@warpgogol/forge 5.2.3 → 5.3.0

package/dist/src/onboarding/doctor.js

@@ -20,8 +20,9 @@ Sweep batch 2: real KEY_DECISIONS on 10 files, expanded purposes (CONTRACT-02/PU
   <history>RFC-0391, RFC-0393, RFC-0524, RFC-0539, RFC-0540, RFC-0611, RFC-0640, RFC-0660, RFC-0661, RFC-0663, RFC-0675</history>
 </CHANGE_SUMMARY>
 */
-import { readFile, readdir, stat } from "node:fs/promises";
-import { readFileSync, existsSync } from "node:fs";
+import { resolveIo } from "../utils/io.js";
+import { hasEditableGeneratedMarker, mergeEditableGenerated } from "../utils/index.js";
+import { readFileSync, existsSync } from "../utils/sync-fs.js";
 import { join, relative, dirname, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
 import { forgePluginManifestSchema } from "../plugin/forge-plugin-manifest.js";
@@ -29,7 +30,7 @@ import { resolveForgeRoot, loadForgeConfig, resolveBinding, resolveTerminology,
 import { FORGE_SKILLS, discoverPackSkills } from "../registry.js";
 import { discoverWorkspaces } from "./workspace-discovery.js";
 import { buildNestedAgentsMd, selectNestedTemplate } from "./nested-agents-templates.js";
-import { readPackageInfo } from "./nested-agents-generate.js";
+import { readPackageInfo, generateNestedAgentsMd } from "./nested-agents-generate.js";
 import { listStackProfiles } from "../profiles/stack-profile.js";
 import { resolveAllTerminology } from "../profiles/terminology-utils.js";
 import { TERMINOLOGY_DEFAULTS } from "../profiles/profile-schema.js";
@@ -38,34 +39,29 @@ import { parseKnowledgeFile } from "../knowledge/index.js";
 import { planKnowledgeSync } from "../knowledge/index.js";
 import { computeLayerBudgets, resolveKnowledgeBudgets, DEFAULT_KNOWLEDGE_BUDGETS } from "../knowledge/budgets.js";
 import { detectDuplicatePrinciples } from "../knowledge/index.js";
-import { checkMemoryLayerHealth } from "./memory-scaffold.js";
+import { checkMemoryLayerHealth, resolveMemoryBudget } from "./memory-scaffold.js";
+import { compactMemoryMd } from "./memory-compact.js";
 import { checkInvariants } from "./invariant-engine.js";
 import { checkNpmToken, workshopNeedsWarpgogolToken } from "./npm-token-check.js";
-import { execSync } from "node:child_process";
-import fs from "node:fs";
-async function pathExists(target) {
-    try {
-        await stat(target);
-        return true;
-    }
-    catch {
-        return false;
-    }
+import { execSync } from "../utils/sync-fs.js";
+import * as fs from "../utils/sync-fs.js";
+async function pathExists(target, io) {
+    return io.exists(target);
 }
 const FORBIDDEN_IMPORT_PATTERN = /(?:^|\n)\s*(?:import\s+[^;]+?\s+from\s+|require\s*\(\s*)["'`](@warpgogol\/[^"'`]+)["'`]/g;
-async function scanForForbiddenImports(dir, workspaceRoot) {
+async function scanForForbiddenImports(dir, workspaceRoot, io) {
     const violations = [];
-    const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+    const entries = await io.readdir(dir).catch(() => []);
     for (const entry of entries) {
         const fullPath = join(dir, entry.name);
-        if (entry.isDirectory()) {
+        if (entry.isDirectory) {
             if (entry.name === "node_modules" || entry.name === "tests")
                 continue;
-            const sub = await scanForForbiddenImports(fullPath, workspaceRoot);
+            const sub = await scanForForbiddenImports(fullPath, workspaceRoot, io);
             violations.push(...sub);
         }
         else if (entry.name.endsWith(".ts")) {
-            const content = await readFile(fullPath, "utf8").catch(() => "");
+            const content = await io.readFile(fullPath).catch(() => "");
             let match;
             const pattern = new RegExp(FORBIDDEN_IMPORT_PATTERN.source, "g");
             while ((match = pattern.exec(content)) !== null) {
@@ -97,7 +93,7 @@ const BINDING_COMMAND_KEYS = [
     "commands.specValidate",
     "commands.sessionSave",
 ];
-async function validateBindings(workspaceRoot) {
+async function validateBindings(workspaceRoot, io) {
     const result = { resolved: [], absent: [], invalid: [], notices: [] };
     let config;
     try {
@@ -115,7 +111,7 @@ async function validateBindings(workspaceRoot) {
             result.absent.push(key);
         }
         else if (typeof value === "string") {
-            const exists = await pathExists(join(workspaceRoot, value));
+            const exists = await pathExists(join(workspaceRoot, value), io);
             if (exists) {
                 result.resolved.push(key);
             }
@@ -127,7 +123,7 @@ async function validateBindings(workspaceRoot) {
     const compassDocs = resolveBinding(config, "paths.compassDocs");
     if (Array.isArray(compassDocs) && compassDocs.length > 0) {
         for (const docPath of compassDocs) {
-            const exists = await pathExists(join(workspaceRoot, docPath));
+            const exists = await pathExists(join(workspaceRoot, docPath), io);
             if (exists) {
                 result.resolved.push(`paths.compassDocs[${docPath}]`);
             }
@@ -166,7 +162,7 @@ async function validateBindings(workspaceRoot) {
 // ---------------------------------------------------------------------------
 // Stale knowledge file detection (RFC-0524)
 // ---------------------------------------------------------------------------
-async function checkStaleKnowledgeFiles(workspaceRoot, forgeRoot) {
+async function checkStaleKnowledgeFiles(workspaceRoot, forgeRoot, io) {
     const stale = [];
     let config;
     try {
@@ -183,8 +179,8 @@ async function checkStaleKnowledgeFiles(workspaceRoot, forgeRoot) {
         for (const kf of skill.knowledge) {
             const srcPath = join(skillSrcDir, kf);
             const destPath = join(agentsSkillsDir, skill.name, kf);
-            const srcExists = await pathExists(srcPath);
-            const destExists = await pathExists(destPath);
+            const srcExists = await pathExists(srcPath, io);
+            const destExists = await pathExists(destPath, io);
             if (srcExists && destExists) {
                 // Append-only contract: local copies legitimately accumulate entries.
                 // Stale = source has entries the local copy lacks (sync would merge).
@@ -212,8 +208,8 @@ async function checkStaleKnowledgeFiles(workspaceRoot, forgeRoot) {
         for (const kf of skill.knowledge) {
             const srcPath = join(skillSrcDir, kf);
             const destPath = join(agentsSkillsDir, skill.name, kf);
-            const srcExists = await pathExists(srcPath);
-            const destExists = await pathExists(destPath);
+            const srcExists = await pathExists(srcPath, io);
+            const destExists = await pathExists(destPath, io);
             if (srcExists && destExists) {
                 const plan = planKnowledgeSync(srcPath, destPath);
                 if (plan.action === "merged") {
@@ -539,7 +535,7 @@ function checkSharedKnowledgeFile(workspaceRoot, forgeRoot) {
 // ---------------------------------------------------------------------------
 // Independent version packages diagnostics (RFC-0704)
 // ---------------------------------------------------------------------------
-async function checkIndependentVersionPackages(workspaceRoot) {
+async function checkIndependentVersionPackages(workspaceRoot, io) {
     let config;
     try {
         config = loadForgeConfig(workspaceRoot);
@@ -553,8 +549,8 @@ async function checkIndependentVersionPackages(workspaceRoot) {
     const issues = [];
     let validCount = 0;
     for (const pkgPath of config.independentVersionPackages) {
-        const dirExists = await pathExists(join(workspaceRoot, pkgPath));
-        const pkgJsonExists = await pathExists(join(workspaceRoot, pkgPath, "package.json"));
+        const dirExists = await pathExists(join(workspaceRoot, pkgPath), io);
+        const pkgJsonExists = await pathExists(join(workspaceRoot, pkgPath, "package.json"), io);
         if (!dirExists) {
             issues.push(`path '${pkgPath}' does not exist`);
         }
@@ -581,7 +577,7 @@ async function checkIndependentVersionPackages(workspaceRoot) {
 // ---------------------------------------------------------------------------
 // Pack skill diagnostics (RFC-0539)
 // ---------------------------------------------------------------------------
-async function checkPackSkills(workspaceRoot) {
+async function checkPackSkills(workspaceRoot, io) {
     let config;
     try {
         config = loadForgeConfig(workspaceRoot);
@@ -608,7 +604,7 @@ async function checkPackSkills(workspaceRoot) {
             issues.push(`duplicate dir '${pack.dir}'`);
         }
         dirs.add(pack.dir);
-        const packDirExists = await pathExists(join(workspaceRoot, pack.dir));
+        const packDirExists = await pathExists(join(workspaceRoot, pack.dir), io);
         if (!packDirExists) {
             issues.push(`pack dir '${pack.dir}' does not exist`);
         }
@@ -625,11 +621,11 @@ async function checkPackSkills(workspaceRoot) {
     for (const skill of packSkills) {
         const srcPath = join(workspaceRoot, skill.dir, skill.path);
         const destPath = join(agentsSkillsDir, skill.name, "SKILL.md");
-        const srcExists = await pathExists(srcPath);
-        const destExists = await pathExists(destPath);
+        const srcExists = await pathExists(srcPath, io);
+        const destExists = await pathExists(destPath, io);
         if (srcExists && destExists) {
-            const srcContent = await readFile(srcPath, "utf8").catch(() => "");
-            const destContent = await readFile(destPath, "utf8").catch(() => "");
+            const srcContent = await io.readFile(srcPath).catch(() => "");
+            const destContent = await io.readFile(destPath).catch(() => "");
             if (srcContent !== destContent) {
                 issues.push(`stale copy of '${skill.name}'`);
             }
@@ -649,7 +645,7 @@ async function checkPackSkills(workspaceRoot) {
 // ---------------------------------------------------------------------------
 // Pack manifest diagnostics (RFC-0941)
 // ---------------------------------------------------------------------------
-async function checkPackManifests(workspaceRoot) {
+async function checkPackManifests(workspaceRoot, _io) {
     let config;
     try {
         config = loadForgeConfig(workspaceRoot);
@@ -696,7 +692,7 @@ async function checkPackManifests(workspaceRoot) {
 // ---------------------------------------------------------------------------
 // Nested AGENTS.md diagnostics (RFC-0611)
 // ---------------------------------------------------------------------------
-async function checkNestedAgentsMd(workspaceRoot, workspaceTypes) {
+async function checkNestedAgentsMd(workspaceRoot, workspaceTypes, io) {
     let config;
     try {
         config = loadForgeConfig(workspaceRoot);
@@ -708,7 +704,7 @@ async function checkNestedAgentsMd(workspaceRoot, workspaceTypes) {
             message: "forge.yaml not loadable — nested AGENTS.md check skipped",
         };
     }
-    const workspaces = discoverWorkspaces(workspaceRoot, workspaceTypes);
+    const workspaces = discoverWorkspaces(workspaceRoot, workspaceTypes, config.bindings?.workspaces?.skipDirs);
     if (workspaces.length === 0) {
         return {
             name: "nested-AGENTS.md",
@@ -720,6 +716,7 @@ async function checkNestedAgentsMd(workspaceRoot, workspaceTypes) {
     let missing = 0;
     let stale = 0;
     let handwritten = 0;
+    let unmapped = 0;
     for (const ws of workspaces) {
         if (!ws.hasAgentsMd) {
             missing++;
@@ -730,7 +727,7 @@ async function checkNestedAgentsMd(workspaceRoot, workspaceTypes) {
             handwritten++;
             const suggestions = [];
             try {
-                const content = await readFile(join(workspaceRoot, ws.path, "AGENTS.md"), "utf8");
+                const content = await io.readFile(join(workspaceRoot, ws.path, "AGENTS.md"));
                 if (!content.includes("AGENTS.md")) {
                     suggestions.push("reference root AGENTS.md");
                 }
@@ -752,8 +749,18 @@ async function checkNestedAgentsMd(workspaceRoot, workspaceTypes) {
             const terminology = resolveAllTerminology(config, profile);
             const wsType = workspaceTypes?.find((wt) => wt.id === ws.type);
             const expected = selectNestedTemplate(wsType, profile, terminology, fallback);
-            const actual = await readFile(join(workspaceRoot, ws.path, "AGENTS.md"), "utf8");
-            if (expected !== actual) {
+            const actual = await io.readFile(join(workspaceRoot, ws.path, "AGENTS.md"));
+            // RFC-1153: boundary-aware staleness — merge(expected, actual) compares
+            // only the generated head; content below the forge:custom boundary (or
+            // the canonical footer fallback) is preserved, not drift. Files bearing
+            // the restrictive GENERATED marker are generator-owned (RFC-0081) — any
+            // divergence is plain staleness, never unmapped-customization.
+            const merged = mergeEditableGenerated(expected, actual, `${ws.path}/AGENTS.md`);
+            if (merged === null && hasEditableGeneratedMarker(actual)) {
+                unmapped++;
+                issues.push(`${ws.path}/AGENTS.md has custom content but no resolvable boundary — add <!-- forge:custom --> manually`);
+            }
+            else if (merged === null || merged !== actual.replace(/\r\n/g, "\n")) {
                 stale++;
                 issues.push(`${ws.path}/AGENTS.md stale — run 'forge agents generate'`);
             }
@@ -774,11 +781,13 @@ async function checkNestedAgentsMd(workspaceRoot, workspaceTypes) {
         parts.push(`${missing} missing`);
     if (stale > 0)
         parts.push(`${stale} stale`);
+    if (unmapped > 0)
+        parts.push(`${unmapped} unmapped-customization`);
     if (handwritten > 0)
         parts.push(`${handwritten} hand-written`);
     return {
         name: "nested-AGENTS.md",
-        status: stale > 0 ? "warn" : "pass",
+        status: stale > 0 || unmapped > 0 ? "warn" : "pass",
         message: `${parts.join(", ")} — ${issues.slice(0, 3).join("; ")}${issues.length > 3 ? ` (+${issues.length - 3} more)` : ""}`,
     };
 }
@@ -1046,11 +1055,13 @@ function checkPrerequisites(prerequisites) {
     };
 }
 export async function runDoctor(input, context) {
-    const { workspaceRoot, logger, outputFormat } = context;
+    const { workspaceRoot, logger, outputFormat, dryRun } = context;
+    const fio = resolveIo(context.io);
     const strict = input.flags["strict"] === true;
+    const fix = input.flags["fix"] === true;
     const checks = [];
     // Check forge.yaml
-    const forgeYamlExists = await pathExists(join(workspaceRoot, "forge.yaml"));
+    const forgeYamlExists = await pathExists(join(workspaceRoot, "forge.yaml"), fio);
     checks.push({
         name: "forge.yaml",
         status: forgeYamlExists ? "pass" : "warn",
@@ -1059,7 +1070,7 @@ export async function runDoctor(input, context) {
             : "forge.yaml not found — run 'forge create' to create project configuration",
     });
     // Check AGENTS.md
-    const agentsMdExists = await pathExists(join(workspaceRoot, "AGENTS.md"));
+    const agentsMdExists = await pathExists(join(workspaceRoot, "AGENTS.md"), fio);
     checks.push({
         name: "AGENTS.md",
         status: agentsMdExists ? "pass" : "warn",
@@ -1068,7 +1079,7 @@ export async function runDoctor(input, context) {
             : "AGENTS.md not found — run 'forge create' to deploy agent instructions",
     });
     // Check PREFERENCES.md
-    const preferencesExists = await pathExists(join(workspaceRoot, "PREFERENCES.md"));
+    const preferencesExists = await pathExists(join(workspaceRoot, "PREFERENCES.md"), fio);
     checks.push({
         name: "PREFERENCES.md",
         status: preferencesExists ? "pass" : "warn",
@@ -1077,7 +1088,7 @@ export async function runDoctor(input, context) {
             : "PREFERENCES.md not found — run 'forge create' to create preferences file",
     });
     // Check .agents/skills/
-    const skillsDirExists = await pathExists(join(workspaceRoot, ".agents", "skills"));
+    const skillsDirExists = await pathExists(join(workspaceRoot, ".agents", "skills"), fio);
     checks.push({
         name: ".agents/skills/",
         status: skillsDirExists ? "pass" : "fail",
@@ -1086,7 +1097,7 @@ export async function runDoctor(input, context) {
             : ".agents/skills/ directory not found — run 'forge create' to deploy skills",
     });
     // Check docs/rfcs/
-    const rfcsDirExists = await pathExists(join(workspaceRoot, "docs", "rfcs"));
+    const rfcsDirExists = await pathExists(join(workspaceRoot, "docs", "rfcs"), fio);
     checks.push({
         name: "docs/rfcs/",
         status: rfcsDirExists ? "pass" : "warn",
@@ -1095,7 +1106,7 @@ export async function runDoctor(input, context) {
             : "docs/rfcs/ directory not found — run 'forge create' to create RFC directory",
     });
     // Check docs/adrs/
-    const adrsDirExists = await pathExists(join(workspaceRoot, "docs", "adrs"));
+    const adrsDirExists = await pathExists(join(workspaceRoot, "docs", "adrs"), fio);
     checks.push({
         name: "docs/adrs/",
         status: adrsDirExists ? "pass" : "warn",
@@ -1187,7 +1198,7 @@ export async function runDoctor(input, context) {
             ? `${profileValidateResult.data?.profiles.length ?? 0} profile(s) valid`
             : `${invalidProfiles.length} profile(s) invalid (advisory): ${invalidProfiles.map((p) => p.id).join(", ")}`,
     });
-    const forbiddenImports = await scanForForbiddenImports(forgeRoot, workspaceRoot);
+    const forbiddenImports = await scanForForbiddenImports(forgeRoot, workspaceRoot, fio);
     checks.push({
         name: "autonomy-guard",
         status: forbiddenImports.length === 0 ? "pass" : "fail",
@@ -1196,7 +1207,7 @@ export async function runDoctor(input, context) {
             : `${forbiddenImports.length} @warpgogol/* import(s) found in forge source — remove them`,
     });
     // Check bindings contract (RFC-0393)
-    const bindingsResult = await validateBindings(workspaceRoot);
+    const bindingsResult = await validateBindings(workspaceRoot, fio);
     checks.push({
         name: "bindings",
         status: bindingsResult.invalid.length === 0 ? "pass" : "fail",
@@ -1205,7 +1216,7 @@ export async function runDoctor(input, context) {
             : `Bindings: ${bindingsResult.invalid.length} invalid — ${bindingsResult.invalid.join(", ")}`,
     });
     // Check stale knowledge files (RFC-0524, RFC-0539)
-    const staleCheck = await checkStaleKnowledgeFiles(workspaceRoot, forgeRoot);
+    const staleCheck = await checkStaleKnowledgeFiles(workspaceRoot, forgeRoot, fio);
     checks.push(staleCheck);
     // RFC-0660: Check legacy sections in knowledge files
     const legacyCheck = checkLegacyKnowledgeSections(workspaceRoot, forgeRoot);
@@ -1221,22 +1232,24 @@ export async function runDoctor(input, context) {
     checks.push(sharedKnowledgeCheck);
     // RFC-0664: Check memory layer health (budget, gitignore coverage, leak risk)
     checks.push(checkMemoryLayer(workspaceRoot));
+    // RFC-1151: Check dist freshness — stale dist/ silently shadows src/ in source checkouts
+    checks.push(checkDistFreshness(forgeRoot));
     // RFC-0539: Check pack skills — stale/missing copies and config validation
-    const packCheck = await checkPackSkills(workspaceRoot);
+    const packCheck = await checkPackSkills(workspaceRoot, fio);
     checks.push(packCheck);
     // RFC-0941: Check pack manifests — forge.plugin.yaml existence and validity
-    const packManifestCheck = await checkPackManifests(workspaceRoot);
+    const packManifestCheck = await checkPackManifests(workspaceRoot, fio);
     checks.push(packManifestCheck);
     // RFC-0704: Check independent version packages — paths must exist and contain package.json
-    const independentCheck = await checkIndependentVersionPackages(workspaceRoot);
+    const independentCheck = await checkIndependentVersionPackages(workspaceRoot, fio);
     checks.push(independentCheck);
     // RFC-0611: Check nested AGENTS.md — missing, stale, hand-written
     // RFC-0640: Use profile-driven workspace types when available (all domains)
     // RFC-0640 fix: previously gated by isSoftwareDomain, which skipped the check
     // entirely for non-software domains. Now runs for all domains — profile-driven
     // wsTypes replace hardcoded detection when present.
+    let wsTypes;
     {
-        let wsTypes;
         try {
             const config = loadForgeConfig(workspaceRoot);
             // RFC-0643: prefer config.profile (loaded by loadForgeConfig)
@@ -1257,7 +1270,7 @@ export async function runDoctor(input, context) {
         catch {
             // profiles not loadable
         }
-        const nestedCheck = await checkNestedAgentsMd(workspaceRoot, wsTypes);
+        const nestedCheck = await checkNestedAgentsMd(workspaceRoot, wsTypes, fio);
         checks.push(nestedCheck);
     }
     // RFC-0640: --strict flag elevates warn to fail for domain-related checks
@@ -1269,6 +1282,15 @@ export async function runDoctor(input, context) {
         : checks;
     const allPass = finalChecks.every((c) => c.status === "pass");
     const hasFails = finalChecks.some((c) => c.status === "fail");
+    // RFC-1151: --fix applies registered safe remediations for warn/fail checks
+    const fixes = [];
+    if (fix) {
+        for (const check of finalChecks) {
+            if (check.status === "pass")
+                continue;
+            fixes.push(await applyDoctorRemediation(check, workspaceRoot, wsTypes, dryRun === true, fio));
+        }
+    }
     if (outputFormat === "pretty") {
         logger.section(`Forge Doctor — ${workspaceRoot}`);
         for (const check of finalChecks) {
@@ -1276,6 +1298,10 @@ export async function runDoctor(input, context) {
             const fn = check.status === "pass" ? logger.success : check.status === "warn" ? logger.warn : logger.error;
             fn(`${icon} ${check.name}: ${check.message}`);
         }
+        for (const f of fixes) {
+            const fn = f.action === "fixed" ? logger.success : f.action === "failed" ? logger.error : logger.info;
+            fn(`  fix ${f.check}: ${f.action} — ${f.detail}`);
+        }
         if (allPass) {
             logger.success("All checks passed — forge is properly configured.");
         }
@@ -1286,12 +1312,104 @@ export async function runDoctor(input, context) {
             logger.warn("Some checks warn — review above.");
         }
     }
+    const fixFailed = fixes.some((f) => f.action === "failed");
     return {
-        data: { command: "forge.doctor", checks: finalChecks, allPass, forbiddenImports, bindings: bindingsResult, domain: domainReport },
-        exitCode: hasFails ? 1 : 0,
+        data: { command: "forge.doctor", checks: finalChecks, allPass, forbiddenImports, bindings: bindingsResult, domain: domainReport, ...(fix ? { fixes } : {}) },
+        exitCode: hasFails || fixFailed ? 1 : 0,
         summary: allPass
             ? "forge.doctor: all checks passed"
-            : `forge.doctor: ${finalChecks.filter((c) => c.status === "fail").length} fail(s), ${finalChecks.filter((c) => c.status === "warn").length} warn(s)`,
+            : `forge.doctor: ${finalChecks.filter((c) => c.status === "fail").length} fail(s), ${finalChecks.filter((c) => c.status === "warn").length} warn(s)${fix ? `, ${fixes.filter((f) => f.action === "fixed").length} fixed` : ""}`,
     };
 }
+// RFC-1151: dist-freshness — a stale dist/ silently shadows src/ because
+// bin/cli.js prefers dist when present. Warn-only; rebuild is a pnpm script,
+// not forge's call. Pass (skip) when src/ or dist/ is absent — npm consumers
+// ship dist-only, so this activates only in source checkouts.
+function checkDistFreshness(forgeRoot) {
+    const srcDir = join(forgeRoot, "src");
+    const distDir = join(forgeRoot, "dist");
+    if (!fs.existsSync(srcDir) || !fs.existsSync(distDir)) {
+        return {
+            name: "dist-freshness",
+            status: "pass",
+            message: "no src+dist pair — not a source checkout",
+        };
+    }
+    const newestSrc = newestMtime(srcDir);
+    const distMtime = fs.statSync(distDir).mtimeMs;
+    if (newestSrc > distMtime) {
+        return {
+            name: "dist-freshness",
+            status: "warn",
+            message: `dist/ older than newest src/ file — run 'pnpm run build' in ${forgeRoot}`,
+        };
+    }
+    return { name: "dist-freshness", status: "pass", message: "dist/ is fresh" };
+}
+function newestMtime(dir) {
+    let newest = 0;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true, recursive: true })) {
+        if (!entry.isFile())
+            continue;
+        const m = fs.statSync(join(entry.parentPath, entry.name)).mtimeMs;
+        if (m > newest)
+            newest = m;
+    }
+    return newest;
+}
+// RFC-1151: remediation dispatch — check name → safe fix action.
+// Remediations reuse existing generators; hand-written files are never touched
+// (generated-marker edit guard inside generateNestedAgentsMd).
+async function applyDoctorRemediation(check, workspaceRoot, workspaceTypes, dryRun, io) {
+    switch (check.name) {
+        case "nested-AGENTS.md": {
+            try {
+                const config = loadForgeConfig(workspaceRoot);
+                const res = await generateNestedAgentsMd(workspaceRoot, config, dryRun, workspaceTypes, io);
+                return {
+                    check: check.name,
+                    action: res.generated.length > 0 ? "fixed" : "skipped",
+                    detail: `${res.generated.length} file(s) ${dryRun ? "would be " : ""}regenerated, ${res.skipped.length} skipped`,
+                };
+            }
+            catch (err) {
+                return { check: check.name, action: "failed", detail: err.message };
+            }
+        }
+        case "memory-layer": {
+            try {
+                const memoryPath = join(workspaceRoot, ".agents", "memory", "MEMORY.md");
+                if (!(await io.exists(memoryPath))) {
+                    return { check: check.name, action: "skipped", detail: "MEMORY.md absent" };
+                }
+                const content = await io.readFile(memoryPath);
+                const budget = resolveMemoryBudget(workspaceRoot);
+                const { lines, removedLines, fitsBudget } = compactMemoryMd(content, budget);
+                if (!fitsBudget) {
+                    return {
+                        check: check.name,
+                        action: "failed",
+                        detail: "still over budget after Environment notes truncation — manual editorial compaction required",
+                    };
+                }
+                if (removedLines.length === 0) {
+                    return { check: check.name, action: "skipped", detail: "within budget" };
+                }
+                if (!dryRun) {
+                    await io.writeFile(memoryPath, lines.join("\n"));
+                }
+                return {
+                    check: check.name,
+                    action: "fixed",
+                    detail: `${dryRun ? "would remove" : "removed"} ${removedLines.length} bullet(s)`,
+                };
+            }
+            catch (err) {
+                return { check: check.name, action: "failed", detail: err.message };
+            }
+        }
+        default:
+            return { check: check.name, action: "skipped", detail: "no-remediation" };
+    }
+}
 //# sourceMappingURL=doctor.js.map