@canonical/pragma-cli 0.35.0 → 0.37.0

package/dist/src/capabilities/doctor/checks/harnessInventory.js

@@ -0,0 +1,195 @@
+/**
+ * The harness inventory: one row per harness per scope, saying what was detected
+ * and whether pragma is registered in it.
+ *
+ * Every fact this needs was ALREADY COMPUTED and thrown away.
+ * `TargetGroup.harnessNames` carries every harness sharing a config file and
+ * both consumers reduced it to `shortenPath(group.path)`; `McpDetection`
+ * carries the `absent`/`registered`/`drifted` classification of every WRITE in
+ * that file. The only thing detection could NOT answer is the negative —
+ * `detectHarnesses` filters to hits, so a harness the machine does not have was
+ * unrepresentable — which is why the roll-up takes the REGISTRY alongside the
+ * groups: the registry supplies the universe, the groups supply the state.
+ *
+ * The state arrives PER HARNESS, never per file. A shared `.vscode/mcp.json`
+ * holds VS Code's `servers` and Cline's `mcpServers` as two independent
+ * entries, so the file's aggregate — `drifted`, when one key is current and the
+ * other absent — is the standing of NEITHER harness. Pairing each name with
+ * the write it owns is the caller's job (it holds the registry's `mcpKey`s and
+ * the group's writes); by the time a group reaches this module the association
+ * is resolved and every name carries its own state.
+ *
+ * Three deliberate constraints:
+ *
+ * 1. **No `@canonical/harnesses` import, of any kind.** `capabilities/lazy.test`
+ *    forbids one from any file statically reachable from `capabilities/index`,
+ *    and its regex has no `import type` exemption. This module is reached only
+ *    through `runChecks`'s dynamic import today, but it is written so that
+ *    staying legal never depends on that: the inputs are declared here as
+ *    narrow structural records.
+ *
+ * 2. **Narrowed to DATA, so `mutates: false` is enforced rather than asserted.**
+ *    `McpDetection` is write-capable — it carries `writeMcpConfigTargets` and
+ *    `removeMcpConfigFrom` as live function references. Projecting it down to
+ *    {@link InventoryGroup} before it reaches this file means a read-only
+ *    report literally cannot reach a writer.
+ *
+ * 3. **It never invents a failure.** The states an inventory can report map onto
+ *    `pass`/`available`/`skip` and NEVER `fail` (see `../types.ts`): a machine
+ *    that simply does not have Windsurf is not a broken machine, and the `mcp`
+ *    row already owns the actionable finding for the harnesses it does have.
+ *    Reporting it twice is how a failure count becomes noise.
+ *
+ * Placement: this is a doctor helper because doctor is its only consumer today,
+ * and `shared/` is explicitly not a utility drawer (see `shared/index.ts`). It
+ * is written to MOVE there unchanged — pure, no capability imports beyond the
+ * scope type — the moment `setup`'s detection summary becomes the second caller.
+ */
+/** Whether a state means "this harness is on the machine". */
+export const isDetectedState = (state) => state === "registered" || state === "drifted" || state === "detected";
+/**
+ * Roll one scope's detected config groups up against the registry into one row
+ * per harness.
+ *
+ * Groups are keyed by harness NAME because that is the only identity
+ * `TargetGroup` records; the registry is the map back to an id, which is why it
+ * is a parameter rather than a lookup. A harness naming no registry row is
+ * ignored rather than invented — the inventory reports on the registry, not on
+ * whatever a group happened to say.
+ *
+ * @param registry - Every known harness, each flagged for scope membership.
+ * @param groups - This scope's detected config files (narrowed, path-shortened),
+ *   each naming the harnesses that share it with their own per-write state.
+ * @param scope - The scope being rolled up.
+ * @returns One row per registry harness, in registry order.
+ * @note Pure — it reads no filesystem and holds no live effect.
+ */
+export function harnessInventory(registry, groups, scope) {
+    const states = new Map();
+    const locations = new Map();
+    for (const group of groups) {
+        for (const member of group.harnesses) {
+            const paths = locations.get(member.name) ?? [];
+            paths.push(group.path);
+            locations.set(member.name, paths);
+            // A harness sharing two files is registered only where EVERY one of them
+            // carries the current entry — the same "all or nothing" rule
+            // `aggregateMcpStates` applies across the writes within a single file.
+            const prior = states.get(member.name);
+            states.set(member.name, prior === undefined || prior === member.state
+                ? member.state
+                : "drifted");
+        }
+    }
+    return registry.map((harness) => {
+        const detected = states.get(harness.name);
+        const paths = locations.get(harness.name) ?? [];
+        const state = detected === undefined
+            ? harness.inScope
+                ? "undetected"
+                : "unscoped"
+            : detected === "registered"
+                ? "registered"
+                : detected === "drifted"
+                    ? "drifted"
+                    : "detected";
+        return {
+            harnessId: harness.id,
+            harnessName: harness.name,
+            scope,
+            state,
+            locations: paths,
+        };
+    });
+}
+/** The per-item status each state renders as. Never `fail` — see the docblock. */
+const STATE_STATUS = {
+    registered: "pass",
+    drifted: "available",
+    detected: "available",
+    undetected: "skip",
+    unscoped: "skip",
+};
+/**
+ * The phrase each state reads as, scope-aware for the unscoped case.
+ *
+ * The unscoped line says WHERE the harness keeps its config rather than naming
+ * an internal partition. `no Global band` told the reader nothing: "band" was
+ * this repository's word, and the fact underneath it — VS Code stores its MCP
+ * config per project, so there is no global file for pragma to be in — is the
+ * thing that explains the row.
+ */
+const stateDetail = (row) => {
+    switch (row.state) {
+        case "registered":
+            return "registered";
+        case "drifted":
+            return "registered, entry differs from current";
+        case "detected":
+            return "detected, not registered";
+        case "undetected":
+            return "not detected";
+        case "unscoped":
+            return row.scope === "global"
+                ? "keeps no global config — it is per-project only"
+                : "keeps no per-project config — it is global only";
+    }
+};
+/**
+ * Project inventory rows into doctor sub-items.
+ *
+ * The default listing is DETECTED HARNESSES ONLY — a report that names every
+ * tool the user does not have buries the ones they do. `--verbose` widens it to
+ * the whole registry, which is the only view in which `undetected`/`unscoped`
+ * rows appear at all.
+ *
+ * @param rows - This scope's inventory rows.
+ * @param verbose - Whether to list the whole registry rather than the hits.
+ * @returns The sub-items, harness name in the left column.
+ */
+export function inventoryItems(rows, verbose) {
+    const shown = verbose
+        ? rows
+        : rows.filter((row) => isDetectedState(row.state));
+    return shown.map((row) => {
+        const where = row.locations.join(", ");
+        return {
+            label: row.harnessName,
+            status: STATE_STATUS[row.state],
+            detail: where ? `${stateDetail(row)} — ${where}` : stateDetail(row),
+        };
+    });
+}
+/**
+ * The whole inventory row for one scope: a listing, not a verdict.
+ *
+ * Its status is only ever `pass` (this scope has harnesses) or `skip` (it has
+ * none). It is the one scoped row that is not a setup target, so it derives no
+ * `fix:` line — the `mcp` and `skills` rows beside it own every action a
+ * harness can need, and a second row proposing the same command would be the
+ * "same finding seen twice" the report is built to avoid.
+ *
+ * @param rows - This scope's inventory rows.
+ * @param verbose - Whether the listing widens to the whole registry.
+ * @returns The status, headline and sub-items for the scope's inventory check.
+ */
+export function inventoryHealth(rows, verbose) {
+    const detected = rows.filter((row) => isDetectedState(row.state));
+    const registered = rows.filter((row) => row.state === "registered");
+    const items = inventoryItems(rows, verbose);
+    if (detected.length === 0) {
+        return {
+            status: "skip",
+            detail: verbose
+                ? `none of ${rows.length} known harnesses detected`
+                : "no harnesses detected",
+            items,
+        };
+    }
+    return {
+        status: "pass",
+        detail: `${detected.length} detected · ${registered.length} registered${verbose ? ` · ${rows.length} known` : ""}`,
+        items,
+    };
+}
+//# sourceMappingURL=harnessInventory.js.map

package/dist/src/capabilities/doctor/checks/harnessInventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessInventory.js","sourceRoot":"","sources":["../../../../../src/capabilities/doctor/checks/harnessInventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AA2EH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAqB,EAAW,EAAE,CAChE,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,UAAU,CAAC;AAExE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAqC,EACrC,MAAiC,EACjC,KAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClC,yEAAyE;YACzE,6DAA6D;YAC7D,uEAAuE;YACvE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,CAAC,GAAG,CACR,MAAM,CAAC,IAAI,EACX,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK;gBAC3C,CAAC,CAAC,MAAM,CAAC,KAAK;gBACd,CAAC,CAAC,SAAS,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAgB,EAAE;QAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,KAAK,GACT,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,OAAO,CAAC,OAAO;gBACf,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,UAAU;YACd,CAAC,CAAC,QAAQ,KAAK,YAAY;gBACzB,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,QAAQ,KAAK,SAAS;oBACtB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,UAAU,CAAC;QACrB,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,KAAK;YACL,KAAK;YACL,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,MAAM,YAAY,GAAwC;IACxD,UAAU,EAAE,MAAM;IAClB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,WAAW;IACrB,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,MAAM;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,CAAC,GAAiB,EAAU,EAAE;IAChD,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,YAAY,CAAC;QACtB,KAAK,SAAS;YACZ,OAAO,wCAAwC,CAAC;QAClD,KAAK,UAAU;YACb,OAAO,0BAA0B,CAAC;QACpC,KAAK,YAAY;YACf,OAAO,cAAc,CAAC;QACxB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAC3B,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,iDAAiD,CAAC;IAC1D,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,IAA6B,EAC7B,OAAgB;IAEhB,MAAM,KAAK,GAAG,OAAO;QACnB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAa,EAAE;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,WAAW;YACtB,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;YAC/B,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC;SACpE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6B,EAC7B,OAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,2BAA2B;gBACnD,CAAC,CAAC,uBAAuB;YAC3B,KAAK;SACN,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,eAAe,UAAU,CAAC,MAAM,cACxD,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,EACxC,EAAE;QACF,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/src/capabilities/doctor/checks/index.js

@@ -6,22 +6,22 @@
  * them apart from the report body is what lets `runChecks` stay a composition
  * — it orders and awaits, and knows nothing about what any check looks at.
  *
- * Two kinds live here, and the barrel exposes them differently. The UNBANDED
+ * Two kinds live here, and the barrel exposes them differently. The UNSCOPED
  * checks diagnose what `setup` cannot install — the Node floor, the CLI's own
  * version and install source, the pack answering this project's reads, and the
- * store — so each is its own named entry point. The BANDED rows are derived
- * per target, per band, from the setup target table rather than authored here,
+ * store — so each is its own named entry point. The SCOPED rows are derived
+ * per target, per scope, from the setup target table rather than authored here,
  * so they surface as the one generator that derives them, never as a list of
  * row names this file would then have to keep in step with `setup`.
  *
  * The per-target probes (the completions script check, the MCP command
- * resolution helpers) stay internal on purpose: `bandedChecks` is the only way
- * they are meant to be reached, and a row reachable past its band is a row
+ * resolution helpers) stay internal on purpose: `scopedChecks` is the only way
+ * they are meant to be reached, and a row reachable past its scope is a row
  * `doctor` can report and `setup` cannot fix.
  */
 export { checkKeStore } from "./checkKeStore.js";
 export { checkNodeVersion } from "./checkNodeVersion.js";
 export { checkPackageRefs } from "./checkPackageRefs.js";
 export { checkPragmaVersion } from "./checkPragmaVersion.js";
-export { bandedChecks } from "./targetHealth.js";
+export { scopedChecks } from "./targetHealth.js";
 //# sourceMappingURL=index.js.map

package/dist/src/capabilities/doctor/checks/isSupportedNodeVersion.js

@@ -0,0 +1,38 @@
+/**
+ * Whether a Node.js version satisfies the range this package declares in its
+ * own `engines.node`, surfaced as `SUPPORTED_NODE_RANGE` in `constants.ts`.
+ *
+ * The range is expressed here as a comparison rather than parsed: the CLI
+ * carries no semver dependency, and one range does not justify a range parser.
+ * What keeps the two honest is `isSupportedNodeVersion.test.ts`, which builds an
+ * independent predicate straight from the declared range string and requires
+ * the two to agree across a version grid — so a change to `engines.node` that
+ * is not mirrored here fails the suite rather than shipping.
+ *
+ * A major-only comparison cannot express this range: it cannot say "22.18 but
+ * not 22.0", and it cannot exclude the 23.0–23.5 window.
+ *
+ * @param version - A Node version string, e.g. `process.versions.node`.
+ * @returns Whether the version falls inside the declared range.
+ */
+export function isSupportedNodeVersion(version) {
+    // A semver range excludes prereleases unless a comparator opts into them, and
+    // `engines.node` opts into none. So `22.18.0-pre` is outside the declared
+    // range even though its numeric part is inside it, and reporting it as
+    // supported would be doctor passing a runtime the install contract rejects.
+    if (version.includes("-"))
+        return false;
+    const [rawMajor, rawMinor] = version.split(".");
+    const major = Number(rawMajor);
+    const minor = Number(rawMinor);
+    if (!Number.isInteger(major) || !Number.isInteger(minor))
+        return false;
+    if (major < 22)
+        return false;
+    if (major === 22)
+        return minor >= 18;
+    if (major === 23)
+        return minor >= 6;
+    return true;
+}
+//# sourceMappingURL=isSupportedNodeVersion.js.map

package/dist/src/capabilities/doctor/checks/isSupportedNodeVersion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isSupportedNodeVersion.js","sourceRoot":"","sources":["../../../../../src/capabilities/doctor/checks/isSupportedNodeVersion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,8EAA8E;IAC9E,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAExC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,IAAI,EAAE,CAAC;IACrC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,KAAK,IAAI,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/capabilities/doctor/checks/targetHealth.js

@@ -1,7 +1,7 @@
 /**
- * The banded doctor rows, derived from the setup target table.
+ * The scoped doctor rows, derived from the setup target table.
  *
- * `doctor` and `setup` are the SAME LIST. Every banded row here carries a
+ * `doctor` and `setup` are the SAME LIST. Every scoped row here carries a
  * target id verbatim — `completions`, not "Shell completions"; `mcp`, not "MCP
  * configured" — because the row name IS the fix command's argument, and a user
  * who reads `✗ mcp` beside `fix: pragma setup mcp` can see that they are the
@@ -11,23 +11,32 @@
  *
  * Every row's detection comes from the target table's own `detect`, so the two
  * surfaces cannot disagree about what they looked at, and every `fix:` is
- * derived from the row's id and band rather than authored per check.
+ * derived from the row's id and scope rather than authored per check.
  *
- * Doctor's UNBANDED environment checks (Node version, the CLI's own version,
+ * Doctor's UNSCOPED environment checks (Node version, the CLI's own version,
  * pack refs, the store) diagnose things setup cannot install and stay outside
  * this list.
+ *
+ * ONE scoped row is not a target: `harnesses`, the per-scope inventory. It is an
+ * inventory of the machine the targets are measured against, not a target that
+ * can be set up, so it deliberately carries no `fix:` and can never be `fail`
+ * or `available` — see {@link inventoryChecks}. The bijection between the other
+ * rows and the setup table is untouched: `harnesses` is not a `TargetId`, and
+ * nothing derives a command from it.
  */
 import { MCP_SERVER_NAME } from "../../../constants.js";
 import { detectionFailure, detectTargets, resolveRoots, } from "../../setup/buildPlan.js";
-import { lspEditorNames, lspSkipReason, mcpGroupState, skillsSkipReason, } from "../../setup/operations/index.js";
+import { lspEditorNames, lspSkipReason, mcpGroupState, mcpWriteState, skillsSkipReason, skillsSkipRemedy, } from "../../setup/operations/index.js";
 import { shortenPath, TARGET_IDS } from "../../setup/plan.js";
+import { MCP_NO_LOCATION } from "../../setup/targets.js";
 import { checkShellCompletions } from "./checkShellCompletions.js";
+import { harnessInventory, inventoryHealth, } from "./harnessInventory.js";
 import { commandResolves } from "./mcpCommand.js";
 /** The `config` row: the global config file exists and parses. */
 const configHealth = (d, roots) => {
     const path = shortenPath(d.path, roots);
     if (!d.exists)
-        return { status: "available", detail: `${path} not created` };
+        return { status: "available", detail: `${path} does not exist yet` };
     if (!d.parses) {
         return { status: "fail", detail: `${path} cannot be parsed as JSON` };
     }
@@ -40,8 +49,8 @@ const lspHealth = (d) => {
     }
     const editors = lspEditorNames(d).join(", ");
     return d.state === "installed"
-        ? { status: "pass", detail: `installed (${editors})` }
-        : { status: "available", detail: `not installed (${editors})` };
+        ? { status: "pass", detail: `installed in ${editors}` }
+        : { status: "available", detail: `not installed in ${editors}` };
 };
 /**
  * The `mcp` row: one sub-item per file, each saying whether the entry is
@@ -49,19 +58,16 @@ const lspHealth = (d) => {
  * one for presence, one for command resolution — and the second judged every
  * server in the file, so a foreign server's dead command failed this CLI's row.
  */
-async function mcpHealth(d, band, cwd, roots) {
+async function mcpHealth(d, scope, cwd, roots) {
     if (d.groups.length === 0) {
-        return {
-            status: "skip",
-            detail: "no harness config location in this band",
-        };
+        return { status: "skip", detail: MCP_NO_LOCATION[scope] };
     }
     const resolves = await commandResolves(MCP_SERVER_NAME, cwd);
     const items = d.groups.map((group) => {
         const state = mcpGroupState(d, group.path);
         const label = shortenPath(group.path, roots);
         if (state === "absent") {
-            return { label, status: "available", detail: "not configured" };
+            return { label, status: "available", detail: "not registered" };
         }
         if (state === "drifted") {
             return { label, status: "fail", detail: "entry differs from current" };
@@ -70,8 +76,8 @@ async function mcpHealth(d, band, cwd, roots) {
             label,
             status: resolves ? "pass" : "fail",
             detail: resolves
-                ? `entry current, \`${MCP_SERVER_NAME}\` resolves`
-                : `entry current, \`${MCP_SERVER_NAME}\` is not on PATH`,
+                ? `registered, and \`${MCP_SERVER_NAME}\` is on PATH`
+                : `registered, but \`${MCP_SERVER_NAME}\` is not on PATH`,
         };
     });
     const configured = items.filter((item) => item.status === "pass").length;
@@ -79,33 +85,51 @@ async function mcpHealth(d, band, cwd, roots) {
     if (failing > 0) {
         return {
             status: "fail",
-            detail: `${failing} of ${items.length} need attention`,
+            detail: `${failing} of ${items.length} config files need attention`,
             items,
         };
     }
     if (configured === 0) {
-        // Project-band absence is not a failure: the band is opt-in, so a
-        // repository with no checked-in MCP config is a healthy repository.
-        return band === "project"
-            ? { status: "skip", detail: "not configured for this project (opt-in)" }
+        // Absence in the LOCAL PROJECT is not a failure: registering there is
+        // opt-in, so a repository with no checked-in MCP config is healthy. The
+        // line says so rather than leaving "(opt-in)" to be decoded.
+        return scope === "project"
+            ? {
+                status: "skip",
+                detail: "not registered for this project — per-project registration is opt-in",
+            }
             : {
                 status: "available",
-                detail: `${items.length} not configured`,
+                detail: `not registered in any of ${items.length} config files`,
                 items,
             };
     }
     return {
         status: configured === items.length ? "pass" : "available",
-        detail: `${configured} of ${items.length} current`,
+        detail: `registered in ${configured} of ${items.length} config files`,
         items,
     };
 }
 /** The `skills` row: every expected link present, lstat-verified, none stale. */
-function skillsHealth(d, band, roots) {
-    if (!d.available) {
+function skillsHealth(d, scope, roots) {
+    const short = shortenPath(d.sourceRoot, roots);
+    // Stale links this scope owns are work even when the root holds no skill, so
+    // the row is only a skip once there is nothing left to reconcile either.
+    const orphans = d.rootExists ? d.orphans.length : 0;
+    if (!d.available && orphans === 0) {
+        // The skip carries a remedy — `setup`'s row and this row are the same
+        // finding, and the dead-end version of it ("no skills installed", no next
+        // step) was reported identically by both surfaces.
         return {
             status: "skip",
-            detail: skillsSkipReason(shortenPath(d.sourceRoot, roots), band),
+            detail: skillsSkipReason(short, scope, d.rootExists),
+            remedy: skillsSkipRemedy(short, scope),
+        };
+    }
+    if (orphans > 0) {
+        return {
+            status: "available",
+            detail: `${orphans} link${orphans === 1 ? "" : "s"} point at a skill that is gone`,
         };
     }
     const stale = d.actions.filter((a) => a.action === "replaced").length;
@@ -120,6 +144,19 @@ function skillsHealth(d, band, roots) {
     // and reporting the two the same way made this row say "links current" where
     // no link exists at all. Setup will never clear such a path — it is not this
     // command's to delete — so the row carries the only remedy that settles it.
+    // A symlink pointing outside every root pragma owns is `skipped` so setup
+    // will never delete it — which would make this row claim "links current" over
+    // a path where the user's own link shadows a shipped skill. `skipped` also
+    // covers an already-correct link (owned) and a real directory (blocked), so
+    // the foreign case is what is left.
+    const foreign = d.actions.filter((a) => a.action === "skipped" && !a.owned && !a.blocked).length;
+    if (foreign > 0) {
+        return {
+            status: "available",
+            detail: `${foreign} of ${d.actions.length} link paths hold a symlink pragma does not own`,
+            remedy: "Move or delete the symlink at that path, then link the skills again.",
+        };
+    }
     const blocked = d.actions.filter((a) => a.blocked).length;
     if (blocked > 0) {
         return {
@@ -143,7 +180,7 @@ function skillsHealth(d, band, roots) {
  */
 async function healthOf(row, rt, roots) {
     // A detection that threw is reported as ITS OWN failing row. Letting the
-    // rejection escape took the whole banded section of the report with it, so a
+    // rejection escape took the whole scoped section of the report with it, so a
     // single unreadable config file left the user with no rows at all — the one
     // moment the report is most worth having.
     const failure = detectionFailure(row);
@@ -163,43 +200,150 @@ async function healthOf(row, rt, roots) {
         case "lsp":
             return lspHealth(row.detection);
         case "mcp":
-            return mcpHealth(row.detection, row.band, rt.cwd, roots);
+            return mcpHealth(row.detection, row.scope, rt.cwd, roots);
         default:
-            return skillsHealth(row.detection, row.band, roots);
+            return skillsHealth(row.detection, row.scope, roots);
     }
 }
+/** The scoped inventory row's name — a LISTING, not a setup target id. */
+export const INVENTORY_CHECK = "harnesses";
+/**
+ * The `harnesses` row for one scope: what this machine has, and where pragma
+ * stands in each.
+ *
+ * It is the one scoped row that is NOT a target, and it earns that by never
+ * competing with the ones that are. Its status is only `pass` or `skip`, so it
+ * adds no failure and no `available` to the tally, and it derives no `fix:` —
+ * the `mcp` and `skills` rows beside it already name every command a harness
+ * needs, and repeating them here would be the same finding seen twice.
+ *
+ * The registry is the only thing detection could not supply: `detectHarnesses`
+ * filters to hits, so "Windsurf is not on this machine" was unrepresentable
+ * until the universe came from somewhere. Everything else — which harnesses
+ * share which file, and whether each one's own entry in it is current — is read
+ * straight off the `mcp` detection this report already ran. The projection to
+ * {@link InventoryGroup} is deliberate: `McpDetection` holds
+ * `writeMcpConfigTargets`/`removeMcpConfigFrom` as live functions, and a
+ * `mutates: false` command should be unable to reach a writer, not merely
+ * trusted not to.
+ *
+ * This is also where the harness↔`mcpKey` association is REJOINED, because it
+ * is the one place that holds both halves: `TargetGroup` records the names
+ * sharing a file and, separately, one write per distinct `mcpKey`, and the
+ * registry is what says which key a given harness writes. Without that join the
+ * only state available per harness is the file's aggregate — and a
+ * `.vscode/mcp.json` where VS Code's `servers` entry is current while Cline's
+ * `mcpServers` is absent aggregates to `drifted`, which would report BOTH
+ * harnesses as drifted when neither one is.
+ *
+ * @param rt - The per-invocation runtime (read for `--verbose`).
+ * @param rows - Every detected row, both scopes, as `scopedChecks` has them.
+ * @param roots - The roots every path renders relative to.
+ * @returns One inventory {@link CheckResult} per scope, global then project.
+ * @note Impure — dynamically imports the harness registry.
+ */
+async function inventoryChecks(rt, rows, roots) {
+    const { harnesses, isHarnessInBand } = await import("@canonical/harnesses");
+    const verbose = rt.globalFlags.verbose;
+    const scopes = ["global", "project"];
+    // The key each harness NAME writes under — the half of the association
+    // `groupConfigTargets` consumed and did not record. Names are the only
+    // identity a group carries, and the registry's are unique.
+    const keyByName = new Map(harnesses.map((h) => [h.name, h.mcpKey]));
+    return scopes.map((scope) => {
+        // `isHarnessInBand(harness.scope, scope, scope)` — the scope asked for as
+        // its OWN selection ("band" is the harnesses package's name for it) — is
+        // exactly "does this harness have a config location here", which is the
+        // question `detectMcp` already answers for that scope. Asking it under the
+        // `both` selection would instead answer "who writes here when both scopes
+        // run", and report every dual-scope harness as having no global location.
+        const registry = harnesses.map((harness) => ({
+            id: harness.id,
+            name: harness.name,
+            inScope: isHarnessInBand(harness.scope, scope, scope),
+        }));
+        const mcpRow = rows.find((row) => row.target.id === "mcp" && row.scope === scope);
+        if (mcpRow === undefined || detectionFailure(mcpRow) !== undefined) {
+            return {
+                name: INVENTORY_CHECK,
+                status: "skip",
+                detail: "harness detection did not settle — see the `mcp` row",
+                scope,
+            };
+        }
+        const detection = mcpRow.detection;
+        const groups = detection.groups.map((group) => ({
+            path: shortenPath(group.path, roots),
+            harnesses: group.harnessNames.map((name) => {
+                // The harness's OWN write in this file. A name the registry does not
+                // know (or a key no write carries — impossible while the group was
+                // built from the same registry) falls back to the file's aggregate:
+                // strictly no worse than the state before this join existed.
+                const write = group.writes.find((w) => w.mcpKey === keyByName.get(name));
+                return {
+                    name,
+                    state: write === undefined
+                        ? mcpGroupState(detection, group.path)
+                        : mcpWriteState(detection, write),
+                };
+            }),
+        }));
+        const health = inventoryHealth(harnessInventory(registry, groups, scope), verbose);
+        return {
+            name: INVENTORY_CHECK,
+            status: health.status,
+            detail: health.detail,
+            scope,
+            ...(health.items.length === 0 ? {} : { items: health.items }),
+        };
+    });
+}
 /**
- * The command that repairs a row — derived from its id and band, never
+ * The command that repairs a row — derived from its id and scope, never
  * authored. This is the bijection made mechanical: a row exists because a
  * target exists, and its fix is that target's own invocation.
  */
-export const fixCommandFor = (id, band, bin) => `${bin} setup ${id}${band === "project" ? " --local" : ""}`;
+export const fixCommandFor = (id, scope, bin) => `${bin} setup ${id}${scope === "project" ? " --local" : ""}`;
 /**
- * Run every banded check: the target table, both bands, in table order.
+ * Run every scoped check: the target table, both scopes, in table order, then
+ * each scope's harness inventory.
+ *
+ * The inventory rows come LAST within the array, and the renderer partitions by
+ * scope while preserving order, so each scope's section ends with the listing of
+ * what that scope actually holds — the targets first, then the machine they were
+ * measured against. They ride on the SAME detection pass: no target is probed a
+ * second time to produce them.
  *
  * @param rt - The per-invocation runtime.
  * @param bin - The binary name the `fix:` lines are derived from.
- * @returns One {@link CheckResult} per (target, band) the machine can hold.
+ * @returns One {@link CheckResult} per (target, scope), plus one per scope.
  * @note Impure — every target's detection reads the real filesystem.
  */
-export async function bandedChecks(rt, bin) {
+export async function scopedChecks(rt, bin) {
     const roots = await resolveRoots(rt);
     const detected = await detectTargets(rt, [...TARGET_IDS], "both");
-    return Promise.all(detected.map(async (row) => {
-        const health = await healthOf(row, rt, roots);
-        const needsFix = health.status === "fail" || health.status === "available";
-        return {
-            name: row.target.id,
-            status: health.status,
-            detail: health.detail,
-            band: row.band,
-            ...(health.items === undefined ? {} : { items: health.items }),
-            ...(needsFix
-                ? {
-                    remedy: health.remedy ?? fixCommandFor(row.target.id, row.band, bin),
-                }
-                : {}),
-        };
-    }));
+    const [targetRows, inventoryRows] = await Promise.all([
+        Promise.all(detected.map(async (row) => {
+            const health = await healthOf(row, rt, roots);
+            const needsFix = health.status === "fail" || health.status === "available";
+            // A `skip` gets no DERIVED fix — re-running the target's own setup command
+            // would reproduce the skip. But a skip that AUTHORED a remedy has found a
+            // real next step on this machine (fill the scope's skill root, say), and
+            // dropping it is what made the skip a dead end on both surfaces.
+            const remedy = needsFix
+                ? (health.remedy ?? fixCommandFor(row.target.id, row.scope, bin))
+                : health.remedy;
+            return {
+                name: row.target.id,
+                status: health.status,
+                detail: health.detail,
+                scope: row.scope,
+                ...(health.items === undefined ? {} : { items: health.items }),
+                ...(remedy === undefined ? {} : { remedy }),
+            };
+        })),
+        inventoryChecks(rt, detected, roots),
+    ]);
+    return [...targetRows, ...inventoryRows];
 }
 //# sourceMappingURL=targetHealth.js.map