stim 1.20.2 → 1.21.0

package/dist/{doctor-kfMBnUw6.mjs → doctor-DTvaDOda.mjs}

@@ -1,34 +1,36 @@
-import { _ as loadConfig$1, s as configCorruptRepair, u as getConcurrencyLimits } from "./config-BYDxlMY3.mjs";
-import { t as getExecutor } from "./exec-DqKo9GKJ.mjs";
-import { r as gitQuiet, t as git } from "./git-DDfFzkMm.mjs";
-import { B as remoteAndroidSetting, Ct as locallyKnownUpstream, D as mergeSettingsLayers, Dt as repoRoot, Ft as makeTemporaryDirectory, G as resolveIosProjectDir, H as remoteIosSetting, I as projectSettingsContext, Lt as temporaryRoot, Pt as filesystemDevice, Q as settingShapeErrors, St as listWorktrees, T as iosSimSlimProfileSetting, U as resolveAndroidLayout, X as settingOrigin, a as SETTING_SHAPE_REMEDY, et as settingsLayers, ht as gitCommonDir, i as SETTINGS_WITH_RESOLVE_TIME_FALLBACK, kt as resolveSourceCheckout, m as defaultAndroidLayout, nt as unknownSettingKeys, pt as dirtyFingerprintFiles, q as resolveSettings, r as PATH_SETTINGS, rt as webSettings } from "./settings-B717odTD.mjs";
-import { C as diffFingerprintSources, D as fingerprintProject, h as listBuildLocks } from "./device-lease-BX1sJQ2E.mjs";
-import { b as workspaceDerivedData, m as sharedBuildCache } from "./workspace-state-DJt_MMvf.mjs";
-import { d as quotedPath, u as plural } from "./command-output-BTy8hZ0F.mjs";
-import { S as resolvePackageJson, _ as detectIsExpo, g as appProjectProblem, y as isPackageResolvable } from "./project-_phNIJfs.mjs";
-import { D as hostSystemImageArch, at as POOL_SETTING_REMEDY, dt as parkedMaxSetting, o as androidHome } from "./android-Mz_Inn3w.mjs";
-import { I as listBuildSlots } from "./workspaces-C36s2jb9.mjs";
-import { l as realIo } from "./tailnet-Dh-qiYzG.mjs";
-import { p as resolveOptimizations, u as compilerCacheFallbackMessage } from "./errors-DzkMYh8Q.mjs";
-import { f as resolveEasCliBin, i as checkEasAuth$1, l as ownerFromConfig, u as providerFromConfig } from "./remote-cache-OyOyVIS3.mjs";
-import { M as hostMemoryPressureAdvice, P as readHostMemoryPressure } from "./ios-RkW4pnQf.mjs";
-import { i as projectCmakeLauncher } from "./ccache-zdKiYQ3E.mjs";
-import { r as androidSdkRefusal } from "./gradle-DSrXb6lG.mjs";
-import { L as podInstallCommand } from "./toolchain-DxSsNssu.mjs";
-import { i as countLiveOwnedDevices } from "./device-capacity-CBUAcRyQ.mjs";
-import { d as androidPathRoomRemedy, i as ccacheEnabled, l as androidPathRoom, t as apkOutputsDir, u as androidPathRoomMessage } from "./react-native-build-CtCccJtb.mjs";
-import { r as resolveAndroidCompilerCache, t as readAndroidCasToolchain } from "./android-cas-Bl-cLJBk.mjs";
-import { g as easCliUpgradeRemedy, h as easCliSupport, m as MIN_EAS_CLI_SIMULATOR_VERSION, s as readInstalledEasCliVersion } from "./device-remote-xRT0Vmo9.mjs";
-import { t as MIN_EAS_CLI_BUILD_DOWNLOAD_VERSION } from "./eas-build-JyfqyHfC.mjs";
-import { n as simslimIsOnPath } from "./simslim-CCr3rE-A.mjs";
-import { n as hasInstalledDependencies, r as installedNpmTreeIsValid, t as dependencyState } from "./dependency-state-DG0p31-y.mjs";
-import { a as findChrome, t as CHROME_INSTALL_REMEDY } from "./chrome-BnzZMqsR.mjs";
+import { g as trackReportResource, m as reportSignal, t as getExecutor } from "./exec-_UbtCQcG.mjs";
+import { i as sharedBuildCache, u as workspaceDerivedData } from "./paths-DQtTgsBf.mjs";
+import { _ as loadConfig$1, rt as realIo, s as configCorruptRepair, u as getConcurrencyLimits } from "./config-CYcBF478.mjs";
+import { d as quotedPath, u as plural } from "./command-output-B1UrjZHL.mjs";
+import { r as readWorkspaceState$1 } from "./workspace-state-Cjuigeeu.mjs";
+import { D as mergeSettingsLayers, Ft as repoRoot, I as projectSettingsContext, It as repoRootAsync, Jt as filesystemDevice, K as resolveIosProjectDir, Q as settingOrigin, T as iosSimSlimProfileSetting, U as remoteIosSetting, V as remoteAndroidSetting, W as resolveAndroidLayout, Y as resolveSettings, Yt as makeTemporaryDirectory, Zt as temporaryRoot, a as SETTING_SHAPE_REMEDY, at as webSettings, et as settingShapeErrors, ht as dirtyFingerprintFiles, i as SETTINGS_WITH_RESOLVE_TIME_FALLBACK, it as unknownSettingKeys, jt as locallyKnownUpstreamAsync, kt as listWorktreesAsync, m as defaultAndroidLayout, nt as settingsLayers, r as PATH_SETTINGS, tt as settingValueAt, yt as gitCommonDirAsync, zt as resolveSourceCheckoutAsync } from "./settings-CsJDEXgK.mjs";
+import { i as gitQuietAsync, t as git } from "./git-C3iTsJaZ.mjs";
+import { C as resolvePackageJson, _ as appProjectProblem, b as isPackageResolvable, v as detectIsExpo } from "./project-BZNjmW_8.mjs";
+import { Bn as checkEasAuth$1, Gn as providerFromConfig, Ht as readInstalledEasCliVersionAsync, Wn as ownerFromConfig, er as MIN_EAS_CLI_SIMULATOR_VERSION, nr as easCliUpgradeRemedy, qn as resolveEasCliBin, tr as easCliSupport } from "./budget-Bs6SxxzO.mjs";
+import { I as listBuildSlots } from "./workspaces-BccMFmGQ.mjs";
+import { N as listBuildLocks } from "./activity-BzVfHSrY.mjs";
+import { a as diffFingerprintSources, l as fingerprintProject } from "./build-cache-DmyR9Zzc.mjs";
+import { O as hostSystemImageArch, ht as parkedMaxSetting, lt as POOL_SETTING_REMEDY, o as androidHome } from "./android-DUYkNF4u.mjs";
+import { F as readHostMemoryPressureAsync, M as hostMemoryPressureAdvice } from "./ios-CpByZy12.mjs";
+import { p as resolveOptimizations, u as compilerCacheFallbackMessage } from "./errors-ccaPc4ox.mjs";
+import { i as projectCmakeLauncher } from "./ccache-BJRZ9pG3.mjs";
+import { x as podInstallCommand } from "./xcode-Zlx3qjEs.mjs";
+import { h as androidPathRoomRemedy, i as ccacheEnabled, l as androidSdkRefusal, m as androidPathRoomMessage, p as androidPathRoom, t as apkOutputsDir } from "./react-native-build-rhk4smwQ.mjs";
+import { a as countLiveOwnedDevicesAsync, i as countLiveOwnedDevices } from "./device-capacity-CMlqEcvw.mjs";
+import { i as probeSigningIdentities } from "./ios-signing-DTTIChGs.mjs";
+import { a as findChrome, t as CHROME_INSTALL_REMEDY } from "./chrome-B6tfCta1.mjs";
+import { i as installedNpmTreeIsValidAsync, n as hasInstalledDependencies, t as dependencyState } from "./dependency-state-BbKQW83h.mjs";
+import { n as simslimIsOnPath } from "./simslim-Cgk17SXV.mjs";
+import { t as MIN_EAS_CLI_BUILD_DOWNLOAD_VERSION } from "./eas-build-BomfRnFT.mjs";
+import { r as resolveAndroidCompilerCache, t as readAndroidCasToolchain } from "./android-cas-Ct5b1xCK.mjs";
 import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, rmSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { LAST_BUILD_KEYS, isJsonObject, readBuildHistory, readJsonObject, readStats, settingDefinition } from "@stim-cli/core/state";
 import { basename as basename$1, dirname as dirname$1, isAbsolute as isAbsolute$1, join as join$1, relative as relative$1, resolve as resolve$1, sep as sep$1 } from "path";
-import { isJsonObject, readJsonObject, readStats, settingDefinition } from "@stim-cli/core/state";
-import { existsSync as existsSync$1, lstatSync as lstatSync$1, readFileSync as readFileSync$1, readdirSync as readdirSync$1, realpathSync as realpathSync$1, rmSync as rmSync$1 } from "fs";
+import { fileURLToPath } from "node:url";
+import { existsSync as existsSync$1, lstatSync as lstatSync$1, readFileSync as readFileSync$1, readdirSync as readdirSync$1, realpathSync as realpathSync$1 } from "fs";
 import * as expoFingerprint from "@expo/fingerprint";
+import { rm } from "fs/promises";
 import { createRequire } from "module";
 //#region src/diagnostics/doctor-config.ts
 function readMachineSettings(context) {
@@ -139,26 +141,44 @@ function missingPath(value, projectRoot, exists, trim = false) {
 }
 //#endregion
 //#region src/diagnostics/doctor-storage.ts
+const temporaryFix = "Unset STIM_TMPDIR / machine tempDir to select same-volume staging automatically, or point the override at a writable directory on the relevant volume outside Git working trees.";
+function crossFilesystem(operation, paths, fix, device) {
+	if (new Set(paths.map(device)).size < 2) return null;
+	return {
+		level: "cost",
+		title: `${operation} crosses filesystems`,
+		detail: `${paths.join(" -> ")}. These copies cannot share file blocks across volumes and can consume the full artifact size in space and I/O. cp -c can silently perform a full copy without an error.`,
+		fix
+	};
+}
+function storageFailure(error) {
+	return {
+		level: "cost",
+		title: "Could not resolve temporary storage",
+		detail: String(error.message),
+		fix: temporaryFix
+	};
+}
+async function checkWorktreeStorageLayout({ root, repoRoot, options }, { device = filesystemDevice } = {}) {
+	if (options.machineSettings?.corrupt) return [];
+	try {
+		const target = repoRoot ?? root;
+		const source = await resolveSourceCheckoutAsync(target);
+		const finding = crossFilesystem("Worktree copy", ["path" in source ? source.path : target, target], "Keep the source checkout and linked worktree on the same volume to share file blocks when warming.", device);
+		return finding ? [finding] : [];
+	} catch (error) {
+		return [storageFailure(error)];
+	}
+}
 function checkStorageLayout(projectRoot, { platform, iosProjectPath = "ios", androidLayout = defaultAndroidLayout(projectRoot), host = process.platform, device = filesystemDevice, stagingRoot = temporaryRoot, scope } = {}) {
 	const findings = [];
-	const temporaryFix = "Unset STIM_TMPDIR / machine tempDir to select same-volume staging automatically, or point the override at a writable directory on the relevant volume outside Git working trees.";
 	const check = (operation, paths, fix) => {
-		if (new Set(paths.map(device)).size < 2) return;
-		findings.push({
-			level: "cost",
-			title: `${operation} crosses filesystems`,
-			detail: `${paths.join(" -> ")}. These copies cannot share file blocks across volumes and can consume the full artifact size in space and I/O. cp -c can silently perform a full copy without an error.`,
-			fix
-		});
+		const finding = crossFilesystem(operation, paths, fix, device);
+		if (finding) findings.push(finding);
 	};
 	try {
 		const cache = sharedBuildCache();
-		if (scope !== "native") {
-			const target = repoRoot(projectRoot) ?? projectRoot;
-			const source = resolveSourceCheckout(target);
-			check("Worktree copy", ["path" in source ? source.path : target, target], "Keep the source checkout and linked worktree on the same volume to share file blocks when warming.");
-			check("Cached app/APK staging", [cache, stagingRoot(join(cache, "artifact.app"))], temporaryFix);
-		}
+		if (scope !== "native") check("Cached app/APK staging", [cache, stagingRoot(join(cache, "artifact.app"))], temporaryFix);
 		const cacheFix = "Place STIM_BUILD_CACHE / machine caches.buildCache on the build-output volume, or accept the full-copy cost of keeping the cache on a separate volume.";
 		const localIos = platform === "ios" || platform !== "android" && existsSync(join(projectRoot, iosProjectPath));
 		if (scope !== "shared" && localIos && host === "darwin") {
@@ -168,150 +188,22 @@ function checkStorageLayout(projectRoot, { platform, iosProjectPath = "ios", and
 		}
 		if (scope !== "shared" && (platform === "android" || platform !== "ios" && existsSync(androidLayout.gradleRoot))) check("Android build-cache storage", [apkOutputsDir(androidLayout), cache], cacheFix);
 	} catch (error) {
-		findings.push({
-			level: "cost",
-			title: "Could not resolve temporary storage",
-			detail: String(error.message),
-			fix: temporaryFix
-		});
+		findings.push(storageFailure(error));
 	}
 	return findings;
 }
 //#endregion
-//#region src/diagnostics/doctor-ios-architectures.ts
-const COMPILED_PRODUCTS = /* @__PURE__ */ new Set([
-	"com.apple.product-type.application",
-	"com.apple.product-type.application.on-demand-install-capable",
-	"com.apple.product-type.app-extension",
-	"com.apple.product-type.framework",
-	"com.apple.product-type.library.static",
-	"com.apple.product-type.library.dynamic"
-]);
-function architectureList(value) {
-	if (typeof value !== "string" || /[^\w\s-]/.test(value)) return null;
-	return [...new Set(value.split(/\s+/).filter(Boolean))];
-}
-function parseIosDebugArchitectures(output) {
-	const report = {
-		affected: [],
-		unknown: false
-	};
-	let data;
-	try {
-		data = JSON.parse(output);
-	} catch {
-		return {
-			...report,
-			unknown: true
-		};
-	}
-	if (!Array.isArray(data) || data.length === 0) return {
-		...report,
-		unknown: true
-	};
-	let inspected = false;
-	for (const entry of data) {
-		if (!entry || typeof entry !== "object" || entry.error || !entry.buildSettings) {
-			report.unknown = true;
-			continue;
-		}
-		const settings = entry.buildSettings;
-		if (settings.CONFIGURATION !== "Debug" || settings.PLATFORM_NAME !== "iphonesimulator") {
-			report.unknown = true;
-			continue;
-		}
-		if (!settings.PRODUCT_TYPE) continue;
-		if (settings.PRODUCT_TYPE === "com.apple.product-type.bundle") {
-			inspected = true;
-			continue;
-		}
-		if (!COMPILED_PRODUCTS.has(settings.PRODUCT_TYPE)) {
-			report.unknown = true;
-			continue;
-		}
-		inspected = true;
-		if (settings.ONLY_ACTIVE_ARCH === "YES") continue;
-		const archs = architectureList(settings.ARCHS);
-		const valid = settings.VALID_ARCHS === void 0 ? archs : architectureList(settings.VALID_ARCHS);
-		const excluded = architectureList(settings.EXCLUDED_ARCHS ?? "");
-		if (settings.ONLY_ACTIVE_ARCH !== "NO" || !archs?.length || !valid || !excluded || typeof entry.target !== "string") {
-			report.unknown = true;
-			continue;
-		}
-		const architectures = archs.filter((arch) => valid.includes(arch) && !excluded.includes(arch));
-		if (architectures.length > 1) report.affected.push({
-			target: entry.target,
-			architectures
-		});
-	}
-	return {
-		...report,
-		unknown: report.unknown || !inspected
-	};
-}
-function inspectIosDebugArchitectures(projectRoot, iosProjectPath = "ios") {
-	const iosRoot = join(projectRoot, iosProjectPath);
-	if (!existsSync(iosRoot)) return [];
-	const findings = [];
-	const unknown = [];
-	let projects;
-	try {
-		projects = readdirSync(iosRoot).filter((name) => name.endsWith(".xcodeproj")).toSorted().map((name) => join(iosRoot, name));
-	} catch {
-		projects = [];
-	}
-	if (!projects.length) unknown.push("app project");
-	const pods = join(iosRoot, "Pods", "Pods.xcodeproj");
-	if (existsSync(pods)) projects.push(pods);
-	else if (existsSync(join(iosRoot, "Podfile"))) unknown.push("Pods project (not generated)");
-	const deadline = Date.now() + 6e4;
-	for (const project of projects) {
-		const label = relative(projectRoot, project);
-		const timeoutMs = Math.min(3e4, deadline - Date.now());
-		if (timeoutMs <= 0) {
-			unknown.push(label);
-			continue;
-		}
-		try {
-			const report = parseIosDebugArchitectures(getExecutor().runFile("xcodebuild", [
-				"-project",
-				project,
-				"-alltargets",
-				"-configuration",
-				"Debug",
-				"-sdk",
-				"iphonesimulator",
-				"-showBuildSettings",
-				"-json",
-				"-disableAutomaticPackageResolution",
-				"-skipPackageUpdates"
-			], {
-				cwd: iosRoot,
-				timeoutMs
-			}));
-			if (report.unknown) unknown.push(label);
-			if (report.affected.length) {
-				const targets = report.affected.slice(0, 5).map(({ target, architectures }) => `${target} (${architectures.join(", ")})`).join("; ");
-				findings.push({
-					code: "ios-debug-architectures",
-					level: "cost",
-					title: "iOS Debug targets build multiple simulator architectures",
-					detail: `${label}: ${report.affected.length} Debug target(s) resolve ONLY_ACTIVE_ARCH=NO with multiple architectures after exclusions: ${targets}${report.affected.length > 5 ? `; plus ${report.affected.length - 5} more` : ""}. This can compile extra native code when targeting one simulator.`,
-					fix: "Review the Debug ONLY_ACTIVE_ARCH override in the project, xcconfig, or Podfile post_install helpers. Prefer YES for local Debug simulator builds where appropriate; preserve intentional Release and distribution settings. Regenerate Pods through the project workflow after changing a helper, then rerun stim doctor --platform ios. Doctor --fix does not change architecture settings."
-				});
-			}
-		} catch {
-			unknown.push(label);
-		}
-	}
-	if (unknown.length) findings.push({
-		code: "ios-debug-architectures-unknown",
-		level: "note",
-		title: "iOS Debug architecture settings could not be fully inspected",
-		detail: `Effective Debug simulator settings are unavailable for ${unknown.join(", ")}. Architecture policy is not verified for those targets. Metadata inspection has a 60-second total budget.`,
-		fix: "Ensure Xcode can read the generated app and Pods projects, then rerun stim doctor --platform ios. Doctor does not evaluate Podfiles or install Pods to inspect architecture settings."
+//#region src/doctor-fingerprint.ts
+async function readDoctorFingerprint(operation, request) {
+	const output = await getExecutor().runFileAsync(process.execPath, [fileURLToPath(new URL("../dist/doctor-fingerprint.mjs", import.meta.url))], {
+		cwd: operation.cwd,
+		env: Object.fromEntries(Object.entries(operation.env).filter((entry) => entry[1] !== void 0)),
+		input: JSON.stringify(request),
+		timeoutMs: 6e4,
+		killSignal: "SIGKILL",
+		signal: operation.signal
 	});
-	return findings;
+	return JSON.parse(output);
 }
 //#endregion
 //#region src/diagnostics/doctor-cxx.ts
@@ -341,7 +233,7 @@ function moduleRoots(root, layout) {
 function cacheFiles(base, depth = 0) {
 	const files = [];
 	for (const name of children(base)) {
-		if (depth === 0 && /^stim-[a-f0-9]{16}$/.test(name)) continue;
+		if (depth === 0 && /^(?:stim-[a-f0-9]{16}|[a-f0-9]{4})$/.test(name)) continue;
 		const path = join(base, name);
 		const entry = lstatSync(path);
 		if (entry.isSymbolicLink()) continue;
@@ -451,6 +343,23 @@ function finding(level, title, detail, fix) {
 		fix
 	};
 }
+const isDeviceCacheKey = (key) => typeof key === "string" && /-device(?:-|$)/.test(key);
+/** Whether this workspace has run, or is set up for, `ios --device`: a device build in its history or an iOS signing or LAN setting. */
+function deviceWorkflowPlausible(state, settings) {
+	const last = state?.[LAST_BUILD_KEYS.ios];
+	if (last && typeof last === "object" && "cacheKey" in last && isDeviceCacheKey(last.cacheKey)) return true;
+	if ((readBuildHistory(state).ios ?? []).some((entry) => isDeviceCacheKey(entry.cacheKey))) return true;
+	return [
+		"ios.signingIdentity",
+		"ios.signingIdentitySha1",
+		"ios.lanHost"
+	].some((key) => settingValueAt(settings, key) !== void 0);
+}
+function checkDeviceSigning(identities) {
+	if (identities === null) return finding("note", "Could not list code signing identities", "`security find-identity -v -p codesigning` failed, so doctor cannot tell whether `stim ios --device` can sign a build for a phone.", "Run `security find-identity -v -p codesigning` to see the error; a locked login keychain is the usual cause (`security unlock-keychain`).");
+	if (identities.length > 0) return null;
+	return finding("note", "No code signing identity for iOS device builds", "`security find-identity -v -p codesigning` lists no identity on this Mac, so `stim ios --device` cannot sign a build for a phone. Simulator runs are unaffected.", "With the phone connected, run `stim device provision ios`: it lists the Apple Developer account changes (register the phone, create or refresh its Development profile, create an Apple Development certificate) and asks before making them; an agent runs it only with your go-ahead. Or sign in under Xcode > Settings > Accounts and build once from Xcode to the phone.");
+}
 function checkOffloadCandidate(placements, machines, peers, now) {
 	if (machines.length || !peers.some((peer) => isJsonObject(peer) && peer.OS === "macOS" && peer.Online === true)) return null;
 	const cold = placements.filter((placement) => {
@@ -462,27 +371,27 @@ function checkOffloadCandidate(placements, machines, peers, now) {
 	if (average <= 18e4) return null;
 	return {
 		code: "offload-candidate",
-		...finding("note", "Builds could run on another Mac", `Cold builds averaged ~${Math.round(average / 6e4)} min over ${cold.length} builds this week.`, "In Stim Desktop, open Settings > Remote Macs > Add.")
+		...finding("note", "Builds could run on another machine", `Cold builds averaged ~${Math.round(average / 6e4)} min over ${cold.length} builds this week.`, "In Stim Desktop, open Settings > Remote Machines > Add.")
 	};
 }
-function readOffloadCandidate(tailnetStatus, now, host) {
+async function readOffloadCandidate(tailnetStatus, now, host) {
 	if (host !== "darwin") return null;
 	try {
 		const entries = loadConfig$1()?.remote?.machines;
 		const machines = Array.isArray(entries) ? entries.filter((entry) => typeof entry === "string") : [];
 		const placements = readStats().record?.placements ?? [];
 		if (machines.length || placements.length < 3) return null;
-		const status = tailnetStatus();
+		const status = await tailnetStatus();
 		return checkOffloadCandidate(placements, machines, isJsonObject(status) && isJsonObject(status.Peer) ? Object.values(status.Peer) : [], now);
 	} catch {
 		return null;
 	}
 }
-function mainCheckoutProjectRoot(projectRoot) {
-	const currentRepoRoot = repoRoot(projectRoot);
+async function mainCheckoutProjectRoot(projectRoot) {
+	const currentRepoRoot = await repoRootAsync(projectRoot);
 	if (!currentRepoRoot) return projectRoot;
 	try {
-		const source = resolveSourceCheckout(currentRepoRoot);
+		const source = await resolveSourceCheckoutAsync(currentRepoRoot);
 		if ("refusal" in source) return projectRoot;
 		const projectRel = relative$1(currentRepoRoot, realpathSync$1(projectRoot));
 		if (projectRel.startsWith("..")) return projectRoot;
@@ -491,15 +400,15 @@ function mainCheckoutProjectRoot(projectRoot) {
 		return projectRoot;
 	}
 }
-function brokenPodLinks(podsRoot) {
+async function brokenPodLinks(podsRoot) {
 	try {
-		return getExecutor().runFile("find", [
+		return (await getExecutor().runFileAsync("find", [
 			"-L",
 			podsRoot,
 			"-type",
 			"l",
 			"-print"
-		], { timeoutMs: 1e4 }).split("\n").map((line) => line.trim()).filter(Boolean);
+		], { timeoutMs: 1e4 })).split("\n").map((line) => line.trim()).filter(Boolean);
 	} catch {
 		return [];
 	}
@@ -514,90 +423,90 @@ function hasIosWarmOutput(root, iosRoot) {
 		return false;
 	}
 }
-function hasLinkedWorktree(projectRoot) {
-	const root = repoRoot(projectRoot);
+async function hasLinkedWorktree(projectRoot) {
+	const root = await repoRootAsync(projectRoot);
 	if (!root) return false;
-	return listWorktrees(root).filter((entry) => !entry.prunable && !entry.bare).length > 1;
+	return (await listWorktreesAsync(root)).filter((entry) => !entry.prunable && !entry.bare).length > 1;
 }
-function headBranch(root) {
-	const ref = gitQuiet(root, [
+async function headBranch(root) {
+	const ref = (await gitQuietAsync(root, [
 		"symbolic-ref",
 		"--quiet",
 		"HEAD"
-	])?.trim();
+	]))?.trim();
 	return ref?.startsWith("refs/heads/") ? ref.slice(11) : null;
 }
-function mainOperation(root) {
-	const gitDir = gitQuiet(root, [
+async function mainOperation(root) {
+	const gitDir = (await gitQuietAsync(root, [
 		"rev-parse",
 		"--path-format=absolute",
 		"--git-dir"
-	])?.trim();
+	]))?.trim();
 	if (!gitDir) return null;
 	if (existsSync$1(join$1(gitDir, "rebase-merge")) || existsSync$1(join$1(gitDir, "rebase-apply"))) return "rebase";
 	return existsSync$1(join$1(gitDir, "MERGE_HEAD")) ? "merge" : null;
 }
-function dirtyTrackedPaths(root) {
-	return (gitQuiet(root, [
+async function dirtyTrackedPaths(root) {
+	return (await gitQuietAsync(root, [
 		"diff",
 		"--name-only",
 		"HEAD"
 	]) ?? "").split("\n").map((line) => line.trim()).filter(Boolean);
 }
-function resolveDefaultBranch(root) {
+async function resolveDefaultBranch(root) {
 	const worktree = resolveSettings({
-		gitCommonDir: gitCommonDir(root),
-		repoRoot: repoRoot(root) ?? root
+		gitCommonDir: await gitCommonDirAsync(root),
+		repoRoot: await repoRootAsync(root) ?? root
 	}).worktree;
 	const configured = worktree && typeof worktree === "object" && !Array.isArray(worktree) ? worktree.defaultBranch : void 0;
 	if (typeof configured === "string" && configured.trim()) return configured.trim();
-	const head = gitQuiet(root, [
+	const head = (await gitQuietAsync(root, [
 		"symbolic-ref",
 		"--short",
 		"refs/remotes/origin/HEAD"
-	])?.trim();
+	]))?.trim();
 	if (!head) return null;
 	const cut = head.indexOf("/");
 	return cut > 0 ? head.slice(cut + 1) : head;
 }
-function seedFindings(mainRoot, upstream) {
+async function seedFindings(mainRoot, upstream) {
 	const findings = [];
-	const root = repoRoot(mainRoot);
+	const root = await repoRootAsync(mainRoot);
 	const quotedRoot = quotedPath(root ?? mainRoot);
 	if (upstream && upstream.behind > 0 && upstream.ahead === 0) findings.push(finding("note", `The source checkout is ${plural(upstream.behind, "commit")} behind ${upstream.name}`, "The count uses the locally known upstream ref. A fetch can reveal additional commits. A later rebase or merge can change native inputs and invalidate work done from the older base.", `Run \`stim worktree warm --refresh\` from a linked worktree to fetch and fast-forward the source checkout, or \`git -C ${quotedRoot} fetch --prune\` and inspect the branch yourself.`));
 	if (root === null) return findings;
-	const operation = mainOperation(root);
+	const operation = await mainOperation(root);
 	if (operation) {
 		findings.push(finding("note", `The source checkout has a ${operation} in progress`, "`stim worktree warm --refresh` refuses a source checkout it cannot move, and the branch stays where the interrupted operation left it.", `Finish it, or run \`git -C ${quotedRoot} ${operation} --abort\`.`));
 		return findings;
 	}
-	const dirty = dirtyTrackedPaths(root);
+	const dirty = await dirtyTrackedPaths(root);
 	if (dirty.length) findings.push(finding("note", `The source checkout has ${plural(dirty.length, "uncommitted tracked change")}`, `\`stim worktree warm --refresh\` refuses a source checkout it cannot move, so the seed stays where it is until this is cleared. First: ${dirty[0]}.`, `Commit them, or run \`git -C ${quotedRoot} stash push -u -m warm-refresh\`.`));
-	const branch = headBranch(root);
+	const branch = await headBranch(root);
 	if (branch === null) {
 		findings.push(finding("note", "The source checkout has a detached HEAD", "`stim worktree warm --refresh` refuses: there is no branch to fast-forward.", `Run \`git -C ${quotedRoot} checkout <branch>\`.`));
 		return findings;
 	}
 	if (upstream && upstream.ahead > 0 && upstream.behind > 0) findings.push(finding("note", `The source checkout has diverged from ${upstream.name}`, `${branch} is ${upstream.ahead} ahead of and ${upstream.behind} behind ${upstream.name}, so it cannot fast-forward. \`stim worktree warm --refresh\` refuses rather than merging or resetting.`, `Rebase or merge ${branch} onto ${upstream.name} yourself.`));
-	const defaultBranch = resolveDefaultBranch(root);
+	const defaultBranch = await resolveDefaultBranch(root);
 	if (defaultBranch !== null && defaultBranch !== branch) findings.push(finding("note", `The source checkout is on ${branch}, not the default branch ${defaultBranch}`, `Every worktree warmed from here carries ${branch}'s dependencies. \`stim worktree warm --refresh\` warns and continues; it never switches a branch under another checkout.`, `Run \`git -C ${quotedRoot} checkout ${defaultBranch}\`.`));
 	return findings;
 }
-function checkMainCheckout(projectRoot, { npmTreeValid, brokenPods = void 0, upstream = void 0, linkedWorktrees = void 0, platform, localIos = platform !== "android", iosProjectPath = "ios", androidLayout = defaultAndroidLayout(projectRoot) } = {}) {
-	const mainRoot = mainCheckoutProjectRoot(projectRoot);
+async function checkMainCheckout(projectRoot, { npmTreeValid, brokenPods = void 0, upstream = void 0, linkedWorktrees = void 0, platform, localIos = platform !== "android", iosProjectPath = "ios", androidLayout = defaultAndroidLayout(projectRoot) } = {}) {
+	const mainRoot = await mainCheckoutProjectRoot(projectRoot);
 	const mainAndroid = {
 		...androidLayout,
 		gradleRoot: join$1(mainRoot, relative$1(projectRoot, androidLayout.gradleRoot)),
 		moduleDir: join$1(mainRoot, relative$1(projectRoot, androidLayout.moduleDir))
 	};
 	const findings = [];
-	const dependencies = dependencyState(mainRoot);
+	const dependencies = dependencyState(mainRoot, await repoRootAsync(mainRoot) ?? mainRoot);
 	if (dependencies) {
 		const installed = hasInstalledDependencies(dependencies.root, dependencies.installed);
 		const installCommand = `cd ${quotedPath(dependencies.root)} && ${dependencies.command}`;
 		if (!installed) findings.push(finding("cost", "The source checkout has no installed dependencies", `A worktree cannot carry dependencies from ${dependencies.root}, so its first build must install them from scratch.`, `Run \`${installCommand}\` before creating native worktrees, or let \`stim worktree warm --refresh\` run it from a linked worktree.`));
 		else if (dependencies.lock === "package-lock.json") {
-			if ((npmTreeValid === void 0 ? installedNpmTreeIsValid(dependencies.root) : npmTreeValid) === false) findings.push(finding("cost", "The source checkout dependency tree is stale", `npm reports that ${dependencies.root}/node_modules does not match the project dependency graph. Copying it makes each worktree start from the same invalid state.`, `Run \`${installCommand}\` before creating native worktrees, or let \`stim worktree warm --refresh\` run it from a linked worktree.`));
+			if ((npmTreeValid === void 0 ? await installedNpmTreeIsValidAsync(dependencies.root) : npmTreeValid) === false) findings.push(finding("cost", "The source checkout dependency tree is stale", `npm reports that ${dependencies.root}/node_modules does not match the project dependency graph. Copying it makes each worktree start from the same invalid state.`, `Run \`${installCommand}\` before creating native worktrees, or let \`stim worktree warm --refresh\` run it from a linked worktree.`));
 		}
 	}
 	const iosRoot = join$1(mainRoot, iosProjectPath);
@@ -616,7 +525,7 @@ function checkMainCheckout(projectRoot, { npmTreeValid, brokenPods = void 0, ups
 			const podCommand = `cd ${quotedPath(iosRoot)} && ${podInstallCommand(mainRoot)}`;
 			findings.push(finding("cost", `The source checkout CocoaPods state is ${podsState}`, `ios/Pods cannot be reused safely because its Manifest.lock ${podsState === "missing" ? "is absent" : "does not match ios/Podfile.lock"}.`, `Run \`${podCommand}\` before creating native worktrees, or let \`stim worktree warm --refresh\` run it from a linked worktree.`));
 		}
-		const broken = brokenPods === void 0 && existsSync$1(podsRoot) ? brokenPodLinks(podsRoot) : brokenPods || [];
+		const broken = brokenPods === void 0 && existsSync$1(podsRoot) ? await brokenPodLinks(podsRoot) : brokenPods || [];
 		if (broken.length) {
 			const podCommand = `cd ${quotedPath(iosRoot)} && ${podInstallCommand(mainRoot, "--clean-install")}`;
 			findings.push(finding("cost", "The source checkout CocoaPods state has broken links", `${broken.length} symlink${broken.length === 1 ? "" : "s"} under ios/Pods point to missing files. Worktrees copy these broken links and can fail during compilation. First: ${broken[0]}.`, `Run \`${podCommand}\` before creating native worktrees.`));
@@ -624,7 +533,7 @@ function checkMainCheckout(projectRoot, { npmTreeValid, brokenPods = void 0, ups
 	}
 	const coldPlatforms = [localIos && existsSync$1(iosRoot) && !hasIosWarmOutput(mainRoot, iosRoot) ? "iOS" : null, platform !== "ios" && hasAndroidProject(mainAndroid) && !existsSync$1(join$1(mainAndroid.gradleRoot, "build")) && !existsSync$1(join$1(mainAndroid.moduleDir, "build")) ? "Android" : null].filter((coldPlatform) => coldPlatform !== null);
 	if (coldPlatforms.length) findings.push(finding("note", `The source checkout has no ${coldPlatforms.join(" or ")} warm build output`, "The shared Stim artifact or compilation cache can still be warm. Building the source checkout once gives later native worktrees the strongest warm starting point.", `When more native worktrees are expected, run \`stim start\`, \`stim ${coldPlatforms[0] === "iOS" ? "ios" : "android"}\`, and \`stim stop\` from ${mainRoot}.`));
-	if (linkedWorktrees === void 0 ? hasLinkedWorktree(projectRoot) : linkedWorktrees) findings.push(...seedFindings(mainRoot, upstream === void 0 ? locallyKnownUpstream(mainRoot) : upstream));
+	if (linkedWorktrees === void 0 ? await hasLinkedWorktree(projectRoot) : linkedWorktrees) findings.push(...await seedFindings(mainRoot, upstream === void 0 ? await locallyKnownUpstreamAsync(mainRoot) : upstream));
 	return findings;
 }
 function checkMetroCache(metroConfigSource) {
@@ -723,9 +632,12 @@ function checkConcurrency({ maxBuilds = 0, maxDevices = 0, liveDevices = 0, acti
 	if (!maxBuilds && !maxDevices) return null;
 	return finding("note", "Concurrency limits are set", `${`maxBuilds ${maxBuilds || "unlimited"}, maxDevices ${maxDevices || "unlimited"}`}. Right now ${typeof liveDevices === "number" ? `${liveDevices} Stim device(s) are booted` : `the number of booted Stim devices is unknown (${liveDevices.unknown})`} and ${activeBuilds} build slot(s) are in use on this machine. At the device cap a new \`stim ios\`/\`android\` waits in FIFO order for 600s (--wait changes it; --no-wait refuses with STIM_AT_CAPACITY); at the build cap a compile waits for a free slot.`, null);
 }
-function easCliOutsideRepository(projectRoot) {
+async function easCliOutsideRepository(projectRoot, operation) {
 	const found = (String(getExecutor().findExecutable("eas") ?? "").split("\n")[0] ?? "").trim();
-	const root = found ? repoRoot(projectRoot) : null;
+	const root = found ? operation ? await repoRootAsync(projectRoot, {
+		env: operation.env,
+		signal: operation.signal
+	}) : repoRoot(projectRoot) : null;
 	if (!found || !root) return null;
 	try {
 		const repository = realpathSync$1(root);
@@ -743,18 +655,19 @@ function easCliOutsideRepository(projectRoot) {
 		return null;
 	}
 }
-function readProjectEasCliVersion(projectRoot) {
+async function readProjectEasCliVersion(projectRoot, operation) {
 	const packageJson = resolvePackageJson(projectRoot, "eas-cli");
 	if (packageJson) {
 		const version = readJsonObject(packageJson)?.version;
 		return typeof version === "string" ? `eas-cli/${version}` : null;
 	}
-	const onPath = easCliOutsideRepository(projectRoot);
-	return onPath ? readInstalledEasCliVersion(onPath, projectRoot) : null;
+	const onPath = await easCliOutsideRepository(projectRoot, operation);
+	return onPath ? readInstalledEasCliVersionAsync(onPath, projectRoot) : null;
 }
-function doctorEasAuth({ projectRoot, owner }) {
-	const file = easCliOutsideRepository(projectRoot);
+async function doctorEasAuth({ projectRoot, owner, operation }) {
+	const file = await easCliOutsideRepository(projectRoot, operation);
 	if (file) return checkEasAuth$1({
+		context: operation,
 		projectRoot,
 		owner,
 		resolveBin: () => ({
@@ -764,6 +677,7 @@ function doctorEasAuth({ projectRoot, owner }) {
 	});
 	const unchecked = resolveEasCliBin(projectRoot);
 	if (!unchecked) return checkEasAuth$1({
+		context: operation,
 		projectRoot,
 		owner,
 		resolveBin: () => null
@@ -793,13 +707,16 @@ function checkEasBuildDownload({ easJson = false, remoteEas = false, easCliResol
 	if (easCli.supported) return null;
 	return finding("cost", easCli.version ? `eas-cli ${easCli.version} cannot download EAS builds for --eas-profile` : "The eas-cli version could not be read for --eas-profile", `\`stim ios --eas-profile\` and \`stim android --eas-profile\` download a finished EAS development build with \`eas build:download --build-id\`, which needs eas-cli ${MIN_EAS_CLI_BUILD_DOWNLOAD_VERSION} or later. Older versions refuse with STIM_EAS_UNAVAILABLE before any download.`, `${easCliUpgradeRemedy(MIN_EAS_CLI_BUILD_DOWNLOAD_VERSION)}.`);
 }
-function projectEasBuildDownloadFinding(projectRoot, remoteBackends, lookupEasCli) {
+async function projectEasBuildDownloadFinding(projectRoot, remoteBackends, lookupEasCli, operation) {
 	const easJson = existsSync$1(join$1(projectRoot, "eas.json"));
+	const remoteEas = remoteBackends.includes("eas");
+	const easCliResolvable = easJson && (lookupEasCli ? lookupEasCli() : Boolean(resolveEasCliBin(projectRoot)));
+	const version = easJson && !remoteEas && easCliResolvable ? await readProjectEasCliVersion(projectRoot, operation) : null;
 	return checkEasBuildDownload({
 		easJson,
-		remoteEas: remoteBackends.includes("eas"),
-		easCliResolvable: easJson && (lookupEasCli ? lookupEasCli() : Boolean(resolveEasCliBin(projectRoot))),
-		readEasCliVersion: () => readProjectEasCliVersion(projectRoot)
+		remoteEas,
+		easCliResolvable,
+		readEasCliVersion: () => version
 	});
 }
 function checkSimSlim({ configured = false, profileError = null, onPath = false } = {}) {
@@ -830,8 +747,8 @@ function configuredRemoteBackends(projectSettings, platform) {
 	const androidTarget = remoteAndroidSetting(projectSettings);
 	return [.../* @__PURE__ */ new Set([...platform !== "android" ? [iosTarget?.kind === "backend" ? iosTarget.backend : null] : [], ...platform !== "ios" ? [androidTarget?.kind === "backend" ? androidTarget.backend : null] : []])].filter((backend) => backend !== null);
 }
-function runDoctor(projectRoot, options = {}, inspectors = []) {
-	const { concurrency = getConcurrencyLimits, liveDevices = null, activeBuilds = null, lookupSimSlim = null, memoryPressure = readHostMemoryPressure, lookupChrome, platform, host = process.platform, platforms = ["ios", "android"], machineSettings = readMachineSettings(projectSettingsContext(projectRoot)) } = options;
+async function runDoctor(projectRoot, options = {}, inspectors = []) {
+	const { concurrency = getConcurrencyLimits, liveDevices = null, activeBuilds = null, lookupSimSlim = null, lookupSigningIdentities = () => probeSigningIdentities({ env: options.operation?.env ?? process.env }), memoryPressure = readHostMemoryPressureAsync, lookupChrome, platform, host = process.platform, platforms = ["ios", "android"], machineSettings = readMachineSettings(projectSettingsContext(projectRoot)) } = options;
 	const localIos = platforms.includes("ios") && platform !== "android" && host === "darwin";
 	const projectSettings = machineSettings.settings;
 	const context = {
@@ -851,14 +768,15 @@ function runDoctor(projectRoot, options = {}, inspectors = []) {
 	if (limits && (limits.maxBuilds || limits.maxDevices)) concurrencyFinding = checkConcurrency({
 		maxBuilds: limits.maxBuilds,
 		maxDevices: limits.maxDevices,
-		liveDevices: liveDevices ? liveDevices() : countLiveOwnedDevices(),
+		liveDevices: liveDevices ? liveDevices() : options.operation ? await countLiveOwnedDevicesAsync(options.operation) : countLiveOwnedDevices(),
 		activeBuilds: activeBuilds ? activeBuilds() : countActiveBuilds()
 	});
 	const settingShapeFindings = settingShapeErrors(projectSettings).map((error) => finding("cost", "A setting has the wrong type", error, SETTING_SHAPE_REMEDY));
 	let optimizations = null;
 	try {
 		optimizations = resolveAndroidCompilerCache({
-			optimizations: resolveOptimizations(projectSettings),
+			optimizations: resolveOptimizations(projectSettings, options.operation?.env ?? options.remoteEnv ?? process.env),
+			env: options.operation?.env ?? options.remoteEnv ?? process.env,
 			use: readAndroidCasToolchain
 		}).optimizations;
 	} catch {}
@@ -880,36 +798,40 @@ function runDoctor(projectRoot, options = {}, inspectors = []) {
 		profileError: simslimProfileError,
 		onPath: simslimProfile ? lookupSimSlim ? lookupSimSlim() : simslimIsOnPath() : false
 	});
-	const memoryAdvice = localIos && !remoteIosSetting(projectSettings) ? hostMemoryPressureAdvice(memoryPressure()) : null;
+	const memoryAdvice = localIos && !remoteIosSetting(projectSettings) ? hostMemoryPressureAdvice(await memoryPressure()) : null;
+	const shared = [
+		...checkStorageLayout(projectRoot, {
+			platform,
+			host,
+			scope: "shared"
+		}),
+		checkChrome({
+			usesWeb: () => !platform && webSettings(projectSettings).url !== null,
+			chrome: lookupChrome
+		}),
+		concurrencyFinding,
+		memoryAdvice ? finding("cost", "Host memory pressure can stall the iOS simulator", memoryAdvice, "Free host memory, then retry. Run `stim guide lifecycle simslim` for the optional memory reduction setup.") : null,
+		simslimFinding,
+		localIos && deviceWorkflowPlausible(readWorkspaceState$1(projectRoot), projectSettings) ? checkDeviceSigning(await lookupSigningIdentities()) : null,
+		...settingShapeFindings,
+		...checkMachineSettings({
+			settings: projectSettings,
+			layers: machineSettings.layers,
+			projectRoot,
+			optimizations,
+			env: options.operation?.env ?? options.remoteEnv ?? process.env,
+			reportedElsewhere: simslimProfileError ? ["ios.simslimProfile"] : []
+		})
+	].filter((f) => Boolean(f));
+	const inspected = await Promise.all(inspectors.map((inspect) => inspect(context)));
 	return {
-		findings: [...[
-			...checkStorageLayout(projectRoot, {
-				platform,
-				host,
-				scope: "shared"
-			}),
-			checkChrome({
-				usesWeb: () => !platform && webSettings(projectSettings).url !== null,
-				chrome: lookupChrome
-			}),
-			concurrencyFinding,
-			memoryAdvice ? finding("cost", "Host memory pressure can stall the iOS simulator", memoryAdvice, "Free host memory, then retry. Run `stim guide lifecycle simslim` for the optional memory reduction setup.") : null,
-			simslimFinding,
-			...settingShapeFindings,
-			...checkMachineSettings({
-				settings: projectSettings,
-				layers: machineSettings.layers,
-				projectRoot,
-				optimizations,
-				reportedElsewhere: simslimProfileError ? ["ios.simslimProfile"] : []
-			})
-		].filter((f) => Boolean(f)), ...inspectors.flatMap((inspect) => inspect(context))],
+		findings: [...shared, ...inspected.flat()],
 		context
 	};
 }
-function reactNativeDoctorFindings({ root: projectRoot, settings: projectSettings, optimizations, options, repoRoot: repositoryRoot }) {
+async function reactNativeDoctorFindings({ root: projectRoot, settings: projectSettings, optimizations, options, repoRoot: repositoryRoot }) {
 	const androidLayout = resolveAndroidLayout(projectSettings, projectRoot, repositoryRoot ?? projectRoot);
-	const { readFile = readFileSync$1, xcodeMajor = null, easAuth = doctorEasAuth, remoteEnv = process.env, lookupAgentDevice = null, lookupEasCli = null, lookupCcache = null, tailnetStatus = realIo.status, now = Date.now, platform, host = process.platform } = options;
+	const { readFile = readFileSync$1, xcodeMajor = null, easAuth = doctorEasAuth, remoteEnv = options.operation?.env ?? process.env, lookupAgentDevice = null, lookupEasCli = null, lookupCcache = null, tailnetStatus = realIo.status, now = Date.now, platform, host = process.platform } = options;
 	const localIos = platform !== "android" && host === "darwin";
 	const read = (rel) => {
 		const p = join$1(projectRoot, rel);
@@ -940,34 +862,29 @@ function reactNativeDoctorFindings({ root: projectRoot, settings: projectSetting
 	const easFinding = remoteBuildCache && provider === "eas" ? checkEasAuth({
 		provider,
 		owner,
-		auth: easAuth({
+		auth: await easAuth({
 			projectRoot,
-			owner
+			owner,
+			operation: options.operation
 		})
 	}) : null;
 	const remoteBackends = configuredRemoteBackends(projectSettings, platform);
 	const daemonInEnv = Boolean(remoteEnv.AGENT_DEVICE_DAEMON_BASE_URL?.trim() && remoteEnv.AGENT_DEVICE_DAEMON_AUTH_TOKEN?.trim());
 	const agentDeviceOnPath = remoteBackends.length ? lookupAgentDevice ? lookupAgentDevice() : agentDeviceIsOnPath() : false;
 	const easCliResolvable = remoteBackends.includes("eas") ? lookupEasCli ? lookupEasCli() : Boolean(resolveEasCliBin(projectRoot)) : false;
+	const remoteVersion = agentDeviceOnPath && easCliResolvable && remoteBackends.includes("eas") ? await readProjectEasCliVersion(projectRoot, options.operation) : null;
 	const remoteFindings = remoteBackends.map((backend) => checkRemoteDevice({
 		configured: backend,
 		daemonInEnv,
 		agentDeviceOnPath,
 		easCliResolvable,
-		readEasCliVersion: () => readProjectEasCliVersion(projectRoot)
+		readEasCliVersion: () => remoteVersion
 	})).filter((remoteFinding) => remoteFinding !== null);
-	const easBuildDownloadFinding = projectEasBuildDownloadFinding(projectRoot, remoteBackends, lookupEasCli);
+	const easBuildDownloadFinding = await projectEasBuildDownloadFinding(projectRoot, remoteBackends, lookupEasCli, options.operation);
 	return [
 		checkAppProject(projectRoot),
 		checkIosHost(platform, host),
 		checkXcodeEnvLineEndings(projectRoot, platform, host),
-		...checkMainCheckout(projectRoot, {
-			platform,
-			localIos,
-			iosProjectPath: iosProject.relative,
-			androidLayout
-		}),
-		...localIos ? inspectIosDebugArchitectures(mainCheckoutProjectRoot(projectRoot), iosProject.relative) : [],
 		...checkStorageLayout(projectRoot, {
 			platform,
 			host,
@@ -988,7 +905,7 @@ function reactNativeDoctorFindings({ root: projectRoot, settings: projectSetting
 		remoteBuildCache ? checkBuildCacheProvider(appConfig, sdkMajor, isExpo, dynamicConfig) : null,
 		easFinding,
 		easBuildDownloadFinding,
-		readOffloadCandidate(tailnetStatus, now(), host),
+		await readOffloadCandidate(tailnetStatus, now(), host),
 		...remoteFindings
 	].filter((value) => Boolean(value));
 }
@@ -1110,8 +1027,8 @@ function listDirectory(dir) {
 		return [];
 	}
 }
-function hasLinkedPackageWithGit(projectRoot) {
-	const root = repoRoot(projectRoot) ?? projectRoot;
+async function hasLinkedPackageWithGit(projectRoot) {
+	const root = await repoRootAsync(projectRoot) ?? projectRoot;
 	for (let dir = projectRoot;; dir = dirname$1(dir)) {
 		if (linkedPackageWithGitIn(join$1(dir, "node_modules"))) return true;
 		if (dir === root || dirname$1(dir) === dir || relative$1(root, dirname$1(dir)).startsWith("..")) return false;
@@ -1137,14 +1054,18 @@ function linkedPackageWithGitIn(nodeModules) {
 * packages can be hoisted, so the gate looks at every node_modules from the
 * app up to the repository root.
 */
-async function detectLinkedLibraryGitMetadata(projectRoot, { createFingerprint = expoFingerprint.createFingerprintAsync, platform } = {}) {
-	const mainRoot = mainCheckoutProjectRoot(projectRoot);
-	if (!hasLinkedPackageWithGit(mainRoot)) return null;
+async function detectLinkedLibraryGitMetadata(projectRoot, { createFingerprint = expoFingerprint.createFingerprintAsync, platform, operation } = {}) {
+	const mainRoot = await mainCheckoutProjectRoot(projectRoot);
+	if (!await hasLinkedPackageWithGit(mainRoot)) return null;
 	const skipped = fingerprintConfigSkipped(mainRoot);
 	if (skipped) return skipped;
 	let sources;
 	try {
-		sources = (await fingerprintProject(mainRoot, {
+		sources = (operation && createFingerprint === expoFingerprint.createFingerprintAsync ? await readDoctorFingerprint(operation, {
+			root: mainRoot,
+			platform,
+			debug: true
+		}) : await fingerprintProject(mainRoot, {
 			platform,
 			createFingerprint,
 			debug: true
@@ -1164,8 +1085,14 @@ async function detectLinkedLibraryGitMetadata(projectRoot, { createFingerprint =
 		code: "linked-library-git-metadata"
 	};
 }
-async function detectFingerprintParity(projectRoot, { createFingerprint = expoFingerprint.createFingerprintAsync, differ = expoFingerprint.diffFingerprints, dirtyFiles = dirtyFingerprintFiles, platform: selectedPlatform, iosProjectPath = "ios" } = {}) {
-	if (gitQuiet(projectRoot, ["rev-parse", "--git-dir"]) == null) return null;
+async function appPathInRepository(projectRoot) {
+	const top = await repoRootAsync(projectRoot);
+	if (!top) return "";
+	const path = relative$1(realpathSync$1.native(top), realpathSync$1.native(projectRoot));
+	return path.startsWith("..") ? "" : path;
+}
+async function detectFingerprintParity(projectRoot, { createFingerprint = expoFingerprint.createFingerprintAsync, differ = expoFingerprint.diffFingerprints, dirtyFiles = dirtyFingerprintFiles, platform: selectedPlatform, iosProjectPath = "ios", operation } = {}) {
+	if (await gitQuietAsync(projectRoot, ["rev-parse", "--git-dir"]) == null) return null;
 	if (hasInstalledDependencies(projectRoot)) return null;
 	const skipped = fingerprintConfigSkipped(projectRoot);
 	if (skipped) return skipped;
@@ -1183,37 +1110,44 @@ async function detectFingerprintParity(projectRoot, { createFingerprint = expoFi
 		return null;
 	}
 	const worktree = join$1(base, "head");
-	if (gitQuiet(projectRoot, [
-		"-c",
-		`core.hooksPath=${join$1(base, "hooks")}`,
-		"worktree",
-		"add",
-		"--detach",
-		worktree,
-		"HEAD"
-	], {
-		write: true,
-		timeoutMs: 6e4
-	}) == null) {
-		rmSync$1(base, {
-			recursive: true,
-			force: true
-		});
-		return null;
-	}
+	let released;
+	let rejected;
+	const cleanup = new Promise((done, reject) => {
+		released = done;
+		rejected = reject;
+	});
+	const release = () => released();
+	let added = false;
+	trackReportResource(operation, cleanup, () => cleanup);
 	try {
-		const headSkipped = fingerprintConfigSkipped(worktree) ?? coldFingerprintRunsProjectCode(worktree, platform);
+		added = await gitQuietAsync(projectRoot, [
+			"-c",
+			`core.hooksPath=${join$1(base, "hooks")}`,
+			"worktree",
+			"add",
+			"--detach",
+			worktree,
+			"HEAD"
+		], {
+			write: true,
+			timeoutMs: 6e4
+		}) !== null;
+		if (!added) return null;
+		const headApp = join$1(worktree, await appPathInRepository(projectRoot));
+		const headSkipped = fingerprintConfigSkipped(headApp) ?? coldFingerprintRunsProjectCode(headApp, platform);
 		if (headSkipped) return headSkipped;
-		const project = await fingerprintProject(projectRoot, {
+		const inspect = (root) => operation && createFingerprint === expoFingerprint.createFingerprintAsync ? readDoctorFingerprint(operation, {
+			root,
 			platform,
 			iosProjectPath,
-			createFingerprint: coldFingerprint
-		});
-		const clean = await fingerprintProject(worktree, {
+			cold: true
+		}) : fingerprintProject(root, {
 			platform,
 			iosProjectPath,
 			createFingerprint: coldFingerprint
 		});
+		const project = await inspect(projectRoot);
+		const clean = await inspect(headApp);
 		if (!project || !clean) return null;
 		if (project.hash === clean.hash) return null;
 		const changed = diffFingerprintSources({
@@ -1226,26 +1160,56 @@ async function detectFingerprintParity(projectRoot, { createFingerprint = expoFi
 			projectHash: project.hash,
 			worktreeHash: clean.hash,
 			changed,
-			dirtyFiles: dirtyFiles(projectRoot)
+			dirtyFiles: await dirtyFiles(projectRoot)
 		});
 	} catch {
 		return null;
 	} finally {
-		gitQuiet(projectRoot, [
-			"worktree",
-			"remove",
-			"--force",
-			worktree
-		], {
-			write: true,
-			timeoutMs: 3e4
-		});
-		rmSync$1(base, {
-			recursive: true,
-			force: true
-		});
-		gitQuiet(projectRoot, ["worktree", "prune"], { write: true });
+		await finishCleanup();
+	}
+	async function finishCleanup() {
+		try {
+			const options = {
+				timeoutMs: 3e4,
+				...operation ? { signal: AbortSignal.timeout(3e4) } : {}
+			};
+			const target = join$1(realpathSync$1.native(base), "head");
+			if (added || operation) await gitQuietAsync(projectRoot, [
+				"worktree",
+				"remove",
+				"--force",
+				"--force",
+				worktree
+			], {
+				write: true,
+				...options
+			});
+			if (operation) {
+				const registered = await gitQuietAsync(projectRoot, [
+					"worktree",
+					"list",
+					"--porcelain",
+					"-z"
+				], options);
+				if (registered === null || registered.split("\0").some((line) => line.startsWith("worktree ") && relative$1(target, line.slice(9)) === "")) throw new Error("The temporary worktree is still registered or its registration cannot be read.");
+			}
+			await rm(base, {
+				recursive: true,
+				force: true
+			});
+			if (added && !operation) await gitQuietAsync(projectRoot, ["worktree", "prune"], { write: true });
+		} catch (error) {
+			if (!operation) throw error;
+			const refusal = Object.assign(new Error(`Cannot finish cleanup for temporary worktree ${worktree}.`, { cause: error }), {
+				code: "STIM_CLAIM_UNAVAILABLE",
+				reportCleanup: true
+			});
+			if (reportSignal(operation)) rejected(refusal);
+			throw refusal;
+		} finally {
+			release();
+		}
 	}
 }
 //#endregion
-export { repairCxxLauncherState as a, runDoctor as i, detectLinkedLibraryGitMetadata as n, readMachineSettings as o, reactNativeDoctorFindings as r, detectFingerprintParity as t };
+export { reactNativeDoctorFindings as a, checkWorktreeStorageLayout as c, mainCheckoutProjectRoot as i, readMachineSettings as l, detectFingerprintParity as n, runDoctor as o, detectLinkedLibraryGitMetadata as r, repairCxxLauncherState as s, checkMainCheckout as t };