the managed-settings file (+ `.d`).
+//                Doctor looks for EVIDENCE of each non-file source and never reads its content:
+//                - remote: `<config home>/remote-settings.json` (`TJ()`; the config home is
+//                  `CLAUDE_CONFIG_DIR` or `~/.claude`; no env override). A planted file did not
+//                  change `--init-only` in a temp config with no account (measured): it is
+//                  honoured only for an eligible account. (`JE()` names a
+//                  `CLAUDE_CODE_REMOTE_SETTINGS_PATH` override in a log line, but returns
+//                  undefined in 2.1.283: compiled out.)
+//                - remote, storage-v5 (round 4): with the v5 backend on (`N()`), the payload is
+//                  written to the state store, `Re.state("remote-settings")` = namespace `state`,
+//                  id `remote-settings`, and the signed-cache sidecars
+//                  `remote-settings.json.signature.json` / `.signature-iat.json` go beside the
+//                  json path. The config home lists `state` and `storage-v2`, but the store's
+//                  exact on-disk name (file or directory, extension) is NOT recoverable from
+//                  strings, so doctor probes every candidate — `state/remote-settings[.json]`,
+//                  `storage-v2/state/remote-settings[.json]` (source `remote_settings_state`) — and
+//                  both sidecars (`remote_settings_signature`); any present is evidence. Whether v5
+//                  is on is decided at runtime by a server-served flag (`tengu_hover_rest`, pinned
+//                  once per process), so its default cannot be told from the binary.
+//                - macOS: `/Library/Managed Preferences/<login>/com.anthropic.claudecode.plist`
+//                  ("per-user managed preferences", login = `os.userInfo().username`) and
+//                  `/Library/Managed Preferences/com.anthropic.claudecode.plist` ("device-level");
+//                  the binary converts them with `/usr/bin/plutil`. Existence only. No login name
+//                  (os.userInfo() throws or gives none) → `managed_policy_check_failed:login_unavailable`,
+//                  never a silent skip.
+//                - Windows: `%SYSTEMROOT%\System32\reg.exe query <key> /v Settings` (default
+//                  `C:\Windows`) for `HKLM\SOFTWARE\Policies\ClaudeCode` and
+//                  `HKCU\SOFTWARE\Policies\ClaudeCode`, 5 s timeout. Doctor runs the same query
+//                  (argv array, no shell): exit 0 → evidence; reg's "unable to find" → none (the
+//                  binary's own test); anything else, a timeout or no reg.exe →
+//                  `managed_policy_check_failed:<reg_failed|reg_timeout|reg_unavailable>`.
+//                - WSL (the binary's test: `WSL_DISTRO_NAME`, or /proc/version naming microsoft or
+//                  wsl): Windows policy is inherited only when an ADMIN Windows source sets
+//                  `wslInheritsWindowsSettings` — `/mnt/c/Program Files/ClaudeCode/managed-settings.json`
+//                  (+ `.d`) or HKLM, queried through `/mnt/c/Windows/System32/reg.exe` when present.
+//                  Evidence of either → the tier is replaced; HKCU alone cannot apply on WSL and is
+//                  not probed; no interop reg.exe → HKLM is not queried (the binary cannot either).
+//                Evidence (or a probe that cannot finish) → the managed FILE tier contributes no
+//                policy, hooks or servers, and registration is `hook_policy_unjudgeable` (or the
+//                check-failed code) unless a failure outside it stands. No evidence → judged
+//                normally. The `managed_policy` report field and its one text line say what was
+//                checked; they never change the exit code. The managed-settings directory
+//                defaults to the binary's per platform (`Zh()`): `/etc/claude-code`,
+//                `/Library/Application Support/ClaudeCode`, `C:\Program Files\ClaudeCode`.
+//                Floors: a macOS profile delivering settings under another domain, a storage-v5
+//                layout other than the probed candidates, and a plist's, key's or store's
+//                CONTENT are not read — presence is the whole signal. `scripts/check-child-argv-credentials.mjs`
+//                passes but does not inspect this call: its program is a variable, which that
+//                checker skips (probed: a planted credential in this argv still scanned clean).
+//   trust        the binary skips hook execution when the workspace trust dialog is not
+//                accepted (`Tie()`); doctor does not read trust (floor).
+//   matchers     (round-2 F029) a group's `matcher` filters: on SessionStart the start source
+//                (measured: "resume" did not fire on startup; "" and "*" did), on FileChanged
+//                basename(file_path), where it also adds static watch paths (binary). Our frozen
+//                groups carry none (absent or ""); a settings or foreign wake hook with any other
+//                matcher is `unjudgeable_hook`.
+//   freeze       (F025) our hooks are compared on type, command, matcher, and the exact handler
+//                and group key NAMES: FileChanged `{type, command, asyncRewake: true}`,
+//                SessionStart `{type, command}`, so a `timeout`, `if`, `statusMessage` or a
+//                SessionStart `asyncRewake` is a mismatch. Floor: the hook script's bytes are not
+//                hashed (a github source of our repository is trusted by source).
+//   disabled vs identity (panel S4, intended): the foreign-plugin and stanza checks read a
+//                plugin's declared tree whether or not `disabledMcpServers` turns its server off
+//                here. What a plugin IS does not depend on one project's switch; only the
+//                registration count and the pin (which need a launched server) honour it.
+//
+// Floors: codex plugins are not read; a plugin's `userConfig`, managed servers under
+// `disabledMcpServers` (unmeasured, so never excluded), and an `--add-dir`/`--settings` layer are
+// not modelled; claude's `.mcp.json`
+// approval state and pi/grok project trust are not modelled (a
+// project entry is counted as loaded); opencode's `OPENCODE_CONFIG`/`OPENCODE_CONFIG_DIR` are not
+// read; `managed-mcp.json`'s exclusive-control mode is not modelled; `claude mcp get` still showed
+// a local entry carrying `disabled: true`, so doctor's reading of that field as "not launched" is
+// stricter than claude.
+//
+// Config text is DATA. Every object the readers build has a null prototype and every lookup is an
+// own-property lookup; a `__proto__`, `constructor` or `prototype` key makes the file unparseable
+// (round 1, Astra 1: `[__proto__.mcp_servers.x]` used to write onto `Object.prototype`).
+import { spawnSync } from "node:child_process";
+import * as nodeFs from "node:fs";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+export const BOARD_MCP_MARKER = "agent-board-mcp";
+export const METADATA_ONLY_FLAG = "--metadata-only";
+export const OPENCODE_PLUGIN_PACKAGE = "@consiliency/agent-board-opencode";
+export const PI_PACKAGE = "npm:@consiliency/agent-board-pi";
+/** Claude Code events that each need exactly one `wake-hook.sh` hook (`docs/local-wake-signal.md`). */
+export const CLAUDE_REQUIRED_HOOK_EVENTS = Object.freeze(["SessionStart", "FileChanged"]);
+/** A wake hook is a command with a token whose BASENAME is this (see `namesWakeHook`). */
+export const WAKE_HOOK_MARKER = "wake-hook.sh";
+const WRAPPER_MAX_BYTES = 64 * 1024;
+// IF-0-CCPLUGIN-1, as frozen on outcome B (`plans/CCPLUGIN-SPIKE.md`). SL-1's manifest check owns
+// the plugin tree; these are the same frozen strings, read from the plan, not from its files.
+export const CLAUDE_PLUGIN_ID = "agent-board@message-board";
+export const CLAUDE_PLUGIN_MARKETPLACE = "message-board";
+/** Compared lower-cased, as Claude Code compares repos. */
+export const CLAUDE_PLUGIN_REPO = "consiliency/message-board";
+export const CLAUDE_PLUGIN_SERVER = "agent-board";
+export const CLAUDE_PLUGIN_MCP_PACKAGE = "@consiliency/agent-board-mcp";
+/** The SL-0 outcome: `B` = the FileChanged hook carries `asyncRewake: true`. */
+export const CLAUDE_WAKE_SHAPE = "B";
+export const CLAUDE_PLUGIN_HOOK_COMMANDS = Object.freeze({
+    SessionStart: "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/wake-hook.sh\" SessionStart",
+    FileChanged: "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/wake-hook.sh\" FileChanged",
+});
+/** The stanza a plugin of version `version` must carry: the pin IS the plugin version. */
+export function claudePluginStanza(version) {
+    return { command: "npx", args: ["-y", `${CLAUDE_PLUGIN_MCP_PACKAGE}@${version}`, "--harness", "claude"] };
+}
+/**
+ * Whether a hook command names the wake hook. The tokenizer is frozen: split on whitespace, strip
+ * quotes, no comment handling; a token matches when its basename is exactly `wake-hook.sh`, so
+ * `codex-wake-hook.sh` does not. Floor: a hook that never names the basename is invisible.
+ */
+export function namesWakeHook(command) {
+    // Quotes are removed by split/join, not a regex: a quote inside a regex literal desyncs the
+    // comment/literal stripper that the #403 class checks run over this file.
+    return command.split(/\s+/).some((token) => token.split("\"").join("").split("'").join("").split("/").pop() === WAKE_HOOK_MARKER);
+}
+const missing = (error) => {
+    const code = error.code;
+    return code === "ENOENT" || code === "ENOTDIR";
+};
+export const nodeRegistrationFs = {
+    readFile(path) {
+        try {
+            return nodeFs.readFileSync(path, "utf8");
+        }
+        catch (error) {
+            if (missing(error))
+                return null;
+            throw error;
+        }
+    },
+    readdir(path) {
+        try {
+            return nodeFs.readdirSync(path).sort();
+        }
+        catch (error) {
+            if (missing(error))
+                return null;
+            throw error;
+        }
+    },
+    lstat(path) {
+        try {
+            const stats = nodeFs.lstatSync(path);
+            return { uid: stats.uid, size: stats.size, isFile: stats.isFile() };
+        }
+        catch (error) {
+            if (missing(error))
+                return null;
+            throw error;
+        }
+    },
+    exists(path) {
+        try {
+            nodeFs.lstatSync(path);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    realpath(path) {
+        try {
+            return nodeFs.realpathSync(path);
+        }
+        catch (error) {
+            if (missing(error))
+                return null;
+            throw error;
+        }
+    },
+    getuid: () => process.getuid?.() ?? -1,
+};
+// ---------------------------------------------------------------------------------------------
+// Readers
+// ---------------------------------------------------------------------------------------------
+export class UnparseableConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnparseableConfigError";
+    }
+}
+/** Keys that name a prototype slot rather than data: a file carrying one is refused. */
+export const FORBIDDEN_CONFIG_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+/** A prototype-free object: an inherited property cannot answer a lookup on it. */
+const dict = () => Object.create(null);
+/**
+ * A prototype-free copy of the sources' OWN enumerable properties, later sources winning. Not
+ * `Object.assign`, which the #403 code-provenance class check (fleet_diagnosability A10) reserves
+ * because it can copy an error's `code`.
+ */
+function overlay(...sources) {
+    const out = dict();
+    for (const source of sources)
+        for (const key of Object.keys(source))
+            out[key] = source[key];
+    return out;
+}
+/** An OWN property of `value`, else undefined: nothing is read through a prototype. */
+export function own(value, key) {
+    return value !== null && typeof value === "object" && Object.prototype.hasOwnProperty.call(value, key)
+        ? value[key]
+        : undefined;
+}
+/** JSON.parse reviver: refuse prototype keys and rebuild every object without a prototype. */
+function prototypeFree(key, value) {
+    if (FORBIDDEN_CONFIG_KEYS.has(key))
+        throw new UnparseableConfigError(`refused key ${key}`);
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return value;
+    return overlay(value);
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text, prototypeFree);
+    }
+    catch (error) {
+        if (error instanceof UnparseableConfigError)
+            throw error;
+        throw new UnparseableConfigError(error.message);
+    }
+}
+/** JSONC: `//` and `/* *\/` comments and trailing commas removed outside strings, then JSON. */
+export function parseJsonc(text) {
+    let out = "";
+    let index = 0;
+    while (index < text.length) {
+        const char = text[index];
+        if (char === "\"") {
+            let end = index + 1;
+            while (end < text.length && text[end] !== "\"")
+                end += text[end] === "\\" ? 2 : 1;
+            out += text.slice(index, end + 1);
+            index = end + 1;
+        }
+        else if (char === "/" && text[index + 1] === "/") {
+            while (index < text.length && text[index] !== "\n")
+                index += 1;
+        }
+        else if (char === "/" && text[index + 1] === "*") {
+            const end = text.indexOf("*/", index + 2);
+            if (end < 0)
+                throw new UnparseableConfigError("unterminated block comment");
+            index = end + 2;
+        }
+        else {
+            out += char;
+            index += 1;
+        }
+    }
+    return parseJson(out.replace(/,(\s*[}\]])/g, "$1"));
+}
+function parseJsonDocument(text, allowEmpty) {
+    if (allowEmpty && text.trim() === "")
+        return dict();
+    return parseJson(text);
+}
+/**
+ * A restricted TOML reader: enough of the grammar to read `[mcp_servers.*]` and `[projects.*]`
+ * tables without a new dependency, and fail-closed on anything outside it. It handles bare and
+ * quoted dotted keys, `[table]` and `[[array.table]]` headers, basic/literal (and multi-line)
+ * strings, arrays over several lines, inline tables, and bare scalars. Sub-tables nest, so
+ * `[mcp_servers.x.env]` is `x`'s `env`, never a server named `x.env`.
+ */
+export function parseRestrictedToml(text) {
+    const root = dict();
+    let table = root;
+    let pos = 0;
+    const fail = (what) => {
+        const line = text.slice(0, pos).split("\n").length;
+        throw new UnparseableConfigError(`TOML line ${line}: ${what}`);
+    };
+    const skipInline = () => {
+        while (pos < text.length && (text[pos] === " " || text[pos] === "\t"))
+            pos += 1;
+        if (text[pos] === "#")
+            while (pos < text.length && text[pos] !== "\n")
+                pos += 1;
+    };
+    const skipAll = () => {
+        for (;;) {
+            skipInline();
+            if (text[pos] === "\n" || text[pos] === "\r")
+                pos += 1;
+            else
+                return;
+        }
+    };
+    const readBasic = () => {
+        if (text.startsWith("\"\"\"", pos)) {
+            const end = text.indexOf("\"\"\"", pos + 3);
+            if (end < 0)
+                fail("unterminated multi-line string");
+            const raw = text.slice(pos + 3, end).replace(/^\r?\n/, "");
+            pos = end + 3;
+            return raw;
+        }
+        let end = pos + 1;
+        while (end < text.length && text[end] !== "\"" && text[end] !== "\n")
+            end += text[end] === "\\" ? 2 : 1;
+        if (text[end] !== "\"")
+            fail("unterminated string");
+        const raw = text.slice(pos, end + 1);
+        pos = end + 1;
+        try {
+            return JSON.parse(raw.replace(/\\U([0-9A-Fa-f]{8})/g, (_m, hex) => String.fromCodePoint(parseInt(hex, 16))));
+        }
+        catch {
+            return fail("invalid escape in string");
+        }
+    };
+    const readLiteral = () => {
+        if (text.startsWith("'''", pos)) {
+            const end = text.indexOf("'''", pos + 3);
+            if (end < 0)
+                fail("unterminated multi-line literal string");
+            const raw = text.slice(pos + 3, end).replace(/^\r?\n/, "");
+            pos = end + 3;
+            return raw;
+        }
+        const end = text.indexOf("'", pos + 1);
+        if (end < 0 || text.slice(pos, end).includes("\n"))
+            fail("unterminated literal string");
+        const raw = text.slice(pos + 1, end);
+        pos = end + 1;
+        return raw;
+    };
+    const readKeyPart = () => {
+        skipInline();
+        const part = text[pos] === "\"" ? readBasic() : text[pos] === "'" ? readLiteral() : (() => {
+            const match = /^[A-Za-z0-9_-]+/.exec(text.slice(pos));
+            if (!match)
+                return fail("expected a key");
+            pos += match[0].length;
+            return match[0];
+        })();
+        if (FORBIDDEN_CONFIG_KEYS.has(part))
+            fail(`refused key ${part}`);
+        return part;
+    };
+    const readKey = () => {
+        const parts = [readKeyPart()];
+        for (;;) {
+            skipInline();
+            if (text[pos] !== ".")
+                return parts;
+            pos += 1;
+            parts.push(readKeyPart());
+        }
+    };
+    const readValue = () => {
+        skipInline();
+        const char = text[pos];
+        if (char === "\"")
+            return readBasic();
+        if (char === "'")
+            return readLiteral();
+        if (char === "[") {
+            pos += 1;
+            const items = [];
+            for (;;) {
+                skipAll();
+                if (text[pos] === "]") {
+                    pos += 1;
+                    return items;
+                }
+                items.push(readValue());
+                skipAll();
+                if (text[pos] === ",")
+                    pos += 1;
+                else if (text[pos] !== "]")
+                    fail("expected , or ] in array");
+            }
+        }
+        if (char === "{") {
+            pos += 1;
+            const inline = dict();
+            skipInline();
+            if (text[pos] === "}") {
+                pos += 1;
+                return inline;
+            }
+            for (;;) {
+                const key = readKey();
+                skipInline();
+                if (text[pos] !== "=")
+                    fail("expected = in inline table");
+                pos += 1;
+                assign(inline, key, readValue());
+                skipInline();
+                if (text[pos] === ",")
+                    pos += 1;
+                else if (text[pos] === "}") {
+                    pos += 1;
+                    return inline;
+                }
+                else
+                    fail("expected , or } in inline table");
+            }
+        }
+        const match = /^[A-Za-z0-9_:.+\-]+(?:[ T][0-9:.+\-Z]+)?/.exec(text.slice(pos));
+        if (!match)
+            return fail("unsupported value");
+        pos += match[0].length;
+        const bare = match[0];
+        if (bare === "true")
+            return true;
+        if (bare === "false")
+            return false;
+        if (/^[+-]?[0-9_]+$/.test(bare))
+            return Number(bare.replace(/_/g, ""));
+        if (/^[+-]?[0-9_]+(\.[0-9_]+)?([eE][+-]?[0-9]+)?$/.test(bare))
+            return Number(bare.replace(/_/g, ""));
+        if (/^\d{4}-\d{2}-\d{2}/.test(bare) || /^\d{2}:\d{2}/.test(bare) || /^[+-]?(inf|nan)$/.test(bare))
+            return bare;
+        return fail("unsupported bare value");
+    };
+    const descend = (from, key, arrayTable) => {
+        let node = from;
+        key.forEach((part, index) => {
+            const last = index === key.length - 1;
+            let next = own(node, part);
+            if (last && arrayTable) {
+                if (next === undefined)
+                    node[part] = next = [];
+                if (!Array.isArray(next))
+                    fail(`${part} is not an array of tables`);
+                const entry = dict();
+                next.push(entry);
+                node = entry;
+                return;
+            }
+            if (Array.isArray(next))
+                next = next[next.length - 1];
+            if (next === undefined)
+                node[part] = next = dict();
+            if (!next || typeof next !== "object" || Array.isArray(next))
+                fail(`${part} is not a table`);
+            node = next;
+        });
+        return node;
+    };
+    const assign = (into, key, value) => {
+        const parent = descend(into, key.slice(0, -1), false);
+        const last = key[key.length - 1];
+        if (Object.prototype.hasOwnProperty.call(parent, last))
+            fail(`duplicate key ${last}`);
+        parent[last] = value;
+    };
+    for (;;) {
+        skipAll();
+        if (pos >= text.length)
+            return root;
+        if (text[pos] === "[") {
+            const arrayTable = text[pos + 1] === "[";
+            pos += arrayTable ? 2 : 1;
+            const key = readKey();
+            skipInline();
+            if (text[pos] !== "]" || (arrayTable && text[pos + 1] !== "]"))
+                fail("unterminated table header");
+            pos += arrayTable ? 2 : 1;
+            table = descend(root, key, arrayTable);
+        }
+        else {
+            const key = readKey();
+            skipInline();
+            if (text[pos] !== "=")
+                fail("expected =");
+            pos += 1;
+            assign(table, key, readValue());
+        }
+        skipInline();
+        if (pos < text.length && text[pos] !== "\n" && text[pos] !== "\r")
+            fail("trailing characters");
+    }
+}
+/** A `type: "command"` handler with a command: the only kind doctor can judge. */
+const isCommand = (hook) => hook.type === "command" && hook.command !== null;
+const empty = () => ({ mcp: [], hooks: Object.create(null), packages: [] });
+const isObject = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+/** Judge-relevant fields of one entry, from its own fields only. */
+export function mcpEntry(name, fields, shape) {
+    let command = null;
+    let args = [];
+    const rawCommand = own(fields, "command");
+    if (shape === "opencode") {
+        if (Array.isArray(rawCommand)) {
+            command = typeof rawCommand[0] === "string" ? rawCommand[0] : null;
+            args = rawCommand.slice(1).filter((item) => typeof item === "string");
+        }
+    }
+    else {
+        command = typeof rawCommand === "string" ? rawCommand : null;
+        const rawArgs = own(fields, "args");
+        args = Array.isArray(rawArgs) ? rawArgs.filter((item) => typeof item === "string") : [];
+    }
+    const disabled = own(fields, "disabled") === true || own(fields, "enabled") === false;
+    return { name, command, args, disabled, fields, shape };
+}
+function mcpFromMap(map, shape) {
+    if (map === undefined || map === null)
+        return [];
+    if (!isObject(map))
+        throw new UnparseableConfigError("MCP server map is not an object");
+    return Object.keys(map).map((name) => {
+        const raw = own(map, name);
+        if (!isObject(raw))
+            throw new UnparseableConfigError(`MCP server ${name} is not an object`);
+        return mcpEntry(name, overlay(raw), shape);
+    });
+}
+function hooksFrom(settings) {
+    const out = Object.create(null);
+    const hooksMap = own(settings, "hooks");
+    if (!isObject(settings) || hooksMap === undefined)
+        return out;
+    if (!isObject(hooksMap))
+        throw new UnparseableConfigError("hooks is not an object");
+    for (const event of Object.keys(hooksMap)) {
+        const groups = own(hooksMap, event);
+        if (!Array.isArray(groups))
+            throw new UnparseableConfigError(`hooks.${event} is not an array`);
+        for (const group of groups) {
+            const hooks = isObject(group) ? own(group, "hooks") : undefined;
+            if (!Array.isArray(hooks))
+                throw new UnparseableConfigError(`hooks.${event} has a group with no hooks array`);
+            // EVERY handler is kept, whatever its type: an http/mcp_tool/prompt/agent handler still
+            // runs (panel B2), so dropping it would hide it from the exact-set and unjudgeable checks.
+            const matcher = own(group, "matcher");
+            for (const hook of hooks) {
+                if (!isObject(hook))
+                    throw new UnparseableConfigError(`hooks.${event} has a handler that is not an object`);
+                const type = own(hook, "type");
+                const command = own(hook, "command");
+                (out[event] ??= []).push({
+                    type: typeof type === "string" ? type : "",
+                    command: type === "command" && typeof command === "string" ? command : null,
+                    asyncRewake: own(hook, "asyncRewake") === true,
+                    hasMatcher: matcher !== undefined && matcher !== "",
+                    handlerKeys: Object.keys(hook).sort(),
+                    groupKeys: Object.keys(group).sort(),
+                });
+            }
+        }
+    }
+    return out;
+}
+function packageSpecs(list, field) {
+    if (list === undefined)
+        return [];
+    if (!Array.isArray(list))
+        throw new UnparseableConfigError(`${field} is not an array`);
+    return list.flatMap((item) => {
+        if (typeof item === "string")
+            return [item];
+        const source = own(item, "source");
+        if (isObject(item) && typeof source === "string")
+            return [source];
+        if (Array.isArray(item) && typeof item[0] === "string")
+            return [item[0]];
+        return [];
+    });
+}
+/** Directories from `cwd` up to its git root (inclusive); just `cwd` outside a repository. */
+export function walkToGitRoot(cwd, fs) {
+    const dirs = [];
+    let current = resolve(cwd);
+    for (;;) {
+        dirs.push(current);
+        if (fs.exists(join(current, ".git")))
+            return dirs;
+        const parent = dirname(current);
+        if (parent === current)
+            return [resolve(cwd)];
+        current = parent;
+    }
+}
+const claudeConfigDir = (ctx) => {
+    const value = ctx.env.CLAUDE_CONFIG_DIR;
+    return value && isAbsolute(value) ? value : null;
+};
+const claudeJsonPath = (ctx) => join(claudeConfigDir(ctx) ?? ctx.home, ".claude.json");
+const claudeUserDir = (ctx) => claudeConfigDir(ctx) ?? join(ctx.home, ".claude");
+const managedSettingsPaths = (ctx) => [
+    join(ctx.claudeManagedDir, "managed-settings.json"),
+    ...(ctx.fs.readdir(join(ctx.claudeManagedDir, "managed-settings.d")) ?? [])
+        .filter((name) => name.endsWith(".json"))
+        .map((name) => join(ctx.claudeManagedDir, "managed-settings.d", name)),
+];
+const codexHome = (ctx) => {
+    const value = ctx.env.CODEX_HOME;
+    return value && isAbsolute(value) ? value : join(ctx.home, ".codex");
+};
+const xdgConfig = (ctx) => {
+    const value = ctx.env.XDG_CONFIG_HOME;
+    return value && value.trim() !== "" && isAbsolute(value) ? value : join(ctx.home, ".config");
+};
+const piAgentDir = (ctx) => {
+    const value = ctx.env.PI_CODING_AGENT_DIR;
+    return value && isAbsolute(value) ? value : join(ctx.home, ".pi", "agent");
+};
+/** codex loads `<dir>/.codex/config.toml` only when the nearest `[projects]` entry at or above `<dir>` is trusted. */
+function codexLayerTrusted(path, ctx) {
+    const text = ctx.fs.readFile(join(codexHome(ctx), "config.toml"));
+    if (text === null)
+        return false;
+    const projects = own(parseRestrictedToml(text), "projects");
+    if (!isObject(projects))
+        return false;
+    let dir = dirname(dirname(path));
+    for (;;) {
+        const entry = own(projects, dir);
+        if (isObject(entry))
+            return own(entry, "trust_level") === "trusted";
+        const parent = dirname(dir);
+        if (parent === dir)
+            return false;
+        dir = parent;
+    }
+}
+const row = (definition) => Object.freeze(definition);
+/** The frozen, re-checked scope table (see the header for each amendment and its evidence). */
+export const HARNESS_CONFIG_SCOPES = Object.freeze({
+    claude: Object.freeze([
+        row({ name: "claude_user_mcp", parser: "json", rank: 10, paths: (ctx) => [claudeJsonPath(ctx)],
+            extract: (doc) => ({ ...empty(), mcp: mcpFromMap(own(doc, "mcpServers"), "claude") }) }),
+        row({ name: "claude_local_mcp", parser: "json", rank: 30, paths: (ctx) => [claudeJsonPath(ctx)],
+            extract: (doc, ctx) => {
+                const project = own(own(doc, "projects"), claudeProjectKey(ctx));
+                return { ...empty(), mcp: mcpFromMap(own(project, "mcpServers"), "claude") };
+            } }),
+        row({ name: "claude_project_mcp", parser: "json", rank: 20, paths: (ctx) => [join(ctx.cwd, ".mcp.json")],
+            extract: (doc) => ({ ...empty(), mcp: mcpFromMap(own(doc, "mcpServers"), "claude") }) }),
+        row({ name: "claude_managed_mcp", parser: "json", rank: 40, paths: (ctx) => [join(ctx.claudeManagedDir, "managed-mcp.json")],
+            extract: (doc) => ({ ...empty(), mcp: mcpFromMap(own(doc, "mcpServers"), "claude") }) }),
+        row({ name: "claude_managed_settings", parser: "json", rank: 40, paths: managedSettingsPaths,
+            extract: (doc) => ({ ...empty(), mcp: mcpFromMap(own(doc, "managedMcpServers"), "claude"), hooks: hooksFrom(doc) }) }),
+        row({ name: "claude_user_settings", parser: "json", rank: 10, paths: (ctx) => [join(claudeUserDir(ctx), "settings.json")],
+            extract: (doc) => ({ ...empty(), hooks: hooksFrom(doc) }) }),
+        row({ name: "claude_project_settings", parser: "json", rank: 20, paths: (ctx) => [join(ctx.cwd, ".claude", "settings.json")],
+            extract: (doc) => ({ ...empty(), hooks: hooksFrom(doc) }) }),
+        row({ name: "claude_project_local_settings", parser: "json", rank: 30, paths: (ctx) => [join(ctx.cwd, ".claude", "settings.local.json")],
+            extract: (doc) => ({ ...empty(), hooks: hooksFrom(doc) }) }),
+    ]),
+    codex: Object.freeze([
+        row({ name: "codex_user", parser: "toml", rank: 10, paths: (ctx) => [join(codexHome(ctx), "config.toml")],
+            extract: (doc) => ({ ...empty(), mcp: mcpFromMap(own(doc, "mcp_servers"), "toml") }) }),
+        row({ name: "codex_project", parser: "toml", rank: 20, walkWins: "nearest",
+            paths: (ctx) => walkToGitRoot(ctx.cwd, ctx.fs).map((dir) => join(dir, ".codex", "config.toml"))
+                .filter((path) => path !== join(codexHome(ctx), "config.toml")),
+            loaded: codexLayerTrusted,
+            extract: (doc) => ({ ...empty(), mcp: mcpFromMap(own(doc, "mcp_servers"), "toml") }) }),
+    ]),
+    grok: Object.freeze([
+        row({ name: "grok_user", parser: "toml", rank: 10, paths: (ctx) => [join(ctx.home, ".grok", "config.toml")],
+            extract: (doc) => ({ ...empty(), mcp: mcpFromMap(own(doc, "mcp_servers"), "toml") }) }),
+        row({ name: "grok_project", parser: "toml", rank: 20, walkWins: "nearest",
+            paths: (ctx) => walkToGitRoot(ctx.cwd, ctx.fs).map((dir) => join(dir, ".grok", "config.toml"))
+                .filter((path) => path !== join(ctx.home, ".grok", "config.toml")),
+            extract: (doc) => ({ ...empty(), mcp: mcpFromMap(own(doc, "mcp_servers"), "toml") }) }),
+    ]),
+    agy: Object.freeze([
+        row({ name: "agy_user", parser: "json_or_empty", rank: 10, paths: (ctx) => [join(ctx.home, ".gemini", "config", "mcp_config.json")],
+            extract: (doc) => ({ ...empty(), mcp: mcpFromMap(own(doc, "mcpServers"), "agy") }) }),
+    ]),
+    opencode: Object.freeze([
+        row({ name: "opencode_user", parser: "jsonc", rank: 10,
+            paths: (ctx) => ["opencode.json", "opencode.jsonc"].map((name) => join(xdgConfig(ctx), "opencode", name)),
+            extract: (doc) => opencodeContribution(doc) }),
+        // Nearest directory wins, but INSIDE one directory .json is applied before .jsonc: measured on
+        // opencode 1.18.32 (`opencode debug config`, dev0, 2026-09-26) — .jsonc won in both orders. So the directories are reversed here and the pair keeps its order: a flat
+        // `walkWins: "nearest"` reverse would also swap the two files (Q-6).
+        row({ name: "opencode_project", parser: "jsonc", rank: 20,
+            paths: (ctx) => [...walkToGitRoot(ctx.cwd, ctx.fs)].reverse().flatMap((dir) => ["opencode.json", "opencode.jsonc"].map((name) => join(dir, name))),
+            extract: (doc) => opencodeContribution(doc) }),
+        row({ name: "opencode_project_dotdir", parser: "jsonc", rank: 30, walkWins: "farthest",
+            paths: (ctx) => walkToGitRoot(ctx.cwd, ctx.fs).flatMap((dir) => ["opencode.json", "opencode.jsonc"].map((name) => join(dir, ".opencode", name))),
+            extract: (doc) => opencodeContribution(doc) }),
+    ]),
+    pi: Object.freeze([
+        row({ name: "pi_user", parser: "json", rank: 10, paths: (ctx) => [join(piAgentDir(ctx), "settings.json")],
+            extract: (doc) => ({ ...empty(), packages: packageSpecs(own(doc, "packages"), "packages") }) }),
+        row({ name: "pi_project", parser: "json", rank: 20, paths: (ctx) => [join(ctx.cwd, ".pi", "settings.json")],
+            extract: (doc) => ({ ...empty(), packages: packageSpecs(own(doc, "packages"), "packages") }) }),
+    ]),
+});
+/**
+ * How a harness combines a same-named entry across its layers (see the header): codex and
+ * opencode overlay the higher layer's fields (measured); claude replaces the whole entry
+ * (inferred); grok is assumed to behave like codex (unmeasured); agy and pi have one layer, so
+ * their value is never used.
+ */
+export const MCP_LAYER_MERGE = Object.freeze({
+    claude: "replace", codex: "fields", grok: "fields", agy: "fields", opencode: "fields", pi: "fields",
+});
+function opencodeContribution(doc) {
+    if (!isObject(doc))
+        throw new UnparseableConfigError("opencode config is not an object");
+    return { ...empty(), mcp: mcpFromMap(own(doc, "mcp"), "opencode"), packages: packageSpecs(own(doc, "plugin"), "plugin") };
+}
+// ---------------------------------------------------------------------------------------------
+// Claude Code plugins (IF-0-CCPLUGIN-3; the measurements are in the header)
+// ---------------------------------------------------------------------------------------------
+/** Synthetic row names: authored, so no plugin id, marketplace name or path reaches a reason. */
+export const CLAUDE_PLUGIN_ROW = "claude_plugin";
+export const CLAUDE_FOREIGN_PLUGIN_ROW = "claude_plugin_foreign";
+const INSTALLED_PLUGINS_SCHEMA = 2;
+// Managed (admin) policy sources other than the managed-settings file, exactly as Claude Code
+// 2.1.283 reads them (strings of the linux-x64, darwin-arm64 and win32-x64 binaries; read, not
+// run; see the header's `managed tier`). Doctor looks for EVIDENCE of each and never reads content.
+export const CLAUDE_REMOTE_SETTINGS_FILE = "remote-settings.json";
+/**
+ * Storage-v5 (round 4): the binary writes the server-managed payload to its state store
+ * (`Re.state("remote-settings")`, a `state` namespace in the config home) and a signed-cache
+ * sidecar beside the json path. The store's exact on-disk name is not recoverable from strings,
+ * so every candidate is probed; any one present is evidence.
+ */
+export const CLAUDE_REMOTE_SETTINGS_STATE_CANDIDATES = Object.freeze([
+    join("state", "remote-settings"), join("state", "remote-settings.json"),
+    join("storage-v2", "state", "remote-settings"), join("storage-v2", "state", "remote-settings.json"),
+]);
+export const CLAUDE_REMOTE_SETTINGS_SIDECARS = Object.freeze([
+    "remote-settings.json.signature.json", "remote-settings.json.signature-iat.json",
+]);
+export const MACOS_MANAGED_PREFERENCES = "/Library/Managed Preferences";
+export const MACOS_POLICY_PLIST = "com.anthropic.claudecode.plist";
+export const WINDOWS_POLICY_KEYS = Object.freeze({
+    hklm: "HKLM\\SOFTWARE\\Policies\\ClaudeCode",
+    hkcu: "HKCU\\SOFTWARE\\Policies\\ClaudeCode",
+});
+export const WINDOWS_POLICY_VALUE = "Settings";
+/** Where WSL's Windows interop puts reg.exe; the binary reads HKLM policy through this path. */
+export const WSL_REG_EXE = "/mnt/c/Windows/System32/reg.exe";
+export const WSL_WINDOWS_MANAGED_DIR = "/mnt/c/Program Files/ClaudeCode";
+const REG_TIMEOUT_MS = 5000;
+/**
+ * The binary's own query: `reg query <key> /v Settings`, an argv array, no shell, 5 s. Exit 0 →
+ * the value is there; reg's "unable to find" → not there (the binary's own test); anything else —
+ * no reg.exe, a timeout, another failure — is an error, never "absent".
+ */
+export function regQueryWith(timeoutMs) {
+    return (regExe, key) => {
+        const result = spawnSync(regExe, ["query", key, "/v", WINDOWS_POLICY_VALUE], {
+            encoding: "utf8", timeout: timeoutMs, windowsHide: true, stdio: ["ignore", "pipe", "pipe"],
+        });
+        if (result.error) {
+            return { kind: "error", cause: result.error.code === "ETIMEDOUT" ? "reg_timeout" : "reg_unavailable" };
+        }
+        if (result.signal !== null)
+            return { kind: "error", cause: "reg_timeout" };
+        if (result.status === 0)
+            return { kind: "present" };
+        return /unable to find/i.test(`${result.stdout ?? ""}${result.stderr ?? ""}`) ? { kind: "absent" } : { kind: "error", cause: "reg_failed" };
+    };
+}
+export const nodeRegQuery = regQueryWith(REG_TIMEOUT_MS);
+/** The binary's WSL test: `WSL_DISTRO_NAME`, or /proc/version naming microsoft or wsl. */
+function onWsl(ctx) {
+    if (ctx.env.WSL_DISTRO_NAME)
+        return true;
+    const version = (ctx.fs.readFile("/proc/version") ?? "").toLowerCase();
+    return version.includes("microsoft") || version.includes("wsl");
+}
+export function probeManagedPolicy(ctx) {
+    const checked = [];
+    const evidence = [];
+    const errors = [];
+    const present = (name, path) => {
+        checked.push(name);
+        if (ctx.fs.exists(path))
+            evidence.push(name);
+    };
+    const registry = (name, regExe, key) => {
+        checked.push(name);
+        const outcome = (ctx.regQuery ?? nodeRegQuery)(regExe, key);
+        if (outcome.kind === "present")
+            evidence.push(name);
+        else if (outcome.kind === "error")
+            errors.push(outcome.cause);
+    };
+    const anyOf = (name, paths) => {
+        checked.push(name);
+        if (paths.some((path) => ctx.fs.exists(path)))
+            evidence.push(name);
+    };
+    const home = claudeUserDir(ctx);
+    present("remote_settings", join(home, CLAUDE_REMOTE_SETTINGS_FILE));
+    anyOf("remote_settings_state", CLAUDE_REMOTE_SETTINGS_STATE_CANDIDATES.map((relative) => join(home, relative)));
+    anyOf("remote_settings_signature", CLAUDE_REMOTE_SETTINGS_SIDECARS.map((relative) => join(home, relative)));
+    const platform = ctx.platform ?? "linux";
+    if (platform === "darwin") {
+        // No login name → the per-user plist cannot be located: an unfinished probe, never a skip.
+        if (ctx.userName)
+            present("macos_user_plist", join(MACOS_MANAGED_PREFERENCES, ctx.userName, MACOS_POLICY_PLIST));
+        else {
+            checked.push("macos_user_plist");
+            errors.push("login_unavailable");
+        }
+        present("macos_device_plist", join(MACOS_MANAGED_PREFERENCES, MACOS_POLICY_PLIST));
+        return { checked, evidence, errors, unreadableSourcesPossible: true, platformLabel: "macOS" };
+    }
+    if (platform === "win32") {
+        const regExe = `${ctx.env.SYSTEMROOT || "C:\\Windows"}\\System32\\reg.exe`;
+        registry("windows_hklm", regExe, WINDOWS_POLICY_KEYS.hklm);
+        registry("windows_hkcu", regExe, WINDOWS_POLICY_KEYS.hkcu);
+        return { checked, evidence, errors, unreadableSourcesPossible: true, platformLabel: "Windows" };
+    }
+    if (onWsl(ctx)) {
+        // WSL inherits Windows policy only when an ADMIN Windows source enables it (HKLM or the
+        // Program Files file); HKCU alone cannot, so it is not probed here.
+        present("wsl_program_files_settings", join(WSL_WINDOWS_MANAGED_DIR, "managed-settings.json"));
+        present("wsl_program_files_settings_d", join(WSL_WINDOWS_MANAGED_DIR, "managed-settings.d"));
+        if (ctx.fs.exists(WSL_REG_EXE))
+            registry("wsl_windows_hklm", WSL_REG_EXE, WINDOWS_POLICY_KEYS.hklm);
+        return { checked, evidence, errors, unreadableSourcesPossible: true, platformLabel: "WSL" };
+    }
+    return { checked, evidence, errors, unreadableSourcesPossible: false, platformLabel: "Linux" };
+}
+/** The binary's `Le`: an env flag is on when it is 1/true/yes/on. */
+const truthyFlag = (value) => value !== undefined && ["1", "true", "yes", "on"].includes(value.toLowerCase().trim());
+/** Evidence of (or an unfinished probe for) a tier that replaces the managed settings FILE. */
+export const managedFileTierReplaced = (probe) => probe.evidence.length > 0 || probe.errors.length > 0;
+function claudeHookPolicy(ctx, allLayers, probe) {
+    // The caller drops the managed FILE layers when a tier doctor cannot read replaces them (round-4
+    // codex: one filter, at the read, for every consumer); this function only reports the fact.
+    const managedTierUnreadable = managedFileTierReplaced(probe);
+    const layers = allLayers;
+    // The highest layer holding a boolean wins (measured for disableAllHooks: local false over user true).
+    const lastBoolean = (key, only) => {
+        let value;
+        for (const layer of layers) {
+            if (only === "managed" && !layer.managed)
+                continue;
+            const candidate = own(layer.document, key);
+            if (typeof candidate === "boolean")
+                value = candidate;
+        }
+        return value;
+    };
+    const managedIds = new Set();
+    let strict;
+    let unjudgeable = false;
+    for (const layer of layers) {
+        if (!layer.managed)
+            continue;
+        const enabled = own(layer.document, "enabledPlugins");
+        if (isObject(enabled)) {
+            for (const id of Object.keys(enabled)) {
+                // As the binary merges managed documents (read, not run): its schema takes a boolean, a
+                // version array or an object here, and reads anything else as UNSET, so a later string,
+                // number or null leaves the earlier value standing. A valid non-true value replaces it,
+                // and `eb()` counts only a literal true.
+                const value = own(enabled, id);
+                if (value === true && id.includes("@"))
+                    managedIds.add(id);
+                else if (value === false || Array.isArray(value) || isObject(value))
+                    managedIds.delete(id);
+            }
+        }
+        const value = own(layer.document, "strictPluginOnlyCustomization");
+        if (value !== undefined)
+            strict = value;
+        if (own(layer.document, "prependPlugins") !== undefined || own(layer.document, "appendPlugins") !== undefined)
+            unjudgeable = true;
+    }
+    const managedDisableAll = lastBoolean("disableAllHooks", "managed") === true;
+    const managedOnly = lastBoolean("allowManagedHooksOnly", "managed") === true;
+    const anyDisableAll = lastBoolean("disableAllHooks") === true;
+    const safeMode = truthyFlag(ctx.env.CLAUDE_CODE_SAFE_MODE);
+    const bare = truthyFlag(ctx.env.CLAUDE_CODE_SIMPLE);
+    const strictHooks = strict === true || (Array.isArray(strict) && strict.includes("hooks"));
+    const managedPluginIds = managedIds;
+    if (bare || managedDisableAll)
+        return { settings: "none", plugins: "none", managedPluginIds, unjudgeable: false, managedTierUnreadable, probe };
+    const settings = managedOnly || safeMode || strictHooks || anyDisableAll ? "managed_only" : "all";
+    const plugins = safeMode ? "none" : managedOnly || anyDisableAll ? "managed_only" : "all";
+    return { settings, plugins, managedPluginIds, unjudgeable: unjudgeable && plugins === "managed_only", managedTierUnreadable, probe };
+}
+class UntrustedPluginPathError extends Error {
+}
+const claudePluginsDir = (ctx) => join(claudeUserDir(ctx), "plugins");
+/** Settings files that carry `enabledPlugins`/`extraKnownMarketplaces`, in ascending precedence. */
+const claudeSettingsLayers = (ctx) => [
+    join(claudeUserDir(ctx), "settings.json"),
+    join(ctx.cwd, ".claude", "settings.json"),
+    join(ctx.cwd, ".claude", "settings.local.json"),
+    ...managedSettingsPaths(ctx),
+];
+const within = (path, root) => path.startsWith(root.endsWith(sep) ? root : root + sep);
+/** The git repository root at or above `dir`, or null outside one. */
+function gitRootOf(dir, fs) {
+    const walked = walkToGitRoot(dir, fs);
+    const top = walked[walked.length - 1];
+    return fs.exists(join(top, ".git")) ? top : null;
+}
+/**
+ * Claude Code's row applicability (`uw`): user/managed rows everywhere, a project's rows in its
+ * repository. Measured from a symlinked cwd (panel S2): Claude's cwd is the REALPATH, while the
+ * row's `projectPath` is compared as recorded — a projectPath that is itself a symlink never
+ * applies, even from that symlink.
+ */
+function rowApplies(row, ctx) {
+    const scope = own(row, "scope");
+    if (scope === "user" || scope === "managed")
+        return true;
+    const projectPath = own(row, "projectPath");
+    if (typeof projectPath !== "string" || projectPath === "")
+        return false;
+    const cwd = ctx.fs.realpath(ctx.cwd) ?? resolve(ctx.cwd);
+    if (resolve(projectPath) === cwd)
+        return true;
+    const root = gitRootOf(cwd, ctx.fs);
+    return root !== null && gitRootOf(resolve(projectPath), ctx.fs) === root;
+}
+function readJsonFile(fs, path) {
+    const text = fs.readFile(path);
+    return text === null ? null : parseJson(text);
+}
+const truthyEnv = (value) => value !== undefined && ["1", "true", "yes", "on"].includes(value.toLowerCase().trim());
+/** `source` names a github marketplace of this repository, with no alternate manifest path. */
+function isOurMarketplaceSource(source) {
+    const repo = own(source, "repo");
+    return isObject(source) && own(source, "source") === "github" && typeof repo === "string"
+        && repo.toLowerCase() === CLAUDE_PLUGIN_REPO && own(source, "path") === undefined;
+}
+/**
+ * Reads one plugin tree, confined to the cache. `installPath` must resolve (realpath) strictly
+ * inside `<configDir>/plugins/cache/`, and so must every file read under it, else
+ * `UntrustedPluginPathError` and nothing beyond it is read: the only call made on an untrusted
+ * path is the `realpath` that judged it.
+ */
+function readPluginTree(ctx, installPath, serverPrefix) {
+    if (!isAbsolute(installPath))
+        throw new UntrustedPluginPathError();
+    const cache = ctx.fs.realpath(join(claudePluginsDir(ctx), "cache"));
+    const root = cache === null ? null : ctx.fs.realpath(installPath);
+    if (cache === null || root === null || !within(root, cache))
+        throw new UntrustedPluginPathError();
+    const confined = (relative) => {
+        const lexical = resolve(root, relative);
+        if (!within(lexical, root))
+            throw new UntrustedPluginPathError();
+        const real = ctx.fs.realpath(lexical);
+        if (real !== null && !within(real, root))
+            throw new UntrustedPluginPathError();
+        return real;
+    };
+    // Each file is read at most once: a manifest naming the default file (`"hooks":
+    // "./hooks/hooks.json"`) must not count its hooks twice.
+    const consumed = new Set();
+    const readConfined = (relative) => {
+        const real = confined(relative);
+        if (real === null || consumed.has(real))
+            return null;
+        consumed.add(real);
+        return readJsonFile(ctx.fs, real);
+    };
+    const manifest = readConfined(join(".claude-plugin", "plugin.json")) ?? dict();
+    const contribution = empty();
+    const addServers = (map) => {
+        for (const entry of mcpFromMap(map, "claude"))
+            contribution.mcp.push({ ...entry, name: `${serverPrefix}:${entry.name}` });
+    };
+    const serversIn = (document) => own(document, "mcpServers") ?? document;
+    const addHooks = (document) => {
+        const hooks = hooksFrom(isObject(own(document, "hooks")) ? document : overlay({ hooks: document }));
+        for (const event of Object.keys(hooks))
+            (contribution.hooks[event] ??= []).push(...hooks[event]);
+    };
+    // A manifest field is an inline object, a path relative to the plugin root, or a list of either.
+    const eachDeclared = (value, field, add, inline) => {
+        if (value === undefined)
+            return;
+        for (const item of Array.isArray(value) ? value : [value]) {
+            if (typeof item === "string") {
+                const document = readConfined(item);
+                if (document !== null)
+                    add(document);
+            }
+            else if (isObject(item))
+                inline(item);
+            else
+                throw new UnparseableConfigError(`plugin ${field} is neither a path nor an object`);
+        }
+    };
+    eachDeclared(own(manifest, "mcpServers"), "mcpServers", (document) => addServers(serversIn(document)), addServers);
+    const dotMcp = readConfined(".mcp.json");
+    if (dotMcp !== null)
+        addServers(serversIn(dotMcp));
+    const hooksFile = readConfined(join("hooks", "hooks.json"));
+    if (hooksFile !== null)
+        addHooks(hooksFile);
+    eachDeclared(own(manifest, "hooks"), "hooks", addHooks, addHooks);
+    return { contribution, manifest };
+}
+/**
+ * One handler, exactly as frozen (round-2 F025/F029): type `command`, the frozen command, no
+ * filtering matcher, `asyncRewake: true` on FileChanged and ABSENT on SessionStart, and no other
+ * handler or group field (so a `timeout`, `if` or `statusMessage` is a mismatch too).
+ */
+function matchesFrozenHandler(event, hook) {
+    const handlerKeys = event === "FileChanged" && CLAUDE_WAKE_SHAPE === "B" ? ["asyncRewake", "command", "type"] : ["command", "type"];
+    return isCommand(hook) && hook.command === CLAUDE_PLUGIN_HOOK_COMMANDS[event]
+        && !hook.hasMatcher && hook.groupKeys.every((key) => key === "hooks" || key === "matcher")
+        && JSON.stringify(hook.handlerKeys) === JSON.stringify(handlerKeys)
+        && (handlerKeys.includes("asyncRewake") ? hook.asyncRewake : true);
+}
+function sameKeys(value, keys) {
+    return isObject(value) && Object.keys(value).sort().join("\n") === [...keys].sort().join("\n");
+}
+/** Ours carries exactly the frozen stanza, derived from its own `version`, and exactly the frozen hooks. */
+function oursMatchesFreeze(contribution, version) {
+    if (version === null)
+        return false;
+    const expected = claudePluginStanza(version);
+    const servers = contribution.mcp;
+    const stanzaOk = servers.length === 1
+        && servers[0].name.endsWith(`:${CLAUDE_PLUGIN_SERVER}`)
+        && sameKeys(servers[0].fields, ["command", "args"])
+        && own(servers[0].fields, "command") === expected.command
+        && JSON.stringify(own(servers[0].fields, "args")) === JSON.stringify(expected.args);
+    // Exactly the frozen set: both events, one command handler each, and no other handler of any
+    // type on any event (panel B2a, S3).
+    const events = Object.keys(contribution.hooks).filter((event) => contribution.hooks[event].length > 0).sort();
+    const hooksOk = JSON.stringify(events) === JSON.stringify(Object.keys(CLAUDE_PLUGIN_HOOK_COMMANDS).sort())
+        && events.every((event) => contribution.hooks[event].length === 1 && matchesFrozenHandler(event, contribution.hooks[event][0]));
+    return stanzaOk && hooksOk;
+}
+function claudeAutoUpdate(ctx, declarations, known) {
+    const envDisabled = truthyEnv(ctx.env.DISABLE_UPDATES) || truthyEnv(ctx.env.DISABLE_AUTOUPDATER)
+        || !!ctx.env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC;
+    let claudeJson;
+    try {
+        claudeJson = readJsonFile(ctx.fs, claudeJsonPath(ctx));
+    }
+    catch (error) {
+        if (!(error instanceof UnparseableConfigError))
+            throw error;
+        return { effective: false, source: "undetermined" };
+    }
+    const configDisabled = own(claudeJson, "autoUpdates") === false
+        && !(own(claudeJson, "installMethod") === "native" && own(claudeJson, "autoUpdatesProtectedForNative") === true);
+    if ((envDisabled || configDisabled) && !truthyEnv(ctx.env.FORCE_AUTOUPDATE_PLUGINS)) {
+        return { effective: false, source: envDisabled ? "env_disabled" : "config_disabled" };
+    }
+    // The highest settings scope that declares the marketplace replaces the lower ones whole.
+    const fromSettings = declarations.length > 0 ? own(declarations[declarations.length - 1], "autoUpdate") : undefined;
+    if (typeof fromSettings === "boolean")
+        return { effective: fromSettings, source: "settings" };
+    const fromKnown = own(own(known, CLAUDE_PLUGIN_MARKETPLACE), "autoUpdate");
+    if (typeof fromKnown === "boolean")
+        return { effective: fromKnown, source: "known_marketplaces" };
+    return { effective: false, source: "default" };
+}
+/**
+ * IF-0-CCPLUGIN-3: every plugin enabled for `ctx.cwd`, followed from `enabledPlugins` to its
+ * installed row and read from the cache. Ours is the plugin id `agent-board@message-board` whose
+ * marketplace is declared, EVERYWHERE it is declared, as the github repository
+ * Consiliency/message-board; anything else contributing a board server or a wake hook is foreign.
+ */
+export function readClaudePluginScopes(ctx) {
+    const unparseable = new Set();
+    const failures = new Set();
+    const files = [];
+    let untrusted = false;
+    const summary = {
+        installed: false, serverActive: false, version: null, pinnedMcpVersion: null, sourceRef: null, autoUpdate: { effective: false, source: "default" },
+    };
+    const tolerant = (read, fallback) => {
+        try {
+            return read();
+        }
+        catch (error) {
+            if (!(error instanceof UnparseableConfigError))
+                throw error;
+            unparseable.add(CLAUDE_PLUGIN_ROW);
+            return fallback;
+        }
+    };
+    // Round-4 codex: when a tier doctor cannot read replaces the managed settings FILE, that file is
+    // not read at all, so it feeds NO consumer — plugin enablement, marketplace declarations (and so
+    // provenance and "ours"), the source ref, auto-update, the hook policy — and its parse errors are
+    // not reported. Only the probe's own evidence speaks for it.
+    const probe = probeManagedPolicy(ctx);
+    const managedPaths = new Set(managedSettingsPaths(ctx));
+    const fileTierReplaced = managedFileTierReplaced(probe);
+    const layers = claudeSettingsLayers(ctx).flatMap((path) => {
+        const managed = managedPaths.has(path);
+        if (managed && fileTierReplaced)
+            return [];
+        const document = tolerant(() => readJsonFile(ctx.fs, path), null);
+        return document === null ? [] : [{ managed, document }];
+    });
+    const settings = layers.map((layer) => layer.document);
+    const hookPolicy = claudeHookPolicy(ctx, layers, probe);
+    const known = tolerant(() => readJsonFile(ctx.fs, join(claudePluginsDir(ctx), "known_marketplaces.json")), null);
+    const installed = tolerant(() => {
+        const document = readJsonFile(ctx.fs, join(claudePluginsDir(ctx), "installed_plugins.json"));
+        if (document !== null && (own(document, "version") !== INSTALLED_PLUGINS_SCHEMA || !isObject(own(document, "plugins")))) {
+            throw new UnparseableConfigError("installed_plugins.json has an unknown shape");
+        }
+        return document;
+    }, null);
+    // enabledPlugins: the highest scope holding a boolean wins; anything else defines nothing.
+    const enabled = new Map();
+    for (const document of settings) {
+        const map = own(document, "enabledPlugins");
+        if (!isObject(map))
+            continue;
+        for (const id of Object.keys(map)) {
+            const value = own(map, id);
+            if (typeof value === "boolean")
+                enabled.set(id, value);
+        }
+    }
+    const declarationsOf = (marketplace) => settings.flatMap((document) => {
+        const declaration = own(own(document, "extraKnownMarketplaces"), marketplace);
+        return declaration === undefined ? [] : [declaration];
+    });
+    const ourDeclarations = declarationsOf(CLAUDE_PLUGIN_MARKETPLACE);
+    const ourKnown = own(known, CLAUDE_PLUGIN_MARKETPLACE);
+    const everyDeclaration = [...ourDeclarations, ...(ourKnown === undefined ? [] : [ourKnown])];
+    const marketplaceIsOurs = everyDeclaration.length > 0
+        && everyDeclaration.every((declaration) => isOurMarketplaceSource(own(declaration, "source")));
+    if (marketplaceIsOurs) {
+        // The winning declaration's ref: the highest settings scope, else known_marketplaces.json.
+        const ref = own(own(everyDeclaration[ourDeclarations.length > 0 ? ourDeclarations.length - 1 : 0], "source"), "ref");
+        summary.sourceRef = typeof ref === "string" ? ref : null;
+    }
+    summary.autoUpdate = tolerant(() => claudeAutoUpdate(ctx, ourDeclarations, known), { effective: false, source: "undetermined" });
+    for (const [id, on] of enabled) {
+        if (!on)
+            continue;
+        const at = id.lastIndexOf("@");
+        if (at <= 0)
+            continue;
+        const name = id.slice(0, at);
+        const rows = own(own(installed, "plugins"), id);
+        if (rows === undefined)
+            continue;
+        if (!Array.isArray(rows)) {
+            unparseable.add(CLAUDE_PLUGIN_ROW);
+            continue;
+        }
+        // The first applicable row is THE row: one without a string installPath stops here like an
+        // untrusted path, rather than falling through to a later row (panel S8).
+        const row = rows.find((candidate) => rowApplies(candidate, ctx));
+        if (row === undefined)
+            continue;
+        if (typeof own(row, "installPath") !== "string") {
+            untrusted = true;
+            continue;
+        }
+        const ours = id === CLAUDE_PLUGIN_ID && marketplaceIsOurs;
+        let tree;
+        try {
+            tree = readPluginTree(ctx, own(row, "installPath"), `plugin:${name}`);
+        }
+        catch (error) {
+            if (error instanceof UntrustedPluginPathError) {
+                untrusted = true;
+                continue;
+            }
+            if (!(error instanceof UnparseableConfigError))
+                throw error;
+            unparseable.add(ours ? CLAUDE_PLUGIN_ROW : CLAUDE_FOREIGN_PLUGIN_ROW);
+            continue;
+        }
+        const { contribution, manifest } = tree;
+        files.push({ row: ours ? CLAUDE_PLUGIN_ROW : CLAUDE_FOREIGN_PLUGIN_ROW, path: own(row, "installPath"), contribution, pluginId: id });
+        if (ours) {
+            const version = own(manifest, "version");
+            summary.installed = true;
+            summary.version = typeof version === "string" ? version : null;
+            const pinArg = contribution.mcp[0]?.args.find((arg) => arg.startsWith(`${CLAUDE_PLUGIN_MCP_PACKAGE}@`));
+            summary.pinnedMcpVersion = pinArg === undefined ? null : pinArg.slice(CLAUDE_PLUGIN_MCP_PACKAGE.length + 1);
+            if (!oursMatchesFreeze(contribution, summary.version))
+                failures.add("plugin_stanza_mismatch");
+        }
+        else {
+            const boardServer = contribution.mcp.some((entry) => judgeMcpEntry(entry, ctx.fs).board);
+            const wakeHook = Object.keys(contribution.hooks).some((event) => contribution.hooks[event].some((hook) => isCommand(hook) && namesWakeHook(hook.command)));
+            if (boardServer || wakeHook)
+                failures.add("foreign_board_plugin");
+        }
+    }
+    return { files, unparseable: [...unparseable], untrusted, failures: [...failures], summary, hookPolicy };
+}
+// ---------------------------------------------------------------------------------------------
+// Judgement
+// ---------------------------------------------------------------------------------------------
+/** A package spec's identity without its version: `@scope/name@1.2.3` → `@scope/name`. */
+export function packageIdentity(spec) {
+    const at = spec.lastIndexOf("@");
+    const scopeEnd = spec.indexOf("/");
+    return at > 0 && at > scopeEnd && spec[at - 1] !== ":" ? spec.slice(0, at) : spec;
+}
+/** A board MCP entry names `agent-board-mcp` in its command/args, or through ONE user-owned wrapper file. */
+export function judgeMcpEntry(entry, fs) {
+    const words = [entry.command ?? "", ...entry.args];
+    const flagged = words.some((word) => word === METADATA_ONLY_FLAG || word.startsWith(`${METADATA_ONLY_FLAG}=`));
+    if (words.some((word) => word.includes(BOARD_MCP_MARKER)))
+        return { board: true, flagged };
+    if (entry.command && isAbsolute(entry.command)) {
+        const stats = fs.lstat(entry.command);
+        if (stats && stats.isFile && stats.uid === fs.getuid() && stats.size < WRAPPER_MAX_BYTES) {
+            const text = fs.readFile(entry.command) ?? "";
+            if (text.includes(BOARD_MCP_MARKER))
+                return { board: true, flagged: flagged || text.includes(METADATA_ONLY_FLAG) };
+        }
+    }
+    return { board: false, flagged: false };
+}
+/**
+ * Read every scope row of `harness` for `cwd`. A file that fails to parse is reported, not guessed.
+ * `files` is in ascending precedence: a later file's same-named entry overrides an earlier one's.
+ */
+export function readScopes(harness, ctx) {
+    const files = [];
+    const unparseable = [];
+    const rows = [...HARNESS_CONFIG_SCOPES[harness]].sort((a, b) => a.rank - b.rank);
+    for (const scope of rows) {
+        // `paths` is in application order (the last file wins), except a walked row with `walkWins`,
+        // whose paths come cwd first and are reversed here when the nearest directory must win.
+        const paths = scope.paths(ctx);
+        for (const path of scope.walkWins === "nearest" ? [...paths].reverse() : paths) {
+            const text = ctx.fs.readFile(path);
+            if (text === null)
+                continue;
+            try {
+                if (scope.loaded && !scope.loaded(path, ctx))
+                    continue;
+                const document = scope.parser === "toml" ? parseRestrictedToml(text)
+                    : scope.parser === "jsonc" ? parseJsonc(text)
+                        : parseJsonDocument(text, scope.parser === "json_or_empty");
+                files.push({ row: scope.name, path, contribution: scope.extract(document, ctx) });
+            }
+            catch (error) {
+                if (!(error instanceof UnparseableConfigError))
+                    throw error;
+                unparseable.push(scope.name);
+            }
+        }
+    }
+    return { files, unparseable };
+}
+const MANAGED_MCP_ROWS = new Set(["claude_managed_mcp", "claude_managed_settings"]);
+/** The `.claude.json` `projects` key Claude Code uses for `cwd`: the git root of its realpath, else the realpath. */
+export function claudeProjectKey(ctx) {
+    const real = ctx.fs.realpath(ctx.cwd) ?? resolve(ctx.cwd);
+    return gitRootOf(real, ctx.fs) ?? real;
+}
+/**
+ * Server names `projects[<key>].disabledMcpServers` turns off here (see the header). An
+ * unparseable `.claude.json` disables nothing: its own row already reports it.
+ */
+function claudeDisabledServers(ctx) {
+    let document;
+    try {
+        document = readJsonFile(ctx.fs, claudeJsonPath(ctx));
+    }
+    catch (error) {
+        if (error instanceof UnparseableConfigError)
+            return new Set();
+        throw error;
+    }
+    const list = own(own(own(document, "projects"), claudeProjectKey(ctx)), "disabledMcpServers");
+    return new Set(Array.isArray(list) ? list.filter((name) => typeof name === "string") : []);
+}
+/** IF-0-CREDPATH-4 registration, for one working directory. */
+export function judgeRegistration(harness, ctx) {
+    const scopes = readScopes(harness, ctx);
+    // claude plugins are synthetic files ranked above user settings. Their server names are
+    // namespaced (`plugin:<name>:<server>`), so no same-name override crosses them either way.
+    const plugins = harness === "claude" ? readClaudePluginScopes(ctx) : null;
+    // When a server-managed or MDM tier replaces the managed settings FILE (round-3 N1), that file
+    // contributes nothing — neither servers nor hooks; the verdict is held undetermined below.
+    const fileTierReplaced = plugins?.hookPolicy.managedTierUnreadable === true;
+    const files = [...scopes.files.filter((file) => !(fileTierReplaced && file.row === "claude_managed_settings")), ...(plugins?.files ?? [])];
+    const scopeUnparseable = scopes.unparseable.filter((row) => !(fileTierReplaced && row === "claude_managed_settings"));
+    const unparseable = plugins ? [...scopeUnparseable, ...plugins.unparseable] : scopes.unparseable;
+    const failures = plugins ? [...plugins.failures] : [];
+    // The EFFECTIVE server map first: a higher layer's same-named entry overrides (replacing it, or
+    // overlaying its fields), so a board entry disabled or re-pointed above is judged as such.
+    const effective = new Map();
+    for (const file of files) {
+        for (const entry of file.contribution.mcp) {
+            const lower = effective.get(entry.name)?.entry;
+            const merged = lower && MCP_LAYER_MERGE[harness] === "fields"
+                ? mcpEntry(entry.name, overlay(lower.fields, entry.fields), entry.shape)
+                : entry;
+            effective.set(entry.name, { entry: merged, row: file.row });
+        }
+    }
+    const boardNames = new Set();
+    const boardRows = new Set();
+    let flagged = false;
+    const disabledHere = harness === "claude" ? claudeDisabledServers(ctx) : new Set();
+    for (const { entry, row: scopeRow } of effective.values()) {
+        if (entry.disabled)
+            continue;
+        if (disabledHere.has(entry.name) && !MANAGED_MCP_ROWS.has(scopeRow))
+            continue;
+        const verdict = judgeMcpEntry(entry, ctx.fs);
+        if (!verdict.board)
+            continue;
+        boardNames.add(entry.name);
+        boardRows.add(scopeRow);
+        flagged ||= verdict.flagged;
+    }
+    if (flagged)
+        failures.push("metadata_only_flag");
+    if (boardNames.size > 1)
+        failures.push(`duplicate_registration:${[...boardRows].sort().join("+")}`);
+    if (harness === "opencode" || harness === "pi") {
+        const wanted = harness === "opencode" ? OPENCODE_PLUGIN_PACKAGE : PI_PACKAGE;
+        const present = files.some((file) => file.contribution.packages.some((spec) => packageIdentity(spec) === wanted));
+        if (!present)
+            failures.push("no_registration");
+    }
+    else if (boardNames.size === 0) {
+        failures.push("no_registration");
+    }
+    let hookCounts;
+    let unjudgeable = false;
+    let policyUnjudgeable = false;
+    let policyCheckFailed = [];
+    if (harness === "claude" && plugins) {
+        // The EFFECTIVE hooks first (round-2 F027/F028): a file whose hooks the policy switches off
+        // contributes none. Dropping a wake hook that way is a failure of its own, never a pass.
+        const policy = plugins.hookPolicy;
+        const isPluginFile = (file) => file.row === CLAUDE_PLUGIN_ROW || file.row === CLAUDE_FOREIGN_PLUGIN_ROW;
+        const runs = (file) => isPluginFile(file)
+            ? policy.plugins === "all" || (policy.plugins === "managed_only" && (policy.unjudgeable || policy.managedPluginIds.has(file.pluginId ?? "")))
+            : policy.settings === "all" || (policy.settings === "managed_only" && file.row === "claude_managed_settings");
+        const namesAWakeHook = (file) => Object.keys(file.contribution.hooks)
+            .some((event) => file.contribution.hooks[event].some((hook) => isCommand(hook) && namesWakeHook(hook.command)));
+        if (files.some((file) => !runs(file) && namesAWakeHook(file)))
+            failures.push("hooks_disabled_by_policy");
+        policyUnjudgeable = policy.unjudgeable || policy.probe.evidence.length > 0;
+        policyCheckFailed = [...new Set(policy.probe.errors)].map((cause) => `managed_policy_check_failed:${cause}`);
+        const hooksOf = (file, event) => runs(file) ? file.contribution.hooks[event] ?? [] : [];
+        const wakeHooks = (event) => files.flatMap((file) => hooksOf(file, event).filter((hook) => isCommand(hook) && namesWakeHook(hook.command)));
+        // A non-command handler on a wake event runs, but doctor cannot tell what it does (panel B2b);
+        // nor can it tell what a settings or foreign wake hook filtered by a matcher fires on (F029).
+        // Ours with a matcher is a stanza mismatch instead.
+        unjudgeable = CLAUDE_REQUIRED_HOOK_EVENTS.some((event) => files.some((file) => hooksOf(file, event)
+            .some((hook) => !isCommand(hook) || (hook.hasMatcher && file.row !== CLAUDE_PLUGIN_ROW && namesWakeHook(hook.command)))));
+        hookCounts = { SessionStart: 0, FileChanged: 0 };
+        for (const event of CLAUDE_REQUIRED_HOOK_EVENTS) {
+            const count = wakeHooks(event).length;
+            hookCounts[event] = count;
+            if (count === 0)
+                failures.push(`missing_hook:${event}`);
+            if (count > 1)
+                failures.push(`duplicate_hook:${event}`);
+        }
+        // Shape B: a FileChanged wake hook wakes an idle session only through asyncRewake.
+        if (CLAUDE_WAKE_SHAPE === "B" && wakeHooks("FileChanged").some((hook) => !hook.asyncRewake))
+            failures.push("hook_not_rewake");
+    }
+    const extras = plugins
+        ? { plugin: { ...plugins.summary, serverActive: boardRows.has(CLAUDE_PLUGIN_ROW) }, hookCounts, managedPolicy: plugins.hookPolicy.probe }
+        : {};
+    // An absence is only evidence when every file was read: the missing entry may be in the file
+    // that did not parse, under the plugin path doctor refused to follow, or a handler doctor
+    // cannot judge. A duplicate or the flag, seen in files that DID parse, stands.
+    const complete = unparseable.length === 0 && !plugins?.untrusted && !unjudgeable && !policyUnjudgeable && policyCheckFailed.length === 0;
+    const standing = complete
+        ? failures
+        : failures.filter((failure) => failure !== "no_registration" && !failure.startsWith("missing_hook:"));
+    if (standing.length > 0)
+        return { status: "fail", reason: standing.join(","), ...extras };
+    const unknowns = [
+        ...(unparseable.length > 0 ? [`unparseable:${[...new Set(unparseable)].join("+")}`] : []),
+        ...(plugins?.untrusted ? ["plugin_path_untrusted"] : []),
+        ...(unjudgeable ? ["unjudgeable_hook"] : []),
+        ...(policyUnjudgeable ? ["hook_policy_unjudgeable"] : []),
+        ...policyCheckFailed,
+    ];
+    if (unknowns.length > 0)
+        return { status: "undetermined", reason: unknowns.join(","), ...extras };
+    return { status: "pass", reason: "registered", ...extras };
+}