agentic-workflow-manager 8.3.0 → 8.4.0

package/dist/src/core/dashboard/validate.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DashboardValidationError = void 0;
+exports.validateDashboardSnapshotV1 = validateDashboardSnapshotV1;
+const SECTION_ORDER = ['machine', 'project', 'planning', 'execution', 'qa', 'retro', 'history'];
+const ITEM_STATES = ['ok', 'attention', 'missing', 'unavailable', 'not_applicable'];
+const AVAILABILITIES = ['available', 'unavailable', 'not_applicable'];
+const OVERALLS = ['healthy', 'degraded'];
+const CONFIDENCES = ['none', 'provisional', 'observing', 'supported'];
+const ACTIONABLE_STATES = new Set(['attention', 'missing', 'unavailable']);
+class DashboardValidationError extends Error {
+    constructor(message) {
+        super(`Invalid DashboardSnapshotV1: ${message}`);
+        this.name = 'DashboardValidationError';
+    }
+}
+exports.DashboardValidationError = DashboardValidationError;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function assertRecord(value, path) {
+    if (!isRecord(value))
+        throw new DashboardValidationError(`${path} must be an object`);
+}
+function assertOnlyKeys(value, keys, path) {
+    for (const key of Object.keys(value)) {
+        if (!keys.includes(key))
+            throw new DashboardValidationError(`${path}.${key} is not supported`);
+    }
+}
+function assertNonEmptyString(value, path) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new DashboardValidationError(`${path} must be a non-empty string`);
+    }
+}
+function assertEnum(value, values, path) {
+    if (typeof value !== 'string' || !values.includes(value)) {
+        throw new DashboardValidationError(`${path} must be one of ${values.join(', ')}`);
+    }
+}
+/** Validates the durable public dashboard boundary without coercing unknown input. */
+function validateDashboardSnapshotV1(value) {
+    assertRecord(value, 'snapshot');
+    assertOnlyKeys(value, ['schema', 'generatedAt', 'overall', 'project', 'confidence', 'sections'], 'snapshot');
+    if (value.schema !== 1)
+        throw new DashboardValidationError('schema must be version 1');
+    assertNonEmptyString(value.generatedAt, 'generatedAt');
+    if (Number.isNaN(Date.parse(value.generatedAt)))
+        throw new DashboardValidationError('generatedAt must be a valid date-time');
+    assertEnum(value.overall, OVERALLS, 'overall');
+    assertEnum(value.confidence, CONFIDENCES, 'confidence');
+    assertRecord(value.project, 'project');
+    assertOnlyKeys(value.project, ['detected', 'label'], 'project');
+    if (typeof value.project.detected !== 'boolean')
+        throw new DashboardValidationError('project.detected must be boolean');
+    assertNonEmptyString(value.project.label, 'project.label');
+    if (!Array.isArray(value.sections))
+        throw new DashboardValidationError('sections must be an array');
+    const sectionIds = new Set();
+    const itemIds = new Set();
+    let previousOrder = -1;
+    for (const [sectionIndex, section] of value.sections.entries()) {
+        const sectionPath = `sections[${sectionIndex}]`;
+        assertRecord(section, sectionPath);
+        assertOnlyKeys(section, ['id', 'availability', 'items'], sectionPath);
+        assertEnum(section.id, SECTION_ORDER, `${sectionPath}.id`);
+        const order = SECTION_ORDER.indexOf(section.id);
+        if (order <= previousOrder)
+            throw new DashboardValidationError('section order must be deterministic');
+        previousOrder = order;
+        if (sectionIds.has(section.id))
+            throw new DashboardValidationError(`duplicate section id ${section.id}`);
+        sectionIds.add(section.id);
+        assertEnum(section.availability, AVAILABILITIES, `${sectionPath}.availability`);
+        if (!Array.isArray(section.items))
+            throw new DashboardValidationError(`${sectionPath}.items must be an array`);
+        for (const [itemIndex, item] of section.items.entries()) {
+            const itemPath = `${sectionPath}.items[${itemIndex}]`;
+            assertRecord(item, itemPath);
+            assertOnlyKeys(item, ['id', 'label', 'state', 'detail', 'remediation'], itemPath);
+            assertNonEmptyString(item.id, `${itemPath}.id`);
+            if (itemIds.has(item.id))
+                throw new DashboardValidationError(`duplicate item id ${item.id}`);
+            itemIds.add(item.id);
+            assertNonEmptyString(item.label, `${itemPath}.label`);
+            assertEnum(item.state, ITEM_STATES, `${itemPath}.state`);
+            if (item.detail !== undefined)
+                assertNonEmptyString(item.detail, `${itemPath}.detail`);
+            if (item.remediation !== undefined)
+                assertNonEmptyString(item.remediation, `${itemPath}.remediation`);
+            if (ACTIONABLE_STATES.has(item.state) && item.remediation === undefined) {
+                throw new DashboardValidationError(`${itemPath}.remediation is required for actionable state`);
+            }
+            if (item.state === 'not_applicable' && item.remediation !== undefined) {
+                throw new DashboardValidationError(`${itemPath}.remediation is forbidden for not_applicable state`);
+            }
+        }
+    }
+    if (!value.project.detected && (value.sections.length !== 1 || value.sections[0].id !== 'machine')) {
+        throw new DashboardValidationError('no project snapshot may contain only the machine section');
+    }
+    if (value.project.detected && sectionIds.size !== SECTION_ORDER.length) {
+        throw new DashboardValidationError('detected project snapshot must contain the canonical lifecycle sections');
+    }
+    return value;
+}

package/dist/src/core/dashboard/write-html.js

@@ -0,0 +1,88 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveHtmlTarget = resolveHtmlTarget;
+exports.writeHtmlAtomically = writeHtmlAtomically;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const crypto_1 = require("crypto");
+function resolveHtmlTarget(input, operations = fs_1.default) {
+    if (!input || typeof input.cwd !== 'string' || input.cwd.trim() === '' || input.cwd.includes('\0') || typeof input.target !== 'string' || input.target.trim() === '' || input.target.includes('\0') || input.target.startsWith('--'))
+        throw new Error('--html requires a file target');
+    if (input.force !== undefined && typeof input.force !== 'boolean')
+        throw new Error('--force must be boolean');
+    const target = path_1.default.isAbsolute(input.target) ? path_1.default.normalize(input.target) : path_1.default.resolve(input.cwd, input.target);
+    const parent = path_1.default.dirname(target);
+    if (!operations.existsSync(parent) || !operations.statSync(parent).isDirectory())
+        throw new Error(`HTML parent directory does not exist: ${parent}`);
+    for (let current = parent;; current = path_1.default.dirname(current)) {
+        if (operations.lstatSync(current).isSymbolicLink())
+            throw new Error('HTML parent directory must not contain a symbolic link');
+        if (current === path_1.default.parse(current).root)
+            break;
+    }
+    try {
+        operations.accessSync(parent, fs_1.default.constants.W_OK);
+    }
+    catch {
+        throw new Error(`HTML parent directory is not writable: ${parent}`);
+    }
+    let stat;
+    try {
+        stat = operations.lstatSync(target);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return target;
+        throw error;
+    }
+    if (stat.isSymbolicLink() || !stat.isFile())
+        throw new Error('HTML target must be a regular file');
+    if (!input.force)
+        throw new Error(`HTML target already exists: ${target}; use --force`);
+    return target;
+}
+function writeHtmlAtomically(input, operations = fs_1.default) {
+    if (!input || typeof input.cwd !== 'string' || input.cwd.trim() === '' || input.cwd.includes('\0'))
+        throw new Error('writeHtmlAtomically requires a non-empty cwd');
+    if (typeof input.target !== 'string' || input.target.trim() === '' || !path_1.default.isAbsolute(input.target))
+        throw new Error('writeHtmlAtomically requires a non-empty absolute target');
+    if (input.target.includes('\0'))
+        throw new Error('writeHtmlAtomically target must not contain NUL');
+    if (typeof input.html !== 'string' || input.html.length === 0)
+        throw new Error('writeHtmlAtomically requires non-empty html');
+    if (input.force !== undefined && typeof input.force !== 'boolean')
+        throw new Error('writeHtmlAtomically force must be boolean');
+    if (operations.existsSync(input.target) && !input.force)
+        throw new Error(`HTML target already exists: ${input.target}; use --force`);
+    const platform = input.platform ?? process.platform;
+    if (typeof platform !== 'string' || !/^[a-z0-9]+$/i.test(platform))
+        throw new Error('writeHtmlAtomically platform must be a valid platform');
+    const temp = path_1.default.join(path_1.default.dirname(input.target), `.${path_1.default.basename(input.target)}.${process.pid}.${(0, crypto_1.randomUUID)()}.tmp`);
+    let fd;
+    let tempCreated = false;
+    try {
+        fd = platform === 'win32' ? operations.openSync(temp, 'wx') : operations.openSync(temp, 'wx', 0o600);
+        tempCreated = true;
+        operations.writeFileSync(fd, input.html, 'utf8');
+        operations.fsyncSync(fd);
+        operations.closeSync(fd);
+        fd = undefined;
+        operations.renameSync(temp, input.target);
+    }
+    catch (error) {
+        if (fd !== undefined)
+            try {
+                operations.closeSync(fd);
+            }
+            catch { /* best effort */ }
+        try {
+            if (tempCreated && operations.existsSync(temp))
+                operations.unlinkSync(temp);
+        }
+        catch { /* known temp only */ }
+        throw error;
+    }
+}

package/dist/src/core/diagnostics/context.js

@@ -297,7 +297,7 @@ function gatherProject(root, bundles, agent = 'claude-code') {
         context = { present: true, file: 'AGENTS.md' };
     return {
         root,
-        profile: { present: profilePresent, extensions: profile.extensions },
+        profile: { present: profilePresent, extensions: profile.extensions, registries: profile.registries },
         activeBundles: { expected, linked, broken },
         orphanLinks,
         sensors: { present: fs_1.default.existsSync(path_1.default.join(root, '.awm', 'sensors.json')) },

package/dist/tests/commands/doctor-is-read-only.test.js

@@ -21,6 +21,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
 describe('awm doctor no escribe nada', () => {
     let home;
     let projectRoot;
@@ -32,7 +33,8 @@ describe('awm doctor no escribe nada', () => {
         process.env.HOME = home;
         process.env.AWM_HOME = path_1.default.join(home, '.awm');
         projectRoot = path_1.default.join(home, 'proj');
-        fs_1.default.mkdirSync(path_1.default.join(projectRoot, '.git'), { recursive: true });
+        fs_1.default.mkdirSync(projectRoot, { recursive: true });
+        (0, child_process_1.execFileSync)('git', ['init', '-q', projectRoot]);
         jest.resetModules();
         writeSpy = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
     });
@@ -62,6 +64,20 @@ describe('awm doctor no escribe nada', () => {
         walk('.');
         return out.sort();
     };
+    const bytesOf = (dir) => {
+        const out = [];
+        const walk = (sub) => {
+            for (const entry of fs_1.default.readdirSync(path_1.default.join(dir, sub), { withFileTypes: true })) {
+                const rel = path_1.default.join(sub, entry.name);
+                if (entry.isDirectory())
+                    walk(rel);
+                else
+                    out.push([rel, fs_1.default.readFileSync(path_1.default.join(dir, rel)).toString('base64')]);
+            }
+        };
+        walk('.');
+        return out.sort(([left], [right]) => left.localeCompare(right));
+    };
     it('no crea AWM_HOME ni preferences.json en una máquina limpia', () => {
         const { runDoctor } = require('../../src/commands/doctor');
         const before = treeOf(home);
@@ -94,4 +110,41 @@ describe('awm doctor no escribe nada', () => {
         const emitted = writeSpy.mock.calls.map((c) => String(c[0])).join('');
         expect(JSON.parse(emitted).providers.map((p) => p.id)).toEqual(['claude-code']);
     });
+    it('collecting the dashboard leaves project, preferences, journal, ledger, and git bytes unchanged', () => {
+        fs_1.default.mkdirSync(path_1.default.join(home, '.awm', 'ledger'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(home, '.awm', 'preferences.json'), '{"defaultAgent":"claude-code","enabledAgents":["claude-code"],"installMethod":"symlink","defaultScope":"local"}\n');
+        fs_1.default.writeFileSync(path_1.default.join(home, '.awm', 'ledger', 'events.jsonl'), '{"event":"before"}\n');
+        fs_1.default.mkdirSync(path_1.default.join(projectRoot, '.awm', 'journal'), { recursive: true });
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, '.awm', 'profile.json'), '{"extensions":[]}\n');
+        fs_1.default.writeFileSync(path_1.default.join(projectRoot, '.awm', 'journal', 'state.json'), '{"state":"active"}\n');
+        const before = { home: bytesOf(home), project: bytesOf(projectRoot), git: (() => { try {
+                return (0, child_process_1.execFileSync)('git', ['status', '--porcelain=v1'], { cwd: projectRoot, encoding: 'utf8' });
+            }
+            catch (error) {
+                return String(error);
+            } })() };
+        const { collectDashboardSnapshot } = require('../../src/core/dashboard/collect');
+        collectDashboardSnapshot({ cwd: projectRoot, now: '2026-08-22T00:00:00.000Z' });
+        const after = { home: bytesOf(home), project: bytesOf(projectRoot), git: (() => { try {
+                return (0, child_process_1.execFileSync)('git', ['status', '--porcelain=v1'], { cwd: projectRoot, encoding: 'utf8' });
+            }
+            catch (error) {
+                return String(error);
+            } })() };
+        expect(after).toEqual(before);
+    });
+    it('--html replaces only its explicitly requested target', () => {
+        const target = path_1.default.join(projectRoot, 'dashboard.html');
+        fs_1.default.writeFileSync(target, 'old dashboard');
+        const before = { home: bytesOf(home), project: bytesOf(projectRoot) };
+        const { runDoctor } = require('../../src/commands/doctor');
+        const code = runDoctor({ cwd: projectRoot, html: target, force: true });
+        const after = { home: bytesOf(home), project: bytesOf(projectRoot) };
+        expect([0, 1]).toContain(code);
+        const targetFromHome = path_1.default.join('proj', 'dashboard.html');
+        expect(after.home.filter(([name]) => name !== targetFromHome)).toEqual(before.home.filter(([name]) => name !== targetFromHome));
+        expect(after.project.filter(([name]) => name !== 'dashboard.html')).toEqual(before.project.filter(([name]) => name !== 'dashboard.html'));
+        expect(fs_1.default.readFileSync(target, 'utf8')).not.toBe('old dashboard');
+        expect(after.project.map(([name]) => name).filter((name) => name.includes('.tmp'))).toEqual([]);
+    });
 });

package/dist/tests/commands/doctor.test.js

@@ -4,9 +4,169 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const doctor_1 = require("../../src/commands/doctor");
+const commander_1 = require("commander");
 const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
+const dashboard_fixtures_1 = require("../helpers/dashboard-fixtures");
+const types_1 = require("../../src/core/dashboard/types");
+const render_html_1 = require("../../src/core/dashboard/render-html");
+describe('runDoctor legacy JSON fixtures', () => {
+    it.each(['bare-home', 'project'])('keeps %s JSON byte-for-byte compatible', (kind) => {
+        const captured = (0, dashboard_fixtures_1.captureDoctorJsonFixture)(kind);
+        try {
+            const expected = fs_1.default.readFileSync(path_1.default.join(__dirname, '..', 'fixtures', 'doctor-json', `${kind}.json`), 'utf-8');
+            expect(captured.output).toBe(expected);
+            expect(captured.code).toBe(1);
+            const parsed = JSON.parse(captured.output);
+            expect(parsed).toEqual(expect.objectContaining({
+                overall: 'degraded',
+                providers: expect.any(Array),
+            }));
+            const provider = parsed.providers[0];
+            expect(provider).toEqual(expect.objectContaining({
+                id: 'copilot',
+                label: 'Copilot',
+                tier: 'agents-md-managed',
+                checks: expect.any(Array),
+            }));
+            expect(provider.checks).toEqual(expect.arrayContaining([
+                expect.objectContaining({ id: 'context.global', state: kind === 'project' ? 'stale' : 'absent' }),
+            ]));
+        }
+        finally {
+            captured.cleanup();
+        }
+    });
+});
+describe('runDoctor dashboard modes', () => {
+    it('CLI rejects --html without an argument before collection or writes', async () => {
+        const program = new commander_1.Command();
+        const stderr = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        const stdout = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        const previousExitCode = process.exitCode;
+        try {
+            (0, doctor_1.registerDoctorCommand)(program);
+            await program.parseAsync(['node', 'awm', 'doctor', '--html']);
+            expect(process.exitCode).toBe(2);
+            expect(stderr.mock.calls.map((call) => String(call[0])).join('')).toContain('--html requires a file target');
+            expect(stdout).not.toHaveBeenCalled();
+        }
+        finally {
+            process.exitCode = previousExitCode;
+            stderr.mockRestore();
+            stdout.mockRestore();
+        }
+    });
+    it.each([
+        [{ json: true, full: true }, '--json cannot be combined with --full'],
+        [{ json: true, html: 'report.html' }, '--json cannot be combined with --html'],
+        [{ full: true, html: 'report.html' }, '--full cannot be combined with --html'],
+        [{ force: true }, '--force requires --html'],
+        [{ html: '' }, '--html requires a file target'],
+    ])('rejects incompatible options before collection', (options, message) => {
+        const stderr = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        try {
+            expect((0, doctor_1.runDoctor)({ ...options, collectSnapshot: () => { throw new Error('collection must not run'); } })).toBe(2);
+            expect(stderr.mock.calls.map((call) => String(call[0])).join('')).toContain(message);
+        }
+        finally {
+            stderr.mockRestore();
+        }
+    });
+    it('writes exact dashboard bytes and only prints the final path after successful --html', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-doctor-html-success-'));
+        const target = path_1.default.join(root, 'dashboard.html');
+        const stdout = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        const snapshot = (0, types_1.dashboardSnapshot)();
+        try {
+            expect((0, doctor_1.runDoctor)({ cwd: root, html: target, collectSnapshot: () => snapshot })).toBe(0);
+            expect(fs_1.default.readFileSync(target, 'utf8')).toBe((0, render_html_1.renderDashboardHtml)(snapshot));
+            expect(stdout.mock.calls.map((call) => String(call[0]))).toEqual([`${target}\n`]);
+        }
+        finally {
+            stdout.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('maps healthy full, invalid, and failing HTML modes to 0, 2, and 2', () => {
+        const stdout = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        const stderr = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        try {
+            expect((0, doctor_1.runDoctor)({ full: true, cwd: '/definitely-not-a-project', collectSnapshot: () => (0, types_1.dashboardSnapshot)() })).toBe(0);
+            expect((0, doctor_1.runDoctor)({ html: '' })).toBe(2);
+            expect((0, doctor_1.runDoctor)({ html: '/definitely-missing-parent/report.html' })).toBe(2);
+        }
+        finally {
+            stdout.mockRestore();
+            stderr.mockRestore();
+        }
+    });
+    it.each([{ full: true }, { html: 'report.html', force: true }])('returns 1 for a degraded dashboard mode', (options) => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-doctor-degraded-'));
+        const stdout = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        try {
+            expect((0, doctor_1.runDoctor)({ ...options, cwd: root, collectSnapshot: () => (0, types_1.dashboardSnapshot)({ overall: 'degraded' }) })).toBe(1);
+        }
+        finally {
+            stdout.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('renders a real read-only machine finding and its remediation in full mode', () => {
+        const home = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-doctor-real-dashboard-'));
+        const previousHome = process.env.HOME;
+        const previousAwmHome = process.env.AWM_HOME;
+        const stdout = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        try {
+            process.env.HOME = home;
+            process.env.AWM_HOME = path_1.default.join(home, '.awm');
+            expect((0, doctor_1.runDoctor)({ full: true, cwd: home })).toBe(1);
+            const output = stdout.mock.calls.map((call) => String(call[0])).join('');
+            expect(output).toContain('machine.preferences.missing');
+            expect(output).toContain('awm init');
+            expect(fs_1.default.existsSync(path_1.default.join(home, '.awm', 'preferences.json'))).toBe(false);
+        }
+        finally {
+            stdout.mockRestore();
+            fs_1.default.rmSync(home, { recursive: true, force: true });
+            if (previousHome === undefined)
+                delete process.env.HOME;
+            else
+                process.env.HOME = previousHome;
+            if (previousAwmHome === undefined)
+                delete process.env.AWM_HOME;
+            else
+                process.env.AWM_HOME = previousAwmHome;
+        }
+    });
+    it('wires existing read-only project facts into the dashboard without inventing lifecycle observations', () => {
+        const root = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'awm-doctor-project-facts-'));
+        const stdout = jest.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        try {
+            fs_1.default.writeFileSync(path_1.default.join(root, 'package.json'), '{}');
+            expect((0, doctor_1.runDoctor)({ full: true, cwd: root })).toBe(1);
+            const output = stdout.mock.calls.map((call) => String(call[0])).join('');
+            expect(output).toContain('project.profile.missing');
+            expect(output).toContain('project.sensors.unavailable');
+            expect(output).toContain('unavailable');
+        }
+        finally {
+            stdout.mockRestore();
+            fs_1.default.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it('applies doctor agent selection validation to full dashboard mode', () => {
+        const stderr = jest.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        try {
+            expect((0, doctor_1.runDoctor)({ full: true, cwd: '/definitely-not-a-project', agent: 'not-a-real-agent' })).toBe(2);
+            expect(stderr.mock.calls.map((call) => String(call[0])).join('')).toContain('Invalid agent');
+        }
+        finally {
+            stderr.mockRestore();
+        }
+    });
+});
 function report(partial = {}) {
     return {
         results: [

package/dist/tests/core/dashboard/collect.test.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const collect_1 = require("../../../src/core/dashboard/collect");
+const sanitize_1 = require("../../../src/core/dashboard/sanitize");
+const fixedNow = '2026-08-22T00:00:00.000Z';
+describe('collectDashboardSnapshot', () => {
+    it('returns only a healthy machine section outside a project', () => {
+        const project = jest.fn();
+        const plans = jest.fn();
+        const execution = jest.fn();
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: '/definitely-not-a-project', now: fixedNow,
+            adapters: { machine: () => ({ findings: [] }), project, plans, execution },
+        });
+        expect(snapshot.project).toEqual({ detected: false, label: 'No project detected' });
+        expect(snapshot.sections.map((section) => section.id)).toEqual(['machine']);
+        expect(snapshot.overall).toBe('healthy');
+        expect(project).not.toHaveBeenCalled();
+        expect(plans).not.toHaveBeenCalled();
+        expect(execution).not.toHaveBeenCalled();
+    });
+    it('fails loudly for malformed central machine findings', () => {
+        expect(() => (0, collect_1.collectDashboardSnapshot)({ cwd: '/definitely-not-a-project', now: fixedNow, adapters: { machine: () => ({ findings: [{ id: '', label: 'Preferences', state: 'ok' }] }), project: jest.fn(), plans: jest.fn(), execution: jest.fn() } })).toThrow(/finding/i);
+    });
+    it.each([undefined, null, {}, 'healthy'])('rejects a non-array central machine findings value: %p', (findings) => {
+        expect(() => (0, collect_1.collectDashboardSnapshot)({
+            cwd: '/definitely-not-a-project', now: fixedNow,
+            adapters: { machine: () => ({ findings }), project: jest.fn(), plans: jest.fn(), execution: jest.fn() },
+        })).toThrow('Dashboard findings must be an array');
+    });
+    it('uses exact verified remediation commands and stable ordered sections', () => {
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: process.cwd(), now: fixedNow,
+            adapters: {
+                machine: () => ({ findings: [{ id: 'machine.preferences.missing', label: 'Preferences', state: 'missing' }] }),
+                project: () => ({ label: 'Demo', findings: [{ id: 'project.profile.missing', label: 'Profile', state: 'missing' }] }),
+                plans: () => Array.from({ length: 2000 }, (_, index) => ({ id: `plan.${index}`, label: `Plan ${index}`, state: 'ok' })),
+                execution: () => ({ history: Array.from({ length: 500 }, (_, index) => ({ id: `history.${index}`, label: `History ${index}`, state: 'ok' })) }),
+            },
+        });
+        expect(snapshot.sections.map((section) => section.id)).toEqual(['machine', 'project', 'planning', 'execution', 'qa', 'retro', 'history']);
+        expect(snapshot.sections.find((section) => section.id === 'machine')?.items[0].remediation).toBe('awm init');
+        expect(snapshot.sections.find((section) => section.id === 'planning')?.items).toHaveLength(2000);
+        expect(snapshot.sections.find((section) => section.id === 'history')?.items).toHaveLength(500);
+        expect(JSON.stringify(snapshot)).not.toMatch(/score|ranking/i);
+    });
+    it('isolates optional adapter failures and omits unverified remediation', () => {
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: process.cwd(), now: fixedNow,
+            adapters: {
+                machine: () => ({ findings: [{ id: 'unknown', label: 'Unknown', state: 'missing' }] }),
+                project: () => { throw new Error('corrupt project source'); },
+                plans: () => [], execution: () => undefined,
+            },
+        });
+        expect(snapshot.sections.find((section) => section.id === 'machine')?.items).toEqual([]);
+        expect(snapshot.sections.find((section) => section.id === 'project')?.availability).toBe('unavailable');
+        expect(snapshot.sections.find((section) => section.id === 'project')?.items).toEqual([]);
+    });
+    it('marks execution-derived sections unavailable when no read-only execution source exists', () => {
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: process.cwd(), now: fixedNow,
+            adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => undefined },
+        });
+        for (const id of ['execution', 'qa', 'retro', 'history']) {
+            expect(snapshot.sections.find((section) => section.id === id)?.availability).toBe('unavailable');
+        }
+    });
+    it('isolates malformed optional source data to its owning section', () => {
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: process.cwd(), now: fixedNow,
+            adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [{ id: 'bad', label: 'Profile', state: 'invented' }] }), plans: () => [], execution: () => undefined },
+        });
+        expect(snapshot.sections.find((section) => section.id === 'project')?.availability).toBe('unavailable');
+        expect(snapshot.sections.find((section) => section.id === 'machine')?.availability).toBe('available');
+    });
+    it('isolates malformed post-sanitization plan findings', () => {
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({ cwd: process.cwd(), now: fixedNow, adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [{ id: '', label: 'Profile', state: 'ok' }], execution: () => undefined } });
+        expect(snapshot.sections.find((section) => section.id === 'planning')?.availability).toBe('unavailable');
+    });
+    it('isolates malformed project findings without dropping other sections', () => {
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({ cwd: process.cwd(), now: fixedNow, adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [{ id: '', label: 'Profile', state: 'ok' }] }), plans: () => [], execution: () => undefined } });
+        expect(snapshot.sections.find((section) => section.id === 'project')?.availability).toBe('unavailable');
+        expect(snapshot.sections.find((section) => section.id === 'planning')?.availability).toBe('available');
+    });
+    it.each(['execution', 'qa', 'retro', 'history'])('isolates malformed %s findings', (key) => {
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({ cwd: process.cwd(), now: fixedNow, adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [], execution: () => ({ [key]: [{ id: '', label: 'Profile', state: 'ok' }] }) } });
+        expect(snapshot.sections.find((section) => section.id === key)?.availability).toBe('unavailable');
+    });
+    it('renders exact remediation only for a canonical optional source failure', () => {
+        const knownFailure = Object.assign(new Error('sensors unavailable'), { findingId: 'project.sensors.unavailable', remediationVerified: true });
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: process.cwd(), now: fixedNow,
+            adapters: { machine: () => ({ findings: [] }), project: () => { throw knownFailure; }, plans: () => [], execution: () => undefined },
+        });
+        expect(snapshot.sections.find((section) => section.id === 'project')?.items).toEqual([
+            expect.objectContaining({ id: 'project.sensors.unavailable', state: 'unavailable', remediation: 'awm sensors status' }),
+        ]);
+    });
+    it.each([
+        ['plans', 'planning.source.unavailable', 'planning', 'awm preflight'],
+        ['execution', 'execution.source.unavailable', 'execution', 'awm sensors status'],
+    ])('renders a known %s failure in its owner section', (adapter, findingId, sectionId, remediation) => {
+        const failure = Object.assign(new Error('unavailable'), { findingId, remediationVerified: true });
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: process.cwd(), now: fixedNow,
+            adapters: {
+                machine: () => ({ findings: [] }), project: () => ({ findings: [] }),
+                plans: () => { if (adapter === 'plans')
+                    throw failure; return []; },
+                execution: () => { if (adapter === 'execution')
+                    throw failure; return undefined; },
+            },
+        });
+        expect(snapshot.sections.find((section) => section.id === sectionId)?.items[0]).toEqual(expect.objectContaining({ id: findingId, remediation }));
+    });
+    it('sorts findings by stable canonical id', () => {
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: '/definitely-not-a-project', now: fixedNow,
+            adapters: { machine: () => ({ findings: [
+                        { id: 'machine.registries.stale', label: 'Registries', state: 'attention' },
+                        { id: 'machine.preferences.missing', label: 'Preferences', state: 'missing' },
+                    ] }), project: jest.fn(), plans: jest.fn(), execution: jest.fn() },
+        });
+        expect(snapshot.sections[0].items.map((item) => item.id)).toEqual(['machine.preferences.missing', 'machine.registries.stale']);
+    });
+    it.each(['blocked', 'active', 'executed', 'retro_pending', 'qa_pending', 'legacy_unverifiable'])('integrates lifecycle state %s into plan detail', (expected) => {
+        const lifecycle = expected === 'blocked' ? { journal: { state: 'blocked' }, markers: { qaComplete: false, retroComplete: false }, tasks: { total: 1, completed: 0 } }
+            : expected === 'active' ? { journal: { state: 'active' }, markers: { qaComplete: false, retroComplete: false }, tasks: { total: 1, completed: 0 } }
+                : expected === 'executed' ? { markers: { qaComplete: true, retroComplete: true }, tasks: { total: 1, completed: 1 } }
+                    : expected === 'retro_pending' ? { markers: { qaComplete: true, retroComplete: false }, tasks: { total: 1, completed: 1 } }
+                        : expected === 'qa_pending' ? { markers: { qaComplete: false, retroComplete: false }, tasks: { total: 1, completed: 1 } }
+                            : { markers: { qaComplete: false, retroComplete: false }, tasks: { total: 0, completed: 0 } };
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({ cwd: process.cwd(), now: fixedNow, adapters: { machine: () => ({ findings: [] }), project: () => ({ findings: [] }), plans: () => [{ id: 'plan.lifecycle', label: 'Profile', state: 'ok', lifecycle }], execution: () => undefined } });
+        expect(snapshot.sections.find((section) => section.id === 'planning')?.items[0].detail).toBe(expected);
+    });
+    it('degrades a machine-only dashboard for actionable machine findings', () => {
+        const snapshot = (0, collect_1.collectDashboardSnapshot)({
+            cwd: '/definitely-not-a-project', now: fixedNow,
+            adapters: { machine: () => ({ findings: [{ id: 'machine.preferences.missing', label: 'Preferences', state: 'missing' }] }), project: jest.fn(), plans: jest.fn(), execution: jest.fn() },
+        });
+        expect(snapshot.sections.map((section) => section.id)).toEqual(['machine']);
+        expect(snapshot.overall).toBe('degraded');
+    });
+});
+describe('sanitizeDashboardSource', () => {
+    it('removes hostile paths and secrets before rendering', () => {
+        const safe = (0, sanitize_1.sanitizeDashboardSource)({ path: '/var/lib/private', token: 'ghp_secret', username: 'alice', output: '<script>alert(1)</script>', rawOutput: 'sk-live-secret', detail: 'log:(cwd=/tmp/run/output) unc=(\\\\server\\share\\secret)(MODE=production)', label: 'alice workstation' });
+        expect(JSON.stringify(safe)).not.toMatch(/alice|ghp_|script|\/var\/|\/tmp\/|sk-live|alert|server|share|MODE=production/i);
+    });
+    it('replaces dynamic finding identifiers with opaque safe identifiers', () => {
+        const safe = (0, sanitize_1.sanitizeDashboardSource)({ findings: [
+                { id: 'alice@example.com', label: 'Preferences', state: 'missing' },
+                { id: '192.0.2.44/repository-private', label: 'Profile', state: 'missing' },
+                { id: 'machine.preferences.missing', label: 'Preferences', state: 'missing' },
+            ] });
+        const serialized = JSON.stringify(safe);
+        expect(serialized).not.toMatch(/alice@example|192\.0\.2\.44|repository-private/i);
+        expect(serialized).toContain('machine.preferences.missing');
+        expect(serialized).toMatch(/item-[a-f0-9]{16}/);
+    });
+    it('rejects invalid item states explicitly', () => {
+        expect(() => (0, sanitize_1.sanitizeDashboardSource)({ state: 'invented' })).toThrow(/state/i);
+    });
+    it('omits raw dynamic command and error details', () => {
+        const safe = (0, sanitize_1.sanitizeDashboardSource)({ findings: [{ id: 'machine.preferences.missing', label: 'Preferences', state: 'missing', detail: 'Error: ghp_secret at /tmp/private; TOKEN=value' }] });
+        expect(JSON.stringify(safe)).not.toMatch(/Error|ghp_|\/tmp|TOKEN=/i);
+        expect(JSON.stringify(safe)).not.toContain('detail');
+    });
+});
+test('exports canonical remediation commands', () => {
+    expect(collect_1.REMEDIATION_BY_FINDING_ID['machine.preferences.missing']).toBe('awm init');
+});