@monoes/monomindcli 2.16.12 → 2.16.13

package/dist/src/commands/doctor-project-checks.js

@@ -3,18 +3,18 @@
  * Config, memory, API keys, MCP, monograph, helpers, routing, gates, gitignore, worker metrics
  */
 import { execSync } from 'node:child_process';
-import { appendFileSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, } from 'node:fs';
-import { createRequire } from 'node:module';
+import { existsSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join, sep } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { isKeptUserEdit } from '../init/file-guard.js';
-import { DOCTOR_TRACKED_HELPERS, OBSOLETE_HELPER_NAMES } from '../init/helpers-generator.js';
-import { MONOMIND_NEVER_COMMIT } from '../init/never-commit.js';
+import { join } from 'node:path';
 import { mcpAddHint } from '../platform-adapters/renderers/mcp.js';
-import { classifyNativeModuleError, extractNativeModulePackageName, } from '../utils/native-error.js';
-import { CONFIG_JSON_CANDIDATE_PATHS, CONFIG_YAML_CANDIDATE_PATHS, MEMORY_DB_CANDIDATE_PATHS, } from '../utils/paths.js';
-import { MAX_DOCTOR_BUILD_LOG_SCAN_BYTES, MAX_DOCTOR_CONFIG_BYTES, MAX_DOCTOR_GITIGNORE_BYTES, MAX_DOCTOR_HELPER_BYTES, MAX_DOCTOR_PKG_BYTES, } from './doctor-env-checks.js';
+import { CONFIG_JSON_CANDIDATE_PATHS, CONFIG_YAML_CANDIDATE_PATHS } from '../utils/paths.js';
+import { MAX_DOCTOR_CONFIG_BYTES } from './doctor-env-checks.js';
+export { checkGitignoreCoverage, fixGitignoreCoverage } from './doctor-gitignore-checks.js';
+export { checkGuidanceGates, checkHelpersFresh, fixStaleHelpers } from './doctor-helpers-checks.js';
+export { checkDocumentExtractors, checkMemoryDatabase, checkMemoryKnowledgeGraph, checkMemoryProficiency, checkProjectRoot, checkSecondBrainModel, } from './doctor-memory-checks.js';
+export { checkMonoesMemory, checkMonograph, checkMonographFreshness, } from './doctor-monograph-checks.js';
+export { checkAgentRegistry, checkMonoesIntegration } from './doctor-routing-checks.js';
+export { checkMetricsFreshness, checkSecurityAuditFindings } from './doctor-worker-checks.js';
 export async function checkConfigFile() {
     const jsonPaths = CONFIG_JSON_CANDIDATE_PATHS;
     for (const configPath of jsonPaths) {
@@ -45,218 +45,6 @@ export async function checkConfigFile() {
         fix: 'monomind config init',
     };
 }
-/** o-16 (AC-6): the marker walk that resolves "this project" for the Memory
- *  & Knowledge store can silently adopt a wrong ancestor — the incident that
- *  motivated this check was a shared scratch parent's bare `.monomind`
- *  capturing an unrelated fixture, with no visible symptom until a search
- *  came back empty. Disclose the resolved root and why it was chosen, so a
- *  user can see which directory their brain is keyed to without reading code
- *  or debug logs. Always 'info': the resolution itself is never a health
- *  problem, only the failure to see it was.
- *
- *  Named/scoped to "Memory Project Root", not a bare "Project Root" (o-16
- *  revision 1, reviewer MAJOR 2): `MONOMIND_PROJECT_ROOT` has a SECOND,
- *  independent consumer — `mcp-tools/guidance-tools.ts:findProjectRoot()`,
- *  which uses a different marker (`.claude`) and can legitimately resolve a
- *  different directory (see the divergence explained at
- *  `memory-bridge.ts`'s `getProjectRoot()` doc comment). A generic "Project
- *  Root" label would claim there is one true answer when this commit is
- *  what creates a state where two resolvers can disagree — this check must
- *  not be the thing that misleads about that. */
-export async function checkProjectRoot() {
-    const name = 'Memory Project Root';
-    const { getProjectRootResolution } = await import('../memory/memory-bridge.js');
-    const { root, reason, ignoredBareMonomind, invalidAnchor } = getProjectRootResolution();
-    const reasonText = {
-        'explicit-anchor': 'MONOMIND_PROJECT_ROOT anchor',
-        git: 'nearest .git ancestor',
-        'monomind-at-start': 'starting directory carries .monomind',
-        'monomind-with-marker': '.monomind ancestor confirmed by a project manifest',
-        'start-fallback': 'no adoptable marker found — using the current directory',
-    };
-    // o-16 revision 1 (dev-lead Addition 1): the anchor's own disclosure must
-    // cover the ambiguous case it exists to resolve — a SET-but-INVALID
-    // anchor — not just the happy path, or a typo'd MONOMIND_PROJECT_ROOT
-    // silently does nothing and the user has no way to find out why. Appended
-    // regardless of which `reason` the walk ultimately fell back to.
-    const invalidAnchorNote = invalidAnchor
-        ? ` [MONOMIND_PROJECT_ROOT="${invalidAnchor.value}" ignored — ${invalidAnchor.problem}]`
-        : '';
-    if (reason === 'start-fallback' && ignoredBareMonomind) {
-        return {
-            name,
-            status: 'info',
-            message: `${root} (${reasonText[reason]}; ignored bare .monomind at ${ignoredBareMonomind} — add a project marker there, or set MONOMIND_PROJECT_ROOT, to adopt it)${invalidAnchorNote}`,
-        };
-    }
-    return { name, status: 'info', message: `${root} (${reasonText[reason]})${invalidAnchorNote}` };
-}
-export async function checkMemoryDatabase() {
-    const dbPaths = MEMORY_DB_CANDIDATE_PATHS;
-    for (const dbPath of dbPaths) {
-        if (existsSync(dbPath)) {
-            try {
-                const sizeMB = (statSync(dbPath).size / 1024 / 1024).toFixed(2);
-                return { name: 'Memory Database', status: 'pass', message: `${dbPath} (${sizeMB} MB)` };
-            }
-            catch {
-                return { name: 'Memory Database', status: 'warn', message: `${dbPath} (unable to stat)` };
-            }
-        }
-    }
-    return {
-        name: 'Memory Database',
-        status: 'warn',
-        message: 'Not initialized',
-        fix: 'monomind memory init',
-    };
-}
-/** Memory knowledge graph (cognee port): entities/relations/rules distilled
- * from sessions and org runs. Informational — an empty graph on a fresh
- * project is normal, so it never fails. */
-export async function checkMemoryKnowledgeGraph() {
-    const name = 'Memory Knowledge Graph';
-    try {
-        const kg = await import('../memory/memory-kg.js');
-        const bridge = await import('../memory/memory-bridge.js');
-        const project = await kg.kgStats();
-        // Org KG facts are namespaced per org (kg:nodes:org:<name> etc.), so an
-        // unscoped kgStats against the org store reads the now-unused flat
-        // namespaces and reports zero for every org. Sum each org's own scope
-        // instead — the org store holds all of them, keyed by scope.
-        const orgDb = join(process.cwd(), '.monomind', 'org-memory');
-        let org = null;
-        if (existsSync(orgDb)) {
-            const { orgKgScope } = await import('../orgrt/org-memory.js');
-            const { listOrgConfigFiles } = await import('./org.js');
-            const orgsDir = join(process.cwd(), '.monomind', 'orgs');
-            const orgNames = existsSync(orgsDir)
-                ? listOrgConfigFiles(orgsDir).map((f) => f.replace(/\.json$/, ''))
-                : [];
-            org = { nodes: 0, edges: 0, rules: 0 };
-            for (const orgName of orgNames) {
-                const s = await kg.kgStats({ dbPath: orgDb, scope: orgKgScope(orgName) });
-                org.nodes += s.nodes;
-                org.edges += s.edges;
-                org.rules += s.rules;
-            }
-        }
-        await bridge.shutdownBridge().catch(() => {
-            /* best effort */
-        });
-        const total = project.nodes + (org?.nodes ?? 0);
-        const fmt = (s) => `${s.nodes}n/${s.edges}e/${s.rules}r`;
-        if (total === 0) {
-            return {
-                name,
-                status: 'warn',
-                message: 'Empty — sessions/org runs have not distilled knowledge yet',
-                fix: 'org runs call org_learn automatically; sessions use memory_kg_ingest',
-            };
-        }
-        return {
-            name,
-            status: 'pass',
-            message: `project ${fmt(project)}${org ? ` · org ${fmt(org)}` : ''}`,
-        };
-    }
-    catch (err) {
-        return {
-            name,
-            status: 'warn',
-            message: `Check failed: ${err instanceof Error ? err.message : String(err)}`,
-        };
-    }
-}
-/** Count live (non-tombstoned) ingested documents under a brain root, without
- * creating the directory — `listDocuments` mkdir's its metadata dir, which
- * would materialize an empty global brain just by running doctor. */
-async function countBrainDocs(root) {
-    if (!existsSync(join(root, '.monomind', 'knowledge', 'doc-metadata.jsonl')))
-        return 0;
-    try {
-        const { listDocuments } = await import('../knowledge/document-pipeline.js');
-        return listDocuments(root).length;
-    }
-    catch {
-        return 0;
-    }
-}
-/** Second Brain: when there is any indexed knowledge — ingested docs in this
- * project, the personal global brain, or the monograph god-node chunk —
- * semantic search needs the local embedding model. Its absence is silent
- * (search degrades to keyword matching), so surface it here instead. */
-export async function checkSecondBrainModel() {
-    const name = 'Second Brain Model';
-    const { BRIDGE_EMBEDDING_MODEL, getGlobalBrainDir, getProjectRoot } = await import('../memory/memory-bridge.js');
-    const projectDocs = await countBrainDocs(getProjectRoot());
-    const globalDocs = await countBrainDocs(getGlobalBrainDir());
-    // chunks.jsonl holds the monograph god-node chunk — knowledge with no doc
-    // ingest. Unlike the document store it is written per-CWD by the session
-    // hook, not at the project root, so check both rather than assuming.
-    const chunksIn = (root) => existsSync(join(root, '.monomind', 'knowledge', 'chunks.jsonl'));
-    const hasChunks = chunksIn(getProjectRoot()) || chunksIn(process.cwd());
-    if (!projectDocs && !globalDocs && !hasChunks) {
-        return { name, status: 'pass', message: 'No knowledge indexed (nothing to check)' };
-    }
-    const indexed = [
-        projectDocs ? `${projectDocs} project doc${projectDocs === 1 ? '' : 's'}` : null,
-        globalDocs ? `${globalDocs} global doc${globalDocs === 1 ? '' : 's'}` : null,
-        !projectDocs && !globalDocs ? 'monograph god-nodes' : null,
-    ]
-        .filter(Boolean)
-        .join(' · ');
-    let entryPath = null;
-    try {
-        // exports map blocks package.json — resolve the entry file, then walk UP
-        // with path ops (no separator-sensitive regex: '/dist/'.replace broke on
-        // Windows paths, and any install layout without a dist segment).
-        // import.meta.resolve is missing on Node 20.0–20.5; fall back to CJS resolve.
-        const viaEsm = import.meta.resolve?.('@huggingface/transformers');
-        if (viaEsm)
-            entryPath = fileURLToPath(await viaEsm);
-    }
-    catch {
-        /* try CJS below */
-    }
-    if (!entryPath) {
-        try {
-            const { createRequire } = await import('node:module');
-            entryPath = createRequire(import.meta.url).resolve('@huggingface/transformers');
-        }
-        catch {
-            return {
-                name,
-                status: 'warn',
-                message: '@huggingface/transformers not installed — semantic search degraded to keyword matching',
-                fix: 'reinstall monomind (the model dependency is optional and may have failed to build)',
-            };
-        }
-    }
-    // Walk up from the entry file to the package root (the dir named 'transformers').
-    let pkgDir = dirname(entryPath);
-    while (pkgDir !== dirname(pkgDir) && !pkgDir.endsWith('transformers'))
-        pkgDir = dirname(pkgDir);
-    // The cached model is whichever one the bridge actually loads. This used to
-    // look for '.cache/Xenova', a model the bridge stopped using — so the check
-    // reported "not downloaded" with a fully provisioned cache sitting on disk.
-    const modelCache = join(pkgDir, '.cache', ...BRIDGE_EMBEDDING_MODEL.split('/'));
-    if (pkgDir.endsWith('transformers') && existsSync(modelCache)) {
-        return {
-            name,
-            status: 'pass',
-            message: `Local embedding model cached — semantic search active (${indexed})`,
-        };
-    }
-    return {
-        name,
-        status: 'warn',
-        message: 'Embedding model not downloaded yet — searches use keyword matching until it is',
-        // Query-time paths all pass local_files_only and never fetch; this is the
-        // one command that downloads the weights.
-        fix: 'run once while online: monomind doc eval --provision-model (downloads ~270MB locally, one time)',
-    };
-}
 export async function checkApiKeys() {
     const keys = ['ANTHROPIC_API_KEY', 'CLAUDE_API_KEY', 'OPENAI_API_KEY'];
     const found = keys.filter((k) => process.env[k]);
@@ -399,1070 +187,6 @@ async function probeConfiguredMcpServer(entry, count, configPath, timeoutMs) {
         fix: `Run it by hand to confirm: ${commandLine}  # a pinned scoped package needs: npx -y --package=@monoes/monomindcli@<version> monomind mcp start`,
     };
 }
-// Resolve an installed package's package.json through Node's real ESM
-// resolution algorithm instead of guessing relative node_modules layouts.
-// The old candidate-path approach assumed a nested install shape that never
-// matches how npm actually hoists dependencies (flat local installs, npx's
-// isolated cache dir, and global installs all put @monoes/* packages as
-// siblings, not nested under this package's dist/ output) — so it always
-// reported "not found" even when the package was present and importable.
-// import.meta.resolve() is used (rather than createRequire().resolve()())
-// because @monoes/monograph and @monoes/memory are ESM-only (no "require"
-// export condition), so a CJS require.resolve() fails outright even when the
-// package is installed. Their exports maps also don't expose a "./package.json"
-// subpath, so the entry file is resolved first and package.json is found by
-// walking up from it.
-function _findInstalledPackageJson(specifier) {
-    try {
-        const entryUrl = import.meta.resolve(specifier);
-        let dir = dirname(fileURLToPath(entryUrl));
-        for (;;) {
-            const candidate = join(dir, 'package.json');
-            if (existsSync(candidate) && statSync(candidate).size <= MAX_DOCTOR_PKG_BYTES) {
-                try {
-                    const pkg = JSON.parse(readFileSync(candidate, 'utf-8'));
-                    if (pkg.name === specifier)
-                        return { path: candidate, pkg };
-                }
-                catch {
-                    /* keep walking */
-                }
-            }
-            const parent = dirname(dir);
-            if (parent === dir)
-                return null;
-            dir = parent;
-        }
-    }
-    catch {
-        return null;
-    }
-}
-export async function checkMonograph() {
-    const found = _findInstalledPackageJson('@monoes/monograph');
-    if (found) {
-        return {
-            name: 'Monograph',
-            status: 'pass',
-            message: `v${found.pkg.version || '?'} available (knowledge graph engine)`,
-        };
-    }
-    return {
-        name: 'Monograph',
-        status: 'warn',
-        message: 'Package not found (knowledge graph disabled)',
-        fix: 'npm install -g monomind@latest',
-    };
-}
-function formatAge(ms) {
-    // Filesystem mtime can round to whole seconds and land a hair ahead of
-    // Date.now() for a file written moments ago — clamp so that never reads
-    // as a negative, nonsensical age.
-    const minutes = Math.floor(Math.max(0, ms) / 60000);
-    return minutes < 60 ? `${minutes}m` : `${Math.floor(minutes / 60)}h`;
-}
-/**
- * Best-effort "when was this package's own install last touched" probe,
- * used only to soften a build.log-based failure (see #244) — never to
- * harden one, so a wrong or missing answer here is always safe. Resolves
- * `pkgName` from `cwd` (works through pnpm's symlinked store too, since
- * `require.resolve` follows symlinks to the real file) and returns the
- * latest mtime among its package.json and any `build/`/`prebuilds/` binary
- * output, or null if the package can't be resolved at all — the caller
- * treats null as "no evidence either way," not as "confirmed still broken."
- */
-function findNativeModuleLastModifiedMs(pkgName, cwd) {
-    try {
-        const require = createRequire(join(cwd, 'noop.js'));
-        const entry = require.resolve(pkgName, { paths: [cwd] });
-        let pkgDir = dirname(entry);
-        for (let i = 0; i < 12 && !existsSync(join(pkgDir, 'package.json')); i++) {
-            const parent = dirname(pkgDir);
-            if (parent === pkgDir)
-                return null;
-            pkgDir = parent;
-        }
-        let latestMs = statSync(join(pkgDir, 'package.json')).mtimeMs;
-        for (const sub of ['build', 'prebuilds']) {
-            const subDir = join(pkgDir, sub);
-            if (!existsSync(subDir))
-                continue;
-            const stack = [subDir];
-            while (stack.length > 0) {
-                const current = stack.pop();
-                for (const entryName of readdirSync(current)) {
-                    const full = join(current, entryName);
-                    const st = statSync(full);
-                    if (st.isDirectory())
-                        stack.push(full);
-                    else if (st.mtimeMs > latestMs)
-                        latestMs = st.mtimeMs;
-                }
-            }
-        }
-        return latestMs;
-    }
-    catch {
-        return null;
-    }
-}
-export async function checkMonographFreshness() {
-    try {
-        const cwd = process.cwd();
-        const dbPath = join(cwd, '.monomind', 'monograph.db');
-        const lockPath = join(cwd, '.monomind', 'graph', 'build.lock');
-        const statsPath = join(cwd, '.monomind', 'graph', 'stats.json');
-        const logPath = join(cwd, '.monomind', 'graph', 'build.log');
-        const hasDb = existsSync(dbPath);
-        if (!hasDb && !existsSync(statsPath)) {
-            // No graph yet — but that's one of three very different situations: a
-            // build is genuinely still running, one already ran and crashed (e.g.
-            // executor.ts's initKnowledgeGraph or monograph-freshen.cjs's detached
-            // spawn hit a native-module ABI mismatch), or nothing was ever
-            // attempted. Both spawners share this same build.lock/build.log pair,
-            // so this one check covers either origin.
-            //
-            // Lock existence (not freshness) is the right signal here: both
-            // spawners write build.lock with their OWN pid (the short-lived parent
-            // that immediately exits after spawning a detached child — not the
-            // child actually doing the build, so checking that pid's liveness
-            // would be checking the wrong process) and unlink it in a `finally`
-            // that runs on both success and a thrown/rejected build — so it's only
-            // ever left behind while the child is still actually running, or in
-            // the rare case of a hard OS-level kill that bypassed the `finally`.
-            // A large monorepo's first index can legitimately run well past any
-            // fixed "freshness" window, so age must not turn a live build into a
-            // false failure report. Neither spawner passes buildAsync an
-            // onProgress callback, so a clean run writes nothing to build.log
-            // until it's done — there's no heartbeat to check the log against, so
-            // this is worded to cover both "still running" and "was killed
-            // without cleaning up" rather than asserting liveness that can't
-            // actually be confirmed from disk.
-            if (existsSync(lockPath)) {
-                const ageMs = (() => {
-                    try {
-                        return Date.now() - statSync(lockPath).mtimeMs;
-                    }
-                    catch {
-                        return 0;
-                    }
-                })();
-                return {
-                    name: 'Graph freshness',
-                    status: 'warn',
-                    message: `Monograph build in progress, or was interrupted — started ${formatAge(ageMs)} ago`,
-                };
-            }
-            if (existsSync(logPath)) {
-                let logTail = '';
-                try {
-                    const raw = readFileSync(logPath, 'utf8');
-                    // Bound the scan to the last MAX_BUILD_LOG_SCAN_BYTES, not the last
-                    // 4000 — that window was cutting the actual "Error:"/"Exception:"
-                    // text out of real Node uncaught-exception dumps. A native-module
-                    // load failure (e.g. `bindings` walking a dozen candidate .node
-                    // paths before giving up) prints its message and stack FIRST, then
-                    // a long list of tried paths — a single such dump easily runs
-                    // 7-8KB, so a 4000-char tail can land entirely inside the path
-                    // list and see no error keyword at all, even though the log is
-                    // nothing but a crash report. 64KB comfortably fits many realistic
-                    // crash dumps (including chained causes) while still bounding this
-                    // append-only, never-truncated file for a long-lived project that
-                    // has failed and retried many times.
-                    logTail =
-                        raw.length > MAX_DOCTOR_BUILD_LOG_SCAN_BYTES
-                            ? raw.slice(-MAX_DOCTOR_BUILD_LOG_SCAN_BYTES)
-                            : raw;
-                }
-                catch {
-                    /* unreadable log — treat as no evidence, fall through below */
-                }
-                // build.log only proves a build ran at some point — a *successful*
-                // build also writes into it before producing monograph.db, so its
-                // mere existence isn't evidence of failure (e.g. monograph.db was
-                // deleted afterward, leaving a clean run's log behind). Only treat
-                // this as a failure when the tail actually looks error-shaped;
-                // otherwise this isn't distinguishable from "never built" and
-                // should read that way rather than as an unsupported "fail".
-                const classified = logTail ? classifyNativeModuleError(logTail) : null;
-                const looksLikeFailure = classified !== null || /error|exception|traceback/i.test(logTail);
-                if (looksLikeFailure) {
-                    let logMtimeMs = 0;
-                    let logAgeStr = '';
-                    try {
-                        logMtimeMs = statSync(logPath).mtimeMs;
-                        logAgeStr = ` (${formatAge(Date.now() - logMtimeMs)} ago)`;
-                    }
-                    catch {
-                        /* ignore */
-                    }
-                    if (classified) {
-                        // build.log is append-only (see the comment above), so this
-                        // failure might be historical — already fixed by a `npm
-                        // rebuild` that ran after this log entry, just not yet
-                        // confirmed by a fresh `monograph build`. When the implicated
-                        // module's own files are demonstrably newer than the log entry,
-                        // that's concrete on-disk evidence it was touched since, so
-                        // soften to a warning instead of asserting it's still broken.
-                        // No evidence either way (can't resolve the module, or its
-                        // files are no newer) falls through to the unchanged 'fail'.
-                        const pkgName = extractNativeModulePackageName(logTail);
-                        const moduleMs = pkgName ? findNativeModuleLastModifiedMs(pkgName, cwd) : null;
-                        if (pkgName && moduleMs !== null && moduleMs > logMtimeMs) {
-                            return {
-                                name: 'Graph freshness',
-                                status: 'warn',
-                                message: `${classified}${logAgeStr} — but \`${pkgName}\` was modified more recently ` +
-                                    `(${formatAge(Date.now() - moduleMs)} ago) than this log entry, so it may ` +
-                                    'already be fixed. Run monograph build to confirm.',
-                                fix: 'mcp__monomind__monograph_build codeOnly:true',
-                            };
-                        }
-                    }
-                    return classified
-                        ? { name: 'Graph freshness', status: 'fail', message: `${classified}${logAgeStr}` }
-                        : {
-                            name: 'Graph freshness',
-                            status: 'fail',
-                            message: `Monograph build failed${logAgeStr} — see .monomind/graph/build.log for details`,
-                            fix: 'cat .monomind/graph/build.log',
-                        };
-                }
-            }
-            return {
-                name: 'Graph freshness',
-                status: 'warn',
-                message: 'No monograph graph built yet',
-                fix: 'mcp__monomind__monograph_build codeOnly:true',
-            };
-        }
-        // Deliberately NOT folding build.lock's mtime into this — a lock only
-        // means "a build started," not "the graph was built at this time," and
-        // counting it here would report a stale graph as freshly-built the
-        // moment a rebuild kicks off, before it's actually produced anything.
-        let buildMs = 0;
-        if (hasDb) {
-            try {
-                buildMs = Math.max(buildMs, statSync(dbPath).mtimeMs);
-            }
-            catch {
-                /* ignore */
-            }
-        }
-        try {
-            buildMs = Math.max(buildMs, statSync(statsPath).mtimeMs);
-        }
-        catch {
-            /* ignore */
-        }
-        if (buildMs === 0)
-            return {
-                name: 'Graph freshness',
-                status: 'warn',
-                message: 'Graph exists but build time unknown',
-            };
-        const buildIso = new Date(buildMs).toISOString();
-        let commitsBehind = 0;
-        try {
-            const out = execSync(`git rev-list --count --since='${buildIso}' HEAD 2>/dev/null`, {
-                encoding: 'utf8',
-                timeout: 2000,
-                cwd,
-            }).trim();
-            commitsBehind = parseInt(out, 10) || 0;
-        }
-        catch {
-            /* git unavailable */
-        }
-        const ageStr = `${formatAge(Date.now() - buildMs)} ago`;
-        if (commitsBehind === 0)
-            return {
-                name: 'Graph freshness',
-                status: 'pass',
-                message: `FRESH — built ${ageStr}, 0 commits behind`,
-            };
-        if (commitsBehind <= 5)
-            return {
-                name: 'Graph freshness',
-                status: 'warn',
-                message: `${commitsBehind} commit(s) behind — built ${ageStr}`,
-                fix: 'mcp__monomind__monograph_build codeOnly:true',
-            };
-        return {
-            name: 'Graph freshness',
-            status: 'fail',
-            message: `STALE — ${commitsBehind} commits behind (built ${ageStr})`,
-            fix: 'mcp__monomind__monograph_build codeOnly:true',
-        };
-    }
-    catch {
-        return { name: 'Graph freshness', status: 'warn', message: 'Could not check graph freshness' };
-    }
-}
-export async function checkMonoesMemory() {
-    // See _findInstalledPackageJson() above checkMonograph(): resolve through
-    // Node's ESM module resolution instead of guessing a node_modules layout
-    // that doesn't match how npm actually hoists dependencies.
-    const found = _findInstalledPackageJson('@monoes/memory');
-    if (found) {
-        return {
-            name: 'Vector Memory',
-            status: 'pass',
-            message: `@monoes/memory v${found.pkg.version || '?'} (HNSW search enabled)`,
-        };
-    }
-    return {
-        name: 'Vector Memory',
-        status: 'warn',
-        message: '@monoes/memory not installed (vector search disabled)',
-        fix: 'npm install @monoes/memory',
-    };
-}
-function _resolveBundledHelper(relativePath) {
-    try {
-        const thisFile = fileURLToPath(import.meta.url);
-        let dir = dirname(thisFile);
-        for (;;) {
-            const candidate = join(dir, 'package.json');
-            if (existsSync(candidate) && statSync(candidate).size <= MAX_DOCTOR_PKG_BYTES) {
-                try {
-                    const pkg = JSON.parse(readFileSync(candidate, 'utf8'));
-                    if (pkg.name === '@monomind/cli' ||
-                        pkg.name === 'monomind' ||
-                        pkg.name === '@monoes/monomindcli') {
-                        const helperPath = join(dir, relativePath);
-                        return existsSync(helperPath) ? helperPath : null;
-                    }
-                }
-                catch {
-                    /* keep walking */
-                }
-            }
-            const parent = dirname(dir);
-            if (parent === dir)
-                return null;
-            dir = parent;
-        }
-    }
-    catch {
-        return null;
-    }
-}
-// Top-level critical helpers, plus every file bundled under handlers/ and utils/
-// (capture-handler.cjs, gates-handler.cjs, route-handler.cjs, session-handler.cjs,
-// etc. — where most actual hook-behavior fixes live). Subdir membership is
-// discovered from the bundled package itself, not hardcoded, so a helper added
-// upstream is picked up automatically instead of silently never syncing.
-function _allTrackedHelperNames() {
-    const names = [...DOCTOR_TRACKED_HELPERS];
-    for (const sub of ['handlers', 'utils']) {
-        const bundledSubDir = _resolveBundledHelper(join('.claude', 'helpers', sub));
-        if (!bundledSubDir)
-            continue;
-        try {
-            for (const f of readdirSync(bundledSubDir)) {
-                if (f.startsWith('._'))
-                    continue;
-                if (statSync(join(bundledSubDir, f)).isDirectory())
-                    continue;
-                names.push(join(sub, f));
-            }
-        }
-        catch {
-            /* skip */
-        }
-    }
-    return names;
-}
-// Top-level helpers the bundle ships. Their mere ABSENCE is a defect no
-// matter which one it is — handlers/ scripts require() some of them at module
-// load, and a missing one fails the hook closed (issue #225: doctor reported
-// "helpers match bundled version" while audit-log-writer.cjs was absent and
-// every PreToolUse hook was crashing). Existence is checked for all of them;
-// content is still only hash-compared for _allTrackedHelperNames(), because
-// the rest are user-editable scaffolds (memory.cjs, session.cjs) whose local
-// edits are legitimate and must not be reported as staleness.
-function _bundledTopLevelHelperNames() {
-    const bundledDir = _resolveBundledHelper(join('.claude', 'helpers'));
-    if (!bundledDir)
-        return [];
-    try {
-        return readdirSync(bundledDir, { withFileTypes: true })
-            .filter((e) => e.isFile() && !e.name.startsWith('._'))
-            .map((e) => e.name);
-    }
-    catch {
-        return [];
-    }
-}
-// The installed helper copies doctor compares against the bundle: the Claude
-// Code tree, plus the copy init writes to .gemini/helpers (Antigravity's status
-// bar runs .gemini/helpers/statusline.cjs), which is only checked when present.
-const CLAUDE_HELPERS = join('.claude', 'helpers');
-const GEMINI_HELPERS = join('.gemini', 'helpers');
-async function _detectStaleHelpers(helpersDir = CLAUDE_HELPERS) {
-    const stale = [];
-    const missing = [];
-    // Helpers this product shipped under a name it has since renamed away from
-    // (e.g. graphify-freshen.cjs -> monograph-freshen.cjs). Reported separately
-    // from `stale`/`missing`: unlike those, doctor --fix does not delete these
-    // on its own — settings.json may still have a hook command pointing at one,
-    // and only `init --force` (which also refreshes settings.json in the same
-    // pass) can safely remove it. See writeHelpers/writeSettings.
-    const orphaned = OBSOLETE_HELPER_NAMES.filter((name) => existsSync(join(process.cwd(), '.claude', 'helpers', name)));
-    const crypto = await import('node:crypto');
-    const hashChecked = new Set(_allTrackedHelperNames());
-    for (const name of new Set([..._allTrackedHelperNames(), ..._bundledTopLevelHelperNames()])) {
-        const bundled = _resolveBundledHelper(join('.claude', 'helpers', name));
-        // Oversized-bundled is reported the same as missing-bundled: doctor can't
-        // verify freshness either way, and silently excluding it from both `stale`
-        // and `missing` would let checkHelpersFresh() report "pass" without ever
-        // having actually compared this file.
-        if (!bundled || statSync(bundled).size > MAX_DOCTOR_HELPER_BYTES) {
-            missing.push(name);
-            continue;
-        }
-        const local = join(process.cwd(), helpersDir, name);
-        if (!existsSync(local)) {
-            stale.push(name);
-            continue;
-        } // bundled has it, project doesn't — needs creating
-        if (!hashChecked.has(name))
-            continue; // existence-only (see above)
-        if (statSync(local).size > MAX_DOCTOR_HELPER_BYTES)
-            continue;
-        try {
-            const hashLocal = crypto.createHash('sha256').update(readFileSync(local)).digest('hex');
-            const hashBundled = crypto.createHash('sha256').update(readFileSync(bundled)).digest('hex');
-            if (hashLocal !== hashBundled)
-                stale.push(name);
-        }
-        catch {
-            /* skip */
-        }
-    }
-    return { stale, missing, orphaned };
-}
-/** Stale helpers in the Gemini copy, as `.gemini/helpers/<name>`; none if not installed. */
-async function _detectStaleGeminiHelpers() {
-    if (!existsSync(join(process.cwd(), GEMINI_HELPERS)))
-        return [];
-    const { stale } = await _detectStaleHelpers(GEMINI_HELPERS);
-    return stale.map((name) => `.gemini/helpers/${name.split(sep).join('/')}`);
-}
-export async function fixStaleHelpers() {
-    const { stale } = await _detectStaleHelpers();
-    const targets = stale.map((name) => ({ name, local: join(process.cwd(), CLAUDE_HELPERS, name) }));
-    if (existsSync(join(process.cwd(), GEMINI_HELPERS))) {
-        for (const name of (await _detectStaleHelpers(GEMINI_HELPERS)).stale) {
-            targets.push({ name, local: join(process.cwd(), GEMINI_HELPERS, name) });
-        }
-    }
-    let fixed = 0;
-    for (const { name, local } of targets) {
-        // A helper `monomind init` kept because the user edited it is theirs.
-        if (isKeptUserEdit(process.cwd(), local))
-            continue;
-        const bundled = _resolveBundledHelper(join('.claude', 'helpers', name));
-        if (bundled) {
-            try {
-                mkdirSync(dirname(local), { recursive: true });
-                copyFileSync(bundled, local);
-                fixed++;
-            }
-            catch (e) {
-                if (process.env.DEBUG || process.env.MONOMIND_DEBUG)
-                    console.error(`[fixStaleHelpers] failed to copy ${name}:`, e);
-            }
-        }
-    }
-    return fixed > 0;
-}
-export async function checkHelpersFresh() {
-    try {
-        const { stale: claudeStale, missing, orphaned } = await _detectStaleHelpers();
-        const stale = [...claudeStale, ...(await _detectStaleGeminiHelpers())];
-        if (orphaned.length > 0) {
-            return {
-                name: 'Helper Files',
-                status: 'warn',
-                message: `Found ${orphaned.length} hook(s) from before a rename, still on disk: ${orphaned.join(', ')}. Run \`monomind init --force\` to update your hooks and rebuild the Monograph graph.`,
-                fix: 'monomind init --force',
-                // `--fix` only copies stale helpers; it never removes these.
-                fixSafety: 'manual',
-            };
-        }
-        if (stale.length === 0 && missing.length === 0) {
-            return {
-                name: 'Helper Files',
-                status: 'pass',
-                message: 'Project helpers match bundled version',
-            };
-        }
-        if (stale.length > 0) {
-            return {
-                name: 'Helper Files',
-                status: 'warn',
-                message: `${stale.length} stale helper(s): ${stale.join(', ')}`,
-                fix: 'monomind init upgrade',
-                fixSafety: 'auto',
-            };
-        }
-        return {
-            name: 'Helper Files',
-            status: 'warn',
-            message: `Could not locate bundled copies of: ${missing.join(', ')}`,
-            fix: 'Reinstall monomind or run `monomind init upgrade`',
-            fixSafety: 'manual',
-        };
-    }
-    catch (e) {
-        return {
-            name: 'Helper Files',
-            status: 'warn',
-            message: `check failed: ${e instanceof Error ? e.message : 'unknown'}`,
-        };
-    }
-}
-function fmtPct(v) {
-    return v === null ? 'n/a' : `${Math.round(v * 100)}%`;
-}
-async function routingAccuracyLine() {
-    try {
-        const { computeRoutingAccuracy, computeAdherence } = await import('../monovector/route-outcomes.js');
-        const baseDir = join(process.cwd(), '.monomind');
-        const acc = await computeRoutingAccuracy(baseDir, 100);
-        const adh = await computeAdherence(baseDir);
-        const adhStr = ` | adherence ${fmtPct(adh.adherence)} (n=${adh.sample})`;
-        if (acc.accuracy === null)
-            return `routing accuracy (last 100): no outcome data yet${adhStr}`;
-        const trend = acc.recentVsPrior === null
-            ? ''
-            : ` trend ${acc.recentVsPrior >= 0 ? '+' : ''}${Math.round(acc.recentVsPrior * 100)}%`;
-        return `routing accuracy (last ${acc.window}): ${fmtPct(acc.accuracy)} [native ${fmtPct(acc.byMode.native)} / js ${fmtPct(acc.byMode.js)}]${trend}${adhStr}`;
-    }
-    catch (e) {
-        if (process.env.DEBUG || process.env.MONOMIND_DEBUG)
-            console.error('[routingAccuracyLine] compute failed:', e);
-        return 'routing accuracy (last 100): no outcome data yet';
-    }
-}
-/** Fallback when route-outcomes.jsonl has no data: summarize .monomind/routing-feedback.jsonl honestly. */
-function routingFeedbackFallback() {
-    try {
-        const p = join(process.cwd(), '.monomind', 'routing-feedback.jsonl');
-        if (!existsSync(p) || statSync(p).size > 512 * 1024)
-            return null;
-        const records = readFileSync(p, 'utf-8')
-            .trim()
-            .split('\n')
-            .filter(Boolean)
-            .map((l) => {
-            try {
-                return JSON.parse(l);
-            }
-            catch {
-                return null;
-            }
-        })
-            .filter((r) => r !== null);
-        if (records.length === 0)
-            return null;
-        const sessions = new Set(records.map((r) => r.sessionId).filter(Boolean));
-        const byAgent = new Map();
-        for (const r of records) {
-            const a = typeof r.suggestedAgent === 'string' ? r.suggestedAgent : 'unknown';
-            byAgent.set(a, (byAgent.get(a) ?? 0) + 1);
-        }
-        const top = [...byAgent.entries()]
-            .sort((a, b) => b[1] - a[1])
-            .slice(0, 3)
-            .map(([a, n]) => `${a}=${n}`)
-            .join(', ');
-        const flags = records
-            .map((r) => r.intelligenceFeedback)
-            .filter((v) => typeof v === 'boolean');
-        const trueCount = flags.filter(Boolean).length;
-        const base = `routing feedback (fallback): ${records.length} decisions across ${sessions.size} sessions; top agents: ${top}`;
-        if (flags.length > 0 && trueCount === flags.length) {
-            return {
-                message: `${base}; success flag is degenerate (100% true — sessionSuccess heuristic never records failure)`,
-                degenerate: true,
-            };
-        }
-        if (flags.length === 0)
-            return { message: `${base}; no evidence-based success flags yet`, degenerate: true };
-        return {
-            message: `${base}; success rate ${Math.round((trueCount / flags.length) * 100)}% (n=${flags.length})`,
-            degenerate: false,
-        };
-    }
-    catch (e) {
-        if (process.env.DEBUG || process.env.MONOMIND_DEBUG)
-            console.error('[routingFeedbackFallback] parse failed:', e);
-        return null;
-    }
-}
-export async function checkMonoesIntegration() {
-    try {
-        const line = await routingAccuracyLine();
-        if (line.startsWith('routing accuracy (last 100): no outcome data yet')) {
-            const fb = routingFeedbackFallback();
-            if (fb)
-                return {
-                    name: 'Routing Learning',
-                    status: fb.degenerate ? 'warn' : 'pass',
-                    message: fb.message,
-                };
-        }
-        return { name: 'Routing Learning', status: 'pass', message: line };
-    }
-    catch (err) {
-        return {
-            name: 'Routing Learning',
-            status: 'warn',
-            message: `Could not compute routing accuracy: ${err instanceof Error ? err.message : String(err)}`,
-        };
-    }
-}
-// i-052: derived from MONOMIND_NEVER_COMMIT (write-runtime-config.ts), the
-// single source of truth for files that must never be committed — this was
-// the THIRD independently-maintained list that omitted `dashboard-token`,
-// and it is the one written specifically to catch gitignore gaps. Consuming
-// the shared list here means `monomind doctor --fix` (fixGitignoreCoverage
-// below) appends any missing entry for existing users for free.
-const REQUIRED_GITIGNORE_PATTERNS = [
-    { pattern: '.monomind/sessions/', reason: 'session files contain cwd and machine paths' },
-    { pattern: '.monomind/data/', reason: 'intelligence data with edit file paths' },
-    { pattern: '.monomind/metrics/', reason: 'metrics with file path references' },
-    { pattern: '.monomind/knowledge/', reason: 'knowledge chunks with local file content' },
-    { pattern: '.monomind/*.json', reason: 'root-level runtime JSON (control, registry, routing)' },
-    { pattern: '.monomind/*.jsonl', reason: 'root-level event logs (decisions, routing-feedback)' },
-    { pattern: '**/.monomind/sessions/', reason: 'nested session files in sub-packages' },
-    { pattern: '**/.monomind/*.json', reason: 'nested runtime JSON in sub-packages' },
-    { pattern: 'data/sessions/', reason: 'session files with machine paths' },
-    { pattern: 'data/mastermind-*.json', reason: 'mastermind session data' },
-    { pattern: 'data/mastermind-*.jsonl', reason: 'mastermind event logs' },
-    { pattern: '**/.claude-flow/', reason: 'claude-flow runtime data with paths' },
-    { pattern: '.monomind/monoswarm/', reason: 'monoswarm state files' },
-    ...MONOMIND_NEVER_COMMIT.map(({ file, reason }) => ({ pattern: `.monomind/${file}`, reason })),
-];
-/** Strip the parts that don't change what a pattern matches, so `**​/.monomind/`,
- *  `.monomind/` and `.monomind` all compare equal. A gitignore pattern with no
- *  leading slash already matches at every depth, so `**​/` is redundant. */
-function normalizeGitignorePattern(p) {
-    return p
-        .replace(/^\/+/, '')
-        .replace(/^\*\*\//, '')
-        .replace(/\/+$/, '');
-}
-/** True when ignoring `line` already protects everything `required` covers.
- *  Beyond exact matches this understands directory containment: a repo with a
- *  blanket `.monomind/` is fully covered for `.monomind/sessions/`,
- *  `.monomind/*.json` and friends, and should not be nagged to add each one. */
-function gitignoreLineCovers(line, required) {
-    const l = normalizeGitignorePattern(line);
-    const r = normalizeGitignorePattern(required);
-    if (!l)
-        return false;
-    if (l === r)
-        return true;
-    // A bare directory entry covers every path beneath it, but only when the
-    // entry itself is literal — `.monomind/*.json` must not be treated as an
-    // ancestor of `.monomind/sessions`.
-    return !l.includes('*') && r.startsWith(`${l}/`);
-}
-export async function checkGitignoreCoverage(root = process.cwd()) {
-    const gitignorePath = join(root, '.gitignore');
-    if (!existsSync(gitignorePath)) {
-        // The old hint was `echo ".monomind/\n**/.monomind/" >> .gitignore`, which
-        // writes a literal backslash-n (sh/bash echo does not interpret escapes
-        // without -e) — one junk line matching nothing. `--fix` now writes the file
-        // directly, so point at that rather than at a command to copy-paste.
-        return {
-            name: 'Gitignore Coverage',
-            status: 'warn',
-            message: 'No .gitignore found — all monomind runtime paths are unprotected',
-            fix: 'monomind doctor --fix   (creates .gitignore covering .monomind/ and secrets)',
-        };
-    }
-    if (statSync(gitignorePath).size > MAX_DOCTOR_GITIGNORE_BYTES) {
-        return { name: 'Gitignore Coverage', status: 'warn', message: '.gitignore too large to parse' };
-    }
-    const lines = readFileSync(gitignorePath, 'utf-8')
-        .split('\n')
-        .map((l) => l.trim())
-        .filter((l) => l && !l.startsWith('#'));
-    const missing = REQUIRED_GITIGNORE_PATTERNS.filter(({ pattern }) => !lines.some((l) => gitignoreLineCovers(l, pattern)));
-    if (missing.length === 0)
-        return {
-            name: 'Gitignore Coverage',
-            status: 'pass',
-            message: 'All monomind runtime paths are gitignored',
-        };
-    const missingList = missing.map((m) => m.pattern).join(', ');
-    return {
-        name: 'Gitignore Coverage',
-        status: 'warn',
-        message: `${missing.length} runtime path(s) not in .gitignore: ${missingList}`,
-        fix: 'monomind doctor --fix   (appends the missing entries)',
-    };
-}
-/** Patterns written by `doctor --fix` when there is no .gitignore at all.
- *  Covers monomind runtime state plus the standard secrets files, since a repo
- *  with no .gitignore has nothing protecting those either. The runtime paths
- *  are the specific ones the check requires, never a blanket `.monomind/`:
- *  git cannot re-include a file below an ignored directory, so a blanket line
- *  disables init's own `.monomind/.gitignore` allow-list (config.yaml,
- *  CAPABILITIES.md, org definitions). */
-const GITIGNORE_FIX_PATTERNS = [
-    '# monomind runtime state',
-    ...REQUIRED_GITIGNORE_PATTERNS.map(({ pattern }) => pattern),
-    '',
-    '# secrets / local env',
-    '.env',
-    '.env.*',
-    '!.env.example',
-    '*.pem',
-    '*.key',
-    '',
-    '# dependencies / build output',
-    'node_modules/',
-    'dist/',
-];
-/** Creates or appends the missing gitignore entries. Returns true if it wrote.
- *  Append-only and idempotent: never rewrites lines the user already has. */
-export async function fixGitignoreCoverage(root = process.cwd()) {
-    const gitignorePath = join(root, '.gitignore');
-    try {
-        if (!existsSync(gitignorePath)) {
-            writeFileSync(gitignorePath, `${GITIGNORE_FIX_PATTERNS.join('\n')}\n`, 'utf-8');
-            return true;
-        }
-        if (statSync(gitignorePath).size > MAX_DOCTOR_GITIGNORE_BYTES)
-            return false;
-        const existing = readFileSync(gitignorePath, 'utf-8');
-        const lines = existing
-            .split('\n')
-            .map((l) => l.trim())
-            .filter((l) => l && !l.startsWith('#'));
-        const missing = REQUIRED_GITIGNORE_PATTERNS.map((m) => m.pattern).filter((pattern) => !lines.some((l) => gitignoreLineCovers(l, pattern)));
-        if (missing.length === 0)
-            return false;
-        const prefix = existing.endsWith('\n') || existing === '' ? '' : '\n';
-        appendFileSync(gitignorePath, `${prefix}\n# monomind runtime state\n${missing.join('\n')}\n`, 'utf-8');
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export async function checkAgentRegistry(opts = {}) {
-    try {
-        const { buildUnifiedRegistry, computeAgentRoots } = await import('../agents/registry-builder.js');
-        const { findProjectRoot, registryPath } = await import('../agents/registry-freshness.js');
-        const project = findProjectRoot(process.cwd());
-        const cwd = project ?? process.cwd();
-        const roots = computeAgentRoots(cwd);
-        const write = project !== null && !opts.readOnly;
-        if (write)
-            mkdirSync(join(cwd, '.monomind'), { recursive: true });
-        // Rebuilds fresh in-memory (and, inside a project, refreshes
-        // .monomind/registry.json on disk, never replacing a non-empty registry
-        // with an empty one) rather than reading a file a separate startup task
-        // may also be writing. Outside a project, and in read-only mode (issue
-        // #335), nothing is written.
-        const registry = buildUnifiedRegistry(roots, write ? registryPath(cwd) : undefined, {
-            base: cwd,
-        });
-        const entries = registry.agents;
-        // An extra root (MONOMIND_EXTRA_AGENT_PATHS or a sibling agency-agents dir)
-        // wins slug conflicts over .claude/agents — say so instead of hiding it.
-        const extras = roots.filter((r) => r.origin === 'extra').map((r) => r.dir);
-        // User agents (~/.claude/agents) are indexed too; project agents win.
-        const shadowed = registry.shadowed.length;
-        const extraNote = `; ${registry.counts.user} from ~/.claude/agents` +
-            (shadowed ? ` (${shadowed} shadowed by a project agent)` : '') +
-            (extras.length ? `; extra agent roots (win on conflict): ${extras.join(', ')}` : '');
-        if (entries.length === 0) {
-            return {
-                name: 'Agent Registry',
-                status: 'warn',
-                message: `No agents found under .claude/agents or ~/.claude/agents${extraNote}`,
-                fix: 'monomind init  (installs agent definitions)',
-            };
-        }
-        let missingSlug = 0, missingName = 0, missingDescription = 0, missingWhenToUse = 0;
-        for (const agent of entries) {
-            if (!agent.slug)
-                missingSlug++;
-            if (!agent.name)
-                missingName++;
-            if (!agent.description)
-                missingDescription++;
-            // The pick index leads with when_to_use; older installs lack it.
-            if (!agent.whenToUse)
-                missingWhenToUse++;
-        }
-        const dupes = registry.duplicates;
-        const total = missingSlug + missingName + missingDescription + missingWhenToUse + dupes.length;
-        if (total === 0) {
-            return {
-                name: 'Agent Registry',
-                status: 'pass',
-                message: `${entries.length} agent(s), all metadata complete${extraNote}`,
-            };
-        }
-        const parts = [
-            missingSlug > 0 ? `${missingSlug} missing slug` : null,
-            missingName > 0 ? `${missingName} missing name` : null,
-            missingDescription > 0 ? `${missingDescription} missing description` : null,
-            missingWhenToUse > 0 ? `${missingWhenToUse} missing when_to_use` : null,
-            dupes.length > 0
-                ? `duplicate slug ${dupes.map((d) => `"${d.slug}" (kept ${d.kept}, dropped ${d.dropped.join(', ')})`).join('; ')}`
-                : null,
-        ]
-            .filter(Boolean)
-            .join(', ');
-        return {
-            name: 'Agent Registry',
-            status: 'warn',
-            message: `${total} metadata issue(s) across ${entries.length} agent(s): ${parts}${extraNote}`,
-            fix: dupes.length
-                ? 'Give each duplicated agent a unique `slug:` in its frontmatter'
-                : missingWhenToUse > 0
-                    ? 'monomind init upgrade  (refreshes unedited bundled agents; add `when_to_use:` to your own agents in .claude/agents/*.md)'
-                    : 'Add the missing field(s) to frontmatter in .claude/agents/*.md',
-        };
-    }
-    catch {
-        return {
-            name: 'Agent Registry',
-            status: 'warn',
-            message: 'Could not build/parse agent registry',
-        };
-    }
-}
-export async function checkGuidanceGates() {
-    const settingsPath = join(process.cwd(), '.claude', 'settings.json');
-    const gatesHandlerPath = join(process.cwd(), '.claude', 'helpers', 'handlers', 'gates-handler.cjs');
-    if (!existsSync(gatesHandlerPath)) {
-        return {
-            name: 'Guidance Gates',
-            status: 'warn',
-            message: 'gates-handler.cjs not found — enforcement gates not installed',
-            fix: 'monomind init  (then monomind guidance setup)',
-        };
-    }
-    if (!existsSync(settingsPath)) {
-        return {
-            name: 'Guidance Gates',
-            status: 'warn',
-            message: 'gates-handler.cjs present but .claude/settings.json missing',
-            fix: 'monomind guidance setup',
-        };
-    }
-    try {
-        if (statSync(settingsPath).size > MAX_DOCTOR_CONFIG_BYTES) {
-            return {
-                name: 'Guidance Gates',
-                status: 'warn',
-                message: 'settings.json too large to parse',
-            };
-        }
-        const settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));
-        const preToolUse = settings?.hooks?.PreToolUse ?? [];
-        // Match on capability, not on an exact matcher string. The matcher is a
-        // regex alternation that legitimately changes as tools are added — it
-        // gained `|NotebookEdit` when that tool turned out to bypass the secret
-        // gate — and an `=== 'Write|Edit|MultiEdit'` test reported the gate as
-        // INACTIVE the moment it did, telling users their secrets gate was off
-        // while it was demonstrably blocking secrets, and sending them to
-        // `guidance setup`, which would then add a duplicate entry.
-        const hasPreWrite = preToolUse.some((e) => /\bWrite\b/.test(e.matcher ?? '') && e.hooks.some((h) => h.command?.includes('pre-write')));
-        const hasPreBash = preToolUse.some((e) => e.matcher === 'Bash' && e.hooks.some((h) => h.command?.includes('pre-bash')));
-        if (!hasPreWrite && !hasPreBash)
-            return {
-                name: 'Guidance Gates',
-                status: 'warn',
-                message: 'gates-handler.cjs present but no gates registered',
-                fix: 'monomind guidance setup',
-            };
-        if (!hasPreWrite)
-            return {
-                name: 'Guidance Gates',
-                status: 'warn',
-                message: 'pre-write hook not registered — secrets gate inactive',
-                fix: 'monomind guidance setup',
-            };
-        if (!hasPreBash)
-            return {
-                name: 'Guidance Gates',
-                status: 'warn',
-                message: 'pre-bash hook not registered — destructive-ops gate inactive',
-                fix: 'monomind guidance setup',
-            };
-        return {
-            name: 'Guidance Gates',
-            status: 'pass',
-            message: 'destructive-ops (pre-bash) + secrets (pre-write) gates active',
-        };
-    }
-    catch {
-        return {
-            name: 'Guidance Gates',
-            status: 'warn',
-            message: 'Could not parse .claude/settings.json',
-            fix: 'monomind guidance setup --force',
-        };
-    }
-}
-// Workers refresh at session start when output is >6h old — allow a grace
-// window beyond that before flagging staleness.
-const METRICS_FRESHNESS_MS = 12 * 60 * 60 * 1000; // 12 hours
-const MAX_DOCTOR_METRICS_BYTES = 5 * 1024 * 1024;
-function readMetricsJSON(name) {
-    try {
-        const p = join(process.cwd(), '.monomind', 'metrics', name);
-        if (!existsSync(p) || statSync(p).size > MAX_DOCTOR_METRICS_BYTES)
-            return null;
-        return JSON.parse(readFileSync(p, 'utf-8'));
-    }
-    catch (e) {
-        if (process.env.DEBUG || process.env.MONOMIND_DEBUG)
-            console.error(`[readMetricsJSON] failed to read ${name}:`, e);
-        return null;
-    }
-}
-/**
- * Worker metrics freshness — reports the age of the @monoes/hooks worker
- * output files (written at session start with a 6h staleness gate, or on
- * demand via `monomind hooks worker run <name>`), so missing/stale worker
- * output is visible without digging through .monomind/metrics.
- */
-export async function checkMetricsFreshness() {
-    const metricsDir = join(process.cwd(), '.monomind', 'metrics');
-    const knownOutputs = [
-        'codebase-map.json',
-        'security-audit.json',
-        'performance.json',
-        'consolidation.json',
-        'ddd-progress.json',
-    ];
-    if (!existsSync(metricsDir)) {
-        return {
-            name: 'Worker Metrics',
-            status: 'warn',
-            message: 'No .monomind/metrics — workers have not run yet (they run at session start)',
-            fix: 'monomind hooks worker run map',
-        };
-    }
-    const now = Date.now();
-    const fresh = [];
-    const stale = [];
-    for (const name of knownOutputs) {
-        const p = join(metricsDir, name);
-        if (!existsSync(p))
-            continue;
-        try {
-            const ageMs = now - statSync(p).mtimeMs;
-            if (ageMs <= METRICS_FRESHNESS_MS)
-                fresh.push(name);
-            else
-                stale.push(name);
-        }
-        catch {
-            /* skip unreadable */
-        }
-    }
-    if (fresh.length === 0 && stale.length === 0) {
-        return {
-            name: 'Worker Metrics',
-            status: 'warn',
-            message: 'No worker output files found yet (they run at session start)',
-            fix: 'monomind hooks worker run map',
-        };
-    }
-    if (stale.length === 0) {
-        return {
-            name: 'Worker Metrics',
-            status: 'pass',
-            message: `${fresh.length} metrics file(s) fresh (<12h)`,
-        };
-    }
-    return {
-        name: 'Worker Metrics',
-        status: 'warn',
-        message: `${stale.length} stale (>12h): ${stale.join(', ')}${fresh.length > 0 ? ` — ${fresh.length} fresh` : ''}`,
-        fix: 'monomind hooks worker run <name>  # map, audit, consolidate, ddd',
-    };
-}
-/**
- * Surfaces critical findings from the security-audit worker output.
- */
-export async function checkSecurityAuditFindings() {
-    const audit = readMetricsJSON('security-audit.json');
-    if (!audit) {
-        return {
-            name: 'Security Audit',
-            status: 'warn',
-            message: 'No security-audit.json yet',
-            fix: 'monomind hooks worker run audit',
-        };
-    }
-    const riskLevel = (audit.riskLevel || 'low').toLowerCase();
-    const recommendations = audit.recommendations || [];
-    const priorityTargets = audit.priorityScanTargets || [];
-    const criticalCount = recommendations.length +
-        (riskLevel === 'high' || riskLevel === 'critical' ? priorityTargets.length : 0);
-    if (riskLevel === 'critical' || riskLevel === 'high') {
-        return {
-            name: 'Security Audit',
-            status: 'fail',
-            message: `risk=${riskLevel}, ${criticalCount} critical finding(s) — ${priorityTargets.length} priority scan target(s)`,
-            fix: 'Review .monomind/metrics/security-audit.json priorityScanTargets and recommendations',
-        };
-    }
-    if (recommendations.length > 0) {
-        return {
-            name: 'Security Audit',
-            status: 'warn',
-            message: `risk=${riskLevel}, ${recommendations.length} recommendation(s)`,
-        };
-    }
-    return { name: 'Security Audit', status: 'pass', message: `risk=${riskLevel}, no open findings` };
-}
-/**
- * AutoMem proficiency check — reports memory learning health
- */
-export async function checkMemoryProficiency() {
-    try {
-        const intelligenceMod = await import('../memory/intelligence.js');
-        const stats = intelligenceMod.getMemoryProficiencyStats();
-        const bankStats = intelligenceMod.getIntelligenceStats();
-        if (stats.totalDecisions === 0) {
-            return {
-                name: 'Memory Proficiency',
-                status: 'pass',
-                message: 'AutoMem active — no decisions recorded yet (builds up over sessions)',
-            };
-        }
-        const successPct = Math.round(stats.successRate * 100);
-        const hitPct = Math.round(stats.patternHitRate * 100);
-        const msg = `${stats.totalDecisions} decisions, ${successPct}% success, ${stats.proficiencyPatterns} patterns, ${hitPct}% hit rate (bank: ${bankStats.patternsLearned} total)`;
-        if (stats.successRate < 0.5) {
-            return { name: 'Memory Proficiency', status: 'warn', message: msg };
-        }
-        return { name: 'Memory Proficiency', status: 'pass', message: msg };
-    }
-    catch {
-        return {
-            name: 'Memory Proficiency',
-            status: 'warn',
-            message: 'Could not load intelligence module',
-        };
-    }
-}
 /** AppleDouble sidecars (`._name`) under `.claude/`.
  *
  * macOS writes these whenever a file carrying extended attributes is copied to
@@ -1543,49 +267,4 @@ export function fixAppleDoubleSidecars(cwd) {
     }
     return removed;
 }
-/** Second Brain document ingestion: whether the "documents" capability is
- * active for this project. Read directly from capabilities.json rather than
- * re-running the directory scan — doctor should report on what's actually
- * activated, not re-detect. */
-function isDocumentsCapabilityActive(cwd) {
-    try {
-        const capsPath = join(cwd, '.monomind', 'capabilities.json');
-        if (!existsSync(capsPath))
-            return false;
-        const parsed = JSON.parse(readFileSync(capsPath, 'utf8'));
-        return Array.isArray(parsed.active) && parsed.active.includes('documents');
-    }
-    catch {
-        return false;
-    }
-}
-/** Per-extractor health for Second Brain document ingestion (MEM-8/MEM-9):
- * one check per format family (PDF, DOCX, XLSX/XLS/ODS, PPTX/ODT/ODP/EPUB,
- * legacy DOC/PPT/Pages) instead of a single blanket "documents" check, so
- * `doctor` can report exactly which formats are functional vs broken.
- * No-op (empty array) when the documents capability isn't active — nothing
- * to report if this project doesn't ingest documents. */
-export async function checkDocumentExtractors() {
-    if (!isDocumentsCapabilityActive(process.cwd()))
-        return [];
-    try {
-        const { documentsCapability } = await import('../capabilities/cap-documents.js');
-        const checks = (await documentsCapability.healthChecks?.()) ?? [];
-        return checks.map((c) => ({
-            name: c.name,
-            status: c.status,
-            message: c.message,
-            fix: c.hint ?? c.fix,
-        }));
-    }
-    catch (err) {
-        return [
-            {
-                name: 'Document Extractors',
-                status: 'warn',
-                message: `Check failed: ${err instanceof Error ? err.message : String(err)}`,
-            },
-        ];
-    }
-}
 //# sourceMappingURL=doctor-project-checks.js.map