simt-dev 0.2.1 → 0.2.2

package/src/commands/init.mjs

@@ -20,7 +20,7 @@ import { promisify } from 'node:util';
 import { mkdir, readFile, symlink, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 
-import { EXIT, emit, fail, isJson, note } from '../output/index.mjs';
+import { EXIT, emit, emitJson, fail, isJson, note } from '../output/index.mjs';
 import { fingerprint } from '../resolve/fingerprint.mjs';
 import { rulePaths, scanDocument, summarise } from '../projection/conflicts.mjs';
 import { MANIFEST, buildManifest, manifestPath, readManifest, writeManifest, planGates } from '../projection/manifest.mjs';
@@ -219,7 +219,7 @@ export async function initCommand(positional, flags) {
     payload.ok = false;
     payload.blockedBy = 'surface-problem';
     for (const p of surfaceProblems) note(`PROBLEM  ${p}`);
-    if (isJson(flags)) emit(`${JSON.stringify(payload, null, 2)}\n`);
+    if (isJson(flags)) emitJson(payload);
     return fail(
       `${surfaceProblems.length} surface(s) cannot be resolved (${surfaceProblems[0]})`,
       EXIT.FAIL,
@@ -234,7 +234,7 @@ export async function initCommand(positional, flags) {
     payload.ok = false;
     payload.blockedBy = 'mdc-problem';
     for (const p of mdcProblems) note(`PROBLEM  ${p}`);
-    if (isJson(flags)) emit(`${JSON.stringify(payload, null, 2)}\n`);
+    if (isJson(flags)) emitJson(payload);
     return fail(
       `${mdcProblems.length} canonical .mdc rule(s) cannot be projected (${mdcProblems[0]})`,
       EXIT.FAIL,
@@ -249,7 +249,7 @@ export async function initCommand(positional, flags) {
     payload.ok = false;
     payload.blockedBy = 'conflict';
     if (isJson(flags)) {
-      emit(`${JSON.stringify(payload, null, 2)}\n`);
+      emitJson(payload);
     } else {
       emit(render(payload, manifest, { npm, version }));
       note('');
@@ -271,7 +271,7 @@ export async function initCommand(positional, flags) {
   if (malformed.length > 0) {
     payload.ok = false;
     payload.blockedBy = 'malformed-region';
-    if (isJson(flags)) emit(`${JSON.stringify(payload, null, 2)}\n`);
+    if (isJson(flags)) emitJson(payload);
     else emit(render(payload, manifest, { npm, version }));
     return fail(
       `${malformed.length} target(s) have a malformed generated region (${malformed[0].file}: ${malformed[0].reason})`,
@@ -282,7 +282,7 @@ export async function initCommand(positional, flags) {
 
   // Step 4/5: report everything, then make changes only when told to.
   if (isJson(flags)) {
-    if (!apply) emit(`${JSON.stringify(payload, null, 2)}\n`);
+    if (!apply) emitJson(payload);
   } else {
     emit(render(payload, manifest, { npm, version }));
   }
@@ -443,7 +443,7 @@ export async function initCommand(positional, flags) {
   }
   payload.written = true;
 
-  if (isJson(flags)) emit(`${JSON.stringify(payload, null, 2)}\n`);
+  if (isJson(flags)) emitJson(payload);
 
   note('');
   note(`next     ${CLI} sync --yes, then ${CLI} check in CI. Commit when you are happy with the diff.`);
@@ -608,8 +608,12 @@ function render(payload, manifest, { npm = true, version } = {}) {
     // on it would understate the edit the reader is approving. A baseline is the
     // opposite case to AGENTS.md in the one way that matters here — it is placed FIRST,
     // so the repo's own settings below it keep winning (ADR-025).
+    // A nested `apps/web/AGENTS.md` is the same kind of target as the root's, so the
+    // test is the suffix and not the exact path: a monorepo's package region holds
+    // hand-written content too, and describing it as a generated rule file would be
+    // the wrong contract for a reader who has prose above the markers.
     const caption =
-      target.file === PRIMARY_TARGET
+      target.file.endsWith(PRIMARY_TARGET)
         ? 'hand-written content outside the markers is never modified'
         : target.kind === 'baseline'
           ? 'a region placed first, so your own settings below it still win (ADR-025)'

package/src/commands/mcp.mjs

@@ -13,9 +13,9 @@ import { readFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 
-import { EXIT, emit, fail, isJson } from '../output/index.mjs';
+import { EXIT, emit, emitJson, fail, isJson } from '../output/index.mjs';
 import { TOOLS } from '../mcp/tools.mjs';
-import { PROTOCOL_VERSION, serve } from '../mcp/server.mjs';
+import { PROTOCOL_VERSION, SUPPORTED_VERSIONS, serve } from '../mcp/server.mjs';
 import { CLI } from '../name.mjs';
 
 export async function mcpCommand(positional, flags) {
@@ -23,12 +23,27 @@ export async function mcpCommand(positional, flags) {
 
   if (flags.list === true) {
     if (isJson(flags)) {
-      emit(`${JSON.stringify({ ok: true, protocolVersion: PROTOCOL_VERSION, version, tools: TOOLS.map(({ name, description, inputSchema }) => ({ name, description, inputSchema })) }, null, 2)}\n`);
+      emitJson({
+        ok: true,
+        protocolVersion: PROTOCOL_VERSION,
+        protocolVersions: SUPPORTED_VERSIONS,
+        version,
+        // The output schema and the read-only annotation travel with the tool here too:
+        // a reader listing the surface should see the same contract a call returns,
+        // rather than discovering the shape by making one.
+        tools: TOOLS.map(({ name, description, inputSchema, outputSchema, annotations }) => ({
+          name,
+          description,
+          inputSchema,
+          ...(outputSchema ? { outputSchema } : {}),
+          annotations,
+        })),
+      });
       return EXIT.OK;
     }
     emit(
       [
-        `simt-dev ${version} - MCP surface over stdio (protocol ${PROTOCOL_VERSION})`,
+        `simt-dev ${version} - MCP surface over stdio (protocols ${SUPPORTED_VERSIONS.join(', ')})`,
         '',
         `${TOOLS.length} read-only tools:`,
         ...TOOLS.map((t) => `  ${t.name.padEnd(16)} ${t.description.split('.')[0]}`),
@@ -44,7 +59,7 @@ export async function mcpCommand(positional, flags) {
   }
 
   try {
-    return await serve(TOOLS, { version });
+    return await serve(TOOLS, { packageVersion: version });
   } catch (error) {
     return fail(`mcp transport failed: ${error.message}`, EXIT.FAIL, `run: ${CLI} mcp --list to check the surface loads`);
   }

package/src/commands/rules.mjs

@@ -14,7 +14,7 @@
 // one, because "this rule has no decision behind it" is exactly the fact a
 // reviewer needs and exactly the fact an empty output would hide.
 
-import { EXIT, emit, fail, isJson } from '../output/index.mjs';
+import { EXIT, emit, emitJson, fail, isJson } from '../output/index.mjs';
 import { loadRules, select } from '../projection/project.mjs';
 import { loadMdcRules } from '../projection/mdc.mjs';
 import { fingerprint } from '../resolve/fingerprint.mjs';
@@ -92,30 +92,25 @@ export async function listCommand(args, flags) {
   const selection = root ? await selectionFor(rules, root) : null;
 
   if (isJson(flags)) {
-    emit(
-      `${JSON.stringify(
-        {
-          ok: broken.length === 0,
-          command: 'rules list',
-          root,
-          rules: sorted(rules).map((r) => ({
-            id: r.id,
-            title: r.title,
-            origin: r.origin,
-            source: r.source,
-            applies: r.applies,
-            fallback: r.fallback,
-            bytes: r.bytes,
-            error: r.error,
-            adrs: citations(r.body),
-            selected: selection ? selection.selected.has(r.id) : null,
-          })),
-          notes: selection?.notes ?? [],
-        },
-        null,
-        2,
-      )}\n`,
-      { maxBytes: flags.maxBytes ?? 0 },
+    emitJson(
+      {
+                ok: broken.length === 0,
+                command: 'rules list',
+                root,
+                rules: sorted(rules).map((r) => ({
+                  id: r.id,
+                  title: r.title,
+                  origin: r.origin,
+                  source: r.source,
+                  applies: r.applies,
+                  fallback: r.fallback,
+                  bytes: r.bytes,
+                  error: r.error,
+                  adrs: citations(r.body),
+                  selected: selection ? selection.selected.has(r.id) : null,
+                })),
+                notes: selection?.notes ?? [],
+              },
     );
     return broken.length === 0 ? EXIT.OK : EXIT.FAIL;
   }
@@ -188,7 +183,7 @@ export async function showCommand(args, flags) {
 
   const adrs = citations(rule.body);
   if (isJson(flags)) {
-    emit(`${JSON.stringify({ ok: !rule.error, ...rule, adrs }, null, 2)}\n`, { maxBytes: flags.maxBytes ?? 0 });
+    emitJson({ ok: !rule.error, ...rule, adrs }, { maxBytes: flags.maxBytes ?? 0 });
     return rule.error ? EXIT.FAIL : EXIT.OK;
   }
 
@@ -238,21 +233,16 @@ async function ruleDirection(id, rules, decisions, flags, broken) {
   const index = byId(decisions);
 
   if (isJson(flags)) {
-    emit(
-      `${JSON.stringify(
-        {
-          ok: true,
-          command: 'rules why',
-          rule: rule.id,
-          source: rule.source,
-          origin: rule.origin,
-          adrs: cited.map((c) => index.get(c) ?? { id: c, missing: true }),
-          uncited: cited.length === 0,
-        },
-        null,
-        2,
-      )}\n`,
-      { maxBytes: flags.maxBytes ?? 0 },
+    emitJson(
+      {
+                ok: true,
+                command: 'rules why',
+                rule: rule.id,
+                source: rule.source,
+                origin: rule.origin,
+                adrs: cited.map((c) => index.get(c) ?? { id: c, missing: true }),
+                uncited: cited.length === 0,
+              },
     );
     return EXIT.OK;
   }
@@ -313,22 +303,17 @@ async function adrDirection(adr, rules, decisions, flags) {
     // effective ruling is carried alongside rather than instead: the record asked about
     // is still named, and what is in force is named separately.
     const replacement = d.supersededBy ? decisions.find((x) => x.id === d.supersededBy) : null;
-    emit(
-      `${JSON.stringify(
-        {
-          ok: true,
-          command: 'rules why',
-          adr: d,
-          supersededBy: replacement ? { id: replacement.id, title: replacement.title } : null,
-          inForce: replacement
-            ? { id: replacement.id, status: replacement.status, summary: replacement.summary }
-            : { id: d.id, status: d.status, summary: d.summary },
-          rules: restates.map((r) => r.id),
-        },
-        null,
-        2,
-      )}\n`,
-      { maxBytes: flags.maxBytes ?? 0 },
+    emitJson(
+      {
+                ok: true,
+                command: 'rules why',
+                adr: d,
+                supersededBy: replacement ? { id: replacement.id, title: replacement.title } : null,
+                inForce: replacement
+                  ? { id: replacement.id, status: replacement.status, summary: replacement.summary }
+                  : { id: d.id, status: d.status, summary: d.summary },
+                rules: restates.map((r) => r.id),
+              },
     );
     return EXIT.OK;
   }

package/src/commands/skills.mjs

@@ -97,24 +97,19 @@ export async function indexCommand(args, flags) {
   const workspace = await workspaceLine(flags);
 
   if (isJson(flags)) {
-    emit(
-      `${JSON.stringify(
-        {
-          ok: true,
-          workspace,
-          skills: registry.skills.map((s) => ({
-            name: s.name,
-            summary: s.summary,
-            capabilities: s.capabilities,
-            stack: s.stack,
-            bytes: s.bytes,
-            deferred: Boolean(s.deferred),
-          })),
-        },
-        null,
-        2,
-      )}\n`,
-      { maxBytes: flags.maxBytes ?? 0 },
+    emitJson(
+      {
+                ok: true,
+                workspace,
+                skills: registry.skills.map((s) => ({
+                  name: s.name,
+                  summary: s.summary,
+                  capabilities: s.capabilities,
+                  stack: s.stack,
+                  bytes: s.bytes,
+                  deferred: Boolean(s.deferred),
+                })),
+              },
     );
     return EXIT.OK;
   }
@@ -168,20 +163,15 @@ async function emitAll(registry, repoStack, flags, warning) {
   const inline = usable.filter((s) => !s.deferred);
 
   if (isJson(flags)) {
-    emit(
-      `${JSON.stringify(
-        {
-          ok: true,
-          all: true,
-          repoStack,
-          inline: inline.map((s) => s.name),
-          deferred: deferred.map((s) => s.name),
-          ...(warning ? { warning } : {}),
-        },
-        null,
-        2,
-      )}\n`,
-      { maxBytes: flags.maxBytes ?? 0 },
+    emitJson(
+      {
+                ok: true,
+                all: true,
+                repoStack,
+                inline: inline.map((s) => s.name),
+                deferred: deferred.map((s) => s.name),
+                ...(warning ? { warning } : {}),
+              },
     );
     return EXIT.OK;
   }
@@ -217,7 +207,10 @@ export async function findCommand(args, flags) {
     .sort((a, b) => b.score - a.score || a.skill.name.localeCompare(b.skill.name));
 
   if (isJson(flags)) {
-    emit(`${JSON.stringify({ ok: true, query, workspace, results: results.map((r) => ({ name: r.skill.name, score: r.score, reasons: r.reasons })) }, null, 2)}\n`, { maxBytes: flags.maxBytes ?? 0 });
+    emitJson(
+      { ok: true, query, workspace, results: results.map((r) => ({ name: r.skill.name, score: r.score, reasons: r.reasons })) },
+      { maxBytes: flags.maxBytes ?? 0 },
+    );
     return EXIT.OK;
   }
 
@@ -275,24 +268,19 @@ export async function briefCommand(args, flags) {
       // is what `warning` carries. Failing here would tell a caller the tool
       // broke when in fact it is telling them their query was.
       if (flags.all) return emitAll(registry, repoStack, flags, warning);
-      emit(
-        `${JSON.stringify(
-          {
-            ok: true,
-            repo: { root, stack: repoStack },
-            workspace,
-            task: null,
-            budget,
-            resolved: [],
-            deferred: [],
-            excluded: [],
-            warning,
-          },
-          null,
-          2,
-        )}\n`,
-        { maxBytes: flags.maxBytes ?? 0 },
-      );
+      emitJson(
+        {
+                    ok: true,
+                    repo: { root, stack: repoStack },
+                    workspace,
+                    task: null,
+                    budget,
+                    resolved: [],
+                    deferred: [],
+                    excluded: [],
+                    warning,
+                  },
+    );
       return EXIT.OK;
     }
     emit(
@@ -333,22 +321,17 @@ export async function briefCommand(args, flags) {
   const lines = [];
 
   if (isJson(flags)) {
-    emit(
-      `${JSON.stringify(
-        {
-          ok: true,
-          repo: { root, stack: repoStack },
-          workspace,
-          task: flags.task ?? null,
-          budget,
-          resolved: picked.map((e) => ({ name: e.skill.name, bytes: e.skill.bytes, why: [...e.reasons, ...[...e.via].map((v) => `requires:${v}`)] })),
-          deferred: deferred.map((e) => ({ name: e.skill.name, bytes: e.skill.bytes })),
-          excluded: excluded.filter((e) => !closureNames.has(e.skill.name)).map((e) => ({ name: e.skill.name, reason: e.reason })),
-        },
-        null,
-        2,
-      )}\n`,
-      { maxBytes: flags.maxBytes ?? 0 },
+    emitJson(
+      {
+                ok: true,
+                repo: { root, stack: repoStack },
+                workspace,
+                task: flags.task ?? null,
+                budget,
+                resolved: picked.map((e) => ({ name: e.skill.name, bytes: e.skill.bytes, why: [...e.reasons, ...[...e.via].map((v) => `requires:${v}`)] })),
+                deferred: deferred.map((e) => ({ name: e.skill.name, bytes: e.skill.bytes })),
+                excluded: excluded.filter((e) => !closureNames.has(e.skill.name)).map((e) => ({ name: e.skill.name, reason: e.reason })),
+              },
     );
     return EXIT.OK;
   }
@@ -470,10 +453,7 @@ export async function showCommand(args, flags) {
   const body = await sourcePath(skill, workspaceRoot, root);
   const bodyFrom = body === null ? 'none' : body.startsWith(`${root}/`) ? 'repo' : 'workspace';
   if (isJson(flags)) {
-    emit(
-      `${JSON.stringify({ ok: true, ...skill, workspace, body, bodyFrom }, null, 2)}\n`,
-      { maxBytes: flags.maxBytes ?? 0 },
-    );
+    emitJson({ ok: true, ...skill, workspace, body, bodyFrom }, { maxBytes: flags.maxBytes ?? 0 });
     return EXIT.OK;
   }
   emit(
@@ -640,27 +620,22 @@ export async function evalCommand(positional, flags) {
   const okRun = unknown.length === 0 && score.clean;
 
   if (isJson(flags)) {
-    emit(
-      `${JSON.stringify(
-        {
-          ok: okRun,
-          command: 'skills eval',
-          corpus: corpusPath,
-          registry: path,
-          cases: score.cases.map((c) => ({
-            name: c.name,
-            selected: c.selected,
-            missing: c.missing,
-            unexpected: c.unexpected,
-          })),
-          unknownSkills: unknown,
-          precision: score.precision,
-          recall: score.recall,
-        },
-        null,
-        2,
-      )}\n`,
-      { maxBytes: flags.maxBytes ?? 0 },
+    emitJson(
+      {
+                ok: okRun,
+                command: 'skills eval',
+                corpus: corpusPath,
+                registry: path,
+                cases: score.cases.map((c) => ({
+                  name: c.name,
+                  selected: c.selected,
+                  missing: c.missing,
+                  unexpected: c.unexpected,
+                })),
+                unknownSkills: unknown,
+                precision: score.precision,
+                recall: score.recall,
+              },
     );
     return okRun ? EXIT.OK : EXIT.FAIL;
   }

package/src/commands/skillsinstall.mjs

@@ -24,7 +24,7 @@ import { cp, mkdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
-import { EXIT, emit, fail, isJson, note, writeMode } from '../output/index.mjs';
+import { EXIT, emit, emitJson, fail, isJson, note, writeMode } from '../output/index.mjs';
 import { loadRegistry, measureSkill } from '../graph/load.mjs';
 import { fingerprint } from '../resolve/fingerprint.mjs';
 import { readCapability } from '../hooks/capability.mjs';
@@ -35,6 +35,7 @@ import { nearMatches } from '../resolve/near.mjs';
 import { resolveWorkspace, WORKSPACE_REMEDY } from '../workspace.mjs';
 import { CLI } from '../name.mjs';
 import { MANIFEST_FILE } from '../name.mjs';
+import { nameProblems } from '../graph/spec.mjs';
 
 /**
  * Where skills live in this repo. The estate already has a convention - a
@@ -112,6 +113,20 @@ export async function installCommand(args, flags) {
   }
 
   const dir = skillsDir(root, await dirEntries(root));
+  // The Agent Skills specification requires `name` to equal the directory it lives in,
+  // and the directory is named after the skill. So a name that breaks the naming rules
+  // cannot be installed at all: the client resolves by name, finds a directory the name
+  // does not match, and never reads the body this command just copied. Refused here,
+  // before anything is written, with the rule broken - because the alternative is a
+  // successful install that no client can load.
+  const broken = nameProblems(name);
+  if (broken !== null) {
+    return fail(
+      `${name}: ${broken}`,
+      EXIT.REGISTRY,
+      `rename it in ${skill.source ?? 'the registry'} to lowercase letters, digits and single hyphens, then install again`,
+    );
+  }
   const dest = join(root, dir, name);
   const inplace = await samePath(src, dest);
   const action = inplace ? 'in-place' : await compare(dest, src, measured.flat, name);
@@ -147,7 +162,7 @@ export async function installCommand(args, flags) {
   // combination a script writes. The payload is now emitted once, at the end,
   // after the write it describes.
   const report = () => {
-    if (isJson(flags)) emit(`${JSON.stringify(payload, null, 2)}\n`, { maxBytes: flags.maxBytes ?? 0 });
+    if (isJson(flags)) emitJson(payload);
   };
   const mode = writeMode(flags);
 

package/src/commands/sync.mjs

@@ -16,8 +16,8 @@
 //     three `.mdc` rules would let a reader believe a repo is fully current when
 //     only the file they happened to open is.
 
-import { mkdir, readFile, symlink, unlink, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
+import { mkdir, readFile, stat, symlink, unlink, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve, sep } from 'node:path';
 import { EXIT, emit, emitJson, fail, isJson, note, writeMode } from '../output/index.mjs';
 import { plan, checkTargets, checkTarget, provenanceDigest, loadRules, select, pointerTargets, pointerState } from '../projection/project.mjs';
 import { fingerprint } from '../resolve/fingerprint.mjs';
@@ -27,6 +27,7 @@ import { surfacesLine } from '../projection/surfaces.mjs';
 import { CLI } from '../name.mjs';
 import { MANIFEST_FILE, MANIFEST_LEGACY } from '../name.mjs';
 import { assertVersionPin, packageVersion } from '../package-version.mjs';
+import { resolvePacks } from '../packs.mjs';
 
 /** Findings `sync` reports and does not fail on.
  *
@@ -48,7 +49,7 @@ import { assertVersionPin, packageVersion } from '../package-version.mjs';
  *  people learn to ignore. A *foreign* one — a real file or a real directory where the
  *  pointer belongs — is reported loudly with what is in the way, because that one is a
  *  decision somebody has to make. */
-export const SYNC_NON_BLOCKING = new Set(['pointer-unread', 'orphaned']);
+export const SYNC_NON_BLOCKING = new Set(['pointer-unread', 'orphaned', 'pack-unpinned', 'budget']);
 
 /**
  * Findings `check` reports and does not fail on.
@@ -68,7 +69,20 @@ export const SYNC_NON_BLOCKING = new Set(['pointer-unread', 'orphaned']);
  *
  *  `orphaned` stays non-blocking in both. Nothing can satisfy it, in either command.
  */
-export const CHECK_NON_BLOCKING = new Set(['orphaned']);
+// `pack-unpinned` is here and `pack-digest-mismatch` is not, which is the whole
+// judgement. An unpinned pack still renders its rules correctly; what is missing
+// is the record of which bytes were declared, and failing a gate over a field the
+// tool does not require would fail every repository that vendored a pack and
+// pinned it later. A pack whose bytes do not match its pin renders a region
+// nobody can account for, so that one blocks.
+//
+// `budget` is here for the opposite reason, and it is a ruling rather than a patch
+// (ADR-072). An over-budget finding says the projection is bigger than this repository
+// said it would be, and the remedy is a decision about which rules to narrow — not a
+// missing file. Nothing is cut: the projection is still in full mode, so a gate that
+// failed here would be failing a repository for exceeding a ceiling it set itself,
+// with no way to fix it except lowering the number it wrote down.
+export const CHECK_NON_BLOCKING = new Set(['orphaned', 'pack-unpinned', 'budget']);
 
 export async function syncCommand(positional, flags) {
   const root = flags.root ?? positional[0] ?? process.cwd();
@@ -399,8 +413,43 @@ async function formatterIgnoresManifest(root) {
     .some((line) => line !== '' && !line.startsWith('#') && (line === MANIFEST_FILE || line === MANIFEST_LEGACY));
 }
 
-export async function checkCommand(positional, flags) {
-  const root = flags.root ?? positional[0] ?? process.cwd();
+/**
+ * `gates.cwd` entries that do not resolve to a directory inside the repository.
+ *
+ * Reported here, not only where the gate runs: the dispatcher fails closed on the same
+ * condition, so a reader finds out on their next commit — after writing a commit, which
+ * is the wrong order. The finding names the gate and the path, and says which of the two
+ * things is wrong, because "no such directory" and "outside the repository" are repaired
+ * by different edits.
+ *
+ * @returns {Promise<{file: string, status: string, gate: string, detail: string, remedy: string}[]>}
+ */
+async function gateCwdFindings(root, manifest) {
+  const cwds = manifest?.gates?.cwd;
+  if (!cwds || typeof cwds !== 'object' || Array.isArray(cwds)) return [];
+  const declared = [...(manifest?.gates?.preCommit ?? []), ...(manifest?.gates?.prePush ?? [])];
+  const findings = [];
+  for (const name of Object.keys(cwds).sort()) {
+    if (!declared.includes(name)) continue;
+    const dir = String(cwds[name]);
+    const resolved = resolve(root, dir);
+    const inside = resolved === root || resolved.startsWith(`${root}${sep}`);
+    const isDir = inside && ((await stat(resolved).catch(() => null))?.isDirectory() ?? false);
+    if (isDir) continue;
+    findings.push({
+      file: MANIFEST_FILE,
+      status: inside ? 'gate-cwd-missing' : 'gate-cwd-outside',
+      gate: name,
+      detail: inside
+        ? `gates.cwd["${name}"] is ${dir}, which is not a directory in this repository`
+        : `gates.cwd["${name}"] is ${dir}, which resolves outside the repository`,
+      remedy: `point gates.cwd["${name}"] at a directory in this repository, or remove it to run the gate at the root`,
+    });
+  }
+  return findings;
+}
+
+export async function checkCommand(positional, flags) {  const root = flags.root ?? positional[0] ?? process.cwd();
   const findings = await checkTargets(root, flags);
   const rules = await loadRules(root);
 
@@ -431,6 +480,13 @@ export async function checkCommand(positional, flags) {
       findings.push({ file: MANIFEST_FILE, status: 'version-mismatch', detail: mismatch, remedy: `run: ${CLI} upgrade --yes` });
     }
     findings.push(...unrunnableGates(manifest, await readCapability(root)));
+    findings.push(...(await gateCwdFindings(root, manifest)));
+    // A pack the repository declares but cannot produce is reported here rather
+    // than when a rule happens to be missing, because that is the failure mode
+    // this guards: the region still renders, it renders SHORT, and `check` would
+    // pass. A reader whose rules were quietly halved is worse off than one whose
+    // gate is red, so this is a blocking finding, not a note.
+    findings.push(...(await resolvePacks(root)).findings);
     // A manifest a formatter has rewritten is not wrong, and not editable-away by
     // hand either: the next `init` puts simt-dev's own bytes back and the formatter
     // takes them away again. Reporting it here is what stops that being a surprise