ostacky 0.7.2 → 0.7.4

package/dist/cli.js

@@ -20,12 +20,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -48,7 +50,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/sisteransi/src/index.js
-var require_src = __commonJS((exports, module) => {
+var require_src = __commonJS(function(exports, module) {
   var ESC = "\x1B";
   var CSI = `${ESC}[`;
   var beep = "\x07";
@@ -106,7 +108,7 @@ var require_src = __commonJS((exports, module) => {
 });
 
 // node_modules/picocolors/picocolors.js
-var require_picocolors = __commonJS((exports, module) => {
+var require_picocolors = __commonJS(function(exports, module) {
   var p = process || {};
   var argv = p.argv || [];
   var env = p.env || {};
@@ -178,9 +180,14 @@ var require_picocolors = __commonJS((exports, module) => {
 // src/security.ts
 var exports_security = {};
 __export(exports_security, {
-  verifyChecksum: () => verifyChecksum,
+  BASH_SENSITIVE_RE: () => BASH_SENSITIVE_RE,
+  SENSITIVE_DEFAULT: () => SENSITIVE_DEFAULT,
+  extractPathsFromBash: () => extractPathsFromBash,
+  getSensitivePatterns: () => getSensitivePatterns,
+  isSensitive: () => isSensitive,
+  sha256: () => sha256,
   validateFilePath: () => validateFilePath,
-  sha256: () => sha256
+  verifyChecksum: () => verifyChecksum
 });
 import { createHash } from "crypto";
 function validateFilePath(filePath) {
@@ -201,7 +208,89 @@ function verifyChecksum(content, expectedHash, label) {
   recibido: ${actual}`);
   }
 }
-var init_security = () => {};
+function isSensitive(filePath, patterns = SENSITIVE_DEFAULT) {
+  if (!filePath)
+    return false;
+  const normalized = filePath.replace(/\\/g, "/");
+  const lower = normalized.toLowerCase();
+  if (lower.endsWith(".env.example") || lower.endsWith(".env.template") || lower.endsWith(".env.sample"))
+    return false;
+  const base = lower.split("/").pop() || "";
+  for (const pat of patterns) {
+    if (pat.includes(".env") && base.startsWith(".env"))
+      return true;
+    if (pat.includes(".secrets") && lower.includes(".secrets"))
+      return true;
+    if (pat.includes("*.pem") && lower.endsWith(".pem"))
+      return true;
+    if (pat.includes("*.key") && lower.endsWith(".key"))
+      return true;
+    if (pat.includes(".aws") && lower.includes(".aws"))
+      return true;
+    if (pat.includes(".ssh") && lower.includes(".ssh"))
+      return true;
+    if (pat.includes("credentials.json") && lower.endsWith("credentials.json"))
+      return true;
+    if (pat.includes(".npmrc") && lower.endsWith(".npmrc"))
+      return true;
+  }
+  if (/\.(pem|key)$/i.test(normalized))
+    return true;
+  if (base.startsWith(".env"))
+    return true;
+  return false;
+}
+function extractPathsFromBash(cmd) {
+  if (!cmd)
+    return [];
+  const normalized = cmd.replace(/&&/g, ";").replace(/\|\|/g, ";");
+  const segments = normalized.split(/[|;><\n]+/);
+  const paths = [];
+  for (const seg of segments) {
+    const trimmed = seg.trim();
+    if (!trimmed)
+      continue;
+    const tokens = trimmed.match(/(?:[^\s"'`\\]+|"[^"]*"|'[^']*'|`[^`]*`)+/g) || [];
+    for (let token of tokens) {
+      const stripped = token.replace(/["'`]/g, "").replace(/\\/g, "");
+      if (!stripped)
+        continue;
+      if (["cat", "grep", "ls", "echo", "awk", "sed", "cut", "head", "tail", "wc", "find", "xargs", "bash", "sh", "zsh", "env", "printenv", "node", "bun", "npm", "npx", "ls"].includes(stripped))
+        continue;
+      if (stripped.startsWith("-"))
+        continue;
+      const lower = stripped.toLowerCase();
+      if (stripped.includes("/") || stripped.includes(".") || lower.startsWith(".env") || lower.includes(".secrets") || lower.endsWith(".pem") || lower.endsWith(".key") || lower.includes(".aws") || lower.includes(".ssh") || lower.endsWith("credentials.json") || lower.endsWith(".npmrc")) {
+        const cleaned = stripped.replace(/[,:;)\]]+$/, "");
+        if (cleaned)
+          paths.push(cleaned);
+      } else if (stripped === ".env") {
+        paths.push(stripped);
+      }
+    }
+  }
+  return [...new Set(paths)];
+}
+function getSensitivePatterns() {
+  const raw = process.env.OSTACKY_SENSITIVE_PATTERNS;
+  if (!raw)
+    return SENSITIVE_DEFAULT;
+  return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}
+var SENSITIVE_DEFAULT, BASH_SENSITIVE_RE;
+var init_security = __esm(() => {
+  SENSITIVE_DEFAULT = [
+    "**/.env*",
+    "**/.secrets/**",
+    "**/*.pem",
+    "**/*.key",
+    "**/.aws/**",
+    "**/.ssh/**",
+    "**/credentials.json",
+    "**/.npmrc"
+  ];
+  BASH_SENSITIVE_RE = /(?:^|[^a-zA-Z0-9_.-])(\.env(\b|[_.-])|\.secrets\b|\.pem\b|\.key\b|credentials\.json|\.aws\b|\.ssh\b|\.npmrc\b)/i;
+});
 
 // src/fs.ts
 import {
@@ -235,6 +324,11 @@ function findOpenCodeDir(startDir = process.cwd()) {
   }
 }
 function findProjectRoot(startDir = process.cwd()) {
+  try {
+    const out = execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf-8", cwd: startDir, stdio: ["pipe", "pipe", "pipe"] }).trim();
+    if (out && existsSync(out))
+      return resolve(out);
+  } catch {}
   let current = resolve(startDir);
   while (true) {
     if (existsSync(join(current, ".opencode")) || existsSync(join(current, ".git"))) {
@@ -546,31 +640,31 @@ var init_fs = __esm(() => {
 var manifest_default;
 var init_manifest = __esm(() => {
   manifest_default = {
-    version: "0.7.2",
+    version: "0.7.4",
     repo: "JaimeHoracio/Ostacky",
-    tag: "v0.7.2",
+    tag: "v0.7.4",
     agents: [
       {
         name: "ostacky",
         file: "assets/agents/ostacky.md",
-        description: "Orquestador con recuperación automática (nunca se congela), ruteo por nivel de impacto, controller MCP con SDK oficial, edición segura con fallback inline, y delegación en OpenSpec + Superpowers. v0.7.2: prune de skills obsoletas, lastHandoff, getAvailableTransitions, consecutiveFailures real, mem_session_summary automático al cierre.",
-        version: "0.7.2",
-        sha256: "1b6a5cbb49f1c6e977241f8ab86d1a045fdb8a04111bbc75633429a131c71acd"
+        description: "Orquestador con recuperación automática (nunca se congela), ruteo por nivel de impacto, controller MCP con SDK oficial, edición segura con fallback inline, y delegación en OpenSpec + Superpowers. v0.7.4: prune de skills obsoletas, lastHandoff, getAvailableTransitions, consecutiveFailures real, mem_session_summary automático al cierre.",
+        version: "0.7.4",
+        sha256: "ffda231d1a9df1693f32460bdb6811077f7f53ba7902b2616d82231a3d6d43bb"
       }
     ],
     commands: [
       {
         name: "install-stack",
         file: "assets/commands/install-stack.md",
-        description: "Instala el stack tecnológico del proyecto (CodeGraph, skills, OpenSpec, Engram, Context7, controller MCP con SDK oficial). v0.7.2: Paso 1.5 controller expandido con verificación post-instalación y troubleshooting.",
-        version: "0.7.2",
-        sha256: "7277d333bfe65e674b9696fa5f887854e35824eb5b88420dd0f5bbde3bca7add"
+        description: "Instala el stack tecnológico del proyecto (CodeGraph, skills, OpenSpec, Engram, Context7, controller MCP con SDK oficial). v0.7.4: Paso 1.5 controller expandido con verificación post-instalación y troubleshooting.",
+        version: "0.7.4",
+        sha256: "6887499074a82c3b4538e38ca501290cacd3afad676bd127662fed77e268f299"
       },
       {
         name: "opsx-sync",
         file: "assets/commands/opsx-sync.md",
         description: "Sincroniza delta specs del change activo sin inicializar CodeGraph si ya existe índice",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "fe0158478f2ca63b315037a85fc1632b77868532e319af6c7384285441767d64"
       }
     ],
@@ -578,15 +672,15 @@ var init_manifest = __esm(() => {
       {
         name: "ostacky-controller",
         file: "assets/mcp/ostacky-controller/",
-        description: "Máquina de estados persistida con @modelcontextprotocol/server SDK. v0.7.2: 22 tools (incluye set_handoff, get_handoff, clear_handoff, get_available_transitions funcional). Bugfixes: consecutiveFailures real, lastHandoff state, defaultChoice persistido. Robustez: degraded mode automático tras 3 fallos, persistence condicional para Nivel 0, prune de skills obsoletas.",
-        version: "0.7.2",
-        sha256: "34048819b8905dff24c731e02d813deb4fb7fbbb65e8b8df66e5c8db201492a0"
+        description: "Máquina de estados persistida con @modelcontextprotocol/server SDK. v0.7.4: 22 tools (incluye set_handoff, get_handoff, clear_handoff, get_available_transitions funcional). Bugfixes: consecutiveFailures real, lastHandoff state, defaultChoice persistido. Robustez: degraded mode automático tras 3 fallos, persistence condicional para Nivel 0, prune de skills obsoletas.",
+        version: "0.7.4",
+        sha256: "4f86b6829293024caeb3d09c83b61aee158c383a7bb053a49e5a33c7c55862d1"
       },
       {
         name: "openspec",
         file: "assets/mcp/openspec/",
         description: "MCP server local para OpenSpec - proposal, apply, archive, sync de cambios",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "fa4be28bfc1e75db8f1a037e2580f04a60066c80e8e5934e90e1041020d04609"
       }
     ],
@@ -595,106 +689,106 @@ var init_manifest = __esm(() => {
         name: "brainstorming",
         file: "assets/skills/brainstorming/SKILL.md",
         description: "Skill unificado de pensamiento con dos modos: creative-design (producción de diseño → transición a implementación directa o openspec-propose) y open-exploration (exploración libre)",
-        version: "0.7.2",
-        sha256: "333810ca63450e8ab795e8c5a58e645101e788d79210ca8ac36e10d11be39585"
+        version: "0.7.4",
+        sha256: "7b0020f31f346d8f2070219930cfb9341135d40941195f0ea50c3bd7f4a42990"
       },
       {
         name: "execution-mode-evaluation",
         file: "assets/skills/execution-mode-evaluation/SKILL.md",
         description: "Skill de análisis de modo de ejecución — output reconciliado con controller snapshot contract (recommendation field)",
-        version: "0.7.2",
-        sha256: "edf6fca0af52cce83f8fd08e7db9b3d79cc130b53fca505e90d3fbaf4909338b"
+        version: "0.7.4",
+        sha256: "e17f1e0309572841dc1fa537b1f32c7468eb70b3acf453b9ff5cc4fa8d94fd39"
       },
       {
         name: "tdd",
         file: "assets/skills/tdd/SKILL.md",
         description: "Skill de test-driven development (Superpowers)",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "aa412298980b7826165c211145c1b8e9135f68f36247bb3cb96d0a0eae274486"
       },
       {
         name: "subagent-driven-development",
         file: "assets/skills/subagent-driven-development/SKILL.md",
         description: "Skill de ejecución con subagentes (Superpowers) — ejecuta solo después de confirmación del coordinador Ostacky",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "1a42d714a9a13faf05f0bf7b580e8d837c2e77a5633839542ccce603023419e8"
       },
       {
         name: "dispatching-parallel-agents",
         file: "assets/skills/dispatching-parallel-agents/SKILL.md",
         description: "Skill de dispatch paralelo de agentes (Superpowers)",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "3c8a66d51ae2e719e877d02c3dac32bd804722c3bb9227c258ecae78252a20ab"
       },
       {
         name: "review",
         file: "assets/skills/review/SKILL.md",
         description: "Skill de revisión de código (Superpowers)",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "b19650ed4d1d4d9857a4dd5b7e08e91328a1a1fc9c45bcc2fb600fa9d0213279"
       },
       {
         name: "receiving-code-review",
         file: "assets/skills/receiving-code-review/SKILL.md",
         description: "Skill de recibir y procesar feedback de code review",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "d761e884e71d8d3476ac734d287cae403a4024506a7d12e7361a448217c0a831"
       },
       {
         name: "openspec-propose",
         file: "assets/skills/openspec-propose/SKILL.md",
         description: "Skill de generación de proposal (OpenSpec)",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "bb59100b9fd3c9f9a1ec6509fa975ec55bf7fc737df4fe73bb3e9bbc217b83f7"
       },
       {
         name: "openspec-apply-change",
         file: "assets/skills/openspec-apply-change/SKILL.md",
         description: "Skill de aplicación de change (OpenSpec)",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "dfc823bf89fc7505e91ab6dee9c1f004be38a410bd3d88fb67b211b1b6cbb1d0"
       },
       {
         name: "openspec-archive-change",
         file: "assets/skills/openspec-archive-change/SKILL.md",
         description: "Skill de archivo de change (OpenSpec)",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "16e4b561de7747283663fed602e506abf502452c49a8d4b86d7a5539c40f0195"
       },
       {
         name: "openspec-explore",
         file: "assets/skills/openspec-explore/SKILL.md",
         description: "Modo explore para OpenSpec — thinking partner para explorar ideas, investigar problemas y clarificar requisitos antes/durante un cambio",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "37ae4aaf17ea71a395bab6dc4d9d61b9a49d7910f6692535ae8553244c46880b"
       },
       {
         name: "using-git-worktrees",
         file: "assets/skills/using-git-worktrees/SKILL.md",
         description: "Skill de uso de git worktrees para aislamiento de trabajo",
-        version: "0.7.2",
-        sha256: "11afa9123828fc5caa22137aff907cd99c751e99027fbd4c020751110a949281"
+        version: "0.7.4",
+        sha256: "93341bc1b7c053618a8b6dc07e3615b77990d7b549a0201f5835d95fef67ce13"
       },
       {
         name: "using-superpowers",
         file: "assets/skills/using-superpowers/SKILL.md",
         description: "Skill de orquestación de Superpowers skills",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "7e54536f96d2a379185a10bfc1e970850caa2561b6d8aca7080f0defea0381a4"
       },
       {
         name: "writing-skills",
         file: "assets/skills/writing-skills/SKILL.md",
         description: "Skill de creación y edición de skills",
-        version: "0.7.2",
+        version: "0.7.4",
         sha256: "3d76b906cee518a2b809febb70db95697a35b9f368986bb504b4120c3bfb437a"
       },
       {
         name: "graceful-degradation",
         file: "assets/skills/graceful-degradation/SKILL.md",
         description: "Skill de degradación graceful cuando múltiples tools están indisponibles",
-        version: "0.7.2",
-        sha256: "376dc90fa27ab7e5947747f20ccf2cc76f9326c77b567fda388252a60d25c431"
+        version: "0.7.4",
+        sha256: "40f929e8032b70d51b3548bddcc383b931d6044fd9d4acce8a5b9f7acd014f59"
       }
     ]
   };
@@ -835,12 +929,12 @@ var init_github = __esm(() => {
 // src/lockfile.ts
 var exports_lockfile = {};
 __export(exports_lockfile, {
-  writeLockfile: () => writeLockfile,
-  removeFromLockfile: () => removeFromLockfile,
-  readLockfile: () => readLockfile,
-  getLockfilePath: () => getLockfilePath,
+  clearLockfile: () => clearLockfile,
   getInstalledVersion: () => getInstalledVersion,
-  clearLockfile: () => clearLockfile
+  getLockfilePath: () => getLockfilePath,
+  readLockfile: () => readLockfile,
+  removeFromLockfile: () => removeFromLockfile,
+  writeLockfile: () => writeLockfile
 });
 import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join4 } from "path";
@@ -905,16 +999,16 @@ var init_lockfile = __esm(() => {
 // src/config.ts
 var exports_config = {};
 __export(exports_config, {
-  writeOpenCodeConfig: () => writeOpenCodeConfig,
-  stripJsoncComments: () => stripJsoncComments,
-  setMcpEntryAtProjectRoot: () => setMcpEntryAtProjectRoot,
-  setMcpEntry: () => setMcpEntry,
-  readOpenCodeConfig: () => readOpenCodeConfig,
-  patchOpenCodeConfig: () => patchOpenCodeConfig,
-  findOpenCodeConfig: () => findOpenCodeConfig,
-  ensureOpenCodeConfig: () => ensureOpenCodeConfig,
+  ensureMcpEntry: () => ensureMcpEntry,
   ensureMcpEntryAtProjectRoot: () => ensureMcpEntryAtProjectRoot,
-  ensureMcpEntry: () => ensureMcpEntry
+  ensureOpenCodeConfig: () => ensureOpenCodeConfig,
+  findOpenCodeConfig: () => findOpenCodeConfig,
+  patchOpenCodeConfig: () => patchOpenCodeConfig,
+  readOpenCodeConfig: () => readOpenCodeConfig,
+  setMcpEntry: () => setMcpEntry,
+  setMcpEntryAtProjectRoot: () => setMcpEntryAtProjectRoot,
+  stripJsoncComments: () => stripJsoncComments,
+  writeOpenCodeConfig: () => writeOpenCodeConfig
 });
 import { existsSync as existsSync4, readFileSync as readFileSync4, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import { join as join5 } from "path";
@@ -1062,17 +1156,17 @@ var init_config = __esm(() => {
 // src/stack.ts
 var exports_stack = {};
 __export(exports_stack, {
-  verifyMcpServers: () => verifyMcpServers,
-  uninstallStackConfig: () => uninstallStackConfig,
-  uninstallEngramConfig: () => uninstallEngramConfig,
-  setupOpenSpec: () => setupOpenSpec,
-  setupContext7: () => setupContext7,
-  installStack: () => installStack,
-  installEngram: () => installEngram,
-  installCodeGraph: () => installCodeGraph,
-  buildLocalMcpCommand: () => buildLocalMcpCommand,
+  OPENSPEC_NPM_PACKAGE: () => OPENSPEC_NPM_PACKAGE,
   buildEngramDownloadUrl: () => buildEngramDownloadUrl,
-  OPENSPEC_NPM_PACKAGE: () => OPENSPEC_NPM_PACKAGE
+  buildLocalMcpCommand: () => buildLocalMcpCommand,
+  installCodeGraph: () => installCodeGraph,
+  installEngram: () => installEngram,
+  installStack: () => installStack,
+  setupContext7: () => setupContext7,
+  setupOpenSpec: () => setupOpenSpec,
+  uninstallEngramConfig: () => uninstallEngramConfig,
+  uninstallStackConfig: () => uninstallStackConfig,
+  verifyMcpServers: () => verifyMcpServers
 });
 import { chmodSync, copyFileSync as copyFileSync3, existsSync as existsSync6, mkdirSync as mkdirSync4, rmSync as rmSync4, unlinkSync as unlinkSync3 } from "fs";
 import { basename as basename2, dirname as dirname5, join as join7, resolve as resolve2 } from "path";
@@ -1494,7 +1588,7 @@ var init_stack = __esm(() => {
 // package.json
 var package_default = {
   name: "ostacky",
-  version: "0.7.2",
+  version: "0.7.4",
   description: "Instalador interactivo de agentes y comandos para OpenCode",
   type: "module",
   bin: {
@@ -1543,23 +1637,23 @@ var package_default = {
 // node_modules/@clack/prompts/dist/index.mjs
 var exports_dist = {};
 __export(exports_dist, {
-  updateSettings: () => hD,
-  text: () => ue,
-  tasks: () => xe,
-  spinner: () => L2,
-  selectKey: () => he,
-  select: () => de,
-  password: () => $e,
-  outro: () => fe,
-  note: () => ye,
-  multiselect: () => pe,
-  log: () => v2,
-  isCancel: () => BD,
-  intro: () => we,
-  groupMultiselect: () => ge,
-  group: () => be,
+  cancel: () => ve,
   confirm: () => me,
-  cancel: () => ve
+  group: () => be,
+  groupMultiselect: () => ge,
+  intro: () => we,
+  isCancel: () => BD,
+  log: () => v2,
+  multiselect: () => pe,
+  note: () => ye,
+  outro: () => fe,
+  password: () => $e,
+  select: () => de,
+  selectKey: () => he,
+  spinner: () => L2,
+  tasks: () => xe,
+  text: () => ue,
+  updateSettings: () => hD
 });
 import { stripVTControlCharacters as T2 } from "node:util";
 
@@ -2494,7 +2588,6 @@ import { dirname as dirname7 } from "path";
 init_github();
 init_fs();
 init_lockfile();
-import { homedir as homedir2 } from "os";
 
 // src/installer.ts
 init_github();
@@ -2670,7 +2763,7 @@ async function probeMcpServer(nodeExecutable, serverPath, cwd, statePath, option
         params: {
           protocolVersion: "2025-03-26",
           capabilities: {},
-          clientInfo: { name: "ostacky-installer", version: "0.7.2" }
+          clientInfo: { name: "ostacky-installer", version: "0.7.4" }
         }
       });
     });
@@ -3029,18 +3122,19 @@ function printPostInstallSteps() {
 async function resolveOpenCodePaths(scope) {
   if (scope === "local" || scope === "global" || scope === "auto") {
     const dir2 = getOpenCodeDirForScope(scope);
+    const isGlobalDir = dir2.replace(/\\/g, "/") === getGlobalOpenCodeDir().replace(/\\/g, "/");
     try {
       const paths = ensureOpenCodePaths(dir2);
       if (scope === "global")
         ye(dir2, "Instalación global");
       else if (scope === "auto")
-        ye(dir2, `Scope auto → ${dir2.includes(homedir2()) && dir2.includes(".config") ? "global" : "local"}`);
+        ye(dir2, `Scope auto → ${isGlobalDir ? "global" : "local"}`);
       else
         ye(dir2, "Instalación local");
       return paths;
     } catch (e2) {
       const msg = e2.message ?? "";
-      if (scope === "global" && (msg.includes("EACCES") || msg.includes("permission"))) {
+      if ((scope === "global" || scope === "auto" && isGlobalDir) && (msg.includes("EACCES") || msg.toLowerCase().includes("permission"))) {
         v2.warn(`No se pudo escribir en global (${dir2}): ${msg}. ¿Instalar local?`);
         const retry = await me({ message: "¿Reintentar como instalación local?" });
         onCancel(retry);
@@ -3082,7 +3176,9 @@ async function resolveOpenCodePaths(scope) {
   }
 }
 function isGlobalScope(paths) {
-  return paths.root === getGlobalOpenCodeDir() || paths.root.startsWith(getGlobalOpenCodeDir() + "/");
+  const globalDir = getGlobalOpenCodeDir().replace(/\\/g, "/");
+  const root = paths.root.replace(/\\/g, "/");
+  return root === globalDir || root.startsWith(globalDir + "/");
 }
 function getOrphanedItems(manifest, paths) {
   const lockfile = readLockfile(paths.root);
@@ -3200,7 +3296,7 @@ async function doInstallStack(toolsDir, projectRoot) {
 async function doInstallAll(manifest, paths) {
   const spin = L2();
   let errors = 0;
-  const isGlobal = paths.root === getGlobalOpenCodeDir() || paths.root.startsWith(getGlobalOpenCodeDir() + "/");
+  const isGlobal = isGlobalScope(paths);
   if (!isGlobal) {
     ensureToolDirs(paths.tools, ["codegraph", "engram", "context7"]);
   } else {
@@ -3934,6 +4030,13 @@ async function runInstallStackCommand(scope) {
     fe("Cancelado.");
     return;
   }
+  if (isGlobalScope(paths)) {
+    v2.error("install-stack requiere scope local; el stack vive en <proyecto>/.opencode/tools");
+    v2.info(`Scope resuelto a global (${paths.root}) — el stack debe instalarse por proyecto local.`);
+    fe("Cancelado.");
+    process.exitCode = 1;
+    return;
+  }
   ensureToolDirs(paths.tools, ["codegraph", "engram", "context7"]);
   const stackOk = await doInstallStack(paths.tools, dirname7(paths.root));
   if (!stackOk)
@@ -4127,6 +4230,9 @@ async function runUninstallMcpCommand(name, scope) {
 }
 
 // src/cli.ts
+init_fs();
+import { existsSync as existsSync8, statSync as statSync3, readFileSync as readFileSync6, readdirSync as readdirSync3 } from "node:fs";
+import { join as join11, dirname as dirname8 } from "node:path";
 var HELP = `
 ostacky — Instalador de agentes, comandos, skills y MCPs para OpenCode
 
@@ -4139,6 +4245,8 @@ Uso:
   npx ostacky add mcp [--scope ...]            Agregar MCP server(s)
   npx ostacky install-stack [--scope local|auto]      Instalar solo el stack de herramientas (CodeGraph, OpenSpec, Engram, Context7) — global bloquea con error
   npx ostacky uninstall-stack [--scope local|global|auto]    Remover la configuración del stack del proyecto
+  npx ostacky doctor                           Diagnostica locks, tools, state health
+  npx ostacky status [--json]                  Muestra estado del controller sin MCP
   npx ostacky update [--scope ...]             Actualizar instalación
   npx ostacky uninstall [--scope ...]          Desinstalar todo
   npx ostacky uninstall agent [--scope ...]    Desinstalar agente(s)
@@ -4187,6 +4295,219 @@ function withoutScopeArgs(argv) {
 var scope = parseScopeArg();
 var argvNoScope = withoutScopeArgs(process.argv);
 var [, , cmd, subcmd] = argvNoScope;
+async function runDoctorCommand() {
+  const cwd = process.cwd();
+  const opencodeDir = findOpenCodeDir(cwd) || join11(cwd, ".opencode");
+  const statePath = join11(opencodeDir, "ostacky-state.json");
+  let hasError = false;
+  let hasWarn = false;
+  const check = (label, ok, warn = false) => {
+    if (ok)
+      console.log(`✅ ${label}: OK`);
+    else if (warn) {
+      console.log(`⚠️ ${label}`);
+      hasWarn = true;
+    } else {
+      console.log(`❌ ${label}`);
+      hasError = true;
+    }
+  };
+  try {
+    if (!existsSync8(statePath)) {
+      check("controller: state file missing", false, true);
+    } else {
+      const stat = statSync3(statePath);
+      const raw = readFileSync6(statePath, "utf-8");
+      const parsed = JSON.parse(raw);
+      check(`controller: OK (rev ${parsed.revision || 0} state ${parsed.state || "unknown"})`, true);
+      if (parsed.degraded) {
+        console.log("⚠️ degraded: true (persistido)");
+        hasWarn = true;
+      }
+      if (parsed.degradedEditsCount > 0)
+        console.log(`⚠️ degraded: confirmation not audited in controller (degradedEditsCount=${parsed.degradedEditsCount})`);
+      if (parsed.codegraphBypassCount > 0)
+        console.log(`⚠️ codegraphBypassCount=${parsed.codegraphBypassCount} (inefficient: codegraph bypass)`);
+      if (parsed.stateOversizedCount > 0)
+        console.log(`⚠️ stateOversizedCount=${parsed.stateOversizedCount} snapshots perdidos`);
+      if (parsed.sensitiveAccess)
+        console.log(`ℹ️ sensitiveAccess: allowed=${parsed.sensitiveAccess.allowed || 0} denied=${parsed.sensitiveAccess.denied || 0} blocked=${parsed.sensitiveAccess.blockedAttempts || 0}`);
+      if (parsed.sensitivePatterns)
+        console.log(`ℹ️ sensitivePatterns: ${parsed.sensitivePatterns.join(", ")}`);
+      if (parsed.allowedFiles && Object.keys(parsed.allowedFiles).length)
+        console.log(`ℹ️ allowedFiles: ${Object.keys(parsed.allowedFiles).join(", ")}`);
+      if (parsed.deniedFiles && Object.keys(parsed.deniedFiles).length) {
+        console.log(`ℹ️ denied files: ${Object.keys(parsed.deniedFiles).join(", ")} (denied by user)`);
+      }
+      if (parsed.staleContentAttempts > 0)
+        console.log(`⚠️ staleContentAttempts=${parsed.staleContentAttempts}`);
+      if (parsed.completeWithoutValidateCount > 0)
+        console.log(`⚠️ completeWithoutValidateCount=${parsed.completeWithoutValidateCount}`);
+      if (stat.size > 2 * 1024 * 1024) {
+        console.log("⚠️ state file >2MB (oversized)");
+        hasWarn = true;
+      }
+      const auditSize = (parsed.audit || []).length;
+      if (auditSize > 500)
+        console.log(`⚠️ audit large: ${auditSize}`);
+      try {
+        const { statfsSync } = await import("node:fs");
+        if (typeof statfsSync === "function") {
+          const s = statfsSync(dirname8(statePath));
+          const freeMB = Math.floor(s.bfree * s.bsize / 1048576);
+          if (freeMB < 100) {
+            console.log(`⚠️ Disco casi lleno: ${freeMB}MB libres`);
+            hasWarn = true;
+          } else
+            console.log(`ℹ️ diskFreeMB: ${freeMB}`);
+        }
+      } catch {}
+      if ((parsed.state === "EXECUTING_INLINE" || parsed.state === "EXECUTING_SUBAGENTS") && parsed.expectedTasks) {
+        const pending = parsed.expectedTasks.filter((id) => !parsed.tasks?.[id] || parsed.tasks[id].status !== "COMPLETED").length;
+        const lastHandoffAge = parsed.lastHandoff ? Date.now() - parsed.lastHandoff.ts : Infinity;
+        if (pending === 0 && lastHandoffAge > 60000) {
+          console.log("⚠️ EXECUTING_* con pending==0 y lastHandoff >60s sin progreso — sugerir implementation_complete manual");
+          hasWarn = true;
+        }
+      }
+    }
+  } catch (e2) {
+    check(`controller: ${e2.message}`, false);
+  }
+  try {
+    const lockPid = join11(opencodeDir, "ostacky-state.json.lock.pid");
+    const lockTs = join11(opencodeDir, "ostacky-state.json.lock.timestamp");
+    if (existsSync8(lockPid) || existsSync8(lockTs)) {
+      let ageStr = "";
+      try {
+        const ts = parseInt(readFileSync6(lockTs, "utf-8"), 10);
+        const age = Date.now() - ts;
+        ageStr = `${Math.floor(age / 1000)}s`;
+        const pid = readFileSync6(lockPid, "utf-8").trim();
+        let alive = false;
+        try {
+          process.kill(parseInt(pid, 10), 0);
+          alive = true;
+        } catch {}
+        check(`lock: PID ${pid} age ${ageStr} alive=${alive}`, !alive || age > 15000, true);
+      } catch {
+        check("lock: exists (no timestamp)", false, true);
+      }
+    } else {
+      check("lock: no active lock", true);
+    }
+  } catch {
+    check("lock: check failed", false, true);
+  }
+  const tools = ["codegraph", "engram"];
+  for (const t of tools) {
+    const p2 = join11(opencodeDir, "tools", t, "bin", t);
+    const pExe = p2 + ".exe";
+    check(`tool ${t}: ${existsSync8(p2) || existsSync8(pExe) ? "found" : "missing"}`, existsSync8(p2) || existsSync8(pExe), true);
+  }
+  try {
+    const manifest = JSON.parse(readFileSync6(join11(cwd, "manifest.json"), "utf-8"));
+    const expected = manifest.mcpServers?.find((x2) => x2.name === "ostacky-controller")?.sha256;
+    if (expected) {
+      const actual = computeTreeHash(join11(cwd, "assets", "mcp", "ostacky-controller"));
+      check(`manifest hash: ${expected.slice(0, 8)} vs actual ${actual.slice(0, 8)}`, expected === actual);
+      if (expected !== actual)
+        console.log("  Run: bun run hash:update");
+    }
+  } catch {
+    check("manifest: not found", false, true);
+  }
+  if (existsSync8(statePath)) {
+    try {
+      const s = JSON.parse(readFileSync6(statePath, "utf-8"));
+      if (s.allowedFiles || s.deniedFiles) {}
+    } catch {}
+  }
+  try {
+    const cacheDir = join11(opencodeDir, "cache", "codegraph");
+    if (!existsSync8(cacheDir)) {
+      console.log("ℹ️ cache: no cache dir yet (ok)");
+    } else {
+      const files = readdirSync3(cacheDir);
+      let total = 0;
+      for (const f2 of files) {
+        try {
+          total += statSync3(join11(cacheDir, f2)).size;
+        } catch {}
+      }
+      const totalMB = (total / 1048576).toFixed(2);
+      if (total > 52428800) {
+        console.log(`⚠️ cache: ${totalMB}MB >50MB — LRU cleanup needed`);
+        hasWarn = true;
+      } else {
+        console.log(`✅ cache: OK (${files.length} files, ${totalMB}MB)`);
+      }
+      try {
+        const s = JSON.parse(readFileSync6(statePath, "utf-8"));
+        if (s.cacheHitCount !== undefined) {
+          console.log(`ℹ️ cacheHitCount=${s.cacheHitCount} cacheMissCount=${s.cacheMissCount || 0} tokenSavingEstimate=${s.tokenSavingEstimate || 0}`);
+        }
+      } catch {}
+    }
+  } catch (e2) {
+    console.log(`⚠️ cache: check failed ${e2.message}`);
+  }
+  try {
+    const secPath = join11(cwd, "src", "security.ts");
+    if (!existsSync8(secPath)) {
+      console.log("⚠️ src/security.ts: missing (source-of-truth)");
+      hasWarn = true;
+    } else {
+      const sec = readFileSync6(secPath, "utf-8");
+      const hasSensitiveDefault = sec.includes("SENSITIVE_DEFAULT");
+      const hasBashRe = sec.includes("BASH_SENSITIVE_RE");
+      const hasIsSensitive = sec.includes("function isSensitive");
+      const hasExtract = sec.includes("extractPathsFromBash");
+      if (hasSensitiveDefault && hasBashRe && hasIsSensitive && hasExtract) {
+        console.log("✅ src/security.ts: source-of-truth OK");
+      } else {
+        console.log("⚠️ src/security.ts: missing exports (SENSITIVE_DEFAULT/BASH_SENSITIVE_RE/isSensitive/extractPathsFromBash)");
+        hasWarn = true;
+      }
+    }
+  } catch {}
+  try {
+    const s = JSON.parse(readFileSync6(statePath, "utf-8"));
+    if (s.sensitiveAccess?.blockedAttempts > 0) {
+      console.log(`ℹ️ sensitiveAccess: blockedAttempts includes bash (${s.sensitiveAccess.blockedAttempts})`);
+    }
+  } catch {}
+  if (hasError)
+    process.exit(1);
+  if (hasWarn)
+    process.exit(0);
+}
+async function runStatusCommand(args) {
+  const isJson = args.includes("--json");
+  const cwd = process.cwd();
+  const opencodeDir = findOpenCodeDir(cwd) || join11(cwd, ".opencode");
+  const statePath = join11(opencodeDir, "ostacky-state.json");
+  if (!existsSync8(statePath)) {
+    console.log(isJson ? JSON.stringify({ error: "no state" }) : "No state file");
+    return;
+  }
+  try {
+    const parsed = JSON.parse(readFileSync6(statePath, "utf-8"));
+    const completed = Object.values(parsed.tasks || {}).filter((t) => t.status === "COMPLETED").length;
+    const expected = parsed.expectedTaskCount ?? parsed.expectedTasks?.length ?? Object.keys(parsed.tasks || {}).length;
+    const degraded = parsed.degraded ? " degraded" : "";
+    const lastHandoff = parsed.lastHandoff ? ` lastHandoff: ${parsed.lastHandoff.summary?.slice(0, 60)}` : "";
+    if (isJson) {
+      console.log(JSON.stringify({ state: parsed.state, revision: parsed.revision, degraded: !!parsed.degraded, tasks: `${completed}/${expected}`, lastHandoff: parsed.lastHandoff }, null, 2));
+    } else {
+      console.log(`${parsed.state} rev ${parsed.revision}${degraded} tasks ${completed}/${expected}${lastHandoff}`);
+      if (parsed.lastProposal)
+        console.log(`lastProposal: ${parsed.lastProposal.summary} shownToUser=${parsed.lastProposal.shownToUser}`);
+    }
+  } catch (e2) {
+    console.log(`Error reading state: ${e2.message}`);
+  }
+}
 async function main() {
   switch (cmd) {
     case "install":
@@ -4240,6 +4561,12 @@ async function main() {
         process.exit(1);
       }
       break;
+    case "doctor":
+      await runDoctorCommand();
+      break;
+    case "status":
+      await runStatusCommand(argvNoScope.slice(3));
+      break;
     case "--help":
     case "-h":
       console.log(HELP);