fix: ESM require() runtime bug + empty setup suggestions block

## Bug 1 — doctor.checkHook always reported "not found" in production

Root cause: three functions in src/doctor/report.ts, two in
src/setup/detect.ts, and one in src/setup/wizard.ts used bare
require() calls at runtime — but tsup bundles to ESM where require
is undefined. The ReferenceError was caught by each function's own
catch block and silently treated as "check failed," so:

- doctor reported "Sentinel hook not found" even after a successful
  install-hook (verified live against a fresh tmp project)
- detect.ts's Claude Code detection reported configured=false even
  when the hook was wired
- setup --user scope would hit "homedir is not a function"

Why tests passed: vitest's test runtime provides CommonJS interop so
require() works in test environment. The bundled CLI doesn't.
v2.0.1 shipped a similar "CI-passed, prod-broken" pattern for a
different reason; this is the same class of bug.

Fix: move every require() to a proper top-level ESM import.
- report.ts: import readFileSync + cachePath/isNewer at top
- detect.ts: import readFileSync at top
- wizard.ts: import readFileSync, writeFileSync, mkdirSync, dirname,
  homedir at top

Verified live:
  $ engram setup -y -p /tmp/fresh-project
  ✓ Sentinel hook installed
  ✓ hook  Sentinel hook active (via /tmp/fresh-project/.claude/settings.local.json)

## Bug 2 — empty "Next steps for detected IDEs:" block

When only Claude Code was detected-but-unconfigured (and there's no
suggest entry for Claude Code because install-hook handles it in
step 2), the wizard printed "Next steps for detected IDEs:" with
no subsequent lines.

Fix: collect suggestions first. If the list is empty, either:
  - skip with "Claude Code hook declined" if Claude Code is the
    culprit (user declined hook install in step 2)
  - done with "no additional adapters needed" otherwise

The header line only prints when there's at least one actionable
suggestion.

## Audit result

While auditing for this bug I grepped every new file for `require(`
and found 7 offenders across 3 files. All fixed in one commit.
No other ESM-interop issues found.

Verified: 746/746 tests still pass, lint clean, build clean, live
E2E test of setup → doctor → Bash auto-reindex all behave
correctly. Bash PostToolUse with ENGRAM_AUTO_REINDEX=1 successfully
prunes the graph when the underlying file is rm'd.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: NickCirv

src/doctor/report.ts

@@ -9,13 +9,14 @@
  * network calls. Safe to run on every SessionStart or in CI.
  */
 import chalk from "chalk";
-import { existsSync, statSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { homedir, platform, release } from "node:os";
 import {
   refreshComponentStatus,
   type ComponentHealth,
 } from "../intercept/component-status.js";
+import { cachePath, isNewer } from "../update/check.js";
 
 /** Severity buckets. */
 export type Severity = "ok" | "warn" | "fail";
@@ -78,7 +79,6 @@ function checkHook(projectRoot: string): DoctorCheck {
   for (const path of candidates) {
     if (!existsSync(path)) continue;
     try {
-      const { readFileSync } = require("node:fs") as typeof import("node:fs");
       const content = readFileSync(path, "utf-8");
       if (content.includes("engram intercept")) {
         return {
@@ -128,7 +128,6 @@ function componentToCheck(c: ComponentHealth): DoctorCheck {
 /** Check engram CLI version against the last cached registry check. */
 function checkVersion(engramVersion: string): DoctorCheck {
   try {
-    const { cachePath } = require("../update/check.js") as typeof import("../update/check.js");
     const path = cachePath();
     if (!existsSync(path)) {
       return {
@@ -137,20 +136,20 @@ function checkVersion(engramVersion: string): DoctorCheck {
         detail: `engram v${engramVersion} (no update check cached yet)`,
       };
     }
-    const { readFileSync } = require("node:fs") as typeof import("node:fs");
     const cached = JSON.parse(readFileSync(path, "utf-8")) as {
       latest?: string;
     };
-    if (typeof cached?.latest === "string" && cached.latest !== engramVersion) {
-      const { isNewer } = require("../update/check.js") as typeof import("../update/check.js");
-      if (isNewer(cached.latest, engramVersion)) {
-        return {
-          name: "version",
-          severity: "warn",
-          detail: `engram v${engramVersion} — v${cached.latest} is available`,
-          remediation: "Run `engram update` to upgrade.",
-        };
-      }
+    if (
+      typeof cached?.latest === "string" &&
+      cached.latest !== engramVersion &&
+      isNewer(cached.latest, engramVersion)
+    ) {
+      return {
+        name: "version",
+        severity: "warn",
+        detail: `engram v${engramVersion} — v${cached.latest} is available`,
+        remediation: "Run `engram update` to upgrade.",
+      };
     }
     return {
       name: "version",

src/setup/detect.ts

@@ -4,7 +4,7 @@
  * Used by `engram setup` to decide which adapters to offer. Pure
  * file-existence probes — no network, no shell calls.
  */
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 
@@ -36,7 +36,6 @@ export function detectClaudeCode(projectRoot: string): IdeDetection {
 
   let configured = false;
   try {
-    const { readFileSync } = require("node:fs") as typeof import("node:fs");
     configured = settingsCandidates
       .filter(existsSync)
       .some((p) => readFileSync(p, "utf-8").includes("engram intercept"));
@@ -99,7 +98,6 @@ export function detectContinue(): IdeDetection {
   let configured = false;
   if (installed) {
     try {
-      const { readFileSync } = require("node:fs") as typeof import("node:fs");
       configured = readFileSync(path, "utf-8").includes("engram");
     } catch {
       configured = false;

src/setup/wizard.ts

@@ -17,12 +17,11 @@
  */
 import chalk from "chalk";
 import readline from "node:readline/promises";
-import { existsSync } from "node:fs";
-import { join, resolve as pathResolve } from "node:path";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { dirname, join, resolve as pathResolve } from "node:path";
+import { homedir } from "node:os";
 import { init } from "../core.js";
 import { installEngramHooks } from "../intercept/installer.js";
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { dirname } from "node:path";
 import { detectAllIdes } from "./detect.js";
 import { buildReport, formatReport } from "../doctor/report.js";
 
@@ -117,7 +116,7 @@ async function ensureHookInstalled(
   const scope = opts.settingsScope ?? "local";
   const settingsPath =
     scope === "user"
-      ? join(require("node:os").homedir(), ".claude", "settings.json")
+      ? join(homedir(), ".claude", "settings.json")
       : scope === "project"
         ? join(root, ".claude", "settings.json")
         : join(root, ".claude", "settings.local.json");
@@ -202,15 +201,33 @@ async function offerIdeAdapters(
     Windsurf: "engram gen-windsurfrules",
     Aider: "engram gen-aider",
   };
-  console.log("");
-  console.log(chalk.dim("  Next steps for detected IDEs:"));
-  const run: string[] = [];
+
+  // Collect suggestions first so we only print the header when there's
+  // something actionable. Claude Code is handled by install-hook (step 2)
+  // so an unconfigured Claude Code here means hook-install was declined.
+  const suggested: Array<{ name: string; cmd: string }> = [];
   for (const ide of unconfigured) {
     const cmd = suggest[ide.name];
-    if (cmd) {
-      console.log(chalk.white(`    $ ${cmd}`));
-      run.push(ide.name);
+    if (cmd) suggested.push({ name: ide.name, cmd });
+  }
+
+  if (suggested.length === 0) {
+    // Nothing actionable to print. Note Claude Code coverage if relevant.
+    const claudeCode = unconfigured.find((d) => d.name === "Claude Code");
+    if (claudeCode) {
+      skip("Claude Code hook declined or missing — re-run `engram install-hook`");
+    } else {
+      done("no additional adapters needed");
     }
+    return [];
+  }
+
+  console.log("");
+  console.log(chalk.dim("  Next steps for detected IDEs:"));
+  const run: string[] = [];
+  for (const s of suggested) {
+    console.log(chalk.white(`    $ ${s.cmd}`));
+    run.push(s.name);
   }
   return run;
 }