Health Check

#!/usr/bin/env bash
# Check Hooks Configuration
# Validates hook commands and timeouts from Claude Code settings files.
# Usage: bash check-hooks.sh --home-dir <path> --project-dir <path> [--verbose]

set -uo pipefail

home_dir=""
project_dir=""
verbose_mode=false

while [ $# -gt 0 ]; do
  case "$1" in
    --home-dir) home_dir="$2"; shift 2 ;;
    --project-dir) project_dir="$2"; shift 2 ;;
    --verbose) verbose_mode=true; shift ;;
    *) shift ;;
  esac
done

: "${home_dir:=$HOME}"
: "${project_dir:=$(pwd)}"

echo "=== HOOKS CONFIGURATION ==="

issue_count=0
check_status="OK"
issues_list=""
total_hooks=0

# Check jq availability
if ! command -v jq >/dev/null 2>&1; then
  echo "JQ_AVAILABLE=false"
  echo "STATUS=ERROR"
  echo "ISSUE_COUNT=1"
  echo "ISSUES:"
  echo "  - SEVERITY=ERROR TYPE=missing_tool MSG=jq is required but not installed"
  echo "=== END HOOKS CONFIGURATION ==="
  exit 1
fi

# Settings files that may contain hooks
settings_files=(
  "${home_dir}/.claude/settings.json"
  "${project_dir}/.claude/settings.json"
  "${home_dir}/.claude/settings.local.json"
  "${project_dir}/.claude/settings.local.json"
)

for settings_file in "${settings_files[@]}"; do
  if [ ! -f "$settings_file" ]; then
    continue
  fi

  # Check if hooks key exists
  has_hooks=$(jq 'has("hooks")' "$settings_file" 2>/dev/null || echo "false")
  if [ "$has_hooks" != "true" ]; then
    continue
  fi

  # Get hook event names
  hook_events=$(jq -r '.hooks | keys[]' "$settings_file" 2>/dev/null)

  while IFS= read -r event_name; do
    [ -z "$event_name" ] && continue

    # Get hooks array for this event
    hook_count=$(jq -r ".hooks[\"${event_name}\"] | length" "$settings_file" 2>/dev/null || echo "0")

    for ((i=0; i<hook_count; i++)); do
      # Get hook entries for this event item
      entry_hooks=$(jq -r ".hooks[\"${event_name}\"][$i].hooks | length" "$settings_file" 2>/dev/null || echo "0")

      for ((j=0; j<entry_hooks; j++)); do
        total_hooks=$((total_hooks + 1))

        hook_type=$(jq -r ".hooks[\"${event_name}\"][$i].hooks[$j].type // \"unknown\"" "$settings_file" 2>/dev/null)
        hook_command=$(jq -r ".hooks[\"${event_name}\"][$i].hooks[$j].command // \"\"" "$settings_file" 2>/dev/null)
        hook_timeout=$(jq -r ".hooks[\"${event_name}\"][$i].hooks[$j].timeout // \"default\"" "$settings_file" 2>/dev/null)
        hook_matcher=$(jq -r ".hooks[\"${event_name}\"][$i].matcher // \"*\"" "$settings_file" 2>/dev/null)

        if [ "$verbose_mode" = true ]; then
          echo "HOOK: event=${event_name} matcher=${hook_matcher} type=${hook_type} timeout=${hook_timeout} file=${settings_file}"
          [ -n "$hook_command" ] && echo "  COMMAND=${hook_command}"
        fi

        # Validate command exists (for command-type hooks)
        if [ "$hook_type" = "command" ] && [ -n "$hook_command" ]; then
          # Extract the base tool from the command (first word)
          base_tool=$(echo "$hook_command" | awk '{print $1}' | sed 's/"//g')

          if [ "$base_tool" != "bash" ] && ! command -v "$base_tool" >/dev/null 2>&1; then
            # Check if it's a file path
            if [ ! -f "$base_tool" ]; then
              issues_list="${issues_list}  - SEVERITY=WARN TYPE=missing_command EVENT=${event_name} COMMAND=${base_tool} FILE=${settings_file}\n"
              issue_count=$((issue_count + 1))
              [ "$check_status" = "OK" ] && check_status="WARN"
            fi
          fi
        fi

        # Flag high timeouts (over 60 seconds)
        if [ "$hook_timeout" != "default" ] && [ "$hook_timeout" != "null" ]; then
          timeout_ms="${hook_timeout}"
          if [ "$timeout_ms" -gt 60000 ] 2>/dev/null; then
            issues_list="${issues_list}  - SEVERITY=WARN TYPE=high_timeout EVENT=${event_name} TIMEOUT=${timeout_ms}ms FILE=${settings_file}\n"
            issue_count=$((issue_count + 1))
            [ "$check_status" = "OK" ] && check_status="WARN"
          fi
        fi
      done
    done
  done <<< "$hook_events"
done

if [ "$total_hooks" -eq 0 ]; then
  echo "HOOKS_CONFIGURED=false"
  check_status="N_A"
else
  echo "HOOKS_CONFIGURED=true"
fi

echo "HOOK_COUNT=${total_hooks}"
echo "STATUS=${check_status}"
echo "ISSUE_COUNT=${issue_count}"
if [ -n "$issues_list" ]; then
  echo "ISSUES:"
  echo -e "$issues_list" | sed '/^$/d'
fi
echo "=== END HOOKS CONFIGURATION ==="

#!/usr/bin/env bash
# Check MCP Server Configuration
# Validates MCP servers from .mcp.json and settings files.
# Usage: bash check-mcp.sh --home-dir <path> --project-dir <path> [--verbose]

set -uo pipefail

home_dir=""
project_dir=""
verbose_mode=false

while [ $# -gt 0 ]; do
  case "$1" in
    --home-dir) home_dir="$2"; shift 2 ;;
    --project-dir) project_dir="$2"; shift 2 ;;
    --verbose) verbose_mode=true; shift ;;
    *) shift ;;
  esac
done

: "${home_dir:=$HOME}"
: "${project_dir:=$(pwd)}"

echo "=== MCP SERVERS ==="

issue_count=0
check_status="OK"
issues_list=""
server_count=0

# Check jq availability
if ! command -v jq >/dev/null 2>&1; then
  echo "JQ_AVAILABLE=false"
  echo "STATUS=ERROR"
  echo "ISSUE_COUNT=1"
  echo "ISSUES:"
  echo "  - SEVERITY=ERROR TYPE=missing_tool MSG=jq is required but not installed"
  echo "=== END MCP SERVERS ==="
  exit 1
fi

# MCP configuration sources
mcp_sources=(
  "${home_dir}/.mcp.json"
  "${project_dir}/.mcp.json"
)

echo "MCP_SOURCES:"
for mcp_file in "${mcp_sources[@]}"; do
  if [ -f "$mcp_file" ]; then
    echo "  - FILE=${mcp_file} EXISTS=true"

    # Validate JSON
    json_error=$(jq empty "$mcp_file" 2>&1)
    if [ $? -ne 0 ]; then
      echo "    VALID=false ERROR=${json_error}"
      issues_list="${issues_list}  - SEVERITY=ERROR TYPE=invalid_json FILE=${mcp_file} MSG=${json_error}\n"
      issue_count=$((issue_count + 1))
      check_status="ERROR"
      continue
    fi

    # List servers
    server_keys=$(jq -r '.mcpServers // {} | keys[]' "$mcp_file" 2>/dev/null)
    while IFS= read -r server_name; do
      [ -z "$server_name" ] && continue
      server_count=$((server_count + 1))

      server_command=$(jq -r ".mcpServers[\"${server_name}\"].command // \"\"" "$mcp_file" 2>/dev/null)
      server_args=$(jq -r ".mcpServers[\"${server_name}\"].args // [] | join(\" \")" "$mcp_file" 2>/dev/null)

      if [ "$verbose_mode" = true ]; then
        echo "  SERVER: name=${server_name} command=${server_command} args=${server_args}"
      fi

      # Validate command exists
      if [ -n "$server_command" ]; then
        if ! command -v "$server_command" >/dev/null 2>&1; then
          issues_list="${issues_list}  - SEVERITY=WARN TYPE=missing_command SERVER=${server_name} COMMAND=${server_command} FILE=${mcp_file}\n"
          issue_count=$((issue_count + 1))
          [ "$check_status" = "OK" ] && check_status="WARN"
        fi
      fi

      # Check for required environment variables
      env_keys=$(jq -r ".mcpServers[\"${server_name}\"].env // {} | keys[]" "$mcp_file" 2>/dev/null)
      while IFS= read -r env_key; do
        [ -z "$env_key" ] && continue
        env_value=$(jq -r ".mcpServers[\"${server_name}\"].env[\"${env_key}\"]" "$mcp_file" 2>/dev/null)
        # Check if env var is empty or references an unset variable
        if [ -z "$env_value" ] || [ "$env_value" = "null" ]; then
          if [ -z "${!env_key:-}" ]; then
            issues_list="${issues_list}  - SEVERITY=WARN TYPE=missing_env SERVER=${server_name} VAR=${env_key} FILE=${mcp_file}\n"
            issue_count=$((issue_count + 1))
            [ "$check_status" = "OK" ] && check_status="WARN"
          fi
        fi
      done <<< "$env_keys"
    done <<< "$server_keys"
  else
    echo "  - FILE=${mcp_file} EXISTS=false"
  fi
done

# Check settings files for enabledMcpjsonServers
settings_files=(
  "${home_dir}/.claude/settings.json"
  "${project_dir}/.claude/settings.json"
)

for settings_file in "${settings_files[@]}"; do
  if [ -f "$settings_file" ]; then
    mcp_enabled=$(jq -r '.enabledMcpjsonServers // {} | length' "$settings_file" 2>/dev/null || echo "0")
    if [ "$mcp_enabled" -gt 0 ]; then
      echo "ENABLED_MCP_SERVERS_IN=$(basename "$(dirname "$settings_file")")/$(basename "$settings_file") COUNT=${mcp_enabled}"
      if [ "$verbose_mode" = true ]; then
        jq -r '.enabledMcpjsonServers // {} | to_entries[] | "  ENABLED: \(.key)=\(.value)"' "$settings_file" 2>/dev/null
      fi
    fi
  fi
done

if [ "$server_count" -eq 0 ]; then
  echo "MCP_CONFIGURED=false"
  check_status="N_A"
else
  echo "MCP_CONFIGURED=true"
fi

echo "SERVER_COUNT=${server_count}"
echo "STATUS=${check_status}"
echo "ISSUE_COUNT=${issue_count}"
if [ -n "$issues_list" ]; then
  echo "ISSUES:"
  echo -e "$issues_list" | sed '/^$/d'
fi
echo "=== END MCP SERVERS ==="

#!/usr/bin/env bash
# Check Plugin Registry
# Validates installed_plugins.json for orphaned entries, scope conflicts,
# and mismatches between installed and enabled plugins.
# Usage: bash check-plugins.sh --home-dir <path> --project-dir <path> [--fix] [--verbose]

set -uo pipefail

home_dir=""
project_dir=""
fix_mode=false
verbose_mode=false

while [ $# -gt 0 ]; do
  case "$1" in
    --home-dir) home_dir="$2"; shift 2 ;;
    --project-dir) project_dir="$2"; shift 2 ;;
    --fix) fix_mode=true; shift ;;
    --verbose) verbose_mode=true; shift ;;
    *) shift ;;
  esac
done

: "${home_dir:=$HOME}"
: "${project_dir:=$(pwd)}"

echo "=== PLUGIN REGISTRY ==="

registry_file="${home_dir}/.claude/plugins/installed_plugins.json"
user_settings="${home_dir}/.claude/settings.json"

issue_count=0
check_status="OK"
issues_list=""

# Check jq availability
if ! command -v jq >/dev/null 2>&1; then
  echo "JQ_AVAILABLE=false"
  echo "STATUS=ERROR"
  echo "ISSUE_COUNT=1"
  echo "ISSUES:"
  echo "  - SEVERITY=ERROR TYPE=missing_tool MSG=jq is required but not installed"
  echo "=== END PLUGIN REGISTRY ==="
  exit 1
fi

# Check registry exists
if [ ! -f "$registry_file" ]; then
  echo "REGISTRY_EXISTS=false"
  echo "REGISTRY_PATH=${registry_file}"
  echo "STATUS=WARN"
  echo "ISSUE_COUNT=1"
  echo "ISSUES:"
  echo "  - SEVERITY=WARN TYPE=missing_registry MSG=Plugin registry file not found"
  echo "=== END PLUGIN REGISTRY ==="
  exit 0
fi

echo "REGISTRY_EXISTS=true"
echo "REGISTRY_PATH=${registry_file}"

# Validate JSON syntax
json_error=$(jq empty "$registry_file" 2>&1)
if [ $? -ne 0 ]; then
  echo "REGISTRY_VALID=false"
  echo "STATUS=ERROR"
  echo "ISSUE_COUNT=1"
  echo "ISSUES:"
  echo "  - SEVERITY=ERROR TYPE=invalid_json MSG=${json_error}"
  echo "=== END PLUGIN REGISTRY ==="
  exit 1
fi

echo "REGISTRY_VALID=true"

# Count plugins (tr -d '\r' to strip Windows CR from jq output)
plugin_count=$(jq '.plugins | length' "$registry_file" 2>/dev/null | tr -d '\r' || echo "0")
echo "PLUGIN_COUNT=${plugin_count}"

# Count by scope
project_scoped=0
global_scoped=0
orphaned_count=0

# Extract plugin entries with project paths.
# tr -d '\r' strips CR line endings that jq emits on Windows; without it,
# every key but the last carries a trailing \r and breaks subsequent lookups.
plugin_keys=$(jq -r '.plugins | keys[]' "$registry_file" 2>/dev/null | tr -d '\r')

while IFS= read -r plugin_key; do
  [ -z "$plugin_key" ] && continue

  plugin_path=$(jq -r ".plugins[\"${plugin_key}\"][0].projectPath // \"\"" "$registry_file" 2>/dev/null | tr -d '\r')

  if [ -n "$plugin_path" ]; then
    project_scoped=$((project_scoped + 1))

    # Check if project path exists
    if [ ! -d "$plugin_path" ]; then
      orphaned_count=$((orphaned_count + 1))
      issues_list="${issues_list}  - SEVERITY=WARN TYPE=orphaned PLUGIN=${plugin_key} PATH=${plugin_path}\n"
      issue_count=$((issue_count + 1))
      [ "$check_status" = "OK" ] && check_status="WARN"
    fi
  else
    global_scoped=$((global_scoped + 1))
  fi

  if [ "$verbose_mode" = true ]; then
    plugin_source=$(jq -r ".plugins[\"${plugin_key}\"][0].source // \"unknown\"" "$registry_file" 2>/dev/null)
    plugin_scope=$(jq -r ".plugins[\"${plugin_key}\"][0].scope // \"user\"" "$registry_file" 2>/dev/null)
    echo "PLUGIN: name=${plugin_key} scope=${plugin_scope} source=${plugin_source}"
  fi
done <<< "$plugin_keys"

echo "PROJECT_SCOPED=${project_scoped}"
echo "GLOBAL_SCOPED=${global_scoped}"
echo "ORPHANED_ENTRIES=${orphaned_count}"

# Check enabled plugins vs installed plugins
if [ -f "$user_settings" ]; then
  enabled_count=$(jq '.enabledPlugins // {} | length' "$user_settings" 2>/dev/null | tr -d '\r' || echo "0")
  echo "ENABLED_IN_SETTINGS=${enabled_count}"

  # Find enabled but not installed (tr -d '\r' for Windows CRLF, see comment above)
  enabled_keys=$(jq -r '.enabledPlugins // {} | keys[]' "$user_settings" 2>/dev/null | tr -d '\r')
  while IFS= read -r enabled_key; do
    [ -z "$enabled_key" ] && continue
    if ! jq -e ".plugins[\"${enabled_key}\"]" "$registry_file" >/dev/null 2>&1; then
      issues_list="${issues_list}  - SEVERITY=WARN TYPE=enabled_not_installed PLUGIN=${enabled_key}\n"
      issue_count=$((issue_count + 1))
      [ "$check_status" = "OK" ] && check_status="WARN"
    fi
  done <<< "$enabled_keys"

  # Find disabled plugins (tr -d '\r' so the numeric compare below works on Windows)
  disabled_count=$(jq '[.enabledPlugins // {} | to_entries[] | select(.value == false)] | length' "$user_settings" 2>/dev/null | tr -d '\r' || echo "0")
  if [ "$disabled_count" -gt 0 ]; then
    echo "DISABLED_PLUGINS=${disabled_count}"
    if [ "$verbose_mode" = true ]; then
      jq -r '.enabledPlugins // {} | to_entries[] | select(.value == false) | .key' "$user_settings" 2>/dev/null | tr -d '\r' | while IFS= read -r disabled_name; do
        echo "  DISABLED: ${disabled_name}"
      done
    fi
  fi
fi

# Fix mode: remove orphaned entries
if [ "$fix_mode" = true ] && [ "$orphaned_count" -gt 0 ]; then
  echo "FIX_MODE=true"

  # Create backup
  backup_file="${registry_file}.backup.$(date -u +%Y%m%dT%H%M%SZ)"
  cp "$registry_file" "$backup_file"
  echo "BACKUP_CREATED=${backup_file}"

  # Build jq filter to remove orphaned entries
  jq_filter='.plugins'
  while IFS= read -r plugin_key; do
    [ -z "$plugin_key" ] && continue
    plugin_path=$(jq -r ".plugins[\"${plugin_key}\"][0].projectPath // \"\"" "$registry_file" 2>/dev/null | tr -d '\r')
    if [ -n "$plugin_path" ] && [ ! -d "$plugin_path" ]; then
      jq_filter="${jq_filter} | del(.\"${plugin_key}\")"
      echo "FIX_REMOVED=${plugin_key}"
    fi
  done <<< "$plugin_keys"

  # Apply fix
  jq ".plugins = (${jq_filter})" "$registry_file" > "${registry_file}.tmp" && mv "${registry_file}.tmp" "$registry_file"
  echo "FIX_APPLIED=true"
  echo "FIX_ORPHANS_REMOVED=${orphaned_count}"
fi

echo "STATUS=${check_status}"
echo "ISSUE_COUNT=${issue_count}"
if [ -n "$issues_list" ]; then
  echo "ISSUES:"
  echo -e "$issues_list" | sed '/^$/d'
fi
echo "FIX_SUPPORTED=true"
echo "=== END PLUGIN REGISTRY ==="

#!/usr/bin/env bash
# Check Runtime State (~/.claude.json)
# Audits the harness runtime state file for stale entries:
#   - projects[] keys pointing at deleted directories
#   - githubRepoPaths[*] entries referencing deleted worktrees
#   - disabledMcpServers[] referencing servers no longer in mcpServers
#   - duplicate / non-canonical MCP naming (bare vs plugin:scope:name)
#
# Read-only audit. Does not write to ~/.claude.json. Prints suggested
# follow-up jq invocations the operator can run after closing other
# Claude Code sessions (the harness rewrites this file during sessions).
#
# Usage: bash check-runtime.sh --home-dir <path> --project-dir <path> [--verbose]

set -uo pipefail

home_dir=""
project_dir=""
verbose_mode=false

while [ $# -gt 0 ]; do
  case "$1" in
    --home-dir) home_dir="$2"; shift 2 ;;
    --project-dir) project_dir="$2"; shift 2 ;;
    --verbose) verbose_mode=true; shift ;;
    *) shift ;;
  esac
done

: "${home_dir:=$HOME}"
: "${project_dir:=$(pwd)}"

echo "=== RUNTIME STATE ==="

runtime_file="${home_dir}/.claude.json"
issue_count=0
check_status="OK"
issues_list=""

# Check jq availability (shared convention with sibling scripts)
if ! command -v jq >/dev/null 2>&1; then
  echo "JQ_AVAILABLE=false"
  echo "STATUS=ERROR"
  echo "ISSUE_COUNT=1"
  echo "ISSUES:"
  echo "  - SEVERITY=ERROR TYPE=missing_tool MSG=jq is required but not installed"
  echo "=== END RUNTIME STATE ==="
  exit 1
fi

# Check runtime file exists
if [ ! -f "$runtime_file" ]; then
  echo "RUNTIME_EXISTS=false"
  echo "RUNTIME_PATH=${runtime_file}"
  echo "STATUS=WARN"
  echo "ISSUE_COUNT=1"
  echo "ISSUES:"
  echo "  - SEVERITY=WARN TYPE=missing_runtime MSG=~/.claude.json not found (no sessions recorded yet)"
  echo "=== END RUNTIME STATE ==="
  exit 0
fi

echo "RUNTIME_EXISTS=true"
echo "RUNTIME_PATH=${runtime_file}"

# Validate JSON syntax
json_error=$(jq empty "$runtime_file" 2>&1)
jq_rc=$?
if [ $jq_rc -ne 0 ]; then
  echo "RUNTIME_VALID=false"
  echo "STATUS=ERROR"
  echo "ISSUE_COUNT=1"
  echo "ISSUES:"
  echo "  - SEVERITY=ERROR TYPE=invalid_json FILE=${runtime_file} MSG=${json_error}"
  echo "=== END RUNTIME STATE ==="
  exit 1
fi
echo "RUNTIME_VALID=true"

# File size in bytes (informational; correlates with cruft accumulation)
runtime_size=$(wc -c <"$runtime_file" | tr -d ' ')
echo "RUNTIME_SIZE_BYTES=${runtime_size}"

# 1. Dead projects[] entries -------------------------------------------------
projects_total=0
projects_dead=0
dead_projects=""

if jq -e 'has("projects")' "$runtime_file" >/dev/null 2>&1; then
  projects_total=$(jq -r '.projects // {} | length' "$runtime_file" 2>/dev/null || echo "0")
  # Each key in .projects is an absolute directory path
  while IFS= read -r project_path; do
    [ -z "$project_path" ] && continue
    if [ ! -d "$project_path" ]; then
      projects_dead=$((projects_dead + 1))
      dead_projects="${dead_projects}${project_path}\n"
      if [ "$verbose_mode" = true ]; then
        issues_list="${issues_list}  - SEVERITY=WARN TYPE=dead_project PATH=${project_path}\n"
      fi
    fi
  done < <(jq -r '.projects // {} | keys[]' "$runtime_file" 2>/dev/null)
fi

echo "PROJECTS_TOTAL=${projects_total}"
echo "PROJECTS_DEAD=${projects_dead}"

if [ "$projects_dead" -gt 0 ]; then
  issue_count=$((issue_count + projects_dead))
  [ "$check_status" = "OK" ] && check_status="WARN"
  if [ "$verbose_mode" = false ]; then
    issues_list="${issues_list}  - SEVERITY=WARN TYPE=dead_projects COUNT=${projects_dead} MSG=projects[] keys pointing at deleted directories (use --verbose to list)\n"
  fi
fi

# 2. Dead githubRepoPaths[*] entries ----------------------------------------
gh_paths_total=0
gh_paths_dead=0

if jq -e 'has("githubRepoPaths")' "$runtime_file" >/dev/null 2>&1; then
  # githubRepoPaths shape: { "<repo>": ["/path1", "/path2", ...], ... }
  # OR a flat array of paths. Handle both.
  gh_kind=$(jq -r '.githubRepoPaths | type' "$runtime_file" 2>/dev/null)
  case "$gh_kind" in
    object)
      gh_paths_total=$(jq -r '[.githubRepoPaths // {} | .[] | .[]?] | length' "$runtime_file" 2>/dev/null || echo "0")
      while IFS= read -r gh_path; do
        [ -z "$gh_path" ] && continue
        if [ ! -d "$gh_path" ]; then
          gh_paths_dead=$((gh_paths_dead + 1))
          if [ "$verbose_mode" = true ]; then
            issues_list="${issues_list}  - SEVERITY=WARN TYPE=dead_gh_path PATH=${gh_path}\n"
          fi
        fi
      done < <(jq -r '[.githubRepoPaths // {} | .[] | .[]?] | .[]' "$runtime_file" 2>/dev/null)
      ;;
    array)
      gh_paths_total=$(jq -r '.githubRepoPaths | length' "$runtime_file" 2>/dev/null || echo "0")
      while IFS= read -r gh_path; do
        [ -z "$gh_path" ] && continue
        if [ ! -d "$gh_path" ]; then
          gh_paths_dead=$((gh_paths_dead + 1))
          if [ "$verbose_mode" = true ]; then
            issues_list="${issues_list}  - SEVERITY=WARN TYPE=dead_gh_path PATH=${gh_path}\n"
          fi
        fi
      done < <(jq -r '.githubRepoPaths[]' "$runtime_file" 2>/dev/null)
      ;;
  esac
fi

echo "GH_PATHS_TOTAL=${gh_paths_total}"
echo "GH_PATHS_DEAD=${gh_paths_dead}"

if [ "$gh_paths_dead" -gt 0 ]; then
  issue_count=$((issue_count + gh_paths_dead))
  [ "$check_status" = "OK" ] && check_status="WARN"
  if [ "$verbose_mode" = false ]; then
    issues_list="${issues_list}  - SEVERITY=WARN TYPE=dead_gh_paths COUNT=${gh_paths_dead} MSG=githubRepoPaths entries referencing deleted directories (use --verbose to list)\n"
  fi
fi

# 3. Orphaned disabledMcpServers --------------------------------------------
# Global mcpServers keys form the "live" set. Per-project disabledMcpServers
# entries that name a server not in the live set are orphans.
orphaned_disabled=0

if jq -e 'has("projects") and has("mcpServers")' "$runtime_file" >/dev/null 2>&1; then
  # Build space-separated list of live server names
  live_servers=$(jq -r '.mcpServers // {} | keys[]' "$runtime_file" 2>/dev/null | tr '\n' ' ')

  # Walk projects[]/disabledMcpServers[]
  while IFS=$'\t' read -r project_path disabled_name; do
    [ -z "$disabled_name" ] && continue
    # Membership test: is disabled_name in live_servers?
    case " ${live_servers} " in
      *" ${disabled_name} "*) ;;
      *)
        orphaned_disabled=$((orphaned_disabled + 1))
        if [ "$verbose_mode" = true ]; then
          issues_list="${issues_list}  - SEVERITY=WARN TYPE=orphan_disabled_mcp PROJECT=${project_path} SERVER=${disabled_name}\n"
        fi
        ;;
    esac
  done < <(jq -r '
    .projects // {}
    | to_entries[]
    | . as $p
    | (.value.disabledMcpServers // [])[]
    | [$p.key, .] | @tsv
  ' "$runtime_file" 2>/dev/null)
fi

echo "ORPHAN_DISABLED_MCP=${orphaned_disabled}"

if [ "$orphaned_disabled" -gt 0 ]; then
  issue_count=$((issue_count + orphaned_disabled))
  [ "$check_status" = "OK" ] && check_status="WARN"
  if [ "$verbose_mode" = false ]; then
    issues_list="${issues_list}  - SEVERITY=WARN TYPE=orphan_disabled_mcp COUNT=${orphaned_disabled} MSG=disabledMcpServers refer to servers no longer in global mcpServers (use --verbose to list)\n"
  fi
fi

# 4. Duplicate / non-canonical MCP names ------------------------------------
# When both "foo" and "plugin:<scope>:foo" appear across mcpServers /
# disabledMcpServers, the bare form is a migration artifact.
duplicate_mcp=0

if jq -e 'has("mcpServers") or has("projects")' "$runtime_file" >/dev/null 2>&1; then
  # Collect every MCP name referenced anywhere, dedupe.
  all_names=$(jq -r '
    [
      (.mcpServers // {} | keys[]),
      (.projects // {} | .[] | (.mcpServers // {} | keys[])?),
      (.projects // {} | .[] | (.disabledMcpServers // [])[]?)
    ] | unique | .[]
  ' "$runtime_file" 2>/dev/null)

  # For every "plugin:<scope>:<name>", if the bare "<name>" also appears,
  # flag the bare form as a duplicate.
  while IFS= read -r mcp_name; do
    [ -z "$mcp_name" ] && continue
    case "$mcp_name" in
      plugin:*:*)
        bare="${mcp_name##*:}"
        if echo "$all_names" | grep -qxF "$bare"; then
          duplicate_mcp=$((duplicate_mcp + 1))
          if [ "$verbose_mode" = true ]; then
            issues_list="${issues_list}  - SEVERITY=WARN TYPE=duplicate_mcp BARE=${bare} NAMESPACED=${mcp_name}\n"
          fi
        fi
        ;;
    esac
  done <<< "$all_names"
fi

echo "DUPLICATE_MCP=${duplicate_mcp}"

if [ "$duplicate_mcp" -gt 0 ]; then
  issue_count=$((issue_count + duplicate_mcp))
  [ "$check_status" = "OK" ] && check_status="WARN"
  if [ "$verbose_mode" = false ]; then
    issues_list="${issues_list}  - SEVERITY=WARN TYPE=duplicate_mcp COUNT=${duplicate_mcp} MSG=bare MCP names coexist with plugin:scope:name form (migration artifact; use --verbose to list)\n"
  fi
fi

# Suggested cleanup (read-only audit; the operator runs these manually) -----
if [ "$issue_count" -gt 0 ]; then
  echo "CLEANUP_SUGGESTED=true"
  echo "CLEANUP_NOTE=Close other Claude Code sessions before editing ~/.claude.json (the harness rewrites this file on session end). Suggested jq filters:"
  if [ "$projects_dead" -gt 0 ]; then
    echo "  CLEANUP_PROJECTS=jq 'reduce (.projects | keys[]) as \$k (.; if (\$k | test(\"^/\") and (\$k | @sh | \"test -d \" + . | @sh)) then . else del(.projects[\$k]) end)' ~/.claude.json  # preview first"
  fi
  if [ "$gh_paths_dead" -gt 0 ]; then
    echo "  CLEANUP_GH_PATHS=Run a shell loop that filters .githubRepoPaths through 'test -d' before writing back to a temp file"
  fi
  if [ "$orphaned_disabled" -gt 0 ]; then
    echo "  CLEANUP_DISABLED_MCP=jq '.projects |= map_values(.disabledMcpServers |= map(select(. as \$n | (input_filename | .mcpServers | has(\$n)))))' ~/.claude.json  # adapt to your shell"
  fi
else
  echo "CLEANUP_SUGGESTED=false"
fi

echo "STATUS=${check_status}"
echo "ISSUE_COUNT=${issue_count}"
if [ -n "$issues_list" ]; then
  echo "ISSUES:"
  echo -e "$issues_list" | sed '/^$/d'
fi
echo "FIX_SUPPORTED=false"
echo "=== END RUNTIME STATE ==="

#!/usr/bin/env bash
# Check Settings Files
# Validates JSON syntax and structure of all Claude Code settings files.
# Usage: bash check-settings.sh --home-dir <path> --project-dir <path> [--verbose]

set -uo pipefail

home_dir=""
project_dir=""
verbose_mode=false

while [ $# -gt 0 ]; do
  case "$1" in
    --home-dir) home_dir="$2"; shift 2 ;;
    --project-dir) project_dir="$2"; shift 2 ;;
    --verbose) verbose_mode=true; shift ;;
    *) shift ;;
  esac
done

: "${home_dir:=$HOME}"
: "${project_dir:=$(pwd)}"

echo "=== SETTINGS FILES ==="

issue_count=0
check_status="OK"

# Check jq availability
if ! command -v jq >/dev/null 2>&1; then
  echo "JQ_AVAILABLE=false"
  echo "STATUS=ERROR"
  echo "ISSUE_COUNT=1"
  echo "ISSUES:"
  echo "  - SEVERITY=ERROR TYPE=missing_tool MSG=jq is required but not installed"
  echo "=== END SETTINGS FILES ==="
  exit 1
fi

echo "JQ_AVAILABLE=true"

# Define settings files to check
declare -A settings_files=(
  ["USER_SETTINGS"]="${home_dir}/.claude/settings.json"
  ["USER_LOCAL_SETTINGS"]="${home_dir}/.claude/settings.local.json"
  ["PROJECT_SETTINGS"]="${project_dir}/.claude/settings.json"
  ["PROJECT_LOCAL_SETTINGS"]="${project_dir}/.claude/settings.local.json"
)

issues_list=""

for settings_key in USER_SETTINGS USER_LOCAL_SETTINGS PROJECT_SETTINGS PROJECT_LOCAL_SETTINGS; do
  settings_file="${settings_files[$settings_key]}"

  if [ ! -f "$settings_file" ]; then
    echo "${settings_key}=MISSING"
    if [ "$verbose_mode" = true ]; then
      echo "${settings_key}_PATH=${settings_file}"
    fi
    continue
  fi

  # Validate JSON syntax
  json_error=$(jq empty "$settings_file" 2>&1)
  if [ $? -ne 0 ]; then
    echo "${settings_key}=INVALID"
    echo "${settings_key}_ERROR=${json_error}"
    issues_list="${issues_list}  - SEVERITY=ERROR TYPE=invalid_json FILE=${settings_file} MSG=${json_error}\n"
    issue_count=$((issue_count + 1))
    check_status="ERROR"
    continue
  fi

  echo "${settings_key}=OK"

  if [ "$verbose_mode" = true ]; then
    echo "${settings_key}_PATH=${settings_file}"

    # Count permission patterns if present
    allow_count=$(jq -r '.permissions.allow // [] | length' "$settings_file" 2>/dev/null || echo "0")
    deny_count=$(jq -r '.permissions.deny // [] | length' "$settings_file" 2>/dev/null || echo "0")
    echo "${settings_key}_ALLOW_PATTERNS=${allow_count}"
    echo "${settings_key}_DENY_PATTERNS=${deny_count}"

    # Count hooks if present
    hook_count=$(jq -r '.hooks // {} | length' "$settings_file" 2>/dev/null || echo "0")
    echo "${settings_key}_HOOKS=${hook_count}"

    # Count enabled plugins if present
    plugin_count=$(jq -r '.enabledPlugins // {} | length' "$settings_file" 2>/dev/null || echo "0")
    echo "${settings_key}_ENABLED_PLUGINS=${plugin_count}"
  fi
done

# Check for permission conflicts (allow and deny same pattern)
user_settings="${home_dir}/.claude/settings.json"
project_settings="${project_dir}/.claude/settings.json"

for sf in "$user_settings" "$project_settings"; do
  if [ -f "$sf" ]; then
    allow_patterns=$(jq -r '.permissions.allow // [] | .[]' "$sf" 2>/dev/null)
    deny_patterns=$(jq -r '.permissions.deny // [] | .[]' "$sf" 2>/dev/null)

    if [ -n "$allow_patterns" ] && [ -n "$deny_patterns" ]; then
      while IFS= read -r pattern; do
        if echo "$deny_patterns" | grep -qxF "$pattern"; then
          issues_list="${issues_list}  - SEVERITY=WARN TYPE=permission_conflict FILE=${sf} PATTERN=${pattern}\n"
          issue_count=$((issue_count + 1))
          [ "$check_status" = "OK" ] && check_status="WARN"
        fi
      done <<< "$allow_patterns"
    fi
  fi
done

# Aggregate permission counts across all files
total_allow=0
total_deny=0
for sf in "$user_settings" "${home_dir}/.claude/settings.local.json" "$project_settings" "${project_dir}/.claude/settings.local.json"; do
  if [ -f "$sf" ]; then
    ac=$(jq -r '.permissions.allow // [] | length' "$sf" 2>/dev/null || echo "0")
    dc=$(jq -r '.permissions.deny // [] | length' "$sf" 2>/dev/null || echo "0")
    total_allow=$((total_allow + ac))
    total_deny=$((total_deny + dc))
  fi
done
echo "TOTAL_ALLOW_PATTERNS=${total_allow}"
echo "TOTAL_DENY_PATTERNS=${total_deny}"

echo "STATUS=${check_status}"
echo "ISSUE_COUNT=${issue_count}"
if [ -n "$issues_list" ]; then
  echo "ISSUES:"
  echo -e "$issues_list" | sed '/^$/d'
fi
echo "=== END SETTINGS FILES ==="