@mmnto/cli 1.111.1 → 1.112.0

package/dist/commands/doctor.test.js

@@ -4,7 +4,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { cleanTmpDir } from '../test-utils.js';
-import { AGENTS_MD_REDIRECT_PATTERN, BYPASS_THRESHOLD, checkAgentsMdCanonical, checkCompiledRules, checkConfig, checkEmbeddingConfig, checkFreezes, checkGitHooks, checkGrandfatheredRules, checkIndex, checkLinkedIndexes, checkOllama, checkSecretLeaks, checkSecretsFileTracked, checkStaleRules, checkStrategyRoot, checkUpgradeCandidates, CLAUDE_MD_REDIRECT_MAX_BYTES, doctorCommand, doctorGateFailed, findLegacyGrandfatheredRules, findStaleRules, MIN_CONTEXT_EVENTS, MIN_EVENTS, NON_CODE_THRESHOLD, resolveStrictTier, runSelfHealing, V_1_13_0_SHIP_DATE_ISO, } from './doctor.js';
+import { AGENTS_MD_REDIRECT_PATTERN, BYPASS_THRESHOLD, checkAgentsMdCanonical, checkCompiledRules, checkConfig, checkEmbeddingConfig, checkEstate, checkFreezes, checkGitHooks, checkGrandfatheredRules, checkIndex, checkLinkedIndexes, checkOllama, checkSecretLeaks, checkSecretsFileTracked, checkStaleRules, checkStrategyRoot, checkUpgradeCandidates, CLAUDE_MD_REDIRECT_MAX_BYTES, doctorCommand, doctorGateFailed, findLegacyGrandfatheredRules, findStaleRules, MIN_CONTEXT_EVENTS, MIN_EVENTS, NON_CODE_THRESHOLD, resolveStrictTier, runSelfHealing, V_1_13_0_SHIP_DATE_ISO, } from './doctor.js';
 // ─── Helpers ────────────────────────────────────────────
 function makeTmpDir() {
     return fs.mkdtempSync(path.join(os.tmpdir(), 'totem-doctor-'));
@@ -314,7 +314,15 @@ const EXPECTED_DIAGNOSTIC_NAMES = [
     'Stale Rules',
     'Grandfathered Rules',
     'Freeze state',
+    'Estate',
 ];
+/**
+ * The ambient `Estate` row reads the real user-level registry and shells git at
+ * every repo listed there. Every `doctorCommand` call in this suite passes an
+ * EMPTY registry through the seam so the suite stays hermetic — same reason the
+ * Ollama probe's `fetch` is mocked above.
+ */
+const HERMETIC = { estateSeamsForTest: { registry: {} } };
 describe('doctorCommand', () => {
     let tmpDir;
     let originalCwd;
@@ -339,12 +347,12 @@ describe('doctorCommand', () => {
         vi.restoreAllMocks();
     });
     it('runs without throwing', async () => {
-        const results = await doctorCommand();
+        const results = await doctorCommand(HERMETIC);
         expect(results).toBeDefined();
         expect(results).toHaveLength(EXPECTED_DIAGNOSTIC_NAMES.length);
     });
     it('returns correct check names', async () => {
-        const results = await doctorCommand();
+        const results = await doctorCommand(HERMETIC);
         const names = results.map((r) => r.name);
         expect(names).toEqual(expect.arrayContaining([...EXPECTED_DIAGNOSTIC_NAMES]));
     });
@@ -372,7 +380,7 @@ describe('doctorCommand output', () => {
         vi.restoreAllMocks();
     });
     it('outputs all check names in console output', async () => {
-        await doctorCommand();
+        await doctorCommand(HERMETIC);
         const output = stderrSpy.mock.calls.map((args) => String(args[0])).join('\n');
         expect(output).toContain('Config');
         expect(output).toContain('Compiled Rules');
@@ -387,7 +395,7 @@ describe('doctorCommand output', () => {
         expect(output).toContain('Stale Rules');
     });
     it('outputs summary line with pass/warn/fail counts', async () => {
-        await doctorCommand();
+        await doctorCommand(HERMETIC);
         const output = stderrSpy.mock.calls.map((args) => String(args[0])).join('\n');
         expect(output).toMatch(/\d+ passed/);
         expect(output).toMatch(/\d+ warnings/);
@@ -429,7 +437,7 @@ describe('doctorCommand strict mode contract', () => {
         // Seed a guaranteed failure: no config means checkConfig returns `fail`.
         fs.unlinkSync(path.join(tmpDir, 'totem.config.ts'));
         process.exitCode = undefined;
-        const results = await doctorCommand({ strict: true });
+        const results = await doctorCommand({ ...HERMETIC, strict: true });
         expect(results.some((r) => r.status === 'fail')).toBe(true);
         expect(process.exitCode).toBeUndefined();
     });
@@ -437,14 +445,14 @@ describe('doctorCommand strict mode contract', () => {
         const exitSpy = vi.spyOn(process, 'exit').mockImplementation(((_) => {
             throw new Error('process.exit should not be called by doctorCommand');
         }));
-        await doctorCommand({ strict: true });
-        await doctorCommand({ strict: false });
-        await doctorCommand();
+        await doctorCommand({ ...HERMETIC, strict: true });
+        await doctorCommand({ ...HERMETIC, strict: false });
+        await doctorCommand(HERMETIC);
         expect(exitSpy).not.toHaveBeenCalled();
     });
     it('returns the same DiagnosticResult[] shape regardless of strict flag', async () => {
-        const resultsStrict = await doctorCommand({ strict: true });
-        const resultsLoose = await doctorCommand({ strict: false });
+        const resultsStrict = await doctorCommand({ ...HERMETIC, strict: true });
+        const resultsLoose = await doctorCommand({ ...HERMETIC, strict: false });
         expect(resultsStrict.map((r) => r.name)).toEqual(resultsLoose.map((r) => r.name));
     });
 });
@@ -492,6 +500,203 @@ describe('doctorGateFailed', () => {
         expect(doctorGateFailed(onlySkip, 'fail')).toBe(false);
         expect(doctorGateFailed(onlySkip, 'warn')).toBe(false);
     });
+    // Sensor-class rows report but never gate (mmnto-ai/totem#2580 ruled scope).
+    // The exemption rides the ROW, so widening the tier later cannot give a
+    // sensor teeth by accident.
+    it('a gateExempt warn row does not gate even under the warn tier', () => {
+        const estateWarn = [
+            ...clean,
+            { name: 'Estate', status: 'warn', message: '', gateExempt: true },
+        ];
+        expect(doctorGateFailed(estateWarn, 'warn')).toBe(false);
+        expect(doctorGateFailed(estateWarn, 'fail')).toBe(false);
+    });
+    it('a non-exempt warn row alongside an exempt one still gates under the warn tier', () => {
+        const mixed = [
+            { name: 'Estate', status: 'warn', message: '', gateExempt: true },
+            { name: 'C', status: 'warn', message: '' },
+        ];
+        expect(doctorGateFailed(mixed, 'warn')).toBe(true);
+        expect(doctorGateFailed(mixed, 'fail')).toBe(false);
+    });
+    // The exemption is scoped to ADVISORY statuses. A fail is a wiring failure
+    // and no row may hide one — sensor rows never emit `fail`, so the narrowing
+    // costs them nothing and closes the mislabelled-row hole.
+    it('a gateExempt FAIL row still gates in both tiers', () => {
+        const exemptFail = [
+            ...clean,
+            { name: 'Sensor', status: 'fail', message: '', gateExempt: true },
+        ];
+        expect(doctorGateFailed(exemptFail, 'fail')).toBe(true);
+        expect(doctorGateFailed(exemptFail, 'warn')).toBe(true);
+    });
+});
+// ─── Ambient estate row (mmnto-ai/totem#2580) ───────────
+describe('checkEstate', () => {
+    const registryOf = (...paths) => Object.fromEntries(paths.map((p) => [
+        p,
+        { path: p, chunkCount: 1, lastSync: '2026-08-01T00:00:00.000Z', embedder: 'test' },
+    ]));
+    let estateDir;
+    beforeEach(() => {
+        estateDir = fs.realpathSync(makeTmpDir());
+    });
+    afterEach(() => {
+        cleanTmpDir(estateDir);
+    });
+    /** Canned git for `repo`; every other path answers as its own toplevel. */
+    function seams(repo, opts = {}) {
+        const listing = [
+            `worktree ${repo.split(path.sep).join('/')}`,
+            `HEAD ${'a'.repeat(40)}`,
+            'branch refs/heads/main',
+            '',
+        ].join('\n');
+        const fold = (p) => process.platform === 'win32' ? path.resolve(p).toLowerCase() : path.resolve(p);
+        const toplevels = new Map(Object.entries(opts.toplevels ?? {}).map(([k, v]) => [fold(k), v]));
+        const failToplevel = new Set((opts.failToplevel ?? []).map(fold));
+        return {
+            registry: registryOf(repo),
+            now: Date.parse('2026-08-05T12:00:00.000Z'),
+            safeExec: ((_command, args = []) => {
+                if (opts.throws === true)
+                    throw new Error('git exploded');
+                const cwd = args[2] ?? '';
+                const verb = args.slice(3);
+                if (verb[0] === 'rev-parse' && verb[1] === '--show-toplevel') {
+                    if (failToplevel.has(fold(cwd)))
+                        throw new Error('not a git repository');
+                    return (toplevels.get(fold(cwd)) ?? path.resolve(cwd)).split(path.sep).join('/');
+                }
+                if (verb[0] === 'worktree') {
+                    if (fold(cwd) !== fold(repo))
+                        throw new Error('not a git repository');
+                    return listing;
+                }
+                if (verb[0] === 'rev-parse')
+                    return 'origin/main';
+                return '';
+            }),
+        };
+    }
+    it('skips when nothing is registered', async () => {
+        const result = await checkEstate({ registry: {} });
+        expect(result.status).toBe('skip');
+        expect(result.message).toContain('No registered repos');
+    });
+    // A corrupt registry must not collapse into the clean "nothing registered"
+    // skip — the ambient row is the surface operators actually see, and it is
+    // the one that would hide the failure. Drives the REAL readRegistry (no
+    // registry seam) against a temp home holding an unparseable registry.json.
+    it('warns (not skip) when the registry exists but cannot be read', async () => {
+        const home = fs.realpathSync(makeTmpDir());
+        fs.mkdirSync(path.join(home, '.totem'), { recursive: true });
+        fs.writeFileSync(path.join(home, '.totem', 'registry.json'), '{ not json', 'utf-8');
+        const prevHome = process.env['HOME'];
+        const prevProfile = process.env['USERPROFILE'];
+        process.env['HOME'] = home;
+        process.env['USERPROFILE'] = home;
+        try {
+            const result = await checkEstate();
+            expect(result.status).toBe('warn');
+            expect(result.message).toContain('Registry unreadable');
+            expect(result.gateExempt).toBe(true);
+        }
+        finally {
+            if (prevHome === undefined)
+                delete process.env['HOME'];
+            else
+                process.env['HOME'] = prevHome;
+            if (prevProfile === undefined)
+                delete process.env['USERPROFILE'];
+            else
+                process.env['USERPROFILE'] = prevProfile;
+            cleanTmpDir(home);
+        }
+    });
+    it('passes quietly on a clean estate, naming missing and unscannable counts', async () => {
+        const repo = path.join(estateDir, 'repo');
+        fs.mkdirSync(repo, { recursive: true });
+        const gone = path.join(estateDir, 'vanished');
+        const base = seams(repo);
+        const result = await checkEstate({
+            ...base,
+            registry: registryOf(repo, gone),
+        });
+        expect(result.status).toBe('pass');
+        // The denominator is what was ENUMERATED — an entry that was missing, not a
+        // git root, or unprobeable was never looked inside and must not inflate it.
+        expect(result.message).toContain('1 enumerated repo(s)');
+        expect(result.message).toContain('(1 missing)');
+        expect(result.message).toContain('0 linked worktree(s)');
+        expect(result.gateExempt).toBe(true);
+    });
+    it('names the not-git-root and unprobeable counts too', async () => {
+        const repo = path.join(estateDir, 'repo');
+        fs.mkdirSync(repo, { recursive: true });
+        const inside = path.join(repo, 'packages');
+        fs.mkdirSync(inside, { recursive: true });
+        const broken = path.join(estateDir, 'broken');
+        fs.mkdirSync(broken, { recursive: true });
+        const result = await checkEstate({
+            ...seams(repo, { toplevels: { [inside]: repo }, failToplevel: [broken] }),
+            registry: registryOf(repo, inside, broken),
+        });
+        expect(result.status).toBe('pass');
+        expect(result.message).toContain('1 enumerated repo(s)');
+        expect(result.message).toContain('1 not-git-root');
+        expect(result.message).toContain('1 unprobeable');
+    });
+    it('warns with counts and the --estate remediation when husks exist', async () => {
+        const repo = path.join(estateDir, 'repo');
+        fs.mkdirSync(path.join(repo, '.claude', 'worktrees', 'agent-a'), { recursive: true });
+        fs.mkdirSync(path.join(repo, '.claude', 'worktrees', 'agent-b'), { recursive: true });
+        const result = await checkEstate(seams(repo));
+        expect(result.status).toBe('warn');
+        expect(result.message).toContain('2 husk candidate(s)');
+        expect(result.remediation).toContain('totem doctor --estate');
+        expect(result.gateExempt).toBe(true);
+    });
+    // A git that fails on every invocation is NOT a scan crash: the scan is
+    // fail-soft per probe, so this lands as unscannable rows and the row still
+    // reports. Asserted so the two failure classes stay distinguishable.
+    it('keeps reporting when every git probe fails, naming the unscannable count', async () => {
+        const repo = path.join(estateDir, 'repo');
+        fs.mkdirSync(repo, { recursive: true });
+        const result = await checkEstate(seams(repo, { throws: true }));
+        expect(result.status).toBe('pass');
+        expect(result.message).toContain('1 probe(s) unscannable');
+    });
+    it('warns (never throws) on a crash-class scan failure', async () => {
+        const repo = path.join(estateDir, 'repo');
+        fs.mkdirSync(repo, { recursive: true });
+        // A malformed registry is the reachable crash class: EVERY exec call site
+        // inside the scan is wrapped, so even a broken git seam degrades to
+        // unscannable rows (asserted above) rather than throwing. What the catch
+        // exists for is a crash BEFORE or AROUND the probes — a bad registry
+        // shape, or the dynamic core import failing.
+        const result = await checkEstate({ ...seams(repo), registry: { bad: null } });
+        expect(result.status).toBe('warn');
+        expect(result.message).toContain('Estate scan failed');
+    });
+    it('marks every row gateExempt so the sensor can never gate', async () => {
+        const repo = path.join(estateDir, 'repo');
+        fs.mkdirSync(repo, { recursive: true });
+        const huskRepo = path.join(estateDir, 'husk-repo');
+        fs.mkdirSync(path.join(huskRepo, '.claude', 'worktrees', 'agent-a'), { recursive: true });
+        // All FOUR real paths: skip / pass / husk-warn / crash-warn.
+        const rows = [
+            await checkEstate({ registry: {} }),
+            await checkEstate(seams(repo)),
+            await checkEstate(seams(huskRepo)),
+            await checkEstate({ ...seams(repo), registry: { bad: null } }),
+        ];
+        expect(rows.map((r) => r.status)).toEqual(['skip', 'pass', 'warn', 'warn']);
+        expect(rows[2].message).toContain('husk candidate(s)');
+        for (const row of rows)
+            expect(row.gateExempt).toBe(true);
+        expect(doctorGateFailed(rows, 'warn')).toBe(false);
+    });
 });
 // ─── Secrets file tracking check ────────────────────────
 describe('checkSecretsFileTracked', () => {