@geonosis/doctor 1.1.0 → 1.3.0

package/dist/{chunk-CG2LN4VW.js → chunk-7BRGHYQR.js}

@@ -23,19 +23,28 @@ var walk = (dir, onFile) => {
   }
 };
 var parse = (path) => JSON.parse(readFileSync(path, "utf8"));
+var stringsOf = (value) => Array.isArray(value) ? value.filter((one) => typeof one === "string") : [];
+var rulesOf = (value) => typeof value === "object" && value !== null ? value : {};
+var overridesOf = (value) => Array.isArray(value) ? value.filter((one) => typeof one === "object" && one !== null).map((one) => ({ files: stringsOf(one.files), rules: rulesOf(one.rules) })) : [];
 var readConfig = (path, root) => {
   const dir = join(path, "..");
   const relative = relativePath(root, path);
   try {
     const config = parse(path);
-    const jsPlugins = Array.isArray(config.jsPlugins) ? config.jsPlugins.filter((one) => typeof one === "string") : [];
-    const rules = typeof config.rules === "object" && config.rules !== null ? config.rules : {};
-    return { dir, jsPlugins, path, relative, rules };
+    return {
+      dir,
+      jsPlugins: stringsOf(config.jsPlugins),
+      overrides: overridesOf(config.overrides),
+      path,
+      relative,
+      rules: rulesOf(config.rules)
+    };
   } catch (error) {
     return {
       dir,
       error: `could not read it: ${error.message}`,
       jsPlugins: [],
+      overrides: [],
       path,
       relative,
       rules: {}
@@ -63,6 +72,14 @@ var discoverWorkspaces = (root) => {
   });
   return found.toSorted((a, b) => a.relative.localeCompare(b.relative));
 };
+var TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
+var testFilesUnder = (dir) => {
+  const found = [];
+  walk(dir, (path, name) => {
+    if (TEST_FILE.test(name)) found.push(path);
+  });
+  return found;
+};
 var readRatchet = (root) => {
   const path = join(root, RATCHET_FILE);
   try {
@@ -324,7 +341,28 @@ import { existsSync as existsSync2, readFileSync as readFileSync3, realpathSync
 import { createRequire } from "module";
 import { dirname, join as join3 } from "path";
 import { pathToFileURL } from "url";
-var resolveFrom = (dir, specifier) => createRequire(join3(dir, "noop.js")).resolve(specifier);
+var packageNameOf = (specifier) => {
+  const parts2 = specifier.split("/");
+  return specifier.startsWith("@") ? parts2.slice(0, 2).join("/") : parts2[0] ?? specifier;
+};
+var resolveFrom = (dir, specifier) => {
+  if (specifier.startsWith(".") || specifier.startsWith("/")) {
+    return createRequire(join3(dir, "noop.js")).resolve(specifier);
+  }
+  const name = packageNameOf(specifier);
+  let at = dir;
+  for (; ; ) {
+    if (existsSync2(join3(at, "node_modules", name, "package.json"))) {
+      return createRequire(join3(at, "noop.js")).resolve(specifier);
+    }
+    const parent = dirname(at);
+    if (parent === at) break;
+    at = parent;
+  }
+  throw new DoctorError(
+    `${specifier} does not resolve from ${dir} \u2014 no node_modules on the way up carries ${name}`
+  );
+};
 var packageDirOf = (entry, name) => {
   let dir = dirname(entry);
   for (; ; ) {
@@ -353,13 +391,17 @@ var pluginVersionOf = async (entry) => {
   }
   return version;
 };
+var filesOf = (answer) => Array.isArray(answer.files) ? answer.files : [answer];
 var probesOf = async (entry, plugin) => {
   const loaded = await import(pathToFileURL(entry).href);
   return Object.fromEntries(
-    Object.entries(loaded.default?.rules ?? {}).filter(([, rule]) => typeof rule?.probe === "function").map(([name, rule]) => [
-      `${plugin}/${name}`,
-      rule.probe
-    ])
+    Object.entries(loaded.default?.rules ?? {}).filter(([, rule]) => typeof rule?.probe === "function").map(([name, rule]) => {
+      const declared = rule.probe;
+      return [
+        `${plugin}/${name}`,
+        (options) => filesOf(declared(options))
+      ];
+    })
   );
 };
 var corpusOfPlugin = (from, specifier) => join3(packageDirOf(resolveFrom(from, specifier), specifier), "corpus");
@@ -373,15 +415,80 @@ var real = (path) => {
 var relativeToRoot = (root, path) => relativePath(real(root), real(path));
 
 // src/drift.ts
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { closeSync, existsSync as existsSync3, openSync, readdirSync as readdirSync2, readFileSync as readFileSync4, readSync } from "fs";
+import { homedir } from "os";
 import { join as join4, sep as sep2 } from "path";
+
+// src/overrides.ts
+var SPECIAL = /* @__PURE__ */ new Set(["$", "(", ")", "+", ".", "/", "@", "\\", "^", "|"]);
+var globToRegExp = (glob) => {
+  let source = "";
+  for (let at = 0; at < glob.length; at += 1) {
+    const character = glob[at] ?? "";
+    if (character === "*") {
+      if (glob[at + 1] === "*") {
+        if (glob[at + 2] === "/") {
+          source += "(?:[^/]*/)*";
+          at += 2;
+        } else {
+          source += ".*";
+          at += 1;
+        }
+      } else {
+        source += "[^/]*";
+      }
+      continue;
+    }
+    if (character === "?") {
+      source += "[^/]";
+      continue;
+    }
+    if (character === "{") {
+      source += "(?:";
+      continue;
+    }
+    if (character === "}") {
+      source += ")";
+      continue;
+    }
+    if (character === ",") {
+      source += "|";
+      continue;
+    }
+    source += SPECIAL.has(character) ? `\\${character}` : character;
+  }
+  return new RegExp(`^${source}$`);
+};
+var matchesGlob = (glob, path) => {
+  const here = globToRegExp(glob);
+  const name = path.slice(path.lastIndexOf("/") + 1);
+  return here.test(path) || !glob.includes("/") && here.test(name);
+};
+var layersOf = (config, rule) => {
+  const layers = [];
+  if (rule in config.rules) layers.push({ files: [], level: config.rules[rule] });
+  for (const override of config.overrides ?? []) {
+    if (rule in override.rules) layers.push({ files: override.files, level: override.rules[rule] });
+  }
+  return layers;
+};
+var governing = (layers, path) => {
+  let found;
+  for (const layer of layers) {
+    if (layer.files.length === 0 || layer.files.some((glob) => matchesGlob(glob, path))) {
+      found = layer;
+    }
+  }
+  return found;
+};
+
+// src/drift.ts
 var WORKFLOWS = ".github/workflows";
 var SETTINGS = ".claude/settings.json";
 var GEONOSIS = "geonosis.json";
 var LAW = "CLAUDE.md";
 var CEILING = 200;
 var SWITCHED_OFF = /^\s*if:\s*(?:\$\{\{\s*)?false\b/m;
-var TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 var finding3 = (subject, verdict, message) => ({
   check: "drift",
   message,
@@ -427,7 +534,7 @@ var holds = (parent, child) => child === parent || child.startsWith(`${parent}${
 var ownersOf = (path, workspaces) => workspaces.filter((one) => holds(one.dir, path)).toSorted((a, b) => b.dir.length - a.dir.length);
 var orphanTests = (root, workspaces) => {
   const orphaned = /* @__PURE__ */ new Map();
-  for (const path of filesUnder(root, (name) => TEST_FILE.test(name))) {
+  for (const path of testFilesUnder(root)) {
     const owners = ownersOf(path, workspaces);
     if (owners.some((one) => typeof one.manifest.scripts?.test === "string")) continue;
     const owner = owners[0];
@@ -446,6 +553,170 @@ var orphanTests = (root, workspaces) => {
     )
   );
 };
+var RUNS_A_FILE = /* @__PURE__ */ new Set(["bun", "node", "tsx"]);
+var BETWEEN_COMMANDS = /(?:&&|\|\||[;|&()])/;
+var NAMES_A_FILE = /\.[cm]?[jt]sx?$/;
+var SHELL_WOULD_REWRITE = /[$*?{}]/;
+var pathRunBy = (segment) => {
+  const words = segment.trim().split(/\s+/).filter((word) => word !== "");
+  for (const [index, word] of words.entries()) {
+    if (!RUNS_A_FILE.has(word)) continue;
+    const argument = words.slice(index + 1).find((one) => !one.startsWith("-"));
+    if (argument === void 0 || SHELL_WOULD_REWRITE.test(argument)) continue;
+    if (NAMES_A_FILE.test(argument)) return argument;
+  }
+  return void 0;
+};
+var pathsRunByScript = (script) => script.split(BETWEEN_COMMANDS).map(pathRunBy).filter((one) => one !== void 0);
+var scriptPaths = (workspaces) => {
+  const missing = workspaces.flatMap(
+    (one) => Object.entries(one.manifest.scripts ?? {}).flatMap(
+      ([name, script]) => pathsRunByScript(script).filter((path) => !existsSync3(join4(one.dir, path))).map((path) => ({ name, path, workspace: one }))
+    )
+  );
+  if (missing.length === 0) {
+    return [
+      finding3("script paths", "OK", "every file a script hands to bun, node or tsx is on disk")
+    ];
+  }
+  return missing.map(
+    ({ name, path, workspace }) => finding3(
+      workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`,
+      "FAIL",
+      `the "${name}" script runs ${path} and there is no such file \u2014 this script fails at that command, and every gate that calls it has been running nothing since the file went`
+    )
+  );
+};
+var workspaceBins = (workspaces) => {
+  const found = /* @__PURE__ */ new Map();
+  for (const one of workspaces) {
+    const declared = one.manifest.bin;
+    if (typeof declared === "string") {
+      const name = one.manifest.name;
+      if (name !== void 0) found.set(name.replace(/^@[^/]+\//, ""), one);
+      continue;
+    }
+    for (const name of Object.keys(declared ?? {})) found.set(name, one);
+  }
+  return found;
+};
+var linkedBins = (root, workspaces) => {
+  const bins = workspaceBins(workspaces);
+  if (bins.size === 0) {
+    return [finding3("workspace bins", "SKIP", "no workspace here declares a bin")];
+  }
+  const missing = workspaces.flatMap(
+    (one) => Object.entries(one.manifest.scripts ?? {}).flatMap(
+      ([script, body]) => [...new Set(body.split(/[\s;|&()]+/).filter((word) => bins.has(word)))].filter((name) => !existsSync3(join4(root, "node_modules/.bin", name))).map((name) => ({ name, script, workspace: one }))
+    )
+  );
+  if (missing.length === 0) {
+    return [
+      finding3(
+        "workspace bins",
+        "OK",
+        "every workspace bin a script names is linked under the root"
+      )
+    ];
+  }
+  return missing.map(
+    ({ name, script, workspace }) => finding3(
+      name,
+      "FAIL",
+      `the "${script}" script in ${workspace.relative === "" ? "package.json" : `${workspace.relative}/package.json`} calls it, ${bins.get(name)?.manifest.name ?? "a workspace"} declares it, and node_modules/.bin/${name} is not there \u2014 add that package as a dependency of the one whose script calls it, so the package manager links the bin`
+    )
+  );
+};
+var SHELLS_TO_PNPM = /(?:^|[\s;&|(])pnpm(?:\s|$)/;
+var NODE_OPTIONS = /(?:^|[\s;&|(])NODE_OPTIONS=/;
+var preloadAroundPnpm = (root, workspaces) => {
+  const counters = (readRatchet(root)?.counters ?? []).filter(
+    (entry) => typeof entry.command === "string" && SHELLS_TO_PNPM.test(entry.command)
+  );
+  if (counters.length === 0) return [];
+  const scripts = workspaces.flatMap(
+    (one) => Object.entries(one.manifest.scripts ?? {}).filter(([, body]) => NODE_OPTIONS.test(body)).map(([name]) => one.relative === "" ? name : `${one.relative}:${name}`)
+  );
+  if (scripts.length === 0) return [];
+  const named2 = counters.map((entry) => typeof entry.key === "string" ? entry.key : String(entry.counter)).join(", ");
+  const some = scripts.slice(0, 3).join(", ");
+  const rest = scripts.length > 3 ? ` and ${scripts.length - 3} more` : "";
+  return [
+    finding3(
+      "NODE_OPTIONS",
+      "WARN",
+      `${scripts.length} script(s) preload something through NODE_OPTIONS (${some}${rest}), and the "${named2}" counter(s) shell out to pnpm \u2014 a nested pnpm INHERITS the option and dies on it (a preloaded resolver patch sends it looking for a .pnpmfile.mjs that is not there). Run the ratchet outside those scripts, or unset NODE_OPTIONS for the nested call: env -u NODE_OPTIONS pnpm \u2026`
+    )
+  ];
+};
+var GATED_BY = /geonosis:gated-by:\s*(.+?)\s*(?:-->|\*\/|$)/m;
+var GENERATED_BY = /Generated by\s+`([^`]+)`/m;
+var CAN_CARRY_A_MARKER = /\.(?:mdc?|markdown|ya?ml|toml|[cm]?[jt]sx?|json[c5]?|txt|sh|mjs|cjs)$/i;
+var HEAD_BYTES = 4096;
+var markerIn = (path) => {
+  let handle;
+  try {
+    handle = openSync(path, "r");
+  } catch {
+    return void 0;
+  }
+  try {
+    const buffer = Buffer.alloc(HEAD_BYTES);
+    const read = readSync(handle, buffer, 0, HEAD_BYTES, 0);
+    const head = buffer.toString("utf8", 0, read);
+    const gate = GATED_BY.exec(head)?.[1];
+    if (gate !== void 0) return { gate };
+    const writer = GENERATED_BY.exec(head)?.[1];
+    return writer === void 0 ? void 0 : { writer };
+  } catch {
+    return void 0;
+  } finally {
+    closeSync(handle);
+  }
+};
+var everythingRun = (root, workspaces) => {
+  const scripts = workspaces.flatMap((one) => Object.values(one.manifest.scripts ?? {}));
+  const counters = (readRatchet(root)?.counters ?? []).map((entry) => String(entry.command ?? ""));
+  const workflows = filesUnder(
+    join4(root, WORKFLOWS),
+    (name) => name.endsWith(".yml") || name.endsWith(".yaml")
+  ).map((path) => {
+    try {
+      return readFileSync4(path, "utf8");
+    } catch {
+      return "";
+    }
+  });
+  return [...scripts, ...counters, ...workflows].join("\n");
+};
+var generatedFiles = (root, workspaces) => {
+  const marked = filesUnder(root, (name) => CAN_CARRY_A_MARKER.test(name)).map((path) => ({ marker: markerIn(path), path })).filter((one) => one.marker !== void 0);
+  if (marked.length === 0) {
+    return [
+      finding3(
+        "generated files",
+        "SKIP",
+        "nothing here says it was generated, so there is no write half here to look for a read half of"
+      )
+    ];
+  }
+  const run = everythingRun(root, workspaces);
+  return marked.map(({ marker, path }) => {
+    const at = relativePath(root, path);
+    if (!("gate" in marker)) {
+      return finding3(
+        at,
+        "FAIL",
+        `generated by \`${marker.writer}\` and it names no gate that reads it back. A written file no check reads is the write half of an instrument with no read half: it can drift from its source for ever and every gate stays green. Re-run \`${marker.writer}\` on a version that writes the \`geonosis:gated-by:\` marker, and run the gate it names`
+      );
+    }
+    return run.includes(marker.gate) ? finding3(at, "OK", `generated, and \`${marker.gate}\` reads it back`) : finding3(
+      at,
+      "FAIL",
+      `generated, and nothing here runs \`${marker.gate}\` \u2014 the gate it names. A written file no check reads is the write half of an instrument with no read half: it can drift from its source for ever and every gate stays green. Add \`${marker.gate}\` to a script, a counter or a workflow`
+    );
+  });
+};
 var readGeonosis = (root) => {
   const path = join4(root, GEONOSIS);
   if (!existsSync3(path)) return void 0;
@@ -458,13 +729,22 @@ var readGeonosis = (root) => {
 var law = (root, config) => {
   const declared = config?.law ?? {};
   const file = typeof declared.file === "string" ? declared.file : LAW;
-  const ceiling = typeof declared.maxLines === "number" ? declared.maxLines : CEILING;
   const path = join4(root, file);
   if (!existsSync3(path)) {
     return [finding3(file, "SKIP", "there is no law file here to measure")];
   }
   const source = readFileSync4(path, "utf8");
   const lines = source.split("\n").length - (source.endsWith("\n") ? 1 : 0);
+  if (typeof declared.maxLines !== "number") {
+    return [
+      finding3(
+        file,
+        "SKIP",
+        `${lines} lines, and no ceiling to measure them against \u2014 set law.maxLines in geonosis.json to have this asked (${CEILING} is what both source repos converged on)`
+      )
+    ];
+  }
+  const ceiling = declared.maxLines;
   return [
     lines > ceiling ? finding3(
       file,
@@ -473,20 +753,40 @@ var law = (root, config) => {
     ) : finding3(file, "OK", `${lines} lines, under the ceiling of ${ceiling}`)
   ];
 };
-var hooks = (root) => {
+var KIT_PLUGIN = "geonosis";
+var enablesKit = (path) => {
+  if (!existsSync3(path)) return false;
+  try {
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const enabled = parsed.enabledPlugins;
+    if (typeof enabled !== "object" || enabled === null) return false;
+    return Object.entries(enabled).some(
+      ([id, on]) => on !== false && id.split("@")[0] === KIT_PLUGIN
+    );
+  } catch {
+    return false;
+  }
+};
+var hooks = (root, userSettings) => {
   const path = join4(root, SETTINGS);
-  if (!existsSync3(path)) {
+  if (enablesKit(path)) {
+    return [finding3(SETTINGS, "OK", `\`enabledPlugins\` here enables the kit\u2019s plugin`)];
+  }
+  if (enablesKit(userSettings)) {
     return [
       finding3(
         SETTINGS,
-        "WARN",
-        "nothing here installs the kit\u2019s plugin, so none of the hooks, agents or skills reach this repo \u2014 the gates run, the method does not"
+        "OK",
+        `installed elsewhere \u2014 not this repo\u2019s to declare: \`enabledPlugins\` in ${userSettings} enables it for every repo on this machine`
       )
     ];
   }
-  const source = readFileSync4(path, "utf8");
   return [
-    source.includes("geonosis") ? finding3(SETTINGS, "OK", "it installs the kit\u2019s plugin") : finding3(SETTINGS, "WARN", "it names no geonosis plugin or marketplace")
+    finding3(
+      SETTINGS,
+      "WARN",
+      `nothing enables the kit\u2019s plugin, so none of the hooks, agents or skills reach this repo \u2014 the gates run, the method does not. What satisfies this: a "geonosis@<marketplace>" entry under \`enabledPlugins\` in ${SETTINGS} here, or the same in the user-scope ${userSettings}`
+    )
   ];
 };
 var READERS = {
@@ -504,7 +804,17 @@ var resolves = (root, name) => {
     return false;
   }
 };
-var blocks = (root, config, readers) => {
+var declaredAnywhere = (workspaces) => new Set(
+  workspaces.flatMap(
+    (one) => [
+      one.manifest.dependencies,
+      one.manifest.devDependencies,
+      one.manifest.optionalDependencies,
+      one.manifest.peerDependencies
+    ].flatMap((field) => Object.keys(field ?? {}))
+  )
+);
+var blocks = (root, config, readers, workspaces) => {
   if (config === void 0) {
     return [
       finding3(
@@ -514,19 +824,30 @@ var blocks = (root, config, readers) => {
       )
     ];
   }
+  const declaredPackages = declaredAnywhere(workspaces);
   return Object.entries(readers).flatMap(([block, name]) => {
     const declared = config[block] !== void 0;
+    const chosen = declaredPackages.has(name);
     const installed = resolves(root, name);
+    if (declared && !chosen) {
+      return [
+        finding3(
+          name,
+          "WARN",
+          `geonosis.json has a "${block}" block and no manifest here declares ${name} \u2014 nothing reads it${installed ? ", and the copy still under node_modules is what a stale install left behind" : ""}`
+        )
+      ];
+    }
     if (declared && !installed) {
       return [
         finding3(
           name,
           "WARN",
-          `geonosis.json has a "${block}" block and ${name} is not installed here \u2014 nothing reads it`
+          `geonosis.json has a "${block}" block, a manifest declares ${name}, and it does not resolve here \u2014 run the install`
         )
       ];
     }
-    if (!declared && installed) {
+    if (!declared && chosen && installed) {
       return [
         finding3(
           name,
@@ -535,29 +856,54 @@ var blocks = (root, config, readers) => {
         )
       ];
     }
+    if (!declared && installed) {
+      return [
+        finding3(
+          name,
+          "OK",
+          `${name} is here but no manifest declares it \u2014 a transitive dependency this repo did not choose, so it wants no "${block}" block`
+        )
+      ];
+    }
     return declared ? [finding3(name, "OK", `a "${block}" block, and ${name} to read it`)] : [];
   });
 };
-var pluginDirsConfigured = (root) => {
+var PLUGIN_DIR_RULE = "biological-architecture/no-unregistered-plugin-dir";
+var registryList = (value) => {
+  if (typeof value === "string") return [value];
+  if (Array.isArray(value) && value.every((one) => typeof one === "string")) return value;
+  return void 0;
+};
+var pluginDirsOf = (level) => {
+  const options = Array.isArray(level) ? level[1] : void 0;
+  const registry = registryList(options?.registry);
+  if (options?.roots === void 0 || registry === void 0) return void 0;
+  return { manifests: options.manifests ?? ["index.ts"], registry, roots: options.roots };
+};
+var pluginDirLayers = (root) => {
   const path = join4(root, ".oxlintrc.json");
-  if (!existsSync3(path)) return void 0;
-  try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
-    const rule = parsed.rules?.["biological-architecture/no-unregistered-plugin-dir"];
-    const options = Array.isArray(rule) ? rule[1] : void 0;
-    if (options?.roots === void 0 || typeof options.registry !== "string") return void 0;
-    return {
-      manifests: options.manifests ?? ["index.ts"],
-      registry: options.registry,
-      roots: options.roots
-    };
-  } catch {
-    return void 0;
+  if (!existsSync3(path)) return [];
+  const layers = [];
+  for (const layer of layersOf(readConfig(path, root), PLUGIN_DIR_RULE)) {
+    const dirs = pluginDirsOf(layer.level);
+    if (dirs !== void 0) layers.push({ dirs, files: layer.files });
   }
+  return layers;
+};
+var layerOver = (layers, root, relative) => {
+  const at = join4(root, relative);
+  const inside = readdirSync2(at, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => `${relative}/${entry.name}`);
+  const paths = inside.length === 0 ? [relative] : inside;
+  const wrapped = layers.map((layer) => ({ files: layer.files, level: layer.dirs }));
+  for (const path of paths) {
+    const found = governing(wrapped, path);
+    if (found !== void 0) return found.level;
+  }
+  return void 0;
 };
 var pluginDirs = (root) => {
-  const configured = pluginDirsConfigured(root);
-  if (configured === void 0) {
+  const layers = pluginDirLayers(root);
+  if (layers.length === 0) {
     return [
       finding3(
         "plugin directories",
@@ -566,50 +912,180 @@ var pluginDirs = (root) => {
       )
     ];
   }
-  const registryPath = join4(root, configured.registry);
-  if (!existsSync3(registryPath)) {
-    return [finding3(configured.registry, "FAIL", "the registry the rule names is not there")];
+  const missing = [...new Set(layers.flatMap((layer) => layer.dirs.registry))].filter(
+    (registry) => !existsSync3(join4(root, registry))
+  );
+  if (missing.length > 0) {
+    return missing.map(
+      (registry) => finding3(registry, "FAIL", "the registry the rule names is not there")
+    );
   }
-  const registry = readFileSync4(registryPath, "utf8");
-  const unreachable = [];
-  for (const rootDir of configured.roots) {
+  const source = /* @__PURE__ */ new Map();
+  const unreachable = /* @__PURE__ */ new Map();
+  for (const rootDir of new Set(layers.flatMap((layer) => layer.dirs.roots))) {
     const at = join4(root, rootDir);
     if (!existsSync3(at)) continue;
     for (const entry of readdirSync2(at, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
-      const hasManifest = configured.manifests.some(
-        (name) => existsSync3(join4(at, entry.name, name))
+      const relative = `${rootDir}/${entry.name}`;
+      const governs = layerOver(layers, root, relative);
+      if (governs === void 0) continue;
+      const key = governs.registry.join(", ");
+      const registry = source.get(key) ?? governs.registry.map((half) => readFileSync4(join4(root, half), "utf8")).join("\n");
+      source.set(key, registry);
+      const hasManifest = governs.manifests.some((name) => existsSync3(join4(at, entry.name, name)));
+      if (!hasManifest || registry.includes(entry.name)) continue;
+      unreachable.set(key, [...unreachable.get(key) ?? [], relative]);
+    }
+  }
+  return [...source.keys()].toSorted().map((registry) => {
+    const named2 = unreachable.get(registry) ?? [];
+    return named2.length === 0 ? finding3(registry, "OK", "every directory under the declared roots is named by it") : finding3(
+      registry,
+      "FAIL",
+      `${named2.length} directory(ies) it never names: ${named2.join(", ")}`
+    );
+  });
+};
+var WORKSPACE_YAML = "pnpm-workspace.yaml";
+var HOIST_KEY = "publicHoistPattern";
+var HOIST_REPAIR = "rm -rf node_modules/.modules.yaml node_modules/.pnpm-workspace-state-v1.json && pnpm install";
+var hoistPatterns = (root) => {
+  const path = join4(root, WORKSPACE_YAML);
+  if (!existsSync3(path)) return void 0;
+  const lines = readFileSync4(path, "utf8").split("\n");
+  const at = lines.findIndex((line) => new RegExp(`^${HOIST_KEY}\\s*:`).test(line));
+  if (at < 0) return void 0;
+  const patterns = [];
+  for (const line of lines.slice(at + 1)) {
+    if (/^\s*(?:#.*)?$/.test(line)) continue;
+    const item = /^\s+-\s*(.+?)\s*$/.exec(line);
+    if (item?.[1] === void 0) break;
+    patterns.push(item[1].replace(/^['"]|['"]$/g, ""));
+  }
+  return patterns;
+};
+var matching = (pattern) => new RegExp(`^${pattern.replaceAll(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*")}$`);
+var publicHoists = (root, workspaces) => {
+  const patterns = hoistPatterns(root);
+  if (patterns === void 0) {
+    return [
+      finding3(
+        WORKSPACE_YAML,
+        "SKIP",
+        `no ${HOIST_KEY} is declared here, so nothing claims a package should be linked at the root`
+      )
+    ];
+  }
+  const named2 = workspaces.flatMap(
+    (one) => one.dir === root || one.manifest.name === void 0 ? [] : [one.manifest.name]
+  );
+  return patterns.map((pattern) => {
+    const shape = matching(pattern);
+    const hoisted = named2.filter((name) => shape.test(name));
+    if (hoisted.length === 0) {
+      return finding3(
+        pattern,
+        "SKIP",
+        `this ${HOIST_KEY} matches no workspace package here, so what it should have linked at the root is a question this cannot answer`
       );
-      if (hasManifest && !registry.includes(entry.name)) {
-        unreachable.push(`${rootDir}/${entry.name}`);
+    }
+    const pruned = hoisted.filter((name) => !existsSync3(join4(root, "node_modules", name)));
+    if (pruned.length === 0) {
+      return finding3(
+        pattern,
+        "OK",
+        `every workspace package this ${HOIST_KEY} matches is linked at the root`
+      );
+    }
+    return finding3(
+      pattern,
+      "FAIL",
+      `the ${HOIST_KEY} \`${pattern}\` has no root link for ${pruned.map((name) => `node_modules/${name}`).join(", ")} \u2014 pnpm prunes one during an unrelated add and then answers "Already up to date" over a clean git status forever. Repair: ${HOIST_REPAIR}`
+    );
+  });
+};
+var HOOK_FILES = ["lefthook.yml", "lefthook.yaml", ".lefthook.yml", ".lefthook.yaml"];
+var HOOK_DIRS = [".husky", ".githooks"];
+var VERSION_MANAGED = /(?:^|[\s;&|(])(?<runner>pnpm|npx|bunx|yarn)\b(?:\s+(?:exec|run|dlx|x))?\s+(?<bin>geonosis(?:-[a-z-]+)?)\b/;
+var NAMES_A_BIN = /(?:^|[\s;&|(/])geonosis(?:-[a-z-]+)?\b/;
+var hookLines = (root) => {
+  const found = [];
+  const read = (path) => {
+    const at = relativePath(root, path);
+    for (const line of readFileSync4(path, "utf8").split("\n")) {
+      if (line.trim() !== "") found.push({ at, line });
+    }
+  };
+  for (const name of HOOK_FILES) {
+    const path = join4(root, name);
+    if (existsSync3(path)) read(path);
+  }
+  for (const name of HOOK_DIRS) {
+    const dir = join4(root, name);
+    if (!existsSync3(dir)) continue;
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+      if (entry.isFile() && !entry.name.startsWith("_") && !entry.name.startsWith(".")) {
+        read(join4(dir, entry.name));
       }
     }
   }
-  return [
-    unreachable.length === 0 ? finding3(
-      configured.registry,
-      "OK",
-      "every directory under the declared roots is named by it"
-    ) : finding3(
-      configured.registry,
-      "FAIL",
-      `${unreachable.length} directory(ies) it never names: ${unreachable.join(", ")}`
-    )
-  ];
+  return found;
+};
+var gitHooks = (root) => {
+  const lines = hookLines(root);
+  if (lines.length === 0) {
+    return [finding3("git hooks", "SKIP", "no lefthook, husky or .githooks file here to read")];
+  }
+  const files = [...new Set(lines.map((one) => one.at))].toSorted();
+  return files.flatMap((at) => {
+    const here = lines.filter((one) => one.at === at);
+    const named2 = here.filter((one) => NAMES_A_BIN.test(one.line));
+    if (named2.length === 0) {
+      return [finding3(at, "SKIP", "it names no geonosis bin, so there is nothing here to start")];
+    }
+    const wrong = named2.flatMap((one) => {
+      const found = VERSION_MANAGED.exec(one.line)?.groups;
+      return found === void 0 ? [] : [{ bin: found["bin"] ?? "", runner: found["runner"] ?? "" }];
+    });
+    if (wrong.length === 0) {
+      return [
+        finding3(
+          at,
+          "OK",
+          `${named2.length} geonosis bin(s) here, every one called directly rather than through a runner`
+        )
+      ];
+    }
+    return wrong.map(
+      ({ bin, runner }) => finding3(
+        at,
+        "FAIL",
+        `it runs ${bin} through ${runner} \u2014 a git hook's PATH is not the shell's and carries no version-manager shim, so ${runner} fails to START and what the author reads is its message, not this gate's. Call it directly: node_modules/.bin/${bin}`
+      )
+    );
+  });
 };
 var checkDrift = ({
   readers = READERS,
   root,
+  userSettings = join4(homedir(), SETTINGS),
   workspaces
 }) => {
   const config = readGeonosis(root);
   return [
     ...ci(root),
     ...orphanTests(root, workspaces),
+    ...scriptPaths(workspaces),
+    ...linkedBins(root, workspaces),
+    ...preloadAroundPnpm(root, workspaces),
+    ...generatedFiles(root, workspaces),
     ...pluginDirs(root),
+    ...publicHoists(root, workspaces),
+    ...gitHooks(root),
     ...law(root, config),
-    ...hooks(root),
-    ...blocks(root, config, readers)
+    ...hooks(root, userSettings),
+    ...blocks(root, config, readers, workspaces)
   ];
 };
 
@@ -672,7 +1148,38 @@ var ownReach = ({
   };
 };
 var optionsOf = (level) => Array.isArray(level) ? level.slice(1) : [];
-var under = (config, rule) => `${rule} under ${JSON.stringify(optionsOf(config.rules[rule]))}`;
+var optionSetsOf = (config, rule) => {
+  const seen = /* @__PURE__ */ new Set();
+  const sets = [];
+  for (const layer of layersOf(config, rule)) {
+    const options = [...optionsOf(layer.level)];
+    const key = JSON.stringify(options);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    sets.push(options);
+  }
+  return sets;
+};
+var enablingLayersOf = (config, rule) => {
+  const seen = /* @__PURE__ */ new Set();
+  const layers = [];
+  for (const layer of layersOf(config, rule)) {
+    if (OFF.has(severityOf(layer.level))) continue;
+    const options = [...optionsOf(layer.level)];
+    const key = JSON.stringify([layer.files, options]);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    layers.push({ files: layer.files, options });
+  }
+  return layers;
+};
+var under = (config, rule) => `${rule} under ${optionSetsOf(config, rule).map((options) => JSON.stringify(options)).join(" / ")}`;
+var enabledHere = (config, plugin) => [
+  .../* @__PURE__ */ new Set([
+    ...enabledRulesOf(config.rules, plugin),
+    ...config.overrides.flatMap((one) => enabledRulesOf(one.rules, plugin))
+  ])
+].toSorted();
 var throughProbes = ({
   config,
   corpus,
@@ -681,6 +1188,7 @@ var throughProbes = ({
   silent
 }) => {
   const refused = /* @__PURE__ */ new Map();
+  const placed = /* @__PURE__ */ new Set();
   const dir = mkdtempSync(join5(tmpdir(), "geonosis-doctor-probe-"));
   const here = join5(dir, "corpus");
   try {
@@ -689,10 +1197,29 @@ var throughProbes = ({
       const write = probes[rule];
       if (write === void 0) continue;
       try {
-        const probe = write(optionsOf(config.rules[rule]));
-        const at = join5(here, probe.path);
-        mkdirSync(dirname2(at), { recursive: true });
-        writeFileSync(at, probe.source);
+        const layers = enablingLayersOf(config, rule);
+        const unclaimed = [];
+        let anyPlaced = false;
+        for (const layer of layers) {
+          const files = write(layer.options);
+          if (files.length === 0) throw new Error("its probe declares no file at all");
+          const claims = layer.files.length === 0 || files.some((file) => layer.files.some((glob) => matchesGlob(glob, file.path)));
+          if (!claims) {
+            unclaimed.push(
+              `its probe lands at ${files[0]?.path ?? ""}, which the entry enabling it claims none of: ${layer.files.join(", ")}`
+            );
+            continue;
+          }
+          for (const file of files) {
+            const at = join5(here, file.path);
+            if (placed.has(at)) continue;
+            placed.add(at);
+            mkdirSync(dirname2(at), { recursive: true });
+            writeFileSync(at, file.source);
+          }
+          anyPlaced = true;
+        }
+        if (!anyPlaced) throw new Error(unclaimed.join(" \xB7 "));
       } catch (error) {
         refused.set(rule, String(error.message));
       }
@@ -735,7 +1262,7 @@ var checkExercised = async ({
   } catch (error) {
     return said("SKIP", refusal(error));
   }
-  const enabled = enabledRulesOf(config.rules, manifest.plugin);
+  const enabled = enabledHere(config, manifest.plugin);
   if (enabled.length === 0) return said("SKIP", `no ${manifest.plugin} rule is enabled here`);
   let reach;
   try {
@@ -796,7 +1323,7 @@ var checkExercised = async ({
   }
   const unplaceable = [
     ...unprobed.map(
-      (rule) => `${rule} declares no probe, so ${optionsOf(config.rules[rule]).length === 0 ? "its scope" : JSON.stringify(optionsOf(config.rules[rule]))} does not reach the corpus`
+      (rule) => `${rule} declares no probe, so ${optionSetsOf(config, rule).every((options) => options.length === 0) ? "its scope" : under(config, rule)} does not reach the corpus`
     ),
     ...inert.map((rule) => `${rule}: ${probed.refused.get(rule) ?? ""}`)
   ];
@@ -919,7 +1446,7 @@ var oneConfig = async ({
   }
   return held ? said("OK", `loaded ${loaded.version} = declared ${declared.spec} (${declared.at})`) : said(
     "FAIL",
-    `loaded ${loaded.version}, declared ${declared.spec} (${declared.at}) \u2014 a nested copy at ${loaded.at}`
+    `loaded ${loaded.version}, declared ${declared.spec} (${declared.at}) \u2014 a nested copy at ${loaded.at}. Remove the nested copies (rm -rf <workspace>/node_modules/@geonosis) and reinstall; the linter is not running what the tree declares until then`
   );
 };
 var labelOf = (workspace) => workspace.relative === "" ? "root" : workspace.relative;
@@ -1199,6 +1726,12 @@ var checkRunner = ({
         `"${script}" runs neither vitest nor bun test \u2014 this check has nothing to say about it`
       );
     }
+    if (testFilesUnder(workspace.dir).length === 0) {
+      return said(
+        "SKIP",
+        `"${script}" runs a test runner and there is no test file under this workspace \u2014 nothing here for its exit code to be wrong about`
+      );
+    }
     if (WRITES_A_REPORT.test(script)) {
       return said("OK", "the script asks the runner for its own JSON report, not for a status code");
     }
@@ -1276,28 +1809,42 @@ var countsOf = (findings) => findings.reduce((counts, one) => ({ ...counts, [one
 });
 var runDoctor = async ({
   baseline,
+  only,
   oxlint,
   root,
   strict = false
 }) => {
   const configs = discoverConfigs(root);
   const workspaces = discoverWorkspaces(root);
-  const binary = oxlint ?? resolveOxlint(root);
-  const repoCorpus = repoCorpusOf(root);
-  const found = ordered([
-    ...await checkLoaded({ configs, root, workspaces }),
-    ...await exercisedOf({
-      configs,
-      oxlint: binary,
-      ...repoCorpus === void 0 ? {} : { repoCorpus },
-      root
-    }),
-    ...baselineOf({ baseline, root }),
-    ...checkRunner({ ratchet: readRatchet(root), workspaces }),
-    ...await checkObservability({ now: Date.now(), root }),
-    ...checkDrift({ root, workspaces }),
-    ...checkDeployed({ root })
-  ]);
+  if (workspaces.length === 0 && configs.length === 0) {
+    throw new DoctorError(
+      `nothing here to examine \u2014 no package.json and no ${CONFIG_FILE} anywhere under ${root}. Every line this would print is about a gate that is not here, and a page of SKIPs is not a pass.`
+    );
+  }
+  const asked = (check) => only === void 0 || only.includes(check);
+  const runs = [
+    ["loaded", () => checkLoaded({ configs, root, workspaces })],
+    [
+      "exercised",
+      () => {
+        const repoCorpus = repoCorpusOf(root);
+        return exercisedOf({
+          configs,
+          oxlint: oxlint ?? resolveOxlint(root),
+          ...repoCorpus === void 0 ? {} : { repoCorpus },
+          root
+        });
+      }
+    ],
+    ["baseline", () => baselineOf({ baseline, root })],
+    ["runner", () => checkRunner({ ratchet: readRatchet(root), workspaces })],
+    ["observability", () => checkObservability({ now: Date.now(), root })],
+    ["drift", () => checkDrift({ root, workspaces })],
+    ["deployed", () => checkDeployed({ root })]
+  ];
+  const collected = [];
+  for (const [check, run] of runs) if (asked(check)) collected.push(...await run());
+  const found = ordered(collected);
   const findings = strict ? found.map((one) => one.verdict === "WARN" ? { ...one, verdict: "FAIL" } : one) : found;
   return {
     counts: countsOf(findings),
@@ -1330,13 +1877,17 @@ var sectionOf = (check, findings) => {
 var formatDoctor = ({ counts, findings, ok, root }) => [
   `geonosis-doctor \u2014 ${root}`,
   "",
-  ...CHECKS.flatMap((check) => sectionOf(check, findings)),
-  `${CHECKS.length} checks, ${findings.length} lines: ${counts.OK} ok, ${counts.WARN} warned, ${counts.SKIP} skipped, ${counts.UNJUDGED} unjudged, ${counts.FAIL} failed`,
+  // A check nobody asked for (--only) said nothing; a section for it would read as a check that ran.
+  ...CHECKS.filter((check) => findings.some((one) => one.check === check)).flatMap(
+    (check) => sectionOf(check, findings)
+  ),
+  `${ranOf(findings)} ${ranOf(findings) === 1 ? "check" : "checks"}, ${findings.length} lines: ${counts.OK} ok, ${counts.WARN} warned, ${counts.SKIP} skipped, ${counts.UNJUDGED} unjudged, ${counts.FAIL} failed`,
   ok ? "doctor PASS \u2014 nothing here says the gates are measuring something other than what they claim." : "doctor FAIL \u2014 a line above is a gate reporting on something other than what it names, or a question this could not ask at all.",
   ""
 ].join("\n");
 var formatJson = (report) => `${JSON.stringify(report, null, 2)}
 `;
+var ranOf = (findings) => new Set(findings.map((one) => one.check)).size;
 
 export {
   CONFIG_FILE,