arcane-cli 1.12.1 → 1.12.3

package/dist/index.js

@@ -17,14 +17,285 @@ import chalk2 from "chalk";
 import {
   mkdir,
   access,
+  lstat,
   readdir,
   readFile,
   rm,
   rmdir,
+  unlink,
   writeFile
 } from "fs/promises";
 import { createHash } from "crypto";
 import path from "path";
+
+// src/modules/git.ts
+import { execFile } from "child_process";
+var GitTimeoutError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "GitTimeoutError";
+  }
+};
+var NETWORK_SUBCOMMANDS = /* @__PURE__ */ new Set(["fetch", "pull", "push", "clone", "ls-remote", "send-email"]);
+var WRITE_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "init",
+  "commit",
+  "add",
+  "checkout",
+  "switch",
+  "merge",
+  "rebase",
+  "reset",
+  "tag",
+  "mv",
+  "rm",
+  "cherry-pick",
+  "revert",
+  "stash",
+  "apply",
+  "am",
+  "restore",
+  "submodule",
+  "sparse-checkout",
+  "maintenance",
+  "notes"
+]);
+var AMBIGUOUS_AS_WRITE = /* @__PURE__ */ new Set(["branch", "config", "remote", "worktree"]);
+var READ_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "status",
+  "rev-parse",
+  "log",
+  "diff",
+  "show",
+  "describe",
+  "cat-file",
+  "ls-files",
+  "ls-tree",
+  "symbolic-ref",
+  "show-ref",
+  "for-each-ref",
+  "merge-base",
+  "blame",
+  "shortlog",
+  "grep",
+  "reflog",
+  "diff-tree",
+  "rev-list",
+  "name-rev",
+  "count-objects",
+  "verify-commit",
+  "verify-tag",
+  "help",
+  "version"
+]);
+var GLOBAL_FLAGS_WITH_SEPARATE_VALUE = /* @__PURE__ */ new Set(["-c", "-C"]);
+var DEFAULT_TIMEOUTS_MS = {
+  read: 15e3,
+  write: 3e4,
+  network: 12e4
+};
+function classifyGitCommand(args) {
+  let subcommand;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (GLOBAL_FLAGS_WITH_SEPARATE_VALUE.has(arg)) {
+      i++;
+      continue;
+    }
+    if (arg.startsWith("-")) continue;
+    subcommand = arg;
+    break;
+  }
+  if (!subcommand) return "read";
+  if (NETWORK_SUBCOMMANDS.has(subcommand)) return "network";
+  if (WRITE_SUBCOMMANDS.has(subcommand) || AMBIGUOUS_AS_WRITE.has(subcommand)) return "write";
+  if (READ_SUBCOMMANDS.has(subcommand)) return "read";
+  return "write";
+}
+function buildGitEnv() {
+  return {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GCM_INTERACTIVE: "Never",
+    GIT_OPTIONAL_LOCKS: "0"
+  };
+}
+function runGit(cwd, args, options = {}) {
+  const commandClass = options.commandClass ?? classifyGitCommand(args);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUTS_MS[commandClass] ?? DEFAULT_TIMEOUTS_MS.write;
+  return new Promise((resolve6, reject) => {
+    const child = execFile(
+      "git",
+      args,
+      {
+        cwd,
+        env: buildGitEnv(),
+        timeout: timeoutMs,
+        // SIGTERM (Node's default) rather than SIGKILL: gives git a chance
+        // to run its own cleanup on POSIX, relevant to EF-20's own concern
+        // about a killed operation leaving refs/locks in an uncertain state.
+        // Moot on Windows -- Node docs: both map to an abrupt TerminateProcess
+        // there -- but this module isn't Windows-gated.
+        killSignal: "SIGTERM",
+        windowsHide: true,
+        encoding: "utf8"
+      },
+      (error, stdout, stderr) => {
+        if (error) {
+          if (error.killed) {
+            reject(
+              new GitTimeoutError(
+                // NOTE: embeds the raw args, including any secrets a future
+                // network-class caller might pass (e.g. a credentialed
+                // clone URL). No current caller does; redact before one does.
+                `git ${args.join(" ")} timed out after ${timeoutMs}ms (class: ${commandClass})`,
+                { cause: error }
+              )
+            );
+            return;
+          }
+          reject(error);
+          return;
+        }
+        resolve6({ stdout, stderr });
+      }
+    );
+    child.stdin?.end();
+  });
+}
+async function inspectGitRepository(cwd) {
+  try {
+    const { stdout: stdout2 } = await runGit(cwd, ["rev-parse", "--is-inside-work-tree"]);
+    if (stdout2.trim() !== "true") {
+      return { status: "not-repository" };
+    }
+  } catch {
+    return { status: "not-repository" };
+  }
+  try {
+    await runGit(cwd, ["rev-parse", "--verify", "HEAD"]);
+  } catch {
+    return { status: "no-commits" };
+  }
+  const { stdout } = await runGit(cwd, ["status", "--porcelain", "-uall"]);
+  const lines = stdout.trim();
+  return {
+    status: "ready",
+    uncommittedChanges: lines.length === 0 ? 0 : lines.split("\n").length
+  };
+}
+async function correctUnbornMasterDefault(cwd) {
+  let current;
+  try {
+    const { stdout } = await runGit(cwd, ["symbolic-ref", "--short", "HEAD"]);
+    current = stdout.trim();
+  } catch {
+    return { corrected: false, to: "main" };
+  }
+  if (current !== "master") {
+    return { corrected: false, to: "main" };
+  }
+  try {
+    await runGit(cwd, ["rev-parse", "--verify", "HEAD"]);
+    return { corrected: false, to: "main" };
+  } catch {
+  }
+  let mainRef;
+  try {
+    mainRef = await runGit(cwd, ["for-each-ref", "--format=%(objectname)", "refs/heads/main"]);
+  } catch {
+    return { corrected: false, to: "main", blockedReason: "target-unreadable" };
+  }
+  if (mainRef.stdout.trim() !== "") {
+    return { corrected: false, to: "main" };
+  }
+  if (mainRef.stderr.trim() !== "") {
+    return { corrected: false, to: "main", blockedReason: "target-unreadable" };
+  }
+  try {
+    await runGit(cwd, ["symbolic-ref", "-q", "refs/heads/main"]);
+    return { corrected: false, to: "main", blockedReason: "target-unreadable" };
+  } catch (error) {
+    if (error.code !== 1) {
+      return { corrected: false, to: "main", blockedReason: "target-unreadable" };
+    }
+  }
+  await runGit(cwd, ["symbolic-ref", "HEAD", "refs/heads/main"]);
+  return { corrected: true, from: current, to: "main" };
+}
+async function ensureLocalPullRebase(cwd) {
+  let rawLocalValue;
+  try {
+    const { stdout } = await runGit(cwd, ["config", "--local", "--get", "pull.rebase"]);
+    rawLocalValue = stdout.trim();
+  } catch {
+    rawLocalValue = void 0;
+  }
+  if (rawLocalValue === void 0) {
+    await runGit(cwd, ["config", "--local", "pull.rebase", "true"]);
+    return { action: "set" };
+  }
+  try {
+    const { stdout } = await runGit(cwd, ["config", "--local", "--type=bool", "--get", "pull.rebase"]);
+    if (stdout.trim() === "false") {
+      return { action: "explicit-false-preserved" };
+    }
+    return { action: "already-set" };
+  } catch {
+    return { action: "already-set" };
+  }
+}
+async function listSymlinkTrackedPaths(cwd) {
+  const paths = /* @__PURE__ */ new Set();
+  let stdout;
+  try {
+    ({ stdout } = await runGit(cwd, ["ls-files", "-s", "-z"]));
+  } catch {
+    return paths;
+  }
+  for (const entry of stdout.split("\0")) {
+    const tab = entry.indexOf("	");
+    if (tab < 0) continue;
+    const [mode] = entry.slice(0, tab).split(" ");
+    if (mode === "120000") paths.add(entry.slice(tab + 1));
+  }
+  return paths;
+}
+async function recordRegularFileInIndex(cwd, relativePath) {
+  const { stdout } = await runGit(cwd, ["hash-object", "-w", "--", relativePath]);
+  const { stdout: prefix } = await runGit(cwd, ["rev-parse", "--show-prefix"]);
+  const rootRelative = `${prefix.trim()}${relativePath.replace(/\\/g, "/")}`;
+  await runGit(cwd, ["update-index", "--add", "--cacheinfo", `100644,${stdout.trim()},${rootRelative}`]);
+}
+async function isUneditedTrackedFile(cwd, relativePath) {
+  let status;
+  try {
+    ({ stdout: status } = await runGit(cwd, ["status", "--porcelain", "-z", "--", relativePath]));
+  } catch {
+    return { verdict: "unknown", detail: "not a git repository, or git is unavailable" };
+  }
+  if (status.startsWith("??")) return { verdict: "untracked", detail: "git does not track it" };
+  if (status.length > 0) return { verdict: "edited", detail: "it has uncommitted changes" };
+  try {
+    const { stdout: shallow } = await runGit(cwd, ["rev-parse", "--is-shallow-repository"]);
+    if (shallow.trim() === "true") {
+      return { verdict: "unknown", detail: "this is a shallow clone, so the history is truncated" };
+    }
+  } catch {
+  }
+  let log;
+  try {
+    ({ stdout: log } = await runGit(cwd, ["log", "--format=%H", "--", relativePath]));
+  } catch {
+    return { verdict: "unknown", detail: "git log could not read its history" };
+  }
+  const commits = log.split("\n").filter(Boolean).length;
+  if (commits === 0) return { verdict: "untracked", detail: "no commit contains it" };
+  if (commits > 1) return { verdict: "edited", detail: `${commits} commits touched it` };
+  return { verdict: "unedited", detail: "tracked, clean, and added by its only commit" };
+}
+
+// src/modules/copier.ts
 function normalizeLineEndings(content) {
   if (!content.includes(13)) return content;
   const out = Buffer.allocUnsafe(content.length);
@@ -72,19 +343,64 @@ async function fileExists(filePath) {
     return false;
   }
 }
-async function copyFile(srcPath, targetDir, relativePath, opts = {}) {
-  validateTargetPath(targetDir, relativePath);
-  const destPath = path.resolve(targetDir, relativePath);
-  await ensureDir(path.dirname(destPath));
-  if (!opts.force && await fileExists(destPath)) {
-    throw new Error(
-      `Destination already exists: "${relativePath}". Use --force to overwrite.`
-    );
+async function replaceSymlinkedDestination(destPath, relativePath, opts) {
+  let isLink;
+  try {
+    isLink = (await lstat(destPath)).isSymbolicLink();
+  } catch {
+    return null;
   }
-  const content = await readFile(srcPath);
-  const hash = hashContent(content);
-  await writeFile(destPath, content);
-  return hash;
+  if (isLink) {
+    await unlink(destPath);
+    return "symlink";
+  }
+  if (opts.linkTracked?.has(relativePath.replace(/\\/g, "/"))) {
+    await unlink(destPath);
+    return "index-symlink";
+  }
+  return null;
+}
+function looksLikeBarePath(body) {
+  const trimmed = body.trim();
+  return trimmed.length <= 512 && /^\.{1,2}\/\S+$/.test(trimmed) && !trimmed.includes("://");
+}
+async function managedPathLinkShape(targetDir, relativePath, linkTracked, bodyHeuristic) {
+  const destPath = path.resolve(targetDir, relativePath);
+  try {
+    if ((await lstat(destPath)).isSymbolicLink()) return "symlink";
+  } catch {
+    return null;
+  }
+  if (linkTracked?.has(relativePath.replace(/\\/g, "/"))) return "index-symlink";
+  if (!bodyHeuristic) return null;
+  try {
+    return looksLikeBarePath(await readFile(destPath, "utf-8")) ? "path-body" : null;
+  } catch {
+    return null;
+  }
+}
+async function writeManagedFile(targetDir, relativePath, content, opts = {}) {
+  validateTargetPath(targetDir, relativePath);
+  const destPath = path.resolve(targetDir, relativePath);
+  await ensureDir(path.dirname(destPath));
+  const shape = await replaceSymlinkedDestination(destPath, relativePath, opts);
+  await writeFile(destPath, content);
+  if (shape === "index-symlink") await recordRegularFileInIndex(targetDir, relativePath);
+  if (shape !== null) opts.conversions?.push({ file: relativePath, shape });
+}
+async function copyFile(srcPath, targetDir, relativePath, opts = {}) {
+  validateTargetPath(targetDir, relativePath);
+  const destPath = path.resolve(targetDir, relativePath);
+  await ensureDir(path.dirname(destPath));
+  if (!opts.force && await fileExists(destPath)) {
+    throw new Error(
+      `Destination already exists: "${relativePath}". Use --force to overwrite.`
+    );
+  }
+  const content = await readFile(srcPath);
+  const hash = hashContent(content);
+  await writeManagedFile(targetDir, relativePath, content, opts);
+  return hash;
 }
 async function removeWithin(targetDir, relativePath) {
   validateTargetPath(targetDir, relativePath);
@@ -976,7 +1292,7 @@ function listProfiles() {
 }
 
 // src/modules/user-tier.ts
-import { lstat, mkdir as mkdir2, readdir as readdir2, readFile as readFile3, rm as rm2, rmdir as rmdir2, writeFile as writeFile3 } from "fs/promises";
+import { lstat as lstat2, mkdir as mkdir2, readdir as readdir2, readFile as readFile3, rm as rm2, rmdir as rmdir2, writeFile as writeFile3 } from "fs/promises";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
 
@@ -1192,7 +1508,7 @@ async function renderUserFanout(storeRoot, spellIds, fallbackDir) {
 }
 async function classifyTarget(path4) {
   try {
-    const stats = await lstat(path4);
+    const stats = await lstat2(path4);
     return stats.isFile() ? "file" : "other";
   } catch (err) {
     if (err.code === "ENOENT") return "absent";
@@ -2194,7 +2510,10 @@ ${rules}
 **Denied:** ${def.tools.denied.join(", ")}
 `;
 }
-function renderSpellRoutingSection() {
+function renderSpellRoutingSection(spellScope) {
+  const userTierRule = spellScope === "user" ? `
+This repository takes its spells from the user tier (\`~/.arcane\`), not from files it carries. If a spell named here does not resolve for your client, stop and say that \`spell init --user\` is needed on this machine; do not improvise the workflow from general knowledge.
+` : "";
   return `## Spell Routing
 
 | When you're about to... | Invoke |
@@ -2208,7 +2527,7 @@ function renderSpellRoutingSection() {
 | Review code or a PR | \`spell-review\` |
 
 If a spell exists for the workflow you are about to perform, invoke it \u2014 do not improvise the workflow from general knowledge, even when the user doesn't name the spell.
-`;
+${userTierRule}`;
 }
 async function loadBranchNamingFragment(assetsDir) {
   try {
@@ -2370,7 +2689,7 @@ async function syncAgents(targetDir, assetsDir, roster, options = {}) {
       unmanagedAgentFiles.push(...await existingAgentFiles(agentsDir));
     }
     if (!userTier) {
-      const copilotSection = `${renderSpellRoutingSection()}
+      const copilotSection = `${renderSpellRoutingSection(options.spellScope)}
 ${branchNaming}${renderAgentRosterSection(resolved)}`;
       const copilotMerged = await mergeIntoFile(
         targetDir,
@@ -2386,7 +2705,7 @@ ${branchNaming}${renderAgentRosterSection(resolved)}`;
     return { synced, skipped, hasUnresolvedRoles, userAgentFiles, unmanagedAgentFiles };
   }
   if (options.claude !== false) {
-    const claudeSection = `${renderSpellRoutingSection()}
+    const claudeSection = `${renderSpellRoutingSection(options.spellScope)}
 ${branchNaming}${renderAgentRosterSection(resolved)}`;
     const claudeMerged = await mergeIntoFile(
       targetDir,
@@ -2397,7 +2716,7 @@ ${branchNaming}${renderAgentRosterSection(resolved)}`;
     if (claudeMerged) synced.push("CLAUDE.md (agents section)");
   }
   if (options.codex !== false) {
-    const codexSection = `${renderSpellRoutingSection()}
+    const codexSection = `${renderSpellRoutingSection(options.spellScope)}
 ${branchNaming}${renderAgentRosterSection(resolved)}`;
     const codexMerged = await mergeIntoFile(
       targetDir,
@@ -2589,389 +2908,171 @@ All 12 roles across ${allCategories.join(", ")}` : "\nPick individual roles from
     schema_version: 2,
     naming_strategy: namingStrategy,
     agent_profile: profileId,
-    openclaw: {
-      enabled: true,
-      workspace_root: "~/.openclaw"
-    },
-    roster: rosterEntries
-  };
-  const arcaneDir = join4(baseDir, "agents");
-  if (!options.dryRun) {
-    await mkdir4(arcaneDir, { recursive: true });
-    await writeFile6(join4(baseDir, "agents.yaml"), stringify(roster), "utf8");
-  } else {
-    console.log(`  [dry-run] Would write: ${label2}/agents.yaml`);
-  }
-  for (const roleId of selectedRoleIds) {
-    const src = join4(assetsDir, "agents", `${roleId}.yaml`);
-    const dest = join4(arcaneDir, `${roleId}.yaml`);
-    if (!options.dryRun) {
-      try {
-        await copyFile2(src, dest);
-      } catch {
-        console.warn(`  ! Could not copy definition for "${roleId}" \u2014 skipping`);
-      }
-    } else {
-      console.log(`  [dry-run] Would copy: ${label2}/agents/${roleId}.yaml`);
-    }
-  }
-  if (options.dryRun) {
-    console.log(
-      `
-  [dry-run] Would initialize roster with ${selectedRoleIds.length} agents`
-    );
-    return;
-  }
-  printStep("Syncing agent definitions to all clients...");
-  const { synced, skipped, hasUnresolvedRoles } = await performAgentSync(
-    targetDir,
-    assetsDir,
-    roster,
-    { dryRun: false, scope }
-  );
-  printSuccess("Agent roster initialized");
-  console.log(`    \u{1F4CB} Profile: ${profileId} \xB7 Naming: ${namingStrategy} \xB7 Agents: ${rosterEntries.length}`);
-  console.log(
-    `    \u{1F504} Synced: ${synced.length} outputs (${scope === "user" ? "agent personas in ~/.claude/agents" : "Copilot, Claude, Codex, OpenClaw"})`
-  );
-  if (skipped.length > 0) {
-    console.log(`    \u26A0\uFE0F  Skipped: ${skipped.length} (${skipped.join(", ")})`);
-  }
-  console.log();
-  console.log(
-    `    \u{1F4A1} Customize: edit ${label2}/agents.yaml \u2192 spell agents sync${scope === "user" ? " --user" : ""}`
-  );
-  console.log();
-  if (hasUnresolvedRoles) {
-    console.error(
-      '  \u2717 One or more rostered roles could not be resolved (see "Skipped" above) \u2014 a malformed or missing agent template must not pass silently.'
-    );
-    process.exitCode = 1;
-  }
-}
-async function runAgentsSync(options, targetDir, assetsDir) {
-  const scope = options.scope ?? "repo";
-  let roster;
-  let definitionsDir;
-  let fromUserTier = false;
-  try {
-    ({ roster, definitionsDir, fromUserTier } = await resolveRoster(targetDir, scope));
-  } catch (err) {
-    if (err instanceof AgentRosterNotFoundError || err instanceof AgentConfigValidationError) {
-      console.error(err.message);
-      process.exit(1);
-      return;
-    }
-    throw err;
-  }
-  if (options.dryRun) {
-    console.log("\n  [dry-run] Would sync agents from roster:\n");
-  } else {
-    console.log("\n  Syncing agents...\n");
-  }
-  if (fromUserTier && scope === "repo") {
-    console.log(
-      "  This repository has no roster of its own and takes its spells from the user tier,\n  so its roster tables are built from ~/.arcane/agents.yaml.\n"
-    );
-  }
-  const { synced, skipped, hasUnresolvedRoles } = await performAgentSync(
-    targetDir,
-    assetsDir,
-    roster,
-    { ...options, scope, ...definitionsDir === void 0 ? {} : { definitionsDir } }
-  );
-  if (options.dryRun) {
-    console.log(`
-  [dry-run] ${synced.length} outputs would be generated`);
-    return;
-  }
-  console.log(`
-  \u2713 Synced ${synced.length} outputs`);
-  for (const item of synced) {
-    console.log(`    + ${item}`);
-  }
-  if (skipped.length > 0) {
-    console.log(`
-  ! Skipped ${skipped.length}:`);
-    for (const item of skipped) {
-      console.log(`    - ${item}`);
-    }
-  }
-  console.log();
-  if (hasUnresolvedRoles) {
-    console.error(
-      '  \u2717 One or more rostered roles could not be resolved (see "Skipped" above) \u2014 a malformed or missing agent template must not pass silently.'
-    );
-    process.exitCode = 1;
-  }
-}
-async function runAgentsList(targetDir, scope = "repo") {
-  let roster;
-  try {
-    roster = await loadRoster(targetDir, scope);
-  } catch (err) {
-    if (err instanceof AgentRosterNotFoundError || err instanceof AgentConfigValidationError) {
-      console.error(err.message);
-      process.exit(1);
-      return;
-    }
-    throw err;
-  }
-  const nameWidth = Math.max(
-    "Name".length,
-    ...roster.roster.map((e) => (e.name ?? e.definition).length)
-  );
-  const defWidth = Math.max(
-    "Role ID".length,
-    ...roster.roster.map((e) => e.definition.length)
-  );
-  const idWidth = Math.max(
-    "OpenClaw ID".length,
-    ...roster.roster.map((e) => e.id.length)
-  );
-  const pad = (s, n) => s.padEnd(n);
-  console.log(
-    `
-  Profile: ${roster.agent_profile}  |  Naming: ${roster.naming_strategy}  |  Agents: ${roster.roster.length}
-`
-  );
-  console.log(
-    `  ${pad("Name", nameWidth)}  ${pad("Role ID", defWidth)}  ${pad("OpenClaw ID", idWidth)}`
-  );
-  console.log(
-    `  ${"-".repeat(nameWidth)}  ${"-".repeat(defWidth)}  ${"-".repeat(idWidth)}`
-  );
-  for (const entry of roster.roster) {
-    console.log(
-      `  ${pad(entry.name ?? "(unnamed)", nameWidth)}  ${pad(entry.definition, defWidth)}  ${pad(entry.id, idWidth)}`
-    );
-  }
-  console.log();
-}
-
-// src/modules/hub.ts
-import { confirm, select as select2, input as input2 } from "@inquirer/prompts";
-import { readdir as readdir5, writeFile as writeFile7 } from "fs/promises";
-import { join as join5 } from "path";
-
-// src/modules/git.ts
-import { execFile } from "child_process";
-var GitTimeoutError = class extends Error {
-  constructor(message, options) {
-    super(message, options);
-    this.name = "GitTimeoutError";
-  }
-};
-var NETWORK_SUBCOMMANDS = /* @__PURE__ */ new Set(["fetch", "pull", "push", "clone", "ls-remote", "send-email"]);
-var WRITE_SUBCOMMANDS = /* @__PURE__ */ new Set([
-  "init",
-  "commit",
-  "add",
-  "checkout",
-  "switch",
-  "merge",
-  "rebase",
-  "reset",
-  "tag",
-  "mv",
-  "rm",
-  "cherry-pick",
-  "revert",
-  "stash",
-  "apply",
-  "am",
-  "restore",
-  "submodule",
-  "sparse-checkout",
-  "maintenance",
-  "notes"
-]);
-var AMBIGUOUS_AS_WRITE = /* @__PURE__ */ new Set(["branch", "config", "remote", "worktree"]);
-var READ_SUBCOMMANDS = /* @__PURE__ */ new Set([
-  "status",
-  "rev-parse",
-  "log",
-  "diff",
-  "show",
-  "describe",
-  "cat-file",
-  "ls-files",
-  "ls-tree",
-  "symbolic-ref",
-  "show-ref",
-  "for-each-ref",
-  "merge-base",
-  "blame",
-  "shortlog",
-  "grep",
-  "reflog",
-  "diff-tree",
-  "rev-list",
-  "name-rev",
-  "count-objects",
-  "verify-commit",
-  "verify-tag",
-  "help",
-  "version"
-]);
-var GLOBAL_FLAGS_WITH_SEPARATE_VALUE = /* @__PURE__ */ new Set(["-c", "-C"]);
-var DEFAULT_TIMEOUTS_MS = {
-  read: 15e3,
-  write: 3e4,
-  network: 12e4
-};
-function classifyGitCommand(args) {
-  let subcommand;
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (GLOBAL_FLAGS_WITH_SEPARATE_VALUE.has(arg)) {
-      i++;
-      continue;
-    }
-    if (arg.startsWith("-")) continue;
-    subcommand = arg;
-    break;
-  }
-  if (!subcommand) return "read";
-  if (NETWORK_SUBCOMMANDS.has(subcommand)) return "network";
-  if (WRITE_SUBCOMMANDS.has(subcommand) || AMBIGUOUS_AS_WRITE.has(subcommand)) return "write";
-  if (READ_SUBCOMMANDS.has(subcommand)) return "read";
-  return "write";
-}
-function buildGitEnv() {
-  return {
-    ...process.env,
-    GIT_TERMINAL_PROMPT: "0",
-    GCM_INTERACTIVE: "Never",
-    GIT_OPTIONAL_LOCKS: "0"
-  };
-}
-function runGit(cwd, args, options = {}) {
-  const commandClass = options.commandClass ?? classifyGitCommand(args);
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUTS_MS[commandClass] ?? DEFAULT_TIMEOUTS_MS.write;
-  return new Promise((resolve6, reject) => {
-    const child = execFile(
-      "git",
-      args,
-      {
-        cwd,
-        env: buildGitEnv(),
-        timeout: timeoutMs,
-        // SIGTERM (Node's default) rather than SIGKILL: gives git a chance
-        // to run its own cleanup on POSIX, relevant to EF-20's own concern
-        // about a killed operation leaving refs/locks in an uncertain state.
-        // Moot on Windows -- Node docs: both map to an abrupt TerminateProcess
-        // there -- but this module isn't Windows-gated.
-        killSignal: "SIGTERM",
-        windowsHide: true,
-        encoding: "utf8"
-      },
-      (error, stdout, stderr) => {
-        if (error) {
-          if (error.killed) {
-            reject(
-              new GitTimeoutError(
-                // NOTE: embeds the raw args, including any secrets a future
-                // network-class caller might pass (e.g. a credentialed
-                // clone URL). No current caller does; redact before one does.
-                `git ${args.join(" ")} timed out after ${timeoutMs}ms (class: ${commandClass})`,
-                { cause: error }
-              )
-            );
-            return;
-          }
-          reject(error);
-          return;
-        }
-        resolve6({ stdout, stderr });
+    openclaw: {
+      enabled: true,
+      workspace_root: "~/.openclaw"
+    },
+    roster: rosterEntries
+  };
+  const arcaneDir = join4(baseDir, "agents");
+  if (!options.dryRun) {
+    await mkdir4(arcaneDir, { recursive: true });
+    await writeFile6(join4(baseDir, "agents.yaml"), stringify(roster), "utf8");
+  } else {
+    console.log(`  [dry-run] Would write: ${label2}/agents.yaml`);
+  }
+  for (const roleId of selectedRoleIds) {
+    const src = join4(assetsDir, "agents", `${roleId}.yaml`);
+    const dest = join4(arcaneDir, `${roleId}.yaml`);
+    if (!options.dryRun) {
+      try {
+        await copyFile2(src, dest);
+      } catch {
+        console.warn(`  ! Could not copy definition for "${roleId}" \u2014 skipping`);
       }
-    );
-    child.stdin?.end();
-  });
-}
-async function inspectGitRepository(cwd) {
-  try {
-    const { stdout: stdout2 } = await runGit(cwd, ["rev-parse", "--is-inside-work-tree"]);
-    if (stdout2.trim() !== "true") {
-      return { status: "not-repository" };
+    } else {
+      console.log(`  [dry-run] Would copy: ${label2}/agents/${roleId}.yaml`);
     }
-  } catch {
-    return { status: "not-repository" };
   }
-  try {
-    await runGit(cwd, ["rev-parse", "--verify", "HEAD"]);
-  } catch {
-    return { status: "no-commits" };
+  if (options.dryRun) {
+    console.log(
+      `
+  [dry-run] Would initialize roster with ${selectedRoleIds.length} agents`
+    );
+    return;
   }
-  const { stdout } = await runGit(cwd, ["status", "--porcelain", "-uall"]);
-  const lines = stdout.trim();
-  return {
-    status: "ready",
-    uncommittedChanges: lines.length === 0 ? 0 : lines.split("\n").length
-  };
-}
-async function correctUnbornMasterDefault(cwd) {
-  let current;
-  try {
-    const { stdout } = await runGit(cwd, ["symbolic-ref", "--short", "HEAD"]);
-    current = stdout.trim();
-  } catch {
-    return { corrected: false, to: "main" };
+  printStep("Syncing agent definitions to all clients...");
+  const { synced, skipped, hasUnresolvedRoles } = await performAgentSync(
+    targetDir,
+    assetsDir,
+    roster,
+    { dryRun: false, scope }
+  );
+  printSuccess("Agent roster initialized");
+  console.log(`    \u{1F4CB} Profile: ${profileId} \xB7 Naming: ${namingStrategy} \xB7 Agents: ${rosterEntries.length}`);
+  console.log(
+    `    \u{1F504} Synced: ${synced.length} outputs (${scope === "user" ? "agent personas in ~/.claude/agents" : "Copilot, Claude, Codex, OpenClaw"})`
+  );
+  if (skipped.length > 0) {
+    console.log(`    \u26A0\uFE0F  Skipped: ${skipped.length} (${skipped.join(", ")})`);
   }
-  if (current !== "master") {
-    return { corrected: false, to: "main" };
+  console.log();
+  console.log(
+    `    \u{1F4A1} Customize: edit ${label2}/agents.yaml \u2192 spell agents sync${scope === "user" ? " --user" : ""}`
+  );
+  console.log();
+  if (hasUnresolvedRoles) {
+    console.error(
+      '  \u2717 One or more rostered roles could not be resolved (see "Skipped" above) \u2014 a malformed or missing agent template must not pass silently.'
+    );
+    process.exitCode = 1;
   }
+}
+async function runAgentsSync(options, targetDir, assetsDir) {
+  const scope = options.scope ?? "repo";
+  let roster;
+  let definitionsDir;
+  let fromUserTier = false;
   try {
-    await runGit(cwd, ["rev-parse", "--verify", "HEAD"]);
-    return { corrected: false, to: "main" };
-  } catch {
+    ({ roster, definitionsDir, fromUserTier } = await resolveRoster(targetDir, scope));
+  } catch (err) {
+    if (err instanceof AgentRosterNotFoundError || err instanceof AgentConfigValidationError) {
+      console.error(err.message);
+      process.exit(1);
+      return;
+    }
+    throw err;
   }
-  let mainRef;
-  try {
-    mainRef = await runGit(cwd, ["for-each-ref", "--format=%(objectname)", "refs/heads/main"]);
-  } catch {
-    return { corrected: false, to: "main", blockedReason: "target-unreadable" };
+  if (options.dryRun) {
+    console.log("\n  [dry-run] Would sync agents from roster:\n");
+  } else {
+    console.log("\n  Syncing agents...\n");
   }
-  if (mainRef.stdout.trim() !== "") {
-    return { corrected: false, to: "main" };
+  if (fromUserTier && scope === "repo") {
+    console.log(
+      "  This repository has no roster of its own and takes its spells from the user tier,\n  so its roster tables are built from ~/.arcane/agents.yaml.\n"
+    );
   }
-  if (mainRef.stderr.trim() !== "") {
-    return { corrected: false, to: "main", blockedReason: "target-unreadable" };
+  const { synced, skipped, hasUnresolvedRoles } = await performAgentSync(
+    targetDir,
+    assetsDir,
+    roster,
+    { ...options, scope, ...definitionsDir === void 0 ? {} : { definitionsDir } }
+  );
+  if (options.dryRun) {
+    console.log(`
+  [dry-run] ${synced.length} outputs would be generated`);
+    return;
   }
-  try {
-    await runGit(cwd, ["symbolic-ref", "-q", "refs/heads/main"]);
-    return { corrected: false, to: "main", blockedReason: "target-unreadable" };
-  } catch (error) {
-    if (error.code !== 1) {
-      return { corrected: false, to: "main", blockedReason: "target-unreadable" };
-    }
+  console.log(`
+  \u2713 Synced ${synced.length} outputs`);
+  for (const item of synced) {
+    console.log(`    + ${item}`);
   }
-  await runGit(cwd, ["symbolic-ref", "HEAD", "refs/heads/main"]);
-  return { corrected: true, from: current, to: "main" };
-}
-async function ensureLocalPullRebase(cwd) {
-  let rawLocalValue;
-  try {
-    const { stdout } = await runGit(cwd, ["config", "--local", "--get", "pull.rebase"]);
-    rawLocalValue = stdout.trim();
-  } catch {
-    rawLocalValue = void 0;
+  if (skipped.length > 0) {
+    console.log(`
+  ! Skipped ${skipped.length}:`);
+    for (const item of skipped) {
+      console.log(`    - ${item}`);
+    }
   }
-  if (rawLocalValue === void 0) {
-    await runGit(cwd, ["config", "--local", "pull.rebase", "true"]);
-    return { action: "set" };
+  console.log();
+  if (hasUnresolvedRoles) {
+    console.error(
+      '  \u2717 One or more rostered roles could not be resolved (see "Skipped" above) \u2014 a malformed or missing agent template must not pass silently.'
+    );
+    process.exitCode = 1;
   }
+}
+async function runAgentsList(targetDir, scope = "repo") {
+  let roster;
   try {
-    const { stdout } = await runGit(cwd, ["config", "--local", "--type=bool", "--get", "pull.rebase"]);
-    if (stdout.trim() === "false") {
-      return { action: "explicit-false-preserved" };
+    roster = await loadRoster(targetDir, scope);
+  } catch (err) {
+    if (err instanceof AgentRosterNotFoundError || err instanceof AgentConfigValidationError) {
+      console.error(err.message);
+      process.exit(1);
+      return;
     }
-    return { action: "already-set" };
-  } catch {
-    return { action: "already-set" };
+    throw err;
+  }
+  const nameWidth = Math.max(
+    "Name".length,
+    ...roster.roster.map((e) => (e.name ?? e.definition).length)
+  );
+  const defWidth = Math.max(
+    "Role ID".length,
+    ...roster.roster.map((e) => e.definition.length)
+  );
+  const idWidth = Math.max(
+    "OpenClaw ID".length,
+    ...roster.roster.map((e) => e.id.length)
+  );
+  const pad = (s, n) => s.padEnd(n);
+  console.log(
+    `
+  Profile: ${roster.agent_profile}  |  Naming: ${roster.naming_strategy}  |  Agents: ${roster.roster.length}
+`
+  );
+  console.log(
+    `  ${pad("Name", nameWidth)}  ${pad("Role ID", defWidth)}  ${pad("OpenClaw ID", idWidth)}`
+  );
+  console.log(
+    `  ${"-".repeat(nameWidth)}  ${"-".repeat(defWidth)}  ${"-".repeat(idWidth)}`
+  );
+  for (const entry of roster.roster) {
+    console.log(
+      `  ${pad(entry.name ?? "(unnamed)", nameWidth)}  ${pad(entry.definition, defWidth)}  ${pad(entry.id, idWidth)}`
+    );
   }
+  console.log();
 }
 
+// src/modules/hub.ts
+import { confirm, select as select2, input as input2 } from "@inquirer/prompts";
+import { readdir as readdir5, writeFile as writeFile7 } from "fs/promises";
+import { join as join5 } from "path";
+
 // src/modules/ado-context.ts
 function remoteUrlHost(url) {
   const trimmed = url.trim();
@@ -4491,14 +4592,14 @@ async function planComponentInstall(component, targetDir, assetsDir, opts = {})
   }
   return { component, files, toCopy: of("missing", "identical"), kept: [], conflicts: of("differs", "directory") };
 }
-async function executeInstallPlan(plan, targetDir) {
+async function executeInstallPlan(plan, targetDir, opts = {}) {
   const files = [];
   const fileHashes = {};
   const written = [];
   try {
     for (const { file, src, state } of plan.toCopy) {
       const previous = state === "missing" ? null : await readFile8(join9(targetDir, file));
-      fileHashes[file] = await copyFile(src, targetDir, file, { force: true });
+      fileHashes[file] = await copyFile(src, targetDir, file, { force: true, ...opts });
       written.push({ file, previous });
       files.push(file);
     }
@@ -4652,7 +4753,7 @@ async function runAdd(names, options, targetDir, assetsDir, packageVersion) {
 
 // src/commands/update.ts
 import { dirname as dirname6, join as join11 } from "path";
-import { readFile as readFile9, writeFile as writeFile10 } from "fs/promises";
+import { readFile as readFile9 } from "fs/promises";
 
 // src/modules/merge3.ts
 var CONFLICT_START = "<<<<<<< yours (edited)";
@@ -4945,11 +5046,11 @@ function describeInstallPlan(plan) {
   }
   return lines;
 }
-async function executeUpdateInstalls(plan, targetDir, packageVersion) {
+async function executeUpdateInstalls(plan, targetDir, packageVersion, copyOpts = {}) {
   const installed = [];
   const lines = [];
   for (const item of plan.items) {
-    const { files, fileHashes } = await executeInstallPlan(item.plan, targetDir);
+    const { files, fileHashes } = await executeInstallPlan(item.plan, targetDir, copyOpts);
     installed.push({
       name: item.plan.component.name,
       files,
@@ -4986,7 +5087,7 @@ async function missingTierWarning(scope, spellScope, homeDir) {
   } catch {
     return [
       "",
-      `  ! This repository takes its spells from the user tier, and ${storeRoot} is not installed.`,
+      `  ! This repository takes its spells from the user tier, and ${storeRoot} is not installed (or its manifest cannot be read).`,
       "    No client can reach a spell here: the routing block in CLAUDE.md and AGENTS.md still",
       "    names spells that resolve to nothing, so an agent improvises the workflow instead of",
       "    failing. Fix it with one of:",
@@ -5092,8 +5193,17 @@ async function resolveOrphan(targetDir, file, recordedHash, prune) {
   if (!await fileExists(filePath)) return "not-found";
   if (!prune) return "reported";
   if (recordedHash === void 0) {
-    console.log(`  ! Orphaned, not pruned (no recorded hash to verify it's untouched): ${file}`);
-    return "reported";
+    const evidence = await isUneditedTrackedFile(targetDir, file);
+    if (evidence.verdict !== "unedited") {
+      console.log(
+        `  ! Orphaned, not pruned: ${file} \u2014 no recorded hash, and git cannot confirm it is untouched (${evidence.detail}). Delete it yourself (git rm -- <path> if git tracks it), then run spell update --prune again to drop it from .arcane.json.`
+      );
+      return "reported";
+    }
+    await removeWithin(targetDir, file);
+    await removeEmptyAncestors(targetDir, file);
+    console.log(`  Pruned orphaned file (no recorded hash; git shows it ${evidence.detail}): ${file}`);
+    return "pruned";
   }
   if (!await fileMatchesHash(filePath, recordedHash)) {
     console.log(`  ! Orphaned but edited since install \u2014 not pruning: ${file}`);
@@ -5237,7 +5347,15 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
   const spellScope = effectiveSpellScope(manifest);
   const readopted = findReadoptedSpellComponents(manifest.components, scope, spellScope);
   const homeDir = dirname6(targetDir);
-  for (const line of await missingTierWarning(scope, spellScope)) console.log(line);
+  const tierGate = await missingTierWarning(scope, spellScope);
+  if (tierGate.length > 0) {
+    for (const line of tierGate) console.error(line);
+    console.error(
+      "  \u2717 Update refused: nothing was written. Install the tier or change spell_scope, then run `spell update` again."
+    );
+    process.exit(1);
+    return;
+  }
   if (scope === "repo") {
     console.warn(
       `WARNING: Arcane v${packageVersion} update safety notice: commit your work before updating.`
@@ -5268,6 +5386,8 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
       return;
     }
   }
+  const linkTracked = scope === "repo" ? await listSymlinkTrackedPaths(targetDir) : /* @__PURE__ */ new Set();
+  const conversions = [];
   const registryChanges = {
     retired: findTrackedRetirements(manifest.components),
     ...scope === "repo" ? {
@@ -5307,7 +5427,10 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
       for (const line of describeInstallPlan(installPlan)) console.log(line);
       return [];
     }
-    const { installed, lines } = await executeUpdateInstalls(installPlan, targetDir, packageVersion);
+    const { installed, lines } = await executeUpdateInstalls(installPlan, targetDir, packageVersion, {
+      linkTracked,
+      conversions
+    });
     for (const line of lines) console.log(line);
     return installed;
   };
@@ -5423,7 +5546,16 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
         if (options.prune && !options.dryRun && installed.files.every((f) => orphanReport.find((o) => o.file === f)?.status !== "reported")) {
           continue;
         }
-        updatedComponents.push(installed);
+        const keptHashes = {};
+        for (const file of stillTracked) {
+          const hash = installed.fileHashes?.[file];
+          if (hash !== void 0) keptHashes[file] = hash;
+        }
+        updatedComponents.push({
+          ...installed,
+          files: stillTracked,
+          ...installed.fileHashes ? { fileHashes: keptHashes } : {}
+        });
         continue;
       }
       throw err;
@@ -5452,7 +5584,8 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
           continue;
         }
       }
-      const editedByOperator = recordedHash !== void 0 && targetExists && !preserveExisting && !await fileMatchesHash(join11(targetDir, file), recordedHash);
+      const linkShape = targetExists ? await managedPathLinkShape(targetDir, file, linkTracked, isClientShimPath(file)) : null;
+      const editedByOperator = recordedHash !== void 0 && targetExists && !preserveExisting && linkShape === null && !await fileMatchesHash(join11(targetDir, file), recordedHash);
       if (preserveExisting) {
         console.log(`  ${options.dryRun ? "[dry-run] Would preserve" : "Preserved"}: ${file}`);
       } else if (editedByOperator && isClientShimPath(file)) {
@@ -5462,7 +5595,9 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
           `  ${options.dryRun ? "[dry-run] Would keep" : "Kept"} customized (not merged): ${file}`
         );
       } else if (options.dryRun) {
-        console.log(`  [dry-run] Would ${sameVersionRestore ? "restore missing" : "update"}: ${file}`);
+        console.log(
+          `  [dry-run] Would ${linkShape !== null ? "convert to a regular file (it is a symlink, or a link written out as text)" : sameVersionRestore ? "restore missing" : "update"}: ${file}`
+        );
         fileCount++;
       } else {
         let handled = false;
@@ -5483,7 +5618,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
               readFile9(srcPath, "utf-8")
             ]);
             const result = merge3(oldVendorContent, currentContent, newContent);
-            await writeFile10(join11(targetDir, file), result.content, "utf-8");
+            await writeManagedFile(targetDir, file, result.content, { linkTracked, conversions });
             fileHashes[file] = await hashFile(srcPath);
             if (result.hasConflict) {
               conflictedFiles.push(file);
@@ -5495,7 +5630,8 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
           }
         }
         if (!handled) {
-          fileHashes[file] = await copyFile(srcPath, targetDir, file, { force: true });
+          fileHashes[file] = await copyFile(srcPath, targetDir, file, { force: true, linkTracked, conversions });
+          if (linkShape === "path-body") conversions.push({ file, shape: "path-body" });
           if (sameVersionRestore) console.log(`  Restored missing: ${file}`);
         }
         fileCount++;
@@ -5509,7 +5645,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
       if (options.dryRun) {
         console.log(`  [dry-run] Would update directory: ${dir}/`);
       } else {
-        const copied = await copyDirectory(srcDirPath, targetDir, dir, { force: true });
+        const copied = await copyDirectory(srcDirPath, targetDir, dir, { force: true, linkTracked, conversions });
         for (const { path: copiedPath, hash } of copied) {
           updatedFiles.push(copiedPath);
           fileHashes[copiedPath] = hash;
@@ -5573,6 +5709,21 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
       console.log("  Run `spell update --prune` to remove the ones that are safe to delete.");
     }
   }
+  if (conversions.length > 0) {
+    console.log(`
+  Converted ${conversions.length} symlinked managed file(s) to regular files (#357):`);
+    const describe = {
+      "index-symlink": "the index tracked it as a symlink (mode 120000); rewritten and staged as a regular file",
+      symlink: "was a symlink in the working tree; now a regular file (stage the typechange with git add)",
+      "path-body": "its body was only a link target, a symlink written out as text; rewritten as a real file"
+    };
+    for (const c of conversions) console.log(`    ${c.file} \u2014 ${describe[c.shape]}`);
+    if (conversions.some((c) => c.shape === "index-symlink")) {
+      console.log(
+        "  Commit the staged typechange, or every other checkout keeps reading a link whose target is the file's own text."
+      );
+    }
+  }
   printRegistryChanges();
   if (customizedShims.length > 0) {
     const verb = options.dryRun ? "[dry-run] Would keep" : "Kept";
@@ -5668,7 +5819,7 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
 import { dirname as dirname8 } from "path";
 
 // src/modules/version-check.ts
-import { readFile as readFile10, writeFile as writeFile11, mkdir as mkdir6 } from "fs/promises";
+import { readFile as readFile10, writeFile as writeFile10, mkdir as mkdir6 } from "fs/promises";
 import { dirname as dirname7, join as join12 } from "path";
 import { homedir as homedir3 } from "os";
 import { createRequire } from "module";
@@ -5700,7 +5851,7 @@ async function readCache(cachePath) {
 async function writeCache(cachePath, latest) {
   await mkdir6(dirname7(cachePath), { recursive: true });
   const entry = { latest, checkedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  await writeFile11(cachePath, JSON.stringify(entry, null, 2), "utf-8");
+  await writeFile10(cachePath, JSON.stringify(entry, null, 2), "utf-8");
 }
 async function getLatestVersion(feedUrl) {
   const normalizedBase = feedUrl.endsWith("/") ? feedUrl : feedUrl + "/";
@@ -7139,6 +7290,49 @@ async function checkPlatformBranchPolicy(targetDir) {
     message: "remote is neither GitHub nor Azure DevOps \u2014 platform policy verification not available for this provider"
   };
 }
+async function checkManagedFileModes(targetDir) {
+  const name = "Managed files are regular files (#357)";
+  let manifest;
+  try {
+    manifest = await readManifest(targetDir);
+  } catch {
+    return { name, passed: true, skipped: true, message: "no .arcane.json \u2014 nothing to check" };
+  }
+  try {
+    await runGit(targetDir, ["rev-parse", "--git-dir"]);
+  } catch {
+    return { name, passed: true, skipped: true, message: "not a git repository \u2014 the index cannot be read" };
+  }
+  const managed = [...new Set(manifest.components.flatMap((c) => c.files))];
+  const linkTracked = await listSymlinkTrackedPaths(targetDir);
+  const asLinks = managed.filter((file) => linkTracked.has(file));
+  const pathBodies = [];
+  for (const file of managed) {
+    if (!isClientShimPath(file) || asLinks.includes(file)) continue;
+    let body;
+    try {
+      body = await readFile13(join16(targetDir, file), "utf-8");
+    } catch {
+      continue;
+    }
+    if (looksLikeBarePath(body)) pathBodies.push(file);
+  }
+  if (asLinks.length === 0 && pathBodies.length === 0) {
+    return { name, passed: true, message: `${managed.length} managed path(s), all regular files` };
+  }
+  const parts = [];
+  if (asLinks.length > 0) {
+    parts.push(`${asLinks.length} tracked as a symlink (mode 120000): ${asLinks.join(", ")}`);
+  }
+  if (pathBodies.length > 0) {
+    parts.push(`${pathBodies.length} client shim(s) whose body is only a path: ${pathBodies.join(", ")}`);
+  }
+  return {
+    name,
+    passed: false,
+    message: parts.join("; ") + " \u2014 clients silently skip or empty these spells. Run `spell update` (it rewrites them as regular files and stages the typechange), then commit."
+  };
+}
 async function checkSpellScope(targetDir, homeDir = resolveHomeDir()) {
   const name = "Spell scope (ARC-045)";
   let manifest;
@@ -7234,6 +7428,7 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
     checkMcpConfig(targetDir),
     checkUserTier(resolveHomeDir(), options.packageVersion),
     checkSpellScope(targetDir),
+    checkManagedFileModes(targetDir),
     checkGovernancePlaceholders(targetDir),
     checkComponentRequires(targetDir),
     checkNewlyAvailableComponents(targetDir)
@@ -8451,7 +8646,7 @@ import { access as access5 } from "fs/promises";
 import { join as join22 } from "path";
 
 // src/modules/show-report/generate.ts
-import { mkdir as mkdir8, readdir as readdir11, readFile as readFile18, writeFile as writeFile12 } from "fs/promises";
+import { mkdir as mkdir8, readdir as readdir11, readFile as readFile18, writeFile as writeFile11 } from "fs/promises";
 import { basename as basename4, dirname as dirname12, isAbsolute, join as join21, relative as relative3, resolve as resolve5 } from "path";
 
 // src/modules/show-report/model.ts
@@ -9122,7 +9317,7 @@ async function runReportGeneration(options) {
         drifted.push(`${relPath} does not match a regeneration from its sources.`);
         if (options.mode === "write") {
           await mkdir8(outAbs, { recursive: true });
-          await writeFile12(join21(options.rootDir, relPath), expected, "utf8");
+          await writeFile11(join21(options.rootDir, relPath), expected, "utf8");
           repaired.push(relPath);
         }
       }