@pieai/pro-gov 0.7.0 → 0.7.2

package/dist/cli.js

@@ -66,7 +66,15 @@ function loadAgentAssetBundles(agentAssetsDir) {
 // src/asset-npx/maintenance.ts
 import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { cpSync, existsSync as existsSync3, mkdirSync, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync2, statSync } from "node:fs";
+import {
+  cpSync,
+  existsSync as existsSync3,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync2,
+  statSync
+} from "node:fs";
 import { join as join3, relative as relative2 } from "node:path";
 import { tmpdir } from "node:os";
 function createNpxSkillsMaintenancePlan(options) {
@@ -93,7 +101,6 @@ function createNpxSkillsMaintenancePlan(options) {
   if (options.operation === "update") {
     assertNoReportedPartialUpdateFailure(result.stdout, result.stderr);
   }
-  assertNoDeprecatedMattSkills(tempRoot);
   const after = snapshotFiles(tempRoot);
   const changes = diffSnapshots(before, after);
   return {
@@ -111,23 +118,14 @@ function createNpxSkillsMaintenancePlan(options) {
   };
 }
 function assertNoReportedPartialUpdateFailure(stdout, stderr) {
+  const ansiEscape = new RegExp(`${String.fromCharCode(27)}\\[[0-?]*[ -/]*[@-~]`, "g");
   const output = `${stdout}
-${stderr}`.replace(/\u001B\[[0-?]*[ -/]*[@-~]/g, "");
+${stderr}`.replace(ansiEscape, "");
   const failure = output.match(/Failed to update\s+\d+\s+skill\(s\)/i);
   if (failure) {
     throw new Error(`npx skills update reported a partial failure: ${failure[0]}`);
   }
 }
-function assertNoDeprecatedMattSkills(npxRoot) {
-  const lockPath = join3(npxRoot, "skills-lock.json");
-  const lock = JSON.parse(readFileSync2(lockPath, "utf8"));
-  const deprecated = Object.entries(lock.skills ?? {}).filter(
-    ([, entry]) => entry.source === "mattpocock/skills" && entry.skillPath?.startsWith("skills/deprecated/")
-  ).map(([name]) => name).sort();
-  if (deprecated.length > 0) {
-    throw new Error(`npx skills plan contains deprecated mattpocock skills: ${deprecated.join(", ")}`);
-  }
-}
 function assertNativeNpxRoot(npxRoot) {
   if (!existsSync3(join3(npxRoot, "skills-lock.json"))) {
     throw new Error(`npx skills root is missing skills-lock.json: ${npxRoot}`);
@@ -3471,12 +3469,13 @@ function validateVersionPolicy(value, projectTypes, issues) {
     issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy", message: "Technology versionPolicy must be an object." });
     return;
   }
-  validateAllowedFields(value, "versionPolicy", ["schemaVersion", "packageManager", "runtime", "packages"], issues);
+  validateAllowedFields(value, "versionPolicy", ["schemaVersion", "packageManager", "runtime", "runtimes", "packages"], issues);
   if (value.schemaVersion !== 1) {
     issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.schemaVersion", message: "Technology versionPolicy schemaVersion must be 1." });
   }
   validateVersionRequirement(value.packageManager, "technologyGovernance.versionPolicy.packageManager", issues);
   validateVersionRequirement(value.runtime, "technologyGovernance.versionPolicy.runtime", issues);
+  validateRuntimeRequirements(value.runtimes, projectTypes, issues);
   if (!Array.isArray(value.packages)) {
     issues.push({ type: "invalid-field", field: "technologyGovernance.versionPolicy.packages", message: "Technology versionPolicy packages must be an array." });
     return;
@@ -3507,6 +3506,39 @@ function validateVersionPolicy(value, projectTypes, issues) {
     }
   }
 }
+function validateRuntimeRequirements(value, projectTypes, issues) {
+  if (value === void 0) return;
+  const field = "technologyGovernance.versionPolicy.runtimes";
+  if (!Array.isArray(value)) {
+    issues.push({ type: "invalid-field", field, message: "Technology versionPolicy runtimes must be an array." });
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of value) {
+    if (!isRecord(entry)) {
+      issues.push({ type: "invalid-field", field, message: "Version policy runtime entries must be objects." });
+      continue;
+    }
+    validateAllowedFields(entry, "versionPolicy.runtimeEntry", ["name", "version", "appliesTo"], issues);
+    const name = typeof entry.name === "string" ? entry.name : "";
+    if (!name || seen.has(name)) {
+      issues.push({ type: "invalid-field", field: `${field}.name`, message: `Version policy runtime name must be non-empty and unique: ${String(entry.name)}` });
+    } else seen.add(name);
+    if (typeof entry.version !== "string" || !isExactVersion(entry.version)) {
+      issues.push({ type: "invalid-field", field: `${field}.version`, message: `Version policy runtime version must be exact semver: ${String(entry.version)}` });
+    }
+    if (entry.appliesTo !== void 0) {
+      validateOptionalStringArray(entry.appliesTo, name, `${field}.appliesTo`, issues);
+      if (Array.isArray(entry.appliesTo)) {
+        for (const projectType of entry.appliesTo) {
+          if (typeof projectType === "string" && !projectTypes.has(projectType)) {
+            issues.push({ type: "invalid-field", field: `${field}.appliesTo`, message: `Version policy references unknown project type: ${projectType}` });
+          }
+        }
+      }
+    }
+  }
+}
 function validateVersionRequirement(value, field, issues) {
   if (value === void 0) return;
   if (!isRecord(value)) {
@@ -3697,11 +3729,11 @@ function isRecord(value) {
 }
 
 // src/portfolio/doctor.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { spawnSync as spawnSync6 } from "node:child_process";
 import { existsSync as existsSync22, readFileSync as readFileSync16 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname12, join as join23 } from "node:path";
+import { dirname as dirname13, join as join23 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/host-tooling/inventory.ts
@@ -3874,20 +3906,51 @@ function pathIsSymlink(path) {
 }
 
 // src/portfolio/version-policy.ts
-import { existsSync as existsSync21, readFileSync as readFileSync15 } from "node:fs";
-import { join as join22 } from "node:path";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync21, readFileSync as readFileSync15, readdirSync as readdirSync9 } from "node:fs";
+import { dirname as dirname12, join as join22 } from "node:path";
 function inspectVersionPolicy(root, policy, projectType) {
-  if (!policy) return { status: "compliant", packages: [], attentionCount: 0 };
-  const packageJson = readJson2(join22(root, "package.json"));
+  if (!policy) return { status: "compliant", packages: [], runtimes: [], attentionCount: 0 };
+  const packageManifests = collectPackageManifests(root);
+  const packageJson = packageManifests.find(
+    (manifest) => manifest.path === "package.json"
+  )?.packageJson;
   const packageManager = policy.packageManager ? inspectPackageManager(packageJson, policy.packageManager.name, policy.packageManager.version) : void 0;
   const runtime = policy.runtime ? inspectRuntime(policy.runtime.name, policy.runtime.version) : void 0;
+  const runtimes = (policy.runtimes ?? []).map((requirement) => {
+    if (requirement.appliesTo && (!projectType || !requirement.appliesTo.includes(projectType))) {
+      return {
+        name: requirement.name,
+        expected: requirement.version,
+        status: "not-applicable"
+      };
+    }
+    return inspectRuntime(requirement.name, requirement.version);
+  });
   const packages = policy.packages.map((requirement) => {
     if (requirement.appliesTo && (!projectType || !requirement.appliesTo.includes(projectType))) {
-      return { name: requirement.name, expected: requirement.version, status: "not-applicable" };
+      return {
+        name: requirement.name,
+        expected: requirement.version,
+        status: "not-applicable"
+      };
     }
-    const declared = findDeclaredVersion(packageJson, requirement.name);
-    const installed = readInstalledVersion(root, requirement.name);
-    const status = declared === void 0 ? requirement.appliesTo ? "missing" : "not-applicable" : declared !== requirement.version ? "drift" : installed !== requirement.version ? installed === void 0 ? "missing" : "drift" : "compliant";
+    const declarations = packageManifests.map((manifest) => ({
+      manifest,
+      declared: findDeclaredVersion(manifest.packageJson, requirement.name)
+    })).filter(
+      (item) => item.declared !== void 0
+    );
+    const declaredValues = unique(declarations.map((item) => item.declared));
+    const installedValues = unique(
+      declarations.map((item) => readInstalledVersion(root, requirement.name, item.manifest.directory)).filter((value) => value !== void 0)
+    );
+    const hasMissingInstall = declarations.some(
+      (item) => readInstalledVersion(root, requirement.name, item.manifest.directory) === void 0
+    );
+    const declared = declaredValues.length ? declaredValues.join(" \xB7 ") : void 0;
+    const installed = installedValues.length ? installedValues.join(" \xB7 ") : void 0;
+    const status = declarations.length === 0 ? requirement.appliesTo ? "missing" : "not-applicable" : declarations.some((item) => item.declared !== requirement.version) ? "drift" : hasMissingInstall ? "missing" : installedValues.some((value) => value !== requirement.version) ? "drift" : "compliant";
     return {
       name: requirement.name,
       expected: requirement.version,
@@ -3897,12 +3960,17 @@ function inspectVersionPolicy(root, policy, projectType) {
       status
     };
   });
-  const all = [packageManager, runtime, ...packages].filter((item) => item !== void 0);
-  const attentionCount = all.filter((item) => item.status !== "compliant" && item.status !== "not-applicable").length;
+  const all = [packageManager, runtime, ...runtimes, ...packages].filter(
+    (item) => item !== void 0
+  );
+  const attentionCount = all.filter(
+    (item) => item.status !== "compliant" && item.status !== "not-applicable"
+  ).length;
   return {
     status: attentionCount === 0 ? "compliant" : "attention",
     packageManager,
     runtime,
+    runtimes,
     packages,
     attentionCount
   };
@@ -3919,7 +3987,7 @@ function inspectPackageManager(packageJson, expectedName, expectedVersion) {
   };
 }
 function inspectRuntime(expectedName, expectedVersion) {
-  const actual = expectedName === "node" ? process.versions.node : void 0;
+  const actual = readRuntimeVersion(expectedName);
   return {
     name: expectedName,
     expected: expectedVersion,
@@ -3927,16 +3995,86 @@ function inspectRuntime(expectedName, expectedVersion) {
     status: actual === void 0 ? "missing" : actual === expectedVersion ? "compliant" : "drift"
   };
 }
+function readRuntimeVersion(name) {
+  if (name === "node") return process.versions.node;
+  if (name !== "deno") return void 0;
+  const result = spawnSync5("deno", ["--version"], { encoding: "utf8" });
+  if (result.status !== 0) return void 0;
+  return /^deno\s+(\d+\.\d+\.\d+)/m.exec(result.stdout)?.[1];
+}
 function findDeclaredVersion(packageJson, name) {
-  for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+  for (const section of [
+    "dependencies",
+    "devDependencies",
+    "peerDependencies",
+    "optionalDependencies"
+  ]) {
     const value = packageJson?.[section]?.[name];
     if (typeof value === "string") return value;
   }
   return void 0;
 }
-function readInstalledVersion(root, name) {
-  const packageJson = readJson2(join22(root, "node_modules", name, "package.json"));
-  return typeof packageJson?.version === "string" ? packageJson.version : void 0;
+function readInstalledVersion(root, name, fromDirectory = root) {
+  let current = fromDirectory;
+  while (true) {
+    const packageJson = readJson2(join22(current, "node_modules", name, "package.json"));
+    if (typeof packageJson?.version === "string") return packageJson.version;
+    if (current === root) return void 0;
+    const parent = dirname12(current);
+    if (parent === current) return void 0;
+    current = parent;
+  }
+}
+function collectPackageManifests(root) {
+  const manifests = [];
+  const ignored = /* @__PURE__ */ new Set([
+    ".git",
+    ".next",
+    ".nuxt",
+    ".output",
+    ".pnpm",
+    ".turbo",
+    ".vercel",
+    ".worktrees",
+    "build",
+    "coverage",
+    "dist",
+    "node_modules",
+    "out",
+    "target",
+    "tmp",
+    ".cache",
+    ".pnpm-store",
+    ".tmp-repos"
+  ]);
+  const visit = (directory, depth) => {
+    if (depth > 6) return;
+    let entries;
+    try {
+      entries = readdirSync9(directory, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const path = join22(directory, entry.name);
+      if (entry.isFile() && entry.name === "package.json") {
+        const packageJson = readJson2(path);
+        if (packageJson)
+          manifests.push({
+            path: path.slice(root.length + 1) || "package.json",
+            directory,
+            packageJson
+          });
+      } else if (entry.isDirectory() && !ignored.has(entry.name)) {
+        visit(path, depth + 1);
+      }
+    }
+  };
+  visit(root, 0);
+  return manifests.sort((a, b) => a.path.localeCompare(b.path));
+}
+function unique(values) {
+  return [...new Set(values)];
 }
 function readJson2(path) {
   if (!existsSync21(path)) return void 0;
@@ -4070,7 +4208,7 @@ function runTargetChecks(target) {
   ];
   return commands.map((command2) => {
     if (!existsSync22(command2.cli)) return { name: command2.name, status: null };
-    const result = spawnSync5(process.execPath, [command2.cli, ...command2.args], {
+    const result = spawnSync6(process.execPath, [command2.cli, ...command2.args], {
       cwd: target.path,
       encoding: "utf8",
       timeout: 3e4
@@ -4079,13 +4217,13 @@ function runTargetChecks(target) {
   });
 }
 function inspectGit(path) {
-  const inside = spawnSync5("git", ["rev-parse", "--is-inside-work-tree"], {
+  const inside = spawnSync6("git", ["rev-parse", "--is-inside-work-tree"], {
     cwd: path,
     encoding: "utf8"
   });
   if (inside.status !== 0) return { isRepository: false, dirty: false };
-  const status = spawnSync5("git", ["status", "--porcelain"], { cwd: path, encoding: "utf8" });
-  const branch = spawnSync5("git", ["branch", "--show-current"], { cwd: path, encoding: "utf8" });
+  const status = spawnSync6("git", ["status", "--porcelain"], { cwd: path, encoding: "utf8" });
+  const branch = spawnSync6("git", ["branch", "--show-current"], { cwd: path, encoding: "utf8" });
   return {
     isRepository: true,
     dirty: status.stdout.trim().length > 0,
@@ -4108,11 +4246,11 @@ function getExpectedPackageVersions() {
   };
 }
 function findOwnPackageJson() {
-  let current = dirname12(fileURLToPath3(import.meta.url));
+  let current = dirname13(fileURLToPath3(import.meta.url));
   for (let depth = 0; depth < 5; depth += 1) {
     const candidate = join23(current, "package.json");
     if (existsSync22(candidate)) return candidate;
-    current = dirname12(current);
+    current = dirname13(current);
   }
   return "";
 }
@@ -4142,13 +4280,13 @@ import {
   lstatSync as lstatSync8,
   mkdirSync as mkdirSync8,
   readFileSync as readFileSync17,
-  readdirSync as readdirSync9,
+  readdirSync as readdirSync10,
   realpathSync as realpathSync4,
   statSync as statSync5,
   writeFileSync as writeFileSync7
 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname13, join as join24, relative as relative8, resolve as resolve5, sep } from "node:path";
+import { dirname as dirname14, join as join24, relative as relative8, resolve as resolve5, sep } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var CURRENT_ROUTER_VERSION = "1.1";
 function inspectPortfolioAiHealth(options) {
@@ -4157,21 +4295,30 @@ function inspectPortfolioAiHealth(options) {
   if (options.targetId && options.targetId !== "all" && endpoints.length === 0) {
     throw new Error(`Unknown portfolio target: ${options.targetId}`);
   }
-  const secretsRoot = options.secretsRoot ?? join24(dirname13(options.manifest.controlPlane?.path ?? allEndpoints[0]?.endpoint.path ?? process.cwd()), ".secrets");
+  const secretsRoot = options.secretsRoot ?? join24(
+    dirname14(
+      options.manifest.controlPlane?.path ?? allEndpoints[0]?.endpoint.path ?? process.cwd()
+    ),
+    ".secrets"
+  );
   const homeDir = options.homeDir ?? process.env.HOME ?? homedir4();
   const grokVersion = commandVersion("grok");
   const executionEngineRoot = options.manifest.executionEngine?.path;
   const skillRegistry = inspectSkillRegistry(executionEngineRoot);
-  const expectedPackageVersion = packageVersion(join24(executionEngineRoot ?? "", "packages/pro-gov/package.json"));
-  const repositories = endpoints.map(({ endpoint, role }) => inspectRepository(
-    endpoint,
-    role,
-    secretsRoot,
-    homeDir,
-    expectedPackageVersion,
-    options.manifest.technologyGovernance,
-    grokVersion
-  ));
+  const expectedPackageVersion = packageVersion(
+    join24(executionEngineRoot ?? "", "packages/pro-gov/package.json")
+  );
+  const repositories = endpoints.map(
+    ({ endpoint, role }) => inspectRepository(
+      endpoint,
+      role,
+      secretsRoot,
+      homeDir,
+      expectedPackageVersion,
+      options.manifest.technologyGovernance,
+      grokVersion
+    )
+  );
   const summary = { healthy: 0, attention: 0, unhealthy: 0 };
   for (const repository of repositories) summary[repository.status] += 1;
   return {
@@ -4196,6 +4343,8 @@ function inspectPortfolioAiHealth(options) {
     technologyGovernance: {
       strategySource: options.manifest.technologyGovernance?.strategySource,
       versionPolicy: options.manifest.technologyGovernance?.versionPolicy,
+      catalog: options.manifest.technologyGovernance?.technologies ?? [],
+      matrix: buildTechnologyMatrix(options.manifest.technologyGovernance, repositories),
       projectTypes: options.manifest.technologyGovernance?.projectTypes.length ?? 0,
       technologies: options.manifest.technologyGovernance?.technologies.length ?? 0
     },
@@ -4205,7 +4354,8 @@ function inspectPortfolioAiHealth(options) {
 }
 function mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) {
   const repositoriesById = /* @__PURE__ */ new Map();
-  for (const repository of existing?.repositories ?? []) repositoriesById.set(repository.id, repository);
+  for (const repository of existing?.repositories ?? [])
+    repositoriesById.set(repository.id, repository);
   for (const repository of latest.repositories) repositoriesById.set(repository.id, repository);
   const repositories = allRepositoryIds.map((id) => repositoriesById.get(id)).filter((repository) => repository !== void 0);
   const coveredIds = /* @__PURE__ */ new Set([
@@ -4216,8 +4366,20 @@ function mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) {
   const summary = { healthy: 0, attention: 0, unhealthy: 0 };
   for (const repository of repositories) summary[repository.status] += 1;
   const complete = coveredRepositoryIds.length === allRepositoryIds.length;
+  const technologyGovernance = (latest.technologyGovernance.catalog?.length ?? 0) > 0 ? {
+    ...latest.technologyGovernance,
+    matrix: buildTechnologyMatrix(
+      {
+        technologies: latest.technologyGovernance.catalog,
+        projectTypes: [],
+        versionPolicy: latest.technologyGovernance.versionPolicy
+      },
+      repositories
+    )
+  } : latest.technologyGovernance;
   return {
     ...latest,
+    technologyGovernance,
     repositories,
     summary,
     coverage: {
@@ -4240,14 +4402,19 @@ function writePortfolioAiHealthReport(report, outDir) {
   const htmlPath = join24(outDir, "index.html");
   writeFileSync7(jsonPath, `${JSON.stringify(report, null, 2)}
 `);
-  writeFileSync7(join24(outDir, "data.js"), `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson(report)};
-`);
+  writeFileSync7(
+    join24(outDir, "data.js"),
+    `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson(report)};
+`
+  );
   return { jsonPath, htmlPath };
 }
 function collectEndpoints(manifest) {
   const result = [];
-  if (manifest.controlPlane) result.push({ endpoint: manifest.controlPlane, role: "control-plane" });
-  if (manifest.executionEngine) result.push({ endpoint: manifest.executionEngine, role: "execution-engine" });
+  if (manifest.controlPlane)
+    result.push({ endpoint: manifest.controlPlane, role: "control-plane" });
+  if (manifest.executionEngine)
+    result.push({ endpoint: manifest.executionEngine, role: "execution-engine" });
   for (const target of manifest.targets) result.push({ endpoint: target, role: "target" });
   const seen = /* @__PURE__ */ new Set();
   return result.filter(({ endpoint }) => {
@@ -4274,56 +4441,156 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
     grokEffective: grokInspection.effectiveMcp,
     grokInspection: grokInspection.inspection
   };
-  const secrets = inspectRepositorySecrets(root, endpoint.id, secretsRoot, git.isRepository, endpoint.environmentPolicy);
+  const secrets = inspectRepositorySecrets(
+    root,
+    endpoint.id,
+    secretsRoot,
+    git.isRepository,
+    endpoint.environmentPolicy
+  );
   const projectModel = inspectProjectModel(root, endpoint, technologyGovernance);
-  const versions = inspectVersionPolicy(root, technologyGovernance?.versionPolicy, endpoint.projectType);
+  const versions = inspectVersionPolicy(
+    root,
+    technologyGovernance?.versionPolicy,
+    endpoint.projectType
+  );
   const verification = inspectProjectVerification(root);
   const redundancy = inspectProjectRedundancy(root, { homeDir });
   const recommendations = [];
   if (!git.isRepository) recommendations.push("\u8BE5\u8DEF\u5F84\u4E0D\u662F Git \u4ED3\u5E93\uFF1B\u786E\u8BA4\u6E05\u5355\u8DEF\u5F84\u662F\u5426\u6B63\u786E\u3002");
-  if (git.unmergedBranches.length > 0) recommendations.push(`\u6709 ${git.unmergedBranches.length} \u6761\u5206\u652F\u5C1A\u672A\u5408\u5165\u5F53\u524D HEAD\uFF1A${git.unmergedBranches.join(", ")}\u3002`);
-  else if (git.branches.length > 1) recommendations.push(`\u6709 ${git.branches.length} \u6761\u672C\u5730\u5206\u652F\uFF0C\u5747\u5DF2\u5408\u5165\u5F53\u524D HEAD\uFF1B\u786E\u8BA4\u65E0\u5176\u4ED6\u5BBF\u4E3B\u5360\u7528\u540E\u53EF\u6E05\u7406\u989D\u5916\u5206\u652F\u3002`);
-  if (git.worktrees.length > 1) recommendations.push(`\u6709 ${git.worktrees.length} \u4E2A worktree\uFF1B\u5B8C\u6210\u5E76\u5408\u5E76\u540E\u518D\u62C6\u9664\u4E34\u65F6 worktree\u3002`);
-  if (git.dirtyPaths.length > 0) recommendations.push(`\u5DE5\u4F5C\u533A\u6709 ${git.dirtyPaths.length} \u4E2A\u53D8\u66F4\u8DEF\u5F84\uFF1B\u5148\u786E\u8BA4\u5F52\u5C5E\uFF0C\u4E0D\u8981\u7531\u5065\u5EB7\u626B\u63CF\u5668\u81EA\u52A8\u6E05\u7406\u3002`);
-  if ((git.ahead ?? 0) > 0) recommendations.push(`\u5F53\u524D\u5206\u652F\u9886\u5148\u4E0A\u6E38 ${git.ahead} \u4E2A\u63D0\u4EA4\uFF1B\u786E\u8BA4\u5DE5\u4F5C\u5B8C\u6210\u540E\u518D\u63A8\u9001\u3002`);
+  if (git.unmergedBranches.length > 0)
+    recommendations.push(
+      `\u6709 ${git.unmergedBranches.length} \u6761\u5206\u652F\u5C1A\u672A\u5408\u5165\u5F53\u524D HEAD\uFF1A${git.unmergedBranches.join(", ")}\u3002`
+    );
+  else if (git.branches.length > 1)
+    recommendations.push(
+      `\u6709 ${git.branches.length} \u6761\u672C\u5730\u5206\u652F\uFF0C\u5747\u5DF2\u5408\u5165\u5F53\u524D HEAD\uFF1B\u786E\u8BA4\u65E0\u5176\u4ED6\u5BBF\u4E3B\u5360\u7528\u540E\u53EF\u6E05\u7406\u989D\u5916\u5206\u652F\u3002`
+    );
+  if (git.worktrees.length > 1)
+    recommendations.push(
+      `\u6709 ${git.worktrees.length} \u4E2A worktree\uFF1B\u5B8C\u6210\u5E76\u5408\u5E76\u540E\u518D\u62C6\u9664\u4E34\u65F6 worktree\u3002`
+    );
+  if (git.dirtyPaths.length > 0)
+    recommendations.push(
+      `\u5DE5\u4F5C\u533A\u6709 ${git.dirtyPaths.length} \u4E2A\u53D8\u66F4\u8DEF\u5F84\uFF1B\u5148\u786E\u8BA4\u5F52\u5C5E\uFF0C\u4E0D\u8981\u7531\u5065\u5EB7\u626B\u63CF\u5668\u81EA\u52A8\u6E05\u7406\u3002`
+    );
+  if ((git.ahead ?? 0) > 0)
+    recommendations.push(`\u5F53\u524D\u5206\u652F\u9886\u5148\u4E0A\u6E38 ${git.ahead} \u4E2A\u63D0\u4EA4\uFF1B\u786E\u8BA4\u5DE5\u4F5C\u5B8C\u6210\u540E\u518D\u63A8\u9001\u3002`);
   if (entries.agents === "missing") recommendations.push("\u7F3A\u5C11 AGENTS.md\uFF1B\u65E0\u6CD5\u53D1\u73B0\u9879\u76EE\u5165\u53E3\u89C4\u5219\u3002");
-  if (entries.agents === "custom") recommendations.push("AGENTS.md \u672A\u8BC6\u522B\u5230 PGS Router \u6807\u8BB0\uFF1B\u68C0\u67E5\u662F\u5426\u5C1A\u672A\u540C\u6B65\u6216\u5DF2\u88AB\u9879\u76EE\u5185\u5BB9\u8986\u76D6\u3002");
-  if (entries.claude === "missing") recommendations.push("\u7F3A\u5C11 CLAUDE.md\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 AGENTS.md\uFF0C\u907F\u514D\u4E24\u4EFD\u5165\u53E3\u6F02\u79FB\u3002");
-  if (entries.claude === "thin-adapter") recommendations.push("CLAUDE.md \u662F\u517C\u5BB9\u9002\u914D\u5668\uFF1B\u53EF\u6539\u4E3A\u76F4\u63A5\u94FE\u63A5 AGENTS.md \u4EE5\u8FDB\u4E00\u6B65\u51CF\u5C11\u7EF4\u62A4\u9762\u3002");
-  if (entries.claude === "custom") recommendations.push("CLAUDE.md \u662F\u72EC\u7ACB\u5165\u53E3\uFF1B\u5BB9\u6613\u4E0E AGENTS.md \u6F02\u79FB\uFF0C\u5EFA\u8BAE\u53EA\u4FDD\u7559\u9879\u76EE\u786E\u9700\u7684\u5BBF\u4E3B\u5DEE\u5F02\u3002");
-  if (entries.claude === "dangling-symlink") recommendations.push("CLAUDE.md \u662F\u65AD\u5F00\u7684\u94FE\u63A5\uFF1B\u9700\u8981\u91CD\u65B0\u6307\u5411 AGENTS.md\u3002");
-  if (entries.gemini === "custom") recommendations.push("GEMINI.md \u662F\u72EC\u7ACB\u5165\u53E3\uFF1B\u82E5\u6CA1\u6709 Gemini \u4E13\u5C5E\u5DEE\u5F02\uFF0C\u5EFA\u8BAE\u94FE\u63A5\u5230 AGENTS.md\u3002");
-  if (entries.gemini === "dangling-symlink") recommendations.push("GEMINI.md \u662F\u65AD\u5F00\u7684\u94FE\u63A5\uFF1B\u9700\u8981\u91CD\u65B0\u6307\u5411 AGENTS.md\u3002");
-  if (skills.canonical.some((skill) => skill.kind === "dangling-symlink")) recommendations.push("`.agents/skills` \u4E2D\u5B58\u5728\u65AD\u5F00\u7684\u6280\u80FD\u94FE\u63A5\u3002");
-  if (skills.claudeCompatibility === "duplicate-directory") recommendations.push("`.claude/skills` \u662F\u72EC\u7ACB\u526F\u672C\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 `.agents/skills`\uFF0C\u907F\u514D\u53CC\u4EFD\u6280\u80FD\u6F02\u79FB\u3002");
-  if (skills.claudeCompatibility === "dangling-symlink") recommendations.push("`.claude/skills` \u662F\u65AD\u5F00\u7684\u94FE\u63A5\u3002");
-  if (!hostSsot.claudeEntry.compliant) recommendations.push(`CLAUDE.md \u4E0D\u662F\u89C4\u8303\u7684\u76F8\u5BF9\u94FE\u63A5 AGENTS.md\uFF08${hostSsot.claudeEntry.status}\uFF09\u3002`);
-  if (!hostSsot.claudeSkills.compliant) recommendations.push(`.claude/skills \u4E0D\u662F\u89C4\u8303\u7684\u76F8\u5BF9\u94FE\u63A5 ../.agents/skills\uFF08${hostSsot.claudeSkills.status}\uFF09\u3002`);
-  if (hostSsot.canonicalSkills.status !== "directory") recommendations.push(`\u7F3A\u5C11\u89C4\u8303\u7684 .agents/skills \u6280\u80FD\u76EE\u5F55\uFF08${hostSsot.canonicalSkills.status}\uFF09\u3002`);
-  if (hasWorkflowReminderHooks(hooks)) recommendations.push("\u53D1\u73B0 Stop/SubagentStop hook\uFF1B\u786E\u8BA4\u5B83\u662F\u5426\u4ECD\u6709\u9879\u76EE\u4E13\u5C5E\u7528\u9014\uFF0C\u5E76\u79FB\u9664\u9000\u4F11\u7684 PGS \u5DE5\u4F5C\u6D41\u63D0\u9192\u3002");
+  if (entries.agents === "custom")
+    recommendations.push(
+      "AGENTS.md \u672A\u8BC6\u522B\u5230 PGS Router \u6807\u8BB0\uFF1B\u68C0\u67E5\u662F\u5426\u5C1A\u672A\u540C\u6B65\u6216\u5DF2\u88AB\u9879\u76EE\u5185\u5BB9\u8986\u76D6\u3002"
+    );
+  if (entries.claude === "missing")
+    recommendations.push("\u7F3A\u5C11 CLAUDE.md\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 AGENTS.md\uFF0C\u907F\u514D\u4E24\u4EFD\u5165\u53E3\u6F02\u79FB\u3002");
+  if (entries.claude === "thin-adapter")
+    recommendations.push("CLAUDE.md \u662F\u517C\u5BB9\u9002\u914D\u5668\uFF1B\u53EF\u6539\u4E3A\u76F4\u63A5\u94FE\u63A5 AGENTS.md \u4EE5\u8FDB\u4E00\u6B65\u51CF\u5C11\u7EF4\u62A4\u9762\u3002");
+  if (entries.claude === "custom")
+    recommendations.push(
+      "CLAUDE.md \u662F\u72EC\u7ACB\u5165\u53E3\uFF1B\u5BB9\u6613\u4E0E AGENTS.md \u6F02\u79FB\uFF0C\u5EFA\u8BAE\u53EA\u4FDD\u7559\u9879\u76EE\u786E\u9700\u7684\u5BBF\u4E3B\u5DEE\u5F02\u3002"
+    );
+  if (entries.claude === "dangling-symlink")
+    recommendations.push("CLAUDE.md \u662F\u65AD\u5F00\u7684\u94FE\u63A5\uFF1B\u9700\u8981\u91CD\u65B0\u6307\u5411 AGENTS.md\u3002");
+  if (entries.gemini === "custom")
+    recommendations.push("GEMINI.md \u662F\u72EC\u7ACB\u5165\u53E3\uFF1B\u82E5\u6CA1\u6709 Gemini \u4E13\u5C5E\u5DEE\u5F02\uFF0C\u5EFA\u8BAE\u94FE\u63A5\u5230 AGENTS.md\u3002");
+  if (entries.gemini === "dangling-symlink")
+    recommendations.push("GEMINI.md \u662F\u65AD\u5F00\u7684\u94FE\u63A5\uFF1B\u9700\u8981\u91CD\u65B0\u6307\u5411 AGENTS.md\u3002");
+  if (skills.canonical.some((skill) => skill.kind === "dangling-symlink"))
+    recommendations.push("`.agents/skills` \u4E2D\u5B58\u5728\u65AD\u5F00\u7684\u6280\u80FD\u94FE\u63A5\u3002");
+  if (skills.claudeCompatibility === "duplicate-directory")
+    recommendations.push(
+      "`.claude/skills` \u662F\u72EC\u7ACB\u526F\u672C\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 `.agents/skills`\uFF0C\u907F\u514D\u53CC\u4EFD\u6280\u80FD\u6F02\u79FB\u3002"
+    );
+  if (skills.claudeCompatibility === "dangling-symlink")
+    recommendations.push("`.claude/skills` \u662F\u65AD\u5F00\u7684\u94FE\u63A5\u3002");
+  if (!hostSsot.claudeEntry.compliant)
+    recommendations.push(
+      `CLAUDE.md \u4E0D\u662F\u89C4\u8303\u7684\u76F8\u5BF9\u94FE\u63A5 AGENTS.md\uFF08${hostSsot.claudeEntry.status}\uFF09\u3002`
+    );
+  if (!hostSsot.claudeSkills.compliant)
+    recommendations.push(
+      `.claude/skills \u4E0D\u662F\u89C4\u8303\u7684\u76F8\u5BF9\u94FE\u63A5 ../.agents/skills\uFF08${hostSsot.claudeSkills.status}\uFF09\u3002`
+    );
+  if (hostSsot.canonicalSkills.status !== "directory")
+    recommendations.push(
+      `\u7F3A\u5C11\u89C4\u8303\u7684 .agents/skills \u6280\u80FD\u76EE\u5F55\uFF08${hostSsot.canonicalSkills.status}\uFF09\u3002`
+    );
+  if (hasWorkflowReminderHooks(hooks))
+    recommendations.push(
+      "\u53D1\u73B0 Stop/SubagentStop hook\uFF1B\u786E\u8BA4\u5B83\u662F\u5426\u4ECD\u6709\u9879\u76EE\u4E13\u5C5E\u7528\u9014\uFF0C\u5E76\u79FB\u9664\u9000\u4F11\u7684 PGS \u5DE5\u4F5C\u6D41\u63D0\u9192\u3002"
+    );
   const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
   const envNeedsCentralReview = liveEnv.filter((file) => !file.localOnly);
-  if (liveEnv.some((file) => file.tracked)) recommendations.push("\u53D1\u73B0\u88AB Git \u8DDF\u8E2A\u7684\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\uFF1B\u5E94\u7ACB\u5373\u786E\u8BA4\u5176\u4E2D\u662F\u5426\u5305\u542B\u51ED\u636E\u5E76\u8FC1\u51FA\u4ED3\u5E93\u3002");
-  if (envNeedsCentralReview.length > 0 && secrets.centralDirectory === "absent") recommendations.push("\u4ED3\u5E93\u6709\u672C\u5730\u73AF\u5883\u6587\u4EF6\uFF0C\u4F46\u4E2D\u592E `.secrets` \u4E2D\u6CA1\u6709\u5BF9\u5E94\u76EE\u5F55\uFF1B\u786E\u8BA4\u662F\u5426\u9700\u8981\u7EB3\u5165\u5206\u5C42\u7BA1\u7406\u3002");
-  else if (envNeedsCentralReview.some((file) => !file.centralized)) recommendations.push("\u53D1\u73B0\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\u5C1A\u672A\u8FDE\u63A5\u5230\u672C\u9879\u76EE\u7684\u4E2D\u592E `.secrets` \u76EE\u5F55\uFF1B\u533A\u5206\u53EF\u4E22\u5F03\u751F\u6210\u7269\u4E0E\u672C\u5730\u4E3B\u6765\u6E90\uFF0C\u9700\u4FDD\u7559\u7684\u6765\u6E90\u5E94\u96C6\u4E2D\u540E\u518D\u63A5\u56DE\u9879\u76EE\u3002");
-  if (hasUnsafeCentralSecretPermissions(secrets)) recommendations.push("\u4E2D\u592E\u5BC6\u94A5\u76EE\u5F55\u6216\u6587\u4EF6\u6743\u9650\u8FC7\u5BBD\uFF1B\u76EE\u5F55\u5E94\u4E3A 0700\uFF0C\u914D\u7F6E\u6587\u4EF6\u5E94\u4E3A 0600\u3002");
-  if (!docs.packages.aligned) recommendations.push(`PGS \u5305\u7248\u672C\u672A\u4E0E\u6267\u884C\u5F15\u64CE ${docs.packages.expected ?? "\u672A\u77E5\u7248\u672C"} \u5BF9\u9F50\uFF1B\u53D1\u5E03\u4E0A\u6E38\u540E\u518D\u540C\u6B65\u76EE\u6807\u4ED3\u5E93\u3002`);
-  if (!docs.routerAligned) recommendations.push(`PGS Router \u7248\u672C\u4E3A ${docs.routerVersion ? `v${docs.routerVersion}` : "\u672A\u8BC6\u522B"}\uFF0C\u5E94\u540C\u6B65\u5230 v${docs.expectedRouterVersion}\u3002`);
-  if (role === "target" && !docs.manifest) recommendations.push("\u7F3A\u5C11 docs/governance/MANIFEST.yml\uFF1B\u6587\u6863\u6E05\u5355\u65E0\u6CD5\u8BC1\u660E\u5DF2\u540C\u6B65\u3002");
-  if (technologyGovernance && !projectModel.projectType) recommendations.push("\u672A\u58F0\u660E\u9879\u76EE\u7C7B\u578B\uFF1B\u65E0\u6CD5\u628A\u5B9E\u9645\u6280\u672F\u4E0E\u4EA7\u54C1\u7EBF\u57FA\u7EBF\u8FDB\u884C\u6BD4\u8F83\u3002");
-  const missingBaseline = projectModel.baseline.filter((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
-  if (missingBaseline.length > 0) recommendations.push(`\u6280\u672F\u57FA\u7EBF\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingBaseline.map((technology) => technology.label).join("\u3001")}\u3002`);
-  const missingSelected = projectModel.optionalCapabilities.filter((technology) => technology.selected && !technology.detected);
-  if (missingSelected.length > 0) recommendations.push(`\u5DF2\u9009\u80FD\u529B\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingSelected.map((technology) => technology.label).join("\u3001")}\u3002`);
-  if (versions.status === "attention") recommendations.push(`\u6280\u672F\u7248\u672C\u7B56\u7565\u6709 ${versions.attentionCount} \u9879\u6F02\u79FB\u6216\u7F3A\u5931\uFF1B\u58F0\u660E\u7248\u672C\u4E0E\u5DF2\u5B89\u88C5\u7248\u672C\u5FC5\u987B\u7CBE\u786E\u5BF9\u9F50\u3002`);
-  if (verification.status === "attention") recommendations.push(`\u9A8C\u8BC1\u811A\u672C\u7F3A\u5931\uFF1A${verification.missing.join("\u3001")}\uFF1BPGS \u8981\u6C42 typecheck\u3001lint\u3001format:check\u3001verify \u53EF\u53D1\u73B0\u3002`);
-  if (redundancy.status === "attention") recommendations.push("\u53D1\u73B0\u65E7 AI \u76EE\u5F55\u6216\u5927\u578B Playwright \u7F13\u5B58\uFF1B\u4EC5\u63D0\u4F9B\u8BC1\u636E\uFF0C\u786E\u8BA4\u5F52\u5C5E\u540E\u518D\u7531\u4EBA\u5DE5\u6E05\u7406\u3002");
+  if (liveEnv.some((file) => file.tracked))
+    recommendations.push("\u53D1\u73B0\u88AB Git \u8DDF\u8E2A\u7684\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\uFF1B\u5E94\u7ACB\u5373\u786E\u8BA4\u5176\u4E2D\u662F\u5426\u5305\u542B\u51ED\u636E\u5E76\u8FC1\u51FA\u4ED3\u5E93\u3002");
+  if (envNeedsCentralReview.length > 0 && secrets.centralDirectory === "absent")
+    recommendations.push(
+      "\u4ED3\u5E93\u6709\u672C\u5730\u73AF\u5883\u6587\u4EF6\uFF0C\u4F46\u4E2D\u592E `.secrets` \u4E2D\u6CA1\u6709\u5BF9\u5E94\u76EE\u5F55\uFF1B\u786E\u8BA4\u662F\u5426\u9700\u8981\u7EB3\u5165\u5206\u5C42\u7BA1\u7406\u3002"
+    );
+  else if (envNeedsCentralReview.some((file) => !file.centralized))
+    recommendations.push(
+      "\u53D1\u73B0\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\u5C1A\u672A\u8FDE\u63A5\u5230\u672C\u9879\u76EE\u7684\u4E2D\u592E `.secrets` \u76EE\u5F55\uFF1B\u533A\u5206\u53EF\u4E22\u5F03\u751F\u6210\u7269\u4E0E\u672C\u5730\u4E3B\u6765\u6E90\uFF0C\u9700\u4FDD\u7559\u7684\u6765\u6E90\u5E94\u96C6\u4E2D\u540E\u518D\u63A5\u56DE\u9879\u76EE\u3002"
+    );
+  if (hasUnsafeCentralSecretPermissions(secrets))
+    recommendations.push("\u4E2D\u592E\u5BC6\u94A5\u76EE\u5F55\u6216\u6587\u4EF6\u6743\u9650\u8FC7\u5BBD\uFF1B\u76EE\u5F55\u5E94\u4E3A 0700\uFF0C\u914D\u7F6E\u6587\u4EF6\u5E94\u4E3A 0600\u3002");
+  if (!docs.packages.aligned)
+    recommendations.push(
+      `PGS \u5305\u7248\u672C\u672A\u4E0E\u6267\u884C\u5F15\u64CE ${docs.packages.expected ?? "\u672A\u77E5\u7248\u672C"} \u5BF9\u9F50\uFF1B\u53D1\u5E03\u4E0A\u6E38\u540E\u518D\u540C\u6B65\u76EE\u6807\u4ED3\u5E93\u3002`
+    );
+  if (!docs.routerAligned)
+    recommendations.push(
+      `PGS Router \u7248\u672C\u4E3A ${docs.routerVersion ? `v${docs.routerVersion}` : "\u672A\u8BC6\u522B"}\uFF0C\u5E94\u540C\u6B65\u5230 v${docs.expectedRouterVersion}\u3002`
+    );
+  if (role === "target" && !docs.manifest)
+    recommendations.push("\u7F3A\u5C11 docs/governance/MANIFEST.yml\uFF1B\u6587\u6863\u6E05\u5355\u65E0\u6CD5\u8BC1\u660E\u5DF2\u540C\u6B65\u3002");
+  if (technologyGovernance && !projectModel.projectType)
+    recommendations.push("\u672A\u58F0\u660E\u9879\u76EE\u7C7B\u578B\uFF1B\u65E0\u6CD5\u628A\u5B9E\u9645\u6280\u672F\u4E0E\u4EA7\u54C1\u7EBF\u57FA\u7EBF\u8FDB\u884C\u6BD4\u8F83\u3002");
+  const missingBaseline = projectModel.baseline.filter(
+    (technology) => !technology.detected && !hasBaselineException(projectModel, technology.id)
+  );
+  if (missingBaseline.length > 0)
+    recommendations.push(
+      `\u6280\u672F\u57FA\u7EBF\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingBaseline.map((technology) => technology.label).join("\u3001")}\u3002`
+    );
+  const missingSelected = projectModel.optionalCapabilities.filter(
+    (technology) => technology.selected && !technology.detected
+  );
+  if (missingSelected.length > 0)
+    recommendations.push(
+      `\u5DF2\u9009\u80FD\u529B\u7F3A\u5C11\u53EF\u9A8C\u8BC1\u4FE1\u53F7\uFF1A${missingSelected.map((technology) => technology.label).join("\u3001")}\u3002`
+    );
+  if (versions.status === "attention")
+    recommendations.push(
+      `\u6280\u672F\u7248\u672C\u7B56\u7565\u6709 ${versions.attentionCount} \u9879\u6F02\u79FB\u6216\u7F3A\u5931\uFF1B\u58F0\u660E\u7248\u672C\u4E0E\u5DF2\u5B89\u88C5\u7248\u672C\u5FC5\u987B\u7CBE\u786E\u5BF9\u9F50\u3002`
+    );
+  if (verification.status === "attention")
+    recommendations.push(
+      `\u9A8C\u8BC1\u811A\u672C\u7F3A\u5931\uFF1A${verification.missing.join("\u3001")}\uFF1BPGS \u8981\u6C42 typecheck\u3001lint\u3001format:check\u3001verify \u53EF\u53D1\u73B0\u3002`
+    );
+  if (redundancy.status === "attention")
+    recommendations.push(
+      "\u53D1\u73B0\u65E7 AI \u76EE\u5F55\u6216\u5927\u578B Playwright \u7F13\u5B58\uFF1B\u4EC5\u63D0\u4F9B\u8BC1\u636E\uFF0C\u786E\u8BA4\u5F52\u5C5E\u540E\u518D\u7531\u4EBA\u5DE5\u6E05\u7406\u3002"
+    );
   return {
     id: endpoint.id,
     role,
     path: root,
     profile: "profile" in endpoint ? endpoint.profile : void 0,
-    status: deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, Boolean(technologyGovernance), versions, verification, redundancy),
+    status: deriveStatus(
+      role,
+      entries,
+      git,
+      hooks,
+      skills,
+      hostSsot,
+      secrets,
+      docs,
+      projectModel,
+      Boolean(technologyGovernance),
+      versions,
+      verification,
+      redundancy
+    ),
     recommendations,
     git,
     entries,
@@ -4339,22 +4606,161 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
     redundancy
   };
 }
+function buildTechnologyMatrix(governance, repositories) {
+  if (!governance) return [];
+  const policy = governance.versionPolicy;
+  return governance.technologies.map((technology) => {
+    const projects = repositories.flatMap((repository) => {
+      const packageManifests = collectPackageManifests(repository.path);
+      const packageSignals = (technology.packages ?? []).map((name) => {
+        const requirement = policy?.packages.find((item) => item.name === name);
+        return packageManifests.map((manifest) => {
+          const declared = findDeclaredVersion(manifest.packageJson, name);
+          return declared === void 0 ? void 0 : {
+            name,
+            source: manifest.path,
+            declared,
+            installed: readInstalledVersion(repository.path, name, manifest.directory),
+            expected: requirement?.version
+          };
+        }).filter((item) => item !== void 0);
+      }).flat();
+      const fileSignal = (technology.files ?? []).some(
+        (path) => hasUsableTechnologyFile(join24(repository.path, path)) || packageManifests.some(
+          (manifest) => hasUsableTechnologyFile(join24(manifest.directory, path))
+        )
+      );
+      const modelSignal = [
+        ...repository.projectModel.baseline,
+        ...repository.projectModel.optionalCapabilities
+      ].find((item) => item.id === technology.id)?.detected ?? false;
+      const runtimeRequirement2 = policy?.runtimes?.find(
+        (item) => item.name === technology.id || technology.id === "deno-edge" && item.name === "deno"
+      );
+      const runtimeEvidence = runtimeRequirement2 ? repository.versions.runtimes.find((item) => item.name === runtimeRequirement2.name) : void 0;
+      const uses = modelSignal || fileSignal || packageSignals.length > 0;
+      if (!uses) return [];
+      const packageStatuses = packageSignals.map(
+        (item) => item.expected === void 0 ? "unversioned" : item.declared !== item.expected ? "drift" : item.installed === void 0 ? "unknown" : item.installed !== item.expected ? "drift" : "aligned"
+      );
+      const statuses = runtimeEvidence ? [
+        ...packageStatuses,
+        runtimeEvidence.status === "compliant" ? "aligned" : runtimeEvidence.status === "not-applicable" ? "unknown" : "drift"
+      ] : packageStatuses;
+      const status2 = statuses.includes("drift") ? "drift" : statuses.includes("unversioned") ? "unversioned" : statuses.includes("unknown") || statuses.length === 0 ? "unknown" : "aligned";
+      const values = {
+        sources: [...new Set(packageSignals.map((item) => item.source))],
+        packages: [...new Set(packageSignals.map((item) => item.name))],
+        declared: [
+          ...new Set(
+            packageSignals.flatMap(
+              (item) => item.declared ? [`${item.name}@${item.declared}`] : []
+            )
+          )
+        ],
+        installed: [
+          ...new Set(
+            packageSignals.flatMap(
+              (item) => item.installed ? [`${item.name}@${item.installed}`] : []
+            )
+          )
+        ],
+        expected: [
+          ...new Set(
+            packageSignals.flatMap(
+              (item) => item.expected ? [`${item.name}@${item.expected}`] : []
+            )
+          )
+        ]
+      };
+      if (runtimeEvidence && runtimeRequirement2) {
+        values.expected.push(`${runtimeRequirement2.name}@${runtimeRequirement2.version}`);
+        if (runtimeEvidence.actual)
+          values.installed.push(`${runtimeRequirement2.name}@${runtimeEvidence.actual}`);
+      }
+      return [
+        {
+          repositoryId: repository.id,
+          sources: values.sources,
+          packages: values.packages,
+          declared: values.declared.length ? values.declared.join(" \xB7 ") : void 0,
+          installed: values.installed.length ? values.installed.join(" \xB7 ") : void 0,
+          expected: values.expected.length ? values.expected.join(" \xB7 ") : void 0,
+          status: status2
+        }
+      ];
+    });
+    const expected = /* @__PURE__ */ new Set();
+    for (const requirement of policy?.packages ?? []) {
+      if ((technology.packages ?? []).includes(requirement.name))
+        expected.add(`${requirement.name}@${requirement.version}`);
+    }
+    const runtimeRequirement = policy?.runtimes?.find(
+      (item) => item.name === technology.id || technology.id === "deno-edge" && item.name === "deno"
+    );
+    if (runtimeRequirement)
+      expected.add(`${runtimeRequirement.name}@${runtimeRequirement.version}`);
+    for (const project of projects) {
+      for (const value of project.expected?.split(" \xB7 ") ?? []) expected.add(value);
+    }
+    const status = projects.some(
+      (project) => project.status === "drift"
+    ) ? "drift" : projects.some((project) => project.status === "unversioned") ? "unversioned" : projects.some((project) => project.status === "unknown") ? "unknown" : projects.length ? "aligned" : "not-applicable";
+    return {
+      id: technology.id,
+      label: technology.label,
+      packages: technology.packages ?? [],
+      expected: [...expected],
+      projectCount: projects.length,
+      status,
+      projects
+    };
+  }).filter((technology) => technology.projectCount > 0);
+}
+function hasUsableTechnologyFile(path) {
+  if (!existsSync23(path)) return false;
+  try {
+    const info = statSync5(path);
+    if (info.isFile()) return true;
+    if (!info.isDirectory()) return false;
+    return readdirSync10(path, { withFileTypes: true }).some((entry) => {
+      if (entry.name.startsWith(".")) return false;
+      const child = join24(path, entry.name);
+      if (entry.isDirectory()) return hasUsableTechnologyFile(child);
+      return entry.name.toLowerCase() !== "readme.md";
+    });
+  } catch {
+    return false;
+  }
+}
 function deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, technologyGovernanceConfigured, versions, verification, redundancy) {
-  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets)) return "unhealthy";
-  const missingBaseline = projectModel.baseline.some((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
-  const missingSelected = projectModel.optionalCapabilities.some((technology) => technology.selected && !technology.detected);
+  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets))
+    return "unhealthy";
+  const missingBaseline = projectModel.baseline.some(
+    (technology) => !technology.detected && !hasBaselineException(projectModel, technology.id)
+  );
+  const missingSelected = projectModel.optionalCapabilities.some(
+    (technology) => technology.selected && !technology.detected
+  );
   const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
-  const secretMaterializationNeedsReview = liveEnv.some((file) => !file.centralized && !file.localOnly);
+  const secretMaterializationNeedsReview = liveEnv.some(
+    (file) => !file.centralized && !file.localOnly
+  );
   const packageVersionNeedsReview = docs.packages.expected !== void 0 && !docs.packages.aligned;
   const routerVersionNeedsReview = !docs.routerAligned;
   const targetManifestMissing = role === "target" && !docs.manifest;
-  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || !hostSsot.compliant || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || routerVersionNeedsReview || targetManifestMissing || versions.status === "attention" || verification.status === "attention" || redundancy.legacyDirectories.length > 0) return "attention";
+  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || !hostSsot.compliant || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || routerVersionNeedsReview || targetManifestMissing || versions.status === "attention" || verification.status === "attention" || redundancy.legacyDirectories.length > 0)
+    return "attention";
   return "healthy";
 }
 function inspectProjectModel(root, endpoint, governance) {
-  const projectType = governance?.projectTypes.find((candidate) => candidate.id === endpoint.projectType);
+  const projectType = governance?.projectTypes.find(
+    (candidate) => candidate.id === endpoint.projectType
+  );
   const packages = collectPackageNames(root);
-  const technologyById = new Map((governance?.technologies ?? []).map((technology) => [technology.id, technology]));
+  const technologyById = new Map(
+    (governance?.technologies ?? []).map((technology) => [technology.id, technology])
+  );
   const detection = (id) => {
     const technology = technologyById.get(id);
     const packageMatch = technology?.packages?.some((name) => packages.has(name)) ?? false;
@@ -4366,7 +4772,10 @@ function inspectProjectModel(root, endpoint, governance) {
     projectType: projectType ? { id: projectType.id, title: projectType.title, summary: projectType.summary } : void 0,
     boundary: endpoint.boundary,
     baseline: (projectType?.baseline ?? []).map(detection),
-    optionalCapabilities: (projectType?.optionalCapabilities ?? []).map((id) => ({ ...detection(id), selected: selected.has(id) })),
+    optionalCapabilities: (projectType?.optionalCapabilities ?? []).map((id) => ({
+      ...detection(id),
+      selected: selected.has(id)
+    })),
     exceptions: endpoint.technologyExceptions ?? []
   };
 }
@@ -4377,16 +4786,14 @@ function hasBaselineException(projectModel, technologyId) {
 }
 function collectPackageNames(root) {
   const names = /* @__PURE__ */ new Set();
-  let files = [];
-  try {
-    files = splitLines(execFileSync("git", ["ls-files", "*package.json"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }));
-  } catch {
-    if (existsSync23(join24(root, "package.json"))) files = ["package.json"];
-  }
-  for (const file of files) {
-    const packageJson = readJson4(join24(root, file));
+  for (const { packageJson } of collectPackageManifests(root)) {
     if (!isRecord3(packageJson)) continue;
-    for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+    for (const section of [
+      "dependencies",
+      "devDependencies",
+      "peerDependencies",
+      "optionalDependencies"
+    ]) {
       const dependencies = packageJson[section];
       if (!isRecord3(dependencies)) continue;
       for (const name of Object.keys(dependencies)) names.add(name);
@@ -4395,17 +4802,31 @@ function collectPackageNames(root) {
   return names;
 }
 function hasWorkflowReminderHooks(hooks) {
-  return hooks.some((hook) => hook.events.some((event) => event.name === "Stop" || event.name === "SubagentStop"));
+  return hooks.some(
+    (hook) => hook.events.some((event) => event.name === "Stop" || event.name === "SubagentStop")
+  );
 }
 function inspectGit2(root) {
   const git = (...args) => {
     try {
-      return execFileSync("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trimEnd();
+      return execFileSync("git", args, {
+        cwd: root,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"]
+      }).trimEnd();
     } catch {
       return void 0;
     }
   };
-  if (git("rev-parse", "--is-inside-work-tree") !== "true") return { isRepository: false, branches: [], mergedBranches: [], unmergedBranches: [], worktrees: [], dirtyPaths: [] };
+  if (git("rev-parse", "--is-inside-work-tree") !== "true")
+    return {
+      isRepository: false,
+      branches: [],
+      mergedBranches: [],
+      unmergedBranches: [],
+      worktrees: [],
+      dirtyPaths: []
+    };
   const status = git("status", "--porcelain=v1", "-uall") ?? "";
   const worktreeText = git("worktree", "list", "--porcelain") ?? "";
   const upstreamCounts = git("rev-list", "--left-right", "--count", "@{upstream}...HEAD")?.split(/\s+/).map(Number);
@@ -4413,8 +4834,12 @@ function inspectGit2(root) {
     isRepository: true,
     branch: git("branch", "--show-current") || "(detached)",
     branches: splitLines(git("for-each-ref", "--format=%(refname:short)", "refs/heads")),
-    mergedBranches: splitLines(git("for-each-ref", "--merged=HEAD", "--format=%(refname:short)", "refs/heads")),
-    unmergedBranches: splitLines(git("for-each-ref", "--no-merged=HEAD", "--format=%(refname:short)", "refs/heads")),
+    mergedBranches: splitLines(
+      git("for-each-ref", "--merged=HEAD", "--format=%(refname:short)", "refs/heads")
+    ),
+    unmergedBranches: splitLines(
+      git("for-each-ref", "--no-merged=HEAD", "--format=%(refname:short)", "refs/heads")
+    ),
     worktrees: splitLines(worktreeText).filter((line) => line.startsWith("worktree ")).map((line) => line.slice(9)),
     dirtyPaths: splitLines(status).map((line) => line.slice(3)),
     behind: upstreamCounts?.[0],
@@ -4540,14 +4965,29 @@ function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environme
     repositoryEnvFiles: envFiles
   };
 }
-var SKIP_ENV_DIRECTORIES = /* @__PURE__ */ new Set([".git", ".next", ".nuxt", ".output", ".turbo", ".vercel", ".worktrees", "build", "coverage", "dist", "node_modules", "out", "target"]);
+var SKIP_ENV_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".git",
+  ".next",
+  ".nuxt",
+  ".output",
+  ".turbo",
+  ".vercel",
+  ".worktrees",
+  "build",
+  "coverage",
+  "dist",
+  "node_modules",
+  "out",
+  "target"
+]);
 function collectEnvironmentFiles(root, current = root, depth = 0) {
   if (depth > 5) return [];
   const found = [];
   try {
-    for (const entry of readdirSync9(current, { withFileTypes: true })) {
+    for (const entry of readdirSync10(current, { withFileTypes: true })) {
       if (entry.isDirectory()) {
-        if (!SKIP_ENV_DIRECTORIES.has(entry.name)) found.push(...collectEnvironmentFiles(root, join24(current, entry.name), depth + 1));
+        if (!SKIP_ENV_DIRECTORIES.has(entry.name))
+          found.push(...collectEnvironmentFiles(root, join24(current, entry.name), depth + 1));
       } else if (isEnvironmentFilename(entry.name) && !isProviderGeneratedEnvironmentFile(entry.name)) {
         found.push(relative8(root, join24(current, entry.name)));
       }
@@ -4561,7 +5001,7 @@ function collectCentralSecretFiles(root, current = root, depth = 0) {
   if (depth > 3) return [];
   const found = [];
   try {
-    for (const entry of readdirSync9(current, { withFileTypes: true })) {
+    for (const entry of readdirSync10(current, { withFileTypes: true })) {
       const path = join24(current, entry.name);
       if (entry.isDirectory()) found.push(...collectCentralSecretFiles(root, path, depth + 1));
       else found.push({ path: relative8(root, path), mode: modeString(lstatSync8(path).mode) });
@@ -4647,17 +5087,25 @@ function inspectDevSpaceHealth(options) {
   const authPath = join24(configDirectory, "auth.json");
   const installedResult = run("devspace", ["--version"], 3e3);
   const installedVersion = installedResult.ok ? installedResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
-  const latestResult = run("npm", ["view", "@waishnav/devspace", "version", "--registry=https://registry.npmjs.org/"], 5e3);
+  const latestResult = run(
+    "npm",
+    ["view", "@waishnav/devspace", "version", "--registry=https://registry.npmjs.org/"],
+    5e3
+  );
   const latestVersion = latestResult.ok ? latestResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
   const processResult = run("pgrep", ["-f", "devspace serve"], 3e3);
   const pid = processResult.ok ? processResult.stdout.match(/\b\d+\b/)?.[0] : void 0;
   const processEnvironment = pid ? run("ps", ["eww", "-p", pid, "-o", "command="], 3e3) : void 0;
-  const processToolMode = processEnvironment?.ok ? processEnvironment.stdout.match(/(?:^|\s)DEVSPACE_TOOL_MODE=(minimal|full|codex)(?:\s|$)/)?.[1] : void 0;
+  const processToolMode = processEnvironment?.ok ? processEnvironment.stdout.match(
+    /(?:^|\s)DEVSPACE_TOOL_MODE=(minimal|full|codex)(?:\s|$)/
+  )?.[1] : void 0;
   const doctor = !installedResult.ok ? "unavailable" : run("devspace", ["doctor"], 1e4).ok ? "ok" : "failed";
   const configValue = readJson4(configPath);
   const configExists = isRecord3(configValue);
   const allowedRoots = configExists && Array.isArray(configValue.allowedRoots) ? configValue.allowedRoots.filter((value) => typeof value === "string") : [];
-  const portfolioCoverage = !configExists || allowedRoots.length === 0 ? "unknown" : options.repositoryPaths.every((repositoryPath) => allowedRoots.some((root) => isPathInside(repositoryPath, root))) ? "complete" : "partial";
+  const portfolioCoverage = !configExists || allowedRoots.length === 0 ? "unknown" : options.repositoryPaths.every(
+    (repositoryPath) => allowedRoots.some((root) => isPathInside(repositoryPath, root))
+  ) ? "complete" : "partial";
   const bind = configExists && typeof configValue.host === "string" ? isLoopbackHost(configValue.host) ? "loopback" : "non-loopback" : "unknown";
   const directoryMode = existsSync23(configDirectory) ? modeString(statSync5(configDirectory).mode) : void 0;
   const fileMode = existsSync23(configPath) ? modeString(statSync5(configPath).mode) : void 0;
@@ -4676,17 +5124,24 @@ function inspectDevSpaceHealth(options) {
   if (!installedResult.ok) unhealthy("\u672C\u673A\u672A\u53D1\u73B0 DevSpace\uFF1B\u65E0\u6CD5\u4F7F\u7528\u5BBF\u4E3B\u5DE5\u4F5C\u533A\u670D\u52A1\u3002");
   if (!configExists) unhealthy("\u7F3A\u5C11 ~/.devspace/config.json\u3002");
   if (!existsSync23(authPath)) unhealthy("\u7F3A\u5C11 ~/.devspace/auth.json\u3002");
-  if (directoryMode && directoryMode !== "700") unhealthy(`~/.devspace \u76EE\u5F55\u6743\u9650\u4E3A ${directoryMode}\uFF0C\u5E94\u6536\u7D27\u4E3A 700\u3002`);
+  if (directoryMode && directoryMode !== "700")
+    unhealthy(`~/.devspace \u76EE\u5F55\u6743\u9650\u4E3A ${directoryMode}\uFF0C\u5E94\u6536\u7D27\u4E3A 700\u3002`);
   if (fileMode && fileMode !== "600") unhealthy(`DevSpace \u914D\u7F6E\u6587\u4EF6\u6743\u9650\u4E3A ${fileMode}\uFF0C\u5E94\u4E3A 600\u3002`);
   if (authMode && authMode !== "600") unhealthy(`DevSpace \u8BA4\u8BC1\u6587\u4EF6\u6743\u9650\u4E3A ${authMode}\uFF0C\u5E94\u4E3A 600\u3002`);
-  if (bind === "non-loopback") unhealthy("DevSpace \u76F4\u63A5\u7ED1\u5B9A\u5230\u975E\u672C\u673A\u5730\u5740\uFF1B\u5E94\u4F7F\u7528 loopback \u5E76\u7531\u53D7\u63A7\u4EE3\u7406\u66B4\u9732\u3002");
+  if (bind === "non-loopback")
+    unhealthy("DevSpace \u76F4\u63A5\u7ED1\u5B9A\u5230\u975E\u672C\u673A\u5730\u5740\uFF1B\u5E94\u4F7F\u7528 loopback \u5E76\u7531\u53D7\u63A7\u4EE3\u7406\u66B4\u9732\u3002");
   if (doctor === "failed") unhealthy("devspace doctor \u672A\u901A\u8FC7\u3002");
   if (portfolioCoverage === "partial") attention("DevSpace allowedRoots \u6CA1\u6709\u8986\u76D6\u5168\u90E8\u5DF2\u767B\u8BB0\u4ED3\u5E93\u3002");
   if (installedResult.ok && !pid) attention("DevSpace \u5DF2\u5B89\u88C5\u4F46\u5F53\u524D\u6CA1\u6709\u8FD0\u884C\u3002");
   if (options.expectedToolMode && pid && processToolMode !== options.expectedToolMode) {
-    attention(`\u8FD0\u884C\u4E2D\u7684 DevSpace \u5DE5\u5177\u6A21\u5F0F\u4E3A ${processToolMode ?? "unknown"}\uFF0C\u671F\u671B ${options.expectedToolMode}\u3002`);
+    attention(
+      `\u8FD0\u884C\u4E2D\u7684 DevSpace \u5DE5\u5177\u6A21\u5F0F\u4E3A ${processToolMode ?? "unknown"}\uFF0C\u671F\u671B ${options.expectedToolMode}\u3002`
+    );
   }
-  if (update === "available") attention(`DevSpace \u6709\u65B0\u7248\u672C\uFF1A${installedVersion} \u2192 ${latestVersion}\uFF1B\u5347\u7EA7\u524D\u4ECD\u5E94\u68C0\u67E5\u53D8\u66F4\u4E0E\u517C\u5BB9\u6027\u3002`);
+  if (update === "available")
+    attention(
+      `DevSpace \u6709\u65B0\u7248\u672C\uFF1A${installedVersion} \u2192 ${latestVersion}\uFF1B\u5347\u7EA7\u524D\u4ECD\u5E94\u68C0\u67E5\u53D8\u66F4\u4E0E\u517C\u5BB9\u6027\u3002`
+    );
   return {
     status,
     installed: installedResult.ok,
@@ -4735,18 +5190,25 @@ function isPathInside(path, root) {
 }
 function inspectSkillRoot(path) {
   const exists = pathLexists(path) && safeIsDirectory(path);
-  const names = exists ? safeReadDir(path).filter((name) => !name.startsWith(".") && existsSync23(join24(path, name, "SKILL.md"))) : [];
+  const names = exists ? safeReadDir(path).filter(
+    (name) => !name.startsWith(".") && existsSync23(join24(path, name, "SKILL.md"))
+  ) : [];
   return { path, exists, names };
 }
 function claudeProjectLocalMcpNames(homeDir, root) {
   if (!homeDir) return [];
   const value = readJson4(join24(homeDir, ".claude.json"));
   if (!isRecord3(value) || !isRecord3(value.projects)) return [];
-  const candidates = new Set([resolve5(root), safeRealpath(root)].filter((path) => Boolean(path)));
+  const candidates = new Set(
+    [resolve5(root), safeRealpath(root)].filter((path) => Boolean(path))
+  );
   const names = /* @__PURE__ */ new Set();
   for (const [path, project] of Object.entries(value.projects)) {
-    const projectPaths = [resolve5(path), safeRealpath(path)].filter((candidate) => Boolean(candidate));
-    if (!projectPaths.some((candidate) => candidates.has(candidate)) || !isRecord3(project) || !isRecord3(project.mcpServers)) continue;
+    const projectPaths = [resolve5(path), safeRealpath(path)].filter(
+      (candidate) => Boolean(candidate)
+    );
+    if (!projectPaths.some((candidate) => candidates.has(candidate)) || !isRecord3(project) || !isRecord3(project.mcpServers))
+      continue;
     for (const name of Object.keys(project.mcpServers)) names.add(name);
   }
   return [...names].sort();
@@ -4773,14 +5235,16 @@ function inspectGrokProject(root, homeDir, grokVersion) {
   });
   if (!grokVersion) return empty("unavailable");
   try {
-    const value = JSON.parse(execFileSync("grok", ["inspect", "--json"], {
-      cwd: root,
-      encoding: "utf8",
-      env: { ...process.env, HOME: homeDir, GROK_HOME: join24(homeDir, ".grok") },
-      maxBuffer: 10 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 8e3
-    }));
+    const value = JSON.parse(
+      execFileSync("grok", ["inspect", "--json"], {
+        cwd: root,
+        encoding: "utf8",
+        env: { ...process.env, HOME: homeDir, GROK_HOME: join24(homeDir, ".grok") },
+        maxBuffer: 10 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 8e3
+      })
+    );
     if (!isRecord3(value)) return empty("failed");
     const userClaudeNames = new Set(jsonObjectKeys(join24(homeDir, ".claude.json"), "mcpServers"));
     const localClaudeNames = new Set(claudeProjectLocalMcpNames(homeDir, root));
@@ -4790,13 +5254,23 @@ function inspectGrokProject(root, homeDir, grokVersion) {
       const sourceType = typeof source.type === "string" ? source.type : "unknown";
       const sourcePath = typeof source.path === "string" ? source.path : void 0;
       const vendor = typeof item.vendor === "string" ? item.vendor : sourceType;
-      return [{
-        name: item.name,
-        vendor,
-        scope: inferGrokMcpScope(item.name, sourceType, sourcePath, root, homeDir, userClaudeNames, localClaudeNames),
-        sourceType,
-        ...sourcePath ? { sourcePath } : {}
-      }];
+      return [
+        {
+          name: item.name,
+          vendor,
+          scope: inferGrokMcpScope(
+            item.name,
+            sourceType,
+            sourcePath,
+            root,
+            homeDir,
+            userClaudeNames,
+            localClaudeNames
+          ),
+          sourceType,
+          ...sourcePath ? { sourcePath } : {}
+        }
+      ];
     }) : [];
     const skillCounts = { project: 0, userOrCompatible: 0, plugin: 0, bundled: 0 };
     if (Array.isArray(value.skills)) {
@@ -4804,7 +5278,8 @@ function inspectGrokProject(root, homeDir, grokVersion) {
         if (!isRecord3(item) || !isRecord3(item.source)) continue;
         const type = item.source.type;
         const path = item.source.path;
-        if (typeof path === "string" && path.includes(sep + ".grok" + sep + "bundled" + sep)) skillCounts.bundled += 1;
+        if (typeof path === "string" && path.includes(sep + ".grok" + sep + "bundled" + sep))
+          skillCounts.bundled += 1;
         else if (type === "project") skillCounts.project += 1;
         else if (type === "plugin") skillCounts.plugin += 1;
         else skillCounts.userOrCompatible += 1;
@@ -4944,12 +5419,20 @@ function inspectSkillRegistry(executionEngineRoot) {
     if (!isRecord3(bundle) || !Array.isArray(bundle.assets)) continue;
     for (const id of bundle.assets) if (typeof id === "string") bundledIds.add(id);
   }
-  const sourceRoots = [join24(agentAssetsRoot, "skills/pie-skills"), join24(agentAssetsRoot, "skills/npx-skills/.agents/skills")];
-  const source = sourceRoots.reduce((count, root) => count + safeReadDir(root).filter((name) => existsSync23(join24(root, name, "SKILL.md"))).length, 0);
+  const sourceRoots = [
+    join24(agentAssetsRoot, "skills/pie-skills"),
+    join24(agentAssetsRoot, "skills/npx-skills/.agents/skills")
+  ];
+  const source = sourceRoots.reduce(
+    (count, root) => count + safeReadDir(root).filter((name) => existsSync23(join24(root, name, "SKILL.md"))).length,
+    0
+  );
   return {
     source,
     registered: registeredSkills.length,
-    bundled: registeredSkills.filter((asset) => isRecord3(asset) && typeof asset.id === "string" && bundledIds.has(asset.id)).length,
+    bundled: registeredSkills.filter(
+      (asset) => isRecord3(asset) && typeof asset.id === "string" && bundledIds.has(asset.id)
+    ).length,
     bundles: bundleFiles.length
   };
 }
@@ -4962,7 +5445,7 @@ function tomlMcpNames(path) {
   if (!existsSync23(path)) return [];
   const names = /* @__PURE__ */ new Set();
   for (const line of safeRead(path).split(/\r?\n/)) {
-    const match = line.match(/^\s*\[mcp_servers\.(?:"([^"]+)"|([^\.\]]+))\]\s*$/);
+    const match = line.match(/^\s*\[mcp_servers\.(?:"([^"]+)"|([^.\]]+))\]\s*$/);
     const name = match?.[1] ?? match?.[2];
     if (name) names.add(name);
   }
@@ -4984,7 +5467,7 @@ function safeRead(path) {
 }
 function safeReadDir(path) {
   try {
-    return readdirSync9(path).sort();
+    return readdirSync10(path).sort();
   } catch {
     return [];
   }
@@ -5006,7 +5489,10 @@ function pathLexists(path) {
 }
 function gitTracks(root, path) {
   try {
-    execFileSync("git", ["ls-files", "--error-unmatch", "--", path], { cwd: root, stdio: "ignore" });
+    execFileSync("git", ["ls-files", "--error-unmatch", "--", path], {
+      cwd: root,
+      stdio: "ignore"
+    });
     return true;
   } catch {
     return false;
@@ -5025,7 +5511,7 @@ function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function findDashboardAssets() {
-  const packageRoot2 = dirname13(dirname13(fileURLToPath4(import.meta.url)));
+  const packageRoot2 = dirname14(dirname14(fileURLToPath4(import.meta.url)));
   const candidates = [
     process.env.PGS_DASHBOARD_ASSETS_DIR,
     join24(packageRoot2, ".dashboard-build"),
@@ -5036,7 +5522,10 @@ function findDashboardAssets() {
     join24(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
   ].filter((value) => Boolean(value));
   const match = candidates.find((path) => existsSync23(join24(path, "index.html")));
-  if (!match) throw new Error("Portfolio dashboard assets were not built. Run pnpm --filter @pieai/pro-gov build.");
+  if (!match)
+    throw new Error(
+      "Portfolio dashboard assets were not built. Run pnpm --filter @pieai/pro-gov build."
+    );
   return match;
 }
 function safeJavaScriptJson(value) {