@meshxdata/fops 0.0.6 → 0.0.8

package/src/doctor.js

@@ -6,8 +6,9 @@ import path from "node:path";
 import chalk from "chalk";
 import { execa } from "execa";
 import { rootDir } from "./project.js";
-import inquirer from "inquirer";
 import { detectEcrRegistry, detectAwsSsoProfiles, fixAwsSso, fixEcr } from "./setup/aws.js";
+import { wslExec, wslHomedir, wslFileExists, wslReadFile, wslCmdVersion } from "./wsl.js";
+import { getInquirer } from "./lazy.js";
 
 const KEY_PORTS = {
   5432: "Postgres",
@@ -62,6 +63,41 @@ async function cmdVersion(cmd, args = ["--version"]) {
   }
 }
 
+/**
+ * Find the Claude CLI binary — checks system PATH first, then node_modules/.bin
+ * Returns the path to the binary or null if not found.
+ */
+async function findClaudeBinary() {
+  // Check system PATH via execa
+  try {
+    const cmd = process.platform === "win32" ? "where" : "which";
+    const { stdout, exitCode } = await execa(cmd, ["claude"], { reject: false, timeout: 3000 });
+    if (exitCode === 0 && stdout?.trim()) return stdout.trim().split("\n")[0];
+  } catch {}
+
+  // Check node_modules/.bin relative to this CLI's installation
+  const thisDir = path.dirname(new URL(import.meta.url).pathname);
+  const candidates = [
+    path.join(thisDir, "..", "node_modules", ".bin", "claude"),
+    path.join(thisDir, "..", "..", ".bin", "claude"), // when installed as dependency
+  ];
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+async function getClaudeVersion() {
+  const claudePath = await findClaudeBinary();
+  if (!claudePath) return null;
+  try {
+    const { stdout } = await execa(claudePath, ["--version"], { reject: false, timeout: 5000 });
+    return stdout?.split("\n")[0]?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Parse ~/.netrc and return the password/token for a given machine, or null.
  */
@@ -160,6 +196,63 @@ export async function runDoctor(opts = {}, registry = null) {
     }
   }
 
+  // WSL (Windows only — Docker Desktop uses WSL 2 backend)
+  let useWsl = false;
+  let wslHome = null;
+  if (process.platform === "win32") {
+    try {
+      const { stdout: wslList, exitCode: wslExit } = await execa("wsl", ["-l", "-v"], {
+        timeout: 10000, reject: false,
+      });
+      if (wslExit === 0 && wslList?.trim()) {
+        // Parse distro list — look for at least one WSL 2 distro
+        const hasWsl2 = /\s+2\s*$/m.test(wslList);
+        if (hasWsl2) {
+          ok("WSL 2 enabled", wslList.split("\n").find((l) => /\s+2\s*$/.test(l))?.trim().replace(/\s+/g, " ") || "active");
+          useWsl = true;
+          try { wslHome = await wslHomedir(); } catch {}
+        } else {
+          warn("WSL installed but no WSL 2 distro found", "Docker Desktop requires WSL 2", async () => {
+            console.log(chalk.cyan("  ▶ wsl --install"));
+            await execa("wsl", ["--install"], { stdio: "inherit", timeout: 300_000 });
+            console.log(chalk.yellow("  ⚠ A reboot may be required to complete WSL installation."));
+          });
+        }
+      } else {
+        fail("WSL not installed", "required for Docker Desktop", async () => {
+          console.log(chalk.cyan("  ▶ wsl --install"));
+          await execa("wsl", ["--install"], { stdio: "inherit", timeout: 300_000 });
+          console.log(chalk.yellow("  ⚠ A reboot may be required to complete WSL installation."));
+        });
+      }
+    } catch {
+      fail("WSL not available", "required for Docker Desktop", async () => {
+        console.log(chalk.cyan("  ▶ wsl --install"));
+        await execa("wsl", ["--install"], { stdio: "inherit", timeout: 300_000 });
+        console.log(chalk.yellow("  ⚠ A reboot may be required to complete WSL installation."));
+      });
+    }
+  }
+
+  // WSL-aware wrappers — when useWsl is true, delegate tool/config checks into WSL
+  const run = useWsl
+    ? (cmd, args, opts) => wslExec(cmd, args, opts)
+    : (cmd, args, opts) => execa(cmd, args, opts);
+
+  const ver = useWsl
+    ? (cmd, args) => wslCmdVersion(cmd, args)
+    : (cmd, args) => cmdVersion(cmd, args);
+
+  const home = useWsl ? wslHome : os.homedir();
+
+  const fileExists = useWsl
+    ? (p) => wslFileExists(p)
+    : (p) => fs.existsSync(p);
+
+  const readFile = useWsl
+    ? (p) => wslReadFile(p)
+    : (p) => fs.readFileSync(p, "utf8");
+
   // Docker
   const dockerVer = await cmdVersion("docker");
   if (dockerVer) {
@@ -216,6 +309,21 @@ export async function runDoctor(opts = {}, registry = null) {
           }
           hasBrew = true;
         }
+        // Clean up stale Docker cask artifacts that block reinstall
+        try {
+          await execa("brew", ["uninstall", "--cask", "--force", "docker-desktop"], { stdio: "ignore", timeout: 30_000 });
+          console.log(chalk.dim("  Removed leftover docker-desktop cask"));
+        } catch {}
+        try {
+          await execa("brew", ["uninstall", "--cask", "--force", "docker"], { stdio: "ignore", timeout: 30_000 });
+          console.log(chalk.dim("  Removed leftover docker cask"));
+        } catch {}
+        // Remove known conflicting binaries left behind by previous installs
+        for (const bin of ["/usr/local/bin/hub-tool"]) {
+          if (fs.existsSync(bin)) {
+            try { fs.unlinkSync(bin); console.log(chalk.dim(`  Removed stale ${bin}`)); } catch {}
+          }
+        }
         console.log(chalk.cyan("  ▶ brew install --cask docker"));
         await execa("brew", ["install", "--cask", "docker"], { stdio: "inherit", timeout: 300_000 });
         console.log(chalk.cyan("  ▶ open -a Docker"));
@@ -254,7 +362,7 @@ export async function runDoctor(opts = {}, registry = null) {
   else fail("Docker Compose not found", "included with Docker Desktop — restart Docker or install the compose plugin");
 
   // Git
-  const gitVer = await cmdVersion("git");
+  const gitVer = await ver("git");
   if (gitVer) ok("Git available", gitVer);
   else fail("Git not found", "install git", async () => {
     if (process.platform === "darwin") {
@@ -262,9 +370,14 @@ export async function runDoctor(opts = {}, registry = null) {
       console.log(chalk.cyan("  ▶ brew install git"));
       await execa("brew", ["install", "git"], { stdio: "inherit", timeout: 300_000 });
     } else if (process.platform === "win32") {
-      if (!hasWinget) throw new Error("winget required");
-      console.log(chalk.cyan("  ▶ winget install Git.Git"));
-      await execa("winget", ["install", "Git.Git", "--accept-source-agreements", "--accept-package-agreements"], { stdio: "inherit", timeout: 300_000 });
+      if (useWsl) {
+        console.log(chalk.cyan("  ▶ [WSL] sudo apt-get install -y git"));
+        await run("sudo", ["apt-get", "install", "-y", "git"], { stdio: "inherit", timeout: 300_000 });
+      } else {
+        if (!hasWinget) throw new Error("winget required");
+        console.log(chalk.cyan("  ▶ winget install Git.Git"));
+        await execa("winget", ["install", "Git.Git", "--accept-source-agreements", "--accept-package-agreements"], { stdio: "inherit", timeout: 300_000 });
+      }
     } else {
       console.log(chalk.cyan("  ▶ sudo apt-get install -y git"));
       await execa("sudo", ["apt-get", "install", "-y", "git"], { stdio: "inherit", timeout: 300_000 });
@@ -272,21 +385,65 @@ export async function runDoctor(opts = {}, registry = null) {
   });
 
   // Node.js version
-  const nodeVer = process.versions.node;
-  const nodeMajor = parseInt(nodeVer.split(".")[0], 10);
-  if (nodeMajor >= 18) ok(`Node.js v${nodeVer}`, ">=18 required");
-  else fail(`Node.js v${nodeVer}`, "upgrade to >=18");
-
-  // Claude CLI (bundled as a dependency)
-  const claudeVer = await cmdVersion("claude");
-  if (claudeVer) ok("Claude CLI", claudeVer);
-  else fail("Claude CLI not found", "included as a dependency", async () => {
-    console.log(chalk.cyan("  ▶ npm install"));
-    await execa("npm", ["install"], { stdio: "inherit", timeout: 300_000 });
+  if (useWsl) {
+    const wslNodeVer = await ver("node", ["-v"]);
+    if (wslNodeVer) {
+      const wslNodeMajor = parseInt(wslNodeVer.replace(/^v/, "").split(".")[0], 10);
+      if (wslNodeMajor >= 18) ok(`Node.js ${wslNodeVer} (WSL)`, ">=18 required");
+      else fail(`Node.js ${wslNodeVer} (WSL)`, "upgrade to >=18");
+    } else {
+      fail("Node.js not found in WSL", "install Node.js >=18 inside WSL");
+    }
+  } else {
+    const nodeVer = process.versions.node;
+    const nodeMajor = parseInt(nodeVer.split(".")[0], 10);
+    if (nodeMajor >= 18) ok(`Node.js v${nodeVer}`, ">=18 required");
+    else fail(`Node.js v${nodeVer}`, "upgrade to >=18", async () => {
+      if (process.platform === "darwin") {
+        if (!(await ensureBrew())) throw new Error("Homebrew required");
+        console.log(chalk.cyan("  ▶ brew install node@22"));
+        await execa("brew", ["install", "node@22"], { stdio: "inherit", timeout: 300_000 });
+      } else if (process.platform === "win32") {
+        if (!hasWinget) throw new Error("winget required");
+        console.log(chalk.cyan("  ▶ winget install OpenJS.NodeJS.LTS"));
+        await execa("winget", ["install", "OpenJS.NodeJS.LTS", "--accept-source-agreements", "--accept-package-agreements"], { stdio: "inherit", timeout: 300_000 });
+      } else {
+        console.log(chalk.dim("  Install via: https://nodejs.org/ or use nvm"));
+      }
+    });
+  }
+
+  // npm (should come with Node.js but verify)
+  const npmVer = await cmdVersion("npm");
+  if (npmVer) ok("npm", npmVer);
+  else fail("npm not found", "usually bundled with Node.js", async () => {
+    if (process.platform === "darwin") {
+      if (!(await ensureBrew())) throw new Error("Homebrew required");
+      console.log(chalk.cyan("  ▶ brew install npm"));
+      await execa("brew", ["install", "npm"], { stdio: "inherit", timeout: 300_000 });
+    } else {
+      console.log(chalk.dim("  npm is bundled with Node.js — reinstall Node.js"));
+    }
   });
 
+  // Claude CLI (bundled as a dependency or installed globally)
+  const claudeVer = await getClaudeVersion();
+  if (claudeVer) {
+    ok("Claude CLI", claudeVer);
+  } else {
+    const claudePath = await findClaudeBinary();
+    if (claudePath) {
+      warn("Claude CLI found but not responding", claudePath);
+    } else {
+      fail("Claude CLI not found", "install globally: npm install -g @anthropic-ai/claude-code", async () => {
+        console.log(chalk.cyan("  ▶ npm install -g @anthropic-ai/claude-code"));
+        await execa("npm", ["install", "-g", "@anthropic-ai/claude-code"], { stdio: "inherit", timeout: 300_000 });
+      });
+    }
+  }
+
   // AWS CLI (optional)
-  const awsVer = await cmdVersion("aws");
+  const awsVer = await ver("aws");
   if (awsVer) ok("AWS CLI", awsVer);
   else warn("AWS CLI not found", "needed for ECR login", async () => {
     if (process.platform === "darwin") {
@@ -294,9 +451,16 @@ export async function runDoctor(opts = {}, registry = null) {
       console.log(chalk.cyan("  ▶ brew install awscli"));
       await execa("brew", ["install", "awscli"], { stdio: "inherit", timeout: 300_000 });
     } else if (process.platform === "win32") {
-      if (!hasWinget) throw new Error("winget required");
-      console.log(chalk.cyan("  ▶ winget install Amazon.AWSCLI"));
-      await execa("winget", ["install", "Amazon.AWSCLI", "--accept-source-agreements", "--accept-package-agreements"], { stdio: "inherit", timeout: 300_000 });
+      if (useWsl) {
+        console.log(chalk.cyan("  ▶ [WSL] curl + unzip install"));
+        await run("sh", ["-c", 'curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip && unzip -qo /tmp/awscliv2.zip -d /tmp && sudo /tmp/aws/install'], {
+          stdio: "inherit", timeout: 300_000,
+        });
+      } else {
+        if (!hasWinget) throw new Error("winget required");
+        console.log(chalk.cyan("  ▶ winget install Amazon.AWSCLI"));
+        await execa("winget", ["install", "Amazon.AWSCLI", "--accept-source-agreements", "--accept-package-agreements"], { stdio: "inherit", timeout: 300_000 });
+      }
     } else {
       console.log(chalk.cyan("  ▶ curl + unzip install"));
       await execa("sh", ["-c", 'curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip && unzip -qo /tmp/awscliv2.zip -d /tmp && sudo /tmp/aws/install'], {
@@ -306,7 +470,7 @@ export async function runDoctor(opts = {}, registry = null) {
   });
 
   // 1Password CLI (optional — needed for secret sync)
-  const opVer = await cmdVersion("op");
+  const opVer = await ver("op");
   if (opVer) ok("1Password CLI (op)", opVer);
   else warn("1Password CLI (op) not installed", "needed for secret sync", async () => {
     if (process.platform === "darwin") {
@@ -314,16 +478,20 @@ export async function runDoctor(opts = {}, registry = null) {
       console.log(chalk.cyan("  ▶ brew install --cask 1password-cli"));
       await execa("brew", ["install", "--cask", "1password-cli"], { stdio: "inherit", timeout: 300_000 });
     } else if (process.platform === "win32") {
-      if (!hasWinget) throw new Error("winget required");
-      console.log(chalk.cyan("  ▶ winget install AgileBits.1Password.CLI"));
-      await execa("winget", ["install", "AgileBits.1Password.CLI", "--accept-source-agreements", "--accept-package-agreements"], { stdio: "inherit", timeout: 300_000 });
+      if (useWsl) {
+        console.log(chalk.dim("  Install manually inside WSL: https://developer.1password.com/docs/cli/get-started/#install"));
+      } else {
+        if (!hasWinget) throw new Error("winget required");
+        console.log(chalk.cyan("  ▶ winget install AgileBits.1Password.CLI"));
+        await execa("winget", ["install", "AgileBits.1Password.CLI", "--accept-source-agreements", "--accept-package-agreements"], { stdio: "inherit", timeout: 300_000 });
+      }
     } else {
       console.log(chalk.dim("  Install manually: https://developer.1password.com/docs/cli/get-started/#install"));
     }
   });
 
   // GitHub CLI
-  const ghVer = await cmdVersion("gh");
+  const ghVer = await ver("gh");
   if (ghVer) ok("GitHub CLI (gh)", ghVer);
   else warn("GitHub CLI (gh) not installed", "needed for auth", async () => {
     if (process.platform === "darwin") {
@@ -331,20 +499,81 @@ export async function runDoctor(opts = {}, registry = null) {
       console.log(chalk.cyan("  ▶ brew install gh"));
       await execa("brew", ["install", "gh"], { stdio: "inherit", timeout: 300_000 });
     } else if (process.platform === "win32") {
-      if (!hasWinget) throw new Error("winget required");
-      console.log(chalk.cyan("  ▶ winget install GitHub.cli"));
-      await execa("winget", ["install", "GitHub.cli", "--accept-source-agreements", "--accept-package-agreements"], { stdio: "inherit", timeout: 300_000 });
+      if (useWsl) {
+        console.log(chalk.cyan("  ▶ [WSL] Install gh via apt"));
+        await run("sh", ["-c", "type -p curl >/dev/null || (sudo apt update && sudo apt install curl -y) && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && echo 'deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main' | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null && sudo apt update && sudo apt install gh -y"], {
+          stdio: "inherit", timeout: 300_000,
+        });
+      } else {
+        if (!hasWinget) throw new Error("winget required");
+        console.log(chalk.cyan("  ▶ winget install GitHub.cli"));
+        await execa("winget", ["install", "GitHub.cli", "--accept-source-agreements", "--accept-package-agreements"], { stdio: "inherit", timeout: 300_000 });
+      }
     } else {
       console.log(chalk.dim("  Install: https://cli.github.com/"));
     }
   });
 
   // ~/.netrc GitHub credentials (required for private repo access)
-  const netrcPath = path.join(os.homedir(), ".netrc");
+  const netrcPath = useWsl
+    ? path.posix.join(home, ".netrc")
+    : path.join(os.homedir(), ".netrc");
+
+  /**
+   * Write GitHub credentials to ~/.netrc from gh CLI auth.
+   * gh auth login stores tokens in its own keychain but doesn't create netrc.
+   */
+  const writeNetrcFromGh = async () => {
+    const { stdout: ghToken, exitCode: tokenExit } = await run("gh", ["auth", "token"], { timeout: 5000, reject: false });
+    if (tokenExit !== 0 || !ghToken?.trim()) {
+      throw new Error("gh auth token failed — run 'gh auth login' first");
+    }
+    const { stdout: ghUser, exitCode: userExit } = await run("gh", ["api", "/user", "--jq", ".login"], { timeout: 10000, reject: false });
+    if (userExit !== 0 || !ghUser?.trim()) {
+      throw new Error("gh api /user failed — token may lack read:user scope");
+    }
+    const entry = `machine github.com\nlogin ${ghUser.trim()}\npassword ${ghToken.trim()}\n`;
+    if (useWsl) {
+      const exists = await fileExists(netrcPath);
+      if (exists) {
+        const content = await readFile(netrcPath);
+        if (!content.includes("github.com")) {
+          await wslExec("sh", ["-c", `echo '\n${entry}' >> ${netrcPath}`]);
+        } else {
+          // Replace existing github.com entry via WSL
+          const newContent = content.replace(
+            /machine github\.com\s+login\s+\S+\s+password\s+\S+\n?/g,
+            entry
+          );
+          await wslExec("sh", ["-c", `cat > ${netrcPath} << 'NETRCEOF'\n${newContent}\nNETRCEOF`]);
+          await wslExec("chmod", ["600", netrcPath]);
+        }
+      } else {
+        await wslExec("sh", ["-c", `echo '${entry}' > ${netrcPath} && chmod 600 ${netrcPath}`]);
+      }
+    } else {
+      if (fs.existsSync(netrcPath)) {
+        const content = fs.readFileSync(netrcPath, "utf8");
+        if (!content.includes("github.com")) {
+          fs.appendFileSync(netrcPath, "\n" + entry);
+        } else {
+          // Replace existing github.com entry
+          const newContent = content.replace(
+            /machine github\.com\s+login\s+\S+\s+password\s+\S+\n?/g,
+            entry
+          );
+          fs.writeFileSync(netrcPath, newContent, { mode: 0o600 });
+        }
+      } else {
+        fs.writeFileSync(netrcPath, entry, { mode: 0o600 });
+      }
+    }
+    console.log(chalk.green("  ✓ ~/.netrc updated with GitHub credentials"));
+  };
   const netrcFixFn = async () => {
     // Install gh if missing
     let hasGh = false;
-    try { await execa("gh", ["--version"]); hasGh = true; } catch {}
+    try { await run("gh", ["--version"]); hasGh = true; } catch {}
     if (!hasGh) {
       if (process.platform === "darwin") {
         if (!(await ensureBrew())) throw new Error("Homebrew required to install gh");
@@ -352,39 +581,45 @@ export async function runDoctor(opts = {}, registry = null) {
         await execa("brew", ["install", "gh"], { stdio: "inherit", timeout: 300_000 });
         hasGh = true;
       } else if (process.platform === "win32") {
-        console.log(chalk.cyan("  ▶ winget install GitHub.cli"));
-        await execa("winget", ["install", "GitHub.cli", "--accept-source-agreements", "--accept-package-agreements"], { stdio: "inherit", timeout: 300_000 });
-        hasGh = true;
+        if (useWsl) {
+          console.log(chalk.cyan("  ▶ [WSL] Install gh via apt"));
+          await run("sh", ["-c", "type -p curl >/dev/null || (sudo apt update && sudo apt install curl -y) && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && echo 'deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main' | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null && sudo apt update && sudo apt install gh -y"], {
+            stdio: "inherit", timeout: 300_000,
+          });
+          hasGh = true;
+        } else {
+          console.log(chalk.cyan("  ▶ winget install GitHub.cli"));
+          await execa("winget", ["install", "GitHub.cli", "--accept-source-agreements", "--accept-package-agreements"], { stdio: "inherit", timeout: 300_000 });
+          hasGh = true;
+        }
       }
     }
+
+    // Check if already authenticated
+    const { exitCode: authStatus } = await execa("gh", ["auth", "status"], { timeout: 5000, reject: false });
+    if (authStatus === 0) {
+      // Already authenticated — just sync to netrc
+      console.log(chalk.dim("  gh already authenticated, syncing to ~/.netrc…"));
+      await writeNetrcFromGh();
+      return;
+    }
+
     // Authenticate via gh
     console.log(chalk.cyan("\n  ▶ gh auth login -p https -h github.com -w"));
-    await execa("gh", ["auth", "login", "-p", "https", "-h", "github.com", "-w"], {
+    await run("gh", ["auth", "login", "-p", "https", "-h", "github.com", "-w"], {
       stdio: "inherit", timeout: 120_000,
     });
     console.log(chalk.cyan("  ▶ gh auth setup-git"));
-    await execa("gh", ["auth", "setup-git"], { stdio: "inherit", timeout: 10_000 }).catch(() => {});
-    // Extract token and write to .netrc for tools that need it directly
-    try {
-      const { stdout: ghToken } = await execa("gh", ["auth", "token"], { timeout: 5000 });
-      const { stdout: ghUser } = await execa("gh", ["api", "/user", "--jq", ".login"], { timeout: 10000 });
-      if (ghToken?.trim() && ghUser?.trim()) {
-        const entry = `machine github.com\nlogin ${ghUser.trim()}\npassword ${ghToken.trim()}\n`;
-        if (fs.existsSync(netrcPath)) {
-          const content = fs.readFileSync(netrcPath, "utf8");
-          if (!content.includes("github.com")) {
-            fs.appendFileSync(netrcPath, "\n" + entry);
-          }
-        } else {
-          fs.writeFileSync(netrcPath, entry, { mode: 0o600 });
-        }
-        console.log(chalk.green("  ✓ ~/.netrc updated with GitHub credentials"));
-      }
-    } catch {}
+    await run("gh", ["auth", "setup-git"], { stdio: "inherit", timeout: 10_000 }).catch(() => {});
+
+    // Extract token and write to .netrc
+    await writeNetrcFromGh();
   };
-  if (fs.existsSync(netrcPath)) {
+
+  const netrcExists = await fileExists(netrcPath);
+  if (netrcExists) {
     try {
-      const content = fs.readFileSync(netrcPath, "utf8");
+      const content = await readFile(netrcPath);
       if (!content.includes("github.com")) {
         fail("~/.netrc exists but no github.com entry", "needed for private repos", netrcFixFn);
       } else {
@@ -417,41 +652,55 @@ export async function runDoctor(opts = {}, registry = null) {
   }
 
   // ~/.fops.json config (optional)
-  const fopsConfig = path.join(os.homedir(), ".fops.json");
-  if (fs.existsSync(fopsConfig)) ok("~/.fops.json config");
+  const fopsConfig = useWsl
+    ? path.posix.join(home, ".fops.json")
+    : path.join(os.homedir(), ".fops.json");
+  const fopsExists = await fileExists(fopsConfig);
+  if (fopsExists) ok("~/.fops.json config");
   else warn("~/.fops.json not found", "optional — run fops init to create");
 
   // ── AWS / ECR ──────────────────────────────────────
   header("AWS / ECR");
 
-  const awsConfigPath = path.join(os.homedir(), ".aws", "config");
+  const awsConfigPath = useWsl
+    ? path.posix.join(home, ".aws", "config")
+    : path.join(os.homedir(), ".aws", "config");
   let awsSessionValid = false;
 
-  if (fs.existsSync(awsConfigPath)) {
+  // Context object for WSL-delegated AWS commands
+  const awsCtx = useWsl ? { exec: run, home } : {};
+  const boundFixAwsSso = () => fixAwsSso(awsCtx);
+
+  const awsConfigExists = await fileExists(awsConfigPath);
+  if (awsConfigExists) {
     ok("~/.aws/config exists");
 
     // Check for SSO session — use detected profile
-    const ssoProfiles = awsVer ? detectAwsSsoProfiles() : [];
+    let awsConfigContent = null;
+    if (useWsl) {
+      try { awsConfigContent = await readFile(awsConfigPath); } catch {}
+    }
+    const ssoProfiles = awsVer ? detectAwsSsoProfiles(awsConfigContent) : [];
     const defaultProfile = ssoProfiles[0];
 
     if (awsVer) {
       const profileArgs = defaultProfile ? ["--profile", defaultProfile.name] : [];
       try {
-        const { stdout } = await execa("aws", ["sts", "get-caller-identity", "--output", "json", ...profileArgs], {
+        const { stdout } = await run("aws", ["sts", "get-caller-identity", "--output", "json", ...profileArgs], {
           timeout: 10000, reject: false,
         });
         if (stdout && stdout.includes("Account")) {
           ok("AWS SSO session valid");
           awsSessionValid = true;
         } else {
-          fail("AWS SSO session expired or invalid", "run: aws sso login", fixAwsSso);
+          fail("AWS SSO session expired or invalid", "run: aws sso login", boundFixAwsSso);
         }
       } catch {
-        fail("AWS SSO session check failed", "run: aws sso login", fixAwsSso);
+        fail("AWS SSO session check failed", "run: aws sso login", boundFixAwsSso);
       }
     }
   } else {
-    warn("~/.aws/config not found", "needed for ECR", fixAwsSso);
+    warn("~/.aws/config not found", "needed for ECR", boundFixAwsSso);
   }
 
   // Validate ECR access if project references ECR images
@@ -462,20 +711,24 @@ export async function runDoctor(opts = {}, registry = null) {
       fail(`ECR registry ${ecrUrl}`, "fix AWS session first");
     } else {
       // Check we can get an ECR login password (same call the actual login uses)
-      const ssoProfiles = detectAwsSsoProfiles();
+      let awsConfigContent = null;
+      if (useWsl) {
+        try { awsConfigContent = await readFile(awsConfigPath); } catch {}
+      }
+      const ssoProfiles = detectAwsSsoProfiles(awsConfigContent);
       const ecrProfile = ssoProfiles.find((p) => p.region === ecrInfo.region) || ssoProfiles[0];
       const ecrProfileArgs = ecrProfile ? ["--profile", ecrProfile.name] : [];
       try {
-        const { stdout, exitCode } = await execa("aws", [
+        const { stdout, exitCode } = await run("aws", [
           "ecr", "get-login-password", "--region", ecrInfo.region, ...ecrProfileArgs,
         ], { timeout: 10000, reject: false });
         if (exitCode === 0 && stdout?.trim()) {
           ok(`ECR registry accessible`, ecrUrl);
         } else {
-          fail(`ECR registry not accessible`, `${ecrUrl} — run: fops doctor --fix`, () => fixEcr(ecrInfo));
+          fail(`ECR registry not accessible`, `${ecrUrl} — run: fops doctor --fix`, () => fixEcr(ecrInfo, awsCtx));
         }
       } catch {
-        fail(`ECR registry check failed`, ecrUrl, () => fixEcr(ecrInfo));
+        fail(`ECR registry check failed`, ecrUrl, () => fixEcr(ecrInfo, awsCtx));
       }
     }
   } else if (dir) {
@@ -582,9 +835,18 @@ export async function runDoctor(opts = {}, registry = null) {
         }
       }
       if (size && avail && pct != null) {
-        if (pct >= 90) fail(`Host disk: ${avail} free of ${size}`, "critically low — Docker needs room");
-        else if (pct >= 80) warn(`Host disk: ${avail} free of ${size}`, "getting low");
-        else ok(`Host disk: ${avail} free of ${size}`);
+        const cleanupFix = async () => {
+          console.log(chalk.cyan("  ▶ docker system prune -af --volumes"));
+          await execa("docker", ["system", "prune", "-af", "--volumes"], { stdio: "inherit", timeout: 300_000 });
+          console.log(chalk.dim("  Tip: Also run 'docker builder prune -af' to clear build cache"));
+        };
+        if (pct >= 90) {
+          fail(`Host disk: ${avail} free of ${size}`, "critically low — Docker needs room", cleanupFix);
+        } else if (pct >= 80) {
+          warn(`Host disk: ${avail} free of ${size}`, "consider running: docker system prune", cleanupFix);
+        } else {
+          ok(`Host disk: ${avail} free of ${size}`);
+        }
       }
     } catch {}
 
@@ -781,7 +1043,7 @@ export async function runDoctor(opts = {}, registry = null) {
   if (fixes.length > 0) {
     let shouldFix = opts.fix;
     if (!shouldFix) {
-      const { ans } = await inquirer.prompt([{ type: "confirm", name: "ans", message: `Fix ${fixes.length} issue(s) automatically?`, default: true }]);
+      const { ans } = await (await getInquirer()).prompt([{ type: "confirm", name: "ans", message: `Fix ${fixes.length} issue(s) automatically?`, default: true }]);
       shouldFix = ans;
     }
     if (shouldFix) {

package/src/feature-flags.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import chalk from "chalk";
 import { execa } from "execa";
-import inquirer from "inquirer";
+import { getInquirer } from "./lazy.js";
 
 /**
  * Canonical feature flags — the complete set known to the platform.
@@ -130,7 +130,7 @@ export async function runFeatureFlags(root) {
     checked: allFlags[name].value,
   }));
 
-  const { enabled } = await inquirer.prompt([{
+  const { enabled } = await (await getInquirer()).prompt([{
     type: "checkbox",
     name: "enabled",
     message: "Toggle feature flags:",
@@ -175,7 +175,7 @@ export async function runFeatureFlags(root) {
   const serviceList = [...affectedServices];
   console.log(chalk.dim(`  Affected: ${serviceList.join(", ")}`));
 
-  const { restart } = await inquirer.prompt([{
+  const { restart } = await (await getInquirer()).prompt([{
     type: "confirm",
     name: "restart",
     message: `Restart ${serviceList.length} service(s)?`,

package/src/lazy.js

@@ -0,0 +1,12 @@
+/**
+ * Lazy-load inquirer to avoid ~20s import penalty on WSL /mnt/c/ filesystem.
+ * Only loads when a command actually needs interactive prompts.
+ */
+let _inquirer;
+export async function getInquirer() {
+  if (!_inquirer) {
+    const mod = await import("inquirer");
+    _inquirer = mod.default;
+  }
+  return _inquirer;
+}

package/src/plugins/bundled/coda/auth.js

@@ -49,8 +49,14 @@ function saveCredentials(creds) {
  * Open a URL in the user's default browser.
  */
 function openBrowser(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  try { execSync(`${cmd} '${url}'`, { stdio: "ignore" }); } catch {}
+  try {
+    if (process.platform === "win32") {
+      execSync(`cmd /c start "" "${url}"`, { stdio: "ignore" });
+    } else {
+      const cmd = process.platform === "darwin" ? "open" : "xdg-open";
+      execSync(`${cmd} '${url}'`, { stdio: "ignore" });
+    }
+  } catch {}
 }
 
 /**

package/src/plugins/bundled/cursor/index.js

@@ -247,8 +247,9 @@ export function register(api) {
     fn: async (ok, warn) => {
       const bin = cursorBin();
       if (bin) {
-        const version = run(bin, ["--version"]);
-        ok("Cursor IDE", version || bin);
+        const raw = run(bin, ["--version"]);
+        const version = raw ? raw.split("\n")[0].trim() : bin;
+        ok("Cursor IDE", version);
       } else {
         warn("Cursor IDE", "not found — install from cursor.com, then: Cmd+Shift+P → Shell Command: Install 'cursor'");
       }