pi-checkup 0.1.1 → 0.1.2

package/README.md

@@ -166,7 +166,7 @@ The `attribution` row is the part no other tool gives you: which package owns wh
 | **Packages** | Package list | Whether `settings.json` could be read at all — a hand-edited file that does not parse is reported as unreadable, not as "no packages" |
 | | Missing directories | In `settings.json` but gone from `node_modules`. A version pin (`npm:name@1.2.3`) is resolved to the directory it installs into, not taken as part of the name |
 | | Version pins | `settings.json` pins an exact version and a different one is installed — the code that runs is not the code that was asked for. Ranges and tags are not compared, because the installer is free to satisfy them |
-| | Corrupt manifests | A `package.json` that parses as nothing — reported as a failure, because the package cannot load |
+| | Corrupt manifests | A `package.json` that does not parse, or that parses to something other than an object (`null`, `"nope"`, `[]`) — reported as a failure, because the package cannot load. An empty object still counts as readable |
 | | Missing manifests | The package directory exists but holds no `package.json` — an interrupted install, or a leftover folder. Its own row, because telling someone to check ownership of a directory that has no manifest sends them to fix the wrong thing |
 | | Unreadable manifests | A `package.json` this process could not read (permissions, or larger than the 4 MB limit). Reported as a warning: unproven, not broken |
 | | Missing entry files | The manifest points at a build output that was never shipped |
@@ -199,7 +199,7 @@ The groups above are the ones that appear in a report, in that order. Independen
 
 Only reversible repairs are automated, and inside a session it normally offers only the first:
 
-1. **Restore a config file** that is no longer valid JSON, from its newest sibling backup. The broken copy is kept.
+1. **Restore a config file** that is no longer valid JSON, from its newest sibling backup that still parses — a corrupt newest backup does not block the valid one beside it, and the message says how many newer ones were skipped. The broken copy is kept.
 
 2. **Collapse duplicate `packages` entries** in `settings.json`. Only byte-identical repeats are dropped: `"npm:a"` next to `{"source": "npm:a", "enabled": false}` carries different intent and is left alone.
 3. **Prune `packages` entries whose directory is gone** — the ones a reinstall did not bring back. Sources resolved by Pi itself (`git:`, `https:`) are never touched, and a prune that would leave the list empty is refused and never even offered: that pattern means the agent directory is wrong, not that every package vanished.
@@ -210,7 +210,7 @@ Repairs 2 and 3 rewrite `settings.json`, so they need a settings file checkup ac
 npx pi-checkup --fix --yes
 ```
 
-Every write is preceded by a timestamped backup, and neither path writes on its own: `/checkup fix` asks in the TUI, and the CLI refuses to write unless you pass `--yes`. Anything that would delete a package, disable an extension, or edit your shell environment is reported with a suggestion and left alone — a diagnostic tool should not be able to break your setup in the process of describing it.
+Every write is preceded by a timestamped backup — one per file per run, taken before the first write, so `restore` hands back the file as it was before checkup ran rather than a half-repaired intermediate — and neither path writes on its own: `/checkup fix` asks in the TUI, and the CLI refuses to write unless you pass `--yes`. Anything that would delete a package, disable an extension, or edit your shell environment is reported with a suggestion and left alone — a diagnostic tool should not be able to break your setup in the process of describing it.
 
 A repair that rewrites `settings.json` re-serialises it with two-space indentation, so expect a larger diff than the change itself. Nothing is repaired unless a check found something wrong, so a healthy install writes nothing at all.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-checkup",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Health checks for your Pi setup: tool/command conflicts, broken packages, shadowed binaries, dead endpoints.",
   "type": "module",
   "license": "MIT",

package/src/checks/config.js

@@ -210,13 +210,16 @@ export async function run({
 		// so the check has to make the same distinction or its hint names a repair
 		// that then answers "nothing to dedupe".
 		const seen = new Map();
-		const duplicates = new Set();
+		// source -> how many byte-identical repeats beyond the first. A Set of
+		// sources counted distinct sources, so three copies of one entry reported
+		// "1 listed twice" when two entries were redundant.
+		const duplicates = new Map();
 		const mixedShapes = new Set();
 		for (const spec of settings.packages) {
 			const source = sourceOf(spec);
 			if (typeof source !== "string") continue;
 			if (seen.has(source)) {
-				if (JSON.stringify(seen.get(source)) === JSON.stringify(spec)) duplicates.add(source);
+				if (JSON.stringify(seen.get(source)) === JSON.stringify(spec)) duplicates.set(source, (duplicates.get(source) ?? 0) + 1);
 				else mixedShapes.add(source);
 			} else {
 				seen.set(source, spec);
@@ -230,8 +233,7 @@ export async function run({
 		// session's copy is authoritative, and "runtime-unreadable" means the file
 		// is a guess.
 		const canDedupe = settingsSource === "file" && Boolean(settingsFile);
-		const listed = [...duplicates, ...mixedShapes].map(redactSource);
-		if (!listed.length) {
+		if (!duplicates.size && !mixedShapes.size) {
 			// Zero entries compared is not a pass: "none" over an empty list is the
 			// same vacuous green tick the rest of this file avoids. Counted by
 			// comparable entries rather than by the list length, because
@@ -242,11 +244,12 @@ export async function run({
 					: row("duplicates", "duplicate packages", "skip", "no comparable package entries"),
 			);
 		} else {
-			const parts = [];
-			if (duplicates.size) parts.push(`${duplicates.size} listed twice`);
-			if (mixedShapes.size) parts.push(`${mixedShapes.size} listed in two different shapes`);
+			// The count is per source and says how many times the entry actually
+			// appears: "listed twice" for one redundant copy, "listed 3 times" for two.
+			const parts = [...duplicates].map(([source, extra]) => `${redactSource(source)}: listed ${extra === 1 ? "twice" : `${extra + 1} times`}`);
+			for (const source of mixedShapes) parts.push(`${redactSource(source)}: listed in two different shapes`);
 			results.push(
-				row("duplicates", "duplicate packages", "warn", `${listed.join(", ")}: ${parts.join(", ")}`, {
+				row("duplicates", "duplicate packages", "warn", parts.join(", "), {
 					hint:
 						mixedShapes.size && !duplicates.size
 							? "Dedupe leaves entries that differ alone, because they say different things. Keep the one you meant."

package/src/checks/packages.js

@@ -96,6 +96,7 @@ export async function run({ settings, settingsLoaded, agentDir: root, settingsFi
 	const unreadableDir = [];
 	const notDir = [];
 	const brokenManifest = [];
+	const nonObjectManifest = [];
 	const unreadableManifest = [];
 	// A directory with no package.json at all is not a permissions problem and the
 	// hint for one ("check ownership") sent the reader looking in the wrong place.
@@ -161,6 +162,15 @@ export async function run({ settings, settingsLoaded, agentDir: root, settingsFi
 			else unreadableManifest.push(`${redactSource(source)} (${manifest.error ?? "unreadable"})`);
 			continue;
 		}
+		// Valid JSON that is not an object — `null`, `"nope"`, `[]` — is not a
+		// manifest: nothing can read `.name`, `.version` or `.pi` off it, and the
+		// package cannot load. Counting it as "readable" put a green tick on a
+		// broken install, right next to an `entry files` row that skipped because
+		// the manifest declared nothing.
+		if (!manifest.data || typeof manifest.data !== "object" || Array.isArray(manifest.data)) {
+			nonObjectManifest.push(`${redactSource(source)} (${manifest.data === null ? "null" : Array.isArray(manifest.data) ? "an array" : typeof manifest.data})`);
+			continue;
+		}
 		manifestRead++;
 		// A pin and a different installed version is the gap between the code that
 		// was asked for and the code that runs. Only exact pins are comparable.
@@ -272,19 +282,16 @@ export async function run({ settings, settingsLoaded, agentDir: root, settingsFi
 			}),
 		);
 	}
-	if (brokenManifest.length) {
+	if (brokenManifest.length || nonObjectManifest.length) {
+		const parts = [];
+		if (brokenManifest.length) parts.push(`${brokenManifest.length} package.json not valid JSON: ${preview(brokenManifest, 3)}`);
+		if (nonObjectManifest.length) parts.push(`${nonObjectManifest.length} package.json not a JSON object: ${preview(nonObjectManifest, 3)}`);
 		results.push(
-			row(
-				"manifests",
-				"manifests",
-				"fail",
-				`${brokenManifest.length} package.json not valid JSON: ${preview(brokenManifest, 3)}`,
-				{
-					// A run that overlaps an install sees a manifest mid-rename. Saying so
-					// is the difference between "reinstall everything" and "wait 30 seconds".
-					hint: "Reinstall the affected packages. If an install or update is running right now, re-run once it finishes.",
-				},
-			),
+			row("manifests", "manifests", "fail", parts.join("; "), {
+				// A run that overlaps an install sees a manifest mid-rename. Saying so
+				// is the difference between "reinstall everything" and "wait 30 seconds".
+				hint: "Reinstall the affected packages. If an install or update is running right now, re-run once it finishes.",
+			}),
 		);
 	} else if (manifestRead) {
 		results.push(row("manifests", "manifests", "ok", `${manifestRead} readable`));

package/src/checks/registry.js

@@ -72,6 +72,12 @@ export async function run({ pi, hasRuntime, settings, agentDir: root }) {
 		commandsByOwner.get(owner).push(command.name);
 	}
 	const toolsNamed = [...toolsByOwner.values()].reduce((n, list) => n + list.length, 0);
+	// Counted from every entry, not from `toolsByOwner`: that map only holds the
+	// named ones, so a registry whose entries carry no `name` printed
+	// "2 registered ... across 0 sources" — two tools from no source at all. A
+	// partly-named registry understated the same number.
+	const toolsSources = new Set(tools.map((tool) => ownerOf(tool?.sourceInfo?.path)));
+	const commandsSources = new Set(commands.map((command) => ownerOf(command?.sourceInfo?.path)));
 
 	// `sourceInfo.path` is a third-party field: a number here threw out of run()
 	// and replaced the whole Registry group with one crash row.
@@ -86,7 +92,7 @@ export async function run({ pi, hasRuntime, settings, agentDir: root }) {
 					// started with tools disabled, and "0 registered across 0 sources"
 					// with a tick reads like everything is accounted for.
 					status: tools.length ? "ok" : "skip",
-					detail: `${tools.length} registered (${tools.length - builtinTools} extension, ${builtinTools} builtin) across ${toolsByOwner.size} sources`,
+					detail: `${tools.length} registered (${tools.length - builtinTools} extension, ${builtinTools} builtin) across ${toolsSources.size} sources`,
 				}
 			: {
 					group,
@@ -111,7 +117,7 @@ export async function run({ pi, hasRuntime, settings, agentDir: root }) {
 			// pass. "0 registered across 0 sources" with a tick claims an answer
 			// the check does not have.
 			status: commands.length ? "ok" : "skip",
-			detail: `${commands.length} registered across ${commandsByOwner.size} sources, ${serverCount}`,
+			detail: `${commands.length} registered across ${commandsSources.size} sources, ${serverCount}`,
 		});
 	} else {
 		results.push({
@@ -141,7 +147,7 @@ export async function run({ pi, hasRuntime, settings, agentDir: root }) {
 			id: "attribution",
 			title: "attribution",
 			status: "ok",
-			detail: `${toolsNamed} tool(s) from ${toolsByOwner.size} source(s): ${truncateList(ranked, 4)}`,
+			detail: `${toolsNamed} tool(s) from ${toolsByOwner.size} source(s): ${truncateList(ranked, 4)}${tools.length > toolsNamed ? ` (${tools.length - toolsNamed} entr${tools.length - toolsNamed === 1 ? "y carries" : "ies carry"} no name and cannot be attributed)` : ""}`,
 			hint: `Run with --verbose for the tool names. ${attribution}`,
 		});
 	}

package/src/checks/runtime.js

@@ -2,7 +2,7 @@
 import path from "node:path";
 import fs from "node:fs";
 import net from "node:net";
-import { bareHost, curlProbe, describeFsError, exists, humanBytes, isMissing, isWindows, proxyFromEnv, redactProxy, whichAll } from "../util.js";
+import { bareHost, curlProbe, describeFsError, humanBytes, isMissing, isWindows, proxyFromEnv, redactProxy, whichAll } from "../util.js";
 
 export const group = "Runtime";
 
@@ -127,7 +127,17 @@ export async function run({ offline = false, agentDir: root, env = process.env,
 	// --- pi binary ---------------------------------------------------------
 	const piBin = path.join(root, "bin", isWindows ? "pi.cmd" : "pi");
 	const piBinAlt = path.join(root, "bin", "pi");
-	const found = [piBin, piBinAlt].find(exists);
+	// `isFile`, not `exists`: a directory named `bin/pi` satisfied the existence
+	// check and its 0755 mode satisfied the executable check, so the row showed a
+	// green tick over something that cannot launch anything.
+	const isFile = (p) => {
+		try {
+			return fs.statSync(p).isFile();
+		} catch {
+			return false;
+		}
+	};
+	const found = [piBin, piBinAlt].find(isFile);
 	let executable = false;
 	if (found && !isWindows) {
 		try {
@@ -144,7 +154,7 @@ export async function run({ offline = false, agentDir: root, env = process.env,
 		// A pi installed by npm lives on PATH, not under the agent dir, so warning
 		// on the absence of ~/.pi/agent/bin/pi told those users their launcher was
 		// missing when `pi` was one PATH lookup away.
-		const onPath = whichAll("pi", env, { windows: isWindows }).find((c) => exists(c));
+		const onPath = whichAll("pi", env, { windows: isWindows }).find(isFile);
 		if (onPath) {
 			launcherStatus = "ok";
 			launcherDetail = `${onPath} (on PATH)`;
@@ -254,15 +264,24 @@ export { redactProxy };
 /** Does something accept connections at this proxy's own address? */
 async function checkProxy(proxy, env = process.env) {
 	const shown = redactProxy(proxy);
+	// `redactProxy` returns a parenthesised placeholder for a value that is nothing
+	// but a credential, so wrapping it again printed "configured ((configured))
+	// but not a parsable URL"; saying "value hidden" is clearer than repeating
+	// the word configured.
+	const shownInParens = shown.startsWith("(") ? "(value hidden)" : `(${shown})`;
 	const row = (status, detail, hint) => ({ group, id: "proxy", title: "proxy", status, detail, hint });
-	let parsed;
+	let parsed = null;
 	try {
 		parsed = new URL(proxy);
 	} catch {
-		return row("warn", `configured (${shown}) but not a parsable URL`, "Expected something like http://127.0.0.1:10808.");
+		// Not fatal here: `127.0.0.1:10808` and `proxy.corp:8080` are both shapes
+		// curl accepts, and only the second one parses as a URL (its "scheme" is a
+		// dotted name). Returning early on the throw judged the same env value two
+		// different ways depending on whether the host happened to start with a
+		// digit. The textual fallback below decides.
 	}
-	let hostname = parsed.hostname;
-	let port = Number(parsed.port) || DEFAULT_PROXY_PORT[parsed.protocol] || 0;
+	let hostname = parsed?.hostname ?? "";
+	let port = Number(parsed?.port) || DEFAULT_PROXY_PORT[parsed?.protocol] || 0;
 	if (!hostname || !port) {
 		// `proxy.corp:8080` with no scheme is a shape curl accepts and this check
 		// used to warn about — the same env value, judged two different ways.
@@ -281,7 +300,7 @@ async function checkProxy(proxy, env = process.env) {
 		}
 	}
 	if (!hostname || !port) {
-		return row("warn", `configured (${shown}) without a usable host and port`);
+		return row("warn", `configured ${shownInParens} but not a parsable URL`, "Expected something like http://127.0.0.1:10808.");
 	}
 
 	// Opt-in end-to-end test: an explicit probe URL means the user asked for
@@ -301,10 +320,10 @@ async function checkProxy(proxy, env = process.env) {
 		if (probe.setupFailed) {
 			// The request never left the machine, so accusing the proxy would be a
 			// finding this check did not establish.
-			return row("skip", `configured (${shown}); the probe could not be set up: ${probe.error}`);
+			return row("skip", `configured ${shownInParens}; the probe could not be set up: ${probe.error}`);
 		}
 		if (probe.missing) {
-			return row("skip", `configured (${shown}); curl is not installed so forwarding was not tested`);
+			return row("skip", `configured ${shownInParens}; curl is not installed so forwarding was not tested`);
 		}
 		const code = probe.code;
 		const numeric = Number(code);

package/src/context.js

@@ -64,10 +64,12 @@ export function buildContext({ pi, cwd, offline = false, agentDir: rootOverride,
 		settingsSource,
 		hasRuntime,
 		// Whether the agent directory came from an explicit `PI_CODING_AGENT_DIR`
-		// rather than the default location. A directory that is missing answers two
-		// different questions depending on that: on a machine that never ran Pi it is
-		// simply the first use, but a path the user typed and got wrong is a problem
-		// with this run — and the two must not both report as a warning.
+		// rather than the default location. A missing directory answers two different
+		// questions depending on that: on a machine that never ran Pi it is simply the
+		// first use, but a path the user typed and got wrong is a problem with this
+		// run. Both stay `warn` — a directory Pi has not created yet is not damage —
+		// but the row names the variable and tells the reader to check it, instead of
+		// sending them to create a default location this run never used.
 		agentDirExplicit: Boolean(agentDirExplicit),
 		// Checks read the environment through the context, not from process.env, so
 		// a test can describe a proxy or an unset variable without touching the

package/src/render.js

@@ -24,6 +24,41 @@ export function toJson(results, extra = {}) {
 	};
 }
 
+/**
+ * Columns a string occupies, not code units.
+ *
+ * A CJK path — `C:\Users\张三\.pi\agent` — is one code unit per character and
+ * two columns on every terminal, so measuring with `.length` wrapped one column
+ * short and let the line spill past the width the report promises to respect.
+ */
+function displayWidth(text) {
+	let width = 0;
+	for (const ch of String(text ?? "")) {
+		const cp = ch.codePointAt(0);
+		// Combining marks and zero-width joiners occupy no column of their own.
+		if (cp === 0x200b || cp === 0xfeff || (cp >= 0x0300 && cp <= 0x036f)) continue;
+		const wide =
+			(cp >= 0x1100 && cp <= 0x115f) ||
+			(cp >= 0x2e80 && cp <= 0x303e) ||
+			(cp >= 0x3041 && cp <= 0x33ff) ||
+			(cp >= 0x3400 && cp <= 0x4dbf) ||
+			(cp >= 0x4e00 && cp <= 0x9fff) ||
+			(cp >= 0xa000 && cp <= 0xa4cf) ||
+			(cp >= 0xa960 && cp <= 0xa97f) ||
+			(cp >= 0xac00 && cp <= 0xd7a3) ||
+			(cp >= 0xf900 && cp <= 0xfaff) ||
+			(cp >= 0xfe10 && cp <= 0xfe19) ||
+			(cp >= 0xfe30 && cp <= 0xfe6f) ||
+			(cp >= 0xff00 && cp <= 0xff60) ||
+			(cp >= 0xffe0 && cp <= 0xffe6) ||
+			(cp >= 0x1f300 && cp <= 0x1f64f) ||
+			(cp >= 0x1f900 && cp <= 0x1f9ff) ||
+			(cp >= 0x20000 && cp <= 0x3fffd);
+		width += wide ? 2 : 1;
+	}
+	return width;
+}
+
 /**
  * Greedy word wrap. `indent` is the column the text starts at, so every line has
  * the same available width and continuation lines line up under the text they
@@ -33,32 +68,59 @@ export function toJson(results, extra = {}) {
  * chunks rather than left to overflow: the terminal would wrap it anyway, and it
  * would do so with no indent, which breaks the column alignment that makes the
  * report scannable.
+ *
+ * Widths are display columns, not code units: see `displayWidth`.
  */
 function wrapText(text, width, indent) {
 	const body = String(text ?? "");
 	if (!body) return [""];
 	const avail = Math.max(8, width - indent);
-	if (body.length <= avail) return [body];
+	if (displayWidth(body) <= avail) return [body];
 
 	const lines = [];
 	let line = "";
+	let lineWidth = 0;
 	const flush = () => {
 		if (line) {
 			lines.push(line);
 			line = "";
+			lineWidth = 0;
 		}
 	};
 	for (const word of body.split(/\s+/).filter(Boolean)) {
-		if (word.length > avail) {
+		const wordWidth = displayWidth(word);
+		if (wordWidth > avail) {
 			flush();
-			for (let i = 0; i < word.length; i += avail) lines.push(word.slice(i, i + avail));
+			// Cut the long token into pieces that fit, measured in columns so a
+			// wide character cannot straddle the edge.
+			let piece = "";
+			let pieceWidth = 0;
+			for (const ch of word) {
+				const cw = displayWidth(ch);
+				if (pieceWidth + cw > avail) {
+					lines.push(piece);
+					piece = "";
+					pieceWidth = 0;
+				}
+				piece += ch;
+				pieceWidth += cw;
+			}
+			if (piece) {
+				line = piece;
+				lineWidth = pieceWidth;
+			}
 			continue;
 		}
-		if (!line) line = word;
-		else if (line.length + 1 + word.length <= avail) line += ` ${word}`;
-		else {
+		if (!line) {
+			line = word;
+			lineWidth = wordWidth;
+		} else if (lineWidth + 1 + wordWidth <= avail) {
+			line += ` ${word}`;
+			lineWidth += 1 + wordWidth;
+		} else {
 			flush();
 			line = word;
+			lineWidth = wordWidth;
 		}
 	}
 	flush();
@@ -92,7 +154,7 @@ export function renderReport(results, { verbose = false, hintCommand = "/checkup
 	// push a single row's detail out of alignment with every other row. A title
 	// longer than the cap gets its detail on its own line rather than shoving it
 	// past the column every wrapped continuation line uses.
-	const titleWidth = Math.min(22, Math.max(8, ...results.map((r) => r.title.length)));
+	const titleWidth = Math.min(22, Math.max(8, ...results.map((r) => displayWidth(r.title))));
 	// Below this width the title column plus one word of detail leaves a gutter
 	// too narrow to read ("package dirs 2 missing from" then two words a line), so
 	// the detail moves under the title instead of beside it.
@@ -105,7 +167,7 @@ export function renderReport(results, { verbose = false, hintCommand = "/checkup
 		for (const r of byGroup.get(g)) {
 			const mark = `  ${MARKS[r.status] ?? "?"} `;
 			const title = r.title.padEnd(titleWidth);
-			if (stacked || r.title.length > titleWidth) {
+			if (stacked || displayWidth(r.title) > titleWidth) {
 				// The title gets the same treatment as the detail: a name that does not
 				// fit would otherwise set the width for the whole report.
 				const titleParts = wrapText(r.title, width, mark.length);
@@ -130,12 +192,20 @@ export function renderReport(results, { verbose = false, hintCommand = "/checkup
 	const s = summarize(results);
 	lines.push("");
 	const warnWord = s.warn === 1 ? "warning" : "warnings";
-	lines.push(`${s.total} checks: ${s.ok} ok, ${s.warn} ${warnWord}, ${s.fail} failed${s.skip ? `, ${s.skip} skipped` : ""}`);
+	// Wrapped like every other line: the summary is the longest single sentence in
+	// a short report — "19 checks: 11 ok, 0 warnings, 0 failed, 8 skipped" is 51
+	// columns — and leaving it unwrapped broke the width the rest of the report
+	// respects on a narrow terminal or a split pane.
+	for (const part of wrapText(`${s.total} checks: ${s.ok} ok, ${s.warn} ${warnWord}, ${s.fail} failed${s.skip ? `, ${s.skip} skipped` : ""}`, width, 0)) {
+		lines.push(part);
+	}
 	// Any hint, on any row. Tying this to non-ok rows meant a report whose only
 	// finding carried no hint never mentioned --verbose at all, so the user had
 	// no way to learn the flag exists.
 	if (!verbose && results.some((r) => r.hint)) {
-		lines.push(`Run \`${hintCommand}\` to show what to do about each finding.`);
+		for (const part of wrapText(`Run \`${hintCommand}\` to show what to do about each finding.`, width, 0)) {
+			lines.push(part);
+		}
 	}
 	return lines.join("\n");
 }

package/src/repair.js

@@ -6,7 +6,7 @@
 // and none of them deletes a package or disables an extension.
 import fs from "node:fs";
 import path from "node:path";
-import { isMissing, newestBackup, readJson, redactSource, resolvePackageDir, scrubCredentials, sourceOf } from "./util.js";
+import { backupsNewestFirst, isMissing, readJson, redactSource, resolvePackageDir, scrubCredentials, sourceOf } from "./util.js";
 
 function stamp() {
 	// Milliseconds are kept: two repairs in the same second would otherwise
@@ -35,6 +35,26 @@ function copyBackup(target, label = "checkup-bak") {
 	throw new Error(`could not find a free backup name for ${path.basename(target)}`);
 }
 
+/**
+ * The backup for `target` in this run, made once and reused.
+ *
+ * Two repairs can hit the same file: a prune and a dedupe both rewrite
+ * `settings.json`, and each used to write its own backup a few milliseconds
+ * apart. That left the newest backup holding the *intermediate* state — after
+ * the prune, before the dedupe — and `restore` picks the newest backup, so
+ * undoing a broken config handed back a half-repaired file instead of the one
+ * the user had before checkup touched it. One backup per file per run keeps
+ * "the backup" meaning "before this run".
+ */
+function backupFor(target, backups) {
+	if (!backups) return copyBackup(target);
+	const existing = backups.get(target);
+	if (existing) return existing;
+	const made = copyBackup(target);
+	backups.set(target, made);
+	return made;
+}
+
 /** Flush a directory entry so a rename survives a power loss. Best effort. */
 function syncDir(dir) {
 	let fd;
@@ -157,12 +177,28 @@ export function applyRestoreConfig(target) {
 	// it would undo the fix.
 	const current = readJson(target);
 	if (current.ok) return { ok: false, message: `${path.basename(target)} is valid JSON again — nothing to restore` };
-	const backup = newestBackup(target);
-	if (!backup) return { ok: false, message: `no backup found for ${path.basename(target)}` };
-	const parsed = readJson(backup);
-	// `!ok` covers oversized and unreadable too, and telling the user a valid
-	// 5 MB backup "is not valid JSON" is the same false claim the checks avoid.
-	if (!parsed.ok) return { ok: false, message: `nothing to restore from: ${unreadable(backup, parsed).message}` };
+	const candidates = backupsNewestFirst(target);
+	if (!candidates.length) return { ok: false, message: `no backup found for ${path.basename(target)}` };
+	// Newest first, and the first one that parses wins. Taking only the newest
+	// meant a corrupt newest backup — a copy taken while the file was already
+	// damaged — blocked the valid one sitting next to it, which is the exact
+	// situation restore exists for.
+	let backup = null;
+	const rejected = [];
+	for (const candidate of candidates) {
+		const parsed = readJson(candidate);
+		if (parsed.ok) {
+			backup = candidate;
+			break;
+		}
+		// `!ok` covers oversized and unreadable too, and telling the user a valid
+		// 5 MB backup "is not valid JSON" is the same false claim the checks avoid.
+		rejected.push(unreadable(candidate, parsed).message);
+	}
+	if (!backup) {
+		return { ok: false, message: `nothing to restore from: ${rejected.join("; ")}` };
+	}
+	const skipped = candidates.indexOf(backup);
 	const aside = copyBackup(target, "broken");
 	// The backup is valid JSON (checked above), so restoring its bytes verbatim
 	// keeps any formatting the user had. If the write itself fails after the
@@ -183,7 +219,7 @@ export function applyRestoreConfig(target) {
 	return {
 		ok: true,
 		changed: true,
-		message: `restored ${path.basename(target)} from ${path.basename(backup)} (broken copy kept as ${path.basename(aside)})`,
+		message: `restored ${path.basename(target)} from ${path.basename(backup)}${skipped ? ` (skipped ${skipped} newer backup(s) that do not parse)` : ""} (broken copy kept as ${path.basename(aside)})`,
 	};
 }
 
@@ -196,7 +232,7 @@ export function applyRestoreConfig(target) {
  * the second one silently changed what Pi loads. The backup would have made it
  * recoverable, but a repair that needs its backup is not a repair.
  */
-export function applyDedupePackages(target) {
+export function applyDedupePackages(target, options = {}) {
 	const settings = readJson(target);
 	if (!settings.ok) return unreadable(target, settings);
 	if (!Array.isArray(settings.data?.packages)) return { ok: false, message: "no packages array to dedupe" };
@@ -213,7 +249,7 @@ export function applyDedupePackages(target) {
 	// between — a second read would prove nothing. Backing up before the plan was
 	// known left a stray `.checkup-bak-*` beside a healthy config on runs that
 	// repaired nothing.
-	const backup = copyBackup(target);
+	const backup = backupFor(target, options.backups);
 	settings.data.packages = plan.kept;
 	writeAtomic(target, `${JSON.stringify(settings.data, null, 2)}\n`);
 	return {
@@ -258,7 +294,7 @@ function dedupePlan(packages) {
  * `dirname(target)` would resolve every entry under the wrong root if this were
  * ever pointed at a project-level settings file.
  */
-export function applyPruneMissingPackages(target, root) {
+export function applyPruneMissingPackages(target, root, options = {}) {
 	// Not defaulted: a wrong root makes every entry look missing, and this repair
 	// deletes what it cannot resolve.
 	if (!root) throw new Error("applyPruneMissingPackages needs the agent directory to resolve packages against");
@@ -288,7 +324,7 @@ export function applyPruneMissingPackages(target, root) {
 
 	// Same reasoning as dedupe: the read above is post-prompt, and the rest of
 	// this function is synchronous.
-	const backup = copyBackup(target);
+	const backup = backupFor(target, options.backups);
 	settings.data.packages = plan.kept;
 	writeAtomic(target, `${JSON.stringify(settings.data, null, 2)}\n`);
 	return {
@@ -328,8 +364,8 @@ function prunePlan(packages, root) {
 /** Named repairs, keyed by the `fix` field a check emits. */
 const REPAIRS = {
 	"restore-config": (target) => applyRestoreConfig(target),
-	"dedupe-packages": (target) => applyDedupePackages(target),
-	"prune-missing-packages": applyPruneMissingPackages,
+	"dedupe-packages": (target, ctx) => applyDedupePackages(target, ctx),
+	"prune-missing-packages": (target, ctx) => applyPruneMissingPackages(target, ctx?.agentDir, ctx),
 };
 
 
@@ -344,6 +380,9 @@ const REPAIRS = {
 export async function applyRepairs(findings, { agentDir } = {}) {
 	const applied = [];
 	const seen = new Set();
+	// Shared across every repair in this run: one backup per file, taken before
+	// the first write to it, so `restore` undoes the run rather than its last step.
+	const ctx = { agentDir, backups: new Map() };
 	for (const finding of findings) {
 		const key = `${finding.fix}:${finding.fixTarget}`;
 		if (seen.has(key)) continue;
@@ -355,7 +394,7 @@ export async function applyRepairs(findings, { agentDir } = {}) {
 			continue;
 		}
 		try {
-			applied.push(repair(finding.fixTarget, agentDir));
+			applied.push(repair(finding.fixTarget, ctx));
 		} catch (e) {
 			// Scrubbed like every other error path: fs errors embed absolute paths and
 			// the prune guard's throw can quote a package source, which may carry a

package/src/util.js

@@ -285,16 +285,27 @@ export function normalizePath(p) {
  * two naming schemes do not sort chronologically against each other.
  */
 export function newestBackup(file) {
+	return backupsNewestFirst(file)[0] ?? null;
+}
+
+/**
+ * Every backup of `file`, newest first.
+ *
+ * `restore` used to take only the newest one and give up when it did not parse,
+ * which failed the one case recovery exists for: the newest backup was corrupt
+ * — a copy taken while the file was already damaged — and a valid older one sat
+ * right next to it. Callers walk this list and stop at the first that parses.
+ */
+export function backupsNewestFirst(file) {
 	const dir = path.dirname(file);
 	const base = path.basename(file);
 	let entries;
 	try {
 		entries = fs.readdirSync(dir);
 	} catch {
-		return null;
+		return [];
 	}
-	let best = null;
-	let bestTime = Number.NEGATIVE_INFINITY;
+	const found = [];
 	for (const entry of entries) {
 		if (entry === base || !entry.startsWith(base)) continue;
 		// Anchored: the marker has to start right after `settings.json`. Unanchored,
@@ -308,14 +319,12 @@ export function newestBackup(file) {
 		} catch {
 			continue; // dangling symlink or raced deletion
 		}
-		// A bulk copy can give several backups the same mtime; break the tie on
-		// the name so repeated runs always pick the same file.
-		if (mtimeMs > bestTime || (mtimeMs === bestTime && best !== null && full > best)) {
-			best = full;
-			bestTime = mtimeMs;
-		}
+		found.push({ file: full, mtimeMs });
 	}
-	return best;
+	// A bulk copy can give several backups the same mtime; break the tie on the
+	// name so repeated runs always see the same order.
+	found.sort((a, b) => b.mtimeMs - a.mtimeMs || (a.file < b.file ? 1 : a.file > b.file ? -1 : 0));
+	return found.map((entry) => entry.file);
 }
 
 /**
@@ -679,7 +688,11 @@ export function redactUrl(raw) {
 		// Printing `url.origin` would then print the string "null".
 		if (!url.hostname) return scrubCredentials(text);
 		const path = url.pathname === "/" ? "" : url.pathname;
-		return `${url.protocol}//${url.host}${path}`;
+		// Scrubbed, not returned raw: a gateway that takes its key in the path —
+		// `https://host/ghp_…/v1` — put the credential back into the report through
+		// the one function whose job is to keep it out. The host itself cannot
+		// match a token shape, so scrubbing the assembled string is safe.
+		return scrubCredentials(`${url.protocol}//${url.host}${path}`);
 	} catch {
 		return scrubCredentials(text);
 	}
@@ -803,6 +816,29 @@ export function scrubCredentials(text) {
 			// `npm:alice:pw@host` and the single slash in `https:/alice:pw@host`
 			// still start a match.
 			.replace(/(^|[\s"'=(,:/])(?!(?:npm|git|file|https?|ssh|link):)([^\s/@:'"]+):([^\s/@]*?)@/g, "$1***@")
+			// A bare token has no userinfo and no query string for the rules above to
+			// find. An error message that quoted one — "extension load failed for
+			// provider openai with apiKey sk-…" — reached the report, the TUI
+			// notification and --json verbatim, minus whatever the caller's own
+			// truncation happened to cut. These are the shapes that carry enough
+			// entropy to be a real credential and enough of a fixed prefix to be
+			// recognised without guessing.
+			.replace(/\b(?:sk|pk|rk)-[A-Za-z0-9_-]{16,}/g, "***")
+			.replace(/\bgh[pousr]_[A-Za-z0-9]{20,}/g, "***")
+			.replace(/\bgithub_pat_[A-Za-z0-9_]{20,}/g, "***")
+			.replace(/\bnpm_[A-Za-z0-9]{20,}/g, "***")
+			.replace(/\bxox[abprs]-[A-Za-z0-9-]{10,}/g, "***")
+			.replace(/\bAKIA[0-9A-Z]{16}\b/g, "***")
+			.replace(/\bAIza[0-9A-Za-z_-]{30,}/g, "***")
+			// A JWT is three base64url segments and is what an `Authorization`
+			// header usually holds.
+			.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, "***")
+			.replace(/\b(bearer)\s+[A-Za-z0-9._~+/=-]{8,}/gi, "$1 ***")
+			// The value after a credential-named key, whatever shape it has: a token
+			// with no recognisable prefix is still a token when the line says
+			// `apiKey: …`. The value stops at whitespace and at the punctuation that
+			// ends a sentence, so surrounding prose survives.
+			.replace(/\b(api[-_]?key|access[-_]?token|auth[-_]?token|token|secret|password|passwd)\s*([:=])\s*[^\s,;)"']+/gi, "$1$2***")
 			// A query string is dropped whole rather than masked: it is where a pasted
 			// `?key=sk-…` lives, and nothing in a report needs it.
 			.replace(/\?[^\s]*/g, "")