@gaodefa/daocore 2026.5.30 → 2026.5.32

package/dist/repair-sequencing-C0jrL5pw.js

@@ -1,640 +0,0 @@
-import { s as normalizeOptionalLowercaseString } from "./string-coerce-DyL154ka.js";
-import { t as sanitizeForLog } from "./ansi-4r6vVvJt.js";
-import { n as resolveDaoCorePackageRootSync } from "./daocore-root-CYblIxyF.js";
-import { v as resolveStateDir } from "./paths-ZwPDM6zn.js";
-import { d as resolveConfigDir, p as resolveUserPath } from "./utils-CNnMhEDp.js";
-import { n as normalizeAccountId } from "./account-id-B32J-iNN.js";
-import { s as normalizeStringEntries } from "./string-normalization-DiPHgdft.js";
-import { r as normalizeChatChannelId } from "./ids-tIRTU44E.js";
-import { O as GENERATED_BUNDLED_CHANNEL_CONFIG_METADATA, T as validateConfigObjectWithPlugins } from "./io-Ct2JqgbR.js";
-import { a as normalizeAnyChannelId } from "./registry-B9-P6D_z.js";
-import { t as applyPluginAutoEnable } from "./plugin-auto-enable-Br-E4AcW.js";
-import { a as readChannelAllowFromStore } from "./pairing-store-D6kKcRDP.js";
-import { a as resolveChannelDmAllowFrom, s as setCanonicalDmAllowFrom } from "./dm-access-CP9QxWdj.js";
-import { a as collectChannelDoctorRepairMutations, s as createChannelDoctorEmptyAllowlistPolicyHooks } from "./channel-doctor-C0bfjbLe.js";
-import { s as isUpdatePackageSwapInProgress } from "./update-phase-ueCdL5Fr.js";
-import { t as asObjectRecord } from "./object-BsiS9JXh.js";
-import { t as repairMissingConfiguredPluginInstalls } from "./missing-configured-plugin-install-CmkDxaVY.js";
-import { t as maybeRepairLegacyOAuthSidecarProfiles } from "./doctor-auth-oauth-sidecar-BOHihH2a.js";
-import { t as applyDoctorConfigMutation } from "./config-mutation-state-C1d35St0.js";
-import { i as maybeRepairStaleManagedNpmBundledPlugins, t as maybeRepairManagedNpmDaoCorePeerLinks } from "./doctor-plugin-registry-YhmEUHK5.js";
-import { t as getDoctorChannelCapabilities } from "./channel-capabilities-BwifmsiQ.js";
-import { n as maybeRepairOpenPolicyAllowFrom, r as resolveAllowFromMode } from "./open-policy-allowfrom-COUqeXce.js";
-import { n as hasAllowFromEntries, t as scanEmptyAllowlistPolicyWarnings } from "./empty-allowlist-scan-Bp1RT76m.js";
-import { n as maybeRepairBundledPluginLoadPaths } from "./bundled-plugin-load-paths-iGWSnzfW.js";
-import { n as maybeRepairCodexRoutes } from "./codex-route-warnings-HCiSExTa.js";
-import { r as maybeRepairContextEngineHostCompatibility } from "./context-engine-host-compat-BNPAIK9F.js";
-import { r as maybeRepairExecSafeBinProfiles } from "./exec-safe-bins-Ch9gKne5.js";
-import { n as maybeRepairLegacyToolsBySenderKeys } from "./legacy-tools-by-sender-CMjarUwp.js";
-import { r as removeStalePluginRuntimeSymlinks } from "./plugin-runtime-symlinks-CrPtl3gN.js";
-import { n as repairStaleOAuthProfileShadows } from "./stale-oauth-profile-shadows-D2B_FdzA.js";
-import { r as maybeRepairStalePluginConfig } from "./stale-plugin-config-DJyr0723.js";
-import { n as maybeRepairStaleSubagentAllowlists } from "./stale-subagent-allowlist-CV7jsUvt.js";
-import path from "node:path";
-import fs from "node:fs/promises";
-//#region src/commands/doctor/shared/allowfrom-fallback-migration.ts
-const PSEUDO_CHANNEL_KEYS = new Set([
-	"defaults",
-	"modelByChannel",
-	"tools"
-]);
-const ACCOUNT_SCHEMA_WILDCARD = "*";
-const CHANNEL_GROUP_ALLOW_FROM_PATH = ["groupAllowFrom"];
-const ACCOUNT_GROUP_ALLOW_FROM_PATH = [
-	"accounts",
-	ACCOUNT_SCHEMA_WILDCARD,
-	"groupAllowFrom"
-];
-function isDisabled(record) {
-	return record.enabled === false;
-}
-function normalizeAllowFrom(raw) {
-	return Array.from(new Set(normalizeStringEntries(Array.isArray(raw) ? raw : [])));
-}
-function readGroupAllowFrom(record) {
-	return normalizeAllowFrom(record.groupAllowFrom);
-}
-function readDmAllowFrom(params) {
-	return normalizeAllowFrom(resolveChannelDmAllowFrom({
-		account: params.account,
-		parent: params.parent,
-		mode: getDoctorChannelCapabilities(params.channelName).dmAllowFromMode
-	}));
-}
-function readOwnDmAllowFrom(params) {
-	return normalizeAllowFrom(resolveChannelDmAllowFrom({
-		account: params.account,
-		mode: getDoctorChannelCapabilities(params.channelName).dmAllowFromMode
-	}));
-}
-function findGeneratedChannelConfigSchema(channelName) {
-	const normalizedChannelId = normalizeAnyChannelId(channelName);
-	return GENERATED_BUNDLED_CHANNEL_CONFIG_METADATA.find((entry) => entry.channelId === channelName || entry.channelId === normalizedChannelId)?.schema;
-}
-function schemaAllowsConfigPath(schema, path) {
-	if (path.length === 0) return true;
-	const node = asObjectRecord(schema);
-	if (!node) return true;
-	const anyOf = Array.isArray(node.anyOf) ? node.anyOf : void 0;
-	if (anyOf) return anyOf.some((branch) => schemaAllowsConfigPath(branch, path));
-	const oneOf = Array.isArray(node.oneOf) ? node.oneOf : void 0;
-	if (oneOf) return oneOf.some((branch) => schemaAllowsConfigPath(branch, path));
-	const allOf = Array.isArray(node.allOf) ? node.allOf : void 0;
-	if (allOf) return allOf.every((branch) => schemaAllowsConfigPath(branch, path));
-	const [segment, ...rest] = path;
-	const properties = asObjectRecord(node.properties);
-	if (segment !== ACCOUNT_SCHEMA_WILDCARD && properties && Object.prototype.hasOwnProperty.call(properties, segment)) return schemaAllowsConfigPath(properties[segment], rest);
-	const additionalProperties = node.additionalProperties;
-	if (additionalProperties === false) return false;
-	if (additionalProperties && typeof additionalProperties === "object") return schemaAllowsConfigPath(additionalProperties, rest);
-	return true;
-}
-function generatedSchemaAllowsGroupAllowFrom(channelName, path) {
-	const schema = findGeneratedChannelConfigSchema(channelName);
-	return !schema || schemaAllowsConfigPath(schema, path);
-}
-function migrateRecord(params) {
-	if (!params.canWriteGroupAllowFrom) return false;
-	if (readGroupAllowFrom(params.account).length > 0) return false;
-	if (params.parent && params.parentHadGroupAllowFrom) return false;
-	const ownAllowFrom = readOwnDmAllowFrom(params);
-	if (params.parent && ownAllowFrom.length === 0 && readGroupAllowFrom(params.parent).length > 0) return false;
-	const allowFrom = readDmAllowFrom(params);
-	if (allowFrom.length === 0) return false;
-	params.account.groupAllowFrom = allowFrom;
-	const noun = allowFrom.length === 1 ? "entry" : "entries";
-	params.changes.push(`${params.prefix}.groupAllowFrom: copied ${allowFrom.length} sender ${noun} from allowFrom for explicit group allowlist.`);
-	return true;
-}
-function maybeRepairGroupAllowFromFallback(cfg) {
-	if (!asObjectRecord(cfg.channels)) return {
-		config: cfg,
-		changes: []
-	};
-	const next = structuredClone(cfg);
-	const nextChannels = next.channels;
-	const changes = [];
-	for (const [channelName, channelConfig] of Object.entries(nextChannels)) {
-		if (PSEUDO_CHANNEL_KEYS.has(channelName) || !channelConfig || typeof channelConfig !== "object") continue;
-		if (isDisabled(channelConfig)) continue;
-		if (!getDoctorChannelCapabilities(channelName).groupAllowFromFallbackToAllowFrom) continue;
-		const hadGroupAllowFrom = readGroupAllowFrom(channelConfig).length > 0;
-		migrateRecord({
-			account: channelConfig,
-			canWriteGroupAllowFrom: generatedSchemaAllowsGroupAllowFrom(channelName, CHANNEL_GROUP_ALLOW_FROM_PATH),
-			channelName,
-			changes,
-			prefix: `channels.${channelName}`
-		});
-		const accounts = asObjectRecord(channelConfig.accounts);
-		if (!accounts) continue;
-		const canWriteAccountGroupAllowFrom = generatedSchemaAllowsGroupAllowFrom(channelName, ACCOUNT_GROUP_ALLOW_FROM_PATH);
-		for (const [accountId, accountConfig] of Object.entries(accounts)) {
-			const account = asObjectRecord(accountConfig);
-			if (!account || isDisabled(account)) continue;
-			migrateRecord({
-				account,
-				canWriteGroupAllowFrom: canWriteAccountGroupAllowFrom,
-				channelName,
-				changes,
-				parent: channelConfig,
-				parentHadGroupAllowFrom: hadGroupAllowFrom,
-				prefix: `channels.${channelName}.accounts.${accountId}`
-			});
-		}
-	}
-	if (changes.length === 0) return {
-		config: cfg,
-		changes: []
-	};
-	return {
-		config: next,
-		changes
-	};
-}
-//#endregion
-//#region src/commands/doctor/shared/allowlist-policy-repair.ts
-async function maybeRepairAllowlistPolicyAllowFrom(cfg) {
-	const channels = cfg.channels;
-	if (!channels || typeof channels !== "object") return {
-		config: cfg,
-		changes: []
-	};
-	const next = structuredClone(cfg);
-	const changes = [];
-	const applyRecoveredAllowFrom = (params) => {
-		const count = params.allowFrom.length;
-		const noun = count === 1 ? "entry" : "entries";
-		setCanonicalDmAllowFrom({
-			entry: params.account,
-			mode: params.mode,
-			allowFrom: params.allowFrom,
-			pathPrefix: params.prefix,
-			changes,
-			reason: `restored ${count} sender ${noun} from pairing store (dmPolicy="allowlist").`
-		});
-	};
-	const recoverAllowFromForAccount = async (params) => {
-		const dmEntry = params.account.dm;
-		const dm = dmEntry && typeof dmEntry === "object" && !Array.isArray(dmEntry) ? dmEntry : void 0;
-		if ((params.account.dmPolicy ?? dm?.policy) !== "allowlist") return;
-		const topAllowFrom = params.account.allowFrom;
-		const nestedAllowFrom = dm?.allowFrom;
-		if (hasAllowFromEntries(topAllowFrom) || hasAllowFromEntries(nestedAllowFrom)) return;
-		const normalizedChannelId = normalizeOptionalLowercaseString(normalizeChatChannelId(params.channelName) ?? params.channelName);
-		if (!normalizedChannelId) return;
-		const normalizedAccountId = normalizeAccountId(params.accountId) || "default";
-		const fromStore = await readChannelAllowFromStore(normalizedChannelId, process.env, normalizedAccountId).catch(() => []);
-		const recovered = Array.from(new Set(normalizeStringEntries(fromStore)));
-		if (recovered.length === 0) return;
-		applyRecoveredAllowFrom({
-			account: params.account,
-			allowFrom: recovered,
-			mode: resolveAllowFromMode(params.channelName),
-			prefix: params.prefix
-		});
-	};
-	const nextChannels = next.channels;
-	for (const [channelName, channelConfig] of Object.entries(nextChannels)) {
-		if (!channelConfig || typeof channelConfig !== "object") continue;
-		if (channelConfig.enabled === false) continue;
-		await recoverAllowFromForAccount({
-			channelName,
-			account: channelConfig,
-			prefix: `channels.${channelName}`
-		});
-		const accounts = asObjectRecord(channelConfig.accounts);
-		if (!accounts) continue;
-		for (const [accountId, accountConfig] of Object.entries(accounts)) {
-			if (!accountConfig || typeof accountConfig !== "object") continue;
-			if (accountConfig.enabled === false) continue;
-			await recoverAllowFromForAccount({
-				channelName,
-				account: accountConfig,
-				accountId,
-				prefix: `channels.${channelName}.accounts.${accountId}`
-			});
-		}
-	}
-	if (changes.length === 0) return {
-		config: cfg,
-		changes: []
-	};
-	return {
-		config: next,
-		changes
-	};
-}
-//#endregion
-//#region src/commands/doctor/shared/invalid-plugin-config.ts
-const PLUGIN_CONFIG_ISSUE_RE = /^plugins\.entries\.([^.]+)\.config(?:\.|$)/;
-function scanInvalidPluginConfig(cfg) {
-	const validation = validateConfigObjectWithPlugins(cfg);
-	if (validation.ok) return [];
-	const hits = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const issue of validation.issues) {
-		if (!issue.message.startsWith("invalid config:")) continue;
-		const pluginId = issue.path.match(PLUGIN_CONFIG_ISSUE_RE)?.[1];
-		if (!pluginId || seen.has(pluginId)) continue;
-		seen.add(pluginId);
-		hits.push({
-			pluginId,
-			pathLabel: `plugins.entries.${pluginId}.config`
-		});
-	}
-	return hits;
-}
-function maybeRepairInvalidPluginConfig(cfg) {
-	const hits = scanInvalidPluginConfig(cfg);
-	if (hits.length === 0) return {
-		config: cfg,
-		changes: []
-	};
-	const next = structuredClone(cfg);
-	const entries = asObjectRecord(next.plugins?.entries);
-	if (!entries) return {
-		config: cfg,
-		changes: []
-	};
-	const quarantined = [];
-	for (const hit of hits) {
-		const entry = asObjectRecord(entries[hit.pluginId]);
-		if (!entry) continue;
-		if ("config" in entry) delete entry.config;
-		entry.enabled = false;
-		quarantined.push(hit.pluginId);
-	}
-	if (quarantined.length === 0) return {
-		config: cfg,
-		changes: []
-	};
-	return {
-		config: next,
-		changes: [sanitizeForLog(`- plugins.entries: quarantined ${quarantined.length} invalid plugin config${quarantined.length === 1 ? "" : "s"} (${quarantined.join(", ")})`)]
-	};
-}
-//#endregion
-//#region src/commands/doctor/shared/plugin-dependency-cleanup.ts
-const LEGACY_DIRECT_CHILD_NAMES = new Set(["plugin-runtime-deps", "bundled-plugin-runtime-deps"]);
-function uniqueSorted(values) {
-	return [...new Set([...values].filter((value) => typeof value === "string" && value.length > 0).map((value) => path.resolve(value)))].toSorted((left, right) => left.localeCompare(right));
-}
-function splitPathList(value) {
-	return value ? value.split(path.delimiter).map((entry) => entry.trim()).filter(Boolean) : [];
-}
-function hasParentPathSegment(value) {
-	return value.split(/[\\/]+/u).includes("..");
-}
-async function pathExists(targetPath) {
-	try {
-		await fs.lstat(targetPath);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function isRuntimeDependencyMarkerName(name) {
-	return name === ".daocore-runtime-deps.json" || name === ".daocore-runtime-deps-stamp.json" || name.startsWith(".daocore-runtime-deps-");
-}
-function isInstallStageDebrisName(name) {
-	return /^\.daocore-install-stage(?:-.+)?$/u.test(name);
-}
-function isLegacyDependencyDebrisName(name) {
-	return isRuntimeDependencyMarkerName(name) || name === ".daocore-pnpm-store" || name === ".daocore-install-backups" || isInstallStageDebrisName(name);
-}
-function isExpectedLegacyCleanupTargetName(name) {
-	return name === "node_modules" || LEGACY_DIRECT_CHILD_NAMES.has(name) || isLegacyDependencyDebrisName(name);
-}
-async function isFile(targetPath) {
-	return (await fs.lstat(targetPath).catch(() => null))?.isFile() === true;
-}
-function isPathInsideRoot(candidate, root) {
-	const relativePath = path.relative(root, candidate);
-	return relativePath === "" || !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
-}
-async function collectDirectChildren(root) {
-	return (await fs.readdir(root, { withFileTypes: true }).catch(() => [])).map((entry) => path.join(root, entry.name));
-}
-async function isDirectoryInCleanupRoot(candidate, cleanupRootRealPath) {
-	const stat = await fs.lstat(candidate).catch(() => null);
-	if (!stat?.isDirectory() && !stat?.isSymbolicLink()) return false;
-	const realPath = await fs.realpath(candidate).catch(() => null);
-	return realPath !== null && isPathInsideRoot(realPath, cleanupRootRealPath);
-}
-async function collectLegacyExtensionDebris(extensionsRoot, cleanupRootRealPath) {
-	if (!await isDirectoryInCleanupRoot(extensionsRoot, cleanupRootRealPath)) return [];
-	const pluginDirs = await fs.readdir(extensionsRoot, { withFileTypes: true }).catch(() => []);
-	const targets = [];
-	for (const entry of pluginDirs) {
-		if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
-		const pluginRoot = path.join(extensionsRoot, entry.name);
-		if (!await isDirectoryInCleanupRoot(pluginRoot, cleanupRootRealPath)) continue;
-		const children = await collectDirectChildren(pluginRoot);
-		const hasRuntimeDepsMarker = children.some((childPath) => isRuntimeDependencyMarkerName(path.basename(childPath)));
-		for (const childPath of children) {
-			const basename = path.basename(childPath);
-			if (basename === "node_modules" && hasRuntimeDepsMarker) {
-				targets.push(childPath);
-				continue;
-			}
-			if (isLegacyDependencyDebrisName(basename)) targets.push(childPath);
-		}
-	}
-	return targets;
-}
-function collectCleanupRootPaths(env, packageRoot) {
-	const stateDirectoryRoots = splitPathList(env.STATE_DIRECTORY).map((entry) => resolveUserPath(entry, env));
-	return uniqueSorted([
-		resolveStateDir(env),
-		resolveConfigDir(env),
-		packageRoot,
-		...stateDirectoryRoots
-	]);
-}
-async function collectExistingCleanupRoots(cleanupRootPaths) {
-	const roots = [];
-	for (const rootPath of cleanupRootPaths) {
-		if (!(await fs.stat(rootPath).catch(() => null))?.isDirectory()) continue;
-		const realPath = await fs.realpath(rootPath).catch(() => null);
-		if (realPath === null) continue;
-		roots.push({ realPath });
-	}
-	return roots;
-}
-function collectExplicitStageTargets(env) {
-	return splitPathList(env.DAOCORE_PLUGIN_STAGE_DIR).map((entry) => ({
-		kind: "explicit-stage",
-		path: resolveUserPath(entry, env),
-		rawPath: entry
-	}));
-}
-async function hasDaoCoreRenameResidue(root) {
-	const nodeModulesRoot = path.join(root, "node_modules");
-	if (await isFile(path.join(nodeModulesRoot, ".daocore-rename-tmp"))) return true;
-	const entries = await fs.readdir(nodeModulesRoot, { withFileTypes: true }).catch(() => []);
-	for (const entry of entries) {
-		if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
-		const entryPath = path.join(nodeModulesRoot, entry.name);
-		if (await isFile(path.join(entryPath, ".daocore-rename-tmp"))) return true;
-		if (!entry.name.startsWith("@")) continue;
-		const scopedEntries = await fs.readdir(entryPath, { withFileTypes: true }).catch(() => []);
-		for (const scopedEntry of scopedEntries) {
-			if (!scopedEntry.isDirectory() || scopedEntry.isSymbolicLink()) continue;
-			if (await isFile(path.join(entryPath, scopedEntry.name, ".daocore-rename-tmp"))) return true;
-		}
-	}
-	return false;
-}
-async function hasExplicitStageDebrisProof(root) {
-	if ((await collectDirectChildren(root)).some((childPath) => isRuntimeDependencyMarkerName(path.basename(childPath)))) return true;
-	return await hasDaoCoreRenameResidue(root);
-}
-function filterLegacyStaleRootCandidates(targets, cleanupRootPaths) {
-	const safeTargets = [];
-	const warnings = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const target of targets) {
-		const targetPath = path.resolve(target.path);
-		if (seen.has(targetPath)) continue;
-		seen.add(targetPath);
-		if (target.kind === "explicit-stage") {
-			if (target.rawPath && hasParentPathSegment(target.rawPath)) {
-				warnings.push(`Skipped legacy plugin dependency state ${targetPath}: parent path segments are not allowed`);
-				continue;
-			}
-			safeTargets.push({
-				...target,
-				path: targetPath
-			});
-			continue;
-		}
-		if (!isExpectedLegacyCleanupTargetName(path.basename(targetPath))) {
-			warnings.push(`Skipped legacy plugin dependency state ${targetPath}: unexpected path name`);
-			continue;
-		}
-		if (!cleanupRootPaths.some((rootPath) => isPathInsideRoot(targetPath, rootPath))) {
-			warnings.push(`Skipped legacy plugin dependency state ${targetPath}: outside DaoCore cleanup roots`);
-			continue;
-		}
-		safeTargets.push({
-			...target,
-			path: targetPath
-		});
-	}
-	return {
-		targets: safeTargets.toSorted((left, right) => left.path.localeCompare(right.path)),
-		warnings
-	};
-}
-async function resolveSafeRemovalTarget(target, cleanupRoots) {
-	const targetPath = path.resolve(target.path);
-	const stat = await fs.lstat(targetPath).catch(() => null);
-	if (target.kind === "explicit-stage" && stat?.isSymbolicLink()) return { warning: `Skipped legacy plugin dependency state ${targetPath}: symbolic link roots are not removed` };
-	const realPath = await fs.realpath(targetPath).catch(() => null);
-	if (realPath === null) return { warning: `Skipped legacy plugin dependency state ${targetPath}: could not resolve path` };
-	if (target.kind === "explicit-stage") {
-		if (!isInstallStageDebrisName(path.basename(targetPath)) && !await hasExplicitStageDebrisProof(targetPath)) return { warning: `Skipped legacy plugin dependency state ${targetPath}: unexpected path name` };
-		return { target: targetPath };
-	}
-	if (!cleanupRoots.some((root) => isPathInsideRoot(realPath, root.realPath))) return { warning: `Skipped legacy plugin dependency state ${targetPath}: resolved outside DaoCore cleanup roots` };
-	return { target: targetPath };
-}
-async function prepareCleanupTargets(targets, cleanupRoots) {
-	const removalTargets = [];
-	const staleRoots = [];
-	const warnings = [];
-	for (const target of targets) {
-		if (!await pathExists(target.path)) continue;
-		const safeTarget = await resolveSafeRemovalTarget(target, cleanupRoots);
-		if ("warning" in safeTarget) {
-			warnings.push(safeTarget.warning);
-			continue;
-		}
-		removalTargets.push(safeTarget.target);
-		staleRoots.push(safeTarget.target);
-	}
-	return {
-		removalTargets: uniqueSorted(removalTargets),
-		staleRoots: uniqueSorted(staleRoots),
-		warnings
-	};
-}
-async function collectLegacyPluginDependencyTargetEntries(env = process.env, options = {}) {
-	const packageRoot = options.packageRoot ?? resolveDaoCorePackageRootSync({
-		argv1: process.argv[1],
-		moduleUrl: import.meta.url,
-		cwd: process.cwd()
-	});
-	const roots = uniqueSorted([
-		resolveStateDir(env),
-		resolveConfigDir(env),
-		packageRoot
-	]);
-	const stateDirectoryRoots = splitPathList(env.STATE_DIRECTORY).map((entry) => ({
-		kind: "legacy",
-		path: path.join(resolveUserPath(entry, env), "plugin-runtime-deps")
-	}));
-	const targets = [
-		...collectExplicitStageTargets(env),
-		...stateDirectoryRoots,
-		...roots.flatMap((root) => [...[...LEGACY_DIRECT_CHILD_NAMES].map((name) => ({
-			kind: "legacy",
-			path: path.join(root, name)
-		})), {
-			kind: "legacy",
-			path: path.join(root, ".local", "bundled-plugin-runtime-deps")
-		}])
-	];
-	for (const root of roots) {
-		const rootRealPath = await fs.realpath(root).catch(() => null);
-		if (rootRealPath === null) continue;
-		targets.push(...(await collectLegacyExtensionDebris(path.join(root, "extensions"), rootRealPath)).map((targetPath) => ({
-			kind: "legacy",
-			path: targetPath
-		})));
-		targets.push(...(await collectLegacyExtensionDebris(path.join(root, "dist", "extensions"), rootRealPath)).map((targetPath) => ({
-			kind: "legacy",
-			path: targetPath
-		})));
-	}
-	return targets.toSorted((left, right) => left.path.localeCompare(right.path));
-}
-async function cleanupLegacyPluginDependencyState(params) {
-	const env = params.env ?? process.env;
-	const changes = [];
-	const warnings = [];
-	const packageRoot = params.packageRoot ?? resolveDaoCorePackageRootSync({
-		argv1: process.argv[1],
-		moduleUrl: import.meta.url,
-		cwd: process.cwd()
-	});
-	const targets = await collectLegacyPluginDependencyTargetEntries(env, { packageRoot });
-	const cleanupRootPaths = collectCleanupRootPaths(env, packageRoot);
-	const cleanupRoots = await collectExistingCleanupRoots(cleanupRootPaths);
-	const staleRootCandidates = filterLegacyStaleRootCandidates(targets, cleanupRootPaths);
-	warnings.push(...staleRootCandidates.warnings);
-	const preparedTargets = await prepareCleanupTargets(staleRootCandidates.targets, cleanupRoots);
-	warnings.push(...preparedTargets.warnings);
-	const staleSymlinks = await removeStalePluginRuntimeSymlinks(packageRoot, { staleRoots: preparedTargets.staleRoots });
-	changes.push(...staleSymlinks.changes);
-	warnings.push(...staleSymlinks.warnings);
-	for (const target of preparedTargets.removalTargets) try {
-		await fs.rm(target, {
-			recursive: true,
-			force: true
-		});
-		changes.push(`Removed legacy plugin dependency state: ${target}`);
-	} catch (error) {
-		warnings.push(`Failed to remove legacy plugin dependency state ${target}: ${String(error)}`);
-	}
-	return {
-		changes,
-		warnings
-	};
-}
-//#endregion
-//#region src/commands/doctor/repair-sequencing.ts
-async function runDoctorRepairSequence(params) {
-	let state = params.state;
-	const changeNotes = [];
-	const warningNotes = [];
-	const env = params.env ?? process.env;
-	const sanitizeLines = (lines) => lines.map((line) => sanitizeForLog(line)).join("\n");
-	const applyMutation = (mutation) => {
-		if (mutation.changes.length > 0) {
-			changeNotes.push(sanitizeLines(mutation.changes));
-			state = applyDoctorConfigMutation({
-				state,
-				mutation,
-				shouldRepair: true
-			});
-		}
-		if (mutation.warnings && mutation.warnings.length > 0) warningNotes.push(sanitizeLines(mutation.warnings));
-	};
-	for (const mutation of await collectChannelDoctorRepairMutations({
-		cfg: state.candidate,
-		doctorFixCommand: params.doctorFixCommand,
-		env
-	})) applyMutation(mutation);
-	applyMutation(maybeRepairBundledPluginLoadPaths(state.candidate, env));
-	maybeRepairStaleManagedNpmBundledPlugins({
-		config: state.candidate,
-		env,
-		prompter: { shouldRepair: true }
-	});
-	await maybeRepairManagedNpmDaoCorePeerLinks({
-		config: state.candidate,
-		env,
-		prompter: { shouldRepair: true }
-	});
-	const codexRouteRepair = maybeRepairCodexRoutes({
-		cfg: state.candidate,
-		env,
-		shouldRepair: true
-	});
-	applyMutation({
-		config: codexRouteRepair.cfg,
-		changes: codexRouteRepair.changes,
-		warnings: codexRouteRepair.warnings
-	});
-	applyMutation(await maybeRepairContextEngineHostCompatibility({
-		cfg: state.candidate,
-		doctorFixCommand: params.doctorFixCommand,
-		env
-	}));
-	const missingConfiguredPluginInstallRepair = await repairMissingConfiguredPluginInstalls({
-		cfg: state.candidate,
-		env
-	});
-	if (missingConfiguredPluginInstallRepair.changes.length > 0) {
-		changeNotes.push(sanitizeLines(missingConfiguredPluginInstallRepair.changes));
-		applyMutation(applyPluginAutoEnable({
-			config: state.candidate,
-			env
-		}));
-	}
-	if (missingConfiguredPluginInstallRepair.warnings.length > 0) warningNotes.push(sanitizeLines(missingConfiguredPluginInstallRepair.warnings));
-	const failedPluginIds = missingConfiguredPluginInstallRepair.failedPluginIds ?? [];
-	const hasUnscopedInstallRepairWarnings = missingConfiguredPluginInstallRepair.warnings.length > 0 && failedPluginIds.length === 0;
-	if (!isUpdatePackageSwapInProgress(env) && !hasUnscopedInstallRepairWarnings) applyMutation(maybeRepairStalePluginConfig(state.candidate, env, { preservePluginIds: failedPluginIds }));
-	applyMutation(maybeRepairInvalidPluginConfig(state.candidate));
-	applyMutation(await maybeRepairAllowlistPolicyAllowFrom(state.candidate));
-	applyMutation(maybeRepairOpenPolicyAllowFrom(state.candidate));
-	applyMutation(maybeRepairGroupAllowFromFallback(state.candidate));
-	applyMutation(maybeRepairStaleSubagentAllowlists(state.candidate));
-	const emptyAllowlistWarnings = scanEmptyAllowlistPolicyWarnings(state.candidate, {
-		doctorFixCommand: params.doctorFixCommand,
-		...createChannelDoctorEmptyAllowlistPolicyHooks({
-			cfg: state.candidate,
-			env
-		})
-	});
-	if (emptyAllowlistWarnings.length > 0) warningNotes.push(sanitizeLines(emptyAllowlistWarnings));
-	applyMutation(maybeRepairLegacyToolsBySenderKeys(state.candidate));
-	applyMutation(maybeRepairExecSafeBinProfiles(state.candidate));
-	const pluginDependencyCleanup = await cleanupLegacyPluginDependencyState({ env });
-	if (pluginDependencyCleanup.changes.length > 0) changeNotes.push(sanitizeLines(pluginDependencyCleanup.changes));
-	if (pluginDependencyCleanup.warnings.length > 0) warningNotes.push(sanitizeLines(pluginDependencyCleanup.warnings));
-	const legacyOAuthSidecarRepair = await maybeRepairLegacyOAuthSidecarProfiles({
-		cfg: state.candidate,
-		prompter: { confirmAutoFix: async () => true },
-		emitNotes: false,
-		env
-	});
-	if (legacyOAuthSidecarRepair.changes.length > 0) changeNotes.push(sanitizeLines(legacyOAuthSidecarRepair.changes));
-	if (legacyOAuthSidecarRepair.warnings.length > 0) warningNotes.push(sanitizeLines(legacyOAuthSidecarRepair.warnings));
-	const staleOAuthShadowRepair = await repairStaleOAuthProfileShadows({
-		cfg: state.candidate,
-		env
-	});
-	if (staleOAuthShadowRepair.changes.length > 0) changeNotes.push(sanitizeLines(staleOAuthShadowRepair.changes));
-	if (staleOAuthShadowRepair.warnings.length > 0) warningNotes.push(sanitizeLines(staleOAuthShadowRepair.warnings));
-	return {
-		state,
-		changeNotes,
-		warningNotes
-	};
-}
-//#endregion
-export { runDoctorRepairSequence };