oh-my-codex 0.20.3 → 0.21.0

package/dist/cli/doctor.js

@@ -1,14 +1,15 @@
 /**
  * omx doctor - Validate oh-my-codex installation
  */
-import { createNativeHookClaimJournalDurability, recoverNativeHookClaimJournal, } from "./native-hook-claim-journal.js";
+import { createNativeHookClaimJournalDurability, recoverNativeHookClaimJournal, wrapNativeHookClaimJournalDurability, } from "./native-hook-claim-journal.js";
 import { emitDegradedDurabilityWarning, recordRegularFileSyncOutcome, } from "../utils/file-durability.js";
 import { constants, existsSync, readFileSync } from "fs";
-import { access, chown, lstat, mkdtemp, readdir, readFile, rmdir, rm } from "fs/promises";
+import { access, chown, lstat, mkdir, mkdtemp, readdir, readFile, rename, rmdir, rm } from "fs/promises";
 import { spawnSync } from "child_process";
 import { basename, dirname, join, relative } from "path";
 import { tmpdir } from "os";
 import { codexHome, codexConfigPath, codexPromptsDir, userSkillsDir, projectSkillsDir, omxStateDir, detectLegacySkillRootOverlap, codexAgentsDir, } from "../utils/paths.js";
+import { readCanonicalSessionBindingSnapshot, isModeStateFilename, normalizeSessionId, } from "../mcp/state-paths.js";
 import { classifySpawnError, spawnPlatformCommandSync, } from "../utils/platform-command.js";
 import { getCatalogExpectations } from "./catalog-contract.js";
 import { parse as parseToml } from "@iarna/toml";
@@ -30,6 +31,8 @@ import { OMX_DEFAULT_SPARK_MODEL_ENV, OMX_SPARK_MODEL_ENV, getAgentModelOverride
 import { AGENT_DEFINITIONS } from "../agents/definitions.js";
 import { getInstallableNativeAgentNames } from "../agents/policy.js";
 import { readCatalogManifest } from "../catalog/reader.js";
+import { defaultProcessInspectionProvider, isValidProcessIdentity, resolveSessionPointerContext, } from "../hooks/session.js";
+import { resolveAuthoritativeTeamWorkerContext, resolveConductorPolicyRoot, } from "../team/worker-provenance.js";
 let doctorClaimJournalDurabilityOverride;
 /** @internal Test seam for deterministic claim-journal durability coverage. */
 export function setDoctorClaimJournalDurabilityForTest(durability) {
@@ -127,16 +130,336 @@ function resolveDoctorPaths(cwd, scope) {
         stateDir: omxStateDir(cwd),
     };
 }
+const BINDING_SELECTOR_NAMES = [
+    "OMX_SESSION_ID",
+    "CODEX_SESSION_ID",
+    "SESSION_ID",
+];
+const ROOT_SELECTOR_BY_SOURCE = {
+    "team-env": "OMX_TEAM_STATE_ROOT",
+    "omx-root-env": "OMX_ROOT",
+    "omx-state-root-env": "OMX_STATE_ROOT",
+};
+function bindingEnvironmentRootSelector(env) {
+    if (env.OMX_TEAM_STATE_ROOT?.trim())
+        return { source: "team-env", selector: "OMX_TEAM_STATE_ROOT" };
+    if (env.OMX_ROOT?.trim())
+        return { source: "omx-root-env", selector: "OMX_ROOT" };
+    if (env.OMX_STATE_ROOT?.trim())
+        return { source: "omx-state-root-env", selector: "OMX_STATE_ROOT" };
+    return undefined;
+}
+function printableBindingComponent(value) {
+    return value
+        .replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+function safeSelectedSessionJsonLabel(_path) {
+    return _path ? "session.json" : undefined;
+}
+export function sanitizeBindingDiagnosticLine(value) {
+    const sanitized = printableBindingComponent(value);
+    if (sanitized.length <= 240)
+        return sanitized;
+    return `${sanitized.slice(0, 239)}…`;
+}
+function selectorEvaluation(snapshot, env) {
+    const nonblank = [];
+    const bad = [];
+    const aliases = new Set(Object.values(snapshot.verifiedAliases ?? {}));
+    for (const name of BINDING_SELECTOR_NAMES) {
+        const raw = env[name];
+        if (typeof raw !== "string" || raw.trim() === "")
+            continue;
+        nonblank.push(name);
+        const normalized = normalizeSessionId(raw);
+        const accepted = snapshot.status === "stale-dead"
+            ? normalized !== undefined && normalized === snapshot.verifiedAliases?.session_id
+            : snapshot.status === "usable"
+                ? normalized !== undefined && aliases.has(normalized)
+                : false;
+        if (!accepted)
+            bad.push(name);
+    }
+    return { nonblank, bad };
+}
+export const evaluateStateRootSessionBinding = selectorEvaluation;
+function bindingRecoveryAction(snapshot, rootSelector, badSelectors) {
+    const rootClear = rootSelector ? `clear ${rootSelector} only if unintended; ` : "";
+    const selectorFix = badSelectors.length > 0 ? "clear or correct listed selectors; " : "";
+    if (snapshot.status === "resolution-error") {
+        const resolutionRecovery = rootSelector
+            ? `${rootClear}then relaunch from intended workspace`
+            : "inspect runtime root policy and relaunch";
+        return `${selectorFix}${resolutionRecovery}`;
+    }
+    if (snapshot.status === "absent") {
+        return `${selectorFix}${rootClear}relaunch`;
+    }
+    if (snapshot.status === "read-error") {
+        return `${selectorFix}${rootClear}inspect selected session.json path/access; relaunch`;
+    }
+    if (snapshot.status === "stale-dead") {
+        return `${selectorFix}${rootClear}inspect selected session.json owner identity; run omx session pointer recover only for a positively dead, non-reused owner; reused or uncertain identity requires investigation; relaunch after resolution`;
+    }
+    return `${selectorFix}${rootClear}inspect selected session.json; verify owner; terminate only verified owner if necessary; relaunch`;
+}
+function compactCappedBindingRecoveryAction(snapshot, rootSelector, badSelectors) {
+    const selectorFix = badSelectors.length > 0 ? "clear or correct listed selectors;" : "";
+    const rootClear = rootSelector ? `clear ${rootSelector} only if unintended;` : "";
+    const ownerTermination = snapshot.status === "stale-dead"
+        || snapshot.status === "foreign-cwd"
+        || snapshot.status === "malformed"
+        || snapshot.status === "identity-indeterminate"
+        ? "terminate only verified owner if necessary;"
+        : "";
+    if (snapshot.status === "stale-dead")
+        return `${selectorFix}${rootClear}recover only verified-dead non-reused owner;investigate reused/uncertain identity;relaunch`;
+    if (ownerTermination)
+        return `${selectorFix}${rootClear}${ownerTermination}relaunch`;
+    if (snapshot.status === "read-error")
+        return `${selectorFix}${rootClear}inspect;relaunch`;
+    return `${selectorFix}${rootClear}relaunch`;
+}
+export function formatStateRootSessionBindingDiagnostic(snapshot, env = process.env, badSelectors) {
+    const failedSelectorSet = new Set(badSelectors ?? selectorEvaluation(snapshot, env).bad);
+    const failedSelectors = BINDING_SELECTOR_NAMES.filter((name) => failedSelectorSet.has(name));
+    const reportBadSelectors = failedSelectors;
+    const inferred = snapshot.rootSource ? undefined : bindingEnvironmentRootSelector(env);
+    const source = snapshot.rootSource ?? inferred?.source ?? "cwd-default";
+    const rootSelector = ROOT_SELECTOR_BY_SOURCE[source] ?? inferred?.selector;
+    const pointer = snapshot.status;
+    const unsafe = (pointer !== "usable" && pointer !== "absent") || failedSelectors.length > 0;
+    const fields = [
+        `src=${source}`,
+        ...(rootSelector && unsafe ? [`root_selector=${rootSelector}`] : []),
+        `ptr=${pointer}`,
+        ...(unsafe ? ["binding check made no mutation"] : []),
+        `fix=${bindingRecoveryAction(snapshot, rootSelector, failedSelectors)}`,
+        ...(safeSelectedSessionJsonLabel(snapshot.selectedSessionJson)
+            ? [`selected_session_json=${safeSelectedSessionJsonLabel(snapshot.selectedSessionJson)}`]
+            : []),
+        ...(reportBadSelectors.length > 0 ? [`bad_selectors=${reportBadSelectors.join(",")}`] : []),
+    ];
+    const raw = fields.join(" ");
+    if (raw.length <= 240 && !(rootSelector && unsafe))
+        return sanitizeBindingDiagnosticLine(raw);
+    const staticFields = [
+        `src=${source}`,
+        ...(rootSelector && unsafe ? [`root_selector=${rootSelector}`] : []),
+        `ptr=${pointer}`,
+        ...(unsafe ? ["binding check made no mutation"] : []),
+    ];
+    // Capped output is assembled from whole fields; selector/session evidence is never
+    // truncated. The tail form keeps the selected-path proof atomic when all selectors are present.
+    const compactRecovery = compactCappedBindingRecoveryAction(snapshot, rootSelector, failedSelectors);
+    const selectedSessionLabel = safeSelectedSessionJsonLabel(snapshot.selectedSessionJson);
+    const badSelectorsField = reportBadSelectors.length > 0
+        ? `bad_selectors=${reportBadSelectors.join(",")}`
+        : undefined;
+    const compactPointerCode = pointer === "identity-indeterminate"
+        ? "indet"
+        : pointer === "resolution-error"
+            ? "resolve"
+            : pointer === "missing-recorded-cwd"
+                ? "missing"
+                : pointer === "root-mismatch"
+                    ? "root"
+                    : pointer === "foreign-cwd"
+                        ? "foreign"
+                        : pointer === "stale-dead"
+                            ? "stale"
+                            : pointer === "read-error"
+                                ? "read"
+                                : pointer;
+    if (rootSelector && unsafe) {
+        const canonicalFields = [
+            `src=${source}`,
+            `root=${rootSelector}`,
+            `clear=${rootSelector}-if-unintended`,
+            `ptr=${compactPointerCode}`,
+            ...(failedSelectors.length > 0 ? ["fix=clear/correct"] : []),
+            "no-mutation",
+            ...(compactRecovery.includes("terminate only verified owner if necessary")
+                ? ["owner=terminate-verified-only-if-needed"]
+                : []),
+            ...(snapshot.status === "stale-dead"
+                ? ["recover=dead-nonreused-only", "reused=investigate"]
+                : []),
+            ...(selectedSessionLabel ? ["selected=session.json"] : []),
+            ...(badSelectorsField ? [badSelectorsField] : []),
+        ];
+        return canonicalFields.join(";");
+    }
+    const buildCompactFields = (selectedEvidence, recovery, includeFixLabel = true) => [
+        ...staticFields,
+        ...(includeFixLabel ? [`fix=${recovery}`] : [recovery]),
+        ...(selectedEvidence ? [selectedEvidence] : []),
+        ...(badSelectorsField ? [badSelectorsField] : []),
+    ];
+    const compactWithFullEvidence = buildCompactFields(selectedSessionLabel ? `selected_session_json=${selectedSessionLabel}` : undefined, compactRecovery).join(";");
+    if (compactWithFullEvidence.length <= 240)
+        return sanitizeBindingDiagnosticLine(compactWithFullEvidence);
+    const selectedTail = selectedSessionLabel ? "session.json" : undefined;
+    const compactWithTailEvidence = buildCompactFields(selectedTail, compactRecovery).join(";");
+    if (compactWithTailEvidence.length <= 240)
+        return sanitizeBindingDiagnosticLine(compactWithTailEvidence);
+    const compactWithoutFixLabel = buildCompactFields(selectedTail, compactRecovery, false).join(";");
+    if (compactWithoutFixLabel.length <= 240)
+        return sanitizeBindingDiagnosticLine(compactWithoutFixLabel);
+    const compactPointer = pointer === "identity-indeterminate"
+        ? "indet"
+        : pointer === "resolution-error"
+            ? "resolve"
+            : pointer === "missing-recorded-cwd"
+                ? "missing"
+                : pointer === "root-mismatch"
+                    ? "root"
+                    : pointer === "foreign-cwd"
+                        ? "foreign"
+                        : pointer === "stale-dead"
+                            ? "stale"
+                            : pointer === "read-error"
+                                ? "read"
+                                : pointer;
+    const fallbackFields = [
+        `src=${source}`,
+        ...(rootSelector && unsafe
+            ? [`root=${rootSelector}`, `clear=${rootSelector}-if-unintended`]
+            : []),
+        `ptr=${compactPointer}`,
+        ...(failedSelectors.length > 0 ? ["fix=clear/correct"] : []),
+        "no-mutation",
+        ...(compactRecovery.includes("terminate only verified owner if necessary")
+            ? ["owner=terminate-verified-only-if-needed"]
+            : []),
+        ...(snapshot.status === "stale-dead"
+            ? ["recover=dead-nonreused-only", "reused=investigate"]
+            : []),
+        ...(selectedSessionLabel ? ["selected=session.json"] : []),
+        ...(badSelectorsField ? [badSelectorsField] : []),
+    ];
+    return sanitizeBindingDiagnosticLine(fallbackFields.join(";"));
+}
+export function checkStateRootSessionBinding(snapshot, env = process.env) {
+    const evaluation = selectorEvaluation(snapshot, env);
+    let status = "fail";
+    if (snapshot.status === "absent" && evaluation.bad.length === 0)
+        status = "pass";
+    else if (snapshot.status === "stale-dead" && evaluation.bad.length === 0)
+        status = "warn";
+    else if (snapshot.status === "usable" && evaluation.bad.length === 0)
+        status = "pass";
+    const message = formatStateRootSessionBindingDiagnostic(snapshot, env, evaluation.bad);
+    return { name: "State root/session binding", status, message };
+}
+function stateProjectionArchivePath(baseStateDir, sourcePath, archiveRoot) {
+    const relativePath = relative(baseStateDir, sourcePath);
+    return join(archiveRoot, "state", relativePath);
+}
+async function collisionSafeArchivePath(path) {
+    if (!existsSync(path))
+        return path;
+    const suffix = path.endsWith(".json") ? ".json" : "";
+    const stem = suffix ? path.slice(0, -suffix.length) : path;
+    for (let index = 1;; index += 1) {
+        const candidate = `${stem}.${index}${suffix}`;
+        if (!existsSync(candidate))
+            return candidate;
+    }
+}
+/**
+ * Archive non-authoritative mode-state projections without interpreting their
+ * workflow contents. The canonical session pointer selects the one current
+ * session scope; all other mode projection files are stale by ownership.
+ */
+export async function repairStateProjections(cwd, env = process.env) {
+    const result = {
+        archived: [],
+        preserved: [],
+        skipped: [],
+    };
+    const snapshot = await readCanonicalSessionBindingSnapshot(cwd, env);
+    const baseStateDir = snapshot.baseStateDir;
+    if (!baseStateDir || ["resolution-error", "read-error", "malformed", "missing-recorded-cwd", "root-mismatch", "foreign-cwd"].includes(snapshot.status)) {
+        return result;
+    }
+    const currentSessionId = snapshot.state && ["usable", "identity-indeterminate"].includes(snapshot.status)
+        ? normalizeSessionId(snapshot.state.session_id)
+        : undefined;
+    const stateDirs = [baseStateDir];
+    try {
+        const sessionsRoot = join(baseStateDir, "sessions");
+        const sessionEntries = await readdir(sessionsRoot, { withFileTypes: true });
+        for (const entry of sessionEntries) {
+            if (entry.isDirectory() && normalizeSessionId(entry.name) === entry.name) {
+                stateDirs.push(join(sessionsRoot, entry.name));
+            }
+        }
+    }
+    catch {
+        // A missing sessions directory is normal; the canonical root is enough.
+    }
+    const archiveRoot = join(dirname(baseStateDir), "archive");
+    for (const stateDir of stateDirs) {
+        const isRoot = stateDir === baseStateDir;
+        const sessionId = isRoot ? undefined : basename(stateDir);
+        const preserveDir = isRoot
+            ? currentSessionId === undefined
+            : sessionId === currentSessionId;
+        let entries;
+        try {
+            entries = await readdir(stateDir);
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (!isModeStateFilename(entry))
+                continue;
+            const sourcePath = join(stateDir, entry);
+            if (preserveDir) {
+                result.preserved.push(sourcePath);
+                continue;
+            }
+            try {
+                const sourceStat = await lstat(sourcePath);
+                if (!sourceStat.isFile()) {
+                    result.skipped.push(`${sourcePath}: not a regular projection file`);
+                    continue;
+                }
+                const destination = await collisionSafeArchivePath(stateProjectionArchivePath(baseStateDir, sourcePath, archiveRoot));
+                await mkdir(dirname(destination), { recursive: true });
+                await rename(sourcePath, destination);
+                result.archived.push(destination);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                result.skipped.push(`${sourcePath}: ${message}`);
+            }
+        }
+    }
+    return result;
+}
 export async function doctor(options = {}) {
     if (options.team) {
         await doctorTeam();
         return;
     }
     const cwd = process.cwd();
+    const bindingSnapshot = await readCanonicalSessionBindingSnapshot(cwd, process.env);
     const scopeResolution = await resolveDoctorScope(cwd);
     const paths = resolveDoctorPaths(cwd, scopeResolution.scope);
+    if (options.repairState) {
+        const repair = await repairStateProjections(cwd);
+        console.log(`State projection repair: archived ${repair.archived.length}, preserved ${repair.preserved.length}, skipped ${repair.skipped.length}`);
+        for (const skipped of repair.skipped)
+            console.log(`  skipped: ${skipped}`);
+        console.log();
+    }
     const recoveryTracker = { degraded: false };
-    const recovery = await recoverNativeHookClaimJournal(paths.codexHomeDir, doctorClaimJournalDurabilityOverride ?? createNativeHookClaimJournalDurability());
+    const recovery = await recoverNativeHookClaimJournal(paths.codexHomeDir, wrapNativeHookClaimJournalDurability(doctorClaimJournalDurabilityOverride ?? createNativeHookClaimJournalDurability(process.platform), recoveryTracker));
     recordRegularFileSyncOutcome(recoveryTracker, recovery.outcome);
     emitDegradedDurabilityWarning("native-hook claim-journal recovery", recoveryTracker);
     const scopeSourceMessage = scopeResolution.source === "persisted"
@@ -177,6 +500,9 @@ export async function doctor(options = {}) {
     checks.push(checkCodexCli());
     // Check 2: Node.js version
     checks.push(checkNodeVersion());
+    const processIdentityCheck = checkProcessIdentityReadiness();
+    if (processIdentityCheck)
+        checks.push(processIdentityCheck);
     // Check 2.5: Explore harness readiness
     const exploreRoutingState = await resolveExploreRoutingState(paths.configPath);
     checks.push(checkExploreHarness(process.platform, process.env, {
@@ -239,7 +565,17 @@ export async function doctor(options = {}) {
     // Check 7: AGENTS.md in project
     checks.push(checkAgentsMd(scopeResolution.scope, paths.codexHomeDir, scopeResolution.installMode));
     // Check 8: State directory
-    checks.push(checkDirectory("State dir", paths.stateDir));
+    if (bindingSnapshot.status === "resolution-error") {
+        checks.push({
+            name: "State dir",
+            status: "fail",
+            message: "effective root unavailable (binding resolution-error)",
+        });
+    }
+    else {
+        checks.push(checkDirectory("State dir", bindingSnapshot.baseStateDir ?? paths.stateDir));
+    }
+    checks.push(checkStateRootSessionBinding(bindingSnapshot, process.env));
     checks.push(await checkRepoArtifactOwnership(cwd));
     // Check 9: MCP servers configured
     checks.push(await checkMcpServers(paths.configPath, scopeResolution.installMode, scopeResolution.mcpMode));
@@ -455,6 +791,55 @@ async function collectTeamDoctorIssues(cwd) {
                     // ignore malformed files
                 }
             }
+            // #3536: run the same runtime preflight the native hook applies. A
+            // worker whose metadata cannot establish an authoritative context, or
+            // whose verified state root still yields an unusable Conductor policy
+            // root, would be denied at runtime while doctor reports all-pass.
+            const identityPath = join(workerDir, "identity.json");
+            if (existsSync(identityPath)) {
+                try {
+                    const identity = JSON.parse(await readFile(identityPath, "utf-8"));
+                    const manifestForWorker = existsSync(manifestPath)
+                        ? JSON.parse(await readFile(manifestPath, "utf-8"))
+                        : {};
+                    const workerCwd = typeof identity.worktree_path === "string" && identity.worktree_path.trim() !== ""
+                        ? identity.worktree_path.trim()
+                        : typeof identity.working_dir === "string" ? identity.working_dir.trim() : "";
+                    const identityStateRoot = typeof identity.team_state_root === "string" && identity.team_state_root.trim() !== ""
+                        ? identity.team_state_root.trim()
+                        : stateDir;
+                    const leaderCwd = typeof manifestForWorker.leader_cwd === "string" ? manifestForWorker.leader_cwd.trim() : "";
+                    if (workerCwd) {
+                        const workerEnv = {
+                            OMX_TEAM_INTERNAL_WORKER: `${teamName}/${worker.name}`,
+                            OMX_TEAM_STATE_ROOT: identityStateRoot,
+                            OMX_TEAM_LEADER_CWD: leaderCwd,
+                        };
+                        const evidence = await resolveAuthoritativeTeamWorkerContext(workerCwd, { env: workerEnv });
+                        if (!evidence) {
+                            issues.push({
+                                code: "worker_policy_root_unusable",
+                                message: `${teamName}/${worker.name} identity/config/manifest metadata does not establish an authoritative worker context; runtime authorization would deny this worker`,
+                                severity: "fail",
+                            });
+                        }
+                        else {
+                            const selectedStateDir = resolveSessionPointerContext(workerCwd, workerEnv).baseStateDir;
+                            const policyRoot = resolveConductorPolicyRoot(selectedStateDir, workerCwd, evidence);
+                            if (!policyRoot.valid) {
+                                issues.push({
+                                    code: "worker_policy_root_unusable",
+                                    message: `${teamName}/${worker.name} selected state root ${selectedStateDir} has no usable canonical session cwd and no verified Team-root binding; runtime authorization would deny this worker`,
+                                    severity: "fail",
+                                });
+                            }
+                        }
+                    }
+                }
+                catch {
+                    // ignore malformed worker metadata
+                }
+            }
         }
     }
     // stale_leader: team has active workers but leader has no recent activity
@@ -611,6 +996,48 @@ function checkNodeVersion() {
         message: `v${process.versions.node} (need >= 20)`,
     };
 }
+export function checkProcessIdentityReadiness(options = {}) {
+    const platform = options.platform ?? process.platform;
+    if (platform !== "darwin" && platform !== "win32")
+        return null;
+    const pid = options.pid ?? process.pid;
+    const provider = options.provider ?? defaultProcessInspectionProvider;
+    try {
+        const observation = provider.observeProcess(pid, platform);
+        if (observation.kind === "identity"
+            && isValidProcessIdentity(observation.identity)
+            && observation.identity.platform === platform) {
+            return {
+                name: "Process identity",
+                status: "pass",
+                message: "native process identity provider is ready",
+            };
+        }
+        const reason = observation.kind === "identity"
+            ? isValidProcessIdentity(observation.identity)
+                ? "platform mismatch"
+                : "provider response unverifiable"
+            : observation.kind === "gone"
+                ? "current process not identified"
+                : observation.kind === "denied"
+                    ? "provider access denied"
+                    : observation.kind === "unsupported"
+                        ? "provider unavailable"
+                        : "provider response unverifiable";
+        return {
+            name: "Process identity",
+            status: "fail",
+            message: `native process identity is unavailable (${reason}); reinstall or update OMX and rerun doctor`,
+        };
+    }
+    catch {
+        return {
+            name: "Process identity",
+            status: "fail",
+            message: "native process identity is unavailable (provider response unverifiable); reinstall or update OMX and rerun doctor",
+        };
+    }
+}
 export function checkExploreHarness(platform = process.platform, env = process.env, options = {}) {
     const override = env[EXPLORE_BIN_ENV]?.trim();
     const exploreRoutingEnabled = options.exploreRoutingEnabled ?? isExploreCommandRoutingEnabled(env);
@@ -2393,7 +2820,6 @@ async function checkPluginVersionDiagnostics(codexHomeDir) {
     };
 }
 const REQUIRED_NATIVE_REVIEWER_ROLES = ["architect", "critic"];
-const ADVISORY_NATIVE_REVIEWER_ROLES = ["scholastic"];
 function getParsedAgentTables(configPath) {
     if (!existsSync(configPath))
         return null;
@@ -2444,31 +2870,19 @@ function checkNativeReviewerRoles(paths, installMode) {
     if (installMode !== "plugin")
         return null;
     const missingRequired = REQUIRED_NATIVE_REVIEWER_ROLES.filter((role) => !nativeReviewerRoleAvailable(paths, role));
-    const missingAdvisory = ADVISORY_NATIVE_REVIEWER_ROLES.filter((role) => !nativeReviewerRoleAvailable(paths, role));
     if (missingRequired.length > 0) {
-        const advisorySuffix = missingAdvisory.length > 0
-            ? `; advisory role missing: ${missingAdvisory.join(", ")}`
-            : "";
         return {
             name: "Native reviewer roles",
             status: "fail",
             message: `plugin mode supplies skills/hooks, but required RALPLAN/Autopilot native reviewer role(s) are unavailable: ${missingRequired.join(", ")}. ` +
                 `Install ${formatNativeRoleFileList(missingRequired)} under ${paths.agentsDir} or define equivalent [agents.<role>] entries in ${paths.configPath}; ` +
-                `otherwise role-specific subagent calls may degrade to prompt-only/default subagents${advisorySuffix}`,
-        };
-    }
-    if (missingAdvisory.length > 0) {
-        return {
-            name: "Native reviewer roles",
-            status: "warn",
-            message: `required RALPLAN/Autopilot native reviewer roles are available (${REQUIRED_NATIVE_REVIEWER_ROLES.join(", ")}); ` +
-                `advisory ontology reviewer role(s) missing: ${missingAdvisory.join(", ")} (optional unless explicitly used)`,
+                `otherwise role-specific subagent calls may degrade to prompt-only/default subagents`,
         };
     }
     return {
         name: "Native reviewer roles",
         status: "pass",
-        message: `required RALPLAN/Autopilot native reviewer roles are available (${REQUIRED_NATIVE_REVIEWER_ROLES.join(", ")}); advisory ${ADVISORY_NATIVE_REVIEWER_ROLES.join(", ")} role is also available`,
+        message: `required RALPLAN/Autopilot native reviewer roles are available (${REQUIRED_NATIVE_REVIEWER_ROLES.join(", ")})`,
     };
 }
 function readInstalledAgentModelInfo(tomlPath) {