thisdamnthing 0.1.0__py3-none-any.whl

thisdamnthing/__init__.py

@@ -0,0 +1,3 @@
+"""ThisDamnThing's agent-neutral workspace core."""
+
+__version__ = "0.1.0"

thisdamnthing/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())

thisdamnthing/agents.py

@@ -0,0 +1,167 @@
+"""Workspace-local host selection and owner-preserving skill enablement."""
+import shutil
+from pathlib import Path
+
+from .workspace import WorkspaceError, read_config, managed_path
+from .bootstrap import PROVIDERS, digest, encode, existing_text, load_manifest
+
+
+def detected():
+    """Only executable discovery; never launch a host or inspect global settings."""
+    return [host for host in PROVIDERS if shutil.which(host)]
+
+
+def enabled(root, config=None):
+    config = read_config(root) if config is None else config
+    selected = config.get('enabled_agents')
+    if selected is not None:
+        if (not isinstance(selected, list) or any(not isinstance(h, str) or h not in PROVIDERS for h in selected)
+                or len(set(selected)) != len(selected)):
+            raise WorkspaceError('Invalid enabled_agents in workspace config')
+        return selected
+    # Legacy consent comes only from ownership records, never from host folders.
+    from . import stacks, skills
+    manifest = load_manifest(root)
+    records = [manifest['files'], *(e['files'] for e in stacks.registry(root)),
+               *skills.state(root)['skills'].values()]
+    return [host for host, (instruction, folder, settings) in PROVIDERS.items()
+            if host in config['adapters'] or instruction in manifest['instructions']
+            or settings in manifest['hooks']
+            or any(any(p.startswith(folder + '/') for p in record) for record in records)]
+
+
+def folders(root):
+    return ['.tdt/skills', *(PROVIDERS[h][1] for h in enabled(root))]
+
+
+def plan_skills(root, hosts):
+    """Add bridges to each original owner's record; preflight before any write."""
+    from . import stacks, skills
+    skills.ready(root)
+    entries = stacks.available(root)
+    users = skills.state(root)
+    changes = {}
+
+    def add(name, record, content):
+        for host in hosts:
+            target = f'{PROVIDERS[host][1]}/{name}/SKILL.md'
+            if host == 'claude' and managed_path(root, f'.claude/commands/{name}.md').exists():
+                raise WorkspaceError(f'Claude command collision: {name}')
+            if target in record:
+                continue
+            if managed_path(root, str(Path(target).parent)).exists():
+                raise WorkspaceError(f'Skill directory collision: {target}')
+            if target in changes:
+                raise WorkspaceError(f'Duplicate skill ownership: {name}')
+            changes[target] = content
+            record[target] = digest(content)
+
+    for entry in entries:
+        stacks.check_owned(root, entry)
+        for relative in entry['manifest']['skills']:
+            name = relative.split('/')[1]
+            add(name, entry['files'], stacks.bridge(name))
+    for name, record in users['skills'].items():
+        for path, expected in record.items():
+            current = existing_text(root, path)
+            if current is None or digest(current) != expected:
+                raise WorkspaceError(f'Owned skill file edited or missing: {path}')
+        # Preserve the approved description exactly, including older serialized YAML.
+        canonical = existing_text(root, f'.tdt/skills/{name}/SKILL.md')
+        if canonical is None or '\n---\n' not in canonical[4:]:
+            raise WorkspaceError(f'Missing user skill front matter: {name}')
+        head = canonical[:canonical.index('\n---\n', 4) + 5]
+        add(name, record, head + '\n' +
+            f'Read and follow .tdt/skills/{name}/SKILL.md from the workspace root.\n')
+    if entries:
+        changes[stacks.REGISTRY] = encode(entries)
+    if users['skills']:
+        changes[skills.STATE] = encode(users)
+    return changes
+
+
+def enable(root, host):
+    from .workspace import initialize
+    initialize(root, host)
+    return f'Enabled {host} for all owned workspace skills. Start a new host session and review project trust and /hooks.'
+
+
+def disable(root, host):
+    """Remove only recorded host integrations, preserving canonical resources."""
+    from . import stacks, skills
+    from .brain import locked
+    from .bootstrap import BEGIN, END, MANIFEST, parse_settings
+    from .workspace import read_json
+    if host not in PROVIDERS:
+        raise WorkspaceError('Unknown agent selection')
+    with locked(root):
+        skills.ready(root)
+        entries = stacks.available(root)
+        users = skills.state(root)
+        config = read_config(root)
+        selected = enabled(root, config)
+        if host not in selected:
+            return f'{host.capitalize()} integration already disabled.'
+        state = load_manifest(root)
+        instruction, folder, settings = PROVIDERS[host]
+        changes = {}
+        records = [state['files'], *(e['files'] for e in entries), *users['skills'].values()]
+        for record in records:
+            for path, expected in list(record.items()):
+                if not path.startswith(folder + '/'):
+                    continue
+                current = existing_text(root, path)
+                if current is None or digest(current) != expected:
+                    raise WorkspaceError(f'Owned agent bridge edited or missing: {path}')
+                if path in changes:
+                    raise WorkspaceError(f'Duplicate agent bridge ownership: {path}')
+                changes[path] = None
+                del record[path]
+        previous = state['instructions'].get(instruction)
+        if previous is not None:
+            current = existing_text(root, instruction)
+            if (not isinstance(previous, str) or current is None
+                    or current.count(BEGIN) != 1 or current.count(END) != 1
+                    or previous not in current):
+                raise WorkspaceError(f'Owned instruction block changed or missing: {instruction}')
+            remaining = current.replace(previous, '', 1)
+            changes[instruction] = remaining if remaining.strip() else None
+            del state['instructions'][instruction]
+        hook_records = (('SessionStart', 'hooks'), ('Stop', 'capture_hooks'),
+                        ('UserPromptSubmit', 'policy_hooks'))
+        if any(settings in state[key] for _, key in hook_records):
+            raw = existing_text(root, settings)
+            data = parse_settings(raw) if raw is not None else None
+            if not isinstance(data, dict) or not isinstance(data.get('hooks'), dict):
+                raise WorkspaceError(f'Owned hook settings missing or invalid: {settings}')
+            for event, key in hook_records:
+                previous = state[key].get(settings)
+                if previous is None:
+                    continue
+                values = data['hooks'].get(event)
+                if not isinstance(values, list) or values.count(previous) != 1:
+                    raise WorkspaceError(f'Owned {event} hook changed, duplicated or missing: {settings}')
+                values.remove(previous)
+                if not values:
+                    del data['hooks'][event]
+                del state[key][settings]
+            if not data['hooks']:
+                del data['hooks']
+            # Settings have entry ownership, never whole-file ownership.
+            changes[settings] = encode(data)
+        config['enabled_agents'] = [h for h in selected if h != host]
+        config['adapters'].pop(host, None)
+        owned = read_json(root, '.tdt/state/owned-files.json')
+        if not isinstance(owned, list) or any(not isinstance(p, str) for p in owned):
+            raise WorkspaceError('Invalid owned-files list')
+        changes[MANIFEST] = encode(state)
+        changes['.tdt/config.json'] = encode(config)
+        changes['.tdt/state/owned-files.json'] = encode(sorted(set(owned) -
+            {p for p, value in changes.items() if value is None}))
+        if entries:
+            changes[stacks.REGISTRY] = encode(entries)
+        if users['skills']:
+            changes[skills.STATE] = encode(users)
+        stacks.transaction(root, changes)
+        stacks.prune(root, [p for p, value in changes.items() if value is None])
+    return f'Disabled {host} workspace integration. Start a new host session; canonical skills and brain are preserved.'

thisdamnthing/bootstrap.py

@@ -0,0 +1,360 @@
+"""Preflight and merge owned adapter entries without changing host permissions."""
+
+from copy import deepcopy
+import hashlib
+import json
+from pathlib import Path
+import shlex
+import sys
+
+from .workspace import WorkspaceError, managed_path, read_json, resource_text
+
+MANIFEST = ".tdt/state/bootstrap.json"
+PROVIDERS = {"claude": ("CLAUDE.md", ".claude/skills", ".claude/settings.json"),
+             "codex": ("AGENTS.md", ".agents/skills", ".codex/hooks.json")}
+SKILLS = ("tdt-constitution", "tdt-workspace", "tdt-review-brain", "tdt-search", "tdt-add-project", "tdt-ui", "tdt-install-stack", "tdt-find-skills", "tdt-update-stack", "tdt-remove-stack")
+LEGACY_SKILLS = {name.replace('tdt-', 'tdt.', 1): name for name in SKILLS}
+LEGACY_SKILLS.update({'tdt.ask-brain': 'tdt-search', 'tdt-ask-brain': 'tdt-search'})
+# Original core-only templates had no bootstrap ownership manifest. Adopt only
+# these exact shipped bytes (or today's bytes), never arbitrary user edits.
+LEGACY_STACK_DOCS = {
+    "docs/README.md": "1a61c9f1b17d09bd94ceeb794b7c69737096bfd12a86523e8b7e93b549fea759",
+    '.tdt/contracts/stack.md': '9bceaa545780b68c06aadfe4c32393e45f2a83e8d19428abf7162c9859892d6d',
+    'docs/stacks.md': 'aa6771c1535a4ebf6e227226e7b4b3933b587272a4d44726ab709b8e82840218',
+}
+RESOURCES = {
+    "docs/constitution.md": "docs/constitution.md",
+    ".tdt/hooks/constitution.py": "harness/hooks/constitution.py",
+    ".tdt/skills/tdt-constitution/SKILL.md": "harness/skills/tdt-constitution/SKILL.md",
+    **{f"docs/{name}.md": f"docs/{name}.md" for name in
+       ("README", "getting-started", "troubleshooting", "authoring", "commands", "workspace-care", "core-skills")},
+    ".tdt/contracts/stack.md": "harness/contracts/stack.md",
+    "docs/stacks.md": "docs/stacks.md",
+    **{f".tdt/skills/{name}/SKILL.md": f"harness/skills/{name}/SKILL.md"
+       for name in ("tdt-search", "tdt-add-project", "tdt-install-stack", "tdt-update-stack", "tdt-remove-stack")},
+    ".tdt/skills/tdt-find-skills/SKILL.md": "harness/skills/tdt-find-skills/SKILL.md",
+    "docs/skills.md": "docs/skills.md",
+    "docs/projects.md": "docs/projects.md",
+    ".tdt/hooks/capture.py": "harness/hooks/capture.py",
+    ".tdt/skills/tdt-review-brain/SKILL.md": "harness/skills/tdt-review-brain/SKILL.md",
+    "docs/brain.md": "docs/brain.md",
+    ".tdt/context.md": "harness/context.md",
+    ".tdt/skills/tdt-workspace/SKILL.md": "harness/skills/tdt-workspace/SKILL.md",
+    ".tdt/hooks/session-start.py": "harness/hooks/session-start.py",
+    ".tdt/contracts/capture-event.md": "harness/contracts/capture-event.md",
+    "docs/agent-bootstrap.md": "docs/agent-bootstrap.md",
+}
+BEGIN, END = "<!-- tdt:begin -->", "<!-- tdt:end -->"
+BLOCK = (BEGIN + "\nRead .tdt/context.md at session start. The canonical ThisDamnThing\n"
+         "skills and hooks live under .tdt/. Before each user request, run\n"
+         "`tdt constitution show` and follow the current workspace policy. Report\n"
+         "load failures before affected actions. This is a guidance-only fallback\n"
+         "when request hooks are unavailable. See docs/constitution.md and\n"
+         "docs/agent-bootstrap.md for host\n"
+         "invocation and trust requirements. This workspace starts with zero stacks.\n"
+         "Enable another host with `tdt agent enable claude` or `tdt agent enable codex`.\n"
+         + END)
+
+
+def parse_settings(raw):
+    def unique(pairs):
+        result = {}
+        for key, value in pairs:
+            if key in result:
+                raise WorkspaceError(f"Duplicate provider JSON key: {key}")
+            result[key] = value
+        return result
+    return json.loads(raw, object_pairs_hook=unique)
+
+
+def encode(value):
+    return json.dumps(value, indent=2) + "\n"
+
+
+def digest(text):
+    return hashlib.sha256(text.encode("utf-8")).hexdigest()
+
+
+def existing_text(root, relative):
+    path = managed_path(root, relative)
+    for parent in path.parents:
+        if parent == root.parent:
+            break
+        if parent.exists() and not parent.is_dir():
+            raise WorkspaceError(f"Expected directory: {parent}")
+    if not path.exists():
+        return None
+    if not path.is_file():
+        raise WorkspaceError(f"Expected file: {relative}")
+    return path.read_bytes().decode("utf-8")
+
+
+def load_manifest(root):
+    if not managed_path(root, MANIFEST).exists():
+        return {"format_version": 1, "files": {}, "instructions": {}, "hooks": {}, "capture_hooks": {}, "policy_hooks": {}}
+    data = read_json(root, MANIFEST)
+    if (not isinstance(data, dict) or data.get("format_version") != 1
+            or any(not isinstance(data.get(k), dict)
+                   for k in ("files", "instructions", "hooks"))):
+        raise WorkspaceError("Invalid bootstrap ownership record")
+    data.setdefault("policy_hooks", {})
+    if not isinstance(data["policy_hooks"], dict) or set(data["policy_hooks"]) - {p[2] for p in PROVIDERS.values()}:
+        raise WorkspaceError("Invalid policy hook ownership record")
+    data.setdefault("capture_hooks", {})
+    if not isinstance(data["capture_hooks"], dict):
+        raise WorkspaceError("Invalid capture hook ownership record")
+    # Never use recorded paths to write arbitrary files.
+    allowed_files = {*RESOURCES, *(f"{p[1]}/{skill}/SKILL.md"
+                                   for p in PROVIDERS.values()
+                                   for skill in SKILLS)}
+    for old, new in LEGACY_SKILLS.items():
+        allowed_files.update(path.replace('/' + new + '/', '/' + old + '/')
+                             for path in tuple(allowed_files) if '/' + new + '/' in path)
+    if (set(data["files"]) - allowed_files
+            or set(data["instructions"]) - {"README.md", *(p[0] for p in PROVIDERS.values())}
+            or set(data["hooks"]) - {p[2] for p in PROVIDERS.values()}
+            or set(data["capture_hooks"]) - {p[2] for p in PROVIDERS.values()}):
+        raise WorkspaceError("Unexpected paths in bootstrap ownership record")
+    return data
+
+
+def plan_bootstrap(root, agent, config, owned):
+    """Return all changes only after every requested path and merge is checked."""
+    from .agents import enabled
+    selected = enabled(root, config) if managed_path(root, ".tdt/config.json").exists() else []
+    requested = list(PROVIDERS) if agent == "both" else ([agent] if agent not in (None, "none") else [])
+    selected = list(dict.fromkeys([*selected, *requested]))
+    state = load_manifest(root)
+    pending = {}
+    generated = {target: resource_text(source) for target, source in RESOURCES.items()}
+    config = deepcopy(config)
+    config["enabled_agents"] = selected
+    readme = existing_text(root, "README.md") or ""
+    previous_readme = state["instructions"].get("README.md")
+    guidance = BEGIN + "\n" + resource_text("workspace/README.md").rstrip() + "\n" + END
+    if previous_readme is not None:
+        if (not isinstance(previous_readme, str) or readme.count(BEGIN) != 1
+                or readme.count(END) != 1 or previous_readme not in readme):
+            raise WorkspaceError("Owned README block changed or missing")
+        updated_readme = readme.replace(previous_readme, guidance, 1)
+    else:
+        if BEGIN in readme or END in readme:
+            raise WorkspaceError("Unowned ThisDamnThing README marker")
+        updated_readme = readme + ("\n\n" if readme else "") + guidance + "\n"
+    if readme != updated_readme:
+        pending["README.md"] = updated_readme
+    state["instructions"]["README.md"] = guidance
+    for host in selected:
+        instruction, skills, settings = PROVIDERS[host]
+        if host == "claude":
+            legacy = managed_path(root, ".claude/commands/tdt-workspace.md")
+            if legacy.exists():
+                raise WorkspaceError("Claude command name conflict: .claude/commands/tdt-workspace.md")
+        generated[f"{skills}/tdt-workspace/SKILL.md"] = (
+            "---\nname: tdt-workspace\ndescription: Orient the user in a ThisDamnThing workspace "
+            "and diagnose its core files and agent setup.\n---\n\n"
+            "Read and follow .tdt/skills/tdt-workspace/SKILL.md from the\n"
+            "workspace root (the ancestor containing .tdt/config.json).\n")
+        if host == "claude" and managed_path(root, ".claude/commands/tdt-review-brain.md").exists():
+            raise WorkspaceError("Claude command name conflict: tdt-review-brain")
+        generated[f"{skills}/tdt-review-brain/SKILL.md"] = (
+            "---\nname: tdt-review-brain\ndescription: Review pending knowledge candidates "
+            "and apply explicit user approval, edits or rejection.\n---\n\n"
+            "Read and follow .tdt/skills/tdt-review-brain/SKILL.md from the workspace root.\n")
+        for name, description in (("tdt-update-stack", "Inspect and approve a newer installed stack version."), ("tdt-remove-stack", "Uninstall a selected stack while preserving user work."), ("tdt-constitution", "Define or update workspace permission rules in natural language."), ("tdt-find-skills", "Find reusable workflows in completed workspace sessions and propose skills for approval."), ("tdt-install-stack", "Discover, inspect and install optional workflow stacks."), ("tdt-ui", "Use UI for local browser questions and custom interactive interviews."), ("tdt-search", "Answer using approved linked knowledge with references and honest gaps."),
+                                  ("tdt-add-project", "Register an external project and offer bounded onboarding.")):
+            if host == "claude" and managed_path(root, f".claude/commands/{name}.md").exists():
+                raise WorkspaceError(f"Claude command name conflict: {name}")
+            generated[f"{skills}/{name}/SKILL.md"] = (
+                f"---\nname: {name}\ndescription: {description}\n---\n\n"
+                f"Read and follow .tdt/skills/{name}/SKILL.md from the workspace root.\n")
+        current = existing_text(root, instruction) or ""
+        previous = state["instructions"].get(instruction)
+        if previous is not None:
+            if (not isinstance(previous, str) or current.count(BEGIN) != 1
+                    or current.count(END) != 1 or previous not in current):
+                raise WorkspaceError(f"Owned instruction block changed or missing: {instruction}")
+            updated = current.replace(previous, BLOCK, 1)
+        else:
+            if BEGIN in current or END in current:
+                raise WorkspaceError(f"Unowned ThisDamnThing instruction marker: {instruction}")
+            updated = current + ("\n\n" if current else "") + BLOCK + "\n"
+        if current != updated:
+            pending[instruction] = updated
+        state["instructions"][instruction] = BLOCK
+
+        raw = existing_text(root, settings)
+        data = parse_settings(raw) if raw is not None else {}
+        if not isinstance(data, dict):
+            raise WorkspaceError(f"Expected settings object: {settings}")
+        hooks = data.setdefault("hooks", {})
+        if not isinstance(hooks, dict):
+            raise WorkspaceError(f"Expected hooks object: {settings}")
+        for event, script, record_key in (("SessionStart", "session-start.py", "hooks"),
+                                          ("Stop", "capture.py", "capture_hooks"),
+                                          ("UserPromptSubmit", "constitution.py", "policy_hooks")):
+            entries = hooks.setdefault(event, [])
+            if not isinstance(entries, list) or any(not isinstance(e, dict) for e in entries):
+                raise WorkspaceError(f"Expected {event} object list: {settings}")
+            command = shlex.join([sys.executable, str(root / f".tdt/hooks/{script}"), host])
+            entry = {"hooks": [{"type": "command", "command": command, "timeout": 10}]}
+            if host == "codex" and event in ("UserPromptSubmit", "SessionStart"):
+                entry["hooks"][0]["additionalContextLimit"] = 10000
+            previous = state[record_key].get(settings)
+            if previous is not None:
+                if entries.count(previous) != 1:
+                    raise WorkspaceError(f"Owned {event} hook changed, duplicated or missing: {settings}")
+                index = entries.index(previous)
+                others = entries[:index] + entries[index + 1:]
+            else:
+                index, others = len(entries), entries
+            if any(".tdt/" in json.dumps(e) for e in others):
+                raise WorkspaceError(f"Unowned ThisDamnThing hook conflict: {settings}")
+            if previous is None:
+                entries.append(entry)
+            else:
+                entries[index] = entry
+            state[record_key][settings] = entry
+        if raw is None or parse_settings(raw) != data:
+            pending[settings] = encode(data)
+        config["adapters"][host] = {"bootstrap_version": 1,
+                                    "capture": "Stop continuation; runtime unverified"}
+
+    # Rename only hash-verified files that this bootstrap already owns. Keep
+    # unselected hosts discoverable too, without changing their settings/hooks.
+    for relative, expected in list(state['files'].items()):
+        replacement = relative
+        for old, new in LEGACY_SKILLS.items():
+            replacement = replacement.replace('/' + old + '/', '/' + new + '/')
+        if replacement == relative:
+            continue
+        current = existing_text(root, relative)
+        if current is None or digest(current) != expected:
+            raise WorkspaceError(f'Owned legacy skill changed or missing: {relative}')
+        for old, new in LEGACY_SKILLS.items():
+            current = current.replace(old, new)
+        generated.setdefault(replacement, current)
+        pending[relative] = None
+        del state['files'][relative]
+
+    for relative, content in generated.items():
+        if relative.startswith('.claude/skills/'):
+            name = Path(relative).parent.name
+            if managed_path(root, f'.claude/commands/{name}.md').exists():
+                raise WorkspaceError(f'Claude command name conflict: {name}')
+        current = existing_text(root, relative)
+        previous = state["files"].get(relative)
+        if previous is not None:
+            if current is None or digest(current) != previous:
+                raise WorkspaceError(f"Owned bootstrap file changed or missing: {relative}")
+        elif current is not None and not (relative in LEGACY_STACK_DOCS
+                and digest(current) in (digest(content), LEGACY_STACK_DOCS[relative])):
+            raise WorkspaceError(f"Bootstrap name conflict; existing file preserved: {relative}")
+        # Reserve skill directories as a whole to avoid hijacking existing skills.
+        if relative.endswith("/SKILL.md") and previous is None:
+            parent = managed_path(root, str(Path(relative).parent))
+            if parent.exists():
+                raise WorkspaceError(f"Bootstrap skill directory conflict: {parent}")
+        if current != content:
+            pending[relative] = content
+        state["files"][relative] = digest(content)
+    if not isinstance(owned, list) or any(not isinstance(v, str) for v in owned):
+        raise WorkspaceError("Invalid owned-files list")
+    pending[MANIFEST] = encode(state)
+    pending[".tdt/state/owned-files.json"] = encode(sorted((set(owned) | {
+        *state["files"], MANIFEST}) - {p for p, text in pending.items() if text is None}))
+    pending[".tdt/config.json"] = encode(config)
+    # Includes manifests and state; fail before the first write on all path conflicts.
+    for relative in pending:
+        existing_text(root, relative)
+    return pending
+
+
+def diagnose_adapters(root, config):
+    lines, healthy = [], True
+    state = {}
+    try:
+        state = load_manifest(root)
+        for relative, expected in state["files"].items():
+            current = existing_text(root, relative)
+            if current is None or digest(current) != expected:
+                raise WorkspaceError(f"Bootstrap file missing or changed: {relative}")
+        for relative, block in state["instructions"].items():
+            current = existing_text(root, relative) or ""
+            if (not isinstance(block, str) or block not in current
+                    or current.count(BEGIN) != 1 or current.count(END) != 1):
+                raise WorkspaceError(f"Bootstrap instruction missing or changed: {relative}")
+        recorded_hooks = [(relative, entry, "SessionStart", "session-start.py")
+                          for relative, entry in state["hooks"].items()]
+        recorded_hooks += [(relative, entry, "Stop", "capture.py")
+                           for relative, entry in state["capture_hooks"].items()]
+        recorded_hooks += [(relative, entry, "UserPromptSubmit", "constitution.py")
+                           for relative, entry in state["policy_hooks"].items()]
+        for relative, entry, event, script in recorded_hooks:
+            raw = existing_text(root, relative)
+            if raw is None:
+                raise WorkspaceError(f"Missing hook configuration: {relative}")
+            data = parse_settings(raw)
+            hooks = data.get("hooks", {}) if isinstance(data, dict) else {}
+            entries = hooks.get(event, []) if isinstance(hooks, dict) else []
+            if not isinstance(entries, list) or entries.count(entry) != 1:
+                raise WorkspaceError(f"{event} hook missing or changed: {relative}")
+            try:
+                handler = entry["hooks"][0]
+                argv = shlex.split(handler["command"])
+                if (len(argv) != 3 or not Path(argv[0]).is_file()
+                        or argv[1] != str(root / f".tdt/hooks/{script}")):
+                    raise ValueError("stale Python or workspace path")
+            except (KeyError, IndexError, TypeError, ValueError) as exc:
+                raise WorkspaceError(f"Invalid startup command in {relative}; "
+                                     "rerun init --agent for this host") from exc
+            if data.get("disableAllHooks") is True:
+                lines.append(f"WARNING: hooks disabled in {relative}")
+                healthy = False
+        from .agents import enabled, detected
+        selected, installed = enabled(root, config), detected()
+        for host, (instruction, skills, settings) in PROVIDERS.items():
+            executable = "found on PATH" if host in installed else "not found on PATH"
+            lines.append(f"{host.capitalize()} executable: {executable}")
+            if host not in selected:
+                lines.append(f"{host.capitalize()} integration: disabled; use tdt agent enable {host}")
+                continue
+            adapter = config["adapters"].get(host)
+            if not isinstance(adapter, dict) or adapter.get("bootstrap_version") != 1:
+                raise WorkspaceError(f"{host} ownership recognized but adapter needs refresh; run tdt agent enable {host}")
+            if (instruction not in state["instructions"] or settings not in state["hooks"]
+                    or settings not in state["capture_hooks"]
+                    or settings not in state["policy_hooks"]
+                    or f"{skills}/tdt-review-brain/SKILL.md" not in state["files"]
+                    or f"{skills}/tdt-workspace/SKILL.md" not in state["files"]
+                    or any(f"{skills}/{name}/SKILL.md" not in state["files"] for name in SKILLS)
+                    or not set(RESOURCES).issubset(state["files"])):
+                raise WorkspaceError(f"Incomplete {host} bootstrap ownership record")
+            lines.append(f"{host.capitalize()} integration: enabled; files installed; runtime unverified")
+            if host == "codex":
+                lines.append("  Trust required: trusted project layer and review SessionStart, UserPromptSubmit and Stop hooks in /hooks.")
+            else:
+                lines.append("  Review project trust and /hooks; host or managed settings may disable hooks.")
+    except (WorkspaceError, ValueError, OSError) as exc:
+        lines.append(f"ERROR: {exc}")
+        healthy = False
+    lines.append("Automatic capture: Stop continuation installed; requires live host trust"
+                 if state.get("capture_hooks") else "Automatic capture: no Stop hooks installed")
+    from .constitution import load as load_policy
+    try:
+        policy = load_policy(root)
+        lines.append("Workspace constitution: " + policy["sha256"] + "; guidance only, live request delivery unverified")
+    except (WorkspaceError, ValueError, OSError) as exc:
+        lines.append(f"ERROR: workspace constitution: {exc}")
+        healthy = False
+    from .brain import candidates
+    try:
+        pending = len(candidates(root))
+        requests = managed_path(root, ".tdt/state/captures")
+        incomplete = sum(read_json(root, str(p.relative_to(root))).get("status") == "requested"
+                         for p in requests.glob("*.json"))
+        lines.append(f"Brain: {pending} pending candidates; {incomplete} incomplete capture requests")
+    except (WorkspaceError, ValueError, OSError) as exc:
+        lines.append(f"ERROR: brain state: {exc}")
+        healthy = False
+    return lines, healthy