@phnx-labs/agents-cli 1.20.87 → 1.20.89

package/dist/commands/doctor.js

@@ -7,6 +7,8 @@ import { fanOutDevices, planFleetTargets, remoteFleetTargets } from '../lib/devi
 import { fleetDialTarget } from '../lib/devices/connect.js';
 import { compareFleetInventories } from '../lib/devices/fleet-divergence.js';
 import { collectLocalFleetInventory } from '../lib/devices/fleet-inventory.js';
+import { buildLocalFindings, fleetDivergenceToFindings, signInToFindings, renderFindings, } from '../lib/devices/doctor-findings.js';
+import { getCliVersion } from '../lib/version.js';
 import { resolveHost } from '../lib/hosts/registry.js';
 import { sshExecAsync } from '../lib/ssh-exec.js';
 import { sshTargetFor } from '../lib/hosts/types.js';
@@ -14,7 +16,6 @@ import { machineId } from '../lib/session/sync/config.js';
 import chalk from 'chalk';
 import { checkAllClis, collectTeamsDoctorData } from '../lib/teams/agents.js';
 import { AGENTS, ALL_AGENT_IDS, resolveAgentName, formatAgentError, getAccountInfo } from '../lib/agents.js';
-import { formatSignInBadge } from '../lib/signin-badge.js';
 import { getGlobalDefault, getVersionHomePath, isVersionInstalled, listInstalledVersions, parseAgentSpec, } from '../lib/versions.js';
 import { loadManifest, isStale } from '../lib/staleness/index.js';
 import { diffVersionResources, DOCTOR_ALL_KINDS, } from '../lib/doctor-diff.js';
@@ -26,8 +27,8 @@ import { unifiedDiff, colorizeUnifiedDiff } from '../lib/diff-text.js';
 import { listCliStatus } from '../lib/cli-resources.js';
 import { setHelpSections } from '../lib/help.js';
 import { heal, healChangedAnything } from '../lib/heal.js';
-import { blocksLocalScripts, getEffectiveExecutionPolicy } from '../lib/platform/winpath.js';
-import { scanUserRcFiles, rcSecretWarningLines } from '../lib/secrets/rc-hygiene.js';
+import { getEffectiveExecutionPolicy } from '../lib/platform/winpath.js';
+import { scanUserRcFiles } from '../lib/secrets/rc-hygiene.js';
 import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/session/width.js';
 import { readRepoBehindMarkers } from '../lib/auto-pull.js';
 import * as fs from 'fs';
@@ -63,239 +64,19 @@ export function wrapLine(prefix, text, width = terminalWidth()) {
     lines.push(line);
     return lines;
 }
+/** Reshape  into the pure finding-builder's input: install state
+ *  per declared CLI, plus the manifests the loader rejected (a bad manifest
+ *  declares a CLI that can never install, so it is a finding, not silence). */
+function toHostCliInput(status) {
+    return {
+        statuses: status.statuses.map((c) => ({ name: c.manifest.name, installed: c.installed })),
+        errors: status.errors.map((e) => ({ file: e.file, reason: e.reason })),
+    };
+}
 function printWrappedLine(prefix, text) {
     for (const line of wrapLine(prefix, text))
         console.log(chalk.gray(line));
 }
-function renderOverviewText(clis, syncRows, orphanRows, hostClis, signIn, repoBehindMarkers, duplicateHooks) {
-    // Triaged health banner FIRST, so a user running bare `agents doctor` sees what
-    // is unhealthy, why it matters, and the exact fix before scrolling the detail
-    // sections below. Same triage model as target mode, aggregated across versions.
-    const overviewHealth = computeOverviewHealth(syncRows, orphanRows, repoBehindMarkers, duplicateHooks);
-    console.log(chalk.bold('Health'));
-    renderHealthBlock(overviewHealth, {
-        healthySummary: syncRows.length
-            ? `${syncRows.length} version${syncRows.length === 1 ? '' : 's'} reconciled · hooks wired · sources current`
-            : 'no installed versions to check',
-        healFix: verdictIsAutoFixable(overviewHealth) ? 'agents doctor --fix' : undefined,
-    });
-    console.log();
-    console.log(chalk.bold('Agent CLIs'));
-    // Show the fleet you actually run — agents that are ready in PATH, plus any
-    // you MANAGE (have installed versions) whose binary isn't resolving (a real
-    // problem). The other supported-but-unadopted agents collapse to one hint line
-    // instead of a column of red "not installed" nags for tools you never wanted.
-    const managed = new Set(ALL_AGENT_IDS.filter((a) => listInstalledVersions(a).length > 0));
-    const entries = Object.entries(clis);
-    const shown = entries.filter(([name, e]) => e.installed || managed.has(name));
-    const hidden = entries.filter(([name, e]) => !e.installed && !managed.has(name)).map(([name]) => name);
-    if (shown.length === 0) {
-        console.log(chalk.gray('  (none installed — `agents add <name>` to start)'));
-    }
-    else {
-        for (const [name, entry] of shown) {
-            const pretty = (AGENT_NAMES[name] || name).padEnd(11);
-            if (entry.installed) {
-                const badge = formatSignInBadge(signIn[name]);
-                const pathHint = entry.path ? chalk.gray(`  ${entry.path}`) : '';
-                console.log(`  ${chalk.green('ready')}  ${pretty} ${badge}${pathHint}`);
-            }
-            else {
-                console.log(`  ${chalk.red('no   ')}  ${pretty} ${chalk.gray(entry.error || 'not installed')}`);
-            }
-        }
-    }
-    if (hidden.length > 0) {
-        printWrappedLine('  ', `+${hidden.length} more supported (${hidden.join(', ')}) — \`agents add <name>\` to manage`);
-    }
-    console.log();
-    console.log(chalk.bold('Sync status (installed versions)'));
-    if (syncRows.length === 0) {
-        console.log(chalk.gray('  (no versions installed; add one with `agents add <agent>@<version>`)'));
-    }
-    else {
-        let anyOutOfSync = false;
-        for (const row of syncRows) {
-            const tag = row.isDefault ? chalk.gray(' (default)') : '';
-            const label = `${AGENT_NAMES[row.agent] || row.agent}@${row.version}${tag}`;
-            const unwired = (row.unwiredHooks ?? 0) > 0;
-            if (row.status === 'fresh' && !unwired) {
-                console.log(`  ${chalk.green('fresh')}  ${label}`);
-                continue;
-            }
-            anyOutOfSync = true;
-            if (row.status === 'stale') {
-                console.log(`  ${chalk.yellow('stale')}  ${label}  ${chalk.gray('— sources changed since last sync')}`);
-            }
-            else if (row.status === 'never-synced') {
-                console.log(`  ${chalk.gray('cold ')}  ${label}  ${chalk.gray('— never synced')}`);
-            }
-            else {
-                // Manifest-fresh but a declared hook is present-on-disk yet not wired into
-                // settings.json — it never fires (the yosemite-s1 blind spot).
-                console.log(`  ${chalk.red('unwired')} ${label}  ${chalk.gray('— hooks present but not wired into settings.json')}`);
-            }
-            for (const line of row.divergence ?? []) {
-                console.log(chalk.gray(`           ${line}`));
-            }
-        }
-        // Launching does NOT reconcile a version home — the shim hot path only
-        // resolves a version and compiles project-scoped resources (shims.ts v15/v16).
-        // Version homes are reconciled only by management commands, so point at one
-        // rather than promising an auto-sync that never happens.
-        if (anyOutOfSync) {
-            printWrappedLine('  ', 'Reconcile with `agents doctor <agent>@<version> --fix` or `agents sync <agent>@<version>` (not applied on launch).');
-        }
-    }
-    console.log();
-    console.log(chalk.bold('Orphans (installed versions)'));
-    if (orphanRows.length === 0) {
-        console.log(chalk.gray('  (none — version homes match central sources)'));
-    }
-    else {
-        for (const row of orphanRows) {
-            const parts = [];
-            if (row.commands > 0)
-                parts.push(`${row.commands} command${row.commands === 1 ? '' : 's'}`);
-            if (row.skills > 0)
-                parts.push(`${row.skills} skill${row.skills === 1 ? '' : 's'}`);
-            if (row.hooks > 0)
-                parts.push(`${row.hooks} hook${row.hooks === 1 ? '' : 's'}`);
-            const label = `${AGENT_NAMES[row.agent] || row.agent}@${row.version}`;
-            console.log(`  ${chalk.yellow('warn ')}  ${label}  ${chalk.gray(parts.join(', '))}`);
-        }
-        console.log(chalk.gray('  Run `agents prune cleanup` to remove.'));
-    }
-    console.log();
-    // Host CLIs are host-global (declared in any DotAgents repo's cli/, installed
-    // to PATH — not synced into version homes), so they live in the overview, not
-    // the per-version resource diff. Source tag shows which repo layer declared
-    // each, including user-level and extra repos.
-    console.log(chalk.bold('Host CLIs'));
-    if (hostClis.statuses.length === 0) {
-        console.log(chalk.gray('  (none declared — add one with `agents cli add <name>`)'));
-    }
-    else {
-        const nameWidth = Math.max(...hostClis.statuses.map((s) => s.manifest.name.length));
-        for (const { manifest, installed } of hostClis.statuses) {
-            const label = manifest.name.padEnd(nameWidth);
-            const src = chalk.gray(`[${manifest.source}]`);
-            if (installed) {
-                const prefix = `  ${chalk.green('ready')}  ${label}  ${src}`;
-                const desc = manifest.description
-                    ? `  ${truncateToWidth(collapseWhitespace(manifest.description), Math.max(1, terminalWidth() - stringWidth(prefix) - 2))}`
-                    : '';
-                console.log(prefix + chalk.gray(desc));
-            }
-            else {
-                const prefix = `  ${chalk.red('miss ')}  ${label}  ${src}`;
-                const msg = `not installed — run \`agents cli install ${manifest.name}\``;
-                const budget = Math.max(1, terminalWidth() - stringWidth(prefix) - 2);
-                console.log(prefix + chalk.gray(`  ${truncateToWidth(msg, budget)}`));
-            }
-        }
-    }
-    for (const err of hostClis.errors) {
-        console.log(`  ${chalk.red('err  ')}  ${chalk.gray(err.file)}: ${chalk.gray(err.reason)}`);
-    }
-    // On Windows a Restricted/AllSigned execution policy silently breaks the
-    // generated `agents.ps1` launcher — postinstall diagnoses it interactively,
-    // but a non-interactive install never sees that. Surface it here too.
-    renderExecPolicyAdvisory();
-    // Credentials exported from a shell rc file leak into every process's
-    // environment (readable via /proc/<pid>/environ) — the RUSH-1968 class. Flag
-    // them here so the master passphrase never silently lives in `~/.zshenv` again.
-    renderRcHygieneAdvisory();
-    // Repos that are behind upstream — surfaced here instead of on stderr during
-    // every command. Markers are written by the background fetch worker and persist
-    // until the user runs `agents repo pull <alias>`.
-    renderRepoBehindAdvisory(repoBehindMarkers);
-}
-// ─── windows execution-policy advisory ─────────────────────────────────────────
-/**
- * Windows-only advisory lines. When the effective PowerShell execution policy
- * blocks unsigned local `.ps1` scripts (`Restricted`/`AllSigned`), the generated
- * `agents.ps1` launcher fails in PowerShell even when it is on PATH. Surface the
- * remediation; the `.cmd` companion still works, so this is a warning, not an
- * error, and doctor never auto-changes the policy. Pure — returns `[]` on
- * non-Windows or a permissive policy, so it is testable without invoking
- * PowerShell.
- */
-export function execPolicyWarningLines(platform, policy) {
-    if (platform !== 'win32')
-        return [];
-    if (!blocksLocalScripts(policy))
-        return [];
-    return [
-        `PowerShell execution policy is ${policy} — it blocks the generated agents.ps1 launcher.`,
-        'Fix: Set-ExecutionPolicy -Scope CurrentUser RemoteSigned',
-        'The agents.cmd shim still works regardless of the policy.',
-    ];
-}
-function renderRcHygieneAdvisory() {
-    const findings = scanUserRcFiles();
-    const lines = rcSecretWarningLines(findings);
-    if (lines.length === 0)
-        return;
-    console.log();
-    console.log(chalk.bold('Secrets in shell config'));
-    const [headline, ...rest] = lines;
-    console.log(`  ${chalk.yellow('warn ')}  ${headline}`);
-    for (const line of rest) {
-        console.log(chalk.gray(`           ${line}`));
-    }
-}
-// ─── repo-behind advisory ─────────────────────────────────────────────────────
-/**
- * Render repo-behind notices from background fetch markers as a "Repo updates"
- * section in `agents doctor`. Reads without consuming the markers so repeated
- * invocations keep showing the notice until the user runs `agents repo pull`.
- */
-function renderRepoBehindAdvisory(markers) {
-    const behind = markers.filter((m) => m.behind > 0);
-    if (behind.length === 0)
-        return;
-    console.log();
-    console.log(chalk.bold('Repo updates'));
-    for (const m of behind) {
-        const label = m.alias === 'user' ? '~/.agents/' : m.alias;
-        const commits = `${m.behind} commit${m.behind === 1 ? '' : 's'}`;
-        console.log(`  ${chalk.yellow('warn ')}  ${label} is ${commits} behind ${m.branch}`);
-        console.log(chalk.gray(`           run \`agents repo pull ${m.alias}\` to update`));
-    }
-}
-function renderExecPolicyAdvisory() {
-    // Only probe the policy on Windows — getEffectiveExecutionPolicy() spawns
-    // powershell, which is a wasted (doomed) process on POSIX where the advisory
-    // never applies.
-    if (process.platform !== 'win32')
-        return;
-    const lines = execPolicyWarningLines(process.platform, getEffectiveExecutionPolicy());
-    if (lines.length === 0)
-        return;
-    console.log();
-    console.log(chalk.bold('Execution policy (Windows)'));
-    const [headline, ...rest] = lines;
-    console.log(`  ${chalk.yellow('warn ')}  ${headline}`);
-    for (const line of rest) {
-        console.log(chalk.gray(`           ${line}`));
-    }
-}
-const AGENT_ORDER = ['claude', 'codex', 'kimi', 'grok', 'antigravity', 'opencode', 'cursor', 'droid'];
-function shortAgentHeader(name) {
-    return name.slice(0, 4).padEnd(4);
-}
-function agentCell(entry) {
-    if (!entry)
-        return chalk.gray('-   ');
-    if (entry.installed) {
-        const signedInHint = entry.signedIn ? '*' : ' ';
-        return chalk.green(`rdy${signedInHint}`.padEnd(4));
-    }
-    if (entry.error)
-        return chalk.red('err '.padEnd(4));
-    return chalk.gray('no  '.padEnd(4));
-}
 async function resolveFleetTargets(opts) {
     const singleName = opts.host || opts.device;
     if (singleName) {
@@ -377,12 +158,73 @@ async function probeFleetInventory(target) {
         return null;
     try {
         const parsed = JSON.parse(res.stdout);
-        return parsed.fleet ?? null;
+        return asFleetInventory(parsed.fleet);
     }
     catch {
         return null;
     }
 }
+/**
+ * Narrow a remote `doctor --json` `.fleet` payload to a usable inventory, or null.
+ *
+ * The remote runs ITS OWN agents-cli, whose version we do not control, so the
+ * payload is untrusted input rather than a typed value — a cast alone let a
+ * partial object (`{"fleet":{}}` from a skewed or truncated remote) reach
+ * `compareFleetInventories`, which indexes `inv.resources[kind]` and
+ * `Object.keys(inv.agentVersions)` unconditionally and throws. Returning null
+ * routes that device into the existing "older agents-cli / no inventory" path,
+ * which is honest and already rendered, instead of aborting the whole fan-out.
+ *
+ * This validates EVERY field of {@link FleetInventory} that anything downstream
+ * reads — `resources`, `agentVersions`, `repos` and each optional `signIn` row.
+ * It was tightened four times during review, each round finding the next
+ * unvalidated layer, so treat partial validation here as a bug: a field added to
+ * the inventory must be checked here in the same change.
+ */
+function asFleetInventory(value) {
+    // `typeof [] === 'object'`, so a shallow object check is not enough: an array
+    // passes it, every `inv.resources[kind] ?? []` then yields empty, and the
+    // comparison reports EVERY baseline resource as missing on that device — a
+    // screenful of false findings, worse than the crash this guard replaced.
+    const isMap = (x) => !!x && typeof x === 'object' && !Array.isArray(x);
+    const isStringArray = (x) => Array.isArray(x) && x.every((e) => typeof e === 'string');
+    if (!isMap(value))
+        return null;
+    const v = value;
+    if (!isMap(v.resources) || !Object.values(v.resources).every(isStringArray))
+        return null;
+    if (!isMap(v.agentVersions) || !Object.values(v.agentVersions).every(isStringArray))
+        return null;
+    // `repos.agents` / `repos.system` must each be a RepoState or null. Checking
+    // only that `repos` is a record let `{agents: [], system: []}` through: `[]` is
+    // truthy, so `describeRepoDrift` read `.head`/`.branch`/`.dirty` off an array,
+    // got undefined for each, and could emit a bogus repo-drift row.
+    const isRepoState = (x) => x === null
+        || (isMap(x)
+            && (x.branch === null || typeof x.branch === 'string')
+            && (x.head === null || typeof x.head === 'string')
+            && typeof x.dirty === 'boolean');
+    if (!isMap(v.repos) || !Object.values(v.repos).every(isRepoState))
+        return null;
+    // `signIn` is optional (older remotes omit it) but every FIELD must be
+    // well-formed if sent — not just `version`. `provable` and `signedIn` are read
+    // as booleans to decide a CRITICAL vs a hedged warning, so a remote sending
+    // `provable: "yes"` would print a logged-out critical for a signed-in version,
+    // and a non-string `account` would render straight into the accounts line.
+    if (v.signIn !== undefined) {
+        if (!isMap(v.signIn))
+            return null;
+        const isSignInRow = (r) => isMap(r)
+            && typeof r.version === 'string'
+            && typeof r.signedIn === 'boolean'
+            && typeof r.provable === 'boolean'
+            && (r.account === null || typeof r.account === 'string');
+        const rowsOk = Object.values(v.signIn).every((rows) => Array.isArray(rows) && rows.every(isSignInRow));
+        if (!rowsOk)
+            return null;
+    }
+    return v;
+}
 async function runDevicesDoctor(opts) {
     const singleName = opts.host || opts.device;
     const targets = await resolveFleetTargets(opts);
@@ -395,7 +237,7 @@ async function runDevicesDoctor(opts) {
             name: localName,
             online: true,
             agents: await collectTeamsDoctorData(),
-            inventory: collectLocalFleetInventory(opts.cwd ?? process.cwd()),
+            inventory: await collectLocalFleetInventory(opts.cwd ?? process.cwd()),
         });
     }
     // Remote targets in parallel: agent readiness (teams doctor) and the harness
@@ -427,74 +269,99 @@ async function runDevicesDoctor(opts) {
     const divergence = singleName
         ? null
         : compareFleetInventories(results.map((r) => ({ name: r.name, inventory: r.inventory ?? null })), localName);
-    if (opts.json) {
-        console.log(JSON.stringify({ devices: results, fleet: divergence }, null, 2));
+    if (opts.json && results.length === 0) {
+        console.log(JSON.stringify({ devices: results, fleet: divergence, findings: [] }, null, 2));
         return;
     }
     if (results.length === 0) {
         console.log(chalk.gray('No registered devices. Run `agents devices` to register some.'));
         return;
     }
-    const agentsToShow = AGENT_ORDER.filter((a) => results.some((r) => r.agents[a] !== undefined));
-    console.log(chalk.bold('Agent readiness by device'));
-    if (agentsToShow.length === 0) {
-        console.log(chalk.gray('  (no agent data collected)'));
-        return;
-    }
-    const nameWidth = Math.max(...results.map((r) => r.name.length));
-    const header = `  ${'Device'.padEnd(nameWidth)}  ${agentsToShow.map(shortAgentHeader).join('  ')}`;
-    console.log(chalk.gray(header));
-    for (const row of results) {
-        const status = row.online ? chalk.green('online ') : chalk.red('offline');
-        const errorSuffix = row.error ? `  ${chalk.gray(row.error)}` : '';
-        const cells = agentsToShow.map((a) => agentCell(row.agents[a])).join('  ');
-        console.log(`  ${row.name.padEnd(nameWidth)}  ${status}  ${cells}${errorSuffix}`);
+    // ── Hybrid fleet view (RUSH-2069): CRITICAL section across all boxes, then a
+    // per-computer block for each. Findings come from:
+    //   - LOCAL: per-version resource reports + sync/orphan/repo-behind + sign-in.
+    //   - REMOTE: the box's self-reported inventory (per-version sign-in) folded to
+    //     logged-out findings, plus cross-device divergence (version-skew, repo
+    //     drift, missing resources). A remote on an older CLI with no `signIn` in
+    //     its inventory emits the "older agents-cli — can't report per-version
+    //     sign-in → upgrade" warning so the readout stays honest.
+    const cwd = opts.cwd ?? process.cwd();
+    const findings = [];
+    const accounts = {};
+    for (const r of results) {
+        if (r.name === localName) {
+            // Local findings from the real reports (not just the inventory summary).
+            const localReports = [];
+            for (const agent of ALL_AGENT_IDS) {
+                for (const version of listInstalledVersions(agent)) {
+                    localReports.push(diffVersionResources(agent, version, { cwd, excludeProject: true }));
+                }
+            }
+            const localCliMissing = ALL_AGENT_IDS.filter((a) => listInstalledVersions(a).length > 0 && !checkAllClis()[a]?.installed);
+            findings.push(...buildLocalFindings({
+                device: localName,
+                syncRows: checkSyncStatus(cwd),
+                orphanRows: countOrphans(),
+                repoBehind: readRepoBehindMarkers(),
+                reports: localReports,
+                signIn: r.inventory?.signIn ?? {},
+                cliMissing: localCliMissing,
+                duplicateHooks: inspectDuplicateVersionHooks(cwd),
+                hostClis: toHostCliInput(listCliStatus(cwd)),
+                rcSecrets: scanUserRcFiles(),
+                execPolicy: process.platform === 'win32'
+                    ? { platform: process.platform, policy: getEffectiveExecutionPolicy() }
+                    : undefined,
+                isolatedVersions: localReports
+                    .filter((rep) => isVersionIsolated(rep.agent, rep.version))
+                    .map((rep) => `${rep.agent}@${rep.version}`),
+            }));
+            accounts[localName] = r.inventory?.signIn ?? {};
+            continue;
+        }
+        // Remote device.
+        if (!r.online) {
+            // An offline / unreachable box: surface it as a warning so it isn't
+            // silently dropped from the per-computer section.
+            findings.push({
+                severity: 'warning', kind: 'stale-cli', device: r.name,
+                message: r.error ? `unreachable — ${r.error}` : 'unreachable',
+                remediation: 'check the device',
+            });
+            continue;
+        }
+        if (r.inventory?.signIn) {
+            findings.push(...signInToFindings(r.name, r.inventory.signIn));
+            accounts[r.name] = r.inventory.signIn;
+        }
+        else {
+            // Reachable, but an older CLI that can't report per-version sign-in.
+            findings.push({
+                severity: 'warning', kind: 'stale-cli', device: r.name,
+                message: "older agents-cli — can't report per-version sign-in",
+                remediation: 'upgrade',
+            });
+            accounts[r.name] = {};
+        }
     }
-    console.log();
-    console.log(chalk.gray('  rdy* = installed and signed in · rdy = installed · no = not installed · err = probe failed · - = offline'));
+    // Cross-device divergence → version-skew / repo-drift / missing-resource
+    // warnings, attributed to the lagging box.
     if (divergence) {
-        console.log();
-        for (const line of renderFleetDivergence(divergence))
-            console.log(line);
+        findings.push(...fleetDivergenceToFindings(divergence.divergences, divergence.baseline));
     }
-}
-/**
- * Render the cross-device divergence section for `agents doctor --devices`
- * (RUSH-2027): a clean all-clear when the fleet agrees, otherwise the specific
- * gaps — a resource/version present here but missing on a box, or a diverged
- * config repo — grouped by device, each a plain-language line. Devices that
- * couldn't be compared (offline / older CLI) are named so the readout is honest.
- */
-export function renderFleetDivergence(report) {
-    const lines = [chalk.bold('Cross-device divergence')];
-    const skippedNote = report.skippedDevices.length > 0
-        ? chalk.gray(`  (not compared: ${report.skippedDevices.join(', ')} — offline or no inventory)`)
-        : null;
-    if (!report.hasDivergence) {
-        lines.push(chalk.green(`  Fleet is consistent — every compared device matches ${report.baseline}.`));
-        if (skippedNote)
-            lines.push(skippedNote);
-        return lines;
-    }
-    // Group findings by the LAGGING device so a box with several gaps reads as one
-    // block AND the remediation points at the right box. For a `*-missing-local`
-    // finding the resource is absent on the local baseline (present on `d.device`),
-    // so the box that's behind is the baseline — not the remote that has it.
-    const byDevice = new Map();
-    for (const d of report.divergences) {
-        const lagging = d.kind.endsWith('-missing-local') ? report.baseline : d.device;
-        (byDevice.get(lagging) ?? byDevice.set(lagging, []).get(lagging)).push(d);
-    }
-    for (const device of Array.from(byDevice.keys()).sort()) {
-        lines.push(`  ${chalk.yellow('⚠')} ${chalk.bold(device)}`);
-        for (const d of byDevice.get(device)) {
-            lines.push(chalk.gray(`      ${d.message}`));
-        }
+    // `--json` emits HERE, not before the findings are built: a consumer that reads
+    // the JSON must see the same finding set the text renders — same membership,
+    // same severities, so the CRITICAL `(N)` and each device's `✗ N critical`
+    // reconcile. Emitting early left `--devices --json` with no `findings` at all
+    // while the bare `--json` had one.
+    if (opts.json) {
+        console.log(JSON.stringify({ devices: results, fleet: divergence, findings }, null, 2));
+        return;
+    }
+    const header = `${chalk.gray('agents doctor ·')} ${chalk.hex('#a3e635')(String(results.length))} ${chalk.gray('devices · baseline')} ${chalk.hex('#a3e635')(localName)}`;
+    for (const line of renderFindings(findings, accounts, { fleet: true, baseline: localName, header })) {
+        console.log(line);
     }
-    if (skippedNote)
-        lines.push(skippedNote);
-    lines.push(chalk.gray('  Read-only — run `agents apply` or `agents repo pull` on a lagging box to reconcile.'));
-    return lines;
 }
 function parseTargetArg(arg) {
     const at = arg.indexOf('@');
@@ -1423,10 +1290,14 @@ export function registerDoctorCommand(program) {
             const orphanRows = countOrphans();
             const hostClis = listCliStatus(cwd);
             const repoBehindMarkers = readRepoBehindMarkers();
+            // The local inventory now carries per-version sign-in (RUSH-2069), so it
+            // is the single source for both the accounts line and the logged-out
+            // criticals. Collected once (async: it parses each version's account).
+            const inventory = await collectLocalFleetInventory(cwd);
+            const localName = machineId();
             const duplicateHooks = inspectDuplicateVersionHooks(cwd);
-            // Advisory login state per installed agent (file-based getAccountInfo,
-            // no home → the account-global/active credential). Best-effort: a probe
-            // failure just leaves that agent's badge as "logged out".
+            // Legacy account-global sign-in map, kept for `--json` back-compat
+            // (ssh.ts RemoteDoctorJson / menubar read `signIn`). File-based, no home.
             const signIn = {};
             await Promise.all(Object.entries(clis)
                 .filter(([, e]) => e.installed)
@@ -1438,6 +1309,41 @@ export function registerDoctorCommand(program) {
                     /* advisory only */
                 }
             }));
+            // Per-version resource reports drive the missing-hook / missing-plugin /
+            // unwired / content-drift findings. Non-project layers only (the global
+            // home is never reconciled against per-cwd project resources).
+            const reports = [];
+            for (const agent of ALL_AGENT_IDS) {
+                for (const version of listInstalledVersions(agent)) {
+                    reports.push(diffVersionResources(agent, version, { cwd, excludeProject: true }));
+                }
+            }
+            // A MANAGED agent (installed versions) whose binary won't resolve is a
+            // real critical — an unmanaged-and-absent agent is not.
+            const cliMissing = ALL_AGENT_IDS.filter((a) => listInstalledVersions(a).length > 0 && clis[a] && !clis[a].installed);
+            // An isolated copy is skipped by the agent-wide `--fix` sweep, so its
+            // findings must never fold into a collapsed cross-version row.
+            const isolatedVersions = reports
+                .filter((r) => isVersionIsolated(r.agent, r.version))
+                .map((r) => `${r.agent}@${r.version}`);
+            const findings = buildLocalFindings({
+                device: localName,
+                syncRows,
+                orphanRows,
+                repoBehind: repoBehindMarkers,
+                reports,
+                signIn: inventory.signIn ?? {},
+                cliMissing,
+                duplicateHooks,
+                hostClis: toHostCliInput(hostClis),
+                rcSecrets: scanUserRcFiles(),
+                // getEffectiveExecutionPolicy spawns powershell — a doomed process on
+                // POSIX, where the advisory never applies. Probe only on Windows.
+                execPolicy: process.platform === 'win32'
+                    ? { platform: process.platform, policy: getEffectiveExecutionPolicy() }
+                    : undefined,
+                isolatedVersions,
+            });
             if (opts.json) {
                 console.log(JSON.stringify({
                     clis,
@@ -1453,12 +1359,14 @@ export function registerDoctorCommand(program) {
                     // reading `sync`/`orphans`/`repos` are unaffected.
                     health: computeOverviewHealth(syncRows, orphanRows, repoBehindMarkers, duplicateHooks),
                     duplicateHooks,
+                    // Prioritized RUSH-2069 findings (critical/warning, per-version, with
+                    // remediation). Additive alongside the legacy fields above.
+                    findings,
                     // This host's harness inventory — installed resources per kind,
-                    // installed version ids per agent, and `.agents`/`.system` repo
-                    // state — so `agents doctor --devices` can compare presence across
-                    // the fleet and flag a resource/version present here but missing
-                    // elsewhere (RUSH-2027). Read-only; no network.
-                    fleet: collectLocalFleetInventory(cwd),
+                    // installed version ids per agent, `.agents`/`.system` repo state, and
+                    // per-version sign-in — so `agents doctor --devices` can compare
+                    // presence and sign-in across the fleet (RUSH-2027/2069). Read-only.
+                    fleet: inventory,
                     hostClis: {
                         statuses: hostClis.statuses.map((s) => ({
                             name: s.manifest.name,
@@ -1480,11 +1388,17 @@ export function registerDoctorCommand(program) {
                 }, null, 2));
                 return;
             }
-            renderOverviewText(clis, syncRows, orphanRows, hostClis, signIn, repoBehindMarkers, duplicateHooks);
-            // Point at the interactive reconcile when anything is out of sync — the
-            // report shouldn't be a dead end. `agents status` runs the unified
-            // home-reading engine and offers to sync (opt-in, never auto-fires here).
-            // Unwired hooks and a behind-origin repo count as out-of-sync too.
+            // Single-machine hybrid: CRITICAL section + one `▸ <machine>` block.
+            const accounts = {
+                [localName]: inventory.signIn ?? {},
+            };
+            const header = `${chalk.gray('agents doctor ·')} ${chalk.hex('#a3e635')(localName)}${chalk.gray(`  ${getCliVersion()}`)}`;
+            for (const line of renderFindings(findings, accounts, { fleet: false, baseline: localName, header })) {
+                console.log(line);
+            }
+            // Point at the interactive reconcile when anything is out of sync — each
+            // finding carries its own fix, but `agents status` is the one place that
+            // reviews and applies them together (opt-in, never auto-fires here).
             if (syncRows.some((r) => r.status !== 'fresh' || (r.unwiredHooks ?? 0) > 0) || repoBehindMarkers.some((m) => m.behind > 0)) {
                 console.log(chalk.gray('\nRun `agents status` to review and sync what has drifted.'));
             }