@dadado/agent-kit-cli 4.4.5 → 4.5.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { defineCommand as defineCommand11, runMain } from "citty";
+import { defineCommand as defineCommand12, runMain } from "citty";
 
 // src/commands/add.ts
 import { defineCommand } from "citty";
@@ -18,8 +18,11 @@ var DEFAULT_PROTECTED_PATHS = [
   ".cursor/HANDOFF.md",
   ".cursor/plans/**",
   ".cursor/memory/**",
-  ".cursor/context/**"
+  ".cursor/context/config.json",
+  ".cursor/context/current/**",
+  ".cursor/context/backups/**"
 ];
+var LEGACY_CONTEXT_PROTECTED_GLOB = ".cursor/context/**";
 var DOMAIN_PACK_IDS = [
   "cybersec",
   "devops",
@@ -63,12 +66,12 @@ async function listDirectory(rootDir) {
 import path2 from "path";
 function resolveContained(root, rel) {
   const rootAbs = path2.resolve(root);
-  const candidate = path2.resolve(rootAbs, rel);
-  const relToRoot = path2.relative(rootAbs, candidate);
+  const candidate2 = path2.resolve(rootAbs, rel);
+  const relToRoot = path2.relative(rootAbs, candidate2);
   if (relToRoot.startsWith("..") || path2.isAbsolute(relToRoot)) {
     throw new Error(`Path escapes registry/project root: ${rel}`);
   }
-  return candidate;
+  return candidate2;
 }
 function toPosixRel(root, absPath) {
   return path2.relative(root, absPath).split(path2.sep).join("/");
@@ -116,11 +119,32 @@ function matchesAnyGlob(relPath, globs) {
 }
 
 // src/lifecycle/protected.ts
+var CONTEXT_SESSION_GLOBS = [
+  ".cursor/context/config.json",
+  ".cursor/context/current/**",
+  ".cursor/context/backups/**"
+];
+function normalizeProtectedGlobs(globs) {
+  const out = [];
+  let sawLegacyContext = false;
+  for (const raw of globs) {
+    const g = normalizeRelPath(raw);
+    if (g === LEGACY_CONTEXT_PROTECTED_GLOB) {
+      sawLegacyContext = true;
+      continue;
+    }
+    out.push(g);
+  }
+  if (sawLegacyContext) {
+    out.push(...CONTEXT_SESSION_GLOBS);
+  }
+  return [...new Set(out)];
+}
 function resolveProtectedGlobs(manifest) {
   const fromManifest = manifest?.protected ?? [];
   const overrides = (manifest?.overrides ?? []).map((o) => o.path);
   const merged = [...DEFAULT_PROTECTED_PATHS, ...fromManifest, ...overrides];
-  return [...new Set(merged.map(normalizeRelPath))];
+  return normalizeProtectedGlobs(merged);
 }
 function isProtectedPath(relPath, globs) {
   return matchesAnyGlob(relPath, globs);
@@ -128,10 +152,19 @@ function isProtectedPath(relPath, globs) {
 
 // src/lifecycle/apply.ts
 function emptyStats() {
-  return { written: [], skippedProtected: [], missing: [], unchanged: [] };
+  return {
+    written: [],
+    removed: [],
+    collisions: [],
+    skippedProtected: [],
+    missing: [],
+    unchanged: []
+  };
 }
 function mergeStats(into, from) {
   into.written.push(...from.written);
+  into.removed.push(...from.removed);
+  into.collisions.push(...from.collisions);
   into.skippedProtected.push(...from.skippedProtected);
   into.missing.push(...from.missing);
   into.unchanged.push(...from.unchanged);
@@ -192,11 +225,12 @@ function buildManifest(input) {
   const manifest = {
     schemaVersion: 1,
     version: input.version,
-    protected: input.protected ?? [...DEFAULT_PROTECTED_PATHS]
+    protected: normalizeProtectedGlobs(input.protected ?? [...DEFAULT_PROTECTED_PATHS])
   };
   if (input.profile) manifest.profile = input.profile;
   if (input.packs?.length) manifest.packs = [...new Set(input.packs)].sort();
   if (input.skills?.length) manifest.skills = [...new Set(input.skills)].sort();
+  if (input.personalization) manifest.personalization = input.personalization;
   if (input.registryUrl || input.registryRef) {
     manifest.registry = {};
     if (input.registryUrl) manifest.registry.url = input.registryUrl;
@@ -234,6 +268,14 @@ function logApplyStats(stats) {
   if (stats.unchanged.length > 0) {
     logger.info(`Unchanged: ${stats.unchanged.length}`);
   }
+  if (stats.removed.length > 0) {
+    logger.info(`Removed managed legacy files: ${stats.removed.length}`);
+    for (const p of stats.removed) logger.info(`  - ${p}`);
+  }
+  if (stats.collisions.length > 0) {
+    logger.warn("Slash collision preserved because the legacy command is customized:");
+    for (const p of stats.collisions) logger.info(`  ! ${p}`);
+  }
   if (stats.skippedProtected.length > 0) {
     logger.warn(`Skipped protected (L3): ${stats.skippedProtected.length}`);
     for (const p of stats.skippedProtected) logger.info(`  ~ ${p}`);
@@ -370,7 +412,21 @@ var REGISTRY_CLI_ARGS = {
 };
 
 // src/lifecycle/version.ts
-var KIT_VERSION = "3.0.0";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+function loadPackageVersion() {
+  for (const packagePath of ["../package.json", "../../package.json"]) {
+    try {
+      const metadata = require2(packagePath);
+      if (typeof metadata.version === "string" && metadata.version.length > 0) {
+        return metadata.version;
+      }
+    } catch {
+    }
+  }
+  throw new Error("Unable to resolve the Agent Kit CLI package version");
+}
+var KIT_VERSION = loadPackageVersion();
 
 // src/manifest/index.ts
 import path5 from "path";
@@ -494,6 +550,21 @@ function parseAgentKitManifest(raw) {
       }
     }
   }
+  let personalization;
+  if (rest.personalization !== void 0) {
+    if (!isPlainObject(rest.personalization)) {
+      issues.push("personalization must be an object");
+    } else if (typeof rest.personalization.contractVersion !== "number" || typeof rest.personalization.generatorVersion !== "string" || rest.personalization.origin !== "repository-profile" || typeof rest.personalization.resultPath !== "string") {
+      issues.push("personalization must contain a valid origin and version contract");
+    } else {
+      personalization = {
+        contractVersion: rest.personalization.contractVersion,
+        generatorVersion: rest.personalization.generatorVersion,
+        origin: "repository-profile",
+        resultPath: rest.personalization.resultPath
+      };
+    }
+  }
   if (rest.installedAt !== void 0 && typeof rest.installedAt !== "string") {
     issues.push("installedAt must be a string");
   }
@@ -506,6 +577,7 @@ function parseAgentKitManifest(raw) {
     "protected",
     "overrides",
     "registry",
+    "personalization",
     "installedAt"
   ]);
   for (const key of Object.keys(rest)) {
@@ -526,6 +598,7 @@ function parseAgentKitManifest(raw) {
   if (protectedPaths) manifest.protected = protectedPaths;
   if (overrides) manifest.overrides = overrides;
   if (registry) manifest.registry = registry;
+  if (personalization) manifest.personalization = personalization;
   if (typeof rest.installedAt === "string") manifest.installedAt = rest.installedAt;
   return manifest;
 }
@@ -888,6 +961,10 @@ var L0_ARTIFACTS = [
     target: ".cursor/rules/docs-professional-standard.mdc"
   },
   { source: ".cursor/rules/memory-loop.mdc", target: ".cursor/rules/memory-loop.mdc" },
+  {
+    source: ".cursor/rules/hitl-ask-questions.mdc",
+    target: ".cursor/rules/hitl-ask-questions.mdc"
+  },
   {
     source: "registry/rules/git-secrets-safety.mdc",
     target: ".cursor/rules/git-secrets-safety.mdc"
@@ -898,8 +975,8 @@ var L0_ARTIFACTS = [
     target: ".cursor/commands/start-project.md"
   },
   {
-    source: ".cursor/commands/onboard.md",
-    target: ".cursor/commands/onboard.md"
+    source: ".cursor/commands/agent-kit-onboard.md",
+    target: ".cursor/commands/agent-kit-onboard.md"
   },
   {
     source: ".cursor/commands/continue-plan.md",
@@ -925,6 +1002,52 @@ var L0_ARTIFACTS = [
     target: ".cursor/commands/git-staging.md"
   },
   { source: ".cursor/commands/git-prod.md", target: ".cursor/commands/git-prod.md" },
+  {
+    source: ".cursor/commands/plan-external-review.md",
+    target: ".cursor/commands/plan-external-review.md"
+  },
+  {
+    source: ".cursor/commands/plan-review-triage.md",
+    target: ".cursor/commands/plan-review-triage.md"
+  },
+  // Context (templates + example config; private config.json is not L0)
+  {
+    source: ".cursor/context/templates/plan-external-review-prompt.md",
+    target: ".cursor/context/templates/plan-external-review-prompt.md"
+  },
+  {
+    source: ".cursor/context/templates/plan.md",
+    target: ".cursor/context/templates/plan.md"
+  },
+  {
+    source: ".cursor/context/templates/context-pack.md",
+    target: ".cursor/context/templates/context-pack.md"
+  },
+  {
+    source: ".cursor/context/templates/task-brief.md",
+    target: ".cursor/context/templates/task-brief.md"
+  },
+  {
+    source: ".cursor/context/templates/handoff.md",
+    target: ".cursor/context/templates/handoff.md"
+  },
+  {
+    source: ".cursor/context/templates/adr.md",
+    target: ".cursor/context/templates/adr.md"
+  },
+  {
+    source: ".cursor/context/templates/plan-monitor.md",
+    target: ".cursor/context/templates/plan-monitor.md"
+  },
+  {
+    source: ".cursor/context/config.example.json",
+    target: ".cursor/context/config.example.json"
+  },
+  // Scripts (canonical launcher; consumers never receive repo-root scripts/)
+  {
+    source: ".cursor/scripts/plan-external-review.sh",
+    target: ".cursor/scripts/plan-external-review.sh"
+  },
   // Secrets gate (structural)
   {
     source: ".cursor/hooks/pre-commit/check-secrets.sh",
@@ -1366,40 +1489,592 @@ var diffCommand = defineCommand3({
   }
 });
 
-// src/commands/handoff.ts
-import { spawn } from "child_process";
-import { readFile as readFile6, readdir as readdir2, writeFile as writeFile3 } from "fs/promises";
-import path10 from "path";
+// src/commands/doctor.ts
+import path19 from "path";
 import { defineCommand as defineCommand4 } from "citty";
 
+// src/scanner/readiness.ts
+import { createHash as createHash2 } from "crypto";
+function action(id, status, recommendation, owner) {
+  return { id, status, recommendation, owner };
+}
+function check(id, title, status, essential, evidence, actions = []) {
+  return { id, title, status, essential, evidence, actions };
+}
+function pillar(pillarName, checks) {
+  return { pillar: pillarName, checks };
+}
+function repositoryFingerprint(scan) {
+  const fingerprintInput = {
+    purpose: scan.purpose,
+    stack: {
+      language: scan.stack.language,
+      framework: scan.stack.framework,
+      packageManager: scan.stack.packageManager,
+      workspaces: scan.stack.workspaces
+    },
+    git: {
+      mode: scan.git.mode,
+      remoteUrl: scan.git.remoteUrl,
+      currentBranch: scan.git.currentBranch,
+      defaultBranch: scan.git.defaultBranch
+    },
+    context: scan.context.sources,
+    agentKitVersion: scan.agentKit.version
+  };
+  return createHash2("sha256").update(JSON.stringify(fingerprintInput)).digest("hex");
+}
+function buildPillars(scan) {
+  const agentKitStatus = scan.agentKit.installed ? "ready" : "auto_fix";
+  const purposeStatus = scan.purpose.value === "unknown" ? "needs_choice" : "ready";
+  const gitStatus = scan.git.mode === "none" ? "needs_choice" : "ready";
+  const secretsStatus = scan.safety.trackedSensitiveFiles.length > 0 ? "blocked" : scan.safety.missingSecretPatterns.length > 0 ? "auto_fix" : "ready";
+  const contextStatus = scan.context.sources.length > 0 ? "ready" : "needs_choice";
+  const providerStatus = scan.git.mode === "none" ? "needs_choice" : scan.git.mode === "local-only" ? "ready" : scan.git.providerKind === "unknown" || scan.git.providerKind === "custom" && scan.git.providerConfidence === "low" ? "needs_choice" : "ready";
+  return [
+    pillar("workspace", [
+      check(
+        "workspace.agent-kit",
+        "Agent Kit installation",
+        agentKitStatus,
+        true,
+        scan.agentKit.manifestPath ? [{ source: "file", value: scan.agentKit.manifestPath }] : [],
+        agentKitStatus === "ready" ? [] : [action("install-agent-kit", "auto_fix", "Install the managed L0 inventory", "system")]
+      )
+    ]),
+    pillar("purpose-context", [
+      check(
+        "purpose.classification",
+        "Repository purpose",
+        purposeStatus,
+        true,
+        scan.purpose.evidence,
+        purposeStatus === "ready" ? [] : [
+          action(
+            "confirm-repository-purpose",
+            "needs_choice",
+            "Confirm the stable repository purpose",
+            "user"
+          )
+        ]
+      ),
+      check(
+        "context.sources",
+        "Project context sources",
+        contextStatus,
+        true,
+        scan.context.sources,
+        contextStatus === "ready" ? [] : [
+          action(
+            "identify-context-source",
+            "needs_choice",
+            "Identify the repository source of truth",
+            "user"
+          )
+        ]
+      )
+    ]),
+    pillar("source-control", [
+      check(
+        "git.repository",
+        "Git repository",
+        gitStatus,
+        true,
+        scan.git.currentBranch ? [{ source: "git", value: `branch:${scan.git.currentBranch}` }] : [],
+        gitStatus === "ready" ? [] : [
+          action(
+            "choose-source-control",
+            "needs_choice",
+            "Choose whether to initialize Git",
+            "user"
+          )
+        ]
+      ),
+      check(
+        "git.staging-branch",
+        "Staging branch",
+        scan.git.hasLocalStaging || scan.git.hasRemoteStaging ? "ready" : "needs_choice",
+        false,
+        [
+          ...scan.git.hasLocalStaging ? [{ source: "git", value: "local branch:staging" }] : [],
+          ...scan.git.hasRemoteStaging ? [{ source: "git", value: "remote branch:staging" }] : []
+        ],
+        scan.git.hasLocalStaging || scan.git.hasRemoteStaging ? [] : [
+          action(
+            "choose-branch-strategy",
+            "needs_choice",
+            "Confirm the repository promotion strategy",
+            "user"
+          )
+        ]
+      )
+    ]),
+    pillar("safety", [
+      check(
+        "safety.secrets",
+        "Secrets hygiene",
+        secretsStatus,
+        true,
+        [
+          ...scan.safety.ignoredSecretPatterns.map((value) => ({
+            source: "file",
+            value: `.gitignore:${value}`
+          })),
+          ...scan.safety.trackedSensitiveFiles.map((value) => ({
+            source: "git",
+            value: `tracked:${value}`
+          }))
+        ],
+        secretsStatus === "ready" ? [] : secretsStatus === "blocked" ? [
+          action(
+            "remove-tracked-secrets",
+            "blocked",
+            "Remove tracked sensitive files and rotate exposed values",
+            "user"
+          )
+        ] : [
+          action(
+            "merge-secret-ignores",
+            "auto_fix",
+            "Merge required secret patterns into .gitignore",
+            "system"
+          )
+        ]
+      )
+    ]),
+    pillar("stack-tooling", [
+      check(
+        "stack.detected",
+        "Stack and package manager",
+        scan.stack.language !== "unknown" || scan.purpose.value !== "unknown" ? "ready" : "needs_choice",
+        true,
+        scan.stack.packageManagerEvidence ?? scan.purpose.evidence
+      )
+    ]),
+    pillar("quality-ci", [
+      check(
+        "quality.validation",
+        "Tests and validation",
+        scan.quality.hasTests || scan.quality.validationCommands.length > 0 ? "ready" : "manual",
+        false,
+        scan.infra.ciFiles.map((value) => ({ source: "file", value })),
+        scan.quality.hasTests || scan.quality.validationCommands.length > 0 ? [] : [
+          action(
+            "document-validation",
+            "manual",
+            "Document a repeatable repository validation command",
+            "user"
+          )
+        ]
+      )
+    ]),
+    pillar("deploy-infrastructure", [
+      check(
+        "infrastructure.detected",
+        "Deployment and infrastructure evidence",
+        "ready",
+        false,
+        [...scan.infra.infrastructureFiles, ...scan.infra.deploymentFiles].map((value) => ({
+          source: "file",
+          value
+        }))
+      )
+    ]),
+    pillar("collaboration", [
+      check(
+        "collaboration.provider",
+        "Repository provider",
+        providerStatus,
+        false,
+        scan.git.providerEvidence,
+        providerStatus === "ready" ? [] : [
+          action(
+            "confirm-provider",
+            "needs_choice",
+            "Confirm the remote provider or local-only model",
+            "user"
+          )
+        ]
+      )
+    ]),
+    pillar("agent-kit-personalization", [
+      check(
+        "agent-kit.context",
+        "Agent guidance",
+        scan.context.hasAgentGuidance ? "ready" : "auto_fix",
+        false,
+        scan.context.sources.filter((item) => item.value.includes("guidance")),
+        scan.context.hasAgentGuidance ? [] : [
+          action(
+            "prepare-agent-context",
+            "auto_fix",
+            "Prepare Agent Kit-owned context from detected evidence",
+            "system"
+          )
+        ]
+      )
+    ])
+  ];
+}
+function createReadinessReport(scan, options) {
+  const pillars = buildPillars(scan);
+  const checks = pillars.flatMap((item) => item.checks);
+  const statuses = ["ready", "auto_fix", "needs_choice", "manual", "blocked"];
+  const summary = Object.fromEntries(
+    statuses.map((status) => [status, checks.filter((item) => item.status === status).length])
+  );
+  const pendingActions = checks.flatMap((item) => item.actions).filter((item) => item.status !== "ready");
+  const { rootDir: _rootDir, ...portableScan } = scan;
+  return {
+    schemaVersion: 1,
+    generatorVersion: options.generatorVersion,
+    generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    repositoryFingerprint: repositoryFingerprint(scan),
+    summary,
+    scan: portableScan,
+    pillars,
+    appliedSafeFixes: [],
+    pendingActions,
+    deferredChecks: []
+  };
+}
+
+// src/scanner/safe-fixes.ts
+import { readFile as readFile8, writeFile as writeFile3 } from "fs/promises";
+import path17 from "path";
+
+// src/scanner/detect-repository.ts
+import { readFile as readFile6 } from "fs/promises";
+import path10 from "path";
+var CONTEXT_PATHS = [
+  ["README.md", "README"],
+  ["README", "README"],
+  ["AGENTS.md", "agent guidance"],
+  ["CLAUDE.md", "agent guidance"],
+  [".cursor/rules", "Cursor rules"],
+  ["docs/architecture.md", "architecture"],
+  ["docs/adr", "architecture decisions"],
+  ["docs/runbooks", "runbooks"],
+  ["runbooks", "runbooks"],
+  ["prompts", "prompts"],
+  ["schemas", "schemas"],
+  ["sql", "SQL"],
+  ["knowledge", "knowledge base"]
+];
+async function existingEvidence(rootDir, candidates) {
+  const evidence = await Promise.all(
+    candidates.map(
+      async ([relativePath, label]) => await fileExists(path10.join(rootDir, relativePath)) ? { source: "file", value: `${relativePath}:${label}` } : void 0
+    )
+  );
+  return evidence.flatMap((item) => item ? [item] : []);
+}
+async function detectContext(rootDir) {
+  const sources = await existingEvidence(rootDir, CONTEXT_PATHS);
+  const paths = sources.map((item) => item.value.split(":")[0]);
+  return {
+    sources,
+    hasReadme: paths.some((item) => item === "README" || item === "README.md"),
+    hasArchitecture: sources.some((item) => item.value.includes("architecture")),
+    hasRunbooks: sources.some((item) => item.value.includes("runbooks")),
+    hasAgentGuidance: sources.some(
+      (item) => item.value.includes("agent guidance") || item.value.includes("Cursor rules")
+    )
+  };
+}
+async function detectPurpose(rootDir, stack) {
+  const entries = await listDirectory(rootDir);
+  const lowerEntries = entries.map((entry) => entry.toLowerCase());
+  const packageJson = await readJson(path10.join(rootDir, "package.json"));
+  const categories = [];
+  const evidence = [];
+  const add = (category, value2) => {
+    if (!categories.includes(category)) categories.push(category);
+    evidence.push({ source: "file", value: value2 });
+  };
+  if (stack.workspaces) add("monorepo", "workspace configuration");
+  else if (stack.language === "node" && packageJson?.private !== true && (packageJson?.exports !== void 0 || packageJson?.main || packageJson?.types)) {
+    add("library", "package export configuration");
+  } else if (stack.hasProjectFiles) add("application", "application package marker");
+  if (lowerEntries.some((entry) => ["docs", "documentation", "mkdocs.yml"].includes(entry))) {
+    add("documentation", "documentation structure");
+  }
+  if (lowerEntries.some(
+    (entry) => ["knowledge", "content", "wiki", "playbooks", "handbook"].includes(entry)
+  )) {
+    add("knowledge", "knowledge structure");
+  }
+  if (lowerEntries.some(
+    (entry) => ["runbooks", "infra", "terraform", "ansible", "k8s", "kubernetes"].includes(entry)
+  )) {
+    add("operations", "operations structure");
+  }
+  if (lowerEntries.some(
+    (entry) => ["n8n", "workflows", "automations", "prompts", "sql", "schemas"].includes(entry)
+  ) || lowerEntries.some((entry) => entry.endsWith(".sql"))) {
+    add("automation", "automation or data artifact");
+  }
+  const meaningfulCategories = categories.filter((category) => category !== "unknown");
+  const value = meaningfulCategories.length === 0 ? "unknown" : meaningfulCategories.length === 1 ? meaningfulCategories[0] ?? "unknown" : "mixed";
+  return {
+    value,
+    categories: meaningfulCategories.length > 0 ? meaningfulCategories : ["unknown"],
+    confidence: evidence.length > 0 ? "high" : "low",
+    evidence
+  };
+}
+async function detectAgentKit(rootDir) {
+  const manifestRelativePath = ".cursor/agent-kit.json";
+  const manifestPath = path10.join(rootDir, manifestRelativePath);
+  const installed = await fileExists(manifestPath);
+  const manifest = installed ? await readJson(manifestPath) : null;
+  return {
+    installed,
+    manifestPath: installed ? manifestRelativePath : void 0,
+    version: manifest?.version,
+    hasPlans: await fileExists(path10.join(rootDir, ".cursor/plans")),
+    hasHandoff: await fileExists(path10.join(rootDir, ".cursor/HANDOFF.md")),
+    hasMemory: await fileExists(path10.join(rootDir, ".cursor/memory"))
+  };
+}
+var REQUIRED_SECRET_PATTERNS = [
+  ".env",
+  ".env.*",
+  "*.key",
+  "*.pem",
+  "*.p12",
+  "*.pfx",
+  "*credentials*.json",
+  "*service-account*.json"
+];
+async function detectSafety(rootDir, trackedFiles) {
+  const gitignorePath = path10.join(rootDir, ".gitignore");
+  const hasGitignore = await fileExists(gitignorePath);
+  const gitignore = hasGitignore ? await readFile6(gitignorePath, "utf8") : "";
+  const lines = gitignore.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
+  const ignoredSecretPatterns = REQUIRED_SECRET_PATTERNS.filter(
+    (pattern) => lines.includes(pattern)
+  );
+  const trackedSensitiveFiles = trackedFiles.filter(
+    (file) => /(^|\/)(\.env(\..+)?|.*\.(key|pem|p12|pfx)|.*credentials.*\.json)$/i.test(file)
+  );
+  const hookPaths = [".husky", ".git/hooks/pre-commit", "git-hooks/pre-commit"];
+  const hasHooks = (await Promise.all(hookPaths.map((item) => fileExists(path10.join(rootDir, item))))).some(Boolean);
+  const guardCandidates = [
+    ".husky/pre-commit",
+    ".husky/pre-push",
+    "git-hooks/pre-commit",
+    "git-hooks/pre-push"
+  ];
+  const guardContents = await Promise.all(
+    guardCandidates.map(
+      async (item) => await fileExists(path10.join(rootDir, item)) ? readFile6(path10.join(rootDir, item), "utf8") : ""
+    )
+  );
+  return {
+    hasGitignore,
+    ignoredSecretPatterns,
+    missingSecretPatterns: REQUIRED_SECRET_PATTERNS.filter(
+      (pattern) => !ignoredSecretPatterns.includes(pattern)
+    ),
+    trackedSensitiveFiles,
+    hasHooks,
+    hasMainBranchGuard: guardContents.some(
+      (content) => content.includes("main") || content.includes("master")
+    )
+  };
+}
+
+// src/scanner/scan.ts
+import path16 from "path";
+
+// src/scanner/detect-git.ts
+import { execFile as execFile2 } from "child_process";
+import path11 from "path";
+import { promisify as promisify2 } from "util";
+var exec = promisify2(execFile2);
+function remoteHostname(remoteUrl) {
+  const scpMatch = remoteUrl.match(/^[^@]+@([^:]+):/);
+  if (scpMatch?.[1]) return scpMatch[1].toLowerCase();
+  try {
+    return new URL(remoteUrl).hostname.toLowerCase();
+  } catch {
+    return void 0;
+  }
+}
+function sanitizeRemoteUrl(remoteUrl) {
+  try {
+    const parsed = new URL(remoteUrl);
+    parsed.username = "";
+    parsed.password = "";
+    return parsed.toString();
+  } catch {
+    return remoteUrl;
+  }
+}
+async function detectProvider(rootDir, remoteUrl) {
+  const configuration = await readJson(
+    path11.join(rootDir, ".cursor", "agent-kit.config.json")
+  );
+  const configuredProvider = configuration?.git?.provider;
+  if (configuredProvider) {
+    const configuredKind = configuration.git?.providerKind ?? (configuredProvider === "github" ? "github" : configuredProvider === "gitlab" ? remoteUrl && remoteHostname(remoteUrl) === "gitlab.com" ? "gitlab-saas" : "gitlab-self-hosted" : configuredProvider === "other" ? "custom" : "known-other");
+    return {
+      provider: configuredProvider,
+      providerKind: configuredKind,
+      confidence: "high",
+      evidence: [{ source: "configuration", value: ".cursor/agent-kit.config.json#git.provider" }]
+    };
+  }
+  if (!remoteUrl) {
+    return { providerKind: "unknown", confidence: "low", evidence: [] };
+  }
+  const hostname = remoteHostname(remoteUrl);
+  const remoteEvidence = [{ source: "git", value: `remote:${remoteUrl}` }];
+  if (hostname === "github.com") {
+    return {
+      provider: "github",
+      providerKind: "github",
+      confidence: "high",
+      evidence: remoteEvidence
+    };
+  }
+  if (hostname === "gitlab.com") {
+    return {
+      provider: "gitlab",
+      providerKind: "gitlab-saas",
+      confidence: "high",
+      evidence: remoteEvidence
+    };
+  }
+  if (hostname === "bitbucket.org") {
+    return {
+      provider: "bitbucket",
+      providerKind: "known-other",
+      confidence: "high",
+      evidence: remoteEvidence
+    };
+  }
+  if (hostname === "dev.azure.com" || hostname?.endsWith(".visualstudio.com")) {
+    return {
+      provider: "azure-devops",
+      providerKind: "known-other",
+      confidence: "high",
+      evidence: remoteEvidence
+    };
+  }
+  if (hostname === "codeberg.org") {
+    return {
+      provider: "gitea",
+      providerKind: "known-other",
+      confidence: "high",
+      evidence: remoteEvidence
+    };
+  }
+  if (await fileExists(path11.join(rootDir, ".gitlab-ci.yml"))) {
+    return {
+      provider: "gitlab",
+      providerKind: "gitlab-self-hosted",
+      confidence: "medium",
+      evidence: [...remoteEvidence, { source: "file", value: ".gitlab-ci.yml" }]
+    };
+  }
+  return {
+    provider: "other",
+    providerKind: hostname ? "custom" : "unknown",
+    confidence: "low",
+    evidence: remoteEvidence
+  };
+}
+function inferWorkflow(currentBranch) {
+  if (!currentBranch) return "unknown";
+  if (currentBranch === "main" || currentBranch === "master") return "feature-pr";
+  if (currentBranch.includes("develop") || currentBranch.includes("release")) return "gitflow";
+  if (currentBranch.includes("staging") || currentBranch.includes("homolog")) return "homolog-prod";
+  return "feature-pr";
+}
+async function runGit(args, rootDir) {
+  try {
+    const { stdout } = await exec("git", args, { cwd: rootDir });
+    return stdout.trim();
+  } catch {
+    return void 0;
+  }
+}
+async function listTrackedFiles(rootDir) {
+  return (await runGit(["ls-files"], rootDir))?.split("\n").filter(Boolean) ?? [];
+}
+async function detectGit(rootDir) {
+  const isGit = await runGit(["rev-parse", "--is-inside-work-tree"], rootDir) === "true";
+  if (!isGit) {
+    return {
+      providerKind: "unknown",
+      providerConfidence: "low",
+      providerEvidence: [],
+      remotes: [],
+      mode: "none",
+      workflow: "unknown",
+      isDirty: false,
+      hasLocalStaging: false,
+      hasRemoteStaging: false
+    };
+  }
+  const remoteNames = (await runGit(["remote"], rootDir))?.split("\n").filter(Boolean) ?? [];
+  const remotes = (await Promise.all(
+    remoteNames.map(async (name) => {
+      const url = await runGit(["remote", "get-url", name], rootDir);
+      return url ? { name, url: sanitizeRemoteUrl(url) } : void 0;
+    })
+  )).filter((remote) => remote !== void 0);
+  const primary = remotes.find((remote) => remote.name === "origin") ?? remotes[0];
+  const remoteUrl = primary?.url;
+  const [currentBranch, remoteHead, localBranchOutput, remoteBranchOutput, status, provider] = await Promise.all([
+    runGit(["branch", "--show-current"], rootDir),
+    primary ? runGit(["symbolic-ref", "--short", `refs/remotes/${primary.name}/HEAD`], rootDir) : Promise.resolve(void 0),
+    runGit(["for-each-ref", "--format=%(refname:short)", "refs/heads"], rootDir),
+    runGit(["for-each-ref", "--format=%(refname:short)", "refs/remotes"], rootDir),
+    runGit(["status", "--porcelain"], rootDir),
+    detectProvider(rootDir, remoteUrl)
+  ]);
+  const localBranches = localBranchOutput?.split("\n").filter(Boolean);
+  const remoteBranches = remoteBranchOutput?.split("\n").filter(Boolean);
+  const defaultBranch = remoteHead?.split("/").slice(1).join("/") || (localBranches?.includes("main") ? "main" : localBranches?.includes("master") ? "master" : void 0);
+  return {
+    provider: provider.provider,
+    providerKind: provider.providerKind,
+    providerConfidence: provider.confidence,
+    providerEvidence: provider.evidence,
+    remoteUrl,
+    remoteName: primary?.name,
+    remotes,
+    mode: remotes.length > 0 ? "remote-hosted" : "local-only",
+    currentBranch,
+    defaultBranch,
+    isDirty: Boolean(status),
+    hasLocalStaging: localBranches?.includes("staging") ?? false,
+    hasRemoteStaging: remoteBranches?.some(
+      (branch) => branch === "origin/staging" || branch.endsWith("/staging")
+    ) ?? false,
+    workflow: inferWorkflow(currentBranch)
+  };
+}
+
+// src/scanner/detect-ide.ts
+import path12 from "path";
+async function detectIde(rootDir) {
+  const hasCursor = await fileExists(path12.join(rootDir, ".cursor"));
+  const hasVSCode = await fileExists(path12.join(rootDir, ".vscode"));
+  const hasWindsurf = await fileExists(path12.join(rootDir, ".windsurfrules"));
+  if (hasCursor) return { ide: "cursor", plan: "cursor-pro" };
+  if (hasVSCode) return { ide: "vscode", plan: "vscode-pro" };
+  if (hasWindsurf) return { ide: "windsurf", plan: "windsurf" };
+  return { ide: "unknown", plan: "default" };
+}
+
+// src/scanner/detect-infra.ts
+import path13 from "path";
+
 // src/types.ts
-var GIT_PLATFORM_META = {
-  github: {
-    cli: "gh",
-    prTerm: "Pull Request",
-    prCommand: "gh pr create",
-    ciDefault: "github-actions"
-  },
-  gitlab: {
-    cli: "glab",
-    prTerm: "Merge Request",
-    prCommand: "glab mr create",
-    ciDefault: "gitlab-ci"
-  },
-  bitbucket: {
-    cli: "bb",
-    prTerm: "Pull Request",
-    prCommand: "bb pr create",
-    ciDefault: "bitbucket-pipelines"
-  },
-  "azure-devops": {
-    cli: "az repos",
-    prTerm: "Pull Request",
-    prCommand: "az repos pr create",
-    ciDefault: "azure-pipelines"
-  },
-  gitea: { cli: "tea", prTerm: "Pull Request", prCommand: "tea pr create", ciDefault: "none" }
-};
 var CI_PLATFORM_FILES = {
   "github-actions": ".github/workflows",
   "gitlab-ci": ".gitlab-ci.yml",
@@ -1424,48 +2099,625 @@ var PM_TOOL_LABELS = {
   none: "None"
 };
 
-// src/commands/handoff.ts
-function parsePlanFrontmatter(raw) {
-  const match = raw.match(/^---\n([\s\S]*?)\n---/);
-  if (!match?.[1]) return null;
-  const block = match[1];
-  const name = block.match(/^name:\s*(.+)$/m)?.[1]?.trim();
-  const todos = [];
-  const todoBlocks = block.matchAll(/- id:\s*(\S+)\s*\n\s*content:\s*(.+)\n\s*status:\s*(\S+)/g);
-  for (const m of todoBlocks) {
-    if (m[1] && m[2] && m[3]) {
-      todos.push({ id: m[1], content: m[2].replace(/^["']|["']$/g, ""), status: m[3] });
+// src/scanner/detect-infra.ts
+async function detectInfra(rootDir) {
+  const docker = await fileExists(path13.join(rootDir, "Dockerfile")) || await fileExists(path13.join(rootDir, "docker-compose.yml")) || await fileExists(path13.join(rootDir, "docker-compose.yaml"));
+  const kubernetes = await fileExists(path13.join(rootDir, "k8s")) || await fileExists(path13.join(rootDir, "kubernetes"));
+  let ci = "none";
+  const ciFiles = [];
+  for (const [platform, filePath] of Object.entries(CI_PLATFORM_FILES)) {
+    if (await fileExists(path13.join(rootDir, filePath))) {
+      if (ci === "none") ci = platform;
+      ciFiles.push(filePath);
     }
   }
-  return { name, todos };
+  const infrastructureCandidates = [
+    "Dockerfile",
+    "docker-compose.yml",
+    "docker-compose.yaml",
+    "k8s",
+    "kubernetes",
+    "terraform",
+    "infra"
+  ];
+  const deploymentCandidates = [
+    "vercel.json",
+    "netlify.toml",
+    "fly.toml",
+    "render.yaml",
+    "Procfile",
+    "deploy",
+    "scripts/deploy.sh"
+  ];
+  const infrastructureFiles = (await Promise.all(
+    infrastructureCandidates.map(
+      async (file) => await fileExists(path13.join(rootDir, file)) ? file : void 0
+    )
+  )).filter((file) => file !== void 0);
+  const deploymentFiles = (await Promise.all(
+    deploymentCandidates.map(
+      async (file) => await fileExists(path13.join(rootDir, file)) ? file : void 0
+    )
+  )).filter((file) => file !== void 0);
+  return { docker, kubernetes, ci, ciFiles, infrastructureFiles, deploymentFiles };
 }
-async function findActivePlan(plansDir) {
-  if (!await fileExists(plansDir)) return null;
-  const files = (await readdir2(plansDir)).filter((f) => f.endsWith(".plan.md")).sort().reverse();
-  for (const file of files) {
-    const raw = await readFile6(path10.join(plansDir, file), "utf8");
-    const fm = parsePlanFrontmatter(raw);
-    if (fm?.todos?.some((t) => t.status !== "completed" && t.status !== "cancelled")) {
-      return { file, raw };
+
+// src/scanner/detect-services.ts
+import { readFile as readFile7 } from "fs/promises";
+import path14 from "path";
+async function detectProjectManagement(rootDir) {
+  const tools = [];
+  const mcpConfigPaths = [
+    path14.join(rootDir, ".cursor", "mcp.json"),
+    path14.join(rootDir, "mcp.json")
+  ];
+  for (const configPath of mcpConfigPaths) {
+    if (!await fileExists(configPath)) continue;
+    try {
+      const raw = await readFile7(configPath, "utf8");
+      const lower = raw.toLowerCase();
+      if (lower.includes("clickup")) tools.push("clickup");
+      if (lower.includes("jira") || lower.includes("atlassian")) tools.push("jira");
+      if (lower.includes("linear")) tools.push("linear");
+      if (lower.includes("asana")) tools.push("asana");
+      if (lower.includes("youtrack")) tools.push("youtrack");
+      if (lower.includes("shortcut")) tools.push("shortcut");
+    } catch {
     }
   }
-  return files[0] ? { file: files[0], raw: await readFile6(path10.join(plansDir, files[0]), "utf8") } : null;
-}
-function now() {
-  return (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 16);
-}
-async function loadProfile(rootDir) {
-  const configPath = path10.join(rootDir, ".cursor", "agent-kit.config.json");
-  try {
-    return await readJson(configPath);
-  } catch {
-    return null;
+  if (await fileExists(path14.join(rootDir, ".github", "ISSUE_TEMPLATE"))) {
+    tools.push("github-issues");
+  }
+  if (await fileExists(path14.join(rootDir, ".github", "projects"))) {
+    tools.push("github-projects");
   }
+  return [...new Set(tools)];
 }
-function buildRoutines(profile) {
-  const lines = [];
-  const workflow = profile?.git.workflow;
-  if (workflow === "homolog-prod") {
+async function detectServices(rootDir) {
+  const hasPrisma = await fileExists(path14.join(rootDir, "prisma/schema.prisma"));
+  const hasSequelize = await fileExists(path14.join(rootDir, "sequelize"));
+  const hasDrizzle = await fileExists(path14.join(rootDir, "drizzle.config.ts"));
+  const hasKnex = await fileExists(path14.join(rootDir, "knexfile.ts"));
+  const hasTypeorm = await fileExists(path14.join(rootDir, "ormconfig.json"));
+  const database = hasPrisma || hasSequelize || hasDrizzle || hasKnex || hasTypeorm ? "postgresql" : void 0;
+  const orm = hasPrisma ? "prisma" : hasDrizzle ? "drizzle" : hasSequelize ? "sequelize" : hasKnex ? "knex" : hasTypeorm ? "typeorm" : void 0;
+  const projectManagement = await detectProjectManagement(rootDir);
+  return {
+    database,
+    orm,
+    projectManagement: projectManagement.length > 0 ? projectManagement : void 0
+  };
+}
+
+// src/scanner/detect-stack.ts
+import path15 from "path";
+var PROJECT_MARKERS = [
+  "package.json",
+  "requirements.txt",
+  "pyproject.toml",
+  "go.mod",
+  "Gemfile",
+  "pom.xml",
+  "build.gradle",
+  "composer.json",
+  "Cargo.toml",
+  "pnpm-workspace.yaml"
+];
+var LOCKFILES = [
+  ["pnpm-lock.yaml", "pnpm"],
+  ["yarn.lock", "yarn"],
+  ["bun.lockb", "bun"],
+  ["bun.lock", "bun"],
+  ["package-lock.json", "npm"]
+];
+async function detectPackageManager(rootDir, packageJson) {
+  const configured = packageJson.packageManager?.split("@")[0];
+  if (configured && ["npm", "pnpm", "yarn", "bun"].includes(configured)) {
+    return {
+      packageManager: configured,
+      evidence: [{ source: "configuration", value: `package.json#packageManager=${configured}` }]
+    };
+  }
+  for (const [lockfile, packageManager] of LOCKFILES) {
+    if (await fileExists(path15.join(rootDir, lockfile))) {
+      return {
+        packageManager,
+        evidence: [{ source: "file", value: lockfile }]
+      };
+    }
+  }
+  return { evidence: [] };
+}
+function commandsForScripts(scripts, packageManager) {
+  const runner = packageManager ?? "npm";
+  const command = (name) => runner === "npm" ? `npm run ${name}` : `${runner} ${name}`;
+  const testCommands = Object.keys(scripts).filter((name) => name === "test" || name.startsWith("test:")).map(command);
+  const validationCommands = ["lint", "typecheck", "check", "build"].filter((name) => scripts[name]).map(command);
+  return { testCommands, validationCommands };
+}
+async function detectStack(rootDir) {
+  const hasAnyProjectMarker = (await Promise.all(PROJECT_MARKERS.map((item) => fileExists(path15.join(rootDir, item))))).some(Boolean);
+  const hasPackageJson = await fileExists(path15.join(rootDir, "package.json"));
+  if (hasPackageJson) {
+    const packageJson = await readJson(path15.join(rootDir, "package.json")) ?? {};
+    const scripts = packageJson.scripts ?? {};
+    const packageManager = await detectPackageManager(rootDir, packageJson);
+    const commands = commandsForScripts(scripts, packageManager.packageManager);
+    const hasNextConfig = await fileExists(path15.join(rootDir, "next.config.js")) || await fileExists(path15.join(rootDir, "next.config.mjs")) || await fileExists(path15.join(rootDir, "next.config.ts"));
+    const hasNestConfig = await fileExists(path15.join(rootDir, "nest-cli.json"));
+    return {
+      language: "node",
+      framework: hasNextConfig ? "nextjs" : hasNestConfig ? "nestjs" : "node",
+      packageManager: packageManager.packageManager,
+      packageManagerEvidence: packageManager.evidence,
+      scripts,
+      workspaces: packageJson.workspaces !== void 0 || await fileExists(path15.join(rootDir, "pnpm-workspace.yaml")),
+      ...commands,
+      hasProjectFiles: hasAnyProjectMarker
+    };
+  }
+  if (await fileExists(path15.join(rootDir, "pyproject.toml"))) {
+    return {
+      language: "python",
+      framework: "python",
+      workspaces: false,
+      testCommands: [],
+      validationCommands: [],
+      hasProjectFiles: hasAnyProjectMarker
+    };
+  }
+  if (await fileExists(path15.join(rootDir, "go.mod"))) {
+    return {
+      language: "go",
+      framework: "go",
+      workspaces: false,
+      testCommands: ["go test ./..."],
+      validationCommands: [],
+      hasProjectFiles: hasAnyProjectMarker
+    };
+  }
+  if (await fileExists(path15.join(rootDir, "Cargo.toml"))) {
+    return {
+      language: "rust",
+      framework: "rust",
+      workspaces: false,
+      testCommands: ["cargo test"],
+      validationCommands: ["cargo check"],
+      hasProjectFiles: hasAnyProjectMarker
+    };
+  }
+  if (await fileExists(path15.join(rootDir, "composer.json"))) {
+    return {
+      language: "php",
+      framework: "php",
+      workspaces: false,
+      testCommands: [],
+      validationCommands: [],
+      hasProjectFiles: hasAnyProjectMarker
+    };
+  }
+  return {
+    language: "unknown",
+    workspaces: false,
+    testCommands: [],
+    validationCommands: [],
+    hasProjectFiles: hasAnyProjectMarker
+  };
+}
+
+// src/scanner/scan.ts
+var GREENFIELD_SAFE_FILES = /* @__PURE__ */ new Set([
+  ".git",
+  ".gitignore",
+  "LICENSE",
+  "README.md",
+  ".cursor",
+  ".vscode"
+]);
+function isGreenfieldByEntries(entries) {
+  const meaningful = entries.filter((entry) => !GREENFIELD_SAFE_FILES.has(entry));
+  return meaningful.length === 0;
+}
+async function runScanner(rootDir) {
+  const normalizedRoot = path16.resolve(rootDir);
+  const entries = await listDirectory(normalizedRoot);
+  const stack = await detectStack(normalizedRoot);
+  const purpose = await detectPurpose(normalizedRoot, stack);
+  const [git, ide, infra, services, context, agentKit, trackedFiles] = await Promise.all([
+    detectGit(normalizedRoot),
+    detectIde(normalizedRoot),
+    detectInfra(normalizedRoot),
+    detectServices(normalizedRoot),
+    detectContext(normalizedRoot),
+    detectAgentKit(normalizedRoot),
+    listTrackedFiles(normalizedRoot)
+  ]);
+  const safety = await detectSafety(normalizedRoot, trackedFiles);
+  const isGreenfield = isGreenfieldByEntries(entries) && purpose.value === "unknown";
+  return {
+    rootDir: normalizedRoot,
+    isGreenfield,
+    purpose,
+    stack,
+    git,
+    ide,
+    infra,
+    services,
+    context,
+    agentKit,
+    safety,
+    quality: {
+      testCommands: stack.testCommands,
+      validationCommands: stack.validationCommands,
+      ci: infra.ci,
+      hasTests: stack.testCommands.length > 0
+    }
+  };
+}
+
+// src/scanner/safe-fixes.ts
+var PROFILE_RELATIVE_PATH = ".cursor/agent-kit.config.json";
+var CONTEXT_CONFIG_RELATIVE_PATH = ".cursor/context/config.json";
+var ESSENTIAL_DIRECTORIES = [
+  ".cursor",
+  ".cursor/context",
+  ".cursor/context/current",
+  ".cursor/context/backups",
+  ".cursor/plans",
+  ".cursor/memory"
+];
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeMissing(existing, defaults) {
+  if (!isObject(existing) || !isObject(defaults)) return existing ?? defaults;
+  const merged = { ...existing };
+  for (const [key, value] of Object.entries(defaults)) {
+    merged[key] = key in existing ? mergeMissing(existing[key], value) : value;
+  }
+  return merged;
+}
+function jsonEqual(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+function relativeEvidence(relativePath, detail) {
+  return [`${relativePath}: ${detail}`];
+}
+function createProfile(scan, report, generatedAt) {
+  const git = {
+    mode: scan.git.mode,
+    workflow: scan.git.workflow,
+    remotes: scan.git.remotes,
+    remoteUrl: scan.git.remoteUrl,
+    remoteName: scan.git.remoteName,
+    currentBranch: scan.git.currentBranch,
+    defaultBranch: scan.git.defaultBranch,
+    isDirty: scan.git.isDirty,
+    hasLocalStaging: scan.git.hasLocalStaging,
+    hasRemoteStaging: scan.git.hasRemoteStaging
+  };
+  if (scan.git.providerConfidence === "high") {
+    git.provider = scan.git.provider;
+    git.providerKind = scan.git.providerKind;
+    git.providerConfidence = scan.git.providerConfidence;
+    git.providerEvidence = scan.git.providerEvidence;
+  }
+  return {
+    schemaVersion: 1,
+    contractVersion: 1,
+    purpose: scan.purpose,
+    stack: scan.stack,
+    git,
+    infra: scan.infra,
+    services: scan.services,
+    context: scan.context,
+    detection: {
+      generatedAt,
+      repositoryFingerprint: report.repositoryFingerprint,
+      providerConfidence: scan.git.providerConfidence,
+      providerEvidence: scan.git.providerEvidence
+    }
+  };
+}
+function createOnboardingState(report, generatedAt, deferredItems = report.deferredChecks) {
+  const validDeferredCheckIds = new Set(
+    deferredItems.filter((item) => item.reason.trim().length > 0).map((item) => item.checkId)
+  );
+  const unresolvedEssential = report.pillars.flatMap((pillar2) => pillar2.checks).some(
+    (check2) => check2.essential && check2.status !== "ready" && (check2.status === "blocked" || !validDeferredCheckIds.has(check2.id))
+  );
+  return {
+    contractVersion: 1,
+    status: unresolvedEssential ? "in_progress" : "completed",
+    updatedAt: generatedAt,
+    checks: Object.fromEntries(
+      report.pillars.flatMap((pillar2) => pillar2.checks).map((check2) => [
+        check2.id,
+        {
+          status: check2.status,
+          essential: check2.essential,
+          evidence: check2.evidence
+        }
+      ])
+    ),
+    deferredItems
+  };
+}
+function validDeferredItems(value, fallback) {
+  if (!Array.isArray(value)) return fallback;
+  return value.filter(
+    (item) => isObject(item) && typeof item.checkId === "string" && typeof item.reason === "string" && (item.recoveryCommand === void 0 || typeof item.recoveryCommand === "string")
+  );
+}
+function reconcileOnboardingState(report, existingConfig, generatedAt) {
+  const existing = isObject(existingConfig.onboarding) ? existingConfig.onboarding : {};
+  const deferredItems = validDeferredItems(existing.deferredItems, report.deferredChecks);
+  const derived = createOnboardingState(report, generatedAt, deferredItems);
+  const candidate2 = {
+    ...existing,
+    ...derived
+  };
+  const { updatedAt: _candidateUpdatedAt, ...candidateState } = candidate2;
+  const { updatedAt: existingUpdatedAt, ...existingState } = existing;
+  candidate2.updatedAt = jsonEqual(candidateState, existingState) && typeof existingUpdatedAt === "string" ? existingUpdatedAt : generatedAt;
+  return candidate2;
+}
+function preferenceDefaults(onboarding, onboarded) {
+  return {
+    onboarded: onboarded === true,
+    onboarding,
+    externalPlanReview: {
+      enabled: false,
+      backend: "claude",
+      autoRemediate: false,
+      offerOnExhausted: true
+    },
+    autoHandoff: false,
+    workspaceSkin: {
+      default: "autopilot",
+      modes: {
+        "continue-plan": "autopilot",
+        "run-plan": "night-shift",
+        "cli-run-plan": "ghost-runner"
+      }
+    }
+  };
+}
+function mergeSecretIgnores(existing) {
+  const activeLines = new Set(
+    existing.split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"))
+  );
+  const missing = REQUIRED_SECRET_PATTERNS.filter((pattern) => !activeLines.has(pattern));
+  if (missing.length === 0) return existing;
+  const prefix = existing.length === 0 ? "" : existing.endsWith("\n") ? existing : `${existing}
+`;
+  return `${prefix}${missing.join("\n")}
+`;
+}
+function recordChange(changes, id, relativePath, changed, dryRun, evidence) {
+  changes.push({
+    id,
+    path: relativePath,
+    status: changed ? dryRun ? "planned" : "applied" : "skipped",
+    evidence
+  });
+}
+function appliedActions(changes) {
+  return changes.filter((change) => change.status === "applied").map((change) => ({
+    id: change.id,
+    status: "ready",
+    recommendation: `Applied safe local change to ${change.path}`,
+    owner: "system"
+  }));
+}
+async function executeSafeReadinessFixes(rootDir, options) {
+  const dryRun = options.dryRun ?? false;
+  const generatedAt = options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const beforeScan = await runScanner(rootDir);
+  const before = createReadinessReport(beforeScan, {
+    generatorVersion: options.generatorVersion,
+    generatedAt
+  });
+  const changes = [];
+  for (const relativePath of ESSENTIAL_DIRECTORIES) {
+    const absolutePath = path17.join(beforeScan.rootDir, relativePath);
+    const exists = await fileExists(absolutePath);
+    if (!exists && !dryRun) await ensureDir(absolutePath);
+    recordChange(
+      changes,
+      "ensure-agent-kit-directory",
+      relativePath,
+      !exists,
+      dryRun,
+      relativeEvidence(relativePath, exists ? "already exists" : "missing directory")
+    );
+  }
+  const gitignoreRelativePath = ".gitignore";
+  const gitignorePath = path17.join(beforeScan.rootDir, gitignoreRelativePath);
+  const existingGitignore = await fileExists(gitignorePath) ? await readFile8(gitignorePath, "utf8") : "";
+  const mergedGitignore = mergeSecretIgnores(existingGitignore);
+  const gitignoreChanged = mergedGitignore !== existingGitignore;
+  if (gitignoreChanged && !dryRun) await writeFile3(gitignorePath, mergedGitignore, "utf8");
+  recordChange(
+    changes,
+    "merge-secret-ignores",
+    gitignoreRelativePath,
+    gitignoreChanged,
+    dryRun,
+    relativeEvidence(
+      gitignoreRelativePath,
+      gitignoreChanged ? "required secret patterns are missing" : "required patterns are present"
+    )
+  );
+  const profilePath = path17.join(beforeScan.rootDir, PROFILE_RELATIVE_PATH);
+  const existingProfile = await readJson(profilePath) ?? {};
+  const desiredProfile = createProfile(beforeScan, before, generatedAt);
+  const mergedProfile = mergeMissing(existingProfile, desiredProfile);
+  const profileChanged = !jsonEqual(existingProfile, mergedProfile);
+  if (profileChanged && !dryRun) await writeJson(profilePath, mergedProfile);
+  recordChange(
+    changes,
+    "merge-repository-profile",
+    PROFILE_RELATIVE_PATH,
+    profileChanged,
+    dryRun,
+    relativeEvidence(
+      PROFILE_RELATIVE_PATH,
+      profileChanged ? "missing scanner-derived facts" : "existing facts preserved"
+    )
+  );
+  const evidenceScan = dryRun ? beforeScan : await runScanner(beforeScan.rootDir);
+  const evidenceReport = createReadinessReport(evidenceScan, {
+    generatorVersion: options.generatorVersion,
+    generatedAt
+  });
+  const contextConfigPath = path17.join(beforeScan.rootDir, CONTEXT_CONFIG_RELATIVE_PATH);
+  const existingContextConfig = await readJson(contextConfigPath) ?? {};
+  const onboarding = reconcileOnboardingState(evidenceReport, existingContextConfig, generatedAt);
+  const defaults = preferenceDefaults(onboarding, existingContextConfig.onboarded);
+  const mergedContextConfig = mergeMissing(existingContextConfig, defaults);
+  mergedContextConfig.onboarding = onboarding;
+  const contextConfigChanged = !jsonEqual(existingContextConfig, mergedContextConfig);
+  if (contextConfigChanged && !dryRun) await writeJson(contextConfigPath, mergedContextConfig);
+  recordChange(
+    changes,
+    "merge-onboarding-state",
+    CONTEXT_CONFIG_RELATIVE_PATH,
+    contextConfigChanged,
+    dryRun,
+    relativeEvidence(
+      CONTEXT_CONFIG_RELATIVE_PATH,
+      contextConfigChanged ? "missing preferences or onboarding state" : "state already merged"
+    )
+  );
+  const afterScan = dryRun ? beforeScan : await runScanner(beforeScan.rootDir);
+  const after = createReadinessReport(afterScan, {
+    generatorVersion: options.generatorVersion,
+    generatedAt
+  });
+  after.appliedSafeFixes = appliedActions(changes);
+  return { dryRun, changes, before, after };
+}
+
+// src/scanner/snapshot.ts
+import path18 from "path";
+var READINESS_SNAPSHOT_RELATIVE_PATH = ".cursor/context/readiness.json";
+async function writeReadinessSnapshot(rootDir, report) {
+  const snapshotPath = path18.join(rootDir, READINESS_SNAPSHOT_RELATIVE_PATH);
+  await writeJson(snapshotPath, report);
+  return snapshotPath;
+}
+
+// src/commands/doctor.ts
+async function runDoctor(cwd, options = {}) {
+  const rootDir = path19.resolve(cwd);
+  if (options.fixSafe) {
+    const execution = await executeSafeReadinessFixes(rootDir, {
+      generatorVersion: KIT_VERSION,
+      generatedAt: options.generatedAt
+    });
+    await writeReadinessSnapshot(rootDir, execution.after);
+    return { report: execution.after, safeChanges: execution.changes };
+  }
+  const scan = await runScanner(rootDir);
+  const report = createReadinessReport(scan, {
+    generatorVersion: KIT_VERSION,
+    generatedAt: options.generatedAt
+  });
+  await writeReadinessSnapshot(rootDir, report);
+  return { report, safeChanges: [] };
+}
+function printDoctorSummary(result) {
+  const { summary, pendingActions } = result.report;
+  const fixed = result.safeChanges.filter((change) => change.status === "applied").length;
+  const nextAction = pendingActions[0];
+  console.log("Repository readiness");
+  console.log(
+    `  ready: ${summary.ready}, choices: ${summary.needs_choice}, manual: ${summary.manual}, blocked: ${summary.blocked}`
+  );
+  console.log(`  safe fixes applied: ${fixed}`);
+  console.log(`  pending actions: ${pendingActions.length}`);
+  console.log(
+    nextAction ? `Next: ${nextAction.recommendation}` : "Next: repository readiness checks are complete"
+  );
+}
+var doctorCommand = defineCommand4({
+  meta: {
+    name: "doctor",
+    description: "Diagnose repository readiness and optionally apply safe local fixes."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      default: process.cwd()
+    },
+    json: {
+      type: "boolean",
+      description: "Print deterministic machine-readable JSON without status messages",
+      default: false
+    },
+    "fix-safe": {
+      type: "boolean",
+      description: "Apply only local, reversible, merge-safe readiness fixes",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const result = await runDoctor(args.cwd, { fixSafe: args["fix-safe"] });
+    if (args.json) {
+      console.log(JSON.stringify(result, null, 2));
+      return;
+    }
+    printDoctorSummary(result);
+  }
+});
+
+// src/commands/handoff.ts
+import { spawn } from "child_process";
+import { readFile as readFile9, readdir as readdir2, writeFile as writeFile4 } from "fs/promises";
+import path20 from "path";
+import { defineCommand as defineCommand5 } from "citty";
+function parsePlanFrontmatter(raw) {
+  const match = raw.match(/^---\n([\s\S]*?)\n---/);
+  if (!match?.[1]) return null;
+  const block = match[1];
+  const name = block.match(/^name:\s*(.+)$/m)?.[1]?.trim();
+  const todos = [];
+  const todoBlocks = block.matchAll(/- id:\s*(\S+)\s*\n\s*content:\s*(.+)\n\s*status:\s*(\S+)/g);
+  for (const m of todoBlocks) {
+    if (m[1] && m[2] && m[3]) {
+      todos.push({ id: m[1], content: m[2].replace(/^["']|["']$/g, ""), status: m[3] });
+    }
+  }
+  return { name, todos };
+}
+async function findActivePlan(plansDir) {
+  if (!await fileExists(plansDir)) return null;
+  const files = (await readdir2(plansDir)).filter((f) => f.endsWith(".plan.md")).sort().reverse();
+  for (const file of files) {
+    const raw = await readFile9(path20.join(plansDir, file), "utf8");
+    const fm = parsePlanFrontmatter(raw);
+    if (fm?.todos?.some((t) => t.status !== "completed" && t.status !== "cancelled")) {
+      return { file, raw };
+    }
+  }
+  return files[0] ? { file: files[0], raw: await readFile9(path20.join(plansDir, files[0]), "utf8") } : null;
+}
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 16);
+}
+async function loadProfile(rootDir) {
+  const configPath = path20.join(rootDir, ".cursor", "agent-kit.config.json");
+  try {
+    return await readJson(configPath);
+  } catch {
+    return null;
+  }
+}
+function buildRoutines(profile) {
+  const lines = [];
+  const workflow = profile?.git.workflow;
+  if (workflow === "homolog-prod") {
     lines.push("- [ ] `git staging` - move changes to staging");
     lines.push("- [ ] `git prod` - promote to production (after approval)");
   } else {
@@ -1541,7 +2793,7 @@ function runCursorHandoff(scriptPath, cwd) {
     child.on("close", (code) => resolve(code ?? 1));
   });
 }
-var handoffCommand = defineCommand4({
+var handoffCommand = defineCommand5({
   meta: {
     name: "handoff",
     description: "Write .cursor/HANDOFF.md from the active Cursor plan, or run ./cursor-handoff handoff when no plan exists."
@@ -1555,15 +2807,15 @@ var handoffCommand = defineCommand4({
   },
   async run({ args }) {
     const profile = await loadProfile(args.cwd);
-    const plansDir = path10.join(args.cwd, ".cursor", "plans");
-    const handoffPath = path10.join(args.cwd, ".cursor", "HANDOFF.md");
+    const plansDir = path20.join(args.cwd, ".cursor", "plans");
+    const handoffPath = path20.join(args.cwd, ".cursor", "HANDOFF.md");
     const plan = await findActivePlan(plansDir);
     if (plan) {
       const fm = parsePlanFrontmatter(plan.raw);
       if (fm) {
-        await ensureDir(path10.join(args.cwd, ".cursor"));
+        await ensureDir(path20.join(args.cwd, ".cursor"));
         const content = buildHandoff(plan.file, fm, profile);
-        await writeFile3(handoffPath, content, "utf8");
+        await writeFile4(handoffPath, content, "utf8");
         logger.success("HANDOFF.md updated: .cursor/HANDOFF.md");
         logger.info(
           `Plan: ${plan.file} (${fm.todos?.filter((t) => t.status === "completed").length}/${fm.todos?.length} completed)`
@@ -1581,7 +2833,7 @@ var handoffCommand = defineCommand4({
       }
       logger.warn(`Plan ${plan.file} without valid frontmatter; trying legacy flow.`);
     }
-    const scriptPath = path10.join(args.cwd, "cursor-handoff");
+    const scriptPath = path20.join(args.cwd, "cursor-handoff");
     if (!await fileExists(scriptPath)) {
       printV3Guidance();
       return;
@@ -1606,868 +2858,320 @@ var handoffCommand = defineCommand4({
 });
 
 // src/commands/init.ts
-import path23 from "path";
 import { intro, outro } from "@clack/prompts";
-import { defineCommand as defineCommand5 } from "citty";
-
-// src/generator/index.ts
-import { writeFile as writeFile9 } from "fs/promises";
-import path16 from "path";
+import { defineCommand as defineCommand7 } from "citty";
 
-// src/generator/agents-md.ts
-import { writeFile as writeFile4 } from "fs/promises";
-import path11 from "path";
+// src/commands/install.ts
+import path23 from "path";
+import { defineCommand as defineCommand6 } from "citty";
 
-// src/generator/platform.ts
-function gitProviderLabel(profile) {
-  const p = profile.git.provider;
-  if (!p || p === "other") return "Git";
-  const labels = {
-    github: "GitHub",
-    gitlab: "GitLab",
-    bitbucket: "Bitbucket",
-    "azure-devops": "Azure DevOps",
-    gitea: "Gitea"
-  };
-  return labels[p] ?? "Git";
-}
-function gitCliTool(profile) {
-  const p = profile.git.provider;
-  if (!p || p === "other") return "git";
-  return GIT_PLATFORM_META[p]?.cli ?? "git";
-}
-function prTerminology(profile) {
-  const p = profile.git.provider;
-  if (!p || p === "other") return "PR/MR";
-  return GIT_PLATFORM_META[p]?.prTerm ?? "PR/MR";
-}
-function pmToolsList(profile) {
-  const tools = profile.services.projectManagement;
-  if (!tools || tools.length === 0) return "";
-  return tools.map((t) => PM_TOOL_LABELS[t]).join(", ");
-}
-function pmRoutineLine(profile) {
-  const label = pmToolsList(profile);
-  if (!label) return "";
-  return `- Update tasks in ${label} (if applicable)`;
-}
-function ciLabel(profile) {
-  const labels = {
-    "github-actions": "GitHub Actions",
-    "gitlab-ci": "GitLab CI",
-    "azure-pipelines": "Azure Pipelines",
-    "bitbucket-pipelines": "Bitbucket Pipelines",
-    jenkins: "Jenkins",
-    circleci: "CircleCI",
-    travis: "Travis CI"
-  };
-  return labels[profile.infra.ci] ?? "";
-}
-function devopsFlowSummary(profile) {
-  const parts = [];
-  const provider = gitProviderLabel(profile);
-  parts.push(`Git: ${provider}`);
-  if (profile.git.workflow !== "unknown") {
-    const workflowLabels = {
-      "trunk-based": "trunk-based",
-      "feature-pr": `feature branch \u2192 ${prTerminology(profile)} \u2192 main`,
-      gitflow: "gitflow (develop/release/main)",
-      "homolog-prod": "staging \u2192 production"
-    };
-    parts.push(`Workflow: ${workflowLabels[profile.git.workflow] ?? profile.git.workflow}`);
-  }
-  const ci = ciLabel(profile);
-  if (ci) parts.push(`CI/CD: ${ci}`);
-  const pm = pmToolsList(profile);
-  if (pm) parts.push(`Project mgmt: ${pm}`);
-  return parts.join(" | ");
-}
-
-// src/generator/agents-md.ts
-async function generateAgentsMd(profile) {
-  const target = path11.join(profile.rootDir, "AGENTS.md");
-  const flow = devopsFlowSummary(profile);
-  const prTerm = prTerminology(profile);
-  const content = `# AGENTS.md
-
-Project configured with Agent Kit v3.
-
-## Detected context
-- Stack: ${profile.stack.language}${profile.stack.framework ? ` (${profile.stack.framework})` : ""}
-- IDE: ${profile.ide.ide} (${profile.ide.plan})
-- ${flow}
-
-## Guidelines
-1. Prefer small, verifiable changes.
-2. Adapt response depth to user's IDE plan/model.
-3. Use /worktree for experiments, /best-of-n for critical decisions (Cursor 3.0).
-4. Security review before merge.
-5. Always create a ${prTerm} \u2014 never push directly to main.
-`;
-  await writeFile4(target, content, "utf8");
+// src/generator/personalization.ts
+import { readFile as readFile10, writeFile as writeFile5 } from "fs/promises";
+import path21 from "path";
+var PERSONALIZATION_CONTRACT_VERSION = 1;
+var CONTEXT_PATH = ".cursor/project-context.md";
+var AGENTS_PATH = "AGENTS.md";
+var RESULT_PATH = ".cursor/context/personalization.json";
+function uniqueEvidence(evidence) {
+  const seen = /* @__PURE__ */ new Set();
+  return evidence.filter((item) => {
+    const key = `${item.source}:${item.value}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
 }
-
-// src/generator/cursor.ts
-import { writeFile as writeFile5 } from "fs/promises";
-import path12 from "path";
-function buildGitWorkflowRule(profile) {
-  const prTerm = prTerminology(profile);
-  const cli = gitCliTool(profile);
-  const provider = gitProviderLabel(profile);
-  const pm = pmToolsList(profile);
-  const lines = [
-    "# Git Workflow",
-    `- Platform: ${provider} | CLI: \`${cli}\``,
-    "- Use Conventional Commits (feat:, fix:, docs:, refactor:, chore:, perf:, test:).",
-    "- For risky changes, prefer /worktree (isolated git worktree).",
-    "- For comparing approaches, use /best-of-n."
-  ];
-  if (profile.git.workflow === "homolog-prod") {
-    lines.push(
-      "- Flow: development \u2192 staging \u2192 production.",
-      `- Create ${prTerm} targeting the staging branch; merge to main only via promotion.`,
-      "- NEVER commit directly to main."
-    );
-  } else if (profile.git.workflow === "feature-pr") {
-    lines.push(
-      `- Flow: feature branch \u2192 ${prTerm} \u2192 main.`,
-      `- Always create a ${prTerm} for review before merging.`
-    );
-  } else if (profile.git.workflow === "gitflow") {
-    lines.push(
-      "- Flow: feature \u2192 develop \u2192 release \u2192 main.",
-      `- Create ${prTerm} targeting develop for features, main for releases.`
-    );
-  }
-  if (pm) {
-    lines.push(`- After merge: update task status in ${pm} if integration is available.`);
-  }
-  return `${lines.join("\n")}
-`;
+function purposeEvidence(profile) {
+  if (profile.purpose.confidence === "low") return [];
+  return profile.purpose.evidence;
 }
-function buildHandoffRule(profile) {
-  const pm = pmRoutineLine(profile);
-  const routines = ["- Suggest routines: git commit/push, review CHANGELOG."];
-  if (pm) routines.push(`${pm}.`);
-  return `# Handoff \u2014 State in File
-- After completing each task: save .cursor/HANDOFF.md with progress and next steps.
-- Update to-dos in the plan (.cursor/plans/) when completing or starting a task.
-- One HANDOFF per project \u2014 source of truth for continuity.
-${routines.join("\n")}
-- To resume: /continue-plan in a new conversation.
-- Native features (summaries, /resume, transcripts, Agents Window) complement \u2014 not replace.
-- Context at ~60%: save handoff and suggest new conversation.
-`;
+function contextEvidence(profile, pattern) {
+  return profile.context.sources.filter((item) => pattern.test(item.value));
 }
-function cursorRulesByPlan(profile) {
-  if (profile.ide.plan === "cursor-free") {
-    return [
-      {
-        filename: "01-core.mdc",
-        content: `# Core Rule
-- Respond directly and concisely.
-- Focus on small changes and local validation.
-- Size each task for ~50% of context window.
-`
-      },
-      {
-        filename: "02-handoff.mdc",
-        content: buildHandoffRule(profile)
-      }
-    ];
-  }
-  return [
-    {
-      filename: "01-core.mdc",
-      content: `# Core Rule
-- Execute tasks end-to-end whenever possible.
-- Prioritize security, tests, and architectural consistency.
-- Size each task for ~50% of context window.
-`
-    },
-    {
-      filename: "02-git-workflow.mdc",
-      content: buildGitWorkflowRule(profile)
-    },
-    {
-      filename: "03-handoff.mdc",
-      content: buildHandoffRule(profile)
-    },
-    {
-      filename: "04-ide-guide.mdc",
-      content: `# Cursor Guide
-- Use Agents Window for parallelism \u2014 each agent reads HANDOFF before acting.
-- Use Await for long-running processes.
-- Transcripts and @mentions for cross-reference.
-- /worktree for risky changes.
-- /best-of-n to compare approaches.
-`
-    }
-  ];
+function readinessEvidence(report, checkId) {
+  return report.pillars.flatMap((pillar2) => pillar2.checks).filter((check2) => check2.id === checkId).flatMap((check2) => check2.evidence);
 }
-async function generateCursorArtifacts(profile) {
-  const rulesDir = path12.join(profile.rootDir, ".cursor", "rules");
-  const skillsDir = path12.join(profile.rootDir, ".cursor", "skills", "core");
-  const agentsDir = path12.join(profile.rootDir, ".cursor", "agents");
-  const commandsDir = path12.join(profile.rootDir, ".cursor", "commands");
-  await Promise.all([
-    ensureDir(rulesDir),
-    ensureDir(skillsDir),
-    ensureDir(agentsDir),
-    ensureDir(commandsDir)
-  ]);
-  const rules = cursorRulesByPlan(profile);
-  await Promise.all(
-    rules.map((rule) => writeFile5(path12.join(rulesDir, rule.filename), rule.content, "utf8"))
-  );
-  const includeAgents = profile.ide.plan !== "cursor-free";
-  if (includeAgents) {
-    await writeFile5(
-      path12.join(agentsDir, "security-reviewer.md"),
-      "# Security Reviewer\n\nFocus on auth, PII, secrets, injection, and logging.\n",
-      "utf8"
-    );
-  }
-  const ci = ciLabel(profile);
-  const provider = gitProviderLabel(profile);
-  const statusLines = [
-    "# /agent-kit-status",
-    "",
-    "Show current profile and active components.",
-    "",
-    "## DevOps Flow",
-    `- Git: ${provider} (${profile.git.workflow})`
-  ];
-  if (ci) statusLines.push(`- CI/CD: ${ci}`);
-  const pm = pmToolsList(profile);
-  if (pm) statusLines.push(`- Project management: ${pm}`);
-  statusLines.push("");
-  await writeFile5(
-    path12.join(commandsDir, "agent-kit-status.md"),
-    `${statusLines.join("\n")}
-`,
-    "utf8"
+function hasPurpose(profile, purposes) {
+  return purposes.some(
+    (purpose) => profile.purpose.value === purpose || profile.purpose.categories.includes(purpose)
   );
 }
-
-// src/generator/git-hooks.ts
-import { chmod, writeFile as writeFile6 } from "fs/promises";
-import path13 from "path";
-async function generateGitHooks(profile) {
-  if (!profile.installHooks) return;
-  const hooksDir = path13.join(profile.rootDir, ".git", "hooks");
-  await ensureDir(hooksDir);
-  const preCommitPath = path13.join(hooksDir, "pre-commit");
-  const preCommit = `#!/usr/bin/env bash
-set -euo pipefail
-
-if command -v rg >/dev/null 2>&1; then
-  rg -n --hidden --glob '!node_modules/**' '(AKIA|BEGIN PRIVATE KEY|xoxb-)' . && {
-    echo "Potential secret detected. Commit blocked."
-    exit 1
-  } || true
-fi
-`;
-  await writeFile6(preCommitPath, preCommit, "utf8");
-  await chmod(preCommitPath, 493);
+function candidate(kind, id, evidence, status) {
+  const verified = uniqueEvidence(evidence);
+  return verified.length > 0 ? { kind, id, status, evidence: verified } : null;
 }
-
-// src/generator/vscode.ts
-import { writeFile as writeFile7 } from "fs/promises";
-import path14 from "path";
-async function generateVSCodeArtifacts(profile) {
-  const vscodeDir = path14.join(profile.rootDir, ".vscode");
-  const githubDir = path14.join(profile.rootDir, ".github");
-  await Promise.all([ensureDir(vscodeDir), ensureDir(githubDir)]);
-  await writeFile7(
-    path14.join(vscodeDir, "settings.json"),
-    `${JSON.stringify(
-      {
-        "editor.formatOnSave": true,
-        "editor.codeActionsOnSave": {
-          "source.fixAll": "explicit"
-        },
-        "files.autoSave": "afterDelay"
-      },
-      null,
-      2
-    )}
-`,
-    "utf8"
-  );
-  const provider = gitProviderLabel(profile);
-  const prTerm = prTerminology(profile);
-  await writeFile7(
-    path14.join(githubDir, "copilot-instructions.md"),
-    `# Copilot Instructions
-
-- Keep code changes small and testable.
-- Use Conventional Commits (feat:, fix:, docs:, etc.).
-- Prefer security-safe defaults.
-- Git platform: ${provider}. Always create a ${prTerm} for review.
-`,
-    "utf8"
-  );
-  if (profile.ide.plan === "vscode-pro") {
-    await writeFile7(
-      path14.join(vscodeDir, "security-review.agent.md"),
-      "# Security Review Agent\n\nSpecialized mode for security review.\n",
-      "utf8"
+function componentAvailable(index, item) {
+  if (item.kind === "skill") return allSkills(index).some((entry) => entry.id === item.id);
+  if (item.kind === "pack") return allPacks(index).some((entry) => entry.id === item.id);
+  if (item.kind === "agent" || item.kind === "command") {
+    return (index.artifacts ?? []).some(
+      (entry) => entry.kind === item.kind && entry.id === item.id
     );
   }
-}
-
-// src/generator/windsurf.ts
-import { writeFile as writeFile8 } from "fs/promises";
-import path15 from "path";
-async function generateWindsurfArtifacts(profile) {
-  const provider = gitProviderLabel(profile);
-  const prTerm = prTerminology(profile);
-  const content = `# Windsurf Rules
-- Keep instructions concise and objective.
-- Prefer small diffs and explicit validation.
-- Apply security review before merge.
-- Use Conventional Commits (feat:, fix:, docs:, etc.).
-- Git: ${provider}. Create a ${prTerm} for every change.
-`;
-  await writeFile8(path15.join(profile.rootDir, ".windsurfrules"), content, "utf8");
-}
-
-// src/generator/index.ts
-async function generateFromProfile(profile) {
-  await generateAgentsMd(profile);
-  await generateGitHooks(profile);
-  if (profile.ide.ide === "cursor" || profile.ide.plan.startsWith("cursor")) {
-    await generateCursorArtifacts(profile);
-  }
-  if (profile.ide.ide === "vscode" || profile.ide.plan.startsWith("vscode")) {
-    await generateVSCodeArtifacts(profile);
-  }
-  if (profile.ide.ide === "windsurf" || profile.ide.plan === "windsurf") {
-    await generateWindsurfArtifacts(profile);
-  }
-  if (profile.ide.plan === "default") {
-    await Promise.all([
-      generateCursorArtifacts(profile),
-      generateVSCodeArtifacts(profile),
-      generateWindsurfArtifacts(profile)
-    ]);
-  }
-  const pluginDir = path16.join(profile.rootDir, ".cursor-plugin");
-  await ensureDir(pluginDir);
-  await writeFile9(
-    path16.join(pluginDir, "plugin.json"),
-    `${JSON.stringify(
-      {
-        name: "agent-kit",
-        displayName: "Agent Kit",
-        author: "agent-kit-startup",
-        description: "Bootstrap de ambiente dev com IA (Cursor, VS Code, Windsurf)",
-        keywords: ["agents", "context", "automation", "multi-ide"],
-        license: "MIT",
-        version: "3.0.0"
-      },
-      null,
-      2
-    )}
-`,
-    "utf8"
-  );
-}
-
-// src/scanner/scan.ts
-import path22 from "path";
-
-// src/scanner/detect-git.ts
-import { execFile as execFile2 } from "child_process";
-import path17 from "path";
-import { promisify as promisify2 } from "util";
-var exec = promisify2(execFile2);
-function detectProvider(remoteUrl) {
-  if (!remoteUrl) return void 0;
-  if (remoteUrl.includes("github")) return "github";
-  if (remoteUrl.includes("gitlab")) return "gitlab";
-  if (remoteUrl.includes("bitbucket")) return "bitbucket";
-  if (remoteUrl.includes("dev.azure.com") || remoteUrl.includes("visualstudio.com"))
-    return "azure-devops";
-  if (remoteUrl.includes("gitea") || remoteUrl.includes("codeberg")) return "gitea";
-  return "other";
-}
-function inferWorkflow(currentBranch) {
-  if (!currentBranch) return "unknown";
-  if (currentBranch === "main" || currentBranch === "master") return "feature-pr";
-  if (currentBranch.includes("develop") || currentBranch.includes("release")) return "gitflow";
-  if (currentBranch.includes("staging") || currentBranch.includes("homolog")) return "homolog-prod";
-  return "feature-pr";
-}
-async function runGit(args, rootDir) {
-  try {
-    const { stdout } = await exec("git", args, { cwd: rootDir });
-    return stdout.trim();
-  } catch {
-    return void 0;
-  }
-}
-async function detectGit(rootDir) {
-  const hasGit = await fileExists(path17.join(rootDir, ".git"));
-  if (!hasGit) return { workflow: "unknown" };
-  const remoteUrl = await runGit(["remote", "get-url", "origin"], rootDir);
-  const currentBranch = await runGit(["branch", "--show-current"], rootDir);
-  return {
-    provider: detectProvider(remoteUrl),
-    remoteUrl,
-    currentBranch,
-    workflow: inferWorkflow(currentBranch)
-  };
-}
-
-// src/scanner/detect-ide.ts
-import path18 from "path";
-async function detectIde(rootDir) {
-  const hasCursor = await fileExists(path18.join(rootDir, ".cursor"));
-  const hasVSCode = await fileExists(path18.join(rootDir, ".vscode"));
-  const hasWindsurf = await fileExists(path18.join(rootDir, ".windsurfrules"));
-  if (hasCursor) return { ide: "cursor", plan: "cursor-pro" };
-  if (hasVSCode) return { ide: "vscode", plan: "vscode-pro" };
-  if (hasWindsurf) return { ide: "windsurf", plan: "windsurf" };
-  return { ide: "unknown", plan: "default" };
-}
-
-// src/scanner/detect-infra.ts
-import path19 from "path";
-async function detectInfra(rootDir) {
-  const docker = await fileExists(path19.join(rootDir, "Dockerfile")) || await fileExists(path19.join(rootDir, "docker-compose.yml")) || await fileExists(path19.join(rootDir, "docker-compose.yaml"));
-  const kubernetes = await fileExists(path19.join(rootDir, "k8s")) || await fileExists(path19.join(rootDir, "kubernetes"));
-  let ci = "none";
-  for (const [platform, filePath] of Object.entries(CI_PLATFORM_FILES)) {
-    if (await fileExists(path19.join(rootDir, filePath))) {
-      ci = platform;
-      break;
-    }
-  }
-  return { docker, kubernetes, ci };
-}
-
-// src/scanner/detect-services.ts
-import { readFile as readFile7 } from "fs/promises";
-import path20 from "path";
-async function detectProjectManagement(rootDir) {
-  const tools = [];
-  const mcpConfigPaths = [
-    path20.join(rootDir, ".cursor", "mcp.json"),
-    path20.join(rootDir, "mcp.json")
+  return true;
+}
+function buildPersonalizationPlan(profile, report, registry) {
+  const items = [];
+  const purpose = purposeEvidence(profile);
+  const packageEvidence = profile.stack.packageManagerEvidence ?? [];
+  const n8nEvidence = [
+    ...contextEvidence(profile, /(^|[/.-])n8n([/.-]|$)/i),
+    ...purpose.filter((item) => /n8n/i.test(item.value))
   ];
-  for (const configPath of mcpConfigPaths) {
-    if (!await fileExists(configPath)) continue;
-    try {
-      const raw = await readFile7(configPath, "utf8");
-      const lower = raw.toLowerCase();
-      if (lower.includes("clickup")) tools.push("clickup");
-      if (lower.includes("jira") || lower.includes("atlassian")) tools.push("jira");
-      if (lower.includes("linear")) tools.push("linear");
-      if (lower.includes("asana")) tools.push("asana");
-      if (lower.includes("youtrack")) tools.push("youtrack");
-      if (lower.includes("shortcut")) tools.push("shortcut");
-    } catch {
-    }
-  }
-  if (await fileExists(path20.join(rootDir, ".github", "ISSUE_TEMPLATE"))) {
-    tools.push("github-issues");
+  const sqlEvidence = [
+    ...contextEvidence(profile, /(^|[/.-])(sql|schema|migration)([/.-]|$)/i),
+    ...purpose.filter((item) => /\bsql\b/i.test(item.value))
+  ];
+  const promptEvidence = contextEvidence(profile, /(^|[/.-])prompts?([/.-]|$)/i);
+  const ciEvidence = profile.infra.ciFiles.map((value) => ({ source: "file", value }));
+  const infraEvidence = [
+    ...ciEvidence,
+    ...profile.infra.infrastructureFiles.map((value) => ({ source: "file", value })),
+    ...profile.infra.deploymentFiles.map((value) => ({ source: "file", value }))
+  ];
+  if (hasPurpose(profile, ["documentation", "knowledge"])) {
+    items.push(candidate("skill", "docs-repo", purpose, "applied"));
   }
-  if (await fileExists(path20.join(rootDir, ".github", "projects"))) {
-    tools.push("github-projects");
+  if (profile.stack.language.toLowerCase() === "node" && packageEvidence.length > 0) {
+    items.push(candidate("skill", "cursor-skills-node", packageEvidence, "applied"));
   }
-  return [...new Set(tools)];
-}
-async function detectServices(rootDir) {
-  const hasPrisma = await fileExists(path20.join(rootDir, "prisma/schema.prisma"));
-  const hasSequelize = await fileExists(path20.join(rootDir, "sequelize"));
-  const hasDrizzle = await fileExists(path20.join(rootDir, "drizzle.config.ts"));
-  const hasKnex = await fileExists(path20.join(rootDir, "knexfile.ts"));
-  const hasTypeorm = await fileExists(path20.join(rootDir, "ormconfig.json"));
-  const database = hasPrisma || hasSequelize || hasDrizzle || hasKnex || hasTypeorm ? "postgresql" : void 0;
-  const orm = hasPrisma ? "prisma" : hasDrizzle ? "drizzle" : hasSequelize ? "sequelize" : hasKnex ? "knex" : hasTypeorm ? "typeorm" : void 0;
-  const projectManagement = await detectProjectManagement(rootDir);
-  return {
-    database,
-    orm,
-    projectManagement: projectManagement.length > 0 ? projectManagement : void 0
-  };
-}
-
-// src/scanner/detect-stack.ts
-import path21 from "path";
-var PROJECT_MARKERS = [
-  "package.json",
-  "requirements.txt",
-  "pyproject.toml",
-  "go.mod",
-  "Gemfile",
-  "pom.xml",
-  "build.gradle",
-  "composer.json",
-  "Cargo.toml"
-];
-async function detectStack(rootDir) {
-  const hasAnyProjectMarker = (await Promise.all(PROJECT_MARKERS.map((item) => fileExists(path21.join(rootDir, item))))).some(Boolean);
-  const hasPackageJson = await fileExists(path21.join(rootDir, "package.json"));
-  if (hasPackageJson) {
-    const hasNextConfig = await fileExists(path21.join(rootDir, "next.config.js")) || await fileExists(path21.join(rootDir, "next.config.mjs")) || await fileExists(path21.join(rootDir, "next.config.ts"));
-    const hasNestConfig = await fileExists(path21.join(rootDir, "nest-cli.json"));
-    return {
-      language: "node",
-      framework: hasNextConfig ? "nextjs" : hasNestConfig ? "nestjs" : "node",
-      packageManager: "pnpm",
-      hasProjectFiles: hasAnyProjectMarker
-    };
+  if (n8nEvidence.length > 0) {
+    items.push(candidate("skill", "n8n-workflows", n8nEvidence, "applied"));
+  } else if (hasPurpose(profile, ["automation"])) {
+    items.push(candidate("skill", "n8n-workflows", purpose, "recommended-confirmation"));
   }
-  if (await fileExists(path21.join(rootDir, "pyproject.toml"))) {
-    return { language: "python", framework: "python", hasProjectFiles: hasAnyProjectMarker };
+  if (sqlEvidence.length > 0) {
+    items.push(candidate("skill", "sql-postgres", sqlEvidence, "applied"));
+  } else if (profile.services.database?.toLowerCase().includes("postgres")) {
+    items.push(
+      candidate(
+        "skill",
+        "sql-postgres",
+        [{ source: "configuration", value: `database:${profile.services.database}` }],
+        "recommended-confirmation"
+      )
+    );
   }
-  if (await fileExists(path21.join(rootDir, "go.mod"))) {
-    return { language: "go", framework: "go", hasProjectFiles: hasAnyProjectMarker };
+  if (promptEvidence.length > 0) {
+    items.push(candidate("skill", "prompts-markdown", promptEvidence, "applied"));
   }
-  if (await fileExists(path21.join(rootDir, "Cargo.toml"))) {
-    return { language: "rust", framework: "rust", hasProjectFiles: hasAnyProjectMarker };
+  if (infraEvidence.length > 0) {
+    items.push(candidate("pack", "devops", infraEvidence, "applied"));
   }
-  if (await fileExists(path21.join(rootDir, "composer.json"))) {
-    return { language: "php", framework: "php", hasProjectFiles: hasAnyProjectMarker };
+  if (profile.stack.testCommands.length > 0 && packageEvidence.length > 0) {
+    items.push(candidate("pack", "quality", packageEvidence, "applied"));
+    items.push(candidate("agent", "test-suites", packageEvidence, "applied"));
   }
-  return { language: "unknown", hasProjectFiles: hasAnyProjectMarker };
-}
-
-// src/scanner/scan.ts
-var GREENFIELD_SAFE_FILES = /* @__PURE__ */ new Set([
-  ".git",
-  ".gitignore",
-  "LICENSE",
-  "README.md",
-  ".cursor",
-  ".vscode"
-]);
-function isGreenfieldByEntries(entries) {
-  const meaningful = entries.filter((entry) => !GREENFIELD_SAFE_FILES.has(entry));
-  return meaningful.length === 0;
-}
-async function runScanner(rootDir) {
-  const normalizedRoot = path22.resolve(rootDir);
-  const entries = await listDirectory(normalizedRoot);
-  const stack = await detectStack(normalizedRoot);
-  const isGreenfield = isGreenfieldByEntries(entries) || !stack.hasProjectFiles;
-  return {
-    rootDir: normalizedRoot,
-    isGreenfield,
-    stack,
-    git: await detectGit(normalizedRoot),
-    ide: await detectIde(normalizedRoot),
-    infra: await detectInfra(normalizedRoot),
-    services: await detectServices(normalizedRoot)
-  };
-}
-
-// src/utils/prompts.ts
-import { cancel, confirm, isCancel, multiselect, select, text } from "@clack/prompts";
-var WORKSPACE_SKIN_MODE_DEFAULTS = {
-  default: "autopilot",
-  modes: {
-    "continue-plan": "autopilot",
-    "run-plan": "night-shift",
-    "cli-run-plan": "ghost-runner"
+  const pmTools = (profile.services.projectManagement ?? []).filter((tool) => tool !== "none");
+  if (pmTools.length > 0) {
+    items.push(
+      candidate(
+        "pack",
+        "project-management",
+        pmTools.map((tool) => ({ source: "configuration", value: `projectManagement:${tool}` })),
+        "recommended-confirmation"
+      )
+    );
   }
-};
-function workspaceSkinConfigFromChoice(choice) {
-  if (choice.kind === "skip") return null;
-  if (choice.kind === "mode-defaults")
-    return { ...WORKSPACE_SKIN_MODE_DEFAULTS, modes: { ...WORKSPACE_SKIN_MODE_DEFAULTS.modes } };
-  return {
-    default: choice.id,
-    modes: {
-      "continue-plan": choice.id,
-      "run-plan": choice.id,
-      "cli-run-plan": choice.id
-    }
-  };
-}
-function ensureNotCancelled(value) {
-  if (isCancel(value)) {
-    cancel("Operation cancelled.");
-    process.exit(0);
-  }
-  return value;
-}
-async function askIdeAndPlan(current) {
-  const ide = ensureNotCancelled(
-    await select({
-      message: "Which is your main IDE?",
-      initialValue: current.ide === "unknown" ? void 0 : current.ide,
-      options: [
-        { label: "Cursor", value: "cursor" },
-        { label: "VS Code", value: "vscode" },
-        { label: "Windsurf", value: "windsurf" },
-        { label: "Other", value: "other" }
-      ]
-    })
-  );
-  const plan = ensureNotCancelled(
-    await select({
-      message: "What's your IDE plan?",
-      initialValue: current.plan === "default" ? void 0 : current.plan,
-      options: [
-        { label: "Cursor Free", value: "cursor-free" },
-        { label: "Cursor Pro / Business", value: "cursor-pro" },
-        { label: "VS Code + Copilot Free", value: "vscode-free" },
-        { label: "VS Code + Copilot Pro / Business", value: "vscode-pro" },
-        { label: "Windsurf", value: "windsurf" },
-        { label: "Don't know / default", value: "default" }
-      ]
-    })
-  );
-  return { ide, plan };
-}
-async function askGitWorkflow(current) {
-  return ensureNotCancelled(
-    await select({
-      message: "What's your Git workflow?",
-      initialValue: current === "unknown" ? void 0 : current,
-      options: [
-        { label: "trunk-based (direct to main)", value: "trunk-based" },
-        { label: "feature branch -> PR/MR -> main", value: "feature-pr" },
-        { label: "gitflow (develop/release/main)", value: "gitflow" },
-        { label: "staging -> production (staging -> main)", value: "homolog-prod" }
-      ]
-    })
+  const safetyEvidence = readinessEvidence(report, "safety.secrets").filter(
+    (item) => item.value.startsWith("tracked:")
   );
-}
-async function askProjectManagement(existing = []) {
-  return ensureNotCancelled(
-    await multiselect({
-      message: "Do you use any project management system?",
-      initialValues: existing,
-      options: [
-        { label: "GitHub Issues / Projects", value: "github-issues" },
-        { label: "Jira", value: "jira" },
-        { label: "Linear", value: "linear" },
-        { label: "ClickUp", value: "clickup" },
-        { label: "Azure Boards", value: "azure-boards" },
-        { label: "Asana", value: "asana" },
-        { label: "Trello", value: "trello" },
-        { label: "Shortcut", value: "shortcut" },
-        { label: "Notion", value: "notion" },
-        { label: "YouTrack", value: "youtrack" }
-      ],
-      required: false
-    })
+  if (safetyEvidence.length > 0) {
+    items.push(candidate("pack", "cybersec", safetyEvidence, "recommended-confirmation"));
+  }
+  items.push(
+    candidate(
+      "command",
+      "start-project",
+      readinessEvidence(report, "agent-kit.context"),
+      "applied"
+    )
   );
+  const availableItems = items.filter((item) => item !== null);
+  return availableItems.map(
+    (item) => componentAvailable(registry, item) ? item : { ...item, status: "unavailable" }
+  ).sort((left, right) => `${left.kind}:${left.id}`.localeCompare(`${right.kind}:${right.id}`));
+}
+function renderProjectContext(profile) {
+  const sections = ["# Project Context", "", "Verified repository facts:"];
+  const purpose = purposeEvidence(profile);
+  if (purpose.length > 0 && profile.purpose.value !== "unknown") {
+    sections.push(`- Purpose: ${profile.purpose.value}.`);
+  }
+  const packageEvidence = profile.stack.packageManagerEvidence ?? [];
+  if (packageEvidence.length > 0) {
+    sections.push(`- Runtime family: ${profile.stack.language}.`);
+    if (profile.stack.packageManager) {
+      sections.push(`- Package manager: ${profile.stack.packageManager}.`);
+    }
+  }
+  if (profile.git.provider && (profile.git.providerEvidence?.length ?? 0) > 0) {
+    sections.push(`- Git provider: ${profile.git.provider}.`);
+  }
+  if (profile.infra.ci !== "none" && profile.infra.ciFiles.length > 0) {
+    sections.push(`- CI: ${profile.infra.ci}.`);
+  }
+  if (profile.context.sources.length > 0) {
+    sections.push("", "## Sources", ...profile.context.sources.map((item) => `- ${item.value}`));
+  }
+  return `${sections.join("\n")}
+`;
 }
-async function askWorkspaceSkin() {
-  const value = ensureNotCancelled(
-    await select({
-      message: "Workspace skin for chat/CLI chrome? (optional)",
-      initialValue: "mode-defaults",
-      options: [
-        {
-          label: "Keep mode defaults (Autopilot/Night Shift/Ghost Runner per mode)",
-          value: "mode-defaults"
-        },
-        { label: "Autopilot", value: "autopilot" },
-        { label: "Night Shift", value: "night-shift" },
-        { label: "Ghost Runner", value: "ghost-runner" },
-        { label: "Skip for now", value: "skip" }
-      ]
-    })
-  );
-  if (value === "skip") return { kind: "skip" };
-  if (value === "mode-defaults") return { kind: "mode-defaults" };
-  return { kind: "skin", id: value };
-}
-async function runExistingProjectWizard(scan) {
-  const ide = await askIdeAndPlan(scan.ide);
-  const workflow = await askGitWorkflow(scan.git.workflow);
-  const projectManagement = await askProjectManagement(scan.services.projectManagement ?? []);
-  const installHooks = ensureNotCancelled(
-    await confirm({
-      message: "Install git hooks? (pre-commit: secrets + lint)",
-      initialValue: true
-    })
-  );
-  const workspaceSkinChoice = await askWorkspaceSkin();
+async function createOwnedFile(rootDir, relativePath, content, evidence) {
+  const target = path21.join(rootDir, relativePath);
+  if (await fileExists(target)) {
+    return {
+      kind: "file",
+      id: relativePath,
+      path: relativePath,
+      status: "skipped-customized",
+      evidence
+    };
+  }
+  await ensureDir(path21.dirname(target));
+  await writeFile5(target, content, "utf8");
   return {
-    rootDir: scan.rootDir,
-    stack: scan.stack,
-    git: { ...scan.git, workflow },
-    ide,
-    infra: scan.infra,
-    services: {
-      ...scan.services,
-      projectManagement: projectManagement.length > 0 ? projectManagement : void 0
-    },
-    installHooks,
-    selectedCoreComponents: [
-      "git-workflow",
-      "security-review",
-      "clean-code",
-      "docs-repo",
-      "ide-guide"
-    ],
-    workspaceSkinChoice
+    kind: "file",
+    id: relativePath,
+    path: relativePath,
+    status: "applied",
+    evidence
   };
 }
-async function runGreenfieldWizard(scan) {
-  const language = ensureNotCancelled(
-    await select({
-      message: "What will be the main stack?",
-      options: [
-        { label: "Node.js (JavaScript/TypeScript)", value: "node" },
-        { label: "Python", value: "python" },
-        { label: "Go", value: "go" },
-        { label: "Ruby", value: "ruby" },
-        { label: "Java / Kotlin", value: "java" },
-        { label: "PHP", value: "php" },
-        { label: "Rust", value: "rust" },
-        { label: "C# / .NET", value: "dotnet" },
-        { label: "Other", value: "other" }
-      ]
-    })
-  );
-  const framework = ensureNotCancelled(
-    await text({
-      message: "Main framework? (ex: nextjs, nestjs, django, rails, spring, none)",
-      placeholder: "none",
-      initialValue: "none",
-      validate(value) {
-        return value.trim().length === 0 ? "Enter a framework or 'none'" : void 0;
-      }
-    })
-  );
-  const database = ensureNotCancelled(
-    await select({
-      message: "Will you use a database?",
-      options: [
-        { label: "PostgreSQL", value: "postgresql" },
-        { label: "MySQL", value: "mysql" },
-        { label: "MongoDB", value: "mongodb" },
-        { label: "SQLite", value: "sqlite" },
-        { label: "SQL Server", value: "sqlserver" },
-        { label: "None for now", value: "none" }
-      ]
-    })
-  );
-  const orm = ensureNotCancelled(
-    await text({
-      message: "ORM / query builder?",
-      placeholder: "prisma, drizzle, sequelize, typeorm, none",
-      initialValue: "none"
-    })
-  );
-  const ide = await askIdeAndPlan(scan.ide);
-  const workflow = await askGitWorkflow(scan.git.workflow);
-  const projectManagement = await askProjectManagement();
-  const installHooks = ensureNotCancelled(
-    await confirm({
-      message: "Install git hooks? (pre-commit: secrets + lint)",
-      initialValue: true
-    })
-  );
-  const workspaceSkinChoice = await askWorkspaceSkin();
-  return {
-    rootDir: scan.rootDir,
-    stack: {
-      language,
-      framework: framework === "none" ? void 0 : framework,
-      hasProjectFiles: false
-    },
-    git: {
-      ...scan.git,
-      workflow
-    },
-    ide,
-    infra: scan.infra,
-    services: {
-      database: database === "none" ? void 0 : database,
-      orm: orm === "none" ? void 0 : orm,
-      projectManagement: projectManagement.length > 0 ? projectManagement : void 0
-    },
-    installHooks,
-    selectedCoreComponents: [
-      "git-workflow",
-      "security-review",
-      "clean-code",
-      "docs-repo",
-      "ide-guide"
-    ],
-    workspaceSkinChoice
-  };
+async function packTargets(registryRoot, packId) {
+  const manifest = await loadPackManifest(registryRoot, packId);
+  return manifest.members.map((member) => packMemberTargets(member).targetRel);
 }
-
-// src/commands/init.ts
-async function mergeWorkspaceSkinConfig(rootDir, workspaceSkin) {
-  const contextDir = path23.join(rootDir, ".cursor", "context");
-  const configPath = path23.join(contextDir, "config.json");
-  await ensureDir(contextDir);
-  const existing = await readJson(configPath) ?? {};
-  await writeJson(configPath, { ...existing, workspaceSkin });
-  return configPath;
-}
-var initCommand = defineCommand5({
-  meta: {
-    name: "init",
-    description: "Run scanner + wizard + generation setup."
-  },
-  args: {
-    cwd: {
-      type: "string",
-      description: "Project root directory",
-      default: process.cwd()
+async function existingTargets(projectRoot, targets) {
+  const checks = await Promise.all(
+    targets.map(
+      async (target) => await fileExists(path21.join(projectRoot, target)) ? target : null
+    )
+  );
+  return checks.filter((target) => target !== null);
+}
+async function applyPersonalization(input) {
+  const planned = buildPersonalizationPlan(input.profile, input.report, input.registry);
+  const componentResults = [];
+  const protectedPaths = new Set(input.manifest.protected ?? []);
+  const packs = new Set(input.manifest.packs ?? []);
+  const skills = new Set(input.manifest.skills ?? []);
+  for (const item of planned) {
+    if (item.status !== "applied") {
+      componentResults.push(item);
+      continue;
     }
-  },
-  async run({ args }) {
-    intro("agent-kit v3.0.0");
-    const scan = await runScanner(args.cwd);
-    logger.info(`Root: ${scan.rootDir}`);
-    logger.info(
-      scan.isGreenfield ? "Empty repo detected (greenfield)." : "Existing project detected."
-    );
-    const profile = scan.isGreenfield ? await runGreenfieldWizard(scan) : await runExistingProjectWizard(scan);
-    const { workspaceSkinChoice, ...profileToSave } = profile;
-    const configPath = path23.join(scan.rootDir, ".cursor", "agent-kit.config.json");
-    await writeJson(configPath, profileToSave);
-    logger.success(`Profile saved in ${configPath}`);
-    const skinConfig = workspaceSkinChoice !== void 0 ? workspaceSkinConfigFromChoice(workspaceSkinChoice) : null;
-    if (skinConfig) {
-      const contextConfigPath = await mergeWorkspaceSkinConfig(scan.rootDir, skinConfig);
-      logger.success(`Workspace skin saved in ${contextConfigPath}`);
-    }
-    await generateFromProfile(profile);
-    try {
-      const registry = await resolveRegistryRoot({ cwd: scan.rootDir });
-      const stats = await installSkillsByIds(
-        registry.root,
-        scan.rootDir,
-        profile.selectedCoreComponents
+    if (item.kind === "skill") {
+      const skill = allSkills(input.registry).find((entry) => entry.id === item.id);
+      if (!skill) {
+        componentResults.push({ ...item, status: "unavailable" });
+        continue;
+      }
+      const target = path21.posix.join(
+        ".cursor",
+        "skills",
+        skill.path.includes("/core/") ? "core" : "community",
+        skill.id,
+        "SKILL.md"
       );
-      if (stats.written.length > 0) {
-        logger.success(`Skills installed: ${stats.written.join(", ")}`);
-      } else if (stats.missing.length > 0) {
-        logger.warn(`Skills not found in registry: ${stats.missing.join(", ")}`);
-      } else {
-        logger.info("No new skills to copy (already installed or empty selection).");
+      if (await fileExists(path21.join(input.rootDir, target))) {
+        componentResults.push({ ...item, status: "skipped-customized", path: target });
+        protectedPaths.add(target);
+        continue;
       }
-    } catch {
-      logger.info(
-        "Registry unavailable in this directory: use agent-kit install / agent-kit add <id> with --registry or remote cache."
+      await installSkill(input.registryRoot, input.rootDir, skill);
+      skills.add(item.id);
+      protectedPaths.add(target);
+      componentResults.push({ ...item, path: target });
+      continue;
+    }
+    if (item.kind === "pack") {
+      const targets = await packTargets(input.registryRoot, item.id);
+      const customizedTargets = await existingTargets(input.rootDir, targets);
+      await installPack(input.registryRoot, input.rootDir, item.id, {
+        protectedGlobs: customizedTargets
+      });
+      for (const target of targets) protectedPaths.add(target);
+      packs.add(item.id);
+      componentResults.push(
+        customizedTargets.length > 0 ? { ...item, status: "skipped-customized" } : item
       );
+      continue;
     }
-    console.log("\nNext:");
-    console.log(`  Open this folder in Cursor: ${scan.rootDir}`);
-    console.log("  Run /onboard in chat; then /start-project when you have a goal");
-    console.log("  Optional: agent-kit status");
-    outro("Setup completed.");
+    componentResults.push(item);
   }
-});
+  const profileEvidence = uniqueEvidence([
+    ...purposeEvidence(input.profile),
+    ...input.profile.stack.packageManagerEvidence ?? [],
+    ...input.profile.git.providerEvidence ?? [],
+    ...input.profile.context.sources
+  ]);
+  const fileResults = await Promise.all([
+    createOwnedFile(
+      input.rootDir,
+      CONTEXT_PATH,
+      renderProjectContext(input.profile),
+      profileEvidence
+    ),
+    createOwnedFile(
+      input.rootDir,
+      AGENTS_PATH,
+      "# Repository Agent Guidance\n\nUse `.cursor/project-context.md` for verified repository facts. Preserve existing project-owned guidance and request confirmation before adding optional integrations.\n",
+      profileEvidence
+    )
+  ]);
+  protectedPaths.add(CONTEXT_PATH);
+  protectedPaths.add(AGENTS_PATH);
+  const result = {
+    contractVersion: PERSONALIZATION_CONTRACT_VERSION,
+    generatorVersion: input.generatorVersion,
+    repositoryFingerprint: input.report.repositoryFingerprint,
+    items: [...fileResults, ...componentResults],
+    protectedPaths: [...protectedPaths].sort()
+  };
+  await writeJson(path21.join(input.rootDir, RESULT_PATH), result);
+  return {
+    result,
+    manifest: {
+      ...input.manifest,
+      packs: [...packs].sort(),
+      skills: [...skills].sort(),
+      protected: result.protectedPaths,
+      personalization: {
+        contractVersion: PERSONALIZATION_CONTRACT_VERSION,
+        generatorVersion: input.generatorVersion,
+        origin: "repository-profile",
+        resultPath: RESULT_PATH
+      }
+    }
+  };
+}
+async function readRepositoryProfile(rootDir) {
+  const target = path21.join(rootDir, ".cursor/agent-kit.config.json");
+  if (!await fileExists(target)) return null;
+  return JSON.parse(await readFile10(target, "utf8"));
+}
 
-// src/commands/install.ts
-import path24 from "path";
-import { defineCommand as defineCommand6 } from "citty";
+// src/lifecycle/onboard-migration.ts
+import { createHash as createHash3 } from "crypto";
+import { readFile as readFile11, unlink } from "fs/promises";
+import path22 from "path";
+var LEGACY_ONBOARD_PATH = ".cursor/commands/onboard.md";
+var NAMESPACED_ONBOARD_PATH = ".cursor/commands/agent-kit-onboard.md";
+var MANAGED_LEGACY_HASHES = /* @__PURE__ */ new Set([
+  "b274a68941813f19b185893cb7c5561dff027f53270890029992f208e24992fe"
+]);
+async function migrateLegacyOnboardCommand(projectRoot, managedHashes = MANAGED_LEGACY_HASHES) {
+  const legacyPath = path22.join(projectRoot, LEGACY_ONBOARD_PATH);
+  if (!await fileExists(legacyPath)) return "absent";
+  const namespacedPath = path22.join(projectRoot, NAMESPACED_ONBOARD_PATH);
+  if (!await fileExists(namespacedPath)) return "preserved-customized";
+  const content = await readFile11(legacyPath);
+  const hash = createHash3("sha256").update(content).digest("hex");
+  if (!managedHashes.has(hash)) return "preserved-customized";
+  await unlink(legacyPath);
+  return "removed-managed";
+}
 
 // src/lifecycle/sync.ts
 async function installL0(registryRoot, projectRoot, protectedGlobs) {
@@ -2482,6 +3186,12 @@ async function installL0(registryRoot, projectRoot, protectedGlobs) {
     );
     recordOutcome(stats, artifact.target, outcome);
   }
+  const migration = await migrateLegacyOnboardCommand(projectRoot);
+  if (migration === "removed-managed") {
+    stats.removed.push(".cursor/commands/onboard.md");
+  } else if (migration === "preserved-customized") {
+    stats.collisions.push(".cursor/commands/onboard.md");
+  }
   return stats;
 }
 async function syncFromManifest(registryRoot, projectRoot, manifest) {
@@ -2511,11 +3221,73 @@ function parsePackList(raw) {
     )
   ];
 }
-function printInstallNextSteps(projectRoot) {
-  console.log("\nNext:");
-  console.log(`  Open this folder in Cursor: ${projectRoot}`);
-  console.log("  Run /onboard in chat; then /start-project when you have a goal");
-  console.log("  Optional: agent-kit status");
+function printReadinessNarrative(result) {
+  const { summary, pendingActions } = result.readiness;
+  const fixed = result.safeChanges.filter((change) => change.status === "applied").length;
+  console.log("\nRepository readiness");
+  console.log(
+    `  ready: ${summary.ready}, choices: ${summary.needs_choice}, manual: ${summary.manual}, blocked: ${summary.blocked}`
+  );
+  console.log(`  safe fixes applied: ${fixed}`);
+  console.log(`  pending actions: ${pendingActions.length}`);
+  console.log(
+    pendingActions.length > 0 ? "Next: run /agent-kit-onboard in Cursor to resolve the first pending action" : "Next: run /start-project in Cursor when you have a deliverable"
+  );
+}
+async function performInstall(options) {
+  const projectRoot = path23.resolve(options.cwd);
+  const packs = parsePackList(options.pack);
+  const existing = await loadAgentKitManifest(projectRoot);
+  const registry = await resolveRegistryFromCli({
+    cwd: projectRoot,
+    registry: options.registry,
+    url: options.url,
+    ref: options.ref,
+    refresh: options.refresh,
+    manifest: existing
+  });
+  const draft = buildManifest({
+    version: KIT_VERSION,
+    profile: options.profile ?? existing?.profile ?? "default",
+    packs: packs.length > 0 ? packs : existing?.packs,
+    skills: existing?.skills,
+    protected: existing?.protected,
+    personalization: existing?.personalization,
+    registryUrl: registry.url ?? existing?.registry?.url,
+    registryRef: registry.ref ?? existing?.registry?.ref
+  });
+  const stats = (draft.packs?.length ?? 0) > 0 || (draft.skills?.length ?? 0) > 0 ? await syncFromManifest(registry.root, projectRoot, draft) : await installL0(registry.root, projectRoot, resolveProtectedGlobs(draft));
+  const manifestPath = await saveManifest(projectRoot, draft);
+  const readinessExecution = await executeSafeReadinessFixes(projectRoot, {
+    generatorVersion: KIT_VERSION
+  });
+  let readiness = readinessExecution.after;
+  const profile = await readRepositoryProfile(projectRoot);
+  if (profile) {
+    const registryIndex = await loadRegistry(registry.root);
+    const personalization = await applyPersonalization({
+      rootDir: projectRoot,
+      registryRoot: registry.root,
+      profile,
+      report: readinessExecution.after,
+      registry: registryIndex,
+      manifest: draft,
+      generatorVersion: KIT_VERSION
+    });
+    await saveManifest(projectRoot, personalization.manifest);
+    readiness = createReadinessReport(await runScanner(projectRoot), {
+      generatorVersion: KIT_VERSION
+    });
+    readiness.appliedSafeFixes = readinessExecution.after.appliedSafeFixes;
+  }
+  await writeReadinessSnapshot(projectRoot, readiness);
+  return {
+    projectRoot,
+    manifestPath,
+    stats,
+    readiness,
+    safeChanges: readinessExecution.changes
+  };
 }
 var installCommand = defineCommand6({
   meta: {
@@ -2539,50 +3311,61 @@ var installCommand = defineCommand6({
     ...REGISTRY_CLI_ARGS
   },
   async run({ args }) {
-    const projectRoot = path24.resolve(args.cwd);
+    const projectRoot = path23.resolve(args.cwd);
     logger.info(`Installing into: ${projectRoot}`);
     const packs = parsePackList(args.pack);
     for (const id of packs) {
       if (!DOMAIN_PACK_IDS.includes(id)) {
-        logger.warn(`Pack '${id}' is not in the known L1 list \u2014 will still try registry.`);
+        logger.warn(`Pack '${id}' is not in the known L1 list; will still try registry.`);
       }
     }
-    const existing = await loadAgentKitManifest(projectRoot);
-    const registry = await resolveRegistryFromCli({
+    const result = await performInstall({
       cwd: projectRoot,
+      profile: args.profile,
+      pack: args.pack,
       registry: args.registry,
       url: args.url,
       ref: args.ref,
-      refresh: args.refresh,
-      manifest: existing
-    });
-    logger.info(`Registry: ${registry.root} (${registry.source})`);
-    const draft = buildManifest({
-      version: KIT_VERSION,
-      profile: args.profile ?? existing?.profile ?? "default",
-      packs: packs.length > 0 ? packs : existing?.packs,
-      skills: existing?.skills,
-      protected: existing?.protected,
-      registryUrl: registry.url ?? existing?.registry?.url,
-      registryRef: registry.ref ?? existing?.registry?.ref
+      refresh: args.refresh
     });
-    let stats;
-    if ((draft.packs?.length ?? 0) > 0 || (draft.skills?.length ?? 0) > 0) {
-      stats = await syncFromManifest(registry.root, projectRoot, draft);
-    } else {
-      const protectedGlobs = resolveProtectedGlobs(draft);
-      stats = await installL0(registry.root, projectRoot, protectedGlobs);
+    logApplyStats(result.stats);
+    logger.success(`Manifest written: ${result.manifestPath}`);
+    logger.success("Readiness snapshot written: .cursor/context/readiness.json");
+    printReadinessNarrative(result);
+  }
+});
+
+// src/commands/init.ts
+async function runInitCompatibility(cwd, installer = performInstall) {
+  return installer({ cwd });
+}
+var initCommand = defineCommand7({
+  meta: {
+    name: "init",
+    description: "Guided compatibility entry point for install and repository readiness."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      description: "Project root directory",
+      default: process.cwd()
     }
-    const manifestPath = await saveManifest(projectRoot, draft);
-    logApplyStats(stats);
-    logger.success(`Manifest written: ${manifestPath}`);
-    printInstallNextSteps(projectRoot);
+  },
+  async run({ args }) {
+    intro(`agent-kit v${KIT_VERSION}`);
+    logger.info("init now uses the canonical install and readiness workflow.");
+    const result = await runInitCompatibility(args.cwd);
+    const pending = result.readiness.pendingActions.length;
+    logger.success(`L0 and readiness prepared in ${result.projectRoot}`);
+    outro(
+      pending > 0 ? "Next: run /agent-kit-onboard in Cursor to resolve the first pending action." : "Next: run /start-project in Cursor when you have a deliverable."
+    );
   }
 });
 
 // src/commands/run-plan.ts
-import path29 from "path";
-import { defineCommand as defineCommand7 } from "citty";
+import path28 from "path";
+import { defineCommand as defineCommand8 } from "citty";
 
 // src/plan-loop/backends.ts
 import { execFileSync, spawn as spawn2 } from "child_process";
@@ -2666,13 +3449,14 @@ function listBackendIds() {
 }
 
 // src/plan-loop/run-loop.ts
-import { mkdir as mkdir4, readFile as readFile10, rm, unlink } from "fs/promises";
-import path28 from "path";
+import { mkdir as mkdir4, readFile as readFile14, rm, unlink as unlink2 } from "fs/promises";
+import path27 from "path";
 
 // src/plan-loop/external-review.ts
 import { spawn as spawn3 } from "child_process";
-import path25 from "path";
-var SCRIPT_REL = path25.join("scripts", "plan-external-review.sh");
+import path24 from "path";
+var CANONICAL_REL = path24.join(".cursor", "scripts", "plan-external-review.sh");
+var FALLBACK_REL = path24.join("scripts", "plan-external-review.sh");
 function isPlanExhaustedReason(reason) {
   const r = reason.trim().toLowerCase();
   if (!r) return false;
@@ -2689,20 +3473,32 @@ function shouldArmExternalPlanReview(input) {
   if (input.stopReason && isPlanExhaustedReason(input.stopReason)) return true;
   return false;
 }
-async function armExternalPlanReview(root, deps = {}) {
-  const spawnFn = deps.spawnFn ?? spawn3;
-  const existsFn = deps.existsFn ?? fileExists;
-  const log = deps.log ?? ((line) => console.log(line));
-  const scriptPath = path25.join(root, SCRIPT_REL);
-  if (!await existsFn(scriptPath)) {
+async function armExternalPlanReview(root, options = {}) {
+  const spawnFn = options.spawnFn ?? spawn3;
+  const existsFn = options.existsFn ?? fileExists;
+  const log = options.log ?? ((line) => console.log(line));
+  const force = options.force === true;
+  const canonicalPath = path24.join(root, CANONICAL_REL);
+  const fallbackPath = path24.join(root, FALLBACK_REL);
+  let scriptPath = null;
+  let scriptRel = CANONICAL_REL;
+  if (await existsFn(canonicalPath)) {
+    scriptPath = canonicalPath;
+    scriptRel = CANONICAL_REL;
+  } else if (await existsFn(fallbackPath)) {
+    scriptPath = fallbackPath;
+    scriptRel = FALLBACK_REL;
+  }
+  if (!scriptPath) {
     log(
-      `tip: ${SCRIPT_REL} missing. Manual: /plan-external-review (enable externalPlanReview in .cursor/context/config.json).`
+      `tip: ${CANONICAL_REL} missing (optional wrapper: ${FALLBACK_REL}). Manual: /plan-external-review (enable externalPlanReview in .cursor/context/config.json).`
     );
     return { invoked: false, exitCode: null, output: "" };
   }
   log("Plan exhausted: arming optional external plan review (opt-in handled by script)...");
+  const args = force ? [scriptPath, "--force"] : [scriptPath];
   return new Promise((resolve) => {
-    const child = spawnFn("bash", [scriptPath], {
+    const child = spawnFn("bash", args, {
       cwd: root,
       env: process.env
     });
@@ -2720,14 +3516,14 @@ async function armExternalPlanReview(root, deps = {}) {
     });
     child.on("error", (err) => {
       log(
-        `tip: external plan review launcher failed (${err.message}). Manual: ${SCRIPT_REL} or /plan-external-review`
+        `tip: external plan review launcher failed (${err.message}). Manual: ${scriptRel} or /plan-external-review`
       );
       resolve({ invoked: true, exitCode: null, output });
     });
     child.on("close", (code) => {
       if (code !== 0 && code !== null) {
         log(
-          `tip: external plan review exited ${code} (ignored; does not fail the loop). Manual: ${SCRIPT_REL} or /plan-external-review`
+          `tip: external plan review exited ${code} (ignored; does not fail the loop). Manual: ${scriptRel} or /plan-external-review`
         );
       }
       resolve({ invoked: true, exitCode: code, output });
@@ -2736,8 +3532,8 @@ async function armExternalPlanReview(root, deps = {}) {
 }
 
 // src/plan-loop/plan-state.ts
-import { readFile as readFile8, readdir as readdir3 } from "fs/promises";
-import path26 from "path";
+import { readFile as readFile12, readdir as readdir3 } from "fs/promises";
+import path25 from "path";
 function countPendingTodos(raw) {
   const lines = raw.split(/\r?\n/);
   let inFront = 0;
@@ -2765,18 +3561,18 @@ function countPendingTodos(raw) {
 async function findActivePlanFile(plansDir) {
   if (!await fileExists(plansDir)) return null;
   const files = (await readdir3(plansDir)).filter((f) => f.endsWith(".plan.md")).sort();
-  return files[0] ? path26.join(plansDir, files[0]) : null;
+  return files[0] ? path25.join(plansDir, files[0]) : null;
 }
 async function readPlan(planPath) {
-  return readFile8(planPath, "utf8");
+  return readFile12(planPath, "utf8");
 }
 
 // src/plan-loop/sentinel.ts
-import { readFile as readFile9 } from "fs/promises";
+import { readFile as readFile13 } from "fs/promises";
 var SENTINEL_RE = /LOOP_TICK_RESULT:\s*(continue|stop(?:\s*[—\-].*)?)/i;
-function takeFromText(text2) {
-  if (!text2) return null;
-  const m = SENTINEL_RE.exec(text2);
+function takeFromText(text) {
+  if (!text) return null;
+  const m = SENTINEL_RE.exec(text);
   if (!m?.[1]) return null;
   const raw = m[1].trim();
   if (raw.toLowerCase().startsWith("stop")) {
@@ -2819,7 +3615,7 @@ function parseSentinelFromLog(content) {
 }
 async function parseSentinelFromLogFile(logPath) {
   try {
-    const content = await readFile9(logPath, "utf8");
+    const content = await readFile13(logPath, "utf8");
     return parseSentinelFromLog(content);
   } catch {
     return { kind: "missing" };
@@ -2832,7 +3628,7 @@ function formatSentinelLine(sentinel) {
 }
 
 // src/plan-loop/skin-banners.ts
-import path27 from "path";
+import path26 from "path";
 import {
   blue,
   cyan as cyan2,
@@ -2868,7 +3664,7 @@ function resolveColor(name, fallback) {
 async function resolveCliSkinId(root) {
   try {
     const cfg = await readJson(
-      path27.join(root, ".cursor", "context", "config.json")
+      path26.join(root, ".cursor", "context", "config.json")
     );
     const id = cfg?.workspaceSkin?.modes?.[CLI_RUN_PLAN_MODE];
     if (typeof id === "string" && id.trim()) return id.trim();
@@ -2878,7 +3674,7 @@ async function resolveCliSkinId(root) {
 }
 async function loadSkinPack(root, skinId) {
   try {
-    const skinPath = path27.join(root, "registry", "skins", "core", skinId, "skin.json");
+    const skinPath = path26.join(root, "registry", "skins", "core", skinId, "skin.json");
     const pack = await readJson(skinPath);
     if (!pack || typeof pack.id !== "string") return null;
     return pack;
@@ -2937,9 +3733,9 @@ function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 async function runPlanLoop(opts) {
-  const plansDir = path28.join(opts.root, ".cursor", "plans");
-  const stopFile = path28.join(opts.root, ".cursor", "loop.stop");
-  const logDir = path28.join(opts.root, ".cursor", "loop-logs");
+  const plansDir = path27.join(opts.root, ".cursor", "plans");
+  const stopFile = path27.join(opts.root, ".cursor", "loop.stop");
+  const logDir = path27.join(opts.root, ".cursor", "loop-logs");
   const planPath = await findActivePlanFile(plansDir);
   if (!planPath) {
     logger.error("No active plan in .cursor/plans/");
@@ -2948,7 +3744,7 @@ async function runPlanLoop(opts) {
   const pending = async () => countPendingTodos(await readPlan(planPath));
   await mkdir4(logDir, { recursive: true });
   try {
-    await unlink(stopFile);
+    await unlink2(stopFile);
   } catch {
   }
   const onSigInt = () => {
@@ -2960,7 +3756,7 @@ async function runPlanLoop(opts) {
   try {
     const skin = await loadCliRunPlanSkin(opts.root);
     const banners = createSkinBannerPrinter(skin);
-    console.log(`Active plan: ${path28.basename(planPath)}`);
+    console.log(`Active plan: ${path27.basename(planPath)}`);
     console.log(`Pending to-dos: ${await pending()} | max ticks: ${opts.maxTicks}`);
     console.log(`Backend: ${opts.backend.id}`);
     if (skin) {
@@ -3003,8 +3799,8 @@ async function runPlanLoop(opts) {
         planExhausted = true;
         break;
       }
-      const logPath = path28.join(logDir, `tick-${stamp()}.log`);
-      const relLog = path28.relative(opts.root, logPath);
+      const logPath = path27.join(logDir, `tick-${stamp()}.log`);
+      const relLog = path27.relative(opts.root, logPath);
       console.log("");
       const tickLine = `=== tick ${tick}/${opts.maxTicks} - pending: ${before} - log: ${relLog} ===`;
       if (banners) banners.tickStart(tickLine);
@@ -3023,7 +3819,7 @@ async function runPlanLoop(opts) {
         return 1;
       }
       try {
-        const logText = await readFile10(logPath, "utf8");
+        const logText = await readFile14(logPath, "utf8");
         if (logText.includes("Too many MCP tools")) {
           const msg = "Too many MCP tools for the headless model - disable servers (cursor-agent mcp disable <id>) and run again.";
           if (banners) banners.stop(msg);
@@ -3080,7 +3876,7 @@ async function runPlanLoop(opts) {
     const finishDetail = `after ${tick} tick(s); pending: ${pendingNow}`;
     if (banners) banners.phaseComplete(finishDetail);
     console.log(
-      `Loop finished after ${tick} tick(s). Pending now: ${pendingNow}. Logs in ${path28.relative(opts.root, logDir)}/`
+      `Loop finished after ${tick} tick(s). Pending now: ${pendingNow}. Logs in ${path27.relative(opts.root, logDir)}/`
     );
     if (planExhausted || shouldArmExternalPlanReview({ pending: pendingNow, stopReason })) {
       await armExternalPlanReview(opts.root);
@@ -3092,7 +3888,7 @@ async function runPlanLoop(opts) {
 }
 
 // src/commands/run-plan.ts
-var runPlanCommand = defineCommand7({
+var runPlanCommand = defineCommand8({
   meta: {
     name: "run-plan",
     description: "Headless continuous plan runner: one fresh agent per tick (LOOP_TICK_RESULT contract). Never git-prod."
@@ -3151,7 +3947,7 @@ var runPlanCommand = defineCommand7({
       return;
     }
     const code = await runPlanLoop({
-      root: path29.resolve(args.cwd),
+      root: path28.resolve(args.cwd),
       maxTicks,
       sleepSeconds,
       model: args.model ? String(args.model) : void 0,
@@ -3163,8 +3959,8 @@ var runPlanCommand = defineCommand7({
 });
 
 // src/commands/scan.ts
-import { defineCommand as defineCommand8 } from "citty";
-var scanCommand = defineCommand8({
+import { defineCommand as defineCommand9 } from "citty";
+var scanCommand = defineCommand9({
   meta: {
     name: "scan",
     description: "Scan the current repository and print detected profile."
@@ -3185,9 +3981,21 @@ var scanCommand = defineCommand8({
 });
 
 // src/commands/status.ts
-import path30 from "path";
-import { defineCommand as defineCommand9 } from "citty";
-var statusCommand = defineCommand9({
+import path29 from "path";
+import { defineCommand as defineCommand10 } from "citty";
+function profileStatus(profile) {
+  if (!profile) return { origin: "none", evidence: [], profile: null };
+  if ("detection" in profile && profile.detection && typeof profile.detection === "object") {
+    const detection = profile.detection;
+    return {
+      origin: "readiness-scanner",
+      evidence: detection.providerEvidence ?? [],
+      profile
+    };
+  }
+  return { origin: "legacy-wizard", evidence: [], profile };
+}
+var statusCommand = defineCommand10({
   meta: {
     name: "status",
     description: "Show Agent Kit distribution status (manifest + optional wizard profile)."
@@ -3204,15 +4012,26 @@ var statusCommand = defineCommand9({
     }
   },
   async run({ args }) {
-    const manifest = await loadAgentKitManifest(args.cwd);
-    const profilePath = path30.join(args.cwd, ".cursor", "agent-kit.config.json");
-    const profile = await readJson(profilePath);
+    const rootDir = path29.resolve(args.cwd);
+    const [manifest, rawProfile, scan] = await Promise.all([
+      loadAgentKitManifest(rootDir),
+      readJson(
+        path29.join(rootDir, ".cursor", "agent-kit.config.json")
+      ),
+      runScanner(rootDir)
+    ]);
+    const readiness = createReadinessReport(scan, { generatorVersion: KIT_VERSION });
+    const profile = profileStatus(rawProfile);
+    const nextAction = readiness.pendingActions[0];
     if (args.json) {
       console.log(
         JSON.stringify(
           {
+            runtimeVersion: KIT_VERSION,
             manifest: manifest ?? null,
-            profile: profile ?? null
+            readiness,
+            pendingActions: readiness.pendingActions,
+            profile
           },
           null,
           2
@@ -3221,11 +4040,12 @@ var statusCommand = defineCommand9({
       return;
     }
     if (!manifest) {
-      logger.warn(`No ${MANIFEST_RELATIVE_PATH} \u2014 run agent-kit install.`);
+      logger.warn(`No ${MANIFEST_RELATIVE_PATH}: run agent-kit install.`);
     } else {
       const protectedGlobs = resolveProtectedGlobs(manifest);
       console.log("Agent Kit status");
-      console.log(`  version:    ${manifest.version}`);
+      console.log(`  runtime:    ${KIT_VERSION}`);
+      console.log(`  installed:  ${manifest.version}`);
       console.log(`  profile:    ${manifest.profile ?? "(none)"}`);
       console.log(`  packs:      ${(manifest.packs ?? []).join(", ") || "(none)"}`);
       console.log(`  skills:     ${(manifest.skills ?? []).length} listed`);
@@ -3233,21 +4053,26 @@ var statusCommand = defineCommand9({
       console.log(
         `  registry:   ${manifest.registry?.url ?? "(default)"} @ ${manifest.registry?.ref ?? "(default)"}`
       );
-      if (manifest.installedAt) console.log(`  installed:  ${manifest.installedAt}`);
-    }
-    if (profile) {
-      console.log("Wizard profile (agent-kit.config.json): present");
-      console.log(`  IDE:        ${profile.ide?.ide ?? "?"}`);
-      console.log(`  core picks: ${(profile.selectedCoreComponents ?? []).join(", ") || "(none)"}`);
-    } else {
-      logger.info("No wizard profile \u2014 optional; run agent-kit init for generators.");
+      if (manifest.installedAt) console.log(`  installed at: ${manifest.installedAt}`);
     }
+    console.log("Repository readiness");
+    console.log(
+      `  ready: ${readiness.summary.ready}, choices: ${readiness.summary.needs_choice}, manual: ${readiness.summary.manual}, blocked: ${readiness.summary.blocked}`
+    );
+    console.log(`  pending: ${readiness.pendingActions.length}`);
+    console.log(`  profile origin: ${profile.origin}`);
+    console.log(
+      `  profile evidence: ${profile.evidence.map((item) => item.value).join(", ") || "(none)"}`
+    );
+    console.log(
+      nextAction ? `Next: ${nextAction.recommendation}` : "Next: repository readiness checks are complete"
+    );
   }
 });
 
 // src/commands/update.ts
-import { defineCommand as defineCommand10 } from "citty";
-var updateCommand = defineCommand10({
+import { defineCommand as defineCommand11 } from "citty";
+var updateCommand = defineCommand11({
   meta: {
     name: "update",
     description: "Re-apply L0/packs/skills from the registry; never overwrites L3 protected paths."
@@ -3292,7 +4117,7 @@ var updateCommand = defineCommand10({
 });
 
 // src/index.ts
-var main = defineCommand11({
+var main = defineCommand12({
   meta: {
     name: "agent-kit",
     description: "HITL framework for AI-assisted IDEs"
@@ -3302,6 +4127,7 @@ var main = defineCommand11({
     install: installCommand,
     scan: scanCommand,
     add: addCommand,
+    doctor: doctorCommand,
     status: statusCommand,
     update: updateCommand,
     diff: diffCommand,