@devflow-tools/cli 0.15.0 → 0.16.0

package/dist/commands/doctor.js

@@ -1,45 +1,3920 @@
-import { createHmac, createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { createEngines } from "@devflow-tools/context-engine";
+import { createHash, createHmac } from "node:crypto";
+import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, openSync, readdirSync, readFileSync, readSync, realpathSync, statSync, } from "node:fs";
+import { homedir } from "node:os";
+import { createRequire, isBuiltin } from "node:module";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import chalk from "chalk";
 import { serverStatus } from "./server.js";
-export async function runDoctor() {
-    const { codegraph, graph, memory, knowledge, workflow, data } = await createEngines(process.cwd());
+import { getGlobalDevFlowDbPath } from "@devflow-tools/database";
+function getProjectHash(rootPath) {
+    return createHash("sha256").update(rootPath).digest("hex").slice(0, 16);
+}
+function getDaemonSocketPath(rootPath) {
+    return join(homedir(), ".devflow", "daemons", `${getProjectHash(rootPath)}.sock`);
+}
+function getDaemonRegistryPath() {
+    return join(homedir(), ".devflow", "daemons.json");
+}
+let databaseSyncConstructor;
+function loadDatabaseSync() {
+    if (databaseSyncConstructor)
+        return databaseSyncConstructor;
+    try {
+        const sqlite = createRequire(import.meta.url)("node:sqlite");
+        if (typeof sqlite.DatabaseSync !== "function")
+            throw new Error("DatabaseSync is unavailable");
+        databaseSyncConstructor = sqlite.DatabaseSync;
+        return databaseSyncConstructor;
+    }
+    catch {
+        throw new Error("DevFlow doctor requires Node.js >=22.13.0 to inspect SQLite memory data (node:sqlite is unavailable).");
+    }
+}
+function sectionStatus(metrics) {
+    if (metrics.some((metric) => !metric.ok && metric.severity === "error")) {
+        return "red";
+    }
+    if (metrics.some((metric) => !metric.ok)) {
+        return "yellow";
+    }
+    return "green";
+}
+function canonicalizeProject(project) {
+    const absolute = resolve(project);
+    try {
+        return { path: realpathSync.native(absolute) };
+    }
+    catch (error) {
+        return { path: absolute, error: error.message };
+    }
+}
+function daemonRegistryEntryIssues(value) {
+    if (typeof value !== "object" || value === null)
+        return ["entry must be an object"];
+    const entry = value;
+    const issues = [];
+    if (typeof entry.rootPath !== "string" || entry.rootPath.length === 0) {
+        issues.push("rootPath must be a nonempty string");
+    }
+    if (typeof entry.projectHash !== "string" || entry.projectHash.length === 0) {
+        issues.push("projectHash must be a nonempty string");
+    }
+    if (typeof entry.pid !== "number" || !Number.isInteger(entry.pid) || entry.pid <= 0) {
+        issues.push("pid must be a positive integer");
+    }
+    if (typeof entry.startedAt !== "number"
+        || !Number.isFinite(entry.startedAt)
+        || entry.startedAt < 0) {
+        issues.push("startedAt must be a finite nonnegative number");
+    }
+    if (typeof entry.rootPath === "string"
+        && entry.rootPath.length > 0
+        && typeof entry.projectHash === "string"
+        && entry.projectHash.length > 0
+        && entry.projectHash !== getProjectHash(entry.rootPath)) {
+        issues.push("projectHash does not match rootPath");
+    }
+    return issues;
+}
+function checkIsolation(project, dependencies) {
+    const canonical = canonicalizeProject(project);
+    const hash = getProjectHash(canonical.path);
+    const socketPath = getDaemonSocketPath(canonical.path);
+    const metrics = [
+        {
+            key: "canonical_project",
+            value: canonical.path,
+            target: "existing canonical path",
+            ok: canonical.error === undefined,
+            severity: canonical.error ? "error" : "info",
+        },
+        { key: "project_hash", value: hash, ok: true, severity: "info" },
+        {
+            key: "daemon_socket_path",
+            value: socketPath,
+            target: `path containing ${hash}`,
+            ok: socketPath.includes(hash),
+            severity: "error",
+        },
+    ];
+    const registryPath = dependencies.registryPath ?? getDaemonRegistryPath();
+    if (!existsSync(registryPath)) {
+        metrics.push({
+            key: "daemon_registry",
+            value: "not found",
+            target: "valid JSON when present",
+            ok: true,
+            severity: "info",
+        });
+    }
+    else {
+        try {
+            const parsed = JSON.parse(readFileSync(registryPath, "utf8"));
+            if (!Array.isArray(parsed)) {
+                throw new Error("registry must be an array");
+            }
+            const invalidEntries = parsed.filter((entry) => daemonRegistryEntryIssues(entry).length > 0);
+            metrics.push({
+                key: "daemon_registry",
+                value: invalidEntries.length === 0 ? "valid" : "malformed",
+                target: "valid daemon entry array",
+                ok: invalidEntries.length === 0,
+                severity: invalidEntries.length === 0 ? "info" : "warning",
+            });
+            metrics.push({
+                key: "invalid_daemon_registry_entries",
+                value: invalidEntries.length,
+                target: 0,
+                ok: invalidEntries.length === 0,
+                severity: "warning",
+            });
+            const projectEntries = parsed.filter((value) => {
+                if (typeof value !== "object" || value === null)
+                    return false;
+                const entry = value;
+                if (typeof entry.rootPath !== "string" || entry.rootPath.length === 0)
+                    return false;
+                return canonicalizeProject(entry.rootPath).path === canonical.path;
+            });
+            metrics.push({
+                key: "project_daemon_registrations",
+                value: projectEntries.length,
+                ok: true,
+                severity: "info",
+            });
+            const registeredSocketPaths = projectEntries.map((entry) => getDaemonSocketPath(entry.rootPath));
+            metrics.push({
+                key: "registered_daemon_socket_paths",
+                value: registeredSocketPaths,
+                target: [socketPath],
+                ok: true,
+                severity: "info",
+            });
+            const identityMismatches = projectEntries.filter((entry, index) => (entry.projectHash !== hash || registeredSocketPaths[index] !== socketPath)).length;
+            metrics.push({
+                key: "daemon_identity_mismatches",
+                value: identityMismatches,
+                target: 0,
+                ok: identityMismatches === 0,
+                severity: "warning",
+            });
+        }
+        catch {
+            metrics.push({
+                key: "daemon_registry",
+                value: "malformed",
+                target: "valid daemon entry array",
+                ok: false,
+                severity: "warning",
+            });
+            metrics.push({
+                key: "invalid_daemon_registry_entries",
+                value: 1,
+                target: 0,
+                ok: false,
+                severity: "warning",
+            });
+        }
+    }
+    return { name: "Isolation", status: sectionStatus(metrics), metrics };
+}
+const REQUIRED_SCHEMA = {
+    distill_leases: ["event_ids", "expires_at", "status"],
+    observations: ["title"],
+    session_events: ["created_at", "id", "processed"],
+};
+function checkRequiredSchema(db) {
+    const tableRows = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table'").all();
+    const tables = new Set(tableRows.map((row) => row.name));
+    const missing = [];
+    for (const [table, requiredColumns] of Object.entries(REQUIRED_SCHEMA)) {
+        if (!tables.has(table)) {
+            missing.push(table);
+            continue;
+        }
+        const columns = new Set(db.prepare(`PRAGMA table_info(${table})`).all()
+            .map((row) => row.name));
+        for (const column of requiredColumns) {
+            if (!columns.has(column))
+                missing.push(`${table}.${column}`);
+        }
+    }
+    return missing.sort();
+}
+function parseLeaseStringArray(value) {
+    if (typeof value !== "string")
+        return null;
+    try {
+        const parsed = JSON.parse(value);
+        if (!Array.isArray(parsed) || !parsed.every((entry) => typeof entry === "string" && entry.trim().length > 0) || new Set(parsed).size !== parsed.length) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function parseLeaseEventIds(value) {
+    const eventIds = parseLeaseStringArray(value);
+    return eventIds && eventIds.length > 0 ? eventIds : null;
+}
+function parseLeaseInteger(value) {
+    if (typeof value === "bigint") {
+        return value >= 0n && value <= BigInt(Number.MAX_SAFE_INTEGER) ? value : null;
+    }
+    if (typeof value !== "number")
+        return null;
+    return Number.isSafeInteger(value) && value >= 0
+        ? value
+        : null;
+}
+function leaseIntegerEquals(value, expected) {
+    return typeof value === "bigint" ? value === BigInt(expected) : value === expected;
+}
+function timestampIsAfter(value, timestamp) {
+    return typeof value === "bigint"
+        ? value > BigInt(Math.trunc(timestamp))
+        : value > timestamp;
+}
+const LEASE_STATUSES = new Set(["pending", "committed", "expired"]);
+function checkDistill(project, dependencies) {
+    const metrics = [];
+    const dbPath = join(project, ".devflow", "memory", "memories.db");
+    if (!existsSync(dbPath)) {
+        metrics.push({
+            key: "memories_db",
+            value: "missing",
+            target: `initialize ${dbPath} with devflow init`,
+            ok: false,
+            severity: "error",
+        });
+        return { name: "Distill", status: sectionStatus(metrics), metrics };
+    }
+    metrics.push({
+        key: "memories_db",
+        value: dbPath,
+        target: "readable memory database",
+        ok: true,
+        severity: "info",
+    });
+    const openDatabase = dependencies.openDatabase
+        ?? ((path) => new (loadDatabaseSync())(path, { readOnly: true }));
+    let db;
+    try {
+        const openedDb = openDatabase(dbPath);
+        db = openedDb;
+        const missingSchema = checkRequiredSchema(openedDb);
+        if (missingSchema.length > 0) {
+            metrics.push({
+                key: "required_schema",
+                value: missingSchema,
+                target: [],
+                ok: false,
+                severity: "error",
+            });
+            return { name: "Distill", status: sectionStatus(metrics), metrics };
+        }
+        const now = (dependencies.now ?? Date.now)();
+        const leaseStatement = openedDb.prepare(`
+      SELECT batch_id, event_ids, session_ids, event_count, created_at, expires_at, status
+      FROM distill_leases
+    `);
+        leaseStatement.setReadBigInts?.(true);
+        const leaseRows = leaseStatement.all();
+        const leasedEventIds = new Set();
+        let malformedLeases = 0;
+        let malformedActiveLeases = 0;
+        for (const lease of leaseRows) {
+            const eventIds = parseLeaseEventIds(lease.event_ids);
+            const sessionIds = parseLeaseStringArray(lease.session_ids);
+            const eventCount = parseLeaseInteger(lease.event_count);
+            const createdAt = parseLeaseInteger(lease.created_at);
+            const expiresAt = parseLeaseInteger(lease.expires_at);
+            const status = typeof lease.status === "string" && LEASE_STATUSES.has(lease.status)
+                ? lease.status
+                : null;
+            const batchIdIsValid = typeof lease.batch_id === "string"
+                && lease.batch_id.trim().length > 0;
+            const eventCountMatches = eventIds !== null
+                && eventCount !== null
+                && leaseIntegerEquals(eventCount, eventIds.length);
+            if (!batchIdIsValid
+                || !eventIds
+                || !sessionIds
+                || !eventCountMatches
+                || createdAt === null
+                || expiresAt === null
+                || status === null) {
+                malformedLeases += 1;
+                if (lease.status === "pending"
+                    && (expiresAt === null || timestampIsAfter(expiresAt, now))) {
+                    malformedActiveLeases += 1;
+                }
+                continue;
+            }
+            if (status !== "pending" || !timestampIsAfter(expiresAt, now))
+                continue;
+            for (const eventId of eventIds)
+                leasedEventIds.add(eventId);
+        }
+        metrics.push({
+            key: "malformed_distill_leases",
+            value: malformedLeases,
+            target: 0,
+            ok: malformedLeases === 0,
+            severity: malformedActiveLeases > 0 ? "error" : "warning",
+        });
+        const staleRows = openedDb.prepare(`
+      SELECT id
+      FROM session_events
+      WHERE processed = 0 AND created_at < ?
+    `).all(now - 5 * 60 * 1000);
+        const staleUnleased = staleRows.filter((row) => !leasedEventIds.has(row.id)).length;
+        metrics.push({
+            key: "unprocessed_stale_events",
+            value: staleUnleased,
+            target: 0,
+            ok: staleUnleased === 0,
+            severity: "error",
+        });
+        const duplicates = openedDb.prepare(`
+      SELECT COUNT(*) AS group_count, COALESCE(SUM(title_count), 0) AS row_count
+      FROM (
+        SELECT project, session_id, title, COUNT(*) AS title_count
+        FROM observations
+        GROUP BY project, session_id, title
+        HAVING COUNT(*) > 1
+      )
+    `).get();
+        metrics.push({
+            key: "duplicate_observation_title_groups",
+            value: Number(duplicates.group_count),
+            target: 0,
+            ok: Number(duplicates.group_count) === 0,
+            severity: "error",
+        });
+        metrics.push({
+            key: "duplicate_observation_title_rows",
+            value: Number(duplicates.row_count),
+            target: 0,
+            ok: Number(duplicates.row_count) === 0,
+            severity: "error",
+        });
+    }
+    catch (error) {
+        metrics.push({
+            key: "database_read",
+            value: error.message,
+            target: "readable Task 2 memory schema",
+            ok: false,
+            severity: "error",
+        });
+    }
+    finally {
+        db?.close();
+    }
+    return { name: "Distill", status: sectionStatus(metrics), metrics };
+}
+function doctorOpenDatabase(path, dependencies) {
+    const openDatabase = dependencies.openDatabase
+        ?? ((databasePath) => new (loadDatabaseSync())(databasePath, { readOnly: true }));
+    return openDatabase(path);
+}
+function doctorTableExists(db, table) {
+    return Boolean(db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ? LIMIT 1").get(table));
+}
+function doctorCount(db, sql, ...params) {
+    const row = db.prepare(sql).get(...params);
+    return Number(row?.count ?? 0);
+}
+function coverage(total, vectors) {
+    return total === 0 ? 1 : vectors / total;
+}
+function checkVectors(project, dependencies) {
+    const metrics = [];
+    let codegraphNodes = null;
+    let symbolVectors = null;
+    const codegraphPath = join(project, ".codegraph", "codegraph.db");
+    if (!existsSync(codegraphPath)) {
+        metrics.push({ key: "codegraph_db", value: "missing", target: codegraphPath, ok: false, severity: "warning" });
+    }
+    else {
+        let db;
+        try {
+            db = doctorOpenDatabase(codegraphPath, dependencies);
+            if (!doctorTableExists(db, "nodes")) {
+                metrics.push({ key: "codegraph_nodes", value: "nodes table missing", target: ">= 0", ok: false, severity: "warning" });
+            }
+            else {
+                codegraphNodes = doctorCount(db, "SELECT COUNT(*) count FROM nodes");
+                metrics.push({ key: "codegraph_nodes", value: codegraphNodes, ok: true, severity: "info" });
+            }
+        }
+        catch (error) {
+            metrics.push({ key: "codegraph_db_read", value: error.message, target: "readable SQLite database", ok: false, severity: "error" });
+        }
+        finally {
+            db?.close();
+        }
+    }
+    const symbolsPath = join(project, ".devflow", "symbols-vec.db");
+    if (!existsSync(symbolsPath)) {
+        metrics.push({ key: "symbols_vectors_db", value: "missing", target: symbolsPath, ok: false, severity: "warning" });
+    }
+    else {
+        let db;
+        try {
+            db = doctorOpenDatabase(symbolsPath, dependencies);
+            const vectorTable = doctorTableExists(db, "symbols_vec_rowids")
+                ? "symbols_vec_rowids"
+                : doctorTableExists(db, "symbol_sources") ? "symbol_sources" : null;
+            if (!vectorTable) {
+                metrics.push({ key: "symbols_vectors", value: "vector metadata missing", target: ">= 0", ok: false, severity: "warning" });
+            }
+            else {
+                symbolVectors = doctorCount(db, `SELECT COUNT(*) count FROM ${vectorTable}`);
+                metrics.push({ key: "symbols_vectors", value: symbolVectors, ok: true, severity: "info" });
+            }
+        }
+        catch (error) {
+            metrics.push({ key: "symbols_vectors_read", value: error.message, target: "readable SQLite database", ok: false, severity: "error" });
+        }
+        finally {
+            db?.close();
+        }
+    }
+    if (codegraphNodes !== null && symbolVectors !== null) {
+        const value = coverage(codegraphNodes, symbolVectors);
+        metrics.push({ key: "symbols_vector_coverage", value, target: ">= 0.90", ok: value >= 0.9, severity: "warning" });
+    }
+    const knowledgePath = join(project, ".devflow", "knowledge", "knowledge.db");
+    if (!existsSync(knowledgePath)) {
+        metrics.push({ key: "knowledge_vectors_db", value: "missing", target: knowledgePath, ok: false, severity: "warning" });
+    }
+    else {
+        let db;
+        try {
+            db = doctorOpenDatabase(knowledgePath, dependencies);
+            const required = ["knowledge_docs", "knowledge_chunks", "knowledge_vec_rowids"];
+            const missing = required.filter(table => !doctorTableExists(db, table));
+            if (missing.length > 0) {
+                metrics.push({ key: "knowledge_vector_schema", value: missing, target: [], ok: false, severity: "warning" });
+            }
+            else {
+                const chunks = doctorCount(db, "SELECT COUNT(*) count FROM knowledge_chunks");
+                const vectors = doctorCount(db, "SELECT COUNT(*) count FROM knowledge_vec_rowids");
+                const value = coverage(chunks, vectors);
+                const rows = db.prepare(`
+          SELECT d.source source, COUNT(c.id) chunks,
+            SUM(CASE WHEN v.id IS NOT NULL THEN 1 ELSE 0 END) vectors
+          FROM knowledge_docs d
+          LEFT JOIN knowledge_chunks c ON c.doc_id = d.id
+          LEFT JOIN knowledge_vec_rowids v ON v.id = c.id
+          GROUP BY d.source ORDER BY d.source
+        `).all();
+                const bySource = rows.map(row => {
+                    const sourceChunks = Number(row.chunks);
+                    const sourceVectors = Number(row.vectors);
+                    return { source: row.source, chunks: sourceChunks, vectors: sourceVectors, coverage: coverage(sourceChunks, sourceVectors) };
+                });
+                metrics.push({ key: "knowledge_chunks", value: chunks, ok: true, severity: "info" });
+                metrics.push({ key: "knowledge_vectors", value: vectors, ok: true, severity: "info" });
+                metrics.push({ key: "knowledge_vector_coverage", value, target: ">= 0.95", ok: value >= 0.95, severity: "warning" });
+                metrics.push({
+                    key: "knowledge_vector_coverage_by_source",
+                    value: bySource,
+                    target: "every source >= 0.95",
+                    ok: bySource.every(source => source.coverage >= 0.95),
+                    severity: "warning",
+                });
+            }
+        }
+        catch (error) {
+            metrics.push({ key: "knowledge_vectors_read", value: error.message, target: "readable SQLite database", ok: false, severity: "error" });
+        }
+        finally {
+            db?.close();
+        }
+    }
+    const memoriesPath = join(project, ".devflow", "memory", "memories.db");
+    if (!existsSync(memoriesPath)) {
+        metrics.push({ key: "observation_vectors_db", value: "missing", target: memoriesPath, ok: false, severity: "warning" });
+    }
+    else {
+        let db;
+        try {
+            db = doctorOpenDatabase(memoriesPath, dependencies);
+            if (!doctorTableExists(db, "observations") || !doctorTableExists(db, "embeddings")) {
+                metrics.push({ key: "observation_vector_schema", value: "observations/embeddings missing", target: "Batch 2 vector schema", ok: false, severity: "warning" });
+            }
+            else {
+                const observations = doctorCount(db, "SELECT COUNT(*) count FROM observations");
+                const vectors = doctorCount(db, `
+          SELECT COUNT(DISTINCT e.source_id) count
+          FROM embeddings e JOIN observations o ON o.id = e.source_id
+          WHERE e.source_type = 'observation'
+        `);
+                const missing = Math.max(0, observations - vectors);
+                metrics.push({ key: "observations", value: observations, ok: true, severity: "info" });
+                metrics.push({ key: "observation_vectors", value: vectors, ok: true, severity: "info" });
+                metrics.push({ key: "observation_vectors_missing", value: missing, target: 0, ok: missing === 0, severity: "warning" });
+            }
+        }
+        catch (error) {
+            metrics.push({ key: "observation_vectors_read", value: error.message, target: "readable SQLite database", ok: false, severity: "error" });
+        }
+        finally {
+            db?.close();
+        }
+    }
+    const now = (dependencies.now ?? Date.now)();
+    const errorLogPath = join(dependencies.homePath ?? homedir(), ".devflow", "errors", "embedder.log");
+    let recentErrors = 0;
+    if (existsSync(errorLogPath)) {
+        try {
+            const cutoff = now - 24 * 60 * 60 * 1000;
+            recentErrors = readFileSync(errorLogPath, "utf8").split("\n").filter(line => {
+                const match = /^\[([^\]]+)\]/.exec(line);
+                return match ? Date.parse(match[1]) >= cutoff : false;
+            }).length;
+        }
+        catch (error) {
+            metrics.push({ key: "embedder_error_log_read", value: error.message, target: "readable error log", ok: false, severity: "error" });
+        }
+    }
+    metrics.push({ key: "embedder_errors_24h", value: recentErrors, target: 0, ok: recentErrors === 0, severity: "warning" });
+    return { name: "Vectors", status: sectionStatus(metrics), metrics };
+}
+function checkTelemetry(project, strict, dependencies) {
+    const metrics = [];
+    const home = dependencies.homePath ?? homedir();
+    const globalDbPath = dependencies.homePath
+        ? join(home, ".devflow", "global", "devflow.db")
+        : getGlobalDevFlowDbPath(home);
+    const cutoff = (dependencies.now ?? Date.now)() - 24 * 60 * 60 * 1000;
+    const strictSeverity = strict ? "error" : "warning";
+    if (!existsSync(globalDbPath)) {
+        metrics.push({ key: "global_telemetry_db", value: "missing", target: globalDbPath, ok: false, severity: "warning" });
+    }
+    else {
+        let db;
+        try {
+            db = doctorOpenDatabase(globalDbPath, dependencies);
+            metrics.push({ key: "global_telemetry_db", value: globalDbPath, ok: true, severity: "info" });
+            for (const [key, table] of [["tool_metrics_24h", "tool_metrics"], ["feedback_24h", "feedback"], ["runs_24h", "runs"]]) {
+                const value = doctorTableExists(db, table)
+                    ? doctorCount(db, `SELECT COUNT(*) count FROM ${table} WHERE created_at >= ?`, cutoff)
+                    : 0;
+                metrics.push({ key, value, ok: true, severity: "info" });
+            }
+            const failures = doctorTableExists(db, "telemetry_failures")
+                ? doctorCount(db, "SELECT COUNT(*) count FROM telemetry_failures WHERE created_at >= ?", cutoff)
+                : 0;
+            metrics.push({ key: "telemetry_failures_24h", value: failures, target: 0, ok: failures === 0, severity: strictSeverity });
+            if (doctorTableExists(db, "tool_call_events")) {
+                const eventColumns = db.prepare("PRAGMA table_info(tool_call_events)").all()
+                    .map(column => column.name);
+                if (eventColumns.includes("failure_category")) {
+                    const rows = db.prepare(`
+            SELECT failure_category category, COUNT(*) count
+            FROM tool_call_events
+            WHERE timestamp >= ? AND failure_category IS NOT NULL
+            GROUP BY failure_category
+            ORDER BY failure_category
+          `).all(cutoff);
+                    const distribution = Object.fromEntries(rows.map(row => [row.category, Number(row.count)]));
+                    const failedEvents = doctorCount(db, "SELECT COUNT(*) count FROM tool_call_events WHERE timestamp >= ? AND error IS NOT NULL", cutoff);
+                    const classifiedEvents = rows.reduce((sum, row) => sum + Number(row.count), 0);
+                    const classificationCoverage = failedEvents === 0 ? 1 : classifiedEvents / failedEvents;
+                    metrics.push({
+                        key: "failure_categories_24h",
+                        value: distribution,
+                        ok: true,
+                        severity: "info",
+                    });
+                    metrics.push({
+                        key: "failure_category_coverage_24h",
+                        value: classificationCoverage,
+                        target: ">= 0.80",
+                        ok: classificationCoverage >= 0.8,
+                        severity: strictSeverity,
+                    });
+                }
+                else {
+                    metrics.push({
+                        key: "failure_category_schema",
+                        value: "failure_category column missing",
+                        target: "Batch 4G telemetry schema",
+                        ok: false,
+                        severity: strictSeverity,
+                    });
+                }
+            }
+        }
+        catch (error) {
+            metrics.push({ key: "global_telemetry_db_read", value: error.message, target: "readable SQLite database", ok: false, severity: "error" });
+        }
+        finally {
+            db?.close();
+        }
+    }
+    const cacheDirs = [...new Set([
+            join(dirname(globalDbPath), "telemetry-cache"),
+            join(home, ".devflow", "telemetry-cache"),
+        ])];
+    let cacheFiles = 0;
+    try {
+        cacheFiles = cacheDirs.reduce((count, cacheDir) => count + (existsSync(cacheDir)
+            ? readdirSync(cacheDir).filter(file => file.endsWith(".json")).length
+            : 0), 0);
+        metrics.push({ key: "telemetry_cache_files", value: cacheFiles, target: 0, ok: cacheFiles === 0, severity: strictSeverity });
+    }
+    catch (error) {
+        metrics.push({ key: "telemetry_cache_read", value: error.message, target: "readable cache directory", ok: false, severity: "error" });
+    }
+    const projectDbPath = join(project, ".devflow", "devflow.db");
+    const projectDbPresent = existsSync(projectDbPath);
+    metrics.push({ key: "project_local_telemetry_db", value: projectDbPresent ? projectDbPath : "absent", target: "absent", ok: !projectDbPresent, severity: strictSeverity });
+    const codegraphPath = join(project, ".codegraph", "codegraph.db");
+    let codegraphDevflowTables = [];
+    if (existsSync(codegraphPath)) {
+        let db;
+        try {
+            db = doctorOpenDatabase(codegraphPath, dependencies);
+            codegraphDevflowTables = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name LIKE 'devflow_%' ORDER BY name").all().map(row => row.name);
+        }
+        catch (error) {
+            metrics.push({ key: "codegraph_telemetry_read", value: error.message, target: "readable SQLite database", ok: false, severity: "error" });
+        }
+        finally {
+            db?.close();
+        }
+    }
+    metrics.push({ key: "codegraph_devflow_tables", value: codegraphDevflowTables, target: [], ok: codegraphDevflowTables.length === 0, severity: strictSeverity });
+    return { name: "Telemetry", status: sectionStatus(metrics), metrics };
+}
+const DAY_MS = 24 * 60 * 60 * 1000;
+const BENCHMARK_MAX_AGE_MS = 30 * DAY_MS;
+const HOOK_DEBUG_MAX_TOTAL_BYTES = 60 * 1024 * 1024;
+function fileMode(path) {
+    return (statSync(path).mode & 0o777).toString(8).padStart(3, "0");
+}
+function diagnosticTimestamp(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return value;
+    if (typeof value !== "string")
+        return null;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : null;
+}
+function checkRuntimeSecurity(dependencies) {
+    const metrics = [];
+    const home = dependencies.homePath ?? homedir();
+    const env = dependencies.env ?? process.env;
+    const keyDir = join(home, ".devflow", "keys");
+    const secretSpecs = [
+        ["local_api_key", "DEVFLOW_API_KEY", "local.key"],
+        ["local_hmac_secret", "DEVFLOW_HMAC_SECRET", "hmac.key"],
+    ];
+    const needsKeyDirectory = secretSpecs.some(([, variable]) => !env[variable]?.trim());
+    if (!needsKeyDirectory && !existsSync(keyDir)) {
+        metrics.push({
+            key: "key_directory",
+            value: "not required (environment overrides active)",
+            ok: true,
+            severity: "info",
+        });
+    }
+    else if (!existsSync(keyDir)) {
+        metrics.push({
+            key: "key_directory",
+            value: "missing",
+            target: keyDir,
+            ok: false,
+            severity: "warning",
+        });
+    }
+    else {
+        try {
+            const directory = lstatSync(keyDir);
+            const mode = fileMode(keyDir);
+            const validType = directory.isDirectory() && !directory.isSymbolicLink();
+            const validMode = process.platform === "win32" || mode === "700";
+            metrics.push({
+                key: "key_directory",
+                value: { path: keyDir, mode },
+                target: { type: "directory", mode: "700" },
+                ok: validType && validMode,
+                severity: validType ? "warning" : "error",
+            });
+        }
+        catch (error) {
+            metrics.push({
+                key: "key_directory",
+                value: error.message,
+                target: "readable directory with mode 700",
+                ok: false,
+                severity: "error",
+            });
+        }
+    }
+    for (const [metricKey, variable, filename] of secretSpecs) {
+        if (env[variable]?.trim()) {
+            metrics.push({
+                key: `${metricKey}_source`,
+                value: variable,
+                target: "environment override or generated key file",
+                ok: true,
+                severity: "info",
+            });
+            continue;
+        }
+        const path = join(keyDir, filename);
+        if (!existsSync(path)) {
+            metrics.push({
+                key: `${metricKey}_source`,
+                value: "missing",
+                target: path,
+                ok: false,
+                severity: "warning",
+            });
+            continue;
+        }
+        try {
+            const entry = lstatSync(path);
+            const mode = fileMode(path);
+            const value = readFileSync(path, "utf8").trim();
+            const validType = entry.isFile() && !entry.isSymbolicLink();
+            metrics.push({
+                key: `${metricKey}_source`,
+                value: { path, mode, bytes: Buffer.byteLength(value) },
+                target: { type: "regular file", mode: "400", nonempty: true },
+                ok: validType && value.length > 0 && (process.platform === "win32" || mode === "400"),
+                severity: !validType || value.length === 0 ? "error" : "warning",
+            });
+        }
+        catch (error) {
+            metrics.push({
+                key: `${metricKey}_source`,
+                value: error.message,
+                target: "readable nonempty key file with mode 400",
+                ok: false,
+                severity: "error",
+            });
+        }
+    }
+    const compressorLog = join(home, ".devflow", "errors", "compressor.log");
+    let recentErrors = 0;
+    let malformedRecords = 0;
+    if (existsSync(compressorLog)) {
+        try {
+            const cutoff = (dependencies.now ?? Date.now)() - DAY_MS;
+            for (const line of readFileSync(compressorLog, "utf8").split("\n")) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const record = JSON.parse(line);
+                    const timestamp = diagnosticTimestamp(record.ts);
+                    if (timestamp === null)
+                        malformedRecords += 1;
+                    else if (timestamp >= cutoff)
+                        recentErrors += 1;
+                }
+                catch {
+                    malformedRecords += 1;
+                }
+            }
+        }
+        catch (error) {
+            metrics.push({
+                key: "compressor_error_log_read",
+                value: error.message,
+                target: "readable JSONL diagnostics",
+                ok: false,
+                severity: "error",
+            });
+        }
+    }
+    metrics.push({
+        key: "compressor_errors_24h",
+        value: recentErrors,
+        target: 0,
+        ok: recentErrors === 0,
+        severity: "warning",
+    });
+    metrics.push({
+        key: "malformed_compressor_records",
+        value: malformedRecords,
+        target: 0,
+        ok: malformedRecords === 0,
+        severity: "error",
+    });
+    return { name: "Runtime security", status: sectionStatus(metrics), metrics };
+}
+function checkBenchmark(dependencies) {
+    const metrics = [];
+    const home = dependencies.homePath ?? homedir();
+    const path = getGlobalDevFlowDbPath(home);
+    if (!existsSync(path)) {
+        metrics.push({
+            key: "latest_benchmark",
+            value: "missing global database",
+            target: "completed baseline within 30 days",
+            ok: false,
+            severity: "warning",
+        });
+        return { name: "Benchmark", status: sectionStatus(metrics), metrics };
+    }
+    let db;
+    try {
+        db = doctorOpenDatabase(path, dependencies);
+        if (!doctorTableExists(db, "benchmark_reports")) {
+            metrics.push({
+                key: "latest_benchmark",
+                value: "benchmark_reports table missing",
+                target: "completed baseline within 30 days",
+                ok: false,
+                severity: "warning",
+            });
+            return { name: "Benchmark", status: sectionStatus(metrics), metrics };
+        }
+        const row = db.prepare(`
+      SELECT run_id, suite_id, suite_version, task_count, status, report_json, created_at
+      FROM benchmark_reports
+      ORDER BY created_at DESC
+      LIMIT 1
+    `).get();
+        if (!row) {
+            metrics.push({
+                key: "latest_benchmark",
+                value: "no reports",
+                target: "completed baseline within 30 days",
+                ok: false,
+                severity: "warning",
+            });
+            return { name: "Benchmark", status: sectionStatus(metrics), metrics };
+        }
+        let reportTaskCount = null;
+        try {
+            if (typeof row.report_json !== "string")
+                throw new Error("report_json is not text");
+            const report = JSON.parse(row.report_json);
+            if (!Array.isArray(report.tasks))
+                throw new Error("report tasks are missing");
+            reportTaskCount = report.tasks.length;
+        }
+        catch (error) {
+            metrics.push({
+                key: "benchmark_report_json",
+                value: error.message,
+                target: "valid report with tasks array",
+                ok: false,
+                severity: "error",
+            });
+        }
+        const taskCount = Number(row.task_count);
+        const createdAt = Number(row.created_at);
+        const ageMs = (dependencies.now ?? Date.now)() - createdAt;
+        metrics.push({
+            key: "latest_benchmark",
+            value: {
+                runId: row.run_id,
+                suiteId: row.suite_id,
+                suiteVersion: row.suite_version,
+                status: row.status,
+                createdAt,
+            },
+            ok: row.status === "completed" && Number.isFinite(createdAt),
+            severity: "error",
+        });
+        metrics.push({
+            key: "benchmark_task_count",
+            value: taskCount,
+            target: ">= 5",
+            ok: Number.isInteger(taskCount) && taskCount >= 5 && reportTaskCount === taskCount,
+            severity: reportTaskCount === null ? "error" : "warning",
+        });
+        metrics.push({
+            key: "benchmark_age_days",
+            value: Number.isFinite(ageMs) ? Number((ageMs / DAY_MS).toFixed(2)) : null,
+            target: "0-30",
+            ok: Number.isFinite(ageMs) && ageMs >= 0 && ageMs <= BENCHMARK_MAX_AGE_MS,
+            severity: ageMs < 0 || !Number.isFinite(ageMs) ? "error" : "warning",
+        });
+    }
+    catch (error) {
+        metrics.push({
+            key: "benchmark_database_read",
+            value: error.message,
+            target: "readable canonical benchmark database",
+            ok: false,
+            severity: "error",
+        });
+    }
+    finally {
+        db?.close();
+    }
+    return { name: "Benchmark", status: sectionStatus(metrics), metrics };
+}
+function hookDebugFootprint(root) {
+    if (!existsSync(root))
+        return { bytes: 0, files: 0 };
+    const pending = [root];
+    let bytes = 0;
+    let files = 0;
+    while (pending.length > 0) {
+        const path = pending.pop();
+        const entry = lstatSync(path);
+        if (entry.isSymbolicLink())
+            continue;
+        if (entry.isDirectory()) {
+            for (const name of readdirSync(path))
+                pending.push(join(path, name));
+            continue;
+        }
+        if (entry.isFile()) {
+            bytes += entry.size;
+            files += 1;
+        }
+    }
+    return { bytes, files };
+}
+function checkHookPathHealth(dependencies) {
+    const metrics = [];
+    const home = dependencies.homePath ?? homedir();
+    const fallbackPaths = [join(home, ".devflow", "errors", "hook-fallback.log")];
+    const datedFallbackDir = join(home, ".devflow", "logs", "hook-fallback");
+    if (existsSync(datedFallbackDir)) {
+        try {
+            for (const name of readdirSync(datedFallbackDir)) {
+                if (name.endsWith(".log"))
+                    fallbackPaths.push(join(datedFallbackDir, name));
+            }
+        }
+        catch (error) {
+            metrics.push({
+                key: "hook_fallback_directory_read",
+                value: error.message,
+                target: "readable fallback directory",
+                ok: false,
+                severity: "error",
+            });
+        }
+    }
+    const cutoff = (dependencies.now ?? Date.now)() - DAY_MS;
+    let recentFallbacks = 0;
+    let malformedFallbacks = 0;
+    for (const path of [...new Set(fallbackPaths)]) {
+        if (!existsSync(path))
+            continue;
+        try {
+            for (const line of readFileSync(path, "utf8").split("\n")) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const record = JSON.parse(line);
+                    const timestamp = diagnosticTimestamp(record.ts);
+                    if (timestamp === null || typeof record.reason !== "string") {
+                        malformedFallbacks += 1;
+                    }
+                    else if (timestamp >= cutoff) {
+                        recentFallbacks += 1;
+                    }
+                }
+                catch {
+                    malformedFallbacks += 1;
+                }
+            }
+        }
+        catch (error) {
+            metrics.push({
+                key: "hook_fallback_log_read",
+                value: { path, error: error.message },
+                target: "readable JSONL diagnostics",
+                ok: false,
+                severity: "error",
+            });
+        }
+    }
+    metrics.push({
+        key: "hook_fallback_events_24h",
+        value: recentFallbacks,
+        target: 0,
+        ok: recentFallbacks === 0,
+        severity: "warning",
+    });
+    metrics.push({
+        key: "malformed_hook_fallback_records",
+        value: malformedFallbacks,
+        target: 0,
+        ok: malformedFallbacks === 0,
+        severity: "error",
+    });
+    const globalDbPath = dependencies.homePath
+        ? join(home, ".devflow", "global", "devflow.db")
+        : getGlobalDevFlowDbPath(home);
+    let daemonRequests = 0;
+    let failedDaemonRequests = 0;
+    let averageDaemonResponseMs = null;
+    if (existsSync(globalDbPath)) {
+        let db;
+        try {
+            db = doctorOpenDatabase(globalDbPath, dependencies);
+            if (doctorTableExists(db, "telemetry_events")) {
+                const row = db.prepare(`
+          SELECT COUNT(*) total,
+            SUM(CASE WHEN success = 0 THEN 1 ELSE 0 END) failures,
+            AVG(CASE WHEN success = 1 THEN duration END) average_duration
+          FROM telemetry_events
+          WHERE kind = 'hook_daemon_request' AND timestamp >= ?
+        `).get(cutoff);
+                daemonRequests = Number(row?.total ?? 0);
+                failedDaemonRequests = Number(row?.failures ?? 0);
+                averageDaemonResponseMs = row?.average_duration == null ? null : Math.round(Number(row.average_duration) * 100) / 100;
+            }
+        }
+        catch (error) {
+            metrics.push({
+                key: "hook_daemon_metrics_read",
+                value: error.message,
+                target: "readable canonical telemetry",
+                ok: false,
+                severity: "error",
+            });
+        }
+        finally {
+            db?.close();
+        }
+    }
+    const observedFailures = Math.max(recentFallbacks, failedDaemonRequests);
+    const observedRequests = Math.max(daemonRequests, observedFailures);
+    const fallbackRate = observedRequests === 0 ? 0 : observedFailures / observedRequests;
+    metrics.push({ key: "hook_daemon_requests_24h", value: observedRequests, ok: true, severity: "info" });
+    metrics.push({
+        key: "hook_fallback_rate_24h",
+        value: Math.round(fallbackRate * 10_000) / 10_000,
+        target: 0,
+        ok: observedFailures === 0,
+        severity: "warning",
+    });
+    metrics.push({
+        key: "hook_daemon_response_ms_avg",
+        value: averageDaemonResponseMs ?? "no successful requests",
+        target: "<= 1000",
+        ok: averageDaemonResponseMs === null || averageDaemonResponseMs <= 1000,
+        severity: "warning",
+    });
+    const degradedFeatures = observedFailures > 0
+        ? ["4-Gate enforcement", "memory prefetch cache", "daemon-shared hook state"]
+        : [];
+    metrics.push({
+        key: "degraded_hook_features",
+        value: degradedFeatures,
+        target: [],
+        ok: degradedFeatures.length === 0,
+        severity: "warning",
+    });
+    const debugRoot = join(home, ".devflow", "logs", "hook-debug");
+    try {
+        const footprint = hookDebugFootprint(debugRoot);
+        metrics.push({
+            key: "hook_debug_log_bytes",
+            value: footprint.bytes,
+            target: `<= ${HOOK_DEBUG_MAX_TOTAL_BYTES}`,
+            ok: footprint.bytes <= HOOK_DEBUG_MAX_TOTAL_BYTES,
+            severity: "warning",
+        });
+        metrics.push({
+            key: "hook_debug_log_files",
+            value: footprint.files,
+            target: "rotated per project",
+            ok: true,
+            severity: "info",
+        });
+    }
+    catch (error) {
+        metrics.push({
+            key: "hook_debug_log_read",
+            value: error.message,
+            target: "readable regular files without symlink traversal",
+            ok: false,
+            severity: "error",
+        });
+    }
+    return { name: "Hook path health", status: sectionStatus(metrics), metrics };
+}
+const RETIRED_PRODUCER_PATH = /\/api\/memory\/(?:process|events|pending-count|extract(?:-rules)?|ollama\/status)(?![\w/-])/g;
+const PLUGIN_PATH_REFERENCE = /\$(?:\{(?:CLAUDE_)?PLUGIN_ROOT\}|(?:CLAUDE_)?PLUGIN_ROOT)\/([A-Za-z0-9._/-]+)/g;
+const MAX_LEGACY_ARTIFACTS_PER_ROOT = 64;
+const MAX_LEGACY_ARTIFACT_BYTES = 1024 * 1024;
+const MAX_LANGUAGE_DEPENDENCY_DEPTH = 8;
+const MAX_SHELL_COMMAND_DEPTH = 8;
+const MAX_SHELL_COMMAND_BYTES = 64 * 1024;
+function canonicalDirectory(candidate) {
+    try {
+        return statSync(candidate).isDirectory() ? realpathSync.native(candidate) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function parseJsonFile(path) {
+    return JSON.parse(readFileSync(path, "utf8"));
+}
+function asRecord(value) {
+    return typeof value === "object" && value !== null
+        ? value
+        : null;
+}
+const UNSUPPORTED_SHELL_WORDS = new Set([
+    ".",
+    "!",
+    "[[",
+    "]]",
+    "case",
+    "coproc",
+    "do",
+    "done",
+    "elif",
+    "else",
+    "esac",
+    "eval",
+    "fi",
+    "for",
+    "function",
+    "if",
+    "in",
+    "select",
+    "source",
+    "then",
+    "time",
+    "trap",
+    "until",
+    "while",
+]);
+const PLUGIN_CONTROL_SHELL_WORDS = new Set([
+    "!",
+    "[[",
+    "]]",
+    "case",
+    "do",
+    "done",
+    "elif",
+    "else",
+    "esac",
+    "fi",
+    "for",
+    "function",
+    "if",
+    "in",
+    "select",
+    "then",
+    "time",
+    "until",
+    "while",
+]);
+const SUPPORTED_BRACED_SHELL_VARIABLE = /^\$\{(?:CLAUDE_PLUGIN_ROOT|CLAUDE_PROJECT_DIR|HOME|PLUGIN_ROOT)\}$/;
+function unsupportedShellWord(word, options) {
+    return UNSUPPORTED_SHELL_WORDS.has(word)
+        && !(options.tolerateControlSyntax && PLUGIN_CONTROL_SHELL_WORDS.has(word));
+}
+// Supported subset: simple commands separated by ;, newline, &, &&, ||, or |,
+// plus the explicit wrappers and interpreter options below. Other execution
+// syntax is reported as malformed instead of being approximated.
+function parseShellCommand(command, options = {}) {
+    if (Buffer.byteLength(command) > MAX_SHELL_COMMAND_BYTES) {
+        return { segments: [], malformed: true };
+    }
+    const segments = [];
+    let segment = [];
+    let token = "";
+    let quote = null;
+    let escaped = false;
+    let malformed = false;
+    const flushToken = () => {
+        if (token.length > 0)
+            segment.push(token);
+        token = "";
+    };
+    const flushSegment = () => {
+        flushToken();
+        if (segment.length > 0)
+            segments.push(segment);
+        segment = [];
+    };
+    for (let index = 0; index < command.length; index += 1) {
+        const character = command[index];
+        if (escaped) {
+            token += character;
+            escaped = false;
+            continue;
+        }
+        if (quote === "'") {
+            if (character === "'")
+                quote = null;
+            else
+                token += character;
+            continue;
+        }
+        if (character === "\\") {
+            if (command[index + 1] === "\n") {
+                index += 1;
+                continue;
+            }
+            if (command[index + 1] === "\r" && command[index + 2] === "\n") {
+                index += 2;
+                continue;
+            }
+            escaped = true;
+            continue;
+        }
+        if (quote === '"') {
+            if (character === '"')
+                quote = null;
+            else {
+                if ((character === "`" || (character === "$" && command[index + 1] === "("))
+                    && !options.tolerateControlSyntax) {
+                    malformed = true;
+                }
+                token += character;
+            }
+            continue;
+        }
+        if (character === "'" || character === '"') {
+            quote = character;
+            continue;
+        }
+        if ((character === "`" || (character === "$" && command[index + 1] === "("))
+            && !options.tolerateControlSyntax) {
+            malformed = true;
+            token += character;
+            continue;
+        }
+        const pair = command.slice(index, index + 2);
+        if (character === "#" && token.length === 0) {
+            while (index < command.length && command[index] !== "\n")
+                index += 1;
+            flushSegment();
+            continue;
+        }
+        if (pair === "<<" && !options.tolerateControlSyntax)
+            malformed = true;
+        const supportedVariableBrace = (character === "{"
+            && token === "$"
+            && /^\{(?:CLAUDE_PLUGIN_ROOT|CLAUDE_PROJECT_DIR|HOME|PLUGIN_ROOT)\}/
+                .test(command.slice(index))) || (character === "}"
+            && SUPPORTED_BRACED_SHELL_VARIABLE.test(`${token}}`));
+        if (["(", ")", "{", "}"].includes(character)
+            && !supportedVariableBrace
+            && !options.tolerateControlSyntax)
+            malformed = true;
+        if (pair === "&&" || pair === "||") {
+            flushSegment();
+            index += 1;
+            continue;
+        }
+        if ([";", "|", "&", "\n"].includes(character)) {
+            flushSegment();
+            continue;
+        }
+        if (/\s/.test(character)) {
+            flushToken();
+            continue;
+        }
+        token += character;
+    }
+    if (quote !== null || escaped)
+        malformed = true;
+    flushSegment();
+    if (segments.some((tokens) => {
+        const commandWord = tokens.find((item) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(item));
+        return commandWord !== undefined && unsupportedShellWord(commandWord, options);
+    })) {
+        malformed = true;
+    }
+    return { segments, malformed };
+}
+function activeShellText(command) {
+    return parseShellCommand(command).segments.flat().join(" ");
+}
+function isShellArtifact(path, content) {
+    const extension = extname(path);
+    if ([".bash", ".sh", ".zsh"].includes(extension))
+        return true;
+    if (/^#![^\n]*\b(?:ba|z)?sh\b/.test(content))
+        return true;
+    return extension === "" && !/^#!/.test(content);
+}
+function inferArtifactParserKind(path, content) {
+    if (isShellArtifact(path, content))
+        return "shell";
+    if (/^#![^\n]*\b(?:node|tsx)\b/.test(content))
+        return "node";
+    if (/^#![^\n]*\bpython(?:3)?\b/.test(content))
+        return "python";
+    if ([".cjs", ".js", ".mjs", ".ts"].includes(extname(path)))
+        return "node";
+    if (extname(path) === ".py")
+        return "python";
+    return "infer";
+}
+function stripJavaScriptComments(content) {
+    const stripped = content.split("");
+    let quote = null;
+    for (let index = 0; index < content.length; index += 1) {
+        const character = content[index];
+        if (quote !== null) {
+            if (character === "\\") {
+                index += 1;
+            }
+            else if (character === quote) {
+                quote = null;
+            }
+            continue;
+        }
+        if (character === "'" || character === '"' || character === "`") {
+            quote = character;
+            continue;
+        }
+        if (character !== "/" || !["/", "*"].includes(content[index + 1] ?? ""))
+            continue;
+        const block = content[index + 1] === "*";
+        stripped[index] = " ";
+        stripped[index + 1] = " ";
+        index += 2;
+        while (index < content.length) {
+            if (block && content[index] === "*" && content[index + 1] === "/") {
+                stripped[index] = " ";
+                stripped[index + 1] = " ";
+                index += 1;
+                break;
+            }
+            if (!block && content[index] === "\n") {
+                index -= 1;
+                break;
+            }
+            if (content[index] !== "\n" && content[index] !== "\r")
+                stripped[index] = " ";
+            index += 1;
+        }
+    }
+    return stripped.join("");
+}
+function stripPythonComments(content) {
+    const stripped = content.split("");
+    for (let index = 0; index < content.length; index += 1) {
+        const character = content[index];
+        if (character === "#") {
+            while (index < content.length && content[index] !== "\n") {
+                stripped[index] = " ";
+                index += 1;
+            }
+            continue;
+        }
+        if (character !== "'" && character !== '"')
+            continue;
+        const quote = character;
+        const delimiterLength = content.slice(index, index + 3) === quote.repeat(3) ? 3 : 1;
+        index += delimiterLength;
+        while (index < content.length) {
+            if (content[index] === "\\") {
+                index += 2;
+                continue;
+            }
+            if (content.slice(index, index + delimiterLength) === quote.repeat(delimiterLength)) {
+                index += delimiterLength - 1;
+                break;
+            }
+            if (delimiterLength === 1 && (content[index] === "\n" || content[index] === "\r"))
+                break;
+            index += 1;
+        }
+    }
+    return stripped.join("");
+}
+function retiredProducerPaths(content, shellSyntax, parserKind = "infer") {
+    const inspectedContent = shellSyntax
+        ? activeShellText(content)
+        : parserKind === "node"
+            ? stripJavaScriptComments(content)
+            : parserKind === "python"
+                ? stripPythonComments(content)
+                : content;
+    return [...new Set(inspectedContent.match(RETIRED_PRODUCER_PATH) ?? [])];
+}
+function commandTokens(command) {
+    return parseShellCommand(command).segments.flat();
+}
+function settingsArtifactReference(token, context, contextualPath = false, parserKind = "infer") {
+    const variableForms = [
+        [/^\$\{CLAUDE_PROJECT_DIR\}(?:\/(.*))?$/, context.project],
+        [/^\$CLAUDE_PROJECT_DIR(?:\/(.*))?$/, context.project],
+        [/^\$\{HOME\}(?:\/(.*))?$/, context.homePath],
+        [/^\$HOME(?:\/(.*))?$/, context.homePath],
+        [/^~(?:\/(.*))?$/, context.homePath],
+    ];
+    for (const [pattern, base] of variableForms) {
+        const match = token.match(pattern);
+        if (match) {
+            return {
+                path: resolve(base, match[1] ?? ""),
+                containmentRoot: base,
+                cwd: context.cwd,
+                parserKind,
+            };
+        }
+    }
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(token)
+        || token.startsWith("node:")) {
+        return null;
+    }
+    if (isAbsolute(token)) {
+        const absolute = resolve(token);
+        const projectRoot = resolve(context.project);
+        const homeRoot = resolve(context.homePath);
+        const containmentRoot = pathIsContained(projectRoot, absolute)
+            ? projectRoot
+            : pathIsContained(homeRoot, absolute)
+                ? homeRoot
+                : dirname(absolute);
+        return { path: absolute, containmentRoot, cwd: context.cwd, parserKind };
+    }
+    if (contextualPath) {
+        return {
+            path: resolve(context.cwd, token),
+            containmentRoot: context.project,
+            cwd: context.cwd,
+            parserKind,
+        };
+    }
+    if (token.startsWith("-") || token.startsWith("#"))
+        return null;
+    const isPlainPath = /^[A-Za-z0-9._/-]+$/.test(token);
+    if (isPlainPath && (token.startsWith("./")
+        || token.startsWith("../")
+        || token.includes("/")
+        || /\.(?:bash|cjs|js|mjs|py|sh|ts|zsh)$/.test(token))) {
+        return {
+            path: resolve(context.cwd, token),
+            containmentRoot: context.project,
+            cwd: context.cwd,
+            parserKind,
+        };
+    }
+    return null;
+}
+function decodeDataSpecifier(specifier) {
+    const comma = specifier.indexOf(",");
+    if (comma < 0)
+        return null;
+    try {
+        const metadata = specifier.slice(5, comma);
+        const payload = specifier.slice(comma + 1);
+        const bytes = metadata.split(";").includes("base64")
+            ? Buffer.from(payload, "base64")
+            : Buffer.from(decodeURIComponent(payload), "utf8");
+        if (bytes.length > MAX_SHELL_COMMAND_BYTES || bytes.includes(0))
+            return null;
+        const content = bytes.toString("utf8");
+        return content.includes("\uFFFD") ? null : content;
+    }
+    catch {
+        return null;
+    }
+}
+function resolveNodeSpecifierCandidate(candidate, resolveBarePackages = true) {
+    const specifier = candidate.value;
+    if (specifier.startsWith("node:") || isBuiltin(specifier))
+        return { malformed: false };
+    if (specifier.startsWith("data:")) {
+        const content = decodeDataSpecifier(specifier);
+        return content === null
+            ? { malformed: true }
+            : {
+                inlineContent: { content, source: specifier },
+                malformed: inlineNodeCodeMayLoadExternal(content),
+            };
+    }
+    if (specifier.startsWith("file:")) {
+        try {
+            const path = fileURLToPath(specifier);
+            const context = {
+                project: candidate.project,
+                homePath: candidate.homePath,
+                cwd: candidate.cwd,
+            };
+            return {
+                reference: settingsArtifactReference(path, context, true, candidate.parserKind) ?? undefined,
+                malformed: false,
+            };
+        }
+        catch {
+            return { malformed: true };
+        }
+    }
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(specifier) || artifactTokenIsAmbiguous(specifier)) {
+        return { malformed: true };
+    }
+    const localSpecifier = isAbsolute(specifier)
+        || specifier.startsWith("./")
+        || specifier.startsWith("../")
+        || specifier.startsWith("~")
+        || specifier.startsWith("$");
+    if (!resolveBarePackages && !localSpecifier)
+        return { malformed: false };
+    const context = {
+        project: candidate.project,
+        homePath: candidate.homePath,
+        cwd: candidate.cwd,
+    };
+    if (localSpecifier) {
+        if (candidate.issuerPath
+            && !specifier.startsWith("~")
+            && !specifier.startsWith("$")) {
+            const resolvedLocalPath = resolveNodeLocalSpecifier(specifier, candidate.issuerPath, candidate.nodeResolutionKind ?? "esm");
+            if (resolvedLocalPath) {
+                return {
+                    reference: settingsArtifactReference(resolvedLocalPath, context, true, candidate.parserKind) ?? undefined,
+                    malformed: false,
+                };
+            }
+        }
+        return {
+            reference: settingsArtifactReference(specifier, context, true, candidate.parserKind) ?? undefined,
+            malformed: false,
+        };
+    }
+    if (candidate.nodeResolutionKind === "esm")
+        return { malformed: true };
+    try {
+        const issuerPath = candidate.issuerPath ?? join(candidate.cwd, "package.json");
+        const resolvedPath = createRequire(issuerPath).resolve(specifier);
+        if (isBuiltin(resolvedPath))
+            return { malformed: false };
+        return {
+            reference: settingsArtifactReference(resolvedPath, context, true, candidate.parserKind) ?? undefined,
+            malformed: false,
+        };
+    }
+    catch {
+        return { malformed: true };
+    }
+}
+const NODE_LOCAL_EXTENSIONS = [".cjs", ".js", ".mjs", ".ts", ".tsx"];
+function existingNodeTextPath(path) {
+    const candidates = [path];
+    if (extname(path) === "") {
+        candidates.push(...NODE_LOCAL_EXTENSIONS.map((extension) => `${path}${extension}`), ...NODE_LOCAL_EXTENSIONS.map((extension) => join(path, `index${extension}`)));
+    }
+    for (const candidate of candidates) {
+        try {
+            if (statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            // Try the next bounded Node text candidate.
+        }
+    }
+    return null;
+}
+function resolveNodeLocalSpecifier(specifier, issuerPath, resolutionKind) {
+    if (resolutionKind === "cjs") {
+        try {
+            const resolvedPath = createRequire(issuerPath).resolve(specifier);
+            return isBuiltin(resolvedPath) ? null : resolvedPath;
+        }
+        catch {
+            // Preserve a missing local path so the queue reports it visibly.
+        }
+    }
+    const unresolvedPath = isAbsolute(specifier)
+        ? resolve(specifier)
+        : resolve(dirname(issuerPath), specifier);
+    return existingNodeTextPath(unresolvedPath) ?? unresolvedPath;
+}
+function tokenizeJavaScriptDependencies(content) {
+    const tokens = [];
+    let malformed = false;
+    for (let index = 0; index < content.length;) {
+        const character = content[index];
+        if (/\s/.test(character)) {
+            index += 1;
+            continue;
+        }
+        if (character === "/" && content[index + 1] === "/") {
+            index += 2;
+            while (index < content.length && content[index] !== "\n")
+                index += 1;
+            continue;
+        }
+        if (character === "/" && content[index + 1] === "*") {
+            const end = content.indexOf("*/", index + 2);
+            if (end < 0) {
+                malformed = true;
+                break;
+            }
+            index = end + 2;
+            continue;
+        }
+        if (character === "'" || character === '"') {
+            const quote = character;
+            let value = "";
+            let valid = true;
+            index += 1;
+            let closed = false;
+            while (index < content.length) {
+                const current = content[index];
+                if (current === quote) {
+                    closed = true;
+                    index += 1;
+                    break;
+                }
+                if (current === "\\") {
+                    valid = false;
+                    if (index + 1 >= content.length)
+                        break;
+                    value += content[index + 1];
+                    index += 2;
+                    continue;
+                }
+                if (current === "\n" || current === "\r") {
+                    valid = false;
+                    break;
+                }
+                value += current;
+                index += 1;
+            }
+            malformed ||= !closed;
+            tokens.push({ kind: "string", value, valid: valid && closed });
+            continue;
+        }
+        if (character === "`") {
+            let escaped = false;
+            let closed = false;
+            index += 1;
+            while (index < content.length) {
+                const current = content[index];
+                if (!escaped && current === "`") {
+                    closed = true;
+                    index += 1;
+                    break;
+                }
+                escaped = !escaped && current === "\\";
+                if (current !== "\\")
+                    escaped = false;
+                index += 1;
+            }
+            malformed ||= !closed;
+            tokens.push({ kind: "template", value: "", valid: closed });
+            continue;
+        }
+        if (/[A-Za-z_$]/.test(character)) {
+            let end = index + 1;
+            while (end < content.length && /[A-Za-z0-9_$]/.test(content[end]))
+                end += 1;
+            tokens.push({
+                kind: "identifier",
+                value: content.slice(index, end),
+                valid: true,
+            });
+            index = end;
+            continue;
+        }
+        tokens.push({ kind: "punctuation", value: character, valid: true });
+        index += 1;
+    }
+    return { tokens, malformed };
+}
+function scanNodeArtifactDependencies(artifact, content, context, resolveBarePackages = true) {
+    const tokenized = tokenizeJavaScriptDependencies(content);
+    const candidates = [];
+    let malformed = tokenized.malformed;
+    const addCandidate = (token, resolutionKind) => {
+        if (!token || token.kind !== "string" || !token.valid || token.value.length === 0) {
+            malformed = true;
+            return;
+        }
+        candidates.push({
+            value: token.value,
+            cwd: dirname(artifact),
+            project: context.project,
+            homePath: context.homePath,
+            parserKind: "node",
+            nodeResolutionKind: resolutionKind,
+            issuerPath: artifact,
+        });
+    };
+    const { tokens } = tokenized;
+    for (let index = 0; index < tokens.length; index += 1) {
+        const token = tokens[index];
+        const previous = tokens[index - 1];
+        if (token.kind !== "identifier")
+            continue;
+        if (token.value === "eval" && previous?.value !== "." && tokens[index + 1]?.value === "(") {
+            malformed = true;
+            continue;
+        }
+        if (token.value === "require") {
+            if (previous?.value === ".") {
+                if (tokens[index - 2]?.value === "module" && tokens[index + 1]?.value === "(") {
+                    malformed = true;
+                }
+                continue;
+            }
+            if (tokens[index + 1]?.value === "(") {
+                const literal = tokens[index + 2];
+                const closed = tokens[index + 3]?.value === ")";
+                if (!closed)
+                    malformed = true;
+                addCandidate(literal, "cjs");
+                continue;
+            }
+            malformed = true;
+            continue;
+        }
+        if (previous?.value === "." || !["export", "import"].includes(token.value))
+            continue;
+        if (token.value === "import" && tokens[index + 1]?.value === "(") {
+            const literal = tokens[index + 2];
+            const closed = tokens[index + 3]?.value === ")";
+            if (!closed)
+                malformed = true;
+            addCandidate(literal, "esm");
+            continue;
+        }
+        if (token.value === "import" && tokens[index + 1]?.kind === "string") {
+            addCandidate(tokens[index + 1], "esm");
+            continue;
+        }
+        if (token.value === "import" && tokens[index + 1]?.value === ".")
+            continue;
+        let fromIndex = -1;
+        for (let cursor = index + 1; cursor < Math.min(tokens.length, index + 32); cursor += 1) {
+            if (tokens[cursor].value === ";")
+                break;
+            if (tokens[cursor].value === "from") {
+                fromIndex = cursor;
+                break;
+            }
+        }
+        if (fromIndex >= 0) {
+            addCandidate(tokens[fromIndex + 1], "esm");
+        }
+        else if (token.value === "import") {
+            malformed = true;
+        }
+    }
+    const references = [];
+    const inlineContents = [];
+    for (const candidate of candidates) {
+        const resolved = resolveNodeSpecifierCandidate(candidate, resolveBarePackages);
+        if (resolved.reference)
+            references.push(resolved.reference);
+        if (resolved.inlineContent)
+            inlineContents.push(resolved.inlineContent);
+        malformed ||= resolved.malformed;
+    }
+    return { references, inlineContents, malformed };
+}
+function maskPythonStringsAndComments(content) {
+    const masked = content.split("");
+    let malformed = false;
+    for (let index = 0; index < content.length;) {
+        const character = content[index];
+        if (character === "#") {
+            while (index < content.length && content[index] !== "\n") {
+                masked[index] = " ";
+                index += 1;
+            }
+            continue;
+        }
+        if (character !== "'" && character !== '"') {
+            index += 1;
+            continue;
+        }
+        let prefixStart = index;
+        while (prefixStart > 0 && /[A-Za-z]/.test(content[prefixStart - 1])) {
+            prefixStart -= 1;
+        }
+        const prefix = content.slice(prefixStart, index);
+        const fString = /^(?:f|fr|rf)$/i.test(prefix);
+        const quote = character;
+        const triple = content.slice(index, index + 3) === quote.repeat(3);
+        const delimiterLength = triple ? 3 : 1;
+        let cursor = index;
+        for (let count = 0; count < delimiterLength; count += 1)
+            masked[cursor + count] = " ";
+        cursor += delimiterLength;
+        let closed = false;
+        while (cursor < content.length) {
+            if (content[cursor] === "\\") {
+                masked[cursor] = " ";
+                if (cursor + 1 < content.length)
+                    masked[cursor + 1] = " ";
+                cursor += 2;
+                continue;
+            }
+            if (content.slice(cursor, cursor + delimiterLength) === quote.repeat(delimiterLength)) {
+                for (let count = 0; count < delimiterLength; count += 1)
+                    masked[cursor + count] = " ";
+                cursor += delimiterLength;
+                closed = true;
+                break;
+            }
+            if (!triple && (content[cursor] === "\n" || content[cursor] === "\r"))
+                break;
+            if (content[cursor] !== "\n" && content[cursor] !== "\r")
+                masked[cursor] = " ";
+            cursor += 1;
+        }
+        if (fString) {
+            const stringBody = content.slice(index + delimiterLength, cursor - delimiterLength);
+            for (let bodyIndex = 0; bodyIndex < stringBody.length; bodyIndex += 1) {
+                if (stringBody[bodyIndex] !== "{")
+                    continue;
+                if (stringBody[bodyIndex + 1] === "{") {
+                    bodyIndex += 1;
+                    continue;
+                }
+                malformed = true;
+                break;
+            }
+        }
+        malformed ||= !closed;
+        index = cursor;
+    }
+    return { content: masked.join(""), malformed };
+}
+function resolvePythonModulePaths(baseDirectory, moduleName) {
+    const components = moduleName.split(".");
+    if (components.length > MAX_LANGUAGE_DEPENDENCY_DEPTH) {
+        return { paths: [], resolved: false };
+    }
+    const paths = [];
+    let currentPath = baseDirectory;
+    for (let index = 0; index < components.length; index += 1) {
+        currentPath = join(currentPath, components[index]);
+        const packageInitializer = join(currentPath, "__init__.py");
+        try {
+            if (statSync(packageInitializer).isFile()) {
+                paths.push(packageInitializer);
+                continue;
+            }
+        }
+        catch {
+            // A namespace package may legitimately omit an initializer.
+        }
+        const terminal = index === components.length - 1;
+        if (terminal) {
+            const modulePath = `${currentPath}.py`;
+            try {
+                if (statSync(modulePath).isFile()) {
+                    paths.push(modulePath);
+                    return { paths, resolved: true };
+                }
+            }
+            catch {
+                return { paths, resolved: false };
+            }
+            return { paths, resolved: false };
+        }
+        try {
+            if (!statSync(currentPath).isDirectory())
+                return { paths, resolved: false };
+        }
+        catch {
+            return { paths, resolved: false };
+        }
+    }
+    return { paths, resolved: paths.length > 0 };
+}
+function scanPythonArtifactDependencies(artifact, content, context) {
+    const masked = maskPythonStringsAndComments(content);
+    const references = [];
+    let malformed = masked.malformed
+        || /\b(?:exec|eval|__import__)\s*\(|\bimportlib\s*\./.test(masked.content);
+    const baseDirectoryForDepth = (relativeDepth) => {
+        let baseDirectory = dirname(artifact);
+        for (let depth = 1; depth < relativeDepth; depth += 1) {
+            baseDirectory = dirname(baseDirectory);
+        }
+        return baseDirectory;
+    };
+    const addReference = (modulePath) => {
+        const reference = settingsArtifactReference(modulePath, { ...context, cwd: dirname(artifact) }, true, "python");
+        if (reference)
+            references.push(reference);
+        else
+            malformed = true;
+    };
+    const addModule = (moduleName, relativeDepth = 0) => {
+        if (!/^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/.test(moduleName)) {
+            malformed = true;
+            return null;
+        }
+        const baseDirectory = baseDirectoryForDepth(relativeDepth);
+        const resolvedModule = resolvePythonModulePaths(baseDirectory, moduleName);
+        malformed ||= !resolvedModule.resolved;
+        for (const modulePath of resolvedModule.paths)
+            addReference(modulePath);
+        const terminalPath = resolvedModule.paths.at(-1);
+        return terminalPath && basename(terminalPath) === "__init__.py"
+            ? dirname(terminalPath)
+            : null;
+    };
+    const fromListNames = (value) => {
+        const names = [];
+        for (const imported of value.split(",")) {
+            const importedName = imported.trim().split(/\s+as\s+/)[0];
+            if (importedName === "*" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(importedName)) {
+                malformed = true;
+                continue;
+            }
+            names.push(importedName);
+        }
+        return names;
+    };
+    const inspectPackageFromList = (packageDirectory, value) => {
+        for (const importedName of fromListNames(value)) {
+            if (packageDirectory
+                && resolvePythonModulePaths(packageDirectory, importedName).resolved) {
+                malformed = true;
+            }
+        }
+    };
+    for (const line of masked.content.split(/\r?\n/)) {
+        for (const rawSegment of line.split(/[;:]/)) {
+            const segment = rawSegment.trim();
+            if (segment.startsWith("import ")) {
+                const imports = segment.slice("import ".length).split(",");
+                for (const imported of imports) {
+                    addModule(imported.trim().split(/\s+as\s+/)[0]);
+                }
+                continue;
+            }
+            const fromImport = segment.match(/^from\s+(\.*)([A-Za-z_][A-Za-z0-9_.]*)?\s+import\s+(.+)$/);
+            if (!fromImport)
+                continue;
+            const relativeDepth = fromImport[1].length;
+            const sourceModule = fromImport[2];
+            if (sourceModule) {
+                const packageDirectory = addModule(sourceModule, relativeDepth);
+                inspectPackageFromList(packageDirectory, fromImport[3]);
+                continue;
+            }
+            if (relativeDepth === 0) {
+                malformed = true;
+                continue;
+            }
+            const packageDirectory = baseDirectoryForDepth(relativeDepth);
+            const packageInitializer = join(packageDirectory, "__init__.py");
+            let localPackage = false;
+            try {
+                localPackage = statSync(packageInitializer).isFile();
+            }
+            catch {
+                // Without an initializer, preserve namespace-package traversal.
+            }
+            if (localPackage) {
+                addReference(packageInitializer);
+                inspectPackageFromList(packageDirectory, fromImport[3]);
+                continue;
+            }
+            for (const importedModule of fromListNames(fromImport[3])) {
+                addModule(importedModule, relativeDepth);
+            }
+        }
+    }
+    return {
+        references: [...new Map(references.map((reference) => [reference.path, reference])).values()],
+        inlineContents: [],
+        malformed,
+    };
+}
+function scanLanguageArtifactDependencies(artifact, content, parserKind, context, resolveBareNodePackages = true) {
+    if (parserKind === "node") {
+        return scanNodeArtifactDependencies(artifact, content, context, resolveBareNodePackages);
+    }
+    if (parserKind === "python") {
+        return scanPythonArtifactDependencies(artifact, content, context);
+    }
+    return { references: [], inlineContents: [], malformed: false };
+}
+function settingsArtifactReferences(command, project, homePath, cwd = project) {
+    const context = { project, homePath, cwd };
+    const scan = settingsArtifactTokens(command, 0, context);
+    const candidateValues = new Set((scan.artifacts ?? []).map((candidate) => candidate.value));
+    const inferredReferences = scan.tokens
+        .filter((token) => !candidateValues.has(token))
+        .map((token) => settingsArtifactReference(token, context))
+        .filter((reference) => reference !== null);
+    const resolvedReferences = [];
+    const inlineContents = [...(scan.inlineContents ?? [])];
+    let malformed = scan.malformed;
+    for (const candidate of scan.artifacts ?? []) {
+        if (candidate.nodeResolutionKind) {
+            const resolved = resolveNodeSpecifierCandidate(candidate);
+            if (resolved.reference)
+                resolvedReferences.push(resolved.reference);
+            if (resolved.inlineContent)
+                inlineContents.push(resolved.inlineContent);
+            malformed ||= resolved.malformed;
+            continue;
+        }
+        const reference = settingsArtifactReference(candidate.value, { ...context, cwd: candidate.cwd }, true, candidate.parserKind);
+        if (reference)
+            resolvedReferences.push(reference);
+        else
+            malformed = true;
+    }
+    const references = [...inferredReferences, ...resolvedReferences];
+    return {
+        references: [...new Map(references.map((reference) => [
+                `${reference.path}:${reference.parserKind}`,
+                reference,
+            ])).values()],
+        inlineContents,
+        malformed,
+    };
+}
+const SETTINGS_INTERPRETERS = new Set([
+    "bash",
+    "node",
+    "python",
+    "python3",
+    "sh",
+    "tsx",
+    "zsh",
+]);
+function isEnvironmentAssignment(token) {
+    return /^[A-Za-z_][A-Za-z0-9_]*=/.test(token);
+}
+function artifactTokenIsAmbiguous(token) {
+    if (/[*?\[]/.test(token))
+        return true;
+    if (!token.includes("$"))
+        return false;
+    return !/^(?:\$(?:CLAUDE_PLUGIN_ROOT|CLAUDE_PROJECT_DIR|HOME|PLUGIN_ROOT)|\$\{(?:CLAUDE_PLUGIN_ROOT|CLAUDE_PROJECT_DIR|HOME|PLUGIN_ROOT)\})(?:\/[A-Za-z0-9._/-]*)?$/.test(token);
+}
+const NODE_CJS_EXECUTABLE_PATH_OPTIONS = new Set([
+    "-r",
+    "--require",
+]);
+const NODE_ESM_EXECUTABLE_PATH_OPTIONS = new Set([
+    "--experimental-loader",
+    "--import",
+    "--loader",
+]);
+const NODE_INLINE_CODE_OPTIONS = new Set(["-e", "--eval", "-p", "--print"]);
+const NODE_NON_PATH_VALUE_OPTIONS = new Set([
+    "-C",
+    "--conditions",
+    "--input-type",
+    "--inspect-port",
+    "--title",
+    "--unhandled-rejections",
+]);
+const NODE_NO_VALUE_OPTIONS = new Set([
+    "--enable-source-maps",
+    "--experimental-strip-types",
+    "--experimental-transform-types",
+    "--no-deprecation",
+    "--no-warnings",
+    "--test",
+    "--trace-deprecation",
+    "--trace-warnings",
+    "--watch",
+]);
+const NODE_CHECK_ONLY_OPTIONS = new Set(["--check", "-c"]);
+const NODE_TERMINAL_OPTIONS = new Set(["--help", "--version", "-h", "-v"]);
+function inlineNodeCodeMayLoadExternal(code) {
+    return /\b(?:import|require)\s*\(/.test(code)
+        || /\bimport\s+(?:[^;\n]*\s+from\s+)?["']/.test(code)
+        || /\b(?:eval|Function)\s*\(/.test(code);
+}
+function matchingOptionValue(token, options) {
+    for (const option of options) {
+        if (token.startsWith(`${option}=`))
+            return token.slice(option.length + 1);
+    }
+    return null;
+}
+function scanNodeInterpreterTokens(tokens, startIndex, context) {
+    const references = [];
+    const artifacts = [];
+    let malformed = false;
+    const addReference = (reference, nodeResolutionKind) => {
+        references.push(reference);
+        artifacts.push({
+            value: reference,
+            cwd: context.cwd,
+            project: context.project,
+            homePath: context.homePath,
+            parserKind: "node",
+            nodeResolutionKind,
+        });
+        malformed ||= artifactTokenIsAmbiguous(reference);
+    };
+    const result = (isMalformed = malformed) => ({
+        tokens: references,
+        artifacts,
+        malformed: isMalformed,
+    });
+    let index = startIndex;
+    let checkOnly = false;
+    while (index < tokens.length) {
+        const token = tokens[index];
+        if (token === "--") {
+            const script = tokens[index + 1];
+            if (script && !checkOnly)
+                addReference(script);
+            return script ? result() : result(true);
+        }
+        if (!token.startsWith("-")) {
+            if (!checkOnly)
+                addReference(token);
+            return result();
+        }
+        if (NODE_TERMINAL_OPTIONS.has(token))
+            return result();
+        if (NODE_CHECK_ONLY_OPTIONS.has(token)) {
+            checkOnly = true;
+            index += 1;
+            continue;
+        }
+        const resolutionKind = NODE_CJS_EXECUTABLE_PATH_OPTIONS.has(token)
+            ? "cjs"
+            : NODE_ESM_EXECUTABLE_PATH_OPTIONS.has(token)
+                ? "esm"
+                : null;
+        if (resolutionKind) {
+            const pathOperand = tokens[index + 1];
+            if (!pathOperand)
+                return result(true);
+            addReference(pathOperand, resolutionKind);
+            index += 2;
+            continue;
+        }
+        const cjsPathValue = matchingOptionValue(token, NODE_CJS_EXECUTABLE_PATH_OPTIONS);
+        const esmPathValue = matchingOptionValue(token, NODE_ESM_EXECUTABLE_PATH_OPTIONS);
+        const pathValue = cjsPathValue ?? esmPathValue;
+        if (pathValue !== null) {
+            if (!pathValue)
+                return result(true);
+            addReference(pathValue, cjsPathValue !== null ? "cjs" : "esm");
+            index += 1;
+            continue;
+        }
+        if (token.startsWith("-r") && token.length > 2) {
+            addReference(token.slice(2), "cjs");
+            index += 1;
+            continue;
+        }
+        if (NODE_INLINE_CODE_OPTIONS.has(token)) {
+            const code = tokens[index + 1];
+            if (code === undefined)
+                return result(true);
+            return result(malformed || inlineNodeCodeMayLoadExternal(code));
+        }
+        const inlineCode = matchingOptionValue(token, NODE_INLINE_CODE_OPTIONS);
+        if (inlineCode !== null) {
+            return result(malformed || inlineNodeCodeMayLoadExternal(inlineCode));
+        }
+        if ((token.startsWith("-e") || token.startsWith("-p")) && token.length > 2) {
+            return result(malformed || inlineNodeCodeMayLoadExternal(token.slice(2)));
+        }
+        if (NODE_NON_PATH_VALUE_OPTIONS.has(token)) {
+            if (tokens[index + 1] === undefined)
+                return result(true);
+            index += 2;
+            continue;
+        }
+        if (matchingOptionValue(token, NODE_NON_PATH_VALUE_OPTIONS) !== null) {
+            index += 1;
+            continue;
+        }
+        if (NODE_NO_VALUE_OPTIONS.has(token)) {
+            index += 1;
+            continue;
+        }
+        return result(true);
+    }
+    return checkOnly ? result() : result(true);
+}
+const SHELL_SCRIPT_FLAGS = new Set(["-e", "-eu", "-o", "-u", "-ue"]);
+const PYTHON_NO_VALUE_OPTIONS = new Set([
+    "-B",
+    "-E",
+    "-I",
+    "-O",
+    "-OO",
+    "-P",
+    "-q",
+    "-s",
+    "-S",
+    "-u",
+    "-v",
+    "-x",
+]);
+const PYTHON_VALUE_OPTIONS = new Set(["-W", "-X", "--check-hash-based-pycs"]);
+const PYTHON_TERMINAL_OPTIONS = new Set(["--help", "--version", "-h", "-V"]);
+function scanShellInterpreterTokens(tokens, startIndex, depth, context, options) {
+    let index = startIndex;
+    while (index < tokens.length) {
+        const token = tokens[index];
+        if (token === "--") {
+            const script = tokens[index + 1];
+            return script
+                ? {
+                    tokens: [script],
+                    artifacts: [{
+                            value: script,
+                            cwd: context.cwd,
+                            project: context.project,
+                            homePath: context.homePath,
+                            parserKind: "shell",
+                        }],
+                    malformed: artifactTokenIsAmbiguous(script),
+                }
+                : { tokens: [], malformed: true };
+        }
+        if (token === "-c" || token === "-lc") {
+            const nestedCommand = tokens[index + 1];
+            if (!nestedCommand)
+                return { tokens: [], malformed: true };
+            return settingsArtifactTokens(nestedCommand, depth + 1, context, options);
+        }
+        if (token === "-o") {
+            if (!tokens[index + 1])
+                return { tokens: [], malformed: true };
+            index += 2;
+            continue;
+        }
+        if (SHELL_SCRIPT_FLAGS.has(token)) {
+            index += 1;
+            continue;
+        }
+        if (token.startsWith("-") || token.startsWith("+")) {
+            return { tokens: [], malformed: true };
+        }
+        return {
+            tokens: [token],
+            artifacts: [{
+                    value: token,
+                    cwd: context.cwd,
+                    project: context.project,
+                    homePath: context.homePath,
+                    parserKind: "shell",
+                }],
+            malformed: artifactTokenIsAmbiguous(token),
+        };
+    }
+    return { tokens: [], malformed: true };
+}
+function scanPythonInterpreterTokens(tokens, startIndex, context) {
+    let index = startIndex;
+    while (index < tokens.length) {
+        const token = tokens[index];
+        if (token === "--") {
+            const script = tokens[index + 1];
+            return script
+                ? {
+                    tokens: [script],
+                    artifacts: [{
+                            value: script,
+                            cwd: context.cwd,
+                            project: context.project,
+                            homePath: context.homePath,
+                            parserKind: "python",
+                        }],
+                    malformed: artifactTokenIsAmbiguous(script),
+                }
+                : { tokens: [], malformed: true };
+        }
+        if (!token.startsWith("-")) {
+            return {
+                tokens: [token],
+                artifacts: [{
+                        value: token,
+                        cwd: context.cwd,
+                        project: context.project,
+                        homePath: context.homePath,
+                        parserKind: "python",
+                    }],
+                malformed: artifactTokenIsAmbiguous(token),
+            };
+        }
+        if (PYTHON_TERMINAL_OPTIONS.has(token))
+            return { tokens: [], malformed: false };
+        if (token === "-c" || token === "-m" || token.startsWith("-c")) {
+            return { tokens: [], malformed: true };
+        }
+        if (PYTHON_VALUE_OPTIONS.has(token)) {
+            if (tokens[index + 1] === undefined)
+                return { tokens: [], malformed: true };
+            index += 2;
+            continue;
+        }
+        if (matchingOptionValue(token, PYTHON_VALUE_OPTIONS) !== null) {
+            index += 1;
+            continue;
+        }
+        if (PYTHON_NO_VALUE_OPTIONS.has(token)) {
+            index += 1;
+            continue;
+        }
+        return { tokens: [], malformed: true };
+    }
+    return { tokens: [], malformed: true };
+}
+const COMMAND_WRAPPERS = new Set(["builtin", "command", "env", "exec", "nohup", "timeout"]);
+const SAFE_WRAPPED_BUILTINS = new Set([":", "[", "echo", "false", "printf", "pwd", "test", "true"]);
+function resolveCommandDirectory(token, context) {
+    const reference = settingsArtifactReference(token, context, true);
+    if (!reference)
+        return null;
+    const directory = canonicalDirectory(reference.path);
+    const projectRoot = canonicalDirectory(context.project);
+    if (!directory || !projectRoot || !pathIsContained(projectRoot, directory))
+        return null;
+    return directory;
+}
+function unwrapCommandWrapper(wrapper, tokens, startIndex, context, options) {
+    let index = startIndex;
+    if (wrapper === "builtin") {
+        while (tokens[index]?.startsWith("-"))
+            index += 1;
+        return { index, malformed: index >= tokens.length };
+    }
+    if (wrapper === "command") {
+        while (tokens[index]?.startsWith("-")) {
+            const option = tokens[index];
+            if (/^-[pvV]+$/.test(option) && /[vV]/.test(option)) {
+                return { index: tokens.length, malformed: false };
+            }
+            index += 1;
+        }
+        return { index, malformed: index >= tokens.length };
+    }
+    if (wrapper === "exec") {
+        while (tokens[index]?.startsWith("-")) {
+            if (tokens[index] === "-a" || tokens[index] === "--argv0")
+                index += 2;
+            else
+                index += 1;
+        }
+        return { index, malformed: index >= tokens.length };
+    }
+    if (wrapper === "nohup") {
+        while (tokens[index]?.startsWith("-"))
+            index += 1;
+        return { index, malformed: index >= tokens.length };
+    }
+    if (wrapper === "env") {
+        let nextContext = context;
+        while (index < tokens.length) {
+            const token = tokens[index];
+            if (isEnvironmentAssignment(token)) {
+                index += 1;
+            }
+            else if (token === "-S" || token === "--split-string") {
+                const splitValue = tokens[index + 1];
+                if (!splitValue)
+                    return { index, malformed: true };
+                const split = parseShellCommand(splitValue, options);
+                if (split.malformed || split.segments.length !== 1)
+                    return { index, malformed: true };
+                return {
+                    index,
+                    malformed: false,
+                    replacement: [...split.segments[0], ...tokens.slice(index + 2)],
+                    context: nextContext,
+                };
+            }
+            else if (["-C", "--chdir"].includes(token)) {
+                const directory = tokens[index + 1];
+                const resolvedDirectory = directory
+                    ? resolveCommandDirectory(directory, nextContext)
+                    : null;
+                if (!resolvedDirectory)
+                    return { index, malformed: true };
+                nextContext = { ...nextContext, cwd: resolvedDirectory };
+                index += 2;
+            }
+            else if (token.startsWith("--chdir=")) {
+                const resolvedDirectory = resolveCommandDirectory(token.slice("--chdir=".length), nextContext);
+                if (!resolvedDirectory)
+                    return { index, malformed: true };
+                nextContext = { ...nextContext, cwd: resolvedDirectory };
+                index += 1;
+            }
+            else if (token.startsWith("-C") && token.length > 2) {
+                const resolvedDirectory = resolveCommandDirectory(token.slice(2), nextContext);
+                if (!resolvedDirectory)
+                    return { index, malformed: true };
+                nextContext = { ...nextContext, cwd: resolvedDirectory };
+                index += 1;
+            }
+            else if (["-u", "--unset"].includes(token)) {
+                if (!tokens[index + 1])
+                    return { index, malformed: true };
+                index += 2;
+            }
+            else if (token.startsWith("--unset=") || (token.startsWith("-u") && token.length > 2)) {
+                index += 1;
+            }
+            else if (["--", "-i", "--ignore-environment", "--null"].includes(token)) {
+                index += 1;
+            }
+            else if (token.startsWith("-")) {
+                return { index, malformed: true };
+            }
+            else {
+                break;
+            }
+        }
+        return { index, malformed: index >= tokens.length, context: nextContext };
+    }
+    while (tokens[index]?.startsWith("-")) {
+        const token = tokens[index];
+        if (["-k", "--kill-after", "-s", "--signal"].includes(token))
+            index += 2;
+        else
+            index += 1;
+    }
+    if (index >= tokens.length)
+        return { index, malformed: true };
+    index += 1;
+    return { index, malformed: index >= tokens.length };
+}
+function settingsArtifactTokens(command, depth = 0, context = {
+    project: process.cwd(),
+    homePath: homedir(),
+    cwd: process.cwd(),
+}, options = {}) {
+    if (depth > MAX_SHELL_COMMAND_DEPTH)
+        return { tokens: [], malformed: true };
+    const parsed = parseShellCommand(command, options);
+    const references = [];
+    const artifacts = [];
+    const inlineContents = [];
+    let malformed = parsed.malformed;
+    for (const tokens of parsed.segments) {
+        const segment = settingsArtifactTokensForSegment(tokens, depth, context, options);
+        references.push(...segment.tokens);
+        artifacts.push(...(segment.artifacts ?? []));
+        inlineContents.push(...(segment.inlineContents ?? []));
+        malformed ||= segment.malformed;
+    }
+    return { tokens: references, artifacts, inlineContents, malformed };
+}
+function settingsArtifactTokensForSegment(tokens, depth, context, options) {
+    let index = 0;
+    while (isEnvironmentAssignment(tokens[index] ?? ""))
+        index += 1;
+    let executable = tokens[index];
+    if (!executable)
+        return { tokens: [], malformed: false };
+    const references = [];
+    let wrapperDepth = depth;
+    let builtinWrapper = false;
+    while (COMMAND_WRAPPERS.has(basename(executable))) {
+        builtinWrapper ||= basename(executable) === "builtin";
+        references.push(executable);
+        wrapperDepth += 1;
+        if (wrapperDepth > MAX_SHELL_COMMAND_DEPTH)
+            return { tokens: references, malformed: true };
+        const unwrapped = unwrapCommandWrapper(basename(executable), tokens, index + 1, context, options);
+        if (unwrapped.malformed)
+            return { tokens: references, malformed: true };
+        context = unwrapped.context ?? context;
+        if (unwrapped.replacement) {
+            const nested = settingsArtifactTokensForSegment(unwrapped.replacement, wrapperDepth, unwrapped.context ?? context, options);
+            references.push(...nested.tokens);
+            return {
+                tokens: references,
+                artifacts: nested.artifacts,
+                inlineContents: nested.inlineContents,
+                malformed: nested.malformed,
+            };
+        }
+        index = unwrapped.index;
+        executable = tokens[index];
+        if (!executable)
+            return { tokens: references, malformed: false };
+    }
+    const executableName = basename(executable);
+    const unsupportedWrappedCommand = !executable.includes(sep)
+        && unsupportedShellWord(executableName, options);
+    const unsupportedBuiltin = builtinWrapper && !SAFE_WRAPPED_BUILTINS.has(executableName);
+    if (unsupportedWrappedCommand || unsupportedBuiltin) {
+        return { tokens: references, malformed: true };
+    }
+    const executableMalformed = artifactTokenIsAmbiguous(executable);
+    references.push(executable);
+    const interpreter = executableName;
+    if (!SETTINGS_INTERPRETERS.has(interpreter)) {
+        return { tokens: references, malformed: executableMalformed };
+    }
+    const interpreterScan = ["node", "tsx"].includes(interpreter)
+        ? scanNodeInterpreterTokens(tokens, index + 1, context)
+        : ["bash", "sh", "zsh"].includes(interpreter)
+            ? scanShellInterpreterTokens(tokens, index + 1, wrapperDepth, context, options)
+            : scanPythonInterpreterTokens(tokens, index + 1, context);
+    references.push(...interpreterScan.tokens);
+    return {
+        tokens: references,
+        artifacts: interpreterScan.artifacts,
+        inlineContents: interpreterScan.inlineContents,
+        malformed: executableMalformed || interpreterScan.malformed,
+    };
+}
+function pluginRootFromHookPath(path) {
+    if (!isAbsolute(path))
+        return null;
+    const absolute = resolve(path);
+    const marker = `${sep}hooks${sep}`;
+    const markerIndex = absolute.lastIndexOf(marker);
+    if (markerIndex < 0)
+        return null;
+    return canonicalDirectory(absolute.slice(0, markerIndex));
+}
+function explicitSettingsTargets(settingsPath, commands) {
+    const grouped = new Map();
+    for (const command of commands) {
+        for (const token of commandTokens(command)) {
+            const root = pluginRootFromHookPath(token);
+            if (!root)
+                continue;
+            const existing = grouped.get(root) ?? [];
+            existing.push(command);
+            grouped.set(root, existing);
+        }
+    }
+    return [...grouped].map(([root, targetCommands]) => ({
+        root,
+        configPath: settingsPath,
+        commands: [...new Set(targetCommands)],
+    }));
+}
+function isDevflowPluginKey(key) {
+    return key === "devflow@devflow"
+        || key === "devflow@devflow-local"
+        || key.startsWith("@devflow-tools/claude-code-plugin@");
+}
+function marketplaceName(pluginKey) {
+    return pluginKey.slice(pluginKey.lastIndexOf("@") + 1);
+}
+function marketplaceSourceRoot(sourcePath) {
+    for (const candidate of [
+        sourcePath,
+        join(sourcePath, "claude-code"),
+        join(sourcePath, "plugins", "claude-code"),
+    ]) {
+        const root = canonicalDirectory(candidate);
+        if (root && existsSync(join(root, "hooks.json")))
+            return root;
+    }
+    return null;
+}
+function localMarketplaceRoot(pluginKey, settings, knownMarketplacesPath) {
+    const marketplace = marketplaceName(pluginKey);
+    const extra = asRecord(settings.extraKnownMarketplaces);
+    const settingsEntry = asRecord(extra?.[marketplace]);
+    if (settingsEntry) {
+        const settingsSource = asRecord(settingsEntry.source);
+        const root = settingsSource?.source === "directory"
+            && typeof settingsSource.path === "string"
+            ? marketplaceSourceRoot(settingsSource.path)
+            : null;
+        return { configured: true, root };
+    }
+    try {
+        const known = asRecord(parseJsonFile(knownMarketplacesPath));
+        const knownEntry = asRecord(known?.[marketplace]);
+        if (knownEntry) {
+            const source = asRecord(knownEntry.source);
+            const root = source?.source === "directory" && typeof source.path === "string"
+                ? marketplaceSourceRoot(source.path)
+                : null;
+            return { configured: true, root };
+        }
+    }
+    catch {
+        // The installed plugin manifest remains the next deterministic source.
+    }
+    return { configured: false, root: null };
+}
+function installedEntryTimestamp(entry) {
+    const timestamps = [entry?.lastUpdated, entry?.installedAt]
+        .map((value) => {
+        if (typeof value === "number" && Number.isFinite(value) && value >= 0)
+            return value;
+        if (typeof value !== "string")
+            return null;
+        const parsed = Date.parse(value);
+        return Number.isFinite(parsed) ? parsed : null;
+    })
+        .filter((value) => value !== null);
+    return timestamps.length > 0 ? Math.max(...timestamps) : null;
+}
+function compareInstalledEntries(left, right) {
+    const leftRecord = asRecord(left.entry);
+    const rightRecord = asRecord(right.entry);
+    const leftTimestamp = installedEntryTimestamp(leftRecord);
+    const rightTimestamp = installedEntryTimestamp(rightRecord);
+    if (leftTimestamp !== rightTimestamp) {
+        if (leftTimestamp === null)
+            return 1;
+        if (rightTimestamp === null)
+            return -1;
+        return rightTimestamp - leftTimestamp;
+    }
+    const leftVersion = typeof leftRecord?.version === "string"
+        ? parseSemanticVersion(leftRecord.version)
+        : null;
+    const rightVersion = typeof rightRecord?.version === "string"
+        ? parseSemanticVersion(rightRecord.version)
+        : null;
+    if (leftVersion && rightVersion) {
+        const versionOrder = compareSemanticVersions(rightVersion, leftVersion);
+        if (versionOrder !== 0)
+            return versionOrder;
+    }
+    else if (leftVersion || rightVersion) {
+        return leftVersion ? -1 : 1;
+    }
+    return right.index - left.index;
+}
+function installedPluginRoot(pluginKey, installedPluginsPath) {
+    try {
+        const manifest = asRecord(parseJsonFile(installedPluginsPath));
+        if (!manifest)
+            throw new Error("installed plugin manifest must be an object");
+        const plugins = asRecord(manifest.plugins);
+        if (!plugins) {
+            throw new Error("installed plugin manifest plugins must be an object");
+        }
+        const entries = plugins?.[pluginKey];
+        if (entries === undefined) {
+            return { configured: false, root: null };
+        }
+        if (!Array.isArray(entries) || entries.length === 0) {
+            return { configured: true, malformed: true, root: null };
+        }
+        const latest = entries
+            .map((entry, index) => ({ entry, index }))
+            .sort(compareInstalledEntries)[0];
+        const latestRecord = asRecord(latest?.entry);
+        if (!latestRecord
+            || typeof latestRecord.installPath !== "string"
+            || latestRecord.installPath.length === 0) {
+            return { configured: true, malformed: true, root: null };
+        }
+        return {
+            configured: true,
+            root: canonicalDirectory(latestRecord.installPath),
+        };
+    }
+    catch {
+        if (existsSync(installedPluginsPath)) {
+            return { configured: true, malformed: true, root: null };
+        }
+    }
+    return { configured: false, root: null };
+}
+function parseSemanticVersion(value) {
+    const match = value.match(/^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/);
+    if (!match)
+        return null;
+    return {
+        major: Number(match[1]),
+        minor: Number(match[2]),
+        patch: Number(match[3]),
+        prerelease: match[4]?.split(".") ?? [],
+    };
+}
+function compareSemanticVersions(left, right) {
+    for (const key of ["major", "minor", "patch"]) {
+        if (left[key] !== right[key])
+            return left[key] - right[key];
+    }
+    if (left.prerelease.length === 0 || right.prerelease.length === 0) {
+        return right.prerelease.length - left.prerelease.length;
+    }
+    const length = Math.max(left.prerelease.length, right.prerelease.length);
+    for (let index = 0; index < length; index += 1) {
+        const leftPart = left.prerelease[index];
+        const rightPart = right.prerelease[index];
+        if (leftPart === undefined)
+            return -1;
+        if (rightPart === undefined)
+            return 1;
+        if (leftPart === rightPart)
+            continue;
+        const leftNumber = /^\d+$/.test(leftPart) ? Number(leftPart) : null;
+        const rightNumber = /^\d+$/.test(rightPart) ? Number(rightPart) : null;
+        if (leftNumber !== null && rightNumber !== null)
+            return leftNumber - rightNumber;
+        if (leftNumber !== null)
+            return -1;
+        if (rightNumber !== null)
+            return 1;
+        return leftPart.localeCompare(rightPart);
+    }
+    return 0;
+}
+function cachedPluginRoot(pluginKey, pluginCachePath) {
+    const separatorIndex = pluginKey.lastIndexOf("@");
+    if (separatorIndex <= 0 || separatorIndex === pluginKey.length - 1)
+        return null;
+    const pluginName = pluginKey.slice(0, separatorIndex);
+    const marketplace = pluginKey.slice(separatorIndex + 1);
+    const cacheBase = join(pluginCachePath, marketplace, pluginName);
+    let entries;
+    try {
+        entries = readdirSync(cacheBase, { withFileTypes: true })
+            .filter((entry) => entry.isDirectory())
+            .map((entry) => {
+            const path = join(cacheBase, entry.name);
+            let version = entry.name;
+            try {
+                const packageJson = asRecord(parseJsonFile(join(path, "package.json")));
+                if (typeof packageJson?.version === "string")
+                    version = packageJson.version;
+            }
+            catch {
+                // Directory name, mtime, and name remain deterministic fallbacks.
+            }
+            return { name: entry.name, path, version, mtimeMs: statSync(path).mtimeMs };
+        });
+    }
+    catch {
+        return null;
+    }
+    entries.sort((left, right) => {
+        const leftSemantic = parseSemanticVersion(left.version);
+        const rightSemantic = parseSemanticVersion(right.version);
+        if (leftSemantic && rightSemantic) {
+            const versionOrder = compareSemanticVersions(rightSemantic, leftSemantic);
+            if (versionOrder !== 0)
+                return versionOrder;
+        }
+        else if (leftSemantic || rightSemantic) {
+            return leftSemantic ? -1 : 1;
+        }
+        return right.mtimeMs - left.mtimeMs || right.name.localeCompare(left.name);
+    });
+    return entries[0] ? canonicalDirectory(entries[0].path) : null;
+}
+function selectActiveLegacyTargets(project, dependencies) {
+    if (dependencies.legacyArtifactRoots !== undefined) {
+        const targets = dependencies.legacyArtifactRoots
+            .map((root) => canonicalDirectory(root))
+            .filter((root) => root !== null)
+            .map((root) => ({ root, inspectPluginConfig: true }));
+        return {
+            targets,
+            configCommands: [],
+            hooksDisabled: false,
+            malformedSettings: [],
+            malformedPluginMetadata: [],
+            method: "injected",
+            ok: targets.length > 0,
+        };
+    }
+    const settingsPath = dependencies.claudeSettingsPath
+        ?? join(dependencies.homePath ?? homedir(), ".claude", "settings.json");
+    const installedPluginsPath = dependencies.installedPluginsPath
+        ?? join(dependencies.homePath ?? homedir(), ".claude", "plugins", "installed_plugins.json");
+    const knownMarketplacesPath = dependencies.knownMarketplacesPath
+        ?? join(dependencies.homePath ?? homedir(), ".claude", "plugins", "known_marketplaces.json");
+    const pluginCachePath = dependencies.pluginCachePath
+        ?? join(dependencies.homePath ?? homedir(), ".claude", "plugins", "cache");
+    const settingsSources = [];
+    const malformedSettings = [];
+    const malformedPluginMetadata = [];
+    const settingsPaths = [...new Set([
+            settingsPath,
+            join(project, ".claude", "settings.json"),
+            join(project, ".claude", "settings.local.json"),
+        ])];
+    for (const activeSettingsPath of settingsPaths) {
+        if (!existsSync(activeSettingsPath))
+            continue;
+        try {
+            const parsed = asRecord(parseJsonFile(activeSettingsPath));
+            if (!parsed)
+                throw new Error("settings must be an object");
+            settingsSources.push({ path: activeSettingsPath, settings: parsed });
+        }
+        catch {
+            malformedSettings.push(activeSettingsPath);
+        }
+    }
+    const hooksDisabled = settingsSources.reduce((disabled, source) => (typeof source.settings.disableAllHooks === "boolean"
+        ? source.settings.disableAllHooks
+        : disabled), false);
+    if (hooksDisabled) {
+        return {
+            targets: [],
+            configCommands: [],
+            hooksDisabled: true,
+            malformedSettings,
+            malformedPluginMetadata: [],
+            method: "hooks-disabled",
+            ok: malformedSettings.length === 0,
+        };
+    }
+    const settingsCommandsByPath = settingsSources.map((source) => {
+        const commands = [];
+        collectCommandStrings(source.settings.hooks, commands);
+        return { path: source.path, commands };
+    });
+    const settingsCommands = settingsCommandsByPath.flatMap((source) => source.commands);
+    const explicitTargets = settingsCommandsByPath.flatMap((source) => (explicitSettingsTargets(source.path, source.commands)));
+    const enabledPlugins = settingsSources.reduce((merged, source) => {
+        const enabled = source.settings.enabledPlugins;
+        if (typeof enabled !== "object" || enabled === null)
+            return merged;
+        for (const [key, value] of Object.entries(enabled)) {
+            if (isDevflowPluginKey(key) && typeof value === "boolean")
+                merged.set(key, value);
+        }
+        return merged;
+    }, new Map());
+    const enabledKeys = [...enabledPlugins]
+        .filter(([, enabled]) => enabled)
+        .map(([key]) => key)
+        .sort();
+    const targets = [...explicitTargets];
+    let unresolved = false;
+    for (const pluginKey of enabledKeys) {
+        const installed = installedPluginRoot(pluginKey, installedPluginsPath);
+        if (installed.malformed)
+            malformedPluginMetadata.push(installedPluginsPath);
+        let root = installed.root;
+        if (!installed.configured) {
+            const configuredMarketplaces = settingsSources
+                .map((source) => localMarketplaceRoot(pluginKey, source.settings, knownMarketplacesPath))
+                .filter((selection) => selection.configured);
+            const marketplace = configuredMarketplaces[configuredMarketplaces.length - 1];
+            if (marketplace) {
+                root = marketplace.root;
+            }
+            else {
+                root = cachedPluginRoot(pluginKey, pluginCachePath);
+            }
+        }
+        if (root)
+            targets.push({ root, inspectPluginConfig: true });
+        else
+            unresolved = true;
+    }
+    const uniqueTargets = [...targets.reduce((byRoot, target) => {
+            const existing = byRoot.get(target.root);
+            if (!existing) {
+                byRoot.set(target.root, target);
+                return byRoot;
+            }
+            byRoot.set(target.root, {
+                root: target.root,
+                configPath: existing.configPath ?? target.configPath,
+                commands: [...new Set([...(existing.commands ?? []), ...(target.commands ?? [])])],
+                inspectPluginConfig: Boolean(existing.inspectPluginConfig || target.inspectPluginConfig),
+            });
+            return byRoot;
+        }, new Map()).values()];
+    const methods = [
+        settingsCommands.length > 0 ? "settings-hooks" : null,
+        enabledKeys.length > 0 ? "enabled-plugin" : null,
+    ].filter((method) => method !== null);
+    return {
+        targets: uniqueTargets,
+        configCommands: settingsCommandsByPath.filter((source) => source.commands.length > 0),
+        hooksDisabled: false,
+        method: methods.length > 0
+            ? `${methods.join("+")}${unresolved ? "-unresolved" : ""}`
+            : malformedSettings.length > 0 ? "settings-unresolved" : "enabled-plugin-unresolved",
+        malformedSettings,
+        malformedPluginMetadata: [...new Set(malformedPluginMetadata)],
+        ok: (uniqueTargets.length > 0 || settingsCommands.length > 0)
+            && !unresolved
+            && malformedSettings.length === 0
+            && malformedPluginMetadata.length === 0,
+    };
+}
+function findWorkspaceRoot(start) {
+    let cursor = start;
+    while (true) {
+        const packagePath = join(cursor, "package.json");
+        if (existsSync(packagePath)) {
+            try {
+                const packageJson = JSON.parse(readFileSync(packagePath, "utf8"));
+                if (packageJson.workspaces)
+                    return cursor;
+            }
+            catch {
+                // Keep walking; a plugin package.json is not necessarily the workspace root.
+            }
+        }
+        const parent = dirname(cursor);
+        if (parent === cursor)
+            return undefined;
+        cursor = parent;
+    }
+}
+function collectCommandStrings(value, commands) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectCommandStrings(item, commands);
+        return;
+    }
+    if (typeof value !== "object" || value === null)
+        return;
+    for (const [key, item] of Object.entries(value)) {
+        if (key === "command" && typeof item === "string")
+            commands.push(item);
+        else
+            collectCommandStrings(item, commands);
+    }
+}
+function pluginReferences(content) {
+    return [...content.matchAll(PLUGIN_PATH_REFERENCE)].map((match) => match[1]);
+}
+function expandStaticPluginPathAliases(content) {
+    const aliases = new Map();
+    const parsed = parseShellCommand(content, { tolerateControlSyntax: true });
+    for (const token of parsed.segments.flat()) {
+        const assignment = token.match(/^([A-Za-z_][A-Za-z0-9_]*)=(\$(?:\{(?:CLAUDE_)?PLUGIN_ROOT\}|(?:CLAUDE_)?PLUGIN_ROOT)\/[A-Za-z0-9._/-]+)$/);
+        if (assignment)
+            aliases.set(assignment[1], assignment[2]);
+    }
+    if (aliases.size === 0)
+        return content;
+    return content.replace(/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g, (reference, bracedName, bareName) => (aliases.get(bracedName ?? bareName ?? "") ?? reference));
+}
+function pluginShellSyntaxMalformed(content) {
+    const parsed = spawnSync("bash", ["--noprofile", "--norc", "-n"], {
+        encoding: "utf8",
+        env: {
+            PATH: process.env.PATH ?? "",
+            HOME: process.env.HOME ?? "",
+            BASH_ENV: "",
+            ENV: "",
+        },
+        input: content,
+        timeout: 2_000,
+    });
+    return parsed.error !== undefined || parsed.status !== 0;
+}
+function pluginNodeSyntaxMalformed(artifact) {
+    if (![".cjs", ".js", ".mjs"].includes(extname(artifact)))
+        return false;
+    const parsed = spawnSync(process.execPath, ["--check", artifact], {
+        encoding: "utf8",
+        env: {
+            PATH: process.env.PATH ?? "",
+            HOME: process.env.HOME ?? "",
+        },
+        timeout: 2_000,
+    });
+    return parsed.error !== undefined || parsed.status !== 0;
+}
+function resolvePluginReference(root, relativePath) {
+    const absolute = resolve(root, relativePath);
+    return absolute.startsWith(`${resolve(root)}${sep}`) ? absolute : null;
+}
+function pathIsContained(root, candidate) {
+    return candidate === root || candidate.startsWith(`${root}${sep}`);
+}
+function readLegacyTextArtifact(path) {
+    let pathStats;
+    try {
+        pathStats = lstatSync(path);
+    }
+    catch {
+        return { kind: "missing" };
+    }
+    if (!pathStats.isFile())
+        return { kind: "unsafe", reason: "nonregular" };
+    if (pathStats.size > MAX_LEGACY_ARTIFACT_BYTES) {
+        return { kind: "unsafe", reason: "oversized" };
+    }
+    let descriptor;
+    try {
+        descriptor = openSync(path, fsConstants.O_RDONLY | fsConstants.O_NONBLOCK | fsConstants.O_NOFOLLOW);
+    }
+    catch {
+        return { kind: "missing" };
+    }
+    try {
+        const stats = fstatSync(descriptor);
+        if (!stats.isFile())
+            return { kind: "unsafe", reason: "nonregular" };
+        if (stats.size > MAX_LEGACY_ARTIFACT_BYTES) {
+            return { kind: "unsafe", reason: "oversized" };
+        }
+        const bytes = Buffer.alloc(Math.min(stats.size + 1, MAX_LEGACY_ARTIFACT_BYTES + 1));
+        let offset = 0;
+        while (offset < bytes.length) {
+            const count = readSync(descriptor, bytes, offset, bytes.length - offset, null);
+            if (count === 0)
+                break;
+            offset += count;
+        }
+        if (offset > MAX_LEGACY_ARTIFACT_BYTES) {
+            return { kind: "unsafe", reason: "oversized" };
+        }
+        const contentBytes = bytes.subarray(0, offset);
+        if (contentBytes.includes(0))
+            return { kind: "unsafe", reason: "binary" };
+        const content = contentBytes.toString("utf8");
+        if (content.includes("\uFFFD"))
+            return { kind: "unsafe", reason: "binary" };
+        return { kind: "text", content };
+    }
+    catch {
+        return { kind: "missing" };
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+function unsafeArtifactLabel(path, reason) {
+    return `${path} (${reason})`;
+}
+function inspectSettingsArtifacts(project, homePath, commands, inspection) {
+    const queue = [];
+    const queued = new Set();
+    let traversedArtifacts = 0;
+    const enqueue = (reference, depth = 0) => {
+        if (depth > MAX_LANGUAGE_DEPENDENCY_DEPTH) {
+            inspection.traversalLimitRoots.push(project);
+            return;
+        }
+        const lexicalPath = resolve(reference.path);
+        const lexicalRoot = resolve(reference.containmentRoot);
+        let canonicalRoot;
+        try {
+            canonicalRoot = realpathSync.native(lexicalRoot);
+        }
+        catch {
+            canonicalRoot = lexicalRoot;
+        }
+        if (!existsSync(lexicalPath)) {
+            if (pathIsContained(lexicalRoot, lexicalPath))
+                inspection.missing.push(lexicalPath);
+            else
+                inspection.escapedArtifacts.push(lexicalPath);
+            return;
+        }
+        let canonicalPath;
+        try {
+            canonicalPath = realpathSync.native(lexicalPath);
+        }
+        catch {
+            inspection.missing.push(lexicalPath);
+            return;
+        }
+        if (!pathIsContained(canonicalRoot, canonicalPath)) {
+            inspection.escapedArtifacts.push(lexicalPath);
+            return;
+        }
+        const queueKey = `${canonicalPath}:${reference.parserKind}:${reference.cwd}`;
+        if (queued.has(queueKey))
+            return;
+        queued.add(queueKey);
+        queue.push({ ...reference, path: canonicalPath, depth });
+    };
+    for (const command of commands) {
+        const scan = settingsArtifactReferences(command, project, homePath);
+        if (scan.malformed)
+            inspection.malformedCommands.push(command);
+        for (const inline of scan.inlineContents) {
+            for (const endpoint of retiredProducerPaths(inline.content, false, "node")) {
+                inspection.findings.push({ artifact: inline.source, endpoint });
+            }
+        }
+        for (const reference of scan.references) {
+            enqueue(reference);
+        }
+    }
+    while (queue.length > 0) {
+        if (traversedArtifacts >= MAX_LEGACY_ARTIFACTS_PER_ROOT) {
+            inspection.traversalLimitRoots.push(project);
+            break;
+        }
+        const queuedArtifact = queue.shift();
+        const artifact = queuedArtifact.path;
+        traversedArtifacts += 1;
+        const artifactRead = readLegacyTextArtifact(artifact);
+        if (artifactRead.kind === "missing") {
+            inspection.missing.push(artifact);
+            continue;
+        }
+        if (artifactRead.kind === "unsafe") {
+            if (artifactRead.reason !== "binary") {
+                inspection.unsafeArtifacts.push(unsafeArtifactLabel(artifact, artifactRead.reason));
+            }
+            continue;
+        }
+        const { content } = artifactRead;
+        inspection.inspected.push(artifact);
+        const parserKind = queuedArtifact.parserKind === "infer"
+            ? inferArtifactParserKind(artifact, content)
+            : queuedArtifact.parserKind;
+        const shellArtifact = parserKind === "shell";
+        for (const endpoint of retiredProducerPaths(content, shellArtifact, parserKind)) {
+            inspection.findings.push({ artifact, endpoint });
+        }
+        if (shellArtifact) {
+            const nestedScan = settingsArtifactReferences(content, project, homePath, queuedArtifact.cwd);
+            if (nestedScan.malformed)
+                inspection.malformedCommands.push(artifact);
+            for (const inline of nestedScan.inlineContents) {
+                for (const endpoint of retiredProducerPaths(inline.content, false, "node")) {
+                    inspection.findings.push({ artifact: inline.source, endpoint });
+                }
+            }
+            for (const reference of nestedScan.references)
+                enqueue(reference, queuedArtifact.depth + 1);
+        }
+        else if (parserKind === "node" || parserKind === "python") {
+            const dependencyScan = scanLanguageArtifactDependencies(artifact, content, parserKind, { project, homePath, cwd: dirname(artifact) });
+            if (dependencyScan.malformed)
+                inspection.malformedCommands.push(artifact);
+            for (const inline of dependencyScan.inlineContents) {
+                for (const endpoint of retiredProducerPaths(inline.content, false, "node")) {
+                    inspection.findings.push({ artifact: inline.source, endpoint });
+                }
+            }
+            for (const reference of dependencyScan.references) {
+                enqueue(reference, queuedArtifact.depth + 1);
+            }
+        }
+    }
+}
+function inspectLegacyRoot(project, homePath, target, inspection) {
+    const root = realpathSync.native(target.root);
+    const queue = [];
+    const queued = new Set();
+    const workspaceRoot = findWorkspaceRoot(root);
+    let traversedArtifacts = 0;
+    const enqueue = (path, required = false, containmentRoot = root, parserKind = "infer", cwd = project, depth = 0) => {
+        if (depth > MAX_LANGUAGE_DEPENDENCY_DEPTH) {
+            inspection.traversalLimitRoots.push(root);
+            return;
+        }
+        const canonicalContainmentRoot = realpathSync.native(containmentRoot);
+        const lexicalPath = resolve(path);
+        if (!existsSync(lexicalPath)) {
+            if (!pathIsContained(canonicalContainmentRoot, lexicalPath)) {
+                inspection.escapedArtifacts.push(lexicalPath);
+                return;
+            }
+            if (required)
+                inspection.missing.push(lexicalPath);
+            return;
+        }
+        let canonicalPath;
+        try {
+            canonicalPath = realpathSync.native(lexicalPath);
+        }
+        catch {
+            if (required)
+                inspection.missing.push(lexicalPath);
+            return;
+        }
+        if (!pathIsContained(canonicalContainmentRoot, canonicalPath)) {
+            inspection.escapedArtifacts.push(lexicalPath);
+            return;
+        }
+        const queueKey = `${canonicalPath}:${parserKind}:${cwd}`;
+        if (queued.has(queueKey))
+            return;
+        queued.add(queueKey);
+        queue.push({ path: canonicalPath, parserKind, cwd, depth });
+    };
+    const enqueuePluginReferences = (content, scan, cwd, depth = 0) => {
+        for (const relativePath of pluginReferences(content)) {
+            const referencedPath = resolvePluginReference(root, relativePath);
+            if (!referencedPath)
+                continue;
+            const candidate = (scan.artifacts ?? []).find((artifact) => (artifact.value.includes("PLUGIN_ROOT") && artifact.value.endsWith(relativePath)));
+            enqueue(referencedPath, true, root, candidate?.parserKind ?? "infer", candidate?.cwd ?? cwd, depth);
+        }
+    };
+    const enqueueSupportedReferences = (scan, fallbackCwd, depth = 0, containedInPluginRoot = false) => {
+        for (const candidate of scan.artifacts ?? []) {
+            if (candidate.value.includes("PLUGIN_ROOT"))
+                continue;
+            const resolved = candidate.nodeResolutionKind
+                ? resolveNodeSpecifierCandidate(candidate, !containedInPluginRoot)
+                : {
+                    reference: settingsArtifactReference(candidate.value, {
+                        project: candidate.project,
+                        homePath: candidate.homePath,
+                        cwd: candidate.cwd,
+                    }, true, candidate.parserKind) ?? undefined,
+                    malformed: false,
+                };
+            if (resolved.malformed) {
+                inspection.malformedCommands.push(candidate.value);
+                continue;
+            }
+            if (resolved.inlineContent) {
+                for (const endpoint of retiredProducerPaths(resolved.inlineContent.content, false, "node")) {
+                    inspection.findings.push({ artifact: resolved.inlineContent.source, endpoint });
+                }
+            }
+            if (resolved.reference) {
+                enqueue(resolved.reference.path, true, containedInPluginRoot ? root : resolved.reference.containmentRoot, resolved.reference.parserKind, resolved.reference.cwd ?? fallbackCwd, depth);
+            }
+        }
+    };
+    const enqueueCommand = (command) => {
+        for (const endpoint of retiredProducerPaths(command, true)) {
+            inspection.findings.push({ artifact: target.configPath ?? join(root, "hooks.json"), endpoint });
+        }
+        const commandScan = settingsArtifactTokens(command, 0, {
+            project,
+            homePath,
+            cwd: project,
+        });
+        if (commandScan.malformed)
+            inspection.malformedCommands.push(command);
+        enqueuePluginReferences(command, commandScan, project);
+        enqueueSupportedReferences(commandScan, project);
+        for (const token of commandScan.tokens) {
+            if (!isAbsolute(token))
+                continue;
+            const tokenRoot = pluginRootFromHookPath(token);
+            const candidate = (commandScan.artifacts ?? []).find((artifact) => artifact.value === token);
+            if (tokenRoot === root) {
+                enqueue(token, true, root, candidate?.parserKind ?? "infer", candidate?.cwd ?? project);
+            }
+        }
+    };
+    if (target.commands) {
+        if (target.configPath)
+            inspection.configsInspected.push(target.configPath);
+        for (const command of target.commands)
+            enqueueCommand(command);
+    }
+    if (target.inspectPluginConfig || !target.commands) {
+        const configPath = join(root, "hooks.json");
+        if (!existsSync(configPath)) {
+            inspection.missing.push(configPath);
+            enqueue(join(root, "hooks", "session-start"));
+        }
+        else {
+            inspection.configsInspected.push(configPath);
+            let canonicalConfigPath;
+            try {
+                canonicalConfigPath = realpathSync.native(configPath);
+            }
+            catch {
+                inspection.missing.push(configPath);
+                enqueue(join(root, "hooks", "session-start"));
+                canonicalConfigPath = "";
+            }
+            if (canonicalConfigPath && !pathIsContained(root, canonicalConfigPath)) {
+                inspection.escapedArtifacts.push(configPath);
+                enqueue(join(root, "hooks", "session-start"));
+                canonicalConfigPath = "";
+            }
+            if (canonicalConfigPath) {
+                const configRead = readLegacyTextArtifact(canonicalConfigPath);
+                if (configRead.kind === "unsafe") {
+                    inspection.unsafeArtifacts.push(unsafeArtifactLabel(configPath, configRead.reason));
+                    enqueue(join(root, "hooks", "session-start"));
+                }
+                else if (configRead.kind === "missing") {
+                    inspection.missing.push(configPath);
+                    enqueue(join(root, "hooks", "session-start"));
+                }
+                else
+                    try {
+                        const config = JSON.parse(configRead.content);
+                        const commands = [];
+                        collectCommandStrings(config, commands);
+                        for (const command of commands)
+                            enqueueCommand(command);
+                    }
+                    catch {
+                        inspection.malformedConfigs.push(configPath);
+                        enqueue(join(root, "hooks", "session-start"));
+                    }
+            }
+        }
+    }
+    while (queue.length > 0) {
+        if (traversedArtifacts >= MAX_LEGACY_ARTIFACTS_PER_ROOT) {
+            inspection.traversalLimitRoots.push(root);
+            break;
+        }
+        const queuedArtifact = queue.shift();
+        const artifact = queuedArtifact.path;
+        traversedArtifacts += 1;
+        const artifactRead = readLegacyTextArtifact(artifact);
+        if (artifactRead.kind === "missing") {
+            inspection.missing.push(artifact);
+            continue;
+        }
+        if (artifactRead.kind === "unsafe") {
+            inspection.unsafeArtifacts.push(unsafeArtifactLabel(artifact, artifactRead.reason));
+            continue;
+        }
+        const { content } = artifactRead;
+        inspection.inspected.push(artifact);
+        const parserKind = queuedArtifact.parserKind === "infer"
+            ? inferArtifactParserKind(artifact, content)
+            : queuedArtifact.parserKind;
+        const shellArtifact = parserKind === "shell";
+        for (const endpoint of retiredProducerPaths(content, shellArtifact, parserKind)) {
+            inspection.findings.push({ artifact, endpoint });
+        }
+        if (shellArtifact) {
+            const expandedContent = expandStaticPluginPathAliases(content);
+            const artifactScan = settingsArtifactTokens(expandedContent, 0, {
+                project,
+                homePath,
+                cwd: dirname(artifact),
+            }, { tolerateControlSyntax: true });
+            if (pluginShellSyntaxMalformed(content))
+                inspection.malformedCommands.push(artifact);
+            enqueuePluginReferences(expandedContent, artifactScan, dirname(artifact), queuedArtifact.depth + 1);
+            enqueueSupportedReferences(artifactScan, dirname(artifact), queuedArtifact.depth + 1, true);
+        }
+        else if (parserKind === "node" || parserKind === "python") {
+            const dependencyScan = scanLanguageArtifactDependencies(artifact, content, parserKind, { project, homePath, cwd: dirname(artifact) }, false);
+            if (parserKind === "node"
+                ? pluginNodeSyntaxMalformed(artifact)
+                : dependencyScan.malformed)
+                inspection.malformedCommands.push(artifact);
+            for (const inline of dependencyScan.inlineContents) {
+                for (const endpoint of retiredProducerPaths(inline.content, false, "node")) {
+                    inspection.findings.push({ artifact: inline.source, endpoint });
+                }
+            }
+            for (const reference of dependencyScan.references) {
+                const relativeReference = relative(root, resolve(reference.path));
+                if (!relativeReference.startsWith(`..${sep}`)
+                    && relativeReference.split(sep).includes("node_modules"))
+                    continue;
+                enqueue(reference.path, true, root, reference.parserKind, reference.cwd, queuedArtifact.depth + 1);
+            }
+            for (const relativePath of pluginReferences(content)) {
+                const referencedPath = resolvePluginReference(root, relativePath);
+                if (referencedPath) {
+                    enqueue(referencedPath, true, root, parserKind, queuedArtifact.cwd, queuedArtifact.depth + 1);
+                }
+            }
+        }
+        else {
+            for (const relativePath of pluginReferences(content)) {
+                const referencedPath = resolvePluginReference(root, relativePath);
+                if (referencedPath) {
+                    enqueue(referencedPath, true, root, parserKind, queuedArtifact.cwd, queuedArtifact.depth + 1);
+                }
+            }
+        }
+        const relativeToRoot = artifact.startsWith(`${root}/`)
+            ? artifact.slice(root.length + 1)
+            : "";
+        const hookName = basename(relativeToRoot).replace(/\.js$/, "");
+        if (workspaceRoot && (relativeToRoot.startsWith("hooks/") || relativeToRoot.startsWith("dist/hooks/"))) {
+            enqueue(join(workspaceRoot, "packages", "devflow", "src", "hooks", `${hookName}.ts`), false, workspaceRoot);
+        }
+        if (relativeToRoot.startsWith("hooks/")) {
+            enqueue(join(root, "dist", "hooks", `${hookName}.js`));
+        }
+    }
+}
+function checkLegacyPaths(project, dependencies) {
+    const selection = selectActiveLegacyTargets(project, dependencies);
+    const inspection = {
+        configsInspected: [],
+        commandsInspected: [],
+        inspected: [],
+        missing: [],
+        malformedConfigs: [],
+        malformedCommands: [],
+        unsafeArtifacts: [],
+        traversalLimitRoots: [],
+        escapedArtifacts: [],
+        findings: [],
+    };
+    for (const configCommands of selection.configCommands) {
+        inspection.configsInspected.push(configCommands.path);
+        for (const command of configCommands.commands) {
+            inspection.commandsInspected.push({ configPath: configCommands.path, command });
+            for (const endpoint of retiredProducerPaths(command, true)) {
+                inspection.findings.push({ artifact: configCommands.path, endpoint });
+            }
+        }
+    }
+    inspectSettingsArtifacts(project, dependencies.homePath ?? homedir(), selection.configCommands.flatMap((source) => source.commands).filter((command) => (!selection.targets.some((target) => target.commands?.includes(command)))), inspection);
+    for (const target of selection.targets) {
+        inspectLegacyRoot(project, dependencies.homePath ?? homedir(), target, inspection);
+    }
+    const configsInspected = [...new Set(inspection.configsInspected)];
+    const inspected = [...new Set(inspection.inspected)];
+    const commandsInspected = inspection.commandsInspected.filter((entry, index, all) => (all.findIndex((candidate) => (candidate.configPath === entry.configPath && candidate.command === entry.command)) === index));
+    const missing = [...new Set(inspection.missing)];
+    const malformedConfigs = [...new Set(inspection.malformedConfigs)];
+    const malformedCommands = [...new Set(inspection.malformedCommands)];
+    const unsafeArtifacts = [...new Set(inspection.unsafeArtifacts)];
+    const traversalLimitRoots = [...new Set(inspection.traversalLimitRoots)];
+    const escapedArtifacts = [...new Set(inspection.escapedArtifacts)];
+    const findings = inspection.findings.filter((finding, index, all) => (all.findIndex((item) => (item.artifact === finding.artifact && item.endpoint === finding.endpoint)) === index));
+    const artifactResolutionFailed = missing.length > 0
+        || escapedArtifacts.length > 0
+        || unsafeArtifacts.length > 0;
+    const resolutionMethod = artifactResolutionFailed && !selection.method.endsWith("-unresolved")
+        ? `${selection.method}-unresolved`
+        : selection.method;
+    const metrics = [
+        {
+            key: "active_plugin_resolution",
+            value: resolutionMethod,
+            target: "resolved active DevFlow hook configuration",
+            ok: selection.ok && !artifactResolutionFailed,
+            severity: "warning",
+        },
+        {
+            key: "active_plugin_roots",
+            value: selection.targets.map((target) => target.root),
+            ok: true,
+            severity: "info",
+        },
+        {
+            key: "hooks_disabled",
+            value: selection.hooksDisabled,
+            ok: true,
+            severity: "info",
+        },
+        {
+            key: "malformed_active_settings",
+            value: selection.malformedSettings,
+            target: [],
+            ok: selection.malformedSettings.length === 0,
+            severity: "warning",
+        },
+        {
+            key: "malformed_plugin_metadata",
+            value: selection.malformedPluginMetadata,
+            target: [],
+            ok: selection.malformedPluginMetadata.length === 0,
+            severity: "warning",
+        },
+        {
+            key: "hook_configs_inspected",
+            value: configsInspected.length,
+            target: selection.hooksDisabled ? "hooks disabled" : ">= 1 hook config file",
+            ok: selection.hooksDisabled || configsInspected.length > 0,
+            severity: "warning",
+        },
+        {
+            key: "legacy_artifacts_inspected",
+            value: inspected.length + commandsInspected.length,
+            target: selection.hooksDisabled ? "hooks disabled" : ">= 1 active hook artifact",
+            ok: selection.hooksDisabled || inspected.length + commandsInspected.length > 0,
+            severity: "warning",
+        },
+        {
+            key: "missing_legacy_artifacts",
+            value: missing,
+            target: [],
+            ok: missing.length === 0,
+            severity: "warning",
+        },
+        {
+            key: "malformed_hook_configs",
+            value: malformedConfigs,
+            target: [],
+            ok: malformedConfigs.length === 0,
+            severity: "warning",
+        },
+        {
+            key: "malformed_hook_commands",
+            value: malformedCommands,
+            target: [],
+            ok: malformedCommands.length === 0,
+            severity: "warning",
+        },
+        {
+            key: "unsafe_legacy_artifacts",
+            value: unsafeArtifacts,
+            target: [],
+            ok: unsafeArtifacts.length === 0,
+            severity: "warning",
+        },
+        {
+            key: "legacy_artifact_traversal_limit",
+            value: traversalLimitRoots,
+            target: [],
+            ok: traversalLimitRoots.length === 0,
+            severity: "warning",
+        },
+        {
+            key: "escaped_legacy_artifacts",
+            value: escapedArtifacts.length,
+            target: 0,
+            ok: escapedArtifacts.length === 0,
+            severity: "warning",
+        },
+        {
+            key: "retired_producer_paths",
+            value: findings.length,
+            target: 0,
+            ok: findings.length === 0,
+            severity: "error",
+        },
+        {
+            key: "retired_producer_path_findings",
+            value: findings,
+            ok: true,
+            severity: "info",
+        },
+    ];
+    return { name: "Legacy paths", status: sectionStatus(metrics), metrics };
+}
+function loadAcceptanceManifest(dependencies) {
+    const moduleDir = dirname(fileURLToPath(import.meta.url));
+    const candidates = [...new Set([
+            dependencies.acceptanceManifestPath,
+            dependencies.env?.DEVFLOW_ACCEPTANCE_MANIFEST,
+            process.env.DEVFLOW_ACCEPTANCE_MANIFEST,
+            join(moduleDir, "..", "acceptance-manifest.json"),
+            join(moduleDir, "..", "..", "..", "..", "packages", "devflow", "acceptance-manifest.json"),
+            join(process.cwd(), "packages", "devflow", "acceptance-manifest.json"),
+        ].filter((path) => Boolean(path)))];
+    for (const path of candidates) {
+        if (!existsSync(path))
+            continue;
+        try {
+            return {
+                path,
+                manifest: JSON.parse(readFileSync(path, "utf8")),
+            };
+        }
+        catch (error) {
+            return { path, error: error.message };
+        }
+    }
+    return { error: `not found (${candidates.join(", ")})` };
+}
+function acceptanceManifestMetrics(dependencies) {
+    const loaded = loadAcceptanceManifest(dependencies);
+    if (!loaded.manifest) {
+        return {
+            metrics: [{
+                    key: "batch4_acceptance_manifest",
+                    value: loaded.error ?? "missing",
+                    target: "readable acceptance-manifest.json",
+                    ok: false,
+                    severity: "warning",
+                }],
+        };
+    }
+    const verifiedAt = Date.parse(loaded.manifest.verifiedAt);
+    const ageDays = Number.isFinite(verifiedAt)
+        ? ((dependencies.now ?? Date.now)() - verifiedAt) / DAY_MS
+        : Number.POSITIVE_INFINITY;
+    return {
+        manifest: loaded.manifest,
+        metrics: [
+            {
+                key: "batch4_acceptance_manifest",
+                value: loaded.path,
+                target: "schemaVersion 1",
+                ok: loaded.manifest.schemaVersion === 1,
+                severity: "error",
+            },
+            {
+                key: "acceptance_evidence_age_days",
+                value: Number.isFinite(ageDays) ? Number(ageDays.toFixed(2)) : "invalid timestamp",
+                target: "0-30",
+                ok: ageDays >= 0 && ageDays <= 30,
+                severity: "warning",
+            },
+        ],
+    };
+}
+function checkInjection(project, dependencies) {
+    const metrics = [];
+    const configPath = join(project, ".devflow", "config.json");
+    let injectionSetting = "default-enabled";
+    if (existsSync(configPath)) {
+        try {
+            const config = JSON.parse(readFileSync(configPath, "utf8"));
+            injectionSetting = config.sessionStart?.injectMemories ?? "default-enabled";
+        }
+        catch (error) {
+            metrics.push({
+                key: "session_start_config",
+                value: error.message,
+                target: "valid .devflow/config.json",
+                ok: false,
+                severity: "error",
+            });
+        }
+    }
+    const injectionEnabled = injectionSetting !== false;
+    metrics.push({
+        key: "session_start_memory_injection",
+        value: injectionSetting,
+        target: "enabled or configured budget",
+        ok: injectionEnabled,
+        severity: "warning",
+    });
+    const memoryPath = join(project, ".devflow", "memory", "memories.db");
+    if (!existsSync(memoryPath)) {
+        metrics.push({
+            key: "explicit_memory_channel",
+            value: "memory database missing",
+            target: "observations.source supports explicit_intent",
+            ok: false,
+            severity: "warning",
+        });
+    }
+    else {
+        let db;
+        try {
+            db = doctorOpenDatabase(memoryPath, dependencies);
+            const columns = doctorTableExists(db, "observations")
+                ? db.prepare("PRAGMA table_info(observations)").all()
+                    .map(column => column.name)
+                : [];
+            const supportsExplicitIntent = columns.includes("source");
+            metrics.push({
+                key: "explicit_memory_channel",
+                value: supportsExplicitIntent ? "explicit_intent source available" : "source column missing",
+                target: "explicit_intent source available",
+                ok: supportsExplicitIntent,
+                severity: "warning",
+            });
+            if (supportsExplicitIntent) {
+                metrics.push({
+                    key: "explicit_memory_observations",
+                    value: doctorCount(db, "SELECT COUNT(*) count FROM observations WHERE source = 'explicit_intent'"),
+                    ok: true,
+                    severity: "info",
+                });
+            }
+        }
+        catch (error) {
+            metrics.push({
+                key: "explicit_memory_channel_read",
+                value: error.message,
+                target: "readable memory database",
+                ok: false,
+                severity: "error",
+            });
+        }
+        finally {
+            db?.close();
+        }
+    }
+    return { name: "Injection", status: sectionStatus(metrics), metrics };
+}
+function checkMemoryQuality(project, dependencies) {
+    const metrics = [];
+    const memoryPath = join(project, ".devflow", "memory", "memories.db");
+    if (!existsSync(memoryPath)) {
+        metrics.push({ key: "memories_db", value: "missing", target: memoryPath, ok: false, severity: "warning" });
+        return { name: "Memory quality", status: sectionStatus(metrics), metrics };
+    }
+    let db;
+    try {
+        db = doctorOpenDatabase(memoryPath, dependencies);
+        if (!doctorTableExists(db, "memories")) {
+            metrics.push({ key: "memories_schema", value: "memories table missing", target: "Batch 3 memory schema", ok: false, severity: "warning" });
+        }
+        else {
+            const cutoff = (dependencies.now ?? Date.now)() - 7 * DAY_MS;
+            const sources = db.prepare(`
+        SELECT source, COUNT(*) count FROM memories
+        WHERE created_at >= ? GROUP BY source ORDER BY source
+      `).all(cutoff);
+            const access = db.prepare(`
+        SELECT
+          SUM(CASE WHEN access_count = 0 THEN 1 ELSE 0 END) never_accessed,
+          SUM(CASE WHEN access_count > 0 THEN 1 ELSE 0 END) accessed
+        FROM memories WHERE status = 'active'
+      `).get();
+            metrics.push({
+                key: "memory_sources_7d",
+                value: Object.fromEntries(sources.map(row => [row.source, Number(row.count)])),
+                ok: true,
+                severity: "info",
+            });
+            metrics.push({
+                key: "memory_access_distribution",
+                value: {
+                    neverAccessed: Number(access?.never_accessed ?? 0),
+                    accessed: Number(access?.accessed ?? 0),
+                },
+                ok: true,
+                severity: "info",
+            });
+        }
+    }
+    catch (error) {
+        metrics.push({ key: "memory_quality_read", value: error.message, target: "readable memory database", ok: false, severity: "error" });
+    }
+    finally {
+        db?.close();
+    }
+    return { name: "Memory quality", status: sectionStatus(metrics), metrics };
+}
+function checkKnowledgeQuality(project, dependencies) {
+    const metrics = [];
+    const knowledgePath = join(project, ".devflow", "knowledge", "knowledge.db");
+    if (!existsSync(knowledgePath)) {
+        metrics.push({ key: "knowledge_db", value: "missing", target: knowledgePath, ok: false, severity: "warning" });
+        return { name: "Knowledge quality", status: sectionStatus(metrics), metrics };
+    }
+    let db;
+    try {
+        db = doctorOpenDatabase(knowledgePath, dependencies);
+        if (!doctorTableExists(db, "knowledge_chunks")) {
+            metrics.push({ key: "knowledge_schema", value: "knowledge_chunks missing", target: "Batch 3 knowledge schema", ok: false, severity: "warning" });
+        }
+        else {
+            const lengths = db.prepare("SELECT length(content) length FROM knowledge_chunks ORDER BY length(content)").all().map(row => Number(row.length));
+            const p95Index = Math.max(0, Math.ceil(lengths.length * 0.95) - 1);
+            const p95 = lengths.length === 0 ? 0 : lengths[p95Index];
+            metrics.push({ key: "knowledge_chunk_length_p95", value: p95, target: "<= 3000", ok: p95 <= 3000, severity: "warning" });
+            const fts = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'knowledge_fts'").get();
+            const trigram = /tokenize\s*=\s*['\"]?trigram/i.test(fts?.sql ?? "");
+            metrics.push({ key: "knowledge_fts_tokenizer", value: trigram ? "trigram" : "missing/non-trigram", target: "trigram", ok: trigram, severity: "warning" });
+        }
+    }
+    catch (error) {
+        metrics.push({ key: "knowledge_quality_read", value: error.message, target: "readable knowledge database", ok: false, severity: "error" });
+    }
+    finally {
+        db?.close();
+    }
+    return { name: "Knowledge quality", status: sectionStatus(metrics), metrics };
+}
+function checkContract(dependencies) {
+    const { manifest, metrics } = acceptanceManifestMetrics(dependencies);
+    const surfaces = manifest?.contract?.surfaces ?? [];
+    metrics.push({ key: "contract_surfaces", value: surfaces, target: ["cli", "http", "mcp", "hook"], ok: manifest?.contract?.status === "green" && surfaces.length === 4, severity: "error" });
+    metrics.push({ key: "contract_test_files", value: manifest?.contract?.tests?.length ?? 0, target: 4, ok: manifest?.contract?.tests?.length === 4, severity: "warning" });
+    return { name: "Contract", status: sectionStatus(metrics), metrics };
+}
+function checkDeadcode(dependencies) {
+    const { manifest, metrics } = acceptanceManifestMetrics(dependencies);
+    const actionable = manifest?.deadcode?.actionableExports;
+    metrics.push({ key: "ts_prune_actionable_exports", value: actionable ?? "missing", target: 0, ok: manifest?.deadcode?.status === "green" && actionable === 0, severity: "error" });
+    metrics.push({ key: "ts_prune_allowlisted_exports", value: manifest?.deadcode?.allowlistedExports ?? "missing", ok: true, severity: "info" });
+    return { name: "Deadcode", status: sectionStatus(metrics), metrics };
+}
+function checkDataFace(dependencies) {
+    const { manifest, metrics } = acceptanceManifestMetrics(dependencies);
+    const adapters = manifest?.dataFace?.sharedAdapters ?? [];
+    metrics.push({
+        key: "shared_retrieval_adapters",
+        value: adapters,
+        target: ["getProjectContextResult", "getMemoryResult", "getKnowledgeResult"],
+        ok: manifest?.dataFace?.status === "green" && adapters.length === 3,
+        severity: "error",
+    });
+    return { name: "Data face", status: sectionStatus(metrics), metrics };
+}
+async function defaultHttpGet(url) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 500);
+    try {
+        const response = await fetch(url, { signal: controller.signal });
+        return { status: response.status };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function checkUiReachability(dependencies) {
+    const { manifest, metrics } = acceptanceManifestMetrics(dependencies);
+    const routes = manifest?.ui?.routes ?? [];
+    metrics.push({ key: "dashboard_routes", value: routes.length, target: ">= 13", ok: manifest?.ui?.status === "green" && routes.length >= 13, severity: "warning" });
+    const port = dependencies.env?.PORT ?? process.env.PORT ?? "13337";
+    const healthUrl = `http://127.0.0.1:${port}/api/health`;
+    try {
+        const response = await (dependencies.httpGet ?? defaultHttpGet)(healthUrl);
+        metrics.push({ key: "dashboard_server_health", value: { url: healthUrl, status: response.status }, target: "HTTP 200", ok: response.status === 200, severity: "warning" });
+    }
+    catch (error) {
+        metrics.push({ key: "dashboard_server_health", value: error.message, target: "HTTP 200", ok: false, severity: "warning" });
+    }
+    return { name: "UI reachability", status: sectionStatus(metrics), metrics };
+}
+export async function runStructuredDoctor(options = {}, dependencies = {}) {
+    const requestedProject = options.project ?? process.cwd();
+    const canonical = canonicalizeProject(requestedProject);
+    const sections = [
+        checkIsolation(requestedProject, dependencies),
+        checkDistill(canonical.path, dependencies),
+        checkLegacyPaths(canonical.path, dependencies),
+        checkVectors(canonical.path, dependencies),
+        checkTelemetry(canonical.path, Boolean(options.strict), dependencies),
+        checkInjection(canonical.path, dependencies),
+        checkMemoryQuality(canonical.path, dependencies),
+        checkKnowledgeQuality(canonical.path, dependencies),
+        checkContract(dependencies),
+        checkDeadcode(dependencies),
+        checkBenchmark(dependencies),
+        checkDataFace(dependencies),
+        checkRuntimeSecurity(dependencies),
+        await checkUiReachability(dependencies),
+        checkHookPathHealth(dependencies),
+    ];
+    const exitCode = options.strict && sections.some((section) => section.status !== "green")
+        ? 1
+        : 0;
+    return { sections, exitCode };
+}
+export function runDoctor(options, dependencies = {}) {
+    return options === undefined
+        ? runLegacyDoctorReport()
+        : runStructuredDoctor(options, dependencies);
+}
+function displayValue(value) {
+    const json = JSON.stringify(value);
+    return json === undefined ? String(value) : json;
+}
+export function renderDoctorText(result) {
+    const lines = [];
+    for (const section of result.sections) {
+        const label = `[${section.status.toUpperCase()}]`;
+        const color = section.status === "green"
+            ? chalk.green
+            : section.status === "yellow"
+                ? chalk.yellow
+                : chalk.red;
+        lines.push(`${color(label)} ${chalk.bold(section.name)}`);
+        for (const metric of section.metrics) {
+            const target = metric.target === undefined
+                ? ""
+                : ` (target: ${displayValue(metric.target)})`;
+            lines.push(`  ${metric.ok ? "OK" : "FAIL"} ${metric.key}: ${displayValue(metric.value)}${target}`);
+        }
+    }
+    return lines.join("\n");
+}
+export async function runDoctorCommand(options = {}, io = {
+    stdout: (output) => console.log(output),
+    stderr: (output) => console.error(output),
+}, dependencies = {}) {
+    const result = await runStructuredDoctor(options, dependencies);
+    io.stdout(options.json ? JSON.stringify(result) : renderDoctorText(result));
+    return result.exitCode;
+}
+async function createLegacyEngines(project) {
+    const { createEngines } = await import("@devflow-tools/context-engine");
+    return createEngines(project);
+}
+export async function runLegacyDoctorReport(project = process.cwd()) {
+    const { codegraph, graph, memory, knowledge, workflow, data } = await createLegacyEngines(project);
     const stats = codegraph.getStats();
     const graphOutput = graph.export();
     let workflowCount = 0;
     try {
-        const wfList = await workflow.list();
-        workflowCount = wfList.length;
+        workflowCount = (await workflow.list()).length;
     }
     catch {
-        // workflow engine not initialized
+        // Legacy report treats an unavailable workflow engine as empty.
     }
     let memoryReady = false;
     let userPrefs = 0;
     try {
         const mem = await memory.getAll();
-        memoryReady = !!mem?.project;
-        const prefs = mem?.user ?? {};
-        userPrefs = Object.keys(prefs).length;
+        memoryReady = Boolean(mem?.project);
+        userPrefs = Object.keys(mem?.user ?? {}).length;
     }
     catch {
-        // memory engine not initialized
+        // Legacy report treats an unavailable memory engine as uninitialized.
     }
     let knowledgeSources = 0;
     try {
-        const sources = await knowledge.getSources();
-        knowledgeSources = sources.length;
+        knowledgeSources = (await knowledge.getSources()).length;
     }
     catch {
-        // knowledge engine not initialized
+        // Legacy report treats an unavailable knowledge engine as empty.
     }
-    // Layer 4: Fetch local tool call telemetry
     let toolCallStats = { total: 0, byTool: {} };
     try {
         toolCallStats = await data.getToolCallStats();
     }
     catch {
-        // data provider not available or table not yet created
+        // Legacy report tolerates missing telemetry tables.
     }
     const server = await serverStatus();
     let readyScore = 0;
@@ -65,33 +3940,18 @@ export async function runDoctor() {
             totalSymbols: stats.nodeCount,
             indexing: codegraph.isIndexing(),
         },
-        graph: {
-            nodes: graphOutput.nodes.length,
-            edges: graphOutput.edges.length,
-        },
-        memory: {
-            projectReady: memoryReady,
-            userPrefs,
-        },
-        knowledge: {
-            sources: knowledgeSources,
-        },
-        plugins: {
-            installed: 0,
-            names: [],
-        },
-        workflows: {
-            registered: workflowCount,
-        },
-        server: {
-            running: server.running,
-        },
+        graph: { nodes: graphOutput.nodes.length, edges: graphOutput.edges.length },
+        memory: { projectReady: memoryReady, userPrefs },
+        knowledge: { sources: knowledgeSources },
+        plugins: { installed: 0, names: [] },
+        workflows: { registered: workflowCount },
+        server: { running: server.running },
         toolCalls: toolCallStats,
         readyScore,
     };
 }
 export async function runDoctorAudit() {
-    const { data } = await createEngines(process.cwd());
+    const { data } = await createLegacyEngines(process.cwd());
     const secret = await data.auditGetSecret();
     const entries = await data.auditGetAll();
     let prevHash = createHash("sha256").update("genesis").digest("hex");
@@ -109,7 +3969,7 @@ export async function runDoctorAudit() {
     return { valid: true, brokenAt: null, entryCount: entries.length };
 }
 export async function runDoctorAuditFix() {
-    const { data } = await createEngines(process.cwd());
+    const { data } = await createLegacyEngines(process.cwd());
     const secret = await data.auditGetSecret();
     const entries = await data.auditGetAll();
     let prevHash = createHash("sha256").update("genesis").digest("hex");
@@ -122,22 +3982,25 @@ export async function runDoctorAuditFix() {
     return { rebuilt: true };
 }
 export async function runDoctorViolations(last) {
-    const { data } = await createEngines(process.cwd());
+    const { data } = await createLegacyEngines(process.cwd());
     const entries = await data.auditGetAll();
-    let violations = entries.filter((e) => e.decision !== "allow");
+    let violations = entries.filter((entry) => entry.decision !== "allow");
     if (last) {
         const match = last.match(/^(\d+)([dh])$/);
         if (match) {
-            const num = parseInt(match[1], 10);
-            const unit = match[2];
-            const cutoffMs = unit === "d" ? num * 86400000 : num * 3600000;
+            const amount = Number.parseInt(match[1], 10);
+            const cutoffMs = match[2] === "d" ? amount * 86_400_000 : amount * 3_600_000;
             const cutoff = Date.now() - cutoffMs;
-            violations = violations.filter((v) => v.ts > cutoff);
+            violations = violations.filter((entry) => entry.ts > cutoff);
         }
     }
     return {
-        violations: violations.map((v) => ({
-            tool: v.tool, decision: v.decision, ruleId: v.ruleId, ts: v.ts, sessionId: v.sessionId,
+        violations: violations.map((entry) => ({
+            tool: entry.tool,
+            decision: entry.decision,
+            ruleId: entry.ruleId,
+            ts: entry.ts,
+            sessionId: entry.sessionId,
         })),
     };
 }
@@ -146,8 +4009,7 @@ export function runDoctorReceipts() {
     const sessionId = createHash("sha256").update(process.cwd()).digest("hex").slice(0, 16);
     const receiptFile = `${receiptDir}/${sessionId}.json`;
     try {
-        const raw = readFileSync(receiptFile, "utf-8");
-        return { sessionId, data: JSON.parse(raw) };
+        return { sessionId, data: JSON.parse(readFileSync(receiptFile, "utf8")) };
     }
     catch {
         return { sessionId, data: null };