ostacky 0.8.7 → 0.9.0

package/dist/cli.js

@@ -186,7 +186,7 @@ var require_picocolors = __commonJS(function(exports, module) {
 });
 
 // src/security.ts
-import { createHash } from "crypto";
+import { createHash } from "node:crypto";
 function validateFilePath(filePath) {
   if (filePath.includes("..") || filePath.startsWith("/") || filePath.startsWith("\\") || /^[a-zA-Z]:/.test(filePath)) {
     throw new Error(`Ruta de archivo inválida: "${filePath}"`);
@@ -621,31 +621,31 @@ var init_fs = __esm(() => {
 var manifest_default;
 var init_manifest = __esm(() => {
   manifest_default = {
-    version: "0.8.7",
+    version: "0.9.0",
     repo: "JaimeHoracio/Ostacky",
-    tag: "v0.8.7",
+    tag: "v0.9.0",
     agents: [
       {
         name: "ostacky",
         file: "assets/agents/ostacky.md",
-        description: "Orquestador con recuperación automática (nunca se congela), ruteo por nivel de impacto, controller MCP con SDK oficial, edición segura con fallback inline, y delegación en OpenSpec + Superpowers. v0.8.7: prune de skills obsoletas, lastHandoff, getAvailableTransitions, consecutiveFailures real, mem_session_summary automático al cierre.",
-        version: "0.8.7",
-        sha256: "191a317be68bde517f6d3877ec3a016720617d7382944fff0d08d31b985a6644"
+        description: "Orquestador con recuperación automática (nunca se congela), ruteo por nivel de impacto, controller MCP con SDK oficial, edición segura con fallback inline, y delegación en OpenSpec + Superpowers. v0.9.0: prune de skills obsoletas, lastHandoff, getAvailableTransitions, consecutiveFailures real, mem_session_summary automático al cierre.",
+        version: "0.9.0",
+        sha256: "ecd046b5eb1d604f5e88bc7e5c7c2bda7d6fe63786fad085a038253202c59eeb"
       }
     ],
     commands: [
       {
         name: "install-stack",
         file: "assets/commands/install-stack.md",
-        description: "Instala el stack tecnológico del proyecto (CodeGraph, skills, OpenSpec, Engram, controller plugin). v0.8.7: controller plugin como alma hard-gate, Context7 removido del stack.",
-        version: "0.8.7",
-        sha256: "315d8fcdf2a945cef863bb4576838f95d7eb4a0acca38c12575dc80ecc4724dc"
+        description: "Instala el stack tecnológico del proyecto (CodeGraph, skills, OpenSpec, Engram, controller plugin). v0.9.0: controller plugin como alma hard-gate, Context7 removido del stack.",
+        version: "0.9.0",
+        sha256: "5cdceea5d8c4ef8eb2d1dcc441ad05f87c8c666dcf9810eb0766c9446840b57c"
       },
       {
         name: "opsx-sync",
         file: "assets/commands/opsx-sync.md",
         description: "Sincroniza delta specs del change activo sin inicializar CodeGraph si ya existe índice",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "fe0158478f2ca63b315037a85fc1632b77868532e319af6c7384285441767d64"
       }
     ],
@@ -653,15 +653,15 @@ var init_manifest = __esm(() => {
       {
         name: "ostacky-controller",
         file: "assets/mcp/ostacky-controller/",
-        description: "Máquina de estados persistida con @modelcontextprotocol/server SDK. v0.8.7: 22 tools (incluye set_handoff, get_handoff, clear_handoff, get_available_transitions funcional). Bugfixes: consecutiveFailures real, lastHandoff state, defaultChoice persistido. Robustez: degraded mode automático tras 3 fallos, persistence condicional para Nivel 0, prune de skills obsoletas.",
-        version: "0.8.7",
-        sha256: "9de463763ea6538c03b9307e7e36dcd2ae854dcc460bd25981e75f4f70df0e66"
+        description: "Máquina de estados persistida con @modelcontextprotocol/server SDK. v0.9.0: 22 tools (incluye set_handoff, get_handoff, clear_handoff, get_available_transitions funcional). Bugfixes: consecutiveFailures real, lastHandoff state, defaultChoice persistido. Robustez: degraded mode automático tras 3 fallos, persistence condicional para Nivel 0, prune de skills obsoletas.",
+        version: "0.9.0",
+        sha256: "29857bfbe1b67a0cf1e7ee6215b991fe86ab3f2765feae8f099af5fac610afc1"
       },
       {
         name: "openspec",
         file: "assets/mcp/openspec/",
         description: "MCP server local para OpenSpec - proposal, apply, archive, sync de cambios",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "fa4be28bfc1e75db8f1a037e2580f04a60066c80e8e5934e90e1041020d04609"
       }
     ],
@@ -670,105 +670,105 @@ var init_manifest = __esm(() => {
         name: "brainstorming",
         file: "assets/skills/brainstorming/SKILL.md",
         description: "Skill unificado de pensamiento con dos modos: creative-design (producción de diseño → transición a implementación directa o openspec-propose) y open-exploration (exploración libre)",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "f1013a86a8f27914d85a716e23c7fd32db1786d93615e8b0834b13d184308549"
       },
       {
         name: "execution-mode-evaluation",
         file: "assets/skills/execution-mode-evaluation/SKILL.md",
         description: "Skill de análisis de modo de ejecución — output reconciliado con controller snapshot contract (recommendation field)",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "2158a6864c0912e868a9d720db7fd79441e6cc298e3320833d2527c9727c852e"
       },
       {
         name: "tdd",
         file: "assets/skills/tdd/SKILL.md",
         description: "Skill de test-driven development (Superpowers)",
-        version: "0.8.7",
-        sha256: "aa412298980b7826165c211145c1b8e9135f68f36247bb3cb96d0a0eae274486"
+        version: "0.9.0",
+        sha256: "f0ebfbbc43a8868d31a3fd2df37ae7f60fe8add09c6475862395a68269e5ff7f"
       },
       {
         name: "subagent-driven-development",
         file: "assets/skills/subagent-driven-development/SKILL.md",
         description: "Skill de ejecución con subagentes (Superpowers) — ejecuta solo después de confirmación del coordinador Ostacky",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "1a42d714a9a13faf05f0bf7b580e8d837c2e77a5633839542ccce603023419e8"
       },
       {
         name: "dispatching-parallel-agents",
         file: "assets/skills/dispatching-parallel-agents/SKILL.md",
         description: "Skill de dispatch paralelo de agentes (Superpowers)",
-        version: "0.8.7",
-        sha256: "3c8a66d51ae2e719e877d02c3dac32bd804722c3bb9227c258ecae78252a20ab"
+        version: "0.9.0",
+        sha256: "7e7b712ef742d5631e302e6a71583e2bbbd33094da9281abfb84b43505fc3ef1"
       },
       {
         name: "review",
         file: "assets/skills/review/SKILL.md",
         description: "Skill de revisión de código (Superpowers)",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "b19650ed4d1d4d9857a4dd5b7e08e91328a1a1fc9c45bcc2fb600fa9d0213279"
       },
       {
         name: "receiving-code-review",
         file: "assets/skills/receiving-code-review/SKILL.md",
         description: "Skill de recibir y procesar feedback de code review",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "d761e884e71d8d3476ac734d287cae403a4024506a7d12e7361a448217c0a831"
       },
       {
         name: "openspec-propose",
         file: "assets/skills/openspec-propose/SKILL.md",
         description: "Skill de generación de proposal (OpenSpec)",
-        version: "0.8.7",
-        sha256: "bb59100b9fd3c9f9a1ec6509fa975ec55bf7fc737df4fe73bb3e9bbc217b83f7"
+        version: "0.9.0",
+        sha256: "6a517f750f24c008208156a2d653e97ed30b1e53878aeac5ce394e573db0678f"
       },
       {
         name: "openspec-apply-change",
         file: "assets/skills/openspec-apply-change/SKILL.md",
         description: "Skill de aplicación de change (OpenSpec)",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "dfc823bf89fc7505e91ab6dee9c1f004be38a410bd3d88fb67b211b1b6cbb1d0"
       },
       {
         name: "openspec-archive-change",
         file: "assets/skills/openspec-archive-change/SKILL.md",
         description: "Skill de archivo de change (OpenSpec)",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "16e4b561de7747283663fed602e506abf502452c49a8d4b86d7a5539c40f0195"
       },
       {
         name: "openspec-explore",
         file: "assets/skills/openspec-explore/SKILL.md",
         description: "Modo explore para OpenSpec — thinking partner para explorar ideas, investigar problemas y clarificar requisitos antes/durante un cambio",
-        version: "0.8.7",
-        sha256: "37ae4aaf17ea71a395bab6dc4d9d61b9a49d7910f6692535ae8553244c46880b"
+        version: "0.9.0",
+        sha256: "9eafc3a8c693b8d9916867ef764d49e5222da717fde501c957bb3f6c312d2415"
       },
       {
         name: "using-git-worktrees",
         file: "assets/skills/using-git-worktrees/SKILL.md",
         description: "Skill de uso de git worktrees para aislamiento de trabajo",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "93341bc1b7c053618a8b6dc07e3615b77990d7b549a0201f5835d95fef67ce13"
       },
       {
         name: "using-superpowers",
         file: "assets/skills/using-superpowers/SKILL.md",
         description: "Skill de orquestación de Superpowers skills",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "7e54536f96d2a379185a10bfc1e970850caa2561b6d8aca7080f0defea0381a4"
       },
       {
         name: "writing-skills",
         file: "assets/skills/writing-skills/SKILL.md",
         description: "Skill de creación y edición de skills",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "3d76b906cee518a2b809febb70db95697a35b9f368986bb504b4120c3bfb437a"
       },
       {
         name: "graceful-degradation",
         file: "assets/skills/graceful-degradation/SKILL.md",
         description: "Skill de degradación graceful cuando múltiples tools están indisponibles",
-        version: "0.8.7",
+        version: "0.9.0",
         sha256: "363449bd9e6f800a0a3168667cf78f767fb105d86e4a4adadcc649d418139303"
       }
     ]
@@ -1058,9 +1058,14 @@ function setMcpEntryAtProjectRoot(projectRoot, name, entry) {
   const config = readOpenCodeConfig(configPath);
   if (!config)
     throw new Error(`Error parseando ${configPath}`);
-  if (!config.mcp)
+  if (!config.mcp || typeof config.mcp !== "object")
     config.mcp = {};
-  config.mcp[name] = entry;
+  const mcp = config.mcp;
+  if (!mcp.servers || typeof mcp.servers !== "object")
+    mcp.servers = {};
+  mcp.servers[name] = entry;
+  if (name in mcp && name !== "servers")
+    delete mcp[name];
   writeOpenCodeConfig(configPath, config);
 }
 function patchOpenCodeConfig(projectRoot = findProjectRoot()) {
@@ -1079,16 +1084,30 @@ function patchOpenCodeConfig(projectRoot = findProjectRoot()) {
     };
   }
   let changed = false;
-  if ("plugin" in config) {
-    delete config.plugin;
-    changed = true;
+  if ("plugin" in config && Array.isArray(config.plugin)) {
+    const entries = config.plugin;
+    const kept = entries.filter((e) => !isSuperpowersPluginEntry(e));
+    if (kept.length !== entries.length) {
+      if (kept.length === 0)
+        delete config.plugin;
+      else
+        config.plugin = kept;
+      changed = true;
+    }
   }
   if (changed) {
     writeOpenCodeConfig(configPath, config);
-    return { success: true, message: "Config actualizada (plugin legacy eliminado)" };
+    return { success: true, message: "Config actualizada (entradas superpowers eliminadas)" };
   }
   return { success: true, message: "Config de OpenCode ya está limpia" };
 }
+function isSuperpowersPluginEntry(entry) {
+  try {
+    return JSON.stringify(entry).toLowerCase().includes("superpowers");
+  } catch {
+    return false;
+  }
+}
 var init_config = __esm(() => {
   init_fs();
 });
@@ -1136,7 +1155,9 @@ function configureLocalTool(projectRoot, name, command) {
   setMcpEntryAtProjectRoot(projectRoot, name, {
     type: "local",
     command,
-    enabled: true
+    disabled: false,
+    timeout: { catalog: 30000, execution: 300000 },
+    protocol: "legacy"
   });
 }
 function buildLocalMcpCommand(executable, args, platform = process.platform) {
@@ -1155,6 +1176,8 @@ function copyEngramPlugin(projectRoot) {
 function copyOstackyControllerPlugin(projectRoot) {
   const pluginSource = join7(PACKAGE_ROOT, "assets", "plugins", "ostacky-plugin.ts");
   const coreSource = join7(PACKAGE_ROOT, "assets", "plugins", "controller-core.ts");
+  const securitySource = join7(PACKAGE_ROOT, "assets", "plugins", "security.ts");
+  const tieredSource = join7(PACKAGE_ROOT, "assets", "plugins", "tiered.ts");
   const pluginsDir = join7(projectRoot, ".opencode", "plugins");
   if (!existsSync6(pluginSource)) {
     throw new Error(`Plugin bundleado de OstackyController no encontrado: ${pluginSource}`);
@@ -1163,6 +1186,10 @@ function copyOstackyControllerPlugin(projectRoot) {
   copyFileSync3(pluginSource, join7(pluginsDir, "ostacky-plugin.ts"));
   if (existsSync6(coreSource))
     copyFileSync3(coreSource, join7(pluginsDir, "controller-core.ts"));
+  if (existsSync6(securitySource))
+    copyFileSync3(securitySource, join7(pluginsDir, "security.ts"));
+  if (existsSync6(tieredSource))
+    copyFileSync3(tieredSource, join7(pluginsDir, "tiered.ts"));
 }
 function buildEngramDownloadUrl(tag, platform = process.platform, arch = process.arch) {
   const target = getEngramReleaseTarget(platform, arch);
@@ -1489,17 +1516,119 @@ var init_stack = __esm(() => {
   init_config();
   init_github();
 });
+
+// src/doctor-v2.ts
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { join as join10, delimiter, isAbsolute } from "path";
+function checkDoctorV2(projectRoot) {
+  const lines = [];
+  const cwd = projectRoot;
+  const opencodeDir = findOpenCodeDir(cwd) || join10(cwd, ".opencode");
+  const pluginPaths = [
+    join10(opencodeDir, "plugins", "ostacky-plugin.ts"),
+    join10(cwd, ".opencode", "plugins", "ostacky-plugin.ts"),
+    join10(cwd, "assets", "plugins", "ostacky-plugin.ts")
+  ];
+  const found = pluginPaths.find((p) => existsSync8(p));
+  if (found) {
+    try {
+      const src = readFileSync6(found, "utf-8");
+      const isV2 = src.includes("Plugin.define") && src.includes("@opencode/plugin") && !src.includes("@opencode-ai/plugin");
+      if (isV2)
+        lines.push(`✅ controller: plugin V2 (${found})`);
+      else
+        lines.push(`⚠️ controller: plugin legacy V1 en ${found} — no corre en V2, reinstalá con ostacky`);
+    } catch {
+      lines.push(`⚠️ controller: no se pudo leer ${found}`);
+    }
+  }
+  const configPath = findOpenCodeConfig(cwd);
+  if (!configPath) {
+    lines.push("ℹ️ config: no hay opencode.json ni opencode.jsonc");
+    return lines;
+  }
+  let config = null;
+  try {
+    config = readOpenCodeConfig(configPath);
+  } catch {
+    lines.push(`⚠️ config: no se pudo parsear ${configPath}`);
+    return lines;
+  }
+  if (!config) {
+    lines.push(`⚠️ config: no se pudo parsear ${configPath}`);
+    return lines;
+  }
+  const mcp = config.mcp ?? {};
+  const servers = mcp.servers ?? {};
+  const serverNames = Object.keys(servers);
+  if (serverNames.length > 0)
+    lines.push(`✅ mcp.servers: OK (${serverNames.length}: ${serverNames.join(", ")})`);
+  for (const [key, value] of Object.entries(mcp)) {
+    if (key === "servers" || key === "timeout")
+      continue;
+    if (value && typeof value === "object" && (("command" in value) || ("enabled" in value) || ("url" in value))) {
+      lines.push(`⚠️ mcp.${key} legacy (forma V1) — mové a mcp.servers.${key} con disabled (install lo migra con restore ante fallo)`);
+    }
+  }
+  const renames = {
+    permission: "permissions[]",
+    agent: "agents",
+    command: "commands",
+    reference: "references",
+    provider: "providers",
+    snapshot: "snapshots",
+    attachment: "media"
+  };
+  for (const [oldKey, newKey] of Object.entries(renames)) {
+    if (oldKey in config) {
+      lines.push(`⚠️ ${oldKey} legacy ajeno — V2 usa ${newKey}; se normaliza en memoria, migrá cuando quieras (doctor no lo modifica)`);
+    }
+  }
+  for (const [name, entry] of Object.entries(servers)) {
+    if (!entry || typeof entry !== "object")
+      continue;
+    const cmd = entry.command;
+    if (entry.type === "local" && Array.isArray(cmd) && typeof cmd[0] === "string") {
+      const bin = cmd[0];
+      const ok = isAbsolute(bin) ? existsSync8(bin) : lookupOnPath(bin) !== null;
+      if (!ok)
+        lines.push(`⚠️ mcp.servers.${name} command no existe (${bin}) — ¿proyecto movido? re-corré install`);
+    }
+  }
+  return lines;
+}
+function lookupOnPath(name) {
+  try {
+    const pathEnv = process.env.PATH ?? "";
+    const suffix = process.platform === "win32" ? ".exe" : "";
+    for (const dir of pathEnv.split(delimiter)) {
+      if (!dir)
+        continue;
+      try {
+        if (existsSync8(join10(dir, name + suffix)))
+          return join10(dir, name + suffix);
+        if (suffix && existsSync8(join10(dir, name)))
+          return join10(dir, name);
+      } catch {}
+    }
+  } catch {}
+  return null;
+}
+var init_doctor_v2 = __esm(() => {
+  init_config();
+  init_fs();
+});
 // package.json
 var package_default = {
   name: "ostacky",
-  version: "0.8.7",
+  version: "0.9.0",
   description: "Instalador interactivo de agentes y comandos para OpenCode",
   type: "module",
   bin: {
     ostacky: "./dist/cli.js"
   },
   scripts: {
-    prebuild: "bun run scripts/sync-version.ts",
+    prebuild: "bun run scripts/sync-version.ts && bun run scripts/sync-controller-core.ts",
     dev: "bun run src/cli.ts",
     build: "bun build src/cli.ts --target=node --format=esm --outfile dist/cli.js && bun scripts/add-shebang.ts",
     start: "node dist/cli.js",
@@ -1510,7 +1639,7 @@ var package_default = {
     "hash:update": "bun run scripts/update-manifest-hashes.ts",
     "manifest:prepare": "bun run scripts/update-manifest-hashes.ts",
     "manifest:check": "bun run scripts/update-manifest-hashes.ts --check",
-    prepublishOnly: "bun run manifest:prepare && bun run build"
+    prepublishOnly: "bun run scripts/sync-controller-core.ts && bun run manifest:prepare && bun run build"
   },
   files: [
     "dist/",
@@ -2519,7 +2648,9 @@ function createMcpConfigEntry(name, nodeExecutable, serverPath, statePath) {
   const entry = {
     type: "local",
     command: [nodeExecutable, serverPath],
-    enabled: true
+    disabled: false,
+    timeout: { catalog: 30000, execution: 300000 },
+    protocol: "legacy"
   };
   if (name === "ostacky-controller" && statePath) {
     entry.environment = { OSTACKY_STATE_PATH: statePath };
@@ -2669,7 +2800,7 @@ async function probeMcpServer(nodeExecutable, serverPath, cwd, statePath, option
         params: {
           protocolVersion: "2025-03-26",
           capabilities: {},
-          clientInfo: { name: "ostacky-installer", version: "0.8.7" }
+          clientInfo: { name: "ostacky-installer", version: "0.9.0" }
         }
       });
     });
@@ -2950,8 +3081,17 @@ function uninstallMcpServer(name, paths) {
     const config = readOpenCodeConfig(configPath);
     if (config) {
       const mcp = config.mcp;
-      if (mcp && mcp[name]) {
-        delete mcp[name];
+      if (mcp) {
+        const servers = mcp.servers;
+        if (servers && name in servers) {
+          delete servers[name];
+          if (Object.keys(servers).length === 0) {
+            delete mcp.servers;
+          }
+        }
+        if (name in mcp && name !== "servers") {
+          delete mcp[name];
+        }
         if (Object.keys(mcp).length === 0) {
           delete config.mcp;
         }
@@ -2978,7 +3118,15 @@ function uninstallAll(paths) {
   for (const name of Object.keys(lockfile.mcpServers ?? {})) {
     uninstallMcpServer(name, paths);
   }
-  const ostackyPlugins = ["ostacky-plugin.ts", "engram.ts", "ostacky-guard.ts", "ostacky-controller.ts"];
+  const ostackyPlugins = [
+    "ostacky-plugin.ts",
+    "engram.ts",
+    "ostacky-guard.ts",
+    "ostacky-controller.ts",
+    "controller-core.ts",
+    "security.ts",
+    "tiered.ts"
+  ];
   for (const file of ostackyPlugins) {
     const fp = join6(paths.plugins, file);
     if (existsSync5(fp)) {
@@ -3785,6 +3933,23 @@ function isOpencodeInstalled() {
     return false;
   }
 }
+function parseOpencodeVersion(output) {
+  const m = /v?(\d+)\.\d+\.\d+/.exec(output ?? "");
+  if (!m)
+    return null;
+  const major = parseInt(m[1], 10);
+  return Number.isNaN(major) ? null : major;
+}
+function getOpencodeVersion() {
+  try {
+    return execFileSync4("opencode", ["--version"], {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
 function getOpencodeInstallCommand(platform = process.platform, _arch = process.arch) {
   if (platform === "win32") {
     return {
@@ -3810,8 +3975,17 @@ function getOpencodeInstallCommand(platform = process.platform, _arch = process.
   };
 }
 async function ensureOpencodeInstalled() {
-  if (isOpencodeInstalled())
+  if (isOpencodeInstalled()) {
+    const raw = getOpencodeVersion();
+    const major = raw ? parseOpencodeVersion(raw) : null;
+    if (major !== null && major < 2) {
+      v2.warn(`OpenCode V1 detectado (${raw}). Ostacky requiere OpenCode V2.`);
+      ye(`El instalador V2 reemplaza el binario V1. Desinstalá V1 (package manager) e instalá V2, luego re-ejecutá.
+Docs: https://opencode.ai/v2/docs/migrate-v1`, "Actualización requerida");
+      process.exit(1);
+    }
     return;
+  }
   const platform = process.platform;
   const info = getOpencodeInstallCommand(platform);
   v2.warn("OpenCode no detectado en este sistema.");
@@ -4228,8 +4402,8 @@ async function runUninstallMcpCommand(name, scope) {
 
 // src/cli.ts
 init_fs();
-import { existsSync as existsSync8, statSync as statSync3, readFileSync as readFileSync6, readdirSync as readdirSync3 } from "node:fs";
-import { join as join10, dirname as dirname8 } from "node:path";
+import { existsSync as existsSync9, statSync as statSync3, readFileSync as readFileSync7, readdirSync as readdirSync3 } from "node:fs";
+import { join as join11, dirname as dirname8 } from "node:path";
 var HELP = `
 ostacky — Instalador de agentes, comandos, skills y MCPs para OpenCode
 
@@ -4300,8 +4474,8 @@ var argvNoScope = withoutScopeArgs(process.argv);
 var [, , cmd, subcmd] = argvNoScope;
 async function runDoctorCommand() {
   const cwd = process.cwd();
-  const opencodeDir = findOpenCodeDir(cwd) || join10(cwd, ".opencode");
-  const statePath = join10(opencodeDir, "ostacky-state.json");
+  const opencodeDir = findOpenCodeDir(cwd) || join11(cwd, ".opencode");
+  const statePath = join11(opencodeDir, "ostacky-state.json");
   let hasError = false;
   let hasWarn = false;
   const check = (label, ok, warn = false) => {
@@ -4316,23 +4490,23 @@ async function runDoctorCommand() {
     }
   };
   const pluginPaths = [
-    join10(cwd, "assets", "plugins", "ostacky-plugin.ts"),
-    join10(opencodeDir, "plugins", "ostacky-plugin.ts"),
-    join10(cwd, ".opencode", "plugins", "ostacky-plugin.ts"),
-    join10(cwd, "assets", "plugins", "ostacky-controller.ts"),
-    join10(opencodeDir, "plugins", "ostacky-controller.ts"),
-    join10(cwd, ".opencode", "plugins", "ostacky-controller.ts")
+    join11(cwd, "assets", "plugins", "ostacky-plugin.ts"),
+    join11(opencodeDir, "plugins", "ostacky-plugin.ts"),
+    join11(cwd, ".opencode", "plugins", "ostacky-plugin.ts"),
+    join11(cwd, "assets", "plugins", "ostacky-controller.ts"),
+    join11(opencodeDir, "plugins", "ostacky-controller.ts"),
+    join11(cwd, ".opencode", "plugins", "ostacky-controller.ts")
   ];
-  const pluginActive = pluginPaths.some((p) => existsSync8(p));
+  const pluginActive = pluginPaths.some((p) => existsSync9(p));
   try {
-    if (!existsSync8(statePath)) {
+    if (!existsSync9(statePath)) {
       if (pluginActive)
         console.log(`✅ controller: plugin active (no state yet)`);
       else
         check("controller: state file missing", false, true);
     } else {
       const stat = statSync3(statePath);
-      const raw = readFileSync6(statePath, "utf-8");
+      const raw = readFileSync7(statePath, "utf-8");
       const parsed = JSON.parse(raw);
       if (pluginActive) {
         console.log(`✅ controller: plugin active (rev ${parsed.revision || 0} state ${parsed.state || "unknown"})`);
@@ -4347,6 +4521,8 @@ async function runDoctorCommand() {
         console.log(`⚠️ degraded: confirmation not audited in controller (degradedEditsCount=${parsed.degradedEditsCount})`);
       if (parsed.codegraphBypassCount > 0)
         console.log(`⚠️ codegraphBypassCount=${parsed.codegraphBypassCount} (inefficient: codegraph bypass)`);
+      if (parsed.engramBypassCount > 0)
+        console.log(`⚠️ engramBypassCount=${parsed.engramBypassCount} (contradiction check bypassed — sin mem_search)`);
       if (parsed.stateOversizedCount > 0)
         console.log(`⚠️ stateOversizedCount=${parsed.stateOversizedCount} snapshots perdidos`);
       if (parsed.sensitiveAccess)
@@ -4394,15 +4570,15 @@ async function runDoctorCommand() {
     check(`controller: ${e.message}`, false);
   }
   try {
-    const lockPid = join10(opencodeDir, "ostacky-state.json.lock.pid");
-    const lockTs = join10(opencodeDir, "ostacky-state.json.lock.timestamp");
-    if (existsSync8(lockPid) || existsSync8(lockTs)) {
+    const lockPid = join11(opencodeDir, "ostacky-state.json.lock.pid");
+    const lockTs = join11(opencodeDir, "ostacky-state.json.lock.timestamp");
+    if (existsSync9(lockPid) || existsSync9(lockTs)) {
       let ageStr = "";
       try {
-        const ts = parseInt(readFileSync6(lockTs, "utf-8"), 10);
+        const ts = parseInt(readFileSync7(lockTs, "utf-8"), 10);
         const age = Date.now() - ts;
         ageStr = `${Math.floor(age / 1000)}s`;
-        const pid = readFileSync6(lockPid, "utf-8").trim();
+        const pid = readFileSync7(lockPid, "utf-8").trim();
         let alive = false;
         try {
           process.kill(parseInt(pid, 10), 0);
@@ -4420,15 +4596,15 @@ async function runDoctorCommand() {
   }
   const tools = ["codegraph", "engram"];
   for (const t of tools) {
-    const p = join10(opencodeDir, "tools", t, "bin", t);
+    const p = join11(opencodeDir, "tools", t, "bin", t);
     const pExe = p + ".exe";
-    check(`tool ${t}: ${existsSync8(p) || existsSync8(pExe) ? "found" : "missing"}`, existsSync8(p) || existsSync8(pExe), true);
+    check(`tool ${t}: ${existsSync9(p) || existsSync9(pExe) ? "found" : "missing"}`, existsSync9(p) || existsSync9(pExe), true);
   }
   try {
-    const manifest = JSON.parse(readFileSync6(join10(cwd, "manifest.json"), "utf-8"));
+    const manifest = JSON.parse(readFileSync7(join11(cwd, "manifest.json"), "utf-8"));
     const expected = manifest.mcpServers?.find((x) => x.name === "ostacky-controller")?.sha256;
     if (expected) {
-      const actual = computeTreeHash(join10(cwd, "assets", "mcp", "ostacky-controller"));
+      const actual = computeTreeHash(join11(cwd, "assets", "mcp", "ostacky-controller"));
       check(`manifest hash: ${expected.slice(0, 8)} vs actual ${actual.slice(0, 8)}`, expected === actual);
       if (expected !== actual)
         console.log("  Run: bun run hash:update");
@@ -4436,22 +4612,32 @@ async function runDoctorCommand() {
   } catch {
     check("manifest: not found", false, true);
   }
-  if (existsSync8(statePath)) {
+  try {
+    await Promise.resolve().then(() => init_doctor_v2());
+    for (const line of checkDoctorV2(cwd)) {
+      console.log(line);
+      if (line.startsWith("⚠️") || line.startsWith("❌"))
+        hasWarn = true;
+    }
+  } catch {
+    check("doctor-v2: check failed", false, true);
+  }
+  if (existsSync9(statePath)) {
     try {
-      const s = JSON.parse(readFileSync6(statePath, "utf-8"));
+      const s = JSON.parse(readFileSync7(statePath, "utf-8"));
       if (s.allowedFiles || s.deniedFiles) {}
     } catch {}
   }
   try {
-    const cacheDir = join10(opencodeDir, "cache", "codegraph");
-    if (!existsSync8(cacheDir)) {
+    const cacheDir = join11(opencodeDir, "cache", "codegraph");
+    if (!existsSync9(cacheDir)) {
       console.log("ℹ️ cache: no cache dir yet (ok)");
     } else {
       const files = readdirSync3(cacheDir);
       let total = 0;
       for (const f of files) {
         try {
-          total += statSync3(join10(cacheDir, f)).size;
+          total += statSync3(join11(cacheDir, f)).size;
         } catch {}
       }
       const totalMB = (total / 1048576).toFixed(2);
@@ -4462,7 +4648,7 @@ async function runDoctorCommand() {
         console.log(`✅ cache: OK (${files.length} files, ${totalMB}MB)`);
       }
       try {
-        const s = JSON.parse(readFileSync6(statePath, "utf-8"));
+        const s = JSON.parse(readFileSync7(statePath, "utf-8"));
         if (s.cacheHitCount !== undefined) {
           console.log(`ℹ️ cacheHitCount=${s.cacheHitCount} cacheMissCount=${s.cacheMissCount || 0} tokenSavingEstimate=${s.tokenSavingEstimate || 0}`);
         }
@@ -4472,28 +4658,28 @@ async function runDoctorCommand() {
     console.log(`⚠️ cache: check failed ${e.message}`);
   }
   try {
-    const coreSrc = join10(cwd, "src", "controller-core.ts");
-    const coreMcp = join10(cwd, "assets", "mcp", "ostacky-controller", "controller-core.js");
-    const corePlugin = join10(cwd, "assets", "plugins", "controller-core.ts");
-    const coreSync = existsSync8(coreSrc) && existsSync8(coreMcp) && existsSync8(corePlugin);
+    const coreSrc = join11(cwd, "src", "controller-core.ts");
+    const coreMcp = join11(cwd, "assets", "mcp", "ostacky-controller", "controller-core.js");
+    const corePlugin = join11(cwd, "assets", "plugins", "controller-core.ts");
+    const coreSync = existsSync9(coreSrc) && existsSync9(coreMcp) && existsSync9(corePlugin);
     if (coreSync) {
-      const srcHash = readFileSync6(coreSrc, "utf-8").slice(0, 100);
-      const mcpHash = readFileSync6(coreMcp, "utf-8").slice(0, 100);
-      const ok = readFileSync6(coreMcp, "utf-8").includes("STATES") && readFileSync6(corePlugin, "utf-8").includes("STATES");
+      const srcHash = readFileSync7(coreSrc, "utf-8").slice(0, 100);
+      const mcpHash = readFileSync7(coreMcp, "utf-8").slice(0, 100);
+      const ok = readFileSync7(coreMcp, "utf-8").includes("STATES") && readFileSync7(corePlugin, "utf-8").includes("STATES");
       check(`controller-core: synced (${ok ? "STATES present" : "mismatch"})`, ok);
       if (!ok)
         console.log("  Run: bun run scripts/sync-controller-core.ts (if exists) or copy src/controller-core.ts");
     } else {
       check("controller-core: synced", false, true);
     }
-    const auditPath = join10(opencodeDir, "ostacky-audit.jsonl");
-    if (existsSync8(auditPath)) {
+    const auditPath = join11(opencodeDir, "ostacky-audit.jsonl");
+    if (existsSync9(auditPath)) {
       const sz = statSync3(auditPath).size;
-      const lines = readFileSync6(auditPath, "utf-8").split(`
+      const lines = readFileSync7(auditPath, "utf-8").split(`
 `).filter(Boolean).length;
       check(`audit: jsonl ${lines} entries, ${(sz / 1024).toFixed(1)}KB`, sz < 512000);
-      if (existsSync8(statePath)) {
-        const s = JSON.parse(readFileSync6(statePath, "utf-8"));
+      if (existsSync9(statePath)) {
+        const s = JSON.parse(readFileSync7(statePath, "utf-8"));
         const stateSize = statSync3(statePath).size;
         check(`state size <50KB (${(stateSize / 1024).toFixed(1)}KB)`, stateSize < 51200);
         if (s.audit && s.audit.length > 20)
@@ -4504,16 +4690,16 @@ async function runDoctorCommand() {
     } else {
       console.log("ℹ️ audit: jsonl not yet created (will be created on next audit)");
     }
-    const ostackyMd = readFileSync6(join10(cwd, "assets", "agents", "ostacky.md"), "utf-8");
+    const ostackyMd = readFileSync7(join11(cwd, "assets", "agents", "ostacky.md"), "utf-8");
     const hasLevels = ostackyMd.includes("LEVEL_THRESHOLDS") || ostackyMd.includes("classifyLevel");
     check("levels: unified via tiered.ts", hasLevels, true);
     const hasHonesty = ostackyMd.includes("Principios de honestidad");
     check("honesty: 7 SHALL", hasHonesty);
     if (!hasHonesty)
       console.log("  Expected: ## Principios de honestidad (SHALL) in ostacky.md");
-    const pluginPath = join10(cwd, "assets", "plugins", "ostacky-plugin.ts");
-    if (existsSync8(pluginPath)) {
-      const plugin = readFileSync6(pluginPath, "utf-8");
+    const pluginPath = join11(cwd, "assets", "plugins", "ostacky-plugin.ts");
+    if (existsSync9(pluginPath)) {
+      const plugin = readFileSync7(pluginPath, "utf-8");
       const hasSpecGuard = plugin.includes("getDiscoverySnapshot") && plugin.includes("specSnapshot");
       const hasNoOverwrite = plugin.includes("No edites sin Read fresco") || plugin.includes("specSnapshot");
       check("spec: no-overwrite guard", hasNoOverwrite, true);
@@ -4524,12 +4710,12 @@ async function runDoctorCommand() {
     console.log(`⚠️ honesty/spec checks failed: ${e.message}`);
   }
   try {
-    const giPath = join10(cwd, ".gitignore");
-    if (!existsSync8(giPath)) {
+    const giPath = join11(cwd, ".gitignore");
+    if (!existsSync9(giPath)) {
       console.log("⚠️ .gitignore: missing (run npx ostacky install --scope local to create)");
       hasWarn = true;
     } else {
-      const gi = readFileSync6(giPath, "utf-8");
+      const gi = readFileSync7(giPath, "utf-8");
       const needed = [
         ".opencode/tools/",
         ".opencode/cache/",
@@ -4549,12 +4735,12 @@ async function runDoctorCommand() {
     }
   } catch {}
   try {
-    const secPath = join10(cwd, "src", "security.ts");
-    if (!existsSync8(secPath)) {
+    const secPath = join11(cwd, "src", "security.ts");
+    if (!existsSync9(secPath)) {
       console.log("⚠️ src/security.ts: missing (source-of-truth)");
       hasWarn = true;
     } else {
-      const sec = readFileSync6(secPath, "utf-8");
+      const sec = readFileSync7(secPath, "utf-8");
       const hasSensitiveDefault = sec.includes("SENSITIVE_DEFAULT");
       const hasBashRe = sec.includes("BASH_SENSITIVE_RE");
       const hasIsSensitive = sec.includes("function isSensitive");
@@ -4568,7 +4754,7 @@ async function runDoctorCommand() {
     }
   } catch {}
   try {
-    const s = JSON.parse(readFileSync6(statePath, "utf-8"));
+    const s = JSON.parse(readFileSync7(statePath, "utf-8"));
     if (s.sensitiveAccess?.blockedAttempts > 0) {
       console.log(`ℹ️ sensitiveAccess: blockedAttempts includes bash (${s.sensitiveAccess.blockedAttempts})`);
     }
@@ -4581,14 +4767,14 @@ async function runDoctorCommand() {
 async function runStatusCommand(args) {
   const isJson = args.includes("--json");
   const cwd = process.cwd();
-  const opencodeDir = findOpenCodeDir(cwd) || join10(cwd, ".opencode");
-  const statePath = join10(opencodeDir, "ostacky-state.json");
-  if (!existsSync8(statePath)) {
+  const opencodeDir = findOpenCodeDir(cwd) || join11(cwd, ".opencode");
+  const statePath = join11(opencodeDir, "ostacky-state.json");
+  if (!existsSync9(statePath)) {
     console.log(isJson ? JSON.stringify({ error: "no state" }) : "No state file");
     return;
   }
   try {
-    const parsed = JSON.parse(readFileSync6(statePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync7(statePath, "utf-8"));
     const completed = Object.values(parsed.tasks || {}).filter((t) => t.status === "COMPLETED").length;
     const expected = parsed.expectedTaskCount ?? parsed.expectedTasks?.length ?? Object.keys(parsed.tasks || {}).length;
     const degraded = parsed.degraded ? " degraded" : "";