agentic-workflow-manager 3.11.0 → 3.13.0

package/dist/src/commands/doctor.js

@@ -101,7 +101,7 @@ function renderProviderReport(report) {
     lines.push(picocolors_1.default.bold('AWM · harness status'));
     lines.push('');
     for (const provider of report.providers) {
-        lines.push(`Provider: ${provider.label}`);
+        lines.push(`Provider: ${provider.label} ${picocolors_1.default.dim(`(${provider.tier})`)}`);
         for (const check of provider.checks)
             lines.push(providerCheckLine(check));
         lines.push('');

package/dist/src/commands/preflight/checks.js

@@ -9,6 +9,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const status_1 = require("../sensors/status");
 const init_1 = require("../sensors/init");
+const baseline_1 = require("../sensors/baseline");
 const paths_1 = require("../../core/paths");
 const MANIFEST = path_1.default.join('.awm', 'sensors.json');
 /**
@@ -36,6 +37,18 @@ function readManifest(cwd) {
         return null;
     }
 }
+/**
+ * Total sensor entries and how many are enabled (`enabled !== false`, so a missing
+ * `enabled` field defaults to counted-as-enabled). Shared by `checkManifest` and
+ * `checkSensorsBaseline` — they were previously two copies of the identical
+ * predicate, which post-implementation-qa flagged: a hardening applied to one (e.g.
+ * guarding a malformed sensor entry) would silently NOT apply to the other unless
+ * someone remembered to edit both. One function, two callers, one place to harden.
+ */
+function countEnabledSensors(manifest) {
+    const entries = Object.values(manifest.sensors ?? {});
+    return { total: entries.length, enabled: entries.filter(s => s.enabled !== false).length };
+}
 /**
  * A repo may legitimately have no sensors — but it has to SAY so, in a committed file.
  *
@@ -62,8 +75,7 @@ function checkManifest(cwd, manifest) {
             remedy: 'fix or regenerate it with `awm sensors init`',
         };
     }
-    const total = Object.keys(manifest.sensors ?? {}).length;
-    const enabled = Object.values(manifest.sensors ?? {}).filter(s => s.enabled !== false).length;
+    const { total, enabled } = countEnabledSensors(manifest);
     // total === 0 is NOT an opt-out: a deliberate opt-out lists every known sensor NAME
     // explicitly with `enabled: false` (total > 0, enabled === 0). Zero entries means
     // nothing was ever configured — most commonly because the registry had no pack.json
@@ -135,6 +147,51 @@ function checkPack(cwd, manifest) {
     }
     return { id: 'pack', ok: true, detail: `${manifest.pack} matches the detected stack` };
 }
+/**
+ * Advisory only — `ok` is ALWAYS `true`, same contract as `checkHost` below. A team
+ * adopting AWM on a legacy repo starts with pre-existing sensor findings; the ratchet
+ * (`awm sensors baseline`, `.awm/sensors.baseline.json`) exists precisely to snapshot
+ * those as accepted debt so the gate only fails on genuinely NEW findings. But nothing
+ * today surfaces that the mechanism exists — the team discovers it only after hitting a
+ * wall of red findings and going looking. This nudges them toward it before that
+ * happens. It never blocks preflight: a repo can legitimately have zero debt to
+ * snapshot (sensors enabled from day one), and "no baseline yet" is not itself a
+ * failure — only the operator's lack of awareness that baselining is an option is the
+ * problem this addresses.
+ *
+ * Only called when a manifest exists (see the conditional spread in `preflight()`) —
+ * there is nothing to baseline without sensors configured in the first place, so this
+ * mirrors how `checkTools`/`checkPack` are skipped entirely rather than reported on a
+ * repo that was never set up.
+ *
+ * Also requires at least one ENABLED sensor, via the same `countEnabledSensors` helper
+ * `checkManifest` uses — a deliberate opt-out (every sensor `enabled: false`) or an
+ * unparseable/empty manifest has nothing to baseline either, and nudging "run `awm
+ * sensors baseline`" there would be actively misleading rather than merely unnecessary.
+ *
+ * Presence is checked via `readBaseline` (same function `partition()` uses at gate time
+ * to decide suppression), not a raw `fs.existsSync` — a baseline PATH that exists but
+ * isn't a readable JSON file (e.g. a stray directory at that path) is treated by the
+ * real gate as "no baseline, nothing suppressed"; `existsSync` alone would have reported
+ * "baseline present" for that same case, reassuring the operator that debt is being
+ * suppressed when it silently is not.
+ */
+function checkSensorsBaseline(cwd, manifest) {
+    const enabled = manifest ? countEnabledSensors(manifest).enabled : 0;
+    if (enabled === 0) {
+        return { id: 'sensors-baseline', ok: true, detail: 'no enabled sensors — nothing to baseline' };
+    }
+    if ((0, baseline_1.readBaseline)(cwd) !== null) {
+        return { id: 'sensors-baseline', ok: true, detail: 'baseline present' };
+    }
+    return {
+        id: 'sensors-baseline',
+        ok: true,
+        detail: 'sensors configured, no baseline yet — awm sensors baseline',
+        remedy: 'run `awm sensors baseline` to snapshot pre-existing findings as accepted debt, '
+            + 'so the gate only chases new problems',
+    };
+}
 /**
  * Extract just the hostname portion of a git remote URL — never match against the
  * full URL string. A bare substring check against the whole remote (`remote.includes
@@ -224,9 +281,10 @@ function preflight(cwd = process.cwd()) {
     const checks = [
         checkContext(cwd),
         checkManifest(cwd, manifest),
-        // Skipped when there is no manifest: reporting "tools broken" on a repo that was
-        // never set up buries the one thing the operator needs to read.
-        ...(manifestExists ? [checkTools(cwd), checkPack(cwd, manifest)] : []),
+        // Skipped when there is no manifest: reporting "tools broken" (or nudging toward
+        // a baseline that has nothing to snapshot) on a repo that was never set up
+        // buries the one thing the operator needs to read.
+        ...(manifestExists ? [checkTools(cwd), checkPack(cwd, manifest), checkSensorsBaseline(cwd, manifest)] : []),
         // Runs unconditionally — orthogonal to sensor configuration entirely, this is
         // about PR/MR tooling, not sensors.
         checkHost(cwd),

package/dist/src/commands/preflight/index.js

@@ -20,7 +20,12 @@ function exitCodeFor(report) {
     return report.status === 'ready' ? 0 : 1;
 }
 function formatReport(report) {
-    const lines = report.checks.map(c => `  ${c.ok ? picocolors_1.default.green('✔') : picocolors_1.default.red('✘')}  ${c.id.padEnd(9)} ${c.detail}`
+    // Computed from the actual ids present, not hardcoded to the widest id THIS
+    // report happens to have — a fixed literal here silently misaligns the moment a
+    // longer `PreflightCheck['id']` is added (confirmed: 'sensors-baseline', at 16
+    // chars, broke a hardcoded 9-char pad).
+    const idWidth = Math.max(0, ...report.checks.map(c => c.id.length));
+    const lines = report.checks.map(c => `  ${c.ok ? picocolors_1.default.green('✔') : picocolors_1.default.red('✘')}  ${c.id.padEnd(idWidth)} ${c.detail}`
         + (c.remedy ? `\n       ${picocolors_1.default.dim('→ ' + c.remedy)}` : ''));
     if (report.status === 'ready') {
         return `${picocolors_1.default.green('✔')}  Harness ready — this project can be gated.\n${lines.join('\n')}\n`;

package/dist/src/commands/sensors/baseline.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.BASELINE_FILE = void 0;
 exports.fingerprint = fingerprint;
 exports.readBaseline = readBaseline;
 exports.writeBaseline = writeBaseline;
@@ -11,7 +12,7 @@ exports.buildBaseline = buildBaseline;
 const crypto_1 = __importDefault(require("crypto"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
-const BASELINE_FILE = path_1.default.join('.awm', 'sensors.baseline.json');
+exports.BASELINE_FILE = path_1.default.join('.awm', 'sensors.baseline.json');
 /**
  * Mask runs of digits so location noise embedded in messages (e.g. the tsc
  * formatter writes "... line 199 ...") doesn't change the fingerprint when code
@@ -43,7 +44,7 @@ function fingerprint(sensor, e) {
     return crypto_1.default.createHash('sha1').update(basis).digest('hex');
 }
 function readBaseline(cwd) {
-    const p = path_1.default.join(cwd, BASELINE_FILE);
+    const p = path_1.default.join(cwd, exports.BASELINE_FILE);
     if (!fs_1.default.existsSync(p))
         return null;
     try {
@@ -55,7 +56,7 @@ function readBaseline(cwd) {
 }
 function writeBaseline(cwd, baseline) {
     fs_1.default.mkdirSync(path_1.default.join(cwd, '.awm'), { recursive: true });
-    fs_1.default.writeFileSync(path_1.default.join(cwd, BASELINE_FILE), JSON.stringify(baseline, null, 2), 'utf-8');
+    fs_1.default.writeFileSync(path_1.default.join(cwd, exports.BASELINE_FILE), JSON.stringify(baseline, null, 2), 'utf-8');
 }
 /**
  * Split a sensor's findings into new vs baseline-suppressed. With no accepted

package/dist/src/core/context/materializer.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.globalContextPath = globalContextPath;
+exports.projectContextPath = projectContextPath;
 exports.materialize = materialize;
 // cli/src/core/context/materializer.ts
 const fs_1 = __importDefault(require("fs"));
@@ -13,6 +14,12 @@ const paths_1 = require("../paths");
 function globalContextPath() {
     return path_1.default.join((0, paths_1.awmHome)(), 'context', 'awm-context.md');
 }
+/** Project-scoped materialized-source path — mirrors globalContextPath()'s shape,
+ *  rooted in the project instead of ~/.awm. This is the MATERIALIZED SOURCE
+ *  content path, distinct from the injection TARGET file (<projectRoot>/AGENTS.md). */
+function projectContextPath(projectRoot) {
+    return path_1.default.join(projectRoot, '.awm', 'context', 'awm-context.md');
+}
 function materialize(ctx, absPath, scope) {
     let onDisk = null;
     try {

package/dist/src/core/context/orchestrator.js

@@ -28,25 +28,42 @@ class InjectionOrchestrator {
             case 'managed-agents-md': return new codex_agents_1.CodexAgentsStrategy();
         }
     }
+    /** Materialized-source content path for `op.scope` — global under ~/.awm, local under the project. */
+    contextPathFor(op) {
+        if (this.overrides.contextPathOverride)
+            return this.overrides.contextPathOverride;
+        if (op.scope === 'local') {
+            if (!op.projectRoot)
+                throw new Error('projectRoot is required for local-scope context operations');
+            return (0, materializer_1.projectContextPath)(op.projectRoot);
+        }
+        return (0, materializer_1.globalContextPath)();
+    }
     /** Full input: builds context from registry and materializes to disk. Used by installContext only. */
     inputFor(op) {
         const ctx = (0, provider_1.buildContext)({ registryRoot: op.registryRoot, profileExtensions: op.profileExtensions });
-        const absPath = this.overrides.contextPathOverride ?? (0, materializer_1.globalContextPath)();
+        const absPath = this.contextPathFor(op);
         const ref = (0, materializer_1.materialize)(ctx, absPath, op.scope);
-        return { ref, registryRoot: op.registryRoot, installMethod: op.installMethod, agent: op.agent, scope: op.scope };
+        return {
+            ref, registryRoot: op.registryRoot, installMethod: op.installMethod,
+            agent: op.agent, scope: op.scope, projectRoot: op.projectRoot,
+        };
     }
     /** Path-only input: no buildContext, no materialize. Safe for remove() which never reads contentHash. */
     pathInputFor(op) {
-        const absPath = this.overrides.contextPathOverride ?? (0, materializer_1.globalContextPath)();
+        const absPath = this.contextPathFor(op);
         const ref = { absPath, scope: op.scope, contentHash: '' };
-        return { ref, registryRoot: op.registryRoot, installMethod: op.installMethod, agent: op.agent, scope: op.scope };
+        return {
+            ref, registryRoot: op.registryRoot, installMethod: op.installMethod,
+            agent: op.agent, scope: op.scope, projectRoot: op.projectRoot,
+        };
     }
     /**
      * Status input: builds context from registry (to get expected hash) but does NOT materialize.
      * Avoids silently correcting a stale file before the strategy can observe it.
      */
     statusInputFor(op) {
-        const absPath = this.overrides.contextPathOverride ?? (0, materializer_1.globalContextPath)();
+        const absPath = this.contextPathFor(op);
         let contentHash = '';
         try {
             const ctx = (0, provider_1.buildContext)({ registryRoot: op.registryRoot, profileExtensions: op.profileExtensions });
@@ -59,7 +76,10 @@ class InjectionOrchestrator {
                 throw err;
         }
         const ref = { absPath, scope: op.scope, contentHash };
-        return { ref, registryRoot: op.registryRoot, installMethod: op.installMethod, agent: op.agent, scope: op.scope };
+        return {
+            ref, registryRoot: op.registryRoot, installMethod: op.installMethod,
+            agent: op.agent, scope: op.scope, projectRoot: op.projectRoot,
+        };
     }
     installContext(op) {
         const provider = this.provider(op.agent);

package/dist/src/core/context/strategies/codex-agents.js

@@ -6,7 +6,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CodexAgentsStrategy = void 0;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
-const paths_1 = require("../../paths");
 const atomic_file_1 = require("../../atomic-file");
 const managed_block_1 = require("../managed-block");
 const provider_1 = require("../provider");
@@ -26,6 +25,17 @@ function injectFile(file, markdown) {
     (0, atomic_file_1.writeFileAtomic)(file, merged);
     return 'injected';
 }
+/** For local-scope providers (Cursor/Copilot), context injection (`inject`) and project
+ *  constitution injection (`injectProject`) target the SAME file — `targetFile`'s local
+ *  branch resolves both to `<projectRoot>/<localFile>` (AGENTS.md). Global-scope providers
+ *  (Codex) don't have this collision: context goes to a separate global file, constitution
+ *  stays project-local. `mergeManagedBlock` supports only one managed slot per file, so for
+ *  local scope the two payloads must be combined into a single write — `inject`/`status`
+ *  append `PROJECT_GUIDANCE` here, and `injectProject` skips its own AGENTS.md write for
+ *  these providers (see its `contextCoversThisFile` check) so there is exactly one writer. */
+function withProjectGuidance(markdown, scope) {
+    return scope === 'local' ? `${markdown}\n\n${PROJECT_GUIDANCE}` : markdown;
+}
 class CodexAgentsStrategy {
     globalPath(provider) {
         const injection = provider.injection;
@@ -38,16 +48,16 @@ class CodexAgentsStrategy {
         return injection.globalPath;
     }
     inject(input, provider) {
-        this.assertGlobalInput(input);
+        const scope = this.assertSupportedScope(input, provider);
         if (!fs_1.default.existsSync(input.ref.absPath)) {
             throw new Error(`materialized context not found at ${input.ref.absPath}`);
         }
         const markdown = fs_1.default.readFileSync(input.ref.absPath, 'utf8');
-        return injectFile(this.globalPath(provider), markdown);
+        return injectFile(this.targetFile(provider, scope, input.projectRoot), withProjectGuidance(markdown, scope));
     }
     remove(input, provider) {
-        this.assertGlobalInput(input);
-        const file = this.globalPath(provider);
+        const scope = this.assertSupportedScope(input, provider);
+        const file = this.targetFile(provider, scope, input.projectRoot);
         if (!fs_1.default.existsSync(file))
             return;
         const original = read(file);
@@ -56,8 +66,8 @@ class CodexAgentsStrategy {
             (0, atomic_file_1.writeFileAtomic)(file, removed);
     }
     status(input, provider) {
-        this.assertGlobalInput(input);
-        const file = this.globalPath(provider);
+        const scope = this.assertSupportedScope(input, provider);
+        const file = this.targetFile(provider, scope, input.projectRoot);
         if (!fs_1.default.existsSync(file))
             return 'absent';
         const body = (0, managed_block_1.managedBlockBody)(read(file));
@@ -68,33 +78,77 @@ class CodexAgentsStrategy {
         const expected = fs_1.default.readFileSync(input.ref.absPath, 'utf8');
         if ((0, provider_1.sha256)(expected) !== input.ref.contentHash)
             return 'stale';
-        return body === (0, managed_block_1.normalizeManagedBody)(expected) ? 'injected' : 'stale';
+        return body === (0, managed_block_1.normalizeManagedBody)(withProjectGuidance(expected, scope)) ? 'injected' : 'stale';
     }
-    injectGlobal(context) {
+    injectGlobal(context, provider) {
         if (typeof context !== 'object' || context === null) {
             throw new Error('context must be an object');
         }
         if (typeof context.markdown !== 'string' || context.markdown.length === 0) {
             throw new Error('markdown must be a non-empty string');
         }
-        return injectFile(path_1.default.join((0, paths_1.homeDir)(), '.codex', 'AGENTS.md'), context.markdown);
+        return injectFile(this.globalPath(provider), context.markdown);
     }
-    injectProject(projectRoot) {
+    injectProject(projectRoot, provider, agent) {
         if (typeof projectRoot !== 'string' || projectRoot.length === 0) {
             throw new Error('projectRoot must be a non-empty string');
         }
-        return injectFile(path_1.default.join(projectRoot, 'AGENTS.md'), PROJECT_GUIDANCE);
+        // A provider whose context injection is ITSELF local-scope (globalPath === null —
+        // today: Cursor, Copilot) already owns this exact file's managed block via `inject()`
+        // (see withProjectGuidance) — writing PROJECT_GUIDANCE here too would be a second
+        // writer of the same single-slot block, silently overwriting whichever one runs last.
+        // Global-scope providers (Codex) have no such collision: their context targets a
+        // separate global file, so this is the only writer of the project AGENTS.md.
+        const injection = provider.injection;
+        const contextCoversThisFile = injection?.type === 'managed-agents-md' && injection.globalPath === null;
+        const result = contextCoversThisFile
+            ? 'unchanged'
+            : injectFile(path_1.default.join(projectRoot, 'AGENTS.md'), PROJECT_GUIDANCE);
+        let carrierResult = 'unchanged';
+        if (agent === 'cursor') {
+            // Cursor's Background/Cloud Agent does not reliably read AGENTS.md (open,
+            // staff-acknowledged bug on Cursor's own community forum, unresolved as of
+            // this research — see docs/plans/2026-08-07-team-rollout-hardening-design.md,
+            // D4 correction note). Interactive Agent mode DOES read AGENTS.md, unaffected.
+            // Write the same guidance as a redundant .mdc carrier with alwaysApply: true
+            // so the managed context survives regardless of which Cursor mode is active.
+            carrierResult = injectFile(path_1.default.join(projectRoot, '.cursor', 'rules', 'awm.mdc'), `---\ndescription: AWM project guidance (redundant carrier — see AGENTS.md)\nglobs:\nalwaysApply: true\n---\n\n${PROJECT_GUIDANCE}`);
+        }
+        return result === 'injected' || carrierResult === 'injected' ? 'injected' : 'unchanged';
+    }
+    /** The scope this provider's managed-agents-md injection operates at: 'local'
+     *  when it has no global AGENTS.md-equivalent (globalPath === null), else 'global'. */
+    requiredScope(provider) {
+        const injection = provider.injection;
+        if (!injection || injection.type !== 'managed-agents-md') {
+            throw new Error('CodexAgentsStrategy requires a managed-agents-md provider');
+        }
+        return injection.globalPath === null ? 'local' : 'global';
+    }
+    /** The actual file this strategy injects/removes/checks, given a scope. */
+    targetFile(provider, scope, projectRoot) {
+        if (scope === 'global')
+            return this.globalPath(provider);
+        if (!projectRoot)
+            throw new Error('projectRoot is required for local-scope injection');
+        const injection = provider.injection;
+        if (!injection || injection.type !== 'managed-agents-md') {
+            throw new Error('CodexAgentsStrategy requires a managed-agents-md provider');
+        }
+        return path_1.default.join(projectRoot, injection.localFile);
     }
-    assertGlobalInput(input) {
+    assertSupportedScope(input, provider) {
         if (typeof input !== 'object' || input === null) {
             throw new Error('input must be an object');
         }
-        if (input.scope !== 'global' || input.ref?.scope !== 'global') {
-            throw new Error('CodexAgentsStrategy supports only global injection');
+        const required = this.requiredScope(provider);
+        if (input.scope !== required || input.ref?.scope !== required) {
+            throw new Error(`CodexAgentsStrategy for ${provider.label} supports only ${required} injection`);
         }
         if (typeof input.ref.absPath !== 'string' || input.ref.absPath.length === 0) {
             throw new Error('input.ref.absPath must be a non-empty string');
         }
+        return required;
     }
 }
 exports.CodexAgentsStrategy = CodexAgentsStrategy;

package/dist/src/core/diagnostics/context.js

@@ -111,14 +111,17 @@ function gatherMachine(bundles, agent = 'claude-code') {
         hookDegraded = hs.overall === 'DEGRADED';
     }
     catch { /* sin soporte de hooks → ausente */ }
-    // devCore (bundle baseline)
+    // devCore (bundle baseline) — skillsDir is null only for providers with no global skill
+    // discovery mechanism (today: Copilot); treated the same as "nothing linked here yet".
     const skillsDir = (0, providers_1.providerFor)(agent).skill.global;
     const baseline = bundles.find((b) => b.scope === 'baseline');
     let devCorePresent = false;
     let brokenLinks = [];
     if (baseline) {
         const skillNames = (0, bundles_1.resolveBundleSkills)(baseline.name, bundles);
-        const { linked, broken } = classifyLinks(skillNames, skillsDir);
+        const { linked, broken } = skillsDir !== null
+            ? classifyLinks(skillNames, skillsDir)
+            : { linked: [], broken: [] };
         const absent = skillNames.filter((s) => !linked.includes(s) && !broken.includes(s));
         devCorePresent = skillNames.length > 0 && (linked.length + broken.length) > 0;
         brokenLinks = [...broken, ...absent];
@@ -133,7 +136,7 @@ function gatherMachine(bundles, agent = 'claude-code') {
         // the real Codex+OpenCode coexistence E2E test
         // (tests/integration/codex-provider-isolated.test.ts).
         const agentConfig = (0, providers_1.providerFor)(agent).agent;
-        if (agentConfig) {
+        if (agentConfig && agentConfig.global !== null) {
             const agentNames = (0, bundles_1.resolveBundleAgents)(baseline.name, bundles);
             if (agentNames.length > 0) {
                 const filenames = agentNames.map((n) => agentConfig.renderer === 'codex-agent-toml' ? `${n}.toml` : n);
@@ -154,7 +157,7 @@ function gatherMachine(bundles, agent = 'claude-code') {
     catch { /* sin config → ningún ambient deseado */ }
     const installed = wanted.filter((name) => {
         const skillNames = (0, bundles_1.resolveBundleSkills)(name, bundles);
-        if (skillNames.length === 0)
+        if (skillNames.length === 0 || skillsDir === null)
             return false;
         const { linked } = classifyLinks(skillNames, skillsDir);
         return linked.length === skillNames.length;
@@ -165,7 +168,9 @@ function gatherMachine(bundles, agent = 'claude-code') {
         devCore: { present: devCorePresent, brokenLinks },
         ambient: { wanted, installed },
         contextInjection: gatherContextInjection(),
-        globalSkills: (0, skill_integrity_1.classifyGlobalSkills)(skillsDir, (0, registries_1.contentRoots)()),
+        globalSkills: skillsDir !== null
+            ? (0, skill_integrity_1.classifyGlobalSkills)(skillsDir, (0, registries_1.contentRoots)())
+            : { valid: [], repairable: [], dead: [] },
     };
 }
 function gatherProject(root, bundles, agent = 'claude-code') {
@@ -203,6 +208,6 @@ function gatherContext(opts = {}) {
     return {
         machine: gatherMachine(bundles, agent),
         project: root ? gatherProject(root, bundles, agent) : null,
-        providers: (0, provider_checks_1.gatherProviderChecks)(agents, scanSkills),
+        providers: (0, provider_checks_1.gatherProviderChecks)(agents, scanSkills, root ?? undefined),
     };
 }

package/dist/src/core/diagnostics/provider-checks.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.providerTier = providerTier;
 exports.gatherProviderChecks = gatherProviderChecks;
 // src/core/diagnostics/provider-checks.ts
 //
@@ -20,6 +21,26 @@ const provider_version_1 = require("../provider-version");
 const status_1 = require("../../commands/hooks/status");
 const orchestrator_1 = require("../context/orchestrator");
 const registries_1 = require("../registries");
+/** File extension a healthy AWM install actually produces for each non-`'link'` renderer —
+ *  used by `skillsGlobalCheck` to require AWM-shaped evidence, not just an arbitrary
+ *  non-empty directory (a user's own unrelated file in `~/.cursor/rules` would otherwise
+ *  read as `'supported'`). Renderers absent from this map (i.e. `'link'`) never reach the
+ *  branch that reads it. */
+const RENDERED_SKILL_EXTENSIONS = {
+    'cursor-mdc': '.mdc',
+    'copilot-instructions': '.instructions.md',
+};
+/** Structural classification, computed purely from `provider`'s config shape — see
+ *  `ProviderTier`'s doc comment in `types.ts` for what each tier means. */
+function providerTier(provider) {
+    if (provider.hooks)
+        return 'hooks-native';
+    if (provider.injection?.type === 'config-instructions')
+        return 'config-managed';
+    if (provider.injection)
+        return 'agents-md-managed';
+    return 'context-only';
+}
 function binaryVersionCheck(agent) {
     const provider = (0, providers_1.providerFor)(agent);
     if (!provider.versionCommand || !provider.minimumVersion) {
@@ -41,7 +62,52 @@ function binaryVersionCheck(agent) {
         };
     }
 }
-function skillsGlobalCheck(dir, owners, integrity) {
+/** Returns `null` (dropped, same convention as `agentsNativeCheck`/`hookTrustCheck`) when
+ *  `dir` is null — i.e. the provider has no global skill discovery mechanism at all
+ *  (today: Copilot, see `globalUnsupportedReason` in providers/index.ts).
+ *
+ *  `renderer` gates which verification is possible: `classifyGlobalSkills` (via `integrity`)
+ *  only ever sees symlinks — `if (!lst.isSymbolicLink()) continue;` — so for a rendered
+ *  format (`cursor-mdc`, `copilot-instructions`) it scans a directory of real files and
+ *  finds nothing, which would make `broken` silently read 0 regardless of whether the
+ *  rendered files are actually well-formed. Reporting `'healthy'` from a scan that
+ *  structurally can't see the files it's supposed to check would be a false green, so for
+ *  any non-`'link'` renderer this reports presence only, honestly, via `detail`. */
+function skillsGlobalCheck(dir, owners, integrity, renderer) {
+    if (dir === null)
+        return null;
+    if (renderer !== 'link') {
+        let entries;
+        try {
+            entries = fs_1.default.readdirSync(dir);
+        }
+        catch {
+            // best-effort: any readdirSync failure (absent dir, EACCES, …) reads the
+            // same as "nothing installed" here — a permissions error surfacing as
+            // `remediationCode: 'awm-init'` is a worse remedy than none, but this
+            // check has no channel to report "can't tell" separately from "absent"
+            // (same tradeoff already made by this file's agentsNativeCheck and by
+            // skill-integrity.ts's classifyGlobalSkills — a systemic, pre-existing
+            // pattern in this codebase, not introduced here).
+            entries = [];
+        }
+        // Require at least one entry with the extension this renderer actually produces,
+        // not just ANY file — a directory non-empty only because of the user's own
+        // pre-existing, unrelated rule/instructions file must not read as "AWM installed".
+        // Still not full integrity verification (a stray file with the right extension but
+        // wrong content still passes) — that residual gap is the same honest tradeoff this
+        // function's doc comment already accepts for the non-`'link'` branch generally.
+        const ext = RENDERED_SKILL_EXTENSIONS[renderer];
+        const present = ext ? entries.some((e) => e.endsWith(ext)) : entries.length > 0;
+        return {
+            id: 'skills.global',
+            state: present ? 'supported' : 'absent',
+            target: dir,
+            owners: owners.length > 1 ? owners : undefined,
+            detail: present ? 'rendered install — content integrity not verified' : undefined,
+            remediationCode: present ? undefined : 'awm-init',
+        };
+    }
     const shared = owners.length > 1;
     const broken = integrity.repairable.length + integrity.dead.length;
     // Broken links are checked BEFORE shared: 'shared' is a non-degrading/OK state
@@ -101,7 +167,7 @@ function tomlAgentsHealthy(dir, entries) {
  */
 function agentsNativeCheck(agent) {
     const provider = (0, providers_1.providerFor)(agent);
-    if (!provider.agent)
+    if (!provider.agent || provider.agent.global === null)
         return null;
     const dir = provider.agent.global;
     let entries;
@@ -152,21 +218,34 @@ function hookTrustCheck(agent) {
 /** R7: reflects the provider's global context-delivery mechanism (config-instructions /
  *  managed-agents-md). claude-code's context rides the SessionStart hook — already
  *  covered by hook.trust, so this check is OMITTED (returns null) rather than reported,
- *  to avoid double-reporting the same fact as a separate, redundant row. */
-function contextGlobalCheck(agent) {
+ *  to avoid double-reporting the same fact as a separate, redundant row.
+ *
+ *  Scope mirrors `init/steps.ts`'s `stepContextInjection` exactly: a `managed-agents-md`
+ *  provider with `globalPath === null` (today: Cursor, Copilot) has no user-level
+ *  AGENTS.md-equivalent file, so its context is legitimately delivered at LOCAL (project)
+ *  scope instead — asking `contextStatus` about 'global' for these providers always
+ *  resolved to 'absent' regardless of whether the local injection actually succeeded. The
+ *  check's `id` stays `'context.global'` either way (stable JSON field); only the
+ *  underlying scope resolution changes. `projectRoot` is only meaningful when the resolved
+ *  scope is 'local' — if it's needed but missing, `contextStatus` throws cleanly
+ *  (`InjectionOrchestrator`'s `contextPathFor`) and the catch below falls back to 'absent',
+ *  same as any other failure to resolve status. */
+function contextGlobalCheck(agent, projectRoot) {
     const injection = (0, providers_1.providerFor)(agent).injection;
     if (!injection || injection.type === 'cc-settings-merge') {
         return null;
     }
+    const scope = injection.type === 'managed-agents-md' && injection.globalPath === null ? 'local' : 'global';
     let state = 'absent';
     try {
         const orchestrator = new orchestrator_1.InjectionOrchestrator();
         const result = orchestrator.contextStatus({
             agent,
-            scope: 'global',
+            scope,
             registryRoot: (0, registries_1.capabilityRoot)('skills') ?? '',
             installMethod: 'symlink',
             profileExtensions: [],
+            projectRoot,
         });
         state = result === 'injected' ? 'delivered' : result === 'stale' ? 'stale' : 'absent';
     }
@@ -190,10 +269,12 @@ function contextGlobalCheck(agent) {
  * snapshot for rollback comparison — a different shape, a different purpose). No file
  * currently imports both, but the names are close enough to trip up a future reader/editor.
  */
-function gatherProviderChecks(agents, scanSkills) {
+function gatherProviderChecks(agents, scanSkills, projectRoot) {
     const ownersByDir = new Map();
     for (const agent of agents) {
         const dir = (0, providers_1.providerFor)(agent).skill.global;
+        if (dir === null)
+            continue;
         const owners = ownersByDir.get(dir) ?? [];
         owners.push(agent);
         ownersByDir.set(dir, owners);
@@ -205,15 +286,15 @@ function gatherProviderChecks(agents, scanSkills) {
     return agents.map((agent) => {
         const provider = (0, providers_1.providerFor)(agent);
         const dir = provider.skill.global;
-        const owners = ownersByDir.get(dir) ?? [agent];
-        const integrity = scansByDir.get(dir) ?? { valid: [], repairable: [], dead: [] };
+        const owners = (dir !== null ? ownersByDir.get(dir) : undefined) ?? [agent];
+        const integrity = (dir !== null ? scansByDir.get(dir) : undefined) ?? { valid: [], repairable: [], dead: [] };
         const checks = [
             binaryVersionCheck(agent),
-            skillsGlobalCheck(dir, owners, integrity),
+            skillsGlobalCheck(dir, owners, integrity, provider.skill.renderer),
             agentsNativeCheck(agent),
             hookTrustCheck(agent),
-            contextGlobalCheck(agent),
+            contextGlobalCheck(agent, projectRoot),
         ].filter((check) => check !== null);
-        return { id: agent, label: provider.label, checks };
+        return { id: agent, label: provider.label, tier: providerTier(provider), checks };
     });
 }