ostacky 0.7.3 → 0.7.4

package/dist/cli.js

@@ -20,12 +20,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -48,7 +50,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/sisteransi/src/index.js
-var require_src = __commonJS((exports, module) => {
+var require_src = __commonJS(function(exports, module) {
   var ESC = "\x1B";
   var CSI = `${ESC}[`;
   var beep = "\x07";
@@ -106,7 +108,7 @@ var require_src = __commonJS((exports, module) => {
 });
 
 // node_modules/picocolors/picocolors.js
-var require_picocolors = __commonJS((exports, module) => {
+var require_picocolors = __commonJS(function(exports, module) {
   var p = process || {};
   var argv = p.argv || [];
   var env = p.env || {};
@@ -178,9 +180,14 @@ var require_picocolors = __commonJS((exports, module) => {
 // src/security.ts
 var exports_security = {};
 __export(exports_security, {
-  verifyChecksum: () => verifyChecksum,
+  BASH_SENSITIVE_RE: () => BASH_SENSITIVE_RE,
+  SENSITIVE_DEFAULT: () => SENSITIVE_DEFAULT,
+  extractPathsFromBash: () => extractPathsFromBash,
+  getSensitivePatterns: () => getSensitivePatterns,
+  isSensitive: () => isSensitive,
+  sha256: () => sha256,
   validateFilePath: () => validateFilePath,
-  sha256: () => sha256
+  verifyChecksum: () => verifyChecksum
 });
 import { createHash } from "crypto";
 function validateFilePath(filePath) {
@@ -201,7 +208,89 @@ function verifyChecksum(content, expectedHash, label) {
   recibido: ${actual}`);
   }
 }
-var init_security = () => {};
+function isSensitive(filePath, patterns = SENSITIVE_DEFAULT) {
+  if (!filePath)
+    return false;
+  const normalized = filePath.replace(/\\/g, "/");
+  const lower = normalized.toLowerCase();
+  if (lower.endsWith(".env.example") || lower.endsWith(".env.template") || lower.endsWith(".env.sample"))
+    return false;
+  const base = lower.split("/").pop() || "";
+  for (const pat of patterns) {
+    if (pat.includes(".env") && base.startsWith(".env"))
+      return true;
+    if (pat.includes(".secrets") && lower.includes(".secrets"))
+      return true;
+    if (pat.includes("*.pem") && lower.endsWith(".pem"))
+      return true;
+    if (pat.includes("*.key") && lower.endsWith(".key"))
+      return true;
+    if (pat.includes(".aws") && lower.includes(".aws"))
+      return true;
+    if (pat.includes(".ssh") && lower.includes(".ssh"))
+      return true;
+    if (pat.includes("credentials.json") && lower.endsWith("credentials.json"))
+      return true;
+    if (pat.includes(".npmrc") && lower.endsWith(".npmrc"))
+      return true;
+  }
+  if (/\.(pem|key)$/i.test(normalized))
+    return true;
+  if (base.startsWith(".env"))
+    return true;
+  return false;
+}
+function extractPathsFromBash(cmd) {
+  if (!cmd)
+    return [];
+  const normalized = cmd.replace(/&&/g, ";").replace(/\|\|/g, ";");
+  const segments = normalized.split(/[|;><\n]+/);
+  const paths = [];
+  for (const seg of segments) {
+    const trimmed = seg.trim();
+    if (!trimmed)
+      continue;
+    const tokens = trimmed.match(/(?:[^\s"'`\\]+|"[^"]*"|'[^']*'|`[^`]*`)+/g) || [];
+    for (let token of tokens) {
+      const stripped = token.replace(/["'`]/g, "").replace(/\\/g, "");
+      if (!stripped)
+        continue;
+      if (["cat", "grep", "ls", "echo", "awk", "sed", "cut", "head", "tail", "wc", "find", "xargs", "bash", "sh", "zsh", "env", "printenv", "node", "bun", "npm", "npx", "ls"].includes(stripped))
+        continue;
+      if (stripped.startsWith("-"))
+        continue;
+      const lower = stripped.toLowerCase();
+      if (stripped.includes("/") || stripped.includes(".") || lower.startsWith(".env") || lower.includes(".secrets") || lower.endsWith(".pem") || lower.endsWith(".key") || lower.includes(".aws") || lower.includes(".ssh") || lower.endsWith("credentials.json") || lower.endsWith(".npmrc")) {
+        const cleaned = stripped.replace(/[,:;)\]]+$/, "");
+        if (cleaned)
+          paths.push(cleaned);
+      } else if (stripped === ".env") {
+        paths.push(stripped);
+      }
+    }
+  }
+  return [...new Set(paths)];
+}
+function getSensitivePatterns() {
+  const raw = process.env.OSTACKY_SENSITIVE_PATTERNS;
+  if (!raw)
+    return SENSITIVE_DEFAULT;
+  return raw.split(",").map((s) => s.trim()).filter(Boolean);
+}
+var SENSITIVE_DEFAULT, BASH_SENSITIVE_RE;
+var init_security = __esm(() => {
+  SENSITIVE_DEFAULT = [
+    "**/.env*",
+    "**/.secrets/**",
+    "**/*.pem",
+    "**/*.key",
+    "**/.aws/**",
+    "**/.ssh/**",
+    "**/credentials.json",
+    "**/.npmrc"
+  ];
+  BASH_SENSITIVE_RE = /(?:^|[^a-zA-Z0-9_.-])(\.env(\b|[_.-])|\.secrets\b|\.pem\b|\.key\b|credentials\.json|\.aws\b|\.ssh\b|\.npmrc\b)/i;
+});
 
 // src/fs.ts
 import {
@@ -551,31 +640,31 @@ var init_fs = __esm(() => {
 var manifest_default;
 var init_manifest = __esm(() => {
   manifest_default = {
-    version: "0.7.3",
+    version: "0.7.4",
     repo: "JaimeHoracio/Ostacky",
-    tag: "v0.7.3",
+    tag: "v0.7.4",
     agents: [
       {
         name: "ostacky",
         file: "assets/agents/ostacky.md",
-        description: "Orquestador con recuperación automática (nunca se congela), ruteo por nivel de impacto, controller MCP con SDK oficial, edición segura con fallback inline, y delegación en OpenSpec + Superpowers. v0.7.3: prune de skills obsoletas, lastHandoff, getAvailableTransitions, consecutiveFailures real, mem_session_summary automático al cierre.",
-        version: "0.7.3",
-        sha256: "b6dc55a9571f9626e7912ac493cc3bfe6b0798a597f706904b2106a4a9acfcd5"
+        description: "Orquestador con recuperación automática (nunca se congela), ruteo por nivel de impacto, controller MCP con SDK oficial, edición segura con fallback inline, y delegación en OpenSpec + Superpowers. v0.7.4: prune de skills obsoletas, lastHandoff, getAvailableTransitions, consecutiveFailures real, mem_session_summary automático al cierre.",
+        version: "0.7.4",
+        sha256: "ffda231d1a9df1693f32460bdb6811077f7f53ba7902b2616d82231a3d6d43bb"
       }
     ],
     commands: [
       {
         name: "install-stack",
         file: "assets/commands/install-stack.md",
-        description: "Instala el stack tecnológico del proyecto (CodeGraph, skills, OpenSpec, Engram, Context7, controller MCP con SDK oficial). v0.7.3: Paso 1.5 controller expandido con verificación post-instalación y troubleshooting.",
-        version: "0.7.3",
-        sha256: "0d4bc0938110c40633b041847148d8212e34a5b5876752825cfd6e186c328b8b"
+        description: "Instala el stack tecnológico del proyecto (CodeGraph, skills, OpenSpec, Engram, Context7, controller MCP con SDK oficial). v0.7.4: Paso 1.5 controller expandido con verificación post-instalación y troubleshooting.",
+        version: "0.7.4",
+        sha256: "6887499074a82c3b4538e38ca501290cacd3afad676bd127662fed77e268f299"
       },
       {
         name: "opsx-sync",
         file: "assets/commands/opsx-sync.md",
         description: "Sincroniza delta specs del change activo sin inicializar CodeGraph si ya existe índice",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "fe0158478f2ca63b315037a85fc1632b77868532e319af6c7384285441767d64"
       }
     ],
@@ -583,15 +672,15 @@ var init_manifest = __esm(() => {
       {
         name: "ostacky-controller",
         file: "assets/mcp/ostacky-controller/",
-        description: "Máquina de estados persistida con @modelcontextprotocol/server SDK. v0.7.3: 22 tools (incluye set_handoff, get_handoff, clear_handoff, get_available_transitions funcional). Bugfixes: consecutiveFailures real, lastHandoff state, defaultChoice persistido. Robustez: degraded mode automático tras 3 fallos, persistence condicional para Nivel 0, prune de skills obsoletas.",
-        version: "0.7.3",
-        sha256: "d723afc107c8a36721e7f04dc1c16694a617cd562492e1ece362482c9023b945"
+        description: "Máquina de estados persistida con @modelcontextprotocol/server SDK. v0.7.4: 22 tools (incluye set_handoff, get_handoff, clear_handoff, get_available_transitions funcional). Bugfixes: consecutiveFailures real, lastHandoff state, defaultChoice persistido. Robustez: degraded mode automático tras 3 fallos, persistence condicional para Nivel 0, prune de skills obsoletas.",
+        version: "0.7.4",
+        sha256: "4f86b6829293024caeb3d09c83b61aee158c383a7bb053a49e5a33c7c55862d1"
       },
       {
         name: "openspec",
         file: "assets/mcp/openspec/",
         description: "MCP server local para OpenSpec - proposal, apply, archive, sync de cambios",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "fa4be28bfc1e75db8f1a037e2580f04a60066c80e8e5934e90e1041020d04609"
       }
     ],
@@ -600,106 +689,106 @@ var init_manifest = __esm(() => {
         name: "brainstorming",
         file: "assets/skills/brainstorming/SKILL.md",
         description: "Skill unificado de pensamiento con dos modos: creative-design (producción de diseño → transición a implementación directa o openspec-propose) y open-exploration (exploración libre)",
-        version: "0.7.3",
-        sha256: "333810ca63450e8ab795e8c5a58e645101e788d79210ca8ac36e10d11be39585"
+        version: "0.7.4",
+        sha256: "7b0020f31f346d8f2070219930cfb9341135d40941195f0ea50c3bd7f4a42990"
       },
       {
         name: "execution-mode-evaluation",
         file: "assets/skills/execution-mode-evaluation/SKILL.md",
         description: "Skill de análisis de modo de ejecución — output reconciliado con controller snapshot contract (recommendation field)",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "e17f1e0309572841dc1fa537b1f32c7468eb70b3acf453b9ff5cc4fa8d94fd39"
       },
       {
         name: "tdd",
         file: "assets/skills/tdd/SKILL.md",
         description: "Skill de test-driven development (Superpowers)",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "aa412298980b7826165c211145c1b8e9135f68f36247bb3cb96d0a0eae274486"
       },
       {
         name: "subagent-driven-development",
         file: "assets/skills/subagent-driven-development/SKILL.md",
         description: "Skill de ejecución con subagentes (Superpowers) — ejecuta solo después de confirmación del coordinador Ostacky",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "1a42d714a9a13faf05f0bf7b580e8d837c2e77a5633839542ccce603023419e8"
       },
       {
         name: "dispatching-parallel-agents",
         file: "assets/skills/dispatching-parallel-agents/SKILL.md",
         description: "Skill de dispatch paralelo de agentes (Superpowers)",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "3c8a66d51ae2e719e877d02c3dac32bd804722c3bb9227c258ecae78252a20ab"
       },
       {
         name: "review",
         file: "assets/skills/review/SKILL.md",
         description: "Skill de revisión de código (Superpowers)",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "b19650ed4d1d4d9857a4dd5b7e08e91328a1a1fc9c45bcc2fb600fa9d0213279"
       },
       {
         name: "receiving-code-review",
         file: "assets/skills/receiving-code-review/SKILL.md",
         description: "Skill de recibir y procesar feedback de code review",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "d761e884e71d8d3476ac734d287cae403a4024506a7d12e7361a448217c0a831"
       },
       {
         name: "openspec-propose",
         file: "assets/skills/openspec-propose/SKILL.md",
         description: "Skill de generación de proposal (OpenSpec)",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "bb59100b9fd3c9f9a1ec6509fa975ec55bf7fc737df4fe73bb3e9bbc217b83f7"
       },
       {
         name: "openspec-apply-change",
         file: "assets/skills/openspec-apply-change/SKILL.md",
         description: "Skill de aplicación de change (OpenSpec)",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "dfc823bf89fc7505e91ab6dee9c1f004be38a410bd3d88fb67b211b1b6cbb1d0"
       },
       {
         name: "openspec-archive-change",
         file: "assets/skills/openspec-archive-change/SKILL.md",
         description: "Skill de archivo de change (OpenSpec)",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "16e4b561de7747283663fed602e506abf502452c49a8d4b86d7a5539c40f0195"
       },
       {
         name: "openspec-explore",
         file: "assets/skills/openspec-explore/SKILL.md",
         description: "Modo explore para OpenSpec — thinking partner para explorar ideas, investigar problemas y clarificar requisitos antes/durante un cambio",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "37ae4aaf17ea71a395bab6dc4d9d61b9a49d7910f6692535ae8553244c46880b"
       },
       {
         name: "using-git-worktrees",
         file: "assets/skills/using-git-worktrees/SKILL.md",
         description: "Skill de uso de git worktrees para aislamiento de trabajo",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "93341bc1b7c053618a8b6dc07e3615b77990d7b549a0201f5835d95fef67ce13"
       },
       {
         name: "using-superpowers",
         file: "assets/skills/using-superpowers/SKILL.md",
         description: "Skill de orquestación de Superpowers skills",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "7e54536f96d2a379185a10bfc1e970850caa2561b6d8aca7080f0defea0381a4"
       },
       {
         name: "writing-skills",
         file: "assets/skills/writing-skills/SKILL.md",
         description: "Skill de creación y edición de skills",
-        version: "0.7.3",
+        version: "0.7.4",
         sha256: "3d76b906cee518a2b809febb70db95697a35b9f368986bb504b4120c3bfb437a"
       },
       {
         name: "graceful-degradation",
         file: "assets/skills/graceful-degradation/SKILL.md",
         description: "Skill de degradación graceful cuando múltiples tools están indisponibles",
-        version: "0.7.3",
-        sha256: "630b87c16d78212c865696ca5df6abb0834606095ffe0e80cff8e04350f01054"
+        version: "0.7.4",
+        sha256: "40f929e8032b70d51b3548bddcc383b931d6044fd9d4acce8a5b9f7acd014f59"
       }
     ]
   };
@@ -840,12 +929,12 @@ var init_github = __esm(() => {
 // src/lockfile.ts
 var exports_lockfile = {};
 __export(exports_lockfile, {
-  writeLockfile: () => writeLockfile,
-  removeFromLockfile: () => removeFromLockfile,
-  readLockfile: () => readLockfile,
-  getLockfilePath: () => getLockfilePath,
+  clearLockfile: () => clearLockfile,
   getInstalledVersion: () => getInstalledVersion,
-  clearLockfile: () => clearLockfile
+  getLockfilePath: () => getLockfilePath,
+  readLockfile: () => readLockfile,
+  removeFromLockfile: () => removeFromLockfile,
+  writeLockfile: () => writeLockfile
 });
 import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join4 } from "path";
@@ -910,16 +999,16 @@ var init_lockfile = __esm(() => {
 // src/config.ts
 var exports_config = {};
 __export(exports_config, {
-  writeOpenCodeConfig: () => writeOpenCodeConfig,
-  stripJsoncComments: () => stripJsoncComments,
-  setMcpEntryAtProjectRoot: () => setMcpEntryAtProjectRoot,
-  setMcpEntry: () => setMcpEntry,
-  readOpenCodeConfig: () => readOpenCodeConfig,
-  patchOpenCodeConfig: () => patchOpenCodeConfig,
-  findOpenCodeConfig: () => findOpenCodeConfig,
-  ensureOpenCodeConfig: () => ensureOpenCodeConfig,
+  ensureMcpEntry: () => ensureMcpEntry,
   ensureMcpEntryAtProjectRoot: () => ensureMcpEntryAtProjectRoot,
-  ensureMcpEntry: () => ensureMcpEntry
+  ensureOpenCodeConfig: () => ensureOpenCodeConfig,
+  findOpenCodeConfig: () => findOpenCodeConfig,
+  patchOpenCodeConfig: () => patchOpenCodeConfig,
+  readOpenCodeConfig: () => readOpenCodeConfig,
+  setMcpEntry: () => setMcpEntry,
+  setMcpEntryAtProjectRoot: () => setMcpEntryAtProjectRoot,
+  stripJsoncComments: () => stripJsoncComments,
+  writeOpenCodeConfig: () => writeOpenCodeConfig
 });
 import { existsSync as existsSync4, readFileSync as readFileSync4, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import { join as join5 } from "path";
@@ -1067,17 +1156,17 @@ var init_config = __esm(() => {
 // src/stack.ts
 var exports_stack = {};
 __export(exports_stack, {
-  verifyMcpServers: () => verifyMcpServers,
-  uninstallStackConfig: () => uninstallStackConfig,
-  uninstallEngramConfig: () => uninstallEngramConfig,
-  setupOpenSpec: () => setupOpenSpec,
-  setupContext7: () => setupContext7,
-  installStack: () => installStack,
-  installEngram: () => installEngram,
-  installCodeGraph: () => installCodeGraph,
-  buildLocalMcpCommand: () => buildLocalMcpCommand,
+  OPENSPEC_NPM_PACKAGE: () => OPENSPEC_NPM_PACKAGE,
   buildEngramDownloadUrl: () => buildEngramDownloadUrl,
-  OPENSPEC_NPM_PACKAGE: () => OPENSPEC_NPM_PACKAGE
+  buildLocalMcpCommand: () => buildLocalMcpCommand,
+  installCodeGraph: () => installCodeGraph,
+  installEngram: () => installEngram,
+  installStack: () => installStack,
+  setupContext7: () => setupContext7,
+  setupOpenSpec: () => setupOpenSpec,
+  uninstallEngramConfig: () => uninstallEngramConfig,
+  uninstallStackConfig: () => uninstallStackConfig,
+  verifyMcpServers: () => verifyMcpServers
 });
 import { chmodSync, copyFileSync as copyFileSync3, existsSync as existsSync6, mkdirSync as mkdirSync4, rmSync as rmSync4, unlinkSync as unlinkSync3 } from "fs";
 import { basename as basename2, dirname as dirname5, join as join7, resolve as resolve2 } from "path";
@@ -1499,7 +1588,7 @@ var init_stack = __esm(() => {
 // package.json
 var package_default = {
   name: "ostacky",
-  version: "0.7.3",
+  version: "0.7.4",
   description: "Instalador interactivo de agentes y comandos para OpenCode",
   type: "module",
   bin: {
@@ -1548,23 +1637,23 @@ var package_default = {
 // node_modules/@clack/prompts/dist/index.mjs
 var exports_dist = {};
 __export(exports_dist, {
-  updateSettings: () => hD,
-  text: () => ue,
-  tasks: () => xe,
-  spinner: () => L2,
-  selectKey: () => he,
-  select: () => de,
-  password: () => $e,
-  outro: () => fe,
-  note: () => ye,
-  multiselect: () => pe,
-  log: () => v2,
-  isCancel: () => BD,
-  intro: () => we,
-  groupMultiselect: () => ge,
-  group: () => be,
+  cancel: () => ve,
   confirm: () => me,
-  cancel: () => ve
+  group: () => be,
+  groupMultiselect: () => ge,
+  intro: () => we,
+  isCancel: () => BD,
+  log: () => v2,
+  multiselect: () => pe,
+  note: () => ye,
+  outro: () => fe,
+  password: () => $e,
+  select: () => de,
+  selectKey: () => he,
+  spinner: () => L2,
+  tasks: () => xe,
+  text: () => ue,
+  updateSettings: () => hD
 });
 import { stripVTControlCharacters as T2 } from "node:util";
 
@@ -2674,7 +2763,7 @@ async function probeMcpServer(nodeExecutable, serverPath, cwd, statePath, option
         params: {
           protocolVersion: "2025-03-26",
           capabilities: {},
-          clientInfo: { name: "ostacky-installer", version: "0.7.3" }
+          clientInfo: { name: "ostacky-installer", version: "0.7.4" }
         }
       });
     });
@@ -4142,7 +4231,7 @@ async function runUninstallMcpCommand(name, scope) {
 
 // src/cli.ts
 init_fs();
-import { existsSync as existsSync8, statSync as statSync3, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync8, statSync as statSync3, readFileSync as readFileSync6, readdirSync as readdirSync3 } from "node:fs";
 import { join as join11, dirname as dirname8 } from "node:path";
 var HELP = `
 ostacky — Instalador de agentes, comandos, skills y MCPs para OpenCode
@@ -4243,6 +4332,10 @@ async function runDoctorCommand() {
         console.log(`⚠️ stateOversizedCount=${parsed.stateOversizedCount} snapshots perdidos`);
       if (parsed.sensitiveAccess)
         console.log(`ℹ️ sensitiveAccess: allowed=${parsed.sensitiveAccess.allowed || 0} denied=${parsed.sensitiveAccess.denied || 0} blocked=${parsed.sensitiveAccess.blockedAttempts || 0}`);
+      if (parsed.sensitivePatterns)
+        console.log(`ℹ️ sensitivePatterns: ${parsed.sensitivePatterns.join(", ")}`);
+      if (parsed.allowedFiles && Object.keys(parsed.allowedFiles).length)
+        console.log(`ℹ️ allowedFiles: ${Object.keys(parsed.allowedFiles).join(", ")}`);
       if (parsed.deniedFiles && Object.keys(parsed.deniedFiles).length) {
         console.log(`ℹ️ denied files: ${Object.keys(parsed.deniedFiles).join(", ")} (denied by user)`);
       }
@@ -4330,6 +4423,60 @@ async function runDoctorCommand() {
       if (s.allowedFiles || s.deniedFiles) {}
     } catch {}
   }
+  try {
+    const cacheDir = join11(opencodeDir, "cache", "codegraph");
+    if (!existsSync8(cacheDir)) {
+      console.log("ℹ️ cache: no cache dir yet (ok)");
+    } else {
+      const files = readdirSync3(cacheDir);
+      let total = 0;
+      for (const f2 of files) {
+        try {
+          total += statSync3(join11(cacheDir, f2)).size;
+        } catch {}
+      }
+      const totalMB = (total / 1048576).toFixed(2);
+      if (total > 52428800) {
+        console.log(`⚠️ cache: ${totalMB}MB >50MB — LRU cleanup needed`);
+        hasWarn = true;
+      } else {
+        console.log(`✅ cache: OK (${files.length} files, ${totalMB}MB)`);
+      }
+      try {
+        const s = JSON.parse(readFileSync6(statePath, "utf-8"));
+        if (s.cacheHitCount !== undefined) {
+          console.log(`ℹ️ cacheHitCount=${s.cacheHitCount} cacheMissCount=${s.cacheMissCount || 0} tokenSavingEstimate=${s.tokenSavingEstimate || 0}`);
+        }
+      } catch {}
+    }
+  } catch (e2) {
+    console.log(`⚠️ cache: check failed ${e2.message}`);
+  }
+  try {
+    const secPath = join11(cwd, "src", "security.ts");
+    if (!existsSync8(secPath)) {
+      console.log("⚠️ src/security.ts: missing (source-of-truth)");
+      hasWarn = true;
+    } else {
+      const sec = readFileSync6(secPath, "utf-8");
+      const hasSensitiveDefault = sec.includes("SENSITIVE_DEFAULT");
+      const hasBashRe = sec.includes("BASH_SENSITIVE_RE");
+      const hasIsSensitive = sec.includes("function isSensitive");
+      const hasExtract = sec.includes("extractPathsFromBash");
+      if (hasSensitiveDefault && hasBashRe && hasIsSensitive && hasExtract) {
+        console.log("✅ src/security.ts: source-of-truth OK");
+      } else {
+        console.log("⚠️ src/security.ts: missing exports (SENSITIVE_DEFAULT/BASH_SENSITIVE_RE/isSensitive/extractPathsFromBash)");
+        hasWarn = true;
+      }
+    }
+  } catch {}
+  try {
+    const s = JSON.parse(readFileSync6(statePath, "utf-8"));
+    if (s.sensitiveAccess?.blockedAttempts > 0) {
+      console.log(`ℹ️ sensitiveAccess: blockedAttempts includes bash (${s.sensitiveAccess.blockedAttempts})`);
+    }
+  } catch {}
   if (hasError)
     process.exit(1);
   if (hasWarn)