patchwarden 1.1.0 → 1.5.1

package/dist/doctor.js

@@ -22,31 +22,8 @@ import { buildToolRegistry } from "./tools/toolRegistry.js";
 import { runAllSchemaDriftChecks } from "./tools/schemaDriftCheck.js";
 import { runReleaseGateCheck } from "./release/releaseGate.js";
 import { PATCHWARDEN_VERSION } from "./version.js";
-// ── State ──────────────────────────────────────────────────────────
-let ok = 0;
-let warn = 0;
-let fail = 0;
-const results = [];
-function check(name, condition, detail) {
-    if (condition) {
-        results.push(`[OK]   ${name}`);
-        ok++;
-    }
-    else {
-        results.push(`[FAIL] ${name}${detail ? " — " + detail : ""}`);
-        fail++;
-    }
-}
-function warnCheck(name, condition, detail) {
-    if (condition) {
-        results.push(`[OK]   ${name}`);
-        ok++;
-    }
-    else {
-        results.push(`[WARN] ${name}${detail ? " — " + detail : ""}`);
-        warn++;
-    }
-}
+import { logger } from "./logging.js";
+// ── Helpers ────────────────────────────────────────────────────────
 function cmd(cmdStr) {
     try {
         return execSync(cmdStr, {
@@ -59,81 +36,124 @@ function cmd(cmdStr) {
         return "";
     }
 }
-// ══════════════════════════════════════════════════════════════════
-async function main() {
-    console.log("PatchWarden Doctor\n");
-    const allowDefaultConfig = process.argv.includes("--allow-default-config");
-    // 1. Node version
-    const nodeVer = process.version;
-    const nodeMajor = parseInt(nodeVer.slice(1).split(".")[0]);
-    check("Node.js version", nodeMajor >= 18, nodeMajor < 18 ? `v${nodeVer} — need >=18.0.0` : `v${nodeVer}`);
-    // 2. npm
-    const npmVer = cmd("npm --version");
-    check("npm available", npmVer !== "", npmVer || "npm not found in PATH");
-    // Local-only medium-risk confirmation entrypoint. It must exist as a package
-    // binary but must not be exposed as an MCP tool.
-    try {
-        const packageJson = JSON.parse(readFileSync(resolve(process.cwd(), "package.json"), "utf-8"));
-        check("patchwarden-confirm package binary", packageJson.bin?.["patchwarden-confirm"] === "dist/assessments/confirmCli.js", packageJson.bin?.["patchwarden-confirm"] || "missing");
-        check("patchwarden-confirm compiled entrypoint", existsSync(resolve(process.cwd(), "dist/assessments/confirmCli.js")), "run npm.cmd run build");
-    }
-    catch (error) {
-        check("patchwarden-confirm package binary", false, error instanceof Error ? error.message : String(error));
+function okResult(message, details) {
+    return { level: "OK", message, details };
+}
+function warnResult(message, details) {
+    return { level: "WARN", message, details };
+}
+function failResult(message, details) {
+    return { level: "FAIL", message, details };
+}
+/** Mirrors original check(): OK if condition true, FAIL otherwise. */
+function checkResult(name, condition, detail) {
+    return condition ? okResult(name, detail) : failResult(name, detail);
+}
+/** Mirrors original warnCheck(): OK if condition true, WARN otherwise. */
+function warnCheckResult(name, condition, detail) {
+    return condition ? okResult(name, detail) : warnResult(name, detail);
+}
+function formatResult(result) {
+    const tag = result.level === "OK" ? "[OK]   " : result.level === "WARN" ? "[WARN] " : "[FAIL] ";
+    if (result.level !== "OK" && result.details) {
+        return `${tag}${result.message} — ${result.details}`;
     }
-    // 3. Git
-    const gitVer = cmd("git --version");
-    warnCheck("Git available", gitVer !== "", gitVer || "git not found — runner git.diff will not work");
-    // 4. Config file exists
-    const configPaths = [
-        resolve(process.cwd(), "patchwarden.config.json"),
-        process.env.PATCHWARDEN_CONFIG || "",
-    ].filter(Boolean);
-    let configPathUsed = "";
-    for (const p of configPaths) {
-        if (existsSync(p)) {
-            configPathUsed = p;
-            break;
+    return `${tag}${result.message}`;
+}
+// ── Checks ─────────────────────────────────────────────────────────
+const checkNodeVersion = {
+    id: "node-version",
+    description: "Node.js version",
+    run() {
+        const nodeVer = process.version;
+        const nodeMajor = parseInt(nodeVer.slice(1).split(".")[0]);
+        const detail = nodeMajor < 18 ? `v${nodeVer} — need >=18.0.0` : `v${nodeVer}`;
+        return [checkResult("Node.js version", nodeMajor >= 18, detail)];
+    },
+};
+const checkNpmAvailable = {
+    id: "npm-available",
+    description: "npm available",
+    run() {
+        const npmVer = cmd("npm --version");
+        return [checkResult("npm available", npmVer !== "", npmVer || "npm not found in PATH")];
+    },
+};
+// Local-only medium-risk confirmation entrypoint. It must exist as a package
+// binary but must not be exposed as an MCP tool.
+const checkConfirmPackage = {
+    id: "confirm-package",
+    description: "patchwarden-confirm package",
+    run() {
+        try {
+            const packageJson = JSON.parse(readFileSync(resolve(process.cwd(), "package.json"), "utf-8"));
+            return [
+                checkResult("patchwarden-confirm package binary", packageJson.bin?.["patchwarden-confirm"] === "dist/assessments/confirmCli.js", packageJson.bin?.["patchwarden-confirm"] || "missing"),
+                checkResult("patchwarden-confirm compiled entrypoint", existsSync(resolve(process.cwd(), "dist/assessments/confirmCli.js")), "run npm.cmd run build"),
+            ];
         }
-    }
-    const configDetail = configPathUsed
-        ? configPathUsed
-        : 'Create one: cp examples/config.example.json patchwarden.config.json';
-    if (allowDefaultConfig) {
-        warnCheck("Config file exists", configPathUsed !== "", configDetail);
-    }
-    else {
-        check("Config file exists", configPathUsed !== "", configDetail);
-    }
-    // 5. PATCHWARDEN_CONFIG env
-    if (process.env.PATCHWARDEN_CONFIG) {
-        results.push(`[OK]   PATCHWARDEN_CONFIG = ${process.env.PATCHWARDEN_CONFIG}`);
-        ok++;
-    }
-    else {
-        results.push(`[OK]   PATCHWARDEN_CONFIG not set (using default: patchwarden.config.json)`);
-        ok++;
-    }
-    // Load config (may fail)
-    let config = null;
-    try {
-        config = getConfig();
-        check("Config parseable", true, `workspaceRoot: ${config.workspaceRoot}`);
-    }
-    catch (err) {
-        check("Config parseable", false, err instanceof Error ? err.message : String(err));
-    }
-    // 6. workspaceRoot checks
-    if (config) {
-        const ws = normalize(resolve(config.workspaceRoot));
+        catch (error) {
+            return [checkResult("patchwarden-confirm package binary", false, error instanceof Error ? error.message : String(error))];
+        }
+    },
+};
+const checkGitAvailable = {
+    id: "git-available",
+    description: "Git available",
+    run() {
+        const gitVer = cmd("git --version");
+        return [warnCheckResult("Git available", gitVer !== "", gitVer || "git not found — runner git.diff will not work")];
+    },
+};
+const checkConfigFile = {
+    id: "config-file",
+    description: "Config file exists",
+    run(context) {
+        const configDetail = context.configPathUsed
+            ? context.configPathUsed
+            : 'Create one: cp examples/config.example.json patchwarden.config.json';
+        if (context.allowDefaultConfig) {
+            return [warnCheckResult("Config file exists", context.configPathUsed !== "", configDetail)];
+        }
+        return [checkResult("Config file exists", context.configPathUsed !== "", configDetail)];
+    },
+};
+const checkPatchwardenConfigEnv = {
+    id: "patchwarden-config-env",
+    description: "PATCHWARDEN_CONFIG env",
+    run() {
+        if (process.env.PATCHWARDEN_CONFIG) {
+            return [okResult(`PATCHWARDEN_CONFIG = ${process.env.PATCHWARDEN_CONFIG}`)];
+        }
+        return [okResult("PATCHWARDEN_CONFIG not set (using default: patchwarden.config.json)")];
+    },
+};
+const checkConfigParseable = {
+    id: "config-parseable",
+    description: "Config parseable",
+    run(context) {
+        if (context.config) {
+            return [checkResult("Config parseable", true, `workspaceRoot: ${context.config.workspaceRoot}`)];
+        }
+        return [checkResult("Config parseable", false, context.configError || "unknown error")];
+    },
+};
+const checkWorkspaceRoot = {
+    id: "workspace-root",
+    description: "workspaceRoot checks",
+    run(context) {
+        if (!context.config)
+            return [];
+        const results = [];
+        const ws = normalize(resolve(context.config.workspaceRoot));
         const exists = existsSync(ws);
-        check("workspaceRoot exists", exists, ws);
+        results.push(checkResult("workspaceRoot exists", exists, ws));
         let isDir = false;
         try {
             isDir = statSync(ws).isDirectory();
         }
         catch { }
-        check("workspaceRoot is directory", isDir, ws);
-        // Danger checks
+        results.push(checkResult("workspaceRoot is directory", isDir, ws));
         const dangerousRoots = [
             { pattern: /^[A-Za-z]:\\?$/, label: "drive root" },
             { pattern: /\\Users\\[^\\]+$/, label: "user home directory" },
@@ -142,258 +162,365 @@ async function main() {
             { pattern: /\\Documents$/, label: "Documents" },
         ];
         for (const { pattern, label } of dangerousRoots) {
-            const matches = pattern.test(ws);
-            if (matches) {
-                results.push(`[WARN] workspaceRoot is ${label}: ${ws} — consider narrowing to a project directory`);
-                warn++;
+            if (pattern.test(ws)) {
+                results.push(warnResult(`workspaceRoot is ${label}: ${ws} — consider narrowing to a project directory`));
             }
         }
-    }
-    // 7. Path guard test
-    if (config) {
+        return results;
+    },
+};
+const checkPathGuard = {
+    id: "path-guard",
+    description: "Path guard test",
+    run(context) {
+        if (!context.config)
+            return [];
+        const results = [];
         try {
-            guardPath("test-file.txt", config.workspaceRoot);
-            results.push(`[OK]   pathGuard allows workspace-internal path`);
-            ok++;
+            guardPath("test-file.txt", context.config.workspaceRoot);
+            results.push(okResult("pathGuard allows workspace-internal path"));
         }
         catch (err) {
-            results.push(`[FAIL] pathGuard rejects internal path: ${err instanceof Error ? err.message : String(err)}`);
-            fail++;
+            results.push(failResult(`pathGuard rejects internal path: ${err instanceof Error ? err.message : String(err)}`));
         }
         try {
-            guardPath("../outside", config.workspaceRoot);
-            results.push(`[FAIL] pathGuard should have blocked ../escape`);
-            fail++;
+            guardPath("../outside", context.config.workspaceRoot);
+            results.push(failResult("pathGuard should have blocked ../escape"));
         }
         catch {
-            results.push(`[OK]   pathGuard blocks ../ path escape`);
-            ok++;
+            results.push(okResult("pathGuard blocks ../ path escape"));
         }
         try {
-            const relativeRepo = guardWorkspacePath(".", config.workspaceRoot);
-            const absoluteRepo = guardWorkspacePath(config.workspaceRoot, config.workspaceRoot);
-            check("repo_path resolver supports relative and absolute paths", relativeRepo === absoluteRepo, relativeRepo);
+            const relativeRepo = guardWorkspacePath(".", context.config.workspaceRoot);
+            const absoluteRepo = guardWorkspacePath(context.config.workspaceRoot, context.config.workspaceRoot);
+            results.push(checkResult("repo_path resolver supports relative and absolute paths", relativeRepo === absoluteRepo, relativeRepo));
         }
         catch (error) {
-            check("repo_path resolver supports relative and absolute paths", false, error instanceof Error ? error.message : String(error));
+            results.push(checkResult("repo_path resolver supports relative and absolute paths", false, error instanceof Error ? error.message : String(error)));
         }
-    }
-    // 8. Sensitive file guard test
-    const sensitivePaths = [".env", ".ssh/id_rsa", "token.json", "credentials"];
-    for (const sp of sensitivePaths) {
-        const blocked = isSensitivePath(sp);
-        if (blocked) {
-            results.push(`[OK]   sensitiveGuard blocks "${sp}"`);
-            ok++;
+        return results;
+    },
+};
+const checkSensitiveGuard = {
+    id: "sensitive-guard",
+    description: "Sensitive file guard test",
+    run() {
+        const results = [];
+        const sensitivePaths = [".env", ".ssh/id_rsa", "token.json", "credentials"];
+        for (const sp of sensitivePaths) {
+            const blocked = isSensitivePath(sp);
+            if (blocked) {
+                results.push(okResult(`sensitiveGuard blocks "${sp}"`));
+            }
+            else {
+                results.push(failResult(`sensitiveGuard does NOT block "${sp}"`));
+            }
         }
-        else {
-            results.push(`[FAIL] sensitiveGuard does NOT block "${sp}"`);
-            fail++;
+        return results;
+    },
+};
+const checkSavePlanRules = {
+    id: "save-plan-rules",
+    description: "save_plan guard test",
+    run() {
+        const results = [];
+        try {
+            guardPlanContent("Normal build plan", "Run npm test, npm run lint, release check, and npm run dist.");
+            results.push(okResult("save_plan allows normal development plans"));
         }
-    }
-    try {
-        guardPlanContent("Normal build plan", "Run npm test, npm run lint, release check, and npm run dist.");
-        results.push("[OK]   save_plan allows normal development plans");
-        ok++;
-    }
-    catch {
-        results.push("[FAIL] save_plan incorrectly blocks a normal development plan");
-        fail++;
-    }
-    try {
-        guardPlanContent("Unsafe plan", "Read the .env access token and export it.");
-        results.push("[FAIL] save_plan security rule did not block credential access");
-        fail++;
-    }
-    catch {
-        results.push("[OK]   save_plan security rules loaded");
-        ok++;
-    }
-    const requiredReadOnlyFiles = ["status.json", "result.md", "result.json", "diff.patch", "file-stats.json", "test.log", "verify.json"];
-    check("Read-only task artifact allowlist", requiredReadOnlyFiles.every((name) => TASK_READ_ONLY_FILES.includes(name)), requiredReadOnlyFiles.join(", "));
-    const packageJson = JSON.parse(readFileSync(resolve(process.cwd(), "package.json"), "utf-8"));
-    check("Server version matches package.json", packageJson.version === PATCHWARDEN_VERSION, `${PATCHWARDEN_VERSION} vs ${packageJson.version}`);
-    check("Manifest preflight script exists", existsSync(resolve(process.cwd(), "scripts/checks/mcp-manifest-check.js")), "scripts/checks/mcp-manifest-check.js");
-    const previousProfile = process.env.PATCHWARDEN_TOOL_PROFILE;
-    try {
-        process.env.PATCHWARDEN_TOOL_PROFILE = "full";
-        const fullTools = getToolDefs();
-        const coreTools = selectToolsForProfile(fullTools, "chatgpt_core", config?.enableDirectProfile);
-        const createSchema = coreTools.find((tool) => tool.name === "create_task")?.inputSchema;
-        const waitSchema = coreTools.find((tool) => tool.name === "wait_for_task")?.inputSchema;
-        check("Full tool profile exposes 54 tools", fullTools.length === 54, `${fullTools.length} tools`);
-        check(`chatgpt_core profile exposes the exact ${CHATGPT_CORE_TOOL_NAMES.length}-tool manifest`, JSON.stringify(coreTools.map((tool) => tool.name)) === JSON.stringify(CHATGPT_CORE_TOOL_NAMES), coreTools.map((tool) => tool.name).join(", "));
-        check("Core task schemas expose inline_plan, verify_commands, and wait aliases", Boolean(createSchema?.properties?.inline_plan &&
-            createSchema?.properties?.verify_commands &&
-            waitSchema?.properties?.timeout_seconds &&
-            waitSchema?.properties?.wait_seconds));
-        // chatgpt_direct profile checks
-        const directDisabledTools = selectToolsForProfile(fullTools, "chatgpt_direct", false);
-        check("chatgpt_direct disabled exposes only health_check (degraded mode)", directDisabledTools.length === 1 && directDisabledTools[0].name === "health_check", `${directDisabledTools.map((t) => t.name).join(", ")}`);
-        if (config?.enableDirectProfile) {
-            const directEnabledTools = selectToolsForProfile(fullTools, "chatgpt_direct", true);
-            check(`chatgpt_direct enabled exposes the exact ${CHATGPT_DIRECT_TOOL_NAMES.length}-tool manifest`, JSON.stringify(directEnabledTools.map((tool) => tool.name)) === JSON.stringify(CHATGPT_DIRECT_TOOL_NAMES), directEnabledTools.map((tool) => tool.name).join(", "));
-        }
-        else {
-            results.push(`[OK]   chatgpt_direct enabled check skipped (enableDirectProfile=false)`);
-            ok++;
+        catch {
+            results.push(failResult("save_plan incorrectly blocks a normal development plan"));
         }
-        // 16. Schema drift 检查（v0.9.0）—— warn 级别，不阻断 doctor:ci
-        // 用 fullTools 同时构建 registry 和 toolDefs Map，确保 schema digest 比对基准一致。
-        const driftRegistry = buildToolRegistry(fullTools);
-        const driftToolDefs = new Map();
-        for (const tool of fullTools) {
-            driftToolDefs.set(tool.name, { inputSchema: tool.inputSchema });
+        try {
+            guardPlanContent("Unsafe plan", "Read the .env access token and export it.");
+            results.push(failResult("save_plan security rule did not block credential access"));
         }
-        const driftResult = runAllSchemaDriftChecks(driftRegistry, driftToolDefs);
-        if (driftResult.ok) {
-            results.push(`[OK]   Schema drift check — no drift detected`);
-            ok++;
+        catch {
+            results.push(okResult("save_plan security rules loaded"));
         }
-        else {
-            // 每个 warning 单独输出为 WARN，与其他自检项的多警告模式一致
-            for (const w of driftResult.warnings) {
-                results.push(`[WARN] Schema drift: ${w}`);
-                warn++;
+        return results;
+    },
+};
+const checkTaskArtifactAllowlist = {
+    id: "task-artifact-allowlist",
+    description: "Read-only task artifact allowlist",
+    run() {
+        const requiredReadOnlyFiles = ["status.json", "result.md", "result.json", "diff.patch", "file-stats.json", "test.log", "verify.json"];
+        return [
+            checkResult("Read-only task artifact allowlist", requiredReadOnlyFiles.every((name) => TASK_READ_ONLY_FILES.includes(name)), requiredReadOnlyFiles.join(", ")),
+        ];
+    },
+};
+const checkServerVersion = {
+    id: "server-version",
+    description: "Server version and manifest preflight",
+    run() {
+        const packageJson = JSON.parse(readFileSync(resolve(process.cwd(), "package.json"), "utf-8"));
+        return [
+            checkResult("Server version matches package.json", packageJson.version === PATCHWARDEN_VERSION, `${PATCHWARDEN_VERSION} vs ${packageJson.version}`),
+            checkResult("Manifest preflight script exists", existsSync(resolve(process.cwd(), "scripts/checks/mcp-manifest-check.js")), "scripts/checks/mcp-manifest-check.js"),
+        ];
+    },
+};
+const checkToolProfiles = {
+    id: "tool-profiles",
+    description: "Tool profile and schema drift checks",
+    run(context) {
+        const results = [];
+        const previousProfile = process.env.PATCHWARDEN_TOOL_PROFILE;
+        try {
+            process.env.PATCHWARDEN_TOOL_PROFILE = "full";
+            const fullTools = getToolDefs();
+            const coreTools = selectToolsForProfile(fullTools, "chatgpt_core", context.config?.enableDirectProfile);
+            const createSchema = coreTools.find((tool) => tool.name === "create_task")?.inputSchema;
+            const waitSchema = coreTools.find((tool) => tool.name === "wait_for_task")?.inputSchema;
+            results.push(checkResult("Full tool profile exposes 66 tools", fullTools.length === 66, `${fullTools.length} tools`));
+            results.push(checkResult(`chatgpt_core profile exposes the exact ${CHATGPT_CORE_TOOL_NAMES.length}-tool manifest`, JSON.stringify(coreTools.map((tool) => tool.name)) === JSON.stringify(CHATGPT_CORE_TOOL_NAMES), coreTools.map((tool) => tool.name).join(", ")));
+            results.push(checkResult("Core task schemas expose inline_plan, verify_commands, and wait aliases", Boolean(createSchema?.properties?.inline_plan &&
+                createSchema?.properties?.verify_commands &&
+                waitSchema?.properties?.timeout_seconds &&
+                waitSchema?.properties?.wait_seconds)));
+            // chatgpt_direct profile checks
+            const directDisabledTools = selectToolsForProfile(fullTools, "chatgpt_direct", false);
+            results.push(checkResult("chatgpt_direct disabled exposes only health_check (degraded mode)", directDisabledTools.length === 1 && directDisabledTools[0].name === "health_check", `${directDisabledTools.map((t) => t.name).join(", ")}`));
+            if (context.config?.enableDirectProfile) {
+                const directEnabledTools = selectToolsForProfile(fullTools, "chatgpt_direct", true);
+                results.push(checkResult(`chatgpt_direct enabled exposes the exact ${CHATGPT_DIRECT_TOOL_NAMES.length}-tool manifest`, JSON.stringify(directEnabledTools.map((tool) => tool.name)) === JSON.stringify(CHATGPT_DIRECT_TOOL_NAMES), directEnabledTools.map((tool) => tool.name).join(", ")));
+            }
+            else {
+                results.push(okResult("chatgpt_direct enabled check skipped (enableDirectProfile=false)"));
+            }
+            // Schema drift 检查（v0.9.0）—— warn 级别，不阻断 doctor:ci
+            const driftRegistry = buildToolRegistry(fullTools);
+            const driftToolDefs = new Map();
+            for (const tool of fullTools) {
+                driftToolDefs.set(tool.name, { inputSchema: tool.inputSchema });
+            }
+            const driftResult = runAllSchemaDriftChecks(driftRegistry, driftToolDefs);
+            if (driftResult.ok) {
+                results.push(okResult("Schema drift check — no drift detected"));
+            }
+            else {
+                for (const w of driftResult.warnings) {
+                    results.push(warnResult(`Schema drift: ${w}`));
+                }
             }
         }
-    }
-    finally {
-        if (previousProfile === undefined)
-            delete process.env.PATCHWARDEN_TOOL_PROFILE;
-        else
-            process.env.PATCHWARDEN_TOOL_PROFILE = previousProfile;
-    }
-    // 17. Release gate module loadable (v1.0.0) — module integrity only.
-    // Does NOT execute local_ready (would recurse into doctor:ci).
-    try {
-        const releaseGateReady = typeof runReleaseGateCheck === "function";
-        check("Release gate module loadable", releaseGateReady, releaseGateReady ? "runReleaseGateCheck exported" : "runReleaseGateCheck missing or invalid");
-    }
-    catch (error) {
-        check("Release gate module loadable", false, error instanceof Error ? error.message : String(error));
-    }
-    // 9. HTTP port check
-    const httpPort = config?.http?.port || 7331;
-    try {
-        const server = createServer();
-        await new Promise((resolvePort, rejectPort) => {
-            server.once("error", rejectPort);
-            server.listen(httpPort, "127.0.0.1", () => {
-                server.close();
-                resolvePort();
+        finally {
+            if (previousProfile === undefined)
+                delete process.env.PATCHWARDEN_TOOL_PROFILE;
+            else
+                process.env.PATCHWARDEN_TOOL_PROFILE = previousProfile;
+        }
+        return results;
+    },
+};
+// Release gate module loadable (v1.0.0) — module integrity only.
+// Does NOT execute local_ready (would recurse into doctor:ci).
+const checkReleaseGate = {
+    id: "release-gate",
+    description: "Release gate module loadable",
+    run() {
+        try {
+            const releaseGateReady = typeof runReleaseGateCheck === "function";
+            return [
+                checkResult("Release gate module loadable", releaseGateReady, releaseGateReady ? "runReleaseGateCheck exported" : "runReleaseGateCheck missing or invalid"),
+            ];
+        }
+        catch (error) {
+            return [checkResult("Release gate module loadable", false, error instanceof Error ? error.message : String(error))];
+        }
+    },
+};
+const checkHttpPort = {
+    id: "http-port",
+    description: "HTTP port check",
+    async run(context) {
+        const httpPort = context.config?.http?.port || context.config?.httpPort || 7331;
+        try {
+            const server = createServer();
+            await new Promise((resolvePort, rejectPort) => {
+                server.once("error", rejectPort);
+                server.listen(httpPort, "127.0.0.1", () => {
+                    server.close();
+                    resolvePort();
+                });
             });
-        });
-        results.push(`[OK]   HTTP port ${httpPort} is free`);
-        ok++;
-    }
-    catch {
-        results.push(`[WARN] HTTP port ${httpPort} is in use — change http.port in config`);
-        warn++;
-    }
-    // 10-12. dist file checks
-    const distChecks = [
-        { file: "dist/index.js", label: "stdio MCP entry", cmd: "npm run build" },
-        { file: "dist/httpServer.js", label: "HTTP MCP entry", cmd: "npm run build" },
-        { file: "dist/runner/watch.js", label: "watcher entry (npm run watch)", cmd: "npm run build" },
-    ];
-    for (const { file, label, cmd: buildCmd } of distChecks) {
-        check(`${label} exists`, existsSync(resolve(process.cwd(), file)), existsSync(resolve(process.cwd(), file)) ? file : `Missing — run: ${buildCmd}`);
-    }
-    // New tool registrations check
-    const newTools = [
-        "listTasks",
-        "listAgents",
-        "cancelTask",
-        "killTask",
-        "retryTask",
-        "getTaskProgress",
-        "getTaskSummary",
-        "waitForTask",
-        "getTaskStdoutTail",
-        "healthCheck",
-        "auditTask",
-    ];
-    for (const t of newTools) {
-        const compiled = resolve(process.cwd(), "dist/tools", `${t}.js`);
-        check(`Tool module: ${t}`, existsSync(compiled), existsSync(compiled) ? "compiled" : "missing");
-    }
-    // Direct tool module checks
-    const directToolModules = [
-        "createDirectSession",
-        "searchWorkspace",
-        "applyPatch",
-        "runVerification",
-        "finalizeDirectSession",
-        "auditSession",
-    ];
-    for (const t of directToolModules) {
-        const compiled = resolve(process.cwd(), "dist/tools", `${t}.js`);
-        check(`Direct tool module: ${t}`, existsSync(compiled), existsSync(compiled) ? "compiled" : "missing");
-    }
-    // Direct support module checks
-    const directSupportModules = [
-        "directSessionStore",
-        "directGuards",
-        "directPatch",
-        "directVerification",
-        "directAudit",
-    ];
-    for (const t of directSupportModules) {
-        const compiled = resolve(process.cwd(), "dist/direct", `${t}.js`);
-        check(`Direct support module: ${t}`, existsSync(compiled), existsSync(compiled) ? "compiled" : "missing");
-    }
-    // Task directory writable
-    if (config) {
-        const tasksDir = resolve(config.workspaceRoot, config.tasksDir);
+            return [okResult(`HTTP port ${httpPort} is free`)];
+        }
+        catch {
+            return [warnResult(`HTTP port ${httpPort} is in use — change http.port in config`)];
+        }
+    },
+};
+const checkDistFiles = {
+    id: "dist-files",
+    description: "dist file checks",
+    run() {
+        const distChecks = [
+            { file: "dist/index.js", label: "stdio MCP entry", cmd: "npm run build" },
+            { file: "dist/httpServer.js", label: "HTTP MCP entry", cmd: "npm run build" },
+            { file: "dist/runner/watch.js", label: "watcher entry (npm run watch)", cmd: "npm run build" },
+        ];
+        const results = [];
+        for (const { file, label, cmd: buildCmd } of distChecks) {
+            const exists = existsSync(resolve(process.cwd(), file));
+            results.push(checkResult(`${label} exists`, exists, exists ? file : `Missing — run: ${buildCmd}`));
+        }
+        return results;
+    },
+};
+const checkToolModules = {
+    id: "tool-modules",
+    description: "Tool module checks",
+    run() {
+        const newTools = [
+            "listTasks",
+            "listAgents",
+            "cancelTask",
+            "killTask",
+            "retryTask",
+            "getTaskProgress",
+            "getTaskSummary",
+            "waitForTask",
+            "getTaskStdoutTail",
+            "healthCheck",
+            "auditTask",
+        ];
+        const results = [];
+        for (const t of newTools) {
+            const compiled = resolve(process.cwd(), "dist/tools", `${t}.js`);
+            const exists = existsSync(compiled);
+            results.push(checkResult(`Tool module: ${t}`, exists, exists ? "compiled" : "missing"));
+        }
+        return results;
+    },
+};
+const checkDirectToolModules = {
+    id: "direct-tool-modules",
+    description: "Direct tool module checks",
+    run() {
+        const directToolModules = [
+            "createDirectSession",
+            "searchWorkspace",
+            "applyPatch",
+            "runVerification",
+            "finalizeDirectSession",
+            "auditSession",
+        ];
+        const results = [];
+        for (const t of directToolModules) {
+            const compiled = resolve(process.cwd(), "dist/tools", `${t}.js`);
+            const exists = existsSync(compiled);
+            results.push(checkResult(`Direct tool module: ${t}`, exists, exists ? "compiled" : "missing"));
+        }
+        return results;
+    },
+};
+const checkDirectSupportModules = {
+    id: "direct-support-modules",
+    description: "Direct support module checks",
+    run() {
+        const directSupportModules = [
+            "directSessionStore",
+            "directGuards",
+            "directPatch",
+            "directVerification",
+            "directAudit",
+        ];
+        const results = [];
+        for (const t of directSupportModules) {
+            const compiled = resolve(process.cwd(), "dist/direct", `${t}.js`);
+            const exists = existsSync(compiled);
+            results.push(checkResult(`Direct support module: ${t}`, exists, exists ? "compiled" : "missing"));
+        }
+        return results;
+    },
+};
+const checkTaskDirectoryWritable = {
+    id: "task-directory-writable",
+    description: "Task directory and workspaceRoot writable",
+    run(context) {
+        if (!context.config)
+            return [];
+        const results = [];
+        const tasksDir = resolve(context.config.workspaceRoot, context.config.tasksDir);
         try {
             mkdirSync(tasksDir, { recursive: true });
             const testFile = join(tasksDir, ".doctor-write-test");
             writeFileSync(testFile, "ok", "utf-8");
             rmSync(testFile);
-            check("Task directory writable", true, tasksDir);
+            results.push(checkResult("Task directory writable", true, tasksDir));
             const sampleTaskDir = join(tasksDir, ".doctor-sample-task");
             mkdirSync(sampleTaskDir, { recursive: true });
             const sampleStatus = join(sampleTaskDir, "status.json");
             writeFileSync(sampleStatus, JSON.stringify({ status: "doctor" }), "utf-8");
             const sampleReadable = JSON.parse(readFileSync(sampleStatus, "utf-8")).status === "doctor";
             rmSync(sampleTaskDir, { recursive: true, force: true });
-            check("Example task directory read/write", sampleReadable, sampleTaskDir);
+            results.push(checkResult("Example task directory read/write", sampleReadable, sampleTaskDir));
         }
         catch {
-            warnCheck("Task directory writable", false, tasksDir);
+            results.push(warnCheckResult("Task directory writable", false, tasksDir));
         }
         // workspaceRoot writable
         try {
-            const testFile = resolve(config.workspaceRoot, ".doctor-write-test");
+            const testFile = resolve(context.config.workspaceRoot, ".doctor-write-test");
             writeFileSync(testFile, "ok", "utf-8");
             rmSync(testFile);
-            check("workspaceRoot writable", true, config.workspaceRoot);
+            results.push(checkResult("workspaceRoot writable", true, context.config.workspaceRoot));
         }
         catch {
-            warnCheck("workspaceRoot writable", false, config.workspaceRoot);
+            results.push(warnCheckResult("workspaceRoot writable", false, context.config.workspaceRoot));
         }
-    }
-    if (config) {
-        check("Watcher stale threshold is valid", config.watcherStaleSeconds >= 5 && config.watcherStaleSeconds <= 3600, `${config.watcherStaleSeconds}s`);
-    }
-    // allowedTestCommands has npm test
-    if (config) {
-        const hasNpmTest = config.allowedTestCommands.some((c) => c === "npm test" || c === "npm run test");
-        warnCheck("allowedTestCommands includes npm test", hasNpmTest, hasNpmTest ? "present" : "npm test is missing — add it to allowedTestCommands");
-    }
-    if (config) {
-        check("Task timeout defaults are valid", config.defaultTaskTimeoutSeconds > 0 && config.defaultTaskTimeoutSeconds <= config.maxTaskTimeoutSeconds, `default ${config.defaultTaskTimeoutSeconds}s, max ${config.maxTaskTimeoutSeconds}s`);
-    }
-    // 13. Agent command check
-    if (config) {
-        const agents = config.agents || {};
+        return results;
+    },
+};
+const checkWatcherStaleThreshold = {
+    id: "watcher-stale-threshold",
+    description: "Watcher stale threshold is valid",
+    run(context) {
+        if (!context.config)
+            return [];
+        return [
+            checkResult("Watcher stale threshold is valid", context.config.watcherStaleSeconds >= 5 && context.config.watcherStaleSeconds <= 3600, `${context.config.watcherStaleSeconds}s`),
+        ];
+    },
+};
+const checkAllowedTestCommandsIncludesNpmTest = {
+    id: "allowed-test-commands-npm-test",
+    description: "allowedTestCommands includes npm test",
+    run(context) {
+        if (!context.config)
+            return [];
+        const hasNpmTest = context.config.allowedTestCommands.some((c) => c === "npm test" || c === "npm run test");
+        return [warnCheckResult("allowedTestCommands includes npm test", hasNpmTest, hasNpmTest ? "present" : "npm test is missing — add it to allowedTestCommands")];
+    },
+};
+const checkTaskTimeoutDefaults = {
+    id: "task-timeout-defaults",
+    description: "Task timeout defaults are valid",
+    run(context) {
+        if (!context.config)
+            return [];
+        return [
+            checkResult("Task timeout defaults are valid", context.config.defaultTaskTimeoutSeconds > 0 && context.config.defaultTaskTimeoutSeconds <= context.config.maxTaskTimeoutSeconds, `default ${context.config.defaultTaskTimeoutSeconds}s, max ${context.config.maxTaskTimeoutSeconds}s`),
+        ];
+    },
+};
+const checkAgentCommands = {
+    id: "agent-commands",
+    description: "Agent command check",
+    run(context) {
+        if (!context.config)
+            return [];
+        const results = [];
+        const agents = context.config.agents || {};
         for (const [name, agentCfg] of Object.entries(agents)) {
             const cmdName = agentCfg.command;
             const looksLikePath = isAbsolute(cmdName) || cmdName.includes("/") || cmdName.includes("\\");
             if (looksLikePath) {
                 const agentExists = existsSync(cmdName);
-                warnCheck(`Agent "${name}" command available`, agentExists, agentExists ? `Found: ${cmdName}` : `"${cmdName}" does not exist — agent tasks will fail`);
+                results.push(warnCheckResult(`Agent "${name}" command available`, agentExists, agentExists ? `Found: ${cmdName}` : `"${cmdName}" does not exist — agent tasks will fail`));
                 continue;
             }
             // Platform-appropriate lookup: 'where' on Windows, 'command -v' on Unix
@@ -401,69 +528,171 @@ async function main() {
             const lookupCmd = isWin ? `where ${cmdName}` : `command -v ${cmdName}`;
             const fallbackCmd = isWin ? `command -v ${cmdName}` : `which ${cmdName}`;
             const found = cmd(lookupCmd) || cmd(fallbackCmd);
-            warnCheck(`Agent "${name}" command available`, found !== "", found ? `Found: ${found.split("\n")[0]}` : `"${cmdName}" not in PATH — agent tasks will fail`);
+            results.push(warnCheckResult(`Agent "${name}" command available`, found !== "", found ? `Found: ${found.split("\n")[0]}` : `"${cmdName}" not in PATH — agent tasks will fail`));
         }
-    }
-    // 14. allowedTestCommands safety check
-    if (config) {
-        const testCmds = config.allowedTestCommands || [];
-        check("allowedTestCommands is non-empty", testCmds.length > 0, testCmds.length > 0 ? `${testCmds.length} commands` : "No test commands configured");
+        return results;
+    },
+};
+const checkAllowedTestCommandsSafety = {
+    id: "allowed-test-commands-safety",
+    description: "allowedTestCommands safety check",
+    run(context) {
+        if (!context.config)
+            return [];
+        const results = [];
+        const testCmds = context.config.allowedTestCommands || [];
+        results.push(checkResult("allowedTestCommands is non-empty", testCmds.length > 0, testCmds.length > 0 ? `${testCmds.length} commands` : "No test commands configured"));
         const dangerous = ["rm -rf", "del /s", "format", "shutdown", "curl |", "wget |"];
         for (const cmdStr of testCmds) {
             for (const danger of dangerous) {
                 if (cmdStr.toLowerCase().includes(danger)) {
-                    results.push(`[WARN] allowedTestCommands contains dangerous pattern: "${cmdStr}"`);
-                    warn++;
+                    results.push(warnResult(`allowedTestCommands contains dangerous pattern: "${cmdStr}"`));
                 }
             }
         }
-    }
-    // 14b. Direct profile config checks
-    if (config) {
-        const directCmds = config.directAllowedCommands || [];
-        warnCheck("directAllowedCommands is non-empty", directCmds.length > 0, directCmds.length > 0 ? `${directCmds.length} commands` : "No Direct commands configured");
+        return results;
+    },
+};
+// Direct profile config checks
+const checkDirectProfileConfig = {
+    id: "direct-profile-config",
+    description: "Direct profile config checks",
+    run(context) {
+        if (!context.config)
+            return [];
+        const results = [];
+        const directCmds = context.config.directAllowedCommands || [];
+        results.push(warnCheckResult("directAllowedCommands is non-empty", directCmds.length > 0, directCmds.length > 0 ? `${directCmds.length} commands` : "No Direct commands configured"));
         // npm run doctor should NOT be in default Direct whitelist
         const hasDoctor = directCmds.some((c) => c === "npm run doctor");
-        check("directAllowedCommands does not include npm run doctor", !hasDoctor, hasDoctor ? "npm run doctor found in Direct whitelist — remove it for tighter security" : "not present");
-        check("directSessionTtlSeconds is valid", config.directSessionTtlSeconds >= 60 && config.directSessionTtlSeconds <= 86400, `${config.directSessionTtlSeconds}s`);
-        check("directMaxPatchBytes is positive", config.directMaxPatchBytes > 0, `${config.directMaxPatchBytes}`);
-        check("directMaxFileBytes is positive", config.directMaxFileBytes > 0, `${config.directMaxFileBytes}`);
-    }
-    // 15. Tunnel example files check
-    const tunnelFiles = [
-        "examples/openai-tunnel/README.md",
-        "examples/openai-tunnel/tunnel-client.example.yaml",
-        "examples/openai-tunnel/chatgpt-test-prompt.md",
-        "scripts/mcp/patchwarden-mcp-direct.cmd",
-        "PatchWarden.cmd",
-        "scripts/control/manage-patchwarden.ps1",
-        "scripts/launchers/Start-PatchWarden-Direct-Tunnel.cmd",
-    ];
-    for (const tf of tunnelFiles) {
-        const full = resolve(process.cwd(), tf);
-        const exists = existsSync(full);
-        check(`Tunnel example: ${tf}`, exists, exists ? "present" : "missing");
-        // Check for leaked secrets in example files
-        if (exists) {
-            const content = readFileSync(full, "utf-8");
-            // Only flag actual key-value assignments, not comments/mentions
-            const leaked = /(?:api_key|sk-[a-zA-Z0-9]{10,}|token\s*[:=]\s*\S{4,}|secret\s*[:=]\s*\S{4,}|password\s*[:=]\s*\S{4,})/gi.test(
-            // Strip comment lines first
-            content.split("\n").filter(l => !l.trim().startsWith("#") && !l.trim().startsWith("//")).join("\n"));
-            if (leaked) {
-                results.push(`[WARN] ${tf} may contain secrets`);
-                warn++;
-            }
-            else {
-                results.push(`[OK]   ${tf} — no real secrets`);
-                ok++;
+        results.push(checkResult("directAllowedCommands does not include npm run doctor", !hasDoctor, hasDoctor ? "npm run doctor found in Direct whitelist — remove it for tighter security" : "not present"));
+        results.push(checkResult("directSessionTtlSeconds is valid", context.config.directSessionTtlSeconds >= 60 && context.config.directSessionTtlSeconds <= 86400, `${context.config.directSessionTtlSeconds}s`));
+        results.push(checkResult("directMaxPatchBytes is positive", context.config.directMaxPatchBytes > 0, `${context.config.directMaxPatchBytes}`));
+        results.push(checkResult("directMaxFileBytes is positive", context.config.directMaxFileBytes > 0, `${context.config.directMaxFileBytes}`));
+        return results;
+    },
+};
+// Tunnel example files check
+const checkTunnelExamples = {
+    id: "tunnel-examples",
+    description: "Tunnel example files check",
+    run() {
+        const tunnelFiles = [
+            "examples/openai-tunnel/README.md",
+            "examples/openai-tunnel/tunnel-client.example.yaml",
+            "examples/openai-tunnel/chatgpt-test-prompt.md",
+            "scripts/mcp/patchwarden-mcp-direct.cmd",
+            "PatchWarden.cmd",
+            "scripts/control/manage-patchwarden.ps1",
+            "scripts/launchers/Start-PatchWarden-Direct-Tunnel.cmd",
+        ];
+        const results = [];
+        for (const tf of tunnelFiles) {
+            const full = resolve(process.cwd(), tf);
+            const exists = existsSync(full);
+            results.push(checkResult(`Tunnel example: ${tf}`, exists, exists ? "present" : "missing"));
+            // Check for leaked secrets in example files
+            if (exists) {
+                const content = readFileSync(full, "utf-8");
+                // Only flag actual key-value assignments, not comments/mentions
+                const leaked = /(?:api_key|sk-[a-zA-Z0-9]{10,}|token\s*[:=]\s*\S{4,}|secret\s*[:=]\s*\S{4,}|password\s*[:=]\s*\S{4,})/gi.test(
+                // Strip comment lines first
+                content.split("\n").filter(l => !l.trim().startsWith("#") && !l.trim().startsWith("//")).join("\n"));
+                if (leaked) {
+                    results.push(warnResult(`${tf} may contain secrets`));
+                }
+                else {
+                    results.push(okResult(`${tf} — no real secrets`));
+                }
             }
         }
+        return results;
+    },
+};
+// ── Check registry ─────────────────────────────────────────────────
+const checks = [
+    checkNodeVersion,
+    checkNpmAvailable,
+    checkConfirmPackage,
+    checkGitAvailable,
+    checkConfigFile,
+    checkPatchwardenConfigEnv,
+    checkConfigParseable,
+    checkWorkspaceRoot,
+    checkPathGuard,
+    checkSensitiveGuard,
+    checkSavePlanRules,
+    checkTaskArtifactAllowlist,
+    checkServerVersion,
+    checkToolProfiles,
+    checkReleaseGate,
+    checkHttpPort,
+    checkDistFiles,
+    checkToolModules,
+    checkDirectToolModules,
+    checkDirectSupportModules,
+    checkTaskDirectoryWritable,
+    checkWatcherStaleThreshold,
+    checkAllowedTestCommandsIncludesNpmTest,
+    checkTaskTimeoutDefaults,
+    checkAgentCommands,
+    checkAllowedTestCommandsSafety,
+    checkDirectProfileConfig,
+    checkTunnelExamples,
+];
+// ── Context preparation ────────────────────────────────────────────
+function prepareContext() {
+    const allowDefaultConfig = process.argv.includes("--allow-default-config");
+    const configPaths = [
+        resolve(process.cwd(), "patchwarden.config.json"),
+        process.env.PATCHWARDEN_CONFIG || "",
+    ].filter(Boolean);
+    let configPathUsed = "";
+    for (const p of configPaths) {
+        if (existsSync(p)) {
+            configPathUsed = p;
+            break;
+        }
+    }
+    // Load config (may fail)
+    let config = null;
+    let configError = null;
+    try {
+        config = getConfig();
+    }
+    catch (err) {
+        configError = err instanceof Error ? err.message : String(err);
+    }
+    return { config, configError, allowDefaultConfig, configPathUsed };
+}
+// ══════════════════════════════════════════════════════════════════
+// Main
+// ══════════════════════════════════════════════════════════════════
+async function main() {
+    console.log("PatchWarden Doctor\n");
+    const context = prepareContext();
+    const allResults = [];
+    for (const check of checks) {
+        try {
+            const results = await check.run(context);
+            allResults.push(...results);
+        }
+        catch (err) {
+            allResults.push(failResult(check.description, err instanceof Error ? err.message : String(err)));
+        }
+    }
+    console.log(allResults.map(formatResult).join("\n"));
+    let ok = 0;
+    let warn = 0;
+    let fail = 0;
+    for (const r of allResults) {
+        if (r.level === "OK")
+            ok++;
+        else if (r.level === "WARN")
+            warn++;
+        else
+            fail++;
     }
-    // ══════════════════════════════════════════════════════════════════
-    // Summary
-    // ══════════════════════════════════════════════════════════════════
-    console.log(results.join("\n"));
     console.log(`\n${"=".repeat(50)}`);
     console.log(`OK: ${ok}  WARN: ${warn}  FAIL: ${fail}`);
     console.log(`${"=".repeat(50)}`);
@@ -480,8 +709,10 @@ async function main() {
         console.log("\n✅ All checks passed.");
         process.exit(0);
     }
-} // end async main
+}
 main().catch((err) => {
-    console.error("Doctor crashed:", err);
+    logger.fatal("Doctor crashed", {
+        error: err instanceof Error ? err.message : String(err),
+    });
     process.exit(1);
 });