doctor

Run a full health check on .warden/. Print a structured report grouped by area. Findings are tagged ok, advisory (informational; nothing broken), or error (will or already does cause failures).

This command does NOT auto-fix anything. Drift between the project's runner and the plugin template is project-owned and expected; the user decides whether to sync. Missing runtimes, broken config, and malformed artifacts are the user's call too. After the report, offer to walk through whichever items the user wants resolved.

Precondition

if [ ! -d .warden ]; then
  echo "No .warden/ in this project. Run /warden:design to bootstrap."
  exit 1
fi

Checks

Run each check, collect findings. Use Read and Glob/Grep for inspection, Bash for parsing.

Engine integrity

• .warden/run.sh present? Record the version stamp from its first comment line if present.
• .warden/lib/ present and contains all 10 expected files: assert.sh, audit.sh, auth.sh, api.sh, db.sh, browser.sh, hurl.sh, env.sh, wait.sh, parse.sh. List any missing.
• Bash syntax: bash -n on run.sh and every lib/*.sh.

Engine drift vs plugin template

For run.sh and each lib/*.sh, diff against ${CLAUDE_PLUGIN_ROOT}/templates/run.sh and ${CLAUDE_PLUGIN_ROOT}/templates/lib/<name>.sh. Report:

• Files that match the template byte-for-byte: ok.
• Files that differ: advisory with a line-count summary (run.sh: 3 added, 1 removed vs template). Do not include the diff body inline; offer to show the full diff if the user asks.
• Files in .warden/lib/ with no counterpart in the template: advisory ("project-specific lib helper").
• Files missing from .warden/lib/ that the template ships: error.

Frame drift as expected and project-owned. The runner being a thin bash script that survives plugin uninstall is the whole point; drift is a feature, not a bug.

Config

Source .warden/warden.config.sh in a subshell. Verify:

• The file is sourceable (bash -n clean and no errors when sourcing into a fresh subshell with set -u).
• WARDEN_PHASES, ENV_FILES, PREFLIGHT, RUNTIME_CHECKS, DESTRUCTIVE are all defined (the runner pre-declares them, but a custom config could break this if rewritten).
• If WARDEN_AUTH_STRATEGY is set:
  • cookie-session, jwt-bearer, jwt-cookie: WARDEN_AUTH_SIGNIN_URL must be set. Missing → error.
  • jwt-bearer: optional WARDEN_AUTH_TOKEN_PATH (default .token).
  • api-key: optional WARDEN_AUTH_HEADER (default X-API-Key) and WARDEN_AUTH_TOKEN_ENV (default AUTH_API_KEY).
  • custom: WARDEN_AUTH_CUSTOM must point at a readable script.
• If WARDEN_USERS_<slot>_email is set, the matching _password must also be set, and vice versa.