@pugi/cli 0.1.0-beta.16 → 0.1.0-beta.18

package/dist/runtime/cli.js

@@ -1,13 +1,11 @@
-import { createHash, randomUUID } from 'node:crypto';
+import { randomUUID } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { statSync } from 'node:fs';
 import { dirname, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { AnvilEngineLoopClient } from '../core/engine/anvil-client.js';
-import { NoopEngineAdapter } from '../core/engine/noop.js';
 import { NativePugiEngineAdapter } from '../core/engine/native-pugi.js';
-import { decidePermission } from '../core/permission.js';
 import { loadMcpRegistry } from '../core/mcp/registry.js';
 import { loadHookRegistryOrExit } from './load-hooks-or-exit.js';
 import { defaultNonInteractiveMcpPrompt } from '../tools/mcp-tool.js';
@@ -16,7 +14,6 @@ import { loadSettings } from '../core/settings.js';
 import { FileReadCache } from '../core/file-cache.js';
 import { resolveWorkspacePath } from '../core/path-security.js';
 import { globTool, grepTool, readTool } from '../tools/file-tools.js';
-import { toolRegistry, toolSchemaBundleHashInput } from '../tools/registry.js';
 import { webFetchTool } from '../tools/web-fetch.js';
 import { emptyIndex, rebuildIndex, readIndex, upsertArtifact, writeIndex, } from '../core/index-store.js';
 import { signatureForPlanReview } from '../core/repl/ask.js';
@@ -29,6 +26,8 @@ import { runDeployCommand } from '../commands/deploy.js';
 import { runJobsCommand } from '../commands/jobs.js';
 import { runConfigCommand } from './commands/config.js';
 import { runPrivacyCommand } from './commands/privacy.js';
+import { runReport } from './commands/report.js';
+import { runDoctorCommand, defaultHome as defaultDoctorHome } from './commands/doctor.js';
 import { runUndoCommand } from './commands/undo.js';
 import { runBudgetCommand } from './commands/budget.js';
 import { runSkillsCommand } from './commands/skills.js';
@@ -90,6 +89,10 @@ const handlers = {
     plan: runEngineTask('plan'),
     'plan-review': dispatchPlanReview,
     privacy: dispatchPrivacy,
+    // PAVF-7 (2026-05-27): `pugi report --from-error` captures the
+    // most-recent failed session as a redacted bundle so operators can
+    // file clean bug reports without manual log-grepping.
+    report: dispatchReport,
     review,
     resume,
     roster: dispatchRoster,
@@ -271,6 +274,25 @@ async function dispatchPrivacy(args, flags, _session) {
         writeOutput: (payload, text) => writeOutput(flags, payload, text),
     });
 }
+/**
+ * PAVF-7 (2026-05-27): `pugi report --from-error` — bundle the most-
+ * recent failed session into a redacted local report so operators can
+ * file clean bug tickets without manual log-grepping. v1 is local-only
+ * (no auto-upload — see commands/report.ts header for the rationale).
+ */
+async function dispatchReport(args, flags, _session) {
+    const rc = runReport(args, {
+        cwd: process.cwd(),
+        json: flags.json,
+        emit: (line) => {
+            if (!flags.json)
+                process.stdout.write(line);
+        },
+        writeOutput: (payload, text) => writeOutput(flags, payload, text),
+    });
+    if (rc !== 0)
+        process.exitCode = rc;
+}
 /**
  * `pugi roster` - α7.5 Phase 1.
  *
@@ -973,6 +995,16 @@ const COMMAND_HELP_BODIES = {
         'event log, settings), permission mode, and the capability matrix per',
         'engine adapter. Safe to run anywhere; no network calls.',
     ],
+    report: [
+        'pugi report — capture a bug report from the most-recent session.',
+        '',
+        '  --from-error            Bundle the most-recent failed session as a',
+        '                          redacted local report (default + only mode in v1).',
+        '',
+        'Output: writes .pugi/reports/<timestamp>-<session-id>/{report.json, report.md}.',
+        'Secrets (bearer tokens, JWTs, named env values) are stripped before disk write.',
+        'Auto-upload to api.pugi.io planned for a follow-up; v1 keeps everything local.',
+    ],
     ask: [
         'pugi ask "<question>" — surface a yes/no question modal locally.',
         '',
@@ -1077,61 +1109,29 @@ async function help(args, flags, _session) {
         'Execution defaults to local. Use --remote or --web to create a handoff bundle.',
     ].join('\n'));
 }
+/**
+ * `pugi doctor` — Leak L17 (2026-05-27). Delegates to the diagnostics
+ * probe runner in `runtime/commands/doctor.ts`. The handler stays
+ * thin so the probe surface stays single-sourced between the CLI
+ * shell command, the `pnpm run doctor --json` package script, and
+ * the in-REPL `/doctor` slash command.
+ *
+ * Exit codes are set by `runDoctorCommand` (0 = healthy/warnings,
+ * 2 = at least one error probe). The pre-L17 minimal doctor surface
+ * (adapter capabilities + schema bundle hash) is preserved under
+ * `payload.meta.legacy` so any operator scripts that grep the JSON
+ * keep working through the transition; the field is marked for
+ * removal in a follow-up sprint once the new shape is the
+ * documented contract.
+ */
 async function doctor(_args, flags, _session) {
-    const cwd = process.cwd();
-    const settings = loadSettings(cwd);
-    // `doctor` reports adapter capabilities only; we pass a no-op client
-    // so we do not require an Anvil endpoint to run `pugi doctor`. The
-    // adapter never invokes `client.send()` from inside `capabilities()`.
-    const inertClient = {
-        async send() {
-            return {
-                stop: 'error',
-                code: 'failed',
-                message: 'doctor: inert client',
-            };
-        },
-    };
-    const adapters = [
-        new NoopEngineAdapter(),
-        new NativePugiEngineAdapter({ client: inertClient }),
-    ];
-    const capabilities = await Promise.all(adapters.map(async (adapter) => ({
-        name: adapter.name,
-        capabilities: await adapter.capabilities(),
-    })));
-    const payload = {
-        cliVersion: PUGI_CLI_VERSION,
-        nodeVersion: process.version,
-        workspaceRoot: cwd,
-        pugiMode: existsSync(resolve(cwd, 'CLAUDE.md')),
-        pugiDir: existsSync(resolve(cwd, '.pugi')),
-        eventLog: existsSync(resolve(cwd, '.pugi/events.jsonl')),
-        permissionMode: settings.permissions.mode,
-        approvals: settings.workflow.approvals,
-        notAutomatic: [...settings.workflow.notAutomatic, ...settings.permissions.notAutomatic],
-        protectedFileCheck: decidePermission({ tool: 'doctor', kind: 'edit', target: '.env' }, settings, cwd),
-        protectedFileSafety: 'configured-in-m1',
-        mcpTrust: 'not-configured',
-        releaseGuard: 'scaffolded',
-        tools: toolRegistry,
-        engineAdapters: capabilities,
-        schemaBundleHash: createHash('sha256')
-            .update(toolSchemaBundleHashInput())
-            .digest('hex'),
-    };
-    writeOutput(flags, payload, [
-        'Pugi doctor',
-        `CLI: ${payload.cliVersion}`,
-        `Node: ${payload.nodeVersion}`,
-        `Workspace: ${payload.workspaceRoot}`,
-        `Pugi mode: ${payload.pugiMode ? 'detected' : 'not detected'}`,
-        `Pugi dir: ${payload.pugiDir ? 'present' : 'missing'}`,
-        `Event log: ${payload.eventLog ? 'present' : 'missing'}`,
-        `Permission mode: ${payload.permissionMode}`,
-        `Approvals: ${payload.approvals}`,
-        `Release guard: ${payload.releaseGuard}`,
-    ].join('\n'));
+    await runDoctorCommand({
+        cwd: process.cwd(),
+        home: defaultDoctorHome(),
+        env: process.env,
+        json: flags.json,
+        writeOutput: (payload, text) => writeOutput(flags, payload, text),
+    });
 }
 /**
  * Programmatic init scaffolder. Idempotent — every helper call is a
@@ -2140,12 +2140,45 @@ async function performTripleProviderReview(root, session, flags, prompt) {
             `Refusing to submit an empty diff for review.`);
     }
     const resolvedCommit = safeGit(root, ['rev-parse', '--short', commitRef]).trim() || commitRef;
-    const mergeBase = safeGit(root, ['merge-base', baseRef, commitRef]).trim() || '';
+    // merge-base is intentionally a PROBE: an empty result is a valid
+    // signal (orphan branch, shallow clone, moved tag) that the dispatch
+    // path handles by falling back к range-notation. Use the legacy
+    // `safeGit` (probe semantics) explicitly rather than the strict
+    // variant.
+    const mergeBase = safeGitProbe(root, ['merge-base', baseRef, commitRef]).trim() || '';
+    // 2026-05-27 (Claude review followup #489): when merge-base returns empty
+    // (orphan branch, shallow clone, moved tag), we MUST NOT pass the
+    // `<range> <commitRef>` two-arg form to `git diff` — that combo is
+    // invalid syntax, git exits 129, `safeGit` swallows the error, and the
+    // diff payload ships empty. An empty diff is then classified as
+    // `'code'` server-side, dispatched to reviewers who emit a trivial
+    // `VERDICT: PASS` over zero lines — a SILENT GREEN REVIEW on a commit
+    // nobody actually examined. Branch on `mergeBase` так что:
+    //   - mergeBase present  → `git diff <mergeBase> <commitRef> --`
+    //     (both endpoints explicit, only-uncommitted-against-base ignored
+    //     because commitRef is a SHA, not HEAD).
+    //   - mergeBase empty    → `git diff <baseRef>..<commitRef> --`
+    //     (range form encodes both endpoints; do NOT append commitRef
+    //     again or git rejects the args).
     const diffRange = mergeBase || `${baseRef}..${commitRef}`;
-    const diffArgs = ['diff', diffRange, commitRef, '--', '.', ...PROTECTED_DIFF_EXCLUDES];
-    const diffStatArgs = ['diff', '--shortstat', diffRange, commitRef, '--', '.', ...PROTECTED_DIFF_EXCLUDES];
-    const diffPatch = safeGit(root, diffArgs);
-    const diffStats = parseDiffStats(safeGit(root, diffStatArgs));
+    const diffArgs = mergeBase
+        ? ['diff', mergeBase, commitRef, '--', '.', ...PROTECTED_DIFF_EXCLUDES]
+        : ['diff', diffRange, '--', '.', ...PROTECTED_DIFF_EXCLUDES];
+    const diffStatArgs = mergeBase
+        ? ['diff', '--shortstat', mergeBase, commitRef, '--', '.', ...PROTECTED_DIFF_EXCLUDES]
+        : ['diff', '--shortstat', diffRange, '--', '.', ...PROTECTED_DIFF_EXCLUDES];
+    // Use the strict variant — a non-empty diffPatch is load-bearing for
+    // the review gate. If git fails for ANY reason (bad ref, ENOBUFS, FS
+    // permission), we'd rather surface a hard error than ship a green
+    // review on nothing. The `--shortstat` companion uses the same
+    // helper so the throw is symmetric.
+    const diffPatch = safeGitRequired(root, diffArgs, 'triple-providers diff');
+    const diffStats = parseDiffStats(safeGitRequired(root, diffStatArgs, 'triple-providers diff --shortstat'));
+    if (diffPatch.trim() === '') {
+        throw new Error(`pugi review --triple: empty diff between '${baseRef}' and '${commitRef}'. ` +
+            `Refusing to dispatch a review for zero changes — check the refs ` +
+            `or commit your changes before running.`);
+    }
     const requestBody = pugiTripleReviewRequestSchema.parse({
         schema: 1,
         workspace: {
@@ -5039,7 +5072,31 @@ function fileBytes(path) {
         return 0;
     }
 }
-function safeGit(root, args) {
+/**
+ * Git invocation helpers — probe vs required semantics.
+ *
+ * 2026-05-27 (Claude review followup #489): the historical `safeGit`
+ * collapsed BOTH "tell me the branch name if you can" probes AND
+ * "give me the diff or fail" hard requirements into a single helper
+ * that swallowed every error as an empty string. That's the correct
+ * shape for the probe case (branch / status / dirty flag — empty
+ * result is a valid signal) but catastrophically wrong for the diff
+ * case (empty result === false PASS on a commit nobody reviewed).
+ *
+ * The split:
+ *   - `safeGitProbe`  — best-effort. Returns '' on any error. Use for
+ *     branch name lookups, status probes, opt-in dirty detection.
+ *   - `safeGitRequired` — throws on non-zero exit / ENOBUFS / bad ref.
+ *     Use for diff, merge-base resolution, anything whose empty
+ *     output would silently corrupt downstream behaviour.
+ *
+ * Legacy `safeGit` is kept as a deprecated alias of `safeGitProbe`
+ * so existing call-sites (branch detection, status, etc.) keep their
+ * tolerant semantics until they are individually migrated. Diff /
+ * merge-base / rev-parse-verify call-sites are migrated к
+ * `safeGitRequired` in this same patch.
+ */
+export function safeGitProbe(root, args) {
     try {
         return execFileSync('git', args, {
             cwd: root,
@@ -5057,6 +5114,38 @@ function safeGit(root, args) {
         return '';
     }
 }
+/**
+ * Strict variant — throws on non-zero exit, ENOBUFS, or any git-side
+ * failure. The thrown error carries the operation context so the
+ * caller (triple-review dispatch, etc.) can fail loud rather than
+ * ship an empty diff to a remote reviewer.
+ */
+export function safeGitRequired(root, args, context) {
+    try {
+        return execFileSync('git', args, {
+            cwd: root,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            maxBuffer: 64 * 1024 * 1024,
+        });
+    }
+    catch (err) {
+        const cause = err instanceof Error ? err.message : String(err);
+        throw new Error(`git ${args.slice(0, 2).join(' ')} failed (${context}): ${cause}. ` +
+            `Refusing to proceed — empty git output here would corrupt downstream behaviour.`);
+    }
+}
+/**
+ * Deprecated alias preserved for diff / status / branch probes that
+ * legitimately want a tolerant empty-string-on-error shape. New call
+ * sites should pick `safeGitProbe` or `safeGitRequired` explicitly.
+ *
+ * @deprecated 2026-05-27 — prefer `safeGitProbe` (tolerant) or
+ * `safeGitRequired` (strict, throws).
+ */
+function safeGit(root, args) {
+    return safeGitProbe(root, args);
+}
 /**
  * Glob patterns excluded from triple-review `diffPatch` before egress.
  *

package/dist/runtime/commands/doctor.js

@@ -0,0 +1,357 @@
+/**
+ * `pugi doctor` — environment health report (Leak L17, 2026-05-27).
+ *
+ * Parity command with Claude Code's `/doctor` (gap doc:
+ * docs/research/2026-05-27-pugi-gap-analysis-3-repos.md §6). Probes
+ * auth, API reachability, CLI version, workspace state, disk space,
+ * Node version, pnpm, git, MCP servers, config file, and session
+ * activity. Emits either a human-readable table OR a structured JSON
+ * envelope depending on `--json`.
+ *
+ * Module contract:
+ *
+ *   - This file owns the WIRING from CLI flags + workspace context to
+ *     the probe runner. The probes themselves live in
+ *     `core/diagnostics/probes/*.ts` and have NO module-level coupling
+ *     to the CLI dispatch surface.
+ *
+ *   - `runDoctorCommand` is the single entry point. Both the top-level
+ *     `pugi doctor` handler in `runtime/cli.ts` AND the in-REPL
+ *     `/doctor` slash command call it. The function returns the
+ *     `DoctorReport` so the REPL can render via the Ink table without
+ *     re-running the probes.
+ *
+ *   - Exit codes are derived from `exitCodeFor(overall)` in
+ *     `core/diagnostics/types.ts` and bubble up via `process.exitCode`
+ *     (matches the convention of every other CLI handler in cli.ts).
+ *
+ *   - The MCP probe is opportunistic: if `core/mcp/registry.js` is
+ *     unavailable for any reason (e.g. sibling L13 not yet landed,
+ *     unexpected schema change), the probe degrades to a graceful
+ *     `skipped` result so the rest of the table still renders.
+ */
+import { execFileSync } from 'node:child_process';
+import { constants as fsConstants, existsSync, accessSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { resolveActiveCredential } from '../../core/credentials.js';
+import { PUGI_CLI_VERSION } from '../version.js';
+import { runProbes, } from '../../core/diagnostics/probe-runner.js';
+import { computeOverall, countProbes, exitCodeFor, } from '../../core/diagnostics/types.js';
+import { probeAuth } from '../../core/diagnostics/probes/auth.js';
+import { probeApi } from '../../core/diagnostics/probes/api.js';
+import { probeCliVersion } from '../../core/diagnostics/probes/cli-version.js';
+import { probeWorkspace } from '../../core/diagnostics/probes/workspace.js';
+import { probeDisk } from '../../core/diagnostics/probes/disk.js';
+import { probeNode } from '../../core/diagnostics/probes/node.js';
+import { probePnpm } from '../../core/diagnostics/probes/pnpm.js';
+import { probeGit } from '../../core/diagnostics/probes/git.js';
+import { probeMcp } from '../../core/diagnostics/probes/mcp.js';
+import { probeConfig } from '../../core/diagnostics/probes/config.js';
+import { probeSession } from '../../core/diagnostics/probes/session.js';
+/**
+ * Default API URL when no PUGI_API_URL env override is set. Mirrors
+ * the constant in `core/credentials.ts` (kept local to avoid an
+ * extra named export from that module).
+ */
+const DEFAULT_API_URL = 'https://api.pugi.io';
+/**
+ * Build the standard probe set with production dependencies. Exported
+ * for the spec so the test can construct the same suite with stub
+ * deps + assert per-probe ordering + fail-isolation in isolation.
+ */
+export function buildDefaultProbes(ctx, options = {}) {
+    const fetchImpl = ctx.fetchImpl ?? globalThis.fetch.bind(globalThis);
+    const now = Date.now;
+    const probes = [
+        {
+            name: 'AUTH',
+            run: () => probeAuth(ctx, {
+                resolveCredential: (env, home) => {
+                    const credential = resolveActiveCredential(env, home);
+                    if (!credential)
+                        return null;
+                    return { apiUrl: credential.apiUrl, apiKey: credential.apiKey };
+                },
+                fetchImpl,
+                now,
+            }),
+            timeoutMs: 4_000,
+        },
+        {
+            name: 'API',
+            run: () => probeApi(ctx, {
+                resolveApiUrl: (env) => {
+                    return env.PUGI_API_URL ?? DEFAULT_API_URL;
+                },
+                fetchImpl,
+                now,
+            }),
+            timeoutMs: 4_000,
+        },
+        {
+            name: 'CLI VERSION',
+            run: () => probeCliVersion({
+                localVersion: options.localCliVersion ?? PUGI_CLI_VERSION,
+                fetchImpl,
+                now,
+            }),
+            timeoutMs: 4_000,
+        },
+        {
+            name: 'WORKSPACE',
+            run: async () => probeWorkspace(ctx, {
+                existsSync,
+                statSync,
+                accessSync,
+                W_OK: fsConstants.W_OK,
+            }),
+        },
+        {
+            name: 'DISK',
+            run: async () => probeDisk(ctx, {
+                getFreeBytes: (home) => getFreeBytesViaDf(home),
+            }),
+        },
+        {
+            name: 'NODE',
+            run: async () => probeNode({ version: process.version }),
+        },
+        {
+            name: 'PNPM',
+            run: async () => probePnpm({
+                resolveVersion: () => execFileSync('pnpm', ['--version'], {
+                    encoding: 'utf8',
+                    timeout: 2_000,
+                    stdio: ['ignore', 'pipe', 'ignore'],
+                }).trim(),
+            }),
+        },
+        {
+            name: 'GIT',
+            run: async () => probeGit(ctx, {
+                resolveVersion: () => execFileSync('git', ['--version'], {
+                    encoding: 'utf8',
+                    timeout: 2_000,
+                    stdio: ['ignore', 'pipe', 'ignore'],
+                }).trim(),
+                isInWorkTree: (cwd) => {
+                    try {
+                        const result = execFileSync('git', ['-C', cwd, 'rev-parse', '--is-inside-work-tree'], {
+                            encoding: 'utf8',
+                            timeout: 2_000,
+                            stdio: ['ignore', 'pipe', 'ignore'],
+                        }).trim();
+                        return result === 'true';
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                resolveHeadSha: (cwd) => {
+                    try {
+                        return execFileSync('git', ['-C', cwd, 'rev-parse', 'HEAD'], {
+                            encoding: 'utf8',
+                            timeout: 2_000,
+                            stdio: ['ignore', 'pipe', 'ignore'],
+                        }).trim();
+                    }
+                    catch {
+                        return null;
+                    }
+                },
+                resolveRoot: (cwd) => {
+                    try {
+                        return execFileSync('git', ['-C', cwd, 'rev-parse', '--show-toplevel'], {
+                            encoding: 'utf8',
+                            timeout: 2_000,
+                            stdio: ['ignore', 'pipe', 'ignore'],
+                        }).trim();
+                    }
+                    catch {
+                        return null;
+                    }
+                },
+            }),
+        },
+        {
+            name: 'MCP SERVERS',
+            run: async () => probeMcpSafely(ctx),
+        },
+        {
+            name: 'CONFIG',
+            run: async () => probeConfig(ctx, {
+                existsSync,
+                readFileSync: (p, encoding) => readFileSync(p, encoding),
+            }),
+        },
+        {
+            name: 'SESSION',
+            run: async () => probeSession(ctx, {
+                existsSync,
+                statSync,
+                readFileSync: (p, encoding) => readFileSync(p, encoding),
+            }, {
+                now,
+                ...(options.liveSessionId ? { liveSessionId: options.liveSessionId } : {}),
+            }),
+        },
+    ];
+    return probes;
+}
+/**
+ * Run the full doctor sweep + emit the output via the supplied
+ * writeOutput sink. Returns the report so REPL callers can route it
+ * к the Ink renderer instead of the plain-text fallback.
+ */
+export async function runDoctorCommand(ctx) {
+    const probeCtx = {
+        cwd: ctx.cwd,
+        home: ctx.home,
+        env: ctx.env,
+    };
+    const probes = buildDefaultProbes(probeCtx, {
+        ...(ctx.liveSessionId ? { liveSessionId: ctx.liveSessionId } : {}),
+    });
+    const report = await runProbes(probes);
+    // Defensive recompute: even though runProbes already computed the
+    // overall + counts, recomputing here documents the invariant for the
+    // reader and gives the JSON envelope a single source of truth.
+    const overall = computeOverall(report.probes);
+    const counts = countProbes(report.probes);
+    const envelope = {
+        command: 'doctor',
+        overall,
+        counts,
+        durationMs: report.durationMs,
+        probes: report.probes,
+        meta: {
+            cliVersion: PUGI_CLI_VERSION,
+            nodeVersion: process.version,
+            cwd: ctx.cwd,
+        },
+    };
+    const text = renderDoctorTable(envelope);
+    ctx.writeOutput(envelope, text);
+    process.exitCode = exitCodeFor(overall);
+    return { ...report, overall, counts };
+}
+/**
+ * Plain-text table renderer. Mirrors the layout from the leak-parity
+ * spec but is intentionally column-light (3 columns: NAME / STATUS /
+ * DETAIL) so it composes well in narrow terminals without dragging
+ * a layout library into the CLI hot path. The Ink TUI renderer in
+ * `tui/doctor-table.tsx` is the colour-aware variant used inside the
+ * REPL.
+ */
+export function renderDoctorTable(envelope) {
+    const NAME_WIDTH = Math.max('NAME'.length, ...envelope.probes.map((row) => row.name.length));
+    const STATUS_WIDTH = Math.max('STATUS'.length, ...envelope.probes.map((row) => row.status.length));
+    const lines = [];
+    lines.push('Pugi Doctor — environment health report');
+    lines.push('='.repeat(50));
+    lines.push('');
+    for (const row of envelope.probes) {
+        const namePart = row.name.padEnd(NAME_WIDTH, ' ');
+        const statusPart = row.status.toUpperCase().padEnd(STATUS_WIDTH, ' ');
+        const latencyPart = typeof row.latencyMs === 'number' ? ` (${row.latencyMs}ms)` : '';
+        lines.push(`${namePart}  ${statusPart}  ${row.detail}${latencyPart}`);
+        if (row.remediation && (row.status === 'warn' || row.status === 'error')) {
+            lines.push(`${' '.repeat(NAME_WIDTH + STATUS_WIDTH + 4)}→ ${row.remediation}`);
+        }
+    }
+    lines.push('');
+    const { ok, warn, error: errorCount, skipped } = envelope.counts;
+    const summary = envelope.overall === 'healthy'
+        ? 'HEALTHY'
+        : envelope.overall === 'warning'
+            ? 'WARNINGS'
+            : 'ERRORS';
+    lines.push(`${errorCount} error(s), ${warn} warning(s), ${ok} ok, ${skipped} skipped. Overall: ${summary}`);
+    lines.push(`CLI ${envelope.meta.cliVersion}  Node ${envelope.meta.nodeVersion}  cwd ${envelope.meta.cwd}`);
+    return lines.join('\n');
+}
+/**
+ * Wrap the MCP probe in a dynamic import + try/catch so a missing
+ * sibling L13 surface (or a schema mismatch in `core/mcp/registry`)
+ * degrades the row к `skipped` instead of breaking the entire sweep.
+ * The probe-runner already isolates throws into `error` rows; this
+ * wrapper additionally distinguishes "feature not available" from
+ * "feature crashed".
+ */
+async function probeMcpSafely(ctx) {
+    try {
+        const mod = await import('../../core/mcp/registry.js');
+        if (typeof mod.loadMcpRegistry !== 'function') {
+            return {
+                name: 'MCP SERVERS',
+                status: 'skipped',
+                detail: 'MCP integration not exported by this build',
+            };
+        }
+        return await probeMcp(ctx, {
+            loadRegistry: (cwd, options) => mod.loadMcpRegistry(cwd, { connect: options.connect ?? false }),
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            name: 'MCP SERVERS',
+            status: 'skipped',
+            detail: 'MCP integration not available',
+            remediation: `Inspection failed: ${message}`,
+        };
+    }
+}
+/**
+ * Best-effort free-bytes lookup via `df -k <home>`. Parses the second
+ * line (header + one data row) and returns the `Available` column ×
+ * 1024. Throws on parse failure so the probe surfaces a `warn`
+ * instead of a misleading 0-bytes-free verdict.
+ *
+ * Exported for the spec so we can drive it through a stubbed
+ * execFileSync without spawning a real subprocess.
+ */
+export function getFreeBytesViaDf(home) {
+    const out = execFileSync('df', ['-k', home], {
+        encoding: 'utf8',
+        timeout: 2_000,
+        stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    return parseDfOutput(out);
+}
+/**
+ * Parse the textual output of `df -k`. Handles both BSD and GNU
+ * variants — both emit a `Available` column at index 3 of the data
+ * row, with one quirk: long device names wrap к the next line on
+ * GNU, so we collapse whitespace + tab newlines first.
+ */
+export function parseDfOutput(out) {
+    // Collapse multi-line device-name wraps into a single logical row.
+    const collapsed = out.replace(/\n\s+/g, ' ');
+    const lines = collapsed
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    if (lines.length < 2) {
+        throw new Error(`df output too short: ${JSON.stringify(out.slice(0, 64))}`);
+    }
+    const data = lines[1].split(/\s+/);
+    // Schema: Filesystem 1K-blocks Used Available Capacity Mounted-on
+    const availableField = data[3];
+    if (!availableField) {
+        throw new Error(`df output missing Available column: ${JSON.stringify(lines[1])}`);
+    }
+    const value = Number(availableField);
+    if (!Number.isFinite(value) || value < 0) {
+        throw new Error(`df Available column not numeric: ${availableField}`);
+    }
+    return value * 1024;
+}
+/**
+ * Default home dir resolver. Centralised so the CLI handler can call
+ * `runDoctorCommand` without re-importing `os.homedir` everywhere.
+ */
+export function defaultHome() {
+    return homedir();
+}
+//# sourceMappingURL=doctor.js.map