agentic-workflow-manager 3.1.0 → 3.2.1

package/dist/src/core/bundle-install.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.expandBundleArtifacts = expandBundleArtifacts;
 exports.installBundle = installBundle;
 exports.addBundle = addBundle;
 exports.syncProfile = syncProfile;
@@ -10,10 +11,12 @@ exports.syncProfile = syncProfile;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const bundles_1 = require("./bundles");
-const executor_1 = require("./executor");
 const providers_1 = require("../providers");
 const profile_1 = require("./profile");
 const registries_1 = require("./registries");
+const config_1 = require("../utils/config");
+const install_planner_1 = require("./install-planner");
+const install_transaction_1 = require("./install-transaction");
 function bundleArtifacts(b, contentDir) {
     const refs = [];
     for (const s of b.skills) {
@@ -28,42 +31,46 @@ function bundleArtifacts(b, contentDir) {
     return refs;
 }
 /**
- * Materializes a bundle and its dependency closure into the target agents.
- * The named bundle uses `scopeOverride` if given; dependencies always use
- * their own default scope (baseline→global, project→local, ambient→global).
- * Local installs resolve under `projectRoot`; global installs use the
- * provider's absolute global path. Unsupported artifact types per agent and
- * missing sources are skipped (never thrown).
+ * Expands a bundle and its dependency closure into the flat list of artifact
+ * intents to install. Pure — resolves the closure and content roots but
+ * performs no filesystem writes and no agent/scope resolution; that's
+ * `planInstall`'s job.
  */
-function installBundle(opts) {
+function expandBundleArtifacts(opts) {
     const fallbackContentDir = opts.contentDir ?? (0, registries_1.contentRoots)()[0] ?? '';
     const closure = (0, bundles_1.resolveBundleClosure)(opts.bundleName, opts.bundles);
-    const installed = [];
-    const skipped = [];
-    for (const b of closure) {
-        const contentDir = b.contentRoot ?? fallbackContentDir;
-        const scope = b.name === opts.bundleName
-            ? opts.scopeOverride ?? (0, bundles_1.defaultScopeForBundle)(b.scope)
-            : (0, bundles_1.defaultScopeForBundle)(b.scope);
-        for (const art of bundleArtifacts(b, contentDir)) {
-            if (!fs_1.default.existsSync(art.sourcePath)) {
-                skipped.push(`${art.name} (source missing: ${art.sourcePath})`);
-                continue;
-            }
-            for (const agent of opts.agents) {
-                if (providers_1.PROVIDERS[agent][art.type] === null) {
-                    skipped.push(`${art.name} (${agent}: ${art.type} unsupported)`);
-                    continue;
-                }
-                const rel = (0, providers_1.getTargetPath)(art.type, agent, scope);
-                const baseDir = scope === 'local' ? path_1.default.join(opts.projectRoot, rel) : rel;
-                const dest = path_1.default.join(baseDir, art.installName);
-                (0, executor_1.installArtifact)(art.sourcePath, dest, opts.method);
-                installed.push(`${art.name} → ${agent} (${scope}) [${b.name}]`);
-            }
-        }
-    }
-    return { installed, skipped };
+    return closure.flatMap((b) => bundleArtifacts(b, b.contentRoot ?? fallbackContentDir));
+}
+/**
+ * Materializes a bundle and its dependency closure into the target agents.
+ *
+ * `expandBundleArtifacts` turns the bundle closure into artifact intents,
+ * `planInstall` turns those into a deduped, ownership-tracked plan (see
+ * install-planner.ts for the shared-target and ownership rules), and
+ * `applyInstallPlan` (install-transaction.ts) performs the actual
+ * transactional filesystem apply — backups before any replace, rollback on
+ * verification failure, artifact-state persistence on success.
+ *
+ * Note: unlike the pre-Task-5 implementation, scope is now resolved once for
+ * the whole call (the named bundle's own scope, or `scopeOverride`) rather
+ * than per-bundle-in-closure; dependency bundles with a *different* default
+ * scope than the named bundle no longer get their own scope. This matches
+ * the plan for Task 5's `planInstall` signature (single `scope` param) and is
+ * expected to be revisited if that distinction turns out to matter.
+ */
+function installBundle(opts) {
+    const intents = expandBundleArtifacts(opts);
+    const enabledAgents = (0, config_1.getPreferences)().enabledAgents;
+    const plan = (0, install_planner_1.planInstall)({
+        artifacts: intents,
+        selectedAgents: opts.agents,
+        enabledAgents,
+        scope: opts.scopeOverride ?? (0, bundles_1.defaultScopeForBundle)(opts.bundles.find((bundle) => bundle.name === opts.bundleName)?.scope ?? 'baseline'),
+        projectRoot: opts.projectRoot,
+        method: opts.method,
+    });
+    const apply = opts.applyPlan ?? install_transaction_1.applyInstallPlan;
+    return apply(plan);
 }
 /**
  * Installs a bundle (closure) and, when it is a project-scope bundle installed
@@ -74,9 +81,19 @@ function addBundle(opts) {
     const summary = installBundle(opts);
     const target = opts.bundles.find((b) => b.name === opts.bundleName);
     let recordedExtension = null;
-    // Check the named bundle's own artifacts (not just closure deps) were installed.
-    const ownInstalled = summary.installed.filter((line) => line.endsWith(`[${opts.bundleName}]`));
-    if (target && ownInstalled.length > 0) {
+    // Check the named bundle's OWN artifacts (not the dependency closure) were
+    // installed — i.e. at least one own artifact has a source on disk AND a
+    // type supported by at least one selected agent (matching what planInstall
+    // would actually materialize). ArtifactIntent/PlannedOperation carry no
+    // bundle provenance (install-planner.ts groups purely by physical target),
+    // so this is computed directly from the bundle's own artifact list rather
+    // than by inspecting `summary.installed`.
+    const ownInstalled = target
+        ? bundleArtifacts(target, target.contentRoot ?? opts.contentDir ?? (0, registries_1.contentRoots)()[0] ?? '')
+            .some((artifact) => fs_1.default.existsSync(artifact.sourcePath) &&
+            opts.agents.some((agent) => (0, providers_1.providerFor)(agent)[artifact.type] !== null))
+        : false;
+    if (target && ownInstalled) {
         const effective = opts.scopeOverride ?? (0, bundles_1.defaultScopeForBundle)(target.scope);
         if ((0, profile_1.shouldRecordExtension)(target.scope, effective)) {
             (0, profile_1.addExtension)(opts.projectRoot, opts.bundleName);
@@ -94,6 +111,8 @@ function syncProfile(opts) {
     const profile = (0, profile_1.readProfile)(opts.projectRoot);
     const installed = [];
     const skipped = [];
+    const modifiedFiles = [];
+    const transactionIds = [];
     for (const ext of profile.extensions) {
         if (!opts.bundles.some((b) => b.name === ext)) {
             skipped.push(`${ext} (bundle not found in registry — remove with \`awm remove ${ext}\`)`);
@@ -106,11 +125,14 @@ function syncProfile(opts) {
             method: opts.method,
             projectRoot: opts.projectRoot,
             contentDir: opts.contentDir,
+            applyPlan: opts.applyPlan,
         });
         installed.push(...summary.installed);
         skipped.push(...summary.skipped);
+        modifiedFiles.push(...summary.modifiedFiles);
+        transactionIds.push(summary.transactionId);
     }
     if (profile.extensions.length > 0)
         (0, profile_1.ensureSkillsGitignored)(opts.projectRoot, opts.agents);
-    return { installed, skipped, extensions: profile.extensions };
+    return { installed, skipped, extensions: profile.extensions, transactionIds, modifiedFiles };
 }

package/dist/src/core/bundles.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.readCatalog = readCatalog;
 exports.discoverBundles = discoverBundles;
 exports.resolveBundleSkills = resolveBundleSkills;
+exports.resolveBundleAgents = resolveBundleAgents;
 exports.defaultScopeForBundle = defaultScopeForBundle;
 exports.discoverAllBundles = discoverAllBundles;
 exports.resolveBundleClosure = resolveBundleClosure;
@@ -67,6 +68,26 @@ function resolveBundleSkills(bundleName, bundles) {
     visit(bundleName);
     return Array.from(skills);
 }
+/** Same closure-walk as `resolveBundleSkills`, over `agent`-type artifact names. */
+function resolveBundleAgents(bundleName, bundles) {
+    const byName = new Map(bundles.map((b) => [b.name, b]));
+    const seen = new Set();
+    const agents = new Set();
+    const visit = (name) => {
+        if (seen.has(name))
+            return;
+        seen.add(name);
+        const b = byName.get(name);
+        if (!b)
+            return;
+        for (const dep of b.dependsOn)
+            visit(dep);
+        for (const a of b.agents)
+            agents.add(a);
+    };
+    visit(bundleName);
+    return Array.from(agents);
+}
 /**
  * Default install scope for a bundle, derived from its scope class.
  * baseline/ambient install globally; project bundles install locally.

package/dist/src/core/context/managed-block.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AWM_END = exports.AWM_START = void 0;
+exports.normalizeManagedBody = normalizeManagedBody;
+exports.managedBlockBody = managedBlockBody;
+exports.mergeManagedBlock = mergeManagedBlock;
+exports.removeManagedBlock = removeManagedBlock;
+exports.AWM_START = '<!-- AWM:START -->';
+exports.AWM_END = '<!-- AWM:END -->';
+const BOUNDARY_PATTERN = /^<!-- AWM:BOUNDARY prefix=([0-2]) suffix=([0-1]) -->\n/u;
+function assertText(value, name) {
+    if (typeof value !== 'string')
+        throw new Error(`${name} must be a string`);
+}
+function markerOffsets(input, marker) {
+    const offsets = [];
+    let offset = input.indexOf(marker);
+    while (offset !== -1) {
+        offsets.push(offset);
+        offset = input.indexOf(marker, offset + marker.length);
+    }
+    return offsets;
+}
+function insideMarkdownFence(input, offset) {
+    let fence = null;
+    for (const line of input.slice(0, offset).split(/\r?\n/u)) {
+        const match = line.match(/^[ ]{0,3}(`{3,}|~{3,})(.*)$/u);
+        if (!match)
+            continue;
+        const run = match[1];
+        if (!fence) {
+            fence = { character: run[0], length: run.length };
+        }
+        else if (run[0] === fence.character &&
+            run.length >= fence.length &&
+            match[2].trim().length === 0) {
+            fence = null;
+        }
+    }
+    return fence !== null;
+}
+function validateMarkerOccurrences(input, prefix, marker) {
+    let offset = input.indexOf(prefix);
+    while (offset !== -1) {
+        if (!input.startsWith(marker, offset)) {
+            if (input.indexOf('-->', offset + prefix.length) === -1) {
+                throw new Error('incomplete AWM marker');
+            }
+            throw new Error('malformed AWM marker');
+        }
+        const after = offset + marker.length;
+        const startsLine = offset === 0 || input[offset - 1] === '\n';
+        const endsLine = after === input.length ||
+            input[after] === '\n' ||
+            (input[after] === '\r' && input[after + 1] === '\n');
+        if (!startsLine || !endsLine) {
+            throw new Error('AWM markers must be standalone delimiter lines');
+        }
+        if (insideMarkdownFence(input, offset)) {
+            throw new Error('AWM markers must be standalone delimiter lines outside code fences');
+        }
+        offset = input.indexOf(prefix, offset + prefix.length);
+    }
+}
+function inspect(input) {
+    validateMarkerOccurrences(input, '<!-- AWM:START', exports.AWM_START);
+    validateMarkerOccurrences(input, '<!-- AWM:END', exports.AWM_END);
+    const comments = input.match(/<!--[\s\S]*?-->/g) ?? [];
+    const malformed = comments.some((comment) => !comment.includes('AWM:BOUNDARY') &&
+        (comment.includes('AWM:START') || comment.includes('AWM:END')) &&
+        comment !== exports.AWM_START &&
+        comment !== exports.AWM_END);
+    if (malformed)
+        throw new Error('malformed AWM marker');
+    const starts = markerOffsets(input, exports.AWM_START);
+    const ends = markerOffsets(input, exports.AWM_END);
+    if (starts.length === 0 && ends.length === 0) {
+        if (input.includes('AWM:BOUNDARY')) {
+            throw new Error('malformed AWM boundary metadata');
+        }
+        return null;
+    }
+    if (starts.length !== ends.length)
+        throw new Error('unmatched AWM marker');
+    if (ends[0] < starts[0])
+        throw new Error('reversed AWM markers');
+    if (starts.length > 1) {
+        if (starts[1] < ends[0])
+            throw new Error('nested AWM markers');
+        throw new Error('duplicate AWM blocks');
+    }
+    return { start: starts[0], end: ends[0] };
+}
+function stripDelimiterNewlines(value) {
+    let result = value;
+    if (result.startsWith('\r\n'))
+        result = result.slice(2);
+    else if (result.startsWith('\n'))
+        result = result.slice(1);
+    if (result.endsWith('\r\n'))
+        result = result.slice(0, -2);
+    else if (result.endsWith('\n'))
+        result = result.slice(0, -1);
+    return result;
+}
+function contentOf(original, block) {
+    const rawContent = original.slice(block.start + exports.AWM_START.length, block.end);
+    const totalBoundaryOccurrences = original.split('AWM:BOUNDARY').length - 1;
+    const contentBoundaryOccurrences = rawContent.split('AWM:BOUNDARY').length - 1;
+    if (totalBoundaryOccurrences !== contentBoundaryOccurrences) {
+        throw new Error('malformed AWM boundary metadata');
+    }
+    let content = stripDelimiterNewlines(rawContent);
+    const boundaryOccurrences = content.split('AWM:BOUNDARY').length - 1;
+    if (boundaryOccurrences === 0)
+        return { body: content, boundary: null };
+    const boundaryMatch = content.match(BOUNDARY_PATTERN);
+    if (boundaryOccurrences !== 1 || !boundaryMatch) {
+        throw new Error('malformed AWM boundary metadata');
+    }
+    content = content.slice(boundaryMatch[0].length);
+    return {
+        body: content,
+        boundary: {
+            prefix: Number(boundaryMatch[1]),
+            suffix: Number(boundaryMatch[2]),
+        },
+    };
+}
+function render(body, boundary) {
+    const metadata = boundary
+        ? `<!-- AWM:BOUNDARY prefix=${boundary.prefix} suffix=${boundary.suffix} -->\n`
+        : '';
+    return `${exports.AWM_START}\n${metadata}${body}\n${exports.AWM_END}`;
+}
+function normalizeManagedBody(body) {
+    assertText(body, 'body');
+    const normalized = body.replace(/(?:\r?\n)+$/u, '');
+    if (normalized.length === 0)
+        throw new Error('body must be non-empty');
+    if (normalized.includes('<!-- AWM:BOUNDARY')) {
+        throw new Error('body must not contain AWM boundary metadata');
+    }
+    if (inspect(normalized))
+        throw new Error('body must not contain AWM markers');
+    return normalized;
+}
+function managedBlockBody(original) {
+    assertText(original, 'original');
+    const block = inspect(original);
+    if (!block)
+        return null;
+    return contentOf(original, block).body;
+}
+function mergeManagedBlock(original, managedBody) {
+    assertText(original, 'original');
+    const body = normalizeManagedBody(managedBody);
+    const block = inspect(original);
+    if (block) {
+        const rendered = render(body, contentOf(original, block).boundary);
+        return original.slice(0, block.start) + rendered + original.slice(block.end + exports.AWM_END.length);
+    }
+    const separator = original.length === 0
+        ? ''
+        : original.endsWith('\n\n')
+            ? ''
+            : original.endsWith('\n') ? '\n' : '\n\n';
+    const boundary = { prefix: separator.length, suffix: 1 };
+    return `${original}${separator}${render(body, boundary)}\n`;
+}
+function removeManagedBlock(original) {
+    assertText(original, 'original');
+    const block = inspect(original);
+    if (!block)
+        return original;
+    const boundary = contentOf(original, block).boundary;
+    let ownedStart = block.start;
+    let ownedEnd = block.end + exports.AWM_END.length;
+    if (boundary) {
+        const prefix = '\n'.repeat(boundary.prefix);
+        const suffix = '\n'.repeat(boundary.suffix);
+        if (original.slice(block.start - prefix.length, block.start) === prefix) {
+            ownedStart -= prefix.length;
+        }
+        if (original.slice(ownedEnd, ownedEnd + suffix.length) === suffix) {
+            ownedEnd += suffix.length;
+        }
+    }
+    return original.slice(0, ownedStart) + original.slice(ownedEnd);
+}

package/dist/src/core/context/orchestrator.js

@@ -5,6 +5,7 @@ exports.InjectionOrchestrator = void 0;
 const providers_1 = require("../../providers");
 const hook_merge_1 = require("./strategies/hook-merge");
 const config_instructions_1 = require("./strategies/config-instructions");
+const codex_agents_1 = require("./strategies/codex-agents");
 const provider_1 = require("./provider");
 const materializer_1 = require("./materializer");
 class InjectionOrchestrator {
@@ -13,7 +14,7 @@ class InjectionOrchestrator {
         this.overrides = overrides;
     }
     provider(agent) {
-        return this.overrides.providerOverride ?? providers_1.PROVIDERS[agent];
+        return this.overrides.providerOverride ?? (0, providers_1.providerFor)(agent);
     }
     strategy(agent) {
         const inj = this.overrides.providerOverride !== undefined
@@ -24,6 +25,7 @@ class InjectionOrchestrator {
         switch (inj.type) {
             case 'cc-settings-merge': return new hook_merge_1.HookMergeStrategy();
             case 'config-instructions': return new config_instructions_1.ConfigInstructionsStrategy();
+            case 'managed-agents-md': return new codex_agents_1.CodexAgentsStrategy();
         }
     }
     /** Full input: builds context from registry and materializes to disk. Used by installContext only. */

package/dist/src/core/context/project-constitution-inject.js

@@ -16,7 +16,7 @@ const providers_1 = require("../../providers");
  * cualquier agente futuro con inyección `config-instructions` hereda el trato.
  */
 function injectProjectConstitution(projectRoot, agent) {
-    const inj = providers_1.PROVIDERS[agent].injection;
+    const inj = (0, providers_1.providerFor)(agent).injection;
     if (!inj || inj.type !== 'config-instructions')
         return 'not-applicable';
     if (!fs_1.default.existsSync(path_1.default.join(projectRoot, 'CONSTITUTION.md')))

package/dist/src/core/context/regenerate.js

@@ -14,13 +14,13 @@ const fs_1 = __importDefault(require("fs"));
 const providers_1 = require("../../providers");
 const registries_1 = require("../registries");
 const orchestrator_1 = require("./orchestrator");
-function regenerateGlobalContext(orch = new orchestrator_1.InjectionOrchestrator()) {
+function regenerateGlobalContext(targets = [...providers_1.AGENT_TARGETS], orch = new orchestrator_1.InjectionOrchestrator()) {
     const skillsRoot = (0, registries_1.capabilityRoot)('skills');
     if (!skillsRoot)
         return [];
     const out = [];
-    for (const agent of Object.keys(providers_1.PROVIDERS)) {
-        const inj = providers_1.PROVIDERS[agent].injection;
+    for (const agent of targets) {
+        const inj = (0, providers_1.providerFor)(agent).injection;
         if (!inj || inj.type !== 'config-instructions')
             continue;
         if (!fs_1.default.existsSync(inj.configPath))

package/dist/src/core/context/strategies/codex-agents.js

@@ -0,0 +1,100 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodexAgentsStrategy = void 0;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../../paths");
+const atomic_file_1 = require("../../atomic-file");
+const managed_block_1 = require("../managed-block");
+const provider_1 = require("../provider");
+const PROJECT_GUIDANCE = [
+    'Read and obey `CONSTITUTION.md` before work when that file exists.',
+    'Use `.awm/profile.json` to declare project extensions, then run `awm sync`.',
+    'Run the verification commands declared by the project before completion.',
+].join('\n');
+function read(file) {
+    return fs_1.default.existsSync(file) ? fs_1.default.readFileSync(file, 'utf8') : '';
+}
+function injectFile(file, markdown) {
+    const original = read(file);
+    const merged = (0, managed_block_1.mergeManagedBlock)(original, markdown);
+    if (merged === original)
+        return 'unchanged';
+    (0, atomic_file_1.writeFileAtomic)(file, merged);
+    return 'injected';
+}
+class CodexAgentsStrategy {
+    globalPath(provider) {
+        const injection = provider.injection;
+        if (!injection || injection.type !== 'managed-agents-md') {
+            throw new Error('CodexAgentsStrategy requires a managed-agents-md provider');
+        }
+        if (typeof injection.globalPath !== 'string' || injection.globalPath.length === 0) {
+            throw new Error('managed-agents-md globalPath must be a non-empty string');
+        }
+        return injection.globalPath;
+    }
+    inject(input, provider) {
+        this.assertGlobalInput(input);
+        if (!fs_1.default.existsSync(input.ref.absPath)) {
+            throw new Error(`materialized context not found at ${input.ref.absPath}`);
+        }
+        const markdown = fs_1.default.readFileSync(input.ref.absPath, 'utf8');
+        return injectFile(this.globalPath(provider), markdown);
+    }
+    remove(input, provider) {
+        this.assertGlobalInput(input);
+        const file = this.globalPath(provider);
+        if (!fs_1.default.existsSync(file))
+            return;
+        const original = read(file);
+        const removed = (0, managed_block_1.removeManagedBlock)(original);
+        if (removed !== original)
+            (0, atomic_file_1.writeFileAtomic)(file, removed);
+    }
+    status(input, provider) {
+        this.assertGlobalInput(input);
+        const file = this.globalPath(provider);
+        if (!fs_1.default.existsSync(file))
+            return 'absent';
+        const body = (0, managed_block_1.managedBlockBody)(read(file));
+        if (body === null)
+            return 'absent';
+        if (!fs_1.default.existsSync(input.ref.absPath))
+            return 'stale';
+        const expected = fs_1.default.readFileSync(input.ref.absPath, 'utf8');
+        if ((0, provider_1.sha256)(expected) !== input.ref.contentHash)
+            return 'stale';
+        return body === (0, managed_block_1.normalizeManagedBody)(expected) ? 'injected' : 'stale';
+    }
+    injectGlobal(context) {
+        if (typeof context !== 'object' || context === null) {
+            throw new Error('context must be an object');
+        }
+        if (typeof context.markdown !== 'string' || context.markdown.length === 0) {
+            throw new Error('markdown must be a non-empty string');
+        }
+        return injectFile(path_1.default.join((0, paths_1.homeDir)(), '.codex', 'AGENTS.md'), context.markdown);
+    }
+    injectProject(projectRoot) {
+        if (typeof projectRoot !== 'string' || projectRoot.length === 0) {
+            throw new Error('projectRoot must be a non-empty string');
+        }
+        return injectFile(path_1.default.join(projectRoot, 'AGENTS.md'), PROJECT_GUIDANCE);
+    }
+    assertGlobalInput(input) {
+        if (typeof input !== 'object' || input === null) {
+            throw new Error('input must be an object');
+        }
+        if (input.scope !== 'global' || input.ref?.scope !== 'global') {
+            throw new Error('CodexAgentsStrategy supports only global injection');
+        }
+        if (typeof input.ref.absPath !== 'string' || input.ref.absPath.length === 0) {
+            throw new Error('input.ref.absPath must be a non-empty string');
+        }
+    }
+}
+exports.CodexAgentsStrategy = CodexAgentsStrategy;

package/dist/src/core/diagnostics/checks.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeProviderOverall = computeProviderOverall;
 exports.runChecks = runChecks;
 // src/core/diagnostics/checks.ts
 const path_1 = __importDefault(require("path"));
@@ -126,6 +127,21 @@ function projectChecks(p) {
     }
     return out;
 }
+// --- Task 9: overall status for the per-provider diagnostic matrix --------
+//
+// Kept separate from `overall` above: that one degrades `CheckReport` (the
+// machine+project report `init` renders before/after each run) on any
+// 'missing' CheckResult. This one degrades the NEW provider matrix
+// (doctor-only) on any check state that represents something genuinely
+// broken/absent/unsupported — 'pending-trust'/'stale'/'pending' are
+// actionable-but-expected transient states (rendered with ◷/⚠, not ✖) and
+// do not by themselves degrade `overall`, mirroring how a 'warn' CheckResult
+// doesn't degrade the machine+project report either.
+const DEGRADING_PROVIDER_STATES = ['missing', 'unsupported', 'broken', 'absent', 'conflict'];
+function computeProviderOverall(providers) {
+    const degraded = providers.some((p) => p.checks.some((c) => DEGRADING_PROVIDER_STATES.includes(c.state)));
+    return degraded ? 'degraded' : 'healthy';
+}
 function runChecks(ctx) {
     const results = [
         ...machineChecks(ctx.machine),