@pieai/pro-gov 0.4.6 → 0.4.8

package/dist/cli.js

@@ -1801,14 +1801,7 @@ function applyStarterFiles(files, profile) {
 }
 function renderAgentsTemplate(template, projectName, profile) {
   const selectedRoute = `docs/governance/agents-routing/${profile}-v0.9.md`;
-  const profileWorkflowNote = profile === "doc-only" ? "- Engineering test workflows are not enabled by default for this doc-only project." : "";
-  return template.replace("# PROJECT_NAME AI Router", `# ${projectName} AI Router`).replace(
-    /\d+\. The selected agents routing file:\n   - `docs\/governance\/agents-routing\/engineering-runtime-v0\.9\.md`, or\n   - `docs\/governance\/agents-routing\/doc-only-v0\.9\.md`/,
-    `3. The selected agents routing file: \`${selectedRoute}\``
-  ).replace(
-    "- Name this project's adopted profile: `engineering-runtime` or `doc-only`.",
-    `- This project adopts the \`${profile}\` profile.`
-  ).replace("- PROFILE_WORKFLOW_NOTE", profileWorkflowNote).replace(/\n{3,}/g, "\n\n");
+  return template.replace("# PROJECT_NAME AI Router", `# ${projectName} AI Router`).replace("`PROFILE_NAME`", `\`${profile}\``).replace("`PROFILE_ROUTE`", `\`${selectedRoute}\``).replace(/\n{3,}/g, "\n\n");
 }
 function readFlag(args, flag) {
   const index = args.indexOf(flag);
@@ -2792,8 +2785,8 @@ function printUsage3() {
 }
 
 // src/commands/portfolio.ts
-import { existsSync as existsSync21 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync22 } from "node:fs";
+import { join as join21 } from "node:path";
 
 // src/portfolio/manifest.ts
 import { existsSync as existsSync18, readFileSync as readFileSync12 } from "node:fs";
@@ -3384,6 +3377,492 @@ function deduplicateIssues(issues) {
   });
 }
 
+// src/portfolio/ai-health.ts
+import { execFileSync } from "node:child_process";
+import {
+  cpSync as cpSync2,
+  existsSync as existsSync21,
+  lstatSync as lstatSync6,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync15,
+  readdirSync as readdirSync8,
+  realpathSync as realpathSync2,
+  statSync as statSync4,
+  writeFileSync as writeFileSync7
+} from "node:fs";
+import { dirname as dirname12, join as join20, relative as relative8, resolve as resolve4 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+function inspectPortfolioAiHealth(options) {
+  const endpoints = collectEndpoints(options.manifest);
+  const secretsRoot = options.secretsRoot ?? join20(dirname12(options.manifest.controlPlane?.path ?? endpoints[0]?.endpoint.path ?? process.cwd()), ".secrets");
+  const homeDir = options.homeDir ?? process.env.HOME ?? "";
+  const executionEngineRoot = options.manifest.executionEngine?.path;
+  const skillRegistry = inspectSkillRegistry(executionEngineRoot);
+  const expectedPackageVersion = packageVersion(join20(executionEngineRoot ?? "", "packages/pro-gov/package.json"));
+  const repositories = endpoints.map(({ endpoint, role }) => inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion));
+  const summary = { healthy: 0, attention: 0, unhealthy: 0 };
+  for (const repository of repositories) summary[repository.status] += 1;
+  return {
+    schemaVersion: 1,
+    portfolioId: options.manifest.portfolioId,
+    generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    privacy: "Names, paths, counts, and configuration structure only. Secret values, environment values, MCP commands, arguments, and MCP environment maps are never collected.",
+    secretsRoot: inspectSecretsRoot(secretsRoot),
+    userMcp: inspectUserMcp(homeDir),
+    skillRegistry,
+    summary,
+    repositories
+  };
+}
+function writePortfolioAiHealthReport(report, outDir) {
+  mkdirSync8(outDir, { recursive: true });
+  const dashboardAssets = findDashboardAssets();
+  for (const file of ["index.html", "app.js", "app.css"]) {
+    const source = join20(dashboardAssets, file);
+    if (!existsSync21(source)) throw new Error(`Portfolio dashboard asset is missing: ${source}`);
+    cpSync2(source, join20(outDir, file));
+  }
+  const jsonPath = join20(outDir, "portfolio-ai-health.json");
+  const htmlPath = join20(outDir, "index.html");
+  writeFileSync7(jsonPath, `${JSON.stringify(report, null, 2)}
+`);
+  writeFileSync7(join20(outDir, "data.js"), `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson(report)};
+`);
+  return { jsonPath, htmlPath };
+}
+function collectEndpoints(manifest) {
+  const result = [];
+  if (manifest.controlPlane) result.push({ endpoint: manifest.controlPlane, role: "control-plane" });
+  if (manifest.executionEngine) result.push({ endpoint: manifest.executionEngine, role: "execution-engine" });
+  for (const target of manifest.targets) result.push({ endpoint: target, role: "target" });
+  const seen = /* @__PURE__ */ new Set();
+  return result.filter(({ endpoint }) => {
+    const key = resolve4(endpoint.path);
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion) {
+  const root = endpoint.path;
+  const git = inspectGit2(root);
+  const entries = inspectEntries(root);
+  const skills = inspectSkills(root);
+  const hooks = inspectHooks(root);
+  const docs = inspectDocs(root, expectedPackageVersion);
+  const mcp = {
+    root: jsonObjectKeys(join20(root, ".mcp.json"), "mcpServers"),
+    claudeCode: jsonObjectKeys(join20(root, ".claude/settings.json"), "mcpServers"),
+    codex: tomlMcpNames(join20(root, ".codex/config.toml"))
+  };
+  const secrets = inspectRepositorySecrets(root, endpoint.id, secretsRoot, git.isRepository);
+  const recommendations = [];
+  if (!git.isRepository) recommendations.push("\u8BE5\u8DEF\u5F84\u4E0D\u662F Git \u4ED3\u5E93\uFF1B\u786E\u8BA4\u6E05\u5355\u8DEF\u5F84\u662F\u5426\u6B63\u786E\u3002");
+  if (git.unmergedBranches.length > 0) recommendations.push(`\u6709 ${git.unmergedBranches.length} \u6761\u5206\u652F\u5C1A\u672A\u5408\u5165\u5F53\u524D HEAD\uFF1A${git.unmergedBranches.join(", ")}\u3002`);
+  else if (git.branches.length > 1) recommendations.push(`\u6709 ${git.branches.length} \u6761\u672C\u5730\u5206\u652F\uFF0C\u5747\u5DF2\u5408\u5165\u5F53\u524D HEAD\uFF1B\u786E\u8BA4\u65E0\u5176\u4ED6\u5BBF\u4E3B\u5360\u7528\u540E\u53EF\u6E05\u7406\u989D\u5916\u5206\u652F\u3002`);
+  if (git.worktrees.length > 1) recommendations.push(`\u6709 ${git.worktrees.length} \u4E2A worktree\uFF1B\u5B8C\u6210\u5E76\u5408\u5E76\u540E\u518D\u62C6\u9664\u4E34\u65F6 worktree\u3002`);
+  if (git.dirtyPaths.length > 0) recommendations.push(`\u5DE5\u4F5C\u533A\u6709 ${git.dirtyPaths.length} \u4E2A\u53D8\u66F4\u8DEF\u5F84\uFF1B\u5148\u786E\u8BA4\u5F52\u5C5E\uFF0C\u4E0D\u8981\u7531\u5065\u5EB7\u626B\u63CF\u5668\u81EA\u52A8\u6E05\u7406\u3002`);
+  if ((git.ahead ?? 0) > 0) recommendations.push(`\u5F53\u524D\u5206\u652F\u9886\u5148\u4E0A\u6E38 ${git.ahead} \u4E2A\u63D0\u4EA4\uFF1B\u786E\u8BA4\u5DE5\u4F5C\u5B8C\u6210\u540E\u518D\u63A8\u9001\u3002`);
+  if (entries.agents === "missing") recommendations.push("\u7F3A\u5C11 AGENTS.md\uFF1B\u65E0\u6CD5\u53D1\u73B0\u9879\u76EE\u5165\u53E3\u89C4\u5219\u3002");
+  if (entries.agents === "custom") recommendations.push("AGENTS.md \u672A\u8BC6\u522B\u5230 PGS Router \u6807\u8BB0\uFF1B\u68C0\u67E5\u662F\u5426\u5C1A\u672A\u540C\u6B65\u6216\u5DF2\u88AB\u9879\u76EE\u5185\u5BB9\u8986\u76D6\u3002");
+  if (entries.claude === "missing") recommendations.push("\u7F3A\u5C11 CLAUDE.md\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 AGENTS.md\uFF0C\u907F\u514D\u4E24\u4EFD\u5165\u53E3\u6F02\u79FB\u3002");
+  if (entries.claude === "thin-adapter") recommendations.push("CLAUDE.md \u662F\u517C\u5BB9\u9002\u914D\u5668\uFF1B\u53EF\u6539\u4E3A\u76F4\u63A5\u94FE\u63A5 AGENTS.md \u4EE5\u8FDB\u4E00\u6B65\u51CF\u5C11\u7EF4\u62A4\u9762\u3002");
+  if (entries.claude === "custom") recommendations.push("CLAUDE.md \u662F\u72EC\u7ACB\u5165\u53E3\uFF1B\u5BB9\u6613\u4E0E AGENTS.md \u6F02\u79FB\uFF0C\u5EFA\u8BAE\u53EA\u4FDD\u7559\u9879\u76EE\u786E\u9700\u7684\u5BBF\u4E3B\u5DEE\u5F02\u3002");
+  if (entries.claude === "dangling-symlink") recommendations.push("CLAUDE.md \u662F\u65AD\u5F00\u7684\u94FE\u63A5\uFF1B\u9700\u8981\u91CD\u65B0\u6307\u5411 AGENTS.md\u3002");
+  if (entries.gemini === "custom") recommendations.push("GEMINI.md \u662F\u72EC\u7ACB\u5165\u53E3\uFF1B\u82E5\u6CA1\u6709 Gemini \u4E13\u5C5E\u5DEE\u5F02\uFF0C\u5EFA\u8BAE\u94FE\u63A5\u5230 AGENTS.md\u3002");
+  if (entries.gemini === "dangling-symlink") recommendations.push("GEMINI.md \u662F\u65AD\u5F00\u7684\u94FE\u63A5\uFF1B\u9700\u8981\u91CD\u65B0\u6307\u5411 AGENTS.md\u3002");
+  if (skills.canonical.some((skill) => skill.kind === "dangling-symlink")) recommendations.push("`.agents/skills` \u4E2D\u5B58\u5728\u65AD\u5F00\u7684\u6280\u80FD\u94FE\u63A5\u3002");
+  if (skills.claudeCompatibility === "duplicate-directory") recommendations.push("`.claude/skills` \u662F\u72EC\u7ACB\u526F\u672C\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 `.agents/skills`\uFF0C\u907F\u514D\u53CC\u4EFD\u6280\u80FD\u6F02\u79FB\u3002");
+  if (skills.claudeCompatibility === "dangling-symlink") recommendations.push("`.claude/skills` \u662F\u65AD\u5F00\u7684\u94FE\u63A5\u3002");
+  if (hasWorkflowReminderHooks(hooks)) recommendations.push("\u53D1\u73B0 Stop/SubagentStop hook\uFF1B\u786E\u8BA4\u5B83\u662F\u5426\u4ECD\u6709\u9879\u76EE\u4E13\u5C5E\u7528\u9014\uFF0C\u5E76\u79FB\u9664\u9000\u4F11\u7684 PGS \u5DE5\u4F5C\u6D41\u63D0\u9192\u3002");
+  const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template);
+  if (liveEnv.some((file) => file.tracked)) recommendations.push("\u53D1\u73B0\u88AB Git \u8DDF\u8E2A\u7684\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\uFF1B\u5E94\u7ACB\u5373\u786E\u8BA4\u5176\u4E2D\u662F\u5426\u5305\u542B\u51ED\u636E\u5E76\u8FC1\u51FA\u4ED3\u5E93\u3002");
+  else if (liveEnv.length > 0 && secrets.centralDirectory === "absent") recommendations.push("\u4ED3\u5E93\u6709\u672C\u5730\u73AF\u5883\u6587\u4EF6\uFF0C\u4F46\u4E2D\u592E `.secrets` \u4E2D\u6CA1\u6709\u5BF9\u5E94\u76EE\u5F55\uFF1B\u786E\u8BA4\u662F\u5426\u9700\u8981\u7EB3\u5165\u5206\u5C42\u7BA1\u7406\u3002");
+  if (!docs.packages.aligned) recommendations.push(`PGS \u5305\u7248\u672C\u672A\u4E0E\u6267\u884C\u5F15\u64CE ${docs.packages.expected ?? "\u672A\u77E5\u7248\u672C"} \u5BF9\u9F50\uFF1B\u53D1\u5E03\u4E0A\u6E38\u540E\u518D\u540C\u6B65\u76EE\u6807\u4ED3\u5E93\u3002`);
+  if (role === "target" && !docs.manifest) recommendations.push("\u7F3A\u5C11 docs/governance/MANIFEST.yml\uFF1B\u6587\u6863\u6E05\u5355\u65E0\u6CD5\u8BC1\u660E\u5DF2\u540C\u6B65\u3002");
+  return {
+    id: endpoint.id,
+    role,
+    path: root,
+    profile: "profile" in endpoint ? endpoint.profile : void 0,
+    status: deriveStatus(entries, git, hooks, skills, secrets),
+    recommendations,
+    git,
+    entries,
+    hooks,
+    mcp,
+    skills,
+    secrets,
+    docs
+  };
+}
+function deriveStatus(entries, git, hooks, skills, secrets) {
+  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template)) return "unhealthy";
+  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0) return "attention";
+  return "healthy";
+}
+function hasWorkflowReminderHooks(hooks) {
+  return hooks.some((hook) => hook.events.some((event) => event.name === "Stop" || event.name === "SubagentStop"));
+}
+function inspectGit2(root) {
+  const git = (...args) => {
+    try {
+      return execFileSync("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trimEnd();
+    } catch {
+      return void 0;
+    }
+  };
+  if (git("rev-parse", "--is-inside-work-tree") !== "true") return { isRepository: false, branches: [], mergedBranches: [], unmergedBranches: [], worktrees: [], dirtyPaths: [] };
+  const status = git("status", "--porcelain=v1", "-uall") ?? "";
+  const worktreeText = git("worktree", "list", "--porcelain") ?? "";
+  const upstreamCounts = git("rev-list", "--left-right", "--count", "@{upstream}...HEAD")?.split(/\s+/).map(Number);
+  return {
+    isRepository: true,
+    branch: git("branch", "--show-current") || "(detached)",
+    branches: splitLines(git("for-each-ref", "--format=%(refname:short)", "refs/heads")),
+    mergedBranches: splitLines(git("for-each-ref", "--merged=HEAD", "--format=%(refname:short)", "refs/heads")),
+    unmergedBranches: splitLines(git("for-each-ref", "--no-merged=HEAD", "--format=%(refname:short)", "refs/heads")),
+    worktrees: splitLines(worktreeText).filter((line) => line.startsWith("worktree ")).map((line) => line.slice(9)),
+    dirtyPaths: splitLines(status).map((line) => line.slice(3)),
+    behind: upstreamCounts?.[0],
+    ahead: upstreamCounts?.[1]
+  };
+}
+function inspectEntries(root) {
+  const agentsPath = join20(root, "AGENTS.md");
+  const agents = !existsSync21(agentsPath) ? "missing" : safeRead(agentsPath).includes("PGS-ROUTER:BEGIN") ? "pgs-router" : "custom";
+  const claudePath = join20(root, "CLAUDE.md");
+  let claude = "missing";
+  if (pathLexists(claudePath)) {
+    const info = lstatSync6(claudePath);
+    if (info.isSymbolicLink()) {
+      try {
+        claude = realpathSync2(claudePath) === realpathSync2(agentsPath) ? "agents-symlink" : "custom";
+      } catch {
+        claude = "dangling-symlink";
+      }
+    } else {
+      const content = safeRead(claudePath);
+      claude = /AGENTS\.md/.test(content) && content.length < 2e3 ? "thin-adapter" : "custom";
+    }
+  }
+  return { agents, claude, gemini: inspectOptionalEntry(root, "GEMINI.md", agentsPath) };
+}
+function inspectOptionalEntry(root, filename, agentsPath) {
+  const path = join20(root, filename);
+  if (!pathLexists(path)) return "missing";
+  const info = lstatSync6(path);
+  if (info.isSymbolicLink()) {
+    try {
+      return realpathSync2(path) === realpathSync2(agentsPath) ? "agents-symlink" : "custom";
+    } catch {
+      return "dangling-symlink";
+    }
+  }
+  const content = safeRead(path);
+  return /AGENTS\.md/.test(content) && content.length < 2e3 ? "thin-adapter" : "custom";
+}
+function inspectSkills(root) {
+  const lock = readJson3(join20(root, ".pro-gov/assets.lock.json"));
+  const managed = /* @__PURE__ */ new Set();
+  const bundleIds = stringArray(isRecord3(lock) ? lock.bundleIds : void 0);
+  if (isRecord3(lock) && Array.isArray(lock.assets)) {
+    for (const asset of lock.assets) {
+      if (!isRecord3(asset) || typeof asset.targetPath !== "string") continue;
+      const match = asset.targetPath.match(/^\.agents\/skills\/([^/]+)$/);
+      if (match) managed.add(match[1]);
+    }
+  }
+  const skillRoot = join20(root, ".agents/skills");
+  const canonical = pathLexists(skillRoot) && safeIsDirectory(skillRoot) ? safeReadDir(skillRoot).filter((name) => !name.startsWith(".")).map((name) => {
+    const path = join20(skillRoot, name);
+    const stat = lstatSync6(path);
+    let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
+    if (stat.isSymbolicLink()) {
+      try {
+        realpathSync2(path);
+      } catch {
+        kind = "dangling-symlink";
+      }
+    }
+    return { name, kind, managed: managed.has(name) };
+  }) : [];
+  const locked = isRecord3(lock) && Array.isArray(lock.assets) ? lock.assets.length : 0;
+  return {
+    canonical,
+    claudeCompatibility: inspectClaudeSkillRoot(root),
+    bundleIds,
+    lifecycle: {
+      desired: bundleIds.length,
+      locked,
+      installed: canonical.filter((item) => item.managed && item.kind !== "dangling-symlink").length,
+      discoverable: canonical.filter((item) => item.kind !== "dangling-symlink").length,
+      runtime: "unobservable"
+    }
+  };
+}
+function inspectClaudeSkillRoot(root) {
+  const path = join20(root, ".claude/skills");
+  if (!pathLexists(path)) return "missing";
+  const stat = lstatSync6(path);
+  if (stat.isSymbolicLink()) {
+    try {
+      const target = realpathSync2(path);
+      return target === realpathSync2(join20(root, ".agents/skills")) ? "shared-root" : "other";
+    } catch {
+      return "dangling-symlink";
+    }
+  }
+  return stat.isDirectory() ? "duplicate-directory" : "other";
+}
+function inspectRepositorySecrets(root, id, secretsRoot, isRepository) {
+  const centralPath = join20(secretsRoot, id);
+  const envFiles = collectEnvironmentFiles(root).map((path) => ({
+    path,
+    tracked: isRepository ? gitTracks(root, path) : false,
+    template: /(?:example|sample|template|defaults?)$/i.test(basenameOnly(path)),
+    symlink: lstatSync6(join20(root, path)).isSymbolicLink()
+  }));
+  return {
+    centralDirectory: existsSync21(centralPath) ? "present" : "absent",
+    centralMode: existsSync21(centralPath) ? modeString(statSync4(centralPath).mode) : void 0,
+    centralFiles: existsSync21(centralPath) ? collectCentralSecretFiles(centralPath) : [],
+    repositoryEnvFiles: envFiles
+  };
+}
+var SKIP_ENV_DIRECTORIES = /* @__PURE__ */ new Set([".git", ".next", ".nuxt", ".output", ".turbo", ".worktrees", "build", "coverage", "dist", "node_modules", "out", "target"]);
+function collectEnvironmentFiles(root, current = root, depth = 0) {
+  if (depth > 5) return [];
+  const found = [];
+  try {
+    for (const entry of readdirSync8(current, { withFileTypes: true })) {
+      if (entry.isDirectory()) {
+        if (!SKIP_ENV_DIRECTORIES.has(entry.name)) found.push(...collectEnvironmentFiles(root, join20(current, entry.name), depth + 1));
+      } else if (entry.name === ".env" || entry.name.startsWith(".env.")) {
+        found.push(relative8(root, join20(current, entry.name)));
+      }
+    }
+  } catch {
+    return found;
+  }
+  return found.sort();
+}
+function collectCentralSecretFiles(root, current = root, depth = 0) {
+  if (depth > 3) return [];
+  const found = [];
+  try {
+    for (const entry of readdirSync8(current, { withFileTypes: true })) {
+      const path = join20(current, entry.name);
+      if (entry.isDirectory()) found.push(...collectCentralSecretFiles(root, path, depth + 1));
+      else found.push({ path: relative8(root, path), mode: modeString(lstatSync6(path).mode) });
+    }
+  } catch {
+    return found;
+  }
+  return found.sort((left, right) => left.path.localeCompare(right.path));
+}
+function basenameOnly(path) {
+  const parts = path.split(/[\\/]/);
+  return parts[parts.length - 1] ?? path;
+}
+function inspectSecretsRoot(path) {
+  return existsSync21(path) ? { path, exists: true, mode: modeString(statSync4(path).mode) } : { path, exists: false };
+}
+function inspectUserMcp(homeDir) {
+  if (!homeDir) return { codex: [], claudeCode: [] };
+  return {
+    codex: tomlMcpNames(join20(homeDir, ".codex/config.toml")),
+    claudeCode: jsonObjectKeys(join20(homeDir, ".claude/settings.json"), "mcpServers")
+  };
+}
+var HOOK_EVENT_NAMES = /* @__PURE__ */ new Set([
+  "PreToolUse",
+  "PostToolUse",
+  "PostToolUseFailure",
+  "PermissionRequest",
+  "UserPromptSubmit",
+  "Notification",
+  "SubagentStart",
+  "SubagentStop",
+  "Stop",
+  "SessionStart",
+  "SessionEnd",
+  "PreCompact",
+  "Setup",
+  "TeammateIdle",
+  "TaskCompleted",
+  "ConfigChange",
+  "WorktreeCreate",
+  "WorktreeRemove"
+]);
+function inspectHooks(root) {
+  const configs = [
+    { host: "agents", path: ".agents/hooks.json" },
+    { host: "claude-code", path: ".claude/settings.json" },
+    { host: "codex", path: ".codex/hooks.json" }
+  ];
+  return configs.map((config) => {
+    const value = readJson3(join20(root, config.path));
+    const counts = /* @__PURE__ */ new Map();
+    collectHookEvents(value, counts);
+    return {
+      ...config,
+      events: [...counts].sort(([left], [right]) => left.localeCompare(right)).map(([name, count]) => ({ name, count }))
+    };
+  });
+}
+function collectHookEvents(value, counts) {
+  if (Array.isArray(value)) {
+    for (const item of value) collectHookEvents(item, counts);
+    return;
+  }
+  if (!isRecord3(value)) return;
+  for (const [key, child] of Object.entries(value)) {
+    if (HOOK_EVENT_NAMES.has(key)) counts.set(key, Array.isArray(child) ? child.length : 1);
+    collectHookEvents(child, counts);
+  }
+}
+function inspectDocs(root, expected) {
+  const packageJson = readJson3(join20(root, "package.json"));
+  const dependencies = isRecord3(packageJson) ? { ...recordOrEmpty(packageJson.dependencies), ...recordOrEmpty(packageJson.devDependencies) } : {};
+  const docGov = dependencyVersion(dependencies["@pieai/doc-gov"]);
+  const proGov = dependencyVersion(dependencies["@pieai/pro-gov"]);
+  const routerMatch = safeRead(join20(root, "AGENTS.md")).match(/PGS-ROUTER:BEGIN\s+v([0-9.]+)/);
+  const declared = [docGov, proGov].filter((value) => Boolean(value));
+  return {
+    routerVersion: routerMatch?.[1],
+    manifest: existsSync21(join20(root, "docs/governance/MANIFEST.yml")),
+    currentWork: existsSync21(join20(root, "docs/reference/execution/current-work.md")),
+    packages: {
+      expected,
+      docGov,
+      proGov,
+      aligned: expected ? declared.length > 0 && declared.every((version) => version === expected) : true
+    }
+  };
+}
+function dependencyVersion(value) {
+  if (typeof value !== "string") return void 0;
+  const match = value.match(/(\d+\.\d+\.\d+)/);
+  return match?.[1];
+}
+function packageVersion(path) {
+  const value = readJson3(path);
+  return isRecord3(value) && typeof value.version === "string" ? value.version : void 0;
+}
+function recordOrEmpty(value) {
+  return isRecord3(value) ? value : {};
+}
+function inspectSkillRegistry(executionEngineRoot) {
+  if (!executionEngineRoot) return { source: 0, registered: 0, bundled: 0, bundles: 0 };
+  const agentAssetsRoot = join20(executionEngineRoot, "agent-assets");
+  const registry = readJson3(join20(agentAssetsRoot, "registry.json"));
+  const assets = isRecord3(registry) && Array.isArray(registry.assets) ? registry.assets : [];
+  const registeredSkills = assets.filter((asset) => isRecord3(asset) && asset.kind === "skill");
+  const bundleRoot = join20(agentAssetsRoot, "bundles");
+  const bundleFiles = safeReadDir(bundleRoot).filter((file) => file.endsWith(".json"));
+  const bundledIds = /* @__PURE__ */ new Set();
+  for (const file of bundleFiles) {
+    const bundle = readJson3(join20(bundleRoot, file));
+    if (!isRecord3(bundle) || !Array.isArray(bundle.assets)) continue;
+    for (const id of bundle.assets) if (typeof id === "string") bundledIds.add(id);
+  }
+  const sourceRoots = [join20(agentAssetsRoot, "skills/pie-skills"), join20(agentAssetsRoot, "skills/npx-skills/.agents/skills")];
+  const source = sourceRoots.reduce((count, root) => count + safeReadDir(root).filter((name) => existsSync21(join20(root, name, "SKILL.md"))).length, 0);
+  return {
+    source,
+    registered: registeredSkills.length,
+    bundled: registeredSkills.filter((asset) => isRecord3(asset) && typeof asset.id === "string" && bundledIds.has(asset.id)).length,
+    bundles: bundleFiles.length
+  };
+}
+function jsonObjectKeys(path, key) {
+  const value = readJson3(path);
+  if (!isRecord3(value) || !isRecord3(value[key])) return [];
+  return Object.keys(value[key]).sort();
+}
+function tomlMcpNames(path) {
+  if (!existsSync21(path)) return [];
+  const names = /* @__PURE__ */ new Set();
+  for (const line of safeRead(path).split(/\r?\n/)) {
+    const match = line.match(/^\s*\[mcp_servers\.(?:"([^"]+)"|([^\.\]]+))\]\s*$/);
+    const name = match?.[1] ?? match?.[2];
+    if (name) names.add(name);
+  }
+  return [...names].sort();
+}
+function readJson3(path) {
+  try {
+    return JSON.parse(readFileSync15(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function safeRead(path) {
+  try {
+    return readFileSync15(path, "utf8");
+  } catch {
+    return "";
+  }
+}
+function safeReadDir(path) {
+  try {
+    return readdirSync8(path).sort();
+  } catch {
+    return [];
+  }
+}
+function safeIsDirectory(path) {
+  try {
+    return statSync4(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function pathLexists(path) {
+  try {
+    lstatSync6(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function gitTracks(root, path) {
+  try {
+    execFileSync("git", ["ls-files", "--error-unmatch", "--", path], { cwd: root, stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function modeString(mode) {
+  return (mode & 511).toString(8).padStart(3, "0");
+}
+function splitLines(value) {
+  return value ? value.split(/\r?\n/).filter(Boolean) : [];
+}
+function stringArray(value) {
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function findDashboardAssets() {
+  const packageRoot2 = dirname12(dirname12(fileURLToPath4(import.meta.url)));
+  const candidates = [
+    process.env.PGS_DASHBOARD_ASSETS_DIR,
+    join20(packageRoot2, "assets/portfolio-dashboard"),
+    join20(process.cwd(), "assets/portfolio-dashboard"),
+    join20(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
+  ].filter((value) => Boolean(value));
+  const match = candidates.find((path) => existsSync21(join20(path, "index.html")));
+  if (!match) throw new Error("Portfolio dashboard assets were not built. Run pnpm --filter @pieai/pro-gov build.");
+  return match;
+}
+function safeJavaScriptJson(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+
 // src/commands/portfolio.ts
 function runPortfolio(args) {
   const [subcommand2, ...rest] = args;
@@ -3391,9 +3870,41 @@ function runPortfolio(args) {
   if (subcommand2 === "plan") return runPortfolioPlan(rest);
   if (subcommand2 === "assets-check") return runPortfolioAssetsCheck(rest);
   if (subcommand2 === "doctor") return runPortfolioDoctor(rest);
+  if (subcommand2 === "ai-health") return runPortfolioAiHealth(rest);
   printUsage4();
   return 1;
 }
+function runPortfolioAiHealth(args) {
+  const options = parsePortfolioOptions(args);
+  if (!options.ok) {
+    console.error(options.error);
+    printUsage4();
+    return 1;
+  }
+  if (!options.value.outDir) {
+    console.error("Expected --out <directory>");
+    printUsage4();
+    return 1;
+  }
+  const loaded = loadPortfolioManifest(options.value.configPath);
+  if (loaded.issues.length > 0 || !loaded.manifest) {
+    for (const issue of loaded.issues) console.error(`${issue.type}: ${issue.message}`);
+    return 1;
+  }
+  const report = inspectPortfolioAiHealth({
+    manifest: loaded.manifest,
+    secretsRoot: options.value.secretsRoot
+  });
+  const written = writePortfolioAiHealthReport(report, options.value.outDir);
+  if (options.value.json) {
+    console.log(JSON.stringify({ ok: true, ...written, summary: report.summary }, null, 2));
+  } else {
+    console.log(`portfolio AI health report written (${report.repositories.length} repositories)`);
+    console.log(`HTML: ${written.htmlPath}`);
+    console.log(`JSON: ${written.jsonPath}`);
+  }
+  return 0;
+}
 function runPortfolioDoctor(args) {
   const options = parsePortfolioOptions(args);
   if (!options.ok) {
@@ -3675,6 +4186,16 @@ function parsePortfolioOptions(args) {
       index += 1;
     } else if (arg === "--json") {
       options.json = true;
+    } else if (arg === "--out") {
+      const outDir = args[index + 1];
+      if (!outDir) return { ok: false, error: "Expected --out <directory>" };
+      options.outDir = outDir;
+      index += 1;
+    } else if (arg === "--secrets-root") {
+      const secretsRoot = args[index + 1];
+      if (!secretsRoot) return { ok: false, error: "Expected --secrets-root <directory>" };
+      options.secretsRoot = secretsRoot;
+      index += 1;
     } else {
       return { ok: false, error: `Unknown portfolio option: ${arg}` };
     }
@@ -3686,8 +4207,8 @@ function isHost2(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
 function findPortfolioAgentAssetsDir(manifest) {
-  const agentAssetsDir = manifest?.executionEngine?.path ? join20(manifest.executionEngine.path, "agent-assets") : void 0;
-  return agentAssetsDir && existsSync21(join20(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
+  const agentAssetsDir = manifest?.executionEngine?.path ? join21(manifest.executionEngine.path, "agent-assets") : void 0;
+  return agentAssetsDir && existsSync22(join21(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
 }
 function printUsage4() {
   console.error("Usage:");
@@ -3695,11 +4216,12 @@ function printUsage4() {
   console.error("  pro-gov portfolio plan --config <path> [--target <id|all>] [--host codex|claude-code|gemini-cli|antigravity] [--json]");
   console.error("  pro-gov portfolio assets-check --config <path> [--target <id|all>] [--json]");
   console.error("  pro-gov portfolio doctor --config <path> [--target <id|all>] [--json]");
+  console.error("  pro-gov portfolio ai-health --config <path> --out <directory> [--secrets-root <directory>] [--json]");
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync22, readFileSync as readFileSync15 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync16 } from "node:fs";
+import { join as join22 } from "node:path";
 function runSync(args) {
   const check = args.includes("--check");
   if (!check) {
@@ -3727,8 +4249,8 @@ function runSync(args) {
   console.log("pro-gov sync check");
   console.log(`profile: ${profile}`);
   for (const file of planStarterFiles(profile)) {
-    const targetPath = join21(process.cwd(), file.targetPath);
-    if (!existsSync22(targetPath)) {
+    const targetPath = join22(process.cwd(), file.targetPath);
+    if (!existsSync23(targetPath)) {
       if (file.ownership === "optional-guardrail") continue;
       console.log(`missing: ${file.targetPath}`);
       differences += 1;
@@ -3736,8 +4258,8 @@ function runSync(args) {
     }
     if (file.ownership === "optional-guardrail") continue;
     if (file.ownership === "project-local-seed") continue;
-    const source = readFileSync15(file.absoluteSourcePath, "utf8");
-    const target = readFileSync15(targetPath, "utf8");
+    const source = readFileSync16(file.absoluteSourcePath, "utf8");
+    const target = readFileSync16(targetPath, "utf8");
     if (!matchesExpectedContent(file.targetPath, source, target)) {
       console.log(`different: ${file.targetPath}`);
       differences += 1;
@@ -3771,7 +4293,7 @@ function normalizeMarkdownTableCell(cell) {
 }
 function inferInstalledProfile(root) {
   const installed = ["engineering-runtime", "doc-only"].filter(
-    (profile) => existsSync22(join21(root, `docs/governance/agents-routing/${profile}-v0.9.md`))
+    (profile) => existsSync23(join22(root, `docs/governance/agents-routing/${profile}-v0.9.md`))
   );
   return installed.length === 1 ? installed[0] : void 0;
 }
@@ -3795,6 +4317,7 @@ var COMMANDS = [
   "portfolio plan --config <path> [--target <id|all>] [--json]",
   "portfolio assets-check --config <path> [--target <id|all>] [--json]",
   "portfolio doctor --config <path> [--target <id|all>] [--json]",
+  "portfolio ai-health --config <path> --out <directory> [--secrets-root <directory>] [--json]",
   "learn recall --query <text> [--target <path>] [--limit <n>] [--json]",
   "learn capture --title <text> --summary <text> [--category <slug>] [--target <path>] [--json]",
   "lens scan [--target <path>] [--json]",