loki-mode 11.2.1 → 11.3.0

package/autonomy/loki

@@ -13945,1226 +13945,127 @@ print(json.dumps({
     return 0
 }
 
-cmd_doctor() {
-    local json_output=false
-    local airgap_audit=false
-
-    while [[ $# -gt 0 ]]; do
-        case "$1" in
-            --json)
-                json_output=true
-                shift
-                ;;
-            --airgap)
-                airgap_audit=true
-                shift
-                ;;
-            --help|-h)
-                echo -e "${BOLD}loki doctor${NC} - Check system prerequisites"
-                echo ""
-                echo "Usage: loki doctor [--json] [--airgap]"
-                echo ""
-                echo "Options:"
-                echo "  --json    Output machine-readable JSON"
-                echo "  --airgap  Audit network egress: model inference, telemetry and"
-                echo "            the update check, whether each is REQUIRED or optional,"
-                echo "            and how to disable it; names what it does not audit"
-                echo "            (package installs, delegate PR). Exits non-zero if any"
-                echo "            required egress remains."
-                echo ""
-                echo "Checks: node, python3, jq, git, curl, bash version,"
-                echo "        provider CLIs, disk space, and cockpit render capability."
-                return 0
-                ;;
-            *)
-                echo -e "${RED}Unknown option: $1${NC}"
-                echo "Usage: loki doctor [--json] [--airgap]"
-                return 1
-                ;;
-        esac
-    done
-
-    if [ "$airgap_audit" = true ]; then
-        _loki_airgap_audit "$json_output"
-        return $?
-    fi
-
-    if [ "$json_output" = true ]; then
-        cmd_doctor_json
-        return $?
-    fi
-
-    echo -e "${BOLD}Loki Mode Doctor${NC}"
-    echo ""
-    echo "Checking system prerequisites..."
-    echo ""
-
-    local pass_count=0
-    local fail_count=0
-    # Set to 1 when the bundled SDK is the ONLY usable provider (no CLI on PATH).
-    # Declared here, not inside the branch that sets it, so the "Next:" block at
-    # the end of this function always reads an initialized value.
-    local _doctor_sdk_only=0
-    # FUNNEL FIX (v8.2.x): collect the NAME + FIX of every hard failure, not just
-    # a count. A first-time user on a bare machine sees 15 warnings (sentrux, GPG
-    # signing, bash 4, Bun, python3.12, truecolor, inline-image probe -- all
-    # OPTIONAL) around 2 real blockers, then a summary that says only "Some
-    # required prerequisites are missing" without naming them. That is the point
-    # where someone closes the terminal. Naming the blockers and their exact
-    # install command turns a wall of yellow into a two-line to-do.
-    local _doctor_blockers=""
-    _doctor_block() { _doctor_blockers="${_doctor_blockers}\n  - $1"; }
-    local warn_count=0
-
-    # Helper: check command exists and optionally check version
-    doctor_check() {
-        local name="$1"
-        local cmd="$2"
-        local required="$3"  # required, recommended, optional
-        local min_version="${4:-}"
-
-        if ! command -v "$cmd" &> /dev/null; then
-            if [ "$required" = "required" ]; then
-                echo -e "  ${RED}FAIL${NC}  $name - not found"
-                _doctor_block "${name%% (*} is not installed"
-                fail_count=$((fail_count + 1))
-            elif [ "$required" = "recommended" ]; then
-                echo -e "  ${YELLOW}WARN${NC}  $name - not found (recommended)"
-                warn_count=$((warn_count + 1))
-            else
-                echo -e "  ${YELLOW}WARN${NC}  $name - not found (optional)"
-                warn_count=$((warn_count + 1))
-            fi
-            return 1
-        fi
-
-        local version=""
-        case "$cmd" in
-            node)
-                version=$(node --version 2>/dev/null | tr -d 'v')
-                ;;
-            python3)
-                version=$(python3 --version 2>/dev/null | awk '{print $2}')
-                ;;
-            git)
-                version=$(git --version 2>/dev/null | awk '{print $3}')
-                ;;
-            bash)
-                version=$("$cmd" --version 2>/dev/null | head -1 | sed 's/.*version \([0-9.]*\).*/\1/')
-                ;;
-            bun)
-                version=$(bun --version 2>/dev/null | head -1 | tr -d 'v ')
-                ;;
-            jq)
-                version=$(jq --version 2>/dev/null | tr -d 'jq-')
-                ;;
-            curl)
-                version=$(curl --version 2>/dev/null | head -1 | awk '{print $2}')
-                ;;
-            claude)
-                version=$(claude --version 2>/dev/null | head -1 | sed 's/[^0-9.]//g' | head -1)
-                ;;
-            codex)
-                version=$(codex --version 2>/dev/null | head -1 | sed 's/[^0-9.]//g' | head -1)
-                ;;
-            cline)
-                version=$(cline --version 2>/dev/null | head -1 | sed 's/[^0-9.]//g' | head -1)
-                ;;
-            aider)
-                version=$(aider --version 2>/dev/null | head -1 | sed 's/[^0-9.]//g' | head -1)
-                ;;
-            opencode)
-                version=$(opencode --version 2>/dev/null | head -1 | sed 's/[^0-9.]//g' | head -1)
-                ;;
-        esac
-
-        local version_display=""
-        if [ -n "$version" ]; then
-            version_display=" (v$version)"
-        fi
-
-        # Simple major version check if min_version is specified
-        if [ -n "$min_version" ] && [ -n "$version" ]; then
-            local cur_major cur_minor min_major min_minor
-            cur_major=$(echo "$version" | cut -d. -f1)
-            min_major=$(echo "$min_version" | cut -d. -f1)
-            cur_minor=$(echo "$version" | cut -d. -f2)
-            min_minor=$(echo "$min_version" | cut -d. -f2)
-
-            if [ "$cur_major" -lt "$min_major" ] 2>/dev/null || \
-               { [ "$cur_major" -eq "$min_major" ] 2>/dev/null && [ "$cur_minor" -lt "$min_minor" ] 2>/dev/null; }; then
-                if [ "$required" = "required" ]; then
-                    echo -e "  ${RED}FAIL${NC}  $name$version_display - requires >= $min_version"
-                    _doctor_block "${name%% (*} must be >= $min_version"
-                    fail_count=$((fail_count + 1))
-                else
-                    echo -e "  ${YELLOW}WARN${NC}  $name$version_display - recommended >= $min_version"
-                    warn_count=$((warn_count + 1))
-                fi
-                return 1
-            fi
-        fi
-
-        echo -e "  ${GREEN}PASS${NC}  $name$version_display"
-        pass_count=$((pass_count + 1))
-        return 0
-    }
-
-    echo -e "${CYAN}Required:${NC}"
-    doctor_check "Node.js (>= 18)"    node     required    18.0  || true
-    doctor_check "Python 3 (>= 3.8)"  python3  required    3.8   || true
-    doctor_check "jq"                  jq       required          || true
-    doctor_check "git"                 git      required          || true
-    doctor_check "curl"                curl     required          || true
-    echo ""
-
-    echo -e "${CYAN}AI Providers:${NC}"
-    # C1 (doctor UX): when an individual provider CLI is missing, print the
-    # EXACT install command right under the WARN line so the user never has to
-    # look it up. doctor_check returns 1 when the CLI is absent; we capture that
-    # and emit the canonical install command for that provider. Honest: this
-    # only PRINTS the command -- the offer-to-run path lives below, gated on a
-    # TTY, and only when NO provider at all is installed.
-    doctor_provider_install_cmd() {
-        case "$1" in
-            claude) echo "npm install -g @anthropic-ai/claude-code" ;;
-            codex)  echo "npm install -g @openai/codex" ;;
-            cline)  echo "npm install -g cline" ;;
-            aider)  echo "pip install aider-chat" ;;
-            opencode) echo "npm install -g opencode-ai" ;;
-            *)      echo "" ;;
-        esac
-    }
-    doctor_check_provider() {
-        local _label="$1" _cmd="$2"
-        if ! doctor_check "$_label" "$_cmd" optional; then
-            local _install
-            _install=$(doctor_provider_install_cmd "$_cmd")
-            # Route the per-provider install hint to STDERR (fd 2), mirroring the
-            # doctor_probe_note stderr-only pattern above. The Bun route emits the
-            # same hint on STDOUT immediately after the provider WARN line; under
-            # the parity harness's 2>&1 capture both land adjacent to the WARN, so
-            # the two routes stay byte-identical when an optional provider is absent
-            # (v7.63.0: closed the cline-absent parity gap by adding the Bun hint).
-            [ -n "$_install" ] && echo -e "         ${YELLOW}Install: ${_install}${NC}" >&2
-        fi
-    }
-    doctor_check_provider "Claude CLI"  claude || true
-    doctor_check_provider "Codex CLI"   codex  || true
-    doctor_check_provider "Cline CLI"   cline  || true
-    doctor_check_provider "Aider CLI"   aider  || true
-    doctor_check_provider "opencode CLI" opencode || true
-
-    # Check if at least one provider is installed (detect_any_provider is the
-    # shared helper from provider-offer.sh, extracted from this exact loop).
-    if ! detect_any_provider; then
-        # The bundled Claude Agent SDK runs the main loop with no separate CLI,
-        # but ONLY when it is genuinely usable: binary extracted, credentials
-        # present, and the SDK loop actually active. detect_bundled_sdk_provider
-        # fails closed on any doubt, so when it returns false we emit today's
-        # blocker verbatim. Mirrored in loki-ts/src/commands/doctor.ts.
-        if declare -f detect_bundled_sdk_provider >/dev/null 2>&1 && detect_bundled_sdk_provider; then
-            # Say exactly which commands this covers. "No separate CLI needed" was
-            # true for `loki start` and FALSE for demo/quick/quickstart, which stay
-            # on the bash route and require a binary on PATH (provider-offer.sh:44
-            # documents why folding the SDK predicate into detect_any_provider
-            # would be a fail-open). The old wording produced the worst first-run
-            # outcome we have: a green doctor ending in "Next: loki quickstart",
-            # followed by quickstart, demo, quick and start-on-bash all exiting 2.
-            echo -e "  ${GREEN}PASS${NC}  Bundled Claude Agent SDK is usable -- 'loki start' needs no separate CLI"
-            echo -e "         ${YELLOW}Note: loki demo/quick/quickstart still need a provider CLI on PATH${NC}"
-            echo -e "         ${YELLOW}      Install: npm install -g @anthropic-ai/claude-code${NC}"
-            # The note above was only half the fix. The final "Next:" line at the
-            # bottom of this function recommended quickstart unconditionally, so a
-            # user reading a GREEN doctor followed its LAST line straight into
-            # quickstart.sh:476 exit 2. Record the state here (where the predicate
-            # is already evaluated) and let the recommendation read it.
-            _doctor_sdk_only=1
-            pass_count=$((pass_count + 1))
-        else
-            echo -e "  ${RED}FAIL${NC}  No AI provider CLI installed -- at least one is required"
-            echo -e "         ${YELLOW}Install: npm install -g @anthropic-ai/claude-code${NC}"
-            _doctor_block "No AI provider CLI. Fix: npm install -g @anthropic-ai/claude-code"
-            fail_count=$((fail_count + 1))
-            # v7.29.0: on a TTY (non-json), append the consent-gated install offer.
-            # In report mode the helper is a no-op on non-TTY/CI, so the doctor
-            # output stays byte-identical for the bun-parity matrix. --json never
-            # reaches here (cmd_doctor dispatches to cmd_doctor_json earlier).
-            if declare -f offer_provider_install >/dev/null 2>&1; then
-                offer_provider_install report || true
-            fi
+# _loki_bun_delegate <cmd> [args...]
+# Hand a command to its single Bun implementation (FC-DUP, docs/v10/FAILURE-CLASSES.md).
+# Resolves bun the way bin/loki's _loki_bun does (PATH first, then an npm-installed
+# @oven/bun-* package, including bun.exe on Windows), resolves the CLI (dist, then
+# src), preflights `bun <cli> version` under a 5s timeout (when `timeout` exists),
+# then execs. On success it never returns. On failure it returns 1 and sets
+# _LOKI_DELEGATE_WHY (the single reason) and _LOKI_DELEGATE_FIX (one fix line) so
+# the caller can print a minimal diagnostic.
+_loki_bun_delegate() {
+    local cmd="$1"
+    shift
+    local root="${_LOKI_SCRIPT_DIR}/.."
+    local c bun_bin="" cli="" t="" rc=0 found=0
+    _LOKI_DELEGATE_WHY=""
+    _LOKI_DELEGATE_FIX=""
+
+    for c in "$(command -v bun 2>/dev/null || true)" \
+             "$root"/node_modules/@oven/bun-*/bin/bun \
+             "$root"/node_modules/@oven/bun-*/bin/bun.exe \
+             "$root/node_modules/bun/bin/bun.exe"; do
+        [ -n "$c" ] && [ -x "$c" ] || continue
+        found=1
+        if "$c" --version >/dev/null 2>&1; then
+            bun_bin="$c"
+            break
         fi
-    fi
-    echo ""
-
-    # A-123: an EXPLICIT LOKI_PROVIDER names the CLI a build will launch, so that
-    # CLI is required even when another provider is installed. Auto-detection
-    # never reaches here: it only picks an installed provider. Bundled-SDK
-    # claude stays allowed. Mirrored in loki-ts/src/commands/doctor.ts.
-    if [ -n "${LOKI_PROVIDER:-}" ] && [ "$fail_count" -eq 0 ] \
-        && ! command -v "$LOKI_PROVIDER" >/dev/null 2>&1 \
-        && ! { [ "$LOKI_PROVIDER" = "claude" ] && [ "$_doctor_sdk_only" = "1" ]; }; then
-        _sel_install=$(doctor_provider_install_cmd "$LOKI_PROVIDER")
-        echo -e "  ${RED}FAIL${NC}  Selected provider '${LOKI_PROVIDER}' CLI not found"
-        _doctor_block "Selected provider ${LOKI_PROVIDER} CLI not found. Fix: ${_sel_install:-install ${LOKI_PROVIDER}, or unset LOKI_PROVIDER}"
-        fail_count=$((fail_count + 1))
-    fi
-
-    # Provider Availability. Which provider a build would ACTUALLY pick, which
-    # is decided by providers/loader.sh auto_detect_provider, not by PATH order
-    # and not by the section above. Rendered by the shared helper in
-    # provider-offer.sh so the Bun route prints the identical bytes (doctor
-    # stdout is byte-compared -- tests/test-doctor-blocker-parity.sh). Skipped
-    # silently, with no error, when loader.sh is missing or unsourceable.
-    if declare -f render_provider_availability >/dev/null 2>&1; then
-        if render_provider_availability; then
-            echo ""
-        fi
-    fi
-
-    echo -e "${CYAN}API Keys:${NC}"
-    # Note: CLI tools use their own login sessions outside Docker/K8s.
-    # This section helps first-time users verify they can authenticate.
-    if [ -n "${ANTHROPIC_API_KEY:-}" ]; then
-        echo -e "  ${GREEN}PASS${NC}  ANTHROPIC_API_KEY is set"
-        pass_count=$((pass_count + 1))
-    elif command -v claude &>/dev/null; then
-        # Zero-network login check. v7.104.2: prefer the CLI's own local
-        # auth-status (JSON with "loggedIn"), which is authoritative for BOTH the
-        # file-based and the native/Keychain login. This fixes doctor missing a
-        # genuine Keychain login (native install writes NO ~/.claude/.credentials
-        # .json). Fall back to the expiry stamp in the file for older CLIs.
-        _claude_login="$(claude auth status 2>/dev/null | python3 -c "
-import json, sys
-try:
-    v = json.load(sys.stdin).get('loggedIn')
-    # Only the explicit booleans are trusted; a missing/renamed field is
-    # inconclusive and falls through to the file-expiry check (never a spurious
-    # 'not logged in' warning). Matches the run.sh helper + bun doctor.
-    if v is True:
-        print('yes')
-    elif v is False:
-        print('no')
-except Exception:
-    pass
-" 2>/dev/null)"
-        _claude_creds="${CLAUDE_CONFIG_DIR:-$HOME/.claude}/.credentials.json"
-        _claude_expired="$( [ -s "$_claude_creds" ] && python3 -c "
-import json, sys, time
-try:
-    d = json.load(open(sys.argv[1]))
-    exp = d.get('claudeAiOauth', {}).get('expiresAt')
-    print('expired' if isinstance(exp,(int,float)) and exp>0 and (exp/1000.0)<=(time.time()+60) else 'ok')
-except Exception:
-    print('ok')
-" "$_claude_creds" 2>/dev/null || echo ok )"
-        if [ "$_claude_login" = "yes" ]; then
-            echo -e "  ${GREEN}PASS${NC}  Claude CLI is logged in (subscription/OAuth login)"
-            pass_count=$((pass_count + 1))
-        elif [ "$_claude_login" = "no" ]; then
-            # BLOCKER, not a warning. A build cannot run without a login, and the
-            # warning form let a user pass doctor, answer every quickstart prompt,
-            # pick a template and CONFIRM THE SPEND before hitting the refusal at
-            # run.sh's auth preflight. Discovering a missing login after the
-            # consent screen is the worst placement available. Doctor is where a
-            # missing credential belongs. (An ANTHROPIC_API_KEY short-circuits
-            # that preflight, which is why this branch is reached only when the
-            # key is absent too.)
-            echo -e "  ${RED}FAIL${NC}  Claude CLI is NOT logged in -- a build would stall instead of running"
-            echo -e "         ${YELLOW}Fix: claude login${NC}   (or set ANTHROPIC_API_KEY)"
-            _doctor_block "Claude CLI is not logged in. Fix: claude login (or set ANTHROPIC_API_KEY)"
-            fail_count=$((fail_count + 1))
-        elif [ "$_claude_expired" = "expired" ]; then
-            echo -e "  ${RED}FAIL${NC}  Claude login has EXPIRED -- a build would stall instead of running"
-            echo -e "         ${YELLOW}Fix: claude login${NC}   (or set ANTHROPIC_API_KEY)"
-            _doctor_block "Claude login has expired. Fix: claude login (or set ANTHROPIC_API_KEY)"
-            fail_count=$((fail_count + 1))
-        else
-            echo -e "  ${DIM}  --  ${NC}  ANTHROPIC_API_KEY not set (Claude CLI uses its own login)"
-        fi
-    fi
-    if [ -n "${OPENAI_API_KEY:-}" ]; then
-        echo -e "  ${GREEN}PASS${NC}  OPENAI_API_KEY is set"
-        pass_count=$((pass_count + 1))
-    elif command -v codex &>/dev/null; then
-        echo -e "  ${DIM}  --  ${NC}  OPENAI_API_KEY not set (Codex CLI uses its own login)"
-    fi
-    # Phase I (v7.5.25): detect ANTHROPIC_BASE_URL alt-provider routing
-    # (OpenRouter, Ollama, LiteLLM, self-hosted). Claude Code reads this env
-    # var natively; Loki passes it through unchanged. Warn when the user sets
-    # an alt endpoint without LOKI_MODEL_OVERRIDE -- the default opus/sonnet/
-    # haiku aliases may not resolve on the alt-provider.
-    if [ -n "${ANTHROPIC_BASE_URL:-}" ]; then
-        echo -e "  ${GREEN}PASS${NC}  ANTHROPIC_BASE_URL: ${ANTHROPIC_BASE_URL}"
-        pass_count=$((pass_count + 1))
-        if [ -z "${LOKI_MODEL_OVERRIDE:-}" ]; then
-            echo -e "  ${YELLOW}WARN${NC}  LOKI_MODEL_OVERRIDE not set -- opus/sonnet/haiku aliases may not resolve on alt-provider"
-            warn_count=$((warn_count + 1))
+    done
+    if [ -z "$bun_bin" ]; then
+        if [ "$found" = "1" ]; then
+            _LOKI_DELEGATE_WHY="bun failed to start (found but 'bun --version' exited non-zero)"
+            _LOKI_DELEGATE_FIX="Reinstall bun: curl -fsSL https://bun.sh/install | bash"
         else
-            echo -e "  ${GREEN}PASS${NC}  LOKI_MODEL_OVERRIDE: ${LOKI_MODEL_OVERRIDE}"
-            pass_count=$((pass_count + 1))
+            _LOKI_DELEGATE_WHY="bun missing (not on PATH and no @oven/bun-* package under ${root})"
+            _LOKI_DELEGATE_FIX="Install bun: curl -fsSL https://bun.sh/install | bash (or npm install -g bun)"
         fi
+        return 1
     fi
-    echo ""
 
-    echo -e "${CYAN}Skills:${NC}"
-    local skill_dirs=(
-        "$HOME/.claude/skills/loki-mode:Claude Code"
-        "$HOME/.codex/skills/loki-mode:Codex CLI"
-        "$HOME/.cline/skills/loki-mode:Cline CLI"
-        "$HOME/.aider/skills/loki-mode:Aider CLI"
-    )
-    # SEVERITY DEPENDS ON WHOSE SKILL IT IS (v9.48.x). A dangling skill symlink
-    # used to block unconditionally, so a stale link left by an old checkout
-    # path exited 1 on a HEALTHY machine -- while the Provider Availability
-    # section three lines above said that same provider was "not installed".
-    # Doctor contradicted itself on one screen and told the user to fix a tool
-    # they do not have.
-    #
-    # The link only blocks when it belongs to the provider a build would
-    # actually launch. Anything else is inert state: still reported, with the
-    # dangling target and the fix, but not a reason to refuse to start.
-    #
-    # `|| true` is mandatory under `set -euo pipefail`: the accessor returns
-    # non-zero when no provider resolves (a bare call would abort doctor), and
-    # an empty id then makes every entry non-blocking -- the same direction the
-    # No-AI-provider blocker above already covers.
-    local _selected_provider=""
-    if declare -f effective_provider_id >/dev/null 2>&1; then
-        _selected_provider="$(effective_provider_id 2>/dev/null || true)"
-    fi
-    for entry in "${skill_dirs[@]}"; do
-        local sdir="${entry%%:*}"
-        local sname="${entry#*:}"
-        local short_path="${sdir/$HOME/~}"
-        # Provider id from the directory, never a parallel list: `.claude` ->
-        # `claude`. A fifth hand-maintained list is how the lists in this repo
-        # have drifted from auto_detect_provider before (v8.76.0, v8.82.0).
-        local _sid="${sdir#"$HOME"/.}"
-        _sid="${_sid%%/*}"
-        if [ -f "$sdir/SKILL.md" ]; then
-            echo -e "  ${GREEN}PASS${NC}  $sname  ${DIM}$short_path${NC}"
-            pass_count=$((pass_count + 1))
-        elif [ -L "$sdir" ]; then
-            local _target
-            # readlink is NOT in POSIX and is absent from minimal images and
-            # from constrained PATHs (the doctor parity harness builds one).
-            # When it is missing this reported the literal string "unknown"
-            # while the Bun route printed the real target, so the two routes
-            # diverged on the same host and bun-parity went red. ls -ld is
-            # POSIX and always present; strip through the FIRST " -> " only,
-            # since a link target may itself contain that sequence.
-            if command -v readlink >/dev/null 2>&1; then
-                _target=$(readlink "$sdir" 2>/dev/null || echo "unknown")
-            else
-                _target=$(ls -ld "$sdir" 2>/dev/null | sed -e 's/^[^>]*-> //')
-                [ -n "$_target" ] || _target="unknown"
-            fi
-            # Blocking ONLY for the provider a build would actually use. The
-            # non-blocking arm is a WARN rather than a non-counted FAIL on
-            # purpose: a red FAIL badge that never reaches `N failed` or the
-            # `Blocking (N)` list makes the summary disagree with the screen.
-            # Either way the dangling target and the fix are still printed --
-            # the stale link is reported, never silently swallowed.
-            if [ -n "$_selected_provider" ] && [ "$_sid" = "$_selected_provider" ]; then
-                echo -e "  ${RED}FAIL${NC}  $sname  ${DIM}(broken symlink -> $_target)${NC}"
-                echo -e "         ${YELLOW}Fix: loki setup-skill${NC}"
-                _doctor_block "$sname is a broken symlink. Fix: loki setup-skill"
-                fail_count=$((fail_count + 1))
-            else
-                echo -e "  ${YELLOW}WARN${NC}  $sname  ${DIM}(broken symlink -> $_target)${NC}"
-                echo -e "         ${YELLOW}Fix: loki setup-skill${NC}"
-                warn_count=$((warn_count + 1))
-            fi
-        else
-            echo -e "  ${YELLOW}WARN${NC}  $sname  ${DIM}(not found - run 'loki setup-skill')${NC}"
-            warn_count=$((warn_count + 1))
+    if [ -n "${LOKI_TS_ENTRY:-}" ]; then
+        if [ ! -f "$LOKI_TS_ENTRY" ]; then
+            _LOKI_DELEGATE_WHY="LOKI_TS_ENTRY invalid (${LOKI_TS_ENTRY} does not exist)"
+            _LOKI_DELEGATE_FIX="Unset LOKI_TS_ENTRY or point it at a built loki.js"
+            return 1
         fi
-    done
-    echo ""
-
-    echo -e "${CYAN}Integrations:${NC}"
-    # MCP SDK check
-    if python3 -c "import mcp" 2>/dev/null; then
-        echo -e "  ${GREEN}PASS${NC}  MCP SDK (Python)"
-        pass_count=$((pass_count + 1))
-    else
-        echo -e "  ${YELLOW}WARN${NC}  MCP SDK - not installed (pip3 install mcp)"
-        warn_count=$((warn_count + 1))
-    fi
-    # Detect best Python for ML packages (3.12 preferred, 3.14+ has compat issues)
-    local _py_ml="python3"
-    if command -v /opt/homebrew/bin/python3.12 &>/dev/null; then
-        _py_ml="/opt/homebrew/bin/python3.12"
-    elif command -v python3.12 &>/dev/null; then
-        _py_ml="python3.12"
-    fi
-    # Vector search dependencies
-    if $_py_ml -c "import numpy" 2>/dev/null; then
-        echo -e "  ${GREEN}PASS${NC}  numpy (vector search)"
-        pass_count=$((pass_count + 1))
-    else
-        echo -e "  ${YELLOW}WARN${NC}  numpy - not installed (pip3 install numpy)"
-        warn_count=$((warn_count + 1))
-    fi
-    if $_py_ml -c "import sentence_transformers" 2>/dev/null; then
-        echo -e "  ${GREEN}PASS${NC}  sentence-transformers (embeddings)"
-        pass_count=$((pass_count + 1))
-    else
-        echo -e "  ${YELLOW}WARN${NC}  sentence-transformers - not installed (loki memory vectors setup)"
-        warn_count=$((warn_count + 1))
-    fi
-    # C3 (doctor UX): the next checks are bounded network probes, not instant
-    # local lookups. They are the slowest part of doctor (a stale/unreachable
-    # host could otherwise hang on curl's default ~2min connect timeout). We
-    # (a) bound every probe with --connect-timeout/--max-time so a dead host
-    # fails fast, and (b) print a transient progress note to stderr on a TTY so
-    # the user knows doctor is doing network work, not stuck. The note goes to
-    # stderr only -- the parity-captured stdout stays byte-identical across the
-    # bash and Bun routes.
-    doctor_probe_note() {
-        # return 0 is mandatory: [ -t 2 ] returns 1 off a TTY, and under
-        # set -euo pipefail a bare call here aborts the whole doctor run on
-        # CI/headless (the v7.58.1 Bun-Parity crash).
-        [ -t 2 ] && printf '  %s...\r' "$1" >&2
-        return 0
-    }
-    doctor_probe_clear() {
-        # Erase the transient progress line so it does not linger above the
-        # PASS/WARN result. Only on a TTY (where the note was printed).
-        # return 0: same set -e safety as doctor_probe_note.
-        [ -t 2 ] && printf '\r\033[K' >&2
-        return 0
-    }
-    # ChromaDB check (bounded network probe)
-    doctor_probe_note "Probing ChromaDB (port 8100)"
-    if curl -sf --connect-timeout 2 --max-time 5 http://localhost:8100/api/v2/heartbeat >/dev/null 2>&1; then
-        doctor_probe_clear
-        echo -e "  ${GREEN}PASS${NC}  ChromaDB server (port 8100)"
-        pass_count=$((pass_count + 1))
-    else
-        doctor_probe_clear
-        echo -e "  ${YELLOW}WARN${NC}  ChromaDB - not running (docker start loki-chroma)"
-        warn_count=$((warn_count + 1))
-    fi
-    # LSP servers check (v7.7.0): auto-detected by mcp.lsp_proxy; reported
-    # here so users know which languages get agent-side symbol grounding.
-    local _lsp_found=0 _lsp_bin
-    local _lsp_list=""
-    for _lsp_bin in pyright-langserver pylsp typescript-language-server gopls rust-analyzer jdtls; do
-        if command -v "$_lsp_bin" >/dev/null 2>&1; then
-            _lsp_found=$((_lsp_found + 1))
-            _lsp_list="${_lsp_list:+$_lsp_list, }${_lsp_bin}"
+        cli="$LOKI_TS_ENTRY"
+    elif [ -f "$root/loki-ts/dist/loki.js" ]; then
+        cli="$root/loki-ts/dist/loki.js"
+        # Dev checkout: a gitignored dist older than src is stale (same rule as bin/loki).
+        if [ -f "$root/loki-ts/src/cli.ts" ] && [ "$root/loki-ts/src/cli.ts" -nt "$cli" ]; then
+            cli="$root/loki-ts/src/cli.ts"
         fi
-    done
-    if [ "$_lsp_found" -gt 0 ]; then
-        echo -e "  ${GREEN}PASS${NC}  LSP servers detected ($_lsp_found): $_lsp_list"
-        pass_count=$((pass_count + 1))
+    elif [ -f "$root/loki-ts/src/cli.ts" ]; then
+        cli="$root/loki-ts/src/cli.ts"
     else
-        echo -e "  ${YELLOW}WARN${NC}  LSP servers - none on PATH (install for symbol grounding: npm i -g pyright typescript-language-server; brew install gopls)"
-        warn_count=$((warn_count + 1))
-    fi
-    # MiroFish check (optional service)
-    local _mf_url="${LOKI_MIROFISH_URL:-http://localhost:5001}"
-    if docker inspect loki-mirofish &>/dev/null 2>&1 || [[ -n "${LOKI_MIROFISH_URL:-}" ]]; then
-        doctor_probe_note "Probing MiroFish ($_mf_url)"
-        if curl -sf --connect-timeout 2 --max-time 5 "$_mf_url/health" >/dev/null 2>&1; then
-            doctor_probe_clear
-            echo -e "  ${GREEN}PASS${NC}  MiroFish server ($_mf_url)"
-            pass_count=$((pass_count + 1))
-        else
-            doctor_probe_clear
-            echo -e "  ${YELLOW}WARN${NC}  MiroFish - not running (loki start --mirofish-docker <image>)"
-            warn_count=$((warn_count + 1))
-        fi
-    fi
-    # OTEL status
-    if [ -n "${LOKI_OTEL_ENDPOINT:-}" ]; then
-        echo -e "  ${GREEN}PASS${NC}  OTEL endpoint: $LOKI_OTEL_ENDPOINT"
-        pass_count=$((pass_count + 1))
-    else
-        echo -e "  ${YELLOW}WARN${NC}  OTEL - not configured (set LOKI_OTEL_ENDPOINT)"
-        warn_count=$((warn_count + 1))
-    fi
-    # sentrux check (v7.5.14, optional architectural-drift gate)
-    if command -v sentrux &>/dev/null; then
-        local _sentrux_ver
-        _sentrux_ver=$(sentrux --version 2>/dev/null | head -1 | awk '{print $NF}')
-        echo -e "  ${GREEN}PASS${NC}  sentrux ${_sentrux_ver:-unknown} (architectural drift gate: loki sentrux help)"
-        pass_count=$((pass_count + 1))
-    else
-        echo -e "  ${YELLOW}WARN${NC}  sentrux - not installed (optional, brew install sentrux/tap/sentrux)"
-        warn_count=$((warn_count + 1))
-    fi
-    # Receipt signing: Ed25519, auto-generated on first run. WARN only, and
-    # only when something needs attention. Byte-mirrored in doctor.ts.
-    if [ -n "${LOKI_PROOF_GPG_KEY:-}" ]; then
-        echo -e "  ${YELLOW}WARN${NC}  Receipt signing: LOKI_PROOF_GPG_KEY is no longer supported and is ignored; use LOKI_RECEIPT_SIGNING_KEY or LOKI_RECEIPT_SIGNING_KEY_FILE (docs/SIGNED-RECEIPTS.md)"
-        warn_count=$((warn_count + 1))
-    fi
-    if ! python3 -c 'import cryptography' >/dev/null 2>&1; then
-        echo -e "  ${YELLOW}WARN${NC}  Receipt signing: python3 'cryptography' package missing, receipts will be UNSIGNED (pip install cryptography)"
-        warn_count=$((warn_count + 1))
-    fi
-    echo ""
-
-    echo -e "${CYAN}System:${NC}"
-    doctor_check "bash (>= 4.0)"      bash     recommended  4.0  || true
-    # v7.4.9: Bun powers ported commands; warn if missing so users notice the
-    # speedup is unavailable (bin/loki falls through to bash silently).
-    doctor_check "Bun (>= 1.3)"       bun      recommended  1.3  || true
-
-    # Disk space check
-    local disk_avail
-    if command -v df &> /dev/null; then
-        # Get available space in GB (works on macOS and Linux).
-        # v7.4.12: || true on the pipes so set -euo pipefail doesn't exit
-        # the whole doctor when df -g fails on Linux (which doesn't support
-        # the -g flag). Pre-v7.4.12 bash route truncated after the System
-        # section on Linux because of this exact early exit.
-        disk_avail=$(df -g "$HOME" 2>/dev/null | tail -1 | awk '{print $4}' || true)
-        if [ -z "$disk_avail" ]; then
-            # Linux fallback (df -g may not work)
-            disk_avail=$(df -BG "$HOME" 2>/dev/null | tail -1 | awk '{print $4}' | tr -d 'G' || true)
-        fi
-        if [ -n "$disk_avail" ] && [ "$disk_avail" -gt 0 ] 2>/dev/null; then
-            if [ "$disk_avail" -lt 1 ]; then
-                echo -e "  ${RED}FAIL${NC}  Disk space: ${disk_avail}GB available (need >= 1GB)"
-                _doctor_block "Free up disk: ${disk_avail}GB available, need >= 1GB"
-                fail_count=$((fail_count + 1))
-            elif [ "$disk_avail" -lt 5 ]; then
-                echo -e "  ${YELLOW}WARN${NC}  Disk space: ${disk_avail}GB available (low)"
-                warn_count=$((warn_count + 1))
-            else
-                echo -e "  ${GREEN}PASS${NC}  Disk space: ${disk_avail}GB available"
-                pass_count=$((pass_count + 1))
-            fi
-        else
-            echo -e "  ${YELLOW}WARN${NC}  Disk space: unable to determine"
-            warn_count=$((warn_count + 1))
-        fi
+        _LOKI_DELEGATE_WHY="dist missing (no loki-ts/dist/loki.js or loki-ts/src/cli.ts under ${root})"
+        _LOKI_DELEGATE_FIX="Reinstall loki-mode (npm install -g loki-mode) or run: cd loki-ts && bun run build"
+        return 1
     fi
-    echo ""
 
-    # v7.5.1 fix B23: Runtime route -- mirror loki-ts/src/commands/doctor.ts.
-    # Informational only; does NOT contribute to pass/fail/warn counts so
-    # the bun-parity matrix can normalize it without reconciling summary
-    # totals across routes.
-    echo -e "${CYAN}Runtime route:${NC}"
-    echo -e "  ${GREEN}PASS${NC}  Active runtime: Bash (autonomy/loki)"
-    if [ "${LOKI_LEGACY_BASH:-}" = "1" ] || [ "${LOKI_LEGACY_BASH:-}" = "true" ]; then
-        echo -e "  ${YELLOW}WARN${NC}  LOKI_LEGACY_BASH set: shim routes every command to autonomy/loki (bash)"
-    fi
-    if [ -n "${LOKI_TS_ENTRY:-}" ]; then
-        echo -e "  ${GREEN}PASS${NC}  LOKI_TS_ENTRY override: ${LOKI_TS_ENTRY}"
-    fi
-    if [ "${BUN_FROM_SOURCE:-}" = "1" ] || [ "${BUN_FROM_SOURCE:-}" = "true" ]; then
-        echo -e "  ${GREEN}PASS${NC}  BUN_FROM_SOURCE set: shim prefers loki-ts/src/ over dist/"
-    fi
-    # v7.5.2: explicit python3.12 probe -- chromadb + sentence-transformers
-    # require it; the generic Python 3 check passes Python 3.13/3.14 and
-    # silently fails at runtime. Informational only.
-    py312_path=$(command -v python3.12 2>/dev/null || true)
-    if [ -n "$py312_path" ]; then
-        py312_ver=$("$py312_path" -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}")' 2>/dev/null)
-        echo -e "  ${GREEN}PASS${NC}  Python 3.12 (chromadb / sentence-transformers): ${py312_ver} at ${py312_path}"
+    t="$(command -v timeout 2>/dev/null || command -v gtimeout 2>/dev/null || true)"
+    if [ -n "$t" ]; then
+        "$t" -k 1 5 "$bun_bin" "$cli" version >/dev/null 2>&1
     else
-        echo -e "  ${YELLOW}WARN${NC}  Python 3.12 NOT on PATH -- chromadb / sentence-transformers may fail. Install via brew install python@3.12 or apt install python3.12."
+        "$bun_bin" "$cli" version >/dev/null 2>&1
     fi
-    echo ""
-
-    # Model catalog freshness. Providers ship models constantly and this catalog
-    # is hand-maintained, so it rots silently -- nothing else in the system ever
-    # reports its age. Reads ONLY the local file's "updated" field: zero network
-    # I/O, so `loki doctor` stays air-gapped-safe (docs/air-gapped.md). We do not
-    # and will not auto-fetch or guess model IDs; inventing a model that does not
-    # exist is worse than being stale, so refresh stays a human-verified step.
-    #
-    # Informational only -- like Runtime route and Cockpit above, it does NOT
-    # touch pass/warn/fail counts and never calls _doctor_block, so a stale
-    # catalog can never flip doctor's exit code or block a build. Advisory by
-    # construction, not by convention.
-    #
-    # Mirrored byte-for-byte in loki-ts/src/commands/doctor.ts -- the bun-parity
-    # matrix diffs this section (it is NOT in the normalizer's strip list), so
-    # edit BOTH routes or parity fails.
-    echo -e "${CYAN}Model catalog:${NC}"
-    _catalog_path="${LOKI_MODEL_CATALOG:-${_LOKI_SCRIPT_DIR}/../providers/model_catalog.json}"
-    _catalog_line=$(LOKI_CATALOG_PATH="$_catalog_path" python3 -c "
-import json, os, datetime
-# Threshold: 90 days. The upstream probe workflow runs weekly, so a catalog
-# untouched for a quarter means the probe PRs are going unread.
-STALE_DAYS = 90
-p = os.environ['LOKI_CATALOG_PATH']
-try:
-    updated = json.load(open(p))['updated']
-    age = (datetime.datetime.now(datetime.timezone.utc).date() - datetime.date.fromisoformat(updated)).days
-except Exception:
-    print('warn|Catalog unreadable or missing an ISO \"updated\" date -- cannot determine age')
-else:
-    if age > STALE_DAYS:
-        print(f'warn|Last updated {updated} ({age} days ago) -- may be missing newer models. Refresh: python3 tools/probe-model-catalog.py (reports new model IDs from provider docs; you verify and edit the catalog by hand -- never auto-applied)')
-    else:
-        print(f'pass|Last updated {updated} ({age} days ago)')
-" 2>/dev/null)
-    # Fail-open: if python3 is missing or the probe dies, say so and move on.
-    [ -n "$_catalog_line" ] || _catalog_line="warn|Could not probe catalog age"
-    if [ "${_catalog_line%%|*}" = "pass" ]; then
-        echo -e "  ${GREEN}PASS${NC}  ${_catalog_line#*|}"
-    else
-        echo -e "  ${YELLOW}WARN${NC}  ${_catalog_line#*|}"
+    rc=$?
+    if [ "$rc" -ne 0 ]; then
+        _LOKI_DELEGATE_WHY="bun failed exit ${rc} running ${cli} version"
+        _LOKI_DELEGATE_FIX="Reinstall loki-mode (npm install -g loki-mode) or unset LOKI_TS_ENTRY"
+        return 1
     fi
-    echo ""
 
-    # Cockpit capability (E5): report what `loki cockpit` will actually do in
-    # this terminal. Informational only (does NOT touch pass/warn/fail counts,
-    # like Runtime route above), so the bun-parity matrix stays reconcilable.
-    # The protocol + resvg + path come from a bun probe that reuses the real
-    # detection code (loki-ts) so this report can never drift from behavior;
-    # with no bun we honestly report the text-only path.
-    echo -e "${CYAN}Cockpit:${NC}"
-    # Truecolor: purely from COLORTERM, same signal the renderer relies on.
-    case "${COLORTERM:-}" in
-        truecolor|24bit)
-            echo -e "  ${GREEN}PASS${NC}  Truecolor: yes (COLORTERM=${COLORTERM})" ;;
-        *)
-            echo -e "  ${DIM}  --  ${NC}  Truecolor: not signalled (COLORTERM unset) -- colors may be approximate" ;;
-    esac
-    local _ck_ts_dir="${_LOKI_SCRIPT_DIR}/../loki-ts"
-    local _ck_entry="$_ck_ts_dir/dist/cockpit.js"
-    [ -f "$_ck_entry" ] || _ck_entry="$_ck_ts_dir/src/cockpit/cli.ts"
-    if command -v bun >/dev/null 2>&1 && [ -f "$_ck_entry" ]; then
-        echo -e "  ${GREEN}PASS${NC}  Bun present -- cockpit renderer available"
-        local _ck_probe _ck_proto _ck_resvg _ck_path
-        _ck_probe="$(bun "$_ck_entry" --probe 2>/dev/null || true)"
-        _ck_proto="$(printf '%s\n' "$_ck_probe" | sed -n 's/^protocol=//p' | head -1)"
-        _ck_resvg="$(printf '%s\n' "$_ck_probe" | sed -n 's/^resvg=//p' | head -1)"
-        _ck_path="$(printf '%s\n' "$_ck_probe" | sed -n 's/^path=//p' | head -1)"
-        [ -n "$_ck_proto" ] || _ck_proto="none"
-        [ -n "$_ck_resvg" ] || _ck_resvg="no"
-        [ -n "$_ck_path" ]  || _ck_path="text+dashboard"
-        if [ "$_ck_proto" = "none" ]; then
-            echo -e "  ${DIM}  --  ${NC}  Inline-image protocol: none (this terminal has no iTerm2/Kitty graphics)"
-        else
-            echo -e "  ${GREEN}PASS${NC}  Inline-image protocol: ${_ck_proto}"
-        fi
-        if [ "$_ck_resvg" = "yes" ]; then
-            echo -e "  ${GREEN}PASS${NC}  SVG rasterizer: ready (bundled wasm; renders the frame to an image)"
-        else
-            echo -e "  ${DIM}  --  ${NC}  SVG rasterizer: unavailable (cockpit uses text+dashboard)"
-        fi
-        if [ "$_ck_path" = "image" ]; then
-            echo -e "  ${GREEN}PASS${NC}  Render path: inline image ('loki cockpit' draws the frame in-terminal)"
-        else
-            echo -e "  ${DIM}  --  ${NC}  Render path: text + browser dashboard ('loki cockpit' prints a summary; open 'loki dashboard')"
-        fi
-    else
-        echo -e "  ${YELLOW}WARN${NC}  Bun not found -- 'loki cockpit' uses the text summary + browser dashboard (install bun for the inline-image frame)"
-        # Report the protocol line here too. Without it doctor's Cockpit section
-        # is asymmetric: the bun branch prints BOTH "Inline-image protocol" and
-        # "Render path", the no-bun branch printed only "Render path". A user
-        # reading doctor on a machine without bun could not tell whether the
-        # inline-image path was unsupported by their terminal or simply never
-        # probed. Naming the reason keeps the section self-explanatory.
-        echo -e "  ${DIM}  --  ${NC}  Inline-image protocol: not probed (needs bun to run the cockpit renderer)"
-        echo -e "  ${DIM}  --  ${NC}  Render path: text + browser dashboard"
-    fi
-    echo ""
+    exec "$bun_bin" "$cli" "$cmd" "$@"
+}
 
-    # INSTALL INTEGRITY: the quality gates shell out to detector scripts. If the
-    # package shipped without them, four gates fail-CLOSED on every iteration --
-    # correct behaviour (a missing detector must never read as "nothing found"),
-    # but it means the build can never pass and first-pass completion is
-    # impossible no matter how good the output is.
-    #
-    # That shipped: package.json's files[] had no tests/ entry until v8.38.0, so
-    # every npm install had zero detectors. `doctor` reported a healthy system
-    # the whole time, because it only ever checked for external COMMANDS -- not
-    # for the files this package is supposed to contain. A broken install and a
-    # healthy one were indistinguishable from the one command meant to tell them
-    # apart.
-    echo -e "${BOLD}Install integrity:${NC}"
-    local _det_missing="" _det
-    for _det in detect-test-mutations detect-mock-problems \
-                detect-semantic-test-problems detect-invariant-violations; do
-        if [ -f "${_LOKI_SCRIPT_DIR}/../tests/${_det}.sh" ]; then
-            pass_count=$((pass_count + 1))
-        else
-            _det_missing="${_det_missing} ${_det}.sh"
-        fi
+# loki doctor. The one implementation is loki-ts/src/commands/doctor.ts; this is a
+# delegator. Only --airgap stays in bash (_loki_airgap_audit). If the Bun route is
+# unavailable we print a minimal diagnostic (never a second copy of the checks).
+cmd_doctor() {
+    local json_output=false
+    local airgap_audit=false
+    local a
+    for a in "$@"; do
+        case "$a" in
+            --json) json_output=true ;;
+            --airgap) airgap_audit=true ;;
+        esac
     done
-    if [ -z "$_det_missing" ]; then
-        echo -e "  ${GREEN}OK${NC}    Quality-gate detectors present (4/4)"
-    else
-        echo -e "  ${RED}FAIL${NC}  Quality-gate detectors MISSING:${_det_missing}"
-        echo -e "  ${DIM}      These gates fail-closed, so every iteration will be blocked.${NC}"
-        _doctor_block "Incomplete install: quality-gate detectors are missing. Reinstall: bun install -g loki-mode"
-        fail_count=$((fail_count + 1))
-    fi
-    echo ""
 
-    # PATH SHADOWING. Reported from the field twice, and it defeats upgrading
-    # entirely: `bun install -g loki-mode` reports installing 9.39.0, then
-    # `loki --version` prints 9.22.3, because an OLDER copy sits earlier on
-    # PATH (typically ~/.local/bin -> a Homebrew node prefix, ahead of
-    # ~/.bun/bin). Reinstalling cannot fix it; every reinstall updates the copy
-    # that is NOT winning, so the user loops forever on advice that cannot work.
-    #
-    # This is a blocker, not a warning: the user is running code they did not
-    # install and cannot upgrade by the documented route.
-    #
-    # Resolved by realpath so two PATH entries pointing at the SAME install are
-    # not reported as shadowing each other.
-    # Resolve symlinks with whatever the host has. macOS ships no `realpath`
-    # on older versions, so fall back to readlink and finally to the path
-    # itself -- an unresolved path is still comparable, just less precise.
-    _doctor_resolve() {
-        if command -v realpath >/dev/null 2>&1; then
-            realpath "$1" 2>/dev/null || printf '%s' "$1"
-        elif command -v readlink >/dev/null 2>&1; then
-            readlink -f "$1" 2>/dev/null || printf '%s' "$1"
-        else
-            printf '%s' "$1"
-        fi
-    }
-    _running_real="$(command -v loki 2>/dev/null || true)"
-    if [ -n "$_running_real" ]; then
-        _running_real="$(_doctor_resolve "$_running_real")"
-        _shadow_found=""
-        _shadow_seen=""
-        _oldIFS="$IFS"; IFS=':'
-        for _d in $PATH; do
-            [ -n "$_d" ] || continue
-            [ -x "$_d/loki" ] || continue
-            _r="$(_doctor_resolve "$_d/loki")"
-            case "$_shadow_seen" in *"|$_r|"*) continue ;; esac
-            _shadow_seen="${_shadow_seen}|$_r|"
-            [ "$_r" = "$_running_real" ] && continue
-            # <pkg>/bin/loki -> package.json two levels up
-            _pj="$(dirname "$(dirname "$_r")")/package.json"
-            [ -f "$_pj" ] || continue
-            _v="$(python3 -c "import json,sys;print(json.load(open(sys.argv[1])).get('version',''))" "$_pj" 2>/dev/null || true)"
-            [ -n "$_v" ] || continue
-            _shadow_found="${_shadow_found}\n      $_v at $_d/loki"
-        done
-        IFS="$_oldIFS"
-        if [ -n "$_shadow_found" ]; then
-            echo -e "  ${RED}FAIL${NC}  Multiple loki installs on PATH; you are running $(get_version 2>/dev/null || echo unknown)"
-            echo -e "  ${DIM}      Running: $_running_real${NC}"
-            printf "  ${DIM}      Others:%b${NC}\n" "$_shadow_found"
-            echo -e "  ${DIM}      Reinstalling updates a copy that is not winning on PATH.${NC}"
-            _doctor_block "Multiple loki installs on PATH. Run 'which -a loki', then remove or re-point every entry EARLIER than the one you want. Reinstalling alone will not fix this."
-            fail_count=$((fail_count + 1))
-        else
-            echo -e "  ${GREEN}OK${NC}    Single loki install on PATH"
-        fi
-        echo ""
+    if [ "$airgap_audit" = true ]; then
+        _loki_airgap_audit "$json_output"
+        return $?
     fi
 
-    # Summary
-    echo -e "${BOLD}Summary:${NC} ${GREEN}$pass_count passed${NC}, ${RED}$fail_count failed${NC}, ${YELLOW}$warn_count warnings${NC}"
-    echo ""
+    # LOKI_LEGACY_BASH stays set: doctor.ts reads it to report the bash runtime
+    # and print the warning; it never re-routes on it.
+    _loki_bun_delegate doctor "$@" || true
 
-    if [ "$fail_count" -gt 0 ]; then
-        echo -e "${RED}Blocking ($fail_count). Everything else above is optional.${NC}"
-        printf '%b\n' "$_doctor_blockers"
-        echo ""
-        echo "Then re-run: loki doctor"
-        echo "Meanwhile 'loki tour' works right now -- no provider, no key, no spend."
-        # Adoption signal: which CLASS of dependency stopped this first run.
-        # Mapped to an enum here rather than forwarding the blocker TEXT, so
-        # the payload can never carry a path or a version. Best-effort and
-        # backgrounded: telemetry must never delay or fail a doctor run, and
-        # every existing opt-out still gates it downstream.
-        if declare -f loki_emit_first_run_blocked >/dev/null 2>&1; then
-            local _blk_key="other"
-            case "$_doctor_blockers" in
-                *"No AI provider CLI"*) _blk_key="no_provider" ;;
-                *"Node.js is not installed"*|*"Node.js must be"*) _blk_key="node" ;;
-                *"Python 3 is not installed"*|*"Python 3 must be"*) _blk_key="python3" ;;
-                *"jq is not installed"*) _blk_key="jq" ;;
-                *"git is not installed"*) _blk_key="git" ;;
-                *"curl is not installed"*) _blk_key="curl" ;;
-                *"Free up disk"*) _blk_key="disk" ;;
-                *"broken symlink"*) _blk_key="skill_symlink" ;;
-            esac
-            ( loki_emit_first_run_blocked "$_blk_key" >/dev/null 2>&1 </dev/null & ) 2>/dev/null || true
-        fi
-        # A-123: the LAST line is the one blocking reason, exactly.
-        printf '%b' "$_doctor_blockers" | awk '/^  - /{sub(/^  - /,""); print; exit}'
-        return 1
-    elif [ "$warn_count" -gt 0 ]; then
-        echo -e "${YELLOW}All required checks passed with some warnings.${NC}"
+    # Reached only when the delegate could not exec.
+    if [ "$json_output" = true ]; then
+        cmd_doctor_json
     else
-        echo -e "${GREEN}All checks passed. System is ready for Loki Mode.${NC}"
+        echo "loki doctor: the Bun doctor is unavailable, so only this minimal report can run."
+        echo "Fix: ${_LOKI_DELEGATE_FIX}"
+        echo "${_LOKI_DELEGATE_WHY}"
     fi
-    # Setup verified (no required check failed): hand the user straight to a
-    # first build with a copy-paste command, so they never dead-end here. Gated
-    # on fail_count==0 above, so a failing setup is never told to build. The
-    # --json path returns long before this code, so machine output is untouched.
-    echo ""
-    if [ "$_doctor_sdk_only" = "1" ]; then
-        # SDK-only host: quickstart and demo stay on the bash route and need a
-        # binary on PATH, so recommending them here is a green doctor pointing at
-        # an exit 2. Recommend only what actually runs, plus the one command that
-        # unlocks the rest.
-        echo "Next: loki start ./prd.md (runs on the bundled SDK, no CLI install needed)"
-        echo "      For loki quickstart/demo: npm install -g @anthropic-ai/claude-code"
-    else
-        echo "Next: loki quickstart (guided first build from your idea, no PRD needed)"
-        echo "      or loki demo (builds a sample todo app end to end) or loki start ./prd.md"
-    fi
-    # A-123: the last stdout line. Provider and model come from the selected
-    # provider; the key state is read WITHOUT creating a key (auto_generate=False).
-    # Byte-mirrored in loki-ts/src/commands/doctor.ts.
-    local _rd_id _rd_model _rd_key _rd_state
-    _rd_id="${LOKI_PROVIDER:-}"
-    [ -n "$_rd_id" ] || _rd_id="$(effective_provider_id 2>/dev/null || true)"
-    [ -n "$_rd_id" ] || _rd_id="claude"
-    _rd_model="$(bash -c 'source "$1" >/dev/null 2>&1; printf %s "${PROVIDER_MODEL_DEVELOPMENT:-}"' _ "${_LOKI_SCRIPT_DIR}/../providers/${_rd_id}.sh" 2>/dev/null || true)"
-    [ -n "$_rd_model" ] || _rd_model="default"
-    _rd_key="$(python3 -E - "${_LOKI_SCRIPT_DIR}" 2>/dev/null <<'PY' || true
-import os, sys
-sys.path[:] = [p for p in sys.path if p not in ("", ".")]
-sys.path.insert(0, sys.argv[1])
-from receipt_jwt import load_signing_key, _CRYPTO_AVAILABLE, RECEIPT_SIGNER_BASENAME
-if not _CRYPTO_AVAILABLE:
-    print("nocrypto")
-else:
-    k, kid = load_signing_key(auto_generate=False)
-    if kid:
-        print("kid " + kid[:8])
-    elif os.environ.get("LOKI_RECEIPT_SIGNING_KEY", "").strip():
-        print("bad")
-    else:
-        # A-122: a missing key FILE is auto-generated on first use when its nearest
-        # existing ancestor directory is writable; an existing file that did not
-        # load (corrupt/unreadable) or an unwritable location is unusable.
-        f = os.environ.get("LOKI_RECEIPT_SIGNING_KEY_FILE", "").strip() or os.path.expanduser("~/.loki/keys/receipt-ed25519.pem")
-        d = os.path.dirname(os.path.abspath(f))
-        while not os.path.isdir(d) and os.path.dirname(d) != d:
-            d = os.path.dirname(d)
-        print("bad" if os.path.lexists(f) or not os.access(d, os.W_OK | os.X_OK) else "none")
-PY
-)"
-    case "$_rd_key" in
-        "kid "*) _rd_state="receipts signed (${_rd_key})" ;;
-        none)    _rd_state="receipts will be signed on first run" ;;
-        bad)     _rd_state="receipts unsigned: signing key could not be loaded" ;;
-        *)       _rd_state="receipts unsigned: python3 cryptography package missing" ;;
-    esac
-    echo "Ready: ${_rd_id} (${_rd_model}), ${_rd_state}"
-    # Best-effort stale-install nudge (stderr only; never blocks; off on
-    # non-TTY/CI). Reached only on the human-readable path (--json returns above).
-    maybe_print_update_hint
-    return 0
+    return 1
 }
 
-# JSON output for loki doctor --json
+# Minimal --json fallback when the Bun doctor is unavailable. Same top-level keys as
+# DoctorJson (loki-ts/src/commands/doctor.ts) with summary.ok=false, failed=1, plus
+# route:"unavailable" and the reason.
 cmd_doctor_json() {
-    local _loki_version
-    _loki_version=$(get_version)
-    # Provider availability, computed in bash and handed to the python program
-    # as an env var (same pattern as LOKI_VERSION). Computed here rather than
-    # inside the program because the answer comes from sourcing loader.sh.
-    # Empty when loader.sh is unavailable, and the key is then null: the same
-    # graceful skip the text section performs.
-    local _provider_availability=""
-    if declare -f provider_availability_json >/dev/null 2>&1; then
-        _provider_availability="$(provider_availability_json 2>/dev/null || true)"
-    fi
-    LOKI_PROVIDER_AVAILABILITY="$_provider_availability" \
-    LOKI_VERSION="$_loki_version" \
-    LOKI_CATALOG_PATH="${LOKI_MODEL_CATALOG:-${_LOKI_SCRIPT_DIR}/../providers/model_catalog.json}" \
-    python3 -c "
-import json, os, subprocess, sys, shutil
-
-def get_version(cmd, args=None):
-    try:
-        if args is None:
-            args = ['--version']
-        result = subprocess.run([cmd] + args, capture_output=True, text=True, timeout=5)
-        output = result.stdout.strip() or result.stderr.strip()
-        # Extract version number
-        import re
-        match = re.search(r'(\d+\.\d+[\.\d]*)', output)
-        return match.group(1) if match else None
-    except (FileNotFoundError, subprocess.TimeoutExpired, Exception):
-        return None
-
-def check_tool(name, cmd, required, min_version=None):
-    found = shutil.which(cmd) is not None
-    version = get_version(cmd) if found else None
-    status = 'pass'
-
-    if not found:
-        status = 'fail' if required == 'required' else 'warn'
-    elif min_version and version:
-        cur_parts = [int(x) for x in version.split('.')[:2]]
-        min_parts = [int(x) for x in min_version.split('.')[:2]]
-        while len(cur_parts) < 2: cur_parts.append(0)
-        while len(min_parts) < 2: min_parts.append(0)
-        if cur_parts < min_parts:
-            status = 'fail' if required == 'required' else 'warn'
-
-    return {
-        'name': name,
-        'command': cmd,
-        'found': found,
-        'version': version,
-        'required': required,
-        'min_version': min_version,
-        'status': status,
-        'path': shutil.which(cmd)
-    }
-
-checks = []
-checks.append(check_tool('Node.js', 'node', 'required', '18.0'))
-checks.append(check_tool('Python 3', 'python3', 'required', '3.8'))
-checks.append(check_tool('jq', 'jq', 'required'))
-checks.append(check_tool('git', 'git', 'required'))
-checks.append(check_tool('curl', 'curl', 'required'))
-checks.append(check_tool('bash', 'bash', 'recommended', '4.0'))
-checks.append(check_tool('Bun', 'bun', 'recommended', '1.3'))
-checks.append(check_tool('Claude CLI', 'claude', 'optional'))
-checks.append(check_tool('Codex CLI', 'codex', 'optional'))
-checks.append(check_tool('Cline CLI', 'cline', 'optional'))
-checks.append(check_tool('Aider CLI', 'aider', 'optional'))
-checks.append(check_tool('opencode CLI', 'opencode', 'optional'))
-
-# Disk space
-disk_gb = None
-try:
-    stat = os.statvfs(os.path.expanduser('~'))
-    disk_gb = round((stat.f_bavail * stat.f_frsize) / (1024**3), 1)
-except Exception:
-    pass
-
-disk_status = 'pass'
-if disk_gb is not None:
-    if disk_gb < 1:
-        disk_status = 'fail'
-    elif disk_gb < 5:
-        disk_status = 'warn'
-
-# v7.5.15: expose the sentrux architectural-drift gate state in --json so
-# dashboards/automation can surface it the same way the text-mode block does
-# (added in v7.5.14). Sibling of checks/disk -- intentionally not counted in
-# the summary tally to keep summary numbers backwards-compatible.
-sentrux_found = shutil.which('sentrux') is not None
-sentrux_version = get_version('sentrux') if sentrux_found else None
-sentrux_status = 'pass' if sentrux_found else 'warn'
-sentrux = {
-    'found': sentrux_found,
-    'version': sentrux_version,
-    'status': sentrux_status,
-    'required': 'optional'
-}
-
-# v7.7.17: memory subsystem health surface. Reports the latest entries
-# from .loki/memory/.errors.log (rotated by memory/error_log.py) so
-# developers see regressions in the previously-silent-fail call sites
-# at run.sh:8724, 9087, 9136. Sibling of checks/disk/sentrux; not
-# counted in the summary tally to keep backwards-compatible numbers.
-# Inline file read (rather than importing memory.error_log) so this
-# block works regardless of the doctor's invocation cwd / sys.path.
-# v7.7.17 council fix (Opus 2): tail-only read (last 64 KB) so a
-# pathological oversize log cannot OOM the doctor command. Bash + Bun
-# emit the SAME relative path string for parity.
-memory_base = os.path.join(os.environ.get('LOKI_DIR', '.loki'), 'memory')
-_memory_log_path = os.path.join(memory_base, '.errors.log')
-_TAIL_BYTES = 64 * 1024
-memory_recent_errors = []
-if os.path.isfile(_memory_log_path):
-    try:
-        with open(_memory_log_path, 'rb') as _f:
-            _f.seek(0, 2)
-            _size = _f.tell()
-            _offset = max(0, _size - _TAIL_BYTES)
-            _f.seek(_offset)
-            _chunk = _f.read()
-        _text = _chunk.decode('utf-8', errors='replace')
-        _lines = _text.split('\n')
-        if _offset > 0 and _lines:
-            _lines = _lines[1:]  # drop possibly-partial first line
-        _lines = [ln.strip() for ln in _lines if ln.strip()]
-        memory_recent_errors = _lines[-5:]
-    except OSError:
-        memory_recent_errors = []
-memory = {
-    'errors_log_path': _memory_log_path if os.path.isfile(_memory_log_path) else None,
-    'recent_errors': memory_recent_errors,
-    'recent_error_count': len(memory_recent_errors),
-    'status': 'pass' if not memory_recent_errors else 'warn',
-}
-
-# SKILL LINK INTEGRITY. The text path has always failed closed on a broken
-# skill symlink (the Skills section, _doctor_block, exit 1), but --json
-# omitted skills entirely -- so on a host with a dangling ~/.claude/skills/
-# loki-mode the two outputs gave OPPOSITE verdicts: text exited 1 while
-# --json reported failed 0 and ok true. An operator gating on the JSON got a
-# green on a host where the skill cannot load. Same class of fake-green as
-# the ai_provider block below, and fixed the same way: counted in the tally.
-#
-# Per-entry counting matches the text path, which tallies each of the four
-# entries separately. Paths are the same ones the text path already prints,
-# so this exposes nothing new.
-#
-# CAUTION: this block lives inside a DOUBLE-QUOTED python3 -c program, so no
-# apostrophes and no double quotes anywhere here, comments included.
-#
-# SEVERITY MIRRORS THE TEXT PATH: a dangling link is a failure only for the
-# provider a build would actually use. Read from the SAME payload the text
-# route uses (LOKI_PROVIDER_AVAILABILITY, set by cmd_doctor_json), parsed here
-# rather than via a second env var so the two cannot disagree. LOKI_PROVIDER
-# wins for the same reason effective_provider_id honors it.
-_SKILL_ENTRIES = (
-    ('Claude Code', '.claude/skills/loki-mode', 'claude'),
-    ('Codex CLI', '.codex/skills/loki-mode', 'codex'),
-    ('Cline CLI', '.cline/skills/loki-mode', 'cline'),
-    ('Aider CLI', '.aider/skills/loki-mode', 'aider'),
-)
-try:
-    _sk_pa = os.environ.get('LOKI_PROVIDER_AVAILABILITY', '').strip()
-    _sk_selected = (json.loads(_sk_pa).get('selected') or '') if _sk_pa else ''
-except Exception:
-    _sk_selected = ''
-_sk_selected = os.environ.get('LOKI_PROVIDER', '') or _sk_selected
-skills = []
-for _sk_name, _sk_rel, _sk_id in _SKILL_ENTRIES:
-    _sk_dir = os.path.join(os.path.expanduser('~'), _sk_rel)
-    # JSON is commonly archived or forwarded to automation. Keep the useful
-    # user-relative location without exposing the machine-specific home path.
-    _sk_json_path = '~/' + _sk_rel
-    if os.path.isfile(os.path.join(_sk_dir, 'SKILL.md')):
-        skills.append({'name': _sk_name, 'path': _sk_json_path, 'status': 'pass',
-                       'detail': None, 'required': 'required'})
-    elif os.path.islink(_sk_dir):
-        # islink is true for a DANGLING link (lstat-based), which is exactly
-        # the broken case the text path reports. fail only for the effective
-        # provider; otherwise warn, matching the text path badge for badge.
-        # 'required' stays 'required' in both arms: an absent link has always
-        # been warn+required, so the warn arm introduces no new shape, and a
-        # consumer keys on 'status'.
-        _sk_blocking = bool(_sk_selected) and _sk_id == _sk_selected
-        skills.append({'name': _sk_name, 'path': _sk_json_path,
-                       'status': 'fail' if _sk_blocking else 'warn',
-                       'detail': 'broken symlink. Fix: loki setup-skill',
-                       'required': 'required'})
-    else:
-        skills.append({'name': _sk_name, 'path': _sk_json_path, 'status': 'warn',
-                       'detail': 'not found - run loki setup-skill',
-                       'required': 'required'})
-
-pass_count = sum(1 for c in checks if c['status'] == 'pass')
-fail_count = sum(1 for c in checks if c['status'] == 'fail')
-warn_count = sum(1 for c in checks if c['status'] == 'warn')
-
-for _sk in skills:
-    if _sk['status'] == 'pass':
-        pass_count += 1
-    elif _sk['status'] == 'fail':
-        fail_count += 1
-    else:
-        warn_count += 1
-
-if disk_status == 'pass': pass_count += 1
-elif disk_status == 'fail': fail_count += 1
-elif disk_status == 'warn': warn_count += 1
-
-# AGGREGATE PROVIDER CHECK. Each provider CLI is individually optional --
-# you need one of Claude, Codex, Cline, Aider, or opencode -- so no single
-# one can be marked required. But having NONE is a blocker, and the text
-# path reports it as one (the No-AI-provider branch near autonomy/loki:11000).
-#
-# --json omitted this entirely, so on a host with no provider the two
-# outputs gave OPPOSITE verdicts: the text path exited 1 while --json
-# reported zero failures and ok true. An operator gating a pipeline on the
-# JSON got a pass on a machine that cannot run a build -- the fake-green
-# this project exists to refuse.
-#
-# CAUTION: this block lives inside python3 -c with a DOUBLE-QUOTED program,
-# so an apostrophe or a double quote in a comment terminates the shell
-# string and mangles the program. First attempt did exactly that: doctor
-# --json printed nothing and exited 0. Keep this comment quote-free.
-# Must match auto_detect_provider() in providers/loader.sh, in ITS order.
-# Omitting opencode made doctor report 'No AI provider CLI' on a machine
-# where the runner would happily select opencode -- the fifth list in this
-# repo to drift from that authority (see v8.76.0, v8.82.0).
-_provider_cmds = ('claude', 'cline', 'codex', 'aider', 'opencode')
-_any_provider = any(shutil.which(_p) is not None for _p in _provider_cmds)
-ai_provider = {
-    'found': _any_provider,
-    'status': 'pass' if _any_provider else 'fail',
-    'required': 'required',
-    'detail': None if _any_provider
-              else 'No AI provider CLI. Fix: npm install -g @anthropic-ai/claude-code',
-}
-if _any_provider:
-    pass_count += 1
-else:
-    fail_count += 1
-
-# Model catalog freshness. Local read only -- no network. Advisory: deliberately
-# excluded from pass/fail/warn counts and from 'ok', so a stale catalog can never
-# flip doctor's exit code. Mirrors describeCatalogFreshness() in
-# loki-ts/src/commands/doctor.ts.
-CATALOG_STALE_DAYS = 90
-_cat_path = os.environ['LOKI_CATALOG_PATH']
-try:
-    import datetime as _dt
-    _cat_updated = json.load(open(_cat_path))['updated']
-    _cat_age = (_dt.datetime.now(_dt.timezone.utc).date() - _dt.date.fromisoformat(_cat_updated)).days
-    if _cat_age > CATALOG_STALE_DAYS:
-        # Deliberately NOT counted. The block comment above states catalog age is
-        # excluded from pass/fail/warn and from 'ok' so a stale catalog can never
-        # fail a build -- this increment contradicted that contract, and it also
-        # broke route parity: the Bun route (doctor.ts) never counted it, so the
-        # same host reported warnings: 2 on bash and 1 on Bun. bun-parity
-        # compares these byte for byte, so it would have gone red on day 91.
-        model_catalog = {'status': 'warn', 'updated': _cat_updated, 'age_days': _cat_age,
-                         'detail': f'Last updated {_cat_updated} ({_cat_age} days ago) -- may be missing newer models'}
-    else:
-        model_catalog = {'status': 'pass', 'updated': _cat_updated, 'age_days': _cat_age,
-                         'detail': f'Last updated {_cat_updated} ({_cat_age} days ago)'}
-except Exception:
-    model_catalog = {'status': 'warn', 'updated': None, 'age_days': None,
-                     'detail': 'Catalog unreadable or missing an ISO \"updated\" date -- cannot determine age'}
-
-# Provider availability, handed in from bash (see cmd_doctor_json). Null when
-# providers/loader.sh could not be sourced, mirroring the text sections skip.
-# CAUTION: this block lives inside a DOUBLE-QUOTED python3 -c program, so no
-# apostrophes and no double quotes anywhere here, comments included.
-try:
-    _pa_raw = os.environ.get('LOKI_PROVIDER_AVAILABILITY', '').strip()
-    provider_availability = json.loads(_pa_raw) if _pa_raw else None
-except Exception:
-    provider_availability = None
-
-result = {
-    'loki_mode_version': os.environ.get('LOKI_VERSION', 'unknown'),
-    'checks': checks,
-    'provider_availability': provider_availability,
-    'disk': {
-        'available_gb': disk_gb,
-        'status': disk_status
-    },
-    'ai_provider': ai_provider,
-    'skills': skills,
-    'sentrux': sentrux,
-    'memory': memory,
-    'model_catalog': model_catalog,
-    'summary': {
-        'passed': pass_count,
-        'failed': fail_count,
-        'warnings': warn_count,
-        'ok': fail_count == 0
-    }
-}
-
-print(json.dumps(result, indent=2))
-sys.exit(0 if result['summary']['ok'] else 1)
-"
+    local ver why fix
+    ver="$(get_version 2>/dev/null || echo unknown)"
+    why="${_LOKI_DELEGATE_WHY:-bun route unavailable}"
+    fix="${_LOKI_DELEGATE_FIX:-}"
+    why="${why//\\/\\\\}"; why="${why//\"/\\\"}"
+    fix="${fix//\\/\\\\}"; fix="${fix//\"/\\\"}"
+    ver="${ver//\\/\\\\}"; ver="${ver//\"/\\\"}"
+    printf '{"loki_mode_version":"%s","checks":[],"provider_availability":null,"disk":null,"ai_provider":null,"skills":[],"sentrux":null,"memory":null,"model_catalog":null,"summary":{"passed":0,"failed":1,"warnings":0,"ok":false},"route":"unavailable","reason":"%s","fix":"%s"}\n' "$ver" "$why" "$fix"
 }
 
 # Architectural-drift gate (v7.5.14, opt-in).