@geraldmaron/construct 1.2.2 → 1.3.0

package/lib/doctor/watchers/credential-parity.mjs

@@ -0,0 +1,97 @@
+/**
+ * lib/doctor/watchers/credential-parity.mjs — advisory credential alignment checks.
+ *
+ * Surfaces when a pinned OpenRouter model or OpenCode default expects
+ * OPENROUTER_API_KEY but the canonical store and op-run catalog both lack it,
+ * or when OpenCode's openrouter provider has no auth wiring.
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { parseEnvFile, getUserEnvPath } from '../../env-config.mjs';
+import { hasSecret } from '../../providers/secret-resolver.mjs';
+import { ensureOpenRouterProviderAuth } from '../../opencode-config.mjs';
+import { findOpenCodeConfigPath } from '../../opencode-config.mjs';
+
+export const name = 'credential-parity';
+export const intervalMs = 30 * 60 * 1000;
+
+function openRouterModelId(modelId) {
+  return typeof modelId === 'string' && /^openrouter\//.test(modelId);
+}
+
+function openCodeNeedsOpenRouter(homeDir) {
+  const configPath = findOpenCodeConfigPath();
+  if (!fs.existsSync(configPath)) return { needs: false, configPath };
+  try {
+    const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    const defaultModel = config.model || config.defaultModel || '';
+    return { needs: openRouterModelId(defaultModel), configPath, config };
+  } catch {
+    return { needs: false, configPath };
+  }
+}
+
+function openRouterAuthWired(config) {
+  const probe = { provider: { openrouter: config?.provider?.openrouter || {} } };
+  ensureOpenRouterProviderAuth(probe);
+  const provider = probe.provider.openrouter;
+  return Boolean(
+    provider.apiKey
+    || provider.options?.headers?.Authorization,
+  );
+}
+
+export async function runCredentialParityChecks({ rootDir = process.cwd(), homeDir = os.homedir(), env = process.env } = {}) {
+  const violations = [];
+  const configPath = getUserEnvPath(homeDir);
+  const openRouterConfigured = hasSecret('OPENROUTER_API_KEY', { env, cwd: rootDir });
+
+  const openCode = openCodeNeedsOpenRouter(homeDir);
+  if (openCode.needs && !openRouterConfigured) {
+    violations.push({
+      category: 'credential-parity',
+      severity: 'advisory',
+      summary: `OpenCode default model uses OpenRouter but OPENROUTER_API_KEY is not configured (${openCode.configPath})`,
+    });
+  }
+
+  if (openCode.config && openCode.needs && !openRouterAuthWired(openCode.config)) {
+    violations.push({
+      category: 'credential-parity',
+      severity: 'advisory',
+      summary: 'OpenCode provider.openrouter has no apiKey env ref — run `construct sync --global`',
+    });
+  }
+
+  const xdgEnv = parseEnvFile(configPath);
+  const legacyEnv = parseEnvFile(path.join(homeDir, '.construct', 'config.env'));
+  if (legacyEnv.CONSTRUCT_OP_ENV_FILE && !xdgEnv.CONSTRUCT_OP_ENV_FILE) {
+    violations.push({
+      category: 'credential-parity',
+      severity: 'advisory',
+      summary: 'CONSTRUCT_OP_ENV_FILE is still in ~/.construct/config.env — run `construct install --scope=user` to migrate to XDG config',
+    });
+  }
+
+  return {
+    summary: violations.length
+      ? `credential-parity: ${violations.length} advisory finding(s)`
+      : 'credential-parity: ok',
+    violations,
+  };
+}
+
+export async function tick({ rootDir = process.cwd(), homeDir = os.homedir(), env = process.env } = {}) {
+  const result = await runCredentialParityChecks({ rootDir, homeDir, env });
+  return {
+    actions: [],
+    escalations: [],
+    findings: result.violations,
+    passed: result.violations.length === 0
+      ? [{ category: 'credential-parity', summary: result.summary }]
+      : [],
+  };
+}

package/lib/doctor/watchers/mcp-protocol.mjs

@@ -6,7 +6,7 @@
  * `initialize`, parse the response, send `tools/list`, report tool count.
  * cass-memory v0.2.x (the original cause of construct-1qt) rejects the
  * handshake outright; this watcher flags servers that fail the handshake so
- * the dashboard surfaces a protocol problem rather than a port-up false
+ * doctor surfaces a protocol problem rather than a port-up false
  * positive.
  *
  * Severity defaults to warning. Set `CONSTRUCT_MCP_PROTOCOL_BLOCKING=1` to

package/lib/doctor/watchers/service-health.mjs

@@ -1,8 +1,8 @@
 /**
  * lib/doctor/watchers/service-health.mjs — continuous service probes.
  *
- * Probes the services `construct dev` starts (postgres, dashboard,
- * cm, opencode). On 2 consecutive probe failures, attempts a restart of
+ * Probes the services `construct dev` starts (postgres, cm).
+ * On 2 consecutive probe failures, attempts a restart of
  * docker-backed services (postgres). On 2 consecutive failed
  * restarts, escalates `service.down` for cx-sre. Non-docker services log +
  * escalate after 3 consecutive failures — auto-restart needs original spawn
@@ -13,12 +13,11 @@
 
 import { spawnSync, spawn } from 'node:child_process';
 import { existsSync, readFileSync, openSync, mkdirSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
 
 import { record } from '../audit.mjs';
 import { escalate } from '../escalate.mjs';
-import { configDir, stateDir, cacheDir } from '../../config/xdg.mjs';
+import { configDir, cacheDir } from '../../config/xdg.mjs';
 
 export const name = 'service-health';
 export const intervalMs = 60 * 1000;
@@ -26,9 +25,6 @@ export const intervalMs = 60 * 1000;
 const failureCounts = {};
 const restartAttempts = {};
 
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const REPO_ROOT = join(__dirname, '..', '..', '..');
-
 const services = [
   {
     id: 'postgres',
@@ -36,12 +32,6 @@ const services = [
     restart: () => dockerRestart('construct-postgres'),
     restartable: true,
   },
-  {
-    id: 'dashboard',
-    probe: () => probeDashboardPort(),
-    restart: () => respawnViaConstructUp('dashboard'),
-    restartable: true,
-  },
   {
     id: 'cm',
     probe: () => probeMemoryHealth(),
@@ -55,18 +45,6 @@ function probeTcp(host, port, timeoutMs = 1500) {
   return r.status === 0;
 }
 
-function probeDashboardPort() {
-  const statePath = join(stateDir(), 'dashboard.json');
-  if (!existsSync(statePath)) return true;
-  try {
-    const state = JSON.parse(readFileSync(statePath, 'utf8'));
-    if (!state.port) return true;
-    return probeTcp('127.0.0.1', state.port);
-  } catch {
-    return true;
-  }
-}
-
 function probeMemoryHealth() {
   const envPath = join(configDir(), 'config.env');
   if (!existsSync(envPath)) return true;
@@ -99,12 +77,6 @@ function detachSpawn(command, args, logName) {
   }
 }
 
-function respawnViaConstructUp() {
-  const bin = join(REPO_ROOT, 'bin', 'construct');
-  if (!existsSync(bin)) return { ok: false, error: 'bin/construct not found' };
-  return detachSpawn('node', [bin, 'up'], 'doctor-respawn-up.log');
-}
-
 function respawnCm() {
   const envPath = join(configDir(), 'config.env');
   let port = '4231';

package/lib/document-export.mjs

@@ -105,6 +105,50 @@ export function pdfRenderedDiagrams(pdfPath, sourceContent) {
   }
 }
 
+function rawDiagramSourcePattern() {
+  return /(?:flowchart\s+(?:TD|LR|BT|RL)|sequenceDiagram|classDiagram|stateDiagram|erDiagram|journey|gantt|pie\s+title|direction:\s*(?:right|down|left|up))/i;
+}
+
+function zipEntryText(zipPath, entryName, env = process.env) {
+  if (!whichBin('unzip', env)) return null;
+  const result = spawnSync('unzip', ['-p', zipPath, entryName], { encoding: 'utf8', env });
+  return result.status === 0 ? String(result.stdout || '') : null;
+}
+
+function zipEntryNames(zipPath, env = process.env) {
+  if (!whichBin('unzip', env)) return [];
+  const result = spawnSync('unzip', ['-Z1', zipPath], { encoding: 'utf8', env });
+  return result.status === 0
+    ? String(result.stdout || '').split('\n').map((line) => line.trim()).filter(Boolean)
+    : [];
+}
+
+export function docxRenderedDiagrams(docxPath, sourceContent, env = process.env) {
+  const expected = countDiagramFences(sourceContent);
+  if (expected === 0) return true;
+  const documentXml = zipEntryText(docxPath, 'word/document.xml', env);
+  if (!documentXml) return false;
+  if (rawDiagramSourcePattern().test(documentXml)) return false;
+  const rels = zipEntryText(docxPath, 'word/_rels/document.xml.rels', env) || '';
+  const entries = zipEntryNames(docxPath, env);
+  const mediaCount = entries.filter((entry) => entry.startsWith('word/media/')).length;
+  return mediaCount >= expected || /relationships\/image/i.test(rels);
+}
+
+export function htmlRenderedDiagrams(htmlPath, sourceContent) {
+  const expected = countDiagramFences(sourceContent);
+  if (expected === 0) return true;
+  let html = '';
+  try {
+    html = fs.readFileSync(htmlPath, 'utf8');
+  } catch {
+    return false;
+  }
+  if (rawDiagramSourcePattern().test(html)) return false;
+  const renderedCount = (html.match(/<(?:img|svg)\b/gi) || []).length;
+  return renderedCount >= expected || /data:image\//i.test(html);
+}
+
 export { pdfUsesBundledBrandSans } from './brand-fonts.mjs';
 
 /** @deprecated use pdfUsesBundledBrandSans */
@@ -441,17 +485,37 @@ export function exportMarkdown({
     };
   }
 
-  if (format === 'pdf' && figures) {
+  if (figures) {
     const source = fs.readFileSync(inputPath, 'utf8');
     const expectedDiagrams = countDiagramFences(source);
-    if (expectedDiagrams > 0 && !pdfRenderedDiagrams(target, source)) {
-      return {
-        ok: false,
-        format,
-        inputPath,
-        outputPath: target,
-        message: `Export wrote PDF but rendered 0/${expectedDiagrams} diagram(s). Ensure d2 and mmdc are installed; mmdc needs Chrome (set PUPPETEER_EXECUTABLE_PATH or install Google Chrome). Pandoc stderr: ${(result.stderr || '').trim().slice(0, 300)}`,
-      };
+    if (expectedDiagrams > 0) {
+      if (format === 'pdf' && !pdfRenderedDiagrams(target, source)) {
+        return {
+          ok: false,
+          format,
+          inputPath,
+          outputPath: target,
+          message: `Export wrote PDF but rendered 0/${expectedDiagrams} diagram(s). Ensure d2 and mmdc are installed; mmdc needs Chrome (set PUPPETEER_EXECUTABLE_PATH or install Google Chrome). Pandoc stderr: ${(result.stderr || '').trim().slice(0, 300)}`,
+        };
+      }
+      if (format === 'docx' && !docxRenderedDiagrams(target, source, effectiveEnv)) {
+        return {
+          ok: false,
+          format,
+          inputPath,
+          outputPath: target,
+          message: `Export wrote DOCX but left diagram source unresolved. Ensure d2 and mermaid-cli rendered the figures before distributing the document. Pandoc stderr: ${(result.stderr || '').trim().slice(0, 300)}`,
+        };
+      }
+      if ((format === 'html' || format === 'deck') && !htmlRenderedDiagrams(target, source)) {
+        return {
+          ok: false,
+          format,
+          inputPath,
+          outputPath: target,
+          message: `Export wrote ${format.toUpperCase()} but left diagram source unresolved. Ensure d2 and mermaid-cli rendered the figures before distributing the document. Pandoc stderr: ${(result.stderr || '').trim().slice(0, 300)}`,
+        };
+      }
     }
   }
 

package/lib/document-extract.mjs

@@ -5,10 +5,8 @@
  *   - Async (preferred): `extractDocumentTextAsync` routes PDF/Office/HTML
  *     through the docling Python sidecar and audio/video through whisper.cpp.
  *     Returns { text, markdown, metadata, droppedInfo, ... }.
- *   - Sync (legacy): `extractDocumentText` keeps regex/CLI extractors.
- *     PDF/Office output is lower fidelity (tables flattened, formulas
- *     dropped, scanned pages return empty). Audio/video throws
- *     { code: 'ASR_REQUIRED' } on this path.
+ *   - Sync (legacy): `extractDocumentText` for text/transcript/calendar/email;
+ *     PDF/Office zip formats require docling or the node-native unpdf/mammoth path.
  *
  * `extractDocumentMetadata` returns frontmatter + title/authors/dates.
  *
@@ -46,17 +44,12 @@ export const AUDIO_VIDEO_EXTS = new Set(['.mp3', '.wav', '.m4a', '.mp4', '.mov',
 
 export const ZIP_DOCUMENT_EXTS = new Set(['.docx', '.xlsx', '.pptx', '.odt', '.ods']);
 
-// Office zip formats with no Node-native backend — callers must route through docling
-// or opt into the legacy zip-xml path via CONSTRUCT_ALLOW_LEGACY_EXTRACT=1.
+// Office zip formats with no Node-native backend require docling.
 const OFFICE_REQUIRES_DOCLING_EXTS = new Set(['.xlsx', '.pptx', '.odt', '.ods']);
 
-function legacyExtractAllowed(env = process.env) {
-  return env.CONSTRUCT_ALLOW_LEGACY_EXTRACT === '1';
-}
-
 function makeOfficeRequiresDoclingError(extension) {
   const err = new Error(
-    `${extension} extraction requires docling. Run \`construct install --with-docling\`, use high-fidelity ingest, or set CONSTRUCT_ALLOW_LEGACY_EXTRACT=1 for the legacy zip-xml path.`,
+    `${extension} extraction requires docling. Run \`construct install --with-docling\` or use high-fidelity ingest.`,
   );
   err.code = 'OFFICE_REQUIRES_DOCLING';
   err.extension = extension;
@@ -65,7 +58,7 @@ function makeOfficeRequiresDoclingError(extension) {
 
 function makePdfRequiresDoclingError() {
   const err = new Error(
-    'PDF extraction requires docling, the node-native unpdf backend, or CONSTRUCT_ALLOW_LEGACY_EXTRACT=1 for pdftotext/PDFKit.',
+    'PDF extraction requires docling or the node-native unpdf backend. Run `construct install --with-docling` or ensure unpdf is installed.',
   );
   err.code = 'PDF_REQUIRES_DOCLING';
   return err;
@@ -85,9 +78,6 @@ export const EXTRACTABLE_DOCUMENT_EXTS = new Set([
   '.pdf',
 ]);
 
-// Minimum extracted characters per page that distinguishes text-bearing PDFs
-// from scanned images. Below this threshold droppedInfo is emitted.
-const PDF_MIN_TEXT_THRESHOLD = 50;
 
 function normalizeText(value) {
   return String(value)
@@ -149,103 +139,6 @@ function extractUtf8(filePath, extension) {
   return { text, method: 'utf8', droppedInfo: [], structured: null };
 }
 
-function zipEntries(filePath) {
-  return run('unzip', ['-Z1', filePath]).split('\n').map((line) => line.trim()).filter(Boolean);
-}
-
-function unzipEntry(filePath, entryPath) {
-  return run('unzip', ['-p', filePath, entryPath]);
-}
-
-function extractZipDocument(filePath, extension) {
-  const entries = zipEntries(filePath);
-  let targets = [];
-  const droppedInfo = [];
-
-  if (extension === '.docx') {
-    targets = entries.filter((entry) => entry === 'word/document.xml' || entry.startsWith('word/header') || entry.startsWith('word/footer'));
-
-    // Count embedded images (word/media/ folder entries)
-    const imageCount = entries.filter((e) => e.startsWith('word/media/')).length;
-    if (imageCount > 0) {
-      droppedInfo.push(makeDropInfo({ kind: 'inline-image', count: imageCount, reason: 'Embedded images not extracted from DOCX', recoverable: true }));
-    }
-
-    // Count tables in the main document XML
-    try {
-      const docXml = unzipEntry(filePath, 'word/document.xml');
-      const tableCount = (docXml.match(/<w:tbl[\s>]/g) || []).length;
-      if (tableCount > 0) {
-        droppedInfo.push(makeDropInfo({ kind: 'table', count: tableCount, reason: 'Table structure flattened; cell boundaries and column headers not preserved', recoverable: true }));
-      }
-    } catch { /* ignore — main extraction still proceeds */ }
-
-    // Count comments
-    if (entries.includes('word/comments.xml')) {
-      try {
-        const commentsXml = unzipEntry(filePath, 'word/comments.xml');
-        const commentCount = (commentsXml.match(/<w:comment\s/g) || []).length;
-        if (commentCount > 0) {
-          droppedInfo.push(makeDropInfo({ kind: 'comment', count: commentCount, reason: 'Document review comments not included in extracted text', recoverable: true }));
-        }
-      } catch { /* ignore */ }
-    }
-  } else if (extension === '.xlsx') {
-    targets = entries.filter((entry) => entry === 'xl/sharedStrings.xml' || /^xl\/worksheets\/sheet\d+\.xml$/.test(entry));
-
-    // Count formula cells across all worksheets
-    let formulaCount = 0;
-    for (const sheetEntry of entries.filter((e) => /^xl\/worksheets\/sheet\d+\.xml$/.test(e))) {
-      try {
-        const sheetXml = unzipEntry(filePath, sheetEntry);
-        formulaCount += (sheetXml.match(/<f\b/g) || []).length;
-      } catch { /* ignore */ }
-    }
-    if (formulaCount > 0) {
-      droppedInfo.push(makeDropInfo({ kind: 'formula', count: formulaCount, reason: 'Spreadsheet formulas not evaluated; only cell string values extracted', recoverable: true }));
-    }
-
-    // Count embedded images
-    const imageCount = entries.filter((e) => e.startsWith('xl/media/')).length;
-    if (imageCount > 0) {
-      droppedInfo.push(makeDropInfo({ kind: 'inline-image', count: imageCount, reason: 'Embedded images not extracted from XLSX', recoverable: true }));
-    }
-  } else if (extension === '.pptx') {
-    targets = entries.filter((entry) => /^ppt\/slides\/slide\d+\.xml$/.test(entry));
-
-    // Count speaker notes slides
-    const notesCount = entries.filter((e) => /^ppt\/notesSlides\/notesSlide\d+\.xml$/.test(e)).length;
-    if (notesCount > 0) {
-      droppedInfo.push(makeDropInfo({ kind: 'speaker-notes', count: notesCount, reason: 'Speaker notes slides not included in extracted text', recoverable: true }));
-    }
-
-    // Count slides with animation sequences
-    let animationCount = 0;
-    for (const slideEntry of targets) {
-      try {
-        const slideXml = unzipEntry(filePath, slideEntry);
-        if (/<p:timing\b/.test(slideXml)) animationCount++;
-      } catch { /* ignore */ }
-    }
-    if (animationCount > 0) {
-      droppedInfo.push(makeDropInfo({ kind: 'animation', count: animationCount, reason: 'Slide animation timing sequences not preserved in extracted text', recoverable: false }));
-    }
-
-    // Count embedded images
-    const imageCount = entries.filter((e) => e.startsWith('ppt/media/')).length;
-    if (imageCount > 0) {
-      droppedInfo.push(makeDropInfo({ kind: 'inline-image', count: imageCount, reason: 'Embedded images not extracted from PPTX', recoverable: true }));
-    }
-  } else if (extension === '.odt' || extension === '.ods') {
-    targets = entries.filter((entry) => entry === 'content.xml');
-  }
-
-  if (targets.length === 0) throw new Error(`No readable document entries found for ${extension}`);
-
-  const text = normalizeText(targets.map((entry) => stripMarkup(unzipEntry(filePath, entry))).join('\n\n'));
-  return { text, method: 'zip-xml', droppedInfo, structured: null };
-}
-
 // Minimal RTF-to-text: strip control words, groups, and escapes. RTF is a
 // text format, so this works everywhere; it is the cross-platform fallback when
 // textutil (macOS only) is absent. Lossy on complex documents, but never throws.
@@ -280,84 +173,12 @@ function extractRichText(filePath, extension) {
   throw new Error('textutil not available for rich-text extraction');
 }
 
-function extractPdfWithPdftotext(filePath) {
-  return {
-    text: normalizeText(run('pdftotext', ['-layout', '-nopgbrk', filePath, '-'])),
-    method: 'pdftotext',
-    droppedInfo: [],
-    structured: null,
-  };
-}
-
-function extractPdfWithSwift(filePath) {
-  const script = `
-import Foundation
-import PDFKit
-
-let path = CommandLine.arguments[1]
-let url = URL(fileURLWithPath: path)
-guard let document = PDFDocument(url: url) else {
-  fputs("Unable to open PDF\\n", stderr)
-  exit(1)
-}
-print(document.string ?? "")
-`;
-  return {
-    text: normalizeText(run('swift', ['-e', script, filePath])),
-    method: 'swift-pdfkit',
-    droppedInfo: [],
-    structured: null,
-  };
-}
-
-function extractPdfWithMdls(filePath) {
-  const text = extractWithMdls(filePath);
-  return { text, method: 'mdls', droppedInfo: [], structured: null };
-}
-
 function extractWithMdls(filePath) {
   const text = normalizeText(run('mdls', ['-raw', '-name', 'kMDItemTextContent', filePath]));
   if (!text || text === '(null)') throw new Error('Spotlight text extraction unavailable');
   return text;
 }
 
-function extractPdf(filePath) {
-  let extracted;
-  if (commandExists('pdftotext')) {
-    extracted = extractPdfWithPdftotext(filePath);
-  } else if (process.platform === 'darwin' && commandExists('swift')) {
-    try {
-      extracted = extractPdfWithSwift(filePath);
-    } catch {
-      extracted = extractPdfWithMdls(filePath);
-    }
-  } else if (process.platform === 'darwin' && commandExists('mdls')) {
-    extracted = extractPdfWithMdls(filePath);
-  } else {
-    throw new Error('No PDF extraction backend available');
-  }
-
-  // Scanned-PDF heuristic: if extracted text is very short relative to file size,
-  // the PDF probably contains only images and needs OCR to be useful.
-  const stat = statSync(filePath);
-  const pages = Math.max(1, Math.ceil(stat.size / 50_000));
-  const threshold = PDF_MIN_TEXT_THRESHOLD * pages;
-  if (extracted.text.length < threshold) {
-    const ocrHint = process.env.CONSTRUCT_PDF_OCR_HINT || 'none';
-    const hintMsg = ocrHint !== 'none'
-      ? `OCR backend hint: ${ocrHint}. See docs/guides/intake/scanned-pdfs.md.`
-      : 'Set CONSTRUCT_PDF_OCR_HINT=tesseract|pdfocr to enable OCR. See docs/guides/intake/scanned-pdfs.md.';
-    extracted.droppedInfo.push(makeDropInfo({
-      kind: 'scanned-pdf',
-      count: pages,
-      reason: `Extracted text (${extracted.text.length} chars) is below minimum threshold for ${pages} page(s); document may be a scanned image. ${hintMsg}`,
-      recoverable: true,
-    }));
-  }
-
-  return extracted;
-}
-
 export function isExtractableDocumentPath(filePath) {
   return EXTRACTABLE_DOCUMENT_EXTS.has(extname(filePath).toLowerCase());
 }
@@ -710,10 +531,7 @@ export function extractDocumentText(filePath, { maxChars = null } = {}) {
     const envelope = extractCalendar(resolvedPath);
     extracted = { text: envelope.text, method: 'ics', droppedInfo: envelope.droppedInfo, structured: envelope.structured };
   } else if (ZIP_DOCUMENT_EXTS.has(extension)) {
-    if (!legacyExtractAllowed()) {
-      throw makeOfficeRequiresDoclingError(extension);
-    }
-    extracted = extractZipDocument(resolvedPath, extension);
+    throw makeOfficeRequiresDoclingError(extension);
   } else if (RICH_TEXT_EXTS.has(extension)) {
     extracted = extractRichText(resolvedPath, extension);
   } else if (MDLS_DOCUMENT_EXTS.has(extension) && process.platform === 'darwin' && commandExists('mdls')) {
@@ -721,10 +539,7 @@ export function extractDocumentText(filePath, { maxChars = null } = {}) {
   } else if (EMAIL_DOCUMENT_EXTS.has(extension)) {
     extracted = extractEml(resolvedPath);
   } else if (extension === '.pdf') {
-    if (!legacyExtractAllowed()) {
-      throw makePdfRequiresDoclingError();
-    }
-    extracted = extractPdf(resolvedPath);
+    throw makePdfRequiresDoclingError();
   } else {
     throw new Error(`Unsupported document type: ${extension || 'unknown'}`);
   }
@@ -798,12 +613,9 @@ export async function extractDocumentTextNodeNative(filePath, { maxChars = null
       if (text) {
         return buildExtractionResult(resolvedPath, extension, { text, method: nodeBackend.method, droppedInfo: [], structured: null }, maxChars);
       }
-    } catch { /* optional dep absent or parse failure — legacy path only when explicitly allowed */ }
-    if (!legacyExtractAllowed()) {
-      if (extension === '.docx') throw makeOfficeRequiresDoclingError(extension);
-      throw makePdfRequiresDoclingError();
-    }
-    return extractDocumentText(resolvedPath, { maxChars });
+    } catch { /* optional dep absent or parse failure */ }
+    if (extension === '.docx') throw makeOfficeRequiresDoclingError(extension);
+    throw makePdfRequiresDoclingError();
   }
 
   return extractDocumentText(resolvedPath, { maxChars });

package/lib/embed/artifact.mjs

@@ -3,9 +3,8 @@
  *
  * Generates PRDs, RFCs, and ADRs as structured markdown files under docs/.
  * Each artifact type has a fixed schema and front-matter. Numbering is auto-
- * incremented by scanning the target directory. Entry points cover the CLI,
- * the embed daemon when analysis triggers a recommendation, and the dashboard
- * API.
+ * incremented by scanning the target directory. Entry points cover the CLI
+ * and the embed daemon when analysis triggers a recommendation.
  */
 
 import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync } from 'fs';

package/lib/embed/cli.mjs

@@ -10,7 +10,7 @@
  * Exports:
  *   resolveEmbedStatus(env, homeDir) — returns { level, label, detail }
  *     level: 'running' | 'stopped' | 'none'
- *     Consumed by session-start hook and dashboard /api/embed/status endpoint.
+ *     Consumed by session-start hook and `construct embed status`.
  *
  *   autoStartEmbedIfNeeded(env, rootDir, homeDir) — spawns daemon when
  *     provider credentials are present but daemon is stopped. No-op if already

package/lib/embed/config.mjs

@@ -38,7 +38,6 @@
  *     - type: slack               # post to a Slack channel
  *       provider: slack
  *       channel: C12345
- *     - type: dashboard           # push to the Construct dashboard
  *
  *   approval:
  *     require:                    # action types that need approval before dispatch
@@ -138,7 +137,7 @@ export const DEFAULT_OPERATING_PROFILE = {
   },
   riskModel: {
     detect: ['blocked work', 'missing owner', 'stale cadence', 'source errors', 'missing focal resource', 'unapproved high-risk action'],
-    dashboardStatus: { ok: 'no known gaps', attention: 'gaps or source errors exist', blocked: 'required focal resource or approval path missing' },
+    riskStatus: { ok: 'no known gaps', attention: 'gaps or source errors exist', blocked: 'required focal resource or approval path missing' },
   },
 };
 

package/lib/embed/customer-profiles.mjs

@@ -128,7 +128,7 @@ export function createCustomerProfile({ name, owner, workspace, status = 'active
     updatedAt: new Date().toISOString(),
   };
 
-  const content = `---
+const content = `---
 cx_doc_id: ${randomUUID()}
 created_at: ${profile.createdAt}
 updated_at: ${profile.updatedAt}

package/lib/embed/daemon.mjs

@@ -737,7 +737,7 @@ this.#scheduler.register(
       async () => {
         const result = await this.#inboxWatcher.poll();
         if (result.processed.length) {
-          const { getRebrand } = await import('../profiles/rebrand.mjs');
+          const { getRebrand } = await import('../scopes/rebrand.mjs');
           const { signalNoun } = getRebrand(this.#rootDir);
           const noun = result.processed.length === 1 ? signalNoun : `${signalNoun}s`;
           process.stderr.write(`[embed] Classified ${result.processed.length} ${noun} from [${result.dirs.join(', ')}]\n`);
@@ -932,9 +932,8 @@ this.#scheduler.register(
     );
 
     // ── Job 13: telemetry-heartbeat ──────────────────────────────────────
-    // Every 5 min — emit a daemon.heartbeat trace event so the
-    // dashboard always has recent data, even when no agent/worker activity
-    // has occurred. The heartbeat is fire-and-forget; failure is non-fatal.
+    // Every 5 min — emit a daemon.heartbeat trace event so telemetry backends
+    // always have recent data, even when no agent/worker activity has occurred.
     this.#scheduler.register(
       'telemetry-heartbeat',
       5 * 60_000,
@@ -962,8 +961,8 @@ this.#scheduler.register(
 
     // ── Job 14: telemetry-generation ─────────────────────────────────────────
     // Every 5 min — make a tiny LLM call and record it as a telemetry generation
-    // observation so the dashboard's Latency/TTFT/Throughput/Error sections
-    // always have recent data to display, even when no agent sessions are active.
+    // observation so external telemetry backends always have recent data to display,
+    // even when no agent sessions are active.
     this.#scheduler.register(
       'telemetry-generation',
       5 * 60_000,