@khoavu882/doflow 2.0.0-beta.5 → 2.0.1

package/src/runtime/health.js

@@ -22,11 +22,15 @@ const os = require('node:os');
 const path = require('node:path');
 const { execFileSync } = require('node:child_process');
 const { CapabilityRouter } = require('./capability-router.js');
-const { loadRegistry } = require('../registry/index.js');
+const { loadRegistry, agentToolScopeView } = require('../registry/index.js');
 const { evaluateReach } = require('./reach.js');
 const { mcpReach } = require('./mcp-reach.js');
 const { OUTCOME_LABELS } = require('./mcp-consultations.js');
 const { REPO_ROOT } = require('../helper/repo-root.js');
+const { readGrants, detectedProjectRoot } = require('./packages/grants.js');
+const { readState, grantRevoked } = require('./packages/state.js');
+const { transcriptsDoctorView } = require('./transcripts/registry.js');
+const { readLedger, stateRoot } = require('../state/index.js');
 
 /** Answered a probe. */
 const HEALTHY = 'HEALTHY';
@@ -82,9 +86,10 @@ const SCAN_FILE_LIMIT = 4000;
  * @param {Object} [options]
  * @param {Function} [options.execFileImpl=execFileSync]
  * @param {number} [options.timeoutMs=PROBE_TIMEOUT_MS]
+ * @param {boolean} [options.retryOnTimeout] run the probe once more after a timeout; defaults to true for git only
  * @returns {{ok: boolean, output: string, durationMs: number, timedOut: boolean, error: string|null}}
  */
-function runProbe(command     , { execFileImpl = execFileSync, timeoutMs = PROBE_TIMEOUT_MS }      = {}) {
+function runProbe(command     , { execFileImpl = execFileSync, timeoutMs = PROBE_TIMEOUT_MS, retryOnTimeout = path.basename(String(command[0])) === 'git' }      = {})      {
   const [bin, ...args] = command;
   const started = Number(process.hrtime.bigint() / 1000000n);
   try {
@@ -105,6 +110,9 @@ function runProbe(command     , { execFileImpl = execFileSync, timeoutMs = PROBE
     // repairs — a timeout usually means a first-run index build, a non-zero exit usually means a
     // broken install — so they are reported apart rather than as one failure string.
     const timedOut = error.killed === true || error.code === 'ETIMEDOUT' || error.signal === 'SIGTERM';
+    // A cold macOS git shim can outlast the first probe and answer at once the second time, which made the
+    // first `doflow doctor` exit 1 falsely (FU-93wtsf). Only the git probe is retried, once.
+    if (timedOut && retryOnTimeout) return runProbe(command, { execFileImpl, timeoutMs, retryOnTimeout: false });
     return {
       ok: false,
       output: '',
@@ -243,6 +251,95 @@ function probeFreshness(providerId     , { root = process.cwd(), homeDir = os.ho
   };
 }
 
+async function probeLocalProvider(
+  provider     ,
+  options                                                                            = {}
+)               {
+  const timeoutMs = options.timeoutMs ?? 1500;
+
+  if (provider.kind === 'http') {
+    const targetUrl = provider.healthEndpoint || provider.endpoint;
+    const { probeHttpEndpoint } = require('./capabilities/executor.js');
+    const probeRes = await probeHttpEndpoint(targetUrl, {
+      timeoutMs,
+      fetchImpl: options.fetchImpl,
+    });
+    if (probeRes.ok) {
+      return {
+        id: provider.id,
+        name: provider.name || provider.id,
+        kind: 'http',
+        status: 'HEALTHY',
+        endpoint: targetUrl,
+        answered: true,
+        durationMs: probeRes.durationMs,
+        detail: `HTTP ${probeRes.status}`,
+      };
+    }
+    if (probeRes.isUnavailable) {
+      return {
+        id: provider.id,
+        name: provider.name || provider.id,
+        kind: 'http',
+        status: 'UNAVAILABLE',
+        endpoint: targetUrl,
+        answered: false,
+        durationMs: probeRes.durationMs,
+        detail: `Local server at ${targetUrl} is not running`,
+      };
+    }
+    return {
+      id: provider.id,
+      name: provider.name || provider.id,
+      kind: 'http',
+      status: 'UNHEALTHY',
+      endpoint: targetUrl,
+      answered: probeRes.status !== undefined,
+      durationMs: probeRes.durationMs,
+      detail: probeRes.status ? `HTTP status ${probeRes.status}` : (probeRes.error || 'HTTP request failed'),
+    };
+  }
+
+  if (provider.kind === 'cli') {
+    const binary = provider.binary || provider.program;
+    const isAvail = options.router ? options.router.isBinaryAvailable(binary) : true;
+    if (!isAvail) {
+      return {
+        id: provider.id,
+        name: provider.name || provider.id,
+        kind: 'cli',
+        status: 'UNAVAILABLE',
+        binary,
+        answered: false,
+        durationMs: null,
+        detail: `Binary '${binary}' not found on PATH`,
+      };
+    }
+    const checkCommand = provider.checkCommand || [binary, '--version'];
+    const probe = runProbe(checkCommand, { execFileImpl: options.execFileImpl, timeoutMs });
+    return {
+      id: provider.id,
+      name: provider.name || provider.id,
+      kind: 'cli',
+      status: probe.ok ? 'HEALTHY' : 'UNHEALTHY',
+      binary,
+      answered: probe.ok,
+      durationMs: probe.durationMs,
+      detail: probe.ok ? banner(probe.output) : probe.error,
+    };
+  }
+
+  return {
+    id: provider.id,
+    name: provider.name || provider.id,
+    kind: provider.kind || 'native',
+    status: 'UNVERIFIED',
+    answered: false,
+    durationMs: null,
+    detail: 'unsupported probe kind',
+  };
+}
+
 /**
  * Probes one provider declared in `capabilities.json`.
  * @param {Object} provider
@@ -257,10 +354,11 @@ function probeProvider(provider     , { router, projectRoot = process.cwd(), exe
   if (!provider || !provider.id) {
     return { id: null, status: UNVERIFIED, detail: 'no provider declared' };
   }
+  const binary = provider.binary || provider.program || null;
   const result      = {
     id: provider.id,
     name: provider.name || provider.id,
-    binary: provider.binary || null,
+    binary,
     present: null,
     answered: false,
     status: UNVERIFIED,
@@ -270,22 +368,32 @@ function probeProvider(provider     , { router, projectRoot = process.cwd(), exe
     freshness: null,
   };
 
-  if (provider.binary) {
-    result.present = router.isBinaryAvailable(provider.binary);
+  if (binary) {
+    result.present = router ? router.isBinaryAvailable(binary) : false;
     if (!result.present) {
       result.status = ABSENT;
-      result.detail = `binary '${provider.binary}' is not on PATH`;
+      result.detail = `binary '${binary}' is not on PATH`;
+      return result;
+    }
+  }
+
+  if (provider.kind === 'http' || provider.endpoint) {
+    const { validateLoopbackUrl } = require('./capabilities/loopback.js');
+    const valid = validateLoopbackUrl(provider.endpoint);
+    if (!valid.ok) {
+      result.status = UNHEALTHY;
+      result.detail = `Disallowed endpoint: ${valid.reason}`;
       return result;
     }
   }
 
   const command = Array.isArray(provider.checkCommand) && provider.checkCommand.length
     ? provider.checkCommand
-    : null;
+    : (provider.kind === 'cli' && binary ? [binary, '--version'] : null);
   if (!command) {
     result.status = UNVERIFIED;
-    result.detail = provider.binary
-      ? `binary '${provider.binary}' is present but the registry declares no probe command, so DoFlow cannot establish that it answers`
+    result.detail = binary
+      ? `binary '${binary}' is present but the registry declares no probe command, so DoFlow cannot establish that it answers`
       : 'declares neither a binary nor a probe command, so its function depends entirely on the project (see the project commands section)';
     return result;
   }
@@ -500,13 +608,29 @@ const byText = (a     , b     ) => (a < b ? -1 : a > b ? 1 : 0);
  */
 function mcpConsultationsView({ projectRoot, fsImpl }     ) {
   const dir = path.join(projectRoot, '.doflow', 'state', 'orchestration');
-  let files = [];
-  try { files = fsImpl.readdirSync(dir).filter((name     ) => name.endsWith('.json')).sort(); } catch { files = []; }
+  // Runs live flat or in `<slug>/` (115: a task id other than its feature's slug is namespaced).
+  const listed                                                                    = [];
+  const readRunFile = (rel        , name        , namespace        )       => {
+    let run;
+    try { run = JSON.parse(fsImpl.readFileSync(path.join(dir, rel), 'utf8')); } catch { run = null; }
+    listed.push({ rel, name, namespace, run });
+  };
+  let entries        = [];
+  try { entries = fsImpl.readdirSync(dir, { withFileTypes: true }); } catch { entries = []; }
+  for (const entry of entries) if (entry.name.endsWith('.json') && !entry.isDirectory()) readRunFile(entry.name, entry.name, '');
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(entry.name) || entry.name.endsWith('.lock')) continue;
+    let inner        = [];
+    try { inner = fsImpl.readdirSync(path.join(dir, entry.name), { withFileTypes: true }); } catch { inner = []; }
+    for (const file of inner) if (file.name.endsWith('.json') && !file.isDirectory()) readRunFile(`${entry.name}/${file.name}`, file.name, entry.name);
+  }
+  listed.sort((a, b) => byText(a.rel, b.rel));
+  // A flat run whose namespaced copy exists is that copy's seed, not a second run.
+  const files = listed.filter((one) => one.namespace !== '' || !listed.some((other) => other.namespace !== '' && other.name === one.name
+    && (typeof one.run?.featureSlug !== 'string' || one.run.featureSlug === other.namespace)));
   let unreadableRuns = 0;
   const bySkill = new Map();
-  for (const name of files) {
-    let run;
-    try { run = JSON.parse(fsImpl.readFileSync(path.join(dir, name), 'utf8')); } catch { run = null; }
+  for (const { name, run } of files) {
     if (!run || typeof run !== 'object' || Array.isArray(run)) { unreadableRuns += 1; continue; }
     for (const item of Array.isArray(run.history) ? run.history : []) {
       const record = item && item.consultations;
@@ -555,6 +679,68 @@ function mcpView({ registry, projectRoot, fsImpl, adapters }     ) {
   return { servers, ...(serversNote ? { serversNote } : {}), consultations: mcpConsultationsView({ projectRoot, fsImpl }) };
 }
 
+/**
+ * The doctor's `packages` block (122 IC-008, IC-009): the grants file path and mtime, every grant with its state,
+ * and the counts held in `state.json`. A trust or exempt grant a revocation covers (or any, when `state.json` is
+ * unreadable) is listed `revoked`. Read-only and not blocking; a failure degrades to a note.
+ */
+function packagesView({ projectRoot, fsImpl, env, homeDir, tmpDir }     ) {
+  try {
+    // The trust root is the project detected from the directory reported on, never that directory itself (IC-008).
+    const home = homeDir ?? (typeof env?.HOME === 'string' && path.isAbsolute(env.HOME) ? env.HOME : os.homedir());
+    const grants = readGrants({ env, fsImpl, projectRoot: detectedProjectRoot({ cwd: projectRoot, homeDir: home, fsImpl }), tmpDir });
+    const state = readState({ homeDir, fsImpl });
+    const rows = grants.entries.map((entry     ) => {
+      const revoked = entry.state === 'valid' && entry.grant !== 'fetch' && grantRevoked(state, entry);
+      const target = entry.grant === 'fetch' ? (entry.source.url || entry.source.name) : `${entry.package}@${entry.version}`;
+      return { line: entry.line, grant: entry.grant, target, state: revoked ? 'revoked' : entry.state, ...(revoked ? { reason: state.unreadable ? 'state-unreadable' : 'revoked' } : entry.reason ? { reason: entry.reason } : {}) };
+    });
+    return {
+      grants: { path: grants.path, noConfigHome: grants.noConfigHome, exists: grants.exists, mtime: grants.mtime, rows, findings: grants.findings },
+      suspendedProjected: state.state.suspended.filter((item     ) => item.projected).map((item     ) => item.package).sort(),
+      state: {
+        path: state.path, exists: state.exists, unreadable: state.unreadable, findings: state.findings,
+        revoked: state.state.revoked.length, suspended: state.state.suspended.length, removed: state.state.removed.length,
+      },
+    };
+  } catch (error     ) {
+    return { note: `package grants unavailable: ${error.message}` };
+  }
+}
+
+function printPackagesSection(packages     ) {
+  console.log('\n[Packages] — person grants and DoFlow state; not blocking');
+  if (packages.note) { console.log(`  ${packages.note}`); return; }
+  const { grants, state } = packages;
+  if (grants.noConfigHome) console.log('  grants            no config home (HOME and XDG_CONFIG_HOME unset): no grant can exist');
+  else if (!grants.exists) console.log(`  grants            none (no file at ${grants.path})`);
+  else {
+    console.log(`  grants            ${grants.path} (modified ${grants.mtime})`);
+    for (const row of grants.rows) console.log(`    line ${String(row.line).padEnd(5)}${row.grant.padEnd(8)}${row.target.padEnd(28)}${row.state}${row.reason ? ` (${row.reason})` : ''}`);
+    for (const item of grants.findings) console.log(`    ${item.code}: ${item.message}`);
+  }
+  if (state.unreadable) console.log(`  state             ${state.path} is unreadable: every package counts as revoked (run: doflow package --action verify --repair)`);
+  else if (state.revoked || state.suspended || state.removed) console.log(`  state             ${state.revoked} revoked, ${state.suspended} suspended, ${state.removed} removed (${state.path})`);
+  for (const id of packages.suspendedProjected ?? []) {
+    console.log(`  suspended         ${id} still has projected files (run: doflow package --action verify)`);
+  }
+}
+
+/** Whether the text report shows `[Packages]`: only when there is something to say. */
+/** The `[Transcripts]` row (093 V.1): shown only when the registry is stale or drifted; never a finding. */
+function printTranscriptsSection(transcripts     ) {
+  if (transcripts.state === 'ok') return;
+  console.log('\n[Transcripts] — transcript locator registry; not blocking');
+  if (transcripts.state === 'drift') {
+    console.log('  transcripts.json  drift: the transcript feature is off');
+    for (const error of transcripts.errors) console.log(`    ${error}`);
+    return;
+  }
+  for (const item of transcripts.stale) console.log(`  ${item.harness.padEnd(18)}verifiedOn ${item.verifiedOn} (${item.ageDays} days ago): re-verify its locations`);
+}
+
+const packagesWorthShowing = (packages     ) => Boolean(packages.note || packages.grants.exists || packages.state.exists);
+
 const MCP_STATE_MARK                      = Object.freeze({
   selected: '✓ selected',
   configured: '✓ configured',
@@ -602,7 +788,86 @@ function printMcpSections(mcp     ) {
   if (unreadableRuns) console.log(`  ${unreadableRuns} run file(s) could not be read`);
 }
 
-function buildHealthReport({ repoRoot, projectRoot = process.cwd(), router, execFileImpl, fsImpl = fs, detector, adapters }      = {}) {
+/** The first release of each Node line that carries the 2026-10-21 security fix (CVE-2026-111497). */
+const NODE_PATCHED_RELEASE                           = Object.freeze({ 24: [24, 22, 1], 26: [26, 12, 1] });
+
+/**
+ * A warning when `version` (a `process.version` string) is a release of a Node line below that
+ * line's patched release; null for a patched release and for a line this table does not know.
+ * The floor in `bin/doflow.js` already refuses anything under 24.22.1, so in practice this fires for
+ * a Node 26 below 26.12.1; the 24 entry keeps the table complete for a caller that bypasses the bin. A line with no entry (25, 27) gets no warning. A prerelease of the
+ * patched release (26.12.1-rc.1) counts as below it.
+ */
+function nodeSecurityWarning(version        )                                                           {
+  const parts = /^v?(\d+)\.(\d+)\.(\d+)(-.*)?$/.exec(String(version));
+  if (!parts) return null;
+  const running = [Number(parts[1]), Number(parts[2]), Number(parts[3])];
+  const patched = NODE_PATCHED_RELEASE[running[0]];
+  if (!patched) return null;
+  const order = patched.reduce((result, part, i) => result || Math.sign(running[i] - part), 0);
+  const below = order < 0 || (order === 0 && Boolean(parts[4])); // a prerelease of the patched release sorts below it
+  if (!below) return null;
+  return {
+    kind: 'node-security-release',
+    subject: 'node',
+    detail: `Node ${String(version).replace(/^v/, '')} is below ${patched.join('.')}, the first ${running[0]}.x release with the fix for CVE-2026-111497 (2026-10-21 security release); upgrade Node`,
+  };
+}
+
+/**
+ * The Claude permission lists a user's own array hides. `mergeSettings` keeps an existing array whole
+ * (a union would widen the user's own permissions), so a settings.json that already had a
+ * `permissions.allow`, `deny` or `ask` array never receives DoFlow's entries for that list. A file is
+ * judged only when the install ledger of its scope records a Claude `settings.json` projection (the
+ * ledger, not hook presence, so an install with Claude outside `hooks.harnesses` is judged too); the
+ * ledgers read are the global one and each project one on the walk from `projectRoot` up to the home
+ * directory, the same walk the reach check makes. The entries named are the shipped ones missing from
+ * the user's array, so the person can add them or leave the list as it is.
+ */
+function claudePermissionWarnings({ repoRoot, projectRoot, homeDir, fsImpl = fs }     )                                                           {
+  let managed     ;
+  try {
+    managed = JSON.parse(fsImpl.readFileSync(path.join(repoRoot, 'core', 'harnesses', 'claude', 'settings', 'settings.json'), 'utf8'));
+  } catch { return []; }
+  const lists                      = managed?.permissions && typeof managed.permissions === 'object' ? managed.permissions : {};
+  const projects = (() => {
+    const found           = [];
+    const home = path.resolve(homeDir);
+    for (let dir = path.resolve(projectRoot); dir !== home; dir = path.dirname(dir)) {
+      found.push(dir);
+      if (path.dirname(dir) === dir) break;
+    }
+    return found;
+  })();
+  const scopes = [
+    { installRoot: path.resolve(homeDir), stateDir: stateRoot({ scope: 'global', homeDir }) },
+    ...projects.map((installRoot) => ({ installRoot, stateDir: path.join(installRoot, '.doflow', 'state') })),
+  ];
+  const warnings                                                           = [];
+  for (const { installRoot, stateDir } of scopes) {
+    let ledger     ;
+    try { ledger = readLedger(stateDir, { fsImpl }); } catch { continue; }
+    const projected = (ledger?.resources || []).some((resource     ) => resource?.harness === 'claude' && resource.kind === 'settings-file' && resource.identity === 'settings.json');
+    if (!projected) continue;
+    const file = path.join(installRoot, '.claude', 'settings.json');
+    let current     ;
+    try { current = JSON.parse(fsImpl.readFileSync(file, 'utf8')); } catch { continue; }
+    for (const [list, shipped] of Object.entries     (lists)) {
+      const own = current?.permissions?.[list];
+      if (!Array.isArray(own) || !Array.isArray(shipped)) continue;
+      const missing = shipped.filter((entry     ) => !own.includes(entry));
+      if (!missing.length) continue;
+      warnings.push({
+        kind: 'claude-permissions-user-array',
+        subject: `${file}: permissions.${list}`,
+        detail: `your own permissions.${list} list wins whole, so DoFlow's entries are absent from it (${missing.join(', ')}); DoFlow never merges into a list you wrote, so add them yourself if you want that behaviour`,
+      });
+    }
+  }
+  return warnings;
+}
+
+function buildHealthReport({ repoRoot, projectRoot = process.cwd(), router, execFileImpl, fsImpl = fs, detector, adapters, env = process.env, nodeVersion = process.version, homeDir, tmpDir, now }      = {}) {
   const root = repoRoot || REPO_ROOT;
   const registry = loadRegistry({ repoRoot: root });
   const activeRouter = router || new CapabilityRouter({ repoRoot: root, projectRoot });
@@ -665,7 +930,11 @@ function buildHealthReport({ repoRoot, projectRoot = process.cwd(), router, exec
       .filter((row     ) => row.state === 'NO-REACH')
       .map((row     ) => ({ kind: 'runtime-no-reach', subject: `${row.harness}:${row.scope}`, detail: `${row.reason}; fix: ${row.fix}` })),
   ];
+  const nodeWarning = nodeSecurityWarning(nodeVersion);
+  const home = homeDir ?? (typeof env?.HOME === 'string' && path.isAbsolute(env.HOME) ? env.HOME : os.homedir());
   const warnings = [
+    ...(nodeWarning ? [nodeWarning] : []),
+    ...claudePermissionWarnings({ repoRoot: root, projectRoot, homeDir: home, fsImpl }),
     ...freshness
       .filter((item) => item.state === 'STALE')
       .map((item) => ({ kind: 'index-stale', subject: item.providerId, detail: `${item.label} is behind the working tree; refresh with: ${item.refresh}` })),
@@ -704,6 +973,8 @@ function buildHealthReport({ repoRoot, projectRoot = process.cwd(), router, exec
     freshness,
     project,
     mcp: mcpView({ registry, projectRoot, fsImpl, adapters }),
+    packages: packagesView({ projectRoot, fsImpl, env, homeDir, tmpDir }),
+    transcripts: transcriptsDoctorView({ repoRoot: root, fsImpl, now }),
     findings,
     warnings,
     summary: {
@@ -713,6 +984,8 @@ function buildHealthReport({ repoRoot, projectRoot = process.cwd(), router, exec
       absent: Object.values(probes).filter((probe) => probe.status === ABSENT).length,
       unverified: Object.values(probes).filter((probe) => probe.status === UNVERIFIED).length,
     },
+    // IC-006: the read switch of doctor's own environment, only when set (additive key).
+    ...(env.DOFLOW_UPKEEP === 'off' ? { upkeepSwitch: 'off' } : {}),
   };
 }
 
@@ -755,6 +1028,121 @@ const FRESHNESS_MARK                      = Object.freeze({
   UNKNOWN: '? UNKNOWN',
 });
 
+/** IC-014: read enabled state, bound tiers and unfiltered eligibility without writing or running worker probes. */
+function workersDoctorView({
+  env = process.env, projectRoot, repoRoot = REPO_ROOT, descriptors, now,
+}      = {}) {
+  const reg = loadRegistry({ repoRoot });
+  const root = require('./lifecycle/root.js').projectRoot(projectRoot);
+  const { activeWorkers } = require('./worker/active.js');
+  // Readiness already requires health.ts; load it only after this module has initialized.
+  const { select, enabledOf, workerDescriptors } = require('./worker/readiness.js');
+  const { readBindings, resolveBinding } = require('./worker/models.js');
+  const active = activeWorkers({ registry: reg, env, projectRoot: root });
+  const bindings = readBindings({ env, projectRoot: root });
+  const entries = workerDescriptors({ descriptors, registry: reg });
+  const tiers = reg.dispatchTiers?.tiers ?? [];
+  const selection = select({
+    descriptors, registry: reg, env, cwd: projectRoot, root, now, needs: [], includeDisabled: true,
+  });
+  const rows = selection.candidates.map(({ harness, eligible, gaps }     ) => {
+    const gap = gaps[0];
+    const descriptor = entries.find((entry     ) => entry.harness === harness)?.worker;
+    const bound = tiers.flatMap((tier        ) => {
+      const resolved = resolveBinding({ worker: harness, tier, bindings, descriptor });
+      return resolved.source === 'binding' ? [{ tier, flag: resolved.flag }] : [];
+    });
+    return {
+      harness,
+      enabled: enabledOf(active, harness),
+      eligible,
+      firstGap: gap ? { requirement: gap.requirement, result: gap.result, reason: gap.reason } : null,
+      bound,
+    };
+  });
+  return {
+    state: active.state,
+    origin: active.origin,
+    inSession: active.inSession,
+    reason: active.reason,
+    dangling: active.dangling,
+    bindings: { state: bindings.state, reason: bindings.reason },
+    rows,
+  };
+}
+
+/** IC-005: read observed catalogue, login states, derived billing and enabled models without running probes. */
+function workerPoolDoctorView({
+  env = process.env, projectRoot, repoRoot = REPO_ROOT,
+}      = {}) {
+  const { readCatalogue } = require('./models/catalogue.js');
+  const { readAllowedModels } = require('./worker/models.js');
+  const { readWorkerBilling, effectiveBilling } = require('./settings/worker-billing.js');
+  const { HARNESS_IDS } = require('./worker/probes/index.js');
+  const reg = loadRegistry({ repoRoot });
+  const root = require('./lifecycle/root.js').projectRoot(projectRoot);
+
+  const catalogue = readCatalogue(root);
+  const allowed = readAllowedModels({ projectRoot: root }) || [];
+  const workerIds = reg.harnesses.map((h     ) => h.id);
+  const billingRecord = readWorkerBilling(env, { workerIds });
+
+  const observedModelIds = new Set        ();
+  const harnesses        = [];
+  const allHarnessIds = Array.from(new Set([...HARNESS_IDS, ...Object.keys(catalogue?.harnesses || {})]));
+
+  for (const id of allHarnessIds) {
+    const catEntry = catalogue?.harnesses?.[id];
+    const regEntry = reg.harnesses.find((h     ) => h.id === id);
+    const descBilling = regEntry?.worker?.billing ?? 'unknown';
+
+    if (catEntry) {
+      for (const m of catEntry.offeredModels || []) {
+        if (m && m.id) observedModelIds.add(m.id);
+      }
+      const effBilling = effectiveBilling(descBilling, id, billingRecord, catalogue);
+      harnesses.push({
+        harness: id,
+        binary: catEntry.binary || id,
+        installed: Boolean(catEntry.installed),
+        loginState: catEntry.loginState,
+        reloginHint: catEntry.reloginHint || null,
+        detectedMode: catEntry.detectedMode,
+        effectiveBilling: effBilling,
+        offeredCount: (catEntry.offeredModels || []).length,
+      });
+    } else {
+      const effBilling = effectiveBilling(descBilling, id, billingRecord, null);
+      harnesses.push({
+        harness: id,
+        binary: id,
+        installed: false,
+        loginState: 'uncalibrated',
+        reloginHint: null,
+        detectedMode: 'unverified',
+        effectiveBilling: effBilling,
+        offeredCount: 0,
+      });
+    }
+  }
+
+  let enabledCount = 0;
+  for (const mId of observedModelIds) {
+    if (allowed.includes(mId)) enabledCount++;
+  }
+
+  return {
+    state: catalogue ? 'synced' : 'unsynced',
+    syncedAt: catalogue?.syncedAt || null,
+    harnesses,
+    models: {
+      enabledCount,
+      listedCount: observedModelIds.size,
+      enabled: allowed,
+    },
+  };
+}
+
 /**
  * Handles `doflow doctor` — installation and capability health.
  * @param {Object} options
@@ -765,11 +1153,159 @@ const FRESHNESS_MARK                      = Object.freeze({
  *   installed harness's skills cannot reach a runtime
  */
 async function handleDoctorCommand({ json = false, repoRoot, projectRoot = process.cwd(), ...rest }      = {}) {
-  const report      = buildHealthReport({ repoRoot, projectRoot, ...rest });
+  const root = repoRoot || REPO_ROOT;
+  const activeRouter = rest.router || new CapabilityRouter({ repoRoot: root, projectRoot });
+  const report      = buildHealthReport({ repoRoot: root, projectRoot, router: activeRouter, ...rest });
+
+  // Probe local capability providers asynchronously (REV-1)
+  for (const capability of Object.values     (activeRouter.capabilities || {})) {
+    for (const provider of capability.providers || []) {
+      if (!provider || !provider.id) continue;
+      if (provider.kind === 'http' || provider.kind === 'cli') {
+        const localRes = await probeLocalProvider(provider, {
+          router: activeRouter,
+          execFileImpl: rest.execFileImpl,
+          fetchImpl: rest.fetchImpl,
+        });
+        const provIdx = report.providers.findIndex((p     ) => p.id === provider.id);
+        if (provIdx !== -1) {
+          report.providers[provIdx] = { ...report.providers[provIdx], ...localRes };
+        } else {
+          report.providers.push(localRes);
+        }
+      }
+    }
+  }
+
+  // Refresh report.capabilities with updated probe states
+  const probeMap                      = {};
+  for (const p of report.providers) {
+    probeMap[p.id] = p;
+  }
+  for (const cap of report.capabilities) {
+    const capDef = activeRouter.capabilities[cap.capability];
+    if (capDef && Array.isArray(capDef.providers)) {
+      const declared = capDef.providers.map((p     ) => probeMap[p.id]).filter(Boolean);
+      const rolled = capabilityStatus(declared);
+      cap.status = rolled.status;
+      cap.activeProvider = rolled.activeProvider;
+      cap.providers = declared.map((p     ) => ({ id: p.id, status: p.status, detail: p.detail }));
+    }
+  }
+
+  // Refresh summary, findings, warnings, and effective identity
+  report.summary.healthy = report.providers.filter((p     ) => p.status === HEALTHY).length;
+  report.summary.unhealthy = report.providers.filter((p     ) => p.status === UNHEALTHY).length;
+  report.summary.absent = report.providers.filter((p     ) => p.status === ABSENT).length;
+  report.summary.unverified = report.providers.filter((p     ) => p.status === UNVERIFIED).length;
+  report.summary.probed = report.providers.length;
+
+  const nonProviderFindings = report.findings.filter(
+    (f     ) => f.kind !== 'provider-unhealthy' && f.kind !== 'capability-degraded'
+  );
+  report.findings = [
+    ...nonProviderFindings,
+    ...report.providers
+      .filter((p     ) => p.status === UNHEALTHY)
+      .map((p     ) => ({ kind: 'provider-unhealthy', subject: p.id, detail: p.detail })),
+    ...report.capabilities
+      .filter((c     ) => c.status === 'DEGRADED')
+      .map((c     ) => ({ kind: 'capability-degraded', subject: c.capability, detail: 'every installed provider for this capability failed its probe' })),
+  ];
+
+  const nonProviderWarnings = report.warnings.filter(
+    (w     ) => w.kind !== 'provider-unverified'
+  );
+  report.warnings = [
+    ...nonProviderWarnings,
+    ...report.providers
+      .filter((p     ) => p.status === UNVERIFIED)
+      .map((p     ) => ({ kind: 'provider-unverified', subject: p.id, detail: p.detail })),
+  ];
+
+  report.identity.connectedCapabilities = report.capabilities
+    .filter((c     ) => c.activeProvider)
+    .map((c     ) => c.capability);
+
   const { buildAdviceDoctor, printAdviceDoctor } = require('./advice/doctor.js');
+  const { buildSettingsReport, printSettingsReport } = require('./settings/cli.js');
   const adviceSections = await buildAdviceDoctor({ repoRoot, projectRoot, fsImpl: rest.fsImpl });
+  const settings = buildSettingsReport({ repoRoot, projectRoot, env: rest.env, fsImpl: rest.fsImpl });
   report.decisionModel = adviceSections.decisionModel;
   report.advice = adviceSections.advice;
+  report.settings = settings;
+  const { buildProfilesDoctor, printProfilesDoctor } = require('./profiles/doctor.js');
+  const profilesSection = buildProfilesDoctor({ repoRoot, projectRoot, env: rest.env, fsImpl: rest.fsImpl });
+  report.rolloutProfile = profilesSection;
+  try {
+    const { loadRuleLedger, getAblationCandidates } = require('./guidance/ablation.js');
+    const ledger = loadRuleLedger({ repoRoot, fsImpl: rest.fsImpl });
+    const candidates = getAblationCandidates(ledger);
+    const neverAblateCount = ledger.rules.filter((r     ) => r.neverAblate).length;
+    report.guidance = {
+      rulesCount: ledger.rules.length,
+      neverAblateCount,
+      candidateCount: candidates.length,
+    };
+  } catch (error     ) {
+    report.guidance = { state: 'unavailable', message: error?.message || String(error) };
+  }
+  try {
+    const { AdmissionController, AdmissionError, resolveTeamSettings } = require('./team/admission.js');
+    const { validateTaskBrief, validateTaskHandBack, quarantineInput, formatTaskBriefPrompt, EnvelopeError } = require('./team/envelope.js');
+    const { assertReviewerSeparation, assertMechanicalPreChecks, ReviewGuardError, NeverReviewOwnCodeError, MechanicalPreChecksIncompleteError } = require('./team/review-guard.js');
+    const teamController = new AdmissionController({ projectRoot, fsImpl: rest.fsImpl });
+    const activeClaims = teamController.getActiveClaims();
+    report.team = {
+      state: 'ready',
+      activeClaimsCount: activeClaims.length,
+      writerCap: teamController.writerCap,
+      maxAttempts: teamController.maxAttempts,
+      _symbols: [
+        AdmissionController,
+        AdmissionError,
+        resolveTeamSettings,
+        validateTaskBrief,
+        validateTaskHandBack,
+        quarantineInput,
+        formatTaskBriefPrompt,
+        EnvelopeError,
+        assertReviewerSeparation,
+        assertMechanicalPreChecks,
+        ReviewGuardError,
+        NeverReviewOwnCodeError,
+        MechanicalPreChecksIncompleteError,
+      ],
+    };
+  } catch (error     ) {
+    report.team = { state: 'unavailable', message: error?.message || String(error) };
+  }
+  try {
+    report.agentToolScope = agentToolScopeView(loadRegistry({ repoRoot, sources: 'skip' }));
+  } catch (error     ) {
+    report.agentToolScope = { state: 'unavailable', message: error?.message || String(error) };
+  }
+  // Read on use (row 120 A.4): no probe runs, nothing is written, and a fault never breaks the report.
+  let primaryText        ;
+  try {
+    const { primaryDoctorView, resolveForReport } = require('./context/primary-command.js');
+    const resolved = resolveForReport({ env: rest.env ?? process.env, projectRoot, repoRoot });
+    report.primary = primaryDoctorView(resolved);
+    primaryText = `${report.primary.state} ${report.primary.harness ?? '-'}/${report.primary.model ?? '-'} (${report.primary.origin}), probe ${report.primary.probe}`;
+  } catch (error     ) {
+    report.primary = { state: 'unavailable', message: error?.message || String(error) };
+    primaryText = `unavailable (${report.primary.message})`;
+  }
+  try {
+    report.workers = workersDoctorView({ env: rest.env ?? process.env, projectRoot, repoRoot });
+  } catch (error     ) {
+    report.workers = { state: 'unavailable', message: error?.message || String(error) };
+  }
+  try {
+    report.workerPool = workerPoolDoctorView({ env: rest.env ?? process.env, projectRoot, repoRoot });
+  } catch (error     ) {
+    report.workerPool = { state: 'unavailable', message: error?.message || String(error) };
+  }
 
   if (json) {
     console.log(JSON.stringify(report, null, 2));
@@ -779,6 +1315,7 @@ async function handleDoctorCommand({ json = false, repoRoot, projectRoot = proce
   console.log('\nDoFlow System Diagnostics (doflow doctor)');
   console.log('═'.repeat(72));
   console.log('Health means a provider answered a probe, not that a binary exists on PATH.');
+  if (report.upkeepSwitch === 'off') console.log('note: DOFLOW_UPKEEP=off in this environment: upkeep and lifecycle retention are skipped');
 
   console.log('\n[Effective Identity]');
   const identity = report.identity;
@@ -789,6 +1326,11 @@ async function handleDoctorCommand({ json = false, repoRoot, projectRoot = proce
   console.log('\n[Harness Adapters]');
   for (const harness of report.harnesses) console.log(`  ${harness.displayName.padEnd(28)} adapter PASS`);
 
+  console.log('\n[Agent Tool Scope]');
+  if (Array.isArray(report.agentToolScope)) {
+    for (const row of report.agentToolScope) console.log(`  ${row.harness.padEnd(14)}${row.status === 'native' ? `native      ${row.field}` : `unenforced  projects no tool field: ${row.reason}`}`);
+  } else console.log(`  unavailable (${report.agentToolScope.message})`);
+
   console.log('\n[Runtime Reach]');
   const reachLines = report.harnesses.flatMap((harness     ) => harness.reach.map((row     ) => {
     const detail = ({ REACHED: row.root, 'NO-REACH': `fix: ${row.fix}`, 'N/A': row.reason }                       )[row.state];
@@ -826,12 +1368,71 @@ async function handleDoctorCommand({ json = false, repoRoot, projectRoot = proce
   console.log(`  test              ${commandLine(commands.test)}`);
   if (commands.reason) console.log(`  note              ${commands.reason}`);
 
+  console.log('\n[Primary and Workers]');
+  console.log(`  primary: ${primaryText}`);
+  if (report.workers.state === 'unavailable') {
+    console.log(`  worker: unavailable (${report.workers.message})`);
+  } else {
+    if (report.workers.bindings.state === 'invalid') {
+      console.log(`  workers.models: invalid (${report.workers.bindings.reason})`);
+    }
+    if (report.workers.state === 'invalid') {
+      console.log(`  workers.enabled: invalid (${report.workers.reason})`);
+    }
+    for (const row of report.workers.rows) {
+      const position = row.enabled.position === null ? '' : ` #${row.enabled.position}`;
+      const eligibility = row.eligible ? 'eligible' : `ineligible (${row.firstGap.requirement})`;
+      const bound = row.bound.map((item     ) => `${item.tier}(${item.flag})`).join(', ') || 'none';
+      console.log(`  worker ${row.harness}: ${row.enabled.state}${position}, ${eligibility}; bound tiers: ${bound}`);
+    }
+    for (const id of report.workers.dangling) {
+      console.log(`  worker ${id}: dangling (no registry or enabled package knows it)`);
+    }
+  }
+
+  console.log('\n[Worker Pool & Models]');
+  if (report.workerPool.state === 'unavailable') {
+    console.log(`  worker pool: unavailable (${report.workerPool.message})`);
+  } else if (report.workerPool.state === 'unsynced') {
+    console.log('  No observed catalogue. Run `doflow models --action sync` to probe worker pool.');
+    console.log(`  Models: ${report.workerPool.models.enabledCount} enabled, ${report.workerPool.models.listedCount} listed`);
+  } else {
+    for (const h of report.workerPool.harnesses) {
+      const binStatus = h.installed ? 'installed' : (h.loginState === 'uncalibrated' ? 'unknown' : 'missing');
+      const hint = h.loginState === 'logged-out' && h.reloginHint ? ` (re-login: ${h.reloginHint})` : '';
+      const billSource = h.effectiveBilling.source ? ` (${h.effectiveBilling.source})` : '';
+      console.log(`  ${h.harness.padEnd(14)} binary: ${binStatus.padEnd(10)} ${h.loginState.padEnd(12)} mode: ${h.detectedMode.padEnd(14)} billing: ${h.effectiveBilling.value}${billSource}${hint}`);
+    }
+    console.log(`  Models: ${report.workerPool.models.enabledCount} enabled, ${report.workerPool.models.listedCount} listed`);
+  }
+
   printMcpSections(report.mcp);
+  if (packagesWorthShowing(report.packages)) printPackagesSection(report.packages);
+  printTranscriptsSection(report.transcripts);
   printAdviceDoctor(adviceSections);
+  printProfilesDoctor(profilesSection);
+  printSettingsReport(settings);
+  if (report.guidance) {
+    console.log('\n[Guidance Rules]');
+    if (report.guidance.state === 'unavailable') {
+      console.log(`  guidance: unavailable (${report.guidance.message})`);
+    } else {
+      console.log(`  ${report.guidance.rulesCount} registered rules (${report.guidance.neverAblateCount} protected invariants, ${report.guidance.candidateCount} ablation candidates)`);
+    }
+  }
+  if (report.team) {
+    console.log('\n[Agent Teams & Coordination]');
+    if (report.team.state === 'unavailable') {
+      console.log(`  team: unavailable (${report.team.message})`);
+    } else {
+      console.log(`  writer cap: ${report.team.writerCap}, max attempts: ${report.team.maxAttempts}, active claims: ${report.team.activeClaimsCount}`);
+    }
+  }
 
   if (report.warnings.length) {
-    console.log('\n[Warnings] — not blocking; a stale or unprobeable provider still degrades cleanly');
-    for (const warning of report.warnings) console.log(`  ${warning.subject.padEnd(18)}${warning.detail}`);
+    console.log('\n[Warnings] — not blocking; a stale or unprobeable provider still degrades cleanly, and a Node below the security release of its line is named here');
+    // A subject at or past the column width (a file path) would run into its detail, so it gets a gap.
+    for (const warning of report.warnings) console.log(`  ${warning.subject.padEnd(18)}${warning.subject.length >= 18 ? '  ' : ''}${warning.detail}`);
   }
 
   console.log('\n[Findings]');
@@ -853,11 +1454,16 @@ module.exports = {
   runProbe,
   probeProvider,
   probeProviders,
+  probeLocalProvider,
   probeFreshness,
+  claudePermissionWarnings,
   PROVIDER_ARTIFACTS,
   newestSourceMtime,
   detectProjectCommands,
   buildHealthReport,
+  nodeSecurityWarning,
+  workersDoctorView,
+  workerPoolDoctorView,
   handleDoctorCommand,
   PROBE_TIMEOUT_MS,
 };