@henols/c64-re-tools 2.0.0-rc.2 → 2.0.0-rc.20

package/src/c64.ts

@@ -20,6 +20,16 @@ export function formatC64Address(value: number): string {
   return `$${checkAddress(value).toString(16).padStart(4, "0")}`;
 }
 
+/** VIC-II state with its addresses as $xxxx; the other values stay numbers. */
+export function formatVicii<T extends { screenAddress: number; graphicsAddress: number }>(state: T): Omit<T, "screenAddress" | "graphicsAddress"> & { screenAddress: string; graphicsAddress: string } {
+  return { ...state, screenAddress: formatC64Address(state.screenAddress), graphicsAddress: formatC64Address(state.graphicsAddress) };
+}
+
+/** A sprite with its data address as $xxxx; the other values stay numbers. */
+export function formatSprite<T extends { dataAddress: number }>(sprite: T): Omit<T, "dataAddress"> & { dataAddress: string } {
+  return { ...sprite, dataAddress: formatC64Address(sprite.dataAddress) };
+}
+
 /** A byte as $xx. Throws RangeError outside 0-255. */
 export function formatC64Byte(value: number): string {
   if (!Number.isInteger(value) || value < 0 || value > 0xff) throw new RangeError(`C64 byte out of range: ${value}`);
@@ -37,8 +47,25 @@ export function prgRange(prg: Uint8Array): { start: number; end: number; body: U
   return { start, end: start + prg.length - 3, body: prg.subarray(2) };
 }
 
-/** How 6502 code refers to an address. */
-export const REFERENCE_KINDS = ["call", "jump", "read", "write", "reference"] as const;
+/** The tables of addresses: words, or words minus 1 for an RTS dispatch; a split table has all low bytes, then all high bytes. */
+export const POINTER_TABLE_TYPES = ["addresses", "addresses-split", "rts-addresses", "rts-addresses-split"] as const;
+export type PointerTableType = (typeof POINTER_TABLE_TYPES)[number];
+
+/** The entries of a table of addresses in [start, end]: the address of each low and high byte, and the target that the entry names. */
+export function pointerTableEntries(table: { start: number; end: number; type: PointerTableType }, byteAt: (address: number) => number): Array<{ low: number; high: number; target: number }> {
+  const length = table.end - table.start + 1;
+  const split = table.type === "addresses-split" || table.type === "rts-addresses-split";
+  const minus = table.type === "rts-addresses" || table.type === "rts-addresses-split" ? 1 : 0;
+  const count = Math.floor(length / 2);
+  return Array.from({ length: count }, (_, index) => {
+    const low = split ? table.start + index : table.start + 2 * index;
+    const high = split ? table.start + count + index : low + 1;
+    return { low, high, target: ((byteAt(low) | (byteAt(high) << 8)) + minus) & 0xffff };
+  });
+}
+
+/** How 6502 code refers to an address. A pointer is code that builds the address from immediates (D65). */
+export const REFERENCE_KINDS = ["call", "jump", "read", "write", "reference", "pointer"] as const;
 export type ReferenceKind = (typeof REFERENCE_KINDS)[number];
 
 /** A symbol or label name: assembler label syntax, at most 64 characters; a leading dot marks a local label. */
@@ -128,7 +155,7 @@ export function textToPetsciiName(text: string): Uint8Array {
 /** BASIC refuses higher line numbers when a line is entered. */
 const MAX_LINE_NUMBER = 63999;
 
-const TOKEN = { data: 0x83, rem: 0x8f, sys: 0x9e, usr: 0xb7, plus: 0xaa, minus: 0xab, times: 0xac, divide: 0xad } as const;
+const TOKEN = { data: 0x83, rem: 0x8f, sys: 0x9e, usr: 0xb7, plus: 0xaa, minus: 0xab, times: 0xac, divide: 0xad, pi: 0xff } as const;
 const QUOTE = 0x22;
 const COLON = 0x3a;
 
@@ -138,31 +165,58 @@ export interface TokenizedLine {
   tokens: Uint8Array;
 }
 
-/** A machine-code handoff in BASIC program text: SYS with a constant address, or a SYS or USR whose target needs run-time values. */
-export type BasicHandoff = { kind: "sys"; line: number; address: number } | { kind: "sys" | "usr"; line: number; computed: true };
+/**
+ * A machine-code handoff in BASIC program text: SYS with a constant address, a
+ * SYS whose argument needs run-time values (with the argument as text), or a USR.
+ */
+export type BasicHandoff =
+  | { kind: "sys"; line: number; address: number }
+  | { kind: "sys"; line: number; computed: true; expression: string }
+  | { kind: "usr"; line: number; computed: true };
+
+/**
+ * `basicEnd` is the first address that holds no BASIC; `textBytes` is the
+ * number of file bytes (load address included) before the end of the BASIC text.
+ */
+export type TokenizedProgram = { loadAddress: number; basicEnd: number; textBytes: number; lines: TokenizedLine[] } | { reason: string };
 
-export type TokenizedProgram = { loadAddress: number; basicEnd: number; lines: TokenizedLine[] } | { reason: string };
+/** BASIC text cannot start below the screen: there are the zero page, the stack and the system pages. */
+const MIN_BASIC_LOAD = 0x0400;
 
 /**
  * Splits a PRG into BASIC lines the way BASIC relinks a loaded program: each
  * line ends at a zero byte, and a link whose high byte is zero ends the
- * program. The stored links are not trusted.
+ * program. A real end marker is two zero bytes; when only the high byte is
+ * zero, the "marker" is the first machine code after the BASIC text (SYS
+ * lines that jump right behind themselves). The stored links are not read:
+ * BASIC relinks a loaded program, and a crack can store odd links to hide
+ * lines from LIST. A load address below $0400 is a memory dump (F-12), and so
+ * is a file whose bytes run past $ffff: a 64 KiB dump from $0000 always does
+ * (b2/01, R3-02).
  */
 export function parseTokenized(program: Uint8Array): TokenizedProgram {
   if (program.length < 4) return { reason: "The file is too short for a BASIC program." };
   const loadAddress = program[0]! | (program[1]! << 8);
+  if (loadAddress < MIN_BASIC_LOAD) {
+    return { reason: `The load address ${formatC64Address(loadAddress)} is below $0400, in the zero page, the stack or the system pages. The file is a memory dump or machine code, not a BASIC program.` };
+  }
+  if (loadAddress + program.length - 2 > 0x10000) {
+    return { reason: `The file holds ${program.length - 2} bytes from ${formatC64Address(loadAddress)}, which runs past $ffff. The file is a memory dump, not a BASIC program.` };
+  }
   const lines: TokenizedLine[] = [];
   let at = 2;
+  const ended = (basicEnd: number): TokenizedProgram => ({ loadAddress, basicEnd, textBytes: at, lines });
   // File offset k (from 2 on) loads at loadAddress + k - 2.
   for (;;) {
     // A file that ends right after a line leaves the end marker to the zeros after it in memory;
     // basicEnd is the address after that marker, as when the file holds it.
-    if (at === program.length && lines.length > 0) return { loadAddress, basicEnd: loadAddress + at, lines };
+    if (at === program.length && lines.length > 0) return ended(loadAddress + at);
     if (at + 1 >= program.length) return { reason: "The BASIC program has no end marker." };
     if (program[at + 1] === 0) {
       // An end marker before any line, with more bytes after it, is how machine code at a non-BASIC address often starts.
       if (lines.length === 0 && at + 2 < program.length) return { reason: "The file holds no BASIC line before other bytes, so it is no BASIC program." };
-      return { loadAddress, basicEnd: loadAddress + at, lines };
+      const marker = program[at] === 0;
+      return ended(loadAddress + (marker ? at : at - 2));
     }
     if (at + 4 > program.length) return { reason: "The last BASIC line is cut off." };
     const number = program[at + 2]! | (program[at + 3]! << 8);
@@ -174,8 +228,43 @@ export function parseTokenized(program: Uint8Array): TokenizedProgram {
   }
 }
 
+/** BASIC V2 keywords for the tokens $80 to $cb, in token order. */
+const KEYWORDS = [
+  "END", "FOR", "NEXT", "DATA", "INPUT#", "INPUT", "DIM", "READ", "LET", "GOTO", "RUN", "IF", "RESTORE", "GOSUB", "RETURN", "REM",
+  "STOP", "ON", "WAIT", "LOAD", "SAVE", "VERIFY", "DEF", "POKE", "PRINT#", "PRINT", "CONT", "LIST", "CLR", "CMD", "SYS", "OPEN",
+  "CLOSE", "GET", "NEW", "TAB(", "TO", "FN", "SPC(", "THEN", "NOT", "STEP", "+", "-", "*", "/", "^", "AND",
+  "OR", ">", "=", "<", "SGN", "INT", "ABS", "USR", "FRE", "POS", "SQR", "RND", "LOG", "EXP", "COS", "SIN",
+  "TAN", "ATN", "PEEK", "LEN", "STR$", "VAL", "ASC", "CHR$", "LEFT$", "RIGHT$", "MID$", "GO",
+] as const;
+
 /**
- * Evaluates a SYS argument that holds only numbers, + - * / and brackets.
+ * One BASIC line as text: keywords for tokens, text in quotes and after REM
+ * as it is, and {$xx} for bytes that are no character. For evidence, not a listing.
+ */
+export function basicLineText(line: TokenizedLine): string {
+  return `${line.number} ${basicText(line.tokens)}`;
+}
+
+/** Tokenized BASIC bytes as text, as for basicLineText; pi is π. */
+function basicText(tokens: Uint8Array): string {
+  let text = "";
+  let literal = false;
+  for (const byte of tokens) {
+    if (byte === QUOTE) literal = !literal;
+    if (!literal && byte >= 0x80 && byte < 0x80 + KEYWORDS.length) {
+      text += KEYWORDS[byte - 0x80];
+      if (byte === TOKEN.rem) literal = true;
+    } else if (!literal && byte === TOKEN.pi) {
+      text += "π";
+    } else {
+      text += petsciiNameToText(Uint8Array.of(byte));
+    }
+  }
+  return text;
+}
+
+/**
+ * Evaluates a SYS argument that holds only numbers, π, + - * / and brackets.
  * Returns undefined for anything that needs run-time values.
  */
 export function constantExpression(bytes: Uint8Array): number | undefined {
@@ -214,6 +303,10 @@ export function constantExpression(bytes: Uint8Array): number | undefined {
       if (value === undefined || tokens[at++] !== 0x29) return undefined;
       return value;
     }
+    if (peek() === TOKEN.pi) {
+      at++;
+      return Math.PI;
+    }
     return number();
   };
   const product = (): number | undefined => {
@@ -269,8 +362,9 @@ export function findHandoffs(lines: TokenizedLine[]): BasicHandoff[] {
         // The argument ends at the statement end or at a comma (extra SYS parameters).
         let end = at + 1;
         while (end < tokens.length && tokens[end] !== COLON && tokens[end] !== 0x2c) end++;
-        const value = constantExpression(tokens.subarray(at + 1, end));
-        if (value === undefined) handoffs.push({ kind: "sys", line: number, computed: true });
+        const argument = tokens.subarray(at + 1, end);
+        const value = constantExpression(argument);
+        if (value === undefined) handoffs.push({ kind: "sys", line: number, computed: true, expression: basicText(argument).trim() });
         // BASIC drops the fraction; outside 0-65535 SYS stops with ILLEGAL QUANTITY and jumps nowhere.
         else if (Math.trunc(value) >= 0 && Math.trunc(value) <= 0xffff) handoffs.push({ kind: "sys", line: number, address: Math.trunc(value) });
         at = end - 1;
@@ -279,3 +373,137 @@ export function findHandoffs(lines: TokenizedLine[]): BasicHandoff[] {
   }
   return handoffs;
 }
+
+// Execution coverage (D40): the byte format of a coverage map, and the 6502
+// instruction lengths that turn the instruction starts in it into code ranges.
+// VICE marks only the opcode byte of an executed instruction as executed.
+
+/** One byte per address: the access flags as VICE reports them, RAM, ROM and I/O apart. */
+export const COVERAGE = {
+  ramRead: 1 << 0,
+  ramWrite: 1 << 1,
+  ramExecute: 1 << 2,
+  romRead: 1 << 3,
+  romExecute: 1 << 4,
+  ioRead: 1 << 5,
+  ioWrite: 1 << 6,
+  ioExecute: 1 << 7,
+} as const;
+
+export const EXECUTE = COVERAGE.ramExecute | COVERAGE.romExecute | COVERAGE.ioExecute;
+export const READ = COVERAGE.ramRead | COVERAGE.romRead | COVERAGE.ioRead;
+export const WRITE = COVERAGE.ramWrite | COVERAGE.ioWrite;
+
+/**
+ * The length in bytes of the NMOS 6502/6510 instruction with this opcode, for
+ * all 256 opcodes with the undocumented ones. The opcode is aaabbbcc: bbb
+ * selects the addressing mode within a group cc. JAM (KIL) and BRK count one byte.
+ */
+export function instructionLength(opcode: number): 1 | 2 | 3 {
+  const group = opcode & 0b11;
+  const mode = (opcode >> 2) & 0b111;
+  if (group === 0b00) {
+    if (mode === 0b000) return opcode === 0x20 ? 3 : opcode === 0x00 || opcode === 0x40 || opcode === 0x60 ? 1 : 2;
+    return ([2, 2, 1, 3, 2, 2, 1, 3] as const)[mode]!;
+  }
+  if (group === 0b10) {
+    if (mode === 0b000) return opcode === 0x02 || opcode === 0x22 || opcode === 0x42 || opcode === 0x62 ? 1 : 2;
+    return ([2, 2, 1, 3, 1, 2, 1, 3] as const)[mode]!;
+  }
+  // Groups 01 and 11 share their addressing modes.
+  return ([2, 2, 2, 3, 2, 2, 3, 3] as const)[mode]!;
+}
+
+export interface CodeRange {
+  start: number;
+  end: number;
+}
+
+/**
+ * The executed code in RAM as ranges: each RAM instruction start in `map`
+ * with its operand bytes, by the opcode in `memory` (64 KiB from $0000).
+ * `map` starts at `base`. Adjacent and overlapping instructions merge.
+ */
+export function executedRamCode(map: Uint8Array, base: number, memory: Uint8Array): CodeRange[] {
+  const ranges: CodeRange[] = [];
+  for (let offset = 0; offset < map.length; offset++) {
+    if ((map[offset]! & COVERAGE.ramExecute) === 0) continue;
+    const start = base + offset;
+    const end = Math.min(0xffff, start + instructionLength(memory[start]!) - 1);
+    const last = ranges.at(-1);
+    if (last !== undefined && start <= last.end + 1) last.end = Math.max(last.end, end);
+    else ranges.push({ start, end });
+  }
+  return ranges;
+}
+
+// Coverage flows (D44, D74): the seeds that a coverage map gives a static analysis.
+
+/**
+ * Instructions after which the next instruction starts a flow for the seeds: the
+ * ones that do not fall through, and JSR, because an analyzer that takes the
+ * called routine for one that does not return stops there (the Bruce Lee run).
+ */
+const FLOW_ENDS = new Set([0x00, 0x20, 0x40, 0x4c, 0x60, 0x6c]);
+/**
+ * The executed instruction starts in RAM that begin a flow: the first after
+ * a gap, or the first after an instruction that does not fall through or is a
+ * JSR. The analyzers follow the rest of a flow themselves.
+ */
+export function coverageEntries(map: Uint8Array, image: (address: number) => number | undefined): number[] {
+  const entries: number[] = [];
+  let falls: number | undefined;
+  for (let address = 0; address < 0x10000; address++) {
+    if ((map[address]! & COVERAGE.ramExecute) === 0) continue;
+    const opcode = image(address);
+    if (opcode === undefined) continue;
+    if (falls !== address) entries.push(address);
+    falls = FLOW_ENDS.has(opcode) ? undefined : address + instructionLength(opcode);
+  }
+  return entries;
+}
+
+/** Every executed instruction start in RAM inside the image: VICE marks the opcode byte of an instruction as executed, not its operand. */
+export function executedStarts(map: Uint8Array, image: (address: number) => number | undefined): number[] {
+  const starts: number[] = [];
+  for (let address = 0; address < 0x10000; address++) if ((map[address]! & COVERAGE.ramExecute) !== 0 && image(address) !== undefined) starts.push(address);
+  return starts;
+}
+
+const BRANCHES = new Set([0x10, 0x30, 0x50, 0x70, 0x90, 0xb0, 0xd0, 0xf0]);
+
+/** Instructions that never fall through to the next one. */
+const NO_FALL = new Set([0x00, 0x40, 0x4c, 0x60, 0x6c]);
+
+/**
+ * The coverage flow starts split for Ghidra (D74). A start is a code start, a
+ * place in a routine, when it follows an executed JSR, or when an executed
+ * branch or JMP from outside its own flow reaches it (the loop of a routine
+ * that jumps back to its own start does not count). Any other start, for
+ * example a vector or table target, is a routine entry.
+ */
+export function coverageSeedKinds(map: Uint8Array, image: (address: number) => number | undefined): { routines: number[]; codeStarts: number[] } {
+  const entries = coverageEntries(map, image);
+  const flowOf = new Map<number, number>();
+  for (const entry of entries) {
+    // A flow runs over the executed instructions that fall through, also over a JSR.
+    for (let at = entry; ; ) {
+      const opcode = image(at);
+      if (opcode === undefined || (map[at]! & COVERAGE.ramExecute) === 0 || flowOf.has(at)) break;
+      flowOf.set(at, entry);
+      if (NO_FALL.has(opcode)) break;
+      at += instructionLength(opcode);
+    }
+  }
+  const inside = new Set<number>();
+  for (const address of executedStarts(map, image)) {
+    const opcode = image(address)!;
+    const low = image(address + 1);
+    const high = image(address + 2);
+    const reach = (target: number) => flowOf.get(address) !== target && inside.add(target);
+    if (BRANCHES.has(opcode) && low !== undefined) reach((address + 2 + (low < 0x80 ? low : low - 0x100)) & 0xffff);
+    if (opcode === 0x4c && low !== undefined && high !== undefined) reach(low | (high << 8));
+    if (opcode === 0x20) inside.add(address + 3);
+  }
+  return { routines: entries.filter((entry) => !inside.has(entry)), codeStarts: entries.filter((entry) => inside.has(entry)) };
+}

package/src/cli/cleanup.ts

@@ -29,7 +29,7 @@ interface Manifest {
 }
 
 /** The directory that the manifest and relative item paths belong to. */
-function scopeRoot(scope: Scope, cwd = process.cwd()): string {
+export function scopeRoot(scope: Scope, cwd = process.cwd()): string {
   return scope === "global" ? homedir() : cwd;
 }
 

package/src/cli/main.ts

@@ -7,14 +7,14 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 
-import { PACKAGE } from "../../distribution/package.ts";
+import { PACKAGE } from "../package.ts";
 import { localToolContext } from "../native/local.ts";
 import { localToolStatus } from "../native/status.ts";
 import { WireFailure } from "../protocol/messages.ts";
 import { startTrace } from "../trace.ts";
 import { runApSdk } from "./ap-sdk.ts";
 import { installedItems, parseTargets, tidyAfterUninstall, undoWindsurfProjectMcp, windsurfBefore, withoutWindsurfMcp, type Scope } from "./cleanup.ts";
-import { hostStatusLines, toolLines } from "./status.ts";
+import { hostStatusLines, installedLines, toolLines } from "./status.ts";
 
 const HELP = `c64-re-tools: Commodore 64 reverse engineering and development
 
@@ -27,10 +27,12 @@ Usage:
 
 Harnesses: claude, codex, pi, opencode, gemini, copilot, cursor, windsurf
 (comma-separated; default: all). Without --global the files go into the
-current project; with --global into your home directory.
+current folder; with --global into your home directory.
 
-Run it in the project: npx -y ${PACKAGE.name}@${PACKAGE.tag} install. The VICE
-MCP declaration starts the latest c64-re-tools-mcp through npx. The Host
+Run it once at the root of the repository:
+npx -y ${PACKAGE.name}@${PACKAGE.tag} install. Each project folder below
+the root uses that install; a project is a folder with .c64-re-tools/. The
+VICE MCP declaration starts the latest c64-re-tools-mcp through npx. The Host
 Runtime runs on the machine with VICE: start it there with
 npx -y --package=${PACKAGE.name}@${PACKAGE.tag} c64-re-tools-host.
 It runs VICE and the tools that come with it (c1541, petcat). The skill
@@ -50,10 +52,14 @@ async function status(): Promise<number> {
   console.log(`c64-re-tools ${PACKAGE.version}`);
   console.log(`Package: ${join(here, "..", "..")}`);
   console.log(`Node: ${process.version} (${process.execPath})`);
+  for (const line of installedLines()) console.log(line);
   // The skill scripts run these tools here, on this machine.
-  for (const line of toolLines("Tools here:", await localToolStatus(localToolContext()))) console.log(line);
-  for (const line of await hostStatusLines()) console.log(line);
-  return 0;
+  const local = await localToolStatus(localToolContext());
+  for (const line of toolLines("Tools here:", local)) console.log(line);
+  const host = await hostStatusLines();
+  for (const line of host.lines) console.log(line);
+  // A script or a CI check can tell a ready setup from a broken one.
+  return host.ready && local.every((tool) => tool.runs) ? 0 : 1;
 }
 
 async function main(argv: string[]): Promise<number> {

package/src/cli/status.ts

@@ -1,34 +1,128 @@
-// The status report of the CLI: the tools on this machine and the Host
-// Runtime with its tools.
+// The status report of the CLI: the installed skills and MCP declarations,
+// the tools on this machine and the Host Runtime with its tools.
 
+import { readFileSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+
+import { installedItems, scopeRoot, type InstallItem, type Scope } from "./cleanup.ts";
 import { hostTools, type ToolCallOptions } from "../host-client/tools.ts";
-import type { ToolStatus } from "../protocol/tools.ts";
+import { viceVersionOf } from "../native/discover.ts";
+import { PACKAGE } from "../package.ts";
+import { STOP_AND_ASK } from "../protocol/messages.ts";
+import type { HostInfo, ToolStatus } from "../protocol/tools.ts";
 
-/** One line per tool under `heading`: its version, or why it does not run. */
+/** One line per tool under `heading`: its version, or why it does not run; then each known flaw of it. */
 export function toolLines(heading: string, tools: readonly ToolStatus[]): string[] {
   return [
     heading,
-    ...tools.map((tool) =>
+    ...tools.flatMap((tool) => [
       tool.runs
         ? `  ${tool.name}: ${tool.version} (${tool.path})`
         : tool.found
           ? `  ${tool.name}: found at ${tool.path} but it does not run. ${tool.problem}`
           : `  ${tool.name}: missing. ${tool.problem}`,
-    ),
+      ...(tool.flaws ?? []).map((flaw) => `    Known flaw: ${flaw}`),
+    ]),
   ];
 }
 
 /**
  * Whether the Host Runtime answers, and the tools it has. VICE and its tools
  * live on the host; it finds and runs each one. One request shows both that
- * the host answers and what it has.
+ * the host answers and what it has. `ready` is true when the host answers and
+ * every tool on it runs.
  */
-export async function hostStatusLines(options: ToolCallOptions = {}): Promise<string[]> {
+export async function hostStatusLines(options: ToolCallOptions = {}): Promise<{ lines: string[]; ready: boolean }> {
+  let host: HostInfo;
   let tools: ToolStatus[];
   try {
-    tools = await hostTools(options);
+    ({ host, tools } = await hostTools(options));
   } catch (error) {
-    return [`Host Runtime: not reachable. ${(error as Error).message}`];
+    // status is read by a person: the instruction for an agent (D37) stays out.
+    return { lines: [`Host Runtime: not reachable. ${(error as Error).message.replace(` ${STOP_AND_ASK}`, "")}`], ready: false };
+  }
+  const mixed = mixedViceBuilds(tools);
+  return {
+    lines: [
+      `Host Runtime: reachable, c64-re-tools ${host.version} on ${host.platform} ${host.release} (${host.arch})`,
+      ...(host.version === PACKAGE.version ? [] : [`  Warning: the Host Runtime is c64-re-tools ${host.version} and this is ${PACKAGE.version}. Start the host again so that both are the same version.`]),
+      ...toolLines("Tools on the host:", tools),
+      ...(mixed === undefined ? [] : [`  Warning: ${mixed}`]),
+    ],
+    ready: tools.every((tool) => tool.runs),
+  };
+}
+
+/** A warning when x64sc, c1541 and petcat that run come from different VICE versions or builds. */
+export function mixedViceBuilds(tools: readonly ToolStatus[]): string | undefined {
+  const running = tools.filter((tool) => tool.runs && tool.version !== undefined);
+  const builds = running.map((tool) => {
+    const version = viceVersionOf(tool.version!);
+    return version === undefined ? tool.version! : `VICE ${version.major}.${version.minor}${version.revision === undefined ? "" : ` SVN r${version.revision}`}`;
+  });
+  if (new Set(builds).size <= 1) return undefined;
+  return `the VICE tools come from different VICE builds: ${running.map((tool) => `${tool.version} (${tool.path})`).join(", ")}. Put x64sc, c1541 and petcat of one VICE first on PATH, or set C64RT_VICE, C64RT_C1541 and C64RT_PETCAT.`;
+}
+
+/**
+ * The skills and MCP declarations that install wrote for this project and
+ * globally (b's R2-01): the c64-re-tools version of each harness's skills,
+ * from their package.json, and the command that starts the MCP server. A
+ * warning names skills of another version than this one.
+ */
+export function installedLines(cwd = process.cwd()): string[] {
+  const lines: string[] = [];
+  for (const scope of ["project", "global"] as const satisfies readonly Scope[]) {
+    const items = installedItems(scope, undefined, cwd);
+    if (items.length === 0) continue;
+    const root = scopeRoot(scope, cwd);
+    lines.push(`Installed ${scope === "project" ? `in this project (${root})` : "globally"}:`);
+    for (const harness of [...new Set(items.map((item) => item.harness))]) {
+      const skills = items.filter((item) => item.harness === harness && item.kind === "skill");
+      const versions = [...new Set(skills.map((item) => skillVersion(item, root)).filter((version) => version !== undefined))];
+      if (skills.length > 0) {
+        lines.push(`  ${harness}: ${skills.length} skills, c64-re-tools ${versions.length === 0 ? "of an unknown version" : versions.join(" and ")}`);
+        const other = versions.filter((version) => version !== PACKAGE.version);
+        if (other.length > 0) lines.push(`  Warning: the ${harness} skills are c64-re-tools ${other.join(" and ")} and this is ${PACKAGE.version}. Run npx -y ${PACKAGE.name}@${PACKAGE.tag} update${scope === "global" ? " --global" : ""} to install this version.`);
+      }
+      for (const item of items.filter((candidate) => candidate.harness === harness && candidate.kind === "mcp")) {
+        lines.push(`  ${harness} MCP server: ${mcpCommand(item, root) ?? `declared in ${item.files.join(", ")}`}`);
+      }
+    }
+  }
+  if (lines.length === 0) return ["Installed: nothing in this project or globally."];
+  lines.push("  The MCP server gives its own version in the result of c64_status.");
+  return lines;
+}
+
+function itemPath(file: string, root: string): string {
+  return isAbsolute(file) ? file : join(root, file);
+}
+
+/** The version in the package.json of an installed skill; a skill without scripts has none. */
+function skillVersion(item: InstallItem, root: string): string | undefined {
+  const file = item.files.find((candidate) => candidate.endsWith("/package.json") || candidate.endsWith("\\package.json"));
+  if (file === undefined) return undefined;
+  try {
+    const { version } = JSON.parse(readFileSync(itemPath(file, root), "utf8")) as { version?: unknown };
+    return typeof version === "string" ? version : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** The command of the MCP server in a JSON configuration file, or undefined for another format. */
+function mcpCommand(item: InstallItem, root: string): string | undefined {
+  const key = item.detail?.mergeKey;
+  const [file] = item.files;
+  if (key === undefined || file === undefined) return undefined;
+  try {
+    const servers = (JSON.parse(readFileSync(itemPath(file, root), "utf8")) as Record<string, unknown>)[key] as Record<string, { command?: unknown; args?: unknown }> | undefined;
+    const server = servers?.[item.name];
+    if (typeof server?.command !== "string") return undefined;
+    const args = Array.isArray(server.args) ? server.args.filter((arg): arg is string => typeof arg === "string") : [];
+    return [server.command, ...args].join(" ");
+  } catch {
+    return undefined;
   }
-  return ["Host Runtime: reachable", ...toolLines("Tools on the host:", tools)];
 }