@aiwg/cli 2026.7.20 → 2026.7.21

package/dist/src/skills/deployer.js

@@ -0,0 +1,554 @@
+/**
+ * Managed Agent Skills provider deployment.
+ *
+ * Imported source trees remain immutable. Provider surfaces receive an atomic,
+ * strict Agent Skills projection plus ownership metadata outside SKILL.md.
+ *
+ * @implements #1879
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { stringify } from 'yaml';
+import { getProviderDefinition, normalizeProviderDefinitionId, } from '../providers/provider-definitions.js';
+import { AGENT_SKILLS_SIDECAR_SCHEMA, AIWG_SKILL_CONTROL_FIELDS, createAgentSkillSidecar, projectStrictAgentSkill, } from './agent-skills.js';
+import { getImportedAgentSkill } from './importer.js';
+import { validateAgentSkillContent } from './validator.js';
+export const AGENT_SKILL_MANAGED_MARKER = '.aiwg-managed';
+export const AGENT_SKILL_DEPLOYMENT_SIDECAR = '.aiwg-agent-skill.json';
+const MARKER_CONTENT = 'aiwg-agent-skill-v1\n';
+const STANDARD_FIELDS = [
+    'name',
+    'description',
+    'license',
+    'compatibility',
+    'metadata',
+    'allowed-tools',
+];
+const AIWG_FIELDS = new Set(AIWG_SKILL_CONTROL_FIELDS);
+export class AgentSkillDeploymentError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'AgentSkillDeploymentError';
+    }
+}
+function fail(code, message) {
+    throw new AgentSkillDeploymentError(code, message);
+}
+function assertPortableName(name) {
+    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name) || name.length > 64) {
+        fail('AS_DEPLOY_NAME', 'Agent Skill name must be 1-64 lowercase ASCII letters, numbers, or single hyphens');
+    }
+}
+function resolvedHome(options) {
+    return path.resolve(options.homeDir ?? os.homedir());
+}
+function resolvePolicy(target, options) {
+    const provider = normalizeProviderDefinitionId(target);
+    if (!provider) {
+        fail('AS_DEPLOY_PROVIDER', `unknown Agent Skills target "${target}"`);
+    }
+    const definition = getProviderDefinition(provider);
+    if (!definition) {
+        fail('AS_DEPLOY_PROVIDER', `provider definition is unavailable for "${provider}"`);
+    }
+    const namespace = definition.skillNamespace;
+    const reasons = [];
+    const warnings = [];
+    let root = namespace.pathType === 'home-dir'
+        ? path.join(resolvedHome(options), namespace.skillsBaseDir)
+        : path.join(path.resolve(options.projectDir), namespace.skillsBaseDir);
+    let status = 'native';
+    let supported = true;
+    let appendToDescription;
+    let maxDescriptionLength;
+    switch (provider) {
+        case 'codex':
+            root = path.join(path.resolve(options.projectDir), '.agents', 'skills');
+            status = 'projected';
+            maxDescriptionLength = namespace.maxDescriptionLength;
+            reasons.push('uses the project .agents/skills compatibility surface without the legacy 100/500 truncation transform');
+            break;
+        case 'factory':
+            status = 'projected';
+            appendToDescription = namespace.appendToDescription;
+            reasons.push('applies the Factory description guidance before strict validation');
+            break;
+        case 'hermes':
+            reasons.push('uses the user-global ~/.hermes/skills bundle surface with strict managed ownership markers');
+            break;
+        case 'openhuman':
+            status = 'projected';
+            reasons.push('uses the verified global one-level ~/.openhuman/skills layout');
+            break;
+        case 'windsurf':
+            status = 'projected';
+            reasons.push('uses one skill bundle directly below the one-level .windsurf/skills surface');
+            break;
+        default:
+            reasons.push('provider exposes a native recursive Agent Skills bundle surface');
+    }
+    return {
+        provider,
+        root,
+        status,
+        supported,
+        reasons,
+        warnings,
+        appendToDescription,
+        maxDescriptionLength,
+    };
+}
+function assertSafeSourceEntry(sourceRoot, absolutePath, relativePath) {
+    const stat = fs.lstatSync(absolutePath);
+    if (stat.isSymbolicLink()) {
+        fail('AS_DEPLOY_SOURCE_SYMLINK', `managed source contains a symlink: ${relativePath}`);
+    }
+    if (!stat.isDirectory() && !stat.isFile()) {
+        fail('AS_DEPLOY_SOURCE_SPECIAL_FILE', `managed source contains a non-regular entry: ${relativePath}`);
+    }
+    const real = fs.realpathSync.native(absolutePath);
+    const relativeReal = path.relative(fs.realpathSync.native(sourceRoot), real);
+    if (relativeReal.startsWith('..') || path.isAbsolute(relativeReal)) {
+        fail('AS_DEPLOY_SOURCE_ESCAPE', `managed source entry escapes its root: ${relativePath}`);
+    }
+    return stat;
+}
+function collectSourceEntries(sourceRoot) {
+    const entries = [];
+    const walk = (current, prefix) => {
+        for (const entry of fs.readdirSync(current, { withFileTypes: true })
+            .sort((left, right) => left.name.localeCompare(right.name))) {
+            const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+            if (relativePath === AGENT_SKILL_MANAGED_MARKER
+                || relativePath === AGENT_SKILL_DEPLOYMENT_SIDECAR) {
+                fail('AS_DEPLOY_RESERVED_PATH', `managed source uses reserved deployment path "${relativePath}"`);
+            }
+            const absolutePath = path.join(current, entry.name);
+            const stat = assertSafeSourceEntry(sourceRoot, absolutePath, relativePath);
+            if (stat.isDirectory()) {
+                entries.push({ kind: 'directory', relativePath });
+                walk(absolutePath, relativePath);
+            }
+            else {
+                entries.push({
+                    kind: 'file',
+                    relativePath,
+                    bytes: fs.readFileSync(absolutePath),
+                });
+            }
+        }
+    };
+    walk(sourceRoot, '');
+    return entries;
+}
+function projectionDocument(record) {
+    const sourceEntries = collectSourceEntries(record.managedLocation);
+    const skillFile = sourceEntries.find((entry) => (entry.kind === 'file' && entry.relativePath === 'SKILL.md'));
+    if (!skillFile) {
+        fail('AS_DEPLOY_SKILL_MISSING', 'managed source does not contain SKILL.md');
+    }
+    const content = new TextDecoder('utf-8', { fatal: true }).decode(skillFile.bytes);
+    const validation = validateAgentSkillContent(content, {
+        profile: record.validationProfile,
+        file: path.join(record.managedLocation, 'SKILL.md'),
+        directoryName: record.name,
+        skillRoot: record.managedLocation,
+        checkResources: true,
+    });
+    if (!validation.valid || !validation.frontmatter) {
+        fail('AS_DEPLOY_SOURCE_INVALID', `managed source for "${record.name}" no longer passes ${record.validationProfile} validation`);
+    }
+    const standard = {};
+    for (const key of STANDARD_FIELDS) {
+        const value = validation.frontmatter[key];
+        if (value !== undefined) {
+            Object.assign(standard, { [key]: structuredClone(value) });
+        }
+    }
+    const aiwg = {};
+    for (const [key, value] of Object.entries(validation.frontmatter)) {
+        if (AIWG_FIELDS.has(key)) {
+            aiwg[key] = structuredClone(value);
+        }
+    }
+    return {
+        document: {
+            standard: standard,
+            body: validation.body,
+            resources: [],
+            aiwg,
+            unknownFields: [],
+        },
+        sourceEntries,
+    };
+}
+function strictSkillBytes(record, policy, document) {
+    const metadata = projectStrictAgentSkill(document);
+    if (policy.appendToDescription) {
+        const suffix = policy.appendToDescription;
+        if (!metadata.description.endsWith(suffix)) {
+            metadata.description = `${metadata.description.trimEnd()} ${suffix}`;
+        }
+    }
+    if (policy.maxDescriptionLength !== undefined
+        && metadata.description.length > policy.maxDescriptionLength) {
+        policy.status = 'degraded';
+        policy.supported = false;
+        policy.reasons.push(`description length ${metadata.description.length} exceeds the provider limit ${policy.maxDescriptionLength}; no truncation was applied`);
+        return undefined;
+    }
+    const frontmatter = stringify(metadata, {
+        lineWidth: 0,
+        sortMapEntries: false,
+    }).trimEnd();
+    const content = `---\n${frontmatter}\n---\n${document.body}`;
+    const validation = validateAgentSkillContent(content, {
+        profile: 'strict',
+        file: 'SKILL.md',
+        directoryName: record.name,
+    });
+    if (!validation.valid) {
+        policy.status = 'degraded';
+        policy.supported = false;
+        policy.reasons.push(`provider projection failed strict validation: ${validation.diagnostics
+            .filter((item) => item.severity === 'error')
+            .map((item) => item.code)
+            .join(', ')}`);
+        return undefined;
+    }
+    return Buffer.from(content, 'utf8');
+}
+function sidecarBytes(record, policy, document) {
+    const portableSidecar = createAgentSkillSidecar(document, {
+        sourceKind: record.source.kind,
+        locator: record.source.locator,
+        ...(record.source.kind === 'git'
+            ? {
+                requestedRevision: record.source.requestedRevision,
+                resolvedRevision: record.source.resolvedRevision,
+            }
+            : {}),
+        sourceDigest: record.digest,
+        importedAt: record.importedAt,
+        aiwgVersion: record.aiwgVersion,
+    }, record.validationProfile, record.trust);
+    return Buffer.from(`${JSON.stringify({
+        schemaVersion: 1,
+        kind: 'aiwg-managed-agent-skill-projection',
+        name: record.name,
+        provider: policy.provider,
+        projectionStatus: policy.status,
+        sourceDigest: record.digest,
+        reasons: policy.reasons,
+        warnings: policy.warnings,
+        portable: portableSidecar,
+    }, null, 2)}\n`, 'utf8');
+}
+function readDeploymentSidecar(targetPath, expectedName, expectedProvider) {
+    try {
+        const sidecarPath = path.join(targetPath, AGENT_SKILL_DEPLOYMENT_SIDECAR);
+        const stat = fs.lstatSync(sidecarPath);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return undefined;
+        const value = JSON.parse(fs.readFileSync(sidecarPath, 'utf8'));
+        if (value.schemaVersion !== 1
+            || value.kind !== 'aiwg-managed-agent-skill-projection'
+            || !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value.name)
+            || !normalizeProviderDefinitionId(value.provider)
+            || !/^[0-9a-f]{64}$/.test(value.sourceDigest)
+            || !['native', 'projected', 'degraded', 'unsupported'].includes(value.projectionStatus)
+            || !Array.isArray(value.reasons)
+            || !value.reasons.every((item) => typeof item === 'string')
+            || !Array.isArray(value.warnings)
+            || !value.warnings.every((item) => typeof item === 'string')
+            || value.portable?.$schema !== AGENT_SKILLS_SIDECAR_SCHEMA
+            || value.portable.schemaVersion !== 1
+            || typeof value.portable.aiwg !== 'object'
+            || value.portable.aiwg === null
+            || Array.isArray(value.portable.aiwg)
+            || value.portable.provenance?.sourceDigest !== value.sourceDigest
+            || !['strict', 'compatible', 'discovery'].includes(value.portable.validationProfile)
+            || !['untrusted', 'trusted', 'revoked'].includes(value.portable.trust?.state)
+            || !['inactive', 'active', 'blocked'].includes(value.portable.trust?.activation)
+            || (expectedName !== undefined && value.name !== expectedName)
+            || (expectedProvider !== undefined && value.provider !== expectedProvider)
+            || path.basename(targetPath) !== value.name) {
+            return undefined;
+        }
+        return value;
+    }
+    catch {
+        return undefined;
+    }
+}
+function buildProjectionPlan(record, options) {
+    const policy = resolvePolicy(options.target, options);
+    const targetPath = path.join(policy.root, record.name);
+    if (!policy.supported) {
+        return {
+            policy,
+            targetPath,
+            sourceDigest: record.digest,
+            desiredEntries: [],
+        };
+    }
+    const { document, sourceEntries } = projectionDocument(record);
+    const skillBytes = strictSkillBytes(record, policy, document);
+    if (!skillBytes) {
+        return {
+            policy,
+            targetPath,
+            sourceDigest: record.digest,
+            desiredEntries: [],
+        };
+    }
+    const desiredEntries = sourceEntries
+        .filter((entry) => entry.relativePath !== 'SKILL.md')
+        .map((entry) => (entry.kind === 'directory'
+        ? { ...entry }
+        : { ...entry, bytes: Buffer.from(entry.bytes) }));
+    desiredEntries.push({ kind: 'file', relativePath: 'SKILL.md', bytes: skillBytes }, {
+        kind: 'file',
+        relativePath: AGENT_SKILL_MANAGED_MARKER,
+        bytes: Buffer.from(MARKER_CONTENT, 'utf8'),
+    }, {
+        kind: 'file',
+        relativePath: AGENT_SKILL_DEPLOYMENT_SIDECAR,
+        bytes: sidecarBytes(record, policy, document),
+    });
+    desiredEntries.sort((left, right) => (left.relativePath.localeCompare(right.relativePath)
+        || left.kind.localeCompare(right.kind)));
+    return {
+        policy,
+        targetPath,
+        sourceDigest: record.digest,
+        desiredEntries,
+    };
+}
+function isManagedTarget(targetPath, expectedName, expectedProvider) {
+    if (!fs.existsSync(targetPath))
+        return false;
+    try {
+        const targetStat = fs.lstatSync(targetPath);
+        const marker = path.join(targetPath, AGENT_SKILL_MANAGED_MARKER);
+        return (targetStat.isDirectory()
+            && !targetStat.isSymbolicLink()
+            && fs.lstatSync(marker).isFile()
+            && !fs.lstatSync(marker).isSymbolicLink()
+            && fs.readFileSync(marker, 'utf8') === MARKER_CONTENT
+            && readDeploymentSidecar(targetPath, expectedName, expectedProvider) !== undefined);
+    }
+    catch {
+        return false;
+    }
+}
+function targetMatches(targetPath, desired, name, provider) {
+    if (!isManagedTarget(targetPath, name, provider))
+        return false;
+    const actual = new Map();
+    const walk = (current, prefix) => {
+        for (const entry of fs.readdirSync(current, { withFileTypes: true })
+            .sort((left, right) => left.name.localeCompare(right.name))) {
+            const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+            const absolutePath = path.join(current, entry.name);
+            const stat = fs.lstatSync(absolutePath);
+            if (stat.isSymbolicLink())
+                return false;
+            if (stat.isDirectory()) {
+                actual.set(relativePath, 'directory');
+                if (!walk(absolutePath, relativePath))
+                    return false;
+            }
+            else if (stat.isFile()) {
+                actual.set(relativePath, fs.readFileSync(absolutePath));
+            }
+            else {
+                return false;
+            }
+        }
+        return true;
+    };
+    if (!walk(targetPath, ''))
+        return false;
+    if (actual.size !== desired.length)
+        return false;
+    return desired.every((entry) => {
+        const value = actual.get(entry.relativePath);
+        return entry.kind === 'directory'
+            ? value === 'directory'
+            : Buffer.isBuffer(value) && value.equals(entry.bytes);
+    });
+}
+function writeDesiredTree(root, desired) {
+    fs.mkdirSync(root, { recursive: false, mode: 0o700 });
+    for (const entry of desired.filter((item) => item.kind === 'directory').sort((left, right) => (left.relativePath.split('/').length - right.relativePath.split('/').length
+        || left.relativePath.localeCompare(right.relativePath)))) {
+        fs.mkdirSync(path.join(root, ...entry.relativePath.split('/')), {
+            recursive: true,
+            mode: 0o700,
+        });
+    }
+    for (const entry of desired.filter((item) => item.kind === 'file').sort((left, right) => left.relativePath.localeCompare(right.relativePath))) {
+        const target = path.join(root, ...entry.relativePath.split('/'));
+        fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(target, entry.bytes, { flag: 'wx', mode: 0o600 });
+    }
+}
+function promoteAtomically(name, plan) {
+    const parent = path.dirname(plan.targetPath);
+    fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const suffix = randomUUID();
+    const staging = path.join(parent, `.${path.basename(plan.targetPath)}.staging-${suffix}`);
+    const backup = path.join(parent, `.${path.basename(plan.targetPath)}.backup-${suffix}`);
+    const existed = fs.existsSync(plan.targetPath);
+    try {
+        writeDesiredTree(staging, plan.desiredEntries);
+        if (existed) {
+            if (!isManagedTarget(plan.targetPath, name, plan.policy.provider)) {
+                fail('AS_DEPLOY_COLLISION_RACE', 'deployment target ownership changed before atomic promotion');
+            }
+            fs.renameSync(plan.targetPath, backup);
+        }
+        try {
+            fs.renameSync(staging, plan.targetPath);
+        }
+        catch (error) {
+            if (fs.existsSync(plan.targetPath)) {
+                fs.rmSync(plan.targetPath, { recursive: true, force: true });
+            }
+            if (fs.existsSync(backup))
+                fs.renameSync(backup, plan.targetPath);
+            throw error;
+        }
+        if (fs.existsSync(backup)) {
+            try {
+                fs.rmSync(backup, { recursive: true, force: true });
+            }
+            catch (error) {
+                fs.rmSync(plan.targetPath, { recursive: true, force: true });
+                fs.renameSync(backup, plan.targetPath);
+                throw error;
+            }
+        }
+        return existed ? 'updated' : 'deployed';
+    }
+    finally {
+        if (fs.existsSync(staging))
+            fs.rmSync(staging, { recursive: true, force: true });
+        if (fs.existsSync(backup) && !fs.existsSync(plan.targetPath)) {
+            fs.renameSync(backup, plan.targetPath);
+        }
+    }
+}
+function result(operation, outcome, dryRun, name, plan) {
+    return {
+        schemaVersion: 1,
+        operation,
+        outcome,
+        dryRun,
+        name,
+        provider: plan.policy.provider,
+        projectionStatus: plan.policy.status,
+        path: plan.targetPath,
+        reasons: [...plan.policy.reasons],
+        warnings: [...plan.policy.warnings],
+        sourceDigest: plan.sourceDigest,
+    };
+}
+function requireDeployableImport(name, projectDir) {
+    const record = getImportedAgentSkill(projectDir, name);
+    if (!record) {
+        fail('AS_DEPLOY_IMPORT_MISSING', `managed Agent Skill "${name}" is not imported`);
+    }
+    if (record.trust.state !== 'trusted'
+        || record.trust.activation !== 'active') {
+        fail('AS_DEPLOY_IMPORT_INACTIVE', `managed Agent Skill "${name}" is ${record.trust.state}/${record.trust.activation}`);
+    }
+    if (record.diagnostics.some((item) => item.code === 'AS_IMPORT_MANAGED_DRIFT')) {
+        fail('AS_DEPLOY_IMPORT_DRIFT', `managed Agent Skill "${name}" no longer matches digest ${record.digest}`);
+    }
+    return record;
+}
+export function deployImportedAgentSkill(name, options) {
+    assertPortableName(name);
+    const projectDir = path.resolve(options.projectDir);
+    const record = requireDeployableImport(name, projectDir);
+    const plan = buildProjectionPlan(record, { ...options, projectDir });
+    const dryRun = options.dryRun ?? false;
+    if (!plan.policy.supported) {
+        return result('deploy', 'blocked', dryRun, name, plan);
+    }
+    if (fs.existsSync(plan.targetPath)
+        && !isManagedTarget(plan.targetPath, name, plan.policy.provider)) {
+        plan.policy.status = 'degraded';
+        plan.policy.reasons.push('target collision is not owned by AIWG');
+        plan.policy.warnings.push('the existing user-owned target was not modified');
+        return result('deploy', 'blocked', dryRun, name, plan);
+    }
+    if (targetMatches(plan.targetPath, plan.desiredEntries, name, plan.policy.provider)) {
+        return result('deploy', 'unchanged', dryRun, name, plan);
+    }
+    if (dryRun)
+        return result('deploy', 'planned', true, name, plan);
+    return result('deploy', promoteAtomically(name, plan), false, name, plan);
+}
+export function uninstallImportedAgentSkill(name, options) {
+    assertPortableName(name);
+    const projectDir = path.resolve(options.projectDir);
+    const record = getImportedAgentSkill(projectDir, name);
+    const policy = resolvePolicy(options.target, { ...options, projectDir });
+    const plan = {
+        policy,
+        targetPath: path.join(policy.root, name),
+        sourceDigest: record?.digest ?? '',
+        desiredEntries: [],
+    };
+    const deployedSidecar = readDeploymentSidecar(plan.targetPath, name, policy.provider);
+    if (deployedSidecar) {
+        plan.sourceDigest = deployedSidecar.sourceDigest;
+    }
+    const dryRun = options.dryRun ?? false;
+    if (!fs.existsSync(plan.targetPath)) {
+        return result('uninstall', 'absent', dryRun, name, plan);
+    }
+    if (!isManagedTarget(plan.targetPath, name, plan.policy.provider)) {
+        plan.policy.status = 'degraded';
+        plan.policy.reasons.push('target collision is not owned by AIWG');
+        plan.policy.warnings.push('the existing user-owned target was not removed');
+        return result('uninstall', 'blocked', dryRun, name, plan);
+    }
+    if (dryRun)
+        return result('uninstall', 'planned', true, name, plan);
+    fs.rmSync(plan.targetPath, { recursive: true, force: true });
+    return result('uninstall', 'removed', false, name, plan);
+}
+export function inspectImportedAgentSkillProjection(name, options) {
+    assertPortableName(name);
+    const projectDir = path.resolve(options.projectDir);
+    const record = getImportedAgentSkill(projectDir, name);
+    if (!record) {
+        fail('AS_DEPLOY_IMPORT_MISSING', `managed Agent Skill "${name}" is not imported`);
+    }
+    const plan = buildProjectionPlan(record, { ...options, projectDir, dryRun: true });
+    const exists = fs.existsSync(plan.targetPath);
+    const managed = exists && isManagedTarget(plan.targetPath, name, plan.policy.provider);
+    return {
+        provider: plan.policy.provider,
+        projectionStatus: plan.policy.status,
+        path: plan.targetPath,
+        sourceDigest: plan.sourceDigest,
+        supported: plan.policy.supported,
+        exists,
+        managed,
+        matches: (plan.policy.supported
+            && managed
+            && targetMatches(plan.targetPath, plan.desiredEntries, name, plan.policy.provider)),
+        reasons: [...plan.policy.reasons],
+        warnings: [...plan.policy.warnings],
+    };
+}
+//# sourceMappingURL=deployer.js.map

package/dist/src/skills/doctor.js

@@ -0,0 +1,105 @@
+/**
+ * Agent Skills health diagnostics for managed imports and active projections.
+ *
+ * @implements #1878
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { listProviderDefinitions } from '../providers/provider-definitions.js';
+import { AGENT_SKILLS_BASELINE, } from './agent-skills.js';
+import { inspectImportedAgentSkillProjection } from './deployer.js';
+import { listImportedAgentSkills } from './importer.js';
+import { validateAgentSkillFile } from './validator.js';
+function diagnostic(code, severity, file, yamlPath, message, remediation) {
+    return {
+        code,
+        severity,
+        file,
+        yamlPath,
+        message,
+        upstreamBaseline: AGENT_SKILLS_BASELINE.revision,
+        remediation,
+    };
+}
+export function buildAgentSkillsDoctorSection(projectDir, options = {}) {
+    const diagnostics = [];
+    let imported;
+    try {
+        imported = listImportedAgentSkills(projectDir);
+    }
+    catch (error) {
+        diagnostics.push(diagnostic('AS_DOCTOR_IMPORT_STORE', 'error', path.join(projectDir, '.aiwg', 'skills', 'imported'), '$', `managed Agent Skills store is invalid: ${error instanceof Error ? error.message : String(error)}`, 'Inspect or restore the managed import manifest, then re-import the source.'));
+        imported = [];
+    }
+    for (const skill of imported) {
+        diagnostics.push(...skill.diagnostics);
+        const sourceFile = path.join(skill.managedLocation, 'SKILL.md');
+        if (!fs.existsSync(sourceFile)) {
+            diagnostics.push(diagnostic('AS_DOCTOR_SOURCE_MISSING', 'error', sourceFile, '$', `managed source for "${skill.name}" is missing SKILL.md`, 'Restore the managed import with an explicit forced import.'));
+            continue;
+        }
+        diagnostics.push(...validateAgentSkillFile(sourceFile, {
+            profile: skill.validationProfile,
+            directoryName: skill.name,
+        }).diagnostics);
+        if (skill.trust.activation !== 'active')
+            continue;
+        for (const provider of listProviderDefinitions()
+            .sort((left, right) => left.id.localeCompare(right.id))) {
+            let inspection;
+            try {
+                inspection = inspectImportedAgentSkillProjection(skill.name, {
+                    projectDir,
+                    homeDir: options.homeDir,
+                    target: provider.id,
+                    dryRun: true,
+                });
+            }
+            catch (error) {
+                diagnostics.push(diagnostic('AS_DOCTOR_PROJECTION_PLAN', 'error', sourceFile, '$', `provider "${provider.id}" projection for "${skill.name}" cannot be planned: ${error instanceof Error ? error.message : String(error)}`, `Repair the managed import, then redeploy "${skill.name}" to ${provider.id}.`));
+                continue;
+            }
+            if (!inspection.supported) {
+                diagnostics.push(diagnostic('AS_DOCTOR_PROVIDER_UNSUPPORTED', 'warning', inspection.path, '$', `provider "${provider.id}" cannot project active imported skill "${skill.name}": ${inspection.reasons.join('; ')}`, `Use a supported provider surface or retain "${skill.name}" in the managed import store.`));
+            }
+            else if (!inspection.exists) {
+                diagnostics.push(diagnostic('AS_DOCTOR_PROVIDER_DEGRADED', 'warning', inspection.path, '$', `active imported skill "${skill.name}" is not projected to provider "${provider.id}"`, `Deploy or repair the ${provider.id} Agent Skills projection.`));
+            }
+            else if (!inspection.managed || !inspection.matches) {
+                diagnostics.push(diagnostic('AS_DOCTOR_DEPLOYED_DRIFT', 'error', inspection.path, '$', `provider "${provider.id}" projection for "${skill.name}" differs from its expected strict managed projection`, `Redeploy "${skill.name}" to ${provider.id} from the managed import.`));
+            }
+        }
+    }
+    const unique = [...new Map(diagnostics.map((item) => [
+            [
+                item.file,
+                item.code,
+                item.yamlPath,
+                item.message,
+            ].join('\0'),
+            item,
+        ])).values()].sort((left, right) => (left.file.localeCompare(right.file)
+        || left.code.localeCompare(right.code)
+        || left.yamlPath.localeCompare(right.yamlPath)
+        || left.message.localeCompare(right.message)));
+    const lines = ['\n── Agent Skills conformance ──'];
+    if (imported.length === 0 && unique.length === 0) {
+        lines.push('  ✓ no managed Agent Skills imports');
+    }
+    else if (unique.length === 0) {
+        lines.push(`  ✓ ${imported.length} managed import(s) conform and have no detected drift`);
+    }
+    else {
+        for (const item of unique) {
+            const mark = item.severity === 'error' ? '✗' : '⚠';
+            lines.push(`  ${mark} ${item.code} ${item.file}: ${item.message}`);
+            lines.push(`      Fix: ${item.remediation}`);
+        }
+    }
+    return {
+        diagnostics: unique,
+        output: lines.join('\n'),
+        hasFailures: unique.some((item) => item.severity === 'error'),
+    };
+}
+//# sourceMappingURL=doctor.js.map