@sebastienrousseau/dotfiles 0.2.520 → 0.2.521

package/scripts/diagnostics/doctor.sh

@@ -1,797 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0 OR MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-## Dotfiles Doctor.
-##
-## Diagnoses dotfiles environment health by checking dependencies, paths,
-## and configuration integrity. Reports errors, warnings, and suggests
-## remediation steps.
-##
-## # Usage
-## dot doctor
-##
-## # Exit Codes
-## - 0: All checks passed (may have warnings)
-## - 1: Critical errors detected
-##
-## # Idempotency
-## Safe to run repeatedly. Read-only checks.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-# shellcheck source=../../lib/dot/platform.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/platform.sh"
-# shellcheck source=../../lib/dot/log.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/log.sh"
-export DOT_COMMAND="doctor"
-
-ui_init
-
-# Extend PATH to include common non-standard install locations
-export PATH="$HOME/.atuin/bin:$HOME/.local/bin:$PATH"
-
-Errors=0
-Warnings=0
-AI_DEBUG=0
-
-for arg in "$@"; do
-  case "$arg" in
-    --ai) AI_DEBUG=1 ;;
-  esac
-done
-
-# --- Output helpers (delegate to shared ui.sh) ---
-_ok() { ui_ok "$1" "${2:-}"; }
-_fail() {
-  ui_err "$1" "${2:-}"
-  Errors=$((Errors + 1))
-}
-_warn() {
-  ui_warn "$1" "${2:-}"
-  Warnings=$((Warnings + 1))
-}
-_section() {
-  echo ""
-  ui_section "$1"
-}
-
-pretty_path() {
-  local value="${1:-}"
-  if [[ -n "$value" ]]; then
-    printf '%s' "${value/#$HOME/\~}"
-  fi
-}
-
-tool_source() {
-  local path="${1:-}"
-  if [[ "$path" == "$HOME/.local/share/mise/"* ]]; then
-    echo "mise"
-  elif [[ "$path" == /usr/bin/* || "$path" == /bin/* || "$path" == /usr/sbin/* || "$path" == /sbin/* ]]; then
-    echo "system"
-  else
-    echo "custom"
-  fi
-}
-
-check_cmd() {
-  local cmd="$1"
-  if command -v "$cmd" &>/dev/null; then return 0; fi
-  if command -v mise &>/dev/null; then
-    if mise ls --installed 2>/dev/null | grep -qE "($cmd|aqua:.*$cmd)"; then
-      return 0
-    fi
-  fi
-  return 1
-}
-
-get_cmd_path() {
-  local cmd="$1"
-  if command -v "$cmd" &>/dev/null; then
-    command -v "$cmd"
-  elif command -v mise &>/dev/null; then
-    local bin_path
-    bin_path=$(mise bin-paths 2>/dev/null | grep -E "/$cmd(/|$)" | head -n 1)
-    if [ -n "$bin_path" ]; then
-      echo "$bin_path/$cmd"
-    else
-      echo "$cmd"
-    fi
-  else
-    echo "$cmd"
-  fi
-}
-
-# --- Header ---
-ui_header "Dotfiles Doctor"
-
-# --- Core Shells ---
-_section "Core Shells"
-for cmd in zsh fish starship; do
-  if check_cmd "$cmd"; then
-    cmd_path="$(get_cmd_path "$cmd")"
-    _ok "$cmd" "$(pretty_path "$cmd_path") ($(tool_source "$cmd_path"))"
-  elif [[ "$cmd" == "fish" ]]; then
-    _warn "$cmd" "optional"
-  else
-    _fail "$cmd" "missing"
-  fi
-done
-
-if check_cmd "nu"; then
-  cmd_path="$(get_cmd_path "nu")"
-  _ok "nu" "$(pretty_path "$cmd_path") ($(tool_source "$cmd_path"))"
-elif check_cmd "nushell"; then
-  cmd_path="$(get_cmd_path "nushell")"
-  _ok "nu" "$(pretty_path "$cmd_path") ($(tool_source "$cmd_path"))"
-else
-  _warn "nu" "optional"
-fi
-
-# --- Modern CLI Tools ---
-_section "Modern CLI Tools"
-for cmd in rg bat chezmoi fzf zoxide atuin yazi zellij; do
-  if check_cmd "$cmd"; then
-    _ok "$cmd" "$(pretty_path "$(get_cmd_path "$cmd")")"
-  elif [[ "$cmd" == "bat" ]] && check_cmd "batcat"; then
-    _ok "$cmd" "$(pretty_path "$(get_cmd_path "batcat")") (batcat)"
-  else
-    _fail "$cmd" "missing"
-  fi
-done
-
-# --- Infrastructure ---
-_section "Infrastructure"
-for cmd in pueue wasmtime nix sops age hyperfine; do
-  if check_cmd "$cmd"; then
-    _ok "$cmd" "$(pretty_path "$(get_cmd_path "$cmd")")"
-  elif [[ "$cmd" == "nix" ]]; then
-    _ok "$cmd" "optional (not installed)"
-  else
-    _fail "$cmd" "missing"
-  fi
-done
-
-if check_cmd pueue; then
-  if "$(get_cmd_path pueue)" status >/dev/null 2>&1; then
-    _ok "pueue daemon" "running"
-  elif command -v pueued >/dev/null 2>&1 && pueued -d >/dev/null 2>&1 && "$(get_cmd_path pueue)" status >/dev/null 2>&1; then
-    _ok "pueue daemon" "started"
-  else
-    _warn "pueue daemon" "not running (pueued -d)"
-  fi
-fi
-
-# --- AI CLIs ---
-_section "AI CLIs"
-for cmd in codex claude copilot kimi agy sgpt ollama opencode aider kiro-cli; do
-  if check_cmd "$cmd"; then
-    _ok "$cmd" "$(pretty_path "$(get_cmd_path "$cmd")")"
-  else
-    ui_info "$cmd" "optional (not installed)"
-  fi
-done
-
-# --- Environment ---
-_section "Environment"
-if [[ -n "${XDG_CONFIG_HOME:-}" ]]; then
-  _ok "XDG_CONFIG_HOME" "$(pretty_path "$XDG_CONFIG_HOME")"
-else
-  _warn "XDG_CONFIG_HOME" "defaulting to ~/.config"
-fi
-
-# Validate XDG paths are absolute
-for var in XDG_CONFIG_HOME XDG_DATA_HOME XDG_CACHE_HOME XDG_STATE_HOME; do
-  val="${!var:-}"
-  if [[ -n "$val" ]] && [[ "$val" != /* ]]; then
-    _warn "$var" "not absolute: $val"
-  fi
-done
-
-if [[ -n "${PIPX_HOME:-}" ]]; then
-  _ok "PIPX_HOME" "$(pretty_path "$PIPX_HOME")"
-else
-  _warn "PIPX_HOME" "not set"
-fi
-
-# --- Platform ---
-_section "Platform"
-
-platform_id="$(dot_platform_id)"
-_os_name="$(uname -s)"
-_kernel="$(uname -sr)"
-_arch="$(uname -m)"
-_user="$(whoami 2>/dev/null || echo "${USER:-unknown}")"
-_hostname_val="$(hostname -s 2>/dev/null || hostname 2>/dev/null || echo "unknown")"
-
-# Shell version
-_shell_name="${SHELL##*/}"
-_shell_ver="$("$SHELL" --version 2>&1 | head -1 | grep -oE '[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1 || true)"
-_shell="${_shell_name}${_shell_ver:+ $_shell_ver}"
-
-# Terminal
-_terminal="${TERM_PROGRAM:-${TERM:-unknown}}"
-
-# Uptime (portable)
-if uptime -p >/dev/null 2>&1; then
-  _uptime="$(uptime -p 2>/dev/null | sed 's/^up //')"
-else
-  _uptime="$(uptime 2>/dev/null | sed -E 's/^.* up ([^,]+(, [^,]+){0,2}), [0-9]+ users?.*$/\1/' || true)"
-fi
-
-# --- OS-specific detection ---
-_os="" _host="" _cpu="" _cpu_cores="" _gpu="" _mem="" _resolution="" _packages="" _de=""
-os_release_file="${DOT_DOCTOR_OS_RELEASE:-/etc/os-release}"
-proc_root="${DOT_DOCTOR_PROC_ROOT:-/proc}"
-sys_root="${DOT_DOCTOR_SYS_ROOT:-/sys}"
-
-if [[ "$_os_name" == "Darwin" ]]; then
-  # macOS
-  _os="macOS $(sw_vers -productVersion 2>/dev/null || echo "unknown")"
-  _host="$(/usr/sbin/system_profiler SPHardwareDataType 2>/dev/null | awk -F': ' '/Model Name/{print $2}' || sysctl -n hw.model 2>/dev/null || echo "Mac")"
-  _cpu="$(sysctl -n machdep.cpu.brand_string 2>/dev/null || echo "$_arch")"
-  _cpu_cores="$(sysctl -n hw.ncpu 2>/dev/null || echo "?")"
-  _gpu="$(system_profiler SPDisplaysDataType 2>/dev/null | awk -F': ' '/Chipset Model|Chip/{print $2; exit}' || echo "n/a")"
-  _mem_total="$(sysctl -n hw.memsize 2>/dev/null || echo 0)"
-  _mem_total_gb="$(awk "BEGIN{printf \"%.2f\", ${_mem_total}/1073741824}")"
-  _mem_pages="$(vm_stat 2>/dev/null | awk '/Pages active/{gsub(/\./,"",$3); print $3}')"
-  _mem_used_gb="$(awk "BEGIN{printf \"%.2f\", ${_mem_pages:-0}*4096/1073741824}")"
-  _mem="${_mem_used_gb} GiB / ${_mem_total_gb} GiB"
-  _resolution="$(system_profiler SPDisplaysDataType 2>/dev/null | awk '/Resolution/{gsub(/^ +/,""); print; exit}' | sed 's/Resolution: //' || echo "n/a")"
-  _packages="$(brew list --formula 2>/dev/null | wc -l | tr -d ' ') (brew)"
-  _de="Aqua"
-
-elif [[ -r "$os_release_file" ]]; then
-  # Linux (Debian, Ubuntu, Arch, Fedora, RHEL, etc.)
-  # shellcheck disable=SC1091
-  . "$os_release_file"
-  _os="${PRETTY_NAME:-$ID}"
-
-  _host="$(cat "$sys_root/devices/virtual/dmi/id/product_name" 2>/dev/null || cat "$sys_root/firmware/devicetree/base/model" 2>/dev/null || echo "Linux")"
-
-  if command -v lscpu >/dev/null 2>&1; then
-    _cpu="$(lscpu | awk -F': +' '/Model name/{print $2}')"
-    _cpu_cores="$(lscpu | awk -F': +' '/^CPU\(s\):/{print $2}')"
-  else
-    _cpu="$(grep -m1 'model name' "$proc_root/cpuinfo" 2>/dev/null | cut -d: -f2 | sed 's/^ //' || uname -p)"
-    _cpu_cores="$(grep -c '^processor' "$proc_root/cpuinfo" 2>/dev/null || echo "?")"
-  fi
-
-  if command -v lspci >/dev/null 2>&1; then
-    # Headless hosts (VMs, containers, CI runners) expose no display
-    # controller, so `grep` exits 1 and — under `set -euo pipefail` —
-    # would abort the whole report mid-section. Absorb the miss.
-    _gpu="$(lspci 2>/dev/null | grep -iE 'vga|3d|display' | head -1 | sed 's/.*: //' || true)"
-    _gpu="${_gpu:-n/a}"
-  else
-    _gpu="n/a"
-  fi
-
-  if command -v free >/dev/null 2>&1; then
-    _mem="$(free -b | awk '/Mem:/{printf "%.2f GiB / %.2f GiB", $3/1073741824, $2/1073741824}')"
-  elif [[ -r "$proc_root/meminfo" ]]; then
-    _mem_total_kb="$(awk '/MemTotal/{print $2}' "$proc_root/meminfo")"
-    _mem_avail_kb="$(awk '/MemAvailable/{print $2}' "$proc_root/meminfo")"
-    _mem_used_kb=$((_mem_total_kb - _mem_avail_kb))
-    _mem="$(awk "BEGIN{printf \"%.2f GiB / %.2f GiB\", ${_mem_used_kb}/1048576, ${_mem_total_kb}/1048576}")"
-  else
-    _mem="n/a"
-  fi
-
-  # Resolution (Wayland or X11)
-  if command -v wlr-randr >/dev/null 2>&1; then
-    _resolution="$(wlr-randr 2>/dev/null | awk '/current/{print $1; exit}' || echo "n/a")"
-  elif command -v xrandr >/dev/null 2>&1; then
-    _resolution="$(xrandr 2>/dev/null | awk '/\*/{print $1; exit}' || echo "n/a")"
-  elif command -v xdpyinfo >/dev/null 2>&1; then
-    _resolution="$(xdpyinfo 2>/dev/null | awk '/dimensions/{print $2}' || echo "n/a")"
-  else
-    _resolution="n/a"
-  fi
-
-  # Packages (multi-distro)
-  _pkg_count=0
-  _pkg_mgr="pkg"
-  if command -v dpkg >/dev/null 2>&1; then
-    _pkg_count="$(dpkg --get-selections 2>/dev/null | wc -l | tr -d ' ')"
-    _pkg_mgr="dpkg"
-  elif command -v rpm >/dev/null 2>&1; then
-    _pkg_count="$(rpm -qa 2>/dev/null | wc -l | tr -d ' ')"
-    _pkg_mgr="rpm"
-  elif command -v pacman >/dev/null 2>&1; then
-    _pkg_count="$(pacman -Q 2>/dev/null | wc -l | tr -d ' ')"
-    _pkg_mgr="pacman"
-  fi
-  _packages="${_pkg_count} (${_pkg_mgr})"
-
-  _de="${XDG_CURRENT_DESKTOP:-${DESKTOP_SESSION:-n/a}}"
-
-else
-  # Fallback (unknown OS)
-  _os="$(uname -sr)"
-  _host="unknown"
-  _cpu="$(uname -p 2>/dev/null || echo "unknown")"
-  _cpu_cores="?"
-  _gpu="n/a"
-  _mem="n/a"
-  _resolution="n/a"
-  _packages="n/a"
-  _de="n/a"
-fi
-
-# WSL detection and overrides
-_wsl=""
-if [[ -f "$proc_root/version" ]] && grep -qi microsoft "$proc_root/version" 2>/dev/null; then
-  _wsl="yes"
-  _os="${_os} (WSL)"
-  _de="Windows Desktop (WSL)"
-  _terminal="${TERM_PROGRAM:-Windows Terminal}"
-fi
-
-# Print platform info
-_C='\033[0;36m'
-_W='\033[1;37m'
-_N='\033[0m'
-_D='\033[2m'
-
-printf '\n'
-printf '  %b%s%b@%b%s%b\n' "$_C" "$_user" "$_N" "$_C" "$_hostname_val" "$_N"
-printf '  %b%s%b\n' "$_D" "$(printf '%*s' "$((${#_user} + 1 + ${#_hostname_val}))" '' | tr ' ' '-')" "$_N"
-printf '  %bOS:%b         %s\n' "$_W" "$_N" "$_os"
-printf '  %bHost:%b       %s\n' "$_W" "$_N" "$_host"
-printf '  %bKernel:%b     %s\n' "$_W" "$_N" "$_kernel"
-printf '  %bUptime:%b     %s\n' "$_W" "$_N" "${_uptime:-n/a}"
-printf '  %bPackages:%b   %s\n' "$_W" "$_N" "$_packages"
-printf '  %bShell:%b      %s\n' "$_W" "$_N" "$_shell"
-printf '  %bResolution:%b %s\n' "$_W" "$_N" "$_resolution"
-printf '  %bDE:%b         %s\n' "$_W" "$_N" "$_de"
-printf '  %bTerminal:%b   %s\n' "$_W" "$_N" "$_terminal"
-printf '  %bCPU:%b        %s (%s)\n' "$_W" "$_N" "$_cpu" "$_cpu_cores"
-printf '  %bGPU:%b        %s\n' "$_W" "$_N" "${_gpu:-n/a}"
-printf '  %bMemory:%b     %s\n' "$_W" "$_N" "$_mem"
-printf '  %bArch:%b       %s\n' "$_W" "$_N" "$_arch"
-
-if [[ -n "$_wsl" ]]; then
-  echo ""
-  if command -v wslpath >/dev/null 2>&1; then
-    _ok "WSL bridge" "wslpath available"
-  else
-    _warn "WSL bridge" "wslpath missing"
-  fi
-  if [[ "$PWD" == /mnt/* ]]; then
-    _warn "WSL filesystem" "/mnt causes IO latency"
-  else
-    _ok "WSL filesystem" "native"
-  fi
-fi
-
-# --- State ---
-_section "State"
-# --exclude=always: a run_before_/run_after_ script (the macOS iCloud hook)
-# is "pending" on every apply by design, so plain `verify` exits 1 forever
-# on a fully synchronised machine. Files, dirs, symlinks and run_once/
-# run_onchange scripts still count.
-if chezmoi verify --exclude=always &>/dev/null; then
-  _ok "chezmoi" "synchronized"
-else
-  _fail "chezmoi" "drifted (run dot drift)"
-fi
-
-if [[ -f "$HOME/.zshrc" ]]; then
-  _ok ".zshrc" "present"
-else
-  _fail ".zshrc" "missing"
-fi
-
-if command -v dot >/dev/null 2>&1; then
-  dot_path="$(command -v dot)"
-  if [[ "$dot_path" == "$HOME/.local/bin/dot" ]]; then
-    _ok "dot" "$(pretty_path "$dot_path")"
-  else
-    _warn "dot" "$(pretty_path "$dot_path") (expected ~/.local/bin/dot)"
-  fi
-else
-  _fail "dot" "not found in PATH"
-fi
-
-# --- Pre-push audit bypass log (closes #871) ---
-_section "Pre-Push Audit Bypass"
-
-bypass_log="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles/audit-bypass.log"
-if [[ -s "$bypass_log" ]]; then
-  # Count entries in the last 7 days (timestamps are ISO-8601 UTC).
-  seven_days_ago=$(date -u -v-7d +%Y-%m-%dT00:00:00Z 2>/dev/null ||
-    date -u -d '7 days ago' +%Y-%m-%dT00:00:00Z 2>/dev/null ||
-    echo "1970-01-01T00:00:00Z")
-  recent=$(awk -v cutoff="$seven_days_ago" '$1 >= cutoff' "$bypass_log" | wc -l | tr -d ' ')
-  if ((recent > 0)); then
-    _warn "audit bypass" "$recent push(es) bypassed in last 7 days — see $(pretty_path "$bypass_log")"
-  else
-    _ok "audit bypass" "log exists; no recent entries (last 7d)"
-  fi
-else
-  _ok "audit bypass" "clean — no pre-push audits bypassed"
-fi
-
-# --- Atuin history-filter (closes #872) ---
-_section "Atuin History Filter"
-
-atuin_cfg="$HOME/.config/atuin/config.toml"
-if [[ ! -f "$atuin_cfg" ]]; then
-  _warn "atuin config" "not found at $(pretty_path "$atuin_cfg")"
-else
-  if grep -Eq "^history_filter[[:space:]]*=" "$atuin_cfg"; then
-    pattern_count=$(awk '
-      /^history_filter[[:space:]]*=[[:space:]]*\[/ { inside = 1; next }
-      inside && /^\]/                              { inside = 0 }
-      inside && /^[[:space:]]*"/                   { count++ }
-      END                                          { print count + 0 }
-    ' "$atuin_cfg")
-    if ((pattern_count >= 10)); then
-      _ok "history_filter" "$pattern_count patterns (chezmoi-managed)"
-    else
-      _warn "history_filter" "$pattern_count patterns (expected ≥10 from secrets-patterns.toml)"
-    fi
-  else
-    _fail "history_filter" "no history_filter block in $(pretty_path "$atuin_cfg") — secrets may leak into shell history"
-  fi
-fi
-
-# --- Topgrade Integration ---
-_section "Topgrade Integration"
-
-if command -v antigravity >/dev/null 2>&1; then
-  ag_path="$(command -v antigravity)"
-  if [[ "$ag_path" == "$HOME/.local/bin/antigravity" ]]; then
-    _ok "antigravity wrapper" "$(pretty_path "$ag_path")"
-  else
-    _warn "antigravity wrapper" "$(pretty_path "$ag_path") (expected ~/.local/bin/antigravity)"
-  fi
-else
-  _warn "antigravity" "optional"
-fi
-
-if [[ -f "$HOME/.config/fish/fish_plugins" ]]; then
-  if grep -qx "jorgebucaran/fisher" "$HOME/.config/fish/fish_plugins"; then
-    _ok "fish_plugins" "contains jorgebucaran/fisher"
-  else
-    _warn "fish_plugins" "present but missing jorgebucaran/fisher"
-  fi
-else
-  _fail "fish_plugins" "missing (~/.config/fish/fish_plugins)"
-fi
-
-# Only meaningful when there is a cargo for topgrade to run it through; a
-# machine without a Rust toolchain has nothing to update, so warning about
-# the missing helper there is noise that never goes away.
-if command -v cargo-install-update >/dev/null 2>&1; then
-  _ok "cargo-install-update" "$(pretty_path "$(command -v cargo-install-update)")"
-elif command -v cargo >/dev/null 2>&1; then
-  _warn "cargo-install-update" "missing (install: cargo install cargo-update)"
-else
-  _ok "cargo-install-update" "not needed (cargo not installed)"
-fi
-
-# --- Symlinks ---
-broken_links=0
-broken_list=""
-for root in "$HOME/.config" "$HOME/.local/bin" "$HOME/.local/share" "$HOME/.ssh"; do
-  [[ -d "$root" ]] || continue
-  while IFS= read -r -d '' link; do
-    link_name="$(basename "$link")"
-    [[ "$link" == *"google-chrome-backup"* ]] && continue
-    [[ "$link_name" == SingletonLock || "$link_name" == SingletonCookie || "$link_name" == SingletonSocket ]] && continue
-    [[ -e "$link" ]] && continue
-    # A link into ~/Library/Caches dangling is macOS working as designed, not a
-    # health problem: the OS purges that directory whenever it wants the space,
-    # and the owning tool recreates its cache on next use. ~/.config/swiftpm/cache
-    # -> ~/Library/Caches/org.swift.swiftpm is the usual one; it was "fixed" by
-    # recreating the target earlier the same day and had broken again by evening,
-    # which is the tell that it is not fixable, only re-reported.
-    case "$(readlink "$link" 2>/dev/null)" in
-      "$HOME/Library/Caches/"*) continue ;;
-    esac
-    broken_links=$((broken_links + 1))
-    broken_list="${broken_list:+$broken_list, }$(pretty_path "$link")"
-  done < <(find "$root" -maxdepth 3 -type l -print0 2>/dev/null)
-done
-
-if [[ $broken_links -eq 0 ]]; then
-  _ok "symlinks" "none broken"
-else
-  # Name them. "1 broken" with no path meant hunting for it by hand, twice.
-  _warn "symlinks" "$broken_links broken: $broken_list"
-fi
-
-# --- Portability ---
-ghost_paths=0
-if command -v chezmoi >/dev/null 2>&1; then
-  while IFS= read -r managed_path; do
-    [[ "$managed_path" == "$HOME/.config/"* ]] || continue
-    [[ -f "$managed_path" ]] || continue
-    grep -Iq . "$managed_path" 2>/dev/null || continue
-
-    match_count=$(
-      grep -nE '"/home/(linuxbrew)?[^$]|/Users/[^$]' "$managed_path" 2>/dev/null |
-        grep -v "linuxbrew" |
-        grep -v "/mozilla/firefox" |
-        grep -v "/google-chrome" |
-        grep -v "/chromium" |
-        grep -v "/chezmoi/chezmoi.toml" |
-        grep -v "/bun/" |
-        grep -v "/.bun/" |
-        grep -v "/noctalia/" |
-        grep -c -v -- "-backup/" ||
-        true
-    )
-
-    ghost_paths=$((ghost_paths + ${match_count:-0}))
-  done < <(chezmoi managed --path-style=absolute 2>/dev/null || true)
-
-  if [[ $ghost_paths -gt 0 ]]; then
-    _warn "portability" "$ghost_paths hardcoded paths in managed ~/.config files"
-  else
-    _ok "portability" "no hardcoded paths in managed ~/.config files"
-  fi
-else
-  _warn "portability" "chezmoi not found (scan skipped)"
-fi
-
-# --- Performance ---
-_section "Performance"
-
-cache_base="${XDG_CACHE_HOME:-$HOME/.cache}"
-
-# 1. Shell cache freshness for tools the project already wraps in _cached_eval.
-# Stale caches force runtime regeneration on next shell start.
-stale_caches=0
-stale_tools=""
-for tool in mise starship zoxide atuin fzf direnv; do
-  tool_bin="$(command -v "$tool" 2>/dev/null || true)"
-  [[ -n "$tool_bin" ]] || continue
-  for shell_dir in zsh bash fish; do
-    case "$shell_dir" in
-      fish) cache_file="$cache_base/$shell_dir/${tool}-init.fish" ;;
-      *) cache_file="$cache_base/$shell_dir/${tool}-init.$shell_dir" ;;
-    esac
-    if [[ ! -f "$cache_file" ]] || [[ "$tool_bin" -nt "$cache_file" ]]; then
-      stale_caches=$((stale_caches + 1))
-      case "$stale_tools" in
-        *"$tool"*) ;;
-        *) stale_tools="${stale_tools:+$stale_tools, }$tool" ;;
-      esac
-      break
-    fi
-  done
-done
-if [[ $stale_caches -eq 0 ]]; then
-  caches_fresh="fresh"
-  _ok "shell caches" "fresh"
-else
-  caches_fresh="stale"
-  _warn "shell caches" "stale ($stale_tools) — run dot prewarm"
-fi
-
-# 2. Slow-init tools that are present but NOT wrapped in _cached_eval.
-# Each of these runs uncached on every shell start; common offenders eat
-# 100-500ms apiece on a populated dev machine.
-#
-# Only flag tools that actually emit shell init via `<tool> init <shell>`
-# (or equivalent) and would benefit from caching that output. Plain CLIs
-# like gh/cargo/pnpm/yarn don't have init eval; their completions are
-# cached separately under $ZSH_COMPLETIONS_DIR.
-unwrapped=""
-for tool in nvm fnm pyenv rbenv jenv asdf sdkman conda kubectl helm thefuck broot mcfly direnv; do
-  command -v "$tool" >/dev/null 2>&1 || continue
-  # If the tool is installed but no shell config sources or evals its
-  # init (no `$tool env`, `$tool init`, `$tool.sh`, lazy-load stub), it
-  # isn't adding startup cost — skip the warning.
-  init_referenced=0
-  if grep -rIlqE "\\b${tool}([[:space:]]+(env|init|hook)|\\.sh|_lazy_load_${tool}|_dot_lazy[[:space:]]+${tool})" \
-    "$HOME/.config/zsh" "$HOME/.config/fish" "$HOME/.config/shell" 2>/dev/null; then
-    init_referenced=1
-  fi
-  ((init_referenced == 0)) && continue
-  # Tools we lazy-load via shell stubs don't need init-eval cache files.
-  case "$tool" in
-    fnm | nvm | sdkman)
-      grep -rIlqE "_lazy_load_${tool}|_dot_lazy[[:space:]]+${tool}" \
-        "$HOME/.config/zsh" "$HOME/.config/fish" 2>/dev/null && continue
-      ;;
-  esac
-  found=0
-  for shell_dir in zsh bash fish; do
-    case "$shell_dir" in
-      fish) [[ -f "$cache_base/$shell_dir/${tool}-init.fish" ]] && found=1 ;;
-      *) [[ -f "$cache_base/$shell_dir/${tool}-init.$shell_dir" ]] && found=1 ;;
-    esac
-    ((found == 1)) && break
-  done
-  ((found == 0)) && unwrapped="${unwrapped:+$unwrapped, }$tool"
-done
-if [[ -z "$unwrapped" ]]; then
-  _ok "uncached slow-init tools" "none detected"
-else
-  _warn "uncached slow-init tools" "$unwrapped — consider wrapping in _cached_eval"
-fi
-
-# 3. Zsh completion dump health. compinit is usually the single biggest
-# cost on a zsh startup; a stale or uncompiled .zcompdump compounds it.
-if command -v zsh >/dev/null 2>&1; then
-  zcompdump="${HOME}/.zcompdump"
-  if [[ -f "$zcompdump" ]]; then
-    dump_mtime=$(stat -c %Y "$zcompdump" 2>/dev/null || stat -f %m "$zcompdump" 2>/dev/null || echo 0)
-    age_days=$((($(date +%s) - dump_mtime) / 86400))
-    if ((age_days > 7)); then
-      _warn ".zcompdump" "${age_days}d old — refresh: rm ~/.zcompdump* && zsh -ic exit"
-    else
-      _ok ".zcompdump" "fresh (${age_days}d)"
-    fi
-    if [[ ! -f "${zcompdump}.zwc" ]]; then
-      _warn ".zcompdump.zwc" "missing — completion init slower than necessary"
-    fi
-  fi
-fi
-
-# 4. PATH length. Each entry is searched on every command resolution.
-# A mise-managed 2026 dev machine routinely adds 60-90 entries (one per
-# installed tool version + per-shim path), so the warn/fail thresholds
-# reflect that baseline rather than a lean default (~40).
-#
-# The OK ceiling was 75, which contradicted the 60-90 baseline stated right
-# above it and warned on every healthy mise machine. Worse, the implied remedy
-# was backwards: those per-tool entries are what let a command resolve to the
-# real binary instead of falling through to a mise shim. Measured 2026-08-20,
-# 20 invocations of ripgrep --version:
-#
-#     via shim            2741ms   (137ms per call)
-#     direct install dir    62ms   (3.1ms per call)
-#
-# ~44x. "Pruning" those entries to satisfy a length check would trade
-# microseconds of PATH scan for ~134ms on every single tool invocation. The
-# ceiling now matches the documented baseline; >90 still warns, because past
-# that the entries are worth auditing for tools you no longer use.
-path_count=$(printf '%s' "${PATH:-}" | tr ':' '\n' | grep -c . || true)
-if [[ "$path_count" -le 90 ]]; then
-  _ok "PATH length" "$path_count entries"
-elif [[ "$path_count" -le 120 ]]; then
-  _warn "PATH length" "$path_count entries — consider pruning"
-else
-  _fail "PATH length" "$path_count entries — likely slowing every command"
-fi
-
-# 5. Shell coverage. Surface installed shells that the project's caching
-# infrastructure doesn't currently maintain caches for.
-shells_unmanaged=""
-for sh in nu pwsh; do
-  command -v "$sh" >/dev/null 2>&1 || continue
-  case "$sh" in
-    nu)
-      [[ -f "$HOME/.config/nushell/cached_eval.nu" ]] && continue
-      ;;
-    pwsh)
-      pwsh -NoLogo -NoProfile -NonInteractive -Command 'exit 0' >/dev/null 2>&1 || continue
-      pwsh_profile="$HOME/.config/powershell/Microsoft.PowerShell_profile.ps1"
-      [[ -f "$pwsh_profile" ]] && grep -q 'Get-DotfilesCachedInit' "$pwsh_profile" && continue
-      ;;
-  esac
-  shells_unmanaged="${shells_unmanaged:+$shells_unmanaged, }$sh"
-done
-if [[ -z "$shells_unmanaged" ]]; then
-  _ok "shell coverage" "all installed shells have _cached_eval support"
-else
-  _warn "shell coverage" "$shells_unmanaged installed — no _cached_eval helper"
-fi
-
-# 6. Zsh hook count. Heavy precmd/preexec functions compound per-prompt.
-# Probe an interactive zsh with a hard timeout so a broken zshrc doesn't
-# stall doctor; skip cleanly if the probe fails.
-if command -v zsh >/dev/null 2>&1 && command -v timeout >/dev/null 2>&1; then
-  hook_counts=$(timeout 5 zsh -i -c 'echo "$#precmd_functions $#preexec_functions"' 2>/dev/null || echo "")
-  if [[ -n "$hook_counts" ]]; then
-    read -r precmd_n preexec_n <<<"$hook_counts"
-    if [[ "${precmd_n:-0}" -le 5 && "${preexec_n:-0}" -le 5 ]]; then
-      _ok "zsh hooks" "precmd=$precmd_n preexec=$preexec_n"
-    else
-      _warn "zsh hooks" "precmd=$precmd_n preexec=$preexec_n — heavy per-prompt work"
-    fi
-  fi
-fi
-
-if command -v hyperfine >/dev/null 2>&1; then
-  if bash "$SCRIPT_DIR/../../benches/bench.sh" 2>/dev/null; then
-    _ok "startup latency" "within target thresholds"
-  else
-    # Only suggest prewarm when it could actually help. The caches were
-    # already reported fresh above in the common case, and telling someone to
-    # re-run a no-op sends them in a circle — as it did on 2026-08-20, where
-    # prewarm changed nothing because nothing was cold.
-    if [[ "${caches_fresh:-unknown}" == "fresh" ]]; then
-      _warn "startup latency" "threshold exceeded (caches already fresh — profile with 'dot benchmark')"
-    else
-      _warn "startup latency" "threshold exceeded (run dot prewarm)"
-    fi
-  fi
-else
-  _warn "hyperfine" "missing (benchmark skipped)"
-fi
-
-# 7. Baseline check + top-3 slowest tools from EVALCACHE_TIMING.
-# Closes part of #863. Reads the same baseline file `dot perf` writes,
-# and the same eval-timings.jsonl _cached_eval populates. Skipped
-# silently when either file is absent (first-run state).
-baseline_file="$cache_base/dotfiles/perf-baseline.json"
-if [[ -s "$baseline_file" ]] && command -v python3 >/dev/null 2>&1; then
-  baseline_age_days=$(python3 -c '
-import json, sys, datetime
-try:
-    d = json.load(open(sys.argv[1]))
-    rec = d.get("recorded_at", "")
-    if not rec: print(-1); sys.exit(0)
-    rec = rec.replace("Z", "+00:00")
-    age = (datetime.datetime.now(datetime.timezone.utc) - datetime.datetime.fromisoformat(rec)).days
-    print(age)
-except Exception:
-    print(-1)
-' "$baseline_file" 2>/dev/null)
-  if [[ "$baseline_age_days" -ge 0 ]]; then
-    _ok "perf baseline" "recorded ${baseline_age_days}d ago — run \`dot perf\` to compare"
-  fi
-fi
-
-timings_file="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles/eval-timings.jsonl"
-if [[ -s "$timings_file" ]] && command -v python3 >/dev/null 2>&1; then
-  top_tools=$(python3 -c '
-import json, sys
-from collections import defaultdict
-samples = defaultdict(list)
-try:
-    for line in open(sys.argv[1]):
-        try:
-            ev = json.loads(line)
-            ms = int(ev.get("ms", 0) or 0)
-            samples[ev.get("label", "?")].append(ms)
-        except Exception:
-            pass
-    rows = sorted(samples.items(), key=lambda kv: sum(kv[1]) // max(len(kv[1]), 1), reverse=True)[:3]
-    print(", ".join(f"{lbl}({sum(v)//max(len(v),1)}ms)" for lbl, v in rows))
-except Exception:
-    pass
-' "$timings_file" 2>/dev/null)
-  if [[ -n "$top_tools" ]]; then
-    _ok "perf top-tools" "$top_tools"
-  fi
-fi
-
-# --- Summary ---
-dot_log info "doctor_complete" "errors=$Errors" "warnings=$Warnings"
-dot_metric "doctor_errors" "$Errors" "count"
-dot_metric "doctor_warnings" "$Warnings" "count"
-echo ""
-if [[ $Errors -eq 0 ]]; then
-  if [[ $Warnings -eq 0 ]]; then
-    ui_ok "Healthy" "All checks passed."
-  else
-    ui_ok "Healthy" "$Warnings warning(s)."
-  fi
-else
-  ui_err "$Errors error(s)" "$Warnings warning(s). Run 'dot heal' to repair."
-
-  if [[ $AI_DEBUG -eq 1 ]]; then
-    _section "AI Problem Analysis"
-    doctor_report=$(~/.local/bin/dot doctor | grep -E "(✗|⚠)")
-    ai_prompt="The dotfiles diagnostic 'dot doctor' found the following issues:
----
-$doctor_report
----
-Suggest specific shell commands to fix these issues according to our architectural standards."
-    dot ai claude --style hardener "$ai_prompt"
-  fi
-  exit 1
-fi
-echo ""