@pellux/goodvibes-tui 1.27.0 → 2.0.1

package/src/runtime/trust/workspace-registration.ts

@@ -1,192 +0,0 @@
-/**
- * workspace-registration.ts — first-open workspace REGISTRATION half.
- *
- * Companion to the per-workspace trust gate (workspace-trust.ts). Trust is
- * TUI-local (a decision persisted under <cwd>/.goodvibes/tui); REGISTRATION is
- * the platform-wide "which project roots has the operator opted GoodVibes into"
- * registry, owned by the SDK.
- *
- * SINGLE SOURCE OF TRUTH. Resolution and mutation both go through the SDK's
- * shared WorkspaceRegistrationStore — the exact class the daemon composes its
- * `workspaces.*` gateway verbs over (control-plane/routes/register-gateway-verb-
- * groups.ts constructs `new WorkspaceRegistrationStore({ path: resolveUserPath(
- * 'control-plane', 'workspace-registrations.json'), homeDir: dirname(daemonState
- * Dir), daemonStateDir })`). We point an in-process store at that identical path
- * and roots, so whether the daemon's `workspaces.resolve` verb reads it over the
- * wire or we read it in-process, both operate on ONE persisted document. This is
- * not a divergent reimplementation: same SDK store class, same file, same
- * root-guard. In-process (rather than an RPC to a composed daemon) because the
- * first-open prompt renders synchronously at startup and must not depend on a
- * daemon being up — the file is the shared source either way.
- *
- * Coverage semantics are the store's (implemented in the SDK, not here): coverage
- * flows DOWN a registered root's subtree, a linked git worktree inherits its main
- * repo's registration, and a remembered decline is subtree-scoped at the root it
- * was asked. So the register half of the first-open prompt only appears when
- * resolution says UNKNOWN; a covered or declined path never re-asks.
- */
-import { dirname } from 'node:path';
-import { parse as parsePath } from 'node:path';
-import {
-  WorkspaceRegistrationStore,
-  WorkspaceRegistrationError,
-  normalizeWorkspaceRoot,
-  type WorkspaceCoverageStatus,
-  type RegisterWorkspaceResult,
-} from '@pellux/goodvibes-sdk/platform/workspace';
-
-/** The slice of ShellPathService this manager needs. */
-export interface WorkspaceRegistrationShellPaths {
-  readonly workingDirectory: string;
-  readonly homeDirectory: string;
-  resolveUserPath(...segments: string[]): string;
-}
-
-/** Filename of the shared control-plane registry document (matches the daemon composition). */
-const REGISTRATIONS_FILE = 'workspace-registrations.json';
-
-export interface WorkspaceRegistrationEvaluation {
-  /** Normalized absolute working directory the prompt would ask about. */
-  readonly root: string;
-  /** Coverage verdict from the shared store: covered / declined / unknown. */
-  readonly status: WorkspaceCoverageStatus;
-  /** The nearest registered root covering the path, or null. */
-  readonly coveredBy: string | null;
-  /** True when coverage was inherited through the git worktree→main-repo link. */
-  readonly viaWorktreeLink: boolean;
-  /** True when the root is one the store would refuse ($HOME, filesystem root, ~/.goodvibes). */
-  readonly broad: boolean;
-  /**
-   * Whether to OFFER the register half of the first-open prompt: only when the
-   * store says UNKNOWN and the root is registrable. Broad roots are never
-   * offered — the store refuses them, so we do not prompt for what would be
-   * refused. Covered / declined roots never re-ask.
-   */
-  readonly offerRegister: boolean;
-  /** Human-readable justification from the resolver. */
-  readonly reason: string;
-}
-
-export interface WorkspaceRegistrationManagerOptions {
-  readonly shellPaths: WorkspaceRegistrationShellPaths;
-  /**
-   * Inject a pre-built store (e.g. a `:memory:` store for tests). Defaults to an
-   * in-process store at the shared control-plane path, configured identically to
-   * the daemon's.
-   */
-  readonly store?: WorkspaceRegistrationStore;
-}
-
-export class WorkspaceRegistrationManager {
-  private readonly store: WorkspaceRegistrationStore;
-  private readonly workingDirectory: string;
-  private readonly homeDir: string;
-  private readonly daemonStateDir: string;
-
-  constructor(options: WorkspaceRegistrationManagerOptions) {
-    const { shellPaths } = options;
-    this.workingDirectory = shellPaths.workingDirectory;
-    // Mirror the daemon's composition exactly (register-gateway-verb-groups.ts):
-    // the daemon state dir IS resolveUserPath() (~/.goodvibes); its parent is the
-    // home directory — both refused as broad roots by the same guard.
-    this.daemonStateDir = shellPaths.resolveUserPath();
-    this.homeDir = dirname(this.daemonStateDir);
-    this.store =
-      options.store ??
-      new WorkspaceRegistrationStore({
-        path: shellPaths.resolveUserPath('control-plane', REGISTRATIONS_FILE),
-        homeDir: this.homeDir,
-        daemonStateDir: this.daemonStateDir,
-      });
-  }
-
-  /**
-   * isBroadRoot — mirrors the SDK store's broad-root refusal SET (filesystem
-   * root, home directory, daemon state dir) so the register half is never
-   * offered for a root the store would refuse. This is a UI-suppression predicate
-   * only; the store's `add` remains the enforcement authority (see register()),
-   * which is why register() also catches WorkspaceRegistrationError.
-   */
-  private isBroadRoot(normalizedRoot: string): boolean {
-    if (normalizedRoot === parsePath(normalizedRoot).root) return true;
-    if (normalizedRoot === normalizeWorkspaceRoot(this.homeDir)) return true;
-    if (normalizedRoot === normalizeWorkspaceRoot(this.daemonStateDir)) return true;
-    return false;
-  }
-
-  /**
-   * Resolve the current working directory against the shared registry and decide
-   * whether the register half of the first-open prompt should appear. Read-only —
-   * never writes, so it is safe to call from `status`/`doctor`.
-   */
-  async evaluate(): Promise<WorkspaceRegistrationEvaluation> {
-    const resolution = await this.store.resolve(this.workingDirectory);
-    const broad = this.isBroadRoot(resolution.path);
-    return {
-      root: resolution.path,
-      status: resolution.status,
-      coveredBy: resolution.coveredBy,
-      viaWorktreeLink: resolution.viaWorktreeLink,
-      broad,
-      offerRegister: resolution.status === 'unknown' && !broad,
-      reason: resolution.reason,
-    };
-  }
-
-  /**
-   * Register the current working directory at its resolved project root. The
-   * store refuses broad roots (WorkspaceRegistrationError) — we surface that
-   * honestly rather than record a phantom registration.
-   *
-   * `origin` stamps which surface wrote the record (honest provenance). This
-   * NEVER passes `checkpointEligible`: absent means false, so a TUI self-record
-   * can never widen the checkpoint-owning consumer's boundary — only that
-   * consumer stamps its own roots eligible on boot.
-   */
-  async register(label?: string, origin?: string): Promise<
-    | { readonly registered: true; readonly result: RegisterWorkspaceResult }
-    | { readonly registered: false; readonly refusedReason: string }
-  > {
-    const opts = label || origin
-      ? { ...(label ? { label } : {}), ...(origin ? { origin } : {}) }
-      : undefined;
-    try {
-      const result = await this.store.add(this.workingDirectory, opts);
-      return { registered: true, result };
-    } catch (error) {
-      if (error instanceof WorkspaceRegistrationError) {
-        return { registered: false, refusedReason: error.message };
-      }
-      throw error;
-    }
-  }
-
-  /** Remember a subtree-scoped decline at the current working directory. Idempotent. */
-  async decline(): Promise<{ readonly root: string; readonly alreadyDeclined: boolean }> {
-    return this.store.decline(this.workingDirectory);
-  }
-
-  /** The normalized working directory this manager asks about. */
-  getWorkingRoot(): string {
-    return normalizeWorkspaceRoot(this.workingDirectory);
-  }
-
-  /**
-   * A one-liner registration posture for `status`/`doctor`. Read-only.
-   */
-  async describe(): Promise<string> {
-    const evaluation = await this.evaluate();
-    switch (evaluation.status) {
-      case 'covered':
-        return evaluation.viaWorktreeLink
-          ? `registered (via worktree link to ${evaluation.coveredBy})`
-          : `registered (covered by ${evaluation.coveredBy})`;
-      case 'declined':
-        return 'not registered (registration declined for this directory)';
-      case 'unknown':
-        return evaluation.broad
-          ? 'not registered (this root is too broad to register)'
-          : 'not registered (never asked)';
-    }
-  }
-}

package/src/runtime/trust/workspace-trust.ts

@@ -1,229 +0,0 @@
-/**
- * workspace-trust.ts — per-workspace trust gate.
- *
- * The first time GoodVibes opens a workspace (a cwd / project root it has no
- * prior decision for), that workspace is "undecided": only read-category
- * tools run; the first write, execute, or delegate tool request raises the
- * trust question AT THAT MOMENT — the exact point it has a real consequence —
- * instead of silently failing or being decided by a side effect of the
- * product's own droppings. This is NOT a parallel permission checker — the
- * decision is consulted by the real permission machinery at its final ask
- * layer (the requestPermission callback wired in bootstrap-core.ts), so it
- * composes with, and cannot drift from, the existing PermissionManager layer
- * chain.
- *
- * Trust is persisted per-workspace in <cwd>/.goodvibes/tui/trust.json. There
- * is no more grandfathering: a workspace that already carries prior GoodVibes
- * runtime state gets no special treatment (that side-effect-based shortcut
- * used to paper over the fact that the first session's write attempts were
- * silently denied without ever recording a real decision — now that the first
- * attempt properly raises the question and persists the answer, the shortcut
- * is unnecessary and would only hide a decision the user should actually see
- * once, even on an upgrade).
- */
-import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
-import { join } from 'node:path';
-import { JsonFileStore } from '@pellux/goodvibes-sdk/platform/state';
-import type { PermissionCategory } from '@pellux/goodvibes-sdk/platform/permissions';
-import type { PermissionPromptRequest, PermissionPromptDecision } from '@pellux/goodvibes-sdk/platform/permissions';
-
-type AskCallback = (request: PermissionPromptRequest) => Promise<PermissionPromptDecision>;
-
-/**
- * Wrap the permission machinery's final ask callback with the workspace trust
- * gate. This runs inside PermissionManager's own layer chain (it IS the ask
- * layer), so it composes with — and cannot drift from — the real machinery.
- *
- * - Trusted workspace: every category passes through to `ask` unchanged.
- * - Restricted workspace with an EXPLICIT prior decision: non-read categories
- *   are denied outright, same as before — that IS what "restricted" means
- *   once the user has actually chosen it.
- * - Undecided workspace (no decision yet, ever): the first non-read request
- *   raises `requestTrustDecision()` — one modal, persisted via `setLevel` —
- *   and, if the answer is 'trusted', the ORIGINAL request is forwarded to
- *   `ask` so the very thing the user just approved actually happens instead
- *   of failing anyway. Concurrent requests that arrive before the first
- *   decision resolves await the same in-flight prompt rather than opening a
- *   second one.
- */
-export function trustGatedAsk(
-  manager: Pick<WorkspaceTrustManager, 'isCategoryAllowed' | 'isDecided' | 'setLevel'>,
-  ask: AskCallback,
-  requestTrustDecision: () => Promise<WorkspaceTrustLevel>,
-): AskCallback {
-  let pendingDecision: Promise<WorkspaceTrustLevel> | null = null;
-  return async (request) => {
-    if (manager.isCategoryAllowed(request.category)) return ask(request);
-    if (!manager.isDecided()) {
-      if (!pendingDecision) {
-        pendingDecision = requestTrustDecision().finally(() => {
-          pendingDecision = null;
-        });
-      }
-      const level = await pendingDecision;
-      await manager.setLevel(level);
-      if (manager.isCategoryAllowed(request.category)) return ask(request);
-    }
-    return { approved: false };
-  };
-}
-
-export type WorkspaceTrustLevel = 'trusted' | 'restricted';
-
-interface PersistedWorkspaceTrust {
-  level: WorkspaceTrustLevel;
-  decidedAt: string;
-  grandfathered?: boolean;
-}
-
-const TRUST_FILE = 'trust.json';
-
-/**
- * detectPriorWorkspaceState — true if <workingDirectory>/.goodvibes already
- * holds GoodVibes RUNTIME state from a prior session. Deliberately keyed on
- * generated state (sessions/checkpoints/state/memory/onboarding marker), not on
- * committed scaffolding like .goodvibes/agents or GOODVIBES.md, so a checked-out
- * template does not read as "previously used". MUST be sampled before any
- * service initializes the workspace this session (bootstrap-core samples it
- * before createRuntimeServices), or this-run scaffolding would look like prior
- * use.
- */
-export function detectPriorWorkspaceState(workingDirectory: string): boolean {
-  const root = join(workingDirectory, '.goodvibes');
-  if (!existsSync(root)) return false;
-
-  const fileSignals = [
-    join(root, 'checkpoints', 'index.json'),
-    join(root, 'tui', 'onboarding-checked.json'),
-    join(root, 'goodvibes.json'),
-  ];
-  for (const file of fileSignals) {
-    if (existsSync(file)) return true;
-  }
-
-  const dirSignals = ['sessions', 'checkpoints', 'state', 'memory'];
-  for (const dir of dirSignals) {
-    const path = join(root, dir);
-    try {
-      if (existsSync(path) && statSync(path).isDirectory() && readdirSync(path).length > 0) {
-        return true;
-      }
-    } catch {
-      // Unreadable — treat as absent rather than crash the gate.
-    }
-  }
-  return false;
-}
-
-export interface WorkspaceTrustPaths {
-  readonly projectGoodVibesRoot: string;
-  resolveProjectPath(...segments: string[]): string;
-}
-
-/** Read-only view of the persisted trust decision, for status/doctor reporting. */
-export interface PersistedWorkspaceTrustView {
-  /** 'trusted' | 'restricted' when a decision exists; 'undecided' when none is persisted yet. */
-  readonly level: WorkspaceTrustLevel | 'undecided';
-  readonly grandfathered: boolean;
-}
-
-/**
- * readPersistedWorkspaceTrust — read <cwd>/.goodvibes/tui/trust.json WITHOUT the
- * side effects of WorkspaceTrustManager.load() (which grandfathers and persists).
- * Reporting surfaces (`status`/`doctor`) must never mutate trust state, so they
- * use this pure reader instead of constructing a manager.
- */
-export function readPersistedWorkspaceTrust(paths: WorkspaceTrustPaths): PersistedWorkspaceTrustView {
-  const file = paths.resolveProjectPath('tui', TRUST_FILE);
-  try {
-    if (!existsSync(file)) return { level: 'undecided', grandfathered: false };
-    const parsed = JSON.parse(readFileSync(file, 'utf-8')) as Partial<PersistedWorkspaceTrust>;
-    if (parsed.level === 'trusted' || parsed.level === 'restricted') {
-      return { level: parsed.level, grandfathered: parsed.grandfathered ?? false };
-    }
-  } catch {
-    // Unreadable/corrupt — report undecided rather than crash the report.
-  }
-  return { level: 'undecided', grandfathered: false };
-}
-
-export interface WorkspaceTrustManagerOptions {
-  readonly shellPaths: WorkspaceTrustPaths;
-}
-
-export class WorkspaceTrustManager {
-  private level: WorkspaceTrustLevel | null = null; // null = undecided (new place)
-  private grandfathered = false;
-  private loaded = false;
-  private readonly store: JsonFileStore<PersistedWorkspaceTrust>;
-
-  constructor(options: WorkspaceTrustManagerOptions) {
-    this.store = new JsonFileStore<PersistedWorkspaceTrust>(
-      options.shellPaths.resolveProjectPath('tui', TRUST_FILE),
-    );
-  }
-
-  /**
-   * Load the persisted decision, if one exists. No grandfathering: a
-   * workspace with no persisted decision stays undecided (the gate treats it
-   * as restricted, and the first non-read tool request raises the trust
-   * question via `trustGatedAsk`'s `requestTrustDecision` callback) — even
-   * one that already carries prior GoodVibes runtime state. `grandfathered`
-   * on an already-persisted decision is read-only history from before this
-   * fix (status/doctor still report it honestly); nothing new is ever
-   * grandfathered.
-   */
-  async load(): Promise<void> {
-    if (this.loaded) return;
-    const persisted = await this.store.load().catch(() => null);
-    if (persisted && (persisted.level === 'trusted' || persisted.level === 'restricted')) {
-      this.level = persisted.level;
-      this.grandfathered = persisted.grandfathered ?? false;
-    }
-    this.loaded = true;
-  }
-
-  isDecided(): boolean {
-    return this.level !== null;
-  }
-
-  /** Undecided workspaces read as 'restricted' — the safe default before a choice. */
-  getLevel(): WorkspaceTrustLevel {
-    return this.level ?? 'restricted';
-  }
-
-  isTrusted(): boolean {
-    return this.level === 'trusted';
-  }
-
-  wasGrandfathered(): boolean {
-    return this.grandfathered;
-  }
-
-  async setLevel(level: WorkspaceTrustLevel): Promise<void> {
-    this.level = level;
-    this.grandfathered = false;
-    this.loaded = true;
-    await this.persist();
-  }
-
-  /**
-   * The restriction rule the permission machinery consults. Read tools always
-   * run (read-only exploration is the whole point of "restricted"); every other
-   * category (write / execute / delegate) is denied until the workspace is
-   * trusted.
-   */
-  isCategoryAllowed(category: PermissionCategory): boolean {
-    if (this.isTrusted()) return true;
-    return category === 'read';
-  }
-
-  private async persist(): Promise<void> {
-    if (this.level === null) return;
-    await this.store.save({
-      level: this.level,
-      decidedAt: new Date().toISOString(),
-      grandfathered: this.grandfathered,
-    });
-  }
-}

package/src/runtime/ui/index.ts

@@ -1,39 +0,0 @@
-/**
- * Runtime UI data surface barrel.
- *
- * Exports enriched data providers and one-shot factory functions for
- * the model picker and provider health surfaces.
- *
- * These modules produce structured data for renderers — no UI rendering
- * logic lives here.
- */
-
-// ── Model picker ──────────────────────────────────────────────────────────────
-export type {
-  CapabilityFlags,
-  ProviderLatencyStats,
-  ProviderHealthContext,
-  ModelPickerEntry,
-  ModelPickerGroup,
-  ModelPickerData,
-} from '@/runtime/index.ts';
-export type { ProviderStatus as ModelPickerProviderStatus } from '@/runtime/index.ts';
-export { ModelPickerDataProvider, createModelPickerData } from '@/runtime/index.ts';
-export type { ModelPickerDataProviderOptions } from '@/runtime/index.ts';
-
-// ── Provider health ───────────────────────────────────────────────────────────
-export type {
-  HealthTimelinePoint,
-  HealthTimeline,
-  ProviderHealthEntry,
-  FallbackChainNode,
-  FallbackChainData,
-  ProviderHealthData,
-  CompositeHealthStatus,
-} from '@/runtime/index.ts';
-export type { ProviderStatus } from '@/runtime/index.ts';
-export {
-  ProviderHealthDataProvider,
-  buildFallbackChainData,
-  createProviderHealthData,
-} from '@/runtime/index.ts';

package/src/runtime/ui/model-picker/data-provider.ts

@@ -1,182 +0,0 @@
-/**
- * ModelPickerDataProvider — enriched model picker data surface.
- *
- * Combines ModelDefinition records from the provider registry with
- * ProviderHealthDomainState and ModelDomainState to produce a single,
- * sorted, health-enriched ModelPickerData snapshot for UI consumption.
- *
- * This class is a data provider only — it contains no rendering logic.
- * Subscribe to change notifications and call getSnapshot() to render.
- */
-import type { ModelDefinition } from '@pellux/goodvibes-sdk/platform/providers';
-import type { ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
-import type { BenchmarkStore } from '@pellux/goodvibes-sdk/platform/providers';
-import type { ProviderHealthDomainState } from '@/runtime/index.ts';
-import type { ModelDomainState } from '@/runtime/index.ts';
-import { enrichModelEntries, groupEntriesByProvider } from '@/runtime/index.ts';
-import type { ModelPickerData, ModelPickerEntry } from '@/runtime/index.ts';
-
-/** Options for constructing a ModelPickerDataProvider. */
-export interface ModelPickerDataProviderOptions {
-  /**
-   * Initial set of pinned model IDs.
-   * Call updatePinnedIds() to update at runtime.
-   */
-  readonly pinnedIds?: ReadonlySet<string>;
-  readonly benchmarkStore: Pick<BenchmarkStore, 'getBenchmarks'>;
-  readonly providerRegistry: Pick<ProviderRegistry, 'getSyntheticModelInfoFromCatalog' | 'getContextWindowForModel'>;
-}
-
-/**
- * ModelPickerDataProvider produces enriched model picker data snapshots.
- *
- * Usage:
- * ```ts
- * const provider = new ModelPickerDataProvider(models, healthState, modelState);
- * const unsub = provider.subscribe(() => {
- *   const data = provider.getSnapshot();
- *   // render data.entries or data.groups
- * });
- * // When health or model state changes:
- * provider.updateHealthState(newHealthState);
- * provider.updateModelState(newModelState);
- * // Cleanup:
- * unsub();
- * provider.dispose();
- * ```
- */
-export class ModelPickerDataProvider {
-  private _models: readonly ModelDefinition[];
-  private _healthState: ProviderHealthDomainState;
-  private _modelState: ModelDomainState;
-  private _pinnedIds: ReadonlySet<string>;
-  private _snapshot: ModelPickerData;
-  private readonly benchmarkStore: Pick<BenchmarkStore, 'getBenchmarks'>;
-  private readonly providerRegistry: Pick<ProviderRegistry, 'getSyntheticModelInfoFromCatalog' | 'getContextWindowForModel'>;
-  private readonly _subscribers = new Set<() => void>();
-
-  constructor(
-    models: readonly ModelDefinition[],
-    healthState: ProviderHealthDomainState,
-    modelState: ModelDomainState,
-    options: ModelPickerDataProviderOptions,
-  ) {
-    this._models = models;
-    this._healthState = healthState;
-    this._modelState = modelState;
-    this._pinnedIds = options.pinnedIds ?? new Set();
-    this.benchmarkStore = options.benchmarkStore;
-    this.providerRegistry = options.providerRegistry;
-    this._snapshot = this._buildSnapshot();
-  }
-
-  /**
-   * Return the current enriched model picker data snapshot.
-   * This is updated synchronously when state changes via update methods.
-   */
-  public getSnapshot(): ModelPickerData {
-    return this._snapshot;
-  }
-
-  /**
-   * Register a callback invoked whenever the snapshot changes.
-   * @returns An unsubscribe function.
-   */
-  public subscribe(callback: () => void): () => void {
-    this._subscribers.add(callback);
-    return () => this._subscribers.delete(callback);
-  }
-
-  /**
-   * Update the model list (e.g. after registry reload).
-   * Triggers a snapshot rebuild and notifies subscribers.
-   */
-  public updateModels(models: readonly ModelDefinition[]): void {
-    this._models = models;
-    this._rebuild();
-  }
-
-  /**
-   * Update health state (e.g. on ProviderHealthDomainState change).
-   * Triggers a snapshot rebuild and notifies subscribers.
-   */
-  public updateHealthState(healthState: ProviderHealthDomainState): void {
-    this._healthState = healthState;
-    this._rebuild();
-  }
-
-  /**
-   * Update model domain state (e.g. on active model or fallback change).
-   * Triggers a snapshot rebuild and notifies subscribers.
-   */
-  public updateModelState(modelState: ModelDomainState): void {
-    this._modelState = modelState;
-    this._rebuild();
-  }
-
-  /**
-   * Update the pinned/favorites model ID set.
-   * Triggers a snapshot rebuild and notifies subscribers.
-   */
-  public updatePinnedIds(pinnedIds: ReadonlySet<string>): void {
-    this._pinnedIds = pinnedIds;
-    this._rebuild();
-  }
-
-  /**
-   * Release all subscriber references.
-   * Does not clear internal state — getSnapshot() remains usable after disposal.
-   */
-  public dispose(): void {
-    this._subscribers.clear();
-  }
-
-  // ── Private ────────────────────────────────────────────────────────────────
-
-  private _rebuild(): void {
-    this._snapshot = this._buildSnapshot();
-    this._notify();
-  }
-
-  private _buildSnapshot(): ModelPickerData {
-    const entries: readonly ModelPickerEntry[] = enrichModelEntries(
-      this._models,
-      this._healthState,
-      this._modelState,
-      this._pinnedIds,
-      this.benchmarkStore,
-      this.providerRegistry,
-    );
-
-    const groups = groupEntriesByProvider(entries);
-
-    const degradedProviderIds: string[] = [];
-    const unavailableProviderIds: string[] = [];
-    for (const [id, record] of this._healthState.providers) {
-      if (record.status === 'degraded' || record.status === 'rate_limited') {
-        degradedProviderIds.push(id);
-      } else if (record.status === 'unavailable' || record.status === 'auth_error') {
-        unavailableProviderIds.push(id);
-      }
-    }
-
-    return {
-      entries,
-      groups,
-      degradedProviderIds,
-      unavailableProviderIds,
-      activeModelId: this._modelState.activeModelId,
-      snapshotAt: Date.now(),
-    };
-  }
-
-  private _notify(): void {
-    for (const cb of this._subscribers) {
-      try {
-        cb();
-      } catch {
-        // Non-fatal: subscriber errors must not crash the provider
-      }
-    }
-  }
-}