@lannguyensi/harness 0.18.0 → 0.19.0

package/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.19.0] - 2026-05-17
+
+**Headline: setup UX gap closed for non-agent-tasks operators.** Through v0.18.x several pieces of the harness experience silently degraded for operators picking Solo (or Team without an agent-tasks account): the new per-task understanding-gate marker expiry never fired because the configured boundary list was agent-tasks MCP names, `harness init --interactive` left the bridge wired but unauthenticated, `harness doctor` flagged the deliberately operator-driven `dogfood-before-release` policy as a missing-producer false positive, and an nvm-drift class of bug went undiagnosed. This release closes those four gaps: profile-aware reset defaults plus a new `expire_on_bash_match` regex list for gh-CLI workflows, a post-install auth probe with login / skip / abort dialog, doctor respect for the policy's own `producers:` array, and a doctor warning that catches when `npm prefix -g`'s bin dir is not on PATH. Doc cleanup made the external-account assumptions of each profile explicit up-front.
+
+### Added
+
+- **understanding-gate: `approval_lifecycle.expire_on_bash_match`** (harness/f54e0ecb). New optional schema field on the `understanding-before-execution` pack config: a string array of regex patterns matched against the `Bash` tool's `tool_input.command`. When a Bash command matches, the per-session approval marker is deleted on PostToolUse, same semantics as the existing `expire_on_tool_match` does for MCP tool names. Enables gh-CLI / pure-Bash workflows to declare task boundaries (e.g. `^gh pr (merge|close)\b`, `^git push origin (master|main)\b`) so the gate's per-task re-prompt works for them too. Profile defaults updated: Solo drops the agent-tasks tool list (dead weight there) and ships only the Bash list with `max_age: 1h`; Team and Full keep the tool list and add the Bash list for hybrid coverage. Patterns are pre-compiled at parse time, invalid regexes dropped with stderr warnings. Round-trip regression tests in `tests/cli/init-full-template-pins.test.ts` parse each template through `yaml.parse + new RegExp + .test()` to pin the escape-pipeline correctness, since the unit-level tests bypass that surface.
+
+- **`harness doctor`: warn when `npm prefix -g`'s bin dir is not on PATH** (harness/4ddd78ed). Surfaces the nvm-drift footgun where `harness init --interactive` runs `npm i -g` against the active Node's prefix but the operator's shell PATH points at a different one, so installed binaries are silently invisible to subsequent doctor probes. Doctor now resolves the bin dir via `npm prefix -g` (the modern replacement for the removed `npm bin -g`) and renders an `Environment` section with the actionable PATH-patch suggestion when the bin dir is not in `process.env.PATH`. The section stays absent on ok and on the unknown branch (npm missing); skipped under `--shallow` so the 100ms timing budget stays intact.
+
+- **`harness init --interactive`: post-install auth probe for the agent-tasks bridge** (harness/3f775180). After a successful `npm i -g @agent-tasks/mcp-bridge`, the wizard runs `agent-tasks-mcp-bridge status` to detect whether a token is configured. Three branches:
+  - **ok**: prints `✓ agent-tasks token validated against the backend.` and continues.
+  - **token present but validation fails** (backend unreachable, expired token, wrong base URL): prints an informational warning naming the bridge's reason and continues. The wizard does not block on this because the recovery is not actionable from inside it.
+  - **no token stored**: opens a three-option dialog: (a) run `agent-tasks-mcp-bridge login` interactively now via stdio pass-through, (b) skip with a reminder, (c) abort the wizard with a pointer to the signup URL and the re-run command. After a successful login the wizard re-probes to confirm.
+
+  Closes the silent footgun where a fresh operator could finish the wizard with `harness doctor` reporting all-green but every `mcp__agent-tasks__*` call returning an auth error.
+
+- **FULL_TEMPLATE `git-preflight` hook pin: `min_version: "0.1.1"` + `version_command: ["preflight", "--version"]`** (agent-preflight/cb5a1770). Same pattern as the existing pins for `agent-tasks-mcp-bridge`, `grounding-mcp`, `memory-router-user-prompt-submit`. Floor at agent-preflight 0.1.1, the release that distinguishes "tool not installed" (e.g. an npm script invoking eslint that is not in devDependencies) from real lint/test/typecheck failures. Stale 0.1.0 installs silently emit false-positive blockers that keep the `preflight-before-*` policies closed forever; with the floor wired, `harness doctor` now warns operators to upgrade.
+
+### Changed
+
+- **`harness doctor`: producer-gap warning now respects the policy's own `producers:` array** (harness/f97e152f). A `block` policy with a `within:` window used to be flagged with `⚠ ... no manifest hook produces it` whenever no automatic SessionStart hook wrote the required tag, even when the policy itself declared a `producers:` entry pointing the agent at the manual recovery (`mcp__agent-grounding__ledger_add`). For `dogfood-before-release` in the Full template that was a false positive: the gate is deliberately operator-driven (an automatic SessionStart producer would defeat its purpose), and the `producers:` array IS the schema-blessed manual recovery path the agent sees in the deny envelope. Doctor now treats a non-empty `producers:` array as a documented producer and suppresses the warning. The warning still fires when both kinds are absent. Visible effect on the Full template: one fewer false-positive warning (dogfood-before-release flips from `⚠` to `✓`); the two preflight policies were already satisfied by the `git-preflight` SessionStart hook and stay green.
+
+- **Profile dependency clarity in README + wizard** (harness/75de11c4). README, `docs/init-interactive.md`, `docs/for-humans.md`, the wizard's profile-choice descriptions, and the Team-profile confirm prompt now state the external-account assumptions of each profile up-front: Solo is standalone, Team requires an agent-tasks account, Full additionally requires `@lannguyensi/agent-preflight` and `gh` on PATH. The wizard also prints a post-init reminder for Team/Full operators naming `agent-tasks-mcp-bridge login` as the auth recovery path and `--template solo` as the fallback for non-agent-tasks workflows.
+
 ## [0.18.0] - 2026-05-17
 
 **Headline: per-task understanding-gate marker expiry.** Through v0.17.x the approval marker had no lifetime: one `harness approve understanding` covered every subsequent Edit / Write / Bash for the whole session. That contract was correct when the gate was about "agent starts a session, picks ONE interpretation, runs", but no longer matches multi-task sessions, where a stale interpretation can silently drive the next task's edits. Live failure mode from the v0.17.4 dogfood: three sequential tasks in one session, marker stayed valid across all three, the third task started implementing the wrong fix surface before the operator caught the misdiagnose. v0.18 expires the marker on configurable task-boundary tools and (optionally) on a TTL safety net, so a fresh task gets a fresh Understanding Report. Backing task: agent-tasks/d8ee60ca.

package/README.md

@@ -11,18 +11,13 @@ applies, audits, and *enforces*.
 > exact context, and why.
 
 A coding agent like Claude Code is configured across half a dozen
-files: `settings.json`, `CLAUDE.md`, memory notes, MCP registrations,
-hook scripts, per-project overrides. No single file answers *"what can
-this agent do right now, and why is it set up that way?"*, so
-configuration drifts between sessions, rules you wrote down in one
-place quietly stop firing, and a broken tool is discovered only by
-tripping over it.
-
-`harness` puts all of that in one YAML file you can read, validate,
-and diff. From that file it generates the config the agent actually
-loads, and at runtime it enforces the rules you declared: it blocks a
-tool call that violates one, and records every decision so you can
-see what fired and why.
+files (`settings.json`, `CLAUDE.md`, memory notes, MCP registrations,
+hook scripts, per-project overrides), and no single file answers
+*"what can this agent do right now, and why is it set up that way?"*.
+`harness` puts all of it in one YAML you read, validate, and diff;
+generates the config the agent loads from it; and at runtime blocks
+tool calls that violate the declared rules while recording every
+decision.
 
 ## See it work
 
@@ -40,12 +35,10 @@ $ harness policy intercept       # Claude Code runs this before each tool call
 {"decision":"block","reason":"review-before-merge: no matching ledger entry for tag `review:42`","hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"review-before-merge: no matching ledger entry for tag `review:42`"}}
 ```
 
-Since v0.17.0 every built-in block-enforcement policy ships a `ux:`
-block (the warn-only `two-reviewers-required` omits it; the agent
-never sees a warn), so the agent actually sees the plain-language
-three-section form instead (see
-[What the agent sees vs what the engine records](#what-the-agent-sees-vs-what-the-engine-records)
-below). The engine-vocabulary text stays in the audit ledger.
+Built-in block-enforcement policies ship a `ux:` block since v0.17.0,
+so the agent sees a plain-language three-section form
+([`docs/for-agents.md`](docs/for-agents.md#agent-facing-block-messages-ux-block));
+the engine-vocabulary text above stays in the audit ledger.
 
 Blocked. `harness explain` says exactly why:
 
@@ -87,54 +80,6 @@ timestamp            policy               outcome  reason
 Declare the rule once; every session is held to it, with a paper
 trail of every decision.
 
-## What the agent sees vs what the engine records
-
-A policy has two readers: the audit ledger (which wants every internal
-detail) and the agent (which only needs to know what is blocked, what
-condition is missing, and which command satisfies it). Declaring a
-policy's `ux:` block splits those readers cleanly.
-
-Engine-internal model (unchanged): session IDs, ledger entries,
-attestations, provenance chains, policy DAGs. All of it still feeds
-`audit`, `explain --trace`, and the evidence-ledger writes that
-`session-export` replays.
-
-Agent-facing model (new, opt-in per policy): `cannot` (what is
-blocked), `required` (the missing precondition, in plain words), and
-`run` (the exact command to satisfy it). When `ux:` is declared, the
-agent sees only this shape, with `${VAR}` references substituted
-against the same context the `ledger_tag` resolved against.
-
-```yaml
-policies:
-  - name: preflight-before-investigation
-    requires: { ledger_tag: "preflight:${REPO}", within: "1h" }
-    enforcement: block
-    ux:
-      cannot: "You cannot investigate this repository yet."
-      required: ["verified repository preflight"]
-      run: ["harness preflight"]
-```
-
-On block, the agent sees:
-
-```
-You cannot investigate this repository yet.
-
-Required:
-- verified repository preflight
-
-Run:
-  harness preflight
-```
-
-Not `no matching ledger entry for tag preflight:harness`. The
-internal failure (tag, hint, matched count) is still written to the
-ledger for `audit` and `explain --trace`. Policies without `ux:` keep
-the legacy deny envelope unchanged, so existing 0.16.x manifests need
-no changes; the canonical form for agents writing new policies lives
-in [`docs/for-agents.md`](docs/for-agents.md#agent-facing-block-messages-ux-block).
-
 ## Concepts in six lines
 
 | Term | What it is |
@@ -163,25 +108,16 @@ flowchart LR
     observe -. refine .-> declare
 ```
 
-One manifest declares grounding, tools, memory, hooks, policies, and
-workflows. `apply` materialises that into the files Claude Code
-actually reads. At runtime, hooks and policies enforce the contract
-and write decision rows to the evidence ledger. The read-side
-surfaces (`audit`, `explain --trace`, `session-export`) replay those
-rows so you can see what fired, why, and across which session.
-Whatever you learn from observing flows back into the manifest. That
-loop is the whole product.
+Observe → refine → declare is the whole loop. The read-side surfaces
+(`audit`, `explain --trace`, `session-export`) replay rows the runtime
+already recorded, so what flows back into the manifest is grounded in
+what actually happened.
 
 ## Pick your audience
 
-- **Operator?** Read [`docs/for-humans.md`](docs/for-humans.md). It
-  walks from `npm i -g @lannguyensi/harness` through your first
-  `apply`, your first real policy, and the diagnostics cheat sheet.
-- **Agent (or onboarding one)?** Read
-  [`docs/for-agents.md`](docs/for-agents.md). It defines the
-  workflow lifecycle, the policy / ledger sequence, the CLI cheat
-  sheet split by side-effect class, and the audit triumvirate
-  (`audit` vs `explain --trace` vs `session-export`).
+- **Operator?** [`docs/for-humans.md`](docs/for-humans.md): install through first `apply`, first real policy, diagnostics cheat sheet.
+- **Agent (or onboarding one)?** [`docs/for-agents.md`](docs/for-agents.md): workflow lifecycle, policy / ledger sequence, CLI cheat sheet by side-effect class, the audit triumvirate.
+- **Writing your own policy?** [`docs/writing-custom-policies.md`](docs/writing-custom-policies.md): three tripwires, four worked recipes (each validated in CI), author loop, field reference.
 
 ## Install
 
@@ -200,11 +136,21 @@ command path, install to wired-in, no prose.
 harness init --interactive
 ```
 
-Guided wizard that detects your environment (existing `~/.claude/` and
-`~/.codex/`, MCP servers already wired in `settings.json`, harness
-binary version), picks a profile (`solo` / `team` / `custom`), and
-writes a starting `harness.yaml`. Ctrl-C at any prompt aborts with no
-partial write. Walkthrough + limitations: `docs/init-interactive.md`.
+Guided wizard. Detects `~/.claude/` and `~/.codex/`, MCP servers
+already wired in `settings.json`, harness binary version. Picks a
+profile (`solo` / `team` / `custom`) and writes a starting
+`harness.yaml`. Ctrl-C aborts cleanly. Walkthrough +
+limitations: [`docs/init-interactive.md`](docs/init-interactive.md).
+
+### Profiles at a glance
+
+| Profile | External accounts / tools required | Best for |
+|---------|------------------------------------|----------|
+| `solo`  | None. `npm` + Claude Code is enough. | Single operators who want the Understanding Gate without committing to a tasking system. |
+| `team`  | An **agent-tasks** account ([hosted](https://agent-tasks.opentriologue.ai) or [self-hosted](https://github.com/LanNguyenSi/agent-tasks)). | Teams that already use `agent-tasks` for PR review tracking. The merge gate (`review:<pr-number>` ledger tag) wires against the agent-tasks MCP. |
+| `full`  | Same as `team` plus `@lannguyensi/agent-preflight` and `gh` on PATH. | Operators who want every reference policy enforced (dogfood gate, preflight gates, review-subagent gate, merge gate). |
+
+**Not using agent-tasks?** Pick `solo`. The `team` and `full` review gates currently match only the agent-tasks MCP tool names, so a `gh pr create` workflow stays unprotected by them today. Tool-agnostic gates that also match `gh pr` are tracked in the backlog.
 
 If you prefer non-interactive (CI, fresh-VM provisioning), pick a
 template directly:
@@ -215,17 +161,14 @@ harness init --template team   # solo + agent-tasks MCP + review-before-merge po
 harness init --template full   # everything from the Appendix A reference manifest
 ```
 
-Debug what the harness sees in your env without writing anything:
+Use `harness init --probe` for a JSON snapshot of detected runtimes
+and MCPs without writing anything.
 
-```bash
-harness init --probe   # JSON snapshot of detected runtimes + MCPs + manifest
-```
-
-## Try it yourself
+## Try it without installing
 
-The demo above shows the runtime path. To see policy matching without
-installing anything or touching the ledger, run `dry-run` against the
-reference manifest:
+`harness dry-run` reports which hooks fire and which policies match
+for a given tool call, against the reference manifest, before any
+ledger I/O:
 
 ```bash
 git clone https://github.com/LanNguyenSi/harness && cd harness
@@ -236,44 +179,23 @@ node dist/cli/main.js dry-run "merge PR 42" \
   --config docs/examples/full-manifest.yaml
 ```
 
-`dry-run` reads the reference manifest, runs the trigger matcher,
-substitutes `${PR_NUMBER}=42` through the JSONPath-restricted extract
-DSL, and tells you exactly which hooks would fire and which policies
-would match, before any ledger I/O.
-
-The reference manifest is a schema-coverage example, not a runnable
-config. `harness validate --config docs/examples/full-manifest.yaml`
-will report errors for install-specific hook script paths it
-references (and warnings for binaries like `git-batch` that only exist
-in a real install). That is expected; the file header spells out the
-contract. Use `harness init --template full` to get a manifest
-tailored to your machine.
-
-Convinced? Install globally and set up your own:
-`npm i -g @lannguyensi/harness && harness init --interactive`.
+`docs/examples/full-manifest.yaml` is a schema-coverage example, not a
+runnable config (the file header spells out the contract). For a
+manifest tailored to your machine, install globally and run
+`harness init --interactive`.
 
 ## Uninstall
 
 `harness uninstall` is the single-command teardown: dry-run by default,
-`--apply` to mutate. It inventories what harness planted under
-`~/.claude/` (manifest, lock, `harness.generated/`, harness-owned hook
-groups and `mcpServers` entries in `settings.json`, any leftover
-`settings.json.pre-harness-<TS>` backups), then removes them after
-writing a reversible backup + JSON snapshot next to `settings.json`.
-
-```bash
-harness uninstall                                      # list, exit 0
-harness uninstall --apply                              # tear down
-harness uninstall --restore-from <pre-harness-backup>  # atomic restore
-npm uninstall -g @lannguyensi/harness                  # drop the CLI itself
-```
+`--apply` to mutate, `--restore-from <backup>` to roll back. Full
+inventory + recommended order in [`docs/uninstall.md`](docs/uninstall.md).
 
 ## Status
 
 harness ships in phases. Phases 1 through 6 are released: read-only
 inventory → managed edits → declarative truth → policy layer → polish
 and dogfood lessons → the Understanding Gate Policy Pack. Phase 7, the
-Risk Gate, is next. The current release is `v0.17.4`.
+Risk Gate, is next. The current release is `v0.19.0`.
 
 The phase-by-phase plan with acceptance criteria lives in
 [`docs/ROADMAP.md`](docs/ROADMAP.md); what shipped in each version is
@@ -281,109 +203,61 @@ in [`CHANGELOG.md`](CHANGELOG.md).
 
 ## Policy Packs
 
-A *Policy Pack* is a reusable bundle of instruction template, hooks,
-policies, and permission profiles that ships under one name and is
-referenced from `harness.yaml` with a single key. The first pack,
-`understanding-before-execution` (shipped in `v0.9.0`), forces agents
-to expose and confirm their task interpretation before any
-write-capable tool fires.
+A *Policy Pack* is a reusable bundle of hooks, policies, instruction
+template, and permission profiles shipped under one name and enabled
+from `harness.yaml` with a single key:
 
 ```yaml
 policy_packs:
   - name: understanding-before-execution
     config:
-      mode: grill_me                       # fast_confirm | grill_me | strict
-      permission_profile: safe-start       # safe-start | implementation-after-approval | high-risk-grill-me
-```
-
-Manage packs with `harness pack add / remove / list`. Apply against
-either runtime:
-
-```sh
-harness apply --runtime claude-code        # default; writes harness.generated/settings.json
-harness apply --runtime codex              # writes harness.generated/codex/config.toml
+      mode: grill_me                  # fast_confirm | grill_me | strict
+      permission_profile: safe-start  # safe-start | implementation-after-approval | high-risk-grill-me
 ```
 
-Approve a session's Understanding Report via
-`harness approve understanding --session <id>` (round-trips both the
-evidence-ledger tag and the persisted JSON report). Verify the
-adapter wiring with `harness doctor --target codex` (`--json` for
-machine-readable). The full reference lives in
-[`docs/policy-packs/understanding-before-execution.md`](docs/policy-packs/understanding-before-execution.md);
-synthetic-stdin dogfood under
-[`dogfood/phase6-6/`](dogfood/phase6-6/run-smoke.sh) exercises the
-block / allow / capture / approve round-trip without a real Codex
-binary.
+Manage packs with `harness pack add / remove / list`. Two packs ship
+today: [`understanding-before-execution`](docs/policy-packs/understanding-before-execution.md)
+(forces an Understanding Report before any write-capable tool fires)
+and [`branch-protection`](docs/policy-packs/branch-protection.md)
+(blocks source mutations on protected branches without an explicit
+override). Custom packs from `path:`, `npm:`, or `git:` sources are
+out of scope for v1 (see the pack docs for the future-vocabulary
+contract).
 
 ## What's next
 
-**Phase 7, Risk Gate.** Today's policy model evaluates a rule per
-matching trigger and returns a binary block/allow. Phase 7 makes
-harness reason about *the action itself*: an Action Envelope (tool +
-raw input + session + runtime context) is enriched by a Context
-Resolver (production / staging / dev / unknown), classified by a Risk
-Classifier (severity + categories + reversibility), then matched
-against policies whose `when:` clauses can reference
-`risk.severity_at_least`, `environment.name`, and similar. The
-decision space extends to `allow / warn / require_approval / deny`.
-Motivating use case: prevent `DROP TABLE users`, `kubectl delete
-namespace prod`, `terraform destroy` against an unverified production
-target, even if the model would have happily run them.
-
-Phase 7 builds on Phase 4's `policy intercept` runtime backbone and
-Phase 6's Policy Pack distribution surface; neither is replaced.
+**Phase 7, Risk Gate.** Today's policy model returns a binary
+block/allow per matching trigger. Phase 7 lets harness reason about
+the action itself (Action Envelope → Context Resolver → Risk
+Classifier) and extends the decision space to `allow / warn /
+require_approval / deny`. Motivating use case: block `DROP TABLE
+users`, `kubectl delete namespace prod`, `terraform destroy` against
+unverified production targets. Full plan in
+[`docs/ROADMAP.md#phase-7--risk-gate`](docs/ROADMAP.md#phase-7--risk-gate).
 
 > Bring your favorite agent harness. Add governance.
 
 ## Why this exists
 
-A working agent harness today has six to eight configuration
-surfaces, each with its own schema and lifecycle: `~/.claude/settings.json`,
-`CLAUDE.md` (per repo + root), `~/.claude/projects/*/memory/*.md`
-with frontmatter, `~/.claude/keybindings.json`, MCP server
-registrations in `~/.claude.json`, skill directories, per-project
-overrides, and external CLIs that behave differently per project.
-
-There is no single place that answers *"what can this agent do right
-now, and why is that configured that way?"*. Drift between sessions
-is invisible until it breaks something. Humans editing one surface
-do not know which other surfaces they need to touch. A fresh agent
-instance has no way to audit its own setup.
-
-Our entry point into this problem: on 2026-04-23, an
-`agent-grounding` checkout that was 16 commits behind origin led two
-tasks to be incorrectly called "stale". The check that would have
-caught it already exists,
+On 2026-04-23, an `agent-grounding` checkout that was 16 commits
+behind origin led two tasks to be incorrectly called "stale". The
+check that would have caught it already existed:
 [`agent-preflight`](https://github.com/LanNguyenSi/agent-preflight)
-runs `git fetch` + `git status` (alongside lint, typecheck, test,
-audit) and emits a structured `ready` + confidence-score result. The
-missing piece was not the check itself, it was the deterministic
-*trigger*: a `SessionStart` hook that invokes `preflight run` and a
-policy that gates further work on the result. Building that wiring
-needs an agreed-upon place for harness config to live first. That
-conversation is the origin of this repo.
+runs `git fetch` + `git status` and emits a structured `ready` +
+confidence-score result. The missing piece was not the check, it was
+the deterministic *trigger*: a `SessionStart` hook that invokes
+`preflight run` and a policy that gates further work on the result.
+Building that wiring needs an agreed-upon place for harness config to
+live first. That conversation is the origin of this repo.
 
 ## Related
 
-- [`agent-grounding`](https://github.com/LanNguyenSi/agent-grounding):
-  grounding primitives (evidence-ledger, claim-gate,
-  review-claim-gate); `grounding-mcp` is the canonical client surface
-  harness queries through `queryLedgerByTag`.
-- [`agent-memory`](https://github.com/LanNguyenSi/agent-memory):
-  memory surfaces the control plane inventories.
-- [`agent-tasks`](https://github.com/LanNguyenSi/agent-tasks): the
-  MCP-registered task platform whose registration + health appear in
-  `harness describe`.
-- [`agent-preflight`](https://github.com/LanNguyenSi/agent-preflight):
-  local preflight validator; the canonical implementation of
-  preflight-hook content harness wires.
-- [`codebase-oracle`](https://github.com/LanNguyenSi/codebase-oracle):
-  an opt-in MCP surface for multi-repo RAG search. Not in the Full
-  default; operators wire it via `harness add mcp codebase-oracle
-  --command codebase-oracle,mcp`.
-- [`agent-dx`](https://github.com/LanNguyenSi/agent-dx): ships
-  `git-batch-cli`, a day-to-day tool whose inventory appears in
-  `harness describe`.
+- [`agent-grounding`](https://github.com/LanNguyenSi/agent-grounding): evidence-ledger, claim-gate, review-claim-gate; `grounding-mcp` is the canonical client surface harness queries through `queryLedgerByTag`.
+- [`agent-memory`](https://github.com/LanNguyenSi/agent-memory): the memory surfaces the control plane inventories.
+- [`agent-tasks`](https://github.com/LanNguyenSi/agent-tasks): MCP-registered task platform whose registration + health appear in `harness describe`.
+- [`agent-preflight`](https://github.com/LanNguyenSi/agent-preflight): local preflight validator; the canonical implementation of preflight-hook content harness wires.
+- [`codebase-oracle`](https://github.com/LanNguyenSi/codebase-oracle): opt-in MCP for multi-repo RAG search; not in Full, wire via `harness add mcp codebase-oracle --command codebase-oracle,mcp`.
+- [`agent-dx`](https://github.com/LanNguyenSi/agent-dx): ships `git-batch-cli`, a day-to-day tool whose inventory appears in `harness describe`.
 
 ## License
 

package/dist/cli/doctor/format.js

@@ -45,6 +45,23 @@ function formatManifestSection(report) {
     }
     return out;
 }
+// Environment section: render only when there is something worth
+// reporting. `ok` stays silent (no point in a ✓ line for a check that
+// hits zero issues), `warn` is the actionable case we want loud, and
+// `unknown` stays silent because if npm is missing the other dep
+// checks already failed loudly.
+function formatEnvironmentSection(report) {
+    const bin = report.npmGlobalBin;
+    if (!bin || bin.status !== "warn")
+        return [];
+    return [
+        "",
+        "Environment",
+        `  ⚠ npm global bin (${bin.binDir}) is not on PATH`,
+        `      harness install commands wrote binaries here but your shell will not find them.`,
+        `      Add to your shell rc (e.g. ~/.bashrc, ~/.zshrc):  ${bin.pathPatchSuggestion}`,
+    ];
+}
 function formatToolsSection(report) {
     const out = ["", "Tools"];
     out.push(`  MCP servers (${report.tools.mcp.length} declared)`);
@@ -133,8 +150,8 @@ function formatPoliciesSection(report) {
     const out = ["", "Policies"];
     for (const p of report.policies) {
         if (p.producerGap) {
-            out.push(`  ⚠ ${p.name}  requires fresh \`${p.producerGap.ledgerTag}\` (within ${p.producerGap.within}) but no manifest hook produces it`);
-            out.push(`      the gate will block its trigger until the tag is supplied out-of-band; add a producer hook (e.g. a SessionStart runner)`);
+            out.push(`  ⚠ ${p.name}  requires fresh \`${p.producerGap.ledgerTag}\` (within ${p.producerGap.within}) but no manifest hook produces it AND the policy declares no \`producers:\` array`);
+            out.push(`      the gate will block its trigger until the tag is supplied out-of-band; add a producer hook (e.g. a SessionStart runner) OR document the manual recovery path in the policy's \`producers:\` array`);
         }
         else {
             out.push(`  ✓ ${p.name}  ${p.caveat}`);
@@ -204,6 +221,7 @@ function formatSummary(report) {
 export function format(report) {
     const lines = [formatHeader(report)];
     lines.push(...formatManifestSection(report));
+    lines.push(...formatEnvironmentSection(report));
     lines.push(...formatToolsSection(report));
     lines.push(...formatMemorySection(report));
     lines.push(...formatHooksSection(report));

package/dist/cli/doctor/format.js.map

@@ -1 +1 @@
-{"version":3,"file":"format.js","sourceRoot":"","sources":["../../../src/cli/doctor/format.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,SAAS,OAAO,CAAC,CAAiB,EAAE,OAAgB;IAClD,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,OAAO;gBACZ,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,iCAAiC;gBAClD,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC;QAC7D,KAAK,OAAO;YACV,OAAO,SAAS,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,kEAAkE;YAClE,8DAA8D;YAC9D,wDAAwD;YACxD,MAAM,KAAK,GACT,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,YAAY;gBAC9B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,OAAO,CAAC;YACzC,OAAO,SAAS,CAAC,CAAC,IAAI,yDAAyD,KAAK,GAAG,CAAC;QAC1F,CAAC;QACD,KAAK,cAAc;YACjB,OAAO,SAAS,CAAC,CAAC,IAAI,qCAAqC,CAAC;QAC9D,KAAK,UAAU;YACb,OAAO,SAAS,CAAC,CAAC,IAAI,sBAAsB,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAU;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,gBAAgB,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,OAAO,WAAW,OAAO,eAAe,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,eAAe,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;AACxH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoB;IACjD,gEAAgE;IAChE,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,wEAAwE;IACxE,+BAA+B;IAC/B,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACvC,GAAG,CAAC,IAAI,CACN,OAAO,MAAM,CAAC,QAAQ,CAAC,mBAAmB,+CAA+C,CAC1F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACpC,GAAG,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;IACzC,GAAG,CAAC,IAAI,CAAC,gBAAgB,QAAQ,YAAY,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IACrE,GAAG,CAAC,IAAI,CACN,aAAa,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,WAAW,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,mBAAmB,GAAG,CAC/M,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAoB;IAC/C,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,aAAa,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC;QACxF,CAAC;aAAM,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CACN,OAAO,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,wEAAwE,CAClH,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,IACE,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM;QACtC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EACxC,CAAC;QACD,mEAAmE;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,SAAS,OAAO,aAAa,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoB;IACjD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CACN,OAAO,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,WAAW,CAAC,SAAS,cAAc,CAAC,CAAC,WAAW,CAAC,MAAM,oCAAoC,CACjI,CAAC;YACF,GAAG,CAAC,IAAI,CACN,+HAA+H,CAChI,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAoB;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3B,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,CACN,KAAK,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC,SAAS,mBAAmB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAC1F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW;YAC1B,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/E,CAAC,CAAC,yBAAyB,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,WAAW,MAAM,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAoB;IACpD,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAoB;IACpD,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CACN,uFAAuF,CACxF,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,kCAAkC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,MAAoB;IACzC,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACrE,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAoB;IACzC,MAAM,KAAK,GAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../../src/cli/doctor/format.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,SAAS,OAAO,CAAC,CAAiB,EAAE,OAAgB;IAClD,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,OAAO;gBACZ,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,iCAAiC;gBAClD,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC;QAC7D,KAAK,OAAO;YACV,OAAO,SAAS,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACzD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,kEAAkE;YAClE,8DAA8D;YAC9D,wDAAwD;YACxD,MAAM,KAAK,GACT,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,YAAY;gBAC9B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,OAAO,CAAC;YACzC,OAAO,SAAS,CAAC,CAAC,IAAI,yDAAyD,KAAK,GAAG,CAAC;QAC1F,CAAC;QACD,KAAK,cAAc;YACjB,OAAO,SAAS,CAAC,CAAC,IAAI,qCAAqC,CAAC;QAC9D,KAAK,UAAU;YACb,OAAO,SAAS,CAAC,CAAC,IAAI,sBAAsB,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAU;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,gBAAgB,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,OAAO,WAAW,OAAO,eAAe,MAAM,CAAC,YAAY,aAAa,MAAM,CAAC,eAAe,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;AACxH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoB;IACjD,gEAAgE;IAChE,qEAAqE;IACrE,kEAAkE;IAClE,iEAAiE;IACjE,wEAAwE;IACxE,+BAA+B;IAC/B,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACvC,GAAG,CAAC,IAAI,CACN,OAAO,MAAM,CAAC,QAAQ,CAAC,mBAAmB,+CAA+C,CAC1F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iEAAiE;AACjE,sEAAsE;AACtE,qEAAqE;AACrE,iEAAiE;AACjE,gCAAgC;AAChC,SAAS,wBAAwB,CAAC,MAAoB;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAC7C,OAAO;QACL,EAAE;QACF,aAAa;QACb,uBAAuB,GAAG,CAAC,MAAM,kBAAkB;QACnD,uFAAuF;QACvF,2DAA2D,GAAG,CAAC,mBAAmB,EAAE;KACrF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACpC,GAAG,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;IACzC,GAAG,CAAC,IAAI,CAAC,gBAAgB,QAAQ,YAAY,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IACrE,GAAG,CAAC,IAAI,CACN,aAAa,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,WAAW,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,mBAAmB,GAAG,CAC/M,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAoB;IAC/C,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,uCAAuC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,kCAAkC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,aAAa,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC;QACxF,CAAC;aAAM,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CACN,OAAO,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,wEAAwE,CAClH,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,IACE,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM;QACtC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EACxC,CAAC;QACD,mEAAmE;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAoB;IAC9C,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,SAAS,OAAO,aAAa,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoB;IACjD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CACN,OAAO,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,WAAW,CAAC,SAAS,cAAc,CAAC,CAAC,WAAW,CAAC,MAAM,oFAAoF,CACjL,CAAC;YACF,GAAG,CAAC,IAAI,CACN,yMAAyM,CAC1M,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAoB;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3B,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,CACN,KAAK,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC,SAAS,mBAAmB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAC1F,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW;YAC1B,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/E,CAAC,CAAC,yBAAyB,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,WAAW,MAAM,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAoB;IACpD,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAoB;IACpD,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CACN,uFAAuF,CACxF,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,kCAAkC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,MAAoB;IACzC,MAAM,GAAG,GAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACrE,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAoB;IACzC,MAAM,KAAK,GAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/cli/doctor/index.d.ts

@@ -1,6 +1,7 @@
 import { type McpProbe } from "../../probes/mcp.js";
 import { type LoaderOptions } from "../loader.js";
 import { type RunCodexCheckOptions } from "./codex.js";
+import { type NpmExec } from "./npm-bin-path.js";
 import { type RogueLedgerScanOptions } from "./rogue-ledger.js";
 import { isDoctorTarget, KNOWN_DOCTOR_TARGETS, type DoctorReport, type DoctorTarget } from "./types.js";
 export interface DoctorOptions extends LoaderOptions {
@@ -26,6 +27,13 @@ export interface DoctorOptions extends LoaderOptions {
      * usually override both plus `fsInterface`.
      */
     rogueLedgerScanOptions?: Partial<RogueLedgerScanOptions>;
+    /**
+     * Test-injection knob for the npm global-bin PATH check (task
+     * 4ddd78ed). Tests fake the `npm prefix -g` invocation by passing a
+     * stub that returns specific stdout / exit codes; production omits
+     * this and the real `npm` is spawned.
+     */
+    npmBinExec?: NpmExec;
 }
 export { isDoctorTarget, KNOWN_DOCTOR_TARGETS };
 export declare function doctor(opts?: DoctorOptions): Promise<DoctorReport>;

package/dist/cli/doctor/index.js

@@ -6,6 +6,7 @@ import { inspectMemory } from "../../probes/memory.js";
 import { RealMcpProbe, probeAll, } from "../../probes/mcp.js";
 import { loadManifest } from "../loader.js";
 import { countCodexDiagnostics, runCodexTargetChecks, } from "./codex.js";
+import { checkNpmBinPath } from "./npm-bin-path.js";
 import { scanForRogueLedgers } from "./rogue-ledger.js";
 import { isDoctorTarget, KNOWN_DOCTOR_TARGETS, } from "./types.js";
 export { isDoctorTarget, KNOWN_DOCTOR_TARGETS };
@@ -296,7 +297,20 @@ function buildPolicies(manifest) {
         // Policies without `within` only need the tag to exist once, which
         // the normal review / PR workflow supplies, so they are not
         // flagged.
-        if (p.enforcement === "block" && p.requires.within !== undefined) {
+        //
+        // Refinement (task f97e152f): a non-empty `producers:` array on
+        // the policy itself is the schema's way of declaring the recovery
+        // path. For example `dogfood-before-release` deliberately wants
+        // the operator to record a manual smoke summary; an automatic
+        // SessionStart producer would defeat the gate's purpose. When that
+        // documented producer exists the warning would be a false positive
+        // and is suppressed. The check still fires when both kinds are
+        // absent. The `length === 0` clause is defensive: the schema
+        // already enforces `producers: .min(1).optional()`, so a defined
+        // array is guaranteed non-empty for any manifest that loaded.
+        if (p.enforcement === "block" &&
+            p.requires.within !== undefined &&
+            (p.producers === undefined || p.producers.length === 0)) {
             const prefix = ledgerTagPrefix(p.requires.ledger_tag);
             if (!hasProducerHook(manifest, p, prefix)) {
                 report.producerGap = {
@@ -385,6 +399,8 @@ function countDiagnostics(report) {
         if (p.producerGap)
             warningCount++;
     }
+    if (report.npmGlobalBin?.status === "warn")
+        warningCount++;
     if (report.memory.routerExecutable && !report.memory.routerExecutable.exists)
         errorCount++;
     if (!report.memory.routerExecutable)
@@ -453,6 +469,15 @@ export async function doctor(opts = {}) {
             ? { fsInterface: opts.rogueLedgerScanOptions.fsInterface }
             : {}),
     });
+    // Shallow mode skips real spawns: the npm-bin probe shells out to
+    // `npm prefix -g` which costs ~30ms and breaks the shallow timing
+    // budget. Mirrors how MCP probes degrade above.
+    const npmGlobalBin = opts.shallow
+        ? undefined
+        : await checkNpmBinPath({
+            ...(opts.npmBinExec !== undefined ? { exec: opts.npmBinExec } : {}),
+            ...(opts.pathEnv !== undefined ? { pathEnv: opts.pathEnv } : {}),
+        });
     const partial = {
         manifestPath: resolved.base,
         manifestVersion: manifest.version,
@@ -465,6 +490,7 @@ export async function doctor(opts = {}) {
         policies,
         workflows,
         rogueLedgerDbs,
+        ...(npmGlobalBin !== undefined ? { npmGlobalBin } : {}),
     };
     if (opts.target === "codex") {
         const manifestDir = path.dirname(resolved.base);