@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/cli/doctor/session-start-preflight-setup-version.d.ts

@@ -1,83 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-/**
- * The probe command run against the `preflight` binary on PATH. Matches
- * the `version_command` the shipped `git-preflight` hook template
- * declares (src/cli/init/templates.ts), same binary and `--version`
- * flag, but is not read FROM the manifest's hook entry: an operator
- * could rename/remove that hook while `session_start_preflight.setup`
- * stays on, and the check should still probe the binary the producer
- * (`harness session-start preflight`) actually spawns.
- */
-export declare const PREFLIGHT_SETUP_VERSION_COMMAND: readonly ["preflight", "--version"];
-export interface SessionStartPreflightSetupVersionFinding {
-    /**
-     * `layer_unresolvable` (task `1c4eb3ea`, round 2, D-027 item 3):
-     * `doctor()`'s own project-scoped SECOND `loadManifest` call threw
-     * (a malformed or unreadable cwd-derived project layer), so this
-     * check could not even determine whether `setup` is on. Built
-     * directly by `doctor()` (`src/cli/doctor/index.ts`), never by this
-     * module's own `checkSessionStartPreflightSetupVersion`: that
-     * function only ever sees a manifest that already degraded to
-     * `setup: false` on such a failure, and bails out before producing
-     * ANY finding for a `setup: false` manifest, which is exactly the
-     * silence this kind replaces.
-     */
-    kind: "below_floor" | "probe_failed" | "parse_failed" | "layer_unresolvable";
-    /**
-     * Parsed installed version, when the probe succeeded and parsed.
-     * Null otherwise. Always the NUMERIC run (`parseProbedVersion`'s
-     * `version` field, e.g. "0.6.0"), never the probed prerelease/build
-     * suffix: for a `below_floor` finding caused by a prerelease of the
-     * floor (e.g. probed "0.6.0-rc.1" against a "0.6.0" `requiredVersion`),
-     * `actualVersion` therefore equals `requiredVersion` even though
-     * `kind` is `"below_floor"`: the numeric components tie, and
-     * `compareVersionFloor`'s prerelease tie-break is what actually
-     * failed the floor. `message` carries the full probed token
-     * (including the suffix) for the human-facing distinction; this
-     * field's JSON shape does not gain a new field for it. See
-     * docs/decisions/2026-09-08-preflight-floors.md.
-     */
-    actualVersion: string | null;
-    /** Always `SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION` today; carried on the finding so format.ts never re-imports the constant. */
-    requiredVersion: string;
-    message: string;
-    /**
-     * The cwd-derived (or explicit `--project`) project name `doctor`
-     * fed its scoped, project-aware `loadManifest` call from when this
-     * finding's `manifest` was resolved (task c88461c1, review round 3
-     * residual). `null` when no project layer FILE actually decided the
-     * result: no project name was derivable for that cwd (not inside a
-     * git work tree, and no explicit `--project`), OR a name WAS
-     * derivable but no matching `<home>/projects/<name>/harness.overrides.yaml`
-     * exists on disk (task `1c4eb3ea`, round 2, D-027 item 1: `doctor()`
-     * only sets this to a non-null name when `resolvePaths(...).projectLayer`
-     * resolved, not merely whenever a name was attempted, so a
-     * base/machine-decided warning stays genuinely distinguishable from
-     * a project-decided one). Present only when the CALLER passes a
-     * `projectName` argument (see below); `checkSessionStartPreflightSetupVersion`'s
-     * own unit tests call it with just `manifest`/`versionProbe`, so
-     * their findings carry no `projectName` key at all, not an
-     * `undefined` value. The report's own top-level `project` field only
-     * ever reflects an EXPLICIT `--project` (`opts.project ?? null`,
-     * `doctor/index.ts`), never this derived name.
-     */
-    projectName?: string | null;
-}
-/**
- * Pure: manifest + versionProbe in, a finding out (or `undefined` when
- * there is nothing to flag). Mirrors `checkHookVersion`'s probe/parse
- * idiom (src/cli/doctor/index.ts) so the warning vocabulary
- * (`below_floor` / `probe_failed` / `parse_failed`) and version-regex
- * parsing stay consistent across both checks, without importing from
- * index.ts (which would create a cycle back into this module's own
- * caller).
- *
- * `projectName` (task c88461c1, review round 3 residual; task
- * `1c4eb3ea`): OPTIONAL third argument, carried onto every returned finding
- * unchanged (see {@link SessionStartPreflightSetupVersionFinding.projectName}'s
- * doc comment). `doctor()` always passes it (the SAME name it derived
- * for its own scoped load, or `null`); every pre-existing direct call
- * to this pure function in its own unit tests omits it, so those
- * findings' shape is unchanged.
- */
-export declare function checkSessionStartPreflightSetupVersion(manifest: Manifest, versionProbe: (cmd: readonly string[]) => string | null, projectName?: string | null): SessionStartPreflightSetupVersionFinding | undefined;

package/dist/cli/doctor/session-start-preflight-setup-version.js

@@ -1,114 +0,0 @@
-// Doctor finding for task 6993d9b5 (tracker id, harness repo): warns
-// when `session_start_preflight.setup: true` is set but the resolved
-// `preflight` binary is below the release that made `--setup` build
-// code, not just install dependencies (agent-preflight 0.6.0, tag
-// v0.6.0). On 0.5.0 `--setup` is dependency-install only, so an
-// operator who enabled the knob against that version pays install time
-// plus the `--setup` trust exposure (see session-start-preflight.ts's
-// SECURITY note) for zero build benefit, with nothing today telling
-// them so.
-//
-// Deliberately independent of the `git-preflight` manifest hook's own
-// `min_version`/`version_command` (checked generically by
-// `checkHookVersion` in ./index.ts): that floor is whatever the
-// operator's own manifest declares, and existing manifests generated
-// before task 6993d9b5 still carry the pre-existing 0.2.0 floor (bumped
-// to `GIT_PREFLIGHT_HOOK_MIN_VERSION`, src/cli/init/templates.ts, in the
-// `init` template only going forward, task 6993d9b5's second commit).
-// This check hardcodes the build-capable floor so an operator on an
-// unregenerated manifest still gets the warning the moment they flip
-// `setup: true`, rather than only after re-running `harness init`.
-//
-// BY DESIGN: on a freshly generated manifest with `setup: true` probed
-// against a stale preflight, this check and the generic `hooks[]`
-// `min_version` walk both fire and both count toward `warningCount` (see
-// `docs/CLI.md`'s VERSION CAVEAT). The two are not a duplicate of the
-// same finding: the hook floor guards the `git-preflight` hook itself,
-// this check guards the `--setup` build-step feature specifically, and
-// a stale preflight breaks both independently.
-//
-// SPLIT FROM THE HOOK FLOOR (task 65952a0c, docs/decisions/2026-09-08-
-// preflight-floors.md): this check's floor,
-// `SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION`, and the hook
-// floor above, `GIT_PREFLIGHT_HOOK_MIN_VERSION`, were ONE shared
-// constant through task 6993d9b5. Both are `"0.6.0"` today and can
-// diverge on a future bump that applies to only one rationale; see the
-// ADR for the bump rule each carries.
-//
-// Silent (returns `undefined`) whenever `session_start_preflight.setup`
-// is `false`/absent: the trust exposure and the install/build cost only
-// exist once the knob is actually on, mirroring every other advisory
-// doctor check's "no opinion when the feature isn't in use" gate.
-import { parseProbedVersion, compareVersionFloor } from "../../io/version-compare.js";
-import { PREFLIGHT_BIN } from "../session-start/index.js";
-import { SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION } from "../../schema/session-start-preflight.js";
-/**
- * The probe command run against the `preflight` binary on PATH. Matches
- * the `version_command` the shipped `git-preflight` hook template
- * declares (src/cli/init/templates.ts), same binary and `--version`
- * flag, but is not read FROM the manifest's hook entry: an operator
- * could rename/remove that hook while `session_start_preflight.setup`
- * stays on, and the check should still probe the binary the producer
- * (`harness session-start preflight`) actually spawns.
- */
-export const PREFLIGHT_SETUP_VERSION_COMMAND = [PREFLIGHT_BIN, "--version"];
-/**
- * Pure: manifest + versionProbe in, a finding out (or `undefined` when
- * there is nothing to flag). Mirrors `checkHookVersion`'s probe/parse
- * idiom (src/cli/doctor/index.ts) so the warning vocabulary
- * (`below_floor` / `probe_failed` / `parse_failed`) and version-regex
- * parsing stay consistent across both checks, without importing from
- * index.ts (which would create a cycle back into this module's own
- * caller).
- *
- * `projectName` (task c88461c1, review round 3 residual; task
- * `1c4eb3ea`): OPTIONAL third argument, carried onto every returned finding
- * unchanged (see {@link SessionStartPreflightSetupVersionFinding.projectName}'s
- * doc comment). `doctor()` always passes it (the SAME name it derived
- * for its own scoped load, or `null`); every pre-existing direct call
- * to this pure function in its own unit tests omits it, so those
- * findings' shape is unchanged.
- */
-export function checkSessionStartPreflightSetupVersion(manifest, versionProbe, projectName) {
-    if (!manifest.session_start_preflight.setup)
-        return undefined;
-    const withProjectName = (finding) => projectName !== undefined ? { ...finding, projectName } : finding;
-    const required = SESSION_START_PREFLIGHT_SETUP_BUILD_MIN_VERSION;
-    const stdout = versionProbe(PREFLIGHT_SETUP_VERSION_COMMAND);
-    if (stdout === null) {
-        return withProjectName({
-            kind: "probe_failed",
-            actualVersion: null,
-            requiredVersion: required,
-            message: `session_start_preflight.setup is enabled but the installed preflight version could not ` +
-                `be determined (probe for "${PREFLIGHT_SETUP_VERSION_COMMAND.join(" ")}" failed); the ` +
-                `build step needs preflight >= ${required}`,
-        });
-    }
-    // parseProbedVersion/compareVersionFloor (not plain compareNumericVersions):
-    // a preflight release candidate of the floor (e.g. "0.6.0-rc.1") must not
-    // count as build-capable. See docs/decisions/2026-09-08-preflight-floors.md.
-    const parsed = parseProbedVersion(stdout);
-    if (!parsed) {
-        return withProjectName({
-            kind: "parse_failed",
-            actualVersion: null,
-            requiredVersion: required,
-            message: `session_start_preflight.setup is enabled but the installed preflight version could not ` +
-                `be parsed from "${stdout.trim()}"; the build step needs preflight >= ${required}`,
-        });
-    }
-    const { version: actual, isPrerelease, token } = parsed;
-    if (compareVersionFloor(actual, isPrerelease, required) < 0) {
-        return withProjectName({
-            kind: "below_floor",
-            actualVersion: actual,
-            requiredVersion: required,
-            message: `session_start_preflight.setup is enabled but installed preflight v${token} < ${required}: ` +
-                `--setup on v${token} is dependency-install only (no build step); upgrade preflight ` +
-                `(npm i -g @lannguyensi/agent-preflight) or set session_start_preflight.setup: false`,
-        });
-    }
-    return undefined;
-}
-//# sourceMappingURL=session-start-preflight-setup-version.js.map

package/dist/cli/doctor/session-start-preflight-setup-version.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-start-preflight-setup-version.js","sourceRoot":"","sources":["../../../src/cli/doctor/session-start-preflight-setup-version.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,qEAAqE;AACrE,oEAAoE;AACpE,kEAAkE;AAClE,gEAAgE;AAChE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,WAAW;AACX,EAAE;AACF,sEAAsE;AACtE,0DAA0D;AAC1D,gEAAgE;AAChE,qEAAqE;AACrE,wEAAwE;AACxE,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,EAAE;AACF,uEAAuE;AACvE,kEAAkE;AAClE,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,+CAA+C;AAC/C,EAAE;AACF,uEAAuE;AACvE,4CAA4C;AAC5C,kEAAkE;AAClE,iEAAiE;AACjE,mEAAmE;AACnE,uEAAuE;AACvE,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,kEAAkE;AAElE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,+CAA+C,EAAE,MAAM,yCAAyC,CAAC;AAG1G;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,aAAa,EAAE,WAAW,CAAU,CAAC;AAyDrF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sCAAsC,CACpD,QAAkB,EAClB,YAAuD,EACvD,WAA2B;IAE3B,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE9D,MAAM,eAAe,GAAG,CACtB,OAAsE,EAC5B,EAAE,CAC5C,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAEpE,MAAM,QAAQ,GAAG,+CAA+C,CAAC;IACjE,MAAM,MAAM,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;YACrB,IAAI,EAAE,cAAc;YACpB,aAAa,EAAE,IAAI;YACnB,eAAe,EAAE,QAAQ;YACzB,OAAO,EACL,yFAAyF;gBACzF,6BAA6B,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB;gBACvF,iCAAiC,QAAQ,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,eAAe,CAAC;YACrB,IAAI,EAAE,cAAc;YACpB,aAAa,EAAE,IAAI;YACnB,eAAe,EAAE,QAAQ;YACzB,OAAO,EACL,yFAAyF;gBACzF,mBAAmB,MAAM,CAAC,IAAI,EAAE,wCAAwC,QAAQ,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACxD,IAAI,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,eAAe,CAAC;YACrB,IAAI,EAAE,aAAa;YACnB,aAAa,EAAE,MAAM;YACrB,eAAe,EAAE,QAAQ;YACzB,OAAO,EACL,qEAAqE,KAAK,MAAM,QAAQ,IAAI;gBAC5F,eAAe,KAAK,iEAAiE;gBACrF,qFAAqF;SACxF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/cli/doctor/settings-drift.d.ts

@@ -1,25 +0,0 @@
-export interface SettingsDriftSection {
-    /** ℹ lines; never roll into warningCount. */
-    notes: string[];
-    /** ⚠ lines; each rolls into warningCount. */
-    warnings: string[];
-}
-/**
- * `~`-relativize `absPath` under `home` for display; never leak the raw
- * absolute path. Exported for `codex-config-drift.ts`'s `$CODEX_HOME`
- * candidate label, which needs the same convention.
- */
-export declare function tildeize(absPath: string, home: string): string;
-export interface BuildSettingsDriftOptions {
-    /** `harness.generated/` for the manifest in use; `.last-apply` lives here. */
-    generatedDir: string;
-    /** `harness.lock` path for the manifest in use. */
-    lockPath: string;
-    /** Resolves the two project-scoped candidate files (`.claude/settings.json`, `.claude/settings.local.json`). */
-    cwd: string;
-    /** Operator home; resolves the user-scope candidate file and its display label. */
-    home: string;
-    /** Env for `CLAUDE_CONFIG_DIR` resolution of the user-scope file. */
-    env: NodeJS.ProcessEnv;
-}
-export declare function buildSettingsDrift(opts: BuildSettingsDriftOptions): SettingsDriftSection;

package/dist/cli/doctor/settings-drift.js

@@ -1,213 +0,0 @@
-// Settings-drift half of ADR docs/decisions/2026-08-27-ug-auto-mode-approval.md
-// slice 1 (agent-tasks 74b4b17d), threat model (c): "The permission mode
-// itself is settings-derived, and settings files are agent-editable
-// after approval" and "The same settings write also reaches the hook
-// roster, which supplies key two." A post-approval agent can plant
-// `permissions.defaultMode: "bypassPermissions"` (key one) and/or a
-// `UserPromptSubmit`/`SessionStart` hook entry that mints a report for
-// every later session (key two) into a Claude Code settings file, and
-// nothing named that plant before this check: `harness diff
-// --since-apply` only re-hashes the whole `--target` file as a lock
-// entry, so it flags SOME change without naming which key moved.
-//
-// What this module actually has to compare against, verified against
-// the real `apply()` code path (not assumed from the ADR prose):
-//
-//   - `.last-apply` (`src/io/last-apply.ts`) stores exactly ONE
-//     `files["settings.json"]` entry: harness's own GENERATED
-//     settings.json content (`buildExpectedFiles` in apply.ts), keyed by
-//     basename, not by which `--target` path it was merged into. Harness
-//     never writes `permissions.defaultMode` itself
-//     (`generate-settings.ts` has no such key), and `--merge` replaces
-//     `hooks` WHOLESALE (`src/io/merge-settings.ts`'s module header: "harness
-//     owns whichever top-level keys appear in the generated output...
-//     hooks stays wholesale-owned"). So this one snapshot is, for every
-//     settings file harness has ever targeted, an accurate "what harness
-//     itself put there at apply time" baseline: defaultMode absent
-//     (harness never owns it) and hooks exactly the generated roster (no
-//     operator hand-added hook entry survives a `--merge`).
-//   - `harness.lock` (`src/io/harness-lock.ts`) records which absolute
-//     path(s) were an actual `--target` write, as a `kind: "target"`
-//     entry. This is how a live settings file is told apart from one
-//     harness has never touched: matching against this lock entry is
-//     the "SAME path" mapping the file was written under.
-//
-// A file whose absolute path has no `target` lock entry never received
-// harness's baseline at all, so it gets the EMPTY baseline (everything
-// in it reads as "absent at last apply") rather than the shared
-// generated-settings.json baseline.
-//
-// Warnings only, never a block; this is the compensating control named
-// in the ADR, not an enforcement (the enforcing lever is the managed
-// setting in operator decision 7).
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { lastApplyPath, readLastApply } from "../../io/last-apply.js";
-import { readLock } from "../../io/harness-lock.js";
-import { safeJsonParse } from "../../io/safe-json-parse.js";
-import { resolveSettingsPath as resolveUserSettingsPath } from "./claude-mcp.js";
-function isRecord(v) {
-    return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function hookIdentityKey(h) {
-    return JSON.stringify([h.event, h.matcher, h.type, h.command]);
-}
-/**
- * Enumerate every `hooks[event][].hooks[]` entry in a parsed settings
- * object as an identity tuple. Mirrors the group-parsing convention
- * `collectOwnedHookGroups`/`classifyHookGroup` use in
- * `src/cli/uninstall/index.ts` for the same on-disk shape. Malformed
- * groups/entries are skipped rather than throwing — a live settings.json
- * this check does not own may carry shapes this parser has no opinion
- * about.
- */
-function collectHookIdentities(hooksValue) {
-    const out = [];
-    if (!isRecord(hooksValue))
-        return out;
-    for (const event of Object.keys(hooksValue)) {
-        const groups = hooksValue[event];
-        if (!Array.isArray(groups))
-            continue;
-        for (const group of groups) {
-            if (!isRecord(group))
-                continue;
-            const matcher = typeof group["matcher"] === "string" ? group["matcher"] : "";
-            const inner = group["hooks"];
-            if (!Array.isArray(inner))
-                continue;
-            for (const h of inner) {
-                if (!isRecord(h))
-                    continue;
-                const type = typeof h["type"] === "string" ? h["type"] : "";
-                const command = typeof h["command"] === "string" ? h["command"] : "";
-                out.push({ event, matcher, type, command });
-            }
-        }
-    }
-    return out;
-}
-function defaultModeOf(settings) {
-    const permissions = settings["permissions"];
-    if (!isRecord(permissions))
-        return undefined;
-    const mode = permissions["defaultMode"];
-    return typeof mode === "string" ? mode : undefined;
-}
-function checkOneFile(file, baseline, targetAbsPaths, warnings) {
-    // Plain read, no readRegularFileRejectingSymlink: this is a live
-    // Claude Code settings file (project or user scope), not one of
-    // harness's own generated artefacts, and doctor's existing reader for
-    // this exact file class (`findDeadSettingsMcpNames` in claude-mcp.ts)
-    // already reads it the same way — a missing file resolves to "nothing
-    // to report" here too, not a symlink-defense case.
-    let raw;
-    try {
-        raw = fs.readFileSync(file.absolutePath, "utf8");
-    }
-    catch {
-        return;
-    }
-    const parsed = safeJsonParse(raw);
-    if (!isRecord(parsed)) {
-        warnings.push(`${file.displayLabel}: unreadable settings JSON`);
-        return;
-    }
-    const live = parsed;
-    const hasSnapshot = targetAbsPaths.has(path.resolve(file.absolutePath));
-    const effectiveBaseline = hasSnapshot ? baseline : {};
-    const suffix = hasSnapshot ? "" : " (no apply snapshot for this file)";
-    const liveMode = defaultModeOf(live);
-    const baselineMode = defaultModeOf(effectiveBaseline);
-    if (liveMode !== undefined && liveMode !== baselineMode) {
-        if (baselineMode === undefined) {
-            warnings.push(`permissions.defaultMode set in ${file.displayLabel} but absent at last apply: ${liveMode}${suffix}`);
-        }
-        else {
-            warnings.push(`permissions.defaultMode set in ${file.displayLabel} changed from ${baselineMode} to ${liveMode}${suffix}`);
-        }
-    }
-    const liveHooks = collectHookIdentities(live["hooks"]);
-    const baselineHookKeys = new Set(collectHookIdentities(effectiveBaseline["hooks"]).map(hookIdentityKey));
-    for (const h of liveHooks) {
-        if (baselineHookKeys.has(hookIdentityKey(h)))
-            continue;
-        warnings.push(`hook entries in ${file.displayLabel} absent at last apply: ${h.event}/${h.matcher || "*"}${suffix}`);
-    }
-}
-/**
- * The absolute paths `harness.lock` records as an actual `--target`
- * write (see the module header: this is the "SAME path" mapping a live
- * file was written under). Not exported: `codex-config-drift.ts` no
- * longer shares this lookup (it keeps no apply-time snapshot to gate on
- * at all, see that module's header).
- */
-function targetLockAbsPaths(lockPath) {
-    const lockEntries = readLock(lockPath) ?? [];
-    return new Set(lockEntries
-        .filter((e) => e.kind === "target")
-        .map((e) => path.resolve(e.path)));
-}
-/**
- * `~`-relativize `absPath` under `home` for display; never leak the raw
- * absolute path. Exported for `codex-config-drift.ts`'s `$CODEX_HOME`
- * candidate label, which needs the same convention.
- */
-export function tildeize(absPath, home) {
-    const resolvedHome = path.resolve(home);
-    const resolvedPath = path.resolve(absPath);
-    if (resolvedPath === resolvedHome)
-        return "~";
-    const withSep = resolvedHome.endsWith(path.sep) ? resolvedHome : `${resolvedHome}${path.sep}`;
-    if (resolvedPath.startsWith(withSep)) {
-        return path.join("~", resolvedPath.slice(withSep.length));
-    }
-    return absPath;
-}
-export function buildSettingsDrift(opts) {
-    const notes = [];
-    const warnings = [];
-    // A malformed `.last-apply` must not abort doctor: degrade to a warning
-    // naming the file and skip the drift comparison (same shape as the
-    // runtime-selection fallback in index.ts).
-    let lastApply;
-    try {
-        lastApply = readLastApply(opts.generatedDir);
-    }
-    catch (err) {
-        warnings.push(`${lastApplyPath(opts.generatedDir)} is unreadable (${err instanceof Error ? err.message : String(err)}); settings drift not checked`);
-        return { notes, warnings };
-    }
-    if (lastApply === null) {
-        notes.push("no apply snapshot; settings drift not checked");
-        return { notes, warnings };
-    }
-    const baselineRaw = lastApply.files["settings.json"]?.content;
-    let baseline = {};
-    if (baselineRaw !== undefined) {
-        const parsed = safeJsonParse(baselineRaw);
-        if (isRecord(parsed))
-            baseline = parsed;
-    }
-    const targetAbsPaths = targetLockAbsPaths(opts.lockPath);
-    const userSettingsPath = resolveUserSettingsPath(opts.home, opts.env);
-    const candidates = [
-        {
-            absolutePath: path.resolve(opts.cwd, ".claude", "settings.json"),
-            displayLabel: ".claude/settings.json",
-        },
-        {
-            absolutePath: path.resolve(opts.cwd, ".claude", "settings.local.json"),
-            displayLabel: ".claude/settings.local.json",
-        },
-        {
-            absolutePath: path.resolve(userSettingsPath),
-            displayLabel: tildeize(userSettingsPath, opts.home),
-        },
-    ];
-    for (const c of candidates) {
-        checkOneFile(c, baseline, targetAbsPaths, warnings);
-    }
-    return { notes, warnings };
-}
-//# sourceMappingURL=settings-drift.js.map

package/dist/cli/doctor/settings-drift.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"settings-drift.js","sourceRoot":"","sources":["../../../src/cli/doctor/settings-drift.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,yEAAyE;AACzE,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,4DAA4D;AAC5D,oEAAoE;AACpE,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,iEAAiE;AACjE,EAAE;AACF,gEAAgE;AAChE,8DAA8D;AAC9D,yEAAyE;AACzE,yEAAyE;AACzE,oDAAoD;AACpD,uEAAuE;AACvE,8EAA8E;AAC9E,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,mEAAmE;AACnE,yEAAyE;AACzE,4DAA4D;AAC5D,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,gEAAgE;AAChE,oCAAoC;AACpC,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,mCAAmC;AAEnC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAoB,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,IAAI,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAejF,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAUD,SAAS,eAAe,CAAC,CAAe;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,UAAmB;IAChD,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC/B,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAK,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,QAAiC;IACtD,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CACnB,IAAuB,EACvB,QAAiC,EACjC,cAAmC,EACnC,QAAkB;IAElB,iEAAiE;IACjE,gEAAgE;IAChE,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,4BAA4B,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC;IAEpB,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oCAAoC,CAAC;IAEvE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QACxD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CACX,kCAAkC,IAAI,CAAC,YAAY,8BAA8B,QAAQ,GAAG,MAAM,EAAE,CACrG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CACX,kCAAkC,IAAI,CAAC,YAAY,iBAAiB,YAAY,OAAO,QAAQ,GAAG,MAAM,EAAE,CAC3G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACvD,QAAQ,CAAC,IAAI,CACX,mBAAmB,IAAI,CAAC,YAAY,0BAA0B,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,GAAG,MAAM,EAAE,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7C,OAAO,IAAI,GAAG,CACZ,WAAW;SACR,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACpC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,IAAY;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,YAAY,KAAK,YAAY;QAAE,OAAO,GAAG,CAAC;IAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9F,IAAI,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAeD,MAAM,UAAU,kBAAkB,CAAC,IAA+B;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,wEAAwE;IACxE,mEAAmE;IACnE,2CAA2C;IAC3C,IAAI,SAA2C,CAAC;IAChD,IAAI,CAAC;QACH,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,+BAA+B,CACtI,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC9D,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,CAAC;YAAE,QAAQ,GAAG,MAAM,CAAC;IAC1C,CAAC;IAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEzD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACtE,MAAM,UAAU,GAAwB;QACtC;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC;YAChE,YAAY,EAAE,uBAAuB;SACtC;QACD;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,qBAAqB,CAAC;YACtE,YAAY,EAAE,6BAA6B;SAC5C;QACD;YACE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC5C,YAAY,EAAE,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC;SACpD;KACF,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC"}

package/dist/cli/doctor/toolchain-parity.d.ts

@@ -1,63 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-import { type CollectNodeVersionResult, type CollectNpmGlobalsResult, type DriftItem } from "../session-start/toolchain-parity.js";
-/** One peer comparison, ready to render. Mirrors `PeerComparison` (session-start) plus a `status` roll-up for `countDiagnostics`. */
-export interface ToolchainParityPeerReport {
-    peerProfile: string;
-    /** `"drift"` is the only status that rolls into `warningCount` (see `countDiagnostics` in index.ts). */
-    status: "ok" | "drift";
-    driftCount: number;
-    ageMs: number;
-    /** `formatSnapshotAge(ageMs)` — human-scannable ("just now" / "3h" / "2d"). */
-    ageLabel: string;
-    drift: DriftItem[];
-}
-export interface ToolchainParitySection {
-    /**
-     * `"skipped"`: `--shallow` suppressed the live collection (no spawn).
-     * `"no-peers"`: configured, but no comparable peer snapshot exists yet
-     * (none present, or every present peer file was unreadable/corrupt).
-     * `"ok"` / `"drift"`: at least one peer was compared.
-     * All four are advisory — only `"drift"` peers roll into warningCount;
-     * none of the four ever roll into errorCount.
-     */
-    status: "skipped" | "no-peers" | "ok" | "drift";
-    message: string;
-    /** This machine's resolved `toolchain_parity.profile` (post-sanitization). */
-    profile: string;
-    /** Empty for `"skipped"` / `"no-peers"`. */
-    peers: ToolchainParityPeerReport[];
-    /** Sum of `peers[].driftCount`. */
-    driftTotal: number;
-    /**
-     * Peer files present in the machine-state directory that failed to
-     * parse as a valid snapshot (informational only — never rolls into
-     * `driftTotal` or any diagnostic counter, mirroring the producer's own
-     * `unparseablePeerCount` treatment).
-     */
-    unparseablePeers: string[];
-}
-export interface RunDoctorToolchainParityOptions {
-    /** Skips the live collection (no `node`/`npm` spawn) — mirrors `npmGlobalBin` / `claudeMcp`'s shallow behaviour. */
-    shallow?: boolean;
-    /** Overrides `toolchain_parity.workspace_root`'s fallback. Defaults to `process.cwd()`. */
-    cwd?: string;
-    /** Overrides "now" for deterministic snapshot-age tests. */
-    now?: Date;
-    nodeTimeoutMs?: number;
-    npmTimeoutMs?: number;
-    /** Inject the `node --version` collector (tests) — see `realNodeVersionSpawn`'s doc in the session-start module. */
-    runNodeVersion?: (timeoutMs: number) => Promise<CollectNodeVersionResult>;
-    /** Inject the `npm ls -g` collector (tests) — see `realNpmGlobalsSpawn`'s doc in the session-start module. */
-    runNpmGlobals?: (timeoutMs: number) => Promise<CollectNpmGlobalsResult>;
-    /** Inject the OW-Kit-version file reader (tests). */
-    readOwKitVersion?: (workspaceRoot: string) => {
-        version?: string;
-        error?: string;
-    };
-    /** Inject the MCP-server-names file reader (tests). */
-    readMcpServerNames?: () => {
-        names: string[];
-        error?: string;
-    };
-}
-export declare function runDoctorToolchainParity(manifest: Manifest, opts?: RunDoctorToolchainParityOptions): Promise<ToolchainParitySection>;