feat(doctor): observe machine checks without project discovery (HACK-2218 R7c)

apps/desktop/DESIGN.md

@@ -197,8 +197,8 @@ is removed after use. The app never types into an existing terminal or pane.
 
 ## 3. Doctor
 
-Source: `hack doctor --json --path <root>` per registered project, plus one run
-outside any project for machine checks (until R7c), on open and every 10
+Source: `hack doctor --json --path <root>` per registered project, plus
+`hack doctor --machine --json` for machine findings, on open and every 10
 minutes while visible. The versioned audit gives `{ok:true,data:{schema:1,checks,summary,counts}}`; checks include `id`, `status`, `detail`, `area`, `scope` and `fix` (R7a).
 
 | Card part | Content |
@@ -380,8 +380,8 @@ Each is small enough for one PR.
 7. **R5b** Activity reader: `hack activity --json [--project] [--limit]`.
 8. **R6** Action progress: `hack up|down|restart --json --progress` emitting ndjson `{type:"progress", service, phase}` before the final envelope.
 9. **R7a — exists.** Doctor audit schema 1 adds per-check `area`, `scope: machine | project` and `fix: {kind: safe | admin | manual, args[], doc_url}` inside the existing `{ok,data}` envelope. Unknown checks default to Other/manual with no executable args. A category is guidance, not permission to run it.
-10. **R7b** One fix without prompts: `hack doctor --fix --only <id> --yes --json`, only for `kind: safe`.
-11. **R7c** Machine-only doctor: `hack doctor --machine --json` (no project), so the app does not need to de-duplicate.
+10. **R7b — exists.** `hack doctor --fix --only <id> --yes --json` executes one allowlisted safe fix and rechecks it. Initially only `hack gitignore` is safe; other IDs and mixed modes refuse before writes. Results use `{ok,data:{schema:1,checks,summary,counts,fix}}`; `fix` records `id`, `changed`, `confirmed`.
+11. **R7c — exists.** `hack doctor --machine --json` skips project discovery even inside an invalid project. It reports only machine scopes for the selected backend plus global secrets hygiene, using the schema-1 `{ok,data}` envelope. Read-only engine/service probes may run; nothing is started or repaired. `--path`, project/browser flags and mutation modes refuse. For R7b project fixes, the app supplies its selected project cwd or appends `--path <root>` to the advertised argv.
 12. **R8** Daemon unit staleness: `service.unit_stale` and reason in `hack daemon status --json`, and `version` there.
 13. **R9** (optional) Push updates: `GET /v1/projects?wait=<generated_at>` long-poll.
 14. **R10** Env key state: `key_state: ok | missing | unreadable` in `hack env list --json` (no values).

docs/reference/cli.md

@@ -1623,6 +1623,9 @@ hack doctor [options]
 | --- | --- |
 | `--path, -p <dir>` | Run a project command against a repo path (overrides cwd search) |
 | `--fix` | Attempt safe auto-remediations (network + CoreDNS + CA) |
+| `--machine` | Observe machine checks only, without discovering a project or repairing state |
+| `--only <id>` | With --fix --yes, run exactly one allowlisted safe repair |
+| `--yes` | Consent to the one safe repair selected with --fix --only |
 | `--migrate-env-config` | Migrate legacy hack.env.json/.env state to the new env config files |
 | `--accept-tracked-env-changes` | With --migrate-env-config and no prompt, allow deleting or editing git-tracked files (hack.env.json, the Compose file) |
 | `--domain-migration preview|apply|rollback` | Preview, apply, or roll back only this project's hack.local migration |

docs/versions/v5/troubleshooting.md

@@ -8,6 +8,10 @@ an original key, not an automatic repair.
 
 `hack doctor --json` returns `{ok:true,data:{schema:1,checks,summary,counts}}`. Each check adds an area, machine/project scope and a fix category (`safe`, `admin` or `manual`), argv after `hack`, and a documentation URL. Empty argv means consult the docs. The audit remains read-only; `ok:true` means the audit ran, while error findings still exit 1. Unknown checks offer no runnable repair.
 
+For a targeted repair, `hack doctor --fix --only 'hack gitignore' --yes --json --path <repo>` repairs only Hack's managed ignore block, keeping user lines. It needs a Git checkout and leaves adopted, unsafe or read-only inputs alone. It rechecks the result and exits 1 when unconfirmed. `data.fix` reports `id`, `changed` and `confirmed`; no other check is run or repaired. Other IDs, absent consent and combinations with other repair modes refuse before writes. Broad `--fix --json` still refuses.
+
+Use `hack doctor --machine --json` for a machine-only audit. It skips project discovery and project checks even from a broken project checkout, and inspects only global stores for secrets hygiene. It also omits the retained gateway checks, whose resolver reads registered project configurations. Every finding has machine scope; failed or unavailable observations remain warnings/errors. It runs bounded read-only probes, never starts Docker, hackd or a native runtime, and accepts no project selection, browser observation or repair flags. The selected backend and home still come from the same environment as ordinary Doctor.
+
 The rows marked **next.17 source** describe merged code intended for next.17.
 They do not change an installed next.16 bundle. See the
 [release notes](../guides/v5-release-notes.md) for version boundaries.