arcane-cli 1.1.0 → 1.2.0

package/dist/index.js

@@ -19,13 +19,38 @@ import {
   access,
   readdir,
   readFile,
+  rm,
+  rmdir,
   writeFile
 } from "fs/promises";
 import { createHash } from "crypto";
 import path from "path";
+function normalizeLineEndings(content) {
+  if (!content.includes(13)) return content;
+  const out = Buffer.allocUnsafe(content.length);
+  let o = 0;
+  for (let i = 0; i < content.length; i++) {
+    const byte = content[i];
+    if (byte === 13) {
+      out[o++] = 10;
+      if (content[i + 1] === 10) i++;
+      continue;
+    }
+    out[o++] = byte;
+  }
+  return out.subarray(0, o);
+}
+function hashContent(content) {
+  const bytes = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
+  return createHash("sha256").update(normalizeLineEndings(bytes)).digest("hex");
+}
 async function hashFile(filePath) {
+  return hashContent(await readFile(filePath));
+}
+async function fileMatchesHash(filePath, recordedHash) {
   const content = await readFile(filePath);
-  return createHash("sha256").update(content).digest("hex");
+  if (hashContent(content) === recordedHash) return true;
+  return createHash("sha256").update(content).digest("hex") === recordedHash;
 }
 function validateTargetPath(targetDir, relativePath) {
   const resolvedBase = path.resolve(targetDir);
@@ -57,10 +82,28 @@ async function copyFile(srcPath, targetDir, relativePath, opts = {}) {
     );
   }
   const content = await readFile(srcPath);
-  const hash = createHash("sha256").update(content).digest("hex");
+  const hash = hashContent(content);
   await writeFile(destPath, content);
   return hash;
 }
+async function removeWithin(targetDir, relativePath) {
+  validateTargetPath(targetDir, relativePath);
+  await rm(path.resolve(targetDir, relativePath), { force: true });
+}
+async function removeEmptyAncestors(targetDir, relativePath) {
+  validateTargetPath(targetDir, relativePath);
+  const base = path.resolve(targetDir);
+  let dir = path.dirname(path.resolve(targetDir, relativePath));
+  while (dir !== base && dir.startsWith(base + path.sep)) {
+    try {
+      if ((await readdir(dir)).length > 0) return;
+      await rmdir(dir);
+    } catch {
+      return;
+    }
+    dir = path.dirname(dir);
+  }
+}
 async function copyDirectory(srcDir, targetDir, relativeDir, opts = {}) {
   validateTargetPath(targetDir, relativeDir);
   const copiedFiles = [];
@@ -173,6 +216,9 @@ function validateTrackingFields(manifest, filePath) {
   if (manifest.scope !== void 0 && !VALID_INSTALL_SCOPES.includes(manifest.scope)) {
     throw new ManifestInvalidFieldError(filePath, "scope", manifest.scope);
   }
+  if (manifest.spell_scope !== void 0 && !VALID_INSTALL_SCOPES.includes(manifest.spell_scope)) {
+    throw new ManifestInvalidFieldError(filePath, "spell_scope", manifest.spell_scope);
+  }
   if (manifest.fanout !== void 0 && !isValidFanoutRecord(manifest.fanout)) {
     throw new ManifestInvalidFieldError(filePath, "fanout", manifest.fanout);
   }
@@ -838,8 +884,7 @@ function listProfiles() {
 }
 
 // src/modules/user-tier.ts
-import { createHash as createHash2 } from "crypto";
-import { lstat, mkdir as mkdir2, readdir as readdir2, readFile as readFile3, rm, rmdir, writeFile as writeFile3 } from "fs/promises";
+import { lstat, mkdir as mkdir2, readdir as readdir2, readFile as readFile3, rm as rm2, rmdir as rmdir2, writeFile as writeFile3 } from "fs/promises";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
 
@@ -902,6 +947,7 @@ function renderClaudeCommandStub(id, frontmatter, canonicalRef = canonicalSpellP
   const title = deriveStubTitle(frontmatter.name);
   const description = frontmatter.claudeDescription ?? frontmatter.description;
   const promptPath = canonicalRef;
+  const includeRef = /\s/.test(promptPath) ? `"${promptPath}"` : promptPath;
   return `---
 description: ${description}
 ---
@@ -914,7 +960,7 @@ See the full prompt at \`${promptPath}\` for the complete workflow definition.
 
 ---
 
-@${promptPath}
+@${includeRef}
 `;
 }
 var SKILL_NAME_PATTERN = /^[a-z0-9-]+$/;
@@ -971,6 +1017,14 @@ function componentForScope(component, scope) {
   }
   return { name: component.name, description: component.description, files, sourceOverrides };
 }
+function componentForSpellScope(component, spellScope) {
+  if (spellScope === "repo") return component;
+  if (!SPELL_COMPONENT_NAMES.includes(component.name)) return component;
+  return { ...component, files: [] };
+}
+function effectiveSpellScope(manifest) {
+  return manifest.spell_scope ?? "repo";
+}
 function spellIdsInStore(components) {
   const ids = /* @__PURE__ */ new Set();
   for (const component of components) {
@@ -1041,9 +1095,6 @@ async function classifyTarget(path4) {
     throw err;
   }
 }
-function sha256(content) {
-  return createHash2("sha256").update(content, "utf-8").digest("hex");
-}
 function perSpellDirectory(homeDir, relativePath) {
   if (clientOfFanoutPath(relativePath) !== "codex") return void 0;
   return dirname(join(homeDir, relativePath));
@@ -1051,7 +1102,7 @@ function perSpellDirectory(homeDir, relativePath) {
 async function removeDirectoryIfEmpty(dir) {
   try {
     const entries = await readdir2(dir);
-    if (entries.length === 0) await rmdir(dir);
+    if (entries.length === 0) await rmdir2(dir);
   } catch {
   }
 }
@@ -1072,9 +1123,10 @@ async function syncUserTierFanout(options) {
     }
   }
   for (const file of desired) {
+    validateTargetPath(options.homeDir, file.relativePath);
     const target = join(options.homeDir, file.relativePath);
     const recorded = previous[file.relativePath];
-    const newHash = sha256(file.content);
+    const newHash = hashContent(file.content);
     const state = await classifyTarget(target);
     if (state === "absent") {
       if (!dryRun) {
@@ -1089,12 +1141,12 @@ async function syncUserTierFanout(options) {
       outcomes.push({ relativePath: file.relativePath, status: "collision" });
       continue;
     }
-    const currentHash = await hashFile(target);
-    if (currentHash !== recorded) {
+    if (!await fileMatchesHash(target, recorded)) {
       record[file.relativePath] = recorded;
       outcomes.push({ relativePath: file.relativePath, status: "customized" });
       continue;
     }
+    const currentHash = await hashFile(target);
     if (currentHash === newHash) {
       record[file.relativePath] = newHash;
       outcomes.push({ relativePath: file.relativePath, status: "unchanged" });
@@ -1106,19 +1158,20 @@ async function syncUserTierFanout(options) {
   }
   for (const [relativePath, recorded] of Object.entries(previous)) {
     if (desiredPaths.has(relativePath)) continue;
+    validateTargetPath(options.homeDir, relativePath);
     const target = join(options.homeDir, relativePath);
     const state = await classifyTarget(target);
     if (state === "absent") {
       outcomes.push({ relativePath, status: "gone" });
       continue;
     }
-    if (state === "other" || await hashFile(target) !== recorded) {
+    if (state === "other" || !await fileMatchesHash(target, recorded)) {
       record[relativePath] = recorded;
       outcomes.push({ relativePath, status: "kept-edited" });
       continue;
     }
     if (!dryRun) {
-      await rm(target, { force: true });
+      await rm2(target, { force: true });
       const spellDir = perSpellDirectory(options.homeDir, relativePath);
       if (spellDir !== void 0) await removeDirectoryIfEmpty(spellDir);
     }
@@ -1209,7 +1262,7 @@ async function inspectUserTierFanout(homeDir, record) {
       health.missing.push(relativePath);
       continue;
     }
-    if (state === "other" || await hashFile(target) !== recorded) health.customized.push(relativePath);
+    if (state === "other" || !await fileMatchesHash(target, recorded)) health.customized.push(relativePath);
   }
   return health;
 }
@@ -1834,7 +1887,7 @@ import { join as join3 } from "path";
 import { homedir as homedir2 } from "os";
 
 // src/modules/merger.ts
-import { readFile as readFile5, writeFile as writeFile4, rm as rm2 } from "fs/promises";
+import { readFile as readFile5, writeFile as writeFile4, rm as rm3 } from "fs/promises";
 import path3 from "path";
 var MARKER_START = "<!-- arcane:start -->";
 var MARKER_END = "<!-- arcane:end -->";
@@ -1920,7 +1973,7 @@ async function stripMarkerSection(targetDir, relativePath, opts = {}) {
   const stripped = (before + after).replace(/\n{3,}/g, "\n\n").trim();
   if (!opts.dryRun) {
     if (stripped.length === 0) {
-      await rm2(destPath, { force: true });
+      await rm3(destPath, { force: true });
     } else {
       await writeFile4(destPath, stripped + "\n", "utf8");
     }
@@ -2426,7 +2479,7 @@ async function runAgentsList(targetDir) {
 }
 
 // src/modules/push-safety.ts
-import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile7, chmod, access as access3, rm as rm3, readdir as readdir4 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile7, chmod, access as access3, rm as rm4, readdir as readdir4 } from "fs/promises";
 import { constants } from "fs";
 import { join as join5, resolve as resolve2, dirname as dirname2, basename } from "path";
 
@@ -2843,7 +2896,7 @@ async function removeHook(cwd, hookName) {
   if (!isArcaneHooksPath(root, existing.value)) return;
   if (existing.scope !== "local" && existing.scope !== "worktree") return;
   try {
-    await rm3(await hookFilePath(cwd, hookName), { force: true });
+    await rm4(await hookFilePath(cwd, hookName), { force: true });
   } catch {
   }
   const hooksDir = join5(root, ARCANE_HOOKS_DIR);
@@ -3247,16 +3300,35 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
     profile = await select2({
       message: "Select an installation profile:\n",
       choices: profiles.map((p) => {
-        const profileComponents = getProfile(p.id);
+        const profileComponents2 = getProfile(p.id);
         return {
           value: p.id,
           name: `${PROFILE_ICONS[p.id] ?? "\u{1F4CB}"}  ${p.displayName} \u2014 ${p.description}`,
-          description: buildProfileDescription(profileComponents, p.id)
+          description: buildProfileDescription(profileComponents2, p.id)
         };
       })
     });
   }
-  const components = getProfile(profile);
+  const profileComponents = getProfile(profile);
+  let spell_scope;
+  if (!options.profile && !options.dryRun) {
+    let storeVersion;
+    try {
+      storeVersion = (await readManifest(userTierRoot())).version;
+    } catch {
+    }
+    if (storeVersion !== void 0) {
+      console.log();
+      const useTier = await confirm({
+        message: `This machine has an Arcane user tier (v${storeVersion}). Use it for this repository's spells instead of installing copies here?`,
+        default: false
+      });
+      spell_scope = useTier ? "user" : "repo";
+    }
+  }
+  const components = profileComponents.map(
+    (component) => componentForSpellScope(component, spell_scope ?? "repo")
+  );
   const groups = categorizeComponents(components);
   console.log();
   printSection(`\u{1F4E6} Profile: ${profile}`);
@@ -3443,6 +3515,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
     profile,
     installedAt: (/* @__PURE__ */ new Date()).toISOString(),
     components: installedComponents,
+    ...spell_scope ? { spell_scope } : {},
     ...role ? { role } : {},
     ...tracking_mode ? { tracking_mode, external_provider } : {},
     ...subject_root !== void 0 ? { subject_root } : {},
@@ -3757,7 +3830,7 @@ async function runAdd(name, options, targetDir, assetsDir, packageVersion) {
 
 // src/commands/update.ts
 import { dirname as dirname4, join as join9 } from "path";
-import { readFile as readFile7, writeFile as writeFile9, rm as rm4 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile9 } from "fs/promises";
 
 // src/modules/hub.ts
 import { confirm as confirm2, select as select3, input as input3 } from "@inquirer/prompts";
@@ -4110,6 +4183,12 @@ function migrateLegacyComponents(components) {
   return out;
 }
 async function resolveOrphan(targetDir, file, recordedHash, prune) {
+  try {
+    validateTargetPath(targetDir, file);
+  } catch {
+    console.log(`  ! Refused (path escapes the target directory): ${file}`);
+    return "reported";
+  }
   const filePath = join9(targetDir, file);
   if (!await fileExists(filePath)) return "not-found";
   if (!prune) return "reported";
@@ -4117,32 +4196,62 @@ async function resolveOrphan(targetDir, file, recordedHash, prune) {
     console.log(`  ! Orphaned, not pruned (no recorded hash to verify it's untouched): ${file}`);
     return "reported";
   }
-  const currentHash = await hashFile(filePath);
-  if (currentHash !== recordedHash) {
+  if (!await fileMatchesHash(filePath, recordedHash)) {
     console.log(`  ! Orphaned but edited since install \u2014 not pruning: ${file}`);
     return "reported";
   }
-  await rm4(filePath, { force: true });
+  await removeWithin(targetDir, file);
+  await removeEmptyAncestors(targetDir, file);
   console.log(`  Pruned orphaned file: ${file}`);
   return "pruned";
 }
-async function findMissingTrackedFiles(targetDir, components, scope = "repo") {
+function findReadoptedSpellComponents(components, scope = "repo", spellScope = "repo") {
+  if (scope !== "repo" || spellScope !== "repo") return /* @__PURE__ */ new Set();
+  return new Set(
+    components.filter((c) => SPELL_COMPONENT_NAMES.includes(c.name) && c.files.length === 0).map((c) => c.name)
+  );
+}
+async function findMissingTrackedFiles(targetDir, components, scope = "repo", spellScope = "repo", readopted = /* @__PURE__ */ new Set()) {
   const missing = [];
   for (const installed of components) {
     let component;
     try {
-      component = componentForScope(getComponent(installed.name), scope);
+      component = componentForSpellScope(
+        componentForScope(getComponent(installed.name), scope),
+        scope === "repo" ? spellScope : "repo"
+      );
     } catch {
       continue;
     }
     if (component.initOnly || component.skipExisting) continue;
-    for (const file of installed.files) {
+    const candidates = readopted.has(installed.name) ? component.files : installed.files;
+    for (const file of candidates) {
       if (!component.files.includes(file)) continue;
       if (!await fileExists(join9(targetDir, file))) missing.push(file);
     }
   }
   return missing;
 }
+function findUnmanagedTrackedFiles(components, scope = "repo", spellScope = "repo") {
+  const unmanaged = [];
+  for (const installed of components) {
+    let component;
+    try {
+      component = componentForSpellScope(
+        componentForScope(getComponent(installed.name), scope),
+        scope === "repo" ? spellScope : "repo"
+      );
+    } catch {
+      unmanaged.push(...installed.files);
+      continue;
+    }
+    const shipped = new Set(component.files);
+    for (const file of installed.files) {
+      if (!shipped.has(file)) unmanaged.push(file);
+    }
+  }
+  return unmanaged;
+}
 async function runUpdate(options, targetDir, assetsDir, packageVersion) {
   let manifest;
   try {
@@ -4164,6 +4273,8 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
     return;
   }
   const scope = resolvedScope.scope;
+  const spellScope = effectiveSpellScope(manifest);
+  const readopted = findReadoptedSpellComponents(manifest.components, scope, spellScope);
   const homeDir = dirname4(targetDir);
   if (scope === "repo") {
     console.warn(
@@ -4197,8 +4308,9 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
   }
   let sameVersionRestore = false;
   if (manifest.version === packageVersion && manifest.components.length > 0) {
-    const missing = await findMissingTrackedFiles(targetDir, manifest.components, scope);
-    if (missing.length === 0) {
+    const missing = await findMissingTrackedFiles(targetDir, manifest.components, scope, spellScope, readopted);
+    const unmanaged = findUnmanagedTrackedFiles(manifest.components, scope, spellScope);
+    if (missing.length === 0 && unmanaged.length === 0) {
       console.log("Already up to date.");
       if (scope === "user") {
         const fanout = await syncUserTierFanout({
@@ -4217,9 +4329,16 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
       return;
     }
     sameVersionRestore = true;
-    console.log(
-      `${options.dryRun ? "[dry-run] " : ""}Already at v${packageVersion}, but ${missing.length} tracked file${missing.length === 1 ? " is" : "s are"} missing \u2014 restoring.`
-    );
+    const prefix = options.dryRun ? "[dry-run] " : "";
+    if (missing.length > 0) {
+      console.log(
+        `${prefix}Already at v${packageVersion}, but ${missing.length} tracked file${missing.length === 1 ? " is" : "s are"} missing \u2014 restoring.`
+      );
+    } else {
+      console.log(
+        `${prefix}Already at v${packageVersion}, but ${unmanaged.length} tracked file${unmanaged.length === 1 ? " is" : "s are"} no longer managed here \u2014 reviewing.`
+      );
+    }
   }
   if (manifest.components.length === 0) {
     console.log("No components installed. Nothing to update.");
@@ -4234,7 +4353,10 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
   for (const installed of componentsToUpdate) {
     let component;
     try {
-      component = componentForScope(getComponent(installed.name), scope);
+      component = componentForSpellScope(
+        componentForScope(getComponent(installed.name), scope),
+        scope === "repo" ? spellScope : "repo"
+      );
     } catch (err) {
       if (err instanceof ComponentNotFoundError) {
         console.log(`  ! ${installed.name} not in registry \u2014 skipping.`);
@@ -4269,7 +4391,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
         continue;
       }
       if (sameVersionRestore) {
-        const tracked = installed.files.includes(file);
+        const tracked = installed.files.includes(file) || readopted.has(installed.name);
         const restorable = tracked && !targetExists && !component.skipExisting;
         if (!restorable) {
           if (tracked) {
@@ -4279,7 +4401,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
           continue;
         }
       }
-      const editedByOperator = recordedHash !== void 0 && targetExists && !preserveExisting && await hashFile(join9(targetDir, file)) !== recordedHash;
+      const editedByOperator = recordedHash !== void 0 && targetExists && !preserveExisting && !await fileMatchesHash(join9(targetDir, file), recordedHash);
       if (preserveExisting) {
         console.log(`  ${options.dryRun ? "[dry-run] Would preserve" : "Preserved"}: ${file}`);
       } else if (editedByOperator && isClientShimPath(file)) {
@@ -4346,13 +4468,24 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
     }
     for (const file of installed.files) {
       if (updatedFiles.includes(file)) continue;
+      const recordedHash = installed.fileHashes?.[file];
       const status = await resolveOrphan(
         targetDir,
         file,
-        installed.fileHashes?.[file],
+        recordedHash,
         Boolean(options.prune) && !options.dryRun
       );
       orphanReport.push({ file, status });
+      if (status === "reported") {
+        try {
+          validateTargetPath(targetDir, file);
+          if (await fileExists(join9(targetDir, file))) {
+            updatedFiles.push(file);
+            if (recordedHash !== void 0) fileHashes[file] = recordedHash;
+          }
+        } catch {
+        }
+      }
     }
     updatedComponents.push({
       ...installed,
@@ -4372,6 +4505,11 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
       const marker = status === "pruned" ? "pruned" : options.prune ? "kept (see reason above)" : "not removed";
       console.log(`    ${file} \u2014 ${marker}`);
     }
+    if (scope === "repo" && spellScope === "user") {
+      console.log(
+        '  This repository takes its spells from the user tier (spell_scope: "user"), so the files above are no longer managed here \u2014 every client reads ~/.arcane instead.'
+      );
+    }
     if (!options.prune) {
       console.log("  Run `spell update --prune` to remove the ones that are safe to delete.");
     }
@@ -4638,12 +4776,18 @@ async function runStatus(targetDir, packageVersion, options = {}) {
       );
     }
   } else {
-    console.log("  Scope: repo");
+    const spellScope = effectiveSpellScope(manifest);
+    console.log(spellScope === "user" ? "  Scope: repo (spells: user tier)" : "  Scope: repo");
+    const store = userTierRoot();
     try {
-      const store = userTierRoot();
       const userManifest = await readManifest(store);
       console.log(`  User tier: v${userManifest.version} at ${store} (spell status --user)`);
     } catch {
+      if (spellScope === "user") {
+        console.log(
+          `  ! User tier: not installed at ${store} \u2014 this repository expects it for every spell. Run \`spell init --user\` (\`spell doctor\` explains).`
+        );
+      }
     }
   }
   console.log("");
@@ -4755,11 +4899,13 @@ Run \`spell unblock-push\` first (interactive), then uninstall.`
   let removed = 0;
   for (const component of manifest.components) {
     for (const file of component.files) {
-      const filePath = join11(targetDir, file);
       try {
-        await rm5(filePath, { force: true });
+        await removeWithin(targetDir, file);
         removed++;
-      } catch {
+      } catch (err) {
+        console.log(
+          `  ! Skipped ${file}: ${err instanceof Error ? err.message : String(err)}`
+        );
       }
     }
   }
@@ -4827,8 +4973,12 @@ async function uninstallUserTier(options, storeRoot, manifest) {
   });
   let removed = 0;
   for (const file of storeFiles) {
-    await rm5(join11(storeRoot, file), { force: true });
-    removed++;
+    try {
+      await removeWithin(storeRoot, file);
+      removed++;
+    } catch (err) {
+      console.log(`  ! Skipped ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
   }
   await rm5(join11(storeRoot, ".arcane.json"), { force: true });
   await removeDirectoryIfEmpty(join11(storeRoot, USER_TIER_SPELLS_DIR));
@@ -4843,7 +4993,7 @@ async function uninstallUserTier(options, storeRoot, manifest) {
 }
 
 // src/commands/doctor.ts
-import { access as access4, readFile as readFile10, mkdir as mkdir7, copyFile as fsCopyFile } from "fs/promises";
+import { access as access4, readdir as readdir7, readFile as readFile10, mkdir as mkdir7, copyFile as fsCopyFile } from "fs/promises";
 import { join as join13, dirname as dirname8 } from "path";
 import { execFile as execFile3 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -5183,8 +5333,8 @@ async function checkVSCodeExtension(id, label) {
   ];
   for (const dir of extDirs) {
     try {
-      const { readdir: readdir9 } = await import("fs/promises");
-      const entries = await readdir9(dir);
+      const { readdir: readdir10 } = await import("fs/promises");
+      const entries = await readdir10(dir);
       const prefix = id.toLowerCase() + "-";
       const found = entries.some(
         (e) => e.toLowerCase() === id.toLowerCase() || e.toLowerCase().startsWith(prefix)
@@ -5608,6 +5758,66 @@ async function checkPlatformBranchPolicy(targetDir) {
     message: "remote is neither GitHub nor Azure DevOps \u2014 platform policy verification not available for this provider"
   };
 }
+async function checkSpellScope(targetDir, homeDir = resolveHomeDir()) {
+  const name = "Spell scope (ARC-045)";
+  let manifest;
+  try {
+    manifest = await readManifest(targetDir);
+  } catch {
+    return { name, passed: true, blocking: false, message: "no .arcane.json \u2014 nothing to check" };
+  }
+  if (effectiveSpellScope(manifest) === "repo") {
+    return {
+      name,
+      passed: true,
+      blocking: false,
+      message: "repo \u2014 this repository carries its own spells (the default)"
+    };
+  }
+  const storeRoot = userTierRoot(homeDir);
+  let store;
+  try {
+    store = await readManifest(storeRoot);
+  } catch (err) {
+    return {
+      name,
+      passed: false,
+      message: `this repository takes its spells from the user tier (spell_scope: "user"), but ${storeRoot} ${err instanceof ManifestNotFoundError ? "is not installed" : `could not be read (${err instanceof Error ? err.message : String(err)})`} \u2014 no client can reach a spell here. Run \`spell init --user\`, or set spell_scope back to "repo" and run \`spell update\`.`
+    };
+  }
+  let spellCount = 0;
+  let probed = false;
+  const probe = "spell-status.md";
+  try {
+    const entries = await readdir7(join13(storeRoot, USER_TIER_SPELLS_DIR));
+    const spells = entries.filter((e) => e.startsWith("spell-") && e.endsWith(".md"));
+    spellCount = spells.length;
+    probed = spells.includes(probe);
+  } catch {
+  }
+  if (spellCount === 0 || !probed) {
+    return {
+      name,
+      passed: false,
+      message: `the user tier at ${storeRoot} holds ${spellCount} spell(s)${spellCount > 0 && !probed ? ` and not ${probe}` : ""} \u2014 this repository expects it to supply every spell. Run \`spell update --user\`.`
+    };
+  }
+  const majorMinor = (v) => v.split(".").slice(0, 2).join(".");
+  if (typeof manifest.version === "string" && majorMinor(store.version) !== majorMinor(manifest.version)) {
+    return {
+      name,
+      passed: false,
+      blocking: false,
+      message: `this repository is at v${manifest.version} but the user tier it uses is at v${store.version} \u2014 run \`spell update --user\` (and \`spell update\` here) to bring them together.`
+    };
+  }
+  return {
+    name,
+    passed: true,
+    blocking: false,
+    message: `user \u2014 ${spellCount} spell(s) from ${storeRoot} (v${store.version}), ${probe} present`
+  };
+}
 async function runDoctor(targetDir, options = {}, assetsDir) {
   console.log("\nspell doctor \u2014 checking your Arcane environment\n");
   if (options.leaks) {
@@ -5633,7 +5843,8 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
     checkPlatformBranchPolicy(targetDir),
     checkDelegations(targetDir),
     checkMcpConfig(targetDir),
-    checkUserTier(resolveHomeDir(), options.packageVersion)
+    checkUserTier(resolveHomeDir(), options.packageVersion),
+    checkSpellScope(targetDir)
   ]);
   const sessionResults = await checkSessionContinuity(targetDir);
   results.push(...sessionResults);
@@ -5681,7 +5892,7 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
 import { readFile as readFile12 } from "fs/promises";
 
 // src/modules/ward.ts
-import { readdir as readdir7, readFile as readFile11 } from "fs/promises";
+import { readdir as readdir8, readFile as readFile11 } from "fs/promises";
 import { join as join14, relative as relative2 } from "path";
 async function scanFileAllRules(absolutePath, displayPath, rules) {
   const findings = [];
@@ -5740,7 +5951,7 @@ async function scanFilenames(root, rules, repoRoot = root) {
   const findings = [];
   let entries;
   try {
-    entries = await readdir7(root, { withFileTypes: true });
+    entries = await readdir8(root, { withFileTypes: true });
   } catch {
     return findings;
   }
@@ -5962,7 +6173,7 @@ import { access as access5 } from "fs/promises";
 import { join as join17 } from "path";
 
 // src/modules/show-report/generate.ts
-import { mkdir as mkdir8, readdir as readdir8, readFile as readFile14, writeFile as writeFile11 } from "fs/promises";
+import { mkdir as mkdir8, readdir as readdir9, readFile as readFile14, writeFile as writeFile11 } from "fs/promises";
 import { basename as basename3, dirname as dirname9, isAbsolute, join as join16, relative as relative3, resolve as resolve4 } from "path";
 
 // src/modules/show-report/model.ts
@@ -6199,9 +6410,10 @@ async function getVersionAtRef(cwd, ref) {
     return null;
   }
 }
-async function getCloseCommit(cwd, completedDate) {
+async function getCloseCommit(cwd, completedDate, generatedOutputs = []) {
   if (!completedDate) {
-    const head = await runGitTextOrNull(cwd, ["rev-parse", "HEAD"]);
+    const args = generatedOutputs.length === 0 ? ["rev-parse", "HEAD"] : ["log", "-1", "--format=%H", "HEAD", "--", ".", ...generatedOutputs.map((p) => `:(exclude)${p}`)];
+    const head = await runGitTextOrNull(cwd, args);
     return head === null || head === "" ? null : head;
   }
   const log = await runGitTextOrNull(cwd, ["log", "--format=%H%x09%cs", "HEAD"]);
@@ -6212,13 +6424,14 @@ async function getCloseCommit(cwd, completedDate) {
   }
   return null;
 }
-async function getCast(cwd, fromRef, toRef) {
+async function getCast(cwd, fromRef, toRef, generatedOutputs = []) {
   const ETX = "";
   const log = await runGitTextOrNull(cwd, [
     "log",
     "--no-merges",
     `--format=%B${ETX}`,
-    `${fromRef}..${toRef}`
+    `${fromRef}..${toRef}`,
+    ...generatedOutputs.length > 0 ? ["--", ".", ...generatedOutputs.map((p) => `:(exclude)${p}`)] : []
   ]);
   const cast = /* @__PURE__ */ new Map();
   if (log === null || log === "") return cast;
@@ -6357,12 +6570,18 @@ async function buildShowReportModel(options) {
   const cast = /* @__PURE__ */ new Map();
   if (frontmatter.baseline) {
     const baselineSha = extractSha(frontmatter.baseline);
-    const closeSha = await getCloseCommit(options.rootDir, frontmatter.completed);
+    const reportDir = options.planRelPath.split("/").slice(0, -1).join("/");
+    const generatedOutputs = ["show-report.json", "show-report.html"].map(
+      (f) => reportDir ? `${reportDir}/${f}` : f
+    );
+    const closeSha = await getCloseCommit(options.rootDir, frontmatter.completed, generatedOutputs);
     if (closeSha) {
       const [from, to, castMap] = await Promise.all([
         getVersionAtRef(options.rootDir, baselineSha),
         getVersionAtRef(options.rootDir, closeSha),
-        getCast(options.rootDir, baselineSha, closeSha)
+        // Regeneration-only commits are never part of the cast, for a closed
+        // program as much as an active one.
+        getCast(options.rootDir, baselineSha, closeSha, generatedOutputs)
       ]);
       if (from && to) versionSpan = { from, to };
       for (const [name, count] of castMap) cast.set(name, count);
@@ -6521,7 +6740,7 @@ async function discoverPrograms(rootDir) {
   const plansDir = join16(rootDir, "docs", "plans");
   let entries;
   try {
-    entries = (await readdir8(plansDir, { withFileTypes: true })).filter((e) => e.isDirectory());
+    entries = (await readdir9(plansDir, { withFileTypes: true })).filter((e) => e.isDirectory());
   } catch (error) {
     if (error.code === "ENOENT") return { programs: [], skipped: [] };
     throw error;
@@ -6540,7 +6759,7 @@ async function programFromPlanPath(rootDir, planPath) {
   const planRelPath = toPosix(relative3(rootDir, planAbs));
   return programFromPlan(rootDir, basename3(dirname9(planAbs)), planRelPath);
 }
-function normalizeLineEndings(content) {
+function normalizeLineEndings2(content) {
   return content.replace(/\r\n?/g, "\n");
 }
 async function readOptionalFile(path4) {
@@ -6586,7 +6805,7 @@ async function runReportGeneration(options) {
     ];
     for (const [relPath, expected] of outputs) {
       const actual = await readOptionalFile(join16(options.rootDir, relPath));
-      if (actual === null || normalizeLineEndings(actual) !== normalizeLineEndings(expected)) {
+      if (actual === null || normalizeLineEndings2(actual) !== normalizeLineEndings2(expected)) {
         drifted.push(`${relPath} does not match a regeneration from its sources.`);
         if (options.mode === "write") {
           await mkdir8(outAbs, { recursive: true });